diff --git a/CHANGELOG.md b/CHANGELOG.md
index f670844..598bee9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ No version has been released yet. Pre-releases are published as `0.1.0-beta.N`;
 - **Snapshots** — `snapshot_to`, `restore_from`, and incremental apply, each authenticated against the state its manifest describes. Destinations must be empty; malformed or incomplete artifacts fail closed.
 - **Recovery** — open-flow GC, apply-journal replay, deep-walk `fsck`, and the `pagedb-fsck` binary.
 - **Online rekey** — rekey under a new key with mixed-cipher and mixed-epoch page coexistence; no full-file migration. A rotation whose source epoch is still pinned by a reader defers retiring it and completes the retirement once the reader set drains — including when the last reader leaves during the deferral itself, so the superseded master key never stays leasable behind an `Ok(())`. A retirement that cannot be taken yet stays queued for the next attempt without holding up the others.
-- **Handle modes** — `Standalone`, `Follower`, `ReadOnly`, and `Observer`.
+- **Handle modes** — `Standalone`, `Follower`, `ReadOnly`, and `Observer`, each holding its own sentinel. A snapshot or restored directory shares its source's identity, so it opens only as `ReadOnly` or as a `Follower` (`open_follower`, `promote_to_follower`), and a `Standalone` open reports `RestoredNotPromoted`. `rekey_into_writer` forks it into an independent `Standalone` writer under a fresh identity.
 - **Open refusals name the parameter, not the store** — `KeyMismatch`, `PageSizeMismatch`, and `RealmMismatch`, each decided before anything is read or written, and none reported as corruption.
 - **Failures report themselves** — an unreadable free-list chain, main file, or segment catalog fails `stats()` instead of reporting zero; compaction never skips a catalog entry whose file it cannot open; segment open distinguishes a missing file from a permission or backend error; and only genuine contention is reported as contention. Persisted named-counter rows are validated at open, and commit-history keys are rejected unless exactly eight bytes.
 
diff --git a/README.md b/README.md
index 4c65622..467a83f 100644
--- a/README.md
+++ b/README.md
@@ -185,6 +185,11 @@ defend against, stated plainly so nobody has to infer it.
   capability bit this build does not understand reports
   `HeaderCapabilityUnsupported`: a newer build wrote the store, and it is
   untouched. Open it with a build that understands the capability.
+- **A restored directory is not a writer.** A snapshot directory, and a
+  directory `restore_from` fills, shares the source's key and nonce space. A
+  Standalone open of one reports `RestoredNotPromoted`. Open it with
+  `open_read_only`, track the source with `open_follower`, or call
+  `rekey_into_writer` to fork an independent writer under a fresh identity.
 - **`main.db` is not reconstructible from `seg/`.** Segment files are
   identity-keyed and the mapping from embedder name to segment id lives only in
   the catalog inside `main.db`. Losing `main.db` while `seg/` survives is
diff --git a/src/compaction/full.rs b/src/compaction/full.rs
index abd5c47..f6b51bb 100644
--- a/src/compaction/full.rs
+++ b/src/compaction/full.rs
@@ -11,7 +11,7 @@ use crate::catalog::codec::{Catalog, CatalogRowKind, SegmentMeta};
 use crate::errors::PagedbError;
 use crate::segment::reader::SegmentReader;
 use crate::segment::types::SegmentPageKind;
-use crate::segment::writer::SegmentWriter;
+use crate::segment::writer::{STAGING_DIR, SegmentWriter};
 use crate::txn::db::{Db, WriterState};
 use crate::vfs::{Vfs, VfsFile};
 
@@ -149,7 +149,7 @@ async fn repack_one_segment<V: Vfs + Clone>(
         mmap_limit,
     )
     .await?;
-    db.vfs.mkdir_all("seg/.staging").await?;
+    db.vfs.mkdir_all(STAGING_DIR).await?;
     let new_segment_id = crate::crypto::random::segment_id()?;
     let mut writer = SegmentWriter::create_internal(
         db.pager.clone(),
diff --git a/src/compaction/helpers.rs b/src/compaction/helpers.rs
index 8dd40c0..637fc36 100644
--- a/src/compaction/helpers.rs
+++ b/src/compaction/helpers.rs
@@ -187,7 +187,7 @@ pub(super) async fn replace_segment_compact<V: Vfs + Clone>(
         format_version: crate::pager::structural_header::MAIN_FORMAT_VERSION,
         cipher_id: db.cipher_id.as_byte(),
         page_size_log2: page_size_log2(db.page_size)?,
-        flags: 0,
+        flags: db.header_flags,
         file_id: db.file_id,
         kek_salt: db.kek_salt,
         mk_epoch: db.mk_epoch.load(std::sync::atomic::Ordering::SeqCst),
@@ -202,10 +202,10 @@ pub(super) async fn replace_segment_compact<V: Vfs + Clone>(
         apply_journal_root_version: 0,
         commit_history_root_page_id: 0,
         commit_history_root_version: 0,
-        restore_mode: 0,
+        restore_mode: state.restore_mode,
         next_page_id: new_next,
-        commit_retain_policy_tag: 0,
-        commit_retain_policy_value: 0,
+        commit_retain_policy_tag: state.commit_retain_policy_tag,
+        commit_retain_policy_value: state.commit_retain_policy_value,
         realm_id: db.realm_id,
     };
 
@@ -272,7 +272,6 @@ pub(super) fn make_header_fields<V: Vfs + Clone>(
     new_next: u64,
     free_list_root_page_id: u64,
 ) -> MainDbHeaderFields {
-    let _ = state;
     let mut catalog_root_bytes = [0u8; 16];
     catalog_root_bytes[..8].copy_from_slice(&new_cat_root.to_le_bytes());
     catalog_root_bytes[8..].copy_from_slice(&new_commit_id.to_le_bytes());
@@ -280,7 +279,7 @@ pub(super) fn make_header_fields<V: Vfs + Clone>(
         format_version: crate::pager::structural_header::MAIN_FORMAT_VERSION,
         cipher_id: db.cipher_id.as_byte(),
         page_size_log2: page_size_log2(db.page_size).unwrap_or(12),
-        flags: 0,
+        flags: db.header_flags,
         file_id: db.file_id,
         kek_salt: db.kek_salt,
         mk_epoch: db.mk_epoch.load(std::sync::atomic::Ordering::SeqCst),
@@ -295,10 +294,10 @@ pub(super) fn make_header_fields<V: Vfs + Clone>(
         apply_journal_root_version: 0,
         commit_history_root_page_id: 0,
         commit_history_root_version: 0,
-        restore_mode: 0,
+        restore_mode: state.restore_mode,
         next_page_id: new_next,
-        commit_retain_policy_tag: 0,
-        commit_retain_policy_value: 0,
+        commit_retain_policy_tag: state.commit_retain_policy_tag,
+        commit_retain_policy_value: state.commit_retain_policy_value,
         realm_id: db.realm_id,
     }
 }
diff --git a/src/pager/header.rs b/src/pager/header.rs
index ebd2322..55f3b7f 100644
--- a/src/pager/header.rs
+++ b/src/pager/header.rs
@@ -5,16 +5,17 @@
 //! `seq` (HK-MAC-verified). A torn write to one slot leaves the other intact.
 
 use crate::Result;
+use crate::crypto::SecretKey;
+use crate::crypto::kdf::{derive_hk, derive_mk};
 use crate::crypto::keys::DerivedKey;
-// `decode_main_db_header` and the corruption detail it reports are needed only
-// by `open_header`, which is test-only: production openers decode per slot
-// because the HK has to be derived from each slot's own salt and epoch.
+// `CorruptionDetail` is used only by `open_header`, which is test-only.
+// Production openers authenticate per slot because each slot's HK derives from its own salt and epoch.
 #[cfg(test)]
 use crate::errors::CorruptionDetail;
 use crate::errors::PagedbError;
-#[cfg(test)]
-use crate::pager::format::structural_header::decode_main_db_header;
-use crate::pager::format::structural_header::{MainDbHeaderFields, encode_main_db_header};
+use crate::pager::format::structural_header::{
+    MainDbHeaderFields, decode_main_db_header, encode_main_db_header,
+};
 use crate::vfs::types::OpenMode;
 use crate::vfs::{Vfs, VfsFile, read_exact_at, write_all_at};
 
@@ -109,6 +110,51 @@ pub(crate) async fn read_header_slot<F: VfsFile + ?Sized>(
     }
 }
 
+/// Authenticate one header slot under `hk`.
+///
+/// Returns `None` when the slot fails to verify. A wrong key, a torn write,
+/// and damage look identical.
+///
+/// Returns `Err` only for `HeaderCapabilityUnsupported`. The key already
+/// authenticated the slot, so no other key or slot revokes its capability.
+pub(crate) fn authenticate_slot(
+    slot: &[u8],
+    hk: &DerivedKey,
+    page_size: usize,
+) -> Result<Option<MainDbHeaderFields>> {
+    match decode_main_db_header(slot, hk, page_size) {
+        Ok(fields) => Ok(Some(fields)),
+        Err(error @ PagedbError::HeaderCapabilityUnsupported { .. }) => Err(error),
+        Err(_) => Ok(None),
+    }
+}
+
+/// Authenticate one header slot under `kek`, as [`authenticate_slot`] does.
+///
+/// The HK derives from the KEK salt and MK epoch, stored unencrypted at
+/// bytes `32..48` and `48..56`. Returns the HK with the fields so the
+/// caller can rewrite the slot.
+pub(crate) fn authenticate_slot_with_kek(
+    slot: &[u8],
+    kek: &SecretKey,
+    page_size: usize,
+) -> Result<Option<(MainDbHeaderFields, DerivedKey)>> {
+    if slot.len() < 56 {
+        return Ok(None);
+    }
+    let mut salt = [0u8; 16];
+    salt.copy_from_slice(&slot[32..48]);
+    let mut epoch = [0u8; 8];
+    epoch.copy_from_slice(&slot[48..56]);
+    let Ok(mk) = derive_mk(kek.as_bytes(), &salt, u64::from_le_bytes(epoch)) else {
+        return Ok(None);
+    };
+    let Ok(hk) = derive_hk(&mk) else {
+        return Ok(None);
+    };
+    Ok(authenticate_slot(slot, &hk, page_size)?.map(|fields| (fields, hk)))
+}
+
 /// Reads both slots; verifies each via HK-MAC; picks the one with the
 /// greater `seq`. If only one verifies, it wins. If neither verifies, returns
 /// `Corruption(HeaderUnverifiable)` — unrecoverable from inside the header
diff --git a/src/recovery/fork.rs b/src/recovery/fork.rs
new file mode 100644
index 0000000..b7e4251
--- /dev/null
+++ b/src/recovery/fork.rs
@@ -0,0 +1,70 @@
+//! Segments a `rekey_into_writer` fork wrote before its `main.db` was live.
+//!
+//! The fork writes its segments in [`FORK_DIR`], which the open-time orphan
+//! scan skips. A fork that never publishes leaves the restored directory
+//! openable. Once the fork's `main.db` is live, its catalog names those
+//! segments. Moving them into staging hands them to catalog repair, which
+//! publishes each one the catalog names and sweeps the rest.
+
+use crate::Result;
+use crate::errors::PagedbError;
+use crate::segment::writer::{FORK_DIR, STAGING_DIR};
+use crate::vfs::Vfs;
+
+/// Move every fork segment into staging. Returns the number moved.
+///
+/// Callers must hold write authority over a store whose `main.db` is the
+/// fork's. Callers must run catalog repair afterwards.
+pub(crate) async fn adopt_forked_segments<V: Vfs>(vfs: &V) -> Result<u64> {
+    let names = forked_segment_names(vfs).await?;
+    if names.is_empty() {
+        return Ok(0);
+    }
+    vfs.mkdir_all(STAGING_DIR).await?;
+    let mut count: u64 = 0;
+    for name in names {
+        vfs.rename(
+            &format!("{FORK_DIR}/{name}"),
+            &format!("{STAGING_DIR}/{name}"),
+        )
+        .await?;
+        count += 1;
+    }
+    vfs.sync_dir(STAGING_DIR).await?;
+    vfs.sync_dir(FORK_DIR).await?;
+    Ok(count)
+}
+
+/// Remove every fork segment. Returns the number removed.
+///
+/// A fork calls this before it starts, to drop what an earlier attempt
+/// wrote without publishing.
+pub(crate) async fn discard_forked_segments<V: Vfs>(vfs: &V) -> Result<u64> {
+    let names = forked_segment_names(vfs).await?;
+    if names.is_empty() {
+        return Ok(0);
+    }
+    let mut count: u64 = 0;
+    for name in names {
+        vfs.remove(&format!("{FORK_DIR}/{name}")).await?;
+        count += 1;
+    }
+    vfs.sync_dir(FORK_DIR).await?;
+    Ok(count)
+}
+
+/// Names in the fork directory that this crate writes: segment identities.
+/// Anything else is left alone.
+async fn forked_segment_names<V: Vfs>(vfs: &V) -> Result<Vec<String>> {
+    let entries = match vfs.list_dir(FORK_DIR).await {
+        Ok(entries) => entries,
+        Err(PagedbError::Io(error)) if error.kind() == std::io::ErrorKind::NotFound => {
+            return Ok(Vec::new());
+        }
+        Err(error) => return Err(error),
+    };
+    Ok(entries
+        .into_iter()
+        .filter(|name| crate::hex::parse_hex::<16>(name).is_some())
+        .collect())
+}
diff --git a/src/recovery/journal.rs b/src/recovery/journal.rs
index 24d8750..88fdec6 100644
--- a/src/recovery/journal.rs
+++ b/src/recovery/journal.rs
@@ -310,7 +310,7 @@ pub async fn replay_apply_journal<V: Vfs + Clone>(
 #[cfg(test)]
 pub async fn execute_journal_actions<V: Vfs>(vfs: &V, actions: &[JournalAction]) -> Result<()> {
     vfs.mkdir_all("seg").await?;
-    vfs.mkdir_all("seg/.staging").await?;
+    vfs.mkdir_all(crate::segment::writer::STAGING_DIR).await?;
     vfs.mkdir_all("seg/.tombstone").await?;
     for action in actions {
         match action {
@@ -338,7 +338,7 @@ pub async fn execute_journal_actions<V: Vfs>(vfs: &V, actions: &[JournalAction])
         }
     }
     vfs.sync_dir("seg").await?;
-    vfs.sync_dir("seg/.staging").await?;
+    vfs.sync_dir(crate::segment::writer::STAGING_DIR).await?;
     vfs.sync_dir("seg/.tombstone").await
 }
 
diff --git a/src/recovery/mod.rs b/src/recovery/mod.rs
index d50ff78..54a0a10 100644
--- a/src/recovery/mod.rs
+++ b/src/recovery/mod.rs
@@ -2,6 +2,7 @@
 //! tombstone GC, spill-scratch reclamation.
 
 pub(crate) mod deep_walk;
+pub(crate) mod fork;
 pub(crate) mod gc;
 pub(crate) mod journal;
 pub(crate) mod provenance;
diff --git a/src/recovery/quarantine/preserve.rs b/src/recovery/quarantine/preserve.rs
index a5b5abd..4a9c6a9 100644
--- a/src/recovery/quarantine/preserve.rs
+++ b/src/recovery/quarantine/preserve.rs
@@ -18,6 +18,7 @@
 
 use crate::Result;
 use crate::errors::PagedbError;
+use crate::segment::writer::STAGING_DIR;
 use crate::vfs::Vfs;
 
 /// Where a quarantined store went, and what moved.
@@ -43,13 +44,7 @@ pub struct QuarantineReport {
 /// So the layout this crate writes is enumerated rather than discovered.
 /// Anything a backend does report is still moved; this only ensures the
 /// directories pagedb itself creates are never missed.
-const STORE_SUBDIRS: &[&str] = &[
-    "seg",
-    "seg/.staging",
-    "seg/.tombstone",
-    "applyjournal",
-    "tmp",
-];
+const STORE_SUBDIRS: &[&str] = &["seg", STAGING_DIR, "seg/.tombstone", "applyjournal", "tmp"];
 
 /// Move every file of the store rooted at `store_dir` into
 /// `<store_dir>/quarantine/<label>/`, preserving the store's directory layout
diff --git a/src/recovery/reconcile.rs b/src/recovery/reconcile.rs
index 7ab2c03..40fa3fb 100644
--- a/src/recovery/reconcile.rs
+++ b/src/recovery/reconcile.rs
@@ -11,6 +11,7 @@ use crate::pager::Pager;
 use crate::segment::authenticated_metadata::{
     ExpectedSegmentPath, authenticate_segment_metadata, validate_expected_path,
 };
+use crate::segment::writer::{STAGING_DIR, staging_path};
 use crate::vfs::Vfs;
 use crate::vfs::types::OpenMode;
 use crate::{RealmId, Result};
@@ -181,10 +182,7 @@ async fn authenticate_row<V: Vfs + Clone>(
             Ok((meta.segment_id, None))
         }
         Err(PagedbError::Io(error)) if error.kind() == std::io::ErrorKind::NotFound => {
-            let staging = format!(
-                "seg/.staging/{}",
-                crate::hex::to_hex_lower(&meta.segment_id)
-            );
+            let staging = staging_path(&meta.segment_id);
             let file = match vfs.open(&staging, OpenMode::Read).await {
                 Ok(file) => file,
                 Err(PagedbError::Io(error)) if error.kind() == std::io::ErrorKind::NotFound => {
@@ -219,7 +217,7 @@ async fn has_orphans<V: Vfs>(vfs: &V, expected: &[[u8; 16]]) -> Result<bool> {
             return Ok(true);
         }
     }
-    let staging_entries = vfs.list_dir("seg/.staging").await?;
+    let staging_entries = vfs.list_dir(STAGING_DIR).await?;
     for name in staging_entries {
         let Some(id) = crate::hex::parse_hex::<16>(&name) else {
             continue;
@@ -248,13 +246,13 @@ async fn sweep_orphans<V: Vfs>(vfs: &V, expected: &[[u8; 16]], recovery_commit:
             vfs.rename(&from, &to).await?;
         }
     }
-    let staging_entries = vfs.list_dir("seg/.staging").await?;
+    let staging_entries = vfs.list_dir(STAGING_DIR).await?;
     for name in staging_entries {
         let Some(id) = crate::hex::parse_hex::<16>(&name) else {
             continue;
         };
         if !expected_ids.contains(&id) {
-            vfs.remove(&format!("seg/.staging/{name}")).await?;
+            vfs.remove(&format!("{STAGING_DIR}/{name}")).await?;
         }
     }
     vfs.sync_dir("seg").await?;
diff --git a/src/segment/writer.rs b/src/segment/writer.rs
index cfb82f0..9151e82 100644
--- a/src/segment/writer.rs
+++ b/src/segment/writer.rs
@@ -43,6 +43,8 @@ pub struct SegmentWriter<V: Vfs + Clone> {
     /// Exact footer layout copied during rekey. Its index pages have already
     /// been authenticated and appended as logical segment pages.
     rekey_footer_layout: Option<(u64, u32)>,
+    /// Directory the file is written in until something publishes it.
+    dir: &'static str,
 }
 
 impl<V: Vfs + Clone> SegmentWriter<V> {
@@ -52,6 +54,25 @@ impl<V: Vfs + Clone> SegmentWriter<V> {
         segment_id: [u8; 16],
         parent_file_id: [u8; 16],
         segment_kind: SegmentKind,
+    ) -> Result<Self> {
+        Self::create_in(
+            pager,
+            realm_id,
+            segment_id,
+            parent_file_id,
+            segment_kind,
+            STAGING_DIR,
+        )
+        .await
+    }
+
+    async fn create_in(
+        pager: Arc<Pager<V>>,
+        realm_id: RealmId,
+        segment_id: [u8; 16],
+        parent_file_id: [u8; 16],
+        segment_kind: SegmentKind,
+        dir: &'static str,
     ) -> Result<Self> {
         let page_size = pager.page_size();
         let cipher_id = pager.cipher_id().as_byte();
@@ -63,10 +84,10 @@ impl<V: Vfs + Clone> SegmentWriter<V> {
         // Ensure the staging directory exists and its entry is durable before
         // creating the staging file, so the file's inode survives a power loss
         // before seal is called.
-        pager.vfs().mkdir_all("seg/.staging").await?;
-        pager.vfs().sync_dir("seg/.staging").await?;
+        pager.vfs().mkdir_all(dir).await?;
+        pager.vfs().sync_dir(dir).await?;
 
