@@ -113,6 +113,20 @@ function createMockTask(options: MockTaskOptions = {}): Task {
 	return task as unknown as Task
 }
 
+/** Resolve after the given delay, for races that must answer instead of hang. */
+function delay(ms: number): Promise<void> {
+	return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+/** Bounded poll: reports whether the condition became true within the limit. */
+async function waitUntil(condition: () => boolean, limitMs: number): Promise<boolean> {
+	const deadline = Date.now() + limitMs
+	while (!condition() && Date.now() < deadline) {
+		await delay(5)
+	}
+	return condition()
+}
+
 // -- Tests -------------------------------------------------------------------
 
 describe("guardedWrite (S4a, epic #1375)", () => {
@@ -1292,16 +1306,46 @@ describe("guardedWrite (S4a, epic #1375)", () => {
 	})
 
 	describe("resetChain", () => {
-		it("detaches pending links so later writes start a fresh chain", async () => {
+		it("detaches a pending link so a later write to the same path publishes before it", async () => {
 			const reg = new ObservationRegistry()
 			reg.observe(abs("x.txt"), "v1")
 			mockedComputeVersionToken.mockResolvedValue("v1")
 			const task = createMockTask({ observationRegistry: reg })
+			// Hold the FIRST write inside its publish so that a link is genuinely pending at reset
+			// time. Awaiting the first write first, as this row used to, settles it, and the row then
+			// passes even when resetChain() does nothing at all.
+			let releaseFirst!: () => void
+			const holdFirst = new Promise<void>((resolve) => {
+				releaseFirst = resolve
+			})
+			let publishStarted = 0
+			mockedSafeWriteText.mockImplementation(async () => {
+				publishStarted++
+				if (publishStarted === 1) {
+					await holdFirst
+				}
+				return undefined
+			})
+
+			const first = guardedWrite(task, "x.txt", "a", "update")
+			// Bounded: the row must answer fast instead of waiting out the 20s test timeout when
+			// the publish never starts.
+			expect(await waitUntil(() => publishStarted === 1, 2000)).toBe(true)
 
-			await guardedWrite(task, "x.txt", "a", "update")
 			resetChain()
-			await guardedWrite(task, "x.txt", "b", "update")
+			const second = guardedWrite(task, "x.txt", "b", "update")
+
+			// A detached chain lets the second write publish while the first is STILL held. Left on
+			// the chain, the second link waits behind the first's pending publish and this race
+			// answers "blocked".
+			const outcome = await Promise.race([second.then(() => "published"), delay(200).then(() => "blocked")])
+			expect(outcome).toBe("published")
+
+			// Cleanup: release the held publish so this row leaves no pending link for the next one.
+			releaseFirst()
+			await first
 
+			expect(publishStarted).toBe(2)
 			expect(mockedSafeWriteText).toHaveBeenLastCalledWith(abs("x.txt"), "b", {
 				expectedResolvedPath: abs("x.txt"),
 				expectedAncestorIdentities: [],
 
@@ -616,17 +616,37 @@ describe("safeWriteText", () => {
 	// ── Test 5: win32 DACL path ──────────────────────────────────────────────
 
