diff --git a/CHANGELOG.md b/CHANGELOG.md
index 68c5b475..536818e6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,7 @@
 "do not ship" with 13 findings. Each was checked by running it in a sandbox state dir; 0.14.3 fixes the ones that lose
 or expose a key and the small ones beside them, by reading the state of an identity only from records committed in one
 atomic step (see "Identity and on-disk state"). The wire is unchanged; the public surface gains `relocation.abortExport`
-and `IdentityExportPendingError`.
+(and `sym node abort-export`) and `IdentityExportPendingError`.
 
 ### What was wrong
 
@@ -52,102 +52,134 @@ and `IdentityExportPendingError`.
 
 ### Identity and on-disk state
 
-The first fix for the findings above was itself reviewed (R1, on the candidate 632b95d) and failed the same way twice
-over: it read the state of an identity from whatever was at a path (a by-id directory that was only partly there, an
-index entry that could not be read, a node directory without `identity.json`, the content of a stale lock), and each
-patch for one of those cases made another. R1 proved eleven by running them. 0.14.3 changes the assumption instead:
-**the state of an identity is a record committed in one atomic step**, and the code that inferred it is deleted
-(`moveTree`, `mergeMove`, `sameTree`, `legacyDirsRemain`, and the migration lock `nodes/.migrating`).
-
-- **The 0.13 → by-id migration copies; it never moves.** The 0.13 directory (`nodes/<name>/`, and
-  `SYM_IDENTITY_DIR/<name>/`) is copied into a staging directory beside its destination
-  (`nodes/by-id/.<nodeId>.partial-<pid>-<rand>`, on the destination's volume), links followed (a node directory kept
-  on another volume behind a link, an `identity.json` that is a relative link to a key file), `identity.json` last, every
-  file synced, the copy verified byte for byte against the source, a commit record (`.sym-commit`) written, and the
-  whole installed by ONE rename. Of several starts doing this at once, one rename wins; the others find the same
-  identity installed and discard their staging. Then the 0.13 directory is renamed aside to
-  `nodes/.legacy-0.13/<name>` (key files narrowed to 0600) and the compat link `nodes/<name>` takes its place. **Nothing
-  is ever deleted from the source.** A staging directory left by a killed process is cleared by the next attempt.
-  With no migration lock there is no wait: a multi-node process no longer blocks for up to 30 s behind another
-  process's migration. A move across volumes is no longer a special case: no rename crosses one.
-- **A by-id directory without the commit record is a husk, never "the identity is in place".** An empty one, or one
-  holding only a stale lock (what 0.14.0 - 0.14.2 left), is removed with `rmdir` (which cannot remove a directory with
-  anything in it) and the commit made; one holding files (a node of an earlier release that ran there without its
-  identity) has them merged into the staged copy, and is itself kept aside at `nodes/by-id/.<nodeId>.husk`. A file
-  that differs, or a different `identity.json`, is a second claim on the nodeId: the start halts and nothing changes.
-  A husk whose lock a live process holds refuses (`EIDENTITYLOCK`).
-- **A name is claimed by an exclusive create of its index entry, after the identity is installed** (written and synced
-  under a temp name, then hard-linked into place; an O_EXCL create where hard links are not supported). Two first starts
-  of a new name both make an identity; exactly one claims the name, and the other discards its identity and loads the
-  winner. R1 measured 2 - 3 agents for one new name in 6 of 6 rounds with three starters; now one, every round.
-- **An index entry reads as "absent" only when there is none (ENOENT).** An entry that is empty, not JSON, names another
-  name or cannot be read (EACCES, EMFILE) halts, says where the identity it named is, and says not to delete it. Index
-  writes are synced (file and directory).
-- **A new identity is made only when nothing on this host is a trace of the name**: no index entry, no `nodes/<name>`
-  (a link, or a directory with anything but a stale lock in it), no `SYM_IDENTITY_DIR/<name>`, no 0.13 directory set
-  aside, no installed identity of that name that no name indexes. A trace that provably is the name's identity (a compat
-  link to it; the one unindexed identity of that name: a start killed between installing it and claiming the name, or a
-  lost entry) is adopted: the name is claimed for it. Any other trace halts and says what it is. **Behaviour change:** a
-  `nodes/<name>/` holding files and no identity used to become a new agent's directory; it now halts (with
-  `SYM_IDENTITY_DIR`'s volume not mounted that directory is the agent's store, and the new identity took it).
-- **One path for pinned and unpinned starts.** `loadIdentity({ name, nodeId, create: false })` (mesh-channel) migrates
-  through the same staged commit and loads the pinned agent. A pin whose identity is in the 0.13 directory and could not
-  be migrated halts saying so (it used to say "No identity on this host").
-- **A start pinned to a nodeId never takes a name from another identity** (R4-9, from the mesh-channel review). It used
-  to re-point the name's index entry to the pin: a folder whose `.sym/node.json` pins X under "reviewer" took the name
-  from another folder's agent Y, whose next start by name then ran as X, and a cloned repository could choose which
-  identity on the host a session signs as. A pinned start may claim a name nobody has, and that is all; a name another
-  identity holds halts (`IdentityHaltError`) with the entry left as it is (with `create: false` and the pin not on this
-  host, `IdentityAbsentError` saying so), and a pinned start is never answered with the name's agent. **Behaviour change:**
-  to give a name to the pinned identity, rename the other agent first.
-- **A live 0.13 process in the agent's 0.13 directory refuses the start** (`EIDENTITYLOCK`, naming its pid). 632b95d
-  loaded the identity in place and a 0.14 node ran beside the 0.13 one, on an empty store. The migration holds that
-  directory's own lock while it copies, so a 0.13 process cannot start in it meanwhile; another 0.14.3 start that finds
-  the lock marked as a migration's goes on beside it.
-- **A stale lock is removed only if it is still the lock judged stale.** Removing one lock is a right of its own: a claim
-  file named after that lock's file identity and content (`lock.pid.break-<hash>`), itself a lock. Holding it, the lock
-  is read again and removed only if it is the same file (dev, ino) with the same content. R1 measured two or more
-  simultaneous holders in 4 of 8 rounds with six starters at a SIGKILLed holder's lock. A lock file is now created whole
-  (linked into place), so it is never seen without its owner.
-- **Export: bundle durable first, then the tombstone beside the key, then the scrub** (`lib/relocation.js`). An intent
-  (`EXPORTING.json`) is written beside the key first; while it is there the source refuses to start the identity
-  (`IdentityExportPendingError`, `EIDENTITYEXPORTING`). An export interrupted before its tombstone is resumable (run it
-  again) or abortable (`relocation.abortExport`, which removes the bundle it wrote); one interrupted after it is finished
-  by running it again (the scrub). The tombstone is in the identity directory, so with `SYM_IDENTITY_DIR` a rebuilt node
-  directory no longer brings a second live copy back. The scrub also removes the private key from a 0.13 copy set aside.
-- **Import** is installed through the same staged commit: directories 0700, key files 0600, and with `SYM_IDENTITY_DIR`
-  the private key only in the identity directory (it was in the node directory too).
-- `validateName` refuses names Windows cannot hold (the rule mesh-channel's `nodeNameProblem` applies: `: * ? " < > |`,
-  CON, PRN, AUX, NUL, COM0-9, LPT0-9 with any extension, a trailing dot or space). **Behaviour change** for an existing
-  agent with such a name: it must be renamed (`renameIdentity` accepts the old name). A compat link is compared with
-  its target as the path it resolves to, so a Windows junction is no longer re-made on every check.
-- Error texts: a halt says where the key is when it is on this host (for example `nodes/by-id/<id>/identity.json` after
-  `SYM_IDENTITY_DIR` was switched on), and tells the operator to remove the index entry only when no copy of the key is
-  anywhere on this host. `IdentityAbsentError` says what is on the host instead, and is never thrown when the identity is.
-- Also in 0.14.3, from the first fix: key files 0600 and their directories 0700 (narrowed on load), atomic rewrites of
-  `identity.json`, a public key without a private key halts, `SYM_IDENTITY_DIR` switched on for a 0.13 node whose
-  identity is in its node directory halts and says how to copy it.
+Two designs for the fixes above failed review before this one. 0.14.2 inferred the state of an identity from whatever
+was at a path. The first 0.14.3 candidate (9f6847c) copied a 0.13 agent into a staging directory, verified the copy and
+committed it by one rename; an independent re-review reproduced what the copy cost: a store that did not fit twice on a
+file system that cannot clone (ext4, HFS+) gave ENOSPC on every start; a 5,000-file first start took 21 s instead of
+61 ms, and 12 agents in one XMesh process blocked its constructor for 15.5 s; private-key copies were left at 0644 in
+husks, killed starters' staging and set-aside directories, outside the export's scrub; a store on a mount point was
+copied onto the state volume; a relative link was set aside dangling; and the export wrote its bundle before its
+tombstone, so an interrupted export retried to another destination left two importable bundles (two live copies of one
+key). 0.14.3 ships the design that replaces both:
+
+- **One source of truth.** An agent exists exactly when its identity is committed: `nodes/by-id/<nodeId>/identity.json`
+  (with `SYM_IDENTITY_DIR`, `SYM_IDENTITY_DIR/by-id/<nodeId>/identity.json`). The name index (`nodes/by-name/`) and the
+  0.13-compatible links (`nodes/<name>`) are caches of which agent a name is, written after the commit. An entry that
+  is missing or cannot be read is re-derived from the committed identities (their `name`), with the compat link as a
+  second witness: an entry whose content is not an entry is written again; one that could not be read for an I/O error
+  (EACCES, EMFILE) is left as it is. Neither is ever read as "no such agent". An entry that names an identity which is
+  not committed here halts (a `SYM_IDENTITY_DIR` volume not mounted). Two committed identities that are one name halt,
+  naming both; each still loads by its nodeId. An entry 0.14.0 - 0.14.2 wrote for a rename or a pinned start (it names
+  an identity under another name) keeps leading where it led, and when it is that identity's only name the identity
+  takes it, so it can be derived from then on. `renameIdentity` writes the identity's own `name` (the commit of a
+  rename), after claiming the new entry.
+- **Names are compared without regard to case on every platform** (Unicode NFC, lower case): the entry is
+  `nodes/by-name/<folded name>.json` and holds the exact name. 0.14.0 - 0.14.2's entry under the exact name is read when
+  the folded one is missing, and written beside it for a rollback. Two 0.13 agents whose names fold together (a
+  case-sensitive file system let both exist): the second halts and is left as it is.
+- **A new identity is minted only when nothing on the host holds the name**: no committed identity of that name (or
+  that its entry or link leads to), no 0.13 directory holding an identity, no identity set aside or in another start's
+  staging, and no other trace (a `nodes/<name>` holding files, an entry that cannot be read, a link to an identity not
+  in place). A mint holds the name's short mint lock (`nodes/by-id/.mint-<name>.lock`, with the atomic stale-lock
+  reclaim) from its staging to its claim: identity.json is written and synced in a staging directory, committed by one
+  rename, the compat link put in place, and the name claimed by an exclusive create (`link()`) of its entry. A start
+  killed between the commit and the claim leaves an identity the next start adopts.
+- **A 0.13 agent is MOVED, never copied.** On one volume, ONE rename of the whole directory onto
+  `nodes/by-id/<nodeId>` (with `SYM_IDENTITY_DIR`, the node directory first and the identity directory last: the
+  identity in place is the commit). Atomic, O(1), no disk: the 5,000-file first start takes 61 ms, and 12 agents in one
+  process start in 0.6 s. The compat link is made before the commit and renamed onto the 0.13 path right after it,
+  before any sync, so a 0.14.2 or 0.13 build finds neither for one system call; no 0.13 directory is moved out from under
+  a path no link can then take. A 0.13 directory that is a link, a mount point, on another volume than `nodes/by-id`,
+  or holding a relative link that leads out of it is not moved and not copied: `by-id/<nodeId>` becomes an absolute
+  link to the directory it is, and the store stays where its operator put it (a link is replaced by the compat link; a
+  mount point stays the real directory). Across volumes only an identity directory's key files (`identity.json`, the
+  0.13 `e2e-keypair.json`) are copied: staged beside their destination, synced, read back and compared, committed by
+  one rename, after a free-space check that halts with the bytes needed (the source untouched); the source is then set
+  aside.
+- **A husk** (a `by-id/<nodeId>` directory an earlier release made without the identity: a lock, a node that ran there
+  beside a live 0.13 process) is set aside whole to `by-id/.<nodeId>.husk-<time>-<rand>` under the nodeId's short
+  migration lock, and the node moved in. Files in it that are the same as the node's are removed from the aside; the
+  ones that differ are kept there and reported (a process warning, `SYM_HUSK_SET_ASIDE`). An empty husk, or one holding
+  only a stale lock or the claim of a killed lock remover, is replaced. A live process in a husk refuses
+  (`EIDENTITYLOCK`). The same identity committed and in use beside a second 0.13 copy: the copy is set aside to
+  `nodes/.legacy-0.13/<name>` and the link takes its place.
+- **Concurrency without a long lock.** Starters racing the same rename: one wins, the others find the identity in
+  place. The stale-lock reclaim of the first candidate is kept (a claim file named after the judged lock's dev, ino
+  and content; lock files created whole by `link()`).
+- **No private key is left loose.** Committed identity and node directories are 0700 and key files 0600, narrowed on
+  every load (directories 0.14.0 - 0.14.2 migrated were left 0755); what is set aside is narrowed at once and again on
+  every load. Every load clears what dead processes left: staging directories (one may hold a never-used key), temp
+  links, temp index entries, temp lock files in the node directory. With `SYM_IDENTITY_DIR`, a copy of the key left in
+  the node directory (0.13 operators copied it there; 0.14.0 - 0.14.2 moved it along with the store) that is the very
+  identity committed is removed: the key is where it is kept.
+- **One path for pinned and unpinned starts.** A pinned start (`{ name, nodeId, create: false }`) goes through the same
+  migration. It never takes a name another agent holds: a committed identity, an index entry, or a 0.13 agent not yet
+  migrated (it halts, and leaves that 0.13 directory where it is: its own start migrates it). It may claim a name
+  nobody holds. The refusals kept from the first candidate: names Windows cannot hold, a live 0.13 process in the
+  agent's 0.13 directory (`EIDENTITYLOCK`), halts instead of mints, and error texts that never tell an operator to
+  remove something that holds a key.
+- **Export stops the source before any bundle can exist** (`lib/relocation.js`): an intent beside the key
+  (`EXPORTING.json`: out, recipient), then the tombstone beside the key and a copy in the node directory (where 0.14.2
+  reads it), then the bundle's sha256 written into the intent, the bundle (fsynced, renamed into place), `complete`
+  written into the intent, then the scrub: every copy of the key on the host (a stray one, one set aside, a husk aside,
+  the 0.13 E2E keypair) loses its private key, and the compat links go. A start after a crash before a complete
+  bundle is refused (`EIDENTITYEXPORTING`, saying how to finish or abandon it); after a complete bundle, refused as
+  moved (`EIDENTITYTOMBSTONED`). The same export run again (the same out, the same recipient) finishes it; another out
+  is refused while a complete bundle may exist at the intent's out, and once the bundle is complete a run again only
+  finishes the scrub. `abortExport` reverts the tombstone only while no complete bundle was produced (the recorded hash
+  tells), and is on the CLI: `sym node abort-export <name>` (or `--node-id <id>`).
+- **Import** installs the identity first (it is the commit), then the node directory, each staged (directories 0700,
+  key files 0600, the private key only in the identity directory) and carrying the import's record of which bundle it
+  came from. An import killed between its installs is finished by running it again: "already here" is decided from the
+  committed identity and that record, never from a directory that merely exists.
+- A node started and stopped in one process (`SymNode`) checks again, once it holds the identity lock (the lock an
+  export takes), that the identity was not exported or is not being exported meanwhile.
+- **Rollback to 0.14.2** after a 0.14.3 start reads every agent: the compat link, the `by-name` file format and the
+  `by-id` directory (a `by-id/<nodeId>` that is a link included). What 0.14.2 cannot read: an agent linked to (a mount
+  point, another volume) whose name is in mixed case, on a case-sensitive file system, with both its exact-name entry
+  and its compat link gone. 0.14.2 ignores `EXPORTING.json`; the tombstone copy in the node directory, written before
+  any bundle, is what stops it.
+
+**Upgrade notes.**
+
+- **Upgrade every embedder on a host (sym CLI and daemon, mesh-channel, XMesh) before the first start.** A 0.14.2
+  process that starts a 0.13 agent while another process migrates it can make a second identity: 0.14.2's own race,
+  which 0.14.2 starters alone hit in 9 of 20 rounds of six, and mixed with 0.14.3 starters in 12 of 20 (0.14.3 alone: 0
+  of 20). The original key is kept, and the next 0.14.3 start halts naming both identities. A 0.14.2 build started on a
+  host that still holds a 0.14.0 - 0.14.2 husk still destroys that agent's key (its own bug, fixed by this release):
+  start the agent with 0.14.3 first.
+- **Behaviour changes:** names are one name whatever their case (on Linux "Kappa" and "kappa" were two agents in
+  0.14.2); an index entry that cannot be read loads the agent its committed identity names instead of halting; a husk
+  whose files differ from the node's no longer halts (it is set aside and reported); a 0.13 directory behind a link, on
+  a mount point or on another volume stays where it is and `by-id/<nodeId>` links to it (no copy); with
+  `SYM_IDENTITY_DIR` a copy of the key in the node directory is removed; `renameIdentity` rewrites the identity's `name`;
+  a pinned start under a name an unmigrated 0.13 agent holds halts; an export cannot be abandoned once its bundle is
+  complete; `migrateIdentities()` also counts `errors`; a state root needs a file system that holds symbolic links (a
+  0.13 directory is not migrated where no link can take its path).
 
 ### Known, not fixed here
 
-- `migrateIdentities()` still counts and discards any error from a single node; the node's own start raises them.
+- `migrateIdentities()` counts an error of a single node (`errors`) and goes on; that node's own start raises it.
 - `loadIdentity({ nodeId, name, create: true })` with a nodeId this host does not hold and no trace of the name still
   makes a new identity under a new nodeId. mesh-channel passes `create: false`.
-- `SYM_IDENTITY_DIR` switched on for an existing node does not copy its key for you (it halts and says how).
-- The 0.13 directory set aside (`nodes/.legacy-0.13/<name>`) and a husk kept aside are never removed by sym: they hold a
-  second copy of the store (and of the key, 0600, until an export scrubs it). Remove them once the agent runs on 0.14.3.
-  On APFS and reflink file systems the copy is a clone; elsewhere it takes the store's size again on disk.
-- A process killed in the two renames between setting the 0.13 directory aside and putting the compat link in its
-  place leaves `nodes/<name>` absent; the next 0.14.3 start puts the link back, but a 0.13 build started first in that
-  state would make a new identity. A crash anywhere else leaves the 0.13 directory, or the link to the installed copy,
-  where a 0.13 build reads it.
-- A husk with files that was claimed by one start can, in a race with another start that never saw it, end up kept at
-  `.<nodeId>.husk` without being merged (nothing is lost; the node runs without those files). It needs a 0.14.0 - 0.14.2
-  node that ran in that directory beside a live 0.13 process, and two concurrent first starts.
-- A claim file left by a process killed while removing a stale lock is itself removed the same way, up to three levels;
-  below that the start refuses (`EIDENTITYLOCK`) rather than guess. A 0.13 process still reclaims a stale lock the old,
-  non-atomic way: a 0.13 and a 0.14 process racing at one dead holder's lock are not covered.
-- `relocation.abortExport` is not on the `sym` CLI yet; `sym node export` run again resumes an interrupted export.
+- `SYM_IDENTITY_DIR` switched on for an existing 0.13 node whose identity is in its node directory halts and says how
+  to copy it; it does not copy the key for you.
+- What is set aside is never removed by sym: a husk's files that differ from the agent's, a second 0.13 copy of an
+  agent already installed, the 0.13 source of an identity copied across volumes. They are narrowed to their owner and
+  scrubbed by an export; remove them once the agent runs on 0.14.3.
+- One system call is left between the commit (the rename that installs the agent) and the compat link that takes its
+  0.13 path. A process killed exactly there and followed by a 0.14.2 or a 0.13 start (a rollback) instead of a 0.14.3
+  one: that build makes a second identity under the name. The original key is untouched, and the next 0.14.3 start
+  halts naming both. The kill -9 fuzz below hits this one point and no other.
+- 0.14.2 processes on the same host (mixed versions, see the upgrade notes) can still make a second identity in their
+  own race, and 0.14.2's stale-lock reclaim is not atomic: a 0.14.2 and a 0.14.3 process racing at one dead holder's
+  lock can both hold it (1 of 6 rounds with three of each). A 0.13 process racing a 0.14 one at a dead holder's lock is
+  not covered either.
+- An export killed between renaming its bundle into place and recording `complete`, whose bundle was then moved away
+  from its out before the export was run again: the intent's hash can no longer tell that a complete bundle was
+  produced, and running the export again writes a second one.
+- A claim file left by a process killed while removing a stale lock is itself removed the same way, up to three
+  levels; below that the start refuses (`EIDENTITYLOCK`) rather than guess.
 
 ### Security
 
@@ -221,37 +253,49 @@ An independent security review (R2) of the 0.14 core reproduced each finding bel
 
 ### Tests
 
-- `tests/identity-commit.test.js` (new): 33 tests, one or more per R1 finding (R1-1 to R1-11), R4-9, the error texts
-  and the guards of the staged commit; 32 fail on 632b95d (the one that passes there checks that a pinned start still
-  claims a name nobody has). R1-1 crashes the migration at every one of its 70 steps (78 over a lock-only husk), one
-  start per step, and checks the 0.13 directory is byte-identical, a 0.13 reader still finds the key, and the next start
-  loads the same agent with its whole store. The race the multi-process fuzz found (below) is a deterministic test.
-- `tests/identity-migration-by-id.test.js`: 53 tests (was 51), 14 of them fail on 632b95d. Updated, each with the reason in
-  the test: a husk's stale lock is no longer kept; a halt writes no index back; a non-compat link at `nodes/<name>` is
-  followed and copied; a node directory with files and no identity halts; the atomic rewrite is tested on an installed
-  identity; across volumes nothing is renamed and the source is kept aside; an interrupted migration leaves the 0.13
-  directory as it was; the migration-lock tests are replaced by no-wait tests; a live 0.13 holder refuses; a pin whose
-  identity is in the 0.13 directory halts instead of "absent".
-- Mutation check: 27 mutants of `lib/config.js` and `lib/relocation.js`, one per guard of the new design (the verify
-  before the commit, the exclusive claim, ENOENT-only, the mint gate, the adoption guard, the live 0.13 holder, the
-  claim and the compare in the lock reclaim, the export order, the tombstone place, the import key place, junction
-  compare, the Windows names, the set-aside, the link-before-aside, a pinned start taking a name, the husk re-look, and
-  others): every one is caught.
-- Multi-process fuzz (real processes, every file call stalled 0 - 4 ms at random): four starters at a 0.13 agent,
-  plain / over a lock-only husk / pinned / pinned over a husk / with SYM_IDENTITY_DIR / with both: 40 rounds each, 0
-  failed (960 starters, all loaded the original; one identity, the key installed, the whole store, the 0.13 data kept,
-  every round); six starters, 30 rounds each plain and over a husk, 0 failed. This fuzz found one race in the first
-  version of this design (a committed directory set aside as a husk, 9 of 40 rounds over a husk; same identity, nothing
-  lost), fixed before release. Six starters at a SIGKILLed holder's stale lock: 0 of 20 rounds with two holders, with
-  and without stalls (632b95d: 3 of 8). Three first starts of one new name: 0 of 10 rounds with two agents, 0 of 6 with
-  SymNode (632b95d: 6 of 6). Across a real second volume (an HFS+ disk image, EXDEV) with a stale migration lock:
-  4 and 6 starters, 50 rounds, every starter the original.
-- kill -9 crash fuzz: the first start is killed at a random moment, a second start follows. Same volume (over a husk,
-  plain, with SYM_IDENTITY_DIR; pinned and not): 360 rounds, 180 of them killed within 60 ms (all mid-run), every one
-  the original agent with its whole store and the key on disk. Across volumes (disk image): 120 rounds, 60 killed
-  mid-run, every one the same (632b95d on the same image: 4 of 10 rounds started with store files missing).
-- Full suite (`--test-concurrency=2`, macOS): 1568 tests, 1564 pass, 0 fail, 4 skipped; `npm run gate:stock-nodes` passed;
-  `npm audit`: 0 vulnerabilities. CI (Linux, Node 20 and 22) green, the real second-filesystem test included.
+- `tests/identity-v2.test.js` (new): 36 tests, each a scenario of the re-review of the copy design (rr-e1 - rr-e25) or
+  of R1 that fails on 9f6847c or on 0.14.2, and one per guard of design v2. On this Mac 29 fail on 9f6847c and 32 on
+  0.14.2; the two that pass on both here test a case-sensitive file system (Linux: they fail there on both).
+- `tests/identity-commit.test.js` (34) and `tests/identity-migration-by-id.test.js` (53): the expectations the copy
+  design wrote are changed to design v2, each with its reason in the test (moved, not copied; linked to, not copied;
+  the index a cache, re-derived; the tombstone before the bundle; a husk set aside, not a halt). The 17 changed tests
+  fail on 9f6847c; every other test passes on both.
+- Mutation check: 42 mutants of `lib/config.js`, `lib/relocation.js` and `lib/node.js`, one per guard (the fold, an
+  entry of another name, an entry naming an absent identity, the two-agents halt, the re-derivation and what blocks it,
+  the traces that block a mint, the mint lock, the live 0.13 holder, a pin and another agent's 0.13 directory, the
+  tombstone, the index held by another, the case collision, another identity under the nodeId, a live husk, a committed
+  directory never set aside, mount point and volume, the relative link outward, the free-space check, the read-back,
+  no move without a link, the link before the syncs, export pending and moved, the bundle hash, the tombstone before
+  the bundle, the out and the recipient of a resume, the abort refusal, the scrub of every copy, the SymNode re-check,
+  the import resume and order, the stray key, the lock temps, the staging, the asides, the directory modes, the alias
+  name, a dead remover's claim): every one is caught.
+- kill -9 at every step (`scripts/identity-fuzz/kill.js`: SIGKILL before and after each mutating file call of one
+  operation, then the next start, a pinned start, a 0.14.2 and a 0.13 rollback, and this release then 0.14.2): 492
+  crash points (489 reached) over a plain 0.13 agent, pinned, a husk with a stale lock, a husk with files, SYM_IDENTITY_DIR, nodes/by-id
+  and SYM_IDENTITY_DIR/by-id on another volume (an HFS+ disk image), and a mint with and without SYM_IDENTITY_DIR. The
+  next 0.14.3 start loaded the same agent with its whole store and every key file 0600 at every one. A 0.14.2 or 0.13
+  rollback made a second identity only at the one point between the commit and the compat link (see "Known, not fixed
+  here"), and where 0.14.2's own bugs act on a state 0.14.3 has not changed yet (a husk; a move across volumes, EXDEV).
+  Export (130 points with SYM_IDENTITY_DIR, 102 without) and import (132 and 104): never a startable source beside a
+  complete bundle; abort where allowed, otherwise the same export finished, the key gone from the source and the agent
+  imported on another host; an interrupted import finished by running it again. In one early run 2 of 130 export points
+  reported one file still holding the key after the resume; not reproduced in four further runs (516 points) nor in 96
+  repeats at those steps.
+- Real processes starting one agent at once (`scripts/identity-fuzz/race.js` and the re-review's scripts): six
+  starters over a 0.13 agent (plain, pinned and not, over a husk, a husk with files, with SYM_IDENTITY_DIR) and over a
+  new name, 5 rounds of each kind from each script; five starters with 60 % of them SIGKILLed at a random moment, 20 + 5
+  rounds: every round one agent, the original, with its whole store. Six starters at a SIGKILLed holder's lock: one
+  holder in 6 of 6 rounds. Mixed with 0.14.2 starters: see the upgrade notes.
+- Rollback: a host 0.14.2 ran (agents it migrated, made, renamed, re-pointed for a pin, a mixed-case name,
+  SYM_IDENTITY_DIR agents) started twice by 0.14.3 and rolled back to 0.14.2: every agent loaded by name and pinned as
+  what 0.14.2 ran, in every phase. Rehearsal: an APFS clone of a sandboxed 15-agent 0.13 + 0.14.2 host (stores written by
+  the releases' own code, two agents behind links, a husk, a rename, a pinned start under a second name), upgraded:
+  every agent unchanged (by name, pinned, as a SymNode) through two 0.14.3 starts and a rollback to 0.14.2.
+- First start, measured: a 5,000-file 0.13 agent 21.4 s on 9f6847c, 61 ms here; 12 0.13 agents (300 files each) in one
+  process 15.5 s, 0.6 s. A 26 MB store on a 48 MB HFS+ image: 9f6847c ENOSPC on every start, here 8 KB used. A store
+  behind a link on another volume: 9f6847c copied 5 MB onto the state volume, here 4 KB.
+- Full suite (`--test-concurrency=2`, macOS): 1688 tests, 1684 pass, 0 fail, 4 skipped; integration 6 of 6;
+  `node scripts/gate-two-stock-nodes.mjs` passed; `npm audit`: 0 vulnerabilities.
 
 ### Transport and node lifecycle
 
diff --git a/bin/sym.js b/bin/sym.js
index 03bff582..6a761403 100755
--- a/bin/sym.js
+++ b/bin/sym.js
@@ -34,6 +34,7 @@ const { logSafe } = require('../lib/wire-identity'); // peer-chosen text on the
  *   sym keys <name> resolve <nodeId> <key>    # Operator: bind nodeId to key (pinned), clearing its conflicts
  *   sym keys <name> reset-floor <nodeId>      # Operator: let a Legacy Import route be used again
  *   sym node export <name> --out <file> (--to-host <x25519 pub> | --passphrase-env VAR --allow-copies)
+ *   sym node abort-export (<name> | --node-id <id>)   abandon an export that produced no complete bundle
  *   sym node import <file> --expect-node <id> [--expect-key <k> | --expect-fingerprint sha256:…] [--passphrase-env VAR]
  *   sym node host-key                 # This host's X25519 key for receiving node bundles
  *   sym logs                          # Tail daemon logs
@@ -176,7 +177,17 @@ function cmdNode() {
       // Sealed to the target host by default; a passphrase bundle opens on any host with the passphrase,
       // so it is a copy, and needs --allow-copies (final re-review, Finding 7b).
       const r = relocation.exportNode({ name: args[2], out: flagValue('--out'), passphrase: passphrase(), toHostKey: flagValue('--to-host') || undefined, copyable: args.includes('--allow-copies') });
-      console.log(`exported ${r.name} (${r.nodeId}, ${r.fingerprint}) to ${r.out}: ${r.files} file(s). It is tombstoned here and will not start on this host again.${flagValue('--to-host') ? '' : ' The bundle is a passphrase bundle: any host with the passphrase can import it.'}`);
+      console.log(r.resumed
+        ? `finished the export of ${r.name} (${r.nodeId}) to ${r.out}: its bundle was complete; the key is removed from this host.`
+        : `exported ${r.name} (${r.nodeId}, ${r.fingerprint}) to ${r.out}: ${r.files} file(s). It is tombstoned here and will not start on this host again.${flagValue('--to-host') ? '' : ' The bundle is a passphrase bundle: any host with the passphrase can import it.'}`);
+      return;
+    }
+    if (sub === 'abort-export') {
+      // Abandon an export that began and produced no complete bundle: the tombstone goes and the node starts here again.
+      const r = relocation.abortExport({ name: args[2] && !args[2].startsWith('--') ? args[2] : undefined, nodeId: flagValue('--node-id') || undefined });
+      console.log(r.aborted
+        ? `the export of ${r.nodeId}${r.bundle ? ` to ${r.bundle}` : ''} is abandoned: no complete bundle was produced, and the node starts on this host again${r.partialRemoved ? ` (${r.partialRemoved} half-written bundle file(s) removed)` : ''}.`
+        : `no export of ${r.nodeId} is under way; nothing was changed.`);
       return;
     }
     if (sub === 'import') {
@@ -189,7 +200,7 @@ function cmdNode() {
     console.error(err.message);
     process.exit(1);
   }
-  console.error('usage: sym node (export <name> --out <file> (--to-host <pub> | --passphrase-env VAR --allow-copies) | import <file> --expect-node <id> (--expect-key <k> | --expect-fingerprint sha256:…) [--passphrase-env VAR] | host-key)');
+  console.error('usage: sym node (export <name> --out <file> (--to-host <pub> | --passphrase-env VAR --allow-copies) | abort-export (<name> | --node-id <id>) | import <file> --expect-node <id> (--expect-key <k> | --expect-fingerprint sha256:…) [--passphrase-env VAR] | host-key)');
   process.exit(1);
 }
 
diff --git a/lib/config.js b/lib/config.js
index f65c57c2..6b6fe8f5 100644
--- a/lib/config.js
+++ b/lib/config.js
@@ -4,7 +4,7 @@
  * Configuration helpers for SYM mesh nodes.
  *
  * Manages identity persistence, node directories, and logging.
- * Node data lives under ~/.sym/nodes/<name>/.
+ * Node data lives under ~/.sym/nodes/by-id/<nodeId>/ (0.14; 0.13 kept it at ~/.sym/nodes/<name>/).
  *
  * See MMP v0.2.0 Section 3 (Identity), Section 18 (Configuration).
  *
@@ -141,9 +141,9 @@ function normalizeMdnsHostname(h) {
 }
 
 /**
- * Get the data directory for a named node. A name is an index (design D9): when the name index holds
- * it, this is the node's by-id directory (`nodes/by-id/<nodeId>`); otherwise the 0.13 path
- * `nodes/<name>`, which `loadIdentity` copies to the by-id layout when it first loads it.
+ * Get the data directory for a named node. A name is an index (design D9): when the name is an agent on
+ * this host, this is the node's by-id directory (`nodes/by-id/<nodeId>`); otherwise the 0.13 path
+ * `nodes/<name>`, which `loadIdentity` moves to the by-id layout when it first loads it.
  * @param {string} name — node name
  * @returns {string} path to the node's directory
  */
@@ -262,10 +262,11 @@ class IdentityAbsentError extends Error {
  * source refuses to start it, so no second live copy can exist.
  */
 class IdentityTombstonedError extends Error {
-  constructor(nodeId, tomb) {
+  constructor(nodeId, tomb, intent) {
     super(`[SYM] REFUSING TO START ${nodeId}: this identity was exported to another host` +
       `${tomb && tomb.movedAt ? ` on ${new Date(tomb.movedAt).toISOString()}` : ''} and is tombstoned here. ` +
-      `It runs where it was imported; two live copies would be two agents claiming one key.`);
+      `It runs where it was imported; two live copies would be two agents claiming one key.` +
+      (intent ? ' The export did not finish removing the key from this host: run the same `sym node export` again to finish it.' : ''));
     this.name = 'IdentityTombstonedError';
     this.code = 'EIDENTITYTOMBSTONED';
     this.tombstone = tomb || null;
@@ -273,16 +274,22 @@ class IdentityTombstonedError extends Error {
 }
 
 /**
- * Raised for an identity whose export began and did not finish (relocation.js wrote EXPORTING.json beside
- * the key, and no tombstone yet): a bundle may exist, so the source does not start it until the export is
- * finished (run it again) or abandoned (`abortExport`, which removes the bundle it wrote).
+ * Raised for an identity whose export began and did not finish (relocation.js wrote EXPORTING.json beside the key):
+ * the source stopped using the key when the export began, so it is not started until the export is finished (run the
+ * same export again: same out, same recipient) or, while no complete bundle was produced, abandoned (abortExport).
  */
 class IdentityExportPendingError extends Error {
-  constructor(nodeId, intent) {
+  constructor(nodeId, intent, tomb) {
+    const i = intent || {};
+    const complete = i.complete === true;
     super(`[SYM] REFUSING TO START ${nodeId}: an export of this identity` +
-      `${intent && intent.out ? ` to ${intent.out}` : ''}${intent && intent.startedAt ? `, begun ${new Date(intent.startedAt).toISOString()},` : ''} did not finish. ` +
-      'A bundle of it may exist; started here as well, there could be two live copies. Finish the export (run `sym node export` ' +
-      'again) or abandon it (relocation.abortExport({ nodeId }), which removes the bundle it wrote; delete any copy made of that file).');
+      `${i.out ? ` to ${i.out}` : ''}${i.startedAt ? `, begun ${new Date(i.startedAt).toISOString()},` : ''} did not finish. ` +
+      (complete
+        ? 'Its bundle is complete: the agent now lives in that bundle. Import it where it goes, and run the same `sym node export` here ' +
+          'again to finish removing the key from this host.'
+        : `This host stopped using the key when the export began${tomb ? '' : ' (an export of an earlier release: a bundle may exist)'}, so it does not start it here meanwhile. ` +
+          'Finish the export (run the same `sym node export` again: the same --out and the same recipient), or abandon it ' +
+          '(`sym node abort-export <name>`, refused once a complete bundle was produced), and the agent starts here again.'));
     this.name = 'IdentityExportPendingError';
     this.code = 'EIDENTITYEXPORTING';
     this.intent = intent || null;
@@ -304,18 +311,12 @@ function identityDirById(nodeId) {
 
 const isNodeIdText = (id) => typeof id === 'string' && /^[0-9A-Za-z][0-9A-Za-z_.-]{0,127}$/.test(id) && id !== '.' && id !== '..';
 const TOMBSTONE = 'TOMBSTONE.json';
-/** Beside the key while an export is under way (relocation.js): the bundle may exist, the tombstone does not yet. */
+/** Beside the key while an export is under way (relocation.js): its out, its recipient, and the bundle's hash once known. */
 const EXPORTING = 'EXPORTING.json';
-/**
- * The commit record of a directory this release installed: written into the staging directory before the
- * one rename that puts it in place, so a directory that carries it is complete. A by-id directory without
- * it was made by something else (a lock, an earlier release's interrupted move) and is never taken for
- * "the identity is in place" by a migration.
- */
+/** The record an import writes into the node directory it installs (relocation.js): which bundle it came from. */
 const COMMIT_MARK = '.sym-commit';
-/** Where a migrated 0.13 directory is set aside, under the root it was in. Nothing deletes it automatically. */
+/** Where a 0.13 directory that is a second copy of an installed agent is set aside, under the root it was in. Never deleted by sym. */
 const LEGACY_ASIDE = '.legacy-0.13';
-const nameIndexPath = (name) => path.join(NODES_DIR, 'by-name', `${encodeURIComponent(name)}.json`);
 const lstatOrNull = (p) => { try { return fs.lstatSync(p); } catch { return null; } };
 const statOrNull = (p) => { try { return fs.statSync(p); } catch { return null; } };
 const randomTag = () => crypto.randomBytes(4).toString('hex');
@@ -323,6 +324,7 @@ const randomTag = () => crypto.randomBytes(4).toString('hex');
 const RENAME_TAKEN = new Set(['EEXIST', 'ENOTEMPTY', 'EPERM', 'EISDIR', 'ENOTDIR']);
 /** A short synchronous pause, for the few places that let another start finish a step of a few system calls. */
 const pause = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+const linkType = () => (process.platform === 'win32' ? 'junction' : 'dir');
 
 // ── Durable files ────────────────────────────────────────────────────────
 
@@ -332,12 +334,6 @@ function fsyncDir(dir) {
   try { fd = fs.openSync(dir, 'r'); fs.fsyncSync(fd); } catch { /* not supported here */ } finally { if (fd !== undefined) try { fs.closeSync(fd); } catch { /* */ } }
 }
 
-/** fsync a file by path. Best effort: a file this process may not open for writing is still read back by the verify. */
-function fsyncFile(file) {
-  let fd;
-  try { fd = fs.openSync(file, 'r+'); fs.fsyncSync(fd); } catch { /* not ours to open for writing */ } finally { if (fd !== undefined) try { fs.closeSync(fd); } catch { /* */ } }
-}
-
 /** Write `text` to a new file `file` (it must not exist), synced. A failure removes what it made (it made it: O_EXCL). */
 function writeNewFileSynced(file, text, mode) {
   const fd = fs.openSync(file, 'wx', mode);
@@ -387,87 +383,84 @@ function createFileExclusive(file, text, mode = 0o644) {
   }
 }
 