-        let path = staging_path(&segment_id);
+        let path = format!("{dir}/{}", crate::hex::to_hex_lower(&segment_id));
         let mut file = pager.vfs().open(&path, OpenMode::CreateNew).await?;
 
         let header_fields = SegmentHeaderFields {
@@ -103,6 +124,7 @@ impl<V: Vfs + Clone> SegmentWriter<V> {
             extents: Vec::new(),
             evictable: Evictable::Authoritative,
             rekey_footer_layout: None,
+            dir,
         })
     }
 
@@ -115,16 +137,61 @@ impl<V: Vfs + Clone> SegmentWriter<V> {
         index_start_page: u64,
         index_page_count: u32,
     ) -> Result<Self> {
-        let mut writer = Self::create_internal(
+        Self::create_replica_in(
             pager,
-            source.realm_id,
+            source,
             segment_id,
             source.parent_file_id,
+            (index_start_page, index_page_count),
+            STAGING_DIR,
+        )
+        .await
+    }
+
+    /// Construct a `rekey_into_writer` copy of `source` under the fork's `parent_file_id`.
+    /// Preserves layout like a rekey replacement.
+    ///
+    /// The file is written in [`FORK_DIR`], which the open-time orphan scan skips.
+    /// A fork that never publishes leaves the restored directory openable.
+    /// A Standalone open adopts the files once the fork's `main.db` is live.
+    pub(crate) async fn create_fork_internal(
+        pager: Arc<Pager<V>>,
+        source: &SegmentMeta,
+        segment_id: [u8; 16],
+        parent_file_id: [u8; 16],
+        index_start_page: u64,
+        index_page_count: u32,
+    ) -> Result<Self> {
+        Self::create_replica_in(
+            pager,
+            source,
+            segment_id,
+            parent_file_id,
+            (index_start_page, index_page_count),
+            FORK_DIR,
+        )
+        .await
+    }
+
+    async fn create_replica_in(
+        pager: Arc<Pager<V>>,
+        source: &SegmentMeta,
+        segment_id: [u8; 16],
+        parent_file_id: [u8; 16],
+        footer_layout: (u64, u32),
+        dir: &'static str,
+    ) -> Result<Self> {
+        let mut writer = Self::create_in(
+            pager,
+            source.realm_id,
+            segment_id,
+            parent_file_id,
             source.segment_kind,
+            dir,
         )
         .await?;
         writer.evictable = source.evictable;
-        writer.rekey_footer_layout = Some((index_start_page, index_page_count));
+        writer.rekey_footer_layout = Some(footer_layout);
         Ok(writer)
     }
 
@@ -343,7 +410,7 @@ impl<V: Vfs + Clone> SegmentWriter<V> {
             .ok_or_else(|| PagedbError::Io(std::io::Error::other("offset overflow")))?;
         write_all_at(&mut self.file, offset, &footer_bytes).await?;
         self.file.sync().await?;
-        self.pager.vfs().sync_dir("seg/.staging").await?;
+        self.pager.vfs().sync_dir(self.dir).await?;
 
         Ok(SegmentMeta {
             segment_id: self.segment_id,
@@ -372,8 +439,15 @@ impl<V: Vfs + Clone> SegmentWriter<V> {
     }
 }
 
+/// Directory a fresh segment is written in until its commit publishes it.
+pub(crate) const STAGING_DIR: &str = "seg/.staging";
+
+/// Directory `rekey_into_writer` writes its segments in before its `main.db`
+/// is live.
+pub(crate) const FORK_DIR: &str = "seg/.fork";
+
 pub(crate) fn staging_path(segment_id: &[u8; 16]) -> String {
-    format!("seg/.staging/{}", crate::hex::to_hex_lower(segment_id))
+    format!("{STAGING_DIR}/{}", crate::hex::to_hex_lower(segment_id))
 }
 
 pub(crate) fn live_path(segment_id: &[u8; 16]) -> String {
diff --git a/src/snapshot/tests/basic.rs b/src/snapshot/tests/basic.rs
index 6f334dc..b4a6260 100644
--- a/src/snapshot/tests/basic.rs
+++ b/src/snapshot/tests/basic.rs
@@ -3311,7 +3311,9 @@ async fn failed_apply_promote_poisoned_handle_reopens_and_replays_journal_before
 
     vfs.fail_renames(false);
     drop(follower);
-    let reopened = Db::open_existing(vfs, KEK, PAGE, REALM).await.unwrap();
+    let reopened = Db::open_follower(vfs, KEK, PAGE, REALM, OpenOptions::default())
+        .await
+        .unwrap();
     let segment = reopened.open_segment(REALM, "promoted").await.unwrap();
     assert!(
         segment
diff --git a/src/txn/db/apply_journal.rs b/src/txn/db/apply_journal.rs
index a0729f8..f07b836 100644
--- a/src/txn/db/apply_journal.rs
+++ b/src/txn/db/apply_journal.rs
@@ -3,13 +3,11 @@
 use crate::errors::PagedbError;
 use crate::pager::anchor::HeaderCursor;
 use crate::pager::header::commit_header;
-use crate::pager::structural_header::MainDbHeaderFields;
 use crate::vfs::Vfs;
 use crate::{CommitId, Result};
 
-use super::core::{Db, WriterState, encode_free_list_root, encode_root_ref};
+use super::core::{Db, WriterState};
 use super::segment::SegmentReconciliation;
-use super::util::page_size_log2;
 
 impl<V: Vfs + Clone> Db<V> {
     /// Retry the journal named by the current durable header. The pointer stays
@@ -80,7 +78,7 @@ impl<V: Vfs + Clone> Db<V> {
         let header_cursor = self.pager.header_cursor()?;
         let next_seq = header_cursor.next_seq()?;
         let counter_anchor = self.pager.pending_anchor();
-        let fields = cleared_header_fields(self, state, next_seq, counter_anchor)?;
+        let fields = self.state_header_fields(state, next_seq, counter_anchor)?;
         let hk = self.hk.read().clone();
         let Ok(next_slot) = commit_header(
             &*self.vfs,
@@ -118,36 +116,3 @@ impl<V: Vfs + Clone> Db<V> {
         Ok(())
     }
 }
-
-fn cleared_header_fields<V: Vfs + Clone>(
-    db: &Db<V>,
-    state: &WriterState,
-    seq: u64,
-    counter_anchor: u64,
-) -> Result<MainDbHeaderFields> {
-    Ok(MainDbHeaderFields {
-        format_version: crate::pager::structural_header::MAIN_FORMAT_VERSION,
-        cipher_id: db.cipher_id.as_byte(),
-        page_size_log2: page_size_log2(db.page_size)?,
-        flags: 0,
-        file_id: db.file_id,
-        kek_salt: db.kek_salt,
-        mk_epoch: db.mk_epoch.load(std::sync::atomic::Ordering::SeqCst),
-        seq,
-        active_root_page_id: state.root_page_id,
-        active_root_txn_id: state.latest_commit_id,
-        counter_anchor,
-        commit_id: CommitId(state.latest_commit_id),
-        free_list_root: encode_free_list_root(state.free_list_root_page_id),
-        catalog_root: encode_root_ref(state.catalog_root_page_id, state.catalog_root_txn_id),
-        apply_journal_root_page_id: 0,
-        apply_journal_root_version: 0,
-        commit_history_root_page_id: state.commit_history_root_page_id,
-        commit_history_root_version: state.commit_history_root_version,
-        restore_mode: state.restore_mode,
-        next_page_id: state.next_page_id,
-        commit_retain_policy_tag: state.commit_retain_policy_tag,
-        commit_retain_policy_value: state.commit_retain_policy_value,
-        realm_id: db.realm_id,
-    })
-}
diff --git a/src/txn/db/catalog/quotas.rs b/src/txn/db/catalog/quotas.rs
index 962c556..a4af14f 100644
--- a/src/txn/db/catalog/quotas.rs
+++ b/src/txn/db/catalog/quotas.rs
@@ -45,19 +45,22 @@ impl<V: Vfs + Clone> Db<V> {
         let counter_anchor = self.pager.pending_anchor();
         let catalog_root_bytes = encode_root_ref(new_catalog_root, new_catalog_txn_id);
 
-        let fields = self.header_fields(HeaderFieldsParams {
-            mk_epoch: self.mk_epoch.load(Ordering::SeqCst),
-            seq: new_seq,
-            active_root_page_id: state.root_page_id,
-            active_root_txn_id: state.latest_commit_id,
-            counter_anchor,
-            commit_id: state.latest_commit_id,
-            catalog_root: catalog_root_bytes,
-            commit_history_root_page_id: state.commit_history_root_page_id,
-            commit_history_root_version: state.commit_history_root_version,
-            free_list_root_page_id: state.free_list_root_page_id,
-            next_page_id: new_next,
-        })?;
+        let fields = self.header_fields(
+            &state,
+            HeaderFieldsParams {
+                mk_epoch: self.mk_epoch.load(Ordering::SeqCst),
+                seq: new_seq,
+                active_root_page_id: state.root_page_id,
+                active_root_txn_id: state.latest_commit_id,
+                counter_anchor,
+                commit_id: state.latest_commit_id,
+                catalog_root: catalog_root_bytes,
+                commit_history_root_page_id: state.commit_history_root_page_id,
+                commit_history_root_version: state.commit_history_root_version,
+                free_list_root_page_id: state.free_list_root_page_id,
+                next_page_id: new_next,
+            },
+        )?;
         let hk_clone = { self.hk.read().clone() };
         let new_slot = commit_header(
             &*self.vfs,
diff --git a/src/txn/db/core.rs b/src/txn/db/core.rs
index 87a10ac..00266cf 100644
--- a/src/txn/db/core.rs
+++ b/src/txn/db/core.rs
@@ -569,12 +569,56 @@ impl<V: Vfs + Clone> Db<V> {
         }
     }
 
-    /// Assemble a [`MainDbHeaderFields`] for a writer header commit, filling in
-    /// the fields that are constant across every writer commit path (identity,
-    /// format version, and the apply-journal / restore-mode / retain-policy
-    /// fields that are always zero on these paths) from `self`, and taking the
-    /// per-commit variable fields from `params`.
-    pub(super) fn header_fields(&self, params: HeaderFieldsParams) -> Result<MainDbHeaderFields> {
+    /// Header fields that republish `state` as it stands, naming no apply
+    /// journal. A header-only commit writes these: one that changes nothing
+    /// but the header, or one that clears a finished apply journal.
+    ///
+    /// This copies every persisted field from `state` or `self`. The
+    /// rewrite never drops the restore mode, capability flags, or
+    /// retention policy the previous header recorded.
+    pub(super) fn state_header_fields(
+        &self,
+        state: &WriterState,
+        seq: u64,
+        counter_anchor: u64,
+    ) -> Result<MainDbHeaderFields> {
+        Ok(MainDbHeaderFields {
+            format_version: self.format_version,
+            cipher_id: self.cipher_id.as_byte(),
+            page_size_log2: super::util::page_size_log2(self.page_size)?,
+            flags: self.header_flags,
+            file_id: self.file_id,
+            kek_salt: self.kek_salt,
+            mk_epoch: self.mk_epoch.load(std::sync::atomic::Ordering::SeqCst),
+            seq,
+            active_root_page_id: state.root_page_id,
+            active_root_txn_id: state.latest_commit_id,
+            counter_anchor,
+            commit_id: CommitId(state.latest_commit_id),
+            free_list_root: encode_free_list_root(state.free_list_root_page_id),
+            catalog_root: encode_root_ref(state.catalog_root_page_id, state.catalog_root_txn_id),
+            apply_journal_root_page_id: 0,
+            apply_journal_root_version: 0,
+            commit_history_root_page_id: state.commit_history_root_page_id,
+            commit_history_root_version: state.commit_history_root_version,
+            restore_mode: state.restore_mode,
+            next_page_id: state.next_page_id,
+            commit_retain_policy_tag: state.commit_retain_policy_tag,
+            commit_retain_policy_value: state.commit_retain_policy_value,
+            realm_id: self.realm_id,
+        })
+    }
+
+    /// Assemble a [`MainDbHeaderFields`] for a writer header commit.
+    /// Identity and format come from `self`. Restore mode and retention
+    /// policy come from `state`, as the previous header recorded them.
+    /// Per-commit fields come from `params`. These paths name no apply
+    /// journal.
+    pub(super) fn header_fields(
+        &self,
+        state: &WriterState,
+        params: HeaderFieldsParams,
+    ) -> Result<MainDbHeaderFields> {
         Ok(MainDbHeaderFields {
             format_version: self.format_version,
             cipher_id: self.cipher_id.as_byte(),
@@ -594,10 +638,10 @@ impl<V: Vfs + Clone> Db<V> {
             apply_journal_root_version: 0,
             commit_history_root_page_id: params.commit_history_root_page_id,
             commit_history_root_version: params.commit_history_root_version,
-            restore_mode: 0,
+            restore_mode: state.restore_mode,
             next_page_id: params.next_page_id,
-            commit_retain_policy_tag: 0,
-            commit_retain_policy_value: 0,
+            commit_retain_policy_tag: state.commit_retain_policy_tag,
+            commit_retain_policy_value: state.commit_retain_policy_value,
             realm_id: self.realm_id,
         })
     }
diff --git a/src/txn/db/mod.rs b/src/txn/db/mod.rs
index a9bd05a..924afa2 100644
--- a/src/txn/db/mod.rs
+++ b/src/txn/db/mod.rs
@@ -24,6 +24,7 @@ mod reader;
 #[cfg(not(target_arch = "wasm32"))]
 mod reclaim;
 pub(crate) mod rekey;
+mod restore_mode;
 mod segment;
 #[cfg(not(target_arch = "wasm32"))]
 mod snapshot;
diff --git a/src/txn/db/open/create.rs b/src/txn/db/open/create.rs
index eb93727..4ea3834 100644
--- a/src/txn/db/open/create.rs
+++ b/src/txn/db/open/create.rs
@@ -233,7 +233,34 @@ impl<V: Vfs + Clone> Db<V> {
         options: OpenOptions,
         cipher_id: CipherId,
     ) -> Result<Self> {
-        let main_db_path = "/main.db".to_string();
+        Self::bootstrap_unlocked_at(
+            vfs,
+            &kek,
+            page_size,
+            realm,
+            options,
+            cipher_id,
+            "/main.db".to_string(),
+        )
+        .await
+    }
+
+    /// Bootstrap a fresh store with a new random identity whose main file is
+    /// `main_db_path`. `rekey_into_writer` builds its replacement `main.db`
+    /// this way, at a scratch path. It later renames the scratch file over
+    /// the live file.
+    ///
+    /// Callers must hold the writer sentinel, since this writes the initial
+    /// header unconditionally.
+    pub(in crate::txn::db) async fn bootstrap_unlocked_at(
+        vfs: V,
+        kek: &SecretKey,
+        page_size: usize,
+        realm: RealmId,
+        options: OpenOptions,
+        cipher_id: CipherId,
+        main_db_path: String,
+    ) -> Result<Self> {
         let (file_id, kek_salt) = crate::crypto::random::database_identity()?;
         let mk_epoch = 0u64;
 
diff --git a/src/txn/db/open/existing.rs b/src/txn/db/open/existing.rs
index 2f060ef..b2457b6 100644
--- a/src/txn/db/open/existing.rs
+++ b/src/txn/db/open/existing.rs
@@ -10,8 +10,7 @@ use crate::crypto::{CipherId, SecretKey};
 use crate::errors::PagedbError;
 use crate::options::OpenOptions;
 use crate::pager::anchor::HeaderCursor;
-use crate::pager::header::ActiveSlot;
-use crate::pager::header::read_header_slot;
+use crate::pager::header::{ActiveSlot, authenticate_slot_with_kek, read_header_slot};
 use crate::pager::structural_header::MainDbHeaderFields;
 use crate::pager::{Pager, PagerConfig};
 use crate::vfs::Vfs;
@@ -44,7 +43,16 @@ impl<V: Vfs + Clone> Db<V> {
         options: OpenOptions,
     ) -> Result<Self> {
         let kek = kek.into();
-        Self::open_existing_inner(vfs, kek, page_size, realm, options, DbMode::Standalone).await
+        Self::open_existing_inner_with_counterpart(
+            vfs,
+            kek,
+            None,
+            page_size,
+            realm,
+            options,
+            DbMode::Standalone,
+        )
+        .await
     }
 
     /// Reopen an existing database: reads and verifies both A/B header slots,
@@ -63,9 +71,10 @@ impl<V: Vfs + Clone> Db<V> {
         realm: RealmId,
     ) -> Result<Self> {
         let kek = kek.into();
-        Self::open_existing_inner(
+        Self::open_existing_inner_with_counterpart(
             vfs,
             kek,
+            None,
             page_size,
             realm,
             OpenOptions::default(),
@@ -76,6 +85,11 @@ impl<V: Vfs + Clone> Db<V> {
 
     /// Explicitly resume an interrupted KEK-changing rekey. `primary_kek` is
     /// the normal caller key; `counterpart_kek` proves the other durable epoch.
+    ///
+    /// The handle is a Standalone writer, opened like [`Db::open`]. It holds
+    /// the writer sentinel and refuses a restored directory. Unlike
+    /// `Db::open`, a missing store reports `NotFound` since no interrupted
+    /// rekey exists to resume.
     pub async fn open_existing_with_counterpart_kek(
         vfs: V,
         primary_kek: impl Into<SecretKey>,
@@ -86,7 +100,7 @@ impl<V: Vfs + Clone> Db<V> {
     ) -> Result<Self> {
         let primary_kek = primary_kek.into();
         let counterpart_kek = counterpart_kek.into();
-        Self::open_existing_inner_with_counterpart(
+        Self::open_with_mode(
             vfs,
             primary_kek,
             Some(counterpart_kek),
@@ -98,20 +112,8 @@ impl<V: Vfs + Clone> Db<V> {
         .await
     }
 
-    pub(super) async fn open_existing_inner(
-        vfs: V,
-        kek: SecretKey,
-        page_size: usize,
-        realm: RealmId,
-        options: OpenOptions,
-        mode: DbMode,
-    ) -> Result<Self> {
-        Self::open_existing_inner_with_counterpart(vfs, kek, None, page_size, realm, options, mode)
-            .await
-    }
-
     #[allow(clippy::too_many_lines)]
-    async fn open_existing_inner_with_counterpart(
+    pub(in crate::txn::db) async fn open_existing_inner_with_counterpart(
         vfs: V,
         kek: SecretKey,
         counterpart_kek: Option<SecretKey>,
@@ -145,34 +147,16 @@ impl<V: Vfs + Clone> Db<V> {
         check_format_version(&buf_a, &buf_b)?;
 
         let try_decode = |buf: &[u8]| -> SlotDecode {
-            if buf.len() < 56 {
-                return (None, None);
-            }
-            let mut salt = [0u8; 16];
-            salt.copy_from_slice(&buf[32..48]);
-            let mut epoch_bytes = [0u8; 8];
-            epoch_bytes.copy_from_slice(&buf[48..56]);
-            let epoch = u64::from_le_bytes(epoch_bytes);
             for (candidate, primary) in [(Some(&kek), true), (counterpart_kek.as_ref(), false)] {
                 let Some(candidate) = candidate else {
                     continue;
                 };
-                let Ok(mk) = derive_mk(candidate.as_bytes(), &salt, epoch) else {
-                    continue;
-                };
-                let Ok(hk) = derive_hk(&mk) else {
-                    continue;
-                };
-                match crate::pager::format::structural_header::decode_main_db_header(
-                    buf, &hk, page_size,
-                ) {
-                    Ok(fields) => return (Some((fields, primary)), None),
+                match authenticate_slot_with_kek(buf, candidate, page_size) {
+                    Ok(Some((fields, _))) => return (Some((fields, primary)), None),
+                    Ok(None) => {}
                     // This key authenticated the slot, so trying a counterpart
                     // cannot make its advertised capability disappear.
-                    Err(error @ PagedbError::HeaderCapabilityUnsupported { .. }) => {
-                        return (None, Some(error));
-                    }
-                    Err(_) => {}
+                    Err(error) => return (None, Some(error)),
                 }
             }
             (None, None)
@@ -215,6 +199,16 @@ impl<V: Vfs + Clone> Db<V> {
             });
         }
 
