diff --git a/.gitattributes b/.gitattributes
index d7136e4..baf4a54 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -4,3 +4,4 @@
 *.png binary
 gradlew text eol=lf
 *.sh text eol=lf
+*.zip binary
diff --git a/AGENTS.md b/AGENTS.md
index 8eac602..7cc3b0c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -10,7 +10,7 @@ This is a backup tool. A bug that corrupts a backup or touches the original worl
 
 - Restores are copy-only. They create a new world and never write into the source world.
 - The mod never deletes a backup on its own. Every cleanup goes through a user-reviewed plan, and labeled backups are always kept.
-- A destination must never read the world while it can still change. All capture work goes through `BackupCoordinator` and the save gate; do not add a path that copies world files outside that flow.
+- A destination must never read the world while it can still change. All capture work goes through `SerializedBackupCoordinator` and the save gate; do not add a path that copies world files outside that flow.
 - An operation that fails must leave the previous state intact. Report failure honestly rather than report success with content half-removed (this applies to remote deletes especially: if the remote refuses to stop exposing a backup, the delete failed).
 
 ### 2. Clean-room provenance
@@ -19,31 +19,39 @@ Another Git-based Minecraft backup mod exists ("Fast" + "Back", GPL-licensed). T
 
 ## Glossary
 
-- **world** — one single-player world directory, identified by a `WorldId` / `WorldIdentity`.
-- **capture** — the short phase that copies the world into an immutable source while saves are gated.
-- **save gate** — the mechanism that pauses autosave and world writes for the duration of a capture.
-- **destination** / **backend** — where a backup lands: a Git repository or a ZIP archive (`BackupBackend`).
-- **snapshot** — one Git commit of a world. One repository per world; an optional remote per world.
-- **archive** — one ZIP file with a SHA-256 checksum.
-- **manifest** — the metadata recorded with each backup, including the Minecraft version it was made with.
-- **catalog** — the persistent per-world index of backup records the UI reads.
-- **trigger** — what started a backup: manual, world exit, or schedule.
-- **label** — a user mark that protects a backup from cleanup.
-- **cleanup** — a user-confirmed deletion plan with a preview.
-- **import** / **recovery** — bringing old or external backups into the catalog, and restoring or deleting from it.
+- **world**: one single-player world directory, identified by a `WorldId` / `WorldIdentity`.
+- **capture**: the phase that copies the world into a private folder under `capture-temp`. It reads and hashes each file while it copies it; a capture of the open world reads every file a second time.
+- **save gate**: for the open world, the save before a capture and the autosave pause during it; autosave then goes back to how the player set it. The world exit backup captures after the final save instead.
+- **destination** / **backend**: where a backup lands: a Git repository or a ZIP archive (`BackupBackend`).
+- **snapshot**: one Git commit of a world. One repository per world; an optional remote per world.
+- **archive**: one ZIP file with a SHA-256 checksum.
+- **manifest**: the metadata recorded with each backup, including the Minecraft version it was made with.
+- **catalog**: the persistent index of backup records for all worlds (`catalog.json`) that the UI reads.
+- **inventory**: the files and hashes of a world's last backup; the next backup counts its changed files against it.
+- **trigger**: what started a backup: manual, world exit, or schedule.
+- **label**: a user mark that protects a backup from cleanup.
+- **cleanup**: a user-confirmed deletion plan with a preview.
+- **deletion mark**: an entry in `deleted-backups.txt` that keeps a deleted backup out of a catalog rebuild while any file of it is left.
+- **import** / **recovery**: bringing old or external backups into the catalog, and restoring or deleting from it.
 
 ## How a backup happens
 
-A trigger in the client runtime asks `BackupCoordinator` for a backup. The coordinator serializes operations per world and coalesces compatible concurrent triggers. The capture phase copies the world under the save gate on a capture thread; only after the capture is sealed does destination work start asynchronously. Each enabled backend (Git, ZIP) writes its artifact and returns a `DestinationResult`. The result is recorded in the catalog, which the UI screens render.
+A trigger in the runtime asks `SerializedBackupCoordinator` for a backup. For the open world, `LiveWorldBackups` has the server save, pauses autosave, and calls `prepareCapture`, which copies the world on a worker. When the copy is complete, autosave goes back to how the player set it, and `createPreparedBackup` queues the destination work. A world exit backup captures after the server's final save. A world that is not open goes through `createBackup`, which captures and then queues in the same way.
+
+The coordinator lets one capture copy a world at a time and writes the backups of one world in order, while different worlds run in parallel. It never merges triggers: each trigger makes its own backup.
+
+The capture (`FileSystemBackupCaptureFactory`) copies the world into `capture-temp` with up to four workers and hashes each file while it copies it. A capture of the open world reads and hashes every file a second time. A capture of a closed world reads a file a second time only when the file changed during the copy, or when its time is within 10 seconds of the newest file's or of the clock, or later. The caller says which kind it is (`CaptureKind`). When the world changed, it tries again and copies only the changed files. Destination work starts only after the capture is complete. Each enabled backend (`WorldGitSnapshotStore`, `ZipBackupBackend`) writes its copy from the capture and returns a `DestinationResult`. The coordinator records one `BackupRecord` in the catalog, updates the world's inventory, and deletes the capture. The UI screens render the catalog.
 
 ## Where code lives
 
 Two production source sets, split by Minecraft coupling:
 
-- `src/main` — the engine. Pure Java, zero Minecraft imports. `core` (coordinator, capture, gates), `storage/git` and `storage/zip` (backends), `storage/management` (cleanup and retention), `catalog`, `model`, `config`, `importing`, `recovery`.
-- `src/client` — the Fabric integration. `runtime` (lifecycle, save gates, scheduling), `ui` (screens), `settings`, `integration` (Mod Menu). New logic goes in `src/main` unless it needs a Minecraft class.
-- `src/test` — plain JUnit tests against `src/main` and client logic. No Minecraft runtime in tests; keep it that way by keeping logic out of `src/client`.
-- `src/main/resources/assets/worldarchive/lang` — every user-visible string. New UI text needs a lang entry, not a literal.
+- `src/main`: the engine. Pure Java, zero Minecraft imports. `core` (coordinator, capture, gates), `storage/git` and `storage/zip` (backends), `storage/management` (cleanup and retention), `catalog`, `model`, `config`, `settings` (the settings service, drafts and validation), `importing`, `recovery`, `runtime` (the service graph built from the settings, the open world's backups behind the small `LiveServer` port, and world identity), `ui/model` (screen logic without Minecraft: rows, filters, selections, summaries), and `support` (shared file, JSON, path, and async helpers; it depends on no other WorldArchive package).
+- `src/client`: the Fabric integration. `runtime` (the Fabric event adapter, toasts, navigation, and the screens' facade), `ui` (screens), `settings` (the settings screen and folder picker), `integration` (Mod Menu). New logic goes in `src/main` unless it needs a Minecraft class.
+- `src/test`: plain JUnit tests against `src/main` and client logic. No Minecraft runtime in tests; keep it that way by keeping logic out of `src/client`. The `e2e` package runs the real engine through the production `ServiceGraph` with real Git and real ZIP files (`Engine`, `TestWorld`); prefer it for backup, restore, delete, and cleanup behavior.
+- `src/main/resources/assets/worldarchive/lang`: every user-visible string. New UI text needs a lang entry, not a literal.
+
+Packages have no dependency cycles. The client `ui` package reaches the runtime and the settings only through `BackupClientFacade`.
 
 ## Build and verify
 
@@ -54,7 +62,7 @@ The gates enforce hard ceilings you should design within, not bump into:
 - 1,000 lines per Java file, 100 lines per method, cyclomatic complexity 15.
 - Every text file (including `.md` and `.yml`): no tabs, no trailing whitespace, final newline.
 
-Tests are focused. Test real behavior — capture ordering, retention math, catalog merges — not implementation detail or UI wiring. A change to backup, restore, or delete logic ships with a test for that behavior.
+Tests are focused. Test real behavior, such as capture ordering, retention math, and catalog merges, not implementation detail or UI wiring. A change to backup, restore, or delete logic ships with a test for that behavior.
 
 ## Taste
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9034c38..8b05ec0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,186 @@
 # Changelog
 
-## 0.4.0 (2026-09-15)
+## 0.4.0 (2026-09-22)
+
+### Changed
+
+- **Breaking.** WorldArchive no longer reads settings files from WorldArchive 0.1.0. The
+  settings screen says so and offers **Reset settings**, which keeps the old file. Settings
+  from 0.1.1 and newer load as before.
+- **Breaking.** WorldArchive no longer reads the shared Git repository of WorldArchive 0.1.0.
+  Its backups stay out of the backup list until you import them one time. Open **World
+  Backups** and click **Import**. Paste the local path of the repository into **Repository
+  address**, then click **Find Backups from Repository**. The default path was
+  `.minecraft/worldarchive/worldarchive.git`.
+- Each backup copies the world faster, up to four files at the same time, so autosave stops for
+  a shorter time. A backup of an open world checks every file twice. A backup of a closed world
+  reads each file once.
+- A backup never makes a Git or ZIP folder that you chose when that folder is missing, for
+  example because its drive is not connected. The backup to that folder fails and says that the
+  folder cannot be reached. When you save the settings with a new folder, WorldArchive makes it.
+  The default folders in `worldarchive` are still made when a backup needs them.
+- **Verify** tells you when the checksum file (`.sha256`) of a ZIP backup is missing.
+- Git backups are much faster. A backup starts a few Git commands instead of one for each file,
+  and it copies only new Git LFS files. The full repository check with `git fsck` no longer
+  runs after each backup. **Verify** still reads every file of the backup.
+- A ZIP backup writes its archive one time and reads it back one time to check it. ZIP backups
+  no longer use the temporary folder of your system.
+- A delete of many backups and the backup scan at start are much faster. A Git delete also
+  frees its space on this computer at once.
+- **World Backups** checks the storage of each world one time when you open it. Before, it
+  scanned every backup folder again each time you came back to it.
+- The schedule skips a world that did not run since its last backup, for example while the
+  game is paused. A skip makes no save and shows no message. Before, the save before each
+  scheduled backup changed the world, so the schedule never skipped.
+- **Sync**, **Verify**, and **Restore** now have a **Cancel** button.
+- The delete prompt names each backup by date and label. It also says how many copies are on
+  the Git remote and how many backups have a label. The delete removes the remote copies too.
+- A delete prompt no longer expires. WorldArchive deletes only the copies that the prompt
+  showed. If a backup changed after you confirmed, WorldArchive deletes nothing of it and
+  says why.
+- Delete results name each backup by date and label.
+- The cleanup confirmation shows the same date, label, and changes as the preview. The cleanup
+  result says why each kept backup stayed. It also warns you when Git could not free the space
+  yet.
+- The backup filter matches labels, triggers as the list shows them, such as "world exit",
+  and the start of a backup ID. It no longer matches the world name, which every row has.
+- **Review Cleanup** stays off until you save the storage limits. A storage limit accepts a
+  comma as the decimal mark, for example "1,5".
+- The settings file no longer stores the default backup folders. A copied or moved game folder
+  uses its own backup folders.
+- **Defaults** on the settings screen keeps your backup folders.
+- Before WorldArchive upgrades an older settings file, it keeps a copy named
+  `worldarchive.json.schema<number>.bak`.
+- The screens say "remote" where they said "GitHub". The **Worlds** tab now says that
+  **Sync** tries a failed upload again. Before, it said that the next backup does.
+
+### Fixed
+
+- A save that replaces `level.dat` while a backup copies the world no longer fails the backup.
+  The backup copies the file again.
+- WorldArchive can back up a world that contains a `.git` folder or file, for example a data
+  pack that is a Git clone. The backup leaves out every `.git` entry.
+- A saves folder or a world folder that is a symbolic link or a Windows junction now works.
+  WorldArchive uses the real folder. A link inside a world still stops a backup.
+- When a file name or a link stops a backup, the message names the file.
+- Cancel during a Git upload keeps the copies that are already complete.
+- When the backup list cannot be saved after a backup, the result says so. The next start lists
+  the backup again.
+- A second game that uses the same WorldArchive folder no longer deletes the world copy of a
+  backup that the first game makes.
+- A backup of the open world no longer turns autosave on again after `/save-off`.
+- A schedule that you turned off no longer gives warnings.
+- Menus no longer freeze while a backup runs. A change to a backup folder while a backup runs
+  gets a message that asks you to try again later.
+- An error in WorldArchive while a world opens, saves, or closes no longer reaches the game, also
+  a Java error such as a missing class. A backup that the error stops fails with a notice.
+- A backup that you start while the previous one gives autosave back no longer leaves autosave
+  off. WorldArchive asks you to try again in a moment.
+- One file with a date in the future, as in some downloaded maps, no longer lets a backup of a
+  closed world miss a change that the game made during the copy.
+- When you quit during a backup, the game waits at most about 35 seconds, world copy included.
+  A notice at the next start says what did not finish.
+- A world whose name has no readable text gets automatic backups. WorldArchive uses the folder
+  name.
+- A label keeps the exact text that you typed. Before, the credential filter could change it.
+- One damaged object in a Git repository, for example after a power loss, no longer makes every
+  later Git backup of that world fail.
+- A lock file that a stopped Git process left behind no longer blocks backups and deletes.
+- Hooks in a world's Git repository never run. A `core.hooksPath` in your global Git settings no
+  longer breaks Git backups, and WorldArchive no longer writes Git LFS hooks into that folder.
+- A remote that does not allow changes to `main` no longer makes uploads fail.
+- When a remote refuses a delete, nothing changes on the remote. Before, `main` could move
+  although the delete failed.
+- A delete of an imported Git backup also removes it from the world's remote.
+- A deleted Git backup no longer comes back after a restart.
+- A remote with more than 256 backups can be imported. When one backup of an import cannot be
+  downloaded, the other backups still import.
+- When this computer's Git copy of a backup is damaged, a restore uses the remote copy and
+  repairs the local one.
+- WorldArchive writes Git backups to disk before it reports them complete. It also writes the
+  Git LFS files that a restore or an import downloads to disk before it records them.
+- When **Verify** or a restore finds a damaged Git LFS file, WorldArchive moves it out of the
+  way. The next backup writes the file again, and a restore gets it again from the remote.
+  Before, later backups used the damaged file and reported success.
+- A file that holds the text of a Git LFS pointer, for example in a data pack cloned without
+  Git LFS, no longer makes every Git backup of the world fail.
+- A cancel right after a Git backup was written no longer reports that backup as failed. It
+  waits for its upload as pending sync.
+- **Open Folder** no longer makes an empty Git folder. The first Git backup also works when such
+  a folder is there.
+- A ZIP backup that lost its `.sha256` file stays in the list, and it verifies and restores.
+- The next backup removes the files that a crash left in a ZIP folder. It keeps the checksum
+  file (`.sha256`) of an archive that is missing for a moment, for example while a sync tool
+  delivers it.
+- **Verify** and import refuse a ZIP archive with a folder entry that has the name of a file. No
+  restore can write such an archive.
+- **Verify** and import refuse a ZIP backup whose checksum file is gone and whose end is cut
+  short, because other ZIP programs cannot open it. WorldArchive can still restore it.
+- The ZIP folder of a world can be a link to another drive. Before, the list and delete did
+  not see the archives there.
+- **Verify** says "unavailable" instead of "damaged" when it cannot read a ZIP archive, for
+  example on a drive that is not connected.
+- Messages for a full drive, a missing ZIP folder, and a failed delete say what happened and
+  what to do.
+- An import never writes into the folder that you choose. Identical copies of one archive
+  import one time.
+- On Windows, WorldArchive tries again for a short time when another program, such as an
+  antivirus scanner, holds a file.
+- A delete that leaves a copy now reports that it failed. Before, a backup whose remote refused
+  the delete counted as deleted.
+- A delete fails when a backup folder that you chose cannot be reached, for example on a drive
+  that is not connected, and nothing is made in its place. Before, the delete said that the
+  backup was deleted, and the backup came back later. If you remove a world's folder by hand
+  from WorldArchive's default backup folders, you can still delete its backups.
+- A deleted backup whose files are on a drive that was not connected at a start no longer comes
+  back when the drive is back.
+- A delete that you confirmed before a sync finished no longer deletes the remote copy that the
+  sync made. WorldArchive deletes nothing and says that the backup changed.
+- A delete of a ZIP backup whose archive has a new name now also deletes that archive when only
+  the checksum file kept the old name.
+- A failure message with a line break no longer stops a delete.
+- After you remove a world's remote from its settings, a delete removes the copies on this
+  computer and says that the copy on the old remote stays. A backup whose only copy is on that
+  remote stays in the list, and the result tells you to add the remote again.
+- Cleanup decides from the files on disk. A backup whose last copy is gone leaves the backup
+  list. Before, cleanup could promise a copy that no longer existed.
+- Cleanup never offers the last intact copy of a labeled backup. Before, it could offer the Git
+  copy of a labeled backup whose ZIP archive **Verify** had found damaged.
+- WorldArchive moves a damaged backup list to `catalog.json.corrupt-<time>`, keeps every entry
+  that it can still read, and lists the other backups from the files again. A Git copy that it
+  lists again stays synced when the world's remote has it. It still refuses a backup list from
+  a newer WorldArchive.
+- The backup scan continues when one repository or ZIP folder cannot be read. A backup that
+  completes during the scan keeps its record.
+- When no copy can restore a backup, the message gives the reason for each copy.
+- A restore from **Edit World** keeps the original world in the world list.
+- A settings save during a restore no longer makes the restore fail, and the unfinished folder
+  of a restore never becomes a world in the settings.
+- A default backup folder that is a link to a drive that is not connected no longer makes the
+  settings unreadable. Only the backups to that folder fail.
+- **Reset settings** keeps a settings file that can be read again, for example after another
+  game window fixed it.
+- A restore into a saves folder that is a link puts the new world into the real folder.
+- An import no longer reports a failure when only the world's remote could not be saved. The
+  backups are imported.
+- An import error shows the reason.
+- The backup list reloads when a background backup of the world completes. The filter keeps its
+  cursor while the list reloads.
+- WorldArchive never saves over a settings file that it cannot read. Backups pause, and the
+  settings screen shows the reason. **Reset settings** keeps the old file as
+  `worldarchive.json.unreadable-<time>`. After you fix the file and open the settings screen
+  again, backups start without a restart.
+- Settings that name a folder on a drive that is not connected now load.
+- A copy of a world folder gets its own backup history. Before, the copy and the original
+  shared one history.
+- Two open game windows no longer erase each other's settings changes.
+- World names such as "Basic Survival" or "Secret=Base" can be saved. WorldArchive looks for
+  credentials only in remote addresses.
+- The remote forms `ssh://user@host:port/path` and `host:path` are accepted, and so is a local
+  path that contains `%`.
+- An import no longer replaces a remote that a world already has.
+
+## 0.3.9 (2026-09-15)
 
 ### Changed
 
diff --git a/MODRINTH_DESCRIPTION.md b/MODRINTH_DESCRIPTION.md
index 8f89aba..7bddf5e 100644
--- a/MODRINTH_DESCRIPTION.md
+++ b/MODRINTH_DESCRIPTION.md
@@ -6,7 +6,7 @@ WorldArchive is a Fabric client mod for dependable backups of single-player Mine
 
 - Manual backups from the backup browser
 - Automatic backups when leaving a world
-- Optional scheduled backups (every 30 minutes by default, skipping unchanged worlds)
+- Optional scheduled backups every 30 minutes by default, skipped while the game is paused
 - Independent Git and ZIP destinations
 - Incremental Git snapshots with optional Git LFS and per-world remote sync
 - ZIP archives with SHA-256 integrity metadata, usable inside OneDrive, Google Drive, or similar synced folders
diff --git a/README.md b/README.md
index d7f5a4d..28e060c 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@ restore always creates a new world. Your original world is never changed.
 - Back up manually, on world exit, or on a schedule
 - Incremental Git snapshots, one repository per world
 - ZIP archives with SHA-256 checksums
-- Optional Git remote per world (HTTPS, SSH, file, or local path)
+- Optional Git remote per world, over HTTPS or SSH or in a local folder
 - ZIP folders can sit in OneDrive, Google Drive, or similar synced folders
 - Labels, verification, remote sync, and storage forecasts
 - Guided cleanup with a preview; labeled backups are always kept
@@ -54,13 +54,25 @@ feature is replaced there.
 | --- | --- | --- |
 | Manual | On | Backs up when you click. |
 | World exit | On | Backs up after the world saves and closes. |
-| Scheduled | Off | Backs up every 30 minutes. Skips unchanged worlds. |
+| Scheduled | Off | Backs up every 30 minutes while you play. Skips a world that did not run since its last backup, for example while the game is paused. |
 
 You can set triggers for Git and ZIP separately. You can also pause single
 worlds. Open **Settings** from the backup browser.
 
+A backup of the open world asks the game to save first. WorldArchive then
+pauses autosave while it copies the world, and sets autosave back the way you
+had it. A world exit backup copies the world after the last save. A backup of
+an open world checks every file twice, because the game can still write a file
+during the copy. A backup of a closed world reads each file once.
+
+A backup leaves out `session.lock`, the `.worldarchive` folder, and every
+`.git` folder or file in the world, such as a data pack that is a Git clone.
+A link inside a world stops the backup, and the message names the link. A
+saves folder or a world folder that is itself a symbolic link or a Windows
+junction works. WorldArchive uses the real folder.
+
 Git and ZIP destinations are independent. If one fails and the other succeeds,
-the good copy is kept. The backup is then reported as a partial success.
+WorldArchive keeps the good copy and reports a partial success.
 
 ## Git remotes
 
@@ -69,11 +81,49 @@ server:
 
 1. Create an empty repository on the server.
 2. Open the **Worlds** settings tab and select the world.
-3. Paste the clone URL into **Git remote**.
+3. Paste the clone address into **Git remote**.
+
+WorldArchive accepts these forms:
+
+- `https://host/path/world.git`
+- `ssh://user@host/path/world.git`, also with a port: `ssh://user@host:2222/path/world.git`
+- `user@host:path/world.git`
+- `file:///path/to/world.git`, or an absolute local path such as
+  `/backups/world.git` or `D:\Backups\world.git`
+
+A remote address must not contain a password, an access token, a query, or a
+fragment. WorldArchive never asks for your account credentials. Git gets them
+from its credential helper or your SSH key. If a push fails, WorldArchive marks
+the backup **pending sync**. You can retry it later.
+
+On the remote, each backup has its own branch,
+`backups/<date>/<time>Z-<backup id>`, and `main` shows the newest backup.
+
+## Delete
+
+**Delete** removes every copy of a backup: the ZIP archive, the Git copy on
+this computer, and the Git copy on the world's remote. It also moves `main` on
+the remote to the newest backup that is left. The prompt names the backups and
+says how many copies are on the remote.
 
-WorldArchive adds a short world code by itself. It never asks for your account
-credentials. If a push fails, the backup is marked **pending sync**. You can
-retry it later.
+If the remote cannot be reached or refuses the delete, nothing changes on the
+remote, and the Git copy on this computer stays too. WorldArchive still deletes
+the ZIP archive. The backup stays in the list with its Git copy, and the result
+says that the delete failed. Delete it again later.
+
+If the folder that holds a copy cannot be reached, for example on a drive that
+is not connected, the delete fails and nothing changes. Connect the drive and
+delete the backup again.
+
+If you removed the world's remote from its settings, a delete removes the
+copies on this computer and says that the copy on the old remote stays. A
+backup whose only copy is on that remote stays in the list until you add the
+remote again.
+
+A deleted backup does not come back after a restart. Two things can stay on
+the server: Git LFS files, which most hosts keep until you remove them in the
+repository settings, and the content of backups made with WorldArchive 0.3.1
+or older, which newer backups from those versions still reach.
 
 ## Storage and cleanup
 
@@ -81,23 +131,32 @@ Each world's backup browser has a **Storage** screen. It shows Git and ZIP
 usage, tracks the world's growth, and estimates when you will reach your
 budget.
 
-Guided cleanup keeps:
+By default, guided cleanup keeps:
 
-- One backup per day for the last 7 days
-- One per week for 4 earlier weeks
-- One per month for 12 earlier months
+- One backup for each of the 7 most recent days that have backups
+- Then one backup for each of the 4 most recent weeks that have older backups
+- Then one backup for each of the 12 most recent months that have older backups
 - Every labeled backup, always
-
-Within a period, manual backups and backups with more changed files win.
-Cleanup always shows a preview first. Nothing is deleted until you confirm.
-
-Cleanup frees space on this computer only. For a backup it lists, it removes
-the ZIP and the local Git copy. Copies on the configured remote are never
-touched: a backup that is synchronized stays listed as a remote-only entry, and
-the Delete button is the way to remove it from the remote. A backup with no copy
-left anywhere leaves the catalog. A protected backup is never deleted; when
-space is still short, cleanup can drop the local Git copies of protected
-backups, but only when each of them keeps a ZIP or a verified remote copy.
+- The newest verified backup
+
+You can change the three counts on the **Storage** screen. A week starts on
+Monday. Within a day, week, or month, cleanup keeps a manual backup first,
+then the backup with the most changed files. Cleanup always shows a preview
+first. Nothing is deleted until you confirm.
+
+Cleanup frees space on this computer only. For each backup it lists, it
+removes the ZIP archive and the Git copy on this computer. It never touches
+copies on the remote. A backup that has a copy on the remote stays in the list
+as a remote-only backup, and **Delete** is the way to remove that copy. If the
+remote cannot be reached when you confirm, the backups that need it keep every
+copy, and the result says why.
+
+Cleanup decides from the files on disk, not from the backup list. A backup
+with no copy left leaves the list. Cleanup never deletes a protected backup.
+When space is still short, it can offer the Git copies on this computer of all
+protected backups as one group. It does this only when each of them keeps a
+ZIP archive that **Verify** did not find damaged, or the same copy on the
+remote. You select the whole group or none of it.
 
 ## Minecraft versions
 
@@ -115,16 +174,26 @@ shipped have no recorded version, and the screen says that too.
 
 ## Recover old backups
 
-Open **Import** from the mod screen after a reinstall, a profile move, or a
-switch to a new computer. Every import is scanned first. You then pick the
-exact backups to bring in. Imports never overwrite your existing catalog.
-
-- **Repository**: paste a repository location (HTTPS, SSH, Git, file, or local
-  path, without credentials). WorldArchive copies and verifies the history,
-  then connects it as the world's remote.
-- **Choose Backup Folder**: pick a folder of WorldArchive ZIP archives.
-- **Find Stored Backups**: rebuild catalog entries and Git refs from local
-  managed storage. This search never touches the network.
+Open **World Backups** and click **Import** after a reinstall, a profile move,
+or a move to a new computer. Every import is scanned first. You then pick the
+exact backups to bring in. Imports never overwrite your existing backup list.
+
+- To import a Git repository, paste its address into **Repository address**
+  and click **Find Backups from Repository**. Any remote form above works, and
+  so does a `git://` address. WorldArchive copies and checks the backups. A
+  world that has no remote yet gets the repository as its remote.
+- To import ZIP archives, click **Choose Backup Folder** and pick their folder.
+  WorldArchive copies them into its ZIP folder and never writes into the folder
+  you pick.
+- To list the backups in WorldArchive's own folders that the backup list lacks,
+  click **Find Stored Backups**. This search uses the network only after
+  WorldArchive set a damaged backup list aside, to ask each world's remote which
+  of the Git backups it finds are there.
+
+WorldArchive 0.1.0 kept all worlds in one shared Git repository, by default
+`.minecraft/worldarchive/worldarchive.git`. This version does not read it on
+its own. Import it one time with **Find Backups from Repository** and its local
+path.
 
 ## Default paths
 
@@ -134,20 +203,49 @@ Paths are relative to the Minecraft instance directory, normally `.minecraft`.
 | --- | --- |
 | Configuration | `config/worldarchive.json` |
 | Per-world Git repositories | `worldarchive/git/<world-id>.git` |
-| ZIP archives | `worldarchive/archives/` |
+| ZIP archives | `worldarchive/archives/<world-id>/` |
 | Backup catalog | `worldarchive/catalog.json` |
 | Import source registry | `worldarchive/import-sources.json` |
 | Deleted-backup registry | `worldarchive/deleted-backups.txt` |
 | Change inventories | `worldarchive/inventories/` |
 | Storage forecast history | `worldarchive/storage-history/` |
-| Storage review cadence | `worldarchive/storage-reviews/` |
-| Temporary captures | `worldarchive/capture-temp/` |
+| Notice from the last session | `worldarchive/last-background-warning.txt` |
+| Temporary world copies | `worldarchive/capture-temp/<id>/` and `<id>.lock` |
+| Temporary Git files | `worldarchive/git/<world-id>.git/worldarchive/tmp/` |
+| Unfinished restores | `saves/.worldarchive-restore-*` |
 | World identity | `saves/<world>/.worldarchive/world.json` |
 
+Each running game makes one `capture-temp/<id>/` folder and locks it with
+`<id>.lock`. At start, WorldArchive removes the copies that a stopped game left
+behind. It never removes the folder of a game that still runs. Git temporary
+files, and a damaged Git LFS file that **Verify** or a restore moved out of the
+way, go before the next Git operation on that repository. A Git import
+preview and the output of Git commands use the temporary folder of your
+system for a short time.
+
+A crash during a restore can leave a `.worldarchive-restore-*` folder in
+`saves`. WorldArchive names such a folder in the game log but never deletes
+it. Delete it yourself when no restore runs.
+
+WorldArchive keeps a copy when it changes a file that it cannot use as is:
+`catalog.json.corrupt-<time>` for a damaged backup catalog,
+`config/worldarchive.json.unreadable-<time>` after a settings reset, and
+`config/worldarchive.json.schema<number>.bak` before a settings upgrade. From a
+damaged backup catalog, WorldArchive keeps every entry that it can still read.
+WorldArchive 0.3.9 and older also left `inventories/*.lock` files and a
+`storage-reviews/` folder, which this version does not use. You can delete
+them.
+
 Keep destination folders outside your world folders. Do not edit managed
 folders while the game runs. Do not use one Git destination from two computers
 at the same time.
 
+A backup never makes a Git or ZIP folder that you chose in the settings. When
+such a folder is missing, for example because its drive is not connected, the
+backup to it fails and says that the folder cannot be reached. WorldArchive
+makes the folder when you save the settings with it. The default folders are
+made when a backup needs them.
+
 ## Build the mod
 
 Install Java 25 and Git, then run:
diff --git a/src/client/java/dev/ishaanko/worldarchive/WorldArchiveClient.java b/src/client/java/dev/ishaanko/worldarchive/WorldArchiveClient.java
index c4d8874..84ba988 100644
--- a/src/client/java/dev/ishaanko/worldarchive/WorldArchiveClient.java
+++ b/src/client/java/dev/ishaanko/worldarchive/WorldArchiveClient.java
@@ -2,6 +2,7 @@
 
 import dev.ishaanko.worldarchive.runtime.WorldArchiveRuntime;
 import dev.ishaanko.worldarchive.settings.ClientSettingsAccess;
+import dev.ishaanko.worldarchive.ui.BackupClientFacade;
 import dev.ishaanko.worldarchive.ui.EditWorldBackupIntegration;
 import dev.ishaanko.worldarchive.ui.IconRowBackupIntegration;
 import dev.ishaanko.worldarchive.ui.SelectWorldBackupIntegration;
@@ -9,16 +10,18 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+/** Fabric's entry point: starts the settings and the runtime, and adds WorldArchive to the game's screens. */
 public final class WorldArchiveClient implements ClientModInitializer {
-    private static final Logger LOGGER = LoggerFactory.getLogger(WorldArchiveMetadata.MOD_NAME);
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
 
     @Override
     public void onInitializeClient() {
         ClientSettingsAccess.initialize();
         WorldArchiveRuntime runtime = WorldArchiveRuntime.initialize();
-        SelectWorldBackupIntegration.register(() -> runtime);
-        EditWorldBackupIntegration.register(() -> runtime);
-        IconRowBackupIntegration.register(() -> runtime, runtime::openBrowser);
-        LOGGER.info("{} initialized.", WorldArchiveMetadata.MOD_NAME);
+        BackupClientFacade facade = runtime.facade();
+        SelectWorldBackupIntegration.register(facade);
+        EditWorldBackupIntegration.register(facade);
+        IconRowBackupIntegration.register(facade, runtime::openBrowser);
+        LOGGER.info("WorldArchive initialized.");
     }
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/integration/WorldArchiveModMenu.java b/src/client/java/dev/ishaanko/worldarchive/integration/WorldArchiveModMenu.java
index 867d26d..29ab170 100644
--- a/src/client/java/dev/ishaanko/worldarchive/integration/WorldArchiveModMenu.java
+++ b/src/client/java/dev/ishaanko/worldarchive/integration/WorldArchiveModMenu.java
@@ -5,9 +5,10 @@
 import dev.ishaanko.worldarchive.runtime.WorldArchiveRuntime;
 import dev.ishaanko.worldarchive.ui.BackupWorldsScreen;
 
+/** Mod Menu's entry point: the mod's config button opens the World Backups screen. */
 public final class WorldArchiveModMenu implements ModMenuApi {
     @Override
     public ConfigScreenFactory<?> getModConfigScreenFactory() {
-        return parent -> new BackupWorldsScreen(parent, WorldArchiveRuntime.instance());
+        return parent -> new BackupWorldsScreen(parent, WorldArchiveRuntime.initialize().facade());
     }
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/BackgroundBackupWarnings.java b/src/client/java/dev/ishaanko/worldarchive/runtime/BackgroundBackupWarnings.java
deleted file mode 100644
index db60167..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/BackgroundBackupWarnings.java
+++ /dev/null
@@ -1,89 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import dev.ishaanko.worldarchive.core.AsyncTasks;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.BackupStatus;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Credential-safe notices for unattended backup outcomes. */
-final class BackgroundBackupWarnings {
-    private BackgroundBackupWarnings() {
-    }
-
-    static Optional<String> scheduled(BackupResult result, Throwable failure) {
-        return warning("Scheduled", result, failure);
-    }
-
-    static Optional<String> worldExit(BackupResult result, Throwable failure) {
-        return warning("World-exit", result, failure);
-    }
-
-    static ExitNotice worldExitNotice(BackupResult result, Throwable failure) {
-        if (isCancellation(failure)) {
-            return new ExitNotice(
-                    "Backup cancelled; world was saved",
-                    NoticeSeverity.WARNING);
-        }
-        if (failure != null || result == null) {
-            return new ExitNotice(
-                    "World save or backup did not complete",
-                    NoticeSeverity.ERROR);
-        }
-        return switch (Objects.requireNonNull(result.status(), "status")) {
-            case SUCCESS -> new ExitNotice(
-                    "Backup finished. You can safely quit Minecraft.",
-                    NoticeSeverity.SUCCESS);
-            case PARTIAL_SUCCESS -> new ExitNotice(
-                    "Backup created with warnings",
-                    NoticeSeverity.WARNING);
-            case FAILED -> new ExitNotice(
-                    "Backup failed; world was saved",
-                    NoticeSeverity.ERROR);
-            case SKIPPED -> new ExitNotice(
-                    "Backup skipped; world was saved",
-                    NoticeSeverity.WARNING);
-        };
-    }
-
-    static String worldExitStartedMessage() {
-        return "Creating backup... Keep Minecraft open until it finishes.";
-    }
-
-    /** A cancellation is the user's own choice, so it never becomes a warning. */
-    static boolean isCancellation(Throwable failure) {
-        return AsyncTasks.isCancellation(failure);
-    }
-
-    private static Optional<String> warning(
-            String trigger,
-            BackupResult result,
-            Throwable failure) {
-        if (isCancellation(failure)) {
-            return Optional.empty();
-        }
-        if (failure != null || result == null) {
-            return Optional.of(trigger + " backup did not complete");
-        }
-        BackupStatus status = Objects.requireNonNull(result.status(), "status");
-        return switch (status) {
-            case SUCCESS -> Optional.empty();
-            case PARTIAL_SUCCESS -> Optional.of(trigger + " backup completed with warnings");
-            case FAILED -> Optional.of(trigger + " backup failed");
-            case SKIPPED -> Optional.empty();
-        };
-    }
-
-    enum NoticeSeverity {
-        SUCCESS,
-        WARNING,
-        ERROR
-    }
-
-    record ExitNotice(String message, NoticeSeverity severity) {
-        ExitNotice {
-            Objects.requireNonNull(message, "message");
-            Objects.requireNonNull(severity, "severity");
-        }
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/BackupProgressToast.java b/src/client/java/dev/ishaanko/worldarchive/runtime/BackupProgressToast.java
index 60b1162..3e4fce3 100644
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/BackupProgressToast.java
+++ b/src/client/java/dev/ishaanko/worldarchive/runtime/BackupProgressToast.java
@@ -1,5 +1,6 @@
 package dev.ishaanko.worldarchive.runtime;
 
+import dev.ishaanko.worldarchive.model.OperationProgress;
 import java.util.List;
 import java.util.Objects;
 import java.util.OptionalDouble;
@@ -14,12 +15,12 @@
 import net.minecraft.util.FormattedCharSequence;
 
 /**
- * Backup toast that stays visible with a live progress bar while an unattended
- * backup runs, then shows the color-coded outcome briefly and hides. While the
- * backup can still be cancelled the toast draws a Cancel button. Toasts receive
- * no input of their own, so the monitor forwards screen clicks to
- * {@link #mouseClicked}. Progress arrives from worker threads; rendering reads
- * one immutable state snapshot.
+ * Backup toast that stays visible with a live progress bar while an unattended backup runs, then
+ * shows the color-coded outcome briefly and hides. While the backup can still be cancelled the
+ * toast draws a Cancel button. Toasts receive no input of their own, so the monitor forwards
+ * screen clicks to {@link #mouseClicked}, and only while the toast manager still shows this toast;
+ * {@link #getToken} is the toast itself for that check. Progress arrives from worker threads;
+ * rendering reads one immutable state snapshot.
  */
 final class BackupProgressToast implements Toast {
     private static final Component TITLE =
@@ -28,6 +29,9 @@ final class BackupProgressToast implements Toast {
     private static final Component CANCEL_LABEL =
             Component.translatable("screen.worldarchive.backup_toast.cancel");
 
+    private static final Component CANCELLING =
+            Component.translatable("screen.worldarchive.backup_toast.cancelling");
+
     private static final int WIDTH = 200;
 
     private static final int HEIGHT = 40;
@@ -82,33 +86,35 @@ final class BackupProgressToast implements Toast {
 
     private final int buttonWidth;
 
-    // Where the toast manager last placed this toast, in GUI coordinates. Written
-    // and read on the render thread only.
+    // Where the toast manager last placed this toast, in GUI coordinates, and whether it has
+    // placed it at all. Written and read on the render thread only.
     private float left;
 
     private float top;
 
+    private boolean placed;
+
     private long hideAtVisibleMs = Long.MAX_VALUE;
 
     private Toast.Visibility visibility = Toast.Visibility.SHOW;
 
-    private String renderedMessage;
+    private Component renderedMessage;
 
     private List<FormattedCharSequence> renderedLines = List.of();
 
     /** A toast that only shows an outcome; it has no Cancel button. */
-    BackupProgressToast(Minecraft minecraft, String message) {
+    BackupProgressToast(Minecraft minecraft, Component message) {
         this(minecraft, message, () -> { }, false);
     }
 
     /** A toast for a running backup; {@code cancel} asks that backup to stop. */
-    BackupProgressToast(Minecraft minecraft, String message, Runnable cancel) {
+    BackupProgressToast(Minecraft minecraft, Component message, Runnable cancel) {
         this(minecraft, message, cancel, true);
     }
 
     private BackupProgressToast(
             Minecraft minecraft,
-            String message,
+            Component message,
             Runnable cancel,
             boolean cancellable) {
         this.minecraft = Objects.requireNonNull(minecraft, "minecraft");
@@ -120,17 +126,17 @@ private BackupProgressToast(
         this.buttonLeft = WIDTH - BUTTON_RIGHT_MARGIN - buttonWidth;
     }
 
-    /** Updates the live phase text and completed fraction; ignored once finished or cancelling. */
-    void progress(String message, OptionalDouble fraction) {
-        Objects.requireNonNull(message, "message");
-        OptionalDouble clamped = clampFraction(fraction);
+    /** Shows the backup's current phase and completed fraction; ignored once finished or cancelling. */
+    void progress(OperationProgress progress) {
+        Component message = Component.literal(progress.message());
+        OptionalDouble fraction = clampFraction(progress.fraction());
         state.updateAndGet(current -> current.finished() || current.cancelling()
                 ? current
-                : new State(message, RUNNING_COLOR, clamped, false, current.cancellable(), false));
+                : new State(message, RUNNING_COLOR, fraction, false, current.cancellable(), false));
     }
 
     /** Switches to the outcome message; the toast hides a few seconds later. */
-    void finish(String message, BackgroundBackupWarnings.NoticeSeverity severity) {
+    void finish(Component message, Notice.Severity severity) {
         int color = switch (severity) {
             case SUCCESS -> SUCCESS_COLOR;
             case WARNING -> WARNING_COLOR;
@@ -145,14 +151,14 @@ void finish(String message, BackgroundBackupWarnings.NoticeSeverity severity) {
      */
     boolean mouseClicked(double mouseX, double mouseY) {
         State current = state.get();
-        if (!current.cancellable() || !overButton(mouseX, mouseY)) {
+        if (!placed || !current.cancellable() || !overButton(mouseX, mouseY)) {
             return false;
         }
         cancel.run();
         state.updateAndGet(latest -> latest.finished()
                 ? latest
                 : new State(
-                        "Cancelling backup...",
+                        CANCELLING,
                         RUNNING_COLOR,
                         latest.fraction(),
                         false,
@@ -161,9 +167,15 @@ boolean mouseClicked(double mouseX, double mouseY) {
         return true;
     }
 
+    @Override
+    public Object getToken() {
+        return this;
+    }
+
     @Override
     public float xPos(int screenWidth, float visiblePortion) {
         left = Toast.super.xPos(screenWidth, visiblePortion);
+        placed = true;
         return left;
     }
 