-// ── The name index (the record of which node a name is) ──────────────────
-
-/**
- * The nodeId the name index holds for `name`; null ONLY when there is no entry (ENOENT). An entry that
- * exists and cannot be read, or does not hold a nodeId, is the record of an agent that cannot be read: it
- * halts (IdentityHaltError), and is never taken for "no such agent" (a start that took it so made a new
- * identity while the original was on disk).
- * @param {string} name
- * @returns {string|null}
- */
-function nodeIdForName(name) {
-  const file = nameIndexPath(name);
-  let raw;
+/** Write a file the way a key file must be written: a private temp file, synced, renamed over the target. */
+function writeFileAtomic0600(file, text) {
+  const tmp = `${file}.${process.pid}.tmp`;
+  let fd;
   try {
-    raw = fs.readFileSync(file, 'utf8');
+    fd = fs.openSync(tmp, 'w', 0o600);
+    fs.writeSync(fd, text);
+    fs.fsyncSync(fd);
+    fs.closeSync(fd);
+    fd = undefined;
+    fs.renameSync(tmp, file);
+    fsyncDir(path.dirname(file));
   } catch (e) {
-    if (e.code === 'ENOENT') return null;
-    throw unreadableIndex(name, file, `it could not be read (${e.code || e.message})`);
-  }
-  let r = null;
-  try { r = JSON.parse(raw); } catch { /* below */ }
-  if (!r || typeof r !== 'object' || !isNodeIdText(r.nodeId) || (r.name !== undefined && r.name !== name)) {
-    throw unreadableIndex(name, file, raw.length ? 'it does not hold {"name", "nodeId"} for this name' : 'it is empty');
-  }
-  return r.nodeId;
-}
-
-function unreadableIndex(name, file, why) {
-  const onDisk = identitiesOnDisk().filter((i) => i.name === name).map((i) => `${i.nodeId} (${i.file})`);
-  const link = compatLinkNodeId(path.join(NODES_DIR, name));
-  return new IdentityHaltError(name, file,
-    `the name index entry for "${name}" exists, but ${why}. It is the record of which node this name is, so it is not read as "no such agent". ` +
-    (onDisk.length || link
-      ? `The identity it named is still on this host: ${[...onDisk, link && `nodes/${name} leads to by-id/${link}`].filter(Boolean).join('; ')}. `
-      : '') +
-    'Nothing was changed.',
-    `Restore the entry: ${file} holds {"name": ${JSON.stringify(name)}, "nodeId": "<the agent's nodeId>"}. Do not delete it to "start over": ` +
-    'the key it leads to is this agent.');
-}
-
-/** Wait (briefly) for the entry another process is creating in place, where hard links are not supported. */
-function nodeIdForNameSettled(name) {
-  for (let i = 0; ; i++) {
-    try { return nodeIdForName(name); } catch (e) {
-      const st = statOrNull(nameIndexPath(name));
-      if (i >= 40 || !st || st.size !== 0 || Date.now() - st.mtimeMs > 2000) throw e;
-      pause(5);
-    }
+    if (fd !== undefined) try { fs.closeSync(fd); } catch { /* */ }
+    try { fs.unlinkSync(tmp); } catch { /* */ }
+    throw e;
   }
 }
 
+/** A JSON file's state: absent (ENOENT), unreadable (exists, cannot be read or parsed), or ok with its value. */
+function readJsonState(file) {
+  let raw;
+  try { raw = fs.readFileSync(file, 'utf8'); } catch (e) {
+    if (e.code === 'ENOENT' || e.code === 'ENOTDIR') return { state: 'absent', file };
+    return { state: 'unreadable', file, why: `it could not be read (${e.code || e.message})`, io: true };
+  }
+  try {
+    const j = JSON.parse(raw);
+    if (j && typeof j === 'object') return { state: 'ok', file, j };
+  } catch { /* below */ }
+  return { state: 'unreadable', file, why: raw.length ? 'it is not valid JSON' : 'it is empty' };
+}
+
+// ── Names ────────────────────────────────────────────────────────────────
+
 /**
- * Claim `name` for `nodeId` by an exclusive create of its index entry. Of several first starts of one name,
- * exactly one makes the entry; the rest find it made. Returns the nodeId the entry holds afterwards: `nodeId`
- * when this call claimed the name (or it already named it), the winner's otherwise.
+ * The one spelling of a name that every comparison uses: Unicode NFC, lower case. A name is compared this way on
+ * every platform, so two agents whose names differ only in case (or in how an accent is encoded) are one name: a
+ * case-insensitive file system (macOS, Windows) cannot hold their two 0.13 directories, and a host that could
+ * (Linux) must not run two agents that one move to a Mac would merge.
  */
-function claimName(name, nodeId) {
-  ensureDir(path.join(NODES_DIR, 'by-name'));
-  for (let i = 0; i < 5; i++) {
-    if (createFileExclusive(nameIndexPath(name), JSON.stringify({ name, nodeId, at: Date.now() }))) return nodeId;
-    const held = nodeIdForNameSettled(name);
-    if (held) return held;
+function foldName(name) { return String(name).normalize('NFC').toLowerCase(); }
+
+/** The name index entry of `name`: `nodes/by-name/<folded name>.json`, holding { name: <exact name>, nodeId }. */
+const nameIndexPath = (name) => path.join(NODES_DIR, 'by-name', `${encodeURIComponent(foldName(name))}.json`);
+/** Where 0.14.0 - 0.14.2 kept it (the exact name): read when the folded entry is missing, written beside it for a rollback. */
+const exactIndexPath = (name) => path.join(NODES_DIR, 'by-name', `${encodeURIComponent(name)}.json`);
+const sameFile = (a, b) => { const x = statOrNull(a); const y = statOrNull(b); return Boolean(x && y && x.dev === y.dev && x.ino === y.ino); };
+
+/** One index entry file, read for the folded name `f`: missing, unreadable (with why), or ok with its nodeId. */
+function readEntryFile(file, f) {
+  const r = readJsonState(file);
+  if (r.state === 'absent') return { state: 'missing', file };
+  if (r.state === 'unreadable') return { state: 'unreadable', file, why: r.why, io: Boolean(r.io) };
+  if (!isNodeIdText(r.j.nodeId)) return { state: 'unreadable', file, why: 'it does not hold {"name", "nodeId"} for this name' };
+  if (r.j.name !== undefined && (typeof r.j.name !== 'string' || foldName(r.j.name) !== f)) {
+    return { state: 'unreadable', file, why: `it holds the entry of another name (${JSON.stringify(String(r.j.name).slice(0, 64))})` };
   }
-  throw new Error(`[SYM] the name index entry for "${name}" keeps appearing and disappearing; nothing was changed`);
+  return { state: 'ok', file, nodeId: r.j.nodeId, name: typeof r.j.name === 'string' ? r.j.name : null };
 }
 
 /**
- * The halt for a start pinned to `pin` under a name whose index entry names another identity (`held`). The entry
- * is left as it is: a name is one agent's on this host.
+ * The index entry for `name`, a cache of which committed identity the name is: the folded entry, or (when that is
+ * missing) the entry 0.14.0 - 0.14.2 wrote under the exact name. Two readable entries for one folded name that name
+ * different nodes (two agents a case-sensitive 0.14.2 host made, "Kappa" and "kappa") are a conflict.
  */
-function nameHeldByAnother(name, pin, held) {
-  const there = identityInPlace(held);
-  return new IdentityHaltError(name, nameIndexPath(name),
-    `this start is pinned to ${pin}, and the name "${name}" is another agent's on this host: its index entry names ${held}` +
-    `${there ? '' : ' (whose identity is not installed here)'}. A pinned start does not take a name from another identity: the next start of ` +
-    `"${name}" by name would run as ${pin}, and ${held} would be left without its name. The index entry was left as it is.`,
-    `Start ${pin} under its own name, or pin the start to ${held} if that is the agent meant. To give "${name}" to ${pin}, ` +
-    `rename the other agent first (renameIdentity).`);
+function entryFor(name) {
+  const f = foldName(name);
+  const a = readEntryFile(nameIndexPath(name), f);
+  if (exactIndexPath(name) === nameIndexPath(name)) return a;
+  const b = readEntryFile(exactIndexPath(name), f);
+  if (a.state === 'ok' && b.state === 'ok' && a.nodeId !== b.nodeId && !sameFile(a.file, b.file)) return { state: 'conflict', entries: [a, b] };
+  if (a.state === 'ok') return a;
+  if (b.state === 'ok') return { ...b, exactKey: true };
+  return a.state === 'unreadable' ? a : b.state === 'unreadable' ? b : a;
 }
 
-/** Every nodeId some index entry names, with the names. Entries that cannot be read are left out. */
+/** Every readable index entry: nodeId -> [{ name, file }]. */
 function indexEntries() {
   const out = new Map();
   const dir = path.join(NODES_DIR, 'by-name');
@@ -475,48 +468,107 @@ function indexEntries() {
   try { files = fs.readdirSync(dir); } catch { return out; }
   for (const f of files) {
     if (f.startsWith('.') || !f.endsWith('.json')) continue;
-    try {
-      const r = JSON.parse(fs.readFileSync(path.join(dir, f), 'utf8'));
-      if (r && isNodeIdText(r.nodeId)) {
-        if (!out.has(r.nodeId)) out.set(r.nodeId, []);
-        out.get(r.nodeId).push(typeof r.name === 'string' ? r.name : decodeURIComponent(f.slice(0, -5)));
-      }
-    } catch { /* unreadable: its own name halts when started */ }
+    const r = readJsonState(path.join(dir, f));
+    if (r.state !== 'ok' || !isNodeIdText(r.j.nodeId)) continue;
+    let name = typeof r.j.name === 'string' ? r.j.name : null;
+    if (name === null) { try { name = decodeURIComponent(f.slice(0, -5)); } catch { continue; } }
+    if (!out.has(r.j.nodeId)) out.set(r.j.nodeId, []);
+    out.get(r.j.nodeId).push({ name, file: path.join(dir, f) });
   }
   return out;
 }
 
-/** The by-id roots: nodes/by-id, and SYM_IDENTITY_DIR/by-id when set. */
-function byIdRoots() {
-  const roots = [path.join(NODES_DIR, 'by-id')];
-  if (process.env.SYM_IDENTITY_DIR) roots.push(path.join(process.env.SYM_IDENTITY_DIR, 'by-id'));
-  return roots;
+/** Write the 0.14.2 exact-name entry beside the folded one when they are different files (a rollback reads it). */
+function writeExactKey(name, nodeId) {
+  const exact = exactIndexPath(name);
+  if (exact === nameIndexPath(name) || sameFile(exact, nameIndexPath(name))) return;
+  const there = readEntryFile(exact, foldName(name));
+  if (there.state === 'ok') return; // the same node, or another one's (a conflict a start reports): never re-pointed here
+  try { writeFileDurable(exact, JSON.stringify({ name, nodeId, at: Date.now() }), 0o644); } catch { /* a cache */ }
 }
 
-/** Every identity.json filed by nodeId on this host: { nodeId, name, file, scrubbed }. Dot-entries (staging, husks) are not identities. */
-function identitiesOnDisk() {
-  const out = new Map();
-  for (const root of byIdRoots()) {
-    let dirs = [];
-    try { dirs = fs.readdirSync(root); } catch { continue; }
-    for (const d of dirs) {
-      if (d.startsWith('.') || !isNodeIdText(d) || out.has(d)) continue;
-      const file = path.join(root, d, 'identity.json');
-      try {
-        const j = JSON.parse(fs.readFileSync(file, 'utf8'));
-        if (j && j.nodeId === d) out.set(d, { nodeId: d, name: j.name, file, scrubbed: !j.privateKey });
-      } catch { /* none, or not readable: not an identity this scan can name */ }
+/**
+ * Claim `name` for `nodeId` by an exclusive create of its index entry. Returns the nodeId the entry holds
+ * afterwards: `nodeId` when this call claimed it (or it already named it), another when another identity holds it,
+ * null when an entry is there that cannot be read (it is not replaced here).
+ */
+function claimName(name, nodeId, exactName = name) {
+  const f = foldName(name);
+  fs.mkdirSync(path.join(NODES_DIR, 'by-name'), { recursive: true });
+  for (let i = 0; i < 8; i++) {
+    if (createFileExclusive(nameIndexPath(name), JSON.stringify({ name: exactName, nodeId, at: Date.now() }))) {
+      writeExactKey(exactName, nodeId);
+      return nodeId;
+    }
+    const e = readEntryFile(nameIndexPath(name), f);
+    if (e.state === 'ok') { if (e.nodeId === nodeId) writeExactKey(exactName, nodeId); return e.nodeId; }
+    if (e.state === 'unreadable') {
+      // Created in place where hard links are not supported, and not written yet: give it a moment.
+      const st = statOrNull(e.file);
+      if (st && st.size === 0 && Date.now() - st.mtimeMs < 2000) { pause(5); continue; }
+      return null;
     }
   }
-  return [...out.values()];
+  return null;
 }
 
-/** True when the identity of `nodeId` is where a load reads it. */
-function identityInPlace(nodeId) {
-  return fs.existsSync(path.join(identityDirById(nodeId), 'identity.json'));
+/** Re-derive an entry whose content is not an entry (empty, not JSON, another name's): replaced in one step. */
+function repairEntry(name, nodeId, exactName) {
+  try { writeFileDurable(nameIndexPath(name), JSON.stringify({ name: exactName, nodeId, at: Date.now() }), 0o644); } catch { return; }
+  writeExactKey(exactName, nodeId);
 }
 
-// ── The 0.13-compatible links (nodes/<name> -> by-id/<nodeId>, for one release) ──
+// ── Committed identities: the one source of truth ────────────────────────
+
+const identityFileById = (nodeId) => path.join(identityDirById(nodeId), 'identity.json');
+
+/**
+ * The committed identity of `nodeId`: the identity.json where a load reads it (identityDirById). An agent exists
+ * exactly when this file exists. `absent`, `unreadable` (it exists and cannot be read, or names another nodeId: a
+ * load halts), or `ok` with its name.
+ */
+function readCommitted(nodeId) {
+  const r = readJsonState(identityFileById(nodeId));
+  if (r.state !== 'ok') return r;
+  if (r.j.nodeId !== nodeId) return { state: 'unreadable', file: r.file, why: `it names ${String(r.j.nodeId).slice(0, 40)}, not ${nodeId}` };
+  return { state: 'ok', file: r.file, identity: r.j, name: typeof r.j.name === 'string' ? r.j.name : null, scrubbed: !r.j.privateKey };
+}
+
+/** True when an identity is committed for `nodeId` (its file exists, readable or not). */
+function isCommitted(nodeId) {
+  try { fs.statSync(identityFileById(nodeId)); return true; } catch (e) { return !(e.code === 'ENOENT' || e.code === 'ENOTDIR'); }
+}
+
+/** Where committed identities are filed: SYM_IDENTITY_DIR/by-id when set, else nodes/by-id. */
+const committedRoot = () => (process.env.SYM_IDENTITY_DIR ? path.join(process.env.SYM_IDENTITY_DIR, 'by-id') : path.join(NODES_DIR, 'by-id'));
+
+/** Every committed identity on this host: [{ nodeId, state, name, scrubbed, file }]. Dot-entries are never identities. */
+function scanCommitted() {
+  const out = [];
+  let names = [];
+  try { names = fs.readdirSync(committedRoot()); } catch { return out; }
+  for (const d of names) {
+    if (d.startsWith('.') || !isNodeIdText(d)) continue;
+    const r = readCommitted(d);
+    if (r.state !== 'absent') out.push({ nodeId: d, ...r });
+  }
+  return out;
+}
+
+/** The live committed identities named `f` (folded) other than `except`: readable, holding their key, not moved away. */
+function namedHere(scan, f, except = null) {
+  return scan.filter((i) => i.state === 'ok' && !i.scrubbed && i.name !== null && foldName(i.name) === f && i.nodeId !== except && !readTombstone(i.nodeId));
+}
+
+/** The halt for two committed identities that are one name. Nothing is changed; the operator renames one. */
+function twoAgentsHalt(name, ids, why) {
+  return new IdentityHaltError(name, nameIndexPath(name),
+    `${ids.length} agents on this host are named "${name}" (names are compared without regard to case): ${ids.map((id) => `${id} (${identityFileById(id)})`).join(', ')}${why ? `; ${why}` : ''}. ` +
+    'A name is one agent, so neither was started and nothing was changed.',
+    `Start the one you mean by its nodeId (loadIdentity({ nodeId })) and give the other another name (renameIdentity, or start it pinned under a new name). Do not remove either identity.json: each is an agent's key.`);
+}
+
+// ── The 0.13-compatible links (nodes/<name> -> by-id/<nodeId>): derived, like the index ──
 
 /**
  * True when the link at `link` leads to `target` (relative to the link's directory). A Windows junction
@@ -546,32 +598,45 @@ function removeLink(p) {
   try { fs.unlinkSync(p); } catch (e) { if (e.code === 'ENOENT') return; fs.rmdirSync(p); }
 }
 
+/** A link to `by-id/<nodeId>` made under a name of its own beside `at`, ready to be renamed onto it; null when none can be made. */
+function makeTempLink(at, nodeId) {
+  const tmp = path.join(path.dirname(at), `.${path.basename(at)}.link-${process.pid}-${randomTag()}`);
+  try { fs.symlinkSync(path.join('by-id', nodeId), tmp, linkType()); return tmp; } catch { return null; }
+}
+
+/**
+ * Put the temp link `tmp` at `at` when nothing but a link is there. A real directory is never replaced, except an empty
+ * one (or one holding only a stale lock), which is nothing.
+ */
+function putTempLink(tmp, at) {
+  if (!tmp) return false;
+  const st = lstatOrNull(at);
+  let done = false;
+  if (!st || st.isSymbolicLink() || (st.isDirectory() && removeEmptyDir(at))) {
+    try { fs.renameSync(tmp, at); done = true; } catch { /* below */ }
+    // The rename failed (not a crash: an error): a link made in place, where nothing is.
+    if (!done && !lstatOrNull(at)) { try { fs.symlinkSync(fs.readlinkSync(tmp), at, linkType()); done = true; } catch { /* */ } }
+  }
+  if (lstatOrNull(tmp)) { try { removeLink(tmp); } catch { /* */ } }
+  if (done) fsyncDir(path.dirname(at));
+  return done;
+}
+
 /**
- * Make `link` lead to `by-id/<nodeId>`. A real directory is not replaced (a 0.13 one is set aside by the
- * migration first), except an empty one (or one holding only a stale lock), which is nothing. The link is
- * made under a name of its own and renamed onto the path, so a stale link is replaced in one step. Best
- * effort: the index is authoritative.
+ * Make `link` lead to `by-id/<nodeId>`. A real directory is not replaced, except an empty one (or one holding only
+ * a stale lock), which is nothing. Best effort: the link is a cache of the name, like the index.
  */
 function linkCompat(link, nodeId) {
   const target = path.join('by-id', nodeId);
   const st = lstatOrNull(link);
   if (st && st.isSymbolicLink() && linkLeadsTo(link, target)) return true;
   if (st && !st.isSymbolicLink() && !(st.isDirectory() && removeEmptyDir(link))) return false;
-  const tmp = path.join(path.dirname(link), `.${path.basename(link)}.link-${process.pid}-${randomTag()}`);
+  const tmp = makeTempLink(link, nodeId);
+  if (putTempLink(tmp, link)) return true;
   try {
-    fs.symlinkSync(target, tmp, process.platform === 'win32' ? 'junction' : 'dir');
-  } catch { return false; }
-  try {
-    fs.renameSync(tmp, link);
-    return true;
-  } catch {
-    try { removeLink(tmp); } catch { /* */ }
-    try {
-      if (lstatOrNull(link) && lstatOrNull(link).isSymbolicLink()) removeLink(link);
-      fs.symlinkSync(target, link, process.platform === 'win32' ? 'junction' : 'dir');
-      return true;
-    } catch { return false; }
-  }
+    if (!lstatOrNull(link)) { fs.symlinkSync(target, link, linkType()); return true; }
+  } catch { /* */ }
+  return false;
 }
 
 /** The compat links of `name`: nodes/<name>, and SYM_IDENTITY_DIR/<name> when the identity is there. */
@@ -595,7 +660,9 @@ function removeEmptyDir(dir) {
   try { fs.rmdirSync(dir); return true; } catch (e) { return e.code === 'ENOENT'; }
 }
 
-/** The tombstone a moved identity left, or null: beside the key, or (written by 0.14.0 - 0.14.2) in the node dir. */
+// ── Tombstones and export intents ────────────────────────────────────────
+
+/** The tombstone a moved identity left, or null: beside the key, or (a copy for 0.14.2, and 0.14.0 - 0.14.2's own) in the node dir. */
 function readTombstone(nodeId) {
   for (const d of new Set([identityDirById(nodeId), nodeDirById(nodeId)])) {
     try { return JSON.parse(fs.readFileSync(path.join(d, TOMBSTONE), 'utf8')); } catch { /* none here */ }
@@ -611,13 +678,15 @@ function readExportIntent(nodeId) {
   return null;
 }
 
+// ── Key files: modes ─────────────────────────────────────────────────────
+
 /** The files in a node's directory that hold a PRIVATE KEY: its signing identity and the 0.13 E2E keypair. */
 const PRIVATE_KEY_FILES = ['identity.json', 'e2e-keypair.json'];
 
 /**
- * Narrow a node's private key files to their owner (0600), and with `dirs` the directories that hold
- * them (0700). A key file a 0.13 node wrote at the umask default (0644 — world-readable) stays
- * world-readable in the 0.13 directory the migration sets aside; this is what ends that.
+ * Narrow a node's private key files to their owner (0600), and with `narrowDirs` the directories that hold
+ * them (0700). A key file a 0.13 node wrote at the umask default (0644 — world-readable) stays world-readable
+ * until this runs; it runs on every load, on everything a migration installs or sets aside, and on staging.
  *
  * Best effort on purpose: a file this process does not own, or a filesystem without modes (Windows),
  * must not stop a node from starting. Nothing here changes what a file holds.
@@ -631,25 +700,6 @@ function securePrivateFiles(dirs, { narrowDirs = false } = {}) {
   }
 }
 
-/** Write a file the way a key file must be written: a private temp file, synced, renamed over the target. */
-function writeFileAtomic0600(file, text) {
-  const tmp = `${file}.${process.pid}.tmp`;
-  let fd;
-  try {
-    fd = fs.openSync(tmp, 'w', 0o600);
-    fs.writeSync(fd, text);
-    fs.fsyncSync(fd);
-    fs.closeSync(fd);
-    fd = undefined;
-    fs.renameSync(tmp, file);
-    fsyncDir(path.dirname(file));
-  } catch (e) {
-    if (fd !== undefined) try { fs.closeSync(fd); } catch { /* */ }
-    try { fs.unlinkSync(tmp); } catch { /* */ }
-    throw e;
-  }
-}
-
 // ── Reading an identity ──────────────────────────────────────────────────
 
 /**
@@ -725,7 +775,7 @@ function readIdentityFile(idPath, name) {
   // Atomic and private: a truncate-in-place that is interrupted leaves a key file with no key in it, and a
   // mode passed to writeFileSync is ignored for a file that already exists.
   if (mutated) writeFileAtomic0600(idPath, JSON.stringify(identity, null, 2));
-  securePrivateFiles([path.dirname(idPath)]);
+  securePrivateFiles([path.dirname(idPath)], { narrowDirs: true });
   return identity;
 }
 
@@ -735,199 +785,80 @@ function sameIdentity(source, other) {
     (!source.privateKey || source.privateKey === other.privateKey) &&
     (!source.publicKey || source.publicKey === other.publicKey);
 }
+const sameIdentityBothWays = (a, b) => sameIdentity(a, b) && sameIdentity(b, a);
 
-// ── Staged copies, committed by one rename ───────────────────────────────
+// ── Runtime leftovers: staging, temp links, temp entries, lock artifacts ──
 
-/** Top-level entries a copy of a node directory leaves out: runtime state, and what the copy writes itself. */
-const COPY_SKIP_TOP = new Set(['lock.pid', 'interior.sock', TOMBSTONE, EXPORTING, COMMIT_MARK]);
-const skipTop = (extra = []) => {
-  const names = new Set([...COPY_SKIP_TOP, ...extra]);
-  return (rel) => !rel.includes('/') && (names.has(rel) || rel.endsWith('.tmp') || rel.startsWith('lock.pid.') || /^\.[^/]*\.link-\d+-[0-9a-f]+$/.test(rel));
-};
+/** A lock, a claim to remove one, or the temp file a lock is written under: runtime state, never a node's data. */
+const isLockArtifact = (n) => n === 'lock.pid' || n.startsWith('lock.pid.') || (n.startsWith('.lock.pid') && n.endsWith('.tmp'));
 
-/** Two regular files hold the same bytes (read in pieces: a store file can be large). */
-function sameBytes(a, b) {
-  const sa = statOrNull(a); const sb = statOrNull(b);
-  if (!sa || !sb || !sa.isFile() || !sb.isFile() || sa.size !== sb.size) return false;
-  let fa; let fb;
-  try {
-    fa = fs.openSync(a, 'r'); fb = fs.openSync(b, 'r');
-    const ba = Buffer.alloc(1 << 20); const bb = Buffer.alloc(1 << 20);
-    for (let pos = 0; pos < sa.size;) {
-      const na = fs.readSync(fa, ba, 0, ba.length, pos); const nb = fs.readSync(fb, bb, 0, bb.length, pos);
-      if (na !== nb || na === 0 || ba.compare(bb, 0, nb, 0, na) !== 0) return false;
-      pos += na;
-    }
-    return true;
-  } catch { return false; } finally {
-    if (fa !== undefined) fs.closeSync(fa);
-    if (fb !== undefined) fs.closeSync(fb);
-  }
+/** Staging directories (this release's `.stage-`, an import's `.import-`, 0.14.3 candidates' `.partial-`): `.<id>.<kind>-<pid>-<rand>`. */
+const STAGING_RE = /^\.([0-9A-Za-z][0-9A-Za-z_.-]*?)\.(stage|import|partial)-(\d+)-([0-9a-f]+)$/;
+/** A process that made a leftover is gone, or (a pid reused) the leftover is older than any step that makes one takes. */
+const LEFTOVER_MAX_AGE_MS = 10 * 60 * 1000;
+function leftoverIsDead(pid, p) {
+  if (pid === process.pid) return false;
+  if (!pidIsAlive(pid)) return true;
+  const st = lstatOrNull(p);
+  return Boolean(st && Date.now() - st.mtimeMs > LEFTOVER_MAX_AGE_MS);
 }
 
 /**
- * Copy the children of directory `src` into directory `dst` (which exists): directories are made 0700,
- * files keep their bytes and mode (a key file 0600) and are synced. Links are FOLLOWED, so what a 0.13 node
- * kept behind a link (its directory on another volume, an identity.json linked to a key file) is copied, not
- * a link that would lead somewhere else from the new place; a link that leads nowhere is copied as the link
- * it is. What is neither a file nor a directory (a socket) is not data and is left out, and so is what
- * `skip(rel)` names. A directory reached twice through links is copied as a link, not followed forever.
+ * Clear what processes that are gone left behind (design: on every load): staging directories (one may hold a
+ * private key: it was never anyone's, and it is never read), temp links, temp index entries and temp key files.
+ * Nothing that is set aside is touched: an aside is kept.
  */
-function copyChildren(src, dst, skip, rel = '', within = new Set()) {
-  within.add(fs.realpathSync(src));
-  for (const e of fs.readdirSync(src).sort()) {
-    const r = rel ? `${rel}/${e}` : e;
-    if (skip(r)) continue;
-    const from = path.join(src, e);
-    const to = path.join(dst, e);
-    const st = statOrNull(from);
-    if (!st) { // a link that leads nowhere
-      const l = lstatOrNull(from);
-      if (l && l.isSymbolicLink()) fs.symlinkSync(fs.readlinkSync(from), to);
-      continue;
-    }
-    if (st.isDirectory()) {
-      if (within.has(fs.realpathSync(from))) { fs.symlinkSync(fs.readlinkSync(from), to); continue; }
-      fs.mkdirSync(to, { mode: 0o700 });
-      fs.chmodSync(to, 0o700);
-      copyChildren(from, to, skip, r, new Set(within));
-      fsyncDir(to);
-    } else if (st.isFile()) {
-      // From the file a link leads to: a clone (macOS) of a link would copy the link.
-      fs.copyFileSync(fs.realpathSync(from), to, fs.constants.COPYFILE_EXCL | fs.constants.COPYFILE_FICLONE);
-      fsyncFile(to);
-      fs.chmodSync(to, PRIVATE_KEY_FILES.includes(e) ? 0o600 : st.mode & 0o777);
+function clearLeftovers() {
+  const idRoot = process.env.SYM_IDENTITY_DIR;
+  for (const dir of new Set([path.join(NODES_DIR, 'by-id'), idRoot && path.join(idRoot, 'by-id')].filter(Boolean))) {
+    let names = [];
+    try { names = fs.readdirSync(dir); } catch { continue; }
+    for (const n of names) {
+      const m = STAGING_RE.exec(n);
+      if (!m || !leftoverIsDead(Number(m[3]), path.join(dir, n))) continue;
+      try { fs.rmSync(path.join(dir, n), { recursive: true, force: true }); } catch { /* the next load */ }
     }
   }
-}
-
-/** The first path (relative) under directory `src` whose copy under `dst` is missing or differs, or null. */
-function firstDifference(src, dst, skip, rel = '', within = new Set()) {
-  within.add(fs.realpathSync(src));
-  for (const e of fs.readdirSync(src).sort()) {
-    const r = rel ? `${rel}/${e}` : e;
-    if (skip(r)) continue;
-    const from = path.join(src, e);
-    const to = path.join(dst, e);
-    const st = statOrNull(from);
-    if (!st) {
-      const l = lstatOrNull(from); const d = lstatOrNull(to);
-      if (l && l.isSymbolicLink() && !(d && d.isSymbolicLink() && fs.readlinkSync(to) === fs.readlinkSync(from))) return r;
-      continue;
-    }
-    if (st.isDirectory()) {
-      if (within.has(fs.realpathSync(from))) continue;
-      const d = lstatOrNull(to);
-      if (!d || !d.isDirectory()) return r;
-      const inner = firstDifference(from, to, skip, r, new Set(within));
-      if (inner) return inner;
-    } else if (st.isFile() && !sameBytes(from, to)) {
-      return r;
+  for (const dir of new Set([NODES_DIR, idRoot].filter(Boolean))) {
+    let names = [];
+    try { names = fs.readdirSync(dir); } catch { continue; }
+    for (const n of names) {
+      const m = /^\..+\.link-(\d+)-[0-9a-f]+$/.exec(n);
+      if (m && leftoverIsDead(Number(m[1]), path.join(dir, n))) { try { removeLink(path.join(dir, n)); } catch { /* */ } }
     }
   }
-  return null;
-}
-
-/** Remove leftover staging directories (`.<id>.partial-<pid>-<rand>`) of processes that are gone. */
-function clearPartials(parent) {
+  // What is set aside and may hold a key (a 0.13 directory, a husk, an import's archive) is narrowed, also when the start
+  // that set it aside was killed before it did.
+  for (const root of new Set([NODES_DIR, idRoot].filter(Boolean))) {
+    let asides = [];
+    try { asides = fs.readdirSync(path.join(root, LEGACY_ASIDE)); } catch { /* none */ }
+    securePrivateFiles(asides.map((n) => path.join(root, LEGACY_ASIDE, n)).filter((d) => { const st = lstatOrNull(d); return st && st.isDirectory(); }), { narrowDirs: true });
+  }
+  for (const dir of new Set([path.join(NODES_DIR, 'by-id'), idRoot && path.join(idRoot, 'by-id')].filter(Boolean))) {
+    let names = [];
+    try { names = fs.readdirSync(dir).filter((n) => /^\.[^/]+\.(husk|moved)(-|$)/.test(n)); } catch { continue; }
+    securePrivateFiles(names.map((n) => path.join(dir, n)).filter((d) => { const st = lstatOrNull(d); return st && st.isDirectory(); }), { narrowDirs: true });
+  }
+  const byName = path.join(NODES_DIR, 'by-name');
   let names = [];
-  try { names = fs.readdirSync(parent); } catch { return; }
+  try { names = fs.readdirSync(byName); } catch { names = []; }
   for (const n of names) {
-    const m = /^\.[^\\/]+\.(?:partial|import)-(\d+)-[0-9a-f]+$/.exec(n);
-    if (!m || Number(m[1]) === process.pid || pidIsAlive(Number(m[1]))) continue;
-    try { fs.rmSync(path.join(parent, n), { recursive: true, force: true }); } catch { /* the next attempt */ }
+    const m = /^\..+\.(\d+)-[0-9a-f]+\.tmp$/.exec(n);
+    if (m && leftoverIsDead(Number(m[1]), path.join(byName, n))) { try { fs.unlinkSync(path.join(byName, n)); } catch { /* */ } }
   }
 }
 
-/**
- * A new staging directory for `nodeId` beside where it will be installed (`parent`), so the commit is a rename
- * on one volume: `.<nodeId>.<kind>-<pid>-<rand>`, 0700. Leftovers of processes that are gone are cleared first.
- */
-function makeStaging(parent, nodeId, kind = 'partial') {
-  ensureDir(parent);
-  clearPartials(parent);
+/** A new staging directory for `nodeId` in `parent` (the directory it commits into, so the commit is one rename): 0700. */
+function makeStaging(parent, nodeId, kind = 'stage') {
+  fs.mkdirSync(parent, { recursive: true });
   const staging = path.join(parent, `.${nodeId}.${kind}-${process.pid}-${randomTag()}`);
   fs.mkdirSync(staging, { mode: 0o700 });
   fs.chmodSync(staging, 0o700);
   return staging;
 }
 
-/** Write the commit record into a staging directory (last), and sync the directory. */
-function markStaged(staging, nodeId, from) {
-  writeNewFileSynced(path.join(staging, COMMIT_MARK), JSON.stringify({ nodeId, from, at: Date.now() }) + '\n', 0o600);
-  fsyncDir(staging);
-}
-
-/** Why a staged commit was refused: a different identity, or files that differ, already under the nodeId. */
-class CommitConflict extends Error {}
-
-/**
- * What is at `target`, the by-id directory a commit for `nodeId` installs:
- *   - 'absent';
- *   - 'committed': it carries the commit record (and, when it holds the identity, `source`'s identity);
- *   - 'husk': a directory without the commit record that does not contradict `source` (empty, a stale lock,
- *     the files of an earlier release's interrupted move or of a node that ran there without its identity);
- *   - 'conflict': it holds a different identity, or is not a directory.
- * `holdsIdentity`: the identity lives in this directory (no SYM_IDENTITY_DIR, or the identity directory).
- */
-function examineTarget(target, nodeId, source, holdsIdentity) {
-  const st = lstatOrNull(target);
-  if (!st) return { state: 'absent' };
-  if (st.isSymbolicLink() || !st.isDirectory()) return { state: 'conflict', reason: `${target} is not a directory` };
-  const marked = fs.existsSync(path.join(target, COMMIT_MARK));
-  if (holdsIdentity) {
-    const f = path.join(target, 'identity.json');
-    if (fs.existsSync(f)) {
-      let other = null;
-      try { other = JSON.parse(fs.readFileSync(f, 'utf8')); } catch { /* below */ }
-      if (!other) return { state: 'conflict', reason: `${f} is already there and cannot be read` };
-      if (!sameIdentity(source, other)) return { state: 'conflict', reason: `a different identity.json is already filed under ${nodeId} (${f})` };
-    } else if (marked) {
-      return { state: 'conflict', reason: `${target} carries a commit record and no identity.json` };
-    }
-  }
-  if (marked) {
-    let mark = null;
-    try { mark = JSON.parse(fs.readFileSync(path.join(target, COMMIT_MARK), 'utf8')); } catch { /* below */ }
-    if (!mark || mark.nodeId !== nodeId) return { state: 'conflict', reason: `${target} carries the commit record of another node` };
-    return { state: 'committed' };
-  }
-  return { state: 'husk' };
-}
-
-/**
- * Copy what `from` holds into `staging` where it is not there yet; a file on both sides that differs is a
- * conflict (CommitConflict), and nothing of `from` is changed. How a husk's files (a node that ran in the
- * by-id directory without its identity) come into the staged directory before the husk is set aside.
- */
-function mergeIntoStaging(from, staging, skip, rel = '') {
-  for (const e of fs.readdirSync(path.join(from, rel)).sort()) {
-    const r = rel ? `${rel}/${e}` : e;
-    if (skip(r)) continue;
-    const src = path.join(from, r);
-    const dst = path.join(staging, r);
-    const st = statOrNull(src);
-    if (!st) continue;
-    const d = lstatOrNull(dst);
-    if (st.isDirectory()) {
-      if (d && !d.isDirectory()) throw new CommitConflict(`${src} is a directory where the 0.13 copy has a file`);
-      if (!d) { fs.mkdirSync(dst, { mode: 0o700 }); fs.chmodSync(dst, 0o700); }
-      mergeIntoStaging(from, staging, skip, r);
-    } else if (st.isFile()) {
-      if (d) { if (!sameBytes(src, dst)) throw new CommitConflict(`${src} differs from the copy of the 0.13 directory`); continue; }
-      fs.copyFileSync(fs.realpathSync(src), dst, fs.constants.COPYFILE_EXCL | fs.constants.COPYFILE_FICLONE);
-      fsyncFile(dst);
-      fs.chmodSync(dst, PRIVATE_KEY_FILES.includes(e) ? 0o600 : st.mode & 0o777);
-      if (!sameBytes(src, dst)) throw new Error(`the copy of ${src} does not match it`);
-    }
-  }
-}
-
-/** A lock, a claim to remove one, or the temp file a lock is written under: runtime state, never a node's data. */
-const isLockArtifact = (n) => n === 'lock.pid' || n.startsWith('lock.pid.') || (n.startsWith('.lock.pid') && n.endsWith('.tmp'));
-
 /**
- * Remove, from a husk that holds nothing else, the lock artifacts of processes that are gone: a claim to remove a
+ * Remove, from a directory that holds nothing else, the lock artifacts of processes that are gone: a claim to remove a
  * lock that is itself gone, or a temp lock file. (lock.pid itself is removed only by removeStaleLock.)
  */
 function clearDeadLockArtifacts(dir) {
@@ -939,7 +870,10 @@ function clearDeadLockArtifacts(dir) {
   for (const n of names) {
     if (n.startsWith('lock.pid.')) {
       const l = readLockFile(path.join(dir, n));
-      if (l && (l.pid === process.pid || (!lockIsLive(l) && Date.now() - l.mtimeMs > LOCK_CORRUPT_GRACE_MS))) { try { fs.unlinkSync(path.join(dir, n)); } catch { /* */ } }
+      // A claim whose holder is gone (killed while it removed the lock, which is gone too) goes at once; one that cannot be
+      // read yet is given the grace a lock being written gets.
+      const gone = l && (l.pid === process.pid || (l.pid !== null ? !lockIsLive(l) : Date.now() - l.mtimeMs > LOCK_CORRUPT_GRACE_MS));
+      if (gone) { try { fs.unlinkSync(path.join(dir, n)); } catch { /* */ } }
     } else if (n.startsWith('.lock.pid') && n.endsWith('.tmp')) {
       const m = /\.(\d+)-[0-9a-f]+\.tmp$/.exec(n);
       if (m && gone(Number(m[1]))) { try { fs.unlinkSync(path.join(dir, n)); } catch { /* */ } }
@@ -947,120 +881,42 @@ function clearDeadLockArtifacts(dir) {
   }
 }
 
