@@ -1686,6 +1686,12 @@ describe("DiffViewProvider", () => {
 		}
 
 		beforeEach(() => {
+			// The guarded publish these rows run through looks the target up in the task's
+			// observation registry before writing it, so the fixture has to record the read and
+			// the version token the guard recomputes. These rows are about the decisions around
+			// the publish - tabs, focus, scroll, finalization - not about the guard refusing it.
+			mockTask.observationRegistry.observe(`${mockCwd}/test.ts`, "v1")
+			vi.mocked(computeVersionToken).mockResolvedValue("v1")
 			// Private members are set via bracket notation (spec convention).
 			// Reset the focus the revert helper reads: a test that sets it must not leak
 			// into the next one, where cleanup could restore a stale editor.
@@ -3446,6 +3452,15 @@ describe("DiffViewProvider", () => {
 	})
 
 	describe("preEditScrollLine capture and restore", () => {
+		beforeEach(() => {
+			// The guarded publish these rows run through looks the target up in the task's
+			// observation registry before writing it, so the fixture has to record the read and
+			// the version token the guard recomputes. These rows are about the decisions around
+			// the publish - tabs, focus, scroll, finalization - not about the guard refusing it.
+			mockTask.observationRegistry.observe(`${mockCwd}/test.txt`, "v1")
+			vi.mocked(computeVersionToken).mockResolvedValue("v1")
+		})
+
 		it("should capture scroll line from visible editor at open() time", async () => {
 			const mockEditor = makeTextEditor({
 				document: makeTextDocument({ uri: makeUri(`${mockCwd}/scroll.ts`) }),
@@ -3599,6 +3614,16 @@ describe("DiffViewProvider", () => {
 	describe("userTouchedDocument close/keep behavior", () => {
 		const mockTargetPath = `${mockCwd}/mock-target-file.ts`
 
+		beforeEach(() => {
+			// The guarded publish these rows run through looks the target up in the task's
+			// observation registry before writing it, so the fixture has to record the read and
+			// the version token the guard recomputes. These rows are about the decisions around
+			// the publish - tabs, focus, scroll, finalization - not about the guard refusing it.
+			mockTask.observationRegistry.observe(`${mockCwd}/mock-target-file.ts`, "v1")
+			mockTask.observationRegistry.observe(`${mockCwd}/test.txt`, "v1")
+			vi.mocked(computeVersionToken).mockResolvedValue("v1")
+		})
+
 		const buildActiveDiffEditor = () =>
 			makeTextEditor({
 				document: makeTextDocument({
@@ -4796,6 +4821,16 @@ describe("DiffViewProvider", () => {
 	})
 
 	describe("userTouchedDiffEditor keep/close behavior", () => {
+		beforeEach(() => {
+			// The guarded publish these rows run through looks the target up in the task's
+			// observation registry before writing it, so the fixture has to record the read and
+			// the version token the guard recomputes. These rows are about the decisions around
+			// the publish - tabs, focus, scroll, finalization - not about the guard refusing it.
+			mockTask.observationRegistry.observe(`${mockCwd}/mock-target-file.ts`, "v1")
+			mockTask.observationRegistry.observe(`${mockCwd}/test.txt`, "v1")
+			vi.mocked(computeVersionToken).mockResolvedValue("v1")
+		})
+
 		const mockTargetPath = `${mockCwd}/mock-target-file.ts`
 
 		const buildActiveDiffEditor = () =>
 
@@ -166,11 +166,14 @@ describe("safeWriteJson lock key under a peer commit", () => {
 		// The lock key is the key every other writer to this file uses, so the caller
 		// queued behind the peer instead of failing before the lock.
 		expect(mockedAcquireFileLock).toHaveBeenCalledWith(referent)
-		// After the lock: the strict publish resolution, the key/publish-target agreement check
-		// (resolve of the publish target plus canonicalization of its directory), the re-resolution of
-		// the staging directory twice - the approval and the re-verification before anything is staged -
-		// then safeWriteText's two
-		// staging-path lstat checks. None of them changes which lock the caller queued behind.
+		// Before the lock the key walk fails once (the peer has the referent renamed away), reports the
+		// link by lstat and canonicalizes the parent, and the caller queues on the referent. After the
+		// lock the publish target is resolved strictly, the agreement check resolves it and canonicalizes
+		// its directory, and the staging directory is resolved twice - the approval and the
+		// re-verification. The two staging-path lstat checks this row used to count are not reached:
+		// with the key spelled as the resolved target, the approved directory and the target's parent are
+		// one canonical directory from the first reading, so safeWriteText has no divergence to measure.
+		// None of these readings changes which lock the caller queued behind.
 		expect(order).toEqual([
 			"resolve-failed",
 			"lstat",
@@ -182,9 +185,6 @@ describe("safeWriteJson lock key under a peer commit", () => {
 			"resolve",
 			"resolve",
 			"resolve",
-			"resolve",
-			"lstat",
-			"lstat",
 		])
 		expect(JSON.parse(await fs.readFile(referent, "utf8"))).toEqual({ id: "task-1" })
 	})
 