@@ -279,11 +291,9 @@ public int height() {
         return HEIGHT;
     }
 
-    private List<FormattedCharSequence> linesFor(String message) {
+    private List<FormattedCharSequence> linesFor(Component message) {
         if (!message.equals(renderedMessage)) {
-            List<FormattedCharSequence> split = font.split(
-                    Component.literal(message),
-                    WIDTH - TEXT_X * 2);
+            List<FormattedCharSequence> split = font.split(message, WIDTH - TEXT_X * 2);
             renderedLines = split.subList(0, Math.min(MAX_ROWS, split.size()));
             renderedMessage = message;
         }
@@ -302,7 +312,7 @@ private static OptionalDouble clampFraction(OptionalDouble fraction) {
      * the "Cancelling" text until the outcome arrives.
      */
     private record State(
-            String message,
+            Component message,
             int color,
             OptionalDouble fraction,
             boolean finished,
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/FabricLifecycle.java b/src/client/java/dev/ishaanko/worldarchive/runtime/FabricLifecycle.java
new file mode 100644
index 0000000..be5b414
--- /dev/null
+++ b/src/client/java/dev/ishaanko/worldarchive/runtime/FabricLifecycle.java
@@ -0,0 +1,154 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import java.nio.file.Path;
+import java.util.Objects;
+import java.util.function.Consumer;
+import net.fabricmc.fabric.api.client.event.lifecycle.v1.ClientLifecycleEvents;
+import net.fabricmc.fabric.api.client.event.lifecycle.v1.ClientTickEvents;
+import net.fabricmc.fabric.api.event.lifecycle.v1.ServerLifecycleEvents;
+import net.minecraft.client.server.IntegratedServer;
+import net.minecraft.server.MinecraftServer;
+import net.minecraft.world.level.storage.LevelResource;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Connects the integrated server's Fabric events to {@link LiveWorldBackups}, and quits the
+ * runtime with the game. Every handler catches what WorldArchive throws: vanilla runs the stopping
+ * event right before the world's final save, and anything thrown there, an error such as a
+ * {@link LinkageError} included, would skip that save.
+ */
+final class FabricLifecycle {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
+    private final LiveWorldBackups live;
+
+    private final Runnable shutdown;
+
+    // Guarded by this; the render and the server thread both use them.
+    private IntegratedServer runningServer;
+
+    private boolean quitting;
+
+    FabricLifecycle(LiveWorldBackups live, Runnable shutdown) {
+        this.live = Objects.requireNonNull(live, "live");
+        this.shutdown = Objects.requireNonNull(shutdown, "shutdown");
+    }
+
+    void register() {
+        ServerLifecycleEvents.SERVER_STARTED.register(this::serverStarted);
+        ServerLifecycleEvents.SERVER_STOPPING.register(server -> run(server, "closing the world", live::stopping));
+        ServerLifecycleEvents.AFTER_SAVE.register((server, flush, force) ->
+                run(server, "saving the world", port -> live.saved(port, flush, force)));
+        ServerLifecycleEvents.SERVER_STOPPED.register(this::serverStopped);
+        ClientTickEvents.END_CLIENT_TICK.register(client -> guard("checking for scheduled backups", live::tick));
+        ClientLifecycleEvents.CLIENT_STOPPING.register(client -> clientStopping());
+    }
+
+    private void serverStarted(MinecraftServer server) {
+        if (server instanceof IntegratedServer integrated) {
+            synchronized (this) {
+                runningServer = integrated;
+            }
+            run(server, "opening the world", live::started);
+        }
+    }
+
+    /** After the last world stopped, a game that is quitting shuts the runtime down: its wait shows as "Saving world". */
+    private void serverStopped(MinecraftServer server) {
+        if (!(server instanceof IntegratedServer integrated)) {
+            return;
+        }
+        run(server, "closing the world", live::stopped);
+        boolean quit;
+        synchronized (this) {
+            if (runningServer == integrated) {
+                runningServer = null;
+            }
+            quit = quitting && runningServer == null;
+        }
+        if (quit) {
+            guard("quitting", shutdown);
+        }
+    }
+
+    /** The game quits; with a world open, the runtime shuts down once that world stopped. */
+    private void clientStopping() {
+        boolean now;
+        synchronized (this) {
+            quitting = true;
+            now = runningServer == null;
+        }
+        if (now) {
+            guard("quitting", shutdown);
+        }
+    }
+
+    /**
+     * Runs a handler for an integrated server. Whatever it throws is logged and never reaches the
+     * server's stop and save; the save waiting on that server fails.
+     */
+    private void run(MinecraftServer server, String event, Consumer<LiveServer> handler) {
+        if (!(server instanceof IntegratedServer integrated)) {
+            return;
+        }
+        LiveServer port = new IntegratedLiveServer(integrated);
+        try {
+            handler.accept(port);
+        } catch (Throwable failure) {
+            LOGGER.error("WorldArchive failed while {}; the game goes on without that backup", event, failure);
+            guard("recovering from that failure", () -> live.abandon(port, failure));
+        }
+    }
+
+    private static void guard(String event, Runnable handler) {
+        try {
+            handler.run();
+        } catch (RuntimeException failure) {
+            LOGGER.error("WorldArchive failed while {}", event, failure);
+        }
+    }
+
+    /** Minecraft's integrated server as a {@link LiveServer}; two are equal when they wrap the same server. */
+    private record IntegratedLiveServer(IntegratedServer server) implements LiveServer {
+        @Override
+        public Path worldDirectory() {
+            return server.getWorldPath(LevelResource.ROOT);
+        }
+
+        @Override
+        public String levelName() {
+            return server.getWorldData().getLevelName();
+        }
+
+        @Override
+        public void execute(Runnable task) {
+            server.execute(task);
+        }
+
+        @Override
+        public boolean isServerThread() {
+            return server.isSameThread();
+        }
+
+        @Override
+        public void saveAll() {
+            server.saveEverything(false, true, true);
+        }
+
+        @Override
+        public boolean isAutoSave() {
+            return server.isAutoSave();
+        }
+
+        @Override
+        public void setAutoSave(boolean enabled) {
+            server.setAutoSave(enabled);
+        }
+
+        @Override
+        public int tickCount() {
+            return server.getTickCount();
+        }
+    }
+}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/LiveBackupSaveGate.java b/src/client/java/dev/ishaanko/worldarchive/runtime/LiveBackupSaveGate.java
deleted file mode 100644
index 790a70c..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/LiveBackupSaveGate.java
+++ /dev/null
@@ -1,186 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import java.util.Objects;
-import java.util.Optional;
-
-/** Pure owned-save state used to distinguish requested, exit, and unrelated vanilla saves. */
-final class LiveBackupSaveGate<K, T> {
-    private Entry<K, T> pending;
-
-    synchronized boolean queueRequested(K owner, T value) {
-        Objects.requireNonNull(owner, "owner");
-        Objects.requireNonNull(value, "value");
-        if (pending != null) {
-            return false;
-        }
-        pending = new Entry<>(owner, value, Phase.REQUESTED);
-        return true;
-    }
-
-    synchronized ExitInstall<T> installExit(K owner, T value) {
-        Objects.requireNonNull(owner, "owner");
-        Objects.requireNonNull(value, "value");
-        if (pending != null
-                && (pending.owner() != owner || pending.phase().exit())) {
-            return ExitInstall.rejected();
-        }
-        T displaced = pending == null ? null : pending.value();
-        pending = new Entry<>(owner, value, Phase.EXIT_WAITING);
-        return ExitInstall.installed(displaced);
-    }
-
-    synchronized boolean armRequested(K owner, T value) {
-        if (pending == null
-                || pending.owner() != owner
-                || pending.value() != value
-                || pending.phase() != Phase.REQUESTED) {
-            return false;
-        }
-        pending = new Entry<>(owner, value, Phase.REQUESTED_ARMED);
-        return true;
-    }
-
-    synchronized Optional<T> observeRequestedSave(
-            K owner,
-            boolean flush,
-            boolean force) {
-        if (pending == null
-                || pending.owner() != owner
-                || pending.phase() != Phase.REQUESTED_ARMED
-                || !flush
-                || !force) {
-            return Optional.empty();
-        }
-        T consumed = pending.value();
-        pending = null;
-        return Optional.of(consumed);
-    }
-
-    synchronized boolean observeExitSave(
-            K owner,
-            boolean flush,
-            boolean force) {
-        if (pending == null
-                || pending.owner() != owner
-                || !pending.phase().exit()
-                || !flush
-                || force) {
-            return false;
-        }
-        pending = new Entry<>(owner, pending.value(), Phase.EXIT_SAVED);
-        return true;
-    }
-
-    synchronized StopResult<T> stop(K owner) {
-        if (pending == null || pending.owner() != owner) {
-            return StopResult.none();
-        }
-        Entry<K, T> stopped = pending;
-        pending = null;
-        return switch (stopped.phase()) {
-            case REQUESTED, REQUESTED_ARMED -> StopResult.of(
-                    StopKind.REQUEST_ABANDONED, stopped.value());
-            case EXIT_WAITING -> StopResult.of(
-                    StopKind.EXIT_MISSING_SAVE, stopped.value());
-            case EXIT_SAVED -> StopResult.of(
-                    StopKind.EXIT_READY, stopped.value());
-        };
-    }
-
-    synchronized Optional<T> clear(K owner, T value) {
-        if (pending == null || pending.owner() != owner || pending.value() != value) {
-            return Optional.empty();
-        }
-        T cleared = pending.value();
-        pending = null;
-        return Optional.of(cleared);
-    }
-
-    synchronized Optional<T> clear() {
-        if (pending == null) {
-            return Optional.empty();
-        }
-        T cleared = pending.value();
-        pending = null;
-        return Optional.of(cleared);
-    }
-
-    synchronized Optional<T> pending() {
-        return pending == null ? Optional.empty() : Optional.of(pending.value());
-    }
-
-    synchronized boolean ownedBy(K owner) {
-        return pending != null && pending.owner() == owner;
-    }
-
-    synchronized boolean hasPending() {
-        return pending != null;
-    }
-
-    enum StopKind {
-        NONE,
-        REQUEST_ABANDONED,
-        EXIT_MISSING_SAVE,
-        EXIT_READY
-    }
-
-    record ExitInstall<T>(boolean installed, Optional<T> displaced) {
-        ExitInstall {
-            displaced = Objects.requireNonNull(displaced, "displaced");
-            if (!installed && displaced.isPresent()) {
-                throw new IllegalArgumentException("Rejected exit installation cannot displace a save");
-            }
-        }
-
-        private static <T> ExitInstall<T> installed(T displaced) {
-            return new ExitInstall<>(true, Optional.ofNullable(displaced));
-        }
-
-        private static <T> ExitInstall<T> rejected() {
-            return new ExitInstall<>(false, Optional.empty());
-        }
-    }
-
-    record StopResult<T>(StopKind kind, Optional<T> value) {
-        StopResult {
-            kind = Objects.requireNonNull(kind, "kind");
-            value = Objects.requireNonNull(value, "value");
-            if ((kind == StopKind.NONE) != value.isEmpty()) {
-                throw new IllegalArgumentException("Only an empty stop result may omit its value");
-            }
-        }
-
-        private static <T> StopResult<T> none() {
-            return new StopResult<>(StopKind.NONE, Optional.empty());
-        }
-
-        private static <T> StopResult<T> of(StopKind kind, T value) {
-            return new StopResult<>(kind, Optional.of(value));
-        }
-    }
-
-    private enum Phase {
-        REQUESTED(false),
-        REQUESTED_ARMED(false),
-        EXIT_WAITING(true),
-        EXIT_SAVED(true);
-
-        private final boolean exit;
-
-        Phase(boolean exit) {
-            this.exit = exit;
-        }
-
-        private boolean exit() {
-            return exit;
-        }
-    }
-
-    private record Entry<K, T>(K owner, T value, Phase phase) {
-        private Entry {
-            Objects.requireNonNull(owner, "owner");
-            Objects.requireNonNull(value, "value");
-            Objects.requireNonNull(phase, "phase");
-        }
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/PreparedOwnership.java b/src/client/java/dev/ishaanko/worldarchive/runtime/PreparedOwnership.java
deleted file mode 100644
index ba458da..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/PreparedOwnership.java
+++ /dev/null
@@ -1,13 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import java.util.Objects;
-
-/** Binds an externally prepared capture to its originating state and configuration permit. */
-record PreparedOwnership(
-        RuntimeState state,
-        RuntimeConfigurationGate.Permit permit) {
-    PreparedOwnership {
-        Objects.requireNonNull(state, "state");
-        Objects.requireNonNull(permit, "permit");
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RestoredWorldTransition.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RestoredWorldTransition.java
deleted file mode 100644
index 1b31c0b..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RestoredWorldTransition.java
+++ /dev/null
@@ -1,26 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import java.util.Objects;
-import java.util.function.BooleanSupplier;
-import java.util.function.Consumer;
-
-/** Runs post-restore navigation only after any active world has closed. */
-final class RestoredWorldTransition {
-    private RestoredWorldTransition() {
-    }
-
-    static void afterLeavingActiveWorld(
-            BooleanSupplier activeWorld,
-            Runnable disconnect,
-            Consumer<Boolean> continuation) {
-        Objects.requireNonNull(activeWorld, "activeWorld");
-        Objects.requireNonNull(disconnect, "disconnect");
-        Objects.requireNonNull(continuation, "continuation");
-
-        boolean leftActiveWorld = activeWorld.getAsBoolean();
-        if (leftActiveWorld) {
-            disconnect.run();
-        }
-        continuation.accept(leftActiveWorld);
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RetryGate.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RetryGate.java
deleted file mode 100644
index cb5e505..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RetryGate.java
+++ /dev/null
@@ -1,66 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import java.time.Duration;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Single-flight retry throttle whose attempt tokens reject stale completions. */
-final class RetryGate<K> {
-    private final long retryDelayNanos;
-
-    private Attempt<K> pending;
-
-    private long nextAttemptNanos;
-
-    private boolean throttled;
-
-    RetryGate(Duration retryDelay) {
-        Objects.requireNonNull(retryDelay, "retryDelay");
-        if (retryDelay.isNegative()) {
-            throw new IllegalArgumentException("retryDelay must not be negative");
-        }
-        retryDelayNanos = retryDelay.toNanos();
-    }
-
-    synchronized Optional<Attempt<K>> tryStart(K owner, long nowNanos) {
-        Objects.requireNonNull(owner, "owner");
-        if (pending != null || throttled && nowNanos < nextAttemptNanos) {
-            return Optional.empty();
-        }
-        pending = new Attempt<>(owner);
-        nextAttemptNanos = saturatingAdd(nowNanos, retryDelayNanos);
-        throttled = true;
-        return Optional.of(pending);
-    }
-
-    synchronized boolean complete(Attempt<K> attempt) {
-        Objects.requireNonNull(attempt, "attempt");
-        if (pending != attempt) {
-            return false;
-        }
-        pending = null;
-        return true;
-    }
-
-    synchronized void reset() {
-        pending = null;
-        nextAttemptNanos = 0L;
-        throttled = false;
-    }
-
-    private static long saturatingAdd(long left, long right) {
-        return left > Long.MAX_VALUE - right ? Long.MAX_VALUE : left + right;
-    }
-
-    static final class Attempt<K> {
-        private final K owner;
-
-        private Attempt(K owner) {
-            this.owner = owner;
-        }
-
-        K owner() {
-            return owner;
-        }
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RunningGameVersion.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RunningGameVersion.java
index cf5fe48..5a46e12 100644
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RunningGameVersion.java
+++ b/src/client/java/dev/ishaanko/worldarchive/runtime/RunningGameVersion.java
@@ -5,11 +5,12 @@
 import net.minecraft.SharedConstants;
 import net.minecraft.WorldVersion;
 
-public final class RunningGameVersion {
+/** The Minecraft version that runs, which each new backup records; empty when the game cannot tell. */
+final class RunningGameVersion {
     private RunningGameVersion() {
     }
 
-    public static Optional<GameVersionStamp> current() {
+    static Optional<GameVersionStamp> current() {
         try {
             WorldVersion version = SharedConstants.getCurrentVersion();
             if (version == null) {
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeActionContextRegistry.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeActionContextRegistry.java
deleted file mode 100644
index 27ce4de..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeActionContextRegistry.java
+++ /dev/null
@@ -1,29 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import dev.ishaanko.worldarchive.ui.BackupWorldContext;
-import java.util.Objects;
-import java.util.Set;
-import java.util.concurrent.ConcurrentHashMap;
-
-/** Marks catalog-only browser contexts that must never offer source-world creation. */
-final class RuntimeActionContextRegistry {
-    private final Set<BackupWorldContext> actionOnly = ConcurrentHashMap.newKeySet();
-
-    BackupWorldContext markActionOnly(BackupWorldContext context) {
-        BackupWorldContext value = Objects.requireNonNull(context, "context");
-        actionOnly.add(value);
-        return value;
-    }
-
-    void allowSourceActions(BackupWorldContext context) {
-        actionOnly.remove(Objects.requireNonNull(context, "context"));
-    }
-
-    boolean sourceActionsAllowed(BackupWorldContext context) {
-        return !actionOnly.contains(Objects.requireNonNull(context, "context"));
-    }
-
-    void clear() {
-        actionOnly.clear();
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackgroundBackupMonitor.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackgroundBackupMonitor.java
index b42eadb..44d3ab9 100644
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackgroundBackupMonitor.java
+++ b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackgroundBackupMonitor.java
@@ -1,289 +1,189 @@
 package dev.ishaanko.worldarchive.runtime;
 
-import dev.ishaanko.worldarchive.WorldArchiveMetadata;
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.ui.model.ProgressState;
+import dev.ishaanko.worldarchive.model.OperationProgress;
+import dev.ishaanko.worldarchive.model.SafeText;
 import java.io.IOException;
-import java.nio.file.Path;
-import java.time.Duration;
 import java.util.Objects;
-import java.util.Optional;
 import java.util.Set;
-import java.util.concurrent.CancellationException;
-import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentMap;
-import java.util.concurrent.ExecutionException;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.TimeoutException;
 import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.concurrent.atomic.AtomicReference;
-import java.util.function.BiConsumer;
 import java.util.function.BooleanSupplier;
+import net.fabricmc.fabric.api.client.event.lifecycle.v1.ClientTickEvents;
 import net.fabricmc.fabric.api.client.screen.v1.ScreenEvents;
 import net.fabricmc.fabric.api.client.screen.v1.ScreenMouseEvents;
 import net.minecraft.ChatFormatting;
 import net.minecraft.client.Minecraft;
-import net.minecraft.client.gui.screens.Screen;
 import net.minecraft.client.input.MouseButtonEvent;
 import net.minecraft.network.chat.Component;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-/** Tracks background backups and reports their results to the client. */
-final class RuntimeBackgroundBackupMonitor {
-    private static final Logger LOGGER =
-            LoggerFactory.getLogger(WorldArchiveMetadata.MOD_NAME);
+/**
+ * Shows the player what background backups do: a toast with progress and a Cancel button for each
+ * world-exit backup, then its outcome; a chat line for a scheduled backup's warning; and at the next
+ * start, as a toast, the notice of a backup the game closed on. A notice that arrives while the game
+ * closes is kept for that next start instead.
+ */
+final class RuntimeBackgroundBackupMonitor implements BackgroundReports {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
 
     private static final int LEFT_MOUSE_BUTTON = 0;
 
     private final Minecraft minecraft;
 
-    private final RuntimeNoticeStore noticeStore;
+    private final RuntimeNoticeStore notices;
 
-    private final BooleanSupplier closed;
+    private final BooleanSupplier closing;
 
-    private final BiConsumer<String, Throwable> failureLogger;
+    /** The toasts whose Cancel button a click may press. Render thread only. */
+    private final Set<BackupProgressToast> cancellable = ConcurrentHashMap.newKeySet();
 
-    private final Set<CompletableFuture<BackupResult>> exitWork =
-            ConcurrentHashMap.newKeySet();
+    private final AtomicBoolean keptNoticeShown = new AtomicBoolean();
 
-    private final AtomicReference<Optional<String>> warning =
-            new AtomicReference<>(Optional.empty());
+    RuntimeBackgroundBackupMonitor(Minecraft minecraft, RuntimeNoticeStore notices, BooleanSupplier closing) {
+        this.minecraft = Objects.requireNonNull(minecraft, "minecraft");
+        this.notices = Objects.requireNonNull(notices, "notices");
+        this.closing = Objects.requireNonNull(closing, "closing");
+    }
 
-    private final AtomicReference<Optional<String>> retainedWarning =
-            new AtomicReference<>(Optional.empty());
+    /** Routes screen clicks to the toasts, and shows the notice kept from the last session once a screen is up. */
+    void register() {
+        // Toasts get no input of their own; a click on a Cancel button is consumed here.
+        ScreenEvents.AFTER_INIT.register((client, screen, width, height) -> ScreenMouseEvents.allowMouseClick(screen)
+                .register((ignoredScreen, event) -> !clickToast(event)));
+        ClientTickEvents.END_CLIENT_TICK.register(client -> showKeptNotice());
+    }
 
-    private final AtomicBoolean retainedWarningShown = new AtomicBoolean();
+    @Override
+    public ExitReport exitStarted(Runnable cancel) {
+        ExitToast report = new ExitToast(cancel);
+        onRenderThread(report::show);
+        return report;
+    }
 
-    // One progress toast per tracked backup, keyed by that backup's result future,
-    // so overlapping backups each finish their own toast.
-    private final ConcurrentMap<Object, BackupProgressToast> activeToasts =
-            new ConcurrentHashMap<>();
+    @Override
+    public void exitNotMade(Notice notice) {
+        if (closing.getAsBoolean()) {
+            keep(notice);
+        } else {
+            onRenderThread(() -> showOutcome(null, notice));
+        }
+    }
 
-    RuntimeBackgroundBackupMonitor(
-            Minecraft minecraft,
-            Path noticeFile,
-            BooleanSupplier closed,
-            BiConsumer<String, Throwable> failureLogger) {
-        this.minecraft = Objects.requireNonNull(minecraft, "minecraft");
-        this.noticeStore = new RuntimeNoticeStore(
-                Objects.requireNonNull(noticeFile, "noticeFile"));
-        this.closed = Objects.requireNonNull(closed, "closed");
-        this.failureLogger = Objects.requireNonNull(failureLogger, "failureLogger");
+    @Override
+    public void scheduledWarning(Notice notice) {
+        onRenderThread(() -> minecraft.gui.chatListener().handleSystemMessage(
+                Component.translatable("screen.worldarchive.notice.chat", text(notice)).withStyle(ChatFormatting.YELLOW),
+                false));
+    }
+
+    /** Keeps a notice for the next start, because the game closes before the player could read it. */
+    void keep(Notice notice) {
         try {
-            retainedWarning.set(noticeStore.load());
-        } catch (IOException exception) {
-            LOGGER.warn("Stored background backup notice could not be loaded");
+            notices.keep(notice);
+        } catch (IOException failure) {
+            LOGGER.warn("A notice for the next start could not be kept: {}",
+                    SafeText.from(failure, "no reason was given", 300));
         }
-        ScreenEvents.AFTER_INIT.register(this::routeScreenClicks);
     }
 
-    // Toasts get no input of their own, so every screen forwards its clicks to the
-    // active progress toasts. A click on a Cancel button is consumed here.
-    private void routeScreenClicks(Minecraft ignored, Screen screen, int width, int height) {
-        ScreenMouseEvents.allowMouseClick(screen)
-                .register((ignoredScreen, event) -> !clickToast(event));
+    /** Text the player reads for a notice, in the game's language. */
+    static Component text(Notice notice) {
+        return Component.translatable(notice.key(), notice.arguments().toArray());
     }
 
     private boolean clickToast(MouseButtonEvent event) {
-        if (event.button() != LEFT_MOUSE_BUTTON || closed.getAsBoolean()) {
+        if (event.button() != LEFT_MOUSE_BUTTON || closing.getAsBoolean()) {
             return false;
         }
-        for (BackupProgressToast toast : activeToasts.values()) {
-            if (toast.mouseClicked(event.x(), event.y())) {
+        for (BackupProgressToast toast : cancellable) {
+            if (shown(toast) && toast.mouseClicked(event.x(), event.y())) {
                 return true;
             }
         }
         return false;
     }
 
-    Optional<String> warning() {
-        return warning.get();
-    }
-
-    void trackExit(CompletableFuture<BackupResult> result) {
-        Objects.requireNonNull(result, "result");
-        exitWork.add(result);
-        result.whenComplete((value, throwable) -> {
-            observeExitResult(result, value, throwable);
-            exitWork.remove(result);
-        });
+    /** The first time a screen is up, without the loading overlay, shows the notice the last session kept. */
+    private void showKeptNotice() {
+        if (minecraft.gui.overlay() != null || minecraft.gui.screen() == null
+                || !keptNoticeShown.compareAndSet(false, true)) {
+            return;
+        }
+        try {
+            notices.showKept(notice -> showOutcome(null, notice));
+        } catch (IOException failure) {
+            LOGGER.warn("The notice kept from the last session could not be read: {}",
+                    SafeText.from(failure, "no reason was given", 300));
+        }
     }
 
-    boolean awaitExitWork(Duration timeout) {
-        Objects.requireNonNull(timeout, "timeout");
-        if (timeout.isNegative()) {
-            throw new IllegalArgumentException("timeout must not be negative");
+    /**
+     * Finishes {@code toast} with the outcome. A toast the toast manager no longer shows, because
+     * the player left a world since, is replaced by a new one, so the outcome is always seen.
+     */
+    private void showOutcome(BackupProgressToast toast, Notice notice) {
+        BackupProgressToast target = toast;
+        if (target != null) {
+            cancellable.remove(target);
         }
-        long remainingNanos = timeout.toNanos();
-        long deadline = System.nanoTime() + remainingNanos;
-        boolean interrupted = false;
-        try {
-            while (!exitWork.isEmpty()) {
-                CompletableFuture<?>[] work =
-                        exitWork.toArray(CompletableFuture[]::new);
-                if (work.length == 0) {
-                    return true;
-                }
-                try {
-                    CompletableFuture.allOf(work).get(
-                            remainingNanos,
-                            TimeUnit.NANOSECONDS);
-                } catch (ExecutionException | CancellationException exception) {
-                    // A completed failure still counts as settled exit work.
-                } catch (TimeoutException exception) {
-                    return false;
-                } catch (InterruptedException exception) {
-                    interrupted = true;
-                    return false;
-                }
-                remainingNanos = deadline - System.nanoTime();
-                if (remainingNanos <= 0 && !exitWork.isEmpty()) {
-                    return false;
-                }
-            }
-            return true;
-        } finally {
-            if (interrupted) {
-                Thread.currentThread().interrupt();
-            }
+        if (target == null || !shown(target)) {
+            target = new BackupProgressToast(minecraft, text(notice));
+            minecraft.gui.toastManager().addToast(target);
         }
+        target.finish(text(notice), notice.severity());
+    }
+
+    /** True while the toast manager shows or queues the toast. */
+    private boolean shown(BackupProgressToast toast) {
+        return minecraft.gui.toastManager().getToast(BackupProgressToast.class, toast) == toast;
     }
 
-    void observeScheduledResult(BackupResult result, Throwable throwable) {
-        Optional<String> current =
-                BackgroundBackupWarnings.scheduled(result, throwable);
-        warning.set(current);
-        if (current.isPresent() && !closed.getAsBoolean()) {
+    private void onRenderThread(Runnable task) {
+        if (!closing.getAsBoolean()) {
             minecraft.execute(() -> {
-                if (!closed.getAsBoolean()) {
-                    showClientWarning(current.orElseThrow());
+                if (!closing.getAsBoolean()) {
+                    task.run();
                 }
             });
         }
     }
 
-    void observeExitResult(BackupResult result, Throwable throwable) {
-        observeExitResult(null, result, throwable);
-    }
+    /** The toast of one world-exit backup; progress may arrive before the render thread made the toast. */
+    private final class ExitToast implements ExitReport {
+        private final Runnable cancel;
 
-    private void observeExitResult(
-            Object progressKey,
-            BackupResult result,
-            Throwable throwable) {
-        if (BackgroundBackupWarnings.isCancellation(throwable)) {
-            LOGGER.info("World-exit backup was cancelled");
-        } else if (throwable != null) {
-            failureLogger.accept(
-                    "World-exit backup did not complete",
-                    throwable);
-        } else if (result == null) {
-            LOGGER.warn("World-exit backup completed without a result");
-        }
-        Optional<String> current =
-                BackgroundBackupWarnings.worldExit(result, throwable);
-        BackgroundBackupWarnings.ExitNotice notice =
-                BackgroundBackupWarnings.worldExitNotice(result, throwable);
-        try {
-            if (current.isPresent()) {
-                noticeStore.retain(current.orElseThrow());
-            } else {
-                noticeStore.clear();
-            }
-        } catch (IOException exception) {
-            failureLogger.accept(
-                    "World-exit backup notice could not be stored",
-                    exception);
-        }
-        warning.set(current);
-        enqueueBackupNotice(progressKey, notice);
-    }
+        private volatile BackupProgressToast toast;
 
-    void showRetainedWarning() {
-        if (closed.getAsBoolean()) {
-            return;
-        }
-        Optional<String> retained = retainedWarning.get();
-        if (retained.isEmpty()
-                || !retainedWarningShown.compareAndSet(false, true)) {
-            return;
+        private ExitToast(Runnable cancel) {
+            this.cancel = Objects.requireNonNull(cancel, "cancel");
         }
-        showClientWarning(retained.orElseThrow());
-        retainedWarning.compareAndSet(retained, Optional.empty());
-        try {
-            noticeStore.clear();
-        } catch (IOException exception) {
-            failureLogger.accept(
-                    "Background backup notice could not be cleared",
-                    exception);
-        }
-    }
 
-    /**
-     * Shows the persistent progress toast for an unattended backup that just started.
-     * {@code cancel} is run when the user presses the toast's Cancel button.
-     */
-    void beginBackupProgress(String message, Object progressKey, Runnable cancel) {
-        Objects.requireNonNull(progressKey, "progressKey");
-        Objects.requireNonNull(cancel, "cancel");
-        if (closed.getAsBoolean()) {
-            return;
+        private void show() {
+            BackupProgressToast created = new BackupProgressToast(
+                    minecraft, text(BackgroundNotices.exitStarted()), cancel);
+            toast = created;
+            cancellable.add(created);
+            minecraft.gui.toastManager().addToast(created);
         }
-        minecraft.execute(() -> {
-            if (closed.getAsBoolean()) {
-                return;
-            }
-            BackupProgressToast toast = new BackupProgressToast(minecraft, message, cancel);
-            activeToasts.put(progressKey, toast);
-            minecraft.gui.toastManager().addToast(toast);
-        });
-    }
 
-    /** Feeds that backup's progress toast; safe to call from any worker thread. */
-    ProgressListener backupProgressListener(Object progressKey) {
-        Objects.requireNonNull(progressKey, "progressKey");
-        return progress -> {
-            BackupProgressToast toast = activeToasts.get(progressKey);
-            if (toast != null) {
-                ProgressState state = ProgressState.from(progress);
-                toast.progress(state.message(), state.fraction());
+        @Override
+        public void onProgress(OperationProgress progress) {
+            BackupProgressToast current = toast;
+            if (current != null) {
+                current.progress(progress);
             }
-        };
-    }
-
-    private void enqueueBackupNotice(
-            Object progressKey,
-            BackgroundBackupWarnings.ExitNotice notice) {
-        if (closed.getAsBoolean()) {
-            return;
         }
-        minecraft.execute(() -> {
-            if (!closed.getAsBoolean()) {
-                showBackupNotice(progressKey, notice);
-            }
-        });
-    }
-
-    private void showClientWarning(String message) {
-        minecraft.gui.chatListener().handleSystemMessage(
-                Component.literal("WorldArchive: " + message)
-                        .withStyle(ChatFormatting.YELLOW),
-                false);
-    }
 
-    /** Finishes that backup's progress toast, or shows the outcome on its own toast. */
-    private void showBackupNotice(
-            Object progressKey,
-            BackgroundBackupWarnings.ExitNotice notice) {
-        BackupProgressToast toast = progressKey == null
-                ? null
-                : activeToasts.remove(progressKey);
-        if (toast == null) {
-            toast = new BackupProgressToast(minecraft, notice.message());
-            minecraft.gui.toastManager().addToast(toast);
+        @Override
+        public void finished(Notice notice) {
+            if (closing.getAsBoolean()) {
+                if (notice.severity() != Notice.Severity.SUCCESS) {
+                    keep(notice);
+                }
+                return;
+            }
+            onRenderThread(() -> showOutcome(toast, notice));
         }
-        toast.finish(notice.message(), notice.severity());
     }
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupCoordinator.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupCoordinator.java
deleted file mode 100644
index c8e91fc..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupCoordinator.java
+++ /dev/null
@@ -1,165 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import dev.ishaanko.worldarchive.core.BackupCoordinator;
-import dev.ishaanko.worldarchive.core.CaptureProgressListener;
-import dev.ishaanko.worldarchive.core.CreateBackupRequest;
-import dev.ishaanko.worldarchive.core.OperationProgress;
-import dev.ishaanko.worldarchive.core.PreparedBackup;
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.util.Objects;
-import java.util.Optional;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.CompletionStage;
-
-/** Stable coordinator facade over atomically replaceable runtime service graphs. */
-final class RuntimeBackupCoordinator implements BackupCoordinator {
-    private final WorldArchiveRuntime runtime;
-
-    RuntimeBackupCoordinator(WorldArchiveRuntime runtime) {
-        this.runtime = Objects.requireNonNull(runtime, "runtime");
-    }
-
-    @Override
-    public PreparedBackup prepareCapture(
-            CreateBackupRequest request,
-            CaptureProgressListener progressListener)
-            throws IOException, InterruptedException {
-        RuntimeConfigurationGate.Permit permit = runtime.configurationGate().enterBackup();
-        boolean transferred = false;
-        try {
-            RuntimeState state = runtime.states().currentOrNull();
-            if (state == null || runtime.isClosed()) {
-                throw new IOException("WorldArchive is still loading");
-            }
-            if (!runtime.registerWorldPath(
-                    request.worldId(),
-                    request.worldDirectory())) {
-                throw new IOException(
-                        "The world identity is registered to a different folder");
-            }
-            Optional<String> storageIssue = runtime.storageIssue(state);
-            if (storageIssue.isPresent()) {
-                throw new IOException(storageIssue.orElseThrow());
-            }
-            PreparedBackup prepared = state.coordinator().prepareCapture(
-                    request,
-                    progressListener);
-            PreparedOwnership ownership = new PreparedOwnership(state, permit);
-            if (runtime.preparedCaptures().putIfAbsent(prepared, ownership) != null) {
-                prepared.close();
-                throw new IOException("Prepared capture is already registered");
-            }
-            try {
-                prepared.addReleaseObserver(
-                        () -> releaseAbandonedPrepared(prepared, ownership));
-            } catch (RuntimeException | Error exception) {
-                runtime.preparedCaptures().remove(prepared, ownership);
-                try {
-                    prepared.close();
-                } catch (IOException closeFailure) {
-                    exception.addSuppressed(closeFailure);
-                }
-                throw exception;
-            }
-            transferred = true;
-            return prepared;
-        } finally {
-            if (!transferred) {
-                permit.close();
-            }
-        }
-    }
-
-    @Override
-    public CompletionStage<BackupResult> createPreparedBackup(
-            PreparedBackup preparedBackup,
-            ProgressListener progressListener) {
-        Objects.requireNonNull(preparedBackup, "preparedBackup");
-        Objects.requireNonNull(progressListener, "progressListener");
-        PreparedOwnership ownership =
-                runtime.preparedCaptures().remove(preparedBackup);
-        if (ownership == null) {
-            return failedStage("Prepared capture does not belong to this runtime");
-        }
-        Optional<String> storageIssue = runtime.storageIssue(ownership.state());
-        if (storageIssue.isPresent()) {
-            try {
-                preparedBackup.close();
-            } catch (IOException exception) {
-                ownership.permit().close();
-                return CompletableFuture.failedFuture(exception);
-            }
-            ownership.permit().close();
-            return failedStage(storageIssue.orElseThrow());
-        }
-        try {
-            CompletionStage<BackupResult> stage = ownership.state()
-                    .coordinator()
-                    .createPreparedBackup(preparedBackup, progressListener);
-            stage.whenComplete((ignored, throwable) -> ownership.permit().close());
-            return stage;
-        } catch (RuntimeException | Error exception) {
-            ownership.permit().close();
-            throw exception;
-        }
-    }
-
-    @Override
-    public CompletionStage<BackupResult> createBackup(
-            CreateBackupRequest request,
-            ProgressListener progressListener) {
-        return runtime.withBackupPermit(() -> {
-            RuntimeState state = runtime.states().currentOrNull();
-            if (state == null || runtime.isClosed()) {
-                return failedStage("WorldArchive is still loading");
-            }
-            if (!runtime.registerWorldPath(
-                    request.worldId(),
-                    request.worldDirectory())) {
-                return failedStage(
-                        "The world identity is registered to a different folder");
-            }
-            Optional<String> storageIssue = runtime.storageIssue(state);
-            if (storageIssue.isPresent()) {
-                return failedStage(storageIssue.orElseThrow());
-            }
-            return state.coordinator().createBackup(request, progressListener);
-        });
-    }
-
-    @Override
-    public Optional<OperationProgress> currentOperation(WorldId worldId) {
-        Objects.requireNonNull(worldId, "worldId");
-        if (runtime.isClosed()) {
-            return Optional.empty();
-        }
-        RuntimeState current = runtime.states().currentOrNull();
-        if (current != null) {
-            Optional<OperationProgress> active = current.coordinator()
-                    .currentOperation(worldId);
-            if (active.isPresent()) {
-                return active;
-            }
-        }
-        return runtime.states().retained().stream()
-                .filter(state -> state != current)
-                .map(state -> state.coordinator().currentOperation(worldId))
-                .flatMap(Optional::stream)
-                .findFirst();
-    }
-
-    private void releaseAbandonedPrepared(
-            PreparedBackup prepared,
-            PreparedOwnership ownership) {
-        if (runtime.preparedCaptures().remove(prepared, ownership)) {
-            ownership.permit().close();
-        }
-    }
-
-    private static <T> CompletionStage<T> failedStage(String message) {
-        return CompletableFuture.failedFuture(new IllegalStateException(message));
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupImportService.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupImportService.java
index 2a0d341..e43f8fe 100644
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupImportService.java
+++ b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupImportService.java
@@ -3,123 +3,66 @@
 import dev.ishaanko.worldarchive.importing.BackupImportService;
 import dev.ishaanko.worldarchive.importing.ImportPreview;
 import dev.ishaanko.worldarchive.importing.ImportSummary;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.SafeText;
 import dev.ishaanko.worldarchive.settings.ClientSettingsAccess;
 import java.nio.file.Path;
 import java.util.Objects;
 import java.util.Set;
 import java.util.UUID;
-import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CompletionStage;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentMap;
-import java.util.function.Function;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
-/** Keeps preview tokens bound to the immutable runtime state that prepared them. */
+/**
+ * The {@link BackupImportService} of the backup screens. Previews come from the current state and
+ * hold nothing. An import runs on the current state under a work permit: a preview made before a
+ * settings change is unknown there, so the import is refused and the player previews again.
+ */
 final class RuntimeBackupImportService implements BackupImportService {
-    private final WorldArchiveRuntime runtime;
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
 
-    private final ConcurrentMap<UUID, OwnedPreview> owners = new ConcurrentHashMap<>();
+    private final StateCalls calls;
 
-    RuntimeBackupImportService(WorldArchiveRuntime runtime) {
-        this.runtime = Objects.requireNonNull(runtime, "runtime");
+    RuntimeBackupImportService(StateCalls calls) {
+        this.calls = Objects.requireNonNull(calls, "calls");
     }
 
     @Override
     public CompletionStage<ImportPreview> previewZip(Path folder) {
-        return preview(service -> service.previewZip(folder));
+        return calls.withState(state -> state.imports().previewZip(folder));
     }
 
     @Override
     public CompletionStage<ImportPreview> previewGit(String remote) {
-        return preview(service -> service.previewGit(remote));
+        return calls.withState(state -> state.imports().previewGit(remote));
     }
 
     @Override
     public CompletionStage<ImportPreview> previewLocal() {
-        return preview(BackupImportService::previewLocal);
+        return calls.withState(state -> state.imports().previewLocal());
     }
 
     @Override
-    public CompletionStage<ImportSummary> execute(UUID token) {
-        return executeOwned(token, service -> service.execute(token));
-    }
-
-    @Override
-    public CompletionStage<ImportSummary> execute(UUID token, Set<dev.ishaanko.worldarchive.model.BackupId> selected) {
-        Objects.requireNonNull(selected, "selected");
-        return executeOwned(token, service -> service.execute(token, selected));
-    }
-
-    private CompletionStage<ImportSummary> executeOwned(
-            UUID token,
-            java.util.function.Function<BackupImportService, CompletionStage<ImportSummary>> execution) {
-        OwnedPreview owner = owners.remove(Objects.requireNonNull(token, "token"));
-        if (owner == null) {
-            return CompletableFuture.failedFuture(
-                    new IllegalArgumentException("Import preview is missing, expired, or already used"));
-        }
-        try {
-            CompletionStage<ImportSummary> imported = execution.apply(owner.service());
-            imported.whenComplete((ignored, throwable) -> owner.permit().close());
-            return imported.thenCompose(summary -> ClientSettingsAccess
-                    .connectWorldRemotes(summary.connections())
-                    .thenApply(ignored -> summary));
-        } catch (RuntimeException | Error exception) {
-            owner.permit().close();
-            throw exception;
-        }
+    public CompletionStage<ImportSummary> execute(UUID token, Set<BackupId> selected) {
+        return connectRemotes(calls.withPermit(state -> state.imports().execute(token, selected)));
     }
 
     @Override
     public CompletionStage<Void> discard(UUID token) {
-        OwnedPreview owner = owners.remove(Objects.requireNonNull(token, "token"));
-        if (owner == null) {
-            return CompletableFuture.completedFuture(null);
-        }
-        try {
-            CompletionStage<Void> discarded = owner.service().discard(token);
-            discarded.whenComplete((ignored, throwable) -> owner.permit().close());
-            return discarded;
-        } catch (RuntimeException | Error exception) {
-            owner.permit().close();
-            throw exception;
-        }
-    }
-
-    @Override
-    public CompletionStage<ImportSummary> rebuildLocal() {
-        return runtime.withBackupPermit(() -> current().rebuildLocal());
-    }
-
-    private BackupImportService current() {
-        return runtime.requireCurrentState().imports();
-    }
-
-    private CompletionStage<ImportPreview> preview(
-            Function<BackupImportService, CompletionStage<ImportPreview>> operation) {
-        RuntimeConfigurationGate.Permit permit = runtime.configurationGate().enterBackup();
-        try {
-            BackupImportService service = current();
-            CompletionStage<ImportPreview> preview = operation.apply(service);
-            return preview.whenComplete((result, throwable) -> {
-                if (throwable != null || result == null) {
-                    permit.close();
-                } else {
-                    owners.put(result.token(), new OwnedPreview(service, permit));
-                }
-            });
-        } catch (RuntimeException | Error exception) {
-            permit.close();
-            throw exception;
-        }
+        return calls.withState(state -> state.imports().discard(token));
     }
 
-    private record OwnedPreview(
-            BackupImportService service,
-            RuntimeConfigurationGate.Permit permit) {
-        private OwnedPreview {
-            Objects.requireNonNull(service, "service");
-            Objects.requireNonNull(permit, "permit");
-        }
+    /** Gives each imported world the remote its backups came from; the import succeeded even when that fails. */
+    private static CompletionStage<ImportSummary> connectRemotes(CompletionStage<ImportSummary> imported) {
+        return imported.thenCompose(summary -> ClientSettingsAccess.service()
+                .connectWorldRemotes(summary.connections())
+                .handle((ignored, failure) -> {
+                    if (failure != null) {
+                        LOGGER.warn("The backups were imported, but their Git remote could not be saved: {}",
+                                SafeText.from(failure, "no reason was given", 300));
+                    }
+                    return summary;
+                }));
     }
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupService.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupService.java
index 805328d..e645199 100644
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupService.java
+++ b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupService.java
@@ -1,248 +1,102 @@
 package dev.ishaanko.worldarchive.runtime;
 
-import dev.ishaanko.worldarchive.core.BackupCoordinator;
 import dev.ishaanko.worldarchive.core.BackupService;
-import dev.ishaanko.worldarchive.core.CreateBackupRequest;
 import dev.ishaanko.worldarchive.core.DeleteBackupRequest;
-import dev.ishaanko.worldarchive.core.DeletePreparation;
-import dev.ishaanko.worldarchive.core.ProgressListener;
 import dev.ishaanko.worldarchive.core.RestoreBackupRequest;
 import dev.ishaanko.worldarchive.core.RestoreBackupResult;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.DestinationHealth;
-import dev.ishaanko.worldarchive.model.DestinationHealthStatus;
-import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.SafeText;
 import dev.ishaanko.worldarchive.model.WorldId;
-import java.nio.file.Path;
 import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CompletionStage;
-
-/** Stable maintenance-service facade over atomically replaceable runtime service graphs. */
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * The {@link BackupService} of the backup screens: the current state's recovery service. A restore,
+ * delete, verify or sync holds a work permit until it has stopped, so no settings save moves the
+ * backup folders under it.
+ */
 final class RuntimeBackupService implements BackupService {
-    private final WorldArchiveRuntime runtime;
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
 
-    private final BackupCoordinator coordinator;
+    private final StateCalls calls;
 
-    RuntimeBackupService(WorldArchiveRuntime runtime, BackupCoordinator coordinator) {
-        this.runtime = Objects.requireNonNull(runtime, "runtime");
-        this.coordinator = Objects.requireNonNull(coordinator, "coordinator");
-    }
+    private final WorldIdentityResolver resolver;
 
-    @Override
-    public CompletionStage<BackupResult> createBackup(
-            CreateBackupRequest request,
-            ProgressListener progressListener) {
-        return coordinator.createBackup(request, progressListener);
+    RuntimeBackupService(StateCalls calls, WorldIdentityResolver resolver) {
+        this.calls = Objects.requireNonNull(calls, "calls");
+        this.resolver = Objects.requireNonNull(resolver, "resolver");
     }
 
     @Override
     public CompletionStage<List<BackupRecord>> listBackups(Optional<WorldId> worldId) {
-        return runtime.withBackupPermit(() -> {
-            RuntimeState state = runtime.states().currentOrNull();
-            return state == null || runtime.isClosed()
-                    ? failedStage("WorldArchive is still loading")
-                    : state.coordinator().maintenanceService().listBackups(worldId);
-        });
-    }
-
-    @Override
-    public CompletionStage<Optional<BackupRecord>> findBackup(BackupId backupId) {
-        return runtime.withBackupPermit(() -> {
-            RuntimeState state = runtime.states().currentOrNull();
-            return state == null || runtime.isClosed()
-                    ? failedStage("WorldArchive is still loading")
-                    : state.coordinator().maintenanceService().findBackup(backupId);
-        });
+        return calls.withState(state -> state.recovery().listBackups(worldId));
     }
 
+    /**
+     * Restores into a new world and registers that world before the permit is released.
+     * Cancelling the returned stage cancels the restore, which then removes its partial world.
+     */
     @Override
     public CompletionStage<RestoreBackupResult> restoreBackup(
             RestoreBackupRequest request,
             ProgressListener progressListener) {
-        RuntimeConfigurationGate.Permit operationPermit =
-                runtime.configurationGate().enterBackup();
-            RuntimeState state = runtime.states().currentOrNull();
-        if (state == null || runtime.isClosed()) {
-            operationPermit.close();
-            return failedStage("WorldArchive is still loading");
-        }
-        Optional<String> storageIssue = runtime.storageIssue(state);
-        if (storageIssue.isPresent()) {
-            operationPermit.close();
-            return failedStage(storageIssue.orElseThrow());
-        }
-        CompletionStage<RestoreBackupResult> operation;
-        try {
-            operation = state.coordinator().maintenanceService()
-                    .restoreBackup(request, progressListener);
-        } catch (RuntimeException | Error exception) {
-            operationPermit.close();
-            throw exception;
-        }
-        return registerRestoredWorld(operation, operationPermit);
-    }
-
-    @Override
-    public CompletionStage<DeletePreparation> prepareDelete(BackupId backupId) {
-        return runtime.withBackupPermit(() -> {
-            RuntimeState state = runtime.states().currentOrNull();
-            return state == null || runtime.isClosed()
-                    ? failedStage("WorldArchive is still loading")
-                    : state.coordinator().maintenanceService().prepareDelete(backupId);
-        });
-    }
-
-    @Override
-    public CompletionStage<BackupResult> deleteBackup(
-            DeleteBackupRequest request,
-            ProgressListener progressListener) {
-        return withHealthyState(state -> state.coordinator()
-                .maintenanceService()
-                .deleteBackup(request, progressListener));
+        return calls.withPermit(state -> registering(
+                state.recovery().restoreBackup(request, progressListener).toCompletableFuture()));
     }
 
     @Override
     public CompletionStage<List<BackupResult>> deleteBackups(
             List<DeleteBackupRequest> requests,
             ProgressListener progressListener) {
-        return withHealthyState(state -> state.coordinator()
-                .maintenanceService()
-                .deleteBackups(requests, progressListener));
-    }
-
-    @Override
-    public CompletionStage<BackupResult> verifyBackup(
-            BackupId backupId,
-            ProgressListener progressListener) {
-        return withHealthyState(state -> state.coordinator()
-                .maintenanceService()
-                .verifyBackup(backupId, progressListener));
+        return calls.withPermit(state -> state.recovery().deleteBackups(requests, progressListener));
     }
 
     @Override
-    public CompletionStage<BackupResult> syncBackup(
-            BackupId backupId,
-            ProgressListener progressListener) {
-        return withHealthyState(state -> state.coordinator()
-                .maintenanceService()
-                .syncBackup(backupId, progressListener));
+    public CompletionStage<BackupResult> verifyBackup(BackupId backupId, ProgressListener progressListener) {
+        return calls.withPermit(state -> state.recovery().verifyBackup(backupId, progressListener));
     }
 
     @Override
-    public CompletionStage<List<DestinationHealth>> health(Optional<WorldId> worldId) {
-        return runtime.withBackupPermit(() -> {
-            RuntimeState state = runtime.states().currentOrNull();
-            if (state == null || runtime.isClosed()) {
-                return failedStage("WorldArchive is still loading");
-            }
-            if (runtime.storageIssue(state).isPresent()) {
-                return CompletableFuture.completedFuture(runtime.storageAwareHealth(
-                        state.config(),
-                        runtime.disabledHealth(state.config())));
+    public CompletionStage<BackupResult> syncBackup(BackupId backupId, ProgressListener progressListener) {
+        return calls.withPermit(state -> state.recovery().syncBackup(backupId, progressListener));
+    }
+
+    /**
+     * The restore's result once its world is registered. Cancelling it cancels the restore; like
+     * the restore's own stage, it completes only once the restore has stopped.
+     */
+    private CompletableFuture<RestoreBackupResult> registering(CompletableFuture<RestoreBackupResult> restore) {
+        CompletableFuture<RestoreBackupResult> registered = new CompletableFuture<>() {
+            @Override
+            public boolean cancel(boolean mayInterruptIfRunning) {
+                return restore.cancel(mayInterruptIfRunning);
             }
-            if (!state.config().git().enabled() && !state.config().zip().enabled()) {
-                return CompletableFuture.completedFuture(
-                        runtime.disabledHealth(state.config()));
-            }
-            return state.coordinator().maintenanceService().health(worldId).thenApply(health -> {
-                health.stream()
-                        .filter(item -> item.destination() == DestinationType.GIT)
-                        .findFirst()
-                        .ifPresent(item -> updateGitAvailability(state, item));
-                return runtime.storageAwareHealth(
-                        state.config(),
-                        runtime.configuredHealth(state.config(), health));
-            });
-        });
-    }
-
-    private CompletionStage<RestoreBackupResult> registerRestoredWorld(
-            CompletionStage<RestoreBackupResult> operation,
-            RuntimeConfigurationGate.Permit operationPermit) {
-        CompletableFuture<RestoreBackupResult> completion = new CompletableFuture<>();
-        operation.whenComplete((result, throwable) -> {
-            if (throwable != null || result == null) {
-                operationPermit.close();
-                completion.completeExceptionally(throwable == null
-                        ? new IllegalStateException("Restore completed without a result")
-                        : throwable);
+        };
+        restore.whenComplete((result, failure) -> {
+            if (failure != null) {
+                registered.completeExceptionally(failure);
                 return;
             }
-            completeRestoredWorldRegistration(
-                    result,
-                    operationPermit,
-                    completion);
-        });
-        return completion;
-    }
-
-    private void completeRestoredWorldRegistration(
-            RestoreBackupResult result,
-            RuntimeConfigurationGate.Permit operationPermit,
-            CompletableFuture<RestoreBackupResult> completion) {
-        RuntimeConfigurationGate.Permit registrationPermit = null;
-        Throwable failure = null;
-        try {
-            registrationPermit = runtime.configurationGate()
-                    .transitionBackupToConfigurationChange(operationPermit);
-            Path restored = result.restoredWorldDirectory().toAbsolutePath().normalize();
-            if (!runtime.registerDiscoveredWorldPathHeld(
-                    result.restoredWorldId(),
-                    restored,
-                    runtime.states().currentOrNull())) {
-                throw new IllegalStateException(
-                        "The restored world identity is registered to another folder");
-            }
-        } catch (RuntimeException | Error exception) {
-            operationPermit.close();
-            failure = exception;
-        } finally {
-            if (registrationPermit != null) {
-                registrationPermit.close();
+            // The world exists either way; opening it or the world list registers it later.
+            try {
+                if (!resolver.register(result.restoredWorldId(), result.restoredWorldDirectory())) {
+                    LOGGER.warn("The restored world {} could not be registered yet", result.restoredWorldDirectory());
+                }
+            } catch (RuntimeException registration) {
+                LOGGER.warn("The restored world could not be registered yet: {}",
+                        SafeText.from(registration, "no reason was given", 300));
+            } finally {
+                registered.complete(result);
             }
-        }
-        if (failure == null) {
-            completion.complete(result);
-        } else {
-            completion.completeExceptionally(failure);
-        }
-    }
-
-    private <T> CompletionStage<T> withHealthyState(
-            HealthyStateOperation<T> operation) {
-        return runtime.withBackupPermit(() -> {
-            RuntimeState state = runtime.states().currentOrNull();
-            if (state == null || runtime.isClosed()) {
-                return failedStage("WorldArchive is still loading");
-            }
-            Optional<String> storageIssue = runtime.storageIssue(state);
-            return storageIssue.isPresent()
-                    ? failedStage(storageIssue.orElseThrow())
-                    : operation.start(state);
         });
-    }
-
-    private static void updateGitAvailability(
-            RuntimeState state,
-            DestinationHealth health) {
-        if (health.status() == DestinationHealthStatus.HEALTHY) {
-            state.selector().gitToolsAvailable(true);
-        } else if (health.status() == DestinationHealthStatus.TOOL_MISSING) {
-            state.selector().gitToolsAvailable(false);
-        }
-    }
-
-    private static <T> CompletionStage<T> failedStage(String message) {
-        return CompletableFuture.failedFuture(new IllegalStateException(message));
-    }
-
-    @FunctionalInterface
-    private interface HealthyStateOperation<T> {
-        CompletionStage<T> start(RuntimeState state);
+        return registered;
     }
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupWorlds.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupWorlds.java
deleted file mode 100644
index d424ead..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupWorlds.java
+++ /dev/null
@@ -1,105 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import dev.ishaanko.worldarchive.catalog.BackupCatalog;
-import dev.ishaanko.worldarchive.config.WorldConfig;
-import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.ui.BackupWorldContext;
-import dev.ishaanko.worldarchive.ui.BackupWorldEntry;
-import java.io.IOException;
-import java.nio.file.Path;
-import java.util.ArrayList;
-import java.util.Comparator;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-
-/** Builds the combined live and catalog-only world chooser model. */
-final class RuntimeBackupWorlds {
-    private final WorldArchiveRuntime runtime;
-
-    private final BackupCatalog catalog;
-
-    RuntimeBackupWorlds(WorldArchiveRuntime runtime, BackupCatalog catalog) {
-        this.runtime = Objects.requireNonNull(runtime, "runtime");
-        this.catalog = Objects.requireNonNull(catalog, "catalog");
-    }
-
-    List<BackupWorldEntry> list() throws IOException {
-        RuntimeState state = runtime.requireCurrentState();
-        Map<WorldId, List<BackupRecord>> byWorld = new HashMap<>();
-        for (BackupRecord record : catalog.listAll()) {
-            byWorld.computeIfAbsent(record.manifest().worldId(), ignored -> new ArrayList<>())
-                    .add(record);
-        }
-        Map<WorldId, BackupWorldEntry> entries = new HashMap<>();
-        for (WorldConfig world : state.config().worlds()) {
-            BackupWorldContext context = configuredContext(world);
-            runtime.actionContexts().allowSourceActions(context);
-            boolean live = new RuntimeNavigation(runtime).sourceDirectoryAvailable(context);
-            if (!live) {
-                context = runtime.actionContexts().markActionOnly(context);
-            }
-            int backupCount = byWorld.getOrDefault(world.worldId(), List.of()).size();
-            if (!shouldInclude(live, backupCount)) {
-                continue;
-            }
-            entries.put(world.worldId(), new BackupWorldEntry(
-                    context,
-                    !live,
-                    backupCount));
-        }
-        addCatalogOnly(entries, byWorld);
-        return entries.values().stream()
-                .sorted(Comparator.comparing(
-                        entry -> entry.context().displayName(),
-                        String.CASE_INSENSITIVE_ORDER))
-                .toList();
-    }
-
-    static boolean shouldInclude(boolean live, int backupCount) {
-        return live || backupCount > 0;
-    }
-
-    private void addCatalogOnly(
-            Map<WorldId, BackupWorldEntry> entries,
-            Map<WorldId, List<BackupRecord>> byWorld) {
-        for (Map.Entry<WorldId, List<BackupRecord>> group : byWorld.entrySet()) {
-            if (entries.containsKey(group.getKey()) || group.getValue().isEmpty()) {
-                continue;
-            }
-            BackupRecord newest = group.getValue().stream()
-                    .max(Comparator.comparing(record -> record.manifest().createdAt()))
-                    .orElseThrow();
-            entries.put(group.getKey(), new BackupWorldEntry(
-                    missingSourceContext(newest),
-                    true,
-                    group.getValue().size()));
-        }
-    }
-
-    private static BackupWorldContext configuredContext(WorldConfig world) {
-        Path directory = world.path();
-        Path parent = directory.getParent();
-        Path name = directory.getFileName();
-        if (parent == null || name == null) {
-            return new BackupWorldContext(
-                    world.worldId(), directory, directory, directory.toString(), directory.toString());
-        }
-        return new BackupWorldContext(
-                world.worldId(), directory, parent, name.toString(), name.toString());
-    }
-
-    private BackupWorldContext missingSourceContext(BackupRecord record) {
-        Path worldsDirectory = runtime.services().minecraft().getLevelSource().getBaseDir()
-                .toAbsolutePath().normalize();
-        String storageName = ".worldarchive-missing-" + record.manifest().worldId();
-        return runtime.actionContexts().markActionOnly(new BackupWorldContext(
-                record.manifest().worldId(),
-                worldsDirectory.resolve(storageName),
-                worldsDirectory,
-                storageName,
-                record.manifest().worldName()));
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeClientFacade.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeClientFacade.java
index 99e23bc..d7302eb 100644
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeClientFacade.java
+++ b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeClientFacade.java
@@ -1,225 +1,240 @@
 package dev.ishaanko.worldarchive.runtime;
 
 import dev.ishaanko.worldarchive.config.StoragePolicy;
-import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
 import dev.ishaanko.worldarchive.core.BackupService;
 import dev.ishaanko.worldarchive.core.CreateBackupRequest;
-import dev.ishaanko.worldarchive.core.OperationId;
-import dev.ishaanko.worldarchive.core.ProgressListener;
 import dev.ishaanko.worldarchive.core.RestoreBackupResult;
 import dev.ishaanko.worldarchive.importing.BackupImportService;
+import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupResult;
 import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.GameVersionStamp;
+import dev.ishaanko.worldarchive.model.ProgressListener;
 import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.settings.ClientSettingsAccess;
 import dev.ishaanko.worldarchive.storage.management.CleanupPlan;
 import dev.ishaanko.worldarchive.storage.management.CleanupRequest;
 import dev.ishaanko.worldarchive.storage.management.CleanupResult;
 import dev.ishaanko.worldarchive.storage.management.StorageOverview;
+import dev.ishaanko.worldarchive.support.AsyncTasks;
 import dev.ishaanko.worldarchive.ui.BackupClientFacade;
-import dev.ishaanko.worldarchive.ui.BackupWorldContext;
-import dev.ishaanko.worldarchive.ui.BackupWorldEntry;
-import dev.ishaanko.worldarchive.ui.BackupWorldSelection;
 import dev.ishaanko.worldarchive.ui.model.BackupBrowserCapabilities;
-import dev.ishaanko.worldarchive.ui.model.BackupRow;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldEntry;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldSelection;
+import dev.ishaanko.worldarchive.ui.model.FolderSelectionResult;
+import java.nio.file.Path;
 import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
+import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CompletionStage;
+import java.util.function.Function;
 import net.minecraft.client.gui.screens.Screen;
-import net.minecraft.client.server.IntegratedServer;
 