 	describe("win32 DACL", () => {
-		it.skipIf(process.platform !== "win32")(
-			"copies target DACL onto staging file via icacls before rename on Windows",
-			async () => {
-				const targetPath = "/tmp/test-dir/target.txt"
-				vi.mocked(fs.realpath).mockResolvedValue(targetPath)
-				await safeWriteText(targetPath, "data", { platform: "win32" })
-
-				// icacls dump + restore were called (execFile is callback-based mock)
-				expect(execFile).toHaveBeenCalledTimes(2)
-			},
-		)
+		it("saves the target DACL before the commit and applies it to the published name after it", async () => {
+			const targetPath = "/tmp/test-dir/target.txt"
+			vi.mocked(fs.realpath).mockResolvedValue(targetPath)
+			vi.mocked(fsSync.openSync).mockReturnValue(1)
+			// The contract this row names, stated as an order: the target's DACL is captured while
+			// the target is still the published file, and the dump is applied to the name that the
+			// commit rename produced. Counting two icacls calls cannot tell those two apart, so the
+			// calls are tagged and compared against the commit itself.
+			const order: string[] = []
+			vi.mocked(execFile).mockImplementation((_cmd, _args, _opts, cb) => {
+				order.push(_args?.[1] === "/save" ? "save" : "restore")
+				if (typeof cb === "function") cb(null, "", "")
+				return fakeChild
+			})
+			vi.mocked(fs.rename).mockImplementation(async () => {
+				order.push("rename")
+			})
+
+			await safeWriteText(targetPath, "data", { platform: "win32" })
+
+			expect(order).toEqual(["save", "rename", "restore"])
+			expect(execFile).toHaveBeenCalledTimes(2)
+			// The dump is applied relative to the directory that holds the published name, which is
+			// how icacls resolves the path recorded by /save - the published file, not the staging
+			// file, is what the restored rights end up on.
+			const restoreArgs = vi.mocked(execFile).mock.calls[1]?.[1]
+			expect(restoreArgs?.[0]).toBe(path.dirname(targetPath))
+			expect(restoreArgs?.[1]).toBe("/restore")
+			// The dump is removed only after the restore, so no stale dump outlives the write.
+			expect(fs.unlink).toHaveBeenCalledWith(expect.stringContaining("safeWriteText.acl"))
+		})
 