-/**
- * Install a complete staging directory as `target` by ONE rename: that rename is the commit. Returns
- * 'committed' when this staging went in, 'exists' when `target` already holds a committed directory (another
- * start committed first, or an earlier one did): the caller checks it is the same identity and discards its
- * staging. Nothing at `target` is ever overwritten by it:
- *   - a husk (no commit record) holding nothing, or only a lock whose holder is gone, is removed with rmdir,
- *     which cannot remove a directory with anything in it, and the rename is tried again;
- *   - a husk with files: they are copied into the staging (a file that differs is a conflict), and the husk is
- *     renamed aside to `.<nodeId>.husk` beside it, kept. That name is taken once and kept, so a later rename
- *     can never move a directory installed since; and the staging takes in the files of a husk set aside by
- *     another start before each attempt;
- *   - a husk whose lock a live process holds: EIDENTITYLOCK, nothing changed.
- */
-function commitStaged(staging, target, { nodeId, examine, skip }) {
-  const asideHusk = path.join(path.dirname(target), `.${nodeId}.husk`);
-  for (let attempt = 0; attempt < 12; attempt++) {
-    if (fs.existsSync(asideHusk)) mergeIntoStaging(asideHusk, staging, skip);
-    try {
-      fs.renameSync(staging, target);
-      fsyncDir(path.dirname(target));
-      return 'committed';
-    } catch (e) {
-      if (!RENAME_TAKEN.has(e.code)) throw e;
-    }
-    const t = examine(target);
-    if (t.state === 'absent') continue;
-    if (t.state === 'committed') return 'exists';
-    if (t.state === 'conflict') throw new CommitConflict(t.reason);
-    const lockPath = path.join(target, 'lock.pid');
-    const lock = readLockFile(lockPath);
-    if (lock) {
-      if (lockHeldInProcess(target) || (lock.pid !== process.pid && lockIsHeldByLiveProcess(lock))) {
-        throw lockError(`[SYM] A live process (PID ${lock.pid ?? 'unknown'}) holds ${lockPath}, but ${nodeId}'s identity is not installed there: ` +
-          'a node of an earlier release is running in that directory without its identity. Stop it, then start this agent again; nothing was changed.', lock);
-      }
-      removeStaleLock(lockPath, lock);
-    }
-    let rest = [];
-    try { rest = fs.readdirSync(target).filter((n) => !isLockArtifact(n)); } catch { continue; }
-    if (!rest.length) {
-      clearDeadLockArtifacts(target);
-      try { fs.rmdirSync(target); continue; } catch (e) {
-        if (!['ENOENT', 'ENOTEMPTY', 'EEXIST'].includes(e.code)) throw e;
-        if (e.code === 'ENOENT') continue;
-        // Another start's claim or temp lock file is in it for a moment; if one stays, the husk is set aside with it.
-        if (attempt < 4) { pause(2); continue; }
-      }
-    }
-    // Looked at again right before it is set aside: since the look above, the husk may have been emptied and
-    // replaced by another start's commit (found by the multi-process fuzz: a committed directory was set aside).
-    // A husk with files cannot be replaced by a commit (a rename onto a directory that is not empty fails), so
-    // from here only another claim can move it, and then the rename below fails.
-    const again = examine(target);
-    if (again.state === 'absent') continue;
-    if (again.state === 'committed') return 'exists';
-    if (again.state === 'conflict') throw new CommitConflict(again.reason);
-    mergeIntoStaging(target, staging, skip);
-    try { fs.renameSync(target, asideHusk); } catch (e) { if (e.code !== 'ENOENT' && !RENAME_TAKEN.has(e.code)) throw e; }
-  }
-  throw new Error(`[SYM] could not install ${target}: what was there kept changing; nothing was overwritten. Start again.`);
+/** The live holder of the lock in `dir` (a process of this or an earlier release running there), or null. */
+function liveLockIn(dir) {
+  const lock = readLockFile(path.join(dir, 'lock.pid'));
+  if (!lock) return null;
+  if (lockHeldInProcess(dir)) return lock;
+  if (lock.pid !== process.pid && lockIsHeldByLiveProcess(lock)) return lock;
+  return null;
 }
 
 /**
- * Stage a copy of the 0.13 directory `src` (null: none) for `nodeId` and commit it as `target`. `identityText`,
- * when given, is written as identity.json after everything else, then the commit record; the copy is verified
- * against `src` byte for byte before the commit. Returns 'committed' | 'exists'; a conflict throws CommitConflict.
+ * Hold the short lock file `lockPath` while `fn` runs: a few system calls (a mint, setting a husk aside), never a
+ * copy. A live holder is waited for (it is done within milliseconds), up to `waitMs`; a holder that is gone is
+ * removed the atomic way (removeStaleLock).
  */
-function commitCopy(src, target, { nodeId, identityText, source, holdsIdentity, from }) {
-  const skip = skipTop(['identity.json']);
-  const examine = (t) => examineTarget(t, nodeId, source, holdsIdentity);
-  const pre = examine(target);
-  if (pre.state === 'committed') return 'exists';
-  if (pre.state === 'conflict') throw new CommitConflict(pre.reason);
-  const staging = makeStaging(path.dirname(target), nodeId);
-  try {
-    if (src) copyChildren(src, staging, skip);
-    if (identityText) writeNewFileSynced(path.join(staging, 'identity.json'), identityText, 0o600);
-    markStaged(staging, nodeId, from);
-    if (src) {
-      const d = firstDifference(src, staging, skip);
-      if (d) throw new Error(`[SYM] the copy of ${path.join(src, d)} does not match its source (did it change while it was copied?); nothing was installed, the source is untouched. Start again.`);
-    }
-    if (identityText && !sameIdentity(source, JSON.parse(fs.readFileSync(path.join(staging, 'identity.json'), 'utf8')))) {
-      throw new Error('[SYM] the staged identity.json does not read back as the identity it was written from; nothing was installed');
+function withShortLock(lockPath, what, fn, waitMs = 10000) {
+  fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+  const t0 = Date.now();
+  for (;;) {
+    const got = acquireLockAt(lockPath, { short: what });
+    if (got.ok) break;
+    // This process's own: lock work is synchronous, so it is a leftover of a step that threw.
+    if (got.lock && got.lock.pid === process.pid && !got.contended) { removeStaleLock(lockPath, got.lock); continue; }
+    if (Date.now() - t0 > waitMs) {
+      throw lockError(`[SYM] Another start (PID ${got.lock && got.lock.pid !== null ? got.lock.pid : 'unknown'}) has been ${what} for over ${Math.round(waitMs / 1000)} s ` +
+        `(${lockPath}). This start is refused; nothing was changed. Start again once that process has finished or exited.`, got.lock);
     }
-    return commitStaged(staging, target, { nodeId, skip, examine });
-  } finally {
-    fs.rmSync(staging, { recursive: true, force: true });
-  }
-}
-
-/**
- * Install a new directory for `nodeId` at `target` (which must not exist), built by `build(staging)` in a staging
- * directory and committed by one rename: for a new identity, and for an import (relocation.js, whose
- * `beforeCommit` sets the tombstoned copy of a node coming back aside once the new one is complete).
- */
-function installNewDir(target, nodeId, build, kind = 'partial', { beforeCommit } = {}) {
-  const staging = makeStaging(path.dirname(target), nodeId, kind);
-  try {
-    build(staging);
-    markStaged(staging, nodeId, kind);
-    if (beforeCommit) beforeCommit();
-    fs.renameSync(staging, target);
-    fsyncDir(path.dirname(target));
-  } finally {
-    fs.rmSync(staging, { recursive: true, force: true });
+    pause(5);
   }
+  try { return fn(); } finally { _releaseLockIfOurs(lockPath); }
 }
 
-// ── 0.13 directories ─────────────────────────────────────────────────────
+// ── 0.13 directories, and moving them in ─────────────────────────────────
 
 /**
  * The 0.13 directory at `p`, or null: a real directory, or a link to a directory that is NOT a compat link (a
- * 0.13 node kept its directory on another volume behind one; it is followed and copied).
+ * 0.13 node kept its directory on another volume behind one).
  */
 function legacyAt(p) {
   const st = lstatOrNull(p);
@@ -1089,138 +945,363 @@ function legacyIdentityUnder(name) {
 
 /** Whether `dir` holds anything but a lock. */
 function hasContent(dir) {
-  try { return fs.readdirSync(dir).some((n) => n !== 'lock.pid'); } catch { return false; }
+  try { return fs.readdirSync(dir).some((n) => !isLockArtifact(n)); } catch { return false; }
 }
 
-/**
- * Hold the 0.13 directory's own lock (`nodes/<name>/lock.pid`, the file a 0.13 process of the agent takes)
- * while it is copied and set aside, so no 0.13 process starts in it meanwhile. The lock says it is a
- * migration's: another 0.14 start that finds it goes on beside it (the staged commit makes that safe) instead
- * of waiting. A live holder that is not a migration is a process running in that directory: `liveHolder`.
- */
-function takeLegacyLock(dir) {
-  const lockPath = path.join(dir, 'lock.pid');
-  const token = randomTag() + randomTag();
-  let got;
-  try {
-    got = acquireLockAt(lockPath, { migrating: true, token });
-  } catch {
-    // The directory does not take a lock (read-only, not ours): copy it all the same, unless a process holds it.
-    const l = readLockFile(lockPath);
-    got = l && lockIsLive(l) ? { ok: false, lock: l } : { ok: true, none: true };
-    if (got.ok) return { release() {} };
+/** The device a new entry in `dir` lands on: `dir`'s, or its nearest existing ancestor's. */
+function deviceOf(dir) {
+  for (let d = path.resolve(dir); ; d = path.dirname(d)) {
+    const st = statOrNull(d);
+    if (st) return st.dev;
+    if (path.dirname(d) === d) return null;
   }
-  if (!got.ok) {
-    const l = got.lock;
-    if (l && (l.migrating || l.pid === process.pid)) return { release() {} };
-    return { liveHolder: (l && l.pid) || 'unknown', release() {} };
-  }
-  return {
-    /** Remove the lock wherever the directory went (set aside), if it is still this one. */
-    release(also = []) {
-      for (const p of [lockPath, ...also.map((d) => path.join(d, 'lock.pid'))]) {
-        const l = readLockFile(p);
-        if (l && l.pid === process.pid && l.token === token) { try { fs.unlinkSync(p); } catch { /* */ } }
-      }
-    },
-  };
 }
 
+/** True when the real directory `p` is a mount point: on another device than its parent. */
+function isMountPoint(p) {
+  const a = statOrNull(p); const b = statOrNull(path.dirname(p));
+  return Boolean(a && b && a.dev !== b.dev);
+}
+
+/** Two paths are one directory (links followed). */
+const sameDir = (a, b) => { const x = statOrNull(a); const y = statOrNull(b); return Boolean(x && y && x.isDirectory() && x.dev === y.dev && x.ino === y.ino); };
+
 /**
- * Rename the 0.13 directory (or link) at `at` aside, to `<root>/.legacy-0.13/<name>`: kept, never deleted.
- * Returns where it went, or null when it is no longer there (another start set it aside).
+ * Set `p` (a directory, or a link) aside to `<root>/.legacy-0.13/<name>`, in the root it is in (one rename, on its
+ * volume), and narrow what holds a key at once. Kept, never deleted. A mount point cannot be renamed: it is narrowed
+ * where it is. Returns where it is now.
  */
-function setAside(at, root, name) {
-  const st = lstatOrNull(at);
-  if (!st || compatLinkNodeId(at)) return null;
+function setLegacyAside(p, root, name, moved) {
+  const st = lstatOrNull(p);
+  if (!st) return null;
+  if (!st.isSymbolicLink() && isMountPoint(p)) { securePrivateFiles([p], { narrowDirs: true }); return p; }
   const dir = path.join(root, LEGACY_ASIDE);
-  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
   for (const dest of [path.join(dir, name), path.join(dir, `${name}.${Date.now()}-${randomTag()}`)]) {
     try {
-      fs.renameSync(at, dest);
+      fs.renameSync(p, dest);
+      if (moved) moved(); // the link in its place first (a 0.13 build reads the path), then the modes, then the syncs
+      if (!st.isSymbolicLink()) securePrivateFiles([dest], { narrowDirs: true });
       fsyncDir(dir);
       fsyncDir(root);
       return dest;
     } catch (e) {
       if (e.code === 'ENOENT') return null;
       if (!RENAME_TAKEN.has(e.code)) throw e;
-      const again = lstatOrNull(at);
-      if (!again || compatLinkNodeId(at)) return null; // set aside meanwhile; what is there now is the link
     }
   }
   return null;
 }
 
 /**
- * After the commit: the 0.13 directories of `name` go aside and compat links take their place. The link is
- * made first, under a name of its own, and renamed onto the old path right after the directory left it, so a
- * 0.13 rollback finds the old path empty for one rename only.
+ * What is at `target` (a by-id directory a migration places into), for the identity `o.source`:
+ *   empty | locks (only lock artifacts) | same (the same identity is there) | other (another identity, or a file that
+ *   cannot be read where an identity is) | husk (anything else: a directory an earlier release made without the
+ *   identity, a link that leads nowhere).
  */
-function setAsideAndLink(name, nodeId, srcs) {
-  const plans = [[NODES_DIR, srcs.nodes]];
-  if (srcs.idRoot) plans.push([srcs.idRoot, srcs.ids]);
-  const aside = [];
-  for (const [root, src] of plans) {
-    const at = path.join(root, name);
-    if (!src) { if (root === NODES_DIR || fs.existsSync(path.join(root, 'by-id', nodeId))) linkCompat(at, nodeId); continue; }
-    const tmp = path.join(root, `.${name}.link-${process.pid}-${randomTag()}`);
+function judgeTarget(target, o) {
+  const l = lstatOrNull(target);
+  if (!l) return { verdict: 'absent' };
+  const isLink = l.isSymbolicLink();
+  const st = isLink ? statOrNull(target) : l;
+  if (!st || !st.isDirectory()) return { verdict: 'husk' };
+  const r = readJsonState(path.join(target, 'identity.json'));
+  if (r.state === 'unreadable') {
+    if (o.holdsIdentity) return { verdict: 'other', reason: `${path.join(target, 'identity.json')} is there and ${r.why}`, halt: true };
+  } else if (r.state === 'ok') {
+    if (!sameIdentityBothWays(o.source, r.j)) return { verdict: 'other', reason: `a different identity.json is already filed under ${o.nodeId} (${path.join(target, 'identity.json')})` };
+    if (o.holdsIdentity) return { verdict: 'same' };
+  }
+  if (isLink) return { verdict: 'husk' };
+  let names = [];
+  try { names = fs.readdirSync(target); } catch { return { verdict: 'husk' }; }
+  if (!names.length) return { verdict: 'empty' };
+  if (names.every(isLockArtifact)) return { verdict: 'locks' };
+  return { verdict: 'husk' };
+}
+
+/**
+ * Set the husk at `target` aside (`by-id/.<nodeId>.husk-<time>-<rand>`, beside it: one rename), under the nodeId's short
+ * migration lock, so no other start sets it aside, or empties it, in between. A husk with content cannot be replaced by a
+ * commit (a rename onto a directory that is not empty fails), so what this looks at under the lock is what it moves. A
+ * husk whose lock a live process holds (a node of an earlier release running there without its identity) is not moved.
+ */
+function setHuskAside(target, o) {
+  return withShortLock(path.join(path.dirname(target), `.${o.nodeId}.migrating`), `migrating ${o.nodeId}`, () => {
+    const v = judgeTarget(target, o);
+    if (v.verdict !== 'husk' && !(v.verdict === 'same' && !o.inUse) && !(o.forImport && v.verdict === 'other')) return { retry: true };
+    if (o.src && !sourcePresent(o.src)) return { retry: true }; // the 0.13 directory was moved in meanwhile: look again
+    const live = lstatOrNull(target).isSymbolicLink() ? null : liveLockIn(target);
+    if (live) return { live };
+    const aside = path.join(path.dirname(target), `.${o.nodeId}.husk-${Date.now()}-${randomTag()}`);
+    try { fs.renameSync(target, aside); } catch (e) { if (e.code === 'ENOENT') return { retry: true }; throw e; }
+    fsyncDir(path.dirname(target));
+    if (!lstatOrNull(aside).isSymbolicLink()) securePrivateFiles([aside], { narrowDirs: true });
+    return { aside };
+  });
+}
+
+/**
+ * Make `target` free for a directory an import installs for `nodeId`: an empty directory (or one holding only a stale
+ * lock) goes, anything else is set aside as a husk (kept); a live process in it refuses (EIDENTITYLOCK). Returns the
+ * aside, or null.
+ */
+function clearForInstall(target, nodeId) {
+  let aside = null;
+  for (let attempt = 0; attempt < 20; attempt++) {
+    const v = judgeTarget(target, { nodeId, holdsIdentity: false, source: { nodeId } });
+    if (v.verdict === 'absent') return aside;
+    const live = lstatOrNull(target) && !lstatOrNull(target).isSymbolicLink() ? liveLockIn(target) : null;
+    if (live) throw lockError(`[SYM] A live process (PID ${live.pid ?? 'unknown'}) runs in ${target}; stop it before importing ${nodeId}. Nothing was changed.`, live);
+    if (v.verdict === 'empty' || v.verdict === 'locks') {
+      const lock = readLockFile(path.join(target, 'lock.pid'));
+      if (lock) removeStaleLock(path.join(target, 'lock.pid'), lock);
+      clearDeadLockArtifacts(target);
+      try { fs.rmdirSync(target); } catch { /* look again */ }
+      continue;
+    }
+    const r = setHuskAside(target, { nodeId, holdsIdentity: false, source: { nodeId }, inUse: false, src: null, forImport: true });
+    if (r.live) throw lockError(`[SYM] A live process (PID ${r.live.pid ?? 'unknown'}) runs in ${target}; stop it before importing ${nodeId}. Nothing was changed.`, r.live);
+    if (r.aside) aside = r.aside;
+  }
+  throw new Error(`[SYM] could not make ${target} free for the import: what was there kept changing; nothing was overwritten.`);
+}
+
+/**
+ * After the node is in place: from the husk set aside at `aside`, the files that are the same as the node's are removed
+ * (they are in the node), and the ones that differ are kept there and reported. An aside left with nothing in it goes.
+ */
+function reportHusk(aside, nodeDir, nodeId) {
+  if (!aside || lstatOrNull(aside).isSymbolicLink()) return { aside, kept: aside ? ['(a link)'] : [] };
+  const kept = [];
+  const walk = (rel) => {
+    let names = [];
+    try { names = fs.readdirSync(path.join(aside, rel)); } catch { return; }
+    for (const n of names) {
+      const r = rel ? path.join(rel, n) : n;
+      const p = path.join(aside, r);
+      const st = lstatOrNull(p);
+      if (!st) continue;
+      if (st.isDirectory()) { walk(r); try { fs.rmdirSync(p); } catch { /* not empty: kept */ } continue; }
+      if (!rel && isLockArtifact(n)) {
+        const l = readLockFile(p);
+        if (!l || !lockIsHeldByLiveProcess(l)) { try { fs.unlinkSync(p); } catch { /* */ } continue; }
+      }
+      if (st.isFile() && sameBytes(p, path.join(nodeDir, r))) { try { fs.unlinkSync(p); } catch { kept.push(r); } continue; }
+      kept.push(r);
+    }
+  };
+  walk('');
+  try { fs.rmdirSync(aside); return { aside: null, kept: [] }; } catch { /* kept */ }
+  fsyncDir(path.dirname(aside));
+  try {
+    process.emitWarning(`[SYM] ${nodeId}: a directory an earlier release made at by-id/${nodeId} without the identity was set aside at ${aside}; ` +
+      `${kept.length} file(s) in it differ from the agent's and are kept there: ${kept.slice(0, 8).join(', ')}${kept.length > 8 ? ', …' : ''}. The agent runs on its own files.`,
+    { code: 'SYM_HUSK_SET_ASIDE' });
+  } catch { /* */ }
+  return { aside, kept };
+}
+
+/** Two regular files hold the same bytes (read in pieces: a store file can be large). */
+function sameBytes(a, b) {
+  const sa = statOrNull(a); const sb = statOrNull(b);
+  if (!sa || !sb || !sa.isFile() || !sb.isFile() || sa.size !== sb.size) return false;
+  let fa; let fb;
+  try {
+    fa = fs.openSync(a, 'r'); fb = fs.openSync(b, 'r');
+    const ba = Buffer.alloc(Math.min(sa.size, 1 << 20) || 1); const bb = Buffer.alloc(ba.length);
+    for (let pos = 0; pos < sa.size;) {
+      const na = fs.readSync(fa, ba, 0, ba.length, pos); const nb = fs.readSync(fb, bb, 0, bb.length, pos);
+      if (na !== nb || na === 0 || ba.compare(bb, 0, nb, 0, na) !== 0) return false;
+      pos += na;
+    }
+    return true;
+  } catch { return false; } finally {
+    if (fa !== undefined) fs.closeSync(fa);
+    if (fb !== undefined) fs.closeSync(fb);
+  }
+}
+
+/** Free bytes for a new file in `dir`, or null where it cannot be told. */
+function freeBytes(dir) {
+  if (typeof fs.statfsSync !== 'function') return null;
+  for (let d = path.resolve(dir); ; d = path.dirname(d)) {
+    try { const s = fs.statfsSync(d); return Number(s.bavail) * Number(s.bsize); } catch { if (path.dirname(d) === d) return null; }
+  }
+}
+
+/**
+ * Across volumes, an identity directory is not linked but its small key files are copied (identity.json, and the 0.13
+ * e2e-keypair.json when it is there): staged beside `target`, synced, read back and compared, committed by one rename.
+ * The space is checked first; the source is never changed.
+ */
+function copyIdentityFiles(src, target, o) {
+  const files = PRIVATE_KEY_FILES.filter((f) => fs.existsSync(path.join(src, f)));
+  const data = files.map((f) => fs.readFileSync(path.join(src, f)));
+  const need = data.reduce((n, b) => n + b.length, 0) + 64 * 1024;
+  const free = freeBytes(path.dirname(target));
+  if (free !== null && free < need) {
+    throw new IdentityHaltError(o.name, path.join(src, 'identity.json'),
+      `the identity directory ${src} is on another volume than ${path.dirname(target)}, so its key files are copied, and that volume has ${free} bytes free; ${need} are needed. Nothing was changed.`,
+      `Free at least ${need} bytes on the volume of ${path.dirname(target)} and start again.`);
+  }
+  const staging = makeStaging(path.dirname(target), o.nodeId);
+  try {
+    files.forEach((f, i) => writeNewFileSynced(path.join(staging, f), data[i], 0o600));
+    fsyncDir(staging);
+    files.forEach((f, i) => {
+      if (!fs.readFileSync(path.join(staging, f)).equals(data[i])) throw new Error(`[SYM] the copy of ${path.join(src, f)} does not read back as its source; nothing was installed, the source is untouched`);
+    });
+    try { fs.renameSync(staging, target); } catch (e) { if (e.code === 'ENOENT' || RENAME_TAKEN.has(e.code)) return 'retry'; throw e; }
+    if (o.committed) o.committed('copied');
+    fsyncDir(path.dirname(target));
+    return 'copied';
+  } finally {
+    fs.rmSync(staging, { recursive: true, force: true });
+  }
+}
+
+/**
+ * True when a link under `dir` is relative and leads out of `dir`: moved one level deeper (nodes/<name> ->
+ * nodes/by-id/<nodeId>) it would lead somewhere else, so such a directory is linked to, never moved. One readdir per
+ * directory (the entry types come with it); links to directories are not followed.
+ */
+function hasEscapingLink(dir) {
+  const root = path.resolve(dir);
+  const within = (p) => { const r = path.relative(root, p); return r === '' || (!r.startsWith('..') && !path.isAbsolute(r)); };
+  const walk = (d) => {
+    let entries = [];
+    try { entries = fs.readdirSync(d, { withFileTypes: true }); } catch { return false; }
+    for (const e of entries) {
+      const p = path.join(d, e.name);
+      if (e.isSymbolicLink()) {
+        let t = null;
+        try { t = fs.readlinkSync(p); } catch { continue; }
+        if (!path.isAbsolute(t) && !within(path.resolve(d, t))) return true;
+      } else if (e.isDirectory() && walk(p)) return true;
+    }
+    return false;
+  };
+  return walk(root);
+}
+
+/**
+ * Move the 0.13 directory `src` in as `target`: ONE rename on its volume (atomic, no disk). A 0.13 directory that is a
+ * link, a mount point, on another volume than `target`, or holds a relative link that leads out of it, is not copied:
+ * `target` becomes a link to the directory it is (absolute), so the store stays where its operator put it. An identity directory across volumes has its key files
+ * copied instead (copyIdentityFiles). Returns 'renamed' | 'linked' | 'copied', or 'retry' when what is there changed.
+ */
+function moveInto(src, target, o) {
+  const l = lstatOrNull(src);
+  if (!l) return 'retry';
+  // `o.committed(how)` runs right after the one call that installs `target`, before anything else (the syncs included): it
+  // puts the compat links in place, so the moment in which a 0.14.2 or 0.13 build finds neither is one call wide.
+  const linkTo = (dir) => {
+    try { fs.symlinkSync(dir, target, linkType()); } catch (e) { if (e.code === 'EEXIST') return 'retry'; throw e; }
+    if (o.committed) o.committed('linked');
+    fsyncDir(path.dirname(target));
+    return 'linked';
+  };
+  if (l.isSymbolicLink()) {
+    let real;
+    try { real = fs.realpathSync(src); } catch { return 'retry'; }
+    return linkTo(real);
+  }
+  if (!l.isDirectory()) return 'retry';
+  const crossing = isMountPoint(src) || deviceOf(src) !== deviceOf(path.dirname(target));
+  if (!crossing && hasEscapingLink(src)) return linkTo(fs.realpathSync(src));
+  if (!crossing) {
     try {
-      fs.symlinkSync(path.join('by-id', nodeId), tmp, process.platform === 'win32' ? 'junction' : 'dir');
-    } catch {
-      // No link can be made here: the 0.13 directory stays where it is (a 0.13 rollback still reads it), and the
-      // next start tries again. The identity is installed and the name claimed either way.
+      fs.renameSync(src, target);
+      if (o.committed) o.committed('renamed');
+      fsyncDir(path.dirname(target));
+      fsyncDir(path.dirname(src));
+      return 'renamed';
+    } catch (e) {
+      if (e.code === 'ENOENT' || RENAME_TAKEN.has(e.code)) return 'retry';
+      if (e.code !== 'EXDEV' && e.code !== 'EBUSY') throw e;
+    }
+  }
+  if (o.kind === 'identity') return copyIdentityFiles(src, target, o);
+  return linkTo(fs.realpathSync(src));
+}
+
+/**
+ * Make `target` the directory of `o.nodeId`, from the 0.13 directory `src` (null: none). Returns
+ *   { state: 'placed', how, husk } — this call moved it in; { state: 'already' } — it is in place (moved by another
+ *   start, or `target` is a link to `src` itself); { state: 'duplicate' } — the same identity is installed and in use,
+ *   and `src` is a second copy; { state: 'conflict', reason, halt } — another identity is filed under the nodeId;
+ *   { state: 'live', lock } — a live process runs in a husk at `target`.
+ * A husk at `target` is set aside first (setHuskAside); an empty one, or one holding only a stale lock, is replaced.
+ */
+/** The 0.13 directory `src` is still there as itself: not gone, and not replaced by the compat link a start put in its place. */
+const sourcePresent = (src) => Boolean(src && lstatOrNull(src) && !compatLinkNodeId(src));
+
+function place(src, target, o) {
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  let husk = null;
+  const until = Date.now() + LOCK_CORRUPT_GRACE_MS + 1000; // a lock artifact still being written is waited for, no longer
+  for (let attempt = 0; attempt < 40 || Date.now() < until; attempt++) {
+    const srcHere = sourcePresent(src);
+    const v = judgeTarget(target, o);
+    if (v.verdict !== 'absent' && srcHere && sameDir(src, target)) return { state: 'already', husk };
+    if (v.verdict === 'other') return { state: 'conflict', reason: v.reason, halt: Boolean(v.halt) };
+    if (!srcHere) {
+      if (v.verdict === 'same' || (!o.holdsIdentity && v.verdict !== 'absent')) return { state: 'already', husk };
+      if (!src && v.verdict === 'absent') { fs.mkdirSync(target, { mode: 0o700 }); fs.chmodSync(target, 0o700); return { state: 'placed', how: 'made', husk }; }
+      if (attempt < 20) { pause(5); continue; } // another start is between its steps
+      return { state: 'gone', husk };
+    }
+    if (v.verdict === 'same' && o.inUse) return { state: 'duplicate', husk };
+    if (v.verdict === 'empty') {
+      try { fs.rmdirSync(target); } catch (e) { if (e.code !== 'ENOENT' && e.code !== 'ENOTEMPTY' && e.code !== 'EEXIST') throw e; }
       continue;
     }
-    let went = null;
-    try { went = setAside(at, root, name); } catch { /* the identity is installed and indexed: the next start sets it aside */ } finally {
-      try { fs.renameSync(tmp, at); } catch { try { removeLink(tmp); } catch { /* */ } }
-      linkCompat(at, nodeId);
+    if (v.verdict === 'locks') {
+      const live = liveLockIn(target);
+      if (live) return { state: 'live', lock: live };
+      const lock = readLockFile(path.join(target, 'lock.pid'));
+      if (lock) removeStaleLock(path.join(target, 'lock.pid'), lock);
+      clearDeadLockArtifacts(target);
+      try { fs.rmdirSync(target); } catch { pause(attempt > 4 ? 20 : 2); }
+      continue;
     }
-    if (went) {
-      aside.push(went);
-      securePrivateFiles([went], { narrowDirs: !src.link });
+    if (v.verdict === 'husk' || v.verdict === 'same') {
+      const r = setHuskAside(target, { ...o, src });
+      if (r.live) return { state: 'live', lock: r.live };
+      if (r.aside) husk = r.aside;
+      continue;
     }
+    const how = moveInto(src, target, o);
+    if (how === 'retry') continue;
+    return { state: 'placed', how, husk };
   }
-  return aside;
+  throw new Error(`[SYM] could not install ${target}: what was there kept changing; nothing was overwritten. Start again.`);
 }
 
 /**
- * Copy one 0.13 node (`nodes/<name>/`, and its identity at `SYM_IDENTITY_DIR/<name>/` when that is set) to
- * `nodes/by-id/<nodeId>/` (and `SYM_IDENTITY_DIR/by-id/<nodeId>/`), and COMMIT it: the copy is staged beside
- * its destination, identity.json last, synced, verified byte for byte against the source, and installed by one
- * rename. Of several starts doing this at once each stages its own copy, one rename wins, and the rest find
- * the same identity installed and discard theirs: nothing is moved, so nothing can be lost between two of
- * them. Then the name is claimed (an exclusive create of its index entry), the 0.13 directory is renamed aside
- * to `.legacy-0.13/<name>` (kept, never deleted), and `nodes/<name>` becomes a link to the by-id directory for
- * one release (a 0.13 rollback reads the old path).
- *
- * A by-id directory already there without the commit record (an empty one, a lock, an earlier release's
- * interrupted move, a node that ran there without its identity) is merged into the staged copy and replaced
- * through the same commit, never read as "the identity is in place". One that holds a DIFFERENT identity, or a
- * file that differs, is a second claim on the nodeId: 'skipped-duplicate', and nothing is changed. A 0.13
- * process running in the directory (its lock live): 'skipped-live', nothing changed (the start refuses with
- * EIDENTITYLOCK). An identity this host exported (tombstoned): 'tombstoned'.
+ * Migrate the 0.13 agent under `name` (`nodes/<name>/`, and its identity at `SYM_IDENTITY_DIR/<name>/` when that is
+ * set) to `nodes/by-id/<nodeId>` (and `SYM_IDENTITY_DIR/by-id/<nodeId>`) by MOVING it: one rename of the whole directory
+ * on its volume (place, moveInto), the node directory first and the identity last. The identity in place IS the commit:
+ * from then on the agent exists by its nodeId. Right after the commit the 0.13 path becomes a compat link (made before
+ * the commit, so it is one rename), then the name is claimed (an exclusive create of its index entry).
  *
- * A 0.13 identity file is read with the same parser a load uses, so one that exists and cannot be established
- * (unreadable, not JSON, no nodeId) HALTS (IdentityHaltError). A 0.13 identity in `nodes/<name>/` while
- * SYM_IDENTITY_DIR is set and it is not in `SYM_IDENTITY_DIR/<name>/` HALTS: it is neither where the identity dir
- * looks nor safe to leave for a mint.
+ * Of several starts doing this at once, one rename wins and the others find the identity in place. A by-id directory an
+ * earlier release left without the identity (a husk) is set aside whole first and reported (setHuskAside, reportHusk).
+ * A 0.13 directory that is a link, a mount point or on another volume is not copied: by-id/<nodeId> becomes a link to it.
  *
- * `onlyNodeId`: a start pinned to a nodeId migrates the directory under `name` only if its identity IS that
- * nodeId; another agent's directory is left as it is ('skipped-duplicate').
- * @returns {{ status: 'moved'|'indexed'|'already'|'not-a-node'|'skipped-live'|'skipped-duplicate'|'tombstoned', nodeId?: string, reason?: string }}
+ * Refusals change nothing: a 0.13 process running in the directory ('skipped-live'); another identity filed under the
+ * nodeId, or the name given to another agent by the index ('skipped-duplicate'); an identity this host exported
+ * ('tombstoned'); a start pinned to another nodeId ('other-agent': the 0.13 agent is left for its own start); another
+ * agent whose name is this one but for case ('fold-collision'). A 0.13 identity file that cannot be read halts.
+ * @returns {{ status: string, nodeId?: string, reason?: string, holderPid?: number, husk?: object }}
  * @private
  */
 function migrateName(name, onlyNodeId) {
   const srcs = legacySources(name);
   if (!srcs.nodes && !srcs.ids) {
-    const linked = compatLinkNodeId(path.join(NODES_DIR, name));
-    const held = nodeIdForName(name);
-    if (held) return { status: 'already', nodeId: held };
-    if (linked && identityInPlace(linked) && !indexEntries().has(linked) && (!onlyNodeId || linked === onlyNodeId)) {
-      return claimName(name, linked) === linked ? { status: 'indexed', nodeId: linked } : { status: 'skipped-duplicate', nodeId: linked, reason: 'another start claimed the name first' };
-    }
-    return { status: 'not-a-node' };
+    const e = entryFor(name);
+    return e.state === 'ok' && isCommitted(e.nodeId) ? { status: 'already', nodeId: e.nodeId } : { status: 'not-a-node' };
   }
   const idFile = srcs.ids && path.join(srcs.ids.path, 'identity.json');
   const inNodeDir = srcs.nodes && path.join(srcs.nodes.path, 'identity.json');
@@ -1237,66 +1318,143 @@ function migrateName(name, onlyNodeId) {
   const read = parseIdentity(readIdentityText(idFile, name), name, idFile); // halts on an identity it cannot establish
   const nodeId = read.identity.nodeId;
   if (!isNodeIdText(nodeId)) throw new IdentityHaltError(name, idFile, `the nodeId ${JSON.stringify(String(nodeId).slice(0, 40))} cannot name a directory under nodes/by-id`);
-  // The operator copied the identity to SYM_IDENTITY_DIR as the halt above says, and kept the original: the
-  // two must be one identity. The copy in the node directory is left out of the node directory's copy.
+  // The operator copied the identity to SYM_IDENTITY_DIR as the halt above says, and kept the original: one identity.
   if (srcs.idRoot && inNodeDir && fs.existsSync(inNodeDir)) {
     const other = parseIdentity(readIdentityText(inNodeDir, name), name, inNodeDir).source;
-    if (!sameIdentity(read.source, other) || !sameIdentity(other, read.source)) {
+    if (!sameIdentityBothWays(read.source, other)) {
       throw new IdentityHaltError(name, inNodeDir, `two different identities sit under "${name}": ${idFile} (${nodeId}) and ${inNodeDir} (${other.nodeId}). Nothing was moved; keep the one that is this agent.`);
     }
   }
-  if (onlyNodeId && nodeId !== onlyNodeId) return { status: 'skipped-duplicate', nodeId, reason: `the 0.13 identity under "${name}" is ${nodeId}, not the pinned ${onlyNodeId}; it was left as it is` };
-  const held = nodeIdForName(name);
-  if (held && held !== nodeId) return { status: 'skipped-duplicate', nodeId, reason: `the name "${name}" already indexes node ${held}; the 0.13 identity ${nodeId} under it was left as it is` };
+  if (onlyNodeId && nodeId !== onlyNodeId) return { status: 'other-agent', nodeId, reason: `the 0.13 directory of "${name}" holds the agent ${nodeId}, not the pinned ${onlyNodeId}; it was left as it is` };
   const tomb = readTombstone(nodeId);
   if (tomb) return { status: 'tombstoned', nodeId, tomb };
-  const lock = srcs.nodes ? takeLegacyLock(srcs.nodes.path) : { release() {} };
-  if (lock.liveHolder) return { status: 'skipped-live', nodeId, holderPid: lock.liveHolder };
-  let aside = [];
+  const f = foldName(name);
+  // The name already given to another agent by the index: a stray 0.13 directory under exactly that agent's name is left
+  // as it is; one under a name that differs only in case is a second agent (a case-sensitive file system let both exist).
+  const e = entryFor(name);
+  if (e.state === 'conflict') return { status: 'fold-collision', nodeId, reason: `two index entries answer to "${name}": ${e.entries.map((x) => `${x.file} (${x.nodeId})`).join(', ')}` };
+  if (e.state === 'ok' && e.nodeId !== nodeId && isCommitted(e.nodeId)) {
+    const c = readCommitted(e.nodeId);
+    const theirs = e.name || (c.state === 'ok' && c.name) || name; // the exact name the entry is for
+    if (theirs !== name && foldName(theirs) === f) return { status: 'fold-collision', nodeId, reason: `the name "${theirs}" of the agent ${e.nodeId} is this name but for case` };
+    return { status: 'skipped-duplicate', nodeId, reason: `the name "${name}" already indexes node ${e.nodeId}; the 0.13 identity ${nodeId} under it was left as it is` };
+  }
+  const others = namedHere(scanCommitted(), f, nodeId);
+  if (others.length) {
+    const exact = others.find((o) => o.name === name);
+    return { status: exact ? 'skipped-duplicate' : 'fold-collision', nodeId,
+      reason: `the agent${others.length > 1 ? 's' : ''} ${others.map((o) => `${o.nodeId} ("${o.name}")`).join(', ')} already ${others.length > 1 ? 'have' : 'has'} this name; the 0.13 identity ${nodeId} under "${name}" was left as it is` };
+  }
+  // A 0.13 process running in its directory holds its lock there: refuse, change nothing.
+  if (srcs.nodes) {
+    const lock = readLockFile(path.join(srcs.nodes.path, 'lock.pid'));
+    if (lock && !lock.migrating && lock.pid !== process.pid && lockIsHeldByLiveProcess(lock)) return { status: 'skipped-live', nodeId, holderPid: lock.pid };
+  }
+  // The identity's own name, for a scan to find it by: a 0.13 file named otherwise (copied under another name) is
+  // renamed in place first, atomically, its key untouched (the commit below must carry the name).
+  if (read.source.name === undefined || typeof read.source.name !== 'string' || foldName(read.source.name) !== f) {
+    writeFileAtomic0600(idFile, JSON.stringify({ ...read.source, name }, null, 2));
+    read.source.name = name;
+  }
+  const nodeTarget = nodeDirById(nodeId);
+  const idTarget = identityDirById(nodeId);
+  const split = idTarget !== nodeTarget;
+  const inUse = (e.state === 'ok' && e.nodeId === nodeId) || indexEntries().has(nodeId);
+  const base = { nodeId, source: read.source, name, inUse };
+  const out = { status: 'already', nodeId };
+  const conflict = (r) => ({ status: 'skipped-duplicate', nodeId, reason: `the 0.13 identity under "${name}" was not migrated: ${r.reason}`, halt: r.halt });
+  const live = (r) => ({ status: 'husk-live', nodeId, holderPid: r.lock && r.lock.pid });
+  // The 0.13 paths become compat links right after the commit: the links are made now, so that is one rename each. A 0.13
+  // directory is never moved out from under a path that no link can then take (a 0.13 or 0.14.2 build reads it there).
+  const tmpLinks = [];
+  const linkFor = (root, src) => {
+    if (!src || (!src.link && isMountPoint(src.path))) return null; // a mount point stays where it is: no link takes its place
+    const t = makeTempLink(path.join(root, name), nodeId);
+    if (!t) {
+      throw new Error(`[SYM] cannot make the link ${path.join(root, name)} -> by-id/${nodeId} that takes the place of the 0.13 directory ` +
+        `(the file system refused a symbolic link there), so "${name}" was not migrated; nothing was moved. A state root needs a file system that holds links.`);
+    }
+    tmpLinks.push(t);
+    return t;
+  };
   try {
-    const nodeTarget = nodeDirById(nodeId);
-    const idTarget = identityDirById(nodeId);
-    const split = idTarget !== nodeTarget;
-    const text = JSON.stringify(read.identity, null, 2);
-    try {
-      commitCopy(srcs.nodes && srcs.nodes.path, nodeTarget, { nodeId, identityText: split ? null : text, source: read.source, holdsIdentity: !split, from: `0.13 nodes/${name}` });
-      if (split) commitCopy(srcs.ids.path, idTarget, { nodeId, identityText: text, source: read.source, holdsIdentity: true, from: `0.13 SYM_IDENTITY_DIR/${name}` });
-    } catch (e) {
-      if (e instanceof CommitConflict) return { status: 'skipped-duplicate', nodeId, reason: `the 0.13 identity under "${name}" was not migrated: ${e.message}` };
-      throw e;
+    const husks = [];
+    const nodesLink = linkFor(NODES_DIR, srcs.nodes);
+    if (split) {
+      const idLink = linkFor(srcs.idRoot, srcs.ids);
+      const n = place(srcs.nodes && srcs.nodes.path, nodeTarget, { ...base, holdsIdentity: false, kind: 'node' });
+      if (n.state === 'conflict') return conflict(n);
+      if (n.state === 'live') return live(n);
+      if (n.husk) husks.push([n.husk, nodeTarget]);
+      // Right after the commit: SYM_IDENTITY_DIR/<name> first (0.14.2 finds the agent by it), then nodes/<name>.
+      const committed = (how) => {
+        if (how !== 'copied') putTempLink(idLink, path.join(srcs.idRoot, name));
+        if (n.state === 'placed' && (n.how === 'renamed' || (n.how === 'linked' && srcs.nodes.link))) putTempLink(nodesLink, path.join(NODES_DIR, name));
+      };
+      const c = place(srcs.ids.path, idTarget, { ...base, holdsIdentity: true, kind: 'identity', committed }); // THE COMMIT
+      if (c.state === 'conflict') return conflict(c);
+      if (c.state === 'live') return live(c);
+      if (c.husk) husks.push([c.husk, idTarget]);
+      if (c.state === 'placed') { out.status = 'moved'; securePrivateFiles([idTarget], { narrowDirs: true }); }
+      // The key's 0.13 copy, where it is not the commit: set aside (narrowed), and the link in its place.
+      if (c.state === 'duplicate' || (c.state === 'placed' && c.how === 'copied')) {
+        if (srcs.ids.link) putTempLink(idLink, path.join(srcs.idRoot, name));
+        else setLegacyAside(srcs.ids.path, srcs.idRoot, name, () => putTempLink(idLink, path.join(srcs.idRoot, name)));
+      }
+      if (n.state === 'duplicate' && srcs.nodes) setLegacyAside(srcs.nodes.path, NODES_DIR, name, () => putTempLink(nodesLink, path.join(NODES_DIR, name)));
+    } else {
+      const committed = (how) => { if (how === 'renamed' || srcs.nodes.link) putTempLink(nodesLink, path.join(NODES_DIR, name)); }; // right after the commit
+      const c = place(srcs.nodes.path, nodeTarget, { ...base, holdsIdentity: true, kind: 'node', committed }); // THE COMMIT
+      if (c.state === 'conflict') return conflict(c);
+      if (c.state === 'live') return live(c);
+      if (c.husk) husks.push([c.husk, nodeTarget]);
+      if (c.state === 'placed') {
+        out.status = 'moved';
+        securePrivateFiles([nodeTarget], { narrowDirs: true });
+      }
+      if (c.state === 'duplicate') {
+        if (srcs.nodes.link) putTempLink(nodesLink, path.join(NODES_DIR, name));
+        else setLegacyAside(srcs.nodes.path, NODES_DIR, name, () => putTempLink(nodesLink, path.join(NODES_DIR, name)));
+      }
+    }
+    // Moved in by another start meanwhile, or the 0.13 directory went elsewhere: nothing is claimed for an identity not in place.
+    if (!isCommitted(nodeId)) return { status: 'gone', nodeId, reason: `the 0.13 directory of "${name}" is no longer there and ${nodeId} is not installed` };
+    // The name, claimed once the identity is in place. Of two starts, the second finds the entry made.
+    const winner = claimName(name, nodeId, name);
+    if (winner && winner !== nodeId) {
+      out.reason = `the name "${name}" was claimed for node ${winner} meanwhile`;
+      out.claimedBy = winner;
     }
-    // The record that the name is this node: claimed once the identity is installed. Of two starts, the
-    // second finds the entry made and loads what it names.
-    const winner = claimName(name, nodeId);
-    if (winner !== nodeId) return { status: 'skipped-duplicate', nodeId, reason: `the name "${name}" was claimed for node ${winner} meanwhile` };
-    aside = setAsideAndLink(name, nodeId, srcs);
     securePrivateFiles([nodeTarget, idTarget], { narrowDirs: true });
-    return { status: 'moved', nodeId };
+    out.husks = husks.map(([aside, dir]) => reportHusk(aside, dir, nodeId)).filter((h) => h.aside);
+    return out;
   } finally {
-    lock.release(aside);
+    for (const t of tmpLinks) { if (lstatOrNull(t)) { try { removeLink(t); } catch { /* */ } } }
   }
 }
 