-/** Implements the native-screen facade against one runtime's service graph. */
+/**
+ * The runtime behind the backup screens. Every call returns a stage at once and never throws on
+ * the render thread; the disk is read on workers, and nothing here waits for a backup.
+ */
 final class RuntimeClientFacade implements BackupClientFacade {
-    private final WorldArchiveRuntime runtime;
+    private final ServiceGraph graph;
 
-    private final BackupService serviceView;
+    private final WorldIdentityResolver resolver;
 
-    private final BackupImportService importsView;
+    private final LiveWorldBackups live;
 
-    private final RuntimeStorageCoordinator storageView;
+    private final StateCalls calls;
 
     private final RuntimeNavigation navigation;
 
-    private final RuntimeLifecycle lifecycle;
+    private final RuntimeBackupService backups;
 
-    private final RuntimeBackgroundBackupMonitor backgroundBackups;
+    private final RuntimeBackupImportService imports;
+
+    private final Path savesDirectory;
+
+    private final Function<WorldId, Optional<String>> settingsWarning;
 
     RuntimeClientFacade(
-            WorldArchiveRuntime runtime,
-            BackupService serviceView,
-            BackupImportService importsView,
-            RuntimeStorageCoordinator storageView,
+            ServiceGraph graph,
+            WorldIdentityResolver resolver,
+            LiveWorldBackups live,
+            StateCalls calls,
             RuntimeNavigation navigation,
-            RuntimeLifecycle lifecycle,
-            RuntimeBackgroundBackupMonitor backgroundBackups) {
-        this.runtime = Objects.requireNonNull(runtime, "runtime");
-        this.serviceView = Objects.requireNonNull(serviceView, "serviceView");
-        this.importsView = Objects.requireNonNull(importsView, "importsView");
-        this.storageView = Objects.requireNonNull(storageView, "storageView");
+            Path savesDirectory,
+            Function<WorldId, Optional<String>> settingsWarning) {
+        this.graph = Objects.requireNonNull(graph, "graph");
+        this.resolver = Objects.requireNonNull(resolver, "resolver");
+        this.live = Objects.requireNonNull(live, "live");
+        this.calls = Objects.requireNonNull(calls, "calls");
         this.navigation = Objects.requireNonNull(navigation, "navigation");
-        this.lifecycle = Objects.requireNonNull(lifecycle, "lifecycle");
-        this.backgroundBackups = Objects.requireNonNull(backgroundBackups, "backgroundBackups");
+        this.savesDirectory = Objects.requireNonNull(savesDirectory, "savesDirectory");
+        this.settingsWarning = Objects.requireNonNull(settingsWarning, "settingsWarning");
+        this.backups = new RuntimeBackupService(calls, resolver);
+        this.imports = new RuntimeBackupImportService(calls);
     }
 
     @Override
     public BackupService backupService() {
-        return serviceView;
+        return backups;
     }
 
     @Override
     public BackupImportService importService() {
-        return importsView;
+        return imports;
     }
 
     @Override
     public CompletionStage<List<BackupWorldEntry>> backupWorlds() {
-        if (runtime.unavailable()) {
-            return WorldArchiveRuntime.failedStage("WorldArchive is still loading");
-        }
-        return runtime.submit(
-                () -> new RuntimeBackupWorlds(runtime, runtime.services().catalog()).list());
+        return calls.withState(state -> AsyncTasks.supplyChecked(graph.executor(), () ->
+                BackupWorldList.build(state.config(), graph.catalog().listAll(), savesDirectory)));
     }
 
     @Override
-    public CompletionStage<Optional<BackupWorldContext>> resolveWorld(
-            BackupWorldSelection selection) {
-        Objects.requireNonNull(selection, "selection");
-        if (runtime.unavailable()) {
-            return WorldArchiveRuntime.failedStage("WorldArchive is still loading");
-        }
-        return runtime.submit(() -> runtime.resolveWorldBlocking(selection));
+    public CompletionStage<BackupWorldContext> resolveWorld(BackupWorldSelection selection) {
+        return calls.withState(state -> AsyncTasks.supplyChecked(graph.executor(), () ->
+                switch (resolver.resolve(selection)) {
+                    case WorldIdentityResolver.Resolution.Resolved resolved -> resolved.world();
+                    case WorldIdentityResolver.Resolution.Refused refused ->
+                            throw new IllegalStateException(refused.reason());
+                }));
     }
 
+    /**
+     * Backs up a world the player picked. The open world is saved by the server first and never
+     * copied while it can still change; any other world is copied directly.
+     */
     @Override
     public CompletionStage<BackupResult> createManualBackup(
             BackupWorldContext world,
             Optional<String> label,
             ProgressListener progressListener) {
-        Objects.requireNonNull(world, "world");
-        Objects.requireNonNull(label, "label");
-        Objects.requireNonNull(progressListener, "progressListener");
-        return runtime.withBackupPermit(() -> {
-            if (!runtime.actionContexts().sourceActionsAllowed(world)) {
-                return WorldArchiveRuntime.failedStage(
-                        "The original world is unavailable for backup creation");
-            }
-            RuntimeState state = runtime.states().currentOrNull();
-            if (state == null || runtime.isClosed()) {
-                return WorldArchiveRuntime.failedStage("WorldArchive is still loading");
-            }
-            Optional<String> storageIssue = runtime.storageIssue(state);
-            if (storageIssue.isPresent()) {
-                return WorldArchiveRuntime.failedStage(storageIssue.orElseThrow());
-            }
-            CreateBackupRequest request = WorldArchiveRuntime.request(
-                    world, label, BackupTrigger.MANUAL);
-            if (!runtime.registerWorldPath(world.worldId(), world.worldDirectory())) {
-                return WorldArchiveRuntime.failedStage(
-                        "The world identity is already registered to a different folder");
-            }
-            if (!state.enabledDestinations(request)) {
-                return WorldArchiveRuntime.failedStage("Manual backups are disabled for this world");
+        return calls.withState(state -> {
+            if (!resolver.isRegistered(world.worldId(), world.worldDirectory())) {
+                return StateCalls.failed(StateCalls.text("screen.worldarchive.runtime.world_unavailable"));
             }
-            if (runtime.busyAcrossStates(world.worldId())) {
-                return WorldArchiveRuntime.failedStage("A backup is already running for this world");
+            CreateBackupRequest request;
+            switch (TriggerCheck.evaluate(state, resolver.storageIssue(), world, BackupTrigger.MANUAL, label)) {
+                case TriggerCheck.Decision.Proceed proceed -> request = proceed.request();
+                case TriggerCheck.Decision.Refused refused -> {
+                    return StateCalls.failed(refused.message());
+                }
             }
-            IntegratedServer server = lifecycle.matchingServer(world);
-            if (server != null) {
-                return lifecycle.queueRequestedSave(
-                        state,
-                        server,
-                        request,
-                        progressListener);
+            if (busy(world.worldId())) {
+                return StateCalls.failed(StateCalls.text("screen.worldarchive.runtime.busy"));
             }
-            return state.coordinator().createBackup(request, progressListener);
+            return switch (live.openWorld(world)) {
+                case READY -> live.backUpOpenWorld(state, request, progressListener, graph.gate().enterWork());
+                case LOADING -> StateCalls.failed(StateCalls.text("screen.worldarchive.runtime.world_loading"));
+                case NOT_OPEN -> backUpClosedWorld(state, request, progressListener);
+            };
         });
     }
 
+    /** A world the game does not run cannot change, so it is copied without a save first. */
+    private CompletionStage<BackupResult> backUpClosedWorld(
+            RuntimeState state,
+            CreateBackupRequest request,
+            ProgressListener progressListener) {
+        ConfigurationGate.Permit permit = graph.gate().enterWork();
+        CompletionStage<BackupResult> backup = state.coordinator().createBackup(request, progressListener);
+        backup.whenComplete((result, failure) -> state.coordinator().whenIdle(request.worldId())
+                .whenComplete((idle, error) -> permit.close()));
+        return backup;
+    }
+
     @Override
-    public CompletionStage<BackupBrowserCapabilities> browserCapabilities(
-            BackupWorldContext world) {
-        Objects.requireNonNull(world, "world");
-        RuntimeState state = runtime.states().currentOrNull();
-        if (state == null || runtime.isClosed()) {
-            return WorldArchiveRuntime.failedStage("WorldArchive is still loading");
-        }
-        // Folder checks and destination validation touch the filesystem; the browser polls
-        // this every second, so it must not run on the render thread.
-        return runtime.submit(() -> capabilities(world, state));
+    public CompletionStage<BackupBrowserCapabilities> browserCapabilities(BackupWorldContext world) {
+        // The folder check reads the disk, and the browser asks every second: never on the render thread.
+        return calls.withState(state -> AsyncTasks.supply(graph.executor(), () -> capabilities(world, state)));
     }
 
     private BackupBrowserCapabilities capabilities(BackupWorldContext world, RuntimeState state) {
-        CreateBackupRequest request = WorldArchiveRuntime.request(
-                world, Optional.empty(), BackupTrigger.MANUAL);
-        WorldArchiveConfig config = state.config();
-        boolean sourceAvailable = navigation.sourceDirectoryAvailable(world);
-        boolean createAvailable = false;
-        if (sourceAvailable) {
-            try {
-                createAvailable = state.enabledDestinations(request);
-            } catch (IllegalArgumentException exception) {
-                sourceAvailable = false;
-            }
+        Optional<String> storageIssue = resolver.storageIssue();
+        boolean sourceAvailable = BackupWorldList.isWorldFolder(world.worldDirectory())
+                && resolver.isRegistered(world.worldId(), world.worldDirectory());
+        Optional<BackupBrowserCapabilities.CreateBlock> block = Optional.empty();
+        if (TriggerCheck.evaluate(state, storageIssue, world, BackupTrigger.MANUAL, Optional.empty())
+                instanceof TriggerCheck.Decision.Refused refused) {
+            sourceAvailable &= refused.reason() != TriggerCheck.Reason.IDENTITY_ELSEWHERE;
+            block = createBlock(refused.reason());
         }
-        boolean folderAvailable = config.zip().destination().isPresent()
-                || config.git().repository().isPresent();
-        Optional<String> storageIssue = runtime.storageIssue(state);
         return new BackupBrowserCapabilities(
-                runtime.busyAcrossStates(world.worldId()),
+                busy(world.worldId()),
                 sourceAvailable,
-                storageIssue.isEmpty() && sourceAvailable && createAvailable,
-                config.git().enabled() && state.gitBackend().remoteConfigured(world.worldId()),
-                storageIssue.isEmpty() && folderAvailable,
-                storageIssue.or(() -> runtime.worldSettingsWarning()
-                        .or(() -> backgroundBackups.warning()
-                                .or(state.selector()::warning))));
+                block,
+                state.config().git().enabled() && state.git().remoteConfigured(world.worldId()),
+                storageIssue.isEmpty(),
+                storageIssue
+                        .or(() -> settingsWarning.apply(world.worldId()))
+                        .or(() -> live.warning(world.worldId())
+                                .map(notice -> RuntimeBackgroundBackupMonitor.text(notice).getString()))
+                        .or(() -> state.selector().warning()));
+    }
+
+    private static Optional<BackupBrowserCapabilities.CreateBlock> createBlock(TriggerCheck.Reason reason) {
+        return switch (reason) {
+            case STORAGE_PROBLEM -> Optional.of(BackupBrowserCapabilities.CreateBlock.STORAGE_PROBLEM);
+            case WORLD_OFF -> Optional.of(BackupBrowserCapabilities.CreateBlock.WORLD_OFF);
+            case TRIGGER_OFF -> Optional.of(BackupBrowserCapabilities.CreateBlock.NO_DESTINATION);
+            case GIT_MISSING -> Optional.of(BackupBrowserCapabilities.CreateBlock.GIT_MISSING);
+            case IDENTITY_ELSEWHERE -> Optional.empty();
+        };
+    }
+
+    private boolean busy(WorldId worldId) {
+        return graph.busy(worldId) || live.hasPending(worldId);
     }
 
     @Override
     public CompletionStage<StorageOverview> storageOverview(WorldId worldId) {
-        return storageView.overview(Objects.requireNonNull(worldId, "worldId"));
+        return calls.withState(state -> state.storage().overview(worldId));
     }
 
     @Override
     public CompletionStage<Boolean> claimStorageReviewNotice(WorldId worldId) {
-        return storageView.claimReviewNotice(Objects.requireNonNull(worldId, "worldId"));
+        if (graph.current().isEmpty()) {
+            return CompletableFuture.completedFuture(false);
+        }
+        return calls.withState(state -> state.storage().claimReviewNotice(worldId));
     }
 
     @Override
     public CompletionStage<CleanupPlan> prepareCleanup(WorldId worldId) {
-        return storageView.prepareCleanup(Objects.requireNonNull(worldId, "worldId"));
+        return calls.withState(state -> state.storage().prepareCleanup(worldId));
     }
 
+    /** Applies a plan of the current state; a plan made before a settings change is refused there. */
     @Override
     public CompletionStage<CleanupResult> applyCleanup(CleanupRequest request) {
-        return storageView.applyCleanup(Objects.requireNonNull(request, "request"));
+        return calls.withPermit(state -> state.storage().applyCleanup(request));
     }
 
     @Override
-    public CompletionStage<Void> discardCleanup(OperationId confirmationToken) {
-        return storageView.discardCleanup(
-                Objects.requireNonNull(confirmationToken, "confirmationToken"));
+    public CompletionStage<Void> saveStoragePolicy(WorldId worldId, StoragePolicy policy) {
+        return ClientSettingsAccess.service()
+                .update(config -> config.withWorld(worldId, world -> world.withStoragePolicy(policy)))
+                .thenApply(ignored -> null);
     }
 
     @Override
-    public CompletionStage<Void> saveStoragePolicy(
-            WorldId worldId,
-            StoragePolicy policy) {
-        return storageView.savePolicy(
-                Objects.requireNonNull(worldId, "worldId"),
-                Objects.requireNonNull(policy, "policy"));
+    public CompletionStage<Void> openManagedFolder(BackupWorldContext world, Optional<BackupId> selectedBackup) {
+        return navigation.openManagedFolder(world, selectedBackup);
     }
 
     @Override
-    public void openManagedFolder(
-            BackupWorldContext world,
-            Optional<BackupRow> selectedBackup) {
-        navigation.openManagedFolder(world, selectedBackup);
+    public void openSettings(Screen returnTo) {
+        navigation.openSettings(returnTo);
     }
 
     @Override
-    public void openSettings(Screen returnTo) {
-        navigation.openSettings(returnTo);
+    public CompletableFuture<FolderSelectionResult> pickFolder(String title) {
+        return ClientSettingsAccess.pickFolder(title, Optional.empty());
+    }
+
+    @Override
+    public Optional<GameVersionStamp> runningGameVersion() {
+        return RunningGameVersion.current();
     }
 
     @Override
@@ -231,4 +246,14 @@ public void selectRestoredWorld(Screen returnTo, RestoreBackupResult result) {
     public void playRestoredWorld(Screen returnTo, RestoreBackupResult result) {
         navigation.playRestoredWorld(returnTo, result);
     }
+
+    /** Opens the open world's backup browser over {@code returnTo}; false while its identity is unknown. */
+    boolean openLiveBrowser(Screen returnTo) {
+        Optional<BackupWorldContext> world = live.liveWorld();
+        if (world.isEmpty() || graph.current().isEmpty()) {
+            return false;
+        }
+        navigation.openBrowser(returnTo, world.get(), this);
+        return true;
+    }
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeConfigurationGate.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeConfigurationGate.java
deleted file mode 100644
index caea649..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeConfigurationGate.java
+++ /dev/null
@@ -1,146 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import java.util.Objects;
-import java.util.concurrent.atomic.AtomicBoolean;
-
-/** Keeps backup publication and destination-path settings transactions from overlapping. */
-final class RuntimeConfigurationGate {
-    private final Runnable idleCallback;
-
-    private int activeBackups;
-
-    private boolean configurationChange;
-
-    private int waitingConfigurationChanges;
-
-    RuntimeConfigurationGate() {
-        this(() -> { });
-    }
-
-    RuntimeConfigurationGate(Runnable idleCallback) {
-        this.idleCallback = Objects.requireNonNull(idleCallback, "idleCallback");
-    }
-
-    synchronized Permit enterBackup() {
-        boolean interrupted = false;
-        while (configurationChange || waitingConfigurationChanges != 0) {
-            try {
-                wait();
-            } catch (InterruptedException exception) {
-                interrupted = true;
-            }
-        }
-        activeBackups++;
-        if (interrupted) {
-            Thread.currentThread().interrupt();
-        }
-        return new Permit(this::leaveBackup);
-    }
-
-    synchronized Permit retainStateWork() {
-        activeBackups++;
-        return new Permit(this::leaveBackup);
-    }
-
-    synchronized Permit tryEnterConfigurationChange() {
-        if (configurationChange || waitingConfigurationChanges != 0 || activeBackups != 0) {
-            throw new IllegalStateException(
-                    "Destination paths cannot change while a backup is in progress");
-        }
-        configurationChange = true;
-        return new Permit(this::leaveConfigurationChange);
-    }
-
-    synchronized Permit enterConfigurationChange() {
-        waitingConfigurationChanges++;
-        boolean interrupted = false;
-        try {
-            while (configurationChange || activeBackups != 0) {
-                try {
-                    wait();
-                } catch (InterruptedException exception) {
-                    interrupted = true;
-                }
-            }
-            configurationChange = true;
-            return new Permit(this::leaveConfigurationChange);
-        } finally {
-            waitingConfigurationChanges--;
-            if (interrupted) {
-                Thread.currentThread().interrupt();
-            }
-        }
-    }
-
-    synchronized Permit transitionBackupToConfigurationChange(Permit backupPermit) {
-        Permit backup = Objects.requireNonNull(backupPermit, "backupPermit");
-        waitingConfigurationChanges++;
-        if (!backup.releaseOnce()) {
-            waitingConfigurationChanges--;
-            throw new IllegalStateException("Backup permit is already closed");
-        }
-        boolean interrupted = false;
-        try {
-            while (configurationChange || activeBackups != 0) {
-                try {
-                    wait();
-                } catch (InterruptedException exception) {
-                    interrupted = true;
-                }
-            }
-            configurationChange = true;
-            return new Permit(this::leaveConfigurationChange);
-        } finally {
-            waitingConfigurationChanges--;
-            if (interrupted) {
-                Thread.currentThread().interrupt();
-            }
-        }
-    }
-
-    private void leaveBackup() {
-        boolean idle;
-        synchronized (this) {
-            activeBackups--;
-            if (activeBackups < 0) {
-                throw new IllegalStateException("Backup configuration gate underflow");
-            }
-            idle = activeBackups == 0;
-            notifyAll();
-        }
-        if (idle) {
-            idleCallback.run();
-        }
-    }
-
-    private synchronized void leaveConfigurationChange() {
-        if (!configurationChange) {
-            throw new IllegalStateException("No configuration change is active");
-        }
-        configurationChange = false;
-        notifyAll();
-    }
-
-    static final class Permit implements AutoCloseable {
-        private final AtomicBoolean closed = new AtomicBoolean();
-
-        private final Runnable release;
-
-        private Permit(Runnable release) {
-            this.release = release;
-        }
-
-        @Override
-        public void close() {
-            releaseOnce();
-        }
-
-        private boolean releaseOnce() {
-            if (closed.compareAndSet(false, true)) {
-                release.run();
-                return true;
-            }
-            return false;
-        }
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationPathGuard.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationPathGuard.java
deleted file mode 100644
index db0754b..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationPathGuard.java
+++ /dev/null
@@ -1,75 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationStatus;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.BackupRecord;
-import java.util.List;
-import java.util.Objects;
-
-/** Prevents a settings save from disconnecting catalog records from managed storage. */
-final class RuntimeDestinationPathGuard {
-    private RuntimeDestinationPathGuard() {
-    }
-
-    static void requireAllowed(
-            RuntimeStoragePaths current,
-            RuntimeStoragePaths replacement,
-            List<DestinationResult> catalogDestinations) {
-        Objects.requireNonNull(current, "current");
-        Objects.requireNonNull(replacement, "replacement");
-        List<DestinationResult> destinations = List.copyOf(
-                Objects.requireNonNull(catalogDestinations, "catalogDestinations"));
-        if (!current.gitRepository().equals(replacement.gitRepository())
-                && dependsOn(destinations, DestinationType.GIT)) {
-            throw new IllegalArgumentException(
-                    "The Git repository cannot change while the catalog contains Git backups");
-        }
-        if (!current.zipDirectory().equals(replacement.zipDirectory())
-                && dependsOn(destinations, DestinationType.ZIP)) {
-            throw new IllegalArgumentException(
-                    "The ZIP destination cannot change while the catalog contains ZIP backups");
-        }
-    }
-
-    static void requireWorldZipOverridesAllowed(
-            RuntimeStoragePaths current,
-            RuntimeStoragePaths replacement,
-            List<BackupRecord> catalogRecords) {
-        Objects.requireNonNull(current, "current");
-        Objects.requireNonNull(replacement, "replacement");
-        for (BackupRecord record : List.copyOf(
-                Objects.requireNonNull(catalogRecords, "catalogRecords"))) {
-            if (!current.zipDirectory(record.manifest().worldId()).equals(
-                            replacement.zipDirectory(record.manifest().worldId()))
-                    && dependsOn(record.result().destinations(), DestinationType.ZIP)) {
-                throw new IllegalArgumentException(
-                        "A world's ZIP destination cannot change while its catalog contains ZIP backups");
-            }
-        }
-    }
-
-    static void requireCatalogAllowed(
-            RuntimeStoragePaths current,
-            RuntimeStoragePaths replacement,
-            List<BackupRecord> catalogRecords) {
-        List<BackupRecord> records = List.copyOf(
-                Objects.requireNonNull(catalogRecords, "catalogRecords"));
-        requireAllowed(
-                current,
-                replacement,
-                records.stream()
-                        .flatMap(record -> record.result().destinations().stream())
-                        .toList());
-        requireWorldZipOverridesAllowed(current, replacement, records);
-    }
-
-    private static boolean dependsOn(
-            List<DestinationResult> destinations,
-            DestinationType type) {
-        return destinations.stream()
-                .anyMatch(result -> result.destination() == type
-                        && (result.status() == DestinationStatus.SUCCESS
-                                || result.status() == DestinationStatus.PENDING_SYNC));
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationSelector.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationSelector.java
deleted file mode 100644
index 344f28c..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationSelector.java
+++ /dev/null
@@ -1,60 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import dev.ishaanko.worldarchive.core.BackupBackend;
-import dev.ishaanko.worldarchive.core.BackupDestinationSelector;
-import dev.ishaanko.worldarchive.core.ConfiguredBackupDestinationSelector;
-import dev.ishaanko.worldarchive.core.CreateBackupRequest;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import java.util.List;
-import java.util.Objects;
-import java.util.Optional;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.concurrent.atomic.AtomicReference;
-
-/** Filters configured Git work until both Git and Git LFS have passed their runtime probe. */
-final class RuntimeDestinationSelector implements BackupDestinationSelector {
-    private final ConfiguredBackupDestinationSelector configured;
-
-    private final AtomicBoolean gitToolsAvailable = new AtomicBoolean();
-
-    private final AtomicReference<Optional<String>> warning =
-            new AtomicReference<>(Optional.empty());
-
-    RuntimeDestinationSelector(ConfiguredBackupDestinationSelector configured) {
-        this.configured = Objects.requireNonNull(configured, "configured");
-    }
-
-    @Override
-    public List<BackupBackend> select(CreateBackupRequest request) {
-        return configured.select(request).stream()
-                .filter(backend -> backend.destinationType() != DestinationType.GIT
-                        || gitToolsAvailable.get())
-                .toList();
-    }
-
-    boolean hasConfiguredDestination(CreateBackupRequest request) {
-        return !configured.select(Objects.requireNonNull(request, "request")).isEmpty();
-    }
-
-    void gitToolsAvailable(boolean available) {
-        gitToolsAvailable.set(available);
-        warning.set(available
-                ? Optional.empty()
-                : Optional.of("Git backups are unavailable because Git or Git LFS is missing"));
-    }
-
-    void gitToolProbeFailed() {
-        gitToolsAvailable.set(false);
-        warning.set(Optional.of(
-                "Git backups are unavailable because the Git tool check failed"));
-    }
-
-    void gitDisabled() {
-        gitToolsAvailable.set(false);
-        warning.set(Optional.empty());
-    }
-
-    Optional<String> warning() {
-        return warning.get();
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeLifecycle.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeLifecycle.java
deleted file mode 100644
index 246f146..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeLifecycle.java
+++ /dev/null
@@ -1,971 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import dev.ishaanko.worldarchive.config.WorldConfig;
-import dev.ishaanko.worldarchive.core.CaptureProgressListener;
-import dev.ishaanko.worldarchive.core.CreateBackupRequest;
-import dev.ishaanko.worldarchive.core.NoCatchUpSchedule;
-import dev.ishaanko.worldarchive.core.PreparedBackup;
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.ui.BackupWorldContext;
-import dev.ishaanko.worldarchive.ui.BackupWorldSelection;
-import java.io.IOException;
-import java.nio.file.Path;
-import java.time.Clock;
-import java.time.Duration;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
-import java.util.concurrent.CancellationException;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.CompletionStage;
-import java.util.concurrent.RejectedExecutionException;
-import net.fabricmc.fabric.api.client.event.lifecycle.v1.ClientLifecycleEvents;
-import net.fabricmc.fabric.api.client.event.lifecycle.v1.ClientTickEvents;
-import net.fabricmc.fabric.api.event.lifecycle.v1.ServerLifecycleEvents;
-import net.minecraft.client.Minecraft;
-import net.minecraft.client.server.IntegratedServer;
-import net.minecraft.server.MinecraftServer;
-import net.minecraft.world.level.storage.LevelResource;
-
-/** Owns integrated-server save gates, scheduling, and live-world lifecycle state. */
-final class RuntimeLifecycle {
-    private static final Duration WORLD_RESOLUTION_RETRY_DELAY = Duration.ofMillis(250);
-
-    private final WorldArchiveRuntime runtime;
-
-    private final Clock clock;
-
-    private final Object lock = new Object();
-
-    private final LiveBackupSaveGate<MinecraftServer, PendingLiveBackup> saveGate =
-            new LiveBackupSaveGate<>();
-
-    private final RetryGate<IntegratedServer> worldResolutionRetries =
-            new RetryGate<>(WORLD_RESOLUTION_RETRY_DELAY);
-
-    // Guarded by lock: which server has autosaving paused for captures, and how
-    // many overlapping captures still hold that pause.
-    private MinecraftServer savingPausedServer;
-
-    private int savingPauses;
-
-    // Guarded by lock: captures still reading each server's world; new requested
-    // saves for that server are refused while one runs, because a forced save
-    // writes even while autosaving is paused.
-    private final Map<MinecraftServer, Integer> activeCaptures = new HashMap<>();
-
-    private IntegratedServer activeServer;
-
-    private BackupWorldContext liveWorld;
-
-    private long liveWorldRevision;
-
-    private IntegratedServer stoppingServer;
-
-    private boolean clientStopping;
-
-    private ScheduleState scheduleState;
-
-    RuntimeLifecycle(WorldArchiveRuntime runtime, Clock clock) {
-        this.runtime = Objects.requireNonNull(runtime, "runtime");
-        this.clock = Objects.requireNonNull(clock, "clock");
-    }
-
-    void register() {
-        ServerLifecycleEvents.SERVER_STARTED.register(this::serverStarted);
-        ServerLifecycleEvents.SERVER_STOPPING.register(this::serverStopping);
-        ServerLifecycleEvents.AFTER_SAVE.register(this::afterSave);
-        ServerLifecycleEvents.SERVER_STOPPED.register(this::serverStopped);
-        ClientTickEvents.END_CLIENT_TICK.register(this::clientTick);
-        ClientLifecycleEvents.CLIENT_STOPPING.register(this::clientStopping);
-    }
-
-    void ensureLiveWorldResolution() {
-        IntegratedServer server;
-        long revision;
-        RetryGate.Attempt<IntegratedServer> attempt;
-        synchronized (lock) {
-            if (runtime.isClosed() || activeServer == null || liveWorld != null) {
-                return;
-            }
-            server = activeServer;
-            attempt = worldResolutionRetries.tryStart(server, System.nanoTime()).orElse(null);
-            if (attempt == null) {
-                return;
-            }
-            revision = liveWorldRevision;
-        }
-        final BackupWorldSelection selection;
-        try {
-            selection = selectionFor(server);
-        } catch (RuntimeException exception) {
-            worldResolutionRetries.complete(attempt);
-            runtime.logFailure("Integrated world path could not be resolved", exception);
-            return;
-        }
-        runtime.submit(() -> runtime.resolveWorldBlocking(selection))
-                .whenComplete((resolved, throwable) -> completeWorldResolution(
-                        server,
-                        revision,
-                        attempt,
-                        resolved,
-                        throwable));
-    }
-
-    void reconcile(RuntimeState state) {
-        synchronized (lock) {
-            for (WorldConfig configured : state.config().worlds()) {
-                runtime.worldPaths().configure(
-                        configured.worldId(),
-                        configured.path());
-            }
-            if (liveWorld != null
-                    && !runtime.matchesKnownWorld(
-                            liveWorld.worldId(),
-                            liveWorld.worldDirectory(),
-                            state.config())) {
-                liveWorld = null;
-                liveWorldRevision++;
-            }
-            resetSchedule(state, liveWorld);
-        }
-    }
-
-    void close() {
-        PendingLiveBackup abandoned;
-        synchronized (lock) {
-            abandoned = saveGate.clear().orElse(null);
-            scheduleState = null;
-            liveWorld = null;
-            activeServer = null;
-            stoppingServer = null;
-            clientStopping = false;
-            worldResolutionRetries.reset();
-            liveWorldRevision++;
-        }
-        if (abandoned != null) {
-            abandoned.fail(new IllegalStateException(
-                    "Minecraft stopped before the pending save completed"));
-        }
-    }
-
-    BackupWorldContext liveWorld() {
-        synchronized (lock) {
-            return liveWorld;
-        }
-    }
-
-    IntegratedServer matchingServer(BackupWorldContext world) {
-        synchronized (lock) {
-            if (activeServer == null
-                    || liveWorld == null
-                    || !liveWorld.worldId().equals(world.worldId())
-                    || !liveWorld.worldDirectory().equals(world.worldDirectory())) {
-                return null;
-            }
-            return activeServer;
-        }
-    }
-
-    boolean hasPending(WorldId worldId) {
-        synchronized (lock) {
-            PendingLiveBackup pending = saveGate.pending().orElse(null);
-            return pending != null && pending.request().worldId().equals(worldId);
-        }
-    }
-
-    CompletionStage<BackupResult> queueRequestedSave(
-            RuntimeState state,
-            IntegratedServer server,
-            CreateBackupRequest request,
-            ProgressListener progressListener) {
-        if (runtime.isClosed()) {
-            return WorldArchiveRuntime.failedStage("WorldArchive is shutting down");
-        }
-        PendingLiveBackup pending = new PendingLiveBackup(
-                state,
-                server,
-                request,
-                progressListener,
-                new CompletableFuture<>());
-        synchronized (lock) {
-            if (activeServer != server || stoppingServer == server) {
-                return WorldArchiveRuntime.failedStage("The integrated world is closing");
-            }
-            if (capturing(server)) {
-                return WorldArchiveRuntime.failedStage(
-                        "A backup is still copying the world; try again shortly");
-            }
-            if (!saveGate.queueRequested(server, pending)) {
-                return WorldArchiveRuntime.failedStage(
-                        "Another world save is already pending");
-            }
-        }
-        try {
-            server.execute(() -> invokeRequestedSave(pending));
-        } catch (RejectedExecutionException exception) {
-            clearAndFailPending(
-                    pending,
-                    "The integrated server rejected the backup save");
-        }
-        return cancellableResult(pending);
-    }
-
-    /**
-     * A view of a pending backup's result whose cancel asks the backup to stop the same way
-     * the world-exit toast's Cancel button does. The view does not mark itself cancelled: it
-     * completes with the backup's real outcome, which is a cancellation unless the
-     * coordinator had already begun recording the result and refused the request. Callers
-     * cannot complete the backup through it.
-     */
-    private CompletableFuture<BackupResult> cancellableResult(PendingLiveBackup pending) {
-        CompletableFuture<BackupResult> view = new CompletableFuture<>() {
-            @Override
-            public boolean cancel(boolean mayInterruptIfRunning) {
-                if (isDone()) {
-                    return false;
-                }
-                cancelLiveBackup(pending);
-                return true;
-            }
-        };
-        pending.result().whenComplete((result, throwable) -> {
-            if (throwable == null) {
-                view.complete(result);
-            } else {
-                view.completeExceptionally(throwable);
-            }
-        });
-        return view;
-    }
-
-    private void serverStarted(MinecraftServer server) {
-        if (runtime.isClosed() || !(server instanceof IntegratedServer integrated)) {
-            return;
-        }
-        final BackupWorldSelection selection;
-        try {
-            selection = selectionFor(integrated);
-        } catch (RuntimeException exception) {
-            runtime.logFailure("Integrated world path could not be resolved", exception);
-            return;
-        }
-        if (!runtime.acceptsLiveWorld(selection)) {
-            return;
-        }
-        synchronized (lock) {
-            activeServer = integrated;
-            stoppingServer = null;
-            liveWorld = null;
-            scheduleState = null;
-            worldResolutionRetries.reset();
-            liveWorldRevision++;
-        }
-        ensureLiveWorldResolution();
-    }
-
-    private void serverStopping(MinecraftServer server) {
-        if (runtime.isClosed() || !(server instanceof IntegratedServer integrated)) {
-            return;
-        }
-        synchronized (lock) {
-            if (activeServer != integrated) {
-                return;
-            }
-            stoppingServer = integrated;
-            // A capture may still hold saving paused; the shutdown save must always write.
-            if (savingPausedServer == integrated) {
-                savingPausedServer = null;
-                savingPauses = 0;
-            }
-        }
-        integrated.setAutoSave(true);
-        BackupWorldContext world = resolveStoppingWorld(integrated);
-        if (world == null) {
-            return;
-        }
-        installExitBackup(integrated, world);
-    }
-
-    private BackupWorldContext resolveStoppingWorld(IntegratedServer server) {
-        BackupWorldContext world = liveWorldFor(server);
-        Throwable failure = null;
-        if (world == null) {
-            try {
-                world = runtime.resolveWorldBlocking(selectionFor(server)).orElse(null);
-            } catch (IOException | RuntimeException exception) {
-                failure = exception;
-                runtime.logFailure(
-                        "Exit backup world identity could not be resolved",
-                        exception);
-            }
-        }
-        if (world == null) {
-            runtime.observeExitResult(
-                    null,
-                    failure == null
-                            ? new IllegalStateException(
-                                    "Exit backup world identity was unavailable")
-                            : failure);
-        }
-        return world;
-    }
-
-    private void installExitBackup(
-            IntegratedServer server,
-            BackupWorldContext world) {
-        RuntimeConfigurationGate.Permit permit = runtime.configurationGate().enterBackup();
-        boolean transferred = false;
-        try {
-            RuntimeState state = runtime.states().currentOrNull();
-            Optional<String> problem = exitBackupProblem(state);
-            if (problem.isPresent()) {
-                runtime.observeExitResult(
-                        null,
-                        new IllegalStateException(problem.orElseThrow()));
-                return;
-            }
-            CreateBackupRequest request = WorldArchiveRuntime.request(
-                    world,
-                    Optional.empty(),
-                    BackupTrigger.WORLD_EXIT);
-            if (!state.enabledDestinations(request)) {
-                if (state.selector().hasConfiguredDestination(request)) {
-                    runtime.observeExitResult(
-                            null,
-                            new IllegalStateException(state.selector()
-                                    .warning()
-                                    .orElse("A configured world-exit destination is unavailable")));
-                }
-                return;
-            }
-            CompletableFuture<BackupResult> exitResult = new CompletableFuture<>();
-            PendingLiveBackup exit = new PendingLiveBackup(
-                    state,
-                    server,
-                    request,
-                    runtime.backupProgressListener(exitResult),
-                    exitResult);
-            LiveBackupSaveGate.ExitInstall<PendingLiveBackup> installation;
-            synchronized (lock) {
-                if (activeServer != server || stoppingServer != server) {
-                    return;
-                }
-                installation = saveGate.installExit(server, exit);
-            }
-            if (!installation.installed()) {
-                runtime.observeExitResult(
-                        null,
-                        new IllegalStateException(
-                                "Another integrated world is still completing its exit backup"));
-                return;
-            }
-            exit.settled().whenComplete((ignored, throwable) -> permit.close());
-            transferred = true;
-            installation.displaced().ifPresent(displaced -> displaced.fail(
-                    new IllegalStateException(
-                            "World shutdown replaced the pending manual save")));
-            runtime.trackExit(exit.result());
-        } finally {
-            if (!transferred) {
-                permit.close();
-            }
-        }
-    }
-
-    private Optional<String> exitBackupProblem(RuntimeState state) {
-        if (state == null || runtime.isClosed()) {
-            return Optional.of("World-exit backup runtime was unavailable");
-        }
-        return runtime.storageIssue(state);
-    }
-
-    private void afterSave(MinecraftServer server, boolean flush, boolean force) {
-        ensureLiveWorldResolution();
-        PendingLiveBackup requested;
-        synchronized (lock) {
-            requested = saveGate.observeRequestedSave(server, flush, force).orElse(null);
-            if (requested == null) {
-                saveGate.observeExitSave(server, flush, force);
-            } else {
-                // Counted while still holding the lock that freed the save gate, so
-                // no new save can slip in before the capture registers itself.
-                captureStarted(server);
-            }
-        }
-        if (requested != null) {
-            captureRunningWorld(requested);
-        }
-    }
-
-    private void serverStopped(MinecraftServer server) {
-        LiveBackupSaveGate.StopResult<PendingLiveBackup> stopped;
-        boolean shutdownAfterServer;
-        synchronized (lock) {
-            if (activeServer != server
-                    && stoppingServer != server
-                    && !saveGate.ownedBy(server)) {
-                return;
-            }
-            stopped = saveGate.stop(server);
-            if (activeServer == server) {
-                activeServer = null;
-                liveWorld = null;
-                scheduleState = null;
-                worldResolutionRetries.reset();
-                liveWorldRevision++;
-            }
-            if (stoppingServer == server) {
-                stoppingServer = null;
-            }
-            shutdownAfterServer = clientStopping
-                    && activeServer == null
-                    && stoppingServer == null;
-        }
-        completeStoppedServer(stopped);
-        if (shutdownAfterServer) {
-            runtime.shutdown();
-        }
-    }
-
-    private void completeStoppedServer(
-            LiveBackupSaveGate.StopResult<PendingLiveBackup> stopped) {
-        switch (stopped.kind()) {
-            case NONE -> { }
-            case REQUEST_ABANDONED -> stopped.value().orElseThrow().fail(
-                    new IllegalStateException(
-                            "The server stopped before the pending save completed"));
-            case EXIT_MISSING_SAVE -> stopped.value().orElseThrow().fail(
-                    new IllegalStateException(
-                            "The server stopped before its final save completed"));
-            case EXIT_READY -> {
-                PendingLiveBackup exit = stopped.value().orElseThrow();
-                runtime.beginBackupProgress(
-                        BackgroundBackupWarnings.worldExitStartedMessage(),
-                        exit.result(),
-                        () -> cancelLiveBackup(exit));
-                boolean quitting;
-                synchronized (lock) {
-                    quitting = clientStopping;
-                }
-                if (quitting) {
-                    // Full quit: no tick loop remains to protect, and capturing here
-                    // keeps the copy out of the bounded shutdown wait.
-                    captureAndDispatch(exit);
-                } else {
-                    captureStoppedWorld(exit);
-                }
-            }
-            default -> throw new IllegalStateException(
-                    "Unknown live-save stop outcome");
-        }
-    }
-
-    private void clientStopping(Minecraft ignored) {
-        boolean noIntegratedServer;
-        synchronized (lock) {
-            clientStopping = true;
-            noIntegratedServer = activeServer == null && stoppingServer == null;
-        }
-        if (noIntegratedServer) {
-            runtime.shutdown();
-        }
-    }
-
-    /** Runs every client tick; a backup bug must never take the game down with it. */
-    private void clientTick(Minecraft ignored) {
-        try {
-            tick();
-        } catch (RuntimeException exception) {
-            runtime.logFailure("Scheduled backup tick failed", exception);
-        }
-    }
-
-    private void tick() {
-        ensureLiveWorldResolution();
-        runtime.showRetainedBackgroundWarning();
-        RuntimeState state = runtime.states().currentOrNull();
-        if (runtime.isClosed()
-                || state == null
-                || !state.config().triggers().scheduledEnabled()) {
-            return;
-        }
-        ScheduledBackup scheduled = pollScheduledBackup(state);
-        if (scheduled == null) {
-            return;
-        }
-        startScheduledBackup(state, scheduled)
-                .whenComplete(runtime::observeScheduledResult);
-    }
-
-    private ScheduledBackup pollScheduledBackup(RuntimeState state) {
-        synchronized (lock) {
-            // poll() consumes the due tick, so every other guard runs first.
-            if (scheduleState == null
-                    || scheduleState.state() != state
-                    || liveWorld == null
-                    || activeServer == null
-                    || capturing(activeServer)
-                    || !scheduleState.worldId().equals(liveWorld.worldId())
-                    || saveGate.hasPending()
-                    || scheduleState.schedule().poll(clock.instant()).isEmpty()) {
-                return null;
-            }
-            return new ScheduledBackup(liveWorld, activeServer);
-        }
-    }
-
-    private CompletionStage<BackupResult> startScheduledBackup(
-            RuntimeState state,
-            ScheduledBackup scheduled) {
-        return runtime.withBackupPermit(() -> {
-            if (runtime.states().currentOrNull() != state
-                    || runtime.busyAcrossStates(scheduled.world().worldId())) {
-                return WorldArchiveRuntime.failedStage(
-                        "Scheduled backup configuration changed before capture");
-            }
-            Optional<String> storageIssue = runtime.storageIssue(state);
-            if (storageIssue.isPresent()) {
-                return WorldArchiveRuntime.failedStage(storageIssue.orElseThrow());
-            }
-            CreateBackupRequest request = WorldArchiveRuntime.request(
-                    scheduled.world(),
-                    Optional.empty(),
-                    BackupTrigger.SCHEDULED);
-            if (!state.enabledDestinations(request)) {
-                return WorldArchiveRuntime.failedStage(
-                        "Scheduled backups are disabled for this world");
-            }
-            return queueRequestedSave(
-                    state,
-                    scheduled.server(),
-                    request,
-                    ProgressListener.NO_OP);
-        });
-    }
-
-    private void invokeRequestedSave(PendingLiveBackup pending) {
-        synchronized (lock) {
-            if (saveGate.pending().orElse(null) != pending
-                    || stoppingServer == pending.server()
-                    || !saveGate.armRequested(pending.server(), pending)) {
-                return;
-            }
-        }
-        try {
-            pending.server().saveEverything(false, true, true);
-        } catch (RuntimeException exception) {
-            clearAndFailPending(
-                    pending,
-                    "The integrated world could not be saved");
-            runtime.logFailure("Requested world save failed", exception);
-        } finally {
-            boolean unmatched;
-            synchronized (lock) {
-                unmatched = saveGate.clear(pending.server(), pending).isPresent();
-            }
-            // Completing the future runs continuations; keep them off the lifecycle lock.
-            if (unmatched) {
-                pending.fail(new IllegalStateException(
-                        "The requested save produced no matching capture event"));
-            }
-        }
-    }
-
-    /**
-     * Captures the just-saved running world on a worker thread so the server keeps
-     * ticking. Autosaving is paused while captures run, which stops chunk writes;
-     * a few small files (player data, level.dat) can still be written, and the
-     * capture re-copies itself when that happens. Runs on the server thread.
-     */
-    private void captureRunningWorld(PendingLiveBackup pending) {
-        synchronized (lock) {
-            if (savingPausedServer != pending.server()) {
-                savingPausedServer = pending.server();
-                savingPauses = 0;
-            }
-            savingPauses++;
-        }
-        pending.server().setAutoSave(false);
-        dispatchCapture(pending, true);
-    }
-
-    private void captureStoppedWorld(PendingLiveBackup pending) {
-        synchronized (lock) {
-            captureStarted(pending.server());
-        }
-        dispatchCapture(pending, false);
-    }
-
-    /** The caller has already counted this capture via {@link #captureStarted}. */
-    private void dispatchCapture(PendingLiveBackup pending, boolean resumeSaving) {
-        runtime.submit(() -> {
-            captureAndDispatch(pending);
-            return null;
-        }).whenComplete((ignored, throwable) -> {
-            captureFinished(pending.server());
-            if (resumeSaving) {
-                resumeLevelSaving(pending.server());
-            }
-            if (throwable != null) {
-                pending.fail(WorldArchiveRuntime.safeFailure(
-                        throwable,
-                        "World capture could not be started"));
-            }
-        });
-    }
-
-    private void captureStarted(MinecraftServer server) {
-        activeCaptures.merge(server, 1, Integer::sum);
-    }
-
-    private void captureFinished(MinecraftServer server) {
-        synchronized (lock) {
-            // A null result removes the entry, so stopped servers do not linger.
-            activeCaptures.computeIfPresent(
-                    server,
-                    (ignored, count) -> count > 1 ? count - 1 : null);
-        }
-    }
-
-    private boolean capturing(MinecraftServer server) {
-        return activeCaptures.getOrDefault(server, 0) > 0;
-    }
-
-    /** Overlapping captures each pause saving; only the last one to finish resumes it. */
-    private void resumeLevelSaving(MinecraftServer server) {
-        synchronized (lock) {
-            if (savingPausedServer != server || --savingPauses > 0) {
-                return;
-            }
-            savingPausedServer = null;
-        }
-        // A stopped server silently drops the task; serverStopping already resumed it.
-        server.execute(() -> server.setAutoSave(true));
-    }
-
-    private void captureAndDispatch(PendingLiveBackup pending) {
-        if (!pending.beginCapture()) {
-            pending.fail(cancelled());
-            return;
-        }
-        PreparedBackup prepared;
-        boolean proceed;
-        try {
-            prepared = prepareCapture(pending);
-        } finally {
-            proceed = pending.endCapture();
-        }
-        if (prepared == null) {
-            return;
-        }
-        if (!proceed) {
-            try {
-                prepared.close();
-            } catch (IOException exception) {
-                runtime.logFailure("A cancelled capture could not be released", exception);
-            }
-            pending.fail(cancelled());
-            return;
-        }
-        CompletionStage<BackupResult> operation;
-        try {
-            operation = pending.state().coordinator().createPreparedBackup(
-                    prepared,
-                    pending.progressListener());
-        } catch (RuntimeException | Error exception) {
-            try {
-                prepared.close();
-            } catch (IOException closeFailure) {
-                exception.addSuppressed(closeFailure);
-            }
-            pending.fail(WorldArchiveRuntime.safeFailure(
-                    exception,
-                    "Prepared backup could not be started"));
-            if (exception instanceof Error error) {
-                throw error;
-            }
-            return;
-        }
-        CompletableFuture<BackupResult> future = operation.toCompletableFuture();
-        if (!pending.dispatched(future)) {
-            future.cancel(true);
-        }
-        future.whenComplete((result, throwable) -> completeBackup(
-                pending,
-                result,
-                throwable));
-    }
-
-    /**
-     * Cancel handler for the world-exit toast and the manual backup screen. Safe to call
-     * from the render thread: the coordinator cancel runs on a worker because it may
-     * release captured files.
-     */
-    private void cancelLiveBackup(PendingLiveBackup pending) {
-        CompletableFuture<BackupResult> running = pending.requestCancel();
-        if (running != null) {
-            runtime.submit(() -> running.cancel(true));
-        }
-    }
-
-    private static CancellationException cancelled() {
-        return new CancellationException("Backup was cancelled");
-    }
-
-    private PreparedBackup prepareCapture(PendingLiveBackup pending) {
-        try {
-            CaptureProgressListener progress = (completed, total) -> pending.state()
-                    .coordinator()
-                    .currentOperation(pending.request().worldId())
-                    .ifPresent(current -> WorldArchiveRuntime.notifyProgress(
-                            pending.progressListener(),
-                            current));
-            return pending.state().coordinator().prepareCapture(
-                    pending.request(),
-                    progress);
-        } catch (IOException | InterruptedException | RuntimeException | Error exception) {
-            if (exception instanceof InterruptedException) {
-                Thread.currentThread().interrupt();
-            }
-            if (pending.isCancelled()) {
-                // The Cancel button interrupted the capture thread; that is not a failure.
-                pending.fail(cancelled());
-            } else {
-                pending.fail(WorldArchiveRuntime.safeFailure(
-                        exception,
-                        "World capture could not be prepared"));
-            }
-            if (exception instanceof Error error) {
-                throw error;
-            }
-            return null;
-        }
-    }
-
-    private static void completeBackup(
-            PendingLiveBackup pending,
-            BackupResult result,
-            Throwable throwable) {
-        if (throwable != null) {
-            pending.fail(throwable);
-        } else if (result == null) {
-            pending.fail(new IllegalStateException(
-                    "Backup completed without a result"));
-        } else {
-            pending.succeed(result);
-        }
-    }
-
-    private void completeWorldResolution(
-            IntegratedServer server,
-            long revision,
-            RetryGate.Attempt<IntegratedServer> attempt,
-            Optional<BackupWorldContext> resolved,
-            Throwable throwable) {
-        if (throwable != null) {
-            runtime.logFailure("Integrated world identity could not be resolved", throwable);
-        }
-        synchronized (lock) {
-            if (!worldResolutionRetries.complete(attempt)
-                    || runtime.isClosed()
-                    || activeServer != server
-                    || liveWorldRevision != revision
-                    || throwable != null
-                    || resolved.isEmpty()) {
-                return;
-            }
-            liveWorld = resolved.orElseThrow();
-            resetSchedule(runtime.states().currentOrNull(), liveWorld);
-        }
-    }
-
-    private void resetSchedule(RuntimeState state, BackupWorldContext world) {
-        if (state == null || world == null || activeServer == null) {
-            scheduleState = null;
-            return;
-        }
-        scheduleState = new ScheduleState(
-                state,
-                world.worldId(),
-                NoCatchUpSchedule.minutes(
-                        state.config().triggers().scheduleIntervalMinutes(),
-                        clock.instant()));
-    }
-
-    private BackupWorldContext liveWorldFor(IntegratedServer server) {
-        synchronized (lock) {
-            return activeServer == server ? liveWorld : null;
-        }
-    }
-
-    private void clearAndFailPending(PendingLiveBackup pending, String message) {
-        synchronized (lock) {
-            saveGate.clear(pending.server(), pending);
-        }
-        pending.fail(new IllegalStateException(message));
-    }
-
-    private static BackupWorldSelection selectionFor(IntegratedServer server) {
-        Path worldDirectory = server.getWorldPath(LevelResource.ROOT)
-                .toAbsolutePath()
-                .normalize();
-        Path worldsDirectory = worldDirectory.getParent();
-        Path fileName = worldDirectory.getFileName();
-        if (worldsDirectory == null || fileName == null) {
-            throw new IllegalStateException(
-                    "Integrated world path has no storage parent");
-        }
-        return new BackupWorldSelection(
-                worldDirectory,
-                worldsDirectory,
-                fileName.toString(),
-                server.getWorldData().getLevelName());
-    }
-
-    private record ScheduleState(
-            RuntimeState state,
-            WorldId worldId,
-            NoCatchUpSchedule schedule) {
-        private ScheduleState {
-            Objects.requireNonNull(state, "state");
-            Objects.requireNonNull(worldId, "worldId");
-            Objects.requireNonNull(schedule, "schedule");
-        }
-    }
-
-    private record ScheduledBackup(
-            BackupWorldContext world,
-            IntegratedServer server) {
-        private ScheduledBackup {
-            Objects.requireNonNull(world, "world");
-            Objects.requireNonNull(server, "server");
-        }
-    }
-
-    private static final class PendingLiveBackup {
-        private final RuntimeState state;
-
-        private final IntegratedServer server;
-
-        private final CreateBackupRequest request;
-
-        private final ProgressListener progressListener;
-
-        private final CompletableFuture<BackupResult> result;
-
-        private final CompletableFuture<Void> settled = new CompletableFuture<>();
-
-        // Guarded by this. A cancellation interrupts the capture thread while the
-        // world is copied, and cancels the coordinator operation once dispatched.
-        private boolean cancelRequested;
-
-        private Thread captureThread;
-
-        private CompletableFuture<BackupResult> operation;
-
-        private PendingLiveBackup(
-                RuntimeState state,
-                IntegratedServer server,
-                CreateBackupRequest request,
-                ProgressListener progressListener,
-                CompletableFuture<BackupResult> result) {
-            this.state = Objects.requireNonNull(state, "state");
-            this.server = Objects.requireNonNull(server, "server");
-            this.request = Objects.requireNonNull(request, "request");
-            this.progressListener = Objects.requireNonNull(
-                    progressListener,
-                    "progressListener");
-            this.result = Objects.requireNonNull(result, "result");
-        }
-
-        private RuntimeState state() {
-            return state;
-        }
-
-        private IntegratedServer server() {
-            return server;
-        }
-
-        private CreateBackupRequest request() {
-            return request;
-        }
-
-        private ProgressListener progressListener() {
-            return progressListener;
-        }
-
-        private CompletableFuture<BackupResult> result() {
-            return result;
-        }
-
-        private CompletableFuture<Void> settled() {
-            return settled;
-        }
-
-        /**
-         * Asks the backup to stop. While the world is copied this interrupts the capture
-         * thread and returns null. Once dispatched it returns the running operation, which
-         * the caller cancels off-thread; the coordinator refuses once it records the
-         * result, and the backup then completes normally.
-         */
-        private synchronized CompletableFuture<BackupResult> requestCancel() {
-            if (result.isDone()) {
-                return null;
-            }
-            cancelRequested = true;
-            if (captureThread != null) {
-                captureThread.interrupt();
-                return null;
-            }
-            return operation;
-        }
-
-        private synchronized boolean isCancelled() {
-            return cancelRequested;
-        }
-
-        /** Claims the calling thread for the capture; false when cancelled before it began. */
-        private synchronized boolean beginCapture() {
-            if (cancelRequested) {
-                return false;
-            }
-            captureThread = Thread.currentThread();
-            return true;
-        }
-
-        /**
-         * Releases the capture thread and clears an interrupt a cancellation may have
-         * left on it. Returns false when the backup must not continue to its destinations.
-         */
-        private boolean endCapture() {
-            boolean proceed;
-            synchronized (this) {
-                captureThread = null;
-                proceed = !cancelRequested;
-            }
-            Thread.interrupted();
-            return proceed;
-        }
-
-        /** Records the running operation; false when a cancellation arrived first. */
-        private synchronized boolean dispatched(CompletableFuture<BackupResult> future) {
-            operation = Objects.requireNonNull(future, "future");
-            return !cancelRequested;
-        }
-
-        private void succeed(BackupResult value) {
-            result.complete(value);
-            settled.complete(null);
-        }
-
-        private void fail(Throwable throwable) {
-            result.completeExceptionally(throwable);
-            settled.complete(null);
-        }
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeNavigation.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeNavigation.java
index 5efe899..4baa84d 100644
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeNavigation.java
+++ b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeNavigation.java
@@ -1,266 +1,166 @@
 package dev.ishaanko.worldarchive.runtime;
 