@@ -572,9 +572,11 @@ describe("safeWriteJson", () => {
 		const content = await readFileContent(currentTestFilePath)
 		expect(content).toEqual(newData)
 
-		// The orphaned backup is still on disk because its deletion failed.
+		// The orphaned backup is still on disk because its deletion failed. It is named from the
+		// target's basename, which is the prefix the leftover scan reads.
 		const entries = await fs.readdir(tempDir)
-		expect(entries.some((entry) => entry.includes("safeWriteText.bak_"))).toBe(true)
+		const backupPrefix = `.${path.basename(currentTestFilePath)}.bak_`
+		expect(entries.some((entry) => entry.startsWith(backupPrefix))).toBe(true)
 
 		vi.mocked(fs.unlink).mockRestore()
 	})
@@ -621,7 +623,10 @@ describe("safeWriteJson", () => {
 
 		// Clean up
 		await fs.unlink(lockTestFilePath).catch(() => {}) // Ignore errors if file doesn't exist
-		vi.unmock("proper-lockfile") // Ensure the mock is removed after this test
+		// vi.unmock is hoisted above the imports, so it would run before the doMock above and
+		// leave the wrapper installed for every later import; doUnmock runs here, in order, the
+		// way this file's other capture/undo pairs spell it.
+		vi.doUnmock("proper-lockfile") // Ensure the mock is removed after this test
 	})
 	test("should release lock even if an error occurs mid-operation", async () => {
 		const data = { message: "test lock release on error" }
@@ -695,22 +700,32 @@ describe("safeWriteJson", () => {
 		const backups = (await fs.readdir(tempDir)).filter((entry) => entry.includes(".bak_"))
 		expect(backups).toHaveLength(1)
 		expect(await readFileContent(path.join(tempDir, backups[0]))).toEqual(initialData)
+		// The counter belongs to the test, not to the write: the failed write above already spent
+		// its four branches, so the merge write is measured as the difference it makes, and read
+		// against the stage list the guard itself reports. The commit rename is the one rename the
+		// write attempts on its own account; the failed write above left the committed content in a
+		// backup with the canonical path gone, so the recovery pass at the start of this write is
+		// allowed one more rename, the restore the guard reports as the recover stage.
+		const mergeStages: string[] = []
+		const renamesBeforeMerge = renameCallCount
 		await safeWriteJson(currentTestFilePath, newData, {
 			merge: (existing) => {
 				expect(existing).toEqual(initialData)
 				return newData
 			},
+			trace: ({ stage }) => mergeStages.push(stage),
 		})
 
-		// Exactly one rename was attempted, and it was the commit.
-		expect(renameCallCount).toBe(1)
+		// Exactly one rename was attempted on the write's own account, and it was the commit.
+		expect(renameCallCount - renamesBeforeMerge).toBe(mergeStages.includes("recover") ? 2 : 1)
 
-		// The target never left its path, so the previous content is still what a
-		// reader sees, and no orphaned backup copy is left behind either.
+		// The recovery pass put the committed content back on the target before this write
+		// merged onto it - that is what the merge callback saw - so the reader now sees the merged
+		// value, and the recovered backup that made it possible is gone from the directory.
 		const content = await readFileContent(currentTestFilePath)
-		expect(content).toEqual(initialData)
+		expect(content).toEqual(newData)
 		const entries = await fs.readdir(tempDir)
-		expect(entries.some((entry) => entry.includes("safeWriteText.bak_"))).toBe(false)
+		expect(entries.some((entry) => entry.includes(".bak_"))).toBe(false)
 