 /**
  * Migrate the 0.13 directory of `name` to the by-id layout (see migrateName). Idempotent, safe from several
- * processes at once, and it takes no lock but the 0.13 directory's own.
+ * processes at once.
  * @param {string} name
  * @param {string} [onlyNodeId]
- * @returns {'moved'|'indexed'|'skipped-live'|'skipped-duplicate'|'not-a-node'|'already'|'tombstoned'}
+ * @returns {'moved'|'skipped-live'|'skipped-duplicate'|'not-a-node'|'already'|'tombstoned'|'other-agent'|'fold-collision'|'husk-live'}
  */
 function migrateNodeDir(name, onlyNodeId) {
   const problem = basicNameProblem(name);
   if (problem) throw new Error(problem);
+  clearLeftovers();
   return migrateName(name, onlyNodeId).status;
 }
 
 /**
- * Migrate every 0.13 node directory under the state root to the by-id layout (design D9, §6 of the
- * design: a one-time, idempotent copy). Safe to run at every start and from several processes.
- * @returns {{ moved: number, already: number, skippedLive: number, duplicates: number }}
+ * Migrate every 0.13 node directory under the state root to the by-id layout. Safe to run at every start and from
+ * several processes; an error of one node is counted (that node's own start raises it).
+ * @returns {{ moved: number, already: number, skippedLive: number, duplicates: number, errors: number }}
  */
 function migrateIdentities() {
-  const out = { moved: 0, already: 0, skippedLive: 0, duplicates: 0 };
+  const out = { moved: 0, already: 0, skippedLive: 0, duplicates: 0, errors: 0 };
+  clearLeftovers();
   const names = new Set();
   for (const root of [NODES_DIR, process.env.SYM_IDENTITY_DIR].filter(Boolean)) {
     let entries = [];
@@ -1305,47 +1463,108 @@ function migrateIdentities() {
   }
   for (const name of names) {
     let r;
-    try { r = migrateNodeDir(name); } catch { continue; }
+    try { r = migrateName(name).status; } catch { out.errors++; continue; }
     if (r === 'moved') out.moved++;
-    else if (r === 'already' || r === 'indexed') out.already++;
-    else if (r === 'skipped-live') out.skippedLive++;
-    else if (r === 'skipped-duplicate') out.duplicates++;
+    else if (r === 'already') out.already++;
+    else if (r === 'skipped-live' || r === 'husk-live') out.skippedLive++;
+    else if (r === 'skipped-duplicate' || r === 'fold-collision') out.duplicates++;
   }
   return out;
 }
 
 // ── Loading ──────────────────────────────────────────────────────────────
 
-/** Load the installed identity of `nodeId`: tombstone and export checked, file validated (halts, never mints). */
-function loadInstalled(nodeId, label, { allowPendingExport = false } = {}) {
+/**
+ * Whether the export `intent` produced a complete bundle: it says so (written after the bundle was renamed into place),
+ * or a file whose sha256 is the bundle's recorded hash is at its out (a crash between the two).
+ */
+function exportProducedBundle(intent) {
+  if (!intent) return false;
+  if (intent.complete === true) return true;
+  if (typeof intent.bundleHash !== 'string' || typeof intent.out !== 'string') return false;
+  try { return crypto.createHash('sha256').update(fs.readFileSync(intent.out)).digest('hex') === intent.bundleHash; } catch { return false; }
+}
+
+/**
+ * Refuse an identity that was moved away or is being moved (relocation.js), whatever else is true of it: an export
+ * that produced its bundle is a move (IdentityTombstonedError); one that did not yet is pending (IdentityExportPendingError).
+ */
+function assertStartable(nodeId) {
+  const intent = readExportIntent(nodeId);
   const tomb = readTombstone(nodeId);
-  if (tomb) throw new IdentityTombstonedError(nodeId, tomb);
-  if (!allowPendingExport) {
-    const intent = readExportIntent(nodeId);
-    if (intent) throw new IdentityExportPendingError(nodeId, intent);
-  }
-  const idPath = path.join(identityDirById(nodeId), 'identity.json');
+  if (intent && !exportProducedBundle(intent)) throw new IdentityExportPendingError(nodeId, intent, tomb);
+  if (tomb || intent) throw new IdentityTombstonedError(nodeId, tomb || { movedAt: intent.startedAt, bundle: intent.out }, intent);
+}
+
+/** Load the committed identity of `nodeId`: export and tombstone checked, file validated (halts, never mints), modes narrowed. */
+function loadInstalled(nodeId, label, { allowPendingExport = false } = {}) {
+  if (!allowPendingExport) assertStartable(nodeId);
+  const idPath = identityFileById(nodeId);
   const identity = readIdentityFile(idPath, label);
   if (identity.nodeId !== nodeId) throw new IdentityHaltError(label, idPath, `identity.json names ${identity.nodeId}, not ${nodeId}`);
-  securePrivateFiles([nodeDirById(nodeId)]); // the 0.13 E2E keypair beside it, when the identity lives elsewhere
+  const nodeDir = nodeDirById(nodeId);
+  securePrivateFiles([nodeDir], { narrowDirs: true }); // the store's directory, and the 0.13 E2E keypair in it
+  if (nodeDir !== path.dirname(idPath)) dropStrayKey(nodeDir, identity);
+  clearDeadLockTemps(nodeDir);
   return identity;
 }
 
-/** Where on this host an identity.json for `nodeId` is, other than where a load reads it. */
-function strayCopiesOf(nodeId) {
-  const out = [];
-  const where = new Set([path.join(NODES_DIR, 'by-id', nodeId)]);
-  if (process.env.SYM_IDENTITY_DIR) where.add(path.join(process.env.SYM_IDENTITY_DIR, 'by-id', nodeId));
-  where.delete(identityDirById(nodeId));
-  for (const root of [NODES_DIR, process.env.SYM_IDENTITY_DIR].filter(Boolean)) {
+/**
+ * With SYM_IDENTITY_DIR the private key belongs only in the identity directory. A copy of it left in the node directory
+ * (0.13 operators copied the key there and kept the original; 0.14.0 - 0.14.2 moved that copy along with the store) that
+ * is the very identity just read from its committed place is removed: the key is not lost, it is where it is kept. A copy
+ * that is anything else is left as it is (narrowed to 0600) for the operator.
+ */
+function dropStrayKey(nodeDir, identity) {
+  const f = path.join(nodeDir, 'identity.json');
+  const r = readJsonState(f);
+  if (r.state !== 'ok' || !r.j.privateKey || !sameIdentityBothWays(identity, r.j)) return;
+  try { fs.unlinkSync(f); fsyncDir(nodeDir); } catch { /* narrowed, and scrubbed by an export */ }
+}
+
+/** The temp files of locks a process that is gone was writing or removing, left in a node directory (a kill -9). */
+function clearDeadLockTemps(dir) {
+  let names = [];
+  try { names = fs.readdirSync(dir); } catch { return; }
+  for (const n of names) {
+    const m = /^\.lock\.pid.*\.(\d+)-[0-9a-f]+\.tmp$/.exec(n);
+    if (m && Number(m[1]) !== process.pid && !pidIsAlive(Number(m[1]))) { try { fs.unlinkSync(path.join(dir, n)); } catch { /* */ } }
+  }
+}
+
+/** The directories on this host other than the committed one that may hold a copy of `nodeId`'s key files. */
+function keyHoldersOf(nodeId) {
+  const out = new Set();
+  const idRoot = process.env.SYM_IDENTITY_DIR;
+  const byIdDirs = new Set([path.join(NODES_DIR, 'by-id'), idRoot && path.join(idRoot, 'by-id')].filter(Boolean));
+  for (const dir of byIdDirs) {
+    out.add(path.join(dir, nodeId));
     let names = [];
-    try { names = fs.readdirSync(path.join(root, LEGACY_ASIDE)); } catch { /* none */ }
-    for (const n of names) where.add(path.join(root, LEGACY_ASIDE, n));
+    try { names = fs.readdirSync(dir); } catch { continue; }
+    for (const n of names) if (n.startsWith(`.${nodeId}.husk`) || n.startsWith(`.${nodeId}.moved-`)) out.add(path.join(dir, n));
   }
-  for (const d of where) {
-    try { if (JSON.parse(fs.readFileSync(path.join(d, 'identity.json'), 'utf8')).nodeId === nodeId) out.push(path.join(d, 'identity.json')); } catch { /* none */ }
+  const holds = (d) => { try { return JSON.parse(fs.readFileSync(path.join(d, 'identity.json'), 'utf8')).nodeId === nodeId; } catch { return false; } };
+  for (const root of [NODES_DIR, idRoot].filter(Boolean)) {
+    let names = [];
+    try { names = fs.readdirSync(path.join(root, LEGACY_ASIDE)); } catch { /* none */ }
+    for (const n of names) if (holds(path.join(root, LEGACY_ASIDE, n))) out.add(path.join(root, LEGACY_ASIDE, n));
+    // A 0.13 directory left in place (a mount point an identity was copied from, a store linked to): it holds a copy.
+    try { names = fs.readdirSync(root); } catch { names = []; }
+    for (const n of names) {
+      if (n.startsWith('.') || n === 'by-id' || n === 'by-name') continue;
+      const p = path.join(root, n);
+      const st = lstatOrNull(p);
+      if (st && st.isDirectory() && !st.isSymbolicLink() && holds(p)) out.add(p);
+    }
   }
-  return out;
+  return [...out];
+}
+
+/** Where on this host an identity.json for `nodeId` is, other than where a load reads it. */
+function strayCopiesOf(nodeId) {
+  const committed = identityFileById(nodeId);
+  return keyHoldersOf(nodeId).map((d) => path.join(d, 'identity.json'))
+    .filter((f) => f !== committed && (() => { try { return JSON.parse(fs.readFileSync(f, 'utf8')).nodeId === nodeId; } catch { return false; } })());
 }
 
 /**
@@ -1354,94 +1573,200 @@ function strayCopiesOf(nodeId) {
  * where, and never tells the operator to remove the index entry.
  */
 function indexedButMissing(name, nodeId, { indexed = true } = {}) {
-  const idPath = path.join(identityDirById(nodeId), 'identity.json');
+  const idPath = identityFileById(nodeId);
   const copies = strayCopiesOf(nodeId);
   const link = path.join(NODES_DIR, name);
   const what = indexed ? `the name "${name}" indexes node ${nodeId}, and its identity.json is not where it is read` : `the identity ${nodeId} is not installed where it is read`;
+  const dir = identityDirById(nodeId);
+  const l = lstatOrNull(dir);
+  const dangling = l && l.isSymbolicLink() && !statOrNull(dir) ? ` (${dir} is a link to ${fs.readlinkSync(dir)}, which is not there: is its volume mounted?)` : '';
   if (copies.length) {
     return new IdentityHaltError(name, idPath,
-      `${what}; it IS on this host, at ${copies.join(' and ')}.`,
+      `${what}${dangling}; it IS on this host, at ${copies.join(' and ')}.`,
       `Put a copy of it at ${idPath} (keep the original until the agent has started)` +
       `${process.env.SYM_IDENTITY_DIR ? ', or unset SYM_IDENTITY_DIR if this agent\'s key was never meant to live there' : ''}. Do not remove the name's index entry: the key is this agent.`);
   }
   return new IdentityHaltError(name, idPath,
-    `${what}, and no copy of it is on this host. ` +
+    `${what}${dangling}, and no copy of it is on this host. ` +
     'If SYM_IDENTITY_DIR changed or its volume is not mounted, restore that.',
     `Restore the keypair from your durable copy to ${idPath} and start again. If this agent's key is gone for good, it cannot return as "${name}"; ` +
     `to let the name start again as a DIFFERENT agent, remove ${nameIndexPath(name)} and the link ${link}.`);
 }
 
 /**
- * What on this host belongs to `name` without being an installed, indexed identity: each is a reason not to
- * mint. `{ identity: bool, text }`: `identity` when it holds an identity (a halt says so; never "absent").
+ * What on this host is a claim on `name` besides a committed identity named so: each is a reason not to mint.
+ * `{ kind, identity, nodeId, text, committed?, live?, other? }`: `identity` when it holds (or may hold) an identity.
  */
-function nameTraces(name, migration, scan = { indexed: indexEntries(), installed: identitiesOnDisk() }) {
+function nameTraces(name, entry, migration) {
+  const f = foldName(name);
   const out = [];
-  const indexed = scan.indexed;
   const idRoot = process.env.SYM_IDENTITY_DIR;
+  const idOf = (d) => { try { const j = JSON.parse(fs.readFileSync(path.join(d, 'identity.json'), 'utf8')); return { nodeId: j.nodeId, name: j.name }; } catch { return null; } };
+  if (entry && entry.state === 'unreadable') out.push({ kind: 'entry', identity: true, nodeId: null, text: `the index entry ${entry.file} exists, but ${entry.why}` });
+  if (migration && ['skipped-duplicate', 'other-agent', 'gone'].includes(migration.status)) {
+    out.push({ kind: 'migration', identity: true, other: true, nodeId: migration.nodeId, text: `a 0.13 identity (${migration.nodeId}) sits under "${name}" and was not migrated (${migration.reason || migration.status})` });
+  }
   for (const [root, label] of [[NODES_DIR, 'nodes'], [idRoot, 'SYM_IDENTITY_DIR']]) {
     if (!root) continue;
-    const at = path.join(root, name);
-    const st = lstatOrNull(at);
-    if (st) {
+    let names = [];
+    try { names = fs.readdirSync(root).filter((n) => !n.startsWith('.') && n !== 'by-id' && n !== 'by-name' && foldName(n) === f); } catch { /* none */ }
+    for (const n of names) {
+      const at = path.join(root, n);
+      const st = lstatOrNull(at);
+      if (!st) continue;
       const linked = compatLinkNodeId(at);
       if (linked) {
-        if (!identityInPlace(linked)) out.push({ identity: false, text: `${at} leads to by-id/${linked}, whose identity is not installed` });
-        else out.push({ identity: true, nodeId: indexed.has(linked) ? null : linked, text: `${at} leads to ${linked}${indexed.has(linked) ? `, which the index gives the name(s) ${indexed.get(linked).join(', ')}` : ''}` });
+        const committed = isCommitted(linked);
+        out.push({ kind: 'link', identity: committed, committed, nodeId: linked, text: `${at} leads to by-id/${linked}${committed ? '' : ', whose identity is not installed (is its volume mounted?)'}` });
       } else if (st.isSymbolicLink() || st.isDirectory()) {
         const l = legacyAt(at);
-        if (l && fs.existsSync(path.join(l.path, 'identity.json'))) {
-          out.push({ identity: true, legacy: true, text: `a 0.13 identity sits in ${at}${migration && migration.reason ? ` and was not migrated (${migration.reason})` : ''}` });
-        } else if (st.isSymbolicLink()) {
-          out.push({ identity: false, text: `${at} is a link to ${fs.readlinkSync(at)} with no identity in it` });
-        } else if (hasContent(at)) {
-          out.push({ identity: false, text: `${at} holds a node's files (${fs.readdirSync(at).filter((n) => n !== 'lock.pid').slice(0, 4).join(', ')}) and no identity` +
-            `${label === 'nodes' && idRoot ? `, and ${path.join(idRoot, name, 'identity.json')} is not there (is the identity volume mounted?)` : ''}` });
+        const id = l && idOf(l.path);
+        if (id) out.push({ kind: 'legacy', identity: true, nodeId: id.nodeId, text: `a 0.13 identity (${id.nodeId}) sits in ${at}` });
+        else if (st.isSymbolicLink()) { let t = '?'; try { t = fs.readlinkSync(at); } catch { /* */ } out.push({ kind: 'dangling', identity: false, text: `${at} is a link to ${t} with no identity in it` }); }
+        else if (hasContent(at)) {
+          out.push({ kind: 'files', identity: false, text: `${at} holds a node's files (${fs.readdirSync(at).filter((x) => !isLockArtifact(x)).slice(0, 4).join(', ')}) and no identity` +
+            `${label === 'nodes' && idRoot ? `, and ${path.join(idRoot, n, 'identity.json')} is not there (is the identity volume mounted?)` : ''}` });
         }
       } else {
-        out.push({ identity: false, text: `${at} is a file, not a node directory` });
+        out.push({ kind: 'file', identity: false, text: `${at} is a file, not a node directory` });
       }
     }
     let aside = [];
-    try { aside = fs.readdirSync(path.join(root, LEGACY_ASIDE)).filter((n) => n === name || n.startsWith(`${name}.`)); } catch { /* none */ }
+    try { aside = fs.readdirSync(path.join(root, LEGACY_ASIDE)); } catch { /* none */ }
     for (const n of aside) {
+      const base = (/^(.*)\.\d+-[0-9a-f]{8}$/.exec(n) || [null, n])[1];
+      if (foldName(base) !== f) continue;
       const d = path.join(root, LEGACY_ASIDE, n);
-      let id = null;
-      try { id = JSON.parse(fs.readFileSync(path.join(d, 'identity.json'), 'utf8')).nodeId; } catch { /* */ }
-      out.push({ identity: Boolean(id), nodeId: id, text: `the 0.13 directory of "${name}" was set aside at ${d}${id ? ` (identity ${id})` : ''}` });
+      const id = idOf(d);
+      out.push({ kind: 'aside', identity: Boolean(id), nodeId: id && id.nodeId, text: `the 0.13 directory of "${base}" was set aside at ${d}${id ? ` (identity ${id.nodeId})` : ''}` });
     }
   }
-  for (const i of scan.installed) {
-    if (i.name !== name || indexed.has(i.nodeId) || i.scrubbed) continue;
-    out.push({ identity: true, nodeId: i.nodeId, text: `the identity ${i.nodeId} named "${name}" is installed at ${i.file} and no name indexes it` });
+  // Husks set aside, import archives, and the staging of a start under way, that hold an identity of this name.
+  for (const dir of new Set([path.join(NODES_DIR, 'by-id'), idRoot && path.join(idRoot, 'by-id')].filter(Boolean))) {
+    let names = [];
+    try { names = fs.readdirSync(dir); } catch { continue; }
+    for (const n of names) {
+      const m = /^\.([0-9A-Za-z][0-9A-Za-z_.-]*?)\.(husk|moved|stage|import|partial)(?:-|$)/.exec(n);
+      if (!m) continue;
+      const id = idOf(path.join(dir, n));
+      if (!id || typeof id.name !== 'string' || foldName(id.name) !== f || isCommitted(id.nodeId)) continue;
+      const staging = STAGING_RE.exec(n);
+      out.push({ kind: staging ? 'staging' : 'aside', identity: true, nodeId: id.nodeId, live: Boolean(staging && !leftoverIsDead(Number(staging[3]), path.join(dir, n))),
+        text: `${path.join(dir, n)} holds the identity ${id.nodeId} named "${id.name}"${staging ? ' (a start under way)' : ''}` });
+    }
   }
   return out;
 }
 
 /**
- * An installed identity the name provably belongs to though its index entry is missing: a compat link
- * `nodes/<name>` to it, or the one installed identity whose `name` is this name and that no name indexes
- * (a start that crashed between installing it and claiming the name; an entry lost). `{ many }` when more
- * than one fits. Nothing is adoptable while any trace of the name holds another identity, or a 0.13 identity
- * that was not migrated (`traces`, from nameTraces): that is two claims on the name, and a halt.
+ * Which committed identity `name` is. The index entry is a cache of the answer: when it is readable and names a
+ * committed identity, that is the answer (an entry 0.14.0 - 0.14.2 wrote for a rename or a pinned start, naming an
+ * identity under another name, included). When it is missing or cannot be read, the answer is re-derived from the
+ * committed identities (their `name`), with the compat link `nodes/<name>` as a second witness; with `write` the
+ * entry is then written again (claimed when missing, replaced when its content is not an entry; an entry that could
+ * not be read for an I/O error is left as it is). Never "no such agent" while something says otherwise:
+ *   { nodeId, via: 'index'|'scan', alias } — the agent; { nodeId, missing: true } — the entry names an identity that is
+ *   not in place (a halt, never a mint); { none: true, traces } — no committed identity is this name (mint only when
+ *   `traces` is empty). Two committed identities that are this name halt.
  */
-function adoptable(name, traces, scan = { indexed: indexEntries(), installed: identitiesOnDisk() }) {
-  const indexed = scan.indexed;
-  const consistent = (id) => traces.every((t) => !t.identity || (!t.legacy && t.nodeId === id));
-  const ok = (id) => id && identityInPlace(id) && !indexed.has(id) && !readTombstone(id) && consistent(id);
-  for (const p of [path.join(NODES_DIR, name), process.env.SYM_IDENTITY_DIR && path.join(process.env.SYM_IDENTITY_DIR, name)]) {
-    const id = p && compatLinkNodeId(p);
-    if (ok(id)) return { nodeId: id };
+function resolveName(name, { write = true, migration = null } = {}) {
+  const f = foldName(name);
+  for (let round = 0; ; round++) {
+    const e = entryFor(name);
+    if (e.state === 'conflict') throw twoAgentsHalt(name, e.entries.map((x) => x.nodeId), `their index entries are ${e.entries.map((x) => x.file).join(' and ')}`);
+    if (e.state === 'ok') {
+      if (!isCommitted(e.nodeId)) return { nodeId: e.nodeId, missing: true, entry: e };
+      const c = readCommitted(e.nodeId);
+      const own = c.state === 'ok' && c.name !== null && foldName(c.name) === f;
+      if (own && !c.scrubbed) {
+        const others = namedHere(scanCommitted(), f, e.nodeId);
+        if (others.length) {
+          if (round < 20) { pause(5); continue; }
+          throw twoAgentsHalt(name, [e.nodeId, ...others.map((o) => o.nodeId)], `the index names ${e.nodeId}`);
+        }
+      }
+      if (e.exactKey && write) claimName(name, e.nodeId, e.name || name);
+      return { nodeId: e.nodeId, via: 'index', entry: e, alias: c.state === 'ok' && c.name !== null && !own };
+    }
+    const scan = scanCommitted();
+    const traces = nameTraces(name, e, migration);
+    const ids = new Set(namedHere(scan, f).map((i) => i.nodeId));
+    for (const t of traces) if (t.kind === 'link' && t.committed && !readTombstone(t.nodeId)) ids.add(t.nodeId);
+    if (ids.size > 1) {
+      if (round < 20) { pause(10); continue; }
+      throw twoAgentsHalt(name, [...ids], 'and no index entry says which');
+    }
+    if (ids.size === 1) {
+      const id = [...ids][0];
+      const blocking = traces.filter((t) => t.identity && t.kind !== 'entry' && t.kind !== 'link' && (t.other || t.nodeId !== id));
+      if (blocking.length) {
+        throw new IdentityHaltError(name, nameIndexPath(name),
+          `the identity ${id} is installed for "${name}" and no index entry names it, and this host holds another claim on the name: ${blocking.map((t) => t.text).join('; ')}. ` +
+          'Nothing was changed.', 'Decide which one is this agent: start it by its nodeId, and move or rename the other. Do not remove an identity.json: each is an agent\'s key.');
+      }
+      if (write) {
+        const c = readCommitted(id);
+        const exact = (c.state === 'ok' && c.name) || name;
+        if (e.state === 'missing') { const w = claimName(name, id, exact); if (w && w !== id) continue; }
+        else if (e.state === 'unreadable' && !e.io) repairEntry(name, id, exact);
+      }
+      return { nodeId: id, via: 'scan', entry: e };
+    }
+    // Nothing committed is this name. Another start that is installing it right now is given a moment.
+    if (traces.some((t) => t.live) && round < 300) { pause(10); continue; }
+    return { none: true, traces, entry: e };
   }
-  const named = scan.installed.filter((i) => i.name === name && !i.scrubbed && ok(i.nodeId));
-  if (named.length === 1) return { nodeId: named[0].nodeId };
-  return named.length ? { many: named } : null;
+}
+
+/** The halt (or, for create: false with nothing that holds an identity, the absence) for a name with traces and no agent. */
+function tracesHalt(name, traces, { create = true, pin = null } = {}) {
+  if (!create && !traces.some((t) => t.identity)) return new IdentityAbsentError(pin ? `"${name}" (${pin})` : `"${name}"`, traces.map((t) => t.text));
+  const entry = traces.find((t) => t.kind === 'entry');
+  return new IdentityHaltError(name, nameIndexPath(name),
+    `no installed identity is named "${name}", and this host holds a trace of it: ${traces.map((t) => t.text).join('; ')}` +
+    `${pin ? `; this start is pinned to ${pin}, which is not on this host` : ''}. ` +
+    'Making a new identity here would orphan or overwrite its key, so none was made.',
+    entry
+      ? `The index entry is the record of which node this name is: restore it (it holds {"name": ${JSON.stringify(name)}, "nodeId": "<the agent's nodeId>"}), or restore the identity it named. Do not delete it to "start over".`
+      : 'If the trace is this agent, restore its identity (or its index entry); if it is not, move it out of the way. Then start again.');
 }
 
 /**
- * Make a new identity for `name`: installed by one rename (the node dir, and the identity dir when
- * SYM_IDENTITY_DIR is set), THEN the name claimed by an exclusive create of its index entry. Returns null when
- * another first start of the name claimed it first: this identity was never anyone's, and it is removed.
+ * The halt for a start pinned to `pin` under a name whose index entry names another identity (`held`). The entry
+ * is left as it is: a name is one agent's on this host.
+ */
+function nameHeldByAnother(name, pin, held) {
+  const there = isCommitted(held);
+  return new IdentityHaltError(name, nameIndexPath(name),
+    `this start is pinned to ${pin}, and the name "${name}" is another agent's on this host: its index entry names ${held}` +
+    `${there ? '' : ' (whose identity is not installed here)'}. A pinned start does not take a name from another identity: the next start of ` +
+    `"${name}" by name would run as ${pin}, and ${held} would be left without its name. The index entry was left as it is.`,
+    `Start ${pin} under its own name, or pin the start to ${held} if that is the agent meant. To give "${name}" to ${pin}, ` +
+    `rename the other agent first (renameIdentity).`);
+}
+
+/**
+ * An entry 0.14.0 - 0.14.2 wrote for a rename or a pinned start names `nodeId` under `name`, which is not its own: when
+ * it is the identity's only name (no entry under its own name leads to it) and no other agent is named so, the identity
+ * takes it, so the name can be derived from what is committed from now on.
+ */
+function adoptAliasName(name, nodeId, identity) {
+  const c = readCommitted(nodeId);
+  if (c.state !== 'ok' || c.scrubbed) return identity;
+  if (c.name !== null) { const own = entryFor(c.name); if (own.state === 'ok' && own.nodeId === nodeId) return identity; }
+  if (namedHere(scanCommitted(), foldName(name), nodeId).length) return identity;
+  try { writeFileAtomic0600(c.file, JSON.stringify({ ...c.identity, name }, null, 2)); } catch { return identity; }
+  return { ...identity, name };
+}
+
+/** The short lock under which a name is minted: one process at a time makes the agent of a name. */
+const mintLockPath = (name) => path.join(NODES_DIR, 'by-id', `.mint-${encodeURIComponent(foldName(name))}.lock`);
+
+/**
+ * Make a new identity for `name`, under the name's mint lock: staged (identity.json written and synced in a staging
+ * directory beside its destination) and committed by ONE rename; right after the commit the compat link, then the
+ * name claimed by an exclusive create of its index entry. Returns null when the entry was taken meanwhile (only a
+ * process of an earlier release, which takes no mint lock, can): this identity was never anyone's, and it is removed.
  */
 function mintIdentity(name) {
   const kp = generateSigningKeyPair();
@@ -1454,40 +1779,54 @@ function mintIdentity(name) {
     privateKey: kp.privateKey.toString('base64url'),
   };
   const nodeId = identity.nodeId;
-  const text = JSON.stringify(identity, null, 2);
   const nodeTarget = nodeDirById(nodeId);
   const idTarget = identityDirById(nodeId);
   const split = idTarget !== nodeTarget;
-  const withIdentity = (staging) => writeNewFileSynced(path.join(staging, 'identity.json'), text, 0o600);
-  installNewDir(nodeTarget, nodeId, split ? () => {} : withIdentity);
-  if (split) installNewDir(idTarget, nodeId, withIdentity);
-  if (claimName(name, nodeId) !== nodeId) {
-    fs.rmSync(nodeTarget, { recursive: true, force: true });
-    if (split) fs.rmSync(idTarget, { recursive: true, force: true });
+  const idRoot = process.env.SYM_IDENTITY_DIR;
+  if (split) {
+    fs.mkdirSync(path.dirname(nodeTarget), { recursive: true });
+    fs.mkdirSync(nodeTarget, { mode: 0o700 });
+    fs.chmodSync(nodeTarget, 0o700);
+  }
+  const staging = makeStaging(path.dirname(idTarget), nodeId);
+  const links = [];
+  try {
+    writeNewFileSynced(path.join(staging, 'identity.json'), JSON.stringify(identity, null, 2), 0o600);
+    fsyncDir(staging);
+    if (split) links.push([makeTempLink(path.join(idRoot, name), nodeId), path.join(idRoot, name)]);
+    links.push([makeTempLink(path.join(NODES_DIR, name), nodeId), path.join(NODES_DIR, name)]);
+    fs.renameSync(staging, idTarget); // THE COMMIT
+    for (const [tmp, at] of links) putTempLink(tmp, at); // right after it
+    fsyncDir(path.dirname(idTarget));
+  } finally {
+    fs.rmSync(staging, { recursive: true, force: true });
+    for (const [tmp] of links) if (tmp && lstatOrNull(tmp)) { try { removeLink(tmp); } catch { /* */ } }
+  }
+  const winner = claimName(name, nodeId, name);
+  if (winner !== nodeId) {
+    fs.rmSync(idTarget, { recursive: true, force: true });
+    if (split) fs.rmSync(nodeTarget, { recursive: true, force: true });
+    if (winner) ensureCompatLinks(name, winner);
     return null;
   }
-  ensureCompatLinks(name, nodeId);
   return identity;
 }
 
 /**
- * Load a node's identity by nodeId or by name (design D9). The state of an identity is read from records
- * committed in one step: an installed identity (a directory installed by one rename) and the name's index
- * entry (created exclusively, after the identity was installed). Nothing is inferred from a path that merely
- * exists.
+ * Load a node's identity by nodeId or by name (design D9). An agent exists exactly when its identity is committed
+ * (`by-id/<nodeId>/identity.json`, in SYM_IDENTITY_DIR when set). The name index and the compat links are caches of
+ * which agent a name is, written after the commit and re-derived from the committed identities when they are missing
+ * or cannot be read; nothing is inferred from a path that merely exists.
  *
  *   - `{ nodeId }` loads that identity;
- *   - `{ name }` (pinned or not) first migrates a 0.13 identity still under the name (one path, see
- *     migrateName), then resolves the name by its index entry; an entry that cannot be read halts;
+ *   - `{ name }` (pinned or not) first migrates a 0.13 agent still under the name (migrateName: moved, not copied), then
+ *     resolves the name (resolveName);
  *   - a 0.13 directory a live process holds refuses (EIDENTITYLOCK): the agent is running there;
+ *   - a pinned start never takes a name another agent holds (R4-9): committed, indexed, or a 0.13 agent not yet
+ *     migrated; it may claim a name nobody has;
  *   - `create: false` throws IdentityAbsentError when the identity is not on this host;
- *   - `create: true` (the default) is the ONLY path that mints, and it mints only when there is no trace
- *     of the name on this host: no index entry, no `nodes/<name>` (a link, or a directory with anything in it),
- *     no `SYM_IDENTITY_DIR/<name>`, no 0.13 directory set aside, no installed identity of that name that no name
- *     indexes. A trace that provably is this name's identity (a compat link to it, the one unindexed identity of
- *     that name) is adopted: the name is claimed for it. Any other trace HALTS (IdentityHaltError), saying what
- *     it is. Two first starts of a new name both mint; one claims the name, the other discards its identity
- *     and loads the winner;
+ *   - `create: true` (the default) is the ONLY path that mints, under the name's mint lock, and only when no committed
+ *     identity, 0.13 directory, aside or staging holds the name and nothing else on the host is a trace of it;
  *   - a tombstoned identity (exported to another host) refuses: IdentityTombstonedError; one whose export
  *     did not finish refuses: IdentityExportPendingError.
  *
@@ -1499,89 +1838,112 @@ function loadIdentity({ nodeId: pin, name, create = true, allowPendingExport = f
   if (!pin && !name) throw new Error('loadIdentity needs a nodeId or a name');
   if (pin && !isNodeIdText(pin)) throw new Error(`not a nodeId: ${String(pin).slice(0, 40)}`);
   const how = { allowPendingExport };
+  clearLeftovers();
   if (!name) {
-    if (identityInPlace(pin)) return loadInstalled(pin, pin, how);
+    if (isCommitted(pin)) return loadInstalled(pin, pin, how);
     if (strayCopiesOf(pin).length) throw indexedButMissing(pin, pin, { indexed: false });
     throw new IdentityAbsentError(pin);
   }
-  // 1. A 0.13 identity under the name is migrated first: the same path for a pinned start and an unpinned one.
+  // 1. A 0.13 agent under the name is migrated first: the same path for a pinned start and an unpinned one.
   let migration = null;
   if (legacyIdentityUnder(name)) {
-    try {
-      migration = migrateName(name, pin);
-    } catch (e) {
-      // Another start finished this migration while this one was copying (it set the 0.13 directory aside under
-      // this copy): what it installed is read below, by the name it claimed. Anything else is this start's to report.
-      if (e instanceof IdentityHaltError || e.code === 'EIDENTITYLOCK' || legacyIdentityUnder(name)) throw e;
-      migration = { status: 'already' };
-    }
-    if (migration.status === 'skipped-live') {
+    migration = migrateName(name, pin);
+    const s = migration.status;
+    if (s === 'skipped-live') {
       throw lockError(
         `[SYM] Agent '${name}' is running in its 0.13 directory: a live process (PID ${migration.holderPid}) holds ${path.join(NODES_DIR, name, 'lock.pid')}.\n\n` +
         '  One agent runs in one process. This start is refused; nothing was moved or changed. Stop that process (it is an older copy of ' +
         'this same agent), and start again: the agent is migrated then, with its store.', { pid: migration.holderPid });
     }
-    if (migration.status === 'tombstoned') throw new IdentityTombstonedError(migration.nodeId, migration.tomb);
-  }
-  if (pin) {
-    // A pinned start never takes a name from another agent (R4-9): it may claim a name nobody has, and that is all.
-    // Re-pointing the entry made the other agent's next start by name run as the pinned identity and orphaned the
-    // other one, and let a pin in a cloned repository's node.json pick which identity on the host a session signs as.
-    const held = nodeIdForName(name);
-    if (identityInPlace(pin)) {
-      if (held && held !== pin) throw nameHeldByAnother(name, pin, held);
-      const identity = loadInstalled(pin, name, how);
-      const winner = held || claimName(name, pin);
-      if (winner !== pin) throw nameHeldByAnother(name, pin, winner); // another start claimed it this moment
-      ensureCompatLinks(name, pin);
-      return identity;
+    if (s === 'husk-live') {
+      throw lockError(`[SYM] A live process (PID ${migration.holderPid ?? 'unknown'}) holds ${path.join(nodeDirById(migration.nodeId), 'lock.pid')}, but ${migration.nodeId}'s identity is not installed there: ` +
+        'a node of an earlier release is running in that directory without its identity. Stop it, then start this agent again; nothing was changed.', { pid: migration.holderPid });
     }
-    if (migration && migration.nodeId === pin) {
+    if (s === 'tombstoned') throw new IdentityTombstonedError(migration.nodeId, migration.tomb);
+    if (s === 'fold-collision') {
       throw new IdentityHaltError(name, path.join(NODES_DIR, name, 'identity.json'),
-        `the identity ${pin} this start is pinned to is on this host, in the 0.13 directory of "${name}", and could not be migrated: ${migration.reason || migration.status}.`,
-        'Resolve that, then start again. Nothing was changed.');
-    }
-    if (!create) {
-      if (strayCopiesOf(pin).length) throw indexedButMissing(name, pin, { indexed: false });
-      const elsewhere = held && held !== pin ? [`the name "${name}" is another agent's here (${held}), and was left as it is`] : [];
-      throw new IdentityAbsentError(`"${name}" (${pin})`, [...elsewhere, ...nameTraces(name, migration).map((t) => t.text)]);
+        `the 0.13 agent ${migration.nodeId} under "${name}" and another agent on this host are one name (names are compared without regard to case): ${migration.reason}. The 0.13 agent was not migrated; nothing was changed.`,
+        'Give one of them another name: rename the installed agent (renameIdentity), or move this 0.13 directory to another name. Then start again.');
     }
-    // Not on this host, and the name is another identity's: the start is never answered with that one.
-    if (held && held !== pin) throw nameHeldByAnother(name, pin, held);
+    if (s === 'skipped-duplicate' && migration.halt) throw new IdentityHaltError(name, path.join(NODES_DIR, name, 'identity.json'), migration.reason);
   }
-  for (let round = 0; ; round++) {
-    const indexed = nodeIdForName(name);
-    if (indexed) {
-      if (!identityInPlace(indexed)) {
-        if (!create && !strayCopiesOf(indexed).length) throw new IdentityAbsentError(`"${name}" (${indexed})`);
-        throw indexedButMissing(name, indexed);
+  if (pin) return loadPinned(name, pin, create, how, migration);
+  return resolveOrMint(name, { create, how, migration });
+}
+
+/**
+ * Load the agent `name` is, or (create) mint it under the name's mint lock when nothing on this host holds the name.
+ * `pin`: a pinned start whose pin is not on this host (create: true), which never gets the name's agent.
+ */
+function resolveOrMint(name, { create, how, migration, pin = null }) {
+  for (let round = 0; round < 3; round++) {
+    const r = resolveName(name, { write: true, migration });
+    if (r.nodeId && pin && r.nodeId !== pin) throw nameHeldByAnother(name, pin, r.nodeId);
+    if (r.nodeId) return loadResolved(name, r, create, how);
+    if (r.traces.length) throw tracesHalt(name, r.traces, { create, pin });
+    if (!create) throw new IdentityAbsentError(pin ? `"${name}" (${pin})` : `"${name}"`);
+    const m = withShortLock(mintLockPath(name), `making the agent "${name}"`, () => {
+      const again = resolveName(name, { write: true, migration });
+      if (again.nodeId) return { r: again };
+      if (again.traces.length) throw tracesHalt(name, again.traces, { create, pin });
+      return { minted: mintIdentity(name) };
+    });
+    if (m.r && pin && m.r.nodeId !== pin) throw nameHeldByAnother(name, pin, m.r.nodeId);
+    if (m.r) return loadResolved(name, m.r, create, how);
+    if (m.minted) return m.minted;
+  }
+  throw new Error(`[SYM] the name "${name}" did not settle (its index entry kept being claimed and lost); nothing was minted`);
+}
+
+/** Load what a name resolved to (resolveName). */
+function loadResolved(name, r, create, how) {
+  if (r.missing) {
+    if (!create && !strayCopiesOf(r.nodeId).length) throw new IdentityAbsentError(`"${name}" (${r.nodeId})`);
+    throw indexedButMissing(name, r.nodeId);
+  }
+  let identity = loadInstalled(r.nodeId, name, how);
+  if (r.alias) identity = adoptAliasName(name, r.nodeId, identity);
+  ensureCompatLinks(name, r.nodeId);
+  return identity;
+}
+
+/** A start pinned to `pin` under `name` (mesh-channel: name + nodeId, create: false). */
+function loadPinned(name, pin, create, how, migration) {
+  const r = resolveName(name, { write: false, migration });
+  const held = r.nodeId || null;
+  if (isCommitted(pin)) {
+    if (held && held !== pin) throw nameHeldByAnother(name, pin, held);
+    if (!held) {
+      const claims = (r.traces || []).filter((t) => t.identity && (t.other || (t.nodeId && t.nodeId !== pin)));
+      if (claims.length) {
+        throw new IdentityHaltError(name, nameIndexPath(name),
+          `this start is pinned to ${pin}, and the name "${name}" is held on this host by another agent: ${claims.map((t) => t.text).join('; ')}. ` +
+          'A pinned start does not take a name from another agent; nothing was changed.',
+          `Start "${name}" by name once (that migrates the agent it holds, and it runs as itself), and start ${pin} under its own name.`);
       }
-      const identity = loadInstalled(indexed, name, how);
-      ensureCompatLinks(name, indexed);
-      return identity;
     }
-    if (round > 40) throw new Error(`[SYM] the name "${name}" did not settle (its index entry kept being claimed and lost); nothing was minted`);
-    // One look at what is installed and indexed decides both what is a trace and what can be adopted; an identity
-    // installed after it is another first start's, and the claim of the name settles which one the name is.
-    const scan = { indexed: indexEntries(), installed: identitiesOnDisk() };
-    const traces = nameTraces(name, migration, scan);
-    const adopt = adoptable(name, traces, scan);
-    if (nodeIdForName(name)) continue; // another start claimed the name meanwhile: load what it names
-    if (adopt && adopt.nodeId) { claimName(name, adopt.nodeId); continue; } // the index decides; read it again
-    if (adopt && adopt.many && round < 20) { pause(10); continue; } // first starts claiming it: the entry appears within ms
-    if (traces.length) {
-      if (!create && !traces.some((t) => t.identity)) throw new IdentityAbsentError(`"${name}"`, traces.map((t) => t.text));
-      throw new IdentityHaltError(name, nameIndexPath(name),
-        `no index entry names "${name}", and this host holds a trace of it: ${traces.map((t) => t.text).join('; ')}` +
-        `${pin ? `; this start is pinned to ${pin}, which is not on this host` : ''}. ` +
-        'Making a new identity here would orphan or overwrite its key, so none was made.',
-        'If the trace is this agent, restore its index entry or its identity; if it is not, move it out of the way. Then start again.');
+    const identity = loadInstalled(pin, name, how);
+    if (!held || r.via !== 'index' || (r.entry && r.entry.exactKey)) {
+      const w = claimName(name, pin, name);
+      if (w && w !== pin) throw nameHeldByAnother(name, pin, w); // another start claimed it this moment
     }
-    if (!create) throw new IdentityAbsentError(pin ? `"${name}" (${pin})` : `"${name}"`);
-    const minted = mintIdentity(name);
-    if (minted) return minted;
-    // Another first start of this name claimed it first: the index says who it is.
+    ensureCompatLinks(name, pin);
+    return r.alias ? adoptAliasName(name, pin, identity) : identity;
+  }
+  if (migration && migration.nodeId === pin && !['moved', 'already', 'not-a-node'].includes(migration.status)) {
+    throw new IdentityHaltError(name, path.join(NODES_DIR, name, 'identity.json'),
+      `the identity ${pin} this start is pinned to is on this host, in the 0.13 directory of "${name}", and could not be migrated: ${migration.reason || migration.status}.`,
+      'Resolve that, then start again. Nothing was changed.');
+  }
+  if (!create) {
+    if (strayCopiesOf(pin).length) throw indexedButMissing(name, pin, { indexed: false });
+    const elsewhere = held && held !== pin ? [`the name "${name}" is another agent's here (${held}), and was left as it is`] : [];
+    throw new IdentityAbsentError(`"${name}" (${pin})`, [...elsewhere, ...(r.traces || []).map((t) => t.text)]);
   }
+  // Not on this host, and the name is another identity's: the start is never answered with that one.
+  if (held && held !== pin) throw nameHeldByAnother(name, pin, held);
+  // create: true and a pin this host does not hold: a name nobody holds is minted (a new nodeId: the Known limit kept).
+  return resolveOrMint(name, { create, how, migration, pin });
 }
 