 import com.mojang.blaze3d.Blaze3D;
+import dev.ishaanko.worldarchive.config.PathSafety;
 import dev.ishaanko.worldarchive.core.RestoreBackupResult;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupRecord;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.SafeText;
 import dev.ishaanko.worldarchive.settings.ClientSettingsAccess;
+import dev.ishaanko.worldarchive.support.AsyncTasks;
 import dev.ishaanko.worldarchive.ui.BackupBrowserScreen;
-import dev.ishaanko.worldarchive.ui.BackupWorldContext;
-import dev.ishaanko.worldarchive.ui.model.BackupRow;
+import dev.ishaanko.worldarchive.ui.BackupClientFacade;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
+import dev.ishaanko.worldarchive.ui.model.RestoreChoice;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
 import java.nio.file.Path;
 import java.util.Objects;
 import java.util.Optional;
-import java.util.concurrent.RejectedExecutionException;
+import java.util.concurrent.CompletionStage;
 import net.minecraft.client.Minecraft;
 import net.minecraft.client.gui.screens.Screen;
 import net.minecraft.client.gui.screens.TitleScreen;
+import net.minecraft.client.gui.screens.worldselection.EditWorldScreen;
 import net.minecraft.client.gui.screens.worldselection.SelectWorldScreen;
 import net.minecraft.client.multiplayer.ClientLevel;
 import net.minecraft.world.level.storage.LevelStorageSource;
 import net.minecraft.world.level.validation.ContentValidationException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
-/** Owns client-screen transitions and managed-folder navigation. */
+/** Opens WorldArchive's screens, the backup folders, and a restored world. */
 final class RuntimeNavigation {
-    private final WorldArchiveRuntime runtime;
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
 
-    RuntimeNavigation(WorldArchiveRuntime runtime) {
-        this.runtime = Objects.requireNonNull(runtime, "runtime");
+    private final Minecraft minecraft;
+
+    private final StateCalls calls;
+
+    private final ServiceGraph graph;
+
+    RuntimeNavigation(Minecraft minecraft, StateCalls calls, ServiceGraph graph) {
+        this.minecraft = Objects.requireNonNull(minecraft, "minecraft");
+        this.calls = Objects.requireNonNull(calls, "calls");
+        this.graph = Objects.requireNonNull(graph, "graph");
     }
 
-    void openManagedFolder(
-            BackupWorldContext world,
-            Optional<BackupRow> selectedBackup) {
-        Objects.requireNonNull(world, "world");
-        Objects.requireNonNull(selectedBackup, "selectedBackup");
-        RuntimeConfigurationGate.Permit permit = runtime.configurationGate().enterBackup();
-        boolean transferred = false;
-        try {
-            RuntimeState state = runtime.requireCurrentState();
-            runtime.storageIssue(state).ifPresent(issue -> {
-                throw new IllegalStateException(issue);
-            });
-            Path destination = managedPath(state, world, selectedBackup);
-            runtime.services().workerExecutor().execute(
-                    () -> openManagedFolder(destination, permit));
-            transferred = true;
-        } catch (RejectedExecutionException exception) {
-            throw new IllegalStateException("WorldArchive is shutting down");
-        } finally {
-            if (!transferred) {
-                permit.close();
-            }
-        }
+    /** Opens the browser of {@code world} over {@code returnTo} on the render thread. */
+    void openBrowser(Screen returnTo, BackupWorldContext world, BackupClientFacade facade) {
+        minecraft.execute(() -> minecraft.setScreenAndShow(new BackupBrowserScreen(returnTo, world, facade)));
+    }
+
+    /**
+     * Opens the folder that holds the selected backup, or the world's backups. A folder that does
+     * not exist yet is never created here: its nearest existing parent opens instead, because an
+     * empty folder in the place of a Git repository would break the world's next Git backup.
+     */
+    CompletionStage<Void> openManagedFolder(BackupWorldContext world, Optional<BackupId> selected) {
+        return calls.withState(state -> AsyncTasks.supplyChecked(graph.executor(), () -> {
+            Path folder = PathSafety.nearestExisting(folder(state, world, selected)).orElseThrow(() ->
+                    new IOException("The backup folder is on a drive that is not connected"));
+            minecraft.execute(() -> Blaze3D.openPath(folder));
+            return null;
+        }));
     }
 
     void openSettings(Screen returnTo) {
-        Objects.requireNonNull(returnTo, "returnTo");
-        if (!runtime.isClosed()) {
-            Minecraft minecraft = runtime.services().minecraft();
-            minecraft.execute(() -> minecraft.setScreenAndShow(
-                    ClientSettingsAccess.createScreen(returnTo)));
-        }
+        minecraft.execute(() -> minecraft.setScreenAndShow(ClientSettingsAccess.createScreen(returnTo)));
     }
 
     void selectRestoredWorld(Screen returnTo, RestoreBackupResult result) {
-        transitionToRestoredWorld(returnTo, result, false);
+        transition(returnTo, result, RestoreChoice.SELECT);
     }
 
     void playRestoredWorld(Screen returnTo, RestoreBackupResult result) {
-        transitionToRestoredWorld(returnTo, result, true);
+        transition(returnTo, result, RestoreChoice.PLAY);
     }
 
-    /**
-     * Opens the live world's browser over {@code returnTo}; false when no world is resolved or
-     * the runtime is not ready.
-     */
-    boolean openBrowser(Screen returnTo) {
-        Objects.requireNonNull(returnTo, "returnTo");
-        BackupWorldContext world = runtime.currentLiveWorld();
-        if (world == null || runtime.unavailable()) {
-            return false;
-        }
-        Minecraft minecraft = runtime.services().minecraft();
-        minecraft.execute(() -> {
-            if (!runtime.isClosed()) {
-                minecraft.setScreenAndShow(new BackupBrowserScreen(returnTo, world, runtime));
+    private Path folder(RuntimeState state, BackupWorldContext world, Optional<BackupId> selected) throws IOException {
+        Path zip = state.storagePaths().zipDirectory(world.worldId()).resolve(world.worldId().toString());
+        Path git = state.git().repositoryFor(world.worldId());
+        if (selected.isPresent()) {
+            Optional<BackupRecord> record = graph.catalog().find(selected.get());
+            if (record.map(found -> holds(found, DestinationType.ZIP)).orElse(false)) {
+                return zip;
+            }
+            if (record.map(found -> holds(found, DestinationType.GIT)).orElse(false)) {
+                return git;
             }
-        });
-        return true;
-    }
-
-    boolean sourceDirectoryAvailable(BackupWorldContext world) {
-        if (!runtime.actionContexts().sourceActionsAllowed(world)) {
-            return false;
-        }
-        try {
-            return Files.isDirectory(world.worldDirectory(), LinkOption.NOFOLLOW_LINKS)
-                    && Files.isRegularFile(
-                            world.worldDirectory().resolve("level.dat"),
-                            LinkOption.NOFOLLOW_LINKS);
-        } catch (SecurityException exception) {
-            return false;
         }
+        return state.config().zip().enabled() ? zip : git;
     }
 
-    private void openManagedFolder(
-            Path destination,
-            RuntimeConfigurationGate.Permit permit) {
-        boolean clientCallbackScheduled = false;
-        try {
-            Files.createDirectories(destination);
-            if (!runtime.isClosed()) {
-                runtime.services().minecraft().execute(() -> {
-                    try {
-                        if (!runtime.isClosed()) {
-                            Blaze3D.openPath(destination);
-                        }
-                    } catch (RuntimeException exception) {
-                        runtime.logFailure(
-                                "Managed backup folder could not be opened",
-                                exception);
-                    } finally {
-                        permit.close();
-                    }
-                });
-                clientCallbackScheduled = true;
-            }
-        } catch (IOException | RuntimeException exception) {
-            runtime.logFailure("Managed backup folder could not be opened", exception);
-        } finally {
-            if (!clientCallbackScheduled) {
-                permit.close();
-            }
-        }
+    private static boolean holds(BackupRecord record, DestinationType type) {
+        return record.result().destinations().stream()
+                .anyMatch(destination -> destination.destination() == type && destination.isDurable());
     }
 
-    private void transitionToRestoredWorld(
-            Screen returnTo,
-            RestoreBackupResult result,
-            boolean playImmediately) {
+    /**
+     * Shows or plays a restored world. A world open in the game is left first. An Edit World
+     * screen on the way back is closed through its own callback, which releases the lock it holds
+     * on the edited world; otherwise that world would drop out of the world list.
+     */
+    private void transition(Screen returnTo, RestoreBackupResult result, RestoreChoice choice) {
         Objects.requireNonNull(returnTo, "returnTo");
         Objects.requireNonNull(result, "result");
-        Minecraft minecraft = runtime.services().minecraft();
         minecraft.execute(() -> {
-            if (runtime.isClosed()) {
-                return;
-            }
-            Optional<String> storageName = validatedRestoredStorageName(result);
+            Optional<String> storageName = restoredStorageName(result);
             if (storageName.isEmpty()) {
                 return;
             }
-            String name = storageName.orElseThrow();
-            RestoredWorldTransition.afterLeavingActiveWorld(
-                    this::hasActiveWorldSession,
-                    () -> minecraft.disconnectFromWorld(ClientLevel.DEFAULT_QUIT_MESSAGE),
-                    leftActiveWorld -> finishRestoredWorldTransition(
-                            leftActiveWorld ? new TitleScreen() : returnTo,
-                            name,
-                            playImmediately,
-                            leftActiveWorld));
+            Screen origin = returnTo;
+            if (origin instanceof EditWorldScreen editWorld) {
+                editWorld.onClose();
+                origin = minecraft.gui.screen();
+            }
+            if (minecraft.hasSingleplayerServer() || minecraft.level != null || minecraft.getConnection() != null) {
+                minecraft.disconnectFromWorld(ClientLevel.DEFAULT_QUIT_MESSAGE);
+                origin = new TitleScreen();
+            }
+            switch (choice) {
+                case PLAY -> play(origin, storageName.get());
+                case SELECT -> showInWorldList(origin, storageName.get());
+                default -> throw new IllegalArgumentException("Unknown restore choice " + choice);
+            }
         });
     }
 
-    private void finishRestoredWorldTransition(
-            Screen returnTo,
-            String storageName,
-            boolean playImmediately,
-            boolean leftActiveWorld) {
-        if (playImmediately) {
-            playRestoredWorld(returnTo, storageName, leftActiveWorld);
-        } else {
-            showRestoredWorldSelection(returnTo, storageName);
-        }
-    }
-
-    private boolean hasActiveWorldSession() {
-        Minecraft minecraft = runtime.services().minecraft();
-        return minecraft.hasSingleplayerServer()
-                || minecraft.level != null
-                || minecraft.getConnection() != null;
-    }
-
-    private void showRestoredWorldSelection(Screen returnTo, String storageName) {
-        Minecraft minecraft = runtime.services().minecraft();
+    private void showInWorldList(Screen returnTo, String storageName) {
         SelectWorldScreen screen = new SelectWorldScreen(returnTo);
         minecraft.setScreenAndShow(screen);
         RestoredWorldSelection.install(screen, storageName);
     }
 
-    private void playRestoredWorld(
-            Screen returnTo,
-            String storageName,
-            boolean selectOnFailure) {
-        Minecraft minecraft = runtime.services().minecraft();
+    /** Opens the restored world; when it cannot open, the world list shows it selected. */
+    private void play(Screen returnTo, String storageName) {
         try (LevelStorageSource.LevelStorageAccess ignored =
                 minecraft.getLevelSource().validateAndCreateAccess(storageName)) {
             // Validation and a clean session close happen before vanilla starts the world.
         } catch (IOException | ContentValidationException exception) {
-            runtime.logFailure("Restored world validation failed", exception);
-            handleRestoredWorldPlayFailure(returnTo, storageName, selectOnFailure);
+            LOGGER.warn("The restored world could not be opened: {}", SafeText.from(exception, "no reason", 300));
+            showInWorldList(returnTo, storageName);
             return;
         }
-        minecraft.createWorldOpenFlows().openWorld(
-                storageName,
-                () -> handleRestoredWorldPlayFailure(
-                        returnTo,
-                        storageName,
-                        selectOnFailure));
-    }
-
-    private void handleRestoredWorldPlayFailure(
-            Screen returnTo,
-            String storageName,
-            boolean selectRestoredWorld) {
-        if (selectRestoredWorld) {
-            showRestoredWorldSelection(returnTo, storageName);
-        } else {
-            runtime.services().minecraft().setScreenAndShow(returnTo);
-        }
+        minecraft.createWorldOpenFlows().openWorld(storageName, () -> showInWorldList(returnTo, storageName));
     }
 
-    private Optional<String> validatedRestoredStorageName(RestoreBackupResult result) {
+    /** The restored world's folder name in the game's saves folder, compared by real paths. */
+    private Optional<String> restoredStorageName(RestoreBackupResult result) {
         try {
-            Path restored = result.restoredWorldDirectory().toAbsolutePath().normalize();
-            Path base = runtime.services().minecraft().getLevelSource().getBaseDir()
-                    .toAbsolutePath()
-                    .normalize();
-            Path fileName = restored.getFileName();
-            if (fileName == null
-                    || !base.equals(restored.getParent())
-                    || !Files.isDirectory(restored, LinkOption.NOFOLLOW_LINKS)) {
-                runtime.logFailure(
-                        "Restored world path could not be validated",
-                        new IOException(
-                                "Restored world is outside the active saves directory"));
-                return Optional.empty();
+            Path restored = result.restoredWorldDirectory().toRealPath();
+            Path saves = minecraft.getLevelSource().getBaseDir().toRealPath();
+            Path name = restored.getFileName();
+            if (name != null && saves.equals(restored.getParent())
+                    && Files.isDirectory(restored, LinkOption.NOFOLLOW_LINKS)) {
+                return Optional.of(name.toString());
             }
-            return Optional.of(fileName.toString());
-        } catch (SecurityException exception) {
-            runtime.logFailure("Restored world path could not be validated", exception);
-            return Optional.empty();
+            LOGGER.warn("The restored world {} is not in the saves folder {}", restored, saves);
+        } catch (IOException | SecurityException exception) {
+            LOGGER.warn("The restored world could not be found: {}", SafeText.from(exception, "no reason", 300));
         }
+        return Optional.empty();
     }
-
-    private Path managedPath(
-            RuntimeState state,
-            BackupWorldContext world,
-            Optional<BackupRow> selected) {
-        if (selected.isPresent() && selected.orElseThrow().zip().durable()) {
-            return state.storagePaths()
-                    .zipDirectory(world.worldId())
-                    .resolve(world.worldId().toString());
-        }
-        if (selected.isPresent() && selected.orElseThrow().git().durable()) {
-            return state.gitBackend().repositoryFor(world.worldId());
-        }
-        if (state.config().zip().enabled()) {
-            return state.storagePaths()
-                    .zipDirectory(world.worldId())
-                    .resolve(world.worldId().toString());
-        }
-        return state.gitBackend().repositoryFor(world.worldId());
-    }
-
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeNoticeStore.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeNoticeStore.java
deleted file mode 100644
index 308fb57..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeNoticeStore.java
+++ /dev/null
@@ -1,60 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import dev.ishaanko.worldarchive.core.AtomicFiles;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Small atomic store for a warning that must survive client shutdown. */
-final class RuntimeNoticeStore {
-    private static final int MAXIMUM_NOTICE_BYTES = 1_024;
-
-    private final Path file;
-
-    RuntimeNoticeStore(Path file) {
-        this.file = Objects.requireNonNull(file, "file").toAbsolutePath().normalize();
-    }
-
-    synchronized Optional<String> load() throws IOException {
-        if (!Files.exists(file, LinkOption.NOFOLLOW_LINKS)) {
-            return Optional.empty();
-        }
-        if (!Files.isRegularFile(file, LinkOption.NOFOLLOW_LINKS)
-                || Files.isSymbolicLink(file)
-                || Files.size(file) > MAXIMUM_NOTICE_BYTES) {
-            throw new IOException("Stored background backup notice is unsafe");
-        }
-        return Optional.of(requireSafe(
-                AtomicFiles.readUtf8(file, MAXIMUM_NOTICE_BYTES)));
-    }
-
-    synchronized void save(String message) throws IOException {
-        AtomicFiles.writeUtf8(
-                file,
-                requireSafe(message) + System.lineSeparator(),
-                MAXIMUM_NOTICE_BYTES);
-    }
-
-    synchronized void retain(String message) throws IOException {
-        if (load().isEmpty()) {
-            save(message);
-        }
-    }
-
-    synchronized void clear() throws IOException {
-        Files.deleteIfExists(file);
-    }
-
-    private static String requireSafe(String message) throws IOException {
-        String safe = Objects.requireNonNull(message, "message").strip();
-        if (safe.isEmpty()
-                || safe.length() > 512
-                || safe.chars().anyMatch(Character::isISOControl)) {
-            throw new IOException("Background backup notice is invalid");
-        }
-        return safe;
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeServices.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeServices.java
deleted file mode 100644
index 066c7b1..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeServices.java
+++ /dev/null
@@ -1,39 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import dev.ishaanko.worldarchive.catalog.BackupCatalog;
-import dev.ishaanko.worldarchive.config.WorldIdentityStore;
-import dev.ishaanko.worldarchive.core.FileSystemBackupCaptureFactory;
-import dev.ishaanko.worldarchive.core.FileWorldInventoryStore;
-import dev.ishaanko.worldarchive.core.LockingWorldOperationGate;
-import java.nio.file.Path;
-import java.time.Clock;
-import java.util.Objects;
-import java.util.concurrent.ExecutorService;
-import net.minecraft.client.Minecraft;
-
-/** Long-lived collaborators shared by runtime state building and client-facing views. */
-record RuntimeServices(
-        Minecraft minecraft,
-        Path storageRoot,
-        BackupCatalog catalog,
-        FileWorldInventoryStore inventoryStore,
-        FileSystemBackupCaptureFactory captureFactory,
-        WorldIdentityStore identityStore,
-        LockingWorldOperationGate captureMutex,
-        LockingWorldOperationGate operationGate,
-        ExecutorService workerExecutor,
-        Clock clock) {
-
-    RuntimeServices {
-        Objects.requireNonNull(minecraft, "minecraft");
-        Objects.requireNonNull(storageRoot, "storageRoot");
-        Objects.requireNonNull(catalog, "catalog");
-        Objects.requireNonNull(inventoryStore, "inventoryStore");
-        Objects.requireNonNull(captureFactory, "captureFactory");
-        Objects.requireNonNull(identityStore, "identityStore");
-        Objects.requireNonNull(captureMutex, "captureMutex");
-        Objects.requireNonNull(operationGate, "operationGate");
-        Objects.requireNonNull(workerExecutor, "workerExecutor");
-        Objects.requireNonNull(clock, "clock");
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeStateFactory.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeStateFactory.java
deleted file mode 100644
index 7f0b420..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeStateFactory.java
+++ /dev/null
@@ -1,159 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
-import dev.ishaanko.worldarchive.catalog.FileBackupDeletionRegistry;
-import dev.ishaanko.worldarchive.config.WorldConfig;
-import dev.ishaanko.worldarchive.core.BackupBackend;
-import dev.ishaanko.worldarchive.core.BackupCaptureGate;
-import dev.ishaanko.worldarchive.core.ConfiguredBackupDestinationSelector;
-import dev.ishaanko.worldarchive.core.SerializedBackupCoordinator;
-import dev.ishaanko.worldarchive.importing.FileBackupImportService;
-import dev.ishaanko.worldarchive.importing.FileImportSourceRegistry;
-import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.recovery.BackupRecoveryService;
-import dev.ishaanko.worldarchive.storage.git.GitBackendSettings;
-import dev.ishaanko.worldarchive.storage.git.SystemGitCommandRunner;
-import dev.ishaanko.worldarchive.storage.git.WorldGitSnapshotStore;
-import dev.ishaanko.worldarchive.storage.management.FileStorageHistoryStore;
-import dev.ishaanko.worldarchive.storage.management.FileStorageReviewStore;
-import dev.ishaanko.worldarchive.storage.management.ManagedStorageService;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupBackend;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupStoreResolver;
-import java.util.List;
-import java.util.Objects;
-import java.util.Optional;
-import java.util.Set;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.CompletionStage;
-
-/** Builds and primes one immutable runtime storage/service graph. */
-final class RuntimeStateFactory {
-    private final WorldArchiveRuntime runtime;
-
-    RuntimeStateFactory(WorldArchiveRuntime runtime) {
-        this.runtime = Objects.requireNonNull(runtime, "runtime");
-    }
-
-    RuntimeState build(WorldArchiveConfig config, RuntimeServices services) {
-        RuntimeStoragePaths storagePaths = RuntimeStoragePaths.from(
-                config, services.storageRoot());
-        WorldGitSnapshotStore gitBackend = gitBackend(config, storagePaths, services);
-        ZipBackupStoreResolver zipStores = new RuntimeZipBackupStores(storagePaths);
-        FileImportSourceRegistry importSources = new FileImportSourceRegistry(
-                services.storageRoot().resolve("import-sources.json"));
-        FileBackupDeletionRegistry deletions = new FileBackupDeletionRegistry(
-                services.storageRoot().resolve("deleted-backups.txt"));
-        Set<WorldId> configuredWorldIds = config.worlds().stream()
-                .map(WorldConfig::worldId)
-                .collect(java.util.stream.Collectors.toUnmodifiableSet());
-        FileBackupImportService imports = new FileBackupImportService(
-                services.catalog(),
-                importSources,
-                deletions,
-                gitBackend,
-                zipStores,
-                () -> configuredWorldIds,
-                services.workerExecutor());
-        RuntimeDestinationSelector selector = selector(config, gitBackend, zipStores, services);
-        BackupRecoveryService recovery = new BackupRecoveryService(
-                services.catalog(),
-                Optional.of(gitBackend),
-                Optional.of(zipStores),
-                importSources,
-                deletions,
-                services.identityStore(),
-                new MinecraftRestoredWorldMetadataFinalizer(),
-                services.workerExecutor(),
-                services.operationGate(),
-                services.clock());
-        SerializedBackupCoordinator coordinator = new SerializedBackupCoordinator(
-                services.catalog(),
-                services.captureFactory(),
-                services.inventoryStore(),
-                selector,
-                recovery,
-                BackupCaptureGate.DIRECT,
-                services.captureMutex(),
-                services.operationGate(),
-                services.workerExecutor(),
-                services.clock());
-        ManagedStorageService storage = new ManagedStorageService(
-                () -> config,
-                services.catalog(),
-                deletions,
-                gitBackend,
-                zipStores,
-                new FileStorageHistoryStore(
-                        services.storageRoot().resolve("storage-history")),
-                new FileStorageReviewStore(
-                        services.storageRoot().resolve("storage-reviews")),
-                services.operationGate(),
-                services.workerExecutor(),
-                services.clock(),
-                java.time.ZoneId.systemDefault());
-        return new RuntimeState(
-                config,
-                storagePaths,
-                gitBackend,
-                selector,
-                coordinator,
-                imports,
-                storage);
-    }
-
-    private WorldGitSnapshotStore gitBackend(
-            WorldArchiveConfig config,
-            RuntimeStoragePaths storagePaths,
-            RuntimeServices services) {
-        return new WorldGitSnapshotStore(
-                GitBackendSettings.from(config.git(), storagePaths.gitRepository()),
-                GitBackendSettings.legacyFrom(config.git()),
-                config.worlds().stream()
-                        .filter(world -> world.remoteUrl().isPresent())
-                        .collect(java.util.stream.Collectors.toUnmodifiableMap(
-                                WorldConfig::worldId,
-                                world -> world.remoteUrl().orElseThrow())),
-                new SystemGitCommandRunner(),
-                services.workerExecutor());
-    }
-
-    private RuntimeDestinationSelector selector(
-            WorldArchiveConfig config,
-            WorldGitSnapshotStore gitBackend,
-            ZipBackupStoreResolver zipStores,
-            RuntimeServices services) {
-        ZipBackupBackend zipBackend = new ZipBackupBackend(
-                zipStores, services.workerExecutor());
-        List<BackupBackend> backends = List.of(gitBackend, zipBackend);
-        return new RuntimeDestinationSelector(new ConfiguredBackupDestinationSelector(
-                () -> config, backends));
-    }
-
-    CompletionStage<Void> prime(RuntimeState state) {
-        CompletionStage<Void> rebuild = state.imports().rebuildLocal().handle((summary, throwable) -> {
-            if (throwable != null) {
-                runtime.logFailure("Local backup catalog rebuild failed", throwable);
-            } else if (summary != null && (summary.conflicts() > 0 || summary.issues() > 0)) {
-                runtime.logFailure(
-                        "Local backup catalog rebuild found conflicts or unreadable artifacts",
-                        new IllegalStateException(summary.message()));
-            }
-            return null;
-        });
-        if (!state.config().git().enabled()) {
-            state.selector().gitDisabled();
-            return rebuild;
-        }
-        CompletionStage<Void> probe = state.gitBackend().probeTools().handle((health, throwable) -> {
-            if (throwable != null || health == null) {
-                state.selector().gitToolProbeFailed();
-            } else {
-                state.selector().gitToolsAvailable(health.available());
-            }
-            return null;
-        });
-        return CompletableFuture.allOf(
-                rebuild.toCompletableFuture(),
-                probe.toCompletableFuture());
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeStateRegistry.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeStateRegistry.java
deleted file mode 100644
index 02a5889..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeStateRegistry.java
+++ /dev/null
@@ -1,39 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Objects;
-
-/** Atomically routes new work to the latest state while retaining older in-flight states. */
-final class RuntimeStateRegistry<T> {
-    private T current;
-
-    private final List<T> retained = new ArrayList<>();
-
-    synchronized void install(T replacement) {
-        T installed = Objects.requireNonNull(replacement, "replacement");
-        retained.add(installed);
-        current = installed;
-    }
-
-    synchronized T currentOrNull() {
-        return current;
-    }
-
-    synchronized List<T> retained() {
-        return List.copyOf(retained);
-    }
-
-    synchronized List<T> removeRetired() {
-        List<T> removed = new ArrayList<>();
-        java.util.Iterator<T> states = retained.iterator();
-        while (states.hasNext()) {
-            T state = states.next();
-            if (state != current) {
-                removed.add(state);
-                states.remove();
-            }
-        }
-        return List.copyOf(removed);
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeStorageCoordinator.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeStorageCoordinator.java
deleted file mode 100644
index efabe20..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeStorageCoordinator.java
+++ /dev/null
@@ -1,169 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import dev.ishaanko.worldarchive.config.StoragePolicy;
-import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
-import dev.ishaanko.worldarchive.config.WorldConfig;
-import dev.ishaanko.worldarchive.core.OperationId;
-import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.settings.ClientSettingsAccess;
-import dev.ishaanko.worldarchive.storage.management.CleanupPlan;
-import dev.ishaanko.worldarchive.storage.management.CleanupRequest;
-import dev.ishaanko.worldarchive.storage.management.CleanupResult;
-import dev.ishaanko.worldarchive.storage.management.StorageOverview;
-import java.util.List;
-import java.util.Objects;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.CompletionStage;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentMap;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicBoolean;
-
-/** Keeps storage work and cleanup tokens bound to one immutable runtime state. */
-final class RuntimeStorageCoordinator {
-    private final WorldArchiveRuntime runtime;
-
-    private final ConcurrentMap<OperationId, OwnedCleanup> owners =
-            new ConcurrentHashMap<>();
-
-    private final AtomicBoolean closed = new AtomicBoolean();
-
-    RuntimeStorageCoordinator(WorldArchiveRuntime runtime) {
-        this.runtime = Objects.requireNonNull(runtime, "runtime");
-    }
-
-    CompletionStage<StorageOverview> overview(WorldId worldId) {
-        return unavailable()
-                ? WorldArchiveRuntime.failedStage("WorldArchive is still loading")
-                : runtime.withBackupPermit(() ->
-                        runtime.requireCurrentState().storage().overview(worldId));
-    }
-
-    CompletionStage<Boolean> claimReviewNotice(WorldId worldId) {
-        return unavailable()
-                ? CompletableFuture.completedFuture(false)
-                : runtime.withBackupPermit(() ->
-                        runtime.requireCurrentState().storage().claimReviewNotice(worldId));
-    }
-
-    CompletionStage<CleanupPlan> prepareCleanup(WorldId worldId) {
-        if (unavailable()) {
-            return WorldArchiveRuntime.failedStage("WorldArchive is still loading");
-        }
-        RuntimeConfigurationGate.Permit permit = runtime.configurationGate().enterBackup();
-        try {
-            var storage = runtime.requireCurrentState().storage();
-            CompletionStage<CleanupPlan> prepared = storage.prepareCleanup(worldId);
-            return prepared.whenComplete((plan, throwable) -> {
-                if (throwable != null || plan == null) {
-                    permit.close();
-                    return;
-                }
-                if (closed.get()) {
-                    permit.close();
-                    throw new IllegalStateException("WorldArchive is shutting down");
-                }
-                OwnedCleanup owner = new OwnedCleanup(storage, permit);
-                OwnedCleanup previous = owners.putIfAbsent(plan.confirmationToken(), owner);
-                if (previous != null) {
-                    permit.close();
-                    throw new IllegalStateException("Cleanup confirmation token already exists");
-                }
-                if (closed.get()) {
-                    release(plan.confirmationToken(), owner);
-                    throw new IllegalStateException("WorldArchive is shutting down");
-                }
-                long delayMillis = Math.max(
-                        0,
-                        java.time.Duration.between(
-                                        runtime.services().clock().instant(),
-                                        plan.expiresAt())
-                                .toMillis());
-                CompletableFuture.delayedExecutor(delayMillis, TimeUnit.MILLISECONDS)
-                        .execute(() -> release(plan.confirmationToken(), owner));
-            });
-        } catch (RuntimeException | Error exception) {
-            permit.close();
-            throw exception;
-        }
-    }
-
-    CompletionStage<CleanupResult> applyCleanup(CleanupRequest request) {
-        OwnedCleanup owner = owners.remove(request.confirmationToken());
-        if (owner == null) {
-            return CompletableFuture.failedFuture(
-                    new IllegalArgumentException(
-                            "Cleanup preview is missing, expired, or already used"));
-        }
-        try {
-            CompletionStage<CleanupResult> applied = owner.storage().applyCleanup(request);
-            applied.whenComplete((ignored, throwable) -> owner.permit().close());
-            return applied;
-        } catch (RuntimeException | Error exception) {
-            owner.permit().close();
-            throw exception;
-        }
-    }
-
-    CompletionStage<Void> discardCleanup(OperationId token) {
-        OwnedCleanup owner = owners.remove(Objects.requireNonNull(token, "token"));
-        if (owner != null) {
-            owner.permit().close();
-        }
-        return CompletableFuture.completedFuture(null);
-    }
-
-    void close() {
-        if (closed.compareAndSet(false, true)) {
-            owners.forEach(this::release);
-        }
-    }
-
-    CompletionStage<Void> savePolicy(WorldId worldId, StoragePolicy policy) {
-        WorldArchiveConfig current = ClientSettingsAccess.snapshot();
-        if (current.worlds().stream().noneMatch(world ->
-                world.worldId().equals(worldId))) {
-            return WorldArchiveRuntime.failedStage(
-                    "Storage budgets are available only for configured worlds");
-        }
-        List<WorldConfig> worlds = current.worlds().stream()
-                .map(world -> world.worldId().equals(worldId)
-                        ? new WorldConfig(
-                                world.worldId(),
-                                world.enabled(),
-                                world.path(),
-                                world.remoteUrl(),
-                                world.zipDestination(),
-                                policy)
-                        : world)
-                .toList();
-        return ClientSettingsAccess.save(new WorldArchiveConfig(
-                        WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                        current.triggers(),
-                        current.git(),
-                        current.zip(),
-                        worlds))
-                .thenApply(ignored -> null);
-    }
-
-    private boolean unavailable() {
-        return closed.get()
-                || runtime.isClosed()
-                || runtime.states().currentOrNull() == null;
-    }
-
-    private void release(OperationId token, OwnedCleanup owner) {
-        if (owners.remove(token, owner)) {
-            owner.permit().close();
-        }
-    }
-
-    private record OwnedCleanup(
-            dev.ishaanko.worldarchive.storage.management.ManagedStorageService storage,
-            RuntimeConfigurationGate.Permit permit) {
-        private OwnedCleanup {
-            Objects.requireNonNull(storage, "storage");
-            Objects.requireNonNull(permit, "permit");
-        }
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeStoragePaths.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeStoragePaths.java
deleted file mode 100644
index 6041140..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeStoragePaths.java
+++ /dev/null
@@ -1,49 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.nio.file.Path;
-import java.util.Map;
-import java.util.Objects;
-import java.util.stream.Collectors;
-
-/** Immutable destination roots used by one runtime state. */
-record RuntimeStoragePaths(
-        Path gitRepository,
-        Path zipDirectory,
-        Map<WorldId, Path> worldZipDirectories) {
-    RuntimeStoragePaths {
-        gitRepository = normalize(gitRepository, "gitRepository");
-        zipDirectory = normalize(zipDirectory, "zipDirectory");
-        worldZipDirectories = Map.copyOf(Objects.requireNonNull(
-                worldZipDirectories, "worldZipDirectories"));
-    }
-
-    RuntimeStoragePaths(Path gitRepository, Path zipDirectory) {
-        this(gitRepository, zipDirectory, Map.of());
-    }
-
-    static RuntimeStoragePaths from(WorldArchiveConfig config, Path storageRoot) {
-        Objects.requireNonNull(config, "config");
-        Path root = normalize(storageRoot, "storageRoot");
-        return new RuntimeStoragePaths(
-                config.git().repository().orElseGet(() -> root.resolve("worldarchive.git")),
-                config.zip().destination().orElseGet(() -> root.resolve("archives")),
-                config.worlds().stream()
-                        .filter(world -> world.zipDestination().isPresent())
-                        .collect(Collectors.toUnmodifiableMap(
-                                world -> world.worldId(),
-                                world -> normalize(
-                                        world.zipDestination().orElseThrow(),
-                                        "worldZipDestination"))));
-    }
-
-    Path zipDirectory(WorldId worldId) {
-        return worldZipDirectories.getOrDefault(
-                Objects.requireNonNull(worldId, "worldId"), zipDirectory);
-    }
-
-    private static Path normalize(Path path, String name) {
-        return Objects.requireNonNull(path, name).toAbsolutePath().normalize();
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeStorageSafety.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeStorageSafety.java
deleted file mode 100644
index 990e9f0..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeStorageSafety.java
+++ /dev/null
@@ -1,40 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
-import java.io.IOException;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.Objects;
-import java.util.Optional;
-import java.util.concurrent.atomic.AtomicReference;
-
-/** Fail-closed runtime state when a destination overlaps any known world. */
-final class RuntimeStorageSafety {
-    private static final String WARNING =
-            "A backup destination overlaps a known world; storage actions are disabled until settings are fixed";
-
-    private final AtomicReference<Optional<String>> warning =
-            new AtomicReference<>(Optional.empty());
-
-    void refresh(WorldArchiveConfig config, List<Path> worldPaths) {
-        warning.set(issue(config, worldPaths));
-    }
-
-    void set(Optional<String> issue) {
-        warning.set(issue);
-    }
-
-    Optional<String> warning() {
-        return warning.get();
-    }
-
-    static Optional<String> issue(WorldArchiveConfig config, List<Path> worldPaths) {
-        try {
-            Objects.requireNonNull(config, "config").validateDestinations(
-                    List.copyOf(Objects.requireNonNull(worldPaths, "worldPaths")));
-            return Optional.empty();
-        } catch (IOException exception) {
-            return Optional.of(WARNING);
-        }
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeWorldPathRegistry.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeWorldPathRegistry.java
deleted file mode 100644
index 4ee4d17..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeWorldPathRegistry.java
+++ /dev/null
@@ -1,82 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Process-lifetime bidirectional guard against copied or conflicting world identities. */
-final class RuntimeWorldPathRegistry {
-    private final Map<WorldId, Path> pathsByWorld = new HashMap<>();
-
-    private final Map<Path, WorldId> worldsByPath = new HashMap<>();
-
-    synchronized void configure(WorldId worldId, Path worldDirectory) {
-        Objects.requireNonNull(worldId, "worldId");
-        Path world = normalize(worldDirectory);
-        Path previous = pathsByWorld.put(worldId, world);
-        if (previous != null && !previous.equals(world)) {
-            worldsByPath.remove(previous, worldId);
-        }
-        worldsByPath.put(world, worldId);
-    }
-
-    synchronized boolean register(WorldId worldId, Path worldDirectory) {
-        Objects.requireNonNull(worldId, "worldId");
-        Path world = normalize(worldDirectory);
-        Path registeredPath = pathsByWorld.get(worldId);
-        WorldId registeredWorld = worldsByPath.get(world);
-        if ((registeredPath != null && !registeredPath.equals(world))
-                || (registeredWorld != null && !registeredWorld.equals(worldId))) {
-            return false;
-        }
-        pathsByWorld.put(worldId, world);
-        worldsByPath.put(world, worldId);
-        return true;
-    }
-
-    synchronized boolean matches(WorldId worldId, Path worldDirectory) {
-        Path world = normalize(worldDirectory);
-        Path registeredPath = pathsByWorld.get(worldId);
-        WorldId registeredWorld = worldsByPath.get(world);
-        return (registeredPath == null || registeredPath.equals(world))
-                && (registeredWorld == null || registeredWorld.equals(worldId));
-    }
-
-    synchronized boolean isRegistered(WorldId worldId, Path worldDirectory) {
-        Path world = normalize(worldDirectory);
-        return world.equals(pathsByWorld.get(worldId))
-                && worldId.equals(worldsByPath.get(world));
-    }
-
-    synchronized Optional<Path> claimedPath(WorldId worldId) {
-        return Optional.ofNullable(pathsByWorld.get(Objects.requireNonNull(worldId, "worldId")));
-    }
-
-    synchronized Optional<WorldId> claimedWorld(Path worldDirectory) {
-        return Optional.ofNullable(worldsByPath.get(normalize(worldDirectory)));
-    }
-
-    /** Releases one claim after the caller verified it no longer matches the folder on disk. */
-    synchronized void release(WorldId worldId, Path worldDirectory) {
-        Objects.requireNonNull(worldId, "worldId");
-        Path world = normalize(worldDirectory);
-        if (world.equals(pathsByWorld.get(worldId))) {
-            pathsByWorld.remove(worldId);
-        }
-        if (worldId.equals(worldsByPath.get(world))) {
-            worldsByPath.remove(world);
-        }
-    }
-
-    synchronized List<Path> snapshotPaths() {
-        return List.copyOf(worldsByPath.keySet());
-    }
-
-    private static Path normalize(Path path) {
-        return Objects.requireNonNull(path, "worldDirectory").toAbsolutePath().normalize();
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeZipBackupStores.java b/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeZipBackupStores.java
deleted file mode 100644
index afb0c06..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeZipBackupStores.java
+++ /dev/null
@@ -1,25 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupStore;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupStoreResolver;
-import java.util.Objects;
-
-/** Creates lightweight store handles against the immutable roots of one runtime state. */
-final class RuntimeZipBackupStores implements ZipBackupStoreResolver {
-    private final RuntimeStoragePaths paths;
-
-    RuntimeZipBackupStores(RuntimeStoragePaths paths) {
-        this.paths = Objects.requireNonNull(paths, "paths");
-    }
-
-    @Override
-    public ZipBackupStore store(WorldId worldId) {
-        return new ZipBackupStore(paths.zipDirectory(worldId));
-    }
-
-    @Override
-    public ZipBackupStore defaultStore() {
-        return new ZipBackupStore(paths.zipDirectory());
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/StateCalls.java b/src/client/java/dev/ishaanko/worldarchive/runtime/StateCalls.java
new file mode 100644
index 0000000..a4e84aa
--- /dev/null
+++ b/src/client/java/dev/ishaanko/worldarchive/runtime/StateCalls.java
@@ -0,0 +1,75 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import dev.ishaanko.worldarchive.model.SafeText;
+import dev.ishaanko.worldarchive.settings.ClientSettingsAccess;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CompletionStage;
+import java.util.function.BooleanSupplier;
+import java.util.function.Function;
+import net.minecraft.network.chat.Component;
+
+/**
+ * Runs the screens' calls against the current runtime state. Every call returns a stage at once
+ * and never throws on the caller's thread: a missing state, a refused permit, or a failure while
+ * starting the call becomes a failed stage whose message the screen shows.
+ */
+final class StateCalls {
+    private final ServiceGraph graph;
+
+    private final BooleanSupplier closed;
+
+    StateCalls(ServiceGraph graph, BooleanSupplier closed) {
+        this.graph = Objects.requireNonNull(graph, "graph");
+        this.closed = Objects.requireNonNull(closed, "closed");
+    }
+
+    /** Runs a call that reads backups, or changes nothing in the backup folders. */
+    <T> CompletionStage<T> withState(Function<RuntimeState, ? extends CompletionStage<T>> call) {
+        Optional<RuntimeState> state = graph.current();
+        if (closed.getAsBoolean() || state.isEmpty()) {
+            return failed(notReady());
+        }
+        try {
+            return call.apply(state.get());
+        } catch (RuntimeException failure) {
+            return CompletableFuture.failedFuture(failure);
+        }
+    }
+
+    /**
+     * Runs a call that writes into the backup folders under a work permit, released once the
+     * returned stage completes; a cancellable stage stays cancellable.
+     */
+    <T> CompletionStage<T> withPermit(Function<RuntimeState, ? extends CompletionStage<T>> call) {
+        return withState(state -> {
+            ConfigurationGate.Permit permit = graph.gate().enterWork();
+            try {
+                CompletionStage<T> stage = call.apply(state);
+                stage.whenComplete((ignored, failure) -> permit.close());
+                return stage;
+            } catch (RuntimeException failure) {
+                permit.close();
+                throw failure;
+            }
+        });
+    }
+
+    static <T> CompletionStage<T> failed(String message) {
+        return CompletableFuture.failedFuture(new IllegalStateException(message));
+    }
+
+    /** A lang key's text in the game's language, for a message that travels in an exception. */
+    static String text(String key, Object... arguments) {
+        return Component.translatable(key, arguments).getString();
+    }
+
+    /** Why there is no state yet: the settings cannot be read, or they are still loading. */
+    private static String notReady() {
+        return ClientSettingsAccess.service().unreadable()
+                .map(failure -> text("screen.worldarchive.runtime.settings_unreadable",
+                        SafeText.from(failure, "no reason was given", 200)))
+                .orElseGet(() -> text("screen.worldarchive.runtime.loading"));
+    }
+}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/WorldArchiveRuntime.java b/src/client/java/dev/ishaanko/worldarchive/runtime/WorldArchiveRuntime.java
index 6d4270f..543fa86 100644
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/WorldArchiveRuntime.java
+++ b/src/client/java/dev/ishaanko/worldarchive/runtime/WorldArchiveRuntime.java
@@ -1,872 +1,213 @@
 package dev.ishaanko.worldarchive.runtime;
 