 		consoleErrorSpy.mockRestore()
 	})
@@ -1043,10 +1058,12 @@ describe("safeWriteJson", () => {
 		const content = await readFileContent(currentTestFilePath)
 		expect(content).toEqual(newData)
 	})
-	// (dropped with the retired spelling: "acquires the lock on the resolved referent, not the caller
-	// alias" and "resolves the real proper-lockfile after the capture above is undone", the pair that
-	// pinned the lock key as the symlink referent. The chain now takes the lock on the path the caller
-	// gives, as trunk spells it, so those two rows describe a spelling this tree no longer carries.)
+	// (A re-land above dropped "acquires the lock on the resolved referent, not the caller alias" and
+	// "resolves the real proper-lockfile after the capture above is undone" as rows about a retired
+	// spelling, while the lock key was being taken from the path the caller gave. The key is resolved
+	// before the lock again (safeWriteJson.ts:327), so the referent question is live: it is answered in
+	// safeWriteJson.lockKey.spec.ts, and the proper-lockfile row below stayed in this file and passes on
+	// its own terms now that the undo runs in order rather than being hoisted above the imports.)
 
 	// The undo in the case above has to be visible from the other side of the file: a later
 	// test that imports proper-lockfile fresh must resolve the real module, not the wrapper
 
@@ -316,11 +316,15 @@ async function safeWriteJson(filePath: string, data: unknown, options?: SafeWrit
 		throw dirError
 	}
 
-	// The lock is taken on the path the caller gave, which is the spelling the trunk carries and this
-	// chain keeps - see the comment at the acquisition below. The guards further down still resolve the
-	// publish target under the lock and still measure it against this path, so the drift check and the
-	// pre-lock confinement check keep their meaning with the key spelled this way.
-	const lockKey = absoluteFilePath
+	// The lock is taken on the key that resolveLockKey establishes for the file - the canonical
+	// spelling, which is the key every other writer to this file takes it on (see the acquisition
+	// comment in core/tools/guardedWrite.ts at lines 190 to 192, and the note on the publish
+	// primitive at lines 233 to 236, both of which state that safeWriteJson holds the resolved key).
+	// Spelled from the caller's pathname instead, a writer whose path runs through an alias directory
+	// and a writer that resolved that directory hold two locks for one file, and this function's own
+	// drift check below then refuses an alias write it was never meant to refuse, because the lock it
+	// holds and the target it measures were then spelled from two different questions.
+	const lockKey = await resolveLockKey(absoluteFilePath)
 
 	// Confinement is checked here as well as under the lock. The lock file lives NEXT
 	// TO the key, so a planted symlink that points outside the declared scope would
@@ -344,7 +348,7 @@ async function safeWriteJson(filePath: string, data: unknown, options?: SafeWrit
 	// remains a no-op, so the finally block in the main file operations
 	// try-catch-finally won't try to release an unacquired lock if this
 	// path is taken.
-	releaseLock = await acquireFileLock(absoluteFilePath)
+	releaseLock = await acquireFileLock(lockKey)
 
 	// Variables to hold the actual path of the temp file if it is created.
 	let actualTempNewFilePath: string | null = null
@@ -370,7 +374,7 @@ async function safeWriteJson(filePath: string, data: unknown, options?: SafeWrit
 		// advisory lock held until the stale timeout for every other writer.
 		resolvedTargetPath = await resolvePublishTarget(absoluteFilePath)
 
-		// The lock above was chosen from the path as it looked before the lock was taken, and the
+		// The lock above was chosen from the key this write resolved before taking it, and the
 		// publish target is resolved under the lock - after a peer committed, and after the alias
 		// itself may have been repointed. If the two no longer name the same file, this writer is
 		// holding the lock of a path it is not about to publish while some other writer can hold
@@ -480,7 +484,7 @@ async function safeWriteJson(filePath: string, data: unknown, options?: SafeWrit
 		// canonical path absent.
 		try {
 			options?.trace?.({ stage: "replacement-rename" })
-			await fs.rename(actualTempNewFilePath, absoluteFilePath)
+			await fs.rename(actualTempNewFilePath, resolvedTargetPath ?? absoluteFilePath)
 		} catch (renameError: unknown) {
 			if (getErrorCode(renameError) !== "EPERM") {
 				throw renameError