+        // A restored directory shares its source's DEK and nonce space. A
+        // Standalone writer on it repeats the source's nonces. Only
+        // `rekey_into_writer`, which gives the directory a fresh identity,
+        // clears the restore mode.
+        if capabilities.rejects_unpromoted_restore()
+            && fields.restore_mode != super::super::restore_mode::STANDALONE
+        {
+            return Err(PagedbError::RestoredNotPromoted);
+        }
+
         let cipher_id = CipherId::from_byte(fields.cipher_id)?;
         let mk_epoch = fields.mk_epoch;
         let file_id = fields.file_id;
@@ -239,7 +233,14 @@ impl<V: Vfs + Clone> Db<V> {
             main_db_path: main_db_path.clone(),
             anchor_budget: options.anchor_budget,
             dek_lru_capacity: 256,
-            observer_retry_count: options.observer_retry_count,
+            // Retrying a failed read absorbs a torn read from a concurrent
+            // writer. Only an Observer shares the file with a writer. Every
+            // other mode reports the first failure as corruption.
+            observer_retry_count: if capabilities.allows_observer_retry() {
+                options.observer_retry_count
+            } else {
+                0
+            },
             metrics_enabled: options.metrics_enabled,
         };
         let vfs_arc = Arc::new(vfs);
diff --git a/src/txn/db/open/mod.rs b/src/txn/db/open/mod.rs
index bf39af8..f04e60a 100644
--- a/src/txn/db/open/mod.rs
+++ b/src/txn/db/open/mod.rs
@@ -2,6 +2,7 @@ mod create;
 mod existing;
 pub(crate) mod header_probe;
 mod modes;
+mod promote;
 mod recovery;
 
 pub(crate) use modes::DbModeCapabilities;
diff --git a/src/txn/db/open/modes.rs b/src/txn/db/open/modes.rs
index 9d97dfc..f0939ca 100644
--- a/src/txn/db/open/modes.rs
+++ b/src/txn/db/open/modes.rs
@@ -11,7 +11,6 @@ use super::super::super::mode::{
     ACQUISITION_LOCK_PATH, DbMode, FROZEN_READERS_LOCK_PATH, OBSERVERS_LOCK_PATH, WRITER_LOCK_PATH,
 };
 use super::super::core::Db;
-use super::super::util::peek_restore_mode;
 
 #[derive(Clone, Copy)]
 pub(super) enum PersistentAccess {
@@ -100,6 +99,19 @@ impl DbModeCapabilities {
         matches!(self.long_lived_lock, LongLivedLock::FrozenReader)
     }
 
+    /// This capability lets the handle fork into an independent Standalone
+    /// writer under a fresh identity. The fork replaces `main.db`, so it
+    /// takes the writer sentinel with no other frozen reader present. Only a
+    /// handle holding the frozen-reader or writer sentinel on a
+    /// non-Standalone store can make that trade.
+    #[must_use]
+    pub(crate) const fn forks_into_writer(self) -> bool {
+        matches!(
+            self.long_lived_lock,
+            LongLivedLock::FrozenReader | LongLivedLock::Writer
+        ) && !matches!(self.recovery_authority, RecoveryAuthority::Standalone)
+    }
+
     #[must_use]
     pub(in crate::txn::db) const fn applies_interrupted_apply(self) -> bool {
         matches!(
@@ -196,8 +208,16 @@ impl<V: Vfs + Clone> Db<V> {
         options: OpenOptions,
     ) -> Result<Self> {
         let kek = kek.into();
-        let db =
-            Self::open_with_mode(vfs, kek, page_size, realm, options, DbMode::Standalone).await?;
+        let db = Self::open_with_mode(
+            vfs,
+            kek,
+            None,
+            page_size,
+            realm,
+            options,
+            DbMode::Standalone,
+        )
+        .await?;
         // Black box: mark the epoch boundary — freed-page use-after-free
         // surfaces on reopen, so the trail needs to know when one happened.
         crate::diag::reopened(db.latest_commit().0);
@@ -213,7 +233,7 @@ impl<V: Vfs + Clone> Db<V> {
         options: OpenOptions,
     ) -> Result<Self> {
         let kek = kek.into();
-        Self::open_with_mode(vfs, kek, page_size, realm, options, DbMode::ReadOnly).await
+        Self::open_with_mode(vfs, kek, None, page_size, realm, options, DbMode::ReadOnly).await
     }
 
     /// Open a best-effort read-only view of a database that may have a writer.
@@ -225,47 +245,42 @@ impl<V: Vfs + Clone> Db<V> {
         options: OpenOptions,
     ) -> Result<Self> {
         let kek = kek.into();
-        Self::open_with_mode(vfs, kek, page_size, realm, options, DbMode::Observer).await
+        Self::open_with_mode(vfs, kek, None, page_size, realm, options, DbMode::Observer).await
     }
 
-    async fn open_with_mode(
+    /// The one path every public open takes. It applies the mode's sentinel,
+    /// the missing-store rule, and bootstrap under the acquisition lock. It
+    /// then hands off to the shared existing-store opener, which applies the
+    /// rest.
+    ///
+    /// `counterpart_kek` resumes an interrupted KEK-changing rekey. Such an
+    /// open never bootstraps: with no store there is no rekey to resume.
+    pub(super) async fn open_with_mode(
         vfs: V,
         kek: SecretKey,
+        counterpart_kek: Option<SecretKey>,
         page_size: usize,
         realm: RealmId,
         options: OpenOptions,
         mode: DbMode,
     ) -> Result<Self> {
         let capabilities = mode.open_capabilities();
-        let options = if capabilities.allows_observer_retry() {
-            options
-        } else {
-            OpenOptions {
-                observer_retry_count: 0,
-                ..options
-            }
-        };
+        let bootstraps = capabilities.bootstraps() && counterpart_kek.is_none();
         let mut locks = Vec::new();
 
-        // A missing database is a terminal read-only error. Probe before
-        // acquiring a lock because native lock backends materialize sentinel
-        // files when locking an otherwise empty directory.
-        if !capabilities.bootstraps() && !main_db_exists(&vfs).await? {
+        // A missing database is a terminal error unless the open bootstraps.
+        // Probe before acquiring a lock: native lock backends materialize
+        // sentinel files when locking an empty directory.
+        if !bootstraps && !main_db_exists(&vfs).await? {
             return Err(PagedbError::NotFound);
         }
 
         let acquisition = vfs.lock_exclusive(ACQUISITION_LOCK_PATH).await?;
         let main_db_exists = {
             let exists = main_db_exists(&vfs).await?;
-            if !exists && !capabilities.bootstraps() {
+            if !exists && !bootstraps {
                 return Err(PagedbError::NotFound);
             }
-            if exists
-                && capabilities.rejects_unpromoted_restore()
-                && peek_restore_mode(&vfs, kek.as_bytes(), page_size).await? == 2
-            {
-                return Err(PagedbError::RestoredNotPromoted);
-            }
             acquire_interlocking_mode_lock(&vfs, capabilities, &mut locks).await?;
             let lock_path = match capabilities.long_lived_lock() {
                 LongLivedLock::Writer => WRITER_LOCK_PATH,
@@ -278,7 +293,16 @@ impl<V: Vfs + Clone> Db<V> {
         };
 
         let mut db = if main_db_exists {
-            Self::open_existing_inner(vfs, kek, page_size, realm, options, mode).await?
+            Self::open_existing_inner_with_counterpart(
+                vfs,
+                kek,
+                counterpart_kek,
+                page_size,
+                realm,
+                options,
+                mode,
+            )
+            .await?
         } else {
             // The caller already holds the writer sentinel acquired above, so
             // bootstrap through the lock-free inner path rather than
@@ -297,51 +321,6 @@ impl<V: Vfs + Clone> Db<V> {
         db.lock_required = capabilities.allows_user_writes();
         Ok(db)
     }
-
-    /// Promote a frozen read-only handle to Follower mode after excluding all
-    /// other frozen readers and acquiring the writer sentinel.
-    pub async fn promote_to_follower(mut self) -> Result<Self> {
-        self.ensure_usable()?;
-        self.require_mode(
-            "promote_to_follower",
-            DbMode::ReadOnly,
-            DbModeCapabilities::promotes_to_follower,
-        )?;
-        let acquisition = self.vfs.lock_exclusive(ACQUISITION_LOCK_PATH).await?;
-        self.sentinel_locks.clear();
-        let frozen_probe = self
-            .vfs
-            .lock_exclusive(FROZEN_READERS_LOCK_PATH)
-            .await
-            .map_err(|error| {
-                map_lock_contention(error, || {
-                    crate::diag::lock_rejected(
-                        "follower",
-                        FROZEN_READERS_LOCK_PATH,
-                        "readers_present",
-                    );
-                    PagedbError::ReadersPresent
-                })
-            })?;
-        drop(frozen_probe);
-        let writer_lock = self
-            .vfs
-            .lock_exclusive(WRITER_LOCK_PATH)
-            .await
-            .map_err(|error| {
-                map_lock_contention(error, || {
-                    crate::diag::lock_rejected("follower", WRITER_LOCK_PATH, "already_open");
-                    PagedbError::AlreadyOpen
-                })
-            })?;
-        drop(acquisition);
-        crate::diag::lock_acquired("follower", WRITER_LOCK_PATH);
-        self.pager.enable_write_access().await;
-        self.sentinel_locks.push(writer_lock);
-        self.lock_required = true;
-        self.mode = DbMode::Follower;
-        Ok(self)
-    }
 }
 
 async fn main_db_exists<V: Vfs>(vfs: &V) -> Result<bool> {
@@ -444,7 +423,7 @@ async fn acquire_long_lived_lock<V: Vfs>(
     Ok(())
 }
 
-fn map_lock_contention(
+pub(super) fn map_lock_contention(
     error: PagedbError,
     on_contention: impl FnOnce() -> PagedbError,
 ) -> PagedbError {
diff --git a/src/txn/db/open/promote.rs b/src/txn/db/open/promote.rs
new file mode 100644
index 0000000..bac32a3
--- /dev/null
+++ b/src/txn/db/open/promote.rs
@@ -0,0 +1,137 @@
+//! Follower mode: opening into it, promoting into it, and trading a handle's
+//! sentinel for the exclusive writer one.
+
+use crate::crypto::SecretKey;
+use crate::errors::PagedbError;
+use crate::options::OpenOptions;
+use crate::pager::anchor::HeaderCursor;
+use crate::pager::header::commit_header;
+use crate::vfs::Vfs;
+use crate::{RealmId, Result};
+
+use super::super::super::mode::{
+    ACQUISITION_LOCK_PATH, DbMode, FROZEN_READERS_LOCK_PATH, WRITER_LOCK_PATH,
+};
+use super::super::core::{Db, WriterState};
+use super::super::restore_mode;
+use super::modes::{DbModeCapabilities, map_lock_contention};
+
+impl<V: Vfs + Clone> Db<V> {
+    /// Promote a frozen read-only handle to Follower mode after excluding all
+    /// other frozen readers and acquiring the writer sentinel.
+    ///
+    /// A restored directory records the promotion in its header. A later
+    /// open still refuses to make it a Standalone writer.
+    pub async fn promote_to_follower(mut self) -> Result<Self> {
+        self.ensure_usable()?;
+        self.require_mode(
+            "promote_to_follower",
+            DbMode::ReadOnly,
+            DbModeCapabilities::promotes_to_follower,
+        )?;
+        self.take_exclusive_writer_sentinel("follower").await?;
+        self.pager.enable_write_access().await;
+        self.record_follower_mode().await?;
+        self.lock_required = true;
+        self.mode = DbMode::Follower;
+        Ok(self)
+    }
+
+    /// Open an existing store as a Follower: it applies a source's
+    /// incremental snapshots and takes no writes of its own.
+    ///
+    /// - Holds the writer sentinel. Refuses with `ReadersPresent` or
+    ///   `AlreadyOpen` while another handle holds the store.
+    /// - Replays an incremental apply that a crash interrupted.
+    /// - Reports `NotFound` for a missing store.
+    /// - Records the promotion on a restored directory, as
+    ///   [`Db::promote_to_follower`] does.
+    pub async fn open_follower(
+        vfs: V,
+        kek: impl Into<SecretKey>,
+        page_size: usize,
+        realm: RealmId,
+        options: OpenOptions,
+    ) -> Result<Self> {
+        let kek = kek.into();
+        let db = Self::open_with_mode(vfs, kek, None, page_size, realm, options, DbMode::Follower)
+            .await?;
+        db.record_follower_mode().await?;
+        Ok(db)
+    }
+
+    /// Record in the header that a restored directory is now a Follower.
+    /// It leaves an original store, or one already recorded, unchanged.
+    async fn record_follower_mode(&self) -> Result<()> {
+        let mut state = self.writer.lock().await;
+        if state.restore_mode == restore_mode::READ_ONLY {
+            self.persist_restore_mode(&mut state, restore_mode::FOLLOWER)
+                .await?;
+        }
+        Ok(())
+    }
+
+    /// Replace this handle's sentinels with the exclusive writer sentinel.
+    ///
+    /// Refuses with `ReadersPresent` while another frozen reader holds the
+    /// store, and with `AlreadyOpen` while a writer does. `role` names the
+    /// requester in lock diagnostics.
+    pub(in crate::txn::db) async fn take_exclusive_writer_sentinel(
+        &mut self,
+        role: &'static str,
+    ) -> Result<()> {
+        let acquisition = self.vfs.lock_exclusive(ACQUISITION_LOCK_PATH).await?;
+        self.sentinel_locks.clear();
+        let frozen_probe = self
+            .vfs
+            .lock_exclusive(FROZEN_READERS_LOCK_PATH)
+            .await
+            .map_err(|error| {
+                map_lock_contention(error, || {
+                    crate::diag::lock_rejected(role, FROZEN_READERS_LOCK_PATH, "readers_present");
+                    PagedbError::ReadersPresent
+                })
+            })?;
+        drop(frozen_probe);
+        let writer_lock = self
+            .vfs
+            .lock_exclusive(WRITER_LOCK_PATH)
+            .await
+            .map_err(|error| {
+                map_lock_contention(error, || {
+                    crate::diag::lock_rejected(role, WRITER_LOCK_PATH, "already_open");
+                    PagedbError::AlreadyOpen
+                })
+            })?;
+        drop(acquisition);
+        crate::diag::lock_acquired(role, WRITER_LOCK_PATH);
+        self.sentinel_locks.push(writer_lock);
+        Ok(())
+    }
+
+    /// Record a restore-mode transition with a header-only commit.
+    ///
+    /// Only the HMAC-authenticated header is written, so the commit seals no
+    /// page and consumes no nonce.
+    async fn persist_restore_mode(&self, state: &mut WriterState, mode: u8) -> Result<()> {
+        let cursor = self.pager.header_cursor()?;
+        let seq = cursor.next_seq()?;
+        let counter_anchor = self.pager.pending_anchor();
+        let mut fields = self.state_header_fields(state, seq, counter_anchor)?;
+        fields.restore_mode = mode;
+        let hk = self.hk.read().clone();
+        let slot = commit_header(
+            &*self.vfs,
+            &self.main_db_path,
+            &hk,
+            &fields,
+            cursor.slot,
+            self.page_size,
+        )
+        .await?;
+        self.pager.note_header_written(HeaderCursor { slot, seq });
+        self.pager.commit_anchor(counter_anchor)?;
+        state.restore_mode = mode;
+        Ok(())
+    }
+}
diff --git a/src/txn/db/open/recovery.rs b/src/txn/db/open/recovery.rs
index e1ea0d6..ef26792 100644
--- a/src/txn/db/open/recovery.rs
+++ b/src/txn/db/open/recovery.rs
@@ -5,7 +5,7 @@ use crate::crypto::SecretKey;
 use crate::errors::PagedbError;
 use crate::pager::freelist;
 use crate::pager::structural_header::MainDbHeaderFields;
-use crate::vfs::Vfs;
+use crate::vfs::{Vfs, remove_if_present};
 
 use super::super::core::Db;
 
@@ -28,12 +28,18 @@ pub(super) async fn recover_open_state<V: Vfs + Clone>(
     }
 
     if capabilities.runs_standalone_recovery() {
-        match db.vfs.remove(&format!("{}.compact", db.main_db_path)).await {
-            Ok(()) => {}
-            Err(PagedbError::Io(error)) if error.kind() == std::io::ErrorKind::NotFound => {}
-            Err(error) => return Err(error),
+        // Compaction and `rekey_into_writer` each build a replacement
+        // `main.db` beside the live one and publish it by rename. A scratch
+        // still present at open is one whose rename never happened.
+        for suffix in [".compact", ".fork"] {
+            remove_if_present(&*db.vfs, &format!("{}{suffix}", db.main_db_path)).await?;
         }
 
+        // A fork's segments wait outside the orphan scan until its `main.db`
+        // is live. This open has write authority over that `main.db`, so it
+        // hands them to the catalog repair below.
+        crate::recovery::fork::adopt_forked_segments(&*db.vfs).await?;
+
         // Write-transaction spill scratch is keyed to the handle that wrote it,
         // so anything still present belongs to a handle that is gone and is
         // reclaimable outright. Without this the scratch of every transaction
@@ -73,11 +79,7 @@ pub(super) async fn recover_open_state<V: Vfs + Clone>(
     {
         if capabilities.applies_interrupted_apply() {
             let staged = crate::snapshot::apply::staged_image_path(&db.main_db_path);
-            match db.vfs.remove(&staged).await {
-                Ok(()) => {}
-                Err(PagedbError::Io(error)) if error.kind() == std::io::ErrorKind::NotFound => {}
-                Err(error) => return Err(error),
-            }
+            remove_if_present(&*db.vfs, &staged).await?;
         }
     }
 