-import dev.ishaanko.worldarchive.WorldArchiveMetadata;
-import dev.ishaanko.worldarchive.catalog.BackupCatalog;
-import dev.ishaanko.worldarchive.catalog.FileBackupCatalog;
 import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
-import dev.ishaanko.worldarchive.config.StoragePolicy;
-import dev.ishaanko.worldarchive.config.WorldConfig;
-import dev.ishaanko.worldarchive.config.WorldIdentityStore;
-import dev.ishaanko.worldarchive.core.BackupCoordinator;
-import dev.ishaanko.worldarchive.core.BackupService;
-import dev.ishaanko.worldarchive.core.CreateBackupRequest;
 import dev.ishaanko.worldarchive.core.FileSystemBackupCaptureFactory;
-import dev.ishaanko.worldarchive.core.FileWorldInventoryStore;
-import dev.ishaanko.worldarchive.core.LockingWorldOperationGate;
-import dev.ishaanko.worldarchive.core.OperationId;
-import dev.ishaanko.worldarchive.core.OperationProgress;
-import dev.ishaanko.worldarchive.core.PreparedBackup;
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.core.RestoreBackupResult;
-import dev.ishaanko.worldarchive.importing.BackupImportService;
-import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.DestinationHealth;
-import dev.ishaanko.worldarchive.model.DestinationHealthStatus;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
+import dev.ishaanko.worldarchive.core.SourceCaptureObserver;
+import dev.ishaanko.worldarchive.model.SafeText;
 import dev.ishaanko.worldarchive.model.WorldId;
 import dev.ishaanko.worldarchive.settings.ClientSettingsAccess;
-import dev.ishaanko.worldarchive.settings.SettingsDefaults;
-import dev.ishaanko.worldarchive.settings.WorldFolderDiscovery;
+import dev.ishaanko.worldarchive.settings.SettingsService;
+import dev.ishaanko.worldarchive.support.AsyncTasks;
 import dev.ishaanko.worldarchive.ui.BackupClientFacade;
-import dev.ishaanko.worldarchive.ui.BackupWorldContext;
-import dev.ishaanko.worldarchive.ui.BackupWorldEntry;
-import dev.ishaanko.worldarchive.ui.BackupWorldSelection;
-import dev.ishaanko.worldarchive.ui.model.BackupBrowserCapabilities;
-import dev.ishaanko.worldarchive.ui.model.BackupRow;
-import dev.ishaanko.worldarchive.storage.management.CleanupPlan;
-import dev.ishaanko.worldarchive.storage.management.CleanupRequest;
-import dev.ishaanko.worldarchive.storage.management.CleanupResult;
-import dev.ishaanko.worldarchive.storage.management.StorageOverview;
 import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
 import java.nio.file.Path;
 import java.time.Clock;
 import java.time.Duration;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Objects;
+import java.util.Map;
 import java.util.Optional;
-import java.util.Set;
-import java.util.concurrent.Callable;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.CompletionException;
-import java.util.concurrent.CompletionStage;
 import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentMap;
-import java.util.concurrent.ExecutionException;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
-import java.util.concurrent.RejectedExecutionException;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.concurrent.atomic.AtomicReference;
-import java.util.function.Supplier;
+import java.util.function.UnaryOperator;
 import net.minecraft.client.Minecraft;
 import net.minecraft.client.gui.screens.Screen;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-/** Client-owned service graph, lifecycle save gate, and native-screen facade. */
-public final class WorldArchiveRuntime implements BackupClientFacade {
-    private static final Logger LOGGER = LoggerFactory.getLogger(WorldArchiveMetadata.MOD_NAME);
+/**
+ * WorldArchive in the running game: it builds the backup engine for the game folder, keeps it in
+ * step with the settings, connects it to the game's events and screens, and shuts it down when the
+ * game quits.
+ */
+public final class WorldArchiveRuntime {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
 
-    private static final Duration CLIENT_SHUTDOWN_WAIT = Duration.ofSeconds(30);
+    /** How long quitting waits for backups, restores and deletes that still run, capture included. */
+    private static final Duration QUIT_WAIT = Duration.ofSeconds(30);
 
-    private static final AtomicReference<WorldArchiveRuntime> INSTANCE = new AtomicReference<>();
+    private static WorldArchiveRuntime instance;
 
-    private final Minecraft minecraft;
-
-    private final Path storageRoot;
-
-    private final BackupCatalog catalog;
-
-    private final FileWorldInventoryStore inventoryStore;
-
-    private final FileSystemBackupCaptureFactory captureFactory;
-
-    private final WorldIdentityStore identityStore = new WorldIdentityStore();
-
-    private final LockingWorldOperationGate captureMutex = new LockingWorldOperationGate();
-
-    private final LockingWorldOperationGate operationGate = new LockingWorldOperationGate();
-
-    private final ExecutorService workerExecutor = Executors.newThreadPerTaskExecutor(
+    private final ExecutorService workers = Executors.newThreadPerTaskExecutor(
             Thread.ofVirtual().name("worldarchive-worker-", 0).factory());
 
-    private final Clock clock = Clock.systemUTC();
-
-    private final RuntimeLifecycle lifecycle = new RuntimeLifecycle(this, clock);
-
-    private final RuntimeStateRegistry<RuntimeState> stateRegistry = new RuntimeStateRegistry<>();
-
-    private final ConcurrentMap<PreparedBackup, PreparedOwnership> externallyPrepared =
-            new ConcurrentHashMap<>();
-
-    private final RuntimeWorldPathRegistry worldPaths = new RuntimeWorldPathRegistry();
-
-    private final RuntimeStorageSafety storageSafety = new RuntimeStorageSafety();
-
-    private final RuntimeConfigurationGate configurationGate;
-
-    private final RuntimeActionContextRegistry actionContexts =
-            new RuntimeActionContextRegistry();
-
-    private final BackupCoordinator coordinatorView = new RuntimeBackupCoordinator(this);
-
-    private final BackupService serviceView = new RuntimeBackupService(this, coordinatorView);
-
-    private final BackupImportService importsView = new RuntimeBackupImportService(this);
-
-    private final RuntimeStorageCoordinator storageView = new RuntimeStorageCoordinator(this);
-
-    private final RuntimeNavigation navigation = new RuntimeNavigation(this);
-
     private final AtomicBoolean closed = new AtomicBoolean();
 
-    private final RuntimeBackgroundBackupMonitor backgroundBackups;
+    /** The worlds whose folder the settings could not record, with that folder. */
+    private final Map<WorldId, Path> unsavedWorlds = new ConcurrentHashMap<>();
+
+    private final ServiceGraph graph;
 
-    private final Set<WorldId> worldSettingsFailures = ConcurrentHashMap.newKeySet();
+    private final WorldIdentityResolver resolver;
 
-    private final Object stateLock = new Object();
+    private final RuntimeBackgroundBackupMonitor monitor;
 
-    private final RuntimeServices services;
+    private final LiveWorldBackups live;
 
-    private final RuntimeClientFacade clientFacade;
+    private final RuntimeClientFacade facade;
 
     private WorldArchiveRuntime(Minecraft minecraft) {
-        this.minecraft = Objects.requireNonNull(minecraft, "minecraft");
-        this.configurationGate = new RuntimeConfigurationGate(this::retireInactiveStates);
-        this.storageRoot = minecraft.gameDirectory.toPath()
-                .toAbsolutePath()
-                .normalize()
-                .resolve("worldarchive");
-        this.backgroundBackups = new RuntimeBackgroundBackupMonitor(
-                minecraft,
-                storageRoot.resolve("last-background-warning.txt"),
-                closed::get,
-                this::logFailure);
-        this.catalog = new FileBackupCatalog(storageRoot.resolve("catalog.json"));
-        this.inventoryStore = new FileWorldInventoryStore(storageRoot.resolve("inventories"));
-        this.captureFactory = new FileSystemBackupCaptureFactory(
-                storageRoot.resolve("capture-temp"),
-                RunningGameVersion.current());
-        this.services = new RuntimeServices(
-                minecraft,
+        Path game = minecraft.gameDirectory.toPath().toAbsolutePath().normalize();
+        Path storageRoot = game.resolve("worldarchive");
+        Path saves = game.resolve("saves");
+        graph = new ServiceGraph(
                 storageRoot,
-                catalog,
-                inventoryStore,
-                captureFactory,
-                identityStore,
-                captureMutex,
-                operationGate,
-                workerExecutor,
-                clock);
-        this.clientFacade = new RuntimeClientFacade(
-                this,
-                serviceView,
-                importsView,
-                storageView,
-                navigation,
-                lifecycle,
-                backgroundBackups);
-    }
-
-    /** Starts the singleton and returns immediately; settings finish loading asynchronously. */
+                new FileSystemBackupCaptureFactory(
+                        storageRoot.resolve("capture-temp"), RunningGameVersion.current(), SourceCaptureObserver.NONE),
+                new MinecraftRestoredWorldMetadataFinalizer(),
+                workers,
+                Clock.systemDefaultZone());
+        resolver = new WorldIdentityResolver(saves, graph.identities(), new SettingsRecorder());
+        monitor = new RuntimeBackgroundBackupMonitor(
+                minecraft, new RuntimeNoticeStore(storageRoot.resolve("last-background-warning.txt")), closed::get);
+        live = new LiveWorldBackups(graph, resolver, monitor, System::nanoTime);
+        StateCalls calls = new StateCalls(graph, closed::get);
+        facade = new RuntimeClientFacade(
+                graph,
+                resolver,
+                live,
+                calls,
+                new RuntimeNavigation(minecraft, calls, graph),
+                saves,
+                this::unsavedWorldWarning);
+    }
+
+    /** Starts the runtime once; the settings finish loading in the background. */
     public static synchronized WorldArchiveRuntime initialize() {
-        WorldArchiveRuntime existing = INSTANCE.get();
-        if (existing != null) {
-            return existing;
-        }
-        WorldArchiveRuntime created = new WorldArchiveRuntime(Minecraft.getInstance());
-        INSTANCE.set(created);
-        created.lifecycle.register();
-        ClientSettingsAccess.addConfigurationGuard(created::acquireConfigurationChange);
-        ClientSettingsAccess.addConfigurationListener(created::reload);
-        ClientSettingsAccess.ready().whenComplete((ignored, throwable) -> {
-            if (throwable != null) {
-                created.logFailure("Runtime settings could not be loaded", throwable);
-                return;
-            }
-            try {
-                created.reload(ClientSettingsAccess.snapshot());
-            } catch (RuntimeException exception) {
-                created.logFailure("Runtime services could not be configured", exception);
-            }
-        });
-        return created;
-    }
-
-    /** Returns the singleton, creating its non-blocking initialization when necessary. */
-    public static WorldArchiveRuntime instance() {
-        return initialize();
-    }
-
-    /** Atomically installs a service graph whose paths and selector share one config snapshot. */
-    public void reload(WorldArchiveConfig config) {
-        Objects.requireNonNull(config, "config");
-        RuntimeState replacement;
-        synchronized (stateLock) {
-            if (closed.get()) {
-                throw new IllegalStateException("WorldArchive runtime is shut down");
-            }
-            WorldArchiveConfig resolved = new SettingsDefaults(storageRoot).resolve(config);
-            RuntimeState current = stateRegistry.currentOrNull();
-            if (current != null && current.config().equals(resolved)) {
-                clearPersistedWorldSettingsFailures(resolved);
-                return;
-            }
-            replacement = buildState(resolved);
-            stateRegistry.install(replacement);
-            lifecycle.reconcile(replacement);
-            refreshStorageSafety(replacement);
-            clearPersistedWorldSettingsFailures(resolved);
+        if (instance == null) {
+            instance = new WorldArchiveRuntime(Minecraft.getInstance());
+            instance.start();
         }
-        primeState(replacement);
-        lifecycle.ensureLiveWorldResolution();
+        return instance;
     }
 
-    private void primeState(RuntimeState state) {
-        RuntimeConfigurationGate.Permit permit = configurationGate.retainStateWork();
-        try {
-            CompletionStage<Void> prime = new RuntimeStateFactory(this).prime(state);
-            prime.whenComplete((ignored, throwable) -> permit.close());
-        } catch (RuntimeException | Error exception) {
-            permit.close();
-            throw exception;
-        }
+    /** What the backup screens and the world list integrations call. */
+    public BackupClientFacade facade() {
+        return facade;
     }
 
-    private void retireInactiveStates() {
-        if (closed.get()) {
-            return;
-        }
-        stateRegistry.removeRetired().forEach(RuntimeState::close);
+    /** Opens the open world's backup browser over {@code returnTo}; false while its identity is still unknown. */
+    public boolean openBrowser(Screen returnTo) {
+        return facade.openLiveBrowser(returnTo);
     }
 
-    private void validateConfigurationChange(WorldArchiveConfig config) {
-        Objects.requireNonNull(config, "config");
-        synchronized (stateLock) {
-            RuntimeState current = stateRegistry.currentOrNull();
-            if (closed.get() || current == null) {
-                return;
-            }
-            RuntimeStoragePaths replacement = RuntimeStoragePaths.from(
-                    new SettingsDefaults(storageRoot).resolve(config),
-                    storageRoot);
-            if (current.storagePaths().equals(replacement)) {
-                return;
-            }
-            List<BackupRecord> records;
+    private void start() {
+        new FabricLifecycle(live, this::shutdown).register();
+        monitor.register();
+        // A crash can leave world copies behind; removing them may take a while, so never on the render thread.
+        AsyncTasks.run(workers, () -> {
             try {
-                records = catalog.listAll();
-            } catch (IOException exception) {
-                throw new IllegalStateException(
-                        "Destination paths cannot be validated against the backup catalog",
-                        exception);
+                graph.captures().removeAbandonedCaptures();
+            } catch (IOException failure) {
+                LOGGER.warn("Old world copies could not be removed: {}", SafeText.from(failure, "no reason", 300));
             }
-            RuntimeDestinationPathGuard.requireCatalogAllowed(
-                    current.storagePaths(), replacement, records);
-        }
-    }
-
-    private Runnable acquireConfigurationChange(WorldArchiveConfig config) {
-        WorldArchiveConfig resolved = new SettingsDefaults(storageRoot).resolve(
-                Objects.requireNonNull(config, "config"));
-        try {
-            resolved.validateDestinations(worldPaths.snapshotPaths());
-        } catch (IOException exception) {
-            throw new IllegalArgumentException(
-                    safeMessage(exception, "A destination overlaps a known world folder"),
-                    exception);
-        }
-        synchronized (stateLock) {
-            RuntimeState current = stateRegistry.currentOrNull();
-            if (closed.get() || current == null || current.storagePaths().equals(
-                    RuntimeStoragePaths.from(resolved, storageRoot))) {
-                return () -> { };
+        });
+        SettingsService settings = ClientSettingsAccess.service();
+        settings.addConfigurationGuard(graph::admitSettingsChange);
+        settings.addConfigurationListener(this::reload);
+        ClientSettingsAccess.ready().whenComplete((config, failure) -> {
+            if (failure == null) {
+                reload(config);
+            } else {
+                // Backups wait; a fixed file or a reset publishes the settings to reload.
+                LOGGER.warn("WorldArchive settings could not be read, so backups are paused: {}",
+                        SafeText.from(failure, "no reason was given", 300));
             }
-        }
-        RuntimeConfigurationGate.Permit permit = configurationGate.tryEnterConfigurationChange();
-        try {
-            validateConfigurationChange(resolved);
-            return permit::close;
-        } catch (RuntimeException | Error exception) {
-            permit.close();
-            throw exception;
-        }
-    }
-
-    /** Waits only for exit-triggered work and never waits beyond the supplied duration. */
-    public boolean awaitExitWork(Duration timeout) {
-        return backgroundBackups.awaitExitWork(timeout);
+        });
     }
 
-    /** Performs bounded exit draining, rejects new work, and releases runtime-owned workers. */
-    public void shutdown() {
-        if (!closed.compareAndSet(false, true)) {
+    /** Installs the services for new settings; runs on the settings thread, and again for the same settings does nothing. */
+    private synchronized void reload(WorldArchiveConfig config) {
+        if (closed.get()) {
             return;
         }
-        lifecycle.close();
-        actionContexts.clear();
-        storageView.close();
-        if (!awaitExitWork(CLIENT_SHUTDOWN_WAIT)) {
-            observeExitResult(
-                    null,
-                    new IllegalStateException("World-exit backup did not settle before shutdown"));
-            LOGGER.warn("WorldArchive exit work exceeded the bounded shutdown wait");
-        }
-        synchronized (stateLock) {
-            // Wait for an already-started immutable state swap before closing every state.
-        }
-        externallyPrepared.forEach((prepared, ownership) -> {
-            if (externallyPrepared.remove(prepared, ownership)) {
-                try {
-                    prepared.close();
-                } catch (IOException exception) {
-                    logFailure("A prepared capture could not be released", exception);
-                } finally {
-                    ownership.permit().close();
-                }
-            }
+        Optional<RuntimeState> previous = graph.current();
+        Optional<RuntimeState> installed = graph.install(config);
+        installed.ifPresent(state -> {
+            resolver.configure(state.config());
+            live.reconcile();
+            graph.prime(previous, state);
         });
-        stateRegistry.retained().forEach(RuntimeState::close);
-        workerExecutor.shutdown();
-        try {
-            if (!workerExecutor.awaitTermination(5, TimeUnit.SECONDS)) {
-                workerExecutor.shutdownNow();
-            }
-        } catch (InterruptedException exception) {
-            Thread.currentThread().interrupt();
-            workerExecutor.shutdownNow();
-        }
-        ClientSettingsAccess.shutdown();
-    }
-
-    RuntimeConfigurationGate configurationGate() {
-        return configurationGate;
-    }
-
-    RuntimeStateRegistry<RuntimeState> states() {
-        return stateRegistry;
-    }
-
-    ConcurrentMap<PreparedBackup, PreparedOwnership> preparedCaptures() {
-        return externallyPrepared;
-    }
-
-    boolean isClosed() {
-        return closed.get();
-    }
-
-    RuntimeServices services() {
-        return services;
-    }
-
-    RuntimeActionContextRegistry actionContexts() {
-        return actionContexts;
-    }
-
-    RuntimeWorldPathRegistry worldPaths() {
-        return worldPaths;
-    }
-
-    BackupWorldContext currentLiveWorld() {
-        return lifecycle.liveWorld();
-    }
-
-    @Override
-    public BackupService backupService() {
-        return clientFacade.backupService();
-    }
-
-    @Override
-    public BackupImportService importService() {
-        return clientFacade.importService();
-    }
-
-    @Override
-    public CompletionStage<List<BackupWorldEntry>> backupWorlds() {
-        return clientFacade.backupWorlds();
-    }
-
-    @Override
-    public CompletionStage<Optional<BackupWorldContext>> resolveWorld(
-            BackupWorldSelection selection) {
-        return clientFacade.resolveWorld(selection);
-    }
-
-    @Override
-    public CompletionStage<BackupResult> createManualBackup(
-            BackupWorldContext world,
-            Optional<String> label,
-            ProgressListener progressListener) {
-        return clientFacade.createManualBackup(world, label, progressListener);
-    }
-
-    @Override
-    public CompletionStage<BackupBrowserCapabilities> browserCapabilities(
-            BackupWorldContext world) {
-        return clientFacade.browserCapabilities(world);
-    }
-
-    @Override
-    public CompletionStage<StorageOverview> storageOverview(WorldId worldId) {
-        return clientFacade.storageOverview(worldId);
-    }
-
-    @Override
-    public CompletionStage<Boolean> claimStorageReviewNotice(WorldId worldId) {
-        return clientFacade.claimStorageReviewNotice(worldId);
-    }
-
-    @Override
-    public CompletionStage<CleanupPlan> prepareCleanup(WorldId worldId) {
-        return clientFacade.prepareCleanup(worldId);
-    }
-
-    @Override
-    public CompletionStage<CleanupResult> applyCleanup(CleanupRequest request) {
-        return clientFacade.applyCleanup(request);
-    }
-
-    @Override
-    public CompletionStage<Void> discardCleanup(OperationId confirmationToken) {
-        return clientFacade.discardCleanup(confirmationToken);
-    }
-
-    @Override
-    public CompletionStage<Void> saveStoragePolicy(
-            WorldId worldId,
-            StoragePolicy policy) {
-        return clientFacade.saveStoragePolicy(worldId, policy);
-    }
-
-    @Override
-    public void openManagedFolder(
-            BackupWorldContext world,
-            Optional<BackupRow> selectedBackup) {
-        clientFacade.openManagedFolder(world, selectedBackup);
-    }
-
-    @Override
-    public void openSettings(Screen returnTo) {
-        clientFacade.openSettings(returnTo);
-    }
-
-    @Override
-    public void selectRestoredWorld(Screen returnTo, RestoreBackupResult result) {
-        clientFacade.selectRestoredWorld(returnTo, result);
-    }
-
-    @Override
-    public void playRestoredWorld(Screen returnTo, RestoreBackupResult result) {
-        clientFacade.playRestoredWorld(returnTo, result);
-    }
-
-    /** Opens the live world's backup browser; false when there is no resolved live world yet. */
-    public boolean openBrowser(Screen returnTo) {
-        return navigation.openBrowser(returnTo);
-    }
-
-    private RuntimeState buildState(WorldArchiveConfig config) {
-        return new RuntimeStateFactory(this).build(config, services);
-    }
-
-    Optional<BackupWorldContext> resolveWorldBlocking(
-            BackupWorldSelection selection) throws IOException {
-        if (!acceptsLiveWorld(selection)) {
-            return Optional.empty();
-        }
-        Path realWorld = selection.worldDirectory().toRealPath();
-        if (!realWorld.equals(selection.worldDirectory())) {
-            return Optional.empty();
-        }
-        List<Path> safeWorlds = WorldFolderDiscovery.discover(selection.worldsDirectory());
-        if (safeWorlds.stream().noneMatch(realWorld::equals)) {
-            return Optional.empty();
-        }
-        WorldId worldId = identityStore.loadOrCreate(realWorld);
-        if (!registerDiscoveredWorldPath(worldId, realWorld)) {
-            return Optional.empty();
-        }
-        return Optional.of(new BackupWorldContext(worldId, selection));
-    }
-
-    boolean acceptsLiveWorld(BackupWorldSelection selection) {
-        return WorldFolderDiscovery.isDirectChild(
-                minecraft.gameDirectory.toPath().resolve("saves"),
-                selection.worldDirectory());
-    }
-
-    boolean busyAcrossStates(WorldId worldId) {
-        if (lifecycle.hasPending(worldId)) {
-            return true;
-        }
-        return stateRegistry.retained().stream()
-                .anyMatch(state -> state.coordinator().isBusy(worldId));
-    }
-
-    static CreateBackupRequest request(
-            BackupWorldContext world,
-            Optional<String> label,
-            BackupTrigger trigger) {
-        return new CreateBackupRequest(
-                world.worldId(),
-                world.worldDirectory(),
-                world.displayName(),
-                label,
-                trigger);
-    }
-
-    boolean registerWorldPath(WorldId worldId, Path worldDirectory) {
-        // Exact registrations were verified against the folder on disk and stay in
-        // sync with every published configuration, so a configuration snapshot that
-        // still carries a stale claim cannot veto them.
-        return worldPaths.isRegistered(worldId, worldDirectory.toAbsolutePath().normalize());
-    }
-
-    boolean matchesKnownWorld(
-            WorldId worldId,
-            Path worldDirectory,
-            WorldArchiveConfig config) {
-        Path world = worldDirectory.toAbsolutePath().normalize();
-        if (worldPaths.isRegistered(worldId, world)) {
-            return true;
-        }
-        if (!matchesConfiguredWorld(worldId, world, config)) {
-            return false;
-        }
-        return worldPaths.matches(worldId, world);
-    }
-
-    private static boolean matchesConfiguredWorld(
-            WorldId worldId,
-            Path worldDirectory,
-            WorldArchiveConfig config) {
-        Optional<WorldConfig> configuredIdentity = config.worlds().stream()
-                .filter(world -> world.worldId().equals(worldId))
-                .findFirst();
-        if (configuredIdentity.isPresent()
-                && !configuredIdentity.orElseThrow().path().equals(worldDirectory)) {
-            return false;
-        }
-        return config.worlds().stream()
-                .noneMatch(world -> world.path().equals(worldDirectory)
-                        && !world.worldId().equals(worldId));
-    }
-
-    private boolean registerDiscoveredWorldPath(
-            WorldId worldId,
-            Path worldDirectory) {
-        Path world = worldDirectory.toAbsolutePath().normalize();
-        RuntimeConfigurationGate.Permit permit = configurationGate.enterConfigurationChange();
-        try {
-            RuntimeState current = stateRegistry.currentOrNull();
-            if ((current == null || matchesConfiguredWorld(worldId, world, current.config()))
-                    && worldPaths.isRegistered(worldId, world)) {
-                registerSettingsWorld(worldId, world);
-                return true;
-            }
-            return registerDiscoveredWorldPathHeld(worldId, world, current);
-        } finally {
-            permit.close();
-        }
+        graph.current().ifPresent(state -> state.config().worlds().forEach(
+                world -> unsavedWorlds.remove(world.worldId(), world.path())));
     }
 
-    boolean registerDiscoveredWorldPathHeld(
-            WorldId worldId,
-            Path world,
-            RuntimeState state) {
-        if (state != null
-                && !matchesConfiguredWorld(worldId, world, state.config())
-                && !conflictingConfiguredClaimsAreStale(worldId, world, state.config())) {
-            return false;
-        }
-        if (!worldPaths.register(worldId, world)
-                && (!releaseStaleRegistryClaims(worldId, world)
-                        || !worldPaths.register(worldId, world))) {
-            return false;
-        }
-        if (state != null) {
-            refreshStorageSafety(state);
-        }
-        registerSettingsWorld(worldId, world);
-        return true;
+    private Optional<String> unsavedWorldWarning(WorldId worldId) {
+        return unsavedWorlds.containsKey(worldId)
+                ? Optional.of(StateCalls.text("screen.worldarchive.runtime.world_not_saved"))
+                : Optional.empty();
     }
 
     /**
-     * Verifies that every configured claim conflicting with this world no longer
-     * matches a folder on disk, so a world restored or moved onto a previously
-     * used path is not blocked by the stale entry the reconciler will drop.
+     * Stops at quit. New work is refused, and work that still runs gets one wait, capture and
+     * destinations together. What could not finish is kept as a notice for the next start.
      */
-    private boolean conflictingConfiguredClaimsAreStale(
-            WorldId worldId,
-            Path world,
-            WorldArchiveConfig config) {
-        for (WorldConfig configured : config.worlds()) {
-            Path configuredPath = configured.path().toAbsolutePath().normalize();
-            boolean sameId = configured.worldId().equals(worldId);
-            boolean samePath = configuredPath.equals(world);
-            if (sameId && !samePath && !claimStaleOnDisk(configured.worldId(), configuredPath)) {
-                return false;
-            }
-            if (!sameId && samePath && !folderHoldsIdentity(worldId, world)) {
-                return false;
-            }
-        }
-        return true;
-    }
-
-    private boolean releaseStaleRegistryClaims(WorldId worldId, Path world) {
-        Path claimedPath = worldPaths.claimedPath(worldId).orElse(null);
-        if (claimedPath != null && !claimedPath.equals(world)) {
-            if (!claimStaleOnDisk(worldId, claimedPath)) {
-                return false;
-            }
-            worldPaths.release(worldId, claimedPath);
-        }
-        WorldId claimedWorld = worldPaths.claimedWorld(world).orElse(null);
-        if (claimedWorld != null && !claimedWorld.equals(worldId)) {
-            if (!folderHoldsIdentity(worldId, world)) {
-                return false;
-            }
-            worldPaths.release(claimedWorld, world);
-        }
-        return true;
-    }
-
-    /** True when the folder no longer exists or no longer carries the claimed identity. */
-    private boolean claimStaleOnDisk(WorldId claimedId, Path claimedPath) {
-        if (!Files.isDirectory(claimedPath, LinkOption.NOFOLLOW_LINKS)) {
-            return true;
+    public void shutdown() {
+        if (!closed.compareAndSet(false, true)) {
+            return;
         }
+        live.close();
+        boolean finished;
         try {
-            return identityStore.loadExisting(claimedPath)
-                    .map(identity -> !identity.worldId().equals(claimedId))
-                    .orElse(true);
-        } catch (IOException exception) {
-            return false;
+            finished = graph.gate().awaitIdle(QUIT_WAIT);
+        } catch (InterruptedException interrupted) {
+            Thread.currentThread().interrupt();
+            finished = false;
         }
-    }
-
-    private boolean folderHoldsIdentity(WorldId worldId, Path world) {
-        try {
-            return identityStore.loadExisting(world)
-                    .map(identity -> identity.worldId().equals(worldId))
-                    .orElse(false);
-        } catch (IOException exception) {
-            return false;
+        if (!finished) {
+            LOGGER.warn("WorldArchive work did not finish before the game closed");
+            monitor.keep(live.exitBackupsRunning()
+                    ? BackgroundNotices.exitInterrupted()
+                    : BackgroundNotices.workInterrupted());
         }
-    }
-
-    private void registerSettingsWorld(WorldId worldId, Path worldDirectory) {
-        CompletionStage<WorldArchiveConfig> registration;
+        graph.close();
+        workers.shutdown();
         try {
-            registration = ClientSettingsAccess.registerWorld(worldId, worldDirectory);
-        } catch (RuntimeException exception) {
-            worldSettingsFailures.add(worldId);
-            logFailure("World settings could not be updated", exception);
-            return;
-        }
-        registration.whenComplete((ignored, throwable) -> {
-            if (throwable == null) {
-                worldSettingsFailures.remove(worldId);
-                return;
+            if (!workers.awaitTermination(5, TimeUnit.SECONDS)) {
+                workers.shutdownNow();
             }
-            worldSettingsFailures.add(worldId);
-            logFailure("World settings could not be updated", throwable);
-        });
-    }
-
-    Optional<String> worldSettingsWarning() {
-        return worldSettingsFailures.isEmpty()
-                ? Optional.empty()
-                : Optional.of("World settings could not be saved; review WorldArchive settings");
-    }
-
-    private void clearPersistedWorldSettingsFailures(WorldArchiveConfig config) {
-        config.worlds().stream()
-                .map(WorldConfig::worldId)
-                .forEach(worldSettingsFailures::remove);
-    }
-
-    private void refreshStorageSafety(RuntimeState state) {
-        if (stateRegistry.currentOrNull() == state) {
-            storageSafety.refresh(state.config(), worldPaths.snapshotPaths());
-        }
-    }
-
-    Optional<String> storageIssue(RuntimeState state) {
-        Optional<String> issue = RuntimeStorageSafety.issue(
-                state.config(), worldPaths.snapshotPaths());
-        if (stateRegistry.currentOrNull() == state) {
-            storageSafety.set(issue);
-        }
-        return issue;
-    }
-
-    void trackExit(CompletableFuture<BackupResult> result) {
-        backgroundBackups.trackExit(result);
-    }
-
-    void observeScheduledResult(BackupResult result, Throwable throwable) {
-        backgroundBackups.observeScheduledResult(result, throwable);
-    }
-
-    void observeExitResult(BackupResult result, Throwable throwable) {
-        backgroundBackups.observeExitResult(result, throwable);
-    }
-
-    void showRetainedBackgroundWarning() {
-        backgroundBackups.showRetainedWarning();
-    }
-
-    void beginBackupProgress(String message, Object progressKey, Runnable cancel) {
-        backgroundBackups.beginBackupProgress(message, progressKey, cancel);
-    }
-
-    ProgressListener backupProgressListener(Object progressKey) {
-        return backgroundBackups.backupProgressListener(progressKey);
-    }
-
-    RuntimeState requireCurrentState() {
-        RuntimeState state = stateRegistry.currentOrNull();
-        if (state == null || closed.get()) {
-            throw new IllegalStateException("WorldArchive is still loading");
-        }
-        return state;
-    }
-
-    boolean unavailable() {
-        return closed.get() || stateRegistry.currentOrNull() == null;
-    }
-
-    <T> CompletionStage<T> withBackupPermit(
-            Supplier<CompletionStage<T>> operation) {
-        RuntimeConfigurationGate.Permit permit = configurationGate.enterBackup();
-        try {
-            CompletionStage<T> stage = Objects.requireNonNull(
-                    operation.get(),
-                    "backup operation result");
-            stage.whenComplete((ignored, throwable) -> permit.close());
-            return stage;
-        } catch (RuntimeException | Error exception) {
-            permit.close();
-            throw exception;
+        } catch (InterruptedException interrupted) {
+            Thread.currentThread().interrupt();
+            workers.shutdownNow();
         }
+        ClientSettingsAccess.shutdown();
     }
 
-    <T> CompletionStage<T> submit(Callable<T> operation) {
-        if (closed.get()) {
-            return failedStage("WorldArchive is shutting down");
-        }
-        CompletableFuture<T> result = new CompletableFuture<>();
-        try {
-            workerExecutor.execute(() -> {
-                try {
-                    result.complete(operation.call());
-                } catch (Throwable throwable) {
-                    result.completeExceptionally(throwable);
+    /** Tells the settings about the worlds the resolver meets. */
+    private final class SettingsRecorder implements WorldIdentityResolver.Listener {
+        @Override
+        public void found(WorldId worldId, Path worldDirectory) {
+            ClientSettingsAccess.service().registerWorld(worldId, worldDirectory).whenComplete((ignored, failure) -> {
+                if (failure == null) {
+                    unsavedWorlds.remove(worldId, worldDirectory);
+                } else {
+                    unsavedWorlds.put(worldId, worldDirectory);
+                    LOGGER.warn("The settings could not record the folder of a world: {}",
+                            SafeText.from(failure, "no reason was given", 300));
                 }
             });
-        } catch (RejectedExecutionException exception) {
-            result.completeExceptionally(new IllegalStateException("WorldArchive is shutting down"));
         }
-        return result;
-    }
-
-    static <T> CompletionStage<T> failedStage(String message) {
-        return CompletableFuture.failedFuture(new IllegalStateException(message));
-    }
 
-    static void notifyProgress(
-            ProgressListener listener,
-            OperationProgress progress) {
-        try {
-            listener.onProgress(progress);
-        } catch (RuntimeException exception) {
-            // Observers never control capture correctness.
-        }
-    }
-
-    static RuntimeException safeFailure(Throwable throwable, String fallback) {
-        String message = safeMessage(throwable, fallback);
-        return new CompletionException(message, throwable);
-    }
-
-    void logFailure(String fallback, Throwable throwable) {
-        LOGGER.warn("{}: {}", fallback, safeMessage(throwable, fallback));
-    }
-
-    private static String safeMessage(Throwable throwable, String fallback) {
-        Throwable current = throwable;
-        while ((current instanceof CompletionException || current instanceof ExecutionException)
-                && current.getCause() != null) {
-            current = current.getCause();
-        }
-        String raw = current.getMessage();
-        if (raw == null || raw.isBlank()) {
-            return fallback;
-        }
-        String redacted = SensitiveDataRedactor.redact(raw)
-                .replaceAll("\\p{Cntrl}+", " ")
-                .strip();
-        if (redacted.isEmpty()) {
-            return fallback;
-        }
-        return redacted.length() <= 512 ? redacted : redacted.substring(0, 512);
-    }
-
-    List<DestinationHealth> storageAwareHealth(
-            WorldArchiveConfig config,
-            List<DestinationHealth> health) {
-        Optional<String> issue = storageSafety.warning();
-        if (issue.isEmpty()) {
-            return health;
-        }
-        return health.stream()
-                .map(item -> {
-                    boolean enabled = item.destination() == DestinationType.GIT
-                            ? config.git().enabled()
-                            : config.zip().enabled();
-                    return enabled
-                            ? new DestinationHealth(
-                                    item.destination(),
-                                    DestinationHealthStatus.UNAVAILABLE,
-                                    issue.orElseThrow(),
-                                    clock.instant())
-                            : item;
-                })
-                .toList();
-    }
-
-    List<DestinationHealth> configuredHealth(
-            WorldArchiveConfig config,
-            List<DestinationHealth> health) {
-        List<DestinationHealth> configured = new ArrayList<>(health.size());
-        for (DestinationHealth item : health) {
-            boolean enabled = item.destination() == DestinationType.GIT
-                    ? config.git().enabled()
-                    : config.zip().enabled();
-            configured.add(enabled
-                    ? item
-                    : new DestinationHealth(
-                            item.destination(),
-                            DestinationHealthStatus.DISABLED,
-                            item.destination() + " destination is disabled",
-                            clock.instant()));
+        @Override
+        public void copyFound(Path copy) {
+            // The settings scan gives a copied world its own identity; the next resolution then succeeds.
+            ClientSettingsAccess.service().saveSettings(UnaryOperator.identity()).whenComplete((ignored, failure) -> {
+                if (failure != null) {
+                    LOGGER.warn("The saves folder could not be scanned for copied worlds: {}",
+                            SafeText.from(failure, "no reason was given", 300));
+                }
+            });
         }
-        return List.copyOf(configured);
     }
-
-    List<DestinationHealth> disabledHealth(WorldArchiveConfig config) {
-        return configuredHealth(config, List.of(
-                DestinationHealth.notChecked(DestinationType.GIT),
-                DestinationHealth.notChecked(DestinationType.ZIP)));
-    }
-
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/settings/ClientSettingsAccess.java b/src/client/java/dev/ishaanko/worldarchive/settings/ClientSettingsAccess.java
index f749d63..7fcaa66 100644
--- a/src/client/java/dev/ishaanko/worldarchive/settings/ClientSettingsAccess.java
+++ b/src/client/java/dev/ishaanko/worldarchive/settings/ClientSettingsAccess.java
@@ -1,46 +1,35 @@
 package dev.ishaanko.worldarchive.settings;
 
-import dev.ishaanko.worldarchive.WorldArchiveMetadata;
+import dev.ishaanko.worldarchive.config.DefaultDestinations;
 import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
 import dev.ishaanko.worldarchive.config.WorldArchiveConfigStore;
 import dev.ishaanko.worldarchive.config.WorldIdentityStore;
-import dev.ishaanko.worldarchive.config.WorldConfig;
-import dev.ishaanko.worldarchive.core.AsyncTasks;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
+import dev.ishaanko.worldarchive.storage.git.SystemGitCommandRunner;
+import dev.ishaanko.worldarchive.ui.model.FolderSelectionResult;
 import java.nio.file.Path;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
+import java.time.Clock;
 import java.util.Objects;
 import java.util.Optional;
-import java.util.concurrent.CancellationException;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CompletionStage;
-import java.util.concurrent.CompletionException;
-import java.util.concurrent.CopyOnWriteArrayList;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
-import java.util.concurrent.Future;
 import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.ScheduledFuture;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.concurrent.atomic.AtomicReference;
-import java.util.function.Consumer;
-import java.util.function.Function;
 import net.fabricmc.loader.api.FabricLoader;
 import net.minecraft.client.Minecraft;
 import net.minecraft.client.gui.screens.Screen;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
-/** Client-wide settings gateway shared by Mod Menu, commands, and world screens. */
+/**
+ * Minecraft glue for WorldArchive settings: builds the one {@link SettingsService} for the game
+ * folder and runs its work on a settings thread, runs health probes on their own thread, shows
+ * the SDL folder picker, and opens the settings screen.
+ */
 public final class ClientSettingsAccess {
     private static final long HEALTH_DEBOUNCE_MILLIS = 250L;
 
-    private static final Logger LOGGER = LoggerFactory.getLogger(WorldArchiveMetadata.MOD_NAME);
-
     private static final ExecutorService SETTINGS_EXECUTOR = Executors.newSingleThreadExecutor(task -> {
         Thread thread = new Thread(task, "WorldArchive settings");
         thread.setDaemon(true);
@@ -54,471 +43,110 @@ public final class ClientSettingsAccess {
                 return thread;
             });
 
-    private static final NativeFolderChooser FOLDER_CHOOSER = new SdlFolderChooser(
-            task -> Minecraft.getInstance().execute(task),
+    private static final SdlFolderChooser FOLDER_CHOOSER = new SdlFolderChooser(
+            task -> Minecraft.getInstance().schedule(task),
             () -> Minecraft.getInstance().getWindow().handle());
 
-    private static final AtomicReference<List<Path>> KNOWN_WORLD_PATHS =
-            new AtomicReference<>(List.of());
-
-    private static final AtomicReference<String> STATUS =
-            new AtomicReference<>("Loading settings...");
-
-    private static final CopyOnWriteArrayList<Consumer<WorldArchiveConfig>> CONFIGURATION_LISTENERS =
-            new CopyOnWriteArrayList<>();
-
-    private static final CopyOnWriteArrayList<Function<WorldArchiveConfig, Runnable>>
-            CONFIGURATION_GUARDS =
-            new CopyOnWriteArrayList<>();
-
     private static final AtomicBoolean SHUT_DOWN = new AtomicBoolean();
 
-    private static volatile WorldArchiveSettingsRepository repository;
-
-    private static volatile SettingsDefaults settingsDefaults;
-
-    private static volatile SettingsHealthProbe healthProbe;
-
-    private static volatile Path worldsDirectory;
+    private static volatile SettingsService service;
 
-    private static volatile WorldArchiveConfig fallbackConfig = WorldArchiveConfig.defaults();
+    private static volatile Path gameDirectory;
 
-    private static volatile CompletableFuture<Void> initialization =
-            CompletableFuture.completedFuture(null);
+    private static volatile CompletionStage<WorldArchiveConfig> ready;
 
     private ClientSettingsAccess() {
     }
 
+    /** Builds the settings service and starts loading the settings; later calls do nothing. */
     public static synchronized void initialize() {
-        if (SHUT_DOWN.get() || repository != null || settingsDefaults != null) {
+        if (service != null) {
             return;
         }
-        Path gameDirectory = Minecraft.getInstance().gameDirectory.toPath()
-                .toAbsolutePath()
-                .normalize();
+        Path game = Minecraft.getInstance().gameDirectory.toPath().toAbsolutePath().normalize();
         Path configFile = FabricLoader.getInstance().getConfigDir().resolve("worldarchive.json");
-        settingsDefaults = SettingsDefaults.fromConfigFile(configFile);
-        fallbackConfig = settingsDefaults.resolve(WorldArchiveConfig.defaults());
-        healthProbe = new SystemSettingsHealthProbe(gameDirectory);
-        try {
-            repository = new WorldArchiveSettingsRepository(
-                    new WorldArchiveConfigStore(configFile),
-                    KNOWN_WORLD_PATHS::get,
-                    settingsDefaults);
-        } catch (IOException exception) {
-            STATUS.set(safeMessage(exception, "Settings storage is unavailable"));
-            LOGGER.error("WorldArchive settings storage is unavailable", exception);
-            initialization = CompletableFuture.failedFuture(exception);
-            return;
-        }
-
-        Path savesDirectory = gameDirectory.resolve("saves");
-        worldsDirectory = savesDirectory;
-        initialization = AsyncTasks.run(
-                        SETTINGS_EXECUTOR,
-                        () -> loadAndDiscoverWorlds(savesDirectory))
-                .toCompletableFuture();
+        gameDirectory = game;
+        service = new SettingsService(
+                new WorldArchiveConfigStore(configFile, new DefaultDestinations(game.resolve("worldarchive"))),
+                game.resolve("saves"),
+                new WorldIdentityStore(),
+                SETTINGS_EXECUTOR,
+                Clock.systemUTC());
+        ready = service.load();
     }
 
-    public static WorldArchiveConfig snapshot() {
+    /** The settings service of this game folder. */
+    public static SettingsService service() {
         initialize();
-        WorldArchiveSettingsRepository currentRepository = repository;
-        return currentRepository == null ? fallbackConfig : currentRepository.current();
+        return service;
     }
 
-    public static CompletionStage<Void> ready() {
+    /**
+     * Completes when the settings first loaded. Fails with
+     * {@link dev.ishaanko.worldarchive.config.UnreadableConfigurationException} when the file
+     * cannot be read; backups then wait until the settings can be read or are reset.
+     */
+    public static CompletionStage<WorldArchiveConfig> ready() {
         initialize();
-        return initialization;
+        return ready;
     }
 
-    public static CompletionStage<WorldArchiveConfig> save(WorldArchiveConfig config) {
-        Objects.requireNonNull(config, "config");
+    public static Screen createScreen(Screen parent) {
         initialize();
-        WorldArchiveSettingsRepository currentRepository = repository;
-        if (currentRepository == null) {
-            return CompletableFuture.failedFuture(new IOException("Settings storage is unavailable"));
-        }
-        STATUS.set("Saving settings...");
-        return initialization.thenApplyAsync(ignored -> {
-            List<Runnable> releases = List.of();
-            try {
-                releases = acquireConfigurationGuards(config);
-                WorldArchiveConfig refreshed = refreshWorlds(config);
-                currentRepository.save(refreshed);
-                WorldArchiveConfig saved = currentRepository.current();
-                STATUS.set("Settings saved");
-                publishConfiguration(saved);
-                return saved;
-            } catch (IOException exception) {
-                STATUS.set(safeMessage(exception, "Settings could not be saved"));
-                throw new SettingsSaveException("Settings could not be saved", exception);
-            } catch (RuntimeException exception) {
-                STATUS.set(safeMessage(exception, "Settings could not be saved"));
-                throw exception;
-            } finally {
-                releaseConfigurationGuards(releases);
-            }
-        }, SETTINGS_EXECUTOR);
+        return new WorldArchiveSettingsScreen(
+                parent, service, new SettingsHealthProbe(gameDirectory, new SystemGitCommandRunner()));
     }
 