 /**
@@ -1594,25 +1956,53 @@ function loadOrCreateIdentity(name) {
 }
 
 /**
- * Rename a node: the name index moves; the identity (nodeId, key) does not (design D9). The new name is
- * claimed exclusively. The old name only needs to be a name at all, so an agent whose name a later rule
- * refuses (one Windows cannot hold) can be renamed to one it accepts.
+ * The nodeId the name is on this host (resolveName, writing nothing), or null when no agent is. Halts
+ * (IdentityHaltError) where the host holds two answers.
+ * @param {string} name
+ * @returns {string|null}
+ */
+function nodeIdForName(name) {
+  const r = resolveName(name, { write: false });
+  return r.nodeId || null;
+}
+
+/**
+ * Rename a node: the identity's own `name` is the commit of the rename; the index entry and the compat link follow
+ * (the new name is claimed exclusively first, so a crash leaves both names leading to the agent, never neither).
+ * The old name only needs to be a name at all, so an agent whose name a later rule refuses (one Windows cannot hold)
+ * can be renamed to one it accepts.
  * @returns {string} the nodeId
  */
 function renameIdentity(oldName, newName) {
   const problem = basicNameProblem(oldName);
   if (problem) throw new Error(problem);
   validateName(newName);
-  const nodeId = nodeIdForName(oldName);
-  if (!nodeId) throw new IdentityAbsentError(`"${oldName}"`);
-  if (nodeIdForName(newName) || claimName(newName, nodeId) !== nodeId) throw new Error(`the name "${newName}" already indexes a node`);
-  ensureCompatLinks(newName, nodeId);
-  try { fs.unlinkSync(nameIndexPath(oldName)); } catch { /* */ }
-  fsyncDir(path.dirname(nameIndexPath(oldName)));
+  const r = resolveName(oldName, { write: false });
+  if (!r.nodeId || r.missing) throw new IdentityAbsentError(`"${oldName}"`);
+  const nodeId = r.nodeId;
+  const caseOnly = foldName(oldName) === foldName(newName);
+  if (!caseOnly) {
+    const n = resolveName(newName, { write: false });
+    if ((n.nodeId && n.nodeId !== nodeId) || (!n.nodeId && n.traces.some((t) => t.identity))) throw new Error(`the name "${newName}" already indexes a node`);
+    const w = claimName(newName, nodeId, newName);
+    if (w !== nodeId) throw new Error(`the name "${newName}" already indexes a node`);
+  } else {
+    repairEntry(newName, nodeId, newName);
+  }
+  const c = readCommitted(nodeId);
+  if (c.state === 'ok' && c.name !== newName) writeFileAtomic0600(c.file, JSON.stringify({ ...c.identity, name: newName }, null, 2));
+  const byName = path.join(NODES_DIR, 'by-name');
+  for (const f of new Set([nameIndexPath(oldName), exactIndexPath(oldName)])) {
+    if (caseOnly && f === nameIndexPath(newName)) continue;
+    const e = readEntryFile(f, foldName(oldName));
+    if (e.state === 'ok' && e.nodeId === nodeId && !sameFile(f, nameIndexPath(newName))) { try { fs.unlinkSync(f); } catch { /* */ } }
+  }
+  fsyncDir(byName);
   for (const root of [NODES_DIR, process.env.SYM_IDENTITY_DIR].filter(Boolean)) {
     const link = path.join(root, oldName);
-    if (compatLinkNodeId(link) === nodeId) { try { removeLink(link); } catch { /* */ } }
+    if (oldName !== newName && compatLinkNodeId(link) === nodeId && !sameFile(link, path.join(root, newName))) { try { removeLink(link); } catch { /* */ } }
   }
+  ensureCompatLinks(newName, nodeId);
   return nodeId;
 }
 
@@ -2187,11 +2577,24 @@ module.exports = {
   IdentityAbsentError,
   IdentityTombstonedError,
   IdentityExportPendingError,
-  /** For relocation.js: durable writes, and installing a staged directory by one rename. */
+  /** For relocation.js: durable writes, staging beside a destination, the committed state, and the key's copies. */
   writeFileDurable,
   writeNewFileSynced,
+  writeFileAtomic0600,
   fsyncDir,
-  installNewDir,
+  makeStaging,
+  setHuskAside,
+  isCommitted,
+  readCommitted,
+  claimName,
+  ensureCompatLinks,
+  keyHoldersOf,
+  clearForInstall,
+  clearLeftovers,
+  compatLinkNodeId,
+  exportProducedBundle,
+  assertStartable,
+  foldName,
   PRIVATE_KEY_FILES,
   uuidv7,
   validateName,
diff --git a/lib/node.js b/lib/node.js
index 67d0e6d0..45049017 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -24,7 +24,7 @@ const path = require('path');
 const crypto = require('crypto');
 const { EventEmitter } = require('events');
 const { MeshNode } = require('./core');
-const { nodeDirById, loadIdentity, acquireIdentityLock, log: logMsg } = require('./config');
+const { nodeDirById, loadIdentity, acquireIdentityLock, assertStartable, log: logMsg } = require('./config');
 const { assertTestSandbox } = require('./core/state-root');
 const { MemoryStore } = require('./memory-store');
 const { AttestationStore, chainHash, isPosition, isCanonicalSig } = require('./attestation-store');
@@ -583,6 +583,9 @@ class SymNode extends EventEmitter {
     // the lock. Hosts should catch and exit cleanly (or pick a
     // different SYM_NODE_NAME).
     this._releaseIdentityLock = acquireIdentityLock(this.name, { dir: this._dir });
+    // Held, the lock is what an export takes too: an identity exported (or being exported) between the load above and
+    // here is refused now, so no node runs a key that a bundle carries.
+    this._assertStillHere();
 
     // Core Secure (design D1/D2): a peer is the set of confirmed sessions that proved one nodeId with
     // one identity key. Session keys are ephemeral, derived per handshake (§5.2.1): there is no
@@ -2447,6 +2450,19 @@ class SymNode extends EventEmitter {
     return op;
   }
 
+  /**
+   * @private Refuse to run an identity that was exported, or whose export is under way, once the identity lock is held
+   * (relocation.js takes that lock for the whole export): the lock is released and the error thrown.
+   */
+  _assertStillHere() {
+    try { assertStartable(this.nodeId); } catch (e) {
+      const release = this._releaseIdentityLock;
+      this._releaseIdentityLock = null;
+      try { if (release) release(); } catch { /* */ }
+      throw e;
+    }
+  }
+
   /**
    * @private What a start needs that a stop gave up (R3-11): the identity lock, taken again here when
    * this node does not hold it (EIDENTITYLOCK if another process took it), and the inbox, when no
@@ -2454,7 +2470,10 @@ class SymNode extends EventEmitter {
    * from disk; with it the delivery ledger, which another instance may have added to.
    */
   _takeOwnership() {
-    if (!this._releaseIdentityLock) this._releaseIdentityLock = acquireIdentityLock(this.name, { dir: this._dir });
+    if (!this._releaseIdentityLock) {
+      this._releaseIdentityLock = acquireIdentityLock(this.name, { dir: this._dir });
+      this._assertStillHere(); // stopped, it may have been exported meanwhile: its key in memory is a bundle's now
+    }
     if (!INBOX_OWNERS.has(this._inboxFile)) {
       INBOX_OWNERS.set(this._inboxFile, this);
       this._loadInbox();
diff --git a/lib/relocation.js b/lib/relocation.js
index 25701ed0..1eb045f2 100644
--- a/lib/relocation.js
+++ b/lib/relocation.js
@@ -5,21 +5,20 @@
  * @description Moving a node to another host (sym 0.14, design D9.2). §3.1.3: "The private key MUST
  * NOT leave the node" — so a node is MOVED, never copied:
  *
- *   - `exportNode` holds the identity's lock throughout (no process can start it meanwhile) and goes in
- *     this order, each step durable before the next (0.14.3; the tombstone used to come first, so a crash
- *     before the bundle existed left a node refused as "exported" with no bundle anywhere, and refused a
- *     second export):
- *       1. an export INTENT (EXPORTING.json) beside the key: from here the source refuses to start the
- *          identity (IdentityExportPendingError) until the export is finished or abandoned;
- *       2. the bundle (fsynced, renamed into place, its directory fsynced);
- *       3. the TOMBSTONE beside the key, in the identity directory (SYM_IDENTITY_DIR when set: a rebuilt
- *          node directory used to take the tombstone with it, and the source started a second live copy);
- *       4. the source LOSES THE KEY (security review): identity.json is rewritten without its private key
- *          (and so is any 0.13 copy the migration set aside), and the 0.13-compatible `nodes/<name>` link goes,
- *          so a 0.13 build on the source host (a rollback) cannot load the moved identity either.
- *     An export interrupted at any step is resumable: run it again (before the tombstone it writes the
- *     bundle again; after it, it finishes the scrub). Before the tombstone it is abortable: `abortExport`
- *     removes the bundle it wrote and the intent, and the node starts here again.
+ *   - `exportNode` holds the identity's lock throughout (no process can start it meanwhile), and the source stops
+ *     using the key BEFORE any bundle can exist (0.14.3), each step durable before the next:
+ *       1. an export INTENT (EXPORTING.json) beside the key: its out and its recipient;
+ *       2. the TOMBSTONE beside the key (and a copy in the node directory, which is where 0.14.2 looks): from here the
+ *          source refuses to start the identity, and so does a 0.14.2 build rolled back to;
+ *       3. the bundle's hash, written into the intent; then the bundle (fsynced, renamed into place, its directory
+ *          fsynced), and `complete` written into the intent;
+ *       4. the source LOSES THE KEY (security review): identity.json is rewritten without its private key (and so is
+ *          every other copy on this host: a 0.13 directory set aside, a husk set aside, the 0.13 E2E keypair), the
+ *          0.13-compatible `nodes/<name>` link goes, and the intent goes.
+ *     A crash after the tombstone and before a complete bundle leaves the agent refused, saying so
+ *     (IdentityExportPendingError). Run the same export again (the same out, the same recipient) and it is finished;
+ *     another out is refused while a complete bundle may exist at the intent's out. `abortExport` reverts the tombstone
+ *     only when no complete bundle was produced (the hash recorded in the intent tells), and the node starts here again.
  *   - The bundle holds the node's directory — its identity, store, key registry, grants and learned
  *     state — encrypted under an operator passphrase (scrypt → AES-256-GCM) or to a target host's
  *     X25519 key (ephemeral X25519 + HKDF-SHA256 → AES-256-GCM).
@@ -168,55 +167,98 @@ function publicOf(privateKeyB64url) {
   return crypto.createPublicKey(priv).export({ type: 'spki', format: 'der' }).subarray(-32).toString('base64url');
 }
 
+/** The sha256 of `buf`, hex. */
+const sha256 = (buf) => crypto.createHash('sha256').update(buf).digest('hex');
+
+/** Who a bundle is sealed to: a host key (a move), or a passphrase (a copy). A host key, when given, wins. */
+const recipientOf = ({ passphrase, toHostKey }) => (typeof toHostKey === 'string' && toHostKey ? `host:${toHostKey}` : (typeof passphrase === 'string' ? 'passphrase' : null));
+const describeRecipient = (r) => (r && r.startsWith('host:') ? `the host key ${r.slice(5)}` : 'a passphrase');
+
+/** @private The intent beside the key, written durably. */
+function writeIntent(id, intent) {
+  config.writeFileDurable(path.join(config.identityDirById(id), config.EXPORTING), JSON.stringify(intent, null, 2), 0o600);
+}
+
+/** @private The tombstone beside the key, and a copy in the node directory, where 0.14.0 - 0.14.2 read it (a rollback). */
+function writeTombstone(id, tomb) {
+  const text = JSON.stringify(tomb, null, 2);
+  config.writeFileDurable(path.join(config.identityDirById(id), config.TOMBSTONE), text, 0o600);
+  const dir = config.nodeDirById(id);
+  if (dir !== config.identityDirById(id) && fs.existsSync(dir)) config.writeFileDurable(path.join(dir, config.TOMBSTONE), text, 0o600);
+}
+
+/** @private The intent goes (the tombstone stays): the export is finished. */
+function removeIntent(id) {
+  for (const d of new Set([config.identityDirById(id), config.nodeDirById(id)])) {
+    try { fs.unlinkSync(path.join(d, config.EXPORTING)); fsyncDir(d); } catch { /* */ }
+  }
+}
+
 /**
- * Move a node off this host: an intent beside the key, its encrypted bundle, then the tombstone, then the
- * source's key scrubbed. Run again after an interruption, it finishes what was begun.
+ * Move a node off this host. The source stops using the key before any bundle can exist: an intent beside the key,
+ * then the tombstone, then the bundle (its hash recorded in the intent first), then the source's key scrubbed. Run
+ * again after an interruption (the same out, the same recipient), it finishes what was begun.
  * @param {object} o
  * @param {string} [o.name]
  * @param {string} [o.nodeId]
  * @param {string} o.out - the bundle file to write
  * @param {string} [o.passphrase]
  * @param {string} [o.toHostKey] - the target host's X25519 public key (sym node host-key there)
- * @returns {{ nodeId: string, name: string, files: number, out: string, fingerprint: string }}
+ * @returns {{ nodeId: string, name: string, files: number, out: string, fingerprint: string, resumed?: string }}
  */
 function exportNode({ name, nodeId, out, passphrase, toHostKey, copyable = false } = {}) {
   if (!out) throw new Error('relocation: out (the bundle file) is required');
   const id = nodeId || (name && config.nodeIdForName(name));
   if (!id) throw new config.IdentityAbsentError(name ? `"${name}"` : 'the node');
+  config.clearLeftovers();
   const dir = config.nodeDirById(id);
+  const idDir = config.identityDirById(id);
+  const outAbs = path.resolve(out);
+  const intent = config.readExportIntent(id);
   const tomb = config.readTombstone(id);
-  if (tomb) {
-    // Tombstoned: the bundle was durable. An export interrupted before the source lost its key is finished here.
-    const left = readIdentityJson(config.identityDirById(id));
+  if (tomb && !intent) {
+    // Finished, or (an earlier release) interrupted between its tombstone and the scrub: the scrub is finished here.
+    const left = readIdentityJson(idDir);
     if (left && left.privateKey) {
       scrubSource(id, left);
       return { nodeId: id, name: left.name, files: 0, out: tomb.bundle || null, fingerprint: tomb.fingerprint || keyFingerprint(left.publicKey), resumed: 'scrub' };
     }
     throw new Error(`relocation: ${id} is already tombstoned here (it was exported${tomb.bundle ? ` to ${tomb.bundle}` : ''})`);
   }
-  const identity = config.loadIdentity({ nodeId: id, name, create: false, allowPendingExport: true });
-  // An export that was interrupted before its tombstone is begun again from the start; the half-written bundle it
-  // may have left (`<out>.<pid>.tmp`) goes. A complete bundle it wrote is left where it is: the new one supersedes it,
-  // and a host imports only one of them.
-  const pending = config.readExportIntent(id);
-  if (pending && typeof pending.out === 'string') removeTempBundles(pending.out);
   // A node running in THIS process holds the lock too (final re-review, Finding 7a).
-  if (config.lockHeldInProcess(dir)) throw new Error(`relocation: ${identity.name} is running in this process; stop it before moving it`);
+  if (config.lockHeldInProcess(dir)) throw new Error(`relocation: ${(intent && intent.name) || name || id} is running in this process; stop it before moving it`);
   const lock = config.readLockFile(path.join(dir, 'lock.pid'));
   if (lock && lock.pid !== process.pid && config.lockIsHeldByLiveProcess(lock)) {
-    throw new Error(`relocation: ${identity.name} is running (PID ${lock.pid}); stop it before moving it`);
+    throw new Error(`relocation: ${(intent && intent.name) || name || id} is running (PID ${lock.pid}); stop it before moving it`);
   }
-  // Sealed to the target host by default. A passphrase bundle opens on any host with the passphrase:
-  // it is a copy, and says so (final re-review, Finding 7b).
-  if (typeof passphrase === 'string' && !(typeof toHostKey === 'string' && toHostKey) && copyable !== true) {
-    throw new Error('relocation: a passphrase bundle can be imported on any host that has the passphrase, so it is a copy, not a move; seal it to the target host (toHostKey, --to-host), or pass copyable: true (--allow-copies)');
+  const complete = intent && config.exportProducedBundle(intent);
+  if (!complete) {
+    // Sealed to the target host by default. A passphrase bundle opens on any host with the passphrase:
+    // it is a copy, and says so (final re-review, Finding 7b).
+    if (typeof passphrase === 'string' && !(typeof toHostKey === 'string' && toHostKey) && copyable !== true) {
+      throw new Error('relocation: a passphrase bundle can be imported on any host that has the passphrase, so it is a copy, not a move; seal it to the target host (toHostKey, --to-host), or pass copyable: true (--allow-copies)');
+    }
+    // Validate the sealing input before anything is written: a refused export leaves the node startable.
+    seal(Buffer.alloc(0), { passphrase, toHostKey });
+  }
+  if (intent && !complete) {
+    // A resume: the same recipient, and while a complete bundle may exist at the intent's out, the same out.
+    const recipient = recipientOf({ passphrase, toHostKey });
+    if (intent.recipient && intent.recipient !== recipient) {
+      throw new Error(`relocation: the export of ${id} that did not finish is sealed to ${describeRecipient(intent.recipient)}; run it again with that recipient, or abandon it (sym node abort-export)`);
+    }
+    if (intent.out !== outAbs && (intent.bundleHash || !intent.tombstoned)) {
+      throw new Error(`relocation: the export of ${id} that did not finish may have written a complete bundle to ${intent.out}; resume it with --out ${intent.out} ` +
+        '(a second bundle elsewhere would be a second live copy of the key), or abandon it (sym node abort-export)');
+    }
   }
-  // Validate the sealing input before the tombstone: a refused export must leave the node startable.
-  seal(Buffer.alloc(0), { passphrase, toHostKey });
+  // The identity, with its key: read where it is committed (a pending export refuses a load).
+  const identity = intent ? readIdentityJson(idDir) : config.loadIdentity({ nodeId: id, create: false });
+  if (!identity || identity.nodeId !== id) throw new Error(`relocation: ${id}'s identity cannot be read at ${idDir}`);
   // The identity's lock, held until the export is done: no process starts it in between.
   const release = config.acquireIdentityLock(identity.name, { dir });
   try {
-    return exportLocked({ id, dir, identity, out, passphrase, toHostKey });
+    return exportLocked({ id, dir, idDir, identity, out: outAbs, passphrase, toHostKey });
   } finally {
     try { release(); } catch { /* the lock goes with the process either way */ }
   }
@@ -228,83 +270,103 @@ function readIdentityJson(dir) {
 }
 
 /** @private The export, under the identity's lock. */
-function exportLocked({ id, dir, identity, out, passphrase, toHostKey }) {
-  const idDir = config.identityDirById(id);
-  const outAbs = path.resolve(out);
-  const exportedAt = Date.now();
+function exportLocked({ id, dir, idDir, identity, out, passphrase, toHostKey }) {
   const fingerprint = keyFingerprint(identity.publicKey);
-  // 1. THE INTENT, beside the key. From here this host refuses to start the identity until this export is
-  // finished or abandoned: a bundle may exist from the next step on.
-  config.writeFileDurable(path.join(idDir, config.EXPORTING), JSON.stringify({ nodeId: id, name: identity.name, out: outAbs, startedAt: exportedAt }, null, 2), 0o600);
-  const tomb = { nodeId: id, name: identity.name, movedAt: exportedAt, bundle: outAbs, fingerprint };
+  const pending = config.readExportIntent(id);
+  if (pending && config.exportProducedBundle(pending)) {
+    // The bundle is complete (the agent lives in it): what is left is the scrub.
+    scrubSource(id, identity);
+    removeIntent(id);
+    return { nodeId: id, name: identity.name, files: 0, out: pending.out, fingerprint, resumed: 'scrub' };
+  }
+  if (!identity.privateKey) throw new Error(`relocation: ${id} holds no private key on this host; there is nothing to export`);
+  if (pending && typeof pending.out === 'string') removeTempBundles(pending.out);
+  const startedAt = pending && Number.isFinite(pending.startedAt) ? pending.startedAt : Date.now();
+  const intent = { nodeId: id, name: identity.name, out, recipient: recipientOf({ passphrase, toHostKey }), startedAt, tombstoned: true };
+  // 1. THE INTENT, beside the key.
+  writeIntent(id, intent);
+  // 2. THE TOMBSTONE, beside the key and in the node directory: from here this host (0.14.2 included) never starts the
+  // identity again, so no bundle of it can ever exist beside a live source.
+  const tomb = { nodeId: id, name: identity.name, movedAt: startedAt, bundle: out, fingerprint };
+  writeTombstone(id, tomb);
   // Each file with its mode (final re-review, Finding 7b), so a 0600 file stays 0600 on the target.
   const files = listFiles(dir).filter((rel) => rel !== 'identity.json')
     .map((rel) => ({ path: rel.split(path.sep).join('/'), mode: fs.statSync(path.join(dir, rel)).mode & 0o777, data: fs.readFileSync(path.join(dir, rel)).toString('base64') }));
   // The identity travels as it was loaded (from SYM_IDENTITY_DIR when set), never a stray copy in the node directory.
   files.push({ path: 'identity.json', mode: 0o600, data: Buffer.from(JSON.stringify(identity, null, 2)).toString('base64') });
-  const contents = { format: FORMAT, nodeId: id, name: identity.name, publicKey: identity.publicKey, exportedAt: tomb.movedAt, files };
+  const contents = { format: FORMAT, nodeId: id, name: identity.name, publicKey: identity.publicKey, exportedAt: startedAt, files };
   // The sealing header is chosen first, so the node's signature covers it (the target host key and
   // the ephemeral key included): the bundle is the node's own statement, for that host only.
   // A host key, when given, wins over a passphrase.
   const sealing = sealParams(typeof toHostKey === 'string' && toHostKey ? { toHostKey } : { passphrase });
-  const header = { format: FORMAT, nodeId: id, fingerprint: tomb.fingerprint, publicKey: identity.publicKey, exportedAt: tomb.movedAt, ...sealing.header };
+  const header = { format: FORMAT, nodeId: id, fingerprint, publicKey: identity.publicKey, exportedAt: startedAt, ...sealing.header };
   const signature = signBundle(header, contents, identity.privateKey);
   // The clear header is signed on its own as well, so an import checks it against the pin before it
   // uses anything the header says (the scrypt parameters).
   const headerSig = signHeader(header, identity.privateKey);
   const plain = Buffer.from(JSON.stringify({ ...contents, signature }), 'utf8');
-  const bundle = { ...header, headerSig, ...sealWith(plain, sealing) };
-  // 2. THE BUNDLE, durable.
+  const bytes = Buffer.from(JSON.stringify({ ...header, headerSig, ...sealWith(plain, sealing) }), 'utf8');
+  // 3. THE BUNDLE: its hash first (so a later look can tell a complete bundle at `out`), then the file, durable, then
+  // `complete`.
+  intent.bundleHash = sha256(bytes);
+  writeIntent(id, intent);
   const tmp = `${out}.${process.pid}.tmp`;
   const bfd = fs.openSync(tmp, 'w', 0o600);
-  try { fs.writeSync(bfd, JSON.stringify(bundle)); fs.fsyncSync(bfd); } finally { fs.closeSync(bfd); }
+  try { fs.writeSync(bfd, bytes); fs.fsyncSync(bfd); } finally { fs.closeSync(bfd); }
   fs.renameSync(tmp, out);
-  fsyncDir(path.dirname(outAbs));
-  // 3. THE TOMBSTONE, beside the key (it outlives a rebuilt node directory), then the intent goes.
-  config.writeFileDurable(path.join(idDir, config.TOMBSTONE), JSON.stringify(tomb, null, 2), 0o600);
-  try { fs.unlinkSync(path.join(idDir, config.EXPORTING)); } catch { /* */ }
-  fsyncDir(idDir);
-  // 4. The source loses the key, and the 0.13 path to it.
+  fsyncDir(path.dirname(out));
+  intent.complete = true;
+  writeIntent(id, intent);
+  // 4. The source loses the key (every copy of it on this host), and the 0.13 path to it; then the intent goes.
   scrubSource(id, identity);
+  writeTombstone(id, { ...tomb, bundleHash: intent.bundleHash });
+  removeIntent(id);
   return { nodeId: id, name: identity.name, files: files.length, out, fingerprint };
 }
 
-/** @private Remove the bundles an export to `out` left half written (`<out>.<pid>.tmp`). */
+/** @private Remove the bundles an export to `out` left half written (`<out>.<pid>.tmp`). Returns how many. */
 function removeTempBundles(out) {
   const base = `${path.basename(out)}.`;
   let names = [];
-  try { names = fs.readdirSync(path.dirname(out)); } catch { return; }
-  for (const n of names) if (n.startsWith(base) && /^\d+\.tmp$/.test(n.slice(base.length))) { try { fs.unlinkSync(path.join(path.dirname(out), n)); } catch { /* */ } }
+  try { names = fs.readdirSync(path.dirname(out)); } catch { return 0; }
+  let n = 0;
+  for (const f of names) if (f.startsWith(base) && /^\d+\.tmp$/.test(f.slice(base.length))) { try { fs.unlinkSync(path.join(path.dirname(out), f)); n++; } catch { /* */ } }
   fsyncDir(path.dirname(out));
+  return n;
 }
 
 /**
- * Abandon an export that began and did not finish (an intent, no tombstone): the bundle it wrote is removed,
- * and the intent, so the node starts on this host again. A bundle copied elsewhere meanwhile is not reachable
- * from here: delete that copy too. After the tombstone it is too late (the bundle is the node now): refused.
+ * Abandon an export that began and did not finish, ONLY while it produced no complete bundle (the intent records the
+ * bundle's hash before the bundle is written, and `complete` after): the tombstone and the intent go, and the node starts
+ * on this host again. Once a complete bundle was produced it is refused: the bundle is the node now (a copy of it may
+ * exist), so it is imported where it goes.
  * @param {{ name?: string, nodeId?: string }} o
- * @returns {{ nodeId: string, aborted: boolean, bundle: string|null, bundleRemoved: boolean }}
+ * @returns {{ nodeId: string, aborted: boolean, bundle: string|null, bundleRemoved: boolean, partialRemoved: number }}
  */
 function abortExport({ name, nodeId } = {}) {
   const id = nodeId || (name && config.nodeIdForName(name));
   if (!id) throw new config.IdentityAbsentError(name ? `"${name}"` : 'the node');
-  const tomb = config.readTombstone(id);
-  if (tomb) throw new Error(`relocation: the export of ${id} finished${tomb.bundle ? ` (${tomb.bundle})` : ''} and it is tombstoned here: the bundle is the node now; import it where it goes`);
   const intent = config.readExportIntent(id);
-  if (!intent) return { nodeId: id, aborted: false, bundle: null, bundleRemoved: false };
+  const tomb = config.readTombstone(id);
+  if (!intent) {
+    if (tomb) throw new Error(`relocation: the export of ${id} finished${tomb.bundle ? ` (${tomb.bundle})` : ''} and it is tombstoned here: the bundle is the node now; import it where it goes`);
+    return { nodeId: id, aborted: false, bundle: null, bundleRemoved: false, partialRemoved: 0 };
+  }
   const dir = config.nodeDirById(id);
   if (config.lockHeldInProcess(dir)) throw new Error(`relocation: ${id} is held by a node in this process`);
-  const release = config.acquireIdentityLock(intent.name || (name || 'node'), { dir });
+  const release = config.acquireIdentityLock(intent.name || name || 'node', { dir });
   try {
-    let bundleRemoved = false;
-    if (typeof intent.out === 'string' && intent.out) {
-      try { fs.unlinkSync(intent.out); bundleRemoved = true; } catch (e) { if (e.code !== 'ENOENT') throw e; }
-      removeTempBundles(intent.out);
+    if (config.exportProducedBundle(intent) || (!intent.tombstoned && typeof intent.out === 'string' && fs.existsSync(intent.out))) {
+      throw new Error(`relocation: the export of ${id} produced a complete bundle (${intent.out}${intent.bundleHash ? `, sha256 ${intent.bundleHash}` : ''}): ` +
+        'the bundle is the node now, and a copy of it may exist, so it is not abandoned. Import it where it goes, then run the same export here again to finish removing the key.');
     }
+    const partialRemoved = typeof intent.out === 'string' ? removeTempBundles(intent.out) : 0;
+    // The tombstones first, while the intent is still there (a crash in between leaves the export pending), then the intent.
     for (const d of new Set([config.identityDirById(id), dir])) {
-      try { fs.unlinkSync(path.join(d, config.EXPORTING)); fsyncDir(d); } catch { /* */ }
+      try { fs.unlinkSync(path.join(d, config.TOMBSTONE)); fsyncDir(d); } catch { /* */ }
     }
-    return { nodeId: id, aborted: true, bundle: intent.out || null, bundleRemoved };
+    removeIntent(id);
+    return { nodeId: id, aborted: true, bundle: intent.out || null, bundleRemoved: false, partialRemoved };
   } finally {
     try { release(); } catch { /* */ }
   }
@@ -317,37 +379,29 @@ function fsyncDir(dir) {
 }
 
 /**
- * @private After a durable export: identity.json (in the node dir and SYM_IDENTITY_DIR, and in any 0.13
- * directory the migration set aside) without its private key, written atomically, and the 0.13-compatible
- * `nodes/<name>` links removed.
+ * @private After a complete bundle: every copy of the key on this host loses its private key (identity.json in the
+ * identity directory, a stray one in the node directory, a 0.13 directory or a husk set aside, a 0.13 directory left in
+ * place; the 0.13 E2E keypair beside any of them), each rewritten atomically, and the 0.13-compatible `nodes/<name>`
+ * links removed.
  */
 function scrubSource(id, identity) {
-  const { privateKey, ...rest } = identity;
-  void privateKey;
-  const scrubbed = JSON.stringify({ ...rest, privateKey: null, movedAt: Date.now() }, null, 2);
-  const dirs = new Set([config.nodeDirById(id), config.identityDirById(id)]);
+  const movedAt = Date.now();
+  for (const d of new Set([config.identityDirById(id), ...config.keyHoldersOf(id)])) {
+    const j = readIdentityJson(d);
+    if (j && j.nodeId === id && j.privateKey) config.writeFileAtomic0600(path.join(d, 'identity.json'), JSON.stringify({ ...j, privateKey: null, movedAt }, null, 2));
+    const e2eFile = path.join(d, 'e2e-keypair.json');
+    let e2e = null;
+    try { e2e = JSON.parse(fs.readFileSync(e2eFile, 'utf8')); } catch { /* none */ }
+    if (e2e && typeof e2e === 'object' && e2e.privateKey) config.writeFileAtomic0600(e2eFile, JSON.stringify({ ...e2e, privateKey: null, movedAt }, null, 2));
+  }
   for (const root of [config.NODES_DIR, process.env.SYM_IDENTITY_DIR].filter(Boolean)) {
     let names = [];
-    try { names = fs.readdirSync(path.join(root, config.LEGACY_ASIDE)); } catch { /* none */ }
+    try { names = fs.readdirSync(root); } catch { continue; }
     for (const n of names) {
-      const d = path.join(root, config.LEGACY_ASIDE, n);
-      const j = readIdentityJson(d);
-      if (j && j.nodeId === id && j.privateKey) dirs.add(d);
+      const p = path.join(root, n);
+      if (config.compatLinkNodeId(p) === id) { try { fs.unlinkSync(p); } catch { /* */ } }
     }
   }
-  for (const d of dirs) {
-    const f = path.join(d, 'identity.json');
-    if (!fs.existsSync(f)) continue;
-    const tmp = `${f}.${process.pid}.tmp`;
-    const fd = fs.openSync(tmp, 'w', 0o600);
-    try { fs.writeSync(fd, scrubbed); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
-    fs.renameSync(tmp, f);
-    fsyncDir(d);
-  }
-  for (const root of [config.NODES_DIR, process.env.SYM_IDENTITY_DIR].filter(Boolean)) {
-    const link = path.join(root, identity.name);
-    try { if (fs.lstatSync(link).isSymbolicLink()) fs.unlinkSync(link); } catch { /* none */ }
-  }
 }
 