diff --git a/src/txn/db/rekey/fork/entry.rs b/src/txn/db/rekey/fork/entry.rs
new file mode 100644
index 0000000..94edf85
--- /dev/null
+++ b/src/txn/db/rekey/fork/entry.rs
@@ -0,0 +1,105 @@
+//! The public fork operation: sentinel trade, replacement build, publication
+//! by rename, and reopen as a Standalone writer.
+
+use crate::Result;
+use crate::crypto::SecretKey;
+use crate::errors::PagedbError;
+use crate::txn::db::{Db, DbModeCapabilities};
+use crate::txn::mode::DbMode;
+use crate::vfs::{Vfs, remove_if_present};
+
+use super::trees::copy_live_state;
+
+impl<V: Vfs + Clone> Db<V> {
+    /// Fork this directory into an independent Standalone writer.
+    ///
+    /// A restored directory shares its source's key and nonce space. The fork
+    /// re-encrypts every page and segment under a fresh `file_id`, a fresh
+    /// `kek_salt`, and `new_kek`, then renames the result over `main.db`.
+    /// Nothing is sealed under the source key. `new_kek` can equal the old KEK.
+    ///
+    /// - Requires a `ReadOnly` or `Follower` handle and no other frozen reader.
+    /// - Keeps keys, values, segments, counters, and quotas. Commit history
+    ///   starts empty.
+    /// - Accepts no further incremental snapshot from the source.
+    /// - Holds two buffer pools at peak: the source's and the fork's.
+    /// - The rename is the commit point. An earlier error leaves the directory
+    ///   restored and readable. The handle is consumed either way.
+    pub async fn rekey_into_writer(mut self, new_kek: impl Into<SecretKey>) -> Result<Self> {
+        let new_kek = new_kek.into();
+        self.ensure_usable()?;
+        self.require_mode(
+            "rekey_into_writer",
+            DbMode::ReadOnly,
+            DbModeCapabilities::forks_into_writer,
+        )?;
+        self.take_exclusive_writer_sentinel("fork").await?;
+
+        // An earlier attempt that never published can leave its scratch and
+        // segments behind. Nothing names either, so they are dropped first.
+        let scratch = format!("{}.fork", self.main_db_path);
+        remove_if_present(&*self.vfs, &scratch).await?;
+        crate::recovery::fork::discard_forked_segments(&*self.vfs).await?;
+        if let Err(error) = self.build_fork(&new_kek, &scratch).await {
+            // Cleanup is best-effort. The directory stays intact either way.
+            // The next attempt removes a leftover scratch before it starts.
+            let _ = self.vfs.remove(&scratch).await;
+            return Err(error);
+        }
+
+        // Close the cached `main.db` handle first. On Windows an open handle
+        // blocks the rename. On Unix an open handle still reads the replaced
+        // inode.
+        self.pager.close_main_handle().await;
+        self.vfs.rename(&scratch, &self.main_db_path).await?;
+        self.vfs.sync_dir(self.main_db_parent_dir()).await?;
+
+        let locks = std::mem::take(&mut self.sentinel_locks);
+        let vfs = V::clone(&*self.vfs);
+        let page_size = self.page_size;
+        let realm = self.realm_id;
+        let options = self.options.clone();
+        drop(self);
+
+        let mut db = Self::open_existing_inner_with_counterpart(
+            vfs,
+            new_kek,
+            None,
+            page_size,
+            realm,
+            options,
+            DbMode::Standalone,
+        )
+        .await?;
+        db.mode = DbMode::Standalone;
+        db.sentinel_locks = locks;
+        db.lock_required = true;
+        crate::diag::reopened(db.latest_commit().0);
+        Ok(db)
+    }
+
+    /// Build the complete replacement `main.db` at `scratch`, with its
+    /// segments promoted under fresh ids. Nothing the live store references
+    /// is touched.
+    async fn build_fork(&self, new_kek: &SecretKey, scratch: &str) -> Result<()> {
+        let state = self.writer.lock().await;
+        // An apply journal names segment ids and pages under the source
+        // identity. It must finish, through a Follower open, before a fork.
+        if state.pending_apply_journal_id != [0; 16] {
+            return Err(PagedbError::rekey_state_invalid(
+                "rekey_into_writer.apply_journal_pending",
+            ));
+        }
+        let fork = Self::bootstrap_unlocked_at(
+            V::clone(&*self.vfs),
+            new_kek,
+            self.page_size,
+            self.realm_id,
+            self.options.clone(),
+            self.cipher_id,
+            scratch.to_string(),
+        )
+        .await?;
+        copy_live_state(self, &state, &fork).await
+    }
+}
diff --git a/src/txn/db/rekey/fork/mod.rs b/src/txn/db/rekey/fork/mod.rs
new file mode 100644
index 0000000..638cda1
--- /dev/null
+++ b/src/txn/db/rekey/fork/mod.rs
@@ -0,0 +1,6 @@
+//! `rekey_into_writer`: fork a restored directory into an independent
+//! Standalone writer under a fresh identity.
+
+mod entry;
+mod segments;
+mod trees;
diff --git a/src/txn/db/rekey/fork/segments.rs b/src/txn/db/rekey/fork/segments.rs
new file mode 100644
index 0000000..24271c7
--- /dev/null
+++ b/src/txn/db/rekey/fork/segments.rs
@@ -0,0 +1,67 @@
+//! Re-encrypting one linked segment into the fork.
+
+use crate::Result;
+use crate::catalog::codec::SegmentMeta;
+use crate::errors::PagedbError;
+use crate::segment::reader::SegmentReader;
+use crate::segment::writer::SegmentWriter;
+use crate::txn::db::Db;
+use crate::vfs::Vfs;
+
+/// Copy the segment `meta` names from `source` into a fresh segment of `fork`.
+/// Returns the replacement's metadata.
+///
+/// Page ids, the extent-index layout, the manifest, kind, and evictability
+/// all carry over. An engine's own index into the segment stays valid.
+/// The replacement stays in the fork directory. The first Standalone open of
+/// the fork's `main.db` adopts it into staging. Catalog repair then publishes
+/// it like any staged segment a commit names.
+pub(super) async fn copy_segment<V: Vfs + Clone>(
+    source: &Db<V>,
+    fork: &Db<V>,
+    meta: &SegmentMeta,
+) -> Result<SegmentMeta> {
+    let limit = u64::try_from(source.options.mmap_view_scratch_bytes).unwrap_or(u64::MAX);
+    let reader = SegmentReader::open_internal(
+        source.pager.clone(),
+        meta.clone(),
+        source.mmap_bytes_in_use.clone(),
+        limit,
+    )
+    .await?;
+    let footer = reader.authenticated_footer();
+    let segment_id = crate::crypto::random::segment_id()?;
+    let mut writer = SegmentWriter::create_fork_internal(
+        fork.pager.clone(),
+        meta,
+        segment_id,
+        fork.file_id,
+        footer.fields.index_start_page,
+        footer.fields.index_page_count,
+    )
+    .await?;
+    writer.set_manifest(&footer.manifest)?;
+    // Pages stream one at a time. The copy never holds a whole segment.
+    for page_id in 1..meta.page_count.saturating_sub(1) {
+        let (kind, body) = reader.read_authenticated_page(page_id).await?;
+        let copied_page_id = writer.append_rekey_page(kind, &body).await?;
+        if copied_page_id != page_id {
+            return Err(PagedbError::rekey_state_invalid(
+                "rekey_into_writer.page_id_ordering",
+            ));
+        }
+    }
+    let copied = writer.seal().await?;
+    drop(reader);
+    if copied.page_count != meta.page_count
+        || copied.format_version != meta.format_version
+        || copied.segment_kind != meta.segment_kind
+        || copied.evictable != meta.evictable
+    {
+        return Err(PagedbError::rekey_state_invalid(
+            "rekey_into_writer.segment_metadata",
+        ));
+    }
+
+    Ok(copied)
+}
diff --git a/src/txn/db/rekey/fork/trees.rs b/src/txn/db/rekey/fork/trees.rs
new file mode 100644
index 0000000..450ccce
--- /dev/null
+++ b/src/txn/db/rekey/fork/trees.rs
@@ -0,0 +1,199 @@
+//! Streaming the live data and catalog trees into the fork.
+
+use bytes::Bytes;
+
+use crate::Result;
+use crate::btree::BTree;
+use crate::catalog::codec::{Catalog, CatalogRowKind};
+use crate::errors::PagedbError;
+use crate::pager::anchor::HeaderCursor;
+use crate::pager::header::commit_header;
+use crate::txn::db::{Db, WriterState};
+use crate::vfs::Vfs;
+
+use super::segments::copy_segment;
+
+/// Records read from a source tree per batch. One batch is all the fork holds
+/// of the source. The destination holds one leaf plus one internal node per
+/// level. Neither scales with the size of the store.
+const FORK_RECORD_BATCH: usize = 256;
+
+/// Copy the state `state` describes from `source` into `fork`.
+/// Then write the fork's header naming it.
+///
+/// Reads authenticate under the source key through the source pager. Writes
+/// seal under the fork key through the fork pager. The two never share a
+/// cache. No page of one is ever served as a page of the other.
+pub(super) async fn copy_live_state<V: Vfs + Clone>(
+    source: &Db<V>,
+    state: &WriterState,
+    fork: &Db<V>,
+) -> Result<()> {
+    let first_page = fork.writer.lock().await.next_page_id;
+
+    let mut main = BTree::open(
+        fork.pager.clone(),
+        fork.realm_id,
+        0,
+        first_page,
+        fork.page_size,
+    );
+    copy_main_tree(source, state, &mut main).await?;
+
+    let mut catalog = BTree::open(
+        fork.pager.clone(),
+        fork.realm_id,
+        0,
+        main.next_page_id(),
+        fork.page_size,
+    );
+    copy_catalog(source, state, fork, &mut catalog).await?;
+
+    fork.pager.flush_main(fork.realm_id).await?;
+    publish_fork_header(state, fork, &main, &catalog).await
+}
+
+/// Copy every record of the source data tree, unchanged.
+async fn copy_main_tree<V: Vfs + Clone>(
+    source: &Db<V>,
+    state: &WriterState,
+    dest: &mut BTree<V>,
+) -> Result<()> {
+    let src = BTree::open(
+        source.pager.clone(),
+        source.realm_id,
+        state.root_page_id,
+        state.next_page_id,
+        source.page_size,
+    );
+    let mut loader = dest.bulk_loader()?;
+    let mut cursor: Vec<u8> = Vec::new();
+    loop {
+        let batch = src.collect_batch_from(&cursor, FORK_RECORD_BATCH).await?;
+        let Some((last_key, _)) = batch.last() else {
+            break;
+        };
+        cursor.clear();
+        cursor.extend_from_slice(last_key);
+        // The exact successor of `last_key` in the key ordering.
+        cursor.push(0);
+        let exhausted = batch.len() < FORK_RECORD_BATCH;
+        let rows: Vec<(Vec<u8>, Bytes)> = batch
+            .into_iter()
+            .map(|(key, value)| (key.to_vec(), value))
+            .collect();
+        loader.push_batch(rows).await?;
+        if exhausted {
+            break;
+        }
+    }
+    loader.finish().await
+}
+
+/// Copy the catalog, re-encrypting each linked segment under a fresh id.
+///
+/// Quota and counter rows carry over unchanged. A segment row is rewritten
+/// to name its re-encrypted replacement. The retired compaction watermark is
+/// dropped, as compaction drops it. A rekey intent or rekey progress row
+/// names the source identity and an unfinished rekey. The fork refuses it.
+async fn copy_catalog<V: Vfs + Clone>(
+    source: &Db<V>,
+    state: &WriterState,
+    fork: &Db<V>,
+    dest: &mut BTree<V>,
+) -> Result<()> {
+    let src = BTree::open(
+        source.pager.clone(),
+        source.realm_id,
+        state.catalog_root_page_id,
+        state.next_page_id,
+        source.page_size,
+    );
+    let mut loader = dest.bulk_loader()?;
+    let mut cursor: Vec<u8> = Vec::new();
+    loop {
+        let batch = src.collect_batch_from(&cursor, FORK_RECORD_BATCH).await?;
+        let Some((last_key, _)) = batch.last() else {
+            break;
+        };
+        cursor.clear();
+        cursor.extend_from_slice(last_key);
+        cursor.push(0);
+        let exhausted = batch.len() < FORK_RECORD_BATCH;
+
+        let mut rows: Vec<(Vec<u8>, Bytes)> = Vec::with_capacity(batch.len());
+        for (key, value) in batch {
+            let Some(&kind) = key.first() else {
+                return Err(PagedbError::catalog_row_invalid("catalog.key"));
+            };
+            let value =
+                if kind == CatalogRowKind::Quota as u8 || kind == CatalogRowKind::Counter as u8 {
+                    value
+                } else if kind == CatalogRowKind::Segment as u8 {
+                    let meta = Catalog::decode_segment_meta(&value)?;
+                    let copied = copy_segment(source, fork, &meta).await?;
+                    Bytes::copy_from_slice(&Catalog::encode_segment_meta(&copied))
+                } else if kind == CatalogRowKind::CompactionState as u8 {
+                    continue;
+                } else if kind == CatalogRowKind::RekeyState as u8
+                    || kind == CatalogRowKind::RekeySegmentProgress as u8
+                {
+                    return Err(PagedbError::rekey_state_invalid(
+                        "rekey_into_writer.rekey_pending",
+                    ));
+                } else {
+                    return Err(PagedbError::catalog_row_invalid("catalog.row_kind"));
+                };
+            rows.push((key.to_vec(), value));
+        }
+        if !rows.is_empty() {
+            loader.push_batch(rows).await?;
+        }
+        if exhausted {
+            break;
+        }
+    }
+    loader.finish().await
+}
+
+/// Write the header that makes the fork a complete Standalone store.
+///
+/// The commit id continues from the source. Ids an embedder already holds
+/// stay ordered. Commit history starts empty: its rows name source pages the
+/// fork does not carry.
+async fn publish_fork_header<V: Vfs + Clone>(
+    state: &WriterState,
+    fork: &Db<V>,
+    main: &BTree<V>,
+    catalog: &BTree<V>,
+) -> Result<()> {
+    let commit_id = state
+        .latest_commit_id
+        .checked_add(1)
+        .ok_or_else(|| PagedbError::arithmetic_overflow("fork commit id"))?;
+    let mut fork_state = fork.writer.lock().await;
+    fork_state.root_page_id = main.root_page_id();
+    fork_state.catalog_root_page_id = catalog.root_page_id();
+    fork_state.catalog_root_txn_id = commit_id;
+    fork_state.next_page_id = catalog.next_page_id();
+    fork_state.latest_commit_id = commit_id;
+    fork_state.commit_retain_policy_tag = state.commit_retain_policy_tag;
+    fork_state.commit_retain_policy_value = state.commit_retain_policy_value;
+
+    let cursor = fork.pager.header_cursor()?;
+    let seq = cursor.next_seq()?;
+    let counter_anchor = fork.pager.pending_anchor();
+    let fields = fork.state_header_fields(&fork_state, seq, counter_anchor)?;
+    let hk = fork.hk.read().clone();
+    let slot = commit_header(
+        &*fork.vfs,
+        &fork.main_db_path,
+        &hk,
+        &fields,
+        cursor.slot,
+        fork.page_size,
+    )
+    .await?;
+    fork.pager.note_header_written(HeaderCursor { slot, seq });
+    Ok(())
+}
diff --git a/src/txn/db/rekey/mod.rs b/src/txn/db/rekey/mod.rs
index f64d34f..e7ed7b4 100644
--- a/src/txn/db/rekey/mod.rs
+++ b/src/txn/db/rekey/mod.rs
@@ -1,5 +1,6 @@
 //! Online rekey implementation split by durable concern.
 
+mod fork;
 pub(crate) mod intent;
 pub(crate) mod keyring;
 pub(crate) mod main;
diff --git a/src/txn/db/restore_mode/mod.rs b/src/txn/db/restore_mode/mod.rs
new file mode 100644
index 0000000..b5d6312
--- /dev/null
+++ b/src/txn/db/restore_mode/mod.rs
@@ -0,0 +1,20 @@
+//! Restore mode: the handle modes a directory admits, kept in the `main.db`
+//! A/B header.
+//!
+//! `restore_from` copies `main.db` byte for byte. A restored directory
+//! shares its source's DEK and nonce space. Independent writes on both
+//! directories repeat nonces under one key. A Standalone open refuses every
+//! restore mode except `STANDALONE`. Transitions only move forward:
+//!
+//! | From | To | Operation |
+//! |---|---|---|
+//! | `READ_ONLY` | `FOLLOWER` | `promote_to_follower` |
+//! | `READ_ONLY` or `FOLLOWER` | `STANDALONE` | `rekey_into_writer`, under a fresh identity |
+
+#[cfg(not(target_arch = "wasm32"))]
+mod stamp;
+mod values;
+
+#[cfg(not(target_arch = "wasm32"))]
+pub(in crate::txn::db) use stamp::{HeaderKey, stamp_read_only};
+pub(crate) use values::{FOLLOWER, READ_ONLY, STANDALONE};
diff --git a/src/txn/db/restore_mode/stamp.rs b/src/txn/db/restore_mode/stamp.rs
new file mode 100644
index 0000000..4d6fc28
--- /dev/null
+++ b/src/txn/db/restore_mode/stamp.rs
@@ -0,0 +1,87 @@
+//! Stamping a copied `main.db` as a restored directory.
+
+use crate::Result;
+use crate::crypto::SecretKey;
+use crate::crypto::keys::DerivedKey;
+use crate::errors::PagedbError;
+use crate::pager::header::{
+    ActiveSlot, authenticate_slot, authenticate_slot_with_kek, commit_header, read_header_slot,
+};
+use crate::pager::structural_header::MainDbHeaderFields;
+use crate::vfs::Vfs;
+use crate::vfs::types::OpenMode;
+
+use super::values::READ_ONLY;
+
+/// Key material that authenticates a `main.db` header.
+pub(in crate::txn::db) enum HeaderKey<'a> {
+    /// The embedder's KEK. Each slot's HK derives from that slot's own salt
+    /// and epoch.
+    Kek(&'a SecretKey),
+    /// The HK of the handle that wrote the file.
+    Hk(&'a DerivedKey),
+}
+
+/// Mark the `main.db` at `path` as a copy that admits no Standalone writer.
+///
+/// Both A/B slots get `restore_mode = READ_ONLY` and a fresh MAC, including
+/// the slot an open selects. With both slots stamped, neither the newer slot
+/// nor a fallback to the older one admits a writer. Only the
+/// HMAC-authenticated header changes, never an AEAD page, so the stamp
+/// consumes no nonce.
+pub(in crate::txn::db) async fn stamp_read_only<V: Vfs>(
+    vfs: &V,
+    path: &str,
+    page_size: usize,
+    key: HeaderKey<'_>,
+) -> Result<()> {
+    let slot_b_offset = u64::try_from(page_size)
+        .map_err(|_| PagedbError::Io(std::io::Error::other("page_size > u64")))?;
+    let mut buf_a = vec![0u8; page_size];
+    let mut buf_b = vec![0u8; page_size];
+    {
+        let mut file = vfs.open(path, OpenMode::Read).await?;
+        read_header_slot(&mut file, 0, &mut buf_a).await?;
+        read_header_slot(&mut file, slot_b_offset, &mut buf_b).await?;
+    }
+
+    let mut selected: Option<(MainDbHeaderFields, DerivedKey)> = None;
+    for buf in [&buf_a, &buf_b] {
+        let Some((fields, hk)) = decode_slot(buf, page_size, &key)? else {
+            continue;
+        };
+        if selected
+            .as_ref()
+            .is_none_or(|(current, _)| fields.seq > current.seq)
+        {
+            selected = Some((fields, hk));
+        }
+    }
+    let Some((mut fields, hk)) = selected else {
+        return Err(super::super::open::header_probe::unverifiable_header_cause(
+            &buf_a, &buf_b, page_size,
+        ));
+    };
+
+    fields.restore_mode = READ_ONLY;
+    // `commit_header` writes the slot after `previous`: B first names A, then
+    // A names B.
+    commit_header(vfs, path, &hk, &fields, ActiveSlot::B, page_size).await?;
+    commit_header(vfs, path, &hk, &fields, ActiveSlot::A, page_size).await?;
+    Ok(())
+}
+
+/// Authenticate one slot under `key`. Returns `None` when `key` does not
+/// verify it.
+fn decode_slot(
+    buf: &[u8],
+    page_size: usize,
+    key: &HeaderKey<'_>,
+) -> Result<Option<(MainDbHeaderFields, DerivedKey)>> {
+    match key {
+        HeaderKey::Kek(kek) => authenticate_slot_with_kek(buf, kek, page_size),
+        HeaderKey::Hk(hk) => {
+            Ok(authenticate_slot(buf, hk, page_size)?.map(|fields| (fields, (*hk).clone())))
+        }
+    }
+}
diff --git a/src/txn/db/restore_mode/values.rs b/src/txn/db/restore_mode/values.rs
new file mode 100644
index 0000000..80cd7c6
--- /dev/null
+++ b/src/txn/db/restore_mode/values.rs
@@ -0,0 +1,9 @@
+//! Restore-mode byte values stored in the `main.db` A/B header.
+
+/// An original store, or one `rekey_into_writer` gave a fresh identity.
+pub(crate) const STANDALONE: u8 = 0;
+/// A restored directory promoted to track its source through
+/// `apply_incremental`.
+pub(crate) const FOLLOWER: u8 = 1;
+/// A snapshot or a restored directory not yet promoted.
+pub(crate) const READ_ONLY: u8 = 2;
diff --git a/src/txn/db/segment.rs b/src/txn/db/segment.rs
index 070fd7c..34248c2 100644
--- a/src/txn/db/segment.rs
+++ b/src/txn/db/segment.rs
@@ -6,7 +6,7 @@ use crate::catalog::codec::CatalogRowKind;
 use crate::catalog::codec::{Catalog, SegmentKind, SegmentMeta};
 use crate::errors::{CorruptionDetail, PagedbError};
 use crate::segment::reader::SegmentReader;
-use crate::segment::writer::SegmentWriter;
+use crate::segment::writer::{STAGING_DIR, SegmentWriter};
 use crate::txn::write::SegmentSideEffect;
 use crate::vfs::types::OpenMode;
 use crate::vfs::{Vfs, VfsFile};
@@ -46,7 +46,7 @@ impl<V: Vfs + Clone> Db<V> {
             DbMode::Standalone,
             DbModeCapabilities::allows_user_writes,
         )?;
-        self.vfs.mkdir_all("seg/.staging").await?;
+        self.vfs.mkdir_all(STAGING_DIR).await?;
         let segment_id = crate::crypto::random::segment_id()?;
         SegmentWriter::create_internal(self.pager.clone(), realm, segment_id, self.file_id, kind)
             .await
@@ -202,10 +202,10 @@ impl<V: Vfs + Clone> Db<V> {
             return Ok(SegmentReconciliation::Complete);
         }
         self.vfs.mkdir_all("seg").await?;
-        self.vfs.mkdir_all("seg/.staging").await?;
+        self.vfs.mkdir_all(STAGING_DIR).await?;
         self.vfs.mkdir_all("seg/.tombstone").await?;
         self.vfs.sync_dir("seg").await?;
-        self.vfs.sync_dir("seg/.staging").await?;
+        self.vfs.sync_dir(STAGING_DIR).await?;
         self.vfs.sync_dir("seg/.tombstone").await?;
 