-    public static CompletionStage<SettingsValidation> validate(
-            SettingsDraft draft,
-            List<Path> knownWorldPaths) {
-        Objects.requireNonNull(draft, "draft");
-        List<Path> worlds = List.copyOf(Objects.requireNonNull(knownWorldPaths, "knownWorldPaths"));
-        return AsyncTasks.supply(
-                SETTINGS_EXECUTOR,
-                () -> draft.validate(mergedWorldPaths(worlds, KNOWN_WORLD_PATHS.get())));
+    /** Shows the platform folder picker. Cancelling the result only ignores the choice; the dialog stays open. */
+    public static CompletableFuture<FolderSelectionResult> pickFolder(String title, Optional<Path> initialDirectory) {
+        return FOLDER_CHOOSER.chooseFolder(
+                Objects.requireNonNull(title, "title"),
+                Objects.requireNonNull(initialDirectory, "initialDirectory"));
     }
 
-    public static CancellableRequest<SettingsHealthSnapshot> probeHealth(
+    /**
+     * Runs a probe after a short pause, so a burst of edits starts one probe. Cancelling the
+     * result stops the probe, interrupting it when it already runs. Every failure completes the
+     * result, so the footer never waits forever.
+     */
+    static CompletableFuture<SettingsHealthSnapshot> probeHealth(
+            SettingsHealthProbe probe,
             SettingsProbeRequest request) {
+        Objects.requireNonNull(probe, "probe");
         Objects.requireNonNull(request, "request");
-        initialize();
-        SettingsHealthProbe currentProbe = healthProbe;
-        if (currentProbe == null) {
-            return completedRequest(SettingsHealthSnapshot.unavailable(
-                    request,
-                    "Destination health checks are unavailable"));
-        }
-
-        CompletableFuture<SettingsHealthSnapshot> completion = new CompletableFuture<>();
-        Future<?> task = HEALTH_EXECUTOR.schedule(() -> {
+        CompletableFuture<SettingsHealthSnapshot> result = new CompletableFuture<>();
+        ScheduledFuture<?> task = HEALTH_EXECUTOR.schedule(() -> {
             try {
-                completion.complete(currentProbe.probe(request));
+                result.complete(probe.probe(request));
             } catch (InterruptedException exception) {
                 Thread.currentThread().interrupt();
-                completion.cancel(false);
-            } catch (RuntimeException exception) {
-                completion.completeExceptionally(exception);
+                result.cancel(false);
+            } catch (Throwable failure) {
+                result.completeExceptionally(failure);
             }
         }, HEALTH_DEBOUNCE_MILLIS, TimeUnit.MILLISECONDS);
-        return new CancellableRequest<>(completion, () -> {
-            task.cancel(true);
-            completion.cancel(false);
-        });
-    }
-
-    public static SettingsDraft defaultsKeepingWorlds(WorldArchiveConfig current) {
-        Objects.requireNonNull(current, "current");
-        initialize();
-        SettingsDefaults currentDefaults = settingsDefaults;
-        return currentDefaults == null
-                ? SettingsDraft.defaultsKeepingWorlds(current)
-                : SettingsDraft.defaultsKeepingWorlds(current, currentDefaults);
-    }
-
-    public static Screen createScreen(Screen parent) {
-        initialize();
-        return new WorldArchiveSettingsScreen(parent, FOLDER_CHOOSER);
-    }
-
-    public static CancellableRequest<FolderSelectionResult> chooseFolder(
-            String title,
-            Optional<Path> initialDirectory) {
-        initialize();
-        return FOLDER_CHOOSER.chooseFolder(
-                Objects.requireNonNull(title, "title"),
-                Objects.requireNonNull(initialDirectory, "initialDirectory"));
-    }
-
-    /** Applies imported remotes only to already configured live worlds. */
-    public static CompletionStage<WorldArchiveConfig> connectWorldRemotes(
-            Map<WorldId, String> connections) {
-        Map<WorldId, String> requested = Map.copyOf(
-                Objects.requireNonNull(connections, "connections"));
-        if (requested.isEmpty()) {
-            return CompletableFuture.completedFuture(snapshot());
-        }
-        return ready().thenCompose(ignored -> {
-            WorldArchiveConfig current = snapshot();
-            List<WorldConfig> worlds = current.worlds().stream()
-                    .map(world -> requested.containsKey(world.worldId())
-                            ? new WorldConfig(
-                                    world.worldId(),
-                                    world.enabled(),
-                                    world.path(),
-                                    Optional.of(requested.get(world.worldId())),
-                                    world.zipDestination(),
-                                    world.storagePolicy())
-                            : world)
-                    .toList();
-            WorldArchiveConfig connected = new WorldArchiveConfig(
-                    WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                    current.triggers(),
-                    current.git(),
-                    current.zip(),
-                    worlds);
-            return connected.equals(current)
-                    ? CompletableFuture.completedFuture(current)
-                    : save(connected);
-        });
-    }
-
-    public static List<Path> knownWorldPaths() {
-        initialize();
-        return KNOWN_WORLD_PATHS.get();
-    }
-
-    /** Immediately remembers a runtime world path and asynchronously persists its identity. */
-    public static CompletionStage<WorldArchiveConfig> registerWorld(
-            WorldId worldId,
-            Path worldDirectory) {
-        Objects.requireNonNull(worldId, "worldId");
-        Path world = Objects.requireNonNull(worldDirectory, "worldDirectory")
-                .toAbsolutePath()
-                .normalize();
-        initialize();
-        rememberWorldPaths(List.of(world));
-        WorldArchiveSettingsRepository currentRepository = repository;
-        if (currentRepository == null) {
-            return CompletableFuture.failedFuture(
-                    new IOException("Settings storage is unavailable"));
-        }
-        try {
-            currentRepository.current().validateDestinations(KNOWN_WORLD_PATHS.get());
-        } catch (IOException exception) {
-            STATUS.set(safeMessage(
-                    exception, "A destination overlaps the newly registered world"));
-            throw new IllegalArgumentException(
-                    safeMessage(exception, "A destination overlaps the newly registered world"),
-                    exception);
-        }
-        return initialization.thenApplyAsync(ignored -> {
-            try {
-                WorldArchiveConfig current = currentRepository.current();
-                WorldArchiveConfig candidate = upsertWorld(current, worldId, world);
-                WorldArchiveConfig refreshed = refreshWorlds(candidate);
-                if (!refreshed.equals(current)) {
-                    List<Runnable> releases = acquireConfigurationGuards(refreshed);
-                    try {
-                        currentRepository.save(refreshed);
-                        publishConfiguration(currentRepository.current());
-                    } finally {
-                        releaseConfigurationGuards(releases);
-                    }
-                }
-                return currentRepository.current();
-            } catch (IOException exception) {
-                STATUS.set(safeMessage(exception, "World settings could not be saved"));
-                throw new CompletionException(exception);
+        result.whenComplete((ignored, failure) -> {
+            if (result.isCancelled()) {
+                task.cancel(true);
             }
-        }, SETTINGS_EXECUTOR);
-    }
-
-    public static String status() {
-        return STATUS.get();
-    }
-
-    /** Registers a process-lifetime listener for successfully loaded or saved configurations. */
-    public static void addConfigurationListener(Consumer<WorldArchiveConfig> listener) {
-        CONFIGURATION_LISTENERS.add(Objects.requireNonNull(listener, "listener"));
-    }
-
-    /** Registers a save guard held from pre-persistence validation through publication. */
-    public static void addConfigurationGuard(Function<WorldArchiveConfig, Runnable> guard) {
-        CONFIGURATION_GUARDS.add(Objects.requireNonNull(guard, "guard"));
+        });
+        return result;
     }
 
-    /** Stops client-owned settings and health workers. */
+    /** Stops the settings and health threads, letting saving settings finish for a few seconds. */
     public static void shutdown() {
         if (!SHUT_DOWN.compareAndSet(false, true)) {
             return;
         }
         HEALTH_EXECUTOR.shutdownNow();
         SETTINGS_EXECUTOR.shutdown();
-        boolean interrupted = false;
         try {
             if (!SETTINGS_EXECUTOR.awaitTermination(5, TimeUnit.SECONDS)) {
                 SETTINGS_EXECUTOR.shutdownNow();
             }
         } catch (InterruptedException exception) {
-            interrupted = true;
             SETTINGS_EXECUTOR.shutdownNow();
-        } finally {
-            CONFIGURATION_GUARDS.clear();
-            CONFIGURATION_LISTENERS.clear();
-            if (interrupted) {
-                Thread.currentThread().interrupt();
-            }
-        }
-    }
-
-    private static void loadAndDiscoverWorlds(Path savesDirectory) {
-        WorldArchiveSettingsRepository currentRepository = repository;
-        if (currentRepository == null) {
-            return;
-        }
-        try {
-            List<Path> paths = WorldFolderDiscovery.discover(savesDirectory);
-            rememberWorldPaths(paths);
-            WorldArchiveConfig loaded = currentRepository.load();
-            List<DiscoveredWorld> discovered = discoverWorldIdentities(paths);
-            WorldReconciliation reconciliation = WorldConfigReconciler.reconcile(
-                    loaded.worlds(),
-                    discovered);
-            WorldArchiveConfig reconciled = new WorldArchiveConfig(
-                    WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                    loaded.triggers(),
-                    loaded.git(),
-                    loaded.zip(),
-                    reconciliation.worlds());
-            if (!reconciled.equals(loaded)) {
-                currentRepository.save(reconciled);
-            }
-            if (reconciliation.errors().isEmpty()) {
-                STATUS.set("Settings loaded");
-            } else {
-                STATUS.set("Settings loaded; " + reconciliation.errors().size()
-                        + " world folder(s) need attention");
-                reconciliation.errors().forEach(error -> LOGGER.warn("World discovery: {}", error));
-            }
-            publishConfiguration(currentRepository.current());
-        } catch (IOException exception) {
-            STATUS.set(safeMessage(exception, "Settings could not be loaded; using defaults"));
-            LOGGER.error("WorldArchive settings could not be loaded", exception);
-        }
-    }
-
-    private static List<DiscoveredWorld> discoverWorldIdentities(List<Path> paths) {
-        WorldIdentityStore identityStore = new WorldIdentityStore();
-        List<DiscoveredWorld> discovered = new ArrayList<>(paths.size());
-        for (Path path : paths) {
-            if (Thread.currentThread().isInterrupted()) {
-                throw new CancellationException("World identity discovery was cancelled");
-            }
-            try {
-                discovered.add(DiscoveredWorld.success(path, identityStore.loadOrCreate(path)));
-            } catch (IOException exception) {
-                discovered.add(DiscoveredWorld.failure(
-                        path,
-                        safeMessage(exception, "A world identity could not be loaded")));
-            }
-        }
-        return List.copyOf(discovered);
-    }
-
-    private static WorldArchiveConfig refreshWorlds(WorldArchiveConfig config) throws IOException {
-        Path savesDirectory = worldsDirectory;
-        if (savesDirectory == null) {
-            return config;
-        }
-        return refreshWorlds(config, savesDirectory, ClientSettingsAccess::rememberWorldPaths);
-    }
-
-    static WorldArchiveConfig refreshWorlds(
-            WorldArchiveConfig config,
-            Path savesDirectory,
-            Consumer<List<Path>> pathConsumer) throws IOException {
-        List<Path> paths = WorldFolderDiscovery.discover(savesDirectory);
-        pathConsumer.accept(paths);
-        WorldReconciliation reconciliation = WorldConfigReconciler.reconcile(
-                config.worlds(), discoverWorldIdentities(paths));
-        reconciliation.errors().forEach(error -> LOGGER.warn("World discovery: {}", error));
-        return withWorlds(config, reconciliation.worlds());
-    }
-
-    static WorldArchiveConfig upsertWorld(
-            WorldArchiveConfig config,
-            WorldId worldId,
-            Path worldDirectory) {
-        WorldReconciliation reconciliation = WorldConfigReconciler.reconcile(
-                config.worlds(),
-                List.of(DiscoveredWorld.success(worldDirectory, worldId)));
-        return withWorlds(config, reconciliation.worlds());
-    }
-
-    static List<Path> mergedWorldPaths(List<Path> existing, List<Path> additions) {
-        List<Path> merged = new ArrayList<>(existing.size() + additions.size());
-        for (Path path : existing) {
-            Path normalized = Objects.requireNonNull(path, "knownWorldPath")
-                    .toAbsolutePath()
-                    .normalize();
-            if (!merged.contains(normalized)) {
-                merged.add(normalized);
-            }
-        }
-        for (Path path : additions) {
-            Path normalized = Objects.requireNonNull(path, "knownWorldPath")
-                    .toAbsolutePath()
-                    .normalize();
-            if (!merged.contains(normalized)) {
-                merged.add(normalized);
-            }
-        }
-        return List.copyOf(merged);
-    }
-
-    private static void rememberWorldPaths(List<Path> paths) {
-        KNOWN_WORLD_PATHS.updateAndGet(existing -> mergedWorldPaths(existing, paths));
-    }
-
-    private static WorldArchiveConfig withWorlds(
-            WorldArchiveConfig config,
-            List<WorldConfig> worlds) {
-        return new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                config.triggers(),
-                config.git(),
-                config.zip(),
-                worlds);
-    }
-
-    private static void publishConfiguration(WorldArchiveConfig config) {
-        for (Consumer<WorldArchiveConfig> listener : CONFIGURATION_LISTENERS) {
-            try {
-                listener.accept(config);
-            } catch (RuntimeException exception) {
-                LOGGER.warn(
-                        "WorldArchive configuration listener failed: {}",
-                        safeMessage(exception, "Configuration listener failed"));
-            }
-        }
-    }
-
-    private static List<Runnable> acquireConfigurationGuards(WorldArchiveConfig config) {
-        List<Runnable> releases = new ArrayList<>(CONFIGURATION_GUARDS.size());
-        try {
-            for (Function<WorldArchiveConfig, Runnable> guard : CONFIGURATION_GUARDS) {
-                releases.add(Objects.requireNonNull(
-                        guard.apply(config),
-                        "configuration guard release"));
-            }
-            return List.copyOf(releases);
-        } catch (RuntimeException | Error exception) {
-            releaseConfigurationGuards(releases);
-            throw exception;
-        }
-    }
-
-    private static void releaseConfigurationGuards(List<Runnable> releases) {
-        for (int index = releases.size() - 1; index >= 0; index--) {
-            releases.get(index).run();
-        }
-    }
-
-    private static CancellableRequest<SettingsHealthSnapshot> completedRequest(
-            SettingsHealthSnapshot value) {
-        return new CancellableRequest<>(CompletableFuture.completedFuture(value), () -> { });
-    }
-
-    private static String safeMessage(Throwable throwable, String fallback) {
-        String message = throwable.getMessage();
-        if (message == null || message.isBlank()) {
-            return fallback;
-        }
-        String redacted = SensitiveDataRedactor.redact(message)
-                .replaceAll("\\p{Cntrl}+", " ")
-                .strip();
-        if (redacted.isEmpty()) {
-            return fallback;
-        }
-        return redacted.length() <= 512 ? redacted : redacted.substring(0, 512);
-    }
-
-    private static final class SettingsSaveException extends RuntimeException {
-        private SettingsSaveException(String message, Throwable cause) {
-            super(message, cause);
+            Thread.currentThread().interrupt();
         }
     }
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/settings/SdlFolderChooser.java b/src/client/java/dev/ishaanko/worldarchive/settings/SdlFolderChooser.java
index aed57b5..2da2f3a 100644
--- a/src/client/java/dev/ishaanko/worldarchive/settings/SdlFolderChooser.java
+++ b/src/client/java/dev/ishaanko/worldarchive/settings/SdlFolderChooser.java
@@ -1,6 +1,6 @@
 package dev.ishaanko.worldarchive.settings;
 
-import dev.ishaanko.worldarchive.WorldArchiveMetadata;
+import dev.ishaanko.worldarchive.ui.model.FolderSelectionResult;
 import java.nio.file.InvalidPathException;
 import java.nio.file.Path;
 import java.util.Objects;
@@ -18,33 +18,39 @@
 
 /**
  * Shows the SDL folder picker that ships with Minecraft. SDL requires the dialog to open on the
- * main thread and reports the choice later through a callback that may run on any thread.
+ * main thread and reports the choice through a callback that may run on any thread, including
+ * the main thread inside the call that opened the dialog.
  */
-public final class SdlFolderChooser implements NativeFolderChooser {
-    private static final Logger LOGGER = LoggerFactory.getLogger(WorldArchiveMetadata.MOD_NAME);
+public final class SdlFolderChooser {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
 
-    private final Executor mainThread;
+    private static final String PICKER_FAILED = "The native folder picker failed; type an absolute path instead";
+
+    private final Executor mainThreadQueue;
 
     private final LongSupplier windowHandle;
 
-    public SdlFolderChooser(Executor mainThread, LongSupplier windowHandle) {
-        this.mainThread = Objects.requireNonNull(mainThread, "mainThread");
+    /**
+     * @param mainThreadQueue queues work for the main thread and never runs it in the calling
+     *        thread, such as {@code Minecraft.schedule}
+     * @param windowHandle the game window the dialog belongs to
+     */
+    public SdlFolderChooser(Executor mainThreadQueue, LongSupplier windowHandle) {
+        this.mainThreadQueue = Objects.requireNonNull(mainThreadQueue, "mainThreadQueue");
         this.windowHandle = Objects.requireNonNull(windowHandle, "windowHandle");
     }
 
-    @Override
-    public CancellableRequest<FolderSelectionResult> chooseFolder(
-            String title,
-            Optional<Path> initialDirectory) {
+    /** Opens the dialog; the result completes when the player chooses or dismisses it. */
+    public CompletableFuture<FolderSelectionResult> chooseFolder(String title, Optional<Path> initialDirectory) {
         Objects.requireNonNull(title, "title");
         Objects.requireNonNull(initialDirectory, "initialDirectory");
         CompletableFuture<FolderSelectionResult> completion = new CompletableFuture<>();
-        mainThread.execute(() -> {
+        mainThreadQueue.execute(() -> {
             if (!completion.isDone()) {
                 show(title, initialDirectory, completion);
             }
         });
-        return new CancellableRequest<>(completion, () -> completion.cancel(false));
+        return completion;
     }
 
     private void show(
@@ -72,20 +78,19 @@ private void show(
             }
         } catch (LinkageError exception) {
             callback.free();
-            completion.complete(new FolderSelectionResult.Unavailable(
+            completion.complete(new FolderSelectionResult.Failed(
                     "Native folder selection is unavailable; type an absolute path instead"));
         } catch (RuntimeException exception) {
             callback.free();
             LOGGER.warn("The SDL folder picker could not be opened", exception);
-            completion.complete(new FolderSelectionResult.Failed(
-                    "The native folder picker failed; type an absolute path instead"));
+            completion.complete(new FolderSelectionResult.Failed(PICKER_FAILED));
         }
     }
 
     /**
      * SDL invokes this exactly once per dialog, on error, cancel, or selection. The native
-     * trampoline is released on the main thread after that invocation, never before it, so a
-     * request cancelled from the screen cannot free memory the dialog still points at.
+     * trampoline is freed by a task queued for the main thread, which runs only after this
+     * invocation has returned, even when SDL calls back inside the call that opened the dialog.
      */
     private final class DialogCallback extends SDL_DialogFileCallback {
         private final CompletableFuture<FolderSelectionResult> completion;
@@ -99,7 +104,7 @@ public void invoke(long userdata, long fileList, int filter) {
             try {
                 completion.complete(read(fileList));
             } finally {
-                mainThread.execute(this::free);
+                mainThreadQueue.execute(this::free);
             }
         }
     }
@@ -108,8 +113,7 @@ public void invoke(long userdata, long fileList, int filter) {
     private static FolderSelectionResult read(long fileList) {
         if (fileList == MemoryUtil.NULL) {
             LOGGER.warn("The SDL folder picker failed: {}", SDLError.SDL_GetError());
-            return new FolderSelectionResult.Failed(
-                    "The native folder picker failed; type an absolute path instead");
+            return new FolderSelectionResult.Failed(PICKER_FAILED);
         }
         long first = MemoryUtil.memGetAddress(fileList);
         if (first == MemoryUtil.NULL) {
diff --git a/src/client/java/dev/ishaanko/worldarchive/settings/SettingsFolderPicker.java b/src/client/java/dev/ishaanko/worldarchive/settings/SettingsFolderPicker.java
deleted file mode 100644
index d134280..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/settings/SettingsFolderPicker.java
+++ /dev/null
@@ -1,68 +0,0 @@
-package dev.ishaanko.worldarchive.settings;
-
-import java.util.Objects;
-import java.util.function.Consumer;
-import java.util.function.Supplier;
-import net.minecraft.client.Minecraft;
-import net.minecraft.network.chat.Component;
-
-/** Owns one cancellable native folder-picker request and its stale-result guard. */
-final class SettingsFolderPicker {
-    private final NativeFolderChooser chooser;
-
-    private final FolderSelectionController selection = new FolderSelectionController();
-
-    private final String titleKey;
-
-    private CancellableRequest<FolderSelectionResult> pending;
-
-    SettingsFolderPicker(NativeFolderChooser chooser, String titleKey) {
-        this.chooser = Objects.requireNonNull(chooser, "chooser");
-        this.titleKey = Objects.requireNonNull(titleKey, "titleKey");
-    }
-
-    boolean choosing() {
-        return pending != null;
-    }
-
-    void noteManualEdit() {
-        selection.noteManualEdit();
-    }
-
-    void choose(
-            SettingsScreenState screenState,
-            Minecraft minecraft,
-            Supplier<String> currentValue,
-            Consumer<FolderSelectionController.Application> completion) {
-        Objects.requireNonNull(screenState, "screenState");
-        Objects.requireNonNull(minecraft, "minecraft");
-        Objects.requireNonNull(currentValue, "currentValue");
-        Objects.requireNonNull(completion, "completion");
-        cancel();
-        FolderSelectionController.Request request = selection.begin(currentValue.get());
-        SettingsScreenState.LifecycleToken lifecycleToken = screenState.lifecycleToken();
-        CancellableRequest<FolderSelectionResult> picker = chooser.chooseFolder(
-                Component.translatable(titleKey).getString(),
-                request.initialDirectory());
-        pending = picker;
-        picker.completion().whenComplete((result, throwable) -> minecraft.execute(() -> {
-            if (pending != picker || !screenState.acceptsActive(lifecycleToken)) {
-                return;
-            }
-            pending = null;
-            FolderSelectionResult outcome = throwable == null && result != null
-                    ? result
-                    : new FolderSelectionResult.Failed(Component.translatable(
-                            "screen.worldarchive.settings.folder_picker_failed").getString());
-            completion.accept(selection.apply(request, outcome, currentValue.get()));
-        }));
-    }
-
-    void cancel() {
-        CancellableRequest<FolderSelectionResult> request = pending;
-        pending = null;
-        if (request != null) {
-            request.cancel();
-        }
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/settings/SettingsStatusPresenter.java b/src/client/java/dev/ishaanko/worldarchive/settings/SettingsStatusPresenter.java
index 0dace56..a4a4bf8 100644
--- a/src/client/java/dev/ishaanko/worldarchive/settings/SettingsStatusPresenter.java
+++ b/src/client/java/dev/ishaanko/worldarchive/settings/SettingsStatusPresenter.java
@@ -1,102 +1,108 @@
 package dev.ishaanko.worldarchive.settings;
 
+import dev.ishaanko.worldarchive.config.UnreadableConfigurationException;
+import dev.ishaanko.worldarchive.config.UnsupportedSchemaVersionException;
+import dev.ishaanko.worldarchive.model.SafeText;
+import java.nio.file.Path;
 import java.util.List;
 import java.util.Objects;
+import java.util.Optional;
+import java.util.stream.Collectors;
 import net.minecraft.ChatFormatting;
 import net.minecraft.client.gui.components.Tooltip;
 import net.minecraft.network.chat.Component;
+import net.minecraft.network.chat.MutableComponent;
 
-/** Composes validation and destination-health state into concise settings status text. */
+/** Turns the settings screen's state into its status line and the text of its tooltip. */
 final class SettingsStatusPresenter {
-    private SettingsStatusPresenter() {}
+    private static final int REASON_LIMIT = 300;
 
-    static Component visible(State state) {
-        if (state.loading()) {
-            return white("screen.worldarchive.settings.loading");
-        }
-        if (state.saving()) {
-            return white("screen.worldarchive.settings.saving");
-        }
-        if (state.validating()) {
-            return white("screen.worldarchive.settings.validating");
-        }
-        if (state.healthChecking()) {
-            return white("screen.worldarchive.settings.health_checking");
+    private SettingsStatusPresenter() {
+    }
+
+    /**
+     * The first of: work in progress, the last action's message, a problem on this page, and
+     * then the page's own summary (destination health, or the worlds and what the last scan found).
+     */
+    static Status status(State state) {
+        Optional<String> busy = busyKey(state);
+        if (busy.isPresent()) {
+            return Status.of(Component.translatable(busy.get()).withStyle(ChatFormatting.WHITE));
         }
         if (!state.transientStatus().getString().isBlank()) {
-            return state.transientStatus().copy().withStyle(ChatFormatting.YELLOW);
+            return Status.of(state.transientStatus().copy().withStyle(ChatFormatting.YELLOW));
         }
-        String issue = pageIssue(state.page(), state.validation());
-        if (issue != null) {
-            return Component.literal(issue).withStyle(ChatFormatting.RED);
+        Optional<String> issue = pageIssue(state.page(), state.validation());
+        if (issue.isPresent()) {
+            return Status.of(Component.literal(issue.get()).withStyle(ChatFormatting.RED));
         }
+        SettingsHealthSnapshot health = state.health();
         return switch (state.page()) {
-            case GIT -> healthComponent(
-                    state.health().gitDisplaySummary(),
-                    state.health().gitTool(),
-                    state.health().lfsTool(),
-                    state.health().repository(),
-                    state.health().remote());
-            case ZIP -> healthComponent(
-                    state.health().zipDisplaySummary(),
-                    state.health().zipDirectory());
-            case WORLDS -> Component.translatable(
-                            "screen.worldarchive.settings.world_count",
-                            state.worldCount())
-                    .withStyle(ChatFormatting.WHITE);
+            case GIT -> health(health.gitDisplaySummary(), health.gitSummary(),
+                    health.gitTool(), health.lfsTool(), health.repository());
+            case ZIP -> health(health.zipDisplaySummary(), health.zipSummary(), health.zipFolder());
+            case WORLDS -> worlds(state);
         };
     }
 
-    static Component detail(State state, Component visible) {
-        if (state.loading()
-                || state.saving()
-                || state.validating()
-                || state.healthChecking()
-                || !state.transientStatus().getString().isBlank()
-                || pageIssue(state.page(), state.validation()) != null) {
-            return visible;
-        }
-        return switch (state.page()) {
-            case GIT -> healthComponent(
-                    state.health().gitSummary(),
-                    state.health().gitTool(),
-                    state.health().lfsTool(),
-                    state.health().repository(),
-                    state.health().remote());
-            case ZIP -> healthComponent(
-                    state.health().zipSummary(),
-                    state.health().zipDirectory());
-            case WORLDS -> visible;
+    /** Why the settings file cannot be read, and what the player can do about it. */
+    static Component unreadable(UnreadableConfigurationException failure) {
+        Component reason = failure.getCause() instanceof UnsupportedSchemaVersionException schema
+                ? Component.translatable(schema.newer()
+                        ? "screen.worldarchive.settings.unreadable_newer"
+                        : "screen.worldarchive.settings.unreadable_older")
+                : Component.translatable(
+                        "screen.worldarchive.settings.unreadable",
+                        SafeText.from(failure.getCause(), "the file is damaged", REASON_LIMIT));
+        return reason.copy().withStyle(ChatFormatting.RED)
+                .append("\n\n")
+                .append(Component.translatable(
+                        "screen.worldarchive.settings.unreadable_help",
+                        String.valueOf(failure.file().getFileName())).withStyle(ChatFormatting.WHITE));
+    }
+
+    static MutableComponent notice(WorldNotice notice) {
+        return switch (notice) {
+            case WorldNotice.CopyGotOwnIdentity copy -> Component.translatable(
+                    "screen.worldarchive.settings.notice.copy", folderName(copy.copy()), folderName(copy.original()));
+            case WorldNotice.SharedIdentity shared -> Component.translatable(
+                    "screen.worldarchive.settings.notice.shared",
+                    shared.folders().stream().map(SettingsStatusPresenter::folderName)
+                            .collect(Collectors.joining(", ")));
+            case WorldNotice.IdentityReplaced replaced -> Component.translatable(
+                    "screen.worldarchive.settings.notice.replaced", folderName(replaced.folder()));
+            case WorldNotice.IdentityUnreadable failed -> Component.translatable(
+                    "screen.worldarchive.settings.notice.unreadable", folderName(failed.folder()), failed.reason());
         };
     }
 
     static Tooltip defaultTooltip(SettingsField field) {
-        if (field == SettingsField.SCHEDULE_INTERVAL) {
-            return Tooltip.create(Component.translatable(
-                    "screen.worldarchive.settings.schedule_interval_tooltip"));
-        }
-        if (field == SettingsField.WORLD_REMOTE_URL) {
-            return Tooltip.create(Component.translatable(
-                    "screen.worldarchive.settings.world_remote_steps"));
+        String key = switch (field) {
+            case SCHEDULE_INTERVAL -> "screen.worldarchive.settings.schedule_interval_tooltip";
+            case WORLD_REMOTE_URL -> "screen.worldarchive.settings.world_remote_steps";
+            case WORLD_ZIP_DESTINATION -> "screen.worldarchive.settings.world_zip_tooltip";
+            case GIT_REMOTE_NAME -> "screen.worldarchive.settings.remote_name_tooltip";
+            default -> null;
+        };
+        return key == null ? null : Tooltip.create(Component.translatable(key));
+    }
+
+    private static Optional<String> busyKey(State state) {
+        if (state.loading()) {
+            return Optional.of("screen.worldarchive.settings.loading");
         }
-        if (field == SettingsField.WORLD_ZIP_DESTINATION) {
-            return Tooltip.create(Component.translatable(
-                    "screen.worldarchive.settings.world_zip_tooltip"));
+        if (state.saving()) {
+            return Optional.of("screen.worldarchive.settings.saving");
         }
-        if (field == SettingsField.GIT_REMOTE_NAME) {
-            return Tooltip.create(Component.translatable(
-                    "screen.worldarchive.settings.remote_name_tooltip"));
+        if (state.validating()) {
+            return Optional.of("screen.worldarchive.settings.validating");
         }
-        return null;
+        return state.healthChecking()
+                ? Optional.of("screen.worldarchive.settings.health_checking")
+                : Optional.empty();
     }
 
-    private static Component white(String translationKey) {
-        return Component.translatable(translationKey).withStyle(ChatFormatting.WHITE);
-    }
-
-    private static String pageIssue(
-            SettingsPage page,
-            SettingsValidation validation) {
+    private static Optional<String> pageIssue(SettingsPage page, SettingsValidation validation) {
         List<SettingsField> pageFields = switch (page) {
             case GIT -> List.of(
                     SettingsField.GIT_REPOSITORY,
@@ -108,53 +114,76 @@ private static String pageIssue(
                     SettingsField.ZIP_DESTINATION,
                     SettingsField.SCHEDULE_INTERVAL,
                     SettingsField.DESTINATIONS);
-            case WORLDS -> List.of(
-                    SettingsField.WORLD_REMOTE_URL,
-                    SettingsField.WORLD_ZIP_DESTINATION,
-                    SettingsField.DESTINATIONS);
+            case WORLDS -> List.of(SettingsField.DESTINATIONS);
         };
         for (SettingsField field : pageFields) {
-            String issue = validation.issues().get(field);
-            if (issue != null) {
+            Optional<String> issue = validation.issue(field);
+            if (issue.isPresent()) {
                 return issue;
             }
         }
-        return validation.firstIssue().orElse(null);
+        return page == SettingsPage.WORLDS
+                ? validation.firstWorldIssue().or(validation::firstIssue)
+                : validation.firstIssue();
     }
 
-    private static Component healthComponent(
-            String message,
-            SettingsHealthItem... items) {
+    private static Status worlds(State state) {
+        Component count = Component.translatable("screen.worldarchive.settings.world_count", state.worldCount())
+                .withStyle(ChatFormatting.WHITE);
+        if (state.notices().isEmpty()) {
+            return Status.of(count);
+        }
+        MutableComponent detail = notice(state.notices().getFirst());
+        for (WorldNotice notice : state.notices().subList(1, state.notices().size())) {
+            detail.append("\n").append(notice(notice));
+        }
+        return new Status(notice(state.notices().getFirst()).withStyle(ChatFormatting.YELLOW), detail);
+    }
+
+    private static Status health(String summary, String detail, SettingsHealthItem... items) {
         ChatFormatting color = ChatFormatting.GREEN;
         for (SettingsHealthItem item : items) {
             color = moreSevere(color, item.status());
         }
-        return Component.literal(message).withStyle(color);
+        return new Status(Component.literal(summary).withStyle(color), Component.literal(detail).withStyle(color));
     }
 
-    private static ChatFormatting moreSevere(
-            ChatFormatting current,
-            SettingsHealthStatus status) {
+    private static ChatFormatting moreSevere(ChatFormatting current, SettingsHealthStatus status) {
         if (status == SettingsHealthStatus.UNAVAILABLE) {
             return ChatFormatting.RED;
         }
         if (current == ChatFormatting.RED) {
             return current;
         }
-        if (status == SettingsHealthStatus.TOOL_MISSING
-                || status == SettingsHealthStatus.UNCHECKED) {
+        if (status == SettingsHealthStatus.TOOL_MISSING || status == SettingsHealthStatus.UNCHECKED) {
             return ChatFormatting.YELLOW;
         }
         if (current == ChatFormatting.YELLOW) {
             return current;
         }
-        if (status == SettingsHealthStatus.DISABLED
-                || status == SettingsHealthStatus.UNCONFIGURED) {
+        if (status == SettingsHealthStatus.DISABLED || status == SettingsHealthStatus.UNCONFIGURED) {
             return ChatFormatting.WHITE;
         }
         return current;
     }
 
+    private static String folderName(Path folder) {
+        return folder.getFileName() == null ? folder.toString() : folder.getFileName().toString();
+    }
+
+    /** The status line, and the fuller text of its tooltip. */
+    record Status(Component visible, Component detail) {
+        Status {
+            Objects.requireNonNull(visible, "visible");
+            Objects.requireNonNull(detail, "detail");
+        }
+
+        static Status of(Component text) {
+            return new Status(text, text);
+        }
+    }
+
+    /** Everything the status line depends on. */
     record State(
             SettingsPage page,
             boolean loading,
@@ -164,12 +193,14 @@ record State(
             Component transientStatus,
             SettingsValidation validation,
             SettingsHealthSnapshot health,
-            int worldCount) {
+            int worldCount,
+            List<WorldNotice> notices) {
         State {
             Objects.requireNonNull(page, "page");
             Objects.requireNonNull(transientStatus, "transientStatus");
             Objects.requireNonNull(validation, "validation");
             Objects.requireNonNull(health, "health");
+            notices = List.copyOf(notices);
         }
     }
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/settings/WorldArchiveSettingsScreen.java b/src/client/java/dev/ishaanko/worldarchive/settings/WorldArchiveSettingsScreen.java
index 84b9376..b05c3e2 100644
--- a/src/client/java/dev/ishaanko/worldarchive/settings/WorldArchiveSettingsScreen.java
+++ b/src/client/java/dev/ishaanko/worldarchive/settings/WorldArchiveSettingsScreen.java
@@ -1,17 +1,24 @@
 package dev.ishaanko.worldarchive.settings;
 
+import dev.ishaanko.worldarchive.config.UnreadableConfigurationException;
 import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.SafeText;
+import dev.ishaanko.worldarchive.model.WorldId;
 import dev.ishaanko.worldarchive.ui.Widgets;
+import dev.ishaanko.worldarchive.ui.model.FolderSelectionResult;
 import dev.ishaanko.worldarchive.ui.model.ScreenGeometry;
 import java.nio.file.Path;
-import java.time.Instant;
 import java.util.EnumMap;
-import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CompletionStage;
 import java.util.function.Consumer;
 import java.util.function.Supplier;
+import net.minecraft.client.gui.Font;
 import net.minecraft.client.gui.components.Button;
 import net.minecraft.client.gui.components.Checkbox;
 import net.minecraft.client.gui.components.EditBox;
@@ -21,7 +28,12 @@
 import net.minecraft.client.gui.screens.Screen;
 import net.minecraft.network.chat.Component;
 
-/** Vanilla-style, keyboard-navigable settings shared by every WorldArchive entry point. */
+/**
+ * WorldArchive's settings screen: Git, ZIP and per-world settings on three tabs above a status
+ * line. An async result is applied on the render thread only while it is still the newest of
+ * its kind. When the settings file cannot be read, the screen shows why and offers only a reset,
+ * which keeps the old file.
+ */
 public final class WorldArchiveSettingsScreen extends Screen {
     private static final int FIELD_TEXT_COLOR = 0xFFE0E0E0;
 
@@ -33,20 +45,17 @@ public final class WorldArchiveSettingsScreen extends Screen {
 
     private static final int CONTENT_MARGIN = 20;
 
-    private final Screen parent;
-
-    private final SettingsScreenState screenState = new SettingsScreenState();
+    private static final int MESSAGE_LIMIT = 256;
 
-    private final WorldSettingsPage worldsPage = new WorldSettingsPage(this);
+    private final Screen parent;
 
-    private final SettingsFolderPicker gitFolderPicker;
+    private final SettingsService settings;
 
-    private final SettingsFolderPicker zipFolderPicker;
+    private final SettingsHealthProbe healthProbe;
 
-    private final Map<SettingsField, EditBox> validatedFields =
-            new EnumMap<>(SettingsField.class);
+    private final WorldSettingsPage worldsPage = new WorldSettingsPage(this);
 
-    private List<Path> knownWorldPaths = List.of();
+    private final Map<SettingsField, EditBox> validatedFields = new EnumMap<>(SettingsField.class);
 
     private SettingsDraft draft;
 
@@ -54,7 +63,8 @@ public final class WorldArchiveSettingsScreen extends Screen {
 
     private SettingsHealthSnapshot healthSnapshot;
 
-    private SettingsLayout layout = SettingsLayout.forHeight(240);
+    private SettingsLayout layout = SettingsLayout.forScreen(
+            SettingsLayout.COMPACT_HEIGHT_THRESHOLD, SettingsLayout.FULL_CONTENT_WIDTH);
 
     private SettingsPage page = SettingsPage.GIT;
 
@@ -62,19 +72,24 @@ public final class WorldArchiveSettingsScreen extends Screen {
 
     private int zipSection;
 
-    private boolean settingsLoaded;
+    private boolean loading = true;
 
-    private boolean loadingSettings = true;
+    private boolean closing;
 
-    private boolean validating;
+    /** Why the settings file cannot be read; null while it can. */
+    private UnreadableConfigurationException unreadable;
 
-    private boolean healthChecking;
+    private Component transientStatus = Component.empty();
 
-    private boolean closing;
+    private CompletionStage<?> pendingLoad;
 
-    private Component transientStatus = Component.empty();
+    private CompletionStage<?> pendingWrite;
+
+    private CompletableFuture<SettingsValidation> pendingValidation;
 
-    private CancellableRequest<SettingsHealthSnapshot> healthRequest;
+    private CompletableFuture<SettingsHealthSnapshot> pendingHealth;
+
+    private CompletableFuture<FolderSelectionResult> pendingFolder;
 
     private Button saveButton;
 
@@ -82,43 +97,35 @@ public final class WorldArchiveSettingsScreen extends Screen {
 
     private Button zipBrowseButton;
 
-    private boolean zipBrowseEnabled = true;
+    private Button worldZipBrowseButton;
+
+    private boolean worldZipBrowseEnabled;
 
     private MultiLineTextWidget statusWidget;
 
-    public WorldArchiveSettingsScreen(Screen parent, NativeFolderChooser folderChooser) {
+    public WorldArchiveSettingsScreen(Screen parent, SettingsService settings, SettingsHealthProbe healthProbe) {
         super(Component.translatable("screen.worldarchive.settings.title"));
         this.parent = parent;
-        NativeFolderChooser chooser = Objects.requireNonNull(folderChooser, "folderChooser");
-        gitFolderPicker = new SettingsFolderPicker(
-                chooser,
-                "screen.worldarchive.settings.git_folder_title");
-        zipFolderPicker = new SettingsFolderPicker(
-                chooser,
-                "screen.worldarchive.settings.zip_folder_title");
-        draft = SettingsDraft.from(ClientSettingsAccess.snapshot());
-        validation = new SettingsValidation(Optional.of(draft.base()), Map.of());
-        healthSnapshot = SettingsHealthSnapshot.unchecked(draft.probeRequest());
+        this.settings = Objects.requireNonNull(settings, "settings");
+        this.healthProbe = Objects.requireNonNull(healthProbe, "healthProbe");
+        startDraft();
     }
 
     @Override
     public void added() {
         super.added();
-        screenState.activate();
-        if (!settingsLoaded) {
-            awaitSettings();
-            return;
+        if (loading) {
+            // A file that could not be read is read again, in case the player fixed it meanwhile.
+            awaitLoad(settings.unreadable().isPresent() ? settings.load() : ClientSettingsAccess.ready());
+        } else if (unreadable == null) {
+            refreshValidation();
+            requestHealthProbe();
         }
-        refreshValidation();
-        requestHealthProbe();
     }
 
     @Override
     public void removed() {
         cancelAsyncRequests();
-        if (!closing) {
-            screenState.deactivate();
-        }
         super.removed();
     }
 
@@ -132,11 +139,16 @@ protected void init() {
         saveButton = null;
         gitBrowseButton = null;
         zipBrowseButton = null;
-        zipBrowseEnabled = true;
+        worldZipBrowseButton = null;
+        worldZipBrowseEnabled = false;
         statusWidget = null;
 
         int contentX = ScreenGeometry.centerX(width, contentWidth);
         addRenderableOnly(Widgets.title(font, contentX, 5, contentWidth, 18, title));
+        if (unreadable != null) {
+            addUnreadableView(contentX, contentWidth);
+            return;
+        }
         addTabs(contentX, contentWidth);
         switch (page) {
             case GIT -> addGitPage(contentX, contentWidth);
@@ -148,26 +160,93 @@ protected void init() {
         applyValidationState();
     }
 
-    private void awaitSettings() {
-        loadingSettings = true;
-        SettingsScreenState.LifecycleToken token = screenState.lifecycleToken();
-        ClientSettingsAccess.ready().whenComplete((ignored, throwable) -> minecraft.execute(() -> {
-            if (!screenState.acceptsActive(token)) {
+    private void awaitLoad(CompletionStage<WorldArchiveConfig> load) {
+        loading = true;
+        pendingLoad = load;
+        load.whenComplete((ignored, failure) -> minecraft.execute(() -> {
+            if (pendingLoad != load || closing) {
                 return;
             }
-            settingsLoaded = true;
-            loadingSettings = false;
-            knownWorldPaths = ClientSettingsAccess.knownWorldPaths();
-            draft = SettingsDraft.from(ClientSettingsAccess.snapshot());
-            validation = new SettingsValidation(Optional.of(draft.base()), Map.of());
-            healthSnapshot = SettingsHealthSnapshot.unchecked(draft.probeRequest());
-            if (throwable != null) {
+            pendingLoad = null;
+            loading = false;
+            unreadable = settings.unreadable().orElse(null);
+            startDraft();
+            if (unreadable == null) {
+                refreshValidation();
+                requestHealthProbe();
+            }
+            rebuildIfShown();
+        }));
+    }
+
+    /**
+     * Starts a new draft from the settings as the service holds them now. Whether the file can
+     * be read is taken from the service only when a load, save or reset finished, so the reset
+     * button never shows while a load that may succeed is still running.
+     */
+    private void startDraft() {
+        draft = SettingsDraft.from(settings.current());
+        validation = SettingsValidation.valid(draft.base());
+        healthSnapshot = SettingsHealthSnapshot.unchecked(draft.probeRequest());
+    }
+
+    /** Settings that cannot be read are never shown as if they were the player's: only the reason and a reset. */
+    private void addUnreadableView(int x, int contentWidth) {
+        statusWidget = new MultiLineTextWidget(x, 32, SettingsStatusPresenter.unreadable(unreadable), font)
+                .setMaxWidth(contentWidth)
+                .setMaxRows(8);
+        addRenderableOnly(statusWidget);
+        addRenderableOnly(SettingsWidgets.wrappedText(
+                font,
+                x,
+                layout.statusY(),
+                contentWidth,
+                transientStatus,
+                2));
+        int buttonWidth = Math.min(120, (contentWidth - 4) / 2);
+        int buttonX = x + (contentWidth - buttonWidth * 2 - 4) / 2;
+        Button reset = Button.builder(
+                        Component.translatable("screen.worldarchive.settings.reset"),
+                        ignored -> resetSettings())
+                .bounds(buttonX, layout.buttonsY(), buttonWidth, 20)
+                .build();
+        reset.active = pendingWrite == null;
+        addRenderableWidget(reset);
+        Button cancel = Button.builder(Component.translatable("gui.cancel"), ignored -> onClose())
+                .bounds(buttonX + buttonWidth + 4, layout.buttonsY(), buttonWidth, 20)
+                .build();
+        cancel.active = pendingWrite == null;
+        addRenderableWidget(cancel);
+    }
+
+    private void resetSettings() {
+        if (pendingWrite != null) {
+            return;
+        }
+        CompletionStage<Optional<Path>> request = settings.reset();
+        pendingWrite = request;
+        transientStatus = Component.translatable("screen.worldarchive.settings.saving");
+        rebuildIfShown();
+        request.whenComplete((keptCopy, failure) -> minecraft.execute(() -> {
+            if (pendingWrite != request || closing) {
+                return;
+            }
+            pendingWrite = null;
+            if (failure != null) {
                 transientStatus = Component.translatable(
-                        "screen.worldarchive.settings.load_failed");
+                        "screen.worldarchive.settings.reset_failed",
+                        SafeText.from(failure, "the settings file could not be replaced", MESSAGE_LIMIT));
+                rebuildIfShown();
+                return;
             }
+            unreadable = settings.unreadable().orElse(null);
+            startDraft();
+            transientStatus = keptCopy.<Component>map(copy -> Component.translatable(
+                            "screen.worldarchive.settings.reset_done", String.valueOf(copy.getFileName())))
+                    .orElseGet(() -> Component.translatable("screen.worldarchive.settings.reset_not_needed"));
             refreshValidation();
             requestHealthProbe();
-            rebuildIfInitialized();
+            rebuildIfShown();
         }));
     }
 
@@ -205,46 +284,19 @@ private void addGitPage(int x, int contentWidth) {
             addGitPatternsRow(x, layout.gitRowY(section, firstIndex + 1), contentWidth);
         }
         if (full || section == 2) {
-            addTriggerRow(
-                    x,
-                    layout.gitRowY(section, full ? 4 : 0),
-                    contentWidth,
-                    draft.gitManualEnabled(),
-                    draft.gitWorldExitEnabled(),
-                    draft.gitScheduledEnabled(),
-                    draft::setGitManualEnabled,
-                    draft::setGitWorldExitEnabled,
-                    draft::setGitScheduledEnabled);
+            addTriggerRow(x, layout.gitRowY(section, full ? 4 : 0), contentWidth, DestinationType.GIT);
         }
     }
 
     private void addGitHeader(int x, int contentWidth, boolean full, int section) {
         int headerY = full ? layout.gitRowY(0, 0) : layout.pagedHeaderY();
         if (full) {
-            addCheckbox(
-                    "screen.worldarchive.settings.git_enabled",
-                    draft.gitEnabled(),
-                    x,
-                    headerY,
-                    contentWidth,
-                    enabled -> {
-                        draft.setGitEnabled(enabled);
-                        requestHealthProbe();
-                    });
+            addGitEnabledCheckbox(x, headerY, contentWidth);
             return;
         }
         switch (section) {
             case 0 -> {
-                addCheckbox(
-                        "screen.worldarchive.settings.git_enabled",
-                        draft.gitEnabled(),
-                        x,
-                        headerY,
-                        contentWidth - 68,
-                        enabled -> {
-                            draft.setGitEnabled(enabled);
-                            requestHealthProbe();
-                        });
+                addGitEnabledCheckbox(x, headerY, contentWidth - 68);
                 addGitSectionButton(
                         x + contentWidth - 64, headerY, "screen.worldarchive.settings.more", 1);
             }
@@ -258,6 +310,13 @@ private void addGitHeader(int x, int contentWidth, boolean full, int section) {
         }
     }
 