 		it("non-win32: DACL path is unreachable when platform is not win32", async () => {
 			const targetPath = "/tmp/test-dir/target.txt"
@@ -1861,7 +1881,7 @@ describe("durability of directories a write had to create", () => {
 		const inner = path.resolve("/tmp/root/mid/inner")
 		const mid = path.resolve("/tmp/root/mid")
 		const root = path.resolve("/tmp/root")
-		vi.mocked(fs.realpath).mockResolvedValue(path.resolve(targetPath))
+		vi.mocked(fs.realpath).mockImplementation(async (p: unknown) => path.resolve(String(p)))
 		// /tmp/root already exists, so the recursive mkdir creates /mid and /inner.
 		// Node reports the first directory it had to create; everything below it down
 		// to the target's own directory was created by this write too.
@@ -1873,8 +1893,189 @@ describe("durability of directories a write had to create", () => {
 		const opened = vi.mocked(fsSync.openSync).mock.calls.map((call) => path.resolve(String(call[0])))
 		expect(opened).toContain(inner)
 		expect(opened).toContain(mid)
-		expect(opened).not.toContain(root)
-		// staged temp + the target's directory + the newly created parent.
-		expect(vi.mocked(fsSync.fsyncSync).mock.calls.length).toBe(3)
+		// The pre-existing directory holding the entry that names the shallowest directory this
+		// write created belongs to the durability chain too: without it a crash can still drop
+		// /mid out of /tmp/root and take the whole subtree, published file included.
+		expect(opened).toContain(root)
+		expect(opened).not.toContain(path.resolve("/tmp"))
+		// staged temp + the target's own directory + each created parent + the pre-existing
+		// directory that links the created chain in.
+		expect(vi.mocked(fsSync.fsyncSync).mock.calls.length).toBe(4)
+	})
+})
+
+// ── Commit failure whose backup copy cannot be removed ─────────────────────────
+describe("commit failure with an unremovable backup copy", () => {
+	beforeEach(() => {
+		mockDefaults()
+		vi.mocked(fsSync.writeSync).mockImplementation((...args: unknown[]) =>
+			typeof args[3] === "number" ? args[3] : 0,
+		)
+	})
+
+	/**
+	 * Script one commit failure together with two failed backup unlinks. The existing
+	 * commit-failure row lets the cleanup unlink SUCCEED, so nothing there reaches this
+	 * combination: the copy is complete, the rename fails, and the cleanup is refused twice.
+	 */
+	function scriptCommitFailureWithStuckBackup(): {
+		targetPath: string
+		unlinked: () => string[]
+		run: () => Promise<unknown>
+	} {
+		const targetPath = "/tmp/test-dir/target.txt"
+		vi.mocked(fs.realpath).mockResolvedValue(targetPath)
+		vi.mocked(fsSync.openSync).mockReturnValue(1)
+		vi.mocked(fs.rename).mockRejectedValue(Object.assign(new Error("EACCES: rename refused"), { code: "EACCES" }))
+		const unlinked: string[] = []
+		vi.mocked(fs.unlink).mockImplementation(async (p: unknown) => {
+			const spelled = String(p)
+			if (spelled.includes("safeWriteText.bak_")) {
+				// A handle is still held on the copy: the retry meets the same EPERM.
+				throw Object.assign(new Error("EPERM: operation not permitted"), { code: "EPERM" })
+			}
+			unlinked.push(spelled)
+			return undefined
+		})
+		return {
+			targetPath,
+			unlinked: (): string[] => unlinked.slice(),
+			run: (): Promise<unknown> =>
+				safeWriteText(targetPath, "new data", {
+					backup: true,
+					platform: "linux",
+				}).catch((caught: unknown) => caught),
+		}
+	}
+
+	it("removes the staging file and its directory before reporting the orphaned backup", async () => {
+		const scenario = scriptCommitFailureWithStuckBackup()
+		const error = (await scenario.run()) as OrphanedBackupError
+
+		expect(error).toBeInstanceOf(OrphanedBackupError)
+		expect(error.name).toBe("OrphanedBackupError")
+		// The commit failure stays primary; the cleanup failure travels beside it.
+		expect(error.originalError).toBeInstanceOf(Error)
+		expect((error.originalError as Error).message).toBe("EACCES: rename refused")
+		expect(error.cause).toBe(error.originalError)
+		expect((error.cleanupError as { code?: string }).code).toBe("EPERM")
+		// Both attempts were made on the copy before the verdict was reached.
+		expect(
+			vi.mocked(fs.unlink).mock.calls.filter((call) => String(call[0]).includes("safeWriteText.bak_")).length,
+		).toBe(2)
+		// And the verdict must not be reached by skipping the staging cleanup: the unpublished
+		// temp file is unlinked and this write's own staging directory is removed. Throwing the
+		// orphan error first leaves both behind on every retry of the same write.
+		expect(scenario.unlinked().some((p) => p.includes("safeWriteText_"))).toBe(true)
+		expect(fs.rmdir).toHaveBeenCalledWith(expect.stringContaining(".file-safety-staging_"))
+		expect(fs.rename).toHaveBeenCalledTimes(1)
+	})
+
+	it("reports the orphaned copy in phase-neutral words", async () => {
+		const scenario = scriptCommitFailureWithStuckBackup()