         // Drain part of the deferred queue as a side effect of this commit, so a
@@ -231,7 +231,7 @@ impl<V: Vfs + Clone> Db<V> {
         }
 
         self.vfs.sync_dir("seg").await?;
-        self.vfs.sync_dir("seg/.staging").await?;
+        self.vfs.sync_dir(STAGING_DIR).await?;
         self.vfs.sync_dir("seg/.tombstone").await?;
         Ok(if deferred {
             SegmentReconciliation::Deferred
diff --git a/src/txn/db/snapshot.rs b/src/txn/db/snapshot.rs
index bfbe9c4..f8890e4 100644
--- a/src/txn/db/snapshot.rs
+++ b/src/txn/db/snapshot.rs
@@ -13,6 +13,7 @@ use crate::pager::structural_header::MainDbHeaderFields;
 use crate::recovery::journal::{
     ApplyJournalRecord, JournalAction, encode_journal_id, encode_journal_pages,
 };
+use crate::segment::writer::STAGING_DIR;
 use crate::snapshot::apply::{
     clone_base_image, discard_staged_image, plan_delta_stream, stage_snapshot_segments,
     staged_image_path, validate_snapshot_segment_count, write_delta_into_image,
@@ -369,16 +370,31 @@ impl<V: Vfs + Clone> Db<V> {
         let published_snapshot = *self.snapshot.read();
         let required_page_ids = collect_published_page_ids(self, published_snapshot).await?;
         let highest_required_main_page = required_page_ids.iter().next_back().copied().unwrap_or(1);
-        let stats = match snapshot_full(
-            &src_root,
-            dst_path,
-            &manifest,
-            &hk_raw,
-            &segment_ids,
-            highest_required_main_page,
-        )
-        .await
-        {
+        let exported = async {
+            let stats = snapshot_full(
+                &src_root,
+                dst_path,
+                &manifest,
+                &hk_raw,
+                &segment_ids,
+                highest_required_main_page,
+            )
+            .await?;
+            // The exported `main.db` shares this store's nonce space. Stamping
+            // it keeps a `Db::open` of the snapshot directory from taking
+            // independent writes under this store's key.
+            let hk = self.hk.read().clone();
+            super::restore_mode::stamp_read_only(
+                &TokioVfs::new(dst_path),
+                "/main.db",
+                self.page_size,
+                super::restore_mode::HeaderKey::Hk(&hk),
+            )
+            .await?;
+            Ok::<_, crate::errors::PagedbError>(stats)
+        }
+        .await;
+        let stats = match exported {
             Ok(stats) => stats,
             Err(error) => {
                 cleanup_failed_snapshot(dst_path, ownership).await;
@@ -478,6 +494,16 @@ impl<V: Vfs + Clone> Db<V> {
                 .map_err(|_| crate::errors::PagedbError::snapshot_incompatible("page_size"))?;
             let realm_id = crate::RealmId(manifest.realm_id);
             let dst_vfs = TokioVfs::new(dst_path);
+            // The copy shares the source's nonce space, so it must never open
+            // as a Standalone writer. The stamp precedes the first open, so no
+            // handle ever sees the copy without it.
+            super::restore_mode::stamp_read_only(
+                &dst_vfs,
+                "/main.db",
+                page_size,
+                super::restore_mode::HeaderKey::Kek(&kek),
+            )
+            .await?;
             let restored =
                 Db::<TokioVfs>::open_read_only(dst_vfs, kek, page_size, realm_id, options).await?;
             validate_restored_snapshot(&manifest, &restored).await?;
@@ -838,7 +864,7 @@ impl<V: Vfs + Clone> Db<V> {
             stage_snapshot_segments(src_path, &dst_seg_root, &expected_promoted_segment_ids)
                 .await?;
         if !staged_ids.is_empty() {
-            self.vfs.sync_dir("seg/.staging").await?;
+            self.vfs.sync_dir(STAGING_DIR).await?;
         }
         let segments_promoted = u32::try_from(staged_ids.len())
             .map_err(|_| crate::errors::PagedbError::snapshot_incompatible("segments_count"))?;
@@ -994,7 +1020,7 @@ impl<V: Vfs + Clone> Db<V> {
             format_version: crate::pager::structural_header::MAIN_FORMAT_VERSION,
             cipher_id: self.cipher_id.as_byte(),
             page_size_log2: page_size_log2(self.page_size)?,
-            flags: 0,
+            flags: self.header_flags,
             file_id: self.file_id,
             kek_salt: self.kek_salt,
             mk_epoch: self.mk_epoch.load(std::sync::atomic::Ordering::SeqCst),
diff --git a/src/txn/db/util.rs b/src/txn/db/util.rs
index 77e9b0a..99dab80 100644
--- a/src/txn/db/util.rs
+++ b/src/txn/db/util.rs
@@ -1,10 +1,9 @@
-//! Free helper functions shared across DB submodules: page-size encoding, VFS
-//! root extraction, and header peeking.
+//! Free helper functions shared across DB submodules: page-size encoding and
+//! VFS root extraction.
 
 use crate::Result;
-use crate::crypto::kdf::{derive_hk, derive_mk};
 use crate::errors::PagedbError;
-use crate::pager::header::read_header_slot;
+#[cfg(not(target_arch = "wasm32"))]
 use crate::vfs::Vfs;
 
 pub(super) fn page_size_log2(page_size: usize) -> Result<u8> {
@@ -27,66 +26,3 @@ pub(super) fn get_vfs_root<V: Vfs + Clone>(vfs: &V) -> Result<std::path::PathBuf
         .map(std::path::Path::to_path_buf)
         .ok_or(PagedbError::Unsupported)
 }
-
-/// Read the `restore_mode` byte from the on-disk header of an existing
-/// `main.db` without fully opening the database.
-///
-/// Authenticates both slots and rejects unsupported capabilities before
-/// returning the first understood slot's `restore_mode` under the given KEK.
-pub(super) async fn peek_restore_mode<V: Vfs + Clone>(
-    vfs: &V,
-    kek: &[u8; 32],
-    page_size: usize,
-) -> Result<u8> {
-    use crate::vfs::types::OpenMode;
-
-    let mut f = vfs.open("/main.db", OpenMode::Read).await?;
-    let mut buf_a = vec![0u8; page_size];
-    let mut buf_b = vec![0u8; page_size];
-    read_header_slot(&mut f, 0, &mut buf_a).await?;
-    let page_size_u64 = u64::try_from(page_size)
-        .map_err(|_| PagedbError::Io(std::io::Error::other("page_size > u64")))?;
-    read_header_slot(&mut f, page_size_u64, &mut buf_b).await?;
-    drop(f);
-
-    // Same classification as the full open, for the same reason: this probe
-    // runs *before* it on the read-only modes, so a wrong page size or KEK
-    // would otherwise be reported here as damage and never reach the check
-    // that knows better.
-    super::open::header_probe::check_page_size(&buf_a, &buf_b, page_size)?;
-    super::open::header_probe::check_format_version(&buf_a, &buf_b)?;
-
-    let mut restore_mode = None;
-    for buf in [&buf_a, &buf_b] {
-        if buf.len() < 56 {
-            continue;
-        }
-        let mut kek_salt = [0u8; 16];
-        kek_salt.copy_from_slice(&buf[32..48]);
-        let mut ep_bytes = [0u8; 8];
-        ep_bytes.copy_from_slice(&buf[48..56]);
-        let mk_epoch = u64::from_le_bytes(ep_bytes);
-        let Ok(mk) = derive_mk(kek, &kek_salt, mk_epoch) else {
-            continue;
-        };
-        let Ok(hk) = derive_hk(&mk) else {
-            continue;
-        };
-        match crate::pager::format::structural_header::decode_main_db_header(buf, &hk, page_size) {
-            Ok(fields) => {
-                // Keep the probe's existing first-understood-slot semantics,
-                // but inspect the other slot before returning: an authentic
-                // unknown capability must not disappear in this preflight.
-                restore_mode.get_or_insert(fields.restore_mode);
-            }
-            Err(error @ PagedbError::HeaderCapabilityUnsupported { .. }) => return Err(error),
-            Err(_) => {}
-        }
-    }
-    if let Some(mode) = restore_mode {
-        return Ok(mode);
-    }
-    Err(super::open::header_probe::unverifiable_header_cause(
-        &buf_a, &buf_b, page_size,
-    ))
-}
diff --git a/src/txn/write/commit.rs b/src/txn/write/commit.rs
index a96d193..63c261f 100644
--- a/src/txn/write/commit.rs
+++ b/src/txn/write/commit.rs
@@ -302,7 +302,7 @@ impl<V: Vfs + Clone> WriteTxn<'_, V> {
             format_version: crate::pager::structural_header::MAIN_FORMAT_VERSION,
             cipher_id: self.db.cipher_id.as_byte(),
             page_size_log2: page_size_log2(self.db.page_size)?,
-            flags: 0,
+            flags: self.db.header_flags,
             file_id: self.db.file_id,
             kek_salt: self.db.kek_salt,
             mk_epoch: self.db.mk_epoch.load(std::sync::atomic::Ordering::SeqCst),
@@ -317,7 +317,7 @@ impl<V: Vfs + Clone> WriteTxn<'_, V> {
             apply_journal_root_version: 0,
             commit_history_root_page_id: pending.commit_history_root_page_id,
             commit_history_root_version: pending.commit_history_root_version,
-            restore_mode: 0,
+            restore_mode: self.guard.restore_mode,
             next_page_id: new_next,
             commit_retain_policy_tag: policy_tag,
             commit_retain_policy_value: policy_value,
diff --git a/src/vfs/gcd/vfs.rs b/src/vfs/gcd/vfs.rs
index 45dc378..7327990 100644
--- a/src/vfs/gcd/vfs.rs
+++ b/src/vfs/gcd/vfs.rs
@@ -1,20 +1,12 @@
 //! `GcdVfs`: macOS / iOS / iPadOS VFS rooted at a directory, using Grand
 //! Central Dispatch I/O for per-file reads and writes. Advisory path locking
-//! uses the same in-process state machine + POSIX `flock` protocol as the
-//! Tokio fallback.
+//! is the shared `oslock` implementation.
 //!
 //! `dispatch_io` covers reads and writes only. Path operations and directory
-//! sync are plain blocking syscalls, so they run on the blocking pool; only
-//! path validation and the in-process lock table stay on the executor.
-#![allow(unsafe_code)]
-
-use std::collections::BTreeMap;
-use std::os::unix::io::AsRawFd;
+//! sync are plain blocking syscalls, so they run on the blocking pool.
 use std::path::PathBuf;
 use std::sync::Arc;
 
-use parking_lot::Mutex;
-
 use dispatch2::{DispatchQoS, DispatchQueue, DispatchRetained, GlobalQueueIdentifier};
 
 use crate::Result;
@@ -22,96 +14,15 @@ use crate::errors::PagedbError;
 
 use super::file::GcdFile;
 use crate::vfs::blocking::offload;
+use crate::vfs::oslock::LockKind;
 use crate::vfs::traits::{Vfs, canonical_native_path, resolve_native_path};
 use crate::vfs::types::OpenMode;
 
-#[derive(Debug, Clone, Copy)]
-enum LockState {
-    Free,
-    Exclusive,
-    Shared(u32),
-}
-
-#[derive(Debug, Clone, Copy)]
-enum LockKind {
-    Exclusive,
-    Shared,
-}
-
-struct InProcLockEntry {
-    state: Mutex<LockState>,
-}
-
-struct OsFcntlHandle {
-    _file: std::fs::File,
-}
-
-impl OsFcntlHandle {
-    fn try_acquire(path: &std::path::Path, kind: LockKind) -> Result<Self> {
-        let file = std::fs::OpenOptions::new()
-            .create(true)
-            .truncate(false)
-            .read(true)
-            .write(true)
-            .open(path)
-            .map_err(PagedbError::Io)?;
-
-        let fd = file.as_raw_fd();
-        #[allow(clippy::cast_possible_truncation)]
-        let l_type = match kind {
-            LockKind::Exclusive => libc::F_WRLCK as libc::c_short,
-            LockKind::Shared => libc::F_RDLCK as libc::c_short,
-        };
-        #[allow(clippy::cast_possible_truncation)]
-        let flock = libc::flock {
-            l_type,
-            l_whence: libc::SEEK_SET as libc::c_short,
-            l_start: 0,
-            l_len: 0,
-            l_pid: 0,
-        };
-        // SAFETY: `fd` valid (owned by `file`); `flock` fully initialised;
-        // F_SETLK is non-blocking.
-        let rc = unsafe { libc::fcntl(fd, libc::F_SETLK, &flock) };
-        if rc == -1 {
-            let err = std::io::Error::last_os_error();
-            let raw = err.raw_os_error().unwrap_or(0);
-            if raw == libc::EAGAIN || raw == libc::EACCES {
-                return Err(PagedbError::AlreadyLocked);
-            }
-            return Err(PagedbError::Io(err));
-        }
-        Ok(Self { _file: file })
-    }
-}
-
-// SAFETY: fd is owned exclusively; struct moves whole-cloth.
-unsafe impl Send for OsFcntlHandle {}
-
-pub struct GcdLockHandle {
-    lock_ref: Arc<InProcLockEntry>,
-    kind: LockKind,
-    _os_lock: OsFcntlHandle,
-}
-
-impl Drop for GcdLockHandle {
-    fn drop(&mut self) {
-        let mut s = self.lock_ref.state.lock();
-        match (self.kind, *s) {
-            (LockKind::Exclusive, LockState::Exclusive)
-            | (LockKind::Shared, LockState::Shared(1)) => *s = LockState::Free,
-            (LockKind::Shared, LockState::Shared(n)) if n > 1 => {
-                *s = LockState::Shared(n - 1);
-            }
-            _ => {}
-        }
-    }
-}
+pub use crate::vfs::oslock::NativeLockHandle as GcdLockHandle;
 
 struct GcdInner {
     root: PathBuf,
     queue: DispatchRetained<DispatchQueue>,
-    locks: Mutex<BTreeMap<String, Arc<InProcLockEntry>>>,
 }
 
 #[derive(Clone)]
@@ -128,7 +39,6 @@ impl GcdVfs {
             inner: Arc::new(GcdInner {
                 root: root.into(),
                 queue,
-                locks: Mutex::new(BTreeMap::new()),
             }),
         }
     }
@@ -137,57 +47,9 @@ impl GcdVfs {
         resolve_native_path(&self.inner.root, path)
     }
 
-    fn lookup_or_create_entry(&self, path: &str) -> Arc<InProcLockEntry> {
-        let mut locks = self.inner.locks.lock();
-        locks
-            .entry(path.to_string())
-            .or_insert_with(|| {
-                Arc::new(InProcLockEntry {
-                    state: Mutex::new(LockState::Free),
-                })
-            })
-            .clone()
-    }
-
     async fn do_lock(&self, path: &str, kind: LockKind) -> Result<GcdLockHandle> {
-        let logical_path = canonical_native_path(path)?;
-        let entry = self.lookup_or_create_entry(&logical_path);
-        {
-            let mut s = entry.state.lock();
-            match (kind, *s) {
-                (LockKind::Exclusive, LockState::Free) => *s = LockState::Exclusive,
-                (LockKind::Shared, LockState::Free) => *s = LockState::Shared(1),
-                (LockKind::Shared, LockState::Shared(n)) => *s = LockState::Shared(n + 1),
-                _ => return Err(PagedbError::AlreadyLocked),
-            }
-        }
-        let lock_path = self.resolve(&logical_path)?;
-        // `F_SETLK` never waits on a conflict, but creating the sentinel file
-        // can still stall on the filesystem, so the pair goes to the pool.
-        let acquired = offload(move || {
-            if let Some(parent) = lock_path.parent() {
-                std::fs::create_dir_all(parent).map_err(PagedbError::Io)?;
-            }
-            OsFcntlHandle::try_acquire(&lock_path, kind)
-        })
-        .await;
-        match acquired {
-            Ok(os_lock) => Ok(GcdLockHandle {
-                lock_ref: entry,
-                kind,
-                _os_lock: os_lock,
-            }),
-            Err(e) => {
-                let mut s = entry.state.lock();
-                match (kind, *s) {
-                    (LockKind::Exclusive, LockState::Exclusive)
-                    | (LockKind::Shared, LockState::Shared(1)) => *s = LockState::Free,
-                    (LockKind::Shared, LockState::Shared(n)) => *s = LockState::Shared(n - 1),
-                    _ => {}
-                }
-                Err(e)
-            }
-        }
+        let lock_path = self.resolve(&canonical_native_path(path)?)?;
+        crate::vfs::oslock::acquire(lock_path, kind).await
     }
 }
 
diff --git a/src/vfs/iocp/vfs.rs b/src/vfs/iocp/vfs.rs
index d507f55..2716050 100644
--- a/src/vfs/iocp/vfs.rs
+++ b/src/vfs/iocp/vfs.rs
@@ -1,150 +1,32 @@
 //! `IocpVfs`: Windows IOCP-backed VFS rooted at a directory. Advisory path
-//! locking uses an in-process state machine backed by `LockFileEx` for
-//! cross-process exclusion — same protocol as the Tokio fallback. Segment
+//! locking is the shared `oslock` implementation. Segment
 //! files open with `FILE_SHARE_DELETE` so tombstone-rename protocols succeed
 //! against held handles.
 //!
 //! Path operations have no overlapped form: `CreateFile`, `MoveFileEx`,
 //! directory enumeration and friends all park the calling thread. They run on
-//! the blocking pool; only path validation and the in-process lock table stay
-//! on the executor.
-#![allow(unsafe_code)]
+//! the blocking pool.
 