+    private void addGitEnabledCheckbox(int x, int y, int width) {
+        addCheckbox("screen.worldarchive.settings.git_enabled", draft.gitEnabled(), x, y, width, enabled -> {
+            draft.setGitEnabled(enabled);
+            requestHealthProbe();
+        });
+    }
+
     private void addGitSectionButton(int x, int y, String key, int section) {
         Button button = Button.builder(
                         Component.translatable(key),
@@ -281,14 +340,16 @@ private void addGitRepositoryRow(int x, int y, int contentWidth) {
                 contentWidth - 68,
                 2048,
                 value -> {
-                    gitFolderPicker.noteManualEdit();
                     draft.setGitRepository(value);
                     requestHealthProbe();
                 });
         repository.setHint(Component.translatable("screen.worldarchive.settings.path_hint"));
         gitBrowseButton = Button.builder(
                         Component.translatable("screen.worldarchive.settings.browse"),
-                        ignored -> chooseGitFolder())
+                        ignored -> chooseFolder(
+                                "screen.worldarchive.settings.git_folder_title",
+                                () -> draft.gitRepository(),
+                                value -> draft.setGitRepository(value)))
                 .bounds(x + contentWidth - 64, y, 64, 20)
                 .build();
         gitBrowseButton.active = !controlsLocked();
@@ -304,10 +365,7 @@ private void addGitPatternsRow(int x, int y, int contentWidth) {
                 y,
                 contentWidth,
                 2048,
-                value -> {
-                    draft.setGitLfsPatterns(value);
-                    requestHealthProbe();
-                });
+                value -> draft.setGitLfsPatterns(value));
         patterns.setHint(Component.translatable("screen.worldarchive.settings.lfs_hint"));
     }
 
@@ -320,10 +378,7 @@ private void addGitRemoteNameRow(int x, int y, int contentWidth) {
                 y,
                 contentWidth,
                 64,
-                value -> {
-                    draft.setGitRemoteName(value);
-                    requestHealthProbe();
-                });
+                value -> draft.setGitRemoteName(value));
         remoteName.setHint(Component.translatable(
                 "screen.worldarchive.settings.remote_name_hint"));
     }
@@ -337,46 +392,19 @@ private void addZipPage(int x, int contentWidth) {
             addZipDestinationRow(x, layout.zipRowY(section, full ? 1 : 0), contentWidth);
         }
         if (full || section == 1) {
-            addTriggerRow(
-                    x,
-                    layout.zipRowY(section, full ? 2 : 0),
-                    contentWidth,
-                    draft.zipManualEnabled(),
-                    draft.zipWorldExitEnabled(),
-                    draft.zipScheduledEnabled(),
-                    draft::setZipManualEnabled,
-                    draft::setZipWorldExitEnabled,
-                    draft::setZipScheduledEnabled);
+            addTriggerRow(x, layout.zipRowY(section, full ? 2 : 0), contentWidth, DestinationType.ZIP);
         }
     }
 
     private void addZipHeader(int x, int contentWidth, boolean full, int section) {
         int headerY = full ? layout.zipRowY(0, 0) : layout.pagedHeaderY();
         if (full) {
-            addCheckbox(
-                    "screen.worldarchive.settings.zip_enabled",
-                    draft.zipEnabled(),
-                    x,
-                    headerY,
-                    contentWidth,
-                    enabled -> {
-                        draft.setZipEnabled(enabled);
-                        requestHealthProbe();
-                    });
+            addZipEnabledCheckbox(x, headerY, contentWidth);
             return;
         }
         switch (section) {
             case 0 -> {
-                addCheckbox(
-                        "screen.worldarchive.settings.zip_enabled",
-                        draft.zipEnabled(),
-                        x,
-                        headerY,
-                        contentWidth - 68,
-                        enabled -> {
-                            draft.setZipEnabled(enabled);
-                            requestHealthProbe();
-                        });
+                addZipEnabledCheckbox(x, headerY, contentWidth - 68);
                 addZipSectionButton(
                         x + contentWidth - 64, headerY, "screen.worldarchive.settings.timing", 1);
             }
@@ -385,6 +413,13 @@ private void addZipHeader(int x, int contentWidth, boolean full, int section) {
         }
     }
 
+    private void addZipEnabledCheckbox(int x, int y, int width) {
+        addCheckbox("screen.worldarchive.settings.zip_enabled", draft.zipEnabled(), x, y, width, enabled -> {
+            draft.setZipEnabled(enabled);
+            requestHealthProbe();
+        });
+    }
+
     private void addZipDestinationRow(int x, int y, int contentWidth) {
         EditBox destination = addTextRow(
                 "screen.worldarchive.settings.archive_folder",
@@ -395,14 +430,16 @@ private void addZipDestinationRow(int x, int y, int contentWidth) {
                 contentWidth - 68,
                 2048,
                 value -> {
-                    zipFolderPicker.noteManualEdit();
                     draft.setZipDestination(value);
                     requestHealthProbe();
                 });
         destination.setHint(Component.translatable("screen.worldarchive.settings.path_hint"));
         zipBrowseButton = Button.builder(
                         Component.translatable("screen.worldarchive.settings.browse"),
-                        ignored -> chooseZipFolder())
+                        ignored -> chooseFolder(
+                                "screen.worldarchive.settings.zip_folder_title",
+                                () -> draft.zipDestination(),
+                                value -> draft.setZipDestination(value)))
                 .bounds(x + contentWidth - 64, y, 64, 20)
                 .build();
         zipBrowseButton.active = !controlsLocked();
@@ -430,7 +467,11 @@ SettingsDraft draft() {
         return draft;
     }
 
-    net.minecraft.client.gui.Font settingsFont() {
+    SettingsValidation validation() {
+        return validation;
+    }
+
+    Font settingsFont() {
         return font;
     }
 
@@ -446,10 +487,10 @@ void addSettingsText(MultiLineTextWidget text) {
         addRenderableOnly(text);
     }
 
-    /** The world page's browse button is only usable while that world's override is on. */
+    /** The selected world's own ZIP Browse button, usable only while that world uses its own folder. */
     void setWorldZipBrowseButton(Button button, boolean overrideEnabled) {
-        zipBrowseButton = button;
-        zipBrowseEnabled = overrideEnabled;
+        worldZipBrowseButton = button;
+        worldZipBrowseEnabled = overrideEnabled;
         addRenderableWidget(button);
         refreshControls();
     }
@@ -466,7 +507,7 @@ private void addFooter(int x, int contentWidth) {
         statusWidget = new MultiLineTextWidget(
                         x,
                         layout.statusY(),
-                        SettingsStatusPresenter.visible(statusState()),
+                        SettingsStatusPresenter.status(statusState()).visible(),
                         font)
                 .setMaxWidth(contentWidth)
                 .setMaxRows(2);
@@ -488,7 +529,7 @@ private void addFooter(int x, int contentWidth) {
                         ignored -> onClose())
                 .bounds(buttonX + buttonWidth + 4, layout.buttonsY(), buttonWidth, 20)
                 .build();
-        cancel.active = !screenState.saving();
+        cancel.active = pendingWrite == null;
         addRenderableWidget(cancel);
         saveButton = Button.builder(
                         Component.translatable("screen.worldarchive.settings.save"),
@@ -538,40 +579,18 @@ Checkbox addCheckbox(
         return checkbox;
     }
 
-    private void addTriggerRow(
-            int x,
-            int y,
-            int width,
-            boolean manual,
-            boolean worldExit,
-            boolean scheduled,
-            Consumer<Boolean> manualResponder,
-            Consumer<Boolean> worldExitResponder,
-            Consumer<Boolean> scheduledResponder) {
+    /** Manual, World exit and Scheduled for one destination, then the minutes between scheduled backups. */
+    private void addTriggerRow(int x, int y, int width, DestinationType destination) {
         boolean stacked = width < 300;
         int itemWidth = width / (stacked ? 2 : 4);
         int secondRowY = stacked ? y + 22 : y;
-        addCheckbox(
-                "screen.worldarchive.settings.manual",
-                manual,
-                x,
-                y,
-                itemWidth,
-                manualResponder);
-        addCheckbox(
-                "screen.worldarchive.settings.world_exit",
-                worldExit,
-                x + itemWidth,
-                y,
-                stacked ? width - itemWidth : itemWidth,
-                worldExitResponder);
-        Checkbox scheduledCheckbox = addCheckbox(
-                "screen.worldarchive.settings.scheduled",
-                scheduled,
-                stacked ? x : x + itemWidth * 2,
-                secondRowY,
-                itemWidth,
-                scheduledResponder);
+        addTriggerCheckbox("screen.worldarchive.settings.manual", destination, BackupTrigger.MANUAL,
+                x, y, itemWidth);
+        addTriggerCheckbox("screen.worldarchive.settings.world_exit", destination, BackupTrigger.WORLD_EXIT,
+                x + itemWidth, y, stacked ? width - itemWidth : itemWidth);
+        Checkbox scheduledCheckbox = addTriggerCheckbox(
+                "screen.worldarchive.settings.scheduled", destination, BackupTrigger.SCHEDULED,
+                stacked ? x : x + itemWidth * 2, secondRowY, itemWidth);
         scheduledCheckbox.setTooltip(Tooltip.create(Component.translatable(
                 "screen.worldarchive.settings.schedule_interval_tooltip")));
         Component intervalLabel = Component.translatable("screen.worldarchive.settings.schedule_interval");
@@ -585,8 +604,6 @@ private void addTriggerRow(
         interval.setMaxLength(5);
         interval.setValue(draft.scheduleInterval());
         interval.setHint(Component.translatable("screen.worldarchive.settings.minutes_hint"));
-        interval.setTooltip(Tooltip.create(Component.translatable(
-                "screen.worldarchive.settings.schedule_interval_tooltip")));
         interval.setResponder(updated -> {
             draft.setScheduleInterval(updated);
             refreshValidation();
@@ -596,6 +613,17 @@ private void addTriggerRow(
         addRenderableWidget(interval);
     }
 
+    private Checkbox addTriggerCheckbox(
+            String translationKey,
+            DestinationType destination,
+            BackupTrigger trigger,
+            int x,
+            int y,
+            int width) {
+        return addCheckbox(translationKey, draft.trigger(destination, trigger), x, y, width,
+                enabled -> draft.setTrigger(destination, trigger, enabled));
+    }
+
     EditBox addTextRow(
             String labelKey,
             String value,
@@ -627,60 +655,56 @@ EditBox addTextRow(
         return editBox;
     }
 
-    private void chooseGitFolder() {
-        chooseFolder(gitFolderPicker, draft::gitRepository, draft::setGitRepository);
-    }
-
-    private void chooseZipFolder() {
-        chooseFolder(zipFolderPicker, draft::zipDestination, draft::setZipDestination);
-    }
-
-    void chooseWorldZipFolder(dev.ishaanko.worldarchive.model.WorldId worldId) {
+    void chooseWorldZipFolder(WorldId worldId) {
         chooseFolder(
-                zipFolderPicker,
+                "screen.worldarchive.settings.zip_folder_title",
                 () -> draft.worldZipDestination(worldId),
                 value -> draft.setWorldZipDestination(worldId, value));
     }
 
-    private void chooseFolder(
-            SettingsFolderPicker picker,
-            Supplier<String> currentValue,
-            Consumer<String> setter) {
+    /**
+     * Opens the platform folder picker. The fields are locked while it is open, so a typed
+     * change cannot race the choice; the setter reads the draft when the choice arrives.
+     */
+    private void chooseFolder(String titleKey, Supplier<String> currentValue, Consumer<String> setter) {
         if (controlsLocked()) {
             return;
         }
-        cancelFolderRequests();
+        CompletableFuture<FolderSelectionResult> request = ClientSettingsAccess.pickFolder(
+                Component.translatable(titleKey).getString(),
+                SettingsPaths.parseAbsolute(currentValue.get()));
+        pendingFolder = request;
         transientStatus = Component.translatable("screen.worldarchive.settings.folder_picker_opening");
-        picker.choose(
-                screenState,
-                minecraft,
-                currentValue,
-                application -> applyFolderSelection(
-                        application,
-                        currentValue.get(),
-                        setter));
+        request.whenComplete((result, failure) -> minecraft.execute(() -> {
+            if (pendingFolder != request) {
+                return;
+            }
+            pendingFolder = null;
+            FolderSelectionResult outcome = failure == null && result != null
+                    ? result
+                    : new FolderSelectionResult.Failed(Component.translatable(
+                            "screen.worldarchive.settings.folder_picker_failed").getString());
+            applyFolderSelection(outcome, setter);
+        }));
         rebuildWidgets();
     }
 
-    private void applyFolderSelection(
-            FolderSelectionController.Application application,
-            String currentValue,
-            Consumer<String> setter) {
-        if (application.applied()) {
-            transientStatus = application.message()
-                    .<Component>map(Component::literal)
-                    .orElse(Component.empty());
-            if (!application.value().equals(currentValue)) {
-                setter.accept(application.value());
+    private void applyFolderSelection(FolderSelectionResult result, Consumer<String> setter) {
+        transientStatus = switch (result) {
+            case FolderSelectionResult.Selected selected -> {
+                setter.accept(selected.path().toString());
                 requestHealthProbe();
+                yield Component.empty();
             }
-        }
+            case FolderSelectionResult.Cancelled ignored -> Component.empty();
+            case FolderSelectionResult.Failed failed -> Component.literal(failed.message());
+        };
         refreshValidation();
-        rebuildIfInitialized();
+        rebuildIfShown();
     }
 
     private void restoreDefaults() {
-        draft = ClientSettingsAccess.defaultsKeepingWorlds(draft.base());
+        draft = draft.withDefaults();
         healthSnapshot = SettingsHealthSnapshot.unchecked(draft.probeRequest());
         transientStatus = Component.translatable(
                 "screen.worldarchive.settings.defaults_restored");
@@ -693,102 +717,96 @@ private void save() {
         if (!canSave()) {
             return;
         }
-        Optional<SettingsScreenState.LifecycleToken> saveToken = screenState.beginSave();
-        if (saveToken.isEmpty()) {
-            return;
-        }
-        WorldArchiveConfig config = validation.config().orElseThrow();
+        WorldArchiveConfig edited = validation.config().orElseThrow();
+        CompletionStage<WorldArchiveConfig> request = settings.saveSettings(draft.changes(edited));
+        pendingWrite = request;
         transientStatus = Component.translatable("screen.worldarchive.settings.saving");
         rebuildWidgets();
-        ClientSettingsAccess.save(config).whenComplete((saved, throwable) -> minecraft.execute(() -> {
-            SettingsScreenState.LifecycleToken token = saveToken.orElseThrow();
-            if (!screenState.acceptsActive(token)) {
+        request.whenComplete((saved, failure) -> minecraft.execute(() -> {
+            if (pendingWrite != request || closing) {
                 return;
             }
-            screenState.finishSave(token);
-            if (throwable == null) {
+            pendingWrite = null;
+            if (failure == null) {
                 closeToParent();
                 return;
             }
-            transientStatus = Component.literal(ClientSettingsAccess.status());
-            rebuildIfInitialized();
+            unreadable = settings.unreadable().orElse(null);
+            transientStatus = Component.translatable(
+                    "screen.worldarchive.settings.save_failed",
+                    SafeText.from(failure, "the settings file could not be written", MESSAGE_LIMIT));
+            rebuildIfShown();
         }));
     }
 
     private void refreshValidation() {
-        if (loadingSettings || closing) {
+        if (loading || closing || unreadable != null) {
             return;
         }
-        validating = true;
-        SettingsScreenState.RevisionToken token = screenState.nextValidation();
-        SettingsDraft candidate = draft.copy();
-        ClientSettingsAccess.validate(candidate, knownWorldPaths)
-                .whenComplete((result, throwable) -> minecraft.execute(() -> {
-                    if (!screenState.acceptsValidation(token)) {
-                        return;
-                    }
-                    validating = false;
-                    validation = throwable == null && result != null
-                            ? result
-                            : new SettingsValidation(
-                                    Optional.empty(),
-                                    Map.of(
-                                            SettingsField.DESTINATIONS,
-                                            Component.translatable(
-                                                    "screen.worldarchive.settings.validation_failed")
-                                                    .getString()));
-                    applyValidationState();
-                }));
+        CompletableFuture<SettingsValidation> request = settings.validate(draft.copy());
+        pendingValidation = request;
+        request.whenComplete((result, failure) -> minecraft.execute(() -> {
+            if (pendingValidation != request) {
+                return;
+            }
+            pendingValidation = null;
+            validation = failure == null && result != null
+                    ? result
+                    : SettingsValidation.invalid(
+                            Map.of(SettingsField.DESTINATIONS, Component.translatable(
+                                    "screen.worldarchive.settings.validation_failed").getString()),
+                            Map.of());
+            applyValidationState();
+        }));
         refreshControls();
     }
 
+    /** Shows the unchecked footer at once and probes after a short pause; a newer probe replaces an older one. */
     void requestHealthProbe() {
-        if (loadingSettings || closing) {
+        if (loading || closing || unreadable != null) {
             return;
         }
-        if (healthRequest != null) {
-            CancellableRequest<SettingsHealthSnapshot> previous = healthRequest;
-            healthRequest = null;
-            previous.cancel();
-        }
+        CompletableFuture<SettingsHealthSnapshot> previous = pendingHealth;
+        pendingHealth = null;
+        cancel(previous);
         SettingsProbeRequest request = draft.probeRequest();
         healthSnapshot = SettingsHealthSnapshot.unchecked(request);
-        healthChecking = true;
-        SettingsScreenState.RevisionToken token = screenState.nextHealthProbe();
-        CancellableRequest<SettingsHealthSnapshot> pending =
-                ClientSettingsAccess.probeHealth(request);
-        healthRequest = pending;
-        pending.completion().whenComplete((result, throwable) -> minecraft.execute(() -> {
-            if (!screenState.acceptsHealthProbe(token) || healthRequest != pending) {
+        CompletableFuture<SettingsHealthSnapshot> probe = ClientSettingsAccess.probeHealth(healthProbe, request);
+        pendingHealth = probe;
+        probe.whenComplete((result, failure) -> minecraft.execute(() -> {
+            if (pendingHealth != probe) {
                 return;
             }
-            healthRequest = null;
-            healthChecking = false;
-            healthSnapshot = throwable == null && result != null
+            pendingHealth = null;
+            healthSnapshot = failure == null && result != null
                     ? result
                     : SettingsHealthSnapshot.unavailable(
                             request,
-                            Component.translatable(
-                                    "screen.worldarchive.settings.health_failed").getString());
-            draft.applyHealth(healthSnapshot, Instant.now());
-            refreshValidation();
+                            Component.translatable("screen.worldarchive.settings.health_failed").getString());
             refreshControls();
         }));
         refreshControls();
     }
 
     private void applyValidationState() {
+        WorldId selectedWorld = worldsPage.selectedWorld();
         for (Map.Entry<SettingsField, EditBox> entry : validatedFields.entrySet()) {
-            boolean invalid = validation.issue(entry.getKey()).isPresent();
-            entry.getValue().setTextColor(invalid ? ERROR_TEXT_COLOR : FIELD_TEXT_COLOR);
-            validation.issue(entry.getKey()).ifPresentOrElse(
-                    issue -> entry.getValue().setTooltip(Tooltip.create(Component.literal(issue))),
-                    () -> entry.getValue().setTooltip(
-                            SettingsStatusPresenter.defaultTooltip(entry.getKey())));
+            Optional<String> issue = isWorldField(entry.getKey())
+                    ? Optional.ofNullable(selectedWorld).flatMap(world -> validation.issue(world, entry.getKey()))
+                    : validation.issue(entry.getKey());
+            entry.getValue().setTextColor(issue.isPresent() ? ERROR_TEXT_COLOR : FIELD_TEXT_COLOR);
+            entry.getValue().setTooltip(issue
+                    .map(message -> Tooltip.create(Component.literal(message)))
+                    .orElseGet(() -> SettingsStatusPresenter.defaultTooltip(entry.getKey())));
         }
+        worldsPage.refreshWorldMarks();
         refreshControls();
     }
 
+    private static boolean isWorldField(SettingsField field) {
+        return field == SettingsField.WORLD_REMOTE_URL || field == SettingsField.WORLD_ZIP_DESTINATION;
+    }
+
     private void refreshControls() {
         if (saveButton != null) {
             saveButton.active = canSave();
@@ -797,67 +815,68 @@ private void refreshControls() {
             gitBrowseButton.active = !controlsLocked();
         }
         if (zipBrowseButton != null) {
-            zipBrowseButton.active = zipBrowseEnabled && !controlsLocked();
+            zipBrowseButton.active = !controlsLocked();
+        }
+        if (worldZipBrowseButton != null) {
+            worldZipBrowseButton.active = worldZipBrowseEnabled && !controlsLocked();
         }
-        if (statusWidget != null) {
+        if (statusWidget != null && unreadable == null) {
             updateStatusWidget();
         }
     }
 
     private void updateStatusWidget() {
-        SettingsStatusPresenter.State state = statusState();
-        Component visible = SettingsStatusPresenter.visible(state);
-        statusWidget.setMessage(visible);
-        Component detail = SettingsStatusPresenter.detail(state, visible);
-        statusWidget.setTooltip(detail.getString().equals(visible.getString())
+        SettingsStatusPresenter.Status status = SettingsStatusPresenter.status(statusState());
+        statusWidget.setMessage(status.visible());
+        statusWidget.setTooltip(status.detail().getString().equals(status.visible().getString())
                 ? null
-                : Tooltip.create(detail));
+                : Tooltip.create(status.detail()));
     }
 
     boolean controlsLocked() {
-        return loadingSettings
-                || screenState.saving()
-                || gitFolderPicker.choosing()
-                || zipFolderPicker.choosing();
+        return loading || pendingWrite != null || pendingFolder != null || unreadable != null;
     }
 
+    /** Health is only a warning: an offline or unwritable folder does not stop a save. */
     private boolean canSave() {
-        return validation.isValid()
-                && !controlsLocked()
-                && !validating
-                && !healthChecking;
+        return validation.isValid() && !controlsLocked() && pendingValidation == null;
     }
 
     private SettingsStatusPresenter.State statusState() {
         return new SettingsStatusPresenter.State(
                 page,
-                loadingSettings,
-                screenState.saving(),
-                validating,
-                healthChecking,
+                loading,
+                pendingWrite != null,
+                pendingValidation != null,
+                pendingHealth != null,
                 transientStatus,
                 validation,
                 healthSnapshot,
-                draft.base().worlds().size());
+                draft.base().worlds().size(),
+                settings.notices());
     }
 
+    /** Each field is cleared before its request is cancelled, so the request's callback sees itself as stale. */
     private void cancelAsyncRequests() {
-        if (healthRequest != null) {
-            CancellableRequest<SettingsHealthSnapshot> pending = healthRequest;
-            healthRequest = null;
-            pending.cancel();
+        CompletableFuture<?> health = pendingHealth;
+        CompletableFuture<?> validationRequest = pendingValidation;
+        CompletableFuture<?> folder = pendingFolder;
+        pendingHealth = null;
+        pendingValidation = null;
+        pendingFolder = null;
+        cancel(health);
+        cancel(validationRequest);
+        cancel(folder);
+    }
+
+    private static void cancel(CompletableFuture<?> request) {
+        if (request != null) {
+            request.cancel(true);
         }
-        healthChecking = false;
-        cancelFolderRequests();
     }
 
-    private void cancelFolderRequests() {
-        gitFolderPicker.cancel();
-        zipFolderPicker.cancel();
-    }
-
-    private void rebuildIfInitialized() {
-        if (width > 0 && height > 0) {
+    private void rebuildIfShown() {
+        if (minecraft.gui.screen() == this) {
             rebuildWidgets();
         }
     }
@@ -867,23 +886,22 @@ private void closeToParent() {
             return;
         }
         closing = true;
-        screenState.close();
         cancelAsyncRequests();
         minecraft.setScreenAndShow(parent);
     }
 
     @Override
     public void onClose() {
-        if (!screenState.saving()) {
+        if (pendingWrite == null) {
             closeToParent();
         }
     }
 
     @Override
     public Component getNarrationMessage() {
-        return title.copy()
-                .append(". ")
-                .append(SettingsStatusPresenter.visible(statusState()));
+        Component status = unreadable != null
+                ? SettingsStatusPresenter.unreadable(unreadable)
+                : SettingsStatusPresenter.status(statusState()).visible();
+        return title.copy().append(". ").append(status);
     }
-
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/settings/WorldSettingsPage.java b/src/client/java/dev/ishaanko/worldarchive/settings/WorldSettingsPage.java
index 022cc92..d2868e8 100644
--- a/src/client/java/dev/ishaanko/worldarchive/settings/WorldSettingsPage.java
+++ b/src/client/java/dev/ishaanko/worldarchive/settings/WorldSettingsPage.java
@@ -4,11 +4,9 @@
 import dev.ishaanko.worldarchive.model.WorldId;
 import dev.ishaanko.worldarchive.ui.Widgets;
 import java.util.HashMap;
-import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
-import java.util.Set;
 import net.minecraft.ChatFormatting;
 import net.minecraft.client.gui.components.Button;
 import net.minecraft.client.gui.components.Checkbox;
@@ -16,38 +14,38 @@
 import net.minecraft.client.gui.components.StringWidget;
 import net.minecraft.client.gui.components.Tooltip;
 import net.minecraft.network.chat.Component;
+import net.minecraft.network.chat.MutableComponent;
 
-/** Multi-world selector and selected-world destination editor for the settings screen. */
+/**
+ * The Worlds tab: a paged list of worlds, and the selected world's own settings. Worlds with a
+ * problem are shown in red.
+ */
 final class WorldSettingsPage {
     private static final int ROW_HEIGHT = 22;
 
     private final WorldArchiveSettingsScreen screen;
 
+    /** The list buttons of the page shown last, so their marks can change without a rebuild. */
+    private final Map<WorldId, Button> listButtons = new HashMap<>();
+
     private int page;
 
     private WorldId selectedWorldId;
 
-    /** Worlds whose override box is ticked while the folder field is still empty. */
-    private final Set<WorldId> overrideEnabled = new HashSet<>();
-
-    /** The last override typed for a world, restored when its box is ticked again. */
-    private final Map<WorldId, String> rememberedOverrides = new HashMap<>();
-
-    /** The draft the transient state above belongs to; a new draft (reload, reset) drops it. */
-    private SettingsDraft observedDraft;
-
     WorldSettingsPage(WorldArchiveSettingsScreen screen) {
         this.screen = Objects.requireNonNull(screen, "screen");
     }
 
+    /** The world whose settings the page shows; null before the page was shown or when there are no worlds. */
+    WorldId selectedWorld() {
+        return selectedWorldId;
+    }
+
     void add(int x, int contentWidth, int pageSize) {
-        if (screen.draft() != observedDraft) {
-            observedDraft = screen.draft();
-            overrideEnabled.clear();
-            rememberedOverrides.clear();
-        }
+        listButtons.clear();
         List<WorldConfig> worlds = screen.draft().base().worlds();
         if (worlds.isEmpty()) {
+            selectedWorldId = null;
             screen.addSettingsText(SettingsWidgets.wrappedText(
                     screen.settingsFont(),
                     x,
@@ -81,12 +79,11 @@ private void addWorldList(
         for (int index = start; index < end; index++) {
             WorldConfig world = worlds.get(index);
             boolean selected = world.worldId().equals(selectedWorldId);
-            Component label = Component.literal((selected ? "> " : "")
-                    + folderName(world) + " [" + world.worldId().displayCode() + "]");
-            Button button = Button.builder(label, ignored -> select(world.worldId()))
+            Button button = Button.builder(listLabel(world), ignored -> select(world.worldId()))
                     .bounds(x, 53 + (index - start) * ROW_HEIGHT, width, 20)
                     .build();
             button.setOverrideRenderHighlightedSprite(() -> selected);
+            listButtons.put(world.worldId(), button);
             button.active = !screen.controlsLocked();
             button.setTooltip(Tooltip.create(Component.literal(world.path().toString())));
             screen.addSettingsButton(button);
@@ -96,6 +93,25 @@ private void addWorldList(
         }
     }
 
+    /** Shows the listed worlds that have a problem in red; called when a validation finishes. */
+    void refreshWorldMarks() {
+        for (WorldConfig world : screen.draft().base().worlds()) {
+            Button button = listButtons.get(world.worldId());
+            if (button != null) {
+                button.setMessage(listLabel(world));
+            }
+        }
+    }
+
+    private Component listLabel(WorldConfig world) {
+        String marker = world.worldId().equals(selectedWorldId) ? "> " : "";
+        MutableComponent label = Component.literal(
+                marker + folderName(world) + " [" + world.worldId().displayCode() + "]");
+        return screen.validation().invalidWorlds().contains(world.worldId())
+                ? label.withStyle(ChatFormatting.RED)
+                : label;
+    }
+
     private void addPageNavigation(
             List<WorldConfig> worlds,
             int x,
@@ -167,19 +183,13 @@ private void addRemoteField(WorldConfig world, int x, int y, int width) {
                 y,
                 width,
                 2048,
-                value -> {
-                    screen.draft().setWorldRemoteUrl(world.worldId(), value);
-                    screen.requestHealthProbe();
-                });
+                value -> screen.draft().setWorldRemoteUrl(world.worldId(), value));
         remoteUrl.setHint(Component.translatable("screen.worldarchive.settings.world_remote_hint"));
-        remoteUrl.setTooltip(Tooltip.create(Component.translatable(
-                "screen.worldarchive.settings.world_remote_steps")));
     }
 
     private void addZipFields(WorldConfig world, int x, int y, int width) {
         WorldId worldId = world.worldId();
-        boolean usesOverride = overrideEnabled.contains(worldId)
-                || !screen.draft().worldZipDestination(worldId).isBlank();
+        boolean usesOverride = screen.draft().worldZipOverride(worldId);
         screen.addCheckbox(
                 "screen.worldarchive.settings.world_zip_default",
                 usesOverride,
@@ -187,33 +197,25 @@ private void addZipFields(WorldConfig world, int x, int y, int width) {
                 y,
                 width,
                 useOverride -> {
-                    if (useOverride) {
-                        overrideEnabled.add(worldId);
-                        screen.draft().setWorldZipDestination(worldId, rememberedOverrides
-                                .getOrDefault(worldId, screen.draft().zipDestination()));
-                    } else {
-                        overrideEnabled.remove(worldId);
-                        rememberedOverrides.put(worldId, screen.draft().worldZipDestination(worldId));
-                        screen.draft().setWorldZipDestination(worldId, "");
-                    }
+                    screen.draft().setWorldZipOverride(worldId, useOverride);
                     screen.rebuildWorldWidgets();
                 });
         int fieldY = y + ROW_HEIGHT;
         int browseWidth = Math.min(64, Math.max(32, width / 4));
         EditBox destination = screen.addTextRow(
                 "screen.worldarchive.settings.world_zip_destination",
-                screen.draft().worldZipDestination(world.worldId()),
+                screen.draft().worldZipDestination(worldId),
                 SettingsField.WORLD_ZIP_DESTINATION,
                 x,
                 fieldY,
                 width - browseWidth - 4,
                 1024,
-                value -> screen.draft().setWorldZipDestination(world.worldId(), value));
+                value -> screen.draft().setWorldZipDestination(worldId, value));
         destination.active = usesOverride && !screen.controlsLocked();
         destination.setHint(Component.translatable("screen.worldarchive.settings.world_zip_hint"));
         Button browse = Button.builder(
                         Component.translatable("screen.worldarchive.settings.browse"),
-                        ignored -> screen.chooseWorldZipFolder(world.worldId()))
+                        ignored -> screen.chooseWorldZipFolder(worldId))
                 .bounds(x + width - browseWidth, fieldY, browseWidth, 20)
                 .build();
         screen.setWorldZipBrowseButton(browse, usesOverride);
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/BackupBrowserScreen.java b/src/client/java/dev/ishaanko/worldarchive/ui/BackupBrowserScreen.java
index 6c8ebef..cdafe16 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/BackupBrowserScreen.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/BackupBrowserScreen.java
@@ -1,33 +1,30 @@
 package dev.ishaanko.worldarchive.ui;
 
-import dev.ishaanko.worldarchive.core.BackupOperation;
 import dev.ishaanko.worldarchive.core.BackupService;
 import dev.ishaanko.worldarchive.core.DeleteBackupRequest;
-import dev.ishaanko.worldarchive.core.DeletePreparation;
 import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupRecord;
+import dev.ishaanko.worldarchive.model.BackupOperation;
 import dev.ishaanko.worldarchive.model.BackupResult;
 import dev.ishaanko.worldarchive.ui.model.ActionDisabledReason;
 import dev.ishaanko.worldarchive.ui.model.BackupAction;
-import dev.ishaanko.worldarchive.ui.model.BackupActionAvailability;
 import dev.ishaanko.worldarchive.ui.model.BackupActionPolicy;
 import dev.ishaanko.worldarchive.ui.model.BackupBrowserCapabilities;
-import dev.ishaanko.worldarchive.ui.model.BackupBrowserPage;
-import dev.ishaanko.worldarchive.ui.model.BackupBrowserQuery;
+import dev.ishaanko.worldarchive.ui.model.BackupFilter;
 import dev.ishaanko.worldarchive.ui.model.BackupRow;
+import dev.ishaanko.worldarchive.ui.model.BackupSelection;
 import dev.ishaanko.worldarchive.ui.model.BackupSort;
-import dev.ishaanko.worldarchive.ui.model.ConfirmationKind;
-import dev.ishaanko.worldarchive.ui.model.ConfirmationState;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
+import dev.ishaanko.worldarchive.ui.model.DeletePrompt;
+import dev.ishaanko.worldarchive.ui.model.Paging;
 import dev.ishaanko.worldarchive.ui.model.ScreenGeometry;
 import java.util.ArrayList;
-import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
-import java.util.Set;
-import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CompletionStage;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
 import net.minecraft.ChatFormatting;
 import net.minecraft.client.gui.components.Button;
 import net.minecraft.client.gui.components.EditBox;
@@ -35,22 +32,29 @@
 import net.minecraft.client.gui.components.Tooltip;
 import net.minecraft.client.gui.screens.Screen;
 import net.minecraft.client.input.InputWithModifiers;
+import net.minecraft.network.chat.CommonComponents;
 import net.minecraft.network.chat.Component;
 
 /**
- * Native backup browser scoped to one persistent world identity.
+ * The backups of one world, with a filter, a sort order and pages, and the actions that act on
+ * the selected backups.
  *
- * <p>Rows support multi-selection: a plain click selects one row, Ctrl or Cmd click toggles a
- * row, Shift click extends from the last clicked row, and "Select all" covers every row that
- * matches the filter. The selection survives paging and filtering so a large cleanup can be
- * assembled across pages; only Delete accepts more than one row.</p>
+ * <p>A plain click selects one row, Ctrl or Cmd click toggles a row, and Shift click extends the
+ * selection from the last clicked row on the page. The selection survives paging and filtering,
+ * so a delete of many backups can be put together across pages. Select all replaces the selection
+ * with every backup that matches the filter, and Clear empties it. Only Delete accepts more than
+ * one backup.</p>
  */
 public final class BackupBrowserScreen extends Screen {
     private static final int ROW_HEIGHT = 38;
 
     private static final int ROW_GAP = 2;
 
-    private static final int ACTION_GAP = 3;
+    private static final int FILTER_Y = 41;
+
+    private static final int ROWS_TOP = 64;
+
+    private static final int MAXIMUM_PAGE_SIZE = 100;
 
     private static final int CONTENT_MIN = 180;
 
@@ -60,11 +64,6 @@ public final class BackupBrowserScreen extends Screen {
 
     private static final int CAPABILITY_POLL_INTERVAL_TICKS = 20;
 
-    /** Covers both sequential five-minute Git tool probes plus scheduling headroom. */
-    private static final int MAXIMUM_CAPABILITY_POLLS = 660;
-
-    private static final int CONFIRMATION_PREVIEW_ROWS = 5;
-
     private final Screen parent;
 
     private final BackupWorldContext world;
@@ -73,694 +72,411 @@ public final class BackupBrowserScreen extends Screen {
 
     private final BackupService service;
 
-    private List<BackupRecord> records = List.of();
-
-    private BackupBrowserCapabilities capabilities = new BackupBrowserCapabilities(
-            false, true, false, false, false, Optional.empty());
-
-    private BackupSort sort = BackupSort.NEWEST;
+    /** Loads of the backup list; a newer one drops the answer of an older one. */
+    private final ScreenCalls calls = new ScreenCalls(this);
 
-    private String filter = "";
+    private final ScreenCalls folders = new ScreenCalls(this);
 
-    private int pageIndex;
+    private final ScreenCalls polls = new ScreenCalls(this);
 
-    private final Set<BackupId> selectedBackupIds = new LinkedHashSet<>();
+    private final BackupSelection selection = new BackupSelection();
 
-    /** Last row clicked without Shift; Shift click selects from here to the clicked row. */
-    private BackupId selectionAnchor;
+    /** Every backup of the world, from the newest catalog load. */
+    private List<BackupRow> rows = List.of();
 
-    private List<BackupRow> visibleRows = List.of();
+    /** The rows that match the filter, in sort order; rebuilt only when rows, filter or sort change. */
+    private List<BackupRow> matching = List.of();
 
-    private Component status = Component.literal("Loading backups…").withStyle(ChatFormatting.GRAY);
+    /** The backups on the current page, in page order, for Shift click ranges. */
+    private List<BackupId> page = List.of();
 
-    private boolean loading = true;
+    private BackupBrowserCapabilities capabilities = new BackupBrowserCapabilities(
+            false, true, Optional.empty(), false, false, Optional.empty());
 
-    private boolean busy;
+    private BackupSort sort = BackupSort.NEWEST;
 
-    private boolean active;
+    private String filter = "";
 
-    private long lifecycle;
+    private int pageIndex;
 
-    private long requestRevision;
+    private Component status = Component.literal("Loading backups…").withStyle(ChatFormatting.GRAY);
 
-    private int capabilityPollTicks;
+    private boolean loading = true;
 
-    private int capabilityPollsRemaining;
+    private int pollTicks;
 
-    private boolean capabilityRefreshPending;
+    private boolean pollPending;
 
-    private EditBox filterWidget;
+    private EditBox filterBox;
 
     public BackupBrowserScreen(Screen parent, BackupWorldContext world, BackupClientFacade facade) {
         super(Component.literal("Backups"));
         this.parent = Objects.requireNonNull(parent, "parent");
         this.world = Objects.requireNonNull(world, "world");
         this.facade = Objects.requireNonNull(facade, "facade");
-        service = Objects.requireNonNull(facade.backupService(), "backupService");
+        service = facade.backupService();
     }
 
     @Override
     public void added() {
         super.added();
-        active = true;
-        lifecycle++;
-        capabilityPollTicks = CAPABILITY_POLL_INTERVAL_TICKS;
-        capabilityPollsRemaining = MAXIMUM_CAPABILITY_POLLS;
-        capabilityRefreshPending = false;
-        reloadData();
-    }
-
-    @Override
-    public void removed() {
-        active = false;
-        lifecycle++;
-        requestRevision++;
-        super.removed();
+        pollTicks = CAPABILITY_POLL_INTERVAL_TICKS;
+        pollPending = false;
+        reload();
     }
 
+    /**
+     * Asks the runtime every second whether an operation runs or a warning applies. When a backup
+     * of this world finishes meanwhile, for example at world exit, the list loads again.
+     */
     @Override
     public void tick() {
         super.tick();
-        if (!active
-                || capabilityRefreshPending
-                || capabilityPollsRemaining <= 0
-                || --capabilityPollTicks > 0) {
+        if (pollPending || --pollTicks > 0) {
             return;
         }
-        capabilityPollTicks = CAPABILITY_POLL_INTERVAL_TICKS;
-        capabilityPollsRemaining--;
-        refreshCapabilities();
+        pollTicks = CAPABILITY_POLL_INTERVAL_TICKS;
+        pollPending = true;
+        polls.start(
+                () -> facade.browserCapabilities(world),
+                this::capabilitiesPolled,
+                ignored -> pollPending = false);
     }
 
-    private void refreshCapabilities() {
-        long token = lifecycle;
-        capabilityRefreshPending = true;
-        CompletionStage<BackupBrowserCapabilities> refresh;
-        try {
-            refresh = Objects.requireNonNull(
-                    facade.browserCapabilities(world),
-                    "browserCapabilities result");
-        } catch (RuntimeException exception) {
-            capabilityRefreshPending = false;
+    private void capabilitiesPolled(BackupBrowserCapabilities updated) {
+        pollPending = false;
+        if (updated.equals(capabilities)) {
             return;
         }
-        refresh.whenComplete((updated, throwable) -> minecraft.execute(() -> {
-            if (!active || lifecycle != token) {
-                return;
-            }
-            capabilityRefreshPending = false;
-            if (throwable == null && updated != null && !updated.equals(capabilities)) {
-                capabilities = updated;
-                rebuildIfInitialized();
-            }
-        }));
+        boolean backupFinished = capabilities.operationInProgress() && !updated.operationInProgress();
+        capabilities = updated;
+        if (backupFinished) {
+            reload();
+        } else {
+            refresh();
+        }
     }
 
     @Override
     protected void init() {
-        filterWidget = null;
         int contentWidth = ScreenGeometry.contentWidth(width, CONTENT_MIN, CONTENT_MAX, CONTENT_MARGIN);
-        int contentX = ScreenGeometry.centerX(width, contentWidth);
-        addRenderableOnly(Widgets.title(font, contentX, 5, contentWidth, 18, title));
-        addRenderableOnly(Widgets.muted(font, contentX, 22, contentWidth, 16, world.displayName()));
-
-        int paginationY = Math.max(
-                88,
-                height - (capabilities.warning().isPresent() ? 100 : 84));
-        int rowTop = 64;
-        int rowCapacity = Math.clamp(
-                (paginationY - rowTop) / (ROW_HEIGHT + ROW_GAP), 1, BackupBrowserQuery.MAXIMUM_PAGE_SIZE);
-        BackupBrowserPage page = page(rowCapacity);
-        pageIndex = page.pageIndex();
-        visibleRows = page.rows();
-        addFilterAndSort(page, contentX, contentWidth);
-        addRows(page, contentX, contentWidth, rowTop);
-        addPagination(page, contentX, contentWidth, paginationY);
-        addWarning(contentX, contentWidth);
-        addStatus(contentX, contentWidth);
-        addActions(contentX, contentWidth);
-    }
-
-    private void addFilterAndSort(BackupBrowserPage page, int x, int contentWidth) {
+        int x = ScreenGeometry.centerX(width, contentWidth);
+        addRenderableOnly(Widgets.title(font, x, 5, contentWidth, 18, title));
+        addRenderableOnly(Widgets.muted(font, x, 22, contentWidth, 16, world.displayName()));
+        Layout layout = Layout.of(height, capabilities.warning().isPresent());
+        int pageSize = Math.clamp((layout.paginationY() - ROWS_TOP) / (ROW_HEIGHT + ROW_GAP), 1, MAXIMUM_PAGE_SIZE);
+        Paging paging = Paging.of(matching.size(), pageSize, pageIndex);
+        pageIndex = paging.pageIndex();
+        List<BackupRow> pageRows = paging.slice(matching);
+        page = ids(pageRows);
+        addFilterBar(x, contentWidth);
+        addRows(pageRows, x, contentWidth);
+        addPagination(paging, x, contentWidth, layout.paginationY());
+        capabilities.warning().ifPresent(warning -> addLine(
+                Component.literal(warning).withStyle(ChatFormatting.YELLOW), x, contentWidth, layout.warningY()));
+        addLine(status, x, contentWidth, layout.statusY());
+        addActions(x, contentWidth, layout);
+    }
+
+    private void addFilterBar(int x, int contentWidth) {
         int sortWidth = Math.min(120, Math.max(72, contentWidth / 4));
         int selectWidth = Math.min(90, Math.max(60, contentWidth / 5));
         int filterWidth = contentWidth - sortWidth - selectWidth - 8;
-        EditBox filterBox = new EditBox(
-                font,
-                x,
-                41,
-                filterWidth,
-                20,
-                Component.literal("Filter backups"));
+        filterBox = new EditBox(font, x, FILTER_Y, filterWidth, 20, Component.literal("Filter backups"));
         filterBox.setMaxLength(128);
         filterBox.setValue(filter);
         filterBox.setHint(Component.literal("Filter backups"));
-        filterBox.setResponder(value -> {
-            if (value.equals(filter)) {
-                return;
-            }
-            filter = value;
-            pageIndex = 0;
-            rebuildWidgets();
-            if (filterWidget != null) {
-                setInitialFocus(filterWidget);
-                filterWidget.moveCursorToEnd(false);
-            }
-        });
-        filterBox.active = !busy;
-        filterWidget = filterBox;
+        filterBox.setResponder(this::filterChanged);
         addRenderableWidget(filterBox);
 
-        Button sortButton = Button.builder(
-                        Component.literal("Sort: " + sortLabel(sort)),
-                        ignored -> {
-                            BackupSort[] values = BackupSort.values();
-                            sort = values[(sort.ordinal() + 1) % values.length];
-                            pageIndex = 0;
-                            rebuildWidgets();
-                        })
-                .bounds(x + filterWidth + 4, 41, sortWidth, 20)
+        Button sortButton = Button.builder(Component.literal("Sort: " + sortLabel(sort)), ignored -> nextSort())
+                .bounds(x + filterWidth + 4, FILTER_Y, sortWidth, 20)
                 .build();
-        sortButton.active = !busy;
         addRenderableWidget(sortButton);
 
-        boolean allMatchingSelected = !page.matchingBackupIds().isEmpty()
-                && selectedBackupIds.containsAll(page.matchingBackupIds());
+        List<BackupId> matchingIds = ids(matching);
         Button selectButton = Button.builder(
-                        Component.literal(allMatchingSelected ? "Clear" : "Select all"),
+                        Component.literal(selection.coversAll(matchingIds) ? "Clear" : "Select all"),
                         ignored -> {
-                            selectedBackupIds.clear();
-                            if (!allMatchingSelected) {
-                                selectedBackupIds.addAll(page.matchingBackupIds());
-                            }
-                            rebuildWidgets();
+                            selection.selectAllOrClear(matchingIds);
+                            refresh();
                         })
-                .bounds(x + filterWidth + sortWidth + 8, 41, selectWidth, 20)
+                .bounds(x + filterWidth + sortWidth + 8, FILTER_Y, selectWidth, 20)
                 .build();
-        selectButton.active = !busy && !page.matchingBackupIds().isEmpty();
+        selectButton.active = !matchingIds.isEmpty();
         selectButton.setTooltip(Tooltip.create(Component.literal(
                 "Selects every backup that matches the filter, on every page")));
         addRenderableWidget(selectButton);
     }
 
-    private BackupBrowserPage page(int pageSize) {
-        BackupBrowserQuery query = new BackupBrowserQuery(filter, sort, pageIndex, pageSize);
-        return BackupBrowserPage.create(records, query, selectedBackupIds);
-    }
-
-    private void addRows(
-            BackupBrowserPage page,
-            int x,
-            int contentWidth,
-            int rowTop) {
-        int y = rowTop;
-        for (BackupRow row : page.rows()) {
-            BackupRowButton button = new BackupRowButton(
-                    x,
-                    y,
-                    contentWidth,
-                    ROW_HEIGHT,
-                    row,
-                    font,
-                    this::selectRow);
-            button.setSelected(selectedBackupIds.contains(row.backupId()));
-            button.active = !busy;
+    private void filterChanged(String value) {
+        if (!value.equals(filter)) {
+            filter = value;
+            pageIndex = 0;
+            rematch();
+            refresh();
+        }
+    }
+
+    private void nextSort() {
+        BackupSort[] values = BackupSort.values();
+        sort = values[(sort.ordinal() + 1) % values.length];
+        pageIndex = 0;
+        rematch();
+        refresh();
+    }
+
+    private void addRows(List<BackupRow> pageRows, int x, int contentWidth) {
+        int y = ROWS_TOP;
+        for (BackupRow row : pageRows) {
+            BackupRowButton button = new BackupRowButton(x, y, contentWidth, ROW_HEIGHT, row, font, this::rowClicked);
+            button.setSelected(selection.contains(row.backupId()));
             addRenderableWidget(button);
             y += ROW_HEIGHT + ROW_GAP;
         }
-        if (!loading && page.rows().isEmpty()) {
-            addRenderableOnly(new StringWidget(
-                    x,
-                    rowTop + 10,
-                    contentWidth,
-                    20,
-                    Component.literal(filter.isBlank()
-                            ? "No backups yet"
-                            : "No backups match the filter").withStyle(ChatFormatting.GRAY),
-                    font));
+        if (!loading && pageRows.isEmpty()) {
+            Component empty = Component.literal(filter.isBlank() ? "No backups yet" : "No backups match the filter")
+                    .withStyle(ChatFormatting.GRAY);
+            addRenderableOnly(new StringWidget(x, ROWS_TOP + 10, contentWidth, 20, empty, font));
         }
     }
 
-    private void selectRow(BackupRow row, InputWithModifiers input) {
-        BackupId clicked = row.backupId();
-        if (input.hasShiftDown() && selectionAnchor != null) {
-            selectedBackupIds.addAll(rangeOnPage(selectionAnchor, clicked));
+    private void rowClicked(BackupRow row, InputWithModifiers input) {
+        BackupSelection.Click click;
+        if (input.hasShiftDown()) {
+            click = BackupSelection.Click.EXTEND;
         } else if (input.hasControlDownWithQuirk()) {
-            if (!selectedBackupIds.remove(clicked)) {
-                selectedBackupIds.add(clicked);
-            }
-            selectionAnchor = clicked;
+            click = BackupSelection.Click.TOGGLE;
         } else {
-            selectedBackupIds.clear();
-            selectedBackupIds.add(clicked);
-            selectionAnchor = clicked;
+            click = BackupSelection.Click.SELECT;
         }
-        rebuildWidgets();
-    }
-
-    /** Rows between two ids in page order; just the clicked row when the anchor scrolled away. */
-    private List<BackupId> rangeOnPage(BackupId anchor, BackupId clicked) {
-        List<BackupId> order = visibleRows.stream().map(BackupRow::backupId).toList();
-        int from = order.indexOf(anchor);
-        int to = order.indexOf(clicked);
-        if (from < 0 || to < 0) {
-            return List.of(clicked);
-        }
-        return order.subList(Math.min(from, to), Math.max(from, to) + 1);
+        selection.click(row.backupId(), click, page);
+        refresh();
     }
 