 /** @private The canonical bytes a bundle's signature covers. */
@@ -445,26 +499,35 @@ function importNode({ from, passphrase, hostPrivateKey, expect, name } = {}) {
   if (tomb && Number.isFinite(tomb.movedAt) && !(plain.exportedAt > tomb.movedAt)) {
     throw new Error(`relocation: refusing ${identity.nodeId}: the bundle was exported at or before this host moved the node away (a replay of an older move)`);
   }
-  const dest = config.nodeDirById(identity.nodeId);
-  const idDest = config.identityDirById(identity.nodeId);
+  const id = identity.nodeId;
+  const dest = config.nodeDirById(id);
+  const idDest = config.identityDirById(id);
   const split = idDest !== dest;
-  const here = fs.existsSync(dest) || (split && fs.existsSync(path.join(idDest, 'identity.json')));
-  if (here && !tomb) throw new Error(`relocation: ${identity.nodeId} already lives on this host`);
   const label = name || identity.name;
   config.validateName(label);
-  const existing = config.nodeIdForName(label);
-  if (existing && existing !== identity.nodeId) throw new Error(`relocation: the name "${label}" already indexes another node here; import with another name`);
   for (const f of plain.files) {
     const rel = String(f.path);
     if (rel.includes('..') || path.isAbsolute(rel) || rel.includes('\\') || !rel) throw new Error(`relocation: refusing a bundle path outside the node: ${rel}`);
   }
-  // STAGED: everything is written to a directory of its own and installed by one rename (config.installNewDir),
-  // so an import refused or failing on the way installs nothing (final re-review, Finding 7b). Directories are
-  // 0700, key files 0600, and with SYM_IDENTITY_DIR the private key goes ONLY into the identity directory.
+  config.clearLeftovers();
+  // "Already here" is decided from the committed identity, never from a directory that merely exists. The identity of
+  // THIS bundle committed by an import that was interrupted before it finished is finished; any other is refused.
+  const bundleTag = sha256(String(plain.signature)).slice(0, 32);
+  const mark = (dir) => { try { return JSON.parse(fs.readFileSync(path.join(dir, config.COMMIT_MARK), 'utf8')); } catch { return null; } };
+  const ours = (dir) => { const m = mark(dir); return Boolean(m && m.nodeId === id && m.bundle === bundleTag); };
+  const committed = config.readCommitted(id);
+  if (committed.state === 'unreadable') throw new Error(`relocation: ${id} already has an identity on this host that cannot be read (${committed.file}); nothing was imported`);
+  const resuming = committed.state === 'ok' && !tomb && ours(idDest);
+  if (committed.state === 'ok' && !tomb && !resuming) throw new Error(`relocation: ${id} already lives on this host`);
+  const existing = config.nodeIdForName(label);
+  if (existing && existing !== id) throw new Error(`relocation: the name "${label}" already indexes another node here; import with another name`);
+  // STAGED: each directory is written in a staging directory of its own beside its destination and installed by one
+  // rename, the IDENTITY FIRST (it is the commit: the agent exists from then on) and the node directory after, each
+  // carrying the import's commit record. Directories are 0700, key files 0600, and with SYM_IDENTITY_DIR the private
+  // key goes ONLY into the identity directory (final re-review, Finding 7b).
   const keyFiles = new Set(config.PRIVATE_KEY_FILES);
   const write = (root, f) => {
-    const rel = String(f.path);
-    const parts = rel.split('/');
+    const parts = String(f.path).split('/');
     let d = root;
     for (const part of parts.slice(0, -1)) {
       d = path.join(d, part);
@@ -473,21 +536,32 @@ function importNode({ from, passphrase, hostPrivateKey, expect, name } = {}) {
     const mode = keyFiles.has(parts[parts.length - 1]) ? 0o600 : (Number.isSafeInteger(f.mode) ? (f.mode & 0o777) : 0o644);
     config.writeNewFileSynced(path.join(root, ...parts), Buffer.from(f.data, 'base64'), mode);
   };
-  const archive = (d) => { if (fs.existsSync(d)) { fs.renameSync(d, path.join(path.dirname(d), `.${identity.nodeId}.moved-${Date.now()}`)); fsyncDir(path.dirname(d)); } };
   // What a node directory holds that is this host's own state (a lock, a tombstone, an export intent, the commit
   // record) is never taken from a bundle.
   const hostState = (rel) => SKIP.has(rel) || rel.startsWith('lock.pid.');
-  config.installNewDir(dest, identity.nodeId, (staging) => {
-    for (const f of plain.files) if (!(split && String(f.path) === 'identity.json') && !hostState(String(f.path))) write(staging, f);
-  }, 'import', { beforeCommit: () => archive(dest) }); // the tombstoned copy of a node coming back is kept aside
-  if (split) {
-    config.installNewDir(idDest, identity.nodeId, (staging) => write(staging, idFile), 'import', { beforeCommit: () => archive(idDest) });
-  }
-  try { fs.appendFileSync(path.join(config.SYM_DIR, CONSUMED_FILE), JSON.stringify({ nodeId: identity.nodeId, signature: plain.signature, exportedAt: plain.exportedAt, importedAt: Date.now() }) + '\n', { mode: 0o600 }); }
+  const install = (target, build) => {
+    const staging = config.makeStaging(path.dirname(target), id, 'import');
+    try {
+      build(staging);
+      config.writeNewFileSynced(path.join(staging, config.COMMIT_MARK), JSON.stringify({ nodeId: id, from: 'import', bundle: bundleTag, at: Date.now() }) + '\n', 0o600);
+      fsyncDir(staging);
+      config.clearForInstall(target, id); // what is there (a node coming back, tombstoned; a directory a start made meanwhile) is kept aside
+      fs.renameSync(staging, target);
+      fsyncDir(path.dirname(target));
+    } finally {
+      fs.rmSync(staging, { recursive: true, force: true });
+    }
+  };
+  const storeFiles = (staging) => { for (const f of plain.files) if (!(split && String(f.path) === 'identity.json') && !hostState(String(f.path))) write(staging, f); };
+  if (!resuming) install(idDest, split ? (staging) => write(staging, idFile) : storeFiles); // THE COMMIT
+  if (split && !ours(dest)) install(dest, storeFiles);
+  const claimed = config.claimName(label, id, label);
+  if (claimed && claimed !== id) throw new Error(`relocation: the name "${label}" was claimed for another node meanwhile; ${id} is installed here, unnamed: start it by its nodeId, or rename`);
+  config.ensureCompatLinks(label, id);
+  try { fs.appendFileSync(path.join(config.SYM_DIR, CONSUMED_FILE), JSON.stringify({ nodeId: id, signature: plain.signature, exportedAt: plain.exportedAt, importedAt: Date.now() }) + '\n', { mode: 0o600 }); }
   catch { /* best effort: the tombstone check still refuses an older bundle */ }
-  // indexName is internal to config; loadIdentity by nodeId + name writes the index.
-  config.loadIdentity({ nodeId: identity.nodeId, name: label, create: false });
-  return { nodeId: identity.nodeId, name: label, files: plain.files.length, pinnedBy };
+  config.loadIdentity({ nodeId: id, name: label, create: false });
+  return { nodeId: id, name: label, files: plain.files.length, pinnedBy, ...(resuming ? { resumed: true } : {}) };
 }
 
 module.exports = { exportNode, abortExport, importNode, hostKey, FORMAT };
diff --git a/scripts/identity-fuzz/common.js b/scripts/identity-fuzz/common.js
new file mode 100644
index 00000000..69cd5402
--- /dev/null
+++ b/scripts/identity-fuzz/common.js
@@ -0,0 +1,60 @@
+'use strict';
+/**
+ * Shared by the identity fuzz scripts (0.14.3, design v2). Nothing here touches ~/.sym: every run is in a state root of
+ * its own under the work directory (SYM_FUZZ_WORK, default a temp dir).
+ *
+ *   node scripts/identity-fuzz/prepare.js            git archive v0.14.2 and v0.13.17 into the work dir (rollback trees)
+ *   node scripts/identity-fuzz/kill.js <scenario>    kill -9 at every mutating step of one operation, then the checks
+ *   node scripts/identity-fuzz/race.js <kind>         real processes starting one agent at once (and some SIGKILLed)
+ *   node scripts/identity-fuzz/rollback.js           a 0.14.2 host upgraded to this tree and rolled back; timing
+ *
+ * FAR (SYM_FUZZ_FAR): a directory on ANOTHER volume (e.g. an hdiutil HFS+ sparse image on macOS, a tmpfs on Linux) for
+ * the cross-volume scenarios. The 1-minute load is checked before each step (SYM_FUZZ_LOAD_MAX, default 10).
+ */
+const fs = require('fs'); const path = require('path'); const os = require('os'); const cp = require('child_process'); const crypto = require('crypto');
+
+const WORK = process.env.SYM_FUZZ_WORK || path.join(os.tmpdir(), 'sym-identity-fuzz');
+const REPO = path.resolve(__dirname, '../..');
+const LIB = {
+  mine: path.join(REPO, 'lib'),
+  base: process.env.SYM_FUZZ_BASE || path.join(WORK, 'trees', '0.14.2', 'lib'),
+  v013: process.env.SYM_FUZZ_V013 || path.join(WORK, 'trees', '0.13.17', 'lib'),
+};
+const FAR = process.env.SYM_FUZZ_FAR || null;
+const sab = new Int32Array(new SharedArrayBuffer(4));
+const waitForLoad = () => { const max = Number(process.env.SYM_FUZZ_LOAD_MAX || 10); while (os.loadavg()[0] >= max) Atomics.wait(sab, 0, 0, 3000); };
+
+function makeIdentity(name) {
+  const kp = crypto.generateKeyPairSync('ed25519'); const ts = Date.now(); const b = crypto.randomBytes(16);
+  b[0] = (ts / 2 ** 40) & 0xff; b[1] = (ts / 2 ** 32) & 0xff; b[2] = (ts / 2 ** 24) & 0xff; b[3] = (ts / 2 ** 16) & 0xff; b[4] = (ts / 2 ** 8) & 0xff; b[5] = ts & 0xff;
+  b[6] = (b[6] & 0x0f) | 0x70; b[8] = (b[8] & 0x3f) | 0x80; const hx = b.toString('hex');
+  return {
+    nodeId: `${hx.slice(0, 8)}-${hx.slice(8, 12)}-${hx.slice(12, 16)}-${hx.slice(16, 20)}-${hx.slice(20)}`, name, hostname: 'h.local', createdAt: 1,
+    publicKey: kp.publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'),
+    privateKey: kp.privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'),
+  };
+}
+const put = (f, t, m = 0o644) => { fs.mkdirSync(path.dirname(f), { recursive: true }); fs.writeFileSync(f, t); fs.chmodSync(f, m); };
+/** A 0.13 agent as 0.13 wrote it: identity.json and e2e-keypair.json at 0644, a store of `nf` files. */
+function legacy(dir, id, nf = 12, size = 0) {
+  put(path.join(dir, 'identity.json'), JSON.stringify(id, null, 2));
+  put(path.join(dir, 'e2e-keypair.json'), JSON.stringify({ publicKey: 'p', privateKey: `e2e-${id.nodeId}` }));
+  for (let i = 0; i < nf; i++) put(path.join(dir, 'cmbs', `c${i}.json`), JSON.stringify({ i, pad: 'x'.repeat(size) }));
+}
+function newRoot(tag) {
+  fs.mkdirSync(path.join(WORK, 'runs'), { recursive: true });
+  const root = fs.mkdtempSync(path.join(WORK, 'runs', `${tag}-`));
+  fs.mkdirSync(path.join(root, 'state', 'nodes'), { recursive: true });
+  return root;
+}
+const envFor = (root, extra = {}) => ({ ...process.env, HOME: root, USERPROFILE: root, SYM_STATE_DIR: path.join(root, 'state'), SYM_IDENTITY_DIR: '', ...extra });
+/** One operation in a child process (op.js), optionally SIGKILLed at its k-th mutating fs call. */
+function op(lib, spec, env, k, when = 'before') {
+  const args = [path.join(__dirname, 'op.js'), lib, JSON.stringify(spec)];
+  if (k !== undefined) args.push(String(k), when);
+  const r = cp.spawnSync(process.execPath, args, { env, encoding: 'utf8', timeout: 120000 });
+  if (r.signal === 'SIGKILL') return { killed: true };
+  const line = (r.stdout || '').trim().split('\n').filter((l) => l.startsWith('{')).pop();
+  try { return JSON.parse(line); } catch { return { ok: false, err: 'CRASH', msg: String(r.stderr || '').slice(0, 300) }; }
+}
+module.exports = { WORK, REPO, LIB, FAR, waitForLoad, makeIdentity, put, legacy, newRoot, envFor, op };
diff --git a/scripts/identity-fuzz/kill.js b/scripts/identity-fuzz/kill.js
new file mode 100644
index 00000000..f481ef55
--- /dev/null
+++ b/scripts/identity-fuzz/kill.js
@@ -0,0 +1,163 @@
+'use strict';
+/**
+ * node scripts/identity-fuzz/kill.js <scenario>: kill -9 at every mutating fs step (before it and after it) of one
+ * operation of this tree, then check what follows. Migration scenarios: this tree's next start by name and pinned (the
+ * same agent, its whole store, every copy of its key 0600), a 0.14.2 rollback, a 0.13 rollback, and this tree then
+ * 0.14.2. Export: never a startable source beside a complete bundle; resume or abort; the move completes on another
+ * host. Import: the retry completes, and the agent loads by pin, by name, and under 0.14.2.
+ *
+ * Scenarios: legacy legacy-pinned legacy-husk legacy-husk-content split mint mint-split xvol-byid xvol-identity
+ * (the xvol ones need SYM_FUZZ_FAR on another volume) export export-split import import-split.
+ */
+const fs = require('fs'); const path = require('path'); const cp = require('child_process');
+const { LIB, FAR, waitForLoad, makeIdentity, put, legacy, newRoot, envFor, op } = require('./common');
+const scenario = process.argv[2];
+const NF = 12;
+const SC = {
+  legacy: (root) => { const id = makeIdentity('agent'); legacy(path.join(root, 'state/nodes/agent'), id, NF); return { id, spec: { op: 'load', name: 'agent' } }; },
+  'legacy-pinned': (root) => { const id = makeIdentity('agent'); legacy(path.join(root, 'state/nodes/agent'), id, NF); return { id, spec: { op: 'load', name: 'agent', nodeId: id.nodeId, create: false } }; },
+  'legacy-husk': (root) => { const id = makeIdentity('agent'); legacy(path.join(root, 'state/nodes/agent'), id, NF); put(path.join(root, 'state/nodes/by-id', id.nodeId, 'lock.pid'), '2147483646\n'); return { id, spec: { op: 'load', name: 'agent' } }; },
+  'legacy-husk-content': (root) => {
+    const id = makeIdentity('agent'); legacy(path.join(root, 'state/nodes/agent'), id, NF);
+    put(path.join(root, 'state/nodes/by-id', id.nodeId, 'cmbs', 'c0.json'), '{"husk":1}'); put(path.join(root, 'state/nodes/by-id', id.nodeId, 'extra.json'), '{}');
+    return { id, spec: { op: 'load', name: 'agent' } };
+  },
+  split: (root) => {
+    const id = makeIdentity('agent'); legacy(path.join(root, 'state/nodes/agent'), id, NF); fs.rmSync(path.join(root, 'state/nodes/agent/identity.json'));
+    put(path.join(root, 'idvol/agent/identity.json'), JSON.stringify(id)); return { id, env: { SYM_IDENTITY_DIR: path.join(root, 'idvol') }, spec: { op: 'load', name: 'agent' } };
+  },
+  'xvol-byid': (root) => {
+    const id = makeIdentity('agent'); legacy(path.join(root, 'state/nodes/agent'), id, NF);
+    const far = fs.mkdtempSync(path.join(FAR, 'kf-')); fs.symlinkSync(far, path.join(root, 'state/nodes/by-id')); return { id, far, spec: { op: 'load', name: 'agent' } };
+  },
+  'xvol-identity': (root) => {
+    const id = makeIdentity('agent'); legacy(path.join(root, 'state/nodes/agent'), id, NF); fs.rmSync(path.join(root, 'state/nodes/agent/identity.json'));
+    put(path.join(root, 'idvol/agent/identity.json'), JSON.stringify(id));
+    const far = fs.mkdtempSync(path.join(FAR, 'kf-')); fs.symlinkSync(far, path.join(root, 'idvol/by-id'));
+    return { id, far, env: { SYM_IDENTITY_DIR: path.join(root, 'idvol') }, spec: { op: 'load', name: 'agent' } };
+  },
+  mint: () => ({ id: null, spec: { op: 'load', name: 'agent' } }),
+  'mint-split': (root) => ({ id: null, env: { SYM_IDENTITY_DIR: path.join(root, 'idvol') }, spec: { op: 'load', name: 'agent' } }),
+};
+if (/^xvol/.test(scenario) && !FAR) { console.error('set SYM_FUZZ_FAR to a directory on another volume'); process.exit(2); }
+const tally = {}; const bump = (k) => { tally[k] = (tally[k] || 0) + 1; };
+const same = (r, id) => Boolean(r && r.ok && id && r.nodeId === id.nodeId && r.key === id.privateKey);
+const looseKeys = (dirs, key) => {
+  const bad = [];
+  const walk = (d) => { let es = []; try { es = fs.readdirSync(d); } catch { return; } for (const e of es) { const p = path.join(d, e); const st = fs.lstatSync(p); if (st.isDirectory()) walk(p); else if (st.isFile() && /^(identity|e2e-keypair)\.json$/.test(e) && fs.readFileSync(p, 'utf8').includes(key) && (st.mode & 0o077)) bad.push(p); } };
+  dirs.filter(Boolean).forEach(walk); return bad;
+};
+
+function migration() {
+  const fresh = () => { const root = newRoot(scenario); const sc = SC[scenario](root); return { root, sc, env: envFor(root, sc.env) }; };
+  const done = (f) => { fs.rmSync(f.root, { recursive: true, force: true }); if (f.sc.far) fs.rmSync(f.sc.far, { recursive: true, force: true }); };
+  const f0 = fresh(); const n0 = op(LIB.mine, f0.sc.spec, f0.env, 0); done(f0);
+  if (!n0.ok) { console.log('the operation fails without a kill:', JSON.stringify(n0)); process.exit(1); }
+  for (let k = 1; k <= n0.steps; k++) {
+    for (const when of ['before', 'after']) {
+      waitForLoad();
+      const res = {};
+      for (const check of ['next', 'pinned', '0.14.2', '0.13', 'next>0.14.2']) {
+        const f = fresh();
+        if (!op(LIB.mine, f.sc.spec, f.env, k, when).killed) { res.kill = 'not-reached'; done(f); break; }
+        const load = (lib, extra = {}) => op(lib, { op: 'load', name: 'agent', ...extra }, f.env);
+        const id = f.sc.id;
+        if (check === 'next') {
+          const a = load(LIB.mine); const b = load(LIB.mine);
+          const ok = id ? same(a, id) && same(b, id) : a.ok && b.ok && a.nodeId === b.nodeId;
+          let note = '';
+          if (ok && id) { let n = 0; try { n = fs.readdirSync(path.join(f.root, 'state/nodes/by-id', id.nodeId, 'cmbs')).length; } catch { /* */ } if (n !== NF) note += ` STORE ${n}/${NF}`; }
+          if (ok) { const loose = looseKeys([f.root, f.sc.far], a.key); if (loose.length) note += ` LOOSE-KEY ${loose.map((p) => path.relative(f.root, p)).join(',')}`; }
+          res[check] = (ok ? 'same' : (a.ok ? 'NEW' : a.err)) + note;
+        } else if (check === 'pinned') {
+          const ref = id || (() => { const m = load(LIB.mine); return { nodeId: m.nodeId, privateKey: m.key }; })();
+          res[check] = same(load(LIB.mine, { nodeId: ref.nodeId, create: false }), ref) ? 'same' : 'DIFF';
+        } else if (check === 'next>0.14.2') {
+          const m = load(LIB.mine); const r = load(LIB.base);
+          const ref = id || { nodeId: m.nodeId, privateKey: m.key };
+          res[check] = same(m, ref) && same(r, ref) ? 'same' : `next=${same(m, ref) ? 'same' : m.err || 'NEW'} 0.14.2=${same(r, ref) ? 'same' : r.err || 'NEW'}`;
+        } else {
+          const r = load(check === '0.14.2' ? LIB.base : LIB.v013);
+          const m = load(LIB.mine); // and this tree afterwards
+          const ref = id || (m.ok ? { nodeId: m.nodeId, privateKey: m.key } : null);
+          res[check] = (same(r, ref) ? 'same' : (r.ok ? 'NEW' : r.err)) + (id && !same(m, id) ? ` then next=${m.ok ? 'NEW' : m.err}` : '');
+        }
+        done(f);
+      }
+      for (const [a, b] of Object.entries(res)) bump(`${a}:${String(b).split(' ')[0]}`);
+      if (Object.values(res).some((v) => v !== 'same')) console.log(`k=${k} ${when}: ${Object.entries(res).map(([a, b]) => `${a}=${b}`).join(' ')}`);
+    }
+  }
+  console.log(`${scenario}: ${n0.steps} steps, ${2 * n0.steps} crash points`, JSON.stringify(tally));
+}
+
+function relocation(what, split) {
+  const host = (tag) => { const root = newRoot(tag); return { root, env: envFor(root, split ? { SYM_IDENTITY_DIR: path.join(root, 'idvol') } : {}) }; };
+  const setup = () => {
+    const A = host('xa'); const B = host('xb');
+    const hk = op(LIB.mine, { op: 'hostkey' }, B.env);
+    const made = op(LIB.mine, { op: 'load', name: 'agent' }, A.env);
+    const dir = path.join(A.root, 'state/nodes/by-id', made.nodeId, 'cmbs');
+    for (let i = 0; i < 5; i++) put(path.join(dir, `m${i}.json`), '{}');
+    const pub = JSON.parse(fs.readFileSync(path.join(split ? path.join(A.root, 'idvol') : path.join(A.root, 'state/nodes'), 'by-id', made.nodeId, 'identity.json'), 'utf8')).publicKey;
+    const out = path.join(A.root, 'agent.bundle');
+    return { A, B, hk, id: { nodeId: made.nodeId, privateKey: made.key, publicKey: pub }, out, exportSpec: { op: 'export', name: 'agent', out, toHostKey: hk.publicKey } };
+  };
+  const done = (x) => { fs.rmSync(x.A.root, { recursive: true, force: true }); fs.rmSync(x.B.root, { recursive: true, force: true }); };
+  const grep = (root, key) => cp.spawnSync('grep', ['-rl', key, root], { encoding: 'utf8' }).stdout.trim().split('\n').filter((f) => f && !/\.bundle(\.\d+\.tmp)?$/.test(f));
+  const s0 = setup();
+  const importSpec = (x) => ({ op: 'import', from: x.out, hostPrivateKey: x.hk.privateKey, expect: { nodeId: x.id.nodeId, key: x.id.publicKey } });
+  let N;
+  if (what === 'export') N = op(LIB.mine, s0.exportSpec, s0.A.env, 0).steps;
+  else { op(LIB.mine, s0.exportSpec, s0.A.env); N = op(LIB.mine, importSpec(s0), s0.B.env, 0).steps; }
+  done(s0);
+  for (let k = 1; k <= N; k++) {
+    for (const when of ['before', 'after']) {
+      waitForLoad();
+      const x = setup(); const line = [];
+      let good;
+      if (what === 'export') {
+        if (!op(LIB.mine, x.exportSpec, x.A.env, k, when).killed) { bump('not-reached'); done(x); continue; }
+        const mine = op(LIB.mine, { op: 'load', name: 'agent' }, x.A.env);
+        const base = op(LIB.base, { op: 'load', name: 'agent', nodeId: x.id.nodeId, create: false }, x.A.env);
+        const complete = fs.existsSync(x.out);
+        const unsafe = complete && ((mine.ok && mine.key) || (base.ok && base.key));
+        line.push(unsafe ? 'UNSAFE' : 'safe', `complete=${complete}`, `start=${mine.ok ? 'starts' : mine.err}`, `0.14.2=${base.ok ? (base.key ? 'starts' : 'keyless') : base.err}`);
+        const ab = op(LIB.mine, { op: 'abort', name: 'agent' }, x.A.env);
+        const aborted = ab.ok && ab.aborted;
+        if (aborted) {
+          const again = op(LIB.mine, { op: 'load', name: 'agent' }, x.A.env);
+          good = !unsafe && same(again, x.id) && !fs.existsSync(x.out);
+          line.push(`abort=${same(again, x.id) ? 'source starts again' : 'BAD'}`);
+        } else {
+          const resume = op(LIB.mine, x.exportSpec, x.A.env);
+          const finished = resume.ok || /already tombstoned/.test(resume.msg || '');
+          const left = grep(x.A.root, x.id.privateKey);
+          const after = op(LIB.mine, { op: 'load', name: 'agent' }, x.A.env);
+          const imp = fs.existsSync(x.out) ? op(LIB.mine, importSpec(x), x.B.env) : { ok: false, err: 'no bundle' };
+          const onB = op(LIB.mine, { op: 'load', name: 'agent', nodeId: x.id.nodeId, create: false }, x.B.env);
+          good = !unsafe && finished && !left.length && !after.ok && imp.ok && same(onB, x.id);
+          line.push(`abort=${ab.ok ? 'nothing to abort' : 'refused'}`, `resume=${finished ? 'ok' : resume.msg}`, `key-left=${left.map((f) => path.relative(x.A.root, f)).join(',') || 0}`, `import=${imp.ok ? 'ok' : imp.err}`, `B=${same(onB, x.id) ? 'the agent' : onB.err}`);
+        }
+      } else {
+        op(LIB.mine, x.exportSpec, x.A.env);
+        if (!op(LIB.mine, importSpec(x), x.B.env, k, when).killed) { bump('not-reached'); done(x); continue; }
+        const retry = op(LIB.mine, importSpec(x), x.B.env);
+        const pinned = op(LIB.mine, { op: 'load', name: 'agent', nodeId: x.id.nodeId, create: false }, x.B.env);
+        const byName = op(LIB.mine, { op: 'load', name: 'agent' }, x.B.env);
+        const base = op(LIB.base, { op: 'load', name: 'agent' }, x.B.env);
+        let store = 0; try { store = fs.readdirSync(path.join(x.B.root, 'state/nodes/by-id', x.id.nodeId, 'cmbs')).length; } catch { /* */ }
+        good = (retry.ok || /already imported/.test(retry.msg || '')) && same(pinned, x.id) && same(byName, x.id) && same(base, x.id) && store === 5;
+        line.push(`retry=${retry.ok ? 'ok' : retry.msg}`, `pinned=${same(pinned, x.id) ? 'the agent' : pinned.err}`, `byName=${same(byName, x.id) ? 'the agent' : byName.err}`, `0.14.2=${same(base, x.id) ? 'the agent' : base.err}`, `store=${store}`);
+      }
+      bump(good ? 'good' : 'BAD');
+      if (!good) console.log(`k=${k} ${when}: ${line.join(' ')}`);
+      done(x);
+    }
+  }
+  console.log(`${what}${split ? '-split' : ''}: ${N} steps, ${2 * N} crash points`, JSON.stringify(tally));
+}
+
+if (SC[scenario]) migration();
+else if (/^(export|import)(-split)?$/.test(scenario)) relocation(scenario.split('-')[0], scenario.endsWith('-split'));
+else { console.error(`unknown scenario ${scenario}`); process.exit(2); }
diff --git a/scripts/identity-fuzz/op.js b/scripts/identity-fuzz/op.js
new file mode 100644
index 00000000..772f09c1
--- /dev/null
+++ b/scripts/identity-fuzz/op.js
@@ -0,0 +1,40 @@
+'use strict';
+// node op.js <libdir> <json spec> [k] [before|after]: one identity operation; with k, SIGKILL at the k-th mutating fs call
+// (k = 0 counts them). spec.op: load | export | abort | import. Prints one JSON line.
+const fs = require('fs');
+const [lib, specText, kText, when = 'before'] = process.argv.slice(2);
+const spec = JSON.parse(specText); const k = kText === undefined ? null : Number(kText);
+if (process.env.SYM_IDENTITY_DIR === '') delete process.env.SYM_IDENTITY_DIR;
+let n = 0; let armed = false;
+if (k !== null) {
+  for (const fn of ['renameSync', 'symlinkSync', 'linkSync', 'unlinkSync', 'rmdirSync', 'rmSync', 'mkdirSync', 'writeSync', 'fsyncSync', 'chmodSync', 'copyFileSync', 'writeFileSync', 'appendFileSync', 'openSync']) {
+    const orig = fs[fn];
+    fs[fn] = function (...a) {
+      if (!armed || (fn === 'openSync' && !/[wax+]/.test(String(a[1] || 'r')))) return orig.apply(this, a);
+      n++;
+      if (k && n === k && when === 'before') process.kill(process.pid, 'SIGKILL');
+      const r = orig.apply(this, a);
+      if (k && n === k && when === 'after') process.kill(process.pid, 'SIGKILL');
+      return r;
+    };
+  }
+}
+const c = require(`${lib}/config`);
+const out = (o) => process.stdout.write(`${JSON.stringify({ steps: n, ...o })}\n`);
+armed = true;
+try {
+  if (spec.op === 'load') {
+    const i = c.loadIdentity ? c.loadIdentity({ name: spec.name, nodeId: spec.nodeId, create: spec.create }) : c.loadOrCreateIdentity(spec.name);
+    armed = false; out({ ok: true, nodeId: i.nodeId, key: i.privateKey });
+  } else if (spec.op === 'export') {
+    const x = require(`${lib}/relocation`).exportNode({ name: spec.name, out: spec.out, toHostKey: spec.toHostKey });
+    armed = false; out({ ok: true, out: x.out, resumed: x.resumed || null });
+  } else if (spec.op === 'abort') {
+    const x = require(`${lib}/relocation`).abortExport({ name: spec.name }); armed = false; out({ ok: true, aborted: x.aborted });
+  } else if (spec.op === 'import') {
+    const x = require(`${lib}/relocation`).importNode({ from: spec.from, hostPrivateKey: spec.hostPrivateKey, expect: spec.expect });
+    armed = false; out({ ok: true, imported: x.nodeId });
+  } else if (spec.op === 'hostkey') {
+    armed = false; out({ ok: true, ...require(`${lib}/relocation`).hostKey() });
+  }
+} catch (e) { armed = false; out({ ok: false, err: e.code || e.name, msg: String(e.message).split('\n').filter(Boolean).slice(0, 2).join(' ').slice(0, 300) }); }
diff --git a/scripts/identity-fuzz/prepare.js b/scripts/identity-fuzz/prepare.js
new file mode 100644
index 00000000..544d90a2
--- /dev/null
+++ b/scripts/identity-fuzz/prepare.js
@@ -0,0 +1,11 @@
+'use strict';
+// node scripts/identity-fuzz/prepare.js: git archive the 0.14.2 and 0.13.17 releases into the work dir (never a stash).
+const fs = require('fs'); const path = require('path'); const cp = require('child_process');
+const { WORK, REPO } = require('./common');
+for (const [tag, dir] of [['v0.14.2', '0.14.2'], ['v0.13.17', '0.13.17']]) {
+  const to = path.join(WORK, 'trees', dir);
+  fs.rmSync(to, { recursive: true, force: true }); fs.mkdirSync(to, { recursive: true });
+  cp.execSync(`git -C ${JSON.stringify(REPO)} archive ${tag} | tar -x -C ${JSON.stringify(to)}`);
+  fs.symlinkSync(path.join(REPO, 'node_modules'), path.join(to, 'node_modules'));
+  console.log(`${tag} -> ${to}`);
+}
diff --git a/scripts/identity-fuzz/race.js b/scripts/identity-fuzz/race.js
new file mode 100644
index 00000000..559fbe86
--- /dev/null
+++ b/scripts/identity-fuzz/race.js
@@ -0,0 +1,58 @@
+'use strict';
+/**
+ * node scripts/identity-fuzz/race.js <kind> [rounds] [starters]: real processes start one agent at the same moment.
+ * kind: legacy | pinned-mix | husk | husk-content | split | new | chaos (some SIGKILLed at a random moment) |
+ * mixed (half of them 0.14.2) | only-0.14.2. After each round a clean start of this tree must load the original agent
+ * (for new: the one agent all loaded) with its whole store, with exactly one identity of the name on disk.
+ */
+const fs = require('fs'); const path = require('path'); const cp = require('child_process');
+const { LIB, waitForLoad, makeIdentity, put, legacy, newRoot, envFor, op } = require('./common');
+const [kind, roundsText = '10', nText = '6'] = process.argv.slice(2);
+const ROUNDS = Number(roundsText); const N = Number(nText); const NF = 200;
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function startAll(specs, env) {
+  const at = Date.now() + 500;
+  return specs.map(({ lib, spec }) => {
+    const code = `const t=${at}; while (Date.now() < t) {} require(${JSON.stringify(path.join(__dirname, 'op.js'))});`;
+    const p = cp.spawn(process.execPath, ['-e', `process.argv.splice(1, 0, 'op'); ${code}`, lib, JSON.stringify(spec)], { env });
+    let so = ''; p.stdout.on('data', (d) => { so += d; });
+    return { p, done: new Promise((res) => p.on('close', (c, sig) => { const l = so.trim().split('\n').filter((x) => x.startsWith('{')).pop(); try { res(sig ? { killed: true } : JSON.parse(l)); } catch { res({ ok: false, err: 'CRASH' }); } })) };
+  });
+}
+(async () => {
+  const tally = {};
+  for (let r = 0; r < ROUNDS; r++) {
+    waitForLoad();
+    const root = newRoot(`race-${kind}`); const nodes = path.join(root, 'state', 'nodes');
+    const split = kind === 'split';
+    const env = envFor(root, split ? { SYM_IDENTITY_DIR: path.join(root, 'idvol') } : {});
+    const id = makeIdentity('agent');
+    if (kind !== 'new') legacy(path.join(nodes, 'agent'), id, NF);
+    if (split) { fs.rmSync(path.join(nodes, 'agent', 'identity.json')); put(path.join(root, 'idvol', 'agent', 'identity.json'), JSON.stringify(id)); }
+    if (kind === 'husk' || kind === 'chaos') put(path.join(nodes, 'by-id', id.nodeId, 'lock.pid'), '2147483646\n');
+    if (kind === 'husk-content') put(path.join(nodes, 'by-id', id.nodeId, 'cmbs', 'from-0142.json'), '{}');
+    const specs = Array.from({ length: N }, (_, i) => {
+      const pinned = (kind === 'pinned-mix' || kind === 'chaos') && i % 2;
+      const lib = kind === 'only-0.14.2' || (kind === 'mixed' && i % 2) ? LIB.base : LIB.mine;
+      return { lib, spec: pinned ? { op: 'load', name: 'agent', nodeId: id.nodeId, create: false } : { op: 'load', name: 'agent' } };
+    });
+    const procs = startAll(specs, env);
+    if (kind === 'chaos') { await sleep(500 + Math.floor(Math.random() * 120)); for (const x of procs) if (Math.random() < 0.6) x.p.kill('SIGKILL'); }
+    const res = await Promise.all(procs.map((x) => x.done));
+    const after = op(LIB.mine, { op: 'load', name: 'agent' }, env);
+    const ids = new Set(res.filter((x) => x.ok).map((x) => x.nodeId));
+    const want = kind === 'new' ? [...ids][0] : id.nodeId;
+    const roots = [path.join(nodes, 'by-id'), split ? path.join(root, 'idvol', 'by-id') : null].filter(Boolean);
+    const named = new Set();
+    for (const d of roots) { let es = []; try { es = fs.readdirSync(d); } catch { /* */ } for (const e of es) { if (e.startsWith('.')) continue; try { const j = JSON.parse(fs.readFileSync(path.join(d, e, 'identity.json'), 'utf8')); if (j.name === 'agent' && j.privateKey) named.add(e); } catch { /* */ } } }
+    let store = NF; if (kind !== 'new') { try { store = fs.readdirSync(path.join(nodes, 'by-id', id.nodeId, 'cmbs')).filter((f) => /^c\d+\.json$/.test(f)).length; } catch { store = -1; } }
+    const startersOk = res.every((x) => x.killed || !x.ok || x.nodeId === want);
+    const good = after.ok && after.nodeId === want && (kind === 'new' || after.key === id.privateKey) && store === NF && named.size === 1 && startersOk;
+    const verdict = good ? 'good' : 'BAD';
+    tally[verdict] = (tally[verdict] || 0) + 1;
+    const outs = res.map((x) => (x.killed ? 'killed' : x.ok ? (x.nodeId === want ? 'same' : 'NEW') : x.err));
+    if (!good) console.log(`r${r}: starters=[${outs.join(',')}] after=${after.ok ? (after.nodeId === want ? 'same' : 'NEW') : `${after.err}: ${after.msg}`} identities named agent=${named.size} store=${store}`);
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+  console.log(`${kind}: ${ROUNDS} rounds of ${N} starters`, JSON.stringify(tally));
+})();
diff --git a/scripts/identity-fuzz/rollback.js b/scripts/identity-fuzz/rollback.js
new file mode 100644
index 00000000..cd6c0f89
--- /dev/null
+++ b/scripts/identity-fuzz/rollback.js
@@ -0,0 +1,69 @@
+'use strict';
+/**
+ * node scripts/identity-fuzz/rollback.js: a host that 0.14.2 ran (0.13 agents it migrated, agents it made, one it
+ * renamed, one whose name it re-pointed for a pinned start, a mixed-case name, SYM_IDENTITY_DIR agents), started twice
+ * by this tree, then rolled back to 0.14.2: every agent must load by name and pinned as what 0.14.2 ran, in every phase.
+ * Then timing: the first start of a 5,000-file 0.13 agent, and 12 0.13 agents in one process.
+ */
+const fs = require('fs'); const path = require('path');
+const { LIB, makeIdentity, put, legacy, newRoot, envFor, op } = require('./common');
+let bad = 0;
+function host(split) {
+  const root = newRoot(split ? 'rb-split' : 'rb'); const nodes = path.join(root, 'state', 'nodes'); const idvol = path.join(root, 'idvol');
+  const env = envFor(root, split ? { SYM_IDENTITY_DIR: idvol } : {});
+  const base = (spec) => op(LIB.base, spec, env);
+  const expect = {};
+  if (!split) {
+    const a = makeIdentity('alpha'); legacy(path.join(nodes, 'alpha'), a, 20); base({ op: 'load', name: 'alpha' }); expect.alpha = a.nodeId;
+    expect.gamma = base({ op: 'load', name: 'gamma' }).nodeId;
+    const e = makeIdentity('eps'); legacy(path.join(nodes, 'eps'), e, 5); expect.eps = e.nodeId; // 0.14.2 never moved it (a pinned start was refused)
+    put(path.join(nodes, 'theta', 'cmbs', 'c.json'), '{}'); expect.theta = base({ op: 'load', name: 'theta' }).nodeId;
+    const i = makeIdentity('iota'); legacy(path.join(nodes, 'iota'), i, 5); base({ op: 'load', name: 'iota' });
+    const ren = require('child_process').spawnSync(process.execPath, ['-e', `require(${JSON.stringify(LIB.base + '/config')}).renameIdentity('iota','iota2')`], { env }); if (ren.status) throw new Error('rename');
+    expect.iota2 = i.nodeId;
+    const k = makeIdentity('Kappa'); legacy(path.join(nodes, 'Kappa'), k, 5); base({ op: 'load', name: 'Kappa' }); expect.Kappa = k.nodeId;
+    const appA = base({ op: 'load', name: 'app' }).nodeId; const appB = base({ op: 'load', name: 'app-b' }).nodeId;
+    base({ op: 'load', name: 'app', nodeId: appB, create: false }); // 0.14.2 re-pointed "app" to B
+    expect.app = appB; expect['app-b'] = appB;
+  } else {
+    const m1 = makeIdentity('m1'); legacy(path.join(nodes, 'm1'), m1, 5); fs.rmSync(path.join(nodes, 'm1', 'identity.json')); put(path.join(idvol, 'm1', 'identity.json'), JSON.stringify(m1));
+    const m2 = makeIdentity('m2'); legacy(path.join(nodes, 'm2'), m2, 5); put(path.join(idvol, 'm2', 'identity.json'), JSON.stringify(m2));
+    base({ op: 'load', name: 'm1' }); base({ op: 'load', name: 'm2' }); expect.m1 = m1.nodeId; expect.m2 = m2.nodeId;
+    expect.new1 = base({ op: 'load', name: 'new1' }).nodeId;
+  }
+  for (const phase of ['this tree', 'this tree again', '0.14.2']) {
+    const lib = phase === '0.14.2' ? LIB.base : LIB.mine;
+    const line = [];
+    for (const [name, want] of Object.entries(expect)) {
+      const byName = op(lib, { op: 'load', name }, env);
+      const pinned = op(lib, { op: 'load', name, nodeId: want, create: false }, env);
+      const v = (r) => (r.ok ? (r.nodeId === want ? 'same' : 'NEW') : r.err);
+      if (v(byName) !== 'same' || v(pinned) !== 'same') bad++;
+      line.push(`${name}=${v(byName)}/${v(pinned)}`);
+    }
+    console.log(`${split ? 'SYM_IDENTITY_DIR host' : 'host'}, ${phase}: ${line.join(' ')}`);
+  }
+  fs.rmSync(root, { recursive: true, force: true });
+}
+host(false);
+host(true);
+// timing
+for (const nf of [5000]) {
+  const root = newRoot('t'); const id = makeIdentity('agent'); const dir = path.join(root, 'state', 'nodes', 'agent');
+  put(path.join(dir, 'identity.json'), JSON.stringify(id)); fs.mkdirSync(path.join(dir, 'cmbs')); for (let i = 0; i < nf; i++) fs.writeFileSync(path.join(dir, 'cmbs', `c${i}.json`), '{"x":1}');
+  const t0 = Date.now(); const r = op(LIB.mine, { op: 'load', name: 'agent' }, envFor(root));
+  console.log(`first start of a ${nf}-file 0.13 agent: ${r.nodeId === id.nodeId ? 'same' : 'NEW'} in ${Date.now() - t0} ms (a child process, its start included)`);
+  fs.rmSync(root, { recursive: true, force: true });
+}
+{
+  const root = newRoot('t12'); const env = envFor(root);
+  for (let i = 0; i < 12; i++) legacy(path.join(root, 'state', 'nodes', `agent-${i}`), makeIdentity(`agent-${i}`), 300, 3000);
+  const code = `const t0 = Date.now(); const { SymNode } = require(${JSON.stringify(LIB.mine + '/node')}); const t1 = Date.now(); const ns = [];
+    for (let i = 0; i < 12; i++) ns.push(new SymNode({ name: 'agent-' + i, silent: true }));
+    console.log('12 x 0.13 agents (300 files each) constructed in one process in ' + (Date.now() - t1) + ' ms'); Promise.all(ns.map((n) => n.stop())).then(() => process.exit(0));`;
+  const r = require('child_process').spawnSync(process.execPath, ['-e', code], { env, encoding: 'utf8' });
+  console.log((r.stdout.split('\n').find((l) => l.startsWith('12 x')) || r.stderr.slice(0, 300)));
+  fs.rmSync(root, { recursive: true, force: true });
+}
+console.log(bad ? `${bad} agent loads were not the agent 0.14.2 ran` : 'every agent loaded as what 0.14.2 ran, in every phase');
+process.exitCode = bad ? 1 : 0;
diff --git a/tests/identity-commit.test.js b/tests/identity-commit.test.js
index 90f17816..34474941 100644
--- a/tests/identity-commit.test.js
+++ b/tests/identity-commit.test.js
@@ -9,9 +9,9 @@ require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/confi
  * An independent review (R1) of the 0.14.3 candidate (632b95d) proved, by running them, that a partial
  * destination, an unreadable index, a node directory without identity.json and a stale lock's content were
  * each read as a state of the identity, and that each patch for one of them had made another. The design that
- * replaces them (lib/config.js):
- *   - a 0.13 directory is COPIED to a staging directory beside its by-id destination, identity.json last,
- *     synced, verified, and installed by ONE rename; the 0.13 directory is then set aside, never deleted;
+ * replaces them (lib/config.js; v2, after the re-review of the copy):
+ *   - a 0.13 directory is MOVED in by ONE rename of the whole directory (or, behind a link, on a mount point or
+ *     another volume, linked to from by-id); the identity in place is the commit;
  *   - a name is claimed by an exclusive create of its index entry, after the identity is installed;
  *   - an index entry is "absent" only on ENOENT; a mint happens only when nothing on the host is a trace of
  *     the name; a stale lock is removed only by the one process holding the right to remove that lock.
@@ -164,10 +164,10 @@ describe('R1-1: a migration interrupted at any step changes nothing in the 0.13
         if (withHusk) put(path.join(cfg.nodeDirById(id.nodeId), 'lock.pid'), '2147483646\n');
         const before = treeOf(path.join(NODES_DIR, name));
         failAt(k, () => cfg.migrateNodeDir(name));
-        // The 0.13 directory: in place and byte-identical, or set aside byte-identical with the link in its place.
+        // The 0.13 directory: in place and byte-identical, or (v2) moved in whole, byte-identical, with the link in its place.
         const legacy = path.join(NODES_DIR, name);
-        const where = isLink(legacy) ? path.join(NODES_DIR, ASIDE, name) : legacy;
-        if (!exists(where)) assert.fail(`step ${k}: the 0.13 directory is no longer at nodes/${name} and was not set aside (moved or deleted, not kept)`);
+        const where = isLink(legacy) ? cfg.nodeDirById(id.nodeId) : legacy;
+        if (!exists(where)) assert.fail(`step ${k}: the 0.13 directory is no longer at nodes/${name} and was not moved in whole (moved or deleted, not kept)`);
         assert.deepStrictEqual(treeOf(where), before, `step ${k}: the 0.13 directory (${path.relative(NODES_DIR, where)}) is byte-identical`);
         // What a 0.13 rollback reads: nodes/<name>/identity.json is the original key.
         assert.strictEqual(JSON.parse(read(path.join(legacy, 'identity.json'))).privateKey, id.privateKey, `step ${k}: a 0.13 reader still finds the key at nodes/<name>`);
@@ -227,7 +227,9 @@ describe('R1-3: what a 0.13 node kept behind a link is followed and copied', ()
     assert.deepStrictEqual(identitiesNamed(name), [id.nodeId]);
   });
 