-use std::collections::BTreeMap;
 use std::os::windows::fs::OpenOptionsExt;
 use std::os::windows::io::AsRawHandle;
 use std::path::PathBuf;
 use std::sync::Arc;
 use std::sync::atomic::{AtomicUsize, Ordering};
 
-use parking_lot::Mutex;
-
 use crate::Result;
 use crate::errors::PagedbError;
 
 use super::file::IocpFile;
 use super::port::Port;
 use crate::vfs::blocking::offload;
+use crate::vfs::oslock::LockKind;
 use crate::vfs::traits::{Vfs, canonical_native_path, resolve_native_path};
 use crate::vfs::types::OpenMode;
 
-use windows_sys::Win32::Foundation::{
-    ERROR_IO_PENDING, ERROR_LOCK_VIOLATION, GetLastError, HANDLE,
-};
-use windows_sys::Win32::Storage::FileSystem::{
-    FILE_FLAG_OVERLAPPED, LOCKFILE_EXCLUSIVE_LOCK, LOCKFILE_FAIL_IMMEDIATELY, LockFileEx,
-    UnlockFileEx,
-};
-use windows_sys::Win32::System::IO::OVERLAPPED;
-
-// ---------------------------------------------------------------------------
-// In-process lock state machine
-// ---------------------------------------------------------------------------
-
-#[derive(Debug, Clone, Copy)]
-enum LockState {
-    Free,
-    Exclusive,
-    Shared(u32),
-}
-
-#[derive(Debug, Clone, Copy)]
-enum LockKind {
-    Exclusive,
-    Shared,
-}
-
-struct InProcLockEntry {
-    state: Mutex<LockState>,
-}
-
-// ---------------------------------------------------------------------------
-// Cross-process lock via LockFileEx
-// ---------------------------------------------------------------------------
-
-struct OsLockFileExHandle {
-    file: std::fs::File,
-}
-
-impl OsLockFileExHandle {
-    fn try_acquire(path: &std::path::Path, kind: LockKind) -> Result<Self> {
-        // FILE_SHARE_READ | FILE_SHARE_WRITE: multiple processes must be able
-        // to open the sentinel file and contend on the lock.
-        const FILE_SHARE_READ_WRITE: u32 = 0x0000_0003;
-
-        let file = std::fs::OpenOptions::new()
-            .create(true)
-            .truncate(false)
-            .read(true)
-            .write(true)
-            .share_mode(FILE_SHARE_READ_WRITE)
-            .open(path)
-            .map_err(PagedbError::Io)?;
-
-        let handle = file.as_raw_handle() as HANDLE;
-        let flags = match kind {
-            LockKind::Exclusive => LOCKFILE_EXCLUSIVE_LOCK | LOCKFILE_FAIL_IMMEDIATELY,
-            LockKind::Shared => LOCKFILE_FAIL_IMMEDIATELY,
-        };
-
-        // SAFETY: `handle` is valid for the duration of this call (owned by
-        // `file` which is alive). Zero-initialised OVERLAPPED is the
-        // documented input for synchronous `LockFileEx` use. We lock the
-        // whole [0, u64::MAX) byte range.
-        let mut overlapped: OVERLAPPED = unsafe { std::mem::zeroed() };
-        let rc = unsafe { LockFileEx(handle, flags, 0, u32::MAX, u32::MAX, &mut overlapped) };
-
-        if rc == 0 {
-            // SAFETY: documented pattern.
-            let err = unsafe { GetLastError() };
-            if err == ERROR_LOCK_VIOLATION || err == ERROR_IO_PENDING {
-                return Err(PagedbError::AlreadyLocked);
-            }
-            return Err(PagedbError::Io(std::io::Error::last_os_error()));
-        }
-
-        Ok(Self { file })
-    }
-}
-
-impl Drop for OsLockFileExHandle {
-    fn drop(&mut self) {
-        let handle = self.file.as_raw_handle() as HANDLE;
-        // SAFETY: `handle` valid until `file` drops at end of this method.
-        // Errors are ignored in Drop; closing the handle releases the lock
-        // regardless.
-        let mut overlapped: OVERLAPPED = unsafe { std::mem::zeroed() };
-        let _ = unsafe { UnlockFileEx(handle, 0, u32::MAX, u32::MAX, &mut overlapped) };
-    }
-}
+use windows_sys::Win32::Foundation::HANDLE;
+use windows_sys::Win32::Storage::FileSystem::FILE_FLAG_OVERLAPPED;
 
-// SAFETY: HANDLE is process-owned and not aliased between threads — the
-// struct moves as a whole.
-unsafe impl Send for OsLockFileExHandle {}
-
-// ---------------------------------------------------------------------------
-// Public lock handle
-// ---------------------------------------------------------------------------
-
-pub struct IocpLockHandle {
-    lock_ref: Arc<InProcLockEntry>,
-    kind: LockKind,
-    _os_lock: OsLockFileExHandle,
-}
-
-impl Drop for IocpLockHandle {
-    fn drop(&mut self) {
-        let mut s = self.lock_ref.state.lock();
-        match (self.kind, *s) {
-            (LockKind::Exclusive, LockState::Exclusive)
-            | (LockKind::Shared, LockState::Shared(1)) => *s = LockState::Free,
-            (LockKind::Shared, LockState::Shared(n)) if n > 1 => {
-                *s = LockState::Shared(n - 1);
-            }
-            _ => {}
-        }
-    }
-}
+pub use crate::vfs::oslock::NativeLockHandle as IocpLockHandle;
 
 // ---------------------------------------------------------------------------
 // IocpVfs
@@ -157,7 +39,6 @@ struct IocpInner {
     /// means keys are not strictly required to disambiguate completions, but
     /// they are useful for diagnostics and future relaxation of serialisation.
     next_key: AtomicUsize,
-    locks: Mutex<BTreeMap<String, Arc<InProcLockEntry>>>,
 }
 
 #[derive(Clone)]
@@ -173,7 +54,6 @@ impl IocpVfs {
                 root: root.into(),
                 port,
                 next_key: AtomicUsize::new(1),
-                locks: Mutex::new(BTreeMap::new()),
             }),
         })
     }
@@ -182,59 +62,9 @@ impl IocpVfs {
         resolve_native_path(&self.inner.root, path)
     }
 
-    fn lookup_or_create_entry(&self, path: &str) -> Arc<InProcLockEntry> {
-        let mut locks = self.inner.locks.lock();
-        locks
-            .entry(path.to_string())
-            .or_insert_with(|| {
-                Arc::new(InProcLockEntry {
-                    state: Mutex::new(LockState::Free),
-                })
-            })
-            .clone()
-    }
-
     async fn do_lock(&self, path: &str, kind: LockKind) -> Result<IocpLockHandle> {
-        let logical_path = canonical_native_path(path)?;
-        let entry = self.lookup_or_create_entry(&logical_path);
-        {
-            let mut s = entry.state.lock();
-            match (kind, *s) {
-                (LockKind::Exclusive, LockState::Free) => *s = LockState::Exclusive,
-                (LockKind::Shared, LockState::Free) => *s = LockState::Shared(1),
-                (LockKind::Shared, LockState::Shared(n)) => *s = LockState::Shared(n + 1),
-                _ => return Err(PagedbError::AlreadyLocked),
-            }
-        }
-        let lock_path = self.resolve(&logical_path)?;
-        // Creating the sentinel file and taking the OS lock are both blocking
-        // syscalls. `LockFileEx` itself is `LOCKFILE_FAIL_IMMEDIATELY`, so it
-        // never waits on a conflict — but opening the file can still stall on
-        // the filesystem, so the pair goes to the pool together.
-        let acquired = offload(move || {
-            if let Some(parent) = lock_path.parent() {
-                std::fs::create_dir_all(parent).map_err(PagedbError::Io)?;
-            }
-            OsLockFileExHandle::try_acquire(&lock_path, kind)
-        })
-        .await;
-        match acquired {
-            Ok(os_lock) => Ok(IocpLockHandle {
-                lock_ref: entry,
-                kind,
-                _os_lock: os_lock,
-            }),
-            Err(e) => {
-                let mut s = entry.state.lock();
-                match (kind, *s) {
-                    (LockKind::Exclusive, LockState::Exclusive)
-                    | (LockKind::Shared, LockState::Shared(1)) => *s = LockState::Free,
-                    (LockKind::Shared, LockState::Shared(n)) => *s = LockState::Shared(n - 1),
-                    _ => {}
-                }
-                Err(e)
-            }
-        }
+        let lock_path = self.resolve(&canonical_native_path(path)?)?;
+        crate::vfs::oslock::acquire(lock_path, kind).await
     }
 }
 
diff --git a/src/vfs/iouring/vfs.rs b/src/vfs/iouring/vfs.rs
index c75f279..f3ecc0a 100644
--- a/src/vfs/iouring/vfs.rs
+++ b/src/vfs/iouring/vfs.rs
@@ -17,7 +17,7 @@ use crate::errors::PagedbError;
 use super::file::IouringFile;
 use super::ring::Ring;
 use crate::vfs::blocking::offload;
-use crate::vfs::oslock::{LockKind, LockTable};
+use crate::vfs::oslock::LockKind;
 use crate::vfs::traits::{Vfs, canonical_native_path, resolve_native_path};
 use crate::vfs::types::OpenMode;
 
@@ -33,12 +33,11 @@ pub use crate::vfs::oslock::NativeLockHandle as IouringLockHandle;
 struct IouringInner {
     root: PathBuf,
     ring: Ring,
-    locks: LockTable,
 }
 
 /// VFS rooted at a directory, using `io_uring` for file I/O and `std::fs` /
-/// libc syscalls for path-level operations. Cloning shares the same root,
-/// ring, and lock table.
+/// libc syscalls for path-level operations. Cloning shares the same root and
+/// ring. Locks are process-wide, so instances over one directory contend.
 #[derive(Clone)]
 pub struct IouringVfs {
     inner: Arc<IouringInner>,
@@ -54,7 +53,6 @@ impl IouringVfs {
             inner: Arc::new(IouringInner {
                 root: root.into(),
                 ring,
-                locks: LockTable::new(),
             }),
         })
     }
@@ -66,7 +64,7 @@ impl IouringVfs {
     async fn do_lock(&self, path: &str, kind: LockKind) -> Result<IouringLockHandle> {
         let logical_path = canonical_native_path(path)?;
         let lock_path = self.resolve(&logical_path)?;
-        crate::vfs::oslock::acquire(&self.inner.locks, &logical_path, lock_path, kind).await
+        crate::vfs::oslock::acquire(lock_path, kind).await
     }
 }
 
diff --git a/src/vfs/mod.rs b/src/vfs/mod.rs
index fc83ce8..ae013e3 100644
--- a/src/vfs/mod.rs
+++ b/src/vfs/mod.rs
@@ -62,7 +62,7 @@ pub use opfs::OpfsVfs;
 pub use oslock::NativeLockHandle;
 pub use traits::{Vfs, VfsFile};
 pub(crate) use traits::{
-    checked_read_progress, read_exact_at, read_exact_at_borrowed, write_all_at,
+    checked_read_progress, read_exact_at, read_exact_at_borrowed, remove_if_present, write_all_at,
 };
 pub use types::{OpenMode, ReadReq, WriteReq};
 pub use wasi::WasiVfs;
diff --git a/src/vfs/oslock.rs b/src/vfs/oslock.rs
index 318ab6e..c1bd24c 100644
--- a/src/vfs/oslock.rs
+++ b/src/vfs/oslock.rs
@@ -1,11 +1,17 @@
 //! Advisory path locking shared by every filesystem-backed native VFS.
 //!
-//! One protocol, one implementation. A lock is two layers: an in-process state
-//! machine that gives fast single-process exclusion, and an OS-level lock that
+//! One protocol, one implementation. A lock is two layers: a process-wide
+//! table that excludes every handle in this process, and an OS-level lock that
 //! excludes other processes — `fcntl` OFD locks (`F_OFD_SETLK`) on Linux,
 //! classic `F_SETLK` on other Unix, and `LockFileEx` on Windows. On targets
 //! with neither, only the in-process layer applies.
 //!
+//! The table is keyed by resolved lock-file path, so all VFS instances share
+//! it. macOS `F_SETLK` never conflicts within one process. This table enforces
+//! the conflict instead.
+//! Each entry owns the process's single OS lock on its file. One descriptor
+//! means an early close can never drop an `F_SETLK` lock.
+//!
 //! Both layers live here rather than in each backend deliberately. The store's
 //! single-writer guarantee rests on the `.writer.lock` sentinel, and two
 //! backends may hold that sentinel at the same time — a process that got an
@@ -48,66 +54,84 @@ pub(crate) enum LockKind {
     Shared,
 }
 
+/// One lock domain: its holders in this process and the OS lock they share.
+struct EntryState {
+    mode: LockState,
+    #[cfg(any(unix, windows))]
+    os: Option<OsLock>,
+}
+
 struct InProcLockEntry {
-    state: Mutex<LockState>,
+    /// Serializes taking the OS lock for a free domain.
+    gate: tokio::sync::Mutex<()>,
+    state: Mutex<EntryState>,
 }
 
 impl InProcLockEntry {
-    /// Take the in-process layer, or report the conflict without touching it.
-    fn try_enter(&self, kind: LockKind) -> Result<()> {
-        let mut state = self.state.lock();
-        match (kind, *state) {
-            (LockKind::Exclusive, LockState::Free) => *state = LockState::Exclusive,
-            (LockKind::Shared, LockState::Free) => *state = LockState::Shared(1),
-            (LockKind::Shared, LockState::Shared(n)) => *state = LockState::Shared(n + 1),
-            _ => return Err(PagedbError::AlreadyLocked),
+    fn new() -> Self {
+        Self {
+            gate: tokio::sync::Mutex::new(()),
+            state: Mutex::new(EntryState {
+                mode: LockState::Free,
+                #[cfg(any(unix, windows))]
+                os: None,
+            }),
         }
-        Ok(())
     }
 
-    /// Give the in-process layer back. Used both when a handle drops and to
-    /// roll back after the OS layer refused, so a failed acquisition leaves no
-    /// trace.
-    fn leave(&self, kind: LockKind) {
+    /// Join a held domain. `false` means it is free and needs the OS lock.
+    fn try_join(&self, kind: LockKind) -> Result<bool> {
         let mut state = self.state.lock();
-        match (kind, *state) {
-            (LockKind::Exclusive, LockState::Exclusive)
-            | (LockKind::Shared, LockState::Shared(1)) => *state = LockState::Free,
-            (LockKind::Shared, LockState::Shared(n)) if n > 1 => *state = LockState::Shared(n - 1),
-            _ => {}
+        match (kind, state.mode) {
+            (_, LockState::Free) => Ok(false),
+            (LockKind::Shared, LockState::Shared(n)) => {
+                state.mode = LockState::Shared(n + 1);
+                Ok(true)
+            }
+            _ => Err(PagedbError::AlreadyLocked),
         }
     }
-}
-
-/// Per-VFS table of in-process lock entries, keyed by canonical logical path.
-///
-/// Each distinct canonical path is its own lock domain. The table only ever
-/// grows an entry per path that has been locked at least once; entries are
-/// cheap and keeping them avoids racing a concurrent acquirer against removal.
-pub(crate) struct LockTable {
-    entries: Mutex<BTreeMap<String, Arc<InProcLockEntry>>>,
-}
 
-impl LockTable {
-    pub(crate) fn new() -> Self {
-        Self {
-            entries: Mutex::new(BTreeMap::new()),
+    /// Record the first holder of a free domain.
+    fn install(&self, kind: LockKind, #[cfg(any(unix, windows))] os: OsLock) {
+        let mut state = self.state.lock();
+        state.mode = match kind {
+            LockKind::Exclusive => LockState::Exclusive,
+            LockKind::Shared => LockState::Shared(1),
+        };
+        #[cfg(any(unix, windows))]
+        {
+            state.os = Some(os);
         }
     }
 
-    fn entry(&self, path: &str) -> Arc<InProcLockEntry> {
-        let mut entries = self.entries.lock();
-        entries
-            .entry(path.to_string())
-            .or_insert_with(|| {
-                Arc::new(InProcLockEntry {
-                    state: Mutex::new(LockState::Free),
-                })
-            })
-            .clone()
+    /// Give one hold back. The last holder releases the OS lock.
+    fn leave(&self, kind: LockKind) {
+        let mut state = self.state.lock();
+        state.mode = match (kind, state.mode) {
+            (LockKind::Shared, LockState::Shared(n)) if n > 1 => LockState::Shared(n - 1),
+            _ => LockState::Free,
+        };
+        #[cfg(any(unix, windows))]
+        if matches!(state.mode, LockState::Free) {
+            state.os = None;
+        }
     }
 }
 
+/// Every lock domain in the process, keyed by resolved lock-file path.
+/// Entries are never removed, so no acquirer races a removal.
+static LOCK_TABLE: std::sync::LazyLock<Mutex<BTreeMap<PathBuf, Arc<InProcLockEntry>>>> =
+    std::sync::LazyLock::new(|| Mutex::new(BTreeMap::new()));
+
+fn entry(key: PathBuf) -> Arc<InProcLockEntry> {
+    LOCK_TABLE
+        .lock()
+        .entry(key)
+        .or_insert_with(|| Arc::new(InProcLockEntry::new()))
+        .clone()
+}
+
 // ---------------------------------------------------------------------------
 // Unix cross-process lock via fcntl.
 // ---------------------------------------------------------------------------
@@ -307,119 +331,142 @@ type OsLock = OsLockFileExHandle;
 // Public lock handle.
 // ---------------------------------------------------------------------------
 
-/// RAII advisory lock handle returned by every native backend's
-/// `lock_exclusive` / `lock_shared`. Holds the in-process state guard and, on
-/// targets that have one, the OS-level lock. Dropping it releases both.
+/// Advisory lock returned by every native backend's `lock_exclusive` and
+/// `lock_shared`. The last holder of a file releases the OS lock on drop.
 pub struct NativeLockHandle {
     entry: Arc<InProcLockEntry>,
     kind: LockKind,
-    /// On Unix: holds the fcntl-locked file open (an OFD lock on Linux, a
-    /// process `F_SETLK` lock elsewhere). On Windows: holds the
-    /// `LockFileEx`-locked file open. Dropped together with this handle.
-    #[cfg(any(unix, windows))]
-    _os_lock: OsLock,
 }
 
 impl Drop for NativeLockHandle {
     fn drop(&mut self) {
         self.entry.leave(self.kind);
-        // `_os_lock` is dropped automatically after this, releasing the OS lock.
     }
 }
 
-/// Acquire an advisory lock on one canonical logical path.
-///
-/// `logical_path` names the lock domain in the in-process table;
-/// `lock_path` is the sentinel file on disk that carries the OS-level lock.
-pub(crate) async fn acquire(
-    table: &LockTable,
-    logical_path: &str,
-    lock_path: PathBuf,
-    kind: LockKind,
-) -> Result<NativeLockHandle> {
-    let entry = table.entry(logical_path);
-    // In-process guard first: fast fail if this process already holds a
-    // conflicting lock on the path, without touching the filesystem.
-    entry.try_enter(kind)?;
-
+/// Acquire an advisory lock on the sentinel file at `lock_path`, creating the
+/// file and its directory when absent.
+pub(crate) async fn acquire(lock_path: PathBuf, kind: LockKind) -> Result<NativeLockHandle> {
     #[cfg(any(unix, windows))]
     {
-        // Neither `*_SETLK` nor `LOCKFILE_FAIL_IMMEDIATELY` waits on a
-        // conflict, but creating the sentinel file can still stall on the
-        // filesystem, so the pair goes to the blocking pool together.
-        let acquired = offload(move || {
-            if let Some(parent) = lock_path.parent() {
-                std::fs::create_dir_all(parent).map_err(PagedbError::Io)?;
-            }
-            OsLock::try_acquire(&lock_path, kind)
-        })
-        .await;
-        match acquired {
-            Ok(os_lock) => Ok(NativeLockHandle {
-                entry,
-                kind,
-                _os_lock: os_lock,
-            }),
-            Err(error) => {
-                // The OS layer refused, so the in-process layer must not stay
-                // taken — a rejected acquisition leaves no trace.
-                entry.leave(kind);
-                Err(error)
+        // Filesystem calls, so off the async thread.
+        let key = offload(move || resolve_lock_key(&lock_path)).await?;
+        let entry = entry(key.clone());
+        {
+            let _gate = entry.gate.lock().await;
+            if !entry.try_join(kind)? {
+                // Creating the sentinel file can stall on the filesystem.
+                let os = offload(move || OsLock::try_acquire(&key, kind)).await?;
+                entry.install(kind, os);
             }
         }
+        Ok(NativeLockHandle { entry, kind })
     }
     #[cfg(not(any(unix, windows)))]
     {
-        let _ = lock_path;
+        let entry = entry(lock_path);
+        {
+            let _gate = entry.gate.lock().await;
+            if !entry.try_join(kind)? {
+                entry.install(kind);
+            }
+        }
         Ok(NativeLockHandle { entry, kind })
     }
 }
 