+		const error = (await scenario.run()) as OrphanedBackupError
+
+		expect(error).toBeInstanceOf(OrphanedBackupError)
+		// The copy here was COMPLETE: the backup step succeeded and the commit is what failed.
+		// Wording that blames the backup creation, or calls the finished copy partial, points the
+		// reader at a step that went right.
+		expect(error.message).not.toContain("could not create the backup")
+		expect(error.message).not.toContain("partial")
+		expect(error.message).toContain("the write of /tmp/test-dir/target.txt failed")
+		expect(error.message).toContain("the copy this write made at")
+		expect(error.message).toContain("safeWriteText.bak_")
+		expect(error.message).toContain("EACCES: rename refused")
+		expect(error.message).toContain("EPERM")
+	})
+})
+
+// ── Lock-key inspection failures are not "end of the chain" ────────────────────
+describe("resolveLockKey propagates inspection failures", () => {
+	beforeEach(() => mockDefaults())
+
+	it("does not key a symlink alias when realpath fails for a reason that is not ENOENT", async () => {
+		const alias = path.resolve("/tmp/linkdir/file.json")
+		// The alias and its referent are one file and must take ONE lock. A realpath that fails
+		// with EACCES says nothing about which spelling the path is, and answering with the
+		// alias's own key puts this writer on a different lock than the writer that resolves the
+		// same file a moment later - which is how a read-modify-write loses one side.
+		vi.mocked(fs.realpath).mockImplementation(async (p: unknown) => {
+			const spelled = String(p)
+			if (spelled === alias) {
+				throw Object.assign(new Error("EACCES: permission denied"), { code: "EACCES" })
+			}
+			return spelled
+		})
+		vi.mocked(fs.readlink).mockResolvedValue("file.json")
+
+		await expect(resolveLockKey(alias)).rejects.toThrow("EACCES")
+	})
+
+	it("does not treat a readlink failure that is not 'not a link' as the end of the chain", async () => {
+		const alias = path.resolve("/tmp/linkdir/file.json")
+		const enoent = Object.assign(new Error("ENOENT: no such file or directory"), { code: "ENOENT" })
+		vi.mocked(fs.realpath).mockRejectedValue(enoent)
+		vi.mocked(fs.lstat).mockResolvedValue(_fileStats(true))
+		// The first readlink answers - the path IS a link - and the walk onto the referent then
+		// hits an I/O error. Stopping there would hand back a half-resolved key as if it had been
+		// proved, and the next writer could take a different lock for the same file.
+		let readlinkCalls = 0
+		vi.mocked(fs.readlink).mockImplementation(async () => {
+			readlinkCalls++
+			if (readlinkCalls === 1) {
+				return "referent.json"
+			}
+			throw Object.assign(new Error("EIO: i/o error"), { code: "EIO" })
+		})
+
+		await expect(resolveLockKey(alias)).rejects.toThrow("EIO")
+		expect(readlinkCalls).toBe(2)
+	})
+})
+
+// ── Directories this write created are pinned before the commit ────────────────
+describe("newly created ancestors are pinned before the commit", () => {
+	beforeEach(() => {
+		mockDefaults()
+		vi.mocked(fsSync.writeSync).mockImplementation((...args: unknown[]) =>
+			typeof args[3] === "number" ? args[3] : 0,
+		)
+	})
+
+	it("refuses the commit when a directory this write created is moved and its old name becomes a link", async () => {
+		const mid = path.resolve("/tmp/root/mid")
+		const outside = path.resolve("/outside/mid")
+		const inner = path.join(mid, "inner")
+		const targetPath = path.join(inner, "target.txt")
+		// The parent did not exist when the caller authorized this target, so it is not in
+		// expectedAncestorIdentities and cannot be pinned from that list. This write creates it
+		// (mkdir reports /tmp/root/mid as the first directory it created) and must pin what it
+		// created for itself.
+		vi.mocked(fs.mkdir).mockResolvedValue(mid)
+		let moved = false
+		vi.mocked(fs.realpath).mockImplementation(async (p: unknown) => {
+			const spelled = path.resolve(String(p))
+			return spelled === mid && moved ? outside : spelled
+		})
+		vi.mocked(fs.copyFile).mockImplementation(async () => {
+			// Between the creation and the commit the directory is moved and its old name is
+			// replaced with a link to the moved location. stat still reports the same (dev, ino)
+			// for it, so only the location comparison can see the move.
+			moved = true
+		})
+		vi.mocked(fsSync.openSync).mockReturnValue(1)
+
+		const error = await safeWriteText(targetPath, "new data", {
+			backup: true,
+			expectedResolvedPath: targetPath,
+			expectedAncestorIdentities: [],
+			platform: "linux",
+		}).catch((caught: unknown) => caught)
+
+		expect(error).toBeInstanceOf(AncestorReplacedError)
+		expect((error as AncestorReplacedError).directory).toBe(mid)
+		expect((error as AncestorReplacedError).message).toContain("no longer resolves to the authorized location")
+		// Nothing was published through the link.
+		expect(fs.rename).not.toHaveBeenCalled()
 	})
 })