-  it('identity.json a RELATIVE link to a key file elsewhere: the original loads, and the installed identity is a file, not a link that now leads nowhere', () => {
+  it('identity.json a RELATIVE link to a key file elsewhere: the original loads, and the installed identity leads to that key file, never nowhere', () => {
+    // (v2: a 0.13 directory holding a relative link that leads out of it is linked to from by-id, not moved: moved one
+    // level deeper, the link would lead elsewhere.)
     const name = uniq('r13-rel');
     const id = makeIdentity(name);
     put(path.join(cfg.SYM_DIR, 'keys', `${name}.json`), JSON.stringify(id), 0o600);
@@ -236,29 +238,38 @@ describe('R1-3: what a 0.13 node kept behind a link is followed and copied', ()
     const loaded = cfg.loadIdentity({ name });
     assert.strictEqual(loaded.privateKey, id.privateKey);
     const installed = path.join(cfg.nodeDirById(id.nodeId), 'identity.json');
-    assert.ok(!isLink(installed), 'a file');
+    assert.ok(isLink(cfg.nodeDirById(id.nodeId)), 'by-id/<id> links to the 0.13 directory');
+    assert.strictEqual(fs.realpathSync(installed), fs.realpathSync(path.join(cfg.SYM_DIR, 'keys', `${name}.json`)), 'the identity leads to the key file');
     assert.strictEqual(JSON.parse(read(installed)).privateKey, id.privateKey);
     assert.strictEqual(JSON.parse(read(path.join(cfg.SYM_DIR, 'keys', `${name}.json`))).privateKey, id.privateKey, 'the key file it led to is untouched');
   });
 });
 
 describe('the staged commit: what it checks before the one rename', () => {
-  it('a copy that does not read back as its source is not installed, and the source is untouched', () => {
-    const name = uniq('verify');
-    const id = legacyNode(name);
-    const before = treeOf(path.join(NODES_DIR, name));
-    assert.throws(() => patchFs('copyFileSync', (o) => function (a, b, ...r) {
-      const out = o.call(fs, a, b, ...r);
-      if (String(b).endsWith('c3.json')) fs.appendFileSync(b, ' '); // a copy that came out different
-      return out;
-    }, () => cfg.migrateNodeDir(name)), /does not match/);
-    assert.ok(!exists(cfg.nodeDirById(id.nodeId)), 'nothing installed');
-    assert.deepStrictEqual(treeOf(path.join(NODES_DIR, name)), before, 'the source is untouched');
-    assert.strictEqual(cfg.nodeIdForName(name), null);
-    assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey, 'the next start copies it right');
+  it('an identity copied across volumes that does not read back as its source is not installed, and the source is untouched', () => {
+    // (v2: only the identity files are ever copied, and only across volumes; EXDEV is simulated here.)
+    withIdentityDir((idRoot) => {
+      const name = uniq('verify');
+      const id = makeIdentity(name);
+      put(path.join(idRoot, name, 'identity.json'), JSON.stringify(id, null, 2), 0o600);
+      put(path.join(NODES_DIR, name, 'cmbs', 'x.json'), '{}');
+      const src = read(path.join(idRoot, name, 'identity.json'));
+      const exdev = (o) => function (a, b) {
+        if (String(a) === path.join(idRoot, name)) throw Object.assign(new Error('EXDEV: simulated'), { code: 'EXDEV' });
+        return o.call(fs, a, b);
+      };
+      assert.throws(() => patchMany({
+        renameSync: exdev,
+        readFileSync: (o) => function (p, ...a) { const r = o.call(fs, p, ...a); return String(p).includes('.stage-') && Buffer.isBuffer(r) ? Buffer.concat([r, Buffer.from(' ')]) : r; },
+      }, () => cfg.migrateNodeDir(name)), /does not read back/);
+      assert.ok(!exists(path.join(idRoot, 'by-id', id.nodeId)), 'nothing installed');
+      assert.strictEqual(read(path.join(idRoot, name, 'identity.json')), src, 'the source is untouched');
+      assert.ok(!cfg.isCommitted(id.nodeId));
+      assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey, 'the next start moves it right');
+    });
   });
 
-  it('a directory inside the 0.13 node that is a relative link is copied as the directory it leads to', () => {
+  it('a directory inside the 0.13 node that is a relative link leading out of it still leads there (v2: linked to, not moved)', () => {
     const name = uniq('sublink');
     const id = makeIdentity(name);
     put(path.join(NODES_DIR, name, 'identity.json'), JSON.stringify(id));
@@ -266,7 +277,8 @@ describe('the staged commit: what it checks before the one rename', () => {
     fs.symlinkSync(`../${name}-store`, path.join(NODES_DIR, name, 'cmbs'), 'dir');
     cfg.loadIdentity({ name });
     const cmbs = path.join(cfg.nodeDirById(id.nodeId), 'cmbs');
-    assert.ok(!isLink(cmbs) && read(path.join(cmbs, 'x.json')) === '{"x":1}', 'a real directory holding the files');
+    assert.ok(isLink(cfg.nodeDirById(id.nodeId)), 'by-id/<id> links to the 0.13 directory, which was not moved');
+    assert.ok(read(path.join(cmbs, 'x.json')) === '{"x":1}', 'the relative link leads to the same files');
   });
 
   it('a by-id husk whose lock a live process holds is not replaced: EIDENTITYLOCK, nothing changed', async () => {
@@ -426,33 +438,50 @@ describe('R1-7: an index entry is "absent" only when there is none', () => {
     assert.deepStrictEqual(identitiesNamed(name), [orig.nodeId]);
   });
 
+  // v2 (design point 1): the index is a cache of the committed identities' names. One that is empty, not JSON or another
+  // name's is re-derived (the identity named so loads, and the entry is written again); one that cannot be read for an
+  // I/O error (EACCES, EMFILE) is re-derived for the start and left as it is. Nothing is minted either way.
   for (const how of ['empty', 'not json', 'another name']) {
-    it(`${how}, and no compat link: the start halts, naming where the identity is; nothing is minted`, () => {
+    it(`${how}, and no compat link: the identity named so loads (re-derived), the entry is written again, nothing is minted`, () => {
       const { name, orig, idx, link } = made();
       fs.writeFileSync(idx, how === 'empty' ? '' : how === 'not json' ? '{"nodeId":' : JSON.stringify({ name: 'someone-else', nodeId: orig.nodeId }));
       fs.unlinkSync(link);
-      assert.throws(() => cfg.loadIdentity({ name }), (e) => e instanceof IdentityHaltError && e.message.includes(orig.nodeId) && !/remove .*by-name/.test(e.message));
-      assert.throws(() => cfg.loadIdentity({ name, create: false }), IdentityHaltError);
+      assert.strictEqual(cfg.loadIdentity({ name }).privateKey, orig.privateKey);
+      assert.strictEqual(cfg.loadIdentity({ name, create: false }).nodeId, orig.nodeId);
+      assert.deepStrictEqual(JSON.parse(read(idx)), { ...JSON.parse(read(idx)), name, nodeId: orig.nodeId }, 'the entry is an entry again');
       assert.deepStrictEqual(identitiesNamed(name), [orig.nodeId], 'no second identity');
     });
   }
 
-  (posix && process.getuid && process.getuid() !== 0 ? it : it.skip)('unreadable (mode 000): halts, nothing minted', () => {
+  it('empty, and the identity it named is not here (no committed identity of the name): halts, says not to delete it, mints nothing', () => {
+    const { name, orig, idx, link } = made();
+    fs.writeFileSync(idx, '');
+    fs.unlinkSync(link);
+    const away = path.join(NODES_DIR, 'by-id', `.away-${orig.nodeId}`);
+    fs.renameSync(cfg.nodeDirById(orig.nodeId), away);
+    try {
+      assert.throws(() => cfg.loadIdentity({ name }), (e) => e instanceof IdentityHaltError && /Do not delete it/.test(e.message) && !/remove .*by-name/.test(e.message));
+      assert.deepStrictEqual(identitiesNamed(name), [], 'nothing minted');
+    } finally { fs.renameSync(away, cfg.nodeDirById(orig.nodeId)); }
+  });
+
+  (posix && process.getuid && process.getuid() !== 0 ? it : it.skip)('unreadable (mode 000): the identity named so loads, the entry is left as it is, nothing minted', () => {
     const { name, orig, idx, link } = made();
     fs.chmodSync(idx, 0); fs.unlinkSync(link);
     try {
-      assert.throws(() => cfg.loadIdentity({ name }), IdentityHaltError);
+      assert.strictEqual(cfg.loadIdentity({ name }).nodeId, orig.nodeId);
+      assert.strictEqual(fs.statSync(idx).mode & 0o777, 0, 'not replaced');
       assert.deepStrictEqual(identitiesNamed(name), [orig.nodeId]);
     } finally { fs.chmodSync(idx, 0o644); }
   });
 
-  it('a read error that is not ENOENT (EMFILE): halts, nothing minted', () => {
+  it('a read error that is not ENOENT (EMFILE): the identity named so loads, nothing minted', () => {
     const { name, orig, idx, link } = made();
     fs.unlinkSync(link);
     patchFs('readFileSync', (o) => function (p, ...a) {
       if (String(p) === idx) throw Object.assign(new Error('EMFILE: too many open files'), { code: 'EMFILE' });
       return o.call(fs, p, ...a);
-    }, () => { assert.throws(() => cfg.loadIdentity({ name }), IdentityHaltError); });
+    }, () => { assert.strictEqual(cfg.loadIdentity({ name }).nodeId, orig.nodeId); });
     assert.deepStrictEqual(identitiesNamed(name), [orig.nodeId]);
     assert.strictEqual(cfg.loadIdentity({ name }).nodeId, orig.nodeId, 'once it reads, the same agent');
   });
@@ -479,7 +508,8 @@ describe('R1-8: an export interrupted before its bundle is durable is resumable
   }
   const out = () => path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'sym-bundle-')), 'node.bundle');
 
-  it('the start is refused saying the export did not finish (not "exported to another host"), and running the export again finishes it', async () => {
+  it('a crash after the tombstone and before a complete bundle: refused saying the export did not finish, and running the export again finishes it', async () => {
+    // v2 (design point 4): the tombstone comes BEFORE the bundle, so no bundle ever exists beside a live source.
     const name = uniq('r18');
     const id = await made(name);
     const file = out();
@@ -490,31 +520,44 @@ describe('R1-8: an export interrupted before its bundle is durable is resumable
     }, () => relocation.exportNode({ name, out: file, toHostKey })), /EIO/);
     assert.ok(!exists(file), 'no bundle');
     assert.throws(() => cfg.loadIdentity({ name }), (e) => e.code === 'EIDENTITYEXPORTING' && !/exported to another host/.test(e.message));
-    assert.strictEqual(cfg.readTombstone(id.nodeId), null, 'not tombstoned: nothing was moved');
+    assert.ok(cfg.readTombstone(id.nodeId), 'tombstoned: the source stopped using the key before any bundle could exist');
+    assert.throws(() => relocation.exportNode({ name, out: file + '.other', toHostKey }), /may have written a complete bundle/, 'another out is refused');
     const r = relocation.exportNode({ name, out: file, toHostKey });
     assert.strictEqual(r.nodeId, id.nodeId);
     assert.ok(exists(file), 'the bundle');
-    assert.ok(cfg.readTombstone(id.nodeId), 'tombstoned now');
+    assert.ok(cfg.readTombstone(id.nodeId), 'tombstoned');
+    assert.strictEqual(cfg.readExportIntent(id.nodeId), null, 'finished');
     assert.strictEqual(JSON.parse(read(path.join(cfg.identityDirById(id.nodeId), 'identity.json'))).privateKey, null, 'the source lost the key');
   });
 
-  it('abortExport removes the bundle it wrote and the intent: the node starts here again', async () => {
+  it('abortExport reverts an export that produced no complete bundle, and refuses one that did', async () => {
     const name = uniq('r18-abort');
     const id = await made(name);
     const file = out();
     const toHostKey = relocation.hostKey().publicKey;
-    // interrupted after the bundle is durable and before the tombstone
+    // interrupted at the tombstone: no bundle can exist yet (v2: the tombstone precedes it)
     assert.throws(() => patchFs('openSync', (o) => function (p, ...a) {
-      if (String(p).includes(cfg.TOMBSTONE)) throw Object.assign(new Error('EIO: crash before the tombstone'), { code: 'EIO' });
+      if (String(p).includes(cfg.TOMBSTONE)) throw Object.assign(new Error('EIO: crash at the tombstone'), { code: 'EIO' });
       return o.call(fs, p, ...a);
     }, () => relocation.exportNode({ name, out: file, toHostKey })), /EIO/);
-    assert.ok(exists(file), 'the bundle is durable');
+    assert.ok(!exists(file), 'no bundle');
     assert.throws(() => cfg.loadIdentity({ name }), (e) => e.code === 'EIDENTITYEXPORTING');
     const a = relocation.abortExport({ name });
     assert.strictEqual(a.aborted, true);
-    assert.strictEqual(a.bundleRemoved, true);
-    assert.ok(!exists(file), 'the bundle is gone');
+    assert.strictEqual(cfg.readTombstone(id.nodeId), null);
     assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey, 'the node starts again, with its key');
+    // interrupted after the bundle is complete and before the scrub: the bundle is the node now
+    const file2 = out();
+    assert.throws(() => patchFs('openSync', (o) => function (p, ...a) {
+      if (/identity\.json\.\d+\.tmp$/.test(String(p))) throw Object.assign(new Error('EIO: crash before the scrub'), { code: 'EIO' });
+      return o.call(fs, p, ...a);
+    }, () => relocation.exportNode({ name, out: file2, toHostKey })), /EIO/);
+    assert.ok(exists(file2), 'the bundle is complete');
+    assert.throws(() => relocation.abortExport({ name }), /complete bundle/);
+    assert.throws(() => cfg.loadIdentity({ name }), (e) => e.code === 'EIDENTITYTOMBSTONED', 'moved: the bundle is the agent');
+    const done = relocation.exportNode({ name, out: file2, toHostKey });
+    assert.strictEqual(done.resumed, 'scrub');
+    assert.strictEqual(JSON.parse(read(path.join(cfg.identityDirById(id.nodeId), 'identity.json'))).privateKey, null);
   });
 });
 
diff --git a/tests/identity-migration-by-id.test.js b/tests/identity-migration-by-id.test.js
index 72d772c3..038101f5 100644
--- a/tests/identity-migration-by-id.test.js
+++ b/tests/identity-migration-by-id.test.js
@@ -35,6 +35,7 @@ const modeOf = (p) => fs.statSync(p).mode & 0o777;
 const read = (p) => fs.readFileSync(p, 'utf8');
 const exists = (p) => fs.existsSync(p);
 const isLink = (p) => { try { return fs.lstatSync(p).isSymbolicLink(); } catch { return false; } };
+const indexFile = (name) => path.join(NODES_DIR, 'by-name', `${encodeURIComponent(name)}.json`);
 
 /** A real Ed25519 identity, in the shape lib/config writes. */
 function makeIdentity(name, extra = {}) {
@@ -113,6 +114,12 @@ function patchFs(fn, wrap, body) {
   fs[fn] = wrap(original);
   try { return body(); } finally { fs[fn] = original; }
 }
+/** Replace several fs functions at once: `wraps` maps a name to (original) => replacement. */
+function patchMany(wraps, body) {
+  const originals = {};
+  for (const [k, w] of Object.entries(wraps)) { originals[k] = fs[k]; fs[k] = w(originals[k]); }
+  try { return body(); } finally { for (const k of Object.keys(originals)) fs[k] = originals[k]; }
+}
 const exdev = (msg) => Object.assign(new Error(`EXDEV: cross-device link not permitted (${msg})`), { code: 'EXDEV' });
 
 /**
@@ -205,10 +212,10 @@ describe('T3-T5: a by-id directory that merely exists is not a second claim on t
     const dest = husk(id.nodeId);
     assert.strictEqual(cfg.migrateNodeDir(name), 'moved');
     assert.strictEqual(JSON.parse(read(path.join(dest, 'identity.json'))).privateKey, id.privateKey, 'the identity is under the nodeId, key unchanged');
-    // 0.14.3 changed this: the husk is REPLACED through the staged commit (one rename), and its stale lock is removed
+    // 0.14.3 changed this: the husk is REPLACED by the commit (one rename), and its stale lock is removed
     // (compare-and-delete, what the next acquire would do anyway) rather than kept; a live one would refuse (EIDENTITYLOCK).
+    // (Design v2: the commit is the identity in place, moved in by one rename; there is no separate commit record.)
     assert.ok(!exists(path.join(dest, 'lock.pid')), 'the stale lock is not carried into the installed directory');
-    assert.ok(exists(path.join(dest, cfg.COMMIT_MARK)), 'the directory carries the commit record');
     assert.ok(exists(path.join(dest, 'cmbs', 'x.json')), 'the store came with it');
     assert.strictEqual(cfg.nodeIdForName(name), id.nodeId);
     assert.ok(isLink(path.join(NODES_DIR, name)), 'nodes/<name> is the compat link');
@@ -286,7 +293,8 @@ describe('T6/T7: a real duplicate is refused, and refusing is a halt, never a mi
     assert.strictEqual(cfg.migrateNodeDir(name), 'skipped-duplicate');
     assert.strictEqual(read(path.join(NODES_DIR, name, 'identity.json')), legacyBefore, 'the 0.13 identity is byte-unchanged');
     assert.strictEqual(read(path.join(dest, 'identity.json')), destBefore, 'the one already filed is byte-unchanged');
-    assert.strictEqual(cfg.nodeIdForName(name), null, 'nothing was indexed');
+    // (v2: nodeIdForName re-derives from what is committed, so "indexed" is the index file itself.)
+    assert.ok(!exists(indexFile(name)), 'nothing was indexed');
     assert.ok(!exists(path.join(dest, 'cmbs')), 'and nothing was merged in beside it');
     assert.ok(mine.privateKey);
   });
@@ -301,18 +309,24 @@ describe('T6/T7: a real duplicate is refused, and refusing is a halt, never a mi
     assert.strictEqual(read(path.join(NODES_DIR, name, 'identity.json')), legacyBefore);
     assert.strictEqual(read(path.join(dest, 'identity.json')), destBefore);
     assert.strictEqual(fs.readdirSync(path.join(NODES_DIR, 'by-id')).length, dirsBefore, 'no new node directory was made');
-    assert.strictEqual(cfg.nodeIdForName(name), null);
+    assert.ok(!exists(indexFile(name)), 'nothing was indexed'); // (v2: nodeIdForName re-derives; the index file is what "indexed" means)
   });
 
-  it('a differing store file in an existing by-id dir is a conflict too: nothing moves', () => {
+  it('a husk holding a store file that differs (changed in v2): set aside whole, the node moved in, the differing file kept aside and reported', () => {
+    // Design v2: halting here left an agent that 0.14.2 had run beside a live 0.13 process unable to start (re-review
+    // e25). The husk is set aside whole; files that differ from the node's are kept there and reported; the node starts.
     const name = uniq('conflict');
     const id = legacyNode(name);
     const dest = husk(id.nodeId, { lock: false });
     put(path.join(dest, 'cmbs', 'x.json'), '{"x":2}');
-    assert.strictEqual(cfg.migrateNodeDir(name), 'skipped-duplicate');
-    assert.ok(exists(path.join(NODES_DIR, name, 'identity.json')), 'the 0.13 node is where it was');
-    assert.strictEqual(read(path.join(dest, 'cmbs', 'x.json')), '{"x":2}');
-    assert.throws(() => cfg.loadIdentity({ name }), IdentityHaltError);
+    put(path.join(dest, 'cmbs', 'same.json'), 'same'); put(path.join(NODES_DIR, name, 'cmbs', 'same.json'), 'same');
+    assert.strictEqual(cfg.migrateNodeDir(name), 'moved');
+    assert.strictEqual(read(path.join(dest, 'cmbs', 'x.json')), '{"x":1}', 'the node is the 0.13 directory');
+    const aside = fs.readdirSync(path.join(NODES_DIR, 'by-id')).filter((n) => n.startsWith(`.${id.nodeId}.husk-`));
+    assert.strictEqual(aside.length, 1, 'the husk is set aside beside it');
+    assert.strictEqual(read(path.join(NODES_DIR, 'by-id', aside[0], 'cmbs', 'x.json')), '{"x":2}', 'the differing file is kept there');
+    assert.ok(!exists(path.join(NODES_DIR, 'by-id', aside[0], 'cmbs', 'same.json')), 'a file the node has too is not kept twice');
+    assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey);
   });
 
   it('a name the index already gives to ANOTHER node is not re-pointed by a stray 0.13 directory', () => {
@@ -398,9 +412,9 @@ describe('the safety net: the mint path never buries a 0.13 identity', () => {
     });
   });
 
-  it('F7 (changed in 0.14.3, R1): a symlink at nodes/<name> that is not a compat link is a 0.13 directory kept elsewhere: it is followed and copied, its target untouched', () => {
+  it('F7 (changed in v2): a symlink at nodes/<name> that is not a compat link is a 0.13 directory kept elsewhere: by-id/<id> links to it, nothing is copied, its target untouched', () => {
     // 632b95d halted here, and minted when the link was a 0.13 node's directory on a durable volume. A link that is
-    // not `by-id/<id>` is the agent's own directory: copy what it leads to, set the link aside, never touch the target.
+    // not `by-id/<id>` is the agent's own directory. Design v2: the store stays where its operator put it.
     const name = uniq('f7');
     const elsewhere = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'sym-stray-')), 'agent');
     const id = legacyNode(name, { where: elsewhere });
@@ -411,9 +425,10 @@ describe('the safety net: the mint path never buries a 0.13 identity', () => {
     assert.strictEqual(cfg.nodeIdForName(name), id.nodeId);
     assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey);
     const dest = cfg.nodeDirById(id.nodeId);
-    assert.ok(!isLink(path.join(dest, 'cmbs')) && exists(path.join(dest, 'cmbs', 'x.json')), 'the store was copied, not linked');
+    assert.ok(isLink(dest) && fs.readlinkSync(dest) === fs.realpathSync(elsewhere), 'by-id/<id> is an absolute link to the directory, not a copy');
+    assert.ok(exists(path.join(dest, 'cmbs', 'x.json')), 'the store is reached through it');
     assert.deepStrictEqual(treeOf(elsewhere), before, 'what the link led to is byte-unchanged');
-    assert.strictEqual(fs.readlinkSync(path.join(NODES_DIR, cfg.LEGACY_ASIDE, name)), elsewhere, 'the link itself was set aside');
+    assert.ok(isLink(path.join(NODES_DIR, name)) && cfg.loadIdentity({ name, create: false }).nodeId === id.nodeId, 'nodes/<name> is the compat link now');
     assert.strictEqual(cfg.migrateNodeDir(name), 'already');
   });
 
@@ -493,9 +508,10 @@ function volumeOf(p, idRoot) {
 }
 
 describe('F9: a copy across filesystems: copies, verifies, commits; the source is kept', () => {
-  it('EXDEV between the trees: the identity arrives intact at 0600, and the source is set aside, not deleted', () => {
-    // 0.14.3: no rename ever crosses from a 0.13 directory into by-id (the staging is made beside its destination),
-    // so every rename across the trees below fails with EXDEV here, and the migration still completes.
+  it('EXDEV between the trees (changed in v2): the store is linked, not copied; the key files are copied, committed, the source set aside', () => {
+    // Design v2: a rename that would cross volumes is refused by the file system (EXDEV, simulated here); the store is
+    // never copied (by-id/<id> becomes a link to it), and only the small identity files cross: staged beside their
+    // destination, synced, verified, committed by one rename; the 0.13 source is set aside (narrowed), never deleted.
     withIdentityDir((idRoot) => {
       const name = uniq('f9');
       const id = makeIdentity(name);
@@ -507,35 +523,49 @@ describe('F9: a copy across filesystems: copies, verifies, commits; the source i
         if (volumeOf(a, idRoot) !== volumeOf(b, idRoot)) { crossed++; throw exdev('simulated'); }
         return orig.call(fs, a, b);
       }, () => cfg.migrateNodeDir(name));
-      assert.strictEqual(crossed, 0, 'no rename tried to cross a volume');
+      assert.ok(crossed >= 2, 'the file system refused the renames across');
       assert.strictEqual(result, 'moved');
       const dest = path.join(idRoot, 'by-id', id.nodeId);
       assert.strictEqual(JSON.parse(read(path.join(dest, 'identity.json'))).privateKey, id.privateKey);
-      assert.strictEqual(read(path.join(dest, 'sub', 'a.txt')), 'a');
+      assert.ok(!exists(path.join(dest, 'sub')), 'only the identity files were copied');
       if (posix) assert.strictEqual(modeOf(path.join(dest, 'identity.json')), 0o600);
       assert.ok(isLink(path.join(idRoot, name)), 'SYM_IDENTITY_DIR/<name> is the compat link');
       assert.strictEqual(JSON.parse(read(path.join(idRoot, cfg.LEGACY_ASIDE, name, 'identity.json'))).privateKey, id.privateKey, 'the 0.13 source is kept, set aside');
+      assert.strictEqual(read(path.join(idRoot, cfg.LEGACY_ASIDE, name, 'sub', 'a.txt')), 'a');
       if (posix) assert.strictEqual(modeOf(path.join(idRoot, cfg.LEGACY_ASIDE, name, 'identity.json')), 0o600, 'and narrowed to its owner');
+      const nodeDir = cfg.nodeDirById(id.nodeId);
+      assert.ok(isLink(nodeDir) && fs.realpathSync(nodeDir) === fs.realpathSync(path.join(NODES_DIR, name)), 'the store is linked to where it is');
       assert.strictEqual(cfg.loadIdentity({ name, create: false }).privateKey, id.privateKey);
     });
   });
 
   it('a copy that fails leaves the source untouched and no half-copy at the destination', () => {
+    // (v2: the store moves first and the identity is the commit, so a failed identity copy leaves the store in by-id and
+    // the key where it was; the next start finishes.)
     withIdentityDir((idRoot) => {
       const name = uniq('f9b');
       const id = makeIdentity(name);
       put(path.join(idRoot, name, 'identity.json'), JSON.stringify(id, null, 2), 0o600);
       put(path.join(NODES_DIR, name, 'cmbs', 'x.json'), '{}');
       const src = read(path.join(idRoot, name, 'identity.json'));
-      assert.throws(() => patchFs('copyFileSync', () => function () { throw Object.assign(new Error('EIO: injected'), { code: 'EIO' }); },
-        () => cfg.migrateNodeDir(name)), /EIO/);
+      const crossing = (orig) => function (a, b) {
+        if (volumeOf(a, idRoot) === idRoot && volumeOf(b, idRoot) === path.join(idRoot, 'by-id')) throw exdev('simulated');
+        return orig.call(fs, a, b);
+      };
+      const staged = new Set();
+      assert.throws(() => patchMany({
+        renameSync: crossing,
+        openSync: (o) => function (p, ...a) { const fd = o.call(fs, p, ...a); if (String(p).includes('.stage-')) staged.add(fd); return fd; },
+        writeSync: (o) => function (fd, ...a) { if (staged.has(fd)) throw Object.assign(new Error('EIO: injected'), { code: 'EIO' }); return o.call(fs, fd, ...a); },
+      }, () => cfg.migrateNodeDir(name)), /EIO/);
       assert.strictEqual(read(path.join(idRoot, name, 'identity.json')), src, 'the identity is where it was');
       assert.ok(!exists(path.join(idRoot, 'by-id', id.nodeId)), 'no half-copy');
-      assert.ok(!exists(cfg.nodeDirById(id.nodeId)), 'and no node directory installed either');
-      assert.deepStrictEqual(fs.readdirSync(path.join(NODES_DIR, 'by-id')).filter((n) => n.includes(id.nodeId)), [], 'no staging left behind');
+      assert.deepStrictEqual(fs.readdirSync(path.join(idRoot, 'by-id')).filter((n) => n.includes(id.nodeId)), [], 'no staging left behind');
+      assert.ok(!cfg.isCommitted(id.nodeId), 'nothing committed');
       // the fault clears: the next run completes the move
       assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey);
       assert.ok(exists(path.join(idRoot, 'by-id', id.nodeId, 'identity.json')));
+      assert.ok(exists(path.join(cfg.nodeDirById(id.nodeId), 'cmbs', 'x.json')), 'with its store');
     });
   });
 });
@@ -567,7 +597,7 @@ describe('F9 on a real second filesystem (Linux: nodes/by-id lives on /dev/shm,
         const dest = c.nodeDirById(id.nodeId);
         console.log(JSON.stringify({
           sawExdev, same: loaded.nodeId === id.nodeId && loaded.privateKey === id.privateKey,
-          sourceKept: fs.lstatSync(dir).isSymbolicLink() && fs.readFileSync(path.join(c.NODES_DIR, c.LEGACY_ASIDE, name, 'cmbs', 'x.json'), 'utf8') === '{"x":1}',
+          sourceKept: !fs.lstatSync(dir).isSymbolicLink() && fs.readFileSync(path.join(dir, 'cmbs', 'x.json'), 'utf8') === '{"x":1}' && fs.lstatSync(c.nodeDirById(id.nodeId)).isSymbolicLink(),
           store: fs.readFileSync(path.join(dest, 'cmbs', 'x.json'), 'utf8'),
           idMode: fs.statSync(path.join(dest, 'identity.json')).mode & 0o777, e2eMode: fs.statSync(path.join(dest, 'e2e-keypair.json')).mode & 0o777,
           dirMode: fs.statSync(dest).mode & 0o777, onOtherFs: fs.realpathSync(dest).startsWith(fs.realpathSync(${JSON.stringify(far)})),
@@ -582,10 +612,12 @@ describe('F9 on a real second filesystem (Linux: nodes/by-id lives on /dev/shm,
         child.on('exit', (code) => (code === 0 ? resolve(so) : reject(new Error(`child exited ${code}: ${se}`))));
       });
       const r = JSON.parse(out);
-      assert.strictEqual(r.onOtherFs, true, 'setup: the node lives on the other filesystem');
-      assert.strictEqual(r.sawExdev, false, 'no rename crossed the volumes: each copy is staged beside its destination');
+      // (v2: the store is never copied across volumes: by-id/<id>, on the other filesystem, is a link to the 0.13
+      // directory, which stays where its operator put it.)
+      assert.strictEqual(r.onOtherFs, false, 'the store stays on its own filesystem');
+      assert.strictEqual(r.sawExdev, false, 'no rename crossed the volumes: the devices are compared first');
       assert.strictEqual(r.same, true);
-      assert.strictEqual(r.sourceKept, true, 'the 0.13 directory is set aside, whole');
+      assert.strictEqual(r.sourceKept, true, 'the 0.13 directory is where it was, whole, and by-id/<id> leads to it');
       assert.strictEqual(r.store, '{"x":1}');
       assert.strictEqual(r.idMode, 0o600);
       assert.strictEqual(r.e2eMode, 0o600);
@@ -640,7 +672,8 @@ describe('F11: the window between the move and the index is not a mint race', ()
     assert.ok(!exists(dead), 'the dead process\'s staging is gone');
     for (const f of ['aaa.json', 'zzz.json', path.join('cmbs', 'x.json')]) assert.ok(exists(path.join(cfg.nodeDirById(id.nodeId), f)), `the whole store: ${f}`);
     assert.ok(isLink(path.join(NODES_DIR, name)), 'finished: nodes/<name> is the compat link');
-    assert.deepStrictEqual(treeOf(path.join(NODES_DIR, cfg.LEGACY_ASIDE, name)).filter((l) => !l.includes(' lock.pid')), before.filter((l) => !l.includes(' lock.pid')), 'and the 0.13 directory is kept, set aside, as it was');
+    // (v2: the 0.13 directory itself is moved in by one rename, not copied and set aside.)
+    assert.deepStrictEqual(treeOf(cfg.nodeDirById(id.nodeId)).filter((l) => !l.includes(' lock.pid')), before.filter((l) => !l.includes(' lock.pid')), 'and it is the 0.13 directory, as it was');
     assert.strictEqual(identitiesNamed(name).length, 1);
   });
 });
@@ -714,13 +747,15 @@ describe('F11 (0.14.3): no migration lock; concurrent starts are made safe by th
     const legacy = path.join(NODES_DIR, name);
     const dest = husk(id.nodeId); // forces an entry-by-entry merge
     let helped = false; let listings = 0;
-    // Something not holding the lock finishes the move while this merge holds a list of what to move (it cannot
-    // happen among cooperating processes; the check is a last guard on a key file).
+    // Something not holding the lock finishes the move while this start holds a list of the 0.13 directory (it cannot
+    // happen among cooperating processes; the check is a last guard on a key file). (v2: nothing is merged; the one
+    // listing is the check for links that would lead elsewhere once moved, before the one rename.)
     patchFs('readdirSync', (orig) => function (p, ...rest) {
       const names = orig.call(fs, p, ...rest);
-      if (!helped && p === legacy && ++listings === 2) { // the 2nd listing is the merge's own, after the conflict check's
+      if (!helped && p === legacy && ++listings === 1) {
         helped = true;
-        for (const n of names) fs.renameSync(path.join(legacy, n), path.join(dest, n));
+        fs.mkdirSync(dest, { recursive: true });
+        for (const n of names) fs.renameSync(path.join(legacy, typeof n === 'string' ? n : n.name), path.join(dest, typeof n === 'string' ? n : n.name));
         fs.rmdirSync(legacy);
         fs.symlinkSync(path.join('by-id', id.nodeId), legacy, 'dir');
       }
@@ -935,7 +970,8 @@ describe('a start pinned to a nodeId migrates too (mesh-channel starts every nod
     const owner = cfg.loadIdentity({ name: uniq('pin-link-owner') }); // some other agent, filed by id
     fs.symlinkSync(path.join('by-id', owner.nodeId), path.join(NODES_DIR, name), 'dir'); // a link under this name, name unindexed
     assert.throws(() => cfg.loadIdentity({ name, nodeId: cfg.uuidv7(), create: false }), (e) => e.code === 'EIDENTITYABSENT');
-    assert.strictEqual(cfg.nodeIdForName(name), null, 'the pinned start wrote no index entry for the name');
+    // (v2: nodeIdForName re-derives the name from the link, a cache of it; what the pinned start must not do is write the entry.)
+    assert.ok(!exists(indexFile(name)), 'the pinned start wrote no index entry for the name');
   });
 