+/// Canonical directory plus file name, so two spellings of one path match.
+#[cfg(any(unix, windows))]
+fn resolve_lock_key(lock_path: &std::path::Path) -> Result<PathBuf> {
+    let parent = lock_path
+        .parent()
+        .filter(|parent| !parent.as_os_str().is_empty())
+        .unwrap_or_else(|| std::path::Path::new("."));
+    std::fs::create_dir_all(parent).map_err(PagedbError::Io)?;
+    let parent = std::fs::canonicalize(parent).map_err(PagedbError::Io)?;
+    let name = lock_path.file_name().ok_or_else(|| {
+        PagedbError::Io(std::io::Error::other(format!(
+            "lock path has no file name: {}",
+            lock_path.display()
+        )))
+    })?;
+    Ok(parent.join(name))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
-    #[test]
-    fn an_exclusive_entry_excludes_every_other_kind() {
-        let table = LockTable::new();
-        let entry = table.entry("/db");
-        entry.try_enter(LockKind::Exclusive).unwrap();
+    fn lock_file(dir: &tempfile::TempDir, name: &str) -> PathBuf {
+        dir.path().join(name)
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn an_exclusive_lock_excludes_every_other_kind() {
+        let dir = tempfile::tempdir().unwrap();
+        let _held = acquire(lock_file(&dir, "a.lock"), LockKind::Exclusive)
+            .await
+            .unwrap();
         assert!(matches!(
-            entry.try_enter(LockKind::Exclusive),
+            acquire(lock_file(&dir, "a.lock"), LockKind::Exclusive).await,
             Err(PagedbError::AlreadyLocked)
         ));
         assert!(matches!(
-            entry.try_enter(LockKind::Shared),
+            acquire(lock_file(&dir, "a.lock"), LockKind::Shared).await,
             Err(PagedbError::AlreadyLocked)
         ));
     }
 
-    #[test]
-    fn shared_entries_stack_and_only_the_last_release_frees_the_domain() {
-        let table = LockTable::new();
-        let entry = table.entry("/db");
-        entry.try_enter(LockKind::Shared).unwrap();
-        entry.try_enter(LockKind::Shared).unwrap();
-
-        entry.leave(LockKind::Shared);
+    #[tokio::test(flavor = "current_thread")]
+    async fn shared_holds_stack_and_only_the_last_release_frees_the_file() {
+        let dir = tempfile::tempdir().unwrap();
+        let first = acquire(lock_file(&dir, "a.lock"), LockKind::Shared)
+            .await
+            .unwrap();
+        let second = acquire(lock_file(&dir, "a.lock"), LockKind::Shared)
+            .await
+            .unwrap();
+
+        drop(first);
         assert!(
             matches!(
-                entry.try_enter(LockKind::Exclusive),
+                acquire(lock_file(&dir, "a.lock"), LockKind::Exclusive).await,
                 Err(PagedbError::AlreadyLocked)
             ),
             "one shared holder remains, so exclusive must still be refused"
         );
 
-        entry.leave(LockKind::Shared);
-        entry.try_enter(LockKind::Exclusive).unwrap();
+        drop(second);
+        acquire(lock_file(&dir, "a.lock"), LockKind::Exclusive)
+            .await
+            .unwrap();
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn two_spellings_of_one_lock_file_share_one_domain() {
+        let dir = tempfile::tempdir().unwrap();
+        let _held = acquire(lock_file(&dir, "a.lock"), LockKind::Exclusive)
+            .await
+            .unwrap();
+        let respelled = dir.path().join("sub").join("..").join("a.lock");
+        std::fs::create_dir_all(dir.path().join("sub")).unwrap();
+        assert!(
+            matches!(
+                acquire(respelled, LockKind::Exclusive).await,
+                Err(PagedbError::AlreadyLocked)
+            ),
+            "a second spelling of the path must not bypass the holder"
+        );
     }
 
-    #[test]
-    fn the_same_logical_path_always_maps_to_one_entry() {
-        let table = LockTable::new();
-        let first = table.entry("/db");
-        let second = table.entry("/db");
-        assert!(Arc::ptr_eq(&first, &second));
-        assert!(!Arc::ptr_eq(&first, &table.entry("/other")));
+    #[tokio::test(flavor = "current_thread")]
+    async fn distinct_lock_files_are_distinct_domains() {
+        let dir = tempfile::tempdir().unwrap();
+        let _a = acquire(lock_file(&dir, "a.lock"), LockKind::Exclusive)
+            .await
+            .unwrap();
+        acquire(lock_file(&dir, "b.lock"), LockKind::Exclusive)
+            .await
+            .unwrap();
     }
 }
diff --git a/src/vfs/tokio_backend.rs b/src/vfs/tokio_backend.rs
index 8d15844..30e5116 100644
--- a/src/vfs/tokio_backend.rs
+++ b/src/vfs/tokio_backend.rs
@@ -13,7 +13,7 @@ use crate::Result;
 use crate::errors::PagedbError;
 
 use super::blocking::offload;
-use super::oslock::{LockKind, LockTable};
+use super::oslock::LockKind;
 use super::traits::{Vfs, VfsFile, canonical_native_path, resolve_native_path};
 use super::types::{OpenMode, ReadReq, WriteReq};
 
@@ -28,7 +28,7 @@ pub use super::oslock::NativeLockHandle as TokioLockHandle;
 
 /// VFS rooted at a directory. Paths supplied to all methods are resolved
 /// relative to this root; a leading `/` is stripped. Cloning shares the same
-/// root and lock table.
+/// root. Locks are process-wide, so instances over one directory contend.
 #[derive(Clone)]
 pub struct TokioVfs {
     inner: Arc<TokioInner>,
@@ -36,7 +36,6 @@ pub struct TokioVfs {
 
 struct TokioInner {
     root: PathBuf,
-    locks: LockTable,
 }
 
 impl TokioVfs {
@@ -44,10 +43,7 @@ impl TokioVfs {
     /// exist or be created before the first `open` call.
     pub fn new(root: impl Into<PathBuf>) -> Self {
         Self {
-            inner: Arc::new(TokioInner {
-                root: root.into(),
-                locks: LockTable::new(),
-            }),
+            inner: Arc::new(TokioInner { root: root.into() }),
         }
     }
 
@@ -68,7 +64,7 @@ impl TokioVfs {
     async fn do_lock(&self, path: &str, kind: LockKind) -> Result<TokioLockHandle> {
         let logical_path = Self::canonical_logical_path(path)?;
         let lock_path = self.resolve(&logical_path)?;
-        super::oslock::acquire(&self.inner.locks, &logical_path, lock_path, kind).await
+        super::oslock::acquire(lock_path, kind).await
     }
 }
 
diff --git a/src/vfs/traits.rs b/src/vfs/traits.rs
index 9f5b169..dcd1565 100644
--- a/src/vfs/traits.rs
+++ b/src/vfs/traits.rs
@@ -120,6 +120,18 @@ pub(crate) async fn read_exact_at<F: VfsFile + ?Sized>(
     Ok(())
 }
 