   it('the name is indexed to another agent and the pin\'s 0.13 directory sits under it: the start halts saying the pin IS here (changed in 0.14.3), and does not answer with the indexed agent', () => {
diff --git a/tests/identity-v2.test.js b/tests/identity-v2.test.js
new file mode 100644
index 00000000..e4c6bd0d
--- /dev/null
+++ b/tests/identity-v2.test.js
@@ -0,0 +1,635 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * 0.14.3, design v2 of the identity and on-disk state (lib/config.js, lib/relocation.js). The second candidate
+ * (9f6847c) copied a 0.13 agent into a staging directory and committed the copy; an independent re-review reproduced
+ * what copying does: ENOSPC where a store does not fit twice, seconds per start, private keys left in husks and
+ * partial copies at 0644, a mount point copied onto the state volume, a relative link set aside dangling, and an export
+ * whose bundle came before its tombstone (two importable bundles: two live copies of one key).
+ *
+ * Design v2: one source of truth (an agent exists exactly when its identity is committed; the name index and the
+ * compat links are caches, re-derived from the committed identities); a 0.13 directory is MOVED in by one rename, or
+ * linked to when it is a link, a mount point or on another volume; only the small identity files ever cross volumes;
+ * the export stops the source before any bundle can exist. Each test below is a scenario of the re-review (rr-eN) or of
+ * the first review (R1-eN) that fails on 9f6847c or on 0.14.2 (fe285a3), as its name says.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const crypto = require('crypto');
+const { spawnSync } = require('child_process');
+const cfg = require('../lib/config');
+const relocation = require('../lib/relocation');
+
+const { NODES_DIR, IdentityHaltError } = cfg;
+const posix = process.platform !== 'win32';
+const modeTest = posix ? it : it.skip;
+const LIB = path.resolve(__dirname, '../lib');
+
+let seq = 0;
+const uniq = (b) => `${b}-${process.pid}-${++seq}-${Math.random().toString(36).slice(2, 6)}`;
+const read = (p) => fs.readFileSync(p, 'utf8');
+const exists = (p) => fs.existsSync(p);
+const modeOf = (p) => fs.statSync(p).mode & 0o777;
+const isLink = (p) => { try { return fs.lstatSync(p).isSymbolicLink(); } catch { return false; } };
+const indexFile = (name) => path.join(NODES_DIR, 'by-name', `${encodeURIComponent(name)}.json`);
+
+function makeIdentity(name, extra = {}) {
+  const kp = crypto.generateKeyPairSync('ed25519');
+  return {
+    nodeId: cfg.uuidv7(), name, hostname: 'host.local', createdAt: 1,
+    publicKey: kp.publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'),
+    privateKey: kp.privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'),
+    ...extra,
+  };
+}
+
+function put(file, text, mode = 0o644) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, text);
+  fs.chmodSync(file, mode);
+}
+
+/** A 0.13 node, as 0.13 wrote it: identity.json and the E2E keypair at the umask default, a small store. */
+function legacyNode(name, { where = path.join(NODES_DIR, name), identity = makeIdentity(name), files = 6 } = {}) {
+  put(path.join(where, 'identity.json'), JSON.stringify(identity, null, 2));
+  put(path.join(where, 'e2e-keypair.json'), JSON.stringify({ publicKey: 'cHVi', privateKey: `e2e-${identity.nodeId}` }));
+  for (let i = 0; i < files; i++) put(path.join(where, 'cmbs', `c${i}.json`), JSON.stringify({ i, pad: 'x'.repeat(300) }));
+  return identity;
+}
+
+/** What 0.14.2 left for a 0.13 agent it migrated: the directory renamed in (modes as 0.13 left them), the index, the link. */
+function migratedBy0142(name) {
+  const id = makeIdentity(name);
+  const dir = path.join(NODES_DIR, 'by-id', id.nodeId);
+  legacyNode(name, { where: dir, identity: id });
+  fs.chmodSync(dir, 0o755);
+  put(indexFile(name), JSON.stringify({ name, nodeId: id.nodeId, at: 1 }));
+  fs.symlinkSync(path.join('by-id', id.nodeId), path.join(NODES_DIR, name), 'dir');
+  return id;
+}
+
+/** Every file under `roots` whose content holds `secret` (bundles left out), as paths. */
+function holding(secret, roots = [cfg.SYM_DIR, process.env.SYM_IDENTITY_DIR].filter(Boolean), skip = () => false) {
+  const out = [];
+  const walk = (d) => {
+    let es = [];
+    try { es = fs.readdirSync(d); } catch { return; }
+    for (const e of es) {
+      const p = path.join(d, e);
+      const st = fs.lstatSync(p);
+      if (st.isDirectory()) walk(p);
+      else if (st.isFile() && !skip(p) && fs.readFileSync(p, 'utf8').includes(secret)) out.push(p);
+    }
+  };
+  for (const r of roots) walk(r);
+  return out;
+}
+
+/** The regular files under `dir` (links not followed) as distinct inodes, with their bytes: a copy makes new ones. */
+function inodes(dir) {
+  const out = new Map();
+  const walk = (d) => {
+    let es = [];
+    try { es = fs.readdirSync(d); } catch { return; }
+    for (const e of es) {
+      const p = path.join(d, e);
+      const st = fs.lstatSync(p);
+      if (st.isDirectory()) walk(p);
+      else if (st.isFile()) out.set(`${st.dev}:${st.ino}`, st.size);
+    }
+  };
+  walk(dir);
+  return out;
+}
+
+function withIdentityDir(fn) {
+  const prev = process.env.SYM_IDENTITY_DIR;
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sym-idroot-'));
+  process.env.SYM_IDENTITY_DIR = root;
+  try { return fn(root); } finally {
+    if (prev === undefined) delete process.env.SYM_IDENTITY_DIR; else process.env.SYM_IDENTITY_DIR = prev;
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+/** Replace several fs functions for the duration of `body`. */
+function patchMany(wraps, body) {
+  const originals = {};
+  for (const [k, w] of Object.entries(wraps)) { originals[k] = fs[k]; fs[k] = w(originals[k]); }
+  try { return body(); } finally { for (const k of Object.keys(originals)) fs[k] = originals[k]; }
+}
+
+/** Run `code` in a child process against this state root, SIGKILLed at the first fs.<fn> call whose arguments match `re`. */
+function killedAt(fn, re, code, when = 'before') {
+  const script = `
+    const fs = require('fs');
+    const orig = fs.${fn}; const re = new RegExp(${JSON.stringify(re)});
+    fs.${fn} = function (...a) {
+      const hit = re.test(a.map(String).join(' -> '));
+      if (hit && ${JSON.stringify(when)} === 'before') process.kill(process.pid, 'SIGKILL');
+      const r = orig.apply(this, a);
+      if (hit && ${JSON.stringify(when)} === 'after') process.kill(process.pid, 'SIGKILL');
+      return r;
+    };
+    const cfg = require(${JSON.stringify(path.join(LIB, 'config.js'))});
+    const relocation = require(${JSON.stringify(path.join(LIB, 'relocation.js'))});
+    ${code}`;
+  const r = spawnSync(process.execPath, ['-e', script], { env: process.env, encoding: 'utf8' });
+  return { killed: r.signal === 'SIGKILL', stderr: r.stderr };
+}
+
+const hostKey = () => relocation.hostKey().publicKey;
+const bundlePath = () => path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'sym-bundle-')), 'node.bundle');
+
+describe('design v2: a 0.13 agent is moved, never copied (rr-e6, rr-e24, rr-e23: ENOSPC, seconds per start)', () => {
+  it('the first start makes no copy of the store: every file is the inode it was (9f6847c copied each one)', () => {
+    const name = uniq('nocopy');
+    const id = legacyNode(name, { files: 40 });
+    const before = inodes(path.join(NODES_DIR, name));
+    assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey);
+    const after = inodes(cfg.nodeDirById(id.nodeId));
+    for (const k of before.keys()) assert.ok(after.has(k), `file ${k} is still the same inode, in by-id`);
+    assert.ok(!exists(path.join(NODES_DIR, cfg.LEGACY_ASIDE, name)), 'nothing is set aside: there is no second copy');
+    const extra = [...after.keys()].filter((k) => !before.has(k)).reduce((n, k) => n + after.get(k), 0);
+    assert.ok(extra < 4096, `no more than a few bytes are new (${extra})`);
+  });
+
+  it('a 5,000-file store starts in well under a second (9f6847c: ~21 s for the copy and its byte-for-byte check)', () => {
+    const name = uniq('fast');
+    const id = makeIdentity(name);
+    put(path.join(NODES_DIR, name, 'identity.json'), JSON.stringify(id));
+    const cmbs = path.join(NODES_DIR, name, 'cmbs');
+    fs.mkdirSync(cmbs, { recursive: true });
+    for (let i = 0; i < 5000; i++) fs.writeFileSync(path.join(cmbs, `c${i}.json`), '{"x":1}');
+    const t0 = Date.now();
+    assert.strictEqual(cfg.loadIdentity({ name }).nodeId, id.nodeId);
+    const ms = Date.now() - t0;
+    assert.ok(ms < 3000, `the first start took ${ms} ms`);
+    assert.strictEqual(fs.readdirSync(path.join(cfg.nodeDirById(id.nodeId), 'cmbs')).length, 5000);
+  });
+});
+
+describe('design v2: a 0.13 directory behind a link, on a mount point, or holding a relative link outward is linked to, not copied', () => {
+  it('rr-e7 / R1-e4: nodes/<name> a link to the store elsewhere: by-id/<id> is an absolute link to it; the store stays there (0.14.2 minted; 9f6847c copied it onto the state volume)', () => {
+    const name = uniq('linked');
+    const far = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'sym-far-')), name);
+    const id = legacyNode(name, { where: far });
+    const before = inodes(far);
+    fs.symlinkSync(far, path.join(NODES_DIR, name), 'dir');
+    for (const o of [{ name }, { name, nodeId: id.nodeId, create: false }]) assert.strictEqual(cfg.loadIdentity(o).privateKey, id.privateKey);
+    const dir = cfg.nodeDirById(id.nodeId);
+    assert.ok(isLink(dir) && path.isAbsolute(fs.readlinkSync(dir)) && fs.realpathSync(dir) === fs.realpathSync(far), 'by-id/<id> leads to the store where it is');
+    assert.deepStrictEqual([...inodes(far).keys()].sort(), [...before.keys()].sort(), 'the same files, none copied');
+    assert.ok(!exists(path.join(NODES_DIR, cfg.LEGACY_ASIDE, name)), 'nothing set aside: no second copy');
+    assert.ok(isLink(path.join(NODES_DIR, name)) && cfg.compatLinkNodeId(path.join(NODES_DIR, name)) === id.nodeId, 'nodes/<name> is the compat link');
+  });
+
+  it('rr-e22: nodes/<name> a RELATIVE link to the 0.13 directory: nothing is left dangling, and after an export no file holds the key (9f6847c set the relative link aside dangling and left the key 0644)', () => {
+    const name = uniq('rellink');
+    const base = fs.mkdtempSync(path.join(cfg.SYM_DIR, 'far-'));
+    const id = legacyNode(name, { where: path.join(base, name) });
+    fs.symlinkSync(path.relative(NODES_DIR, path.join(base, name)), path.join(NODES_DIR, name), 'dir');
+    assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey);
+    const dangling = [];
+    const walk = (d) => { for (const e of fs.readdirSync(d)) { const p = path.join(d, e); const st = fs.lstatSync(p); if (st.isSymbolicLink() && !exists(p)) dangling.push(p); else if (st.isDirectory()) walk(p); } };
+    walk(NODES_DIR);
+    assert.deepStrictEqual(dangling, [], 'no link that leads nowhere');
+    if (posix) assert.strictEqual(modeOf(path.join(base, name, 'identity.json')), 0o600, 'the key file where it is, narrowed');
+    relocation.exportNode({ name, out: bundlePath(), toHostKey: hostKey() });
+    assert.deepStrictEqual(holding(id.privateKey, [base, NODES_DIR]), [], 'no copy of the private key is left');
+    assert.deepStrictEqual(holding(`e2e-${id.nodeId}`, [base, NODES_DIR]), [], 'nor of the 0.13 E2E key');
+  });
+
+  it('rr-e14: nodes/<name> a mount point (another device than nodes/): linked to where it is, never copied onto the state volume (9f6847c copied it)', () => {
+    const name = uniq('mount');
+    const id = legacyNode(name);
+    const at = path.join(NODES_DIR, name);
+    const real = fs.statSync;
+    const mounted = (p, st) => { if (st && String(p) === at) { return Object.assign(Object.create(Object.getPrototypeOf(st)), st, { dev: st.dev + 1000 }); } return st; };
+    const before = inodes(at);
+    patchMany({
+      statSync: () => function (p, ...a) { return mounted(p, real.call(fs, p, ...a)); },
+    }, () => assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey));
+    const dir = cfg.nodeDirById(id.nodeId);
+    assert.ok(isLink(dir) && fs.realpathSync(dir) === fs.realpathSync(at), 'by-id/<id> links to the mount point');
+    assert.ok(!isLink(at) && exists(path.join(at, 'identity.json')), 'the mounted directory is where it was');
+    assert.deepStrictEqual([...inodes(at).keys()].sort(), [...before.keys()].sort(), 'no file copied');
+    assert.strictEqual(cfg.loadIdentity({ name, nodeId: id.nodeId, create: false }).privateKey, id.privateKey, 'and the next start is the same agent');
+  });
+});
+
+describe('design v2: husks', () => {
+  it('rr-e25: a husk 0.14.2 ran beside a live 0.13 process (both stores grew): the agent starts, the husk is kept aside with what differs (9f6847c halted; 0.14.2 overwrote the key)', () => {
+    const name = uniq('diverged');
+    const id = legacyNode(name);
+    put(path.join(NODES_DIR, name, 'attestations', 'attestations.jsonl'), '{"seq":1,"by":"0.13"}\n');
+    const husk = cfg.nodeDirById(id.nodeId);
+    put(path.join(husk, 'attestations', 'attestations.jsonl'), '{"seq":1,"by":"0.14.2"}\n');
+    put(path.join(husk, 'cmbs', 'cmb-new-in-0142.json'), '{"x":1}');
+    const warned = [];
+    const onWarning = (w) => { if (w.code === 'SYM_HUSK_SET_ASIDE') warned.push(w.message); };
+    process.on('warning', onWarning);
+    try {
+      for (const o of [{ name }, { name, nodeId: id.nodeId, create: false }]) assert.strictEqual(cfg.loadIdentity(o).privateKey, id.privateKey);
+    } finally { process.removeListener('warning', onWarning); }
+    assert.strictEqual(read(path.join(husk, 'attestations', 'attestations.jsonl')), '{"seq":1,"by":"0.13"}\n', 'the node is its 0.13 directory');
+    const aside = fs.readdirSync(path.join(NODES_DIR, 'by-id')).filter((n) => n.startsWith(`.${id.nodeId}.husk-`));
+    assert.strictEqual(aside.length, 1);
+    const kept = path.join(NODES_DIR, 'by-id', aside[0]);
+    assert.strictEqual(read(path.join(kept, 'attestations', 'attestations.jsonl')), '{"seq":1,"by":"0.14.2"}\n', 'what differs is kept');
+    assert.ok(exists(path.join(kept, 'cmbs', 'cmb-new-in-0142.json')));
+    if (posix) assert.strictEqual(modeOf(kept), 0o700, 'the aside narrowed');
+  });
+
+  it('rr-e5: 0.14.2 crashed between moving nodes/<name> and SYM_IDENTITY_DIR/<name> (a stray identity.json and the E2E key at 0644 in the node dir): after the start and an export, no file on the host holds either key (9f6847c left both in a husk)', () => {
+    withIdentityDir((idRoot) => {
+      const name = uniq('e5');
+      const id = makeIdentity(name);
+      legacyNode(name, { identity: id, files: 4 });
+      put(path.join(idRoot, name, 'identity.json'), JSON.stringify(id, null, 2));
+      fs.mkdirSync(path.join(NODES_DIR, 'by-id'), { recursive: true });
+      fs.renameSync(path.join(NODES_DIR, name), cfg.nodeDirById(id.nodeId)); // 0.14.2's first rename, then the crash
+      assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey);
+      assert.ok(!exists(path.join(cfg.nodeDirById(id.nodeId), 'identity.json')), 'the stray copy of the key in the node directory is gone (the key is in SYM_IDENTITY_DIR)');
+      relocation.exportNode({ name, out: bundlePath(), toHostKey: hostKey() });
+      assert.deepStrictEqual(holding(id.privateKey), [], 'no file holds the private key');
+      assert.deepStrictEqual(holding(`e2e-${id.nodeId}`), [], 'nor the 0.13 E2E private key');
+    });
+  });
+});
+
+describe('design v2: leftovers that hold a key are cleared on every load (rr-e11, rr-e12)', () => {
+  it('a dead start\'s staging holding a private key is removed by any later load, and an export leaves no copy (9f6847c cleared it only while migrating)', () => {
+    const name = uniq('leftover');
+    const agent = cfg.loadIdentity({ name });
+    const ghost = makeIdentity(name);
+    const dead = path.join(NODES_DIR, 'by-id', `.${agent.nodeId}.partial-2147483646-0badc0de`);
+    const deadMint = path.join(NODES_DIR, 'by-id', `.${ghost.nodeId}.stage-2147483645-0badc0de`);
+    put(path.join(dead, 'identity.json'), JSON.stringify(agent), 0o644);
+    put(path.join(deadMint, 'identity.json'), JSON.stringify(ghost), 0o644);
+    const aside = path.join(NODES_DIR, cfg.LEGACY_ASIDE, uniq('aside'));
+    put(path.join(aside, 'identity.json'), JSON.stringify(makeIdentity('x')), 0o644);
+    cfg.loadIdentity({ name }); // a later start of the agent, already migrated
+    assert.ok(!exists(dead) && !exists(deadMint), 'cleared');
+    if (posix) assert.strictEqual(modeOf(path.join(aside, 'identity.json')), 0o600, 'a key set aside by a start that was killed before it narrowed it, narrowed now');
+    relocation.exportNode({ name, out: bundlePath(), toHostKey: hostKey() });
+    assert.deepStrictEqual(holding(agent.privateKey), []);
+  });
+
+  it('rr-e19: the temp files a killed lock holder left in the node directory are cleared on load', () => {
+    const name = uniq('locktmp');
+    const id = cfg.loadIdentity({ name });
+    const dir = cfg.nodeDirById(id.nodeId);
+    put(path.join(dir, '.lock.pid.2147483646-deadbeef.tmp'), '2147483646\n');
+    put(path.join(dir, '.lock.pid.break-0123456789abcdef.2147483646-deadbeef.tmp'), '2147483646\n');
+    cfg.loadIdentity({ name });
+    assert.deepStrictEqual(fs.readdirSync(dir).filter((n) => n.startsWith('.lock')), []);
+  });
+});
+
+describe('design v2: export stops the source before any bundle exists (rr-e13, rr-e13b, rr-e18, rr-e20)', () => {
+  it('killed right after its bundle is in place: the source refuses, and a retry to ANOTHER out writes no second bundle (9f6847c wrote it: two importable bundles)', () => {
+    const name = uniq('two-bundles');
+    const id = cfg.loadIdentity({ name });
+    const b1 = bundlePath(); const b2 = bundlePath();
+    const k = killedAt('renameSync', `${b1.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\.\\d+\\.tmp -> `, `relocation.exportNode({ name: ${JSON.stringify(name)}, out: ${JSON.stringify(b1)}, toHostKey: ${JSON.stringify(hostKey())} });`, 'after');
+    assert.ok(k.killed, `killed after the bundle rename (${k.stderr.slice(0, 200)})`);
+    assert.ok(exists(b1), 'the bundle is complete');
+    assert.throws(() => cfg.loadIdentity({ name }), (e) => e.code === 'EIDENTITYTOMBSTONED', 'the source does not start: the agent is in the bundle');
+    const again = relocation.exportNode({ name, out: b2, toHostKey: hostKey() });
+    assert.strictEqual(again.resumed, 'scrub');
+    assert.ok(!exists(b2), 'no second bundle');
+    assert.strictEqual(JSON.parse(read(path.join(cfg.identityDirById(id.nodeId), 'identity.json'))).privateKey, null, 'the source lost the key');
+  });
+
+  it('killed after the tombstone and before the bundle: refused (pending), another out refused while a bundle may exist, the same out finishes', () => {
+    const name = uniq('pending');
+    cfg.loadIdentity({ name });
+    const b1 = bundlePath();
+    const k = killedAt('openSync', `${path.basename(b1)}\\.\\d+\\.tmp`, `relocation.exportNode({ name: ${JSON.stringify(name)}, out: ${JSON.stringify(b1)}, toHostKey: ${JSON.stringify(hostKey())} });`);
+    assert.ok(k.killed);
+    assert.ok(!exists(b1));
+    assert.throws(() => cfg.loadIdentity({ name }), (e) => e.code === 'EIDENTITYEXPORTING');
+    assert.throws(() => relocation.exportNode({ name, out: bundlePath(), toHostKey: hostKey() }), /may have written a complete bundle/);
+    assert.ok(relocation.exportNode({ name, out: b1, toHostKey: hostKey() }).nodeId);
+    assert.ok(exists(b1));
+  });
+
+  it('a resume must use the same recipient', () => {
+    const name = uniq('recipient');
+    cfg.loadIdentity({ name });
+    const b1 = bundlePath();
+    const k = killedAt('openSync', `${path.basename(b1)}\\.\\d+\\.tmp`, `relocation.exportNode({ name: ${JSON.stringify(name)}, out: ${JSON.stringify(b1)}, toHostKey: ${JSON.stringify(hostKey())} });`);
+    assert.ok(k.killed);
+    const other = crypto.generateKeyPairSync('x25519').publicKey.export({ type: 'spki', format: 'der' }).subarray(-32).toString('base64url');
+    assert.throws(() => relocation.exportNode({ name, out: b1, toHostKey: other }), /sealed to the host key/);
+  });
+
+  it('rr-e18: with SYM_IDENTITY_DIR the tombstone is also in the node directory (where 0.14.2 reads it), written before the bundle (9f6847c: only beside the key, so a 0.14.2 rollback started the node)', () => {
+    withIdentityDir(() => {
+      const name = uniq('rollback');
+      const id = cfg.loadIdentity({ name });
+      const b1 = bundlePath();
+      const k = killedAt('openSync', `${path.basename(b1)}\\.\\d+\\.tmp`, `relocation.exportNode({ name: ${JSON.stringify(name)}, out: ${JSON.stringify(b1)}, toHostKey: ${JSON.stringify(hostKey())} });`);
+      assert.ok(k.killed, 'killed before the bundle was written');
+      assert.ok(exists(path.join(cfg.nodeDirById(id.nodeId), cfg.TOMBSTONE)), 'the tombstone 0.14.2 reads is there before any bundle');
+      assert.ok(exists(path.join(cfg.identityDirById(id.nodeId), cfg.TOMBSTONE)));
+    });
+  });
+
+  it('rr-e20: a node stopped in this process and exported is refused when it starts again (9f6847c took the lock again and ran the exported key)', async () => {
+    const { SymNode } = require('../lib/node');
+    const name = uniq('restart');
+    const n = new SymNode({ name, silent: true });
+    await n.stop();
+    relocation.exportNode({ name, out: bundlePath(), toHostKey: hostKey() });
+    assert.throws(() => n._takeOwnership(), (e) => e.code === 'EIDENTITYTOMBSTONED');
+    assert.ok(!n._releaseIdentityLock, 'and it holds no lock');
+  });
+
+  it('abortExport is on the CLI (sym node abort-export), and refuses once a complete bundle exists', () => {
+    const name = uniq('cli-abort');
+    const id = cfg.loadIdentity({ name });
+    const b1 = bundlePath();
+    const k = killedAt('openSync', `${path.basename(b1)}\\.\\d+\\.tmp`, `relocation.exportNode({ name: ${JSON.stringify(name)}, out: ${JSON.stringify(b1)}, toHostKey: ${JSON.stringify(hostKey())} });`);
+    assert.ok(k.killed);
+    const cli = (...a) => spawnSync(process.execPath, [path.resolve(__dirname, '../bin/sym.js'), ...a], { env: process.env, encoding: 'utf8' });
+    const r = cli('node', 'abort-export', name);
+    assert.strictEqual(r.status, 0, r.stderr);
+    assert.match(r.stdout, /abandoned/);
+    assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey, 'it starts here again');
+    const k2 = killedAt('openSync', 'identity\\.json\\.\\d+\\.tmp', `relocation.exportNode({ name: ${JSON.stringify(name)}, out: ${JSON.stringify(b1)}, toHostKey: ${JSON.stringify(hostKey())} });`);
+    assert.ok(k2.killed && exists(b1), 'killed after a complete bundle');
+    const r2 = cli('node', 'abort-export', '--node-id', id.nodeId);
+    assert.notStrictEqual(r2.status, 0);
+    assert.match(r2.stderr, /complete bundle/);
+  });
+});
+
+describe('design v2: an import interrupted between its installs can be retried (rr-e16)', () => {
+  for (const split of [true, false]) {
+    it(`${split ? 'SYM_IDENTITY_DIR' : 'plain'}: killed after its first install, the retry completes and the agent starts by pin and by name (9f6847c: "already lives on this host", the pin absent)`, () => {
+      const run = () => {
+        const name = uniq('imp');
+        const id = cfg.loadIdentity({ name });
+        put(path.join(cfg.nodeDirById(id.nodeId), 'cmbs', 'm.json'), '{"m":1}');
+        const out = bundlePath();
+        relocation.exportNode({ name, out, toHostKey: hostKey() });
+        // another host: this host's copies of the node removed
+        fs.rmSync(cfg.nodeDirById(id.nodeId), { recursive: true, force: true });
+        fs.rmSync(cfg.identityDirById(id.nodeId), { recursive: true, force: true });
+        const k = killedAt('renameSync', '\\.import-', `relocation.importNode({ from: ${JSON.stringify(out)}, expect: { nodeId: ${JSON.stringify(id.nodeId)}, key: ${JSON.stringify(id.publicKey)} } });`, 'after');
+        assert.ok(k.killed, k.stderr.slice(0, 300));
+        // The identity is installed first (it is the commit): already between the installs the agent is here.
+        assert.strictEqual(cfg.loadIdentity({ nodeId: id.nodeId }).privateKey, id.privateKey, 'committed by the first install');
+        const r = relocation.importNode({ from: out, expect: { nodeId: id.nodeId, key: id.publicKey } });
+        assert.strictEqual(r.nodeId, id.nodeId);
+        assert.strictEqual(cfg.loadIdentity({ name, nodeId: id.nodeId, create: false }).privateKey, id.privateKey);
+        assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey);
+        assert.strictEqual(read(path.join(cfg.nodeDirById(id.nodeId), 'cmbs', 'm.json')), '{"m":1}', 'with its store');
+        if (split) assert.ok(!exists(path.join(cfg.nodeDirById(id.nodeId), 'identity.json')), 'the private key only in the identity directory');
+      };
+      if (split) withIdentityDir(run); else run();
+    });
+  }
+});
+
+describe('design v2: a pin never takes a name held by another agent (rr-e17)', () => {
+  it('a pinned start under a name whose 0.13 directory holds ANOTHER agent halts and moves nothing; the name\'s own start loads that agent (9f6847c claimed the name for the pin)', () => {
+    const name = uniq('claude-foo');
+    const old = legacyNode(name);
+    const pin = cfg.loadIdentity({ name: uniq('pinned-elsewhere') });
+    assert.throws(() => cfg.loadIdentity({ name, nodeId: pin.nodeId, create: false }), (e) => e instanceof IdentityHaltError && e.reason.includes(old.nodeId));
+    assert.ok(!isLink(path.join(NODES_DIR, name)) && !exists(indexFile(name)), 'nothing moved, nothing claimed');
+    assert.strictEqual(cfg.loadIdentity({ name }).privateKey, old.privateKey, 'by name: the 0.13 agent');
+  });
+});
+
+describe('design v2: one source of truth; the index and the links are caches (rr-e1, rr-e8, R1-e7)', () => {
+  modeTest('rr-e1: an agent 0.14.2 migrated (by-id dir 0755, key 0644): it loads, its directory narrowed to 0700 and its keys to 0600 (9f6847c left the directory 0755)', () => {
+    const name = uniq('narrow');
+    const id = migratedBy0142(name);
+    const dir = cfg.nodeDirById(id.nodeId);
+    assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey);
+    assert.strictEqual(modeOf(dir), 0o700);
+    assert.strictEqual(modeOf(path.join(dir, 'identity.json')), 0o600);
+    assert.strictEqual(modeOf(path.join(dir, 'e2e-keypair.json')), 0o600);
+  });
+
+  it('rr-e1: an entry 0.14.2 wrote for a rename (the identity still under its old name) leads to the agent, and the identity takes the name', () => {
+    const old = uniq('iota');
+    const id = migratedBy0142(old);
+    const renamed = uniq('iota2');
+    fs.renameSync(indexFile(old), indexFile(renamed)); // what 0.14.2's renameIdentity did: the entry moved, identity.json kept its name
+    fs.unlinkSync(path.join(NODES_DIR, old));
+    fs.symlinkSync(path.join('by-id', id.nodeId), path.join(NODES_DIR, renamed), 'dir');
+    put(indexFile(renamed), JSON.stringify({ name: renamed, nodeId: id.nodeId, at: 2 }));
+    assert.strictEqual(cfg.loadIdentity({ name: renamed }).nodeId, id.nodeId);
+    assert.strictEqual(JSON.parse(read(path.join(cfg.nodeDirById(id.nodeId), 'identity.json'))).name, renamed, 'derivable from the identity now');
+    fs.unlinkSync(indexFile(renamed)); fs.unlinkSync(path.join(NODES_DIR, renamed)); // both caches lost
+    assert.strictEqual(cfg.loadIdentity({ name: renamed }).nodeId, id.nodeId, 're-derived from the identity\'s name');
+  });
+
+  it('rr-e1: an entry 0.14.2 wrote for a pinned start under another identity\'s name keeps leading where it led; a pin of the other one halts (R4-9)', () => {
+    const name = uniq('app');
+    const a = cfg.loadIdentity({ name });
+    const b = cfg.loadIdentity({ name: uniq('app-b') });
+    put(indexFile(name), JSON.stringify({ name, nodeId: b.nodeId, at: 3 })); // 0.14.2 re-pointed the entry to the pin
+    assert.strictEqual(cfg.loadIdentity({ name }).nodeId, b.nodeId, 'by name: what 0.14.2 ran under the name');
+    assert.strictEqual(cfg.loadIdentity({ name, nodeId: b.nodeId, create: false }).nodeId, b.nodeId);
+    assert.throws(() => cfg.loadIdentity({ name, nodeId: a.nodeId, create: false }), IdentityHaltError);
+  });
+
+  it('two committed identities that are one name halt, naming both; the index alone does not pick one silently', () => {
+    const name = uniq('twins');
+    const a = cfg.loadIdentity({ name });
+    const b = makeIdentity(name);
+    put(path.join(cfg.nodeDirById(b.nodeId), 'identity.json'), JSON.stringify(b), 0o600); // e.g. 0.14.2 minted in a moment it should not have
+    assert.throws(() => cfg.loadIdentity({ name }), (e) => e instanceof IdentityHaltError && e.reason.includes(a.nodeId) && e.reason.includes(b.nodeId));
+    assert.strictEqual(cfg.loadIdentity({ nodeId: a.nodeId }).nodeId, a.nodeId, 'each loads by its nodeId');
+  });
+
+  it('names are compared without regard to case: the index entry is keyed by the folded name and holds the exact name', () => {
+    const name = `Case-${uniq('mixed')}`;
+    const id = cfg.loadIdentity({ name });
+    const folded = path.join(NODES_DIR, 'by-name', `${encodeURIComponent(name.toLowerCase())}.json`);
+    assert.strictEqual(JSON.parse(read(folded)).name, name);
+    assert.strictEqual(cfg.loadIdentity({ name: name.toLowerCase() }).nodeId, id.nodeId, 'the same agent under another case');
+    assert.strictEqual(cfg.loadIdentity({ name: name.toUpperCase() }).nodeId, id.nodeId);
+  });
+
+  it('a 0.14.2 entry under the exact (unfolded) name is read, and the folded one written beside it', () => {
+    const name = `Kappa-${uniq('k')}`;
+    const id = migratedBy0142(name);
+    fs.unlinkSync(path.join(NODES_DIR, name));
+    assert.strictEqual(cfg.loadIdentity({ name }).nodeId, id.nodeId);
+    assert.strictEqual(JSON.parse(read(path.join(NODES_DIR, 'by-name', `${encodeURIComponent(name.toLowerCase())}.json`))).nodeId, id.nodeId);
+  });
+
+  it('two 0.13 agents whose names fold together (a case-sensitive file system let both exist): the second halts, the first is not touched', () => {
+    const lower = uniq('fold');
+    const upper = lower.toUpperCase();
+    const a = legacyNode(lower);
+    if (exists(path.join(NODES_DIR, upper))) return; // case-insensitive: one directory, one agent (the start above is enough)
+    const b = legacyNode(upper);
+    assert.strictEqual(cfg.loadIdentity({ name: lower }).privateKey, a.privateKey);
+    assert.throws(() => cfg.loadIdentity({ name: upper }), (e) => e instanceof IdentityHaltError && /without regard to case/.test(e.message));
+    assert.ok(exists(path.join(NODES_DIR, upper, 'identity.json')) && JSON.parse(read(path.join(NODES_DIR, upper, 'identity.json'))).privateKey === b.privateKey, 'the second 0.13 agent is where it was');
+  });
+});
+
+describe('design v2: the commit, the link, then the name (design point 6: a kill between commit and claim leaves a state 0.14.2 reads)', () => {
+  it('killed at the name claim after the commit: nodes/<name> already leads to the committed identity, and the next start claims the name for it', () => {
+    const name = uniq('claimkill');
+    const id = legacyNode(name);
+    const k = killedAt('linkSync', `by-name/${name}\\.json$`, `cfg.loadIdentity({ name: ${JSON.stringify(name)} });`);
+    assert.ok(k.killed);
+    assert.ok(!exists(indexFile(name)), 'the name was not claimed');
+    assert.strictEqual(cfg.compatLinkNodeId(path.join(NODES_DIR, name)), id.nodeId, 'the compat link 0.14.2 reads is there');
+    assert.strictEqual(fs.realpathSync(path.join(NODES_DIR, name, 'identity.json')), fs.realpathSync(path.join(cfg.nodeDirById(id.nodeId), 'identity.json')));
+    assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey);
+    assert.strictEqual(JSON.parse(read(indexFile(name))).nodeId, id.nodeId);
+  });
+
+  it('R1-e9: killed at the compat link: the next start puts it and loads the original; modes 0700/0600', () => {
+    const name = uniq('linkkill');
+    const id = legacyNode(name);
+    const k = killedAt('renameSync', `\\.${name}\\.link-\\d+-[0-9a-f]+ -> `, `cfg.loadIdentity({ name: ${JSON.stringify(name)} });`);
+    assert.ok(k.killed);
+    for (let i = 0; i < 2; i++) assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey);
+    assert.ok(isLink(path.join(NODES_DIR, name)));
+    if (posix) { assert.strictEqual(modeOf(cfg.nodeDirById(id.nodeId)), 0o700); assert.strictEqual(modeOf(path.join(cfg.nodeDirById(id.nodeId), 'identity.json')), 0o600); }
+  });
+
+  it('a minter killed between its commit and its claim: the next start adopts that identity, and no second one is made', () => {
+    const name = uniq('mintkill');
+    const k = killedAt('linkSync', `by-name/${name}\\.json$`, `cfg.loadIdentity({ name: ${JSON.stringify(name)} });`);
+    assert.ok(k.killed);
+    const a = cfg.loadIdentity({ name });
+    const b = cfg.loadIdentity({ name });
+    assert.strictEqual(a.nodeId, b.nodeId);
+    const named = fs.readdirSync(path.join(NODES_DIR, 'by-id')).filter((d) => !d.startsWith('.')).filter((d) => { try { return JSON.parse(read(path.join(NODES_DIR, 'by-id', d, 'identity.json'))).name === name; } catch { return false; } });
+    assert.deepStrictEqual(named, [a.nodeId]);
+  });
+});
+
+describe('design v2: across volumes only the key files are copied, after a free-space check', () => {
+  const exdev = (from) => (o) => function (a, b) {
+    if (String(a) === from) throw Object.assign(new Error('EXDEV: cross-device link not permitted (simulated)'), { code: 'EXDEV' });
+    return o.call(fs, a, b);
+  };
+
+  it('too little space for the key files on the identity volume: halts with the bytes needed, the source untouched (9f6847c checked nothing)', () => {
+    withIdentityDir((idRoot) => {
+      const name = uniq('nospace');
+      const id = makeIdentity(name);
+      put(path.join(idRoot, name, 'identity.json'), JSON.stringify(id, null, 2), 0o600);
+      put(path.join(NODES_DIR, name, 'cmbs', 'x.json'), '{}');
+      const src = read(path.join(idRoot, name, 'identity.json'));
+      assert.throws(() => patchMany({
+        renameSync: exdev(path.join(idRoot, name)),
+        statfsSync: (o) => function (p, ...a) { const s = o.call(fs, p, ...a); return { ...s, bavail: typeof s.bavail === 'bigint' ? 1n : 1, bsize: typeof s.bsize === 'bigint' ? 1024n : 1024 }; },
+      }, () => cfg.loadIdentity({ name })), (e) => e instanceof IdentityHaltError && /bytes free/.test(e.reason) && /\d+ are needed/.test(e.reason));
+      assert.strictEqual(read(path.join(idRoot, name, 'identity.json')), src);
+      assert.ok(!cfg.isCommitted(id.nodeId));
+      assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey, 'with the space, the next start finishes');
+    });
+  });
+});
+
+describe('design v2: the guards of the migration and the mint', () => {
+  it('a mint holds the name\'s mint lock from its staging to its claim: one process at a time makes the agent of a name', () => {
+    const name = uniq('mintlock');
+    const lock = path.join(NODES_DIR, 'by-id', `.mint-${encodeURIComponent(name)}.lock`);
+    const seen = [];
+    patchMany({
+      renameSync: (o) => function (a, b) { if (/\.stage-/.test(String(a))) seen.push(cfg.readLockFile(lock)); return o.call(fs, a, b); },
+    }, () => cfg.loadIdentity({ name }));
+    assert.strictEqual(seen.length, 1, 'one commit');
+    assert.ok(seen[0] && seen[0].pid === process.pid, 'the mint lock was held by this process at the commit');
+    assert.ok(!exists(lock), 'and released');
+  });
+
+  it('a 0.13 directory under a name the index gives to an agent whose name differs only in case: a second agent, it halts (never loads the other one)', () => {
+    const name = `Fold${uniq('x')}`;
+    const other = cfg.loadIdentity({ name });
+    fs.unlinkSync(path.join(NODES_DIR, name));
+    const lower = name.toLowerCase();
+    const mine = legacyNode(lower);
+    assert.throws(() => cfg.loadIdentity({ name: lower }), (e) => e instanceof IdentityHaltError && /without regard to case/.test(e.message) && e.message.includes(other.nodeId));
+    assert.strictEqual(JSON.parse(read(path.join(NODES_DIR, lower, 'identity.json'))).privateKey, mine.privateKey, 'the 0.13 agent is where it was');
+  });
+
+  it('a committed directory is never set aside as a husk: the 0.13 copy replaced by a link while this start looks at it', () => {
+    const name = uniq('nohusk');
+    const id = legacyNode(name);
+    const target = cfg.nodeDirById(id.nodeId);
+    fs.mkdirSync(target, { recursive: true });
+    fs.copyFileSync(path.join(NODES_DIR, name, 'identity.json'), path.join(target, 'identity.json')); // the same identity, committed, no entry
+    let raced = false;
+    patchMany({
+      openSync: (o) => function (p, ...a) {
+        if (!raced && String(p).includes(`.${id.nodeId}.migrating`)) { // another start set the 0.13 copy aside and put the link
+          raced = true;
+          fs.renameSync(path.join(NODES_DIR, name), path.join(os.tmpdir(), `${name}-elsewhere-${process.pid}`));
+          fs.symlinkSync(path.join('by-id', id.nodeId), path.join(NODES_DIR, name), 'dir');
+        }
+        return o.call(fs, p, ...a);
+      },
+    }, () => cfg.migrateNodeDir(name));
+    assert.ok(raced, 'the other start ran in between');
+    assert.strictEqual(JSON.parse(read(path.join(target, 'identity.json'))).privateKey, id.privateKey, 'the committed directory is in place');
+    assert.deepStrictEqual(fs.readdirSync(path.dirname(target)).filter((n) => n.startsWith(`.${id.nodeId}.husk`)), [], 'nothing was set aside');
+    fs.rmSync(path.join(os.tmpdir(), `${name}-elsewhere-${process.pid}`), { recursive: true, force: true });
+  });
+
+  it('the compat link is in place before anything else after the commit (no sync in between): the moment a rollback finds neither is one call', () => {
+    const name = uniq('order');
+    const id = legacyNode(name);
+    const target = cfg.nodeDirById(id.nodeId);
+    let committed = false; let linkAtFirstSync = null;
+    patchMany({
+      renameSync: (o) => function (a, b) { const r = o.call(fs, a, b); if (String(b) === target) committed = true; return r; },
+      fsyncSync: (o) => function (fd) { if (committed && linkAtFirstSync === null) linkAtFirstSync = isLink(path.join(NODES_DIR, name)); return o.call(fs, fd); },
+    }, () => cfg.migrateNodeDir(name));
+    assert.ok(committed);
+    assert.strictEqual(linkAtFirstSync, true, 'the link was there at the first sync after the commit');
+  });
+
+  it('a husk holding only the claim of a lock remover that was killed (the lock itself gone): replaced at once, not "kept changing"', () => {
+    const name = uniq('deadclaim');
+    const id = legacyNode(name);
+    const husk = cfg.nodeDirById(id.nodeId);
+    put(path.join(husk, 'lock.pid.break-0123456789abcdef'), `2147483646\n${JSON.stringify({ start: 'x', createdAt: Date.now() })}\n`);
+    const t0 = Date.now();
+    assert.strictEqual(cfg.loadIdentity({ name }).privateKey, id.privateKey);
+    assert.ok(Date.now() - t0 < 1500, `at once, not after the grace a lock being written gets (${Date.now() - t0} ms)`);
+  });
+
+  it('a 0.13 directory under a name whose entry leads to another agent under another name (a 0.14.2 alias): left as it is, not moved in', () => {
+    const name = uniq('aliased');
+    const x = cfg.loadIdentity({ name: uniq('x-own') });
+    put(indexFile(name), JSON.stringify({ name, nodeId: x.nodeId, at: 1 }));
+    const stray = legacyNode(name);
+    assert.strictEqual(cfg.migrateNodeDir(name), 'skipped-duplicate');
+    assert.ok(!exists(cfg.nodeDirById(stray.nodeId)), 'not moved in');
+    assert.strictEqual(JSON.parse(read(path.join(NODES_DIR, name, 'identity.json'))).privateKey, stray.privateKey);
+    assert.strictEqual(cfg.loadIdentity({ name }).nodeId, x.nodeId, 'the name leads where its entry led');
+  });
+
+  modeTest('with SYM_IDENTITY_DIR the node directory (the store) is narrowed to 0700 on load too', () => {
+    withIdentityDir(() => {
+      const name = uniq('nodedir');
+      const id = cfg.loadIdentity({ name });
+      fs.chmodSync(cfg.nodeDirById(id.nodeId), 0o755);
+      cfg.loadIdentity({ name });
+      assert.strictEqual(modeOf(cfg.nodeDirById(id.nodeId)), 0o700);
+    });
+  });
+});