+/// Remove `path`, treating a file that is already gone as removed.
+///
+/// Used for crash-cleanup of scratch files, where absence counts as success.
+/// Only a real backend error returns as `Err`.
+pub(crate) async fn remove_if_present<V: Vfs>(vfs: &V, path: &str) -> Result<()> {
+    match vfs.remove(path).await {
+        Ok(()) => Ok(()),
+        Err(PagedbError::Io(error)) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(error) => Err(error),
+    }
+}
+
 /// Validate one positional read result and advance its offset.
 ///
 /// A backend may legally satisfy a request in several calls, so a short read is
diff --git a/tests/common/mod.rs b/tests/common/mod.rs
new file mode 100644
index 0000000..930cd7e
--- /dev/null
+++ b/tests/common/mod.rs
@@ -0,0 +1,69 @@
+//! Helpers shared by the restored-directory integration suites.
+
+use std::path::Path;
+
+use pagedb::vfs::tokio_backend::TokioVfs;
+use pagedb::{Db, DbMode, OpenOptions, RealmId, SegmentKind, SegmentPageKind};
+
+pub const PAGE: usize = 4096;
+pub const KEK: [u8; 32] = [9u8; 32];
+pub const REALM: RealmId = RealmId::new([1u8; 16]);
+pub const SEGMENT: &str = "engine.idx";
+
+/// Seeds a source store with one row and a two-page segment, then snapshots it.
+/// Restores the snapshot into `dst` and drops every handle so the directory is at rest.
+/// Returns the source segment's id.
+pub async fn restore_into(dst: &Path) -> [u8; 16] {
+    let src_dir = tempfile::tempdir().unwrap();
+    let snap_dir = tempfile::tempdir().unwrap();
+
+    let source = Db::open(
+        TokioVfs::new(src_dir.path()),
+        KEK,
+        PAGE,
+        REALM,
+        OpenOptions::default(),
+    )
+    .await
+    .unwrap();
+    let mut segment = source
+        .create_segment(REALM, SegmentKind::Unspecified)
+        .await
+        .unwrap();
+    segment
+        .append_page(SegmentPageKind::Data, b"page-one")
+        .await
+        .unwrap();
+    segment
+        .append_page(SegmentPageKind::Data, b"page-two")
+        .await
+        .unwrap();
+    let segment_meta = segment.seal().await.unwrap();
+    let mut w = source.begin_write().await.unwrap();
+    w.put(b"k", b"v").await.unwrap();
+    w.link_segment(SEGMENT, &segment_meta).await.unwrap();
+    w.commit().await.unwrap();
+    source.snapshot_to(snap_dir.path()).await.unwrap();
+    drop(source);
+
+    let restored = Db::<TokioVfs>::restore_from(snap_dir.path(), dst, OpenOptions::default(), KEK)
+        .await
+        .unwrap();
+    assert_eq!(restored.mode(), DbMode::ReadOnly);
+    segment_meta.segment_id
+}
+
+pub async fn open_standalone(dir: &Path) -> pagedb::Result<Db<TokioVfs>> {
+    Db::open(TokioVfs::new(dir), KEK, PAGE, REALM, OpenOptions::default()).await
+}
+
+pub async fn open_read_only(dir: &Path) -> pagedb::Result<Db<TokioVfs>> {
+    Db::open_read_only(TokioVfs::new(dir), KEK, PAGE, REALM, OpenOptions::default()).await
+}
+
+pub fn describe(result: &pagedb::Result<Db<TokioVfs>>) -> String {
+    match result {
+        Ok(db) => format!("Ok({:?})", db.mode()),
+        Err(err) => format!("Err({err:?})"),
+    }
+}
diff --git a/tests/open_mode_discipline.rs b/tests/open_mode_discipline.rs
new file mode 100644
index 0000000..1c5e18b
--- /dev/null
+++ b/tests/open_mode_discipline.rs
@@ -0,0 +1,349 @@
+//! Every public open applies its mode's discipline.
+//!
+//! A handle's mode decides three things at open:
+//! - which sentinel it holds
+//! - whether a missing store bootstraps or refuses
+//! - whether a page that fails authentication is re-read
+//!
+//! The unpromoted-restore refusal is covered in `restored_store_modes.rs`.
+//!
+//! These tests hold every public entry point to the same answers. This
+//! includes `Db::open_existing_with_counterpart_kek`, which resumes an
+//! interrupted KEK-changing rekey as a Standalone writer.
+
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex};
+
+use pagedb::vfs::memory::MemVfs;
+use pagedb::vfs::{OpenMode, ReadReq, Vfs, VfsFile, WriteReq};
+use pagedb::{Db, DbMode, OpenOptions, PagedbError, RealmId};
+
+const PAGE: usize = 4096;
+const KEK: [u8; 32] = [9u8; 32];
+/// Authenticates nothing in these stores.
+/// A counterpart key matters only when the primary key cannot open the header.
+/// Any other value works here.
+const COUNTERPART_KEK: [u8; 32] = [8u8; 32];
+const REALM: RealmId = RealmId::new([1u8; 16]);
+const MAIN_DB: &str = "/main.db";
+/// Enough rows to build a multi-level tree.
+/// A point read after reopen misses the small buffer pool and reaches the VFS.
+const ROWS: u32 = 3000;
+
+fn row_key(i: u32) -> Vec<u8> {
+    format!("key-{i:06}").into_bytes()
+}
+
+async fn seed_store(vfs: MemVfs) {
+    let db = Db::open(vfs, KEK, PAGE, REALM, OpenOptions::default())
+        .await
+        .unwrap();
+    let mut w = db.begin_write().await.unwrap();
+    for i in 0..ROWS {
+        w.put(&row_key(i), &[0x5a; 64]).await.unwrap();
+    }
+    w.commit().await.unwrap();
+}
+
+fn small_pool() -> OpenOptions {
+    OpenOptions::default().with_buffer_pool_pages(16)
+}
+
+// ── Page-read retry ─────────────────────────────────────────────────────────
+
+/// Corrupts every `main.db` page read past the A/B header slots once armed.
+/// Records the offset of each read.
+/// The pager reads a page once per attempt, so offsets count the retries.
+#[derive(Clone)]
+struct TamperingVfs {
+    inner: MemVfs,
+    armed: Arc<AtomicBool>,
+    reads: Arc<Mutex<Vec<u64>>>,
+}
+
+impl TamperingVfs {
+    fn new(inner: MemVfs) -> Self {
+        Self {
+            inner,
+            armed: Arc::new(AtomicBool::new(false)),
+            reads: Arc::new(Mutex::new(Vec::new())),
+        }
+    }
+
+    fn arm(&self) {
+        self.armed.store(true, Ordering::SeqCst);
+    }
+
+    fn tampered_reads(&self) -> Vec<u64> {
+        self.reads.lock().unwrap().clone()
+    }
+}
+
+struct TamperingFile<F> {
+    inner: F,
+    is_main_db: bool,
+    armed: Arc<AtomicBool>,
+    reads: Arc<Mutex<Vec<u64>>>,
+}
+
+impl<F> TamperingFile<F> {
+    /// Flip one byte in the page body. The page header still parses, so the
+    /// read fails authentication rather than header decoding.
+    fn tamper(&self, offset: u64, buf: &mut [u8]) {
+        let past_headers = offset >= 2 * PAGE as u64;
+        if self.is_main_db && past_headers && self.armed.load(Ordering::SeqCst) {
+            self.reads.lock().unwrap().push(offset);
+            let mid = buf.len() / 2;
+            buf[mid] ^= 0xff;
+        }
+    }
+}
+
+impl Vfs for TamperingVfs {
+    type File = TamperingFile<<MemVfs as Vfs>::File>;
+    type LockHandle = <MemVfs as Vfs>::LockHandle;
+
+    async fn open(&self, path: &str, mode: OpenMode) -> pagedb::Result<Self::File> {
+        Ok(TamperingFile {
+            inner: self.inner.open(path, mode).await?,
+            is_main_db: path == MAIN_DB,
+            armed: self.armed.clone(),
+            reads: self.reads.clone(),
+        })
+    }
+
+    async fn remove(&self, path: &str) -> pagedb::Result<()> {
+        self.inner.remove(path).await
+    }
+
+    async fn rename(&self, from: &str, to: &str) -> pagedb::Result<()> {
+        self.inner.rename(from, to).await
+    }
+
+    async fn list_dir(&self, path: &str) -> pagedb::Result<Vec<String>> {
+        self.inner.list_dir(path).await
+    }
+
+    async fn mkdir_all(&self, path: &str) -> pagedb::Result<()> {
+        self.inner.mkdir_all(path).await
+    }
+
+    async fn sync_dir(&self, path: &str) -> pagedb::Result<()> {
+        self.inner.sync_dir(path).await
+    }
+
+    async fn lock_exclusive(&self, path: &str) -> pagedb::Result<Self::LockHandle> {
+        self.inner.lock_exclusive(path).await
+    }
+
+    async fn lock_shared(&self, path: &str) -> pagedb::Result<Self::LockHandle> {
+        self.inner.lock_shared(path).await
+    }
+}
+
+impl<F: VfsFile + Sync> VfsFile for TamperingFile<F> {
+    async fn read_at(&self, offset: u64, buf: &mut [u8]) -> pagedb::Result<usize> {
+        let n = self.inner.read_at(offset, buf).await?;
+        self.tamper(offset, &mut buf[..n]);
+        Ok(n)
+    }
+
+    async fn read_at_vectored(&self, reqs: &mut [ReadReq<'_>]) -> pagedb::Result<()> {
+        self.inner.read_at_vectored(reqs).await?;
+        for req in reqs.iter_mut() {
+            self.tamper(req.offset, req.buf);
+        }
+        Ok(())
+    }
+
+    async fn write_at(&mut self, offset: u64, buf: &[u8]) -> pagedb::Result<usize> {
+        self.inner.write_at(offset, buf).await
+    }
+
+    async fn write_at_vectored(&mut self, reqs: &[WriteReq<'_>]) -> pagedb::Result<()> {
+        self.inner.write_at_vectored(reqs).await
+    }
+
+    async fn sync(&mut self) -> pagedb::Result<()> {
+        self.inner.sync().await
+    }
+
+    async fn truncate(&mut self, len: u64) -> pagedb::Result<()> {
+        self.inner.truncate(len).await
+    }
+
+    async fn len(&self) -> pagedb::Result<u64> {
+        self.inner.len().await
+    }
+
+    async fn is_empty(&self) -> pagedb::Result<bool> {
+        self.inner.is_empty().await
+    }
+
+    fn supports_direct_io(&self) -> bool {
+        self.inner.supports_direct_io()
+    }
+}
+
+/// Reads a row through `db` with every `main.db` page read corrupted.
+/// Returns the offsets of the tampered reads.
+///
+/// The first page the read misses on fails authentication.
+/// Every tampered read must target that one page.
+/// The count is the number of attempts.
+async fn attempts_on_a_failed_page(db: &Db<TamperingVfs>, vfs: &TamperingVfs) -> usize {
+    let reader = db.begin_read().await.unwrap();
+    vfs.arm();
+    let err = match reader.get(&row_key(ROWS / 2)).await {
+        Ok(_) => panic!("every page read is corrupted, so the read must fail"),
+        Err(err) => err,
+    };
+    assert!(
+        matches!(err, PagedbError::Corruption(_)),
+        "a page that fails authentication must report corruption, got {err:?}"
+    );
+    let reads = vfs.tampered_reads();
+    assert!(
+        !reads.is_empty(),
+        "the read never reached the VFS, so it proves nothing"
+    );
+    assert!(
+        reads.iter().all(|offset| *offset == reads[0]),
+        "every attempt must target the failed page, got offsets {reads:?}"
+    );
+    reads.len()
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_standalone_open_reads_a_failed_page_once() {
+    let mem = MemVfs::new();
+    seed_store(mem.clone()).await;
+    let vfs = TamperingVfs::new(mem);
+    let db = Db::open(vfs.clone(), KEK, PAGE, REALM, small_pool())
+        .await
+        .unwrap();
+    assert_eq!(db.mode(), DbMode::Standalone);
+
+    assert_eq!(attempts_on_a_failed_page(&db, &vfs).await, 1);
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_read_only_open_reads_a_failed_page_once() {
+    let mem = MemVfs::new();
+    seed_store(mem.clone()).await;
+    let vfs = TamperingVfs::new(mem);
+    let db = Db::open_read_only(vfs.clone(), KEK, PAGE, REALM, small_pool())
+        .await
+        .unwrap();
+
+    assert_eq!(attempts_on_a_failed_page(&db, &vfs).await, 1);
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_counterpart_kek_open_reads_a_failed_page_once() {
+    let mem = MemVfs::new();
+    seed_store(mem.clone()).await;
+    let vfs = TamperingVfs::new(mem);
+    let db = Db::open_existing_with_counterpart_kek(
+        vfs.clone(),
+        KEK,
+        COUNTERPART_KEK,
+        PAGE,
+        REALM,
+        small_pool(),
+    )
+    .await
+    .unwrap();
+    assert_eq!(db.mode(), DbMode::Standalone);
+
+    assert_eq!(attempts_on_a_failed_page(&db, &vfs).await, 1);
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn an_observer_open_retries_a_failed_page_the_configured_count() {
+    let mem = MemVfs::new();
+    seed_store(mem.clone()).await;
+    let vfs = TamperingVfs::new(mem);
+    let db = Db::open_observer(
+        vfs.clone(),
+        KEK,
+        PAGE,
+        REALM,
+        small_pool().with_observer_retry_count(2),
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(attempts_on_a_failed_page(&db, &vfs).await, 3);
+}
+
+// ── Sentinels and missing stores ──────────────────────────
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_counterpart_kek_open_holds_the_writer_sentinel() {
+    let vfs = MemVfs::new();
+    seed_store(vfs.clone()).await;
+    let _resumed = Db::open_existing_with_counterpart_kek(
+        vfs.clone(),
+        KEK,
+        COUNTERPART_KEK,
+        PAGE,
+        REALM,
+        OpenOptions::default(),
+    )
+    .await
+    .unwrap();
+
+    let second = Db::open(vfs, KEK, PAGE, REALM, OpenOptions::default()).await;
+    assert!(
+        matches!(second, Err(PagedbError::AlreadyOpen)),
+        "a second writer must be refused while a counterpart-key handle is open, got {:?}",
+        second.map(|db| db.mode())
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_counterpart_kek_open_is_refused_while_a_writer_is_open() {
+    let vfs = MemVfs::new();
+    seed_store(vfs.clone()).await;
+    let _writer = Db::open(vfs.clone(), KEK, PAGE, REALM, OpenOptions::default())
+        .await
+        .unwrap();
+
+    let resumed = Db::open_existing_with_counterpart_kek(
+        vfs,
+        KEK,
+        COUNTERPART_KEK,
+        PAGE,
+        REALM,
+        OpenOptions::default(),
+    )
+    .await;
+    assert!(
+        matches!(resumed, Err(PagedbError::AlreadyOpen)),
+        "a counterpart-key open must not attach beside a live writer, got {:?}",
+        resumed.map(|db| db.mode())
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_counterpart_kek_open_of_a_missing_store_reports_not_found() {
+    let vfs = MemVfs::new();
+
+    let resumed = Db::open_existing_with_counterpart_kek(
+        vfs.clone(),
+        KEK,
+        COUNTERPART_KEK,
+        PAGE,
+        REALM,
+        OpenOptions::default(),
+    )
+    .await;
+    assert!(
+        matches!(resumed, Err(PagedbError::NotFound)),
+        "resuming a rekey needs an existing store, got {:?}",
+        resumed.map(|db| db.mode())
+    );
+    let bootstrapped = vfs.open(MAIN_DB, OpenMode::Read).await.is_ok();
+    assert!(!bootstrapped, "a refused open must not create main.db");
+}
diff --git a/tests/restored_store_fork.rs b/tests/restored_store_fork.rs
new file mode 100644
index 0000000..5e28763
--- /dev/null
+++ b/tests/restored_store_fork.rs
@@ -0,0 +1,356 @@
+//! `rekey_into_writer` forks a restored directory into an independent
+//! Standalone writer under a fresh identity.
+//!
+//! The fork re-encrypts every page and segment under a new `kek_salt` and KEK.
+//! It writes the result into a replacement `main.db` and publishes it by rename.
+//!
+//! These tests cover:
+//! - what the fork carries
+//! - the identity it gets
+//! - who can fork
+//! - both sides of the rename commit point
+
+mod common;
+
+use std::path::Path;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use pagedb::vfs::tokio_backend::TokioVfs;
+use pagedb::vfs::{OpenMode, Vfs, VfsFile};
+use pagedb::{Db, DbMode, OpenOptions, PagedbError};
+
+use common::{KEK, PAGE, REALM, SEGMENT, describe, open_read_only, open_standalone, restore_into};
+
+const NEW_KEK: [u8; 32] = [7u8; 32];
+
+/// The `kek_salt` recorded in the active header of `dir/main.db`. Every page
+/// key derives from it, so two stores with different salts share no key.
+fn header_kek_salt(dir: &Path) -> [u8; 16] {
+    let bytes = std::fs::read(dir.join("main.db")).unwrap();
+    let mut salt = [0u8; 16];
+    salt.copy_from_slice(&bytes[32..48]);
+    salt
+}
+
+/// Everything the source held is readable through `db`.
+/// The segment keeps its page contents but gets a fresh id.
+async fn assert_carries_source_data(db: &Db<TokioVfs>, source_segment: [u8; 16]) {
+    let reader = db.begin_read().await.unwrap();
+    assert_eq!(
+        reader.get(b"k").await.unwrap().as_deref(),
+        Some(b"v".as_slice())
+    );
+    drop(reader);
+    let segment = db.open_segment(REALM, SEGMENT).await.unwrap();
+    assert!(segment.read_page(1).await.unwrap().starts_with(b"page-one"));
+    assert!(segment.read_page(2).await.unwrap().starts_with(b"page-two"));
+    assert_ne!(
+        segment.meta().segment_id,
+        source_segment,
+        "a forked segment must be re-encrypted under a fresh id"
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_restored_store_forks_into_an_independent_writer() {
+    let dst = tempfile::tempdir().unwrap();
+    let source_segment = restore_into(dst.path()).await;
+
+    let fork = open_read_only(dst.path())
+        .await
+        .unwrap()
+        .rekey_into_writer(NEW_KEK)
+        .await
+        .unwrap();
+    assert_eq!(fork.mode(), DbMode::Standalone);
+    assert_carries_source_data(&fork, source_segment).await;
+
+    let mut w = fork.begin_write().await.unwrap();
+    w.put(b"after-fork", b"written").await.unwrap();
+    w.commit().await.unwrap();
+    drop(fork);
+
+    let reopened = Db::open(
+        TokioVfs::new(dst.path()),
+        NEW_KEK,
+        PAGE,
+        REALM,
+        OpenOptions::default(),
+    )
+    .await
+    .unwrap();
+    assert_eq!(reopened.mode(), DbMode::Standalone);
+    assert_carries_source_data(&reopened, source_segment).await;
+    let reader = reopened.begin_read().await.unwrap();
+    assert_eq!(
+        reader.get(b"after-fork").await.unwrap().as_deref(),
+        Some(b"written".as_slice())
+    );
+    drop(reader);
+
+    let old_segment = dst
+        .path()
+        .join("seg")
+        .join(pagedb::hex::to_hex_lower(&source_segment));
+    assert!(
+        !old_segment.exists(),
+        "the source-identity segment must be swept once the fork is open"
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_fork_under_the_same_kek_shares_no_key_with_its_source() {
+    let dst = tempfile::tempdir().unwrap();
+    let _ = restore_into(dst.path()).await;
+    let source_salt = header_kek_salt(dst.path());
+
+    let fork = open_read_only(dst.path())
+        .await
+        .unwrap()
+        .rekey_into_writer(KEK)
+        .await
+        .unwrap();
+    drop(fork);
+
+    assert_ne!(
+        header_kek_salt(dst.path()),
+        source_salt,
+        "a fork keyed from the source salt would derive the source's page keys"
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_forked_store_does_not_open_under_the_source_kek() {
+    let dst = tempfile::tempdir().unwrap();
+    let _ = restore_into(dst.path()).await;
+    drop(
+        open_read_only(dst.path())
+            .await
+            .unwrap()
+            .rekey_into_writer(NEW_KEK)
+            .await
+            .unwrap(),
+    );
+
+    let under_source_key = open_standalone(dst.path()).await;
+    assert!(
+        matches!(under_source_key, Err(PagedbError::KeyMismatch)),
+        "the fork is keyed by the new KEK only, got {}",
+        describe(&under_source_key)
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_follower_store_forks_into_an_independent_writer() {
+    let dst = tempfile::tempdir().unwrap();
+    let source_segment = restore_into(dst.path()).await;
+    let follower = open_read_only(dst.path())
+        .await
+        .unwrap()
+        .promote_to_follower()
+        .await
+        .unwrap();
+
+    let fork = follower.rekey_into_writer(NEW_KEK).await.unwrap();
+    assert_eq!(fork.mode(), DbMode::Standalone);
+    assert_carries_source_data(&fork, source_segment).await;
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_fork_is_refused_while_another_reader_holds_the_store() {
+    let dst = tempfile::tempdir().unwrap();
+    let _ = restore_into(dst.path()).await;
+    let other_reader = open_read_only(dst.path()).await.unwrap();
+
+    let fork = open_read_only(dst.path())
+        .await
+        .unwrap()
+        .rekey_into_writer(NEW_KEK)
+        .await;
+    assert!(
+        matches!(fork, Err(PagedbError::ReadersPresent)),
+        "the fork replaces main.db and must not run under another reader, got {}",
+        describe(&fork)
+    );
+    drop(other_reader);
+
+    let standalone = open_standalone(dst.path()).await;
+    assert!(
+        matches!(standalone, Err(PagedbError::RestoredNotPromoted)),
+        "a refused fork must leave the directory restored, got {}",
+        describe(&standalone)
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_standalone_handle_cannot_fork() {
+    let dir = tempfile::tempdir().unwrap();
+    let db = open_standalone(dir.path()).await.unwrap();
+
+    let fork = db.rekey_into_writer(NEW_KEK).await;
+    assert!(
+        matches!(
+            fork,
+            Err(PagedbError::WrongMode {
+                operation: "rekey_into_writer",
+                required: DbMode::ReadOnly,
+                actual: DbMode::Standalone,
+            })
+        ),
+        "an original store already has its own identity, got {}",
+        describe(&fork)
+    );
+}
+
+/// Where [`ForkFaultVfs`] interrupts a fork.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum ForkFault {
+    /// Fails the rename that publishes the replacement `main.db`.
+    /// The fork stops at its commit point.
+    BeforePublication,
+    /// Lets the rename land, then fails the directory sync after it.
+    /// The fork's `main.db` is live, but the pager never adopts its segments.
+    AfterPublication,
+}
+
+#[derive(Clone)]
+struct ForkFaultVfs {
+    inner: TokioVfs,
+    fault: ForkFault,
+    published: Arc<AtomicBool>,
+}
+
+impl ForkFaultVfs {
+    fn new(dir: &Path, fault: ForkFault) -> Self {
+        Self {
+            inner: TokioVfs::new(dir),
+            fault,
+            published: Arc::new(AtomicBool::new(false)),
+        }
+    }
+}
+
+fn injected(what: &str) -> PagedbError {
+    PagedbError::Io(std::io::Error::other(format!(
+        "injected fork fault: {what}"
+    )))
+}
+
+impl Vfs for ForkFaultVfs {
+    type File = <TokioVfs as Vfs>::File;
+    type LockHandle = <TokioVfs as Vfs>::LockHandle;
+
+    async fn open(&self, path: &str, mode: OpenMode) -> pagedb::Result<Self::File> {
+        self.inner.open(path, mode).await
+    }
+
+    async fn remove(&self, path: &str) -> pagedb::Result<()> {
+        self.inner.remove(path).await
+    }
+
+    async fn rename(&self, from: &str, to: &str) -> pagedb::Result<()> {
+        let publishes_fork = from.ends_with("main.db.fork");
+        if publishes_fork && self.fault == ForkFault::BeforePublication {
+            return Err(injected("publication rename"));
+        }
+        self.inner.rename(from, to).await?;
+        if publishes_fork {
+            self.published.store(true, Ordering::SeqCst);
+        }
+        Ok(())
+    }
+
+    async fn list_dir(&self, path: &str) -> pagedb::Result<Vec<String>> {
+        self.inner.list_dir(path).await
+    }
+
+    async fn mkdir_all(&self, path: &str) -> pagedb::Result<()> {
+        self.inner.mkdir_all(path).await
+    }
+
+    async fn sync_dir(&self, path: &str) -> pagedb::Result<()> {
+        if self.fault == ForkFault::AfterPublication && self.published.swap(false, Ordering::SeqCst)
+        {
+            return Err(injected("sync after publication"));
+        }
+        self.inner.sync_dir(path).await
+    }
+
+    async fn lock_exclusive(&self, path: &str) -> pagedb::Result<Self::LockHandle> {
+        self.inner.lock_exclusive(path).await
+    }
+
+    async fn lock_shared(&self, path: &str) -> pagedb::Result<Self::LockHandle> {
+        self.inner.lock_shared(path).await
+    }
+
+    fn root_path(&self) -> Option<&Path> {
+        Vfs::root_path(&self.inner)
+    }
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_fork_that_fails_before_publication_leaves_the_store_restored() {
+    let dst = tempfile::tempdir().unwrap();
+    let _ = restore_into(dst.path()).await;
+    // A scratch left by an earlier interrupted fork must not block this one.
+    {
+        let vfs = TokioVfs::new(dst.path());
+        let mut stale = vfs
+            .open("/main.db.fork", OpenMode::CreateNew)
+            .await
+            .unwrap();
+        stale.write_at(0, b"stale fork scratch").await.unwrap();
+        stale.sync().await.unwrap();
+    }
+
+    let vfs = ForkFaultVfs::new(dst.path(), ForkFault::BeforePublication);
+    let reader = Db::open_read_only(vfs, KEK, PAGE, REALM, OpenOptions::default())
+        .await
+        .unwrap();
+    let fork = reader.rekey_into_writer(NEW_KEK).await;
+    assert!(fork.is_err(), "the injected rename failure must surface");
+
+    let standalone = open_standalone(dst.path()).await;
+    assert!(
+        matches!(standalone, Err(PagedbError::RestoredNotPromoted)),
+        "an unpublished fork must leave the directory restored, got {}",
+        describe(&standalone)
+    );
+    let reopened = open_read_only(dst.path()).await.unwrap();
+    let reader = reopened.begin_read().await.unwrap();
+    assert_eq!(
+        reader.get(b"k").await.unwrap().as_deref(),
+        Some(b"v".as_slice())
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_fork_interrupted_after_publication_opens_with_every_segment() {
+    let dst = tempfile::tempdir().unwrap();
+    let source_segment = restore_into(dst.path()).await;
+
+    let vfs = ForkFaultVfs::new(dst.path(), ForkFault::AfterPublication);
+    let reader = Db::open_read_only(vfs, KEK, PAGE, REALM, OpenOptions::default())
+        .await
+        .unwrap();
+    let fork = reader.rekey_into_writer(NEW_KEK).await;
+    assert!(
+        fork.is_err(),
+        "the injected post-publication fault must surface"
+    );
+
+    // The rename landed, so the fork is the store now. Its first open adopts
+    // the segments the fork wrote and publishes the ones its catalog names.
+    let reopened = Db::open(
+        TokioVfs::new(dst.path()),
+        NEW_KEK,
+        PAGE,
+        REALM,
+        OpenOptions::default(),
+    )
+    .await
+    .unwrap();
+    assert_carries_source_data(&reopened, source_segment).await;
+}
diff --git a/tests/restored_store_modes.rs b/tests/restored_store_modes.rs
new file mode 100644
index 0000000..85c1bdb
--- /dev/null
+++ b/tests/restored_store_modes.rs
@@ -0,0 +1,178 @@
+//! A restored directory keeps its restore mode across reopens.
+//!
+//! `restore_from` copies `main.db` byte for byte.
+//! The copy shares the source's `file_id`, `kek_salt`, and `mk_epoch`: one DEK and one nonce space.
+//! If both directories take independent writes, nonces repeat under one key.
+//! The restore mode in the A/B header prevents that.
+//!
+//! A restored directory reopens read-only, or as a Follower after `promote_to_follower`.
+//! Every Standalone open is refused with `RestoredNotPromoted`.
+//! The fork out of that state is covered in `restored_store_fork.rs`.
+
+mod common;
+
+use pagedb::vfs::tokio_backend::TokioVfs;
+use pagedb::{Db, DbMode, OpenOptions, PagedbError};
+
+use common::{KEK, PAGE, REALM, describe, open_read_only, open_standalone, restore_into};
+
+/// Authenticates nothing in these stores.
+/// A counterpart key matters only when the primary key cannot open the header.
+/// Any other value works here.
+const COUNTERPART_KEK: [u8; 32] = [8u8; 32];
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_restored_store_is_refused_as_a_standalone_writer() {
+    let dst = tempfile::tempdir().unwrap();
+    let _ = restore_into(dst.path()).await;
+
+    let standalone = open_standalone(dst.path()).await;
+    assert!(
+        matches!(standalone, Err(PagedbError::RestoredNotPromoted)),
+        "a restored copy shares the source nonce space and must not open as a writer, got {}",
+        describe(&standalone)
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_restored_store_reopens_read_only() {
+    let dst = tempfile::tempdir().unwrap();
+    let _ = restore_into(dst.path()).await;
+
+    let reopened = open_read_only(dst.path()).await.unwrap();
+    assert_eq!(reopened.mode(), DbMode::ReadOnly);
+    let reader = reopened.begin_read().await.unwrap();
+    assert_eq!(
+        reader.get(b"k").await.unwrap().as_deref(),
+        Some(b"v".as_slice())
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_restored_store_stays_restored_after_a_read_only_reopen() {
+    let dst = tempfile::tempdir().unwrap();
+    let _ = restore_into(dst.path()).await;
+    drop(open_read_only(dst.path()).await.unwrap());
+
+    let standalone = open_standalone(dst.path()).await;
+    assert!(
+        matches!(standalone, Err(PagedbError::RestoredNotPromoted)),
+        "a read-only reopen must not clear the restore mode, got {}",
+        describe(&standalone)
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_follower_store_is_refused_as_a_standalone_writer() {
+    let dst = tempfile::tempdir().unwrap();
+    let _ = restore_into(dst.path()).await;
+    let follower = open_read_only(dst.path())
+        .await
+        .unwrap()
+        .promote_to_follower()
+        .await
+        .unwrap();
+    assert_eq!(follower.mode(), DbMode::Follower);
+    drop(follower);
+
+    let standalone = open_standalone(dst.path()).await;
+    assert!(
+        matches!(standalone, Err(PagedbError::RestoredNotPromoted)),
+        "a Follower keeps the source identity and must not reopen as an independent writer, got {}",
+        describe(&standalone)
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_counterpart_kek_open_refuses_a_restored_store() {
+    let dst = tempfile::tempdir().unwrap();
+    let _ = restore_into(dst.path()).await;
+
+    let resumed = Db::open_existing_with_counterpart_kek(
+        TokioVfs::new(dst.path()),
+        KEK,
+        COUNTERPART_KEK,
+        PAGE,
+        REALM,
+        OpenOptions::default(),
+    )
+    .await;
+    assert!(
+        matches!(resumed, Err(PagedbError::RestoredNotPromoted)),
+        "a counterpart-key open is a Standalone writer and must refuse a restored store, got {}",
+        describe(&resumed)
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_follower_store_reopens_as_a_follower() {
+    let dst = tempfile::tempdir().unwrap();
+    let _ = restore_into(dst.path()).await;
+    drop(
+        open_read_only(dst.path())
+            .await
+            .unwrap()
+            .promote_to_follower()
+            .await
+            .unwrap(),
+    );
+
+    let follower = Db::open_follower(
+        TokioVfs::new(dst.path()),
+        KEK,
+        PAGE,
+        REALM,
+        OpenOptions::default(),
+    )
+    .await
+    .unwrap();
+    assert_eq!(follower.mode(), DbMode::Follower);
+    let reader = follower.begin_read().await.unwrap();
+    assert_eq!(
+        reader.get(b"k").await.unwrap().as_deref(),
+        Some(b"v".as_slice())
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_restored_store_opened_as_a_follower_stays_refused_as_a_writer() {
+    let dst = tempfile::tempdir().unwrap();
+    let _ = restore_into(dst.path()).await;
+    let follower = Db::open_follower(
+        TokioVfs::new(dst.path()),
+        KEK,
+        PAGE,
+        REALM,
+        OpenOptions::default(),
+    )
+    .await
+    .unwrap();
+    assert_eq!(follower.mode(), DbMode::Follower);
+    drop(follower);
+
+    let standalone = open_standalone(dst.path()).await;
+    assert!(
+        matches!(standalone, Err(PagedbError::RestoredNotPromoted)),
+        "a Follower open must not clear the restore mode, got {}",
+        describe(&standalone)
+    );
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn a_follower_open_of_a_missing_store_reports_not_found() {
+    let dir = tempfile::tempdir().unwrap();
+
+    let follower = Db::open_follower(
+        TokioVfs::new(dir.path()),
+        KEK,
+        PAGE,
+        REALM,
+        OpenOptions::default(),
+    )
+    .await;
+    assert!(
+        matches!(follower, Err(PagedbError::NotFound)),
+        "a Follower tracks an existing store and never creates one, got {}",
+        describe(&follower)
+    );
+}