-    private void addPagination(
-            BackupBrowserPage page,
-            int x,
-            int contentWidth,
-            int y) {
+    private void addPagination(Paging paging, int x, int contentWidth, int y) {
         int buttonWidth = Math.min(72, Math.max(48, contentWidth / 5));
-        Button previous = Button.builder(Component.literal("Previous"), ignored -> {
-                    pageIndex = Math.max(0, page.pageIndex() - 1);
-                    rebuildWidgets();
-                })
-                .bounds(x, y, buttonWidth, 18)
-                .build();
-        previous.active = !busy && page.pageIndex() > 0;
-        addRenderableWidget(previous);
-        Button next = Button.builder(Component.literal("Next"), ignored -> {
-                    pageIndex = Math.min(page.pageCount() - 1, page.pageIndex() + 1);
-                    rebuildWidgets();
-                })
-                .bounds(x + contentWidth - buttonWidth, y, buttonWidth, 18)
-                .build();
-        next.active = !busy && page.pageIndex() + 1 < page.pageCount();
-        addRenderableWidget(next);
-        String selection = selectedBackupIds.isEmpty()
-                ? ""
-                : " · " + selectedBackupIds.size() + " selected";
+        List<Button> pager = Widgets.pageButtons(paging, index -> {
+            pageIndex = index;
+            refresh();
+        });
+        pager.getFirst().setRectangle(buttonWidth, 18, x, y);
+        pager.getLast().setRectangle(buttonWidth, 18, x + contentWidth - buttonWidth, y);
+        pager.forEach(this::addRenderableWidget);
+        String selected = selection.size() == 0 ? "" : " · " + selection.size() + " selected";
         addRenderableOnly(new StringWidget(
                 x + buttonWidth + 4,
                 y,
                 contentWidth - buttonWidth * 2 - 8,
                 18,
-                Component.literal("Page " + (page.pageIndex() + 1)
-                        + " of " + page.pageCount()
-                        + " · " + page.totalRows() + " backups"
-                        + selection),
+                Component.literal("Page " + (paging.pageIndex() + 1)
+                        + " of " + paging.pageCount()
+                        + " · " + matching.size() + " backups"
+                        + selected),
                 font));
     }
 
-    private void addStatus(int x, int contentWidth) {
-        StringWidget widget = new StringWidget(
-                x,
-                ScreenGeometry.anchorBottom(108, height, 64),
-                contentWidth,
-                14,
-                status,
-                font);
-        widget.setTooltip(Tooltip.create(status));
-        addRenderableOnly(widget);
-    }
-
-    private void addWarning(int x, int contentWidth) {
-        capabilities.warning().ifPresent(message -> {
-            Component warning = Component.literal(message).withStyle(ChatFormatting.YELLOW);
-            StringWidget widget = new StringWidget(
-                    x,
-                    ScreenGeometry.anchorBottom(94, height, 80),
-                    contentWidth,
-                    14,
-                    warning,
-                    font);
-            widget.setTooltip(Tooltip.create(warning));
-            addRenderableOnly(widget);
-        });
+    private void addLine(Component text, int x, int contentWidth, int y) {
+        StringWidget line = new StringWidget(x, y, contentWidth, 14, text, font);
+        line.setTooltip(Tooltip.create(text));
+        addRenderableOnly(line);
     }
 
-    private void addActions(int x, int contentWidth) {
-        List<BackupRow> selection = selectedRows();
-        BackupBrowserCapabilities effectiveCapabilities = new BackupBrowserCapabilities(
-                busy || loading,
-                capabilities.sourceAvailable(),
-                capabilities.createDestinationConfigured(),
-                capabilities.gitRemoteConfigured(),
-                capabilities.managedFolderAvailable(),
-                capabilities.warning());
-        Map<BackupAction, BackupActionAvailability> availability = BackupActionPolicy.evaluate(
-                effectiveCapabilities,
-                selection);
-
-        addActionRow(
-                List.of(
+    private void addActions(int x, int contentWidth, Layout layout) {
+        List<BackupRow> selected = selection.rows(rows);
+        Map<BackupAction, ActionDisabledReason> reasons = BackupActionPolicy.evaluate(
+                loading ? capabilities.withOperationInProgress() : capabilities,
+                selected);
+        List<Button> primary = Stream.of(
                         BackupAction.CREATE,
                         BackupAction.RESTORE,
                         BackupAction.DELETE,
                         BackupAction.SYNC,
-                        BackupAction.VERIFY),
-                availability,
-                selection.size(),
-                x,
-                contentWidth,
-                ScreenGeometry.anchorBottom(128, height, 48));
-        int y = ScreenGeometry.anchorBottom(150, height, 24);
-        List<BackupAction> secondaryActions = List.of(
-                BackupAction.OPEN_FOLDER,
-                BackupAction.STORAGE,
-                BackupAction.SETTINGS);
-        int buttonWidth = actionButtonWidth(contentWidth, secondaryActions.size() + 1);
-        int currentX = x;
-        for (BackupAction action : secondaryActions) {
-            addActionButton(action, availability.get(action), 0, currentX, y, buttonWidth);
-            currentX += buttonWidth + ACTION_GAP;
-        }
-        addRenderableWidget(Button.builder(Component.literal("Done"), ignored -> onClose())
-                .bounds(currentX, y, buttonWidth, 20)
-                .build());
-    }
-
-    private void addActionRow(
-            List<BackupAction> actions,
-            Map<BackupAction, BackupActionAvailability> availability,
-            int selectionCount,
-            int x,
-            int contentWidth,
-            int y) {
-        int buttonWidth = actionButtonWidth(contentWidth, actions.size());
-        int currentX = x;
-        for (BackupAction action : actions) {
-            addActionButton(action, availability.get(action), selectionCount, currentX, y, buttonWidth);
-            currentX += buttonWidth + ACTION_GAP;
-        }
-    }
-
-    private void addActionButton(
-            BackupAction action,
-            BackupActionAvailability availability,
-            int selectionCount,
-            int x,
-            int y,
-            int width) {
-        String label = action == BackupAction.DELETE && selectionCount > 1
-                ? "Delete (" + selectionCount + ")"
+                        BackupAction.VERIFY)
+                .map(action -> actionButton(action, reasons.get(action), selected.size()))
+                .toList();
+        List<Button> secondary = new ArrayList<>(Stream.of(
+                        BackupAction.OPEN_FOLDER,
+                        BackupAction.STORAGE,
+                        BackupAction.SETTINGS)
+                .map(action -> actionButton(action, reasons.get(action), selected.size()))
+                .toList());
+        secondary.add(Button.builder(Component.literal("Done"), ignored -> onClose()).build());
+        Widgets.row(x, layout.primaryActionsY(), contentWidth, primary);
+        Widgets.row(x, layout.secondaryActionsY(), contentWidth, secondary);
+        primary.forEach(this::addRenderableWidget);
+        secondary.forEach(this::addRenderableWidget);
+    }
+
+    private Button actionButton(BackupAction action, ActionDisabledReason reason, int selectedCount) {
+        String label = action == BackupAction.DELETE && selectedCount > 1
+                ? "Delete (" + selectedCount + ")"
                 : actionLabel(action);
-        Button button = Button.builder(Component.literal(label), ignored -> runAction(action))
-                .bounds(x, y, width, 20)
-                .build();
-        button.active = availability.enabled();
-        if (!availability.enabled()) {
-            button.setTooltip(Tooltip.create(Component.literal(disabledReason(availability.reason()))));
+        Button button = Button.builder(Component.literal(label), ignored -> runAction(action)).build();
+        button.active = reason == ActionDisabledReason.NONE;
+        if (!button.active) {
+            button.setTooltip(Tooltip.create(disabledReason(reason)));
         }
-        addRenderableWidget(button);
-    }
-
-    private int actionButtonWidth(int contentWidth, int buttonCount) {
-        return Math.max(32, (contentWidth - ACTION_GAP * (buttonCount - 1)) / buttonCount);
+        return button;
     }
 
+    /**
+     * Runs a button's action; the policy has already checked the selection it needs. The selected
+     * backups keep the browser's sort order, so a delete prompt lists them as the browser does.
+     */
     private void runAction(BackupAction action) {
-        List<BackupRow> selection = selectedRows();
-        Optional<BackupRow> single = selection.size() == 1
-                ? Optional.of(selection.getFirst())
-                : Optional.empty();
-        switch (action) {
-            case CREATE -> promptManualBackup();
-            case RESTORE -> single.ifPresent(row -> minecraft.setScreenAndShow(
-                    new BackupRestoreScreen(this, parent, world, row, facade)));
-            case DELETE -> {
-                if (selection.size() > 1) {
-                    prepareDeleteMany(selection);
-                } else {
-                    single.ifPresent(this::prepareDelete);
-                }
-            }
-            case SYNC -> single.ifPresent(row -> openResultOperation(
+        List<BackupRow> selected = BackupFilter.apply(selection.rows(rows), "", sort);
+        Runnable run = switch (action) {
+            case CREATE -> () -> minecraft.setScreenAndShow(new BackupCreateScreen(this, label -> openOperation(
+                    BackupOperation.CREATE,
+                    "Creating backup",
+                    listener -> facade.createManualBackup(world, label, listener))));
+            case RESTORE -> () -> minecraft.setScreenAndShow(
+                    new BackupRestoreScreen(this, parent, world, selected.getFirst(), facade));
+            case DELETE -> () -> confirmDelete(selected);
+            case SYNC -> () -> openOperation(
                     BackupOperation.SYNC,
                     "Syncing backup",
-                    listener -> service.syncBackup(row.backupId(), listener)));
-            case VERIFY -> single.ifPresent(row -> openResultOperation(
+                    listener -> service.syncBackup(selected.getFirst().backupId(), listener));
+            case VERIFY -> () -> openOperation(
                     BackupOperation.VERIFY,
                     "Checking backup integrity",
-                    listener -> service.verifyBackup(row.backupId(), listener)));
-            case OPEN_FOLDER -> openFolder();
-            case STORAGE -> minecraft.setScreenAndShow(
-                    new StorageScreen(this, world, facade));
-            case SETTINGS -> openSettings();
-            default -> throw new IllegalStateException("Unknown backup action: " + action);
-        }
-    }
-
-    /** Every selected row, including rows on other pages, in catalog order. */
-    private List<BackupRow> selectedRows() {
-        if (selectedBackupIds.isEmpty()) {
-            return List.of();
-        }
-        return records.stream()
-                .filter(record -> selectedBackupIds.contains(record.manifest().backupId()))
-                .map(BackupRow::from)
-                .toList();
-    }
-
-    private void promptManualBackup() {
-        minecraft.setScreenAndShow(new BackupCreateScreen(this, label -> openResultOperation(
-                "Creating backup",
-                listener -> facade.createManualBackup(world, label, listener))));
+                    listener -> service.verifyBackup(selected.getFirst().backupId(), listener));
+            case OPEN_FOLDER -> () -> openFolder(selected);
+            case STORAGE -> () -> minecraft.setScreenAndShow(new StorageScreen(this, world, facade));
+            case SETTINGS -> this::openSettings;
+        };
+        run.run();
     }
 
-    private void prepareDelete(BackupRow row) {
-        if (busy) {
-            return;
-        }
-        busy = true;
-        status = Component.literal("Preparing deletion…").withStyle(ChatFormatting.GRAY);
-        rebuildWidgets();
-        long token = lifecycle;
-        long revision = ++requestRevision;
-        CompletionStage<DeletePreparation> preparation;
-        try {
-            preparation = Objects.requireNonNull(
-                    service.prepareDelete(row.backupId()),
-                    "prepareDelete result");
-        } catch (RuntimeException exception) {
-            finishInlineFailure(token, revision, exception);
-            return;
-        }
-        preparation.whenComplete((result, throwable) -> minecraft.execute(() -> {
-            if (!accepts(token, revision)) {
-                return;
-            }
-            if (throwable != null || result == null) {
-                finishInlineFailureOnClient(token, revision, throwable == null
-                        ? new IllegalStateException("Delete preparation returned no result")
-                        : throwable);
-                return;
-            }
-            busy = false;
-            ConfirmationState confirmation = new ConfirmationState(
-                    ConfirmationKind.DELETE,
-                    result.backupId(),
-                    "Delete backup?",
-                    result.description(),
-                    Optional.empty(),
-                    true);
-            minecraft.setScreenAndShow(new BackupConfirmationScreen(this, confirmation, () -> {
-                DeleteBackupRequest request = new DeleteBackupRequest(
-                        result.backupId(),
-                        result.confirmationToken());
-                openResultOperation(
-                        BackupOperation.DELETE,
-                        "Deleting backup",
-                        listener -> service.deleteBackup(request, listener));
-            }));
-        }));
+    private void openOperation(
+            BackupOperation operation,
+            String title,
+            BackupOperationScreen.OperationStarter<BackupResult> starter) {
+        minecraft.setScreenAndShow(BackupOperationScreen.backupResult(this, operation, title, starter));
     }
 
     /**
-     * Issues one confirmation per selected backup, then asks once. Every token must be
-     * issued before the prompt appears, so a backup that cannot be prepared cancels the
-     * whole batch with nothing deleted.
+     * Asks once for the selected backups, by name as the browser shows them. The delete request
+     * carries the copies each row shows, so a backup that changed since the list loaded is left
+     * alone. One backup or many, the delete is one call and one result screen.
      */
-    private void prepareDeleteMany(List<BackupRow> rows) {
-        if (busy) {
-            return;
-        }
-        busy = true;
-        status = Component.literal("Preparing deletion of " + rows.size() + " backups…")
-                .withStyle(ChatFormatting.GRAY);
-        rebuildWidgets();
-        long token = lifecycle;
-        long revision = ++requestRevision;
-        List<CompletableFuture<DeletePreparation>> preparations = new ArrayList<>();
-        try {
-            for (BackupRow row : rows) {
-                preparations.add(Objects.requireNonNull(
-                                service.prepareDelete(row.backupId()),
-                                "prepareDelete result")
-                        .toCompletableFuture());
-            }
-        } catch (RuntimeException exception) {
-            finishInlineFailure(token, revision, exception);
-            return;
+    private void confirmDelete(List<BackupRow> selected) {
+        List<DeleteBackupRequest> requests = selected.stream()
+                .map(row -> new DeleteBackupRequest(world.worldId(), row.backupId(), row.copies()))
+                .toList();
+        DeletePrompt prompt = DeletePrompt.of(selected);
+        Component title = prompt.count() == 1
+                ? Component.translatable("screen.worldarchive.delete.title_one")
+                : Component.translatable("screen.worldarchive.delete.title_many", prompt.count());
+        minecraft.setScreenAndShow(new BackupConfirmationScreen(
+                this,
+                title,
+                deletePromptText(prompt),
+                Component.literal("Delete").withStyle(ChatFormatting.RED),
+                () -> minecraft.setScreenAndShow(BackupOperationScreen.deleteBatch(
+                        this,
+                        prompt.count() == 1 ? "Deleting backup" : "Deleting backups",
+                        listener -> service.deleteBackups(requests, listener),
+                        selected))));
+    }
+
+    /** The delete prompt: what is deleted, by name as the browser shows it, and what goes with it. */
+    private static Component deletePromptText(DeletePrompt prompt) {
+        boolean one = prompt.count() == 1;
+        List<Component> lines = new ArrayList<>();
+        lines.add(one
+                ? Component.translatable("screen.worldarchive.delete.prompt_one")
+                : Component.translatable("screen.worldarchive.delete.prompt_many", prompt.count()));
+        prompt.shown().forEach(row -> lines.add(Component.literal(BackupRowText.promptLine(row))));
+        if (prompt.more() > 0) {
+            lines.add(Component.translatable("screen.worldarchive.delete.more", prompt.more()));
         }
-        CompletableFuture.allOf(preparations.toArray(CompletableFuture[]::new))
-                .whenComplete((ignored, throwable) -> minecraft.execute(() -> {
-                    if (!accepts(token, revision)) {
-                        return;
-                    }
-                    if (throwable != null) {
-                        finishInlineFailureOnClient(token, revision, throwable);
-                        return;
-                    }
-                    List<DeletePreparation> prepared = preparations.stream()
-                            .map(CompletableFuture::join)
-                            .toList();
-                    if (prepared.stream().anyMatch(Objects::isNull)) {
-                        finishInlineFailureOnClient(token, revision, new IllegalStateException(
-                                "Delete preparation returned no result"));
-                        return;
-                    }
-                    busy = false;
-                    List<DeleteBackupRequest> requests = prepared.stream()
-                            .map(preparation -> new DeleteBackupRequest(
-                                    preparation.backupId(), preparation.confirmationToken()))
-                            .toList();
-                    ConfirmationState confirmation = new ConfirmationState(
-                            ConfirmationKind.DELETE,
-                            requests.getFirst().backupId(),
-                            "Delete " + rows.size() + " backups?",
-                            deletePrompt(rows),
-                            Optional.empty(),
-                            true);
-                    minecraft.setScreenAndShow(new BackupConfirmationScreen(
-                            this,
-                            confirmation,
-                            () -> minecraft.setScreenAndShow(BackupOperationScreen.deleteBatch(
-                                    this,
-                                    "Deleting backups",
-                                    listener -> service.deleteBackups(requests, listener)))));
-                }));
-    }
-
-    private static String deletePrompt(List<BackupRow> rows) {
-        StringBuilder prompt = new StringBuilder("Delete these backups from every available destination?");
-        int shown = Math.min(rows.size(), CONFIRMATION_PREVIEW_ROWS);
-        for (BackupRow row : rows.subList(0, shown)) {
-            prompt.append('\n').append(BackupRowButton.primaryLine(row));
+        if (prompt.onRemote() > 0) {
+            lines.add(one
+                    ? Component.translatable("screen.worldarchive.delete.remote_one")
+                    : Component.translatable("screen.worldarchive.delete.remote_many", prompt.onRemote()));
         }
-        if (rows.size() > shown) {
-            prompt.append("\n…and ").append(rows.size() - shown).append(" more");
+        if (prompt.labeled() > 0 && !one) {
+            lines.add(Component.translatable("screen.worldarchive.delete.labeled", prompt.labeled()));
         }
-        return prompt.toString();
-    }
-
-    private void openResultOperation(
-            String operationTitle,
-            BackupOperationScreen.OperationStarter<BackupResult> starter) {
-        openResultOperation(BackupOperation.CREATE, operationTitle, starter);
-    }
-
-    private void openResultOperation(
-            BackupOperation operation,
-            String operationTitle,
-            BackupOperationScreen.OperationStarter<BackupResult> starter) {
-        minecraft.setScreenAndShow(BackupOperationScreen.backupResult(
-                this,
-                operationTitle,
-                operation,
-                starter));
-    }
-
-    private void openFolder() {
-        try {
-            List<BackupRow> selection = selectedRows();
-            facade.openManagedFolder(
-                    world,
-                    selection.size() == 1 ? Optional.of(selection.getFirst()) : Optional.empty());
-            status = Component.literal("Opened the backup folder").withStyle(ChatFormatting.GRAY);
-        } catch (RuntimeException exception) {
-            status = failureStatus(exception);
-        }
-        rebuildWidgets();
+        return CommonComponents.joinLines(lines);
+    }
+
+    /** Opens the folder of the selected backup, or the world's backup folder; the runtime opens it on a worker. */
+    private void openFolder(List<BackupRow> selected) {
+        status = Component.translatable("screen.worldarchive.browser.opening_folder").withStyle(ChatFormatting.GRAY);
+        refresh();
+        folders.dropPending();
+        folders.start(
+                () -> facade.openManagedFolder(
+                        world,
+                        selected.size() == 1 ? Optional.of(selected.getFirst().backupId()) : Optional.empty()),
+                ignored -> {
+                },
+                failure -> {
+                    status = FailureMessages.status(failure);
+                    refresh();
+                });
     }
 
     private void openSettings() {
         try {
             facade.openSettings(this);
         } catch (RuntimeException exception) {
-            status = failureStatus(exception);
-            rebuildWidgets();
+            status = FailureMessages.status(exception);
+            refresh();
         }
     }
 
-    private void reloadData() {
+    private void reload() {
         loading = true;
-        busy = false;
         status = Component.literal("Loading backups…").withStyle(ChatFormatting.GRAY);
-        long token = lifecycle;
-        long revision = ++requestRevision;
-        rebuildIfInitialized();
-        CompletionStage<List<BackupRecord>> backupLoad;
-        CompletionStage<BackupBrowserCapabilities> capabilityLoad;
-        try {
-            backupLoad = Objects.requireNonNull(
-                    service.listBackups(Optional.of(world.worldId())),
-                    "listBackups result");
-            capabilityLoad = Objects.requireNonNull(
-                    facade.browserCapabilities(world),
-                    "browserCapabilities result");
-        } catch (RuntimeException exception) {
-            finishInlineFailure(token, revision, exception);
-            return;
-        }
-        backupLoad.thenCombine(capabilityLoad, BrowserLoad::new)
-                .whenComplete((result, throwable) -> minecraft.execute(() -> {
-                    if (!accepts(token, revision)) {
-                        return;
-                    }
-                    loading = false;
-                    if (throwable != null || result == null) {
-                        status = failureStatus(throwable == null
-                                ? new IllegalStateException("Backup browser returned no result")
-                                : throwable);
-                        rebuildIfInitialized();
-                        return;
-                    }
-                    records = result.records().stream()
-                            .filter(record -> record.manifest().worldId().equals(world.worldId()))
-                            .toList();
-                    capabilities = result.capabilities();
-                    Set<BackupId> known = new LinkedHashSet<>();
-                    for (BackupRecord record : records) {
-                        known.add(record.manifest().backupId());
-                    }
-                    selectedBackupIds.retainAll(known);
-                    if (selectionAnchor != null && !known.contains(selectionAnchor)) {
-                        selectionAnchor = null;
-                    }
-                    status = Component.literal(records.isEmpty()
-                                    ? "No backups yet"
-                                    : records.size() + " backups loaded")
-                            .withStyle(ChatFormatting.GRAY);
-                    rebuildIfInitialized();
-                }));
-    }
-
-    private void finishInlineFailure(long token, long revision, Throwable throwable) {
-        minecraft.execute(() -> finishInlineFailureOnClient(token, revision, throwable));
-    }
-
-    private void finishInlineFailureOnClient(long token, long revision, Throwable throwable) {
-        if (!accepts(token, revision)) {
-            return;
-        }
+        refresh();
+        calls.dropPending();
+        calls.start(this::load, this::loaded, this::showFailure);
+    }
+
+    /** Lists the world's backups and builds their rows on the thread that loaded them. */
+    private CompletionStage<BrowserLoad> load() {
+        return service.listBackups(Optional.of(world.worldId()))
+                .thenApply(records -> records.stream().map(BackupRow::from).toList())
+                .thenCombine(facade.browserCapabilities(world), BrowserLoad::new);
+    }
+
+    private void loaded(BrowserLoad load) {
         loading = false;
-        busy = false;
-        status = failureStatus(throwable);
-        rebuildIfInitialized();
+        rows = load.rows();
+        capabilities = load.capabilities();
+        selection.retain(rows.stream().map(BackupRow::backupId).collect(Collectors.toSet()));
+        rematch();
+        status = Component.literal(rows.isEmpty() ? "No backups yet" : rows.size() + " backups loaded")
+                .withStyle(ChatFormatting.GRAY);
+        refresh();
+    }
+
+    private void showFailure(Throwable failure) {
+        loading = false;
+        status = FailureMessages.status(failure);
+        refresh();
     }
 
-    private boolean accepts(long token, long revision) {
-        return active && lifecycle == token && requestRevision == revision;
+    private void rematch() {
+        matching = BackupFilter.apply(rows, filter, sort);
     }
 
-    private void rebuildIfInitialized() {
-        if (width > 0 && height > 0) {
-            rebuildWidgets();
+    /** Lays the screen out again; a focused filter box keeps its focus and its cursor. */
+    private void refresh() {
+        if (width == 0 || height == 0) {
+            return;
+        }
+        boolean typing = filterBox != null && filterBox.isFocused();
+        int cursor = typing ? filterBox.getCursorPosition() : 0;
+        rebuildWidgets();
+        if (typing) {
+            setInitialFocus(filterBox);
+            filterBox.setCursorPosition(cursor);
+            filterBox.setHighlightPos(cursor);
         }
     }
 
@@ -769,6 +485,10 @@ public void onClose() {
         minecraft.setScreenAndShow(parent);
     }
 
+    private static List<BackupId> ids(List<BackupRow> rows) {
+        return rows.stream().map(BackupRow::backupId).toList();
+    }
+
     private static String sortLabel(BackupSort value) {
         return switch (value) {
             case NEWEST -> "Newest";
@@ -776,7 +496,6 @@ private static String sortLabel(BackupSort value) {
             case LABEL -> "Label";
             case SIZE_DESCENDING -> "Largest";
             case CHANGED_FILES_DESCENDING -> "Most changed";
-            default -> throw new IllegalStateException("Unknown backup sort: " + value);
         };
     }
 
@@ -790,35 +509,51 @@ private static String actionLabel(BackupAction action) {
             case OPEN_FOLDER -> "Open Folder";
             case STORAGE -> "Storage";
             case SETTINGS -> "Settings";
-            default -> throw new IllegalStateException("Unknown backup action: " + action);
         };
     }
 
-    private static String disabledReason(ActionDisabledReason reason) {
+    private Component disabledReason(ActionDisabledReason reason) {
         return switch (reason) {
-            case OPERATION_IN_PROGRESS -> "Wait for the current operation";
-            case SOURCE_UNAVAILABLE -> "The original world is unavailable";
-            case NO_DESTINATION_CONFIGURED -> "Configure at least one destination";
-            case NO_SELECTION -> "Select a backup";
-            case MULTIPLE_SELECTED -> "Select one backup";
-            case NO_DURABLE_COPY -> "This backup has no available copy";
-            case REMOTE_NOT_CONFIGURED -> "Configure a Git remote first";
-            case FOLDER_UNAVAILABLE -> "No managed backup folder is available";
-            case NONE -> "Available";
-            default -> throw new IllegalStateException("Unknown disabled reason: " + reason);
+            case NONE -> throw new IllegalArgumentException("An available action has no disabled reason");
+            case OPERATION_IN_PROGRESS -> Component.literal("Wait for the current operation");
+            case SOURCE_UNAVAILABLE -> Component.literal("The original world is unavailable");
+            case CREATE_BLOCKED -> createBlocked();
+            case NO_SELECTION -> Component.literal("Select a backup");
+            case MULTIPLE_SELECTED -> Component.literal("Select one backup");
+            case NO_DURABLE_COPY -> Component.literal("This backup has no available copy");
+            case REMOTE_NOT_CONFIGURED -> Component.literal("Configure a Git remote first");
+            case FOLDER_UNAVAILABLE -> Component.literal("No managed backup folder is available");
         };
     }
 
-    private static Component failureStatus(Throwable throwable) {
-        return Component.literal("Error: " + FailureMessages.safe(throwable, 220))
-                .withStyle(ChatFormatting.RED);
+    private Component createBlocked() {
+        return Component.translatable(switch (capabilities.createBlock().orElseThrow()) {
+            case WORLD_OFF -> "screen.worldarchive.browser.create_world_off";
+            case NO_DESTINATION -> "screen.worldarchive.browser.create_no_destination";
+            case GIT_MISSING -> "screen.worldarchive.browser.create_git_missing";
+            case STORAGE_PROBLEM -> "screen.worldarchive.browser.create_storage_problem";
+        });
+    }
+
+    /**
+     * The vertical position of each row below the backup list. Each row keeps its distance from
+     * the bottom edge, but never rises above its minimum on a very short screen.
+     */
+    private record Layout(int paginationY, int warningY, int statusY, int primaryActionsY, int secondaryActionsY) {
+        private static Layout of(int height, boolean warning) {
+            return new Layout(
+                    Math.max(88, height - (warning ? 100 : 84)),
+                    Math.max(94, height - 80),
+                    Math.max(108, height - 64),
+                    Math.max(128, height - 48),
+                    Math.max(150, height - 24));
+        }
     }
 
-    private record BrowserLoad(
-            List<BackupRecord> records,
-            BackupBrowserCapabilities capabilities) {
+    /** One catalog load: the world's rows and what the runtime reported with them. */
+    private record BrowserLoad(List<BackupRow> rows, BackupBrowserCapabilities capabilities) {
         private BrowserLoad {
-            records = List.copyOf(records);
+            rows = List.copyOf(rows);
             Objects.requireNonNull(capabilities, "capabilities");
         }
     }
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/BackupClientFacade.java b/src/client/java/dev/ishaanko/worldarchive/ui/BackupClientFacade.java
index a7f7d89..f019957 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/BackupClientFacade.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/BackupClientFacade.java
@@ -1,25 +1,34 @@
 package dev.ishaanko.worldarchive.ui;
 
+import dev.ishaanko.worldarchive.config.StoragePolicy;
 import dev.ishaanko.worldarchive.core.BackupService;
-import dev.ishaanko.worldarchive.core.OperationId;
-import dev.ishaanko.worldarchive.core.ProgressListener;
 import dev.ishaanko.worldarchive.core.RestoreBackupResult;
-import dev.ishaanko.worldarchive.config.StoragePolicy;
 import dev.ishaanko.worldarchive.importing.BackupImportService;
+import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.ui.model.BackupBrowserCapabilities;
-import dev.ishaanko.worldarchive.ui.model.BackupRow;
+import dev.ishaanko.worldarchive.model.GameVersionStamp;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.WorldId;
 import dev.ishaanko.worldarchive.storage.management.CleanupPlan;
 import dev.ishaanko.worldarchive.storage.management.CleanupRequest;
 import dev.ishaanko.worldarchive.storage.management.CleanupResult;
 import dev.ishaanko.worldarchive.storage.management.StorageOverview;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.util.Optional;
+import dev.ishaanko.worldarchive.ui.model.BackupBrowserCapabilities;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldEntry;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldSelection;
+import dev.ishaanko.worldarchive.ui.model.FolderSelectionResult;
 import java.util.List;
+import java.util.Optional;
+import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CompletionStage;
 import net.minecraft.client.gui.screens.Screen;
 
-/** Injectable boundary between native client screens and runtime-owned services or navigation. */
+/**
+ * What the backup screens ask of the runtime: its services, world lookups, storage actions,
+ * navigation and the game facts they show. Every call returns at once and never throws for a
+ * backup problem; the problem arrives as a failed stage whose message the screen can show.
+ */
 public interface BackupClientFacade {
     BackupService backupService();
 
@@ -27,7 +36,8 @@ public interface BackupClientFacade {
 
     CompletionStage<List<BackupWorldEntry>> backupWorlds();
 
-    CompletionStage<Optional<BackupWorldContext>> resolveWorld(BackupWorldSelection selection);
+    /** The world's identity; fails with the reason when WorldArchive does not back the world up. */
+    CompletionStage<BackupWorldContext> resolveWorld(BackupWorldSelection selection);
 
     /**
      * Requests a save-gated manual capture; screens must not capture a live world directly.
@@ -48,16 +58,20 @@ CompletionStage<BackupResult> createManualBackup(
 
     CompletionStage<CleanupResult> applyCleanup(CleanupRequest request);
 
-    CompletionStage<Void> discardCleanup(OperationId confirmationToken);
-
     CompletionStage<Void> saveStoragePolicy(WorldId worldId, StoragePolicy policy);
 
-    void openManagedFolder(BackupWorldContext world, Optional<BackupRow> selectedBackup);
+    /** Opens the folder of the selected backup, or of the world's backups, in the file manager. */
+    CompletionStage<Void> openManagedFolder(BackupWorldContext world, Optional<BackupId> selectedBackup);
 
     void openSettings(Screen returnTo);
 
+    /** Shows the platform folder picker; cancelling the result only ignores the choice. */
+    CompletableFuture<FolderSelectionResult> pickFolder(String title);
+
+    /** The Minecraft version that runs, for the restore screen's version notice; empty when the game cannot tell. */
+    Optional<GameVersionStamp> runningGameVersion();
+
     void selectRestoredWorld(Screen returnTo, RestoreBackupResult result);
 
     void playRestoredWorld(Screen returnTo, RestoreBackupResult result);
-
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/BackupConfirmationScreen.java b/src/client/java/dev/ishaanko/worldarchive/ui/BackupConfirmationScreen.java
index 50a0137..1042429 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/BackupConfirmationScreen.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/BackupConfirmationScreen.java
@@ -1,15 +1,16 @@
 package dev.ishaanko.worldarchive.ui;
 
-import dev.ishaanko.worldarchive.ui.model.ConfirmationState;
 import dev.ishaanko.worldarchive.ui.model.ScreenGeometry;
 import java.util.Objects;
-import net.minecraft.ChatFormatting;
 import net.minecraft.client.gui.components.Button;
 import net.minecraft.client.gui.components.MultiLineTextWidget;
 import net.minecraft.client.gui.screens.Screen;
 import net.minecraft.network.chat.Component;
 
-/** Small native confirmation screen shared by deletion and copy-only restoration. */
+/**
+ * Asks once before a delete or a copy-only restore. The confirm action runs at most once; Cancel
+ * and Esc return to the parent screen.
+ */
 final class BackupConfirmationScreen extends Screen {
     private static final int CONTENT_MIN = 180;
 
@@ -19,16 +20,24 @@ final class BackupConfirmationScreen extends Screen {
 
     private final Screen parent;
 
-    private final ConfirmationState state;
+    private final Component prompt;
+
+    private final Component confirmLabel;
 
     private final Runnable confirmed;
 
     private boolean consumed;
 
-    BackupConfirmationScreen(Screen parent, ConfirmationState state, Runnable confirmed) {
-        super(Component.literal(Objects.requireNonNull(state, "state").title()));
+    BackupConfirmationScreen(
+            Screen parent,
+            Component title,
+            Component prompt,
+            Component confirmLabel,
+            Runnable confirmed) {
+        super(title);
         this.parent = Objects.requireNonNull(parent, "parent");
-        this.state = state;
+        this.prompt = Objects.requireNonNull(prompt, "prompt");
+        this.confirmLabel = Objects.requireNonNull(confirmLabel, "confirmLabel");
         this.confirmed = Objects.requireNonNull(confirmed, "confirmed");
     }
 
@@ -43,23 +52,19 @@ protected void init() {
                 contentWidth,
                 20,
                 title));
-        MultiLineTextWidget prompt = new MultiLineTextWidget(
+        MultiLineTextWidget promptWidget = new MultiLineTextWidget(
                         contentX,
                         ScreenGeometry.anchorMiddle(38, height, -44),
-                        Component.literal(state.prompt()),
+                        prompt,
                         font)
                 .setMaxWidth(contentWidth)
                 .setCentered(true);
-        prompt.setWidth(contentWidth);
-        addRenderableOnly(prompt);
+        promptWidget.setWidth(contentWidth);
+        addRenderableOnly(promptWidget);
 
         int buttonWidth = Math.min(150, Math.max(80, (contentWidth - 6) / 2));
-        int buttonY = Math.min(height - 28, Math.max(height / 2 + 30, prompt.getBottom() + 16));
-        Component confirmText = switch (state.kind()) {
-            case DELETE -> Component.literal("Delete").withStyle(ChatFormatting.RED);
-            case RESTORE -> Component.literal("Restore");
-        };
-        addRenderableWidget(Button.builder(confirmText, ignored -> confirm())
+        int buttonY = Math.min(height - 28, Math.max(height / 2 + 30, promptWidget.getBottom() + 16));
+        addRenderableWidget(Button.builder(confirmLabel, ignored -> confirm())
                 .bounds(width / 2 - buttonWidth - 3, buttonY, buttonWidth, 20)
                 .build());
         addRenderableWidget(Button.builder(Component.literal("Cancel"), ignored -> onClose())
@@ -68,11 +73,10 @@ protected void init() {
     }
 
     private void confirm() {
-        if (consumed) {
-            return;
+        if (!consumed) {
+            consumed = true;
+            confirmed.run();
         }
-        consumed = true;
-        confirmed.run();
     }
 
     @Override
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/BackupCreateScreen.java b/src/client/java/dev/ishaanko/worldarchive/ui/BackupCreateScreen.java
index bc8ae84..f5715f0 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/BackupCreateScreen.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/BackupCreateScreen.java
@@ -1,5 +1,6 @@
 package dev.ishaanko.worldarchive.ui;
 
+import dev.ishaanko.worldarchive.model.BackupManifest;
 import dev.ishaanko.worldarchive.ui.model.ScreenGeometry;
 import java.util.Objects;
 import java.util.Optional;
@@ -56,7 +57,7 @@ protected void init() {
                 contentWidth,
                 20,
                 Component.literal("Optional backup label"));
-        labelBox.setMaxLength(128);
+        labelBox.setMaxLength(BackupManifest.MAXIMUM_LABEL_LENGTH);
         labelBox.setValue(label);
         labelBox.setHint(Component.literal("Optional backup label"));
         labelBox.setResponder(value -> label = value);
@@ -74,12 +75,11 @@ protected void init() {
     }
 
     private void confirm() {
-        if (consumed) {
-            return;
+        if (!consumed) {
+            consumed = true;
+            String value = label.strip();
+            confirmed.accept(value.isEmpty() ? Optional.empty() : Optional.of(value));
         }
-        consumed = true;
-        String value = label.strip();
-        confirmed.accept(value.isEmpty() ? Optional.empty() : Optional.of(value));
     }
 
     @Override
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/BackupImportPreviewScreen.java b/src/client/java/dev/ishaanko/worldarchive/ui/BackupImportPreviewScreen.java
index de7240e..42bfc37 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/BackupImportPreviewScreen.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/BackupImportPreviewScreen.java
@@ -3,13 +3,14 @@
 import dev.ishaanko.worldarchive.importing.ImportDisposition;
 import dev.ishaanko.worldarchive.importing.ImportPreview;
 import dev.ishaanko.worldarchive.importing.ImportPreviewItem;
+import dev.ishaanko.worldarchive.importing.ImportSummary;
 import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.ui.model.BackupText;
+import dev.ishaanko.worldarchive.ui.model.Paging;
 import dev.ishaanko.worldarchive.ui.model.ScreenGeometry;
-import java.time.ZoneId;
-import java.time.format.DateTimeFormatter;
-import java.time.format.FormatStyle;
+import java.util.ArrayList;
 import java.util.HashSet;
-import java.util.Locale;
+import java.util.List;
 import java.util.Objects;
 import java.util.Set;
 import net.minecraft.ChatFormatting;
@@ -17,9 +18,17 @@
 import net.minecraft.client.gui.components.MultiLineTextWidget;
 import net.minecraft.client.gui.screens.Screen;
 import net.minecraft.network.chat.Component;
-
-/** Lets the user choose exact backups before executing a pinned import preview. */
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Lets the player choose which found backups to import. The import runs from the preview that the
+ * service pinned, so it imports exactly what this screen showed; leaving without importing
+ * discards the preview.
+ */
 public final class BackupImportPreviewScreen extends Screen {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
     private static final int ROW_HEIGHT = 24;
 
     private static final int CONTENT_MIN = 240;
@@ -28,11 +37,6 @@ public final class BackupImportPreviewScreen extends Screen {
 
     private static final int CONTENT_MARGIN = 24;
 
-    private static final DateTimeFormatter DATE_FORMAT = DateTimeFormatter
-            .ofLocalizedDateTime(FormatStyle.SHORT)
-            .withLocale(Locale.getDefault())
-            .withZone(ZoneId.systemDefault());
-
     private final Screen parent;
 
     private final BackupClientFacade facade;
@@ -41,18 +45,22 @@ public final class BackupImportPreviewScreen extends Screen {
 
     private final Set<BackupId> selected = new HashSet<>();
 
-    private Component status;
-
-    private boolean busy;
-
-    private boolean finished;
+    private final ScreenCalls calls = new ScreenCalls(this);
 
-    private boolean successful;
+    private Component status;
 
-    private boolean active = true;
+    private State state = State.CHOOSING;
 
     private int page;
 
+    /** Where the import stands; the buttons and Back follow it. */
+    private enum State {
+        CHOOSING,
+        IMPORTING,
+        /** The import ended, with or without success; the preview is used up. */
+        FINISHED
+    }
+
     public BackupImportPreviewScreen(
             Screen parent,
             BackupClientFacade facade,
@@ -73,102 +81,79 @@ protected void init() {
         int contentWidth = ScreenGeometry.contentWidth(width, CONTENT_MIN, CONTENT_MAX, CONTENT_MARGIN);
         int x = ScreenGeometry.centerX(width, contentWidth);
         addRenderableOnly(Widgets.title(font, x, 12, contentWidth, 20, title));
-        addRenderableOnly(new MultiLineTextWidget(
-                x, 34, Component.literal(summaryText()), font)
+        addRenderableOnly(new MultiLineTextWidget(x, 34, Component.literal(summaryText()), font)
                 .setMaxWidth(contentWidth).setMaxRows(2));
-        int pageSize = Math.max(1, Math.min(7, (height - 126) / ROW_HEIGHT));
-        int pageCount = Math.max(1, (preview.items().size() + pageSize - 1) / pageSize);
-        page = Math.min(page, pageCount - 1);
-        addBackupButtons(x, contentWidth, pageSize);
+        Paging paging = Paging.of(preview.items().size(), Math.min(7, (height - 126) / ROW_HEIGHT), page);
+        page = paging.pageIndex();
+        int y = 58;
+        for (ImportPreviewItem item : paging.slice(preview.items())) {
+            addRenderableWidget(itemButton(item, x, y, contentWidth));
+            y += ROW_HEIGHT;
+        }
         addRenderableOnly(new MultiLineTextWidget(x, height - 72, status, font)
                 .setMaxWidth(contentWidth).setMaxRows(2));
-        addFooter(x, contentWidth, pageCount);
+        addFooter(x, contentWidth, paging);
     }
 
-    private void addBackupButtons(int x, int contentWidth, int pageSize) {
-        int first = page * pageSize;
-        int limit = Math.min(preview.items().size(), first + pageSize);
-        int y = 58;
-        for (int index = first; index < limit; index++) {
-            ImportPreviewItem item = preview.items().get(index);
-            BackupId backupId = item.manifest().backupId();
-            String marker = actionable(item)
-                    ? selected.contains(backupId) ? "[x] " : "[ ] "
-                    : "";
-            String label = marker + item.manifest().worldName() + " — "
-                    + DATE_FORMAT.format(item.manifest().createdAt()) + " — "
-                    + disposition(item.disposition());
-            Button choice = Button.builder(Component.literal(label), ignored -> {
-                        if (!selected.remove(backupId)) {
-                            selected.add(backupId);
-                        }
-                        updateSelectionStatus();
-                        rebuildWidgets();
-                    })
-                    .bounds(x, y, contentWidth, 20).build();
-            choice.active = !busy && !finished && actionable(item);
-            addRenderableWidget(choice);
-            y += ROW_HEIGHT;
-        }
+    private Button itemButton(ImportPreviewItem item, int x, int y, int contentWidth) {
+        BackupId backupId = item.manifest().backupId();
+        Component text = Component.literal(item.manifest().worldName()
+                + BackupText.SEPARATOR + BackupText.dateTime(item.manifest().createdAt())
+                + BackupText.SEPARATOR + disposition(item.disposition()));
+        Button choice = Button.builder(
+                        actionable(item) ? Widgets.checkbox(selected.contains(backupId), text) : text,
+                        ignored -> {
+                            if (!selected.remove(backupId)) {
+                                selected.add(backupId);
+                            }
+                            updateSelectionStatus();
+                            rebuildWidgets();
+                        })
+                .bounds(x, y, contentWidth, 20)
+                .build();
+        choice.active = state == State.CHOOSING && actionable(item);
+        return choice;
     }
 
-    private void addFooter(int x, int contentWidth, int pageCount) {
-        int buttonWidth = (contentWidth - 12) / 4;
-        Button previous = Button.builder(Component.literal("<"), ignored -> {
-                    page--;
-                    rebuildWidgets();
-                })
-                .bounds(x, height - 28, buttonWidth, 20).build();
-        previous.active = !busy && page > 0;
-        addRenderableWidget(previous);
-        Button next = Button.builder(Component.literal(">"), ignored -> {
-                    page++;
-                    rebuildWidgets();
-                })
-                .bounds(x + buttonWidth + 4, height - 28, buttonWidth, 20).build();
-        next.active = !busy && page + 1 < pageCount;
-        addRenderableWidget(next);
-        Button confirm = Button.builder(
-                        Component.literal(successful
-                                ? "Imported"
-                                : finished ? "Failed" : "Import Selected"),
-                        ignored -> execute())
-                .bounds(x + (buttonWidth + 4) * 2, height - 28, buttonWidth, 20).build();
-        confirm.active = !busy && !finished && !selected.isEmpty();
-        addRenderableWidget(confirm);
-        Button back = Button.builder(Component.literal("Back"), ignored -> onClose())
-                .bounds(x + (buttonWidth + 4) * 3, height - 28, buttonWidth, 20).build();
-        back.active = !busy;
-        addRenderableWidget(back);
+    private void addFooter(int x, int contentWidth, Paging paging) {
+        List<Button> buttons = new ArrayList<>(Widgets.pageButtons(paging, index -> {
+            page = index;
+            rebuildWidgets();
+        }));
+        Button confirm = Button.builder(Component.literal("Import Selected"), ignored -> execute()).build();
+        confirm.active = state == State.CHOOSING && !selected.isEmpty();
+        buttons.add(confirm);
+        buttons.add(Button.builder(Component.literal("Back"), ignored -> onClose()).build());
+        buttons.forEach(button -> button.active &= state != State.IMPORTING);
+        Widgets.row(x, height - 28, contentWidth, buttons);
+        buttons.forEach(this::addRenderableWidget);
     }
 
     private void execute() {
-        busy = true;
-        status = Component.literal("Importing the selected backups...")
-                .withStyle(ChatFormatting.YELLOW);
+        state = State.IMPORTING;
+        status = Component.literal("Importing the selected backups...").withStyle(ChatFormatting.YELLOW);
         rebuildWidgets();
-        facade.importService().execute(preview.token(), Set.copyOf(selected))
-                .whenComplete((summary, throwable) -> minecraft.execute(() -> {
-                    if (!active) {
-                        return;
-                    }
-                    busy = false;
-                    finished = true;
-                    successful = throwable == null && summary != null;
-                    status = successful
-                            ? Component.literal(summary.message()).withStyle(ChatFormatting.GREEN)
-                            : Component.literal(
-                                    "Import stopped. Some selected backups may have been imported; "
-                                            + "go Back and check again before retrying.")
-                                    .withStyle(ChatFormatting.RED);
-                    rebuildWidgets();
-                }));
+        calls.start(
+                () -> facade.importService().execute(preview.token(), Set.copyOf(selected)),
+                this::imported,
+                this::importFailed);
     }
 
-    @Override
-    public void removed() {
-        active = false;
-        super.removed();
+    /** Green only when every selected backup came in cleanly; conflicts or issues show in yellow. */
+    private void imported(ImportSummary summary) {
+        state = State.FINISHED;
+        boolean clean = summary.conflicts() == 0 && summary.issues() == 0 && summary.added() + summary.merged() > 0;
+        status = Component.literal(summary.message())
+                .withStyle(clean ? ChatFormatting.GREEN : ChatFormatting.YELLOW);
+        rebuildWidgets();
+    }
+
+    private void importFailed(Throwable failure) {
+        state = State.FINISHED;
+        LOGGER.warn("Import failed: {}", FailureMessages.text(failure));
+        status = Component.translatable("screen.worldarchive.import.stopped", FailureMessages.text(failure))
+                .withStyle(ChatFormatting.RED);
+        rebuildWidgets();
     }
 
     private void updateSelectionStatus() {
@@ -210,14 +195,18 @@ private static boolean actionable(ImportPreviewItem item) {
                 || item.disposition() == ImportDisposition.MERGE;
     }
 
+    @Override
+    public boolean shouldCloseOnEsc() {
+        return state != State.IMPORTING;
+    }
+
     @Override
     public void onClose() {
-        if (busy) {
+        if (state == State.IMPORTING) {
             return;
         }
-        if (!finished) {
+        if (state == State.CHOOSING) {
             facade.importService().discard(preview.token());
-            finished = true;
         }
         minecraft.setScreenAndShow(parent);
     }
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/BackupImportScreen.java b/src/client/java/dev/ishaanko/worldarchive/ui/BackupImportScreen.java
index 8a0e513..badee0f 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/BackupImportScreen.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/BackupImportScreen.java
@@ -2,12 +2,10 @@
 
 import dev.ishaanko.worldarchive.importing.BackupImportService;
 import dev.ishaanko.worldarchive.importing.ImportPreview;
-import dev.ishaanko.worldarchive.settings.CancellableRequest;
-import dev.ishaanko.worldarchive.settings.ClientSettingsAccess;
-import dev.ishaanko.worldarchive.settings.FolderSelectionResult;
+import dev.ishaanko.worldarchive.ui.model.FolderSelectionResult;
 import dev.ishaanko.worldarchive.ui.model.ScreenGeometry;
 import java.util.Objects;
-import java.util.Optional;
+import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CompletionStage;
 import java.util.function.Supplier;
 import net.minecraft.ChatFormatting;
@@ -16,9 +14,17 @@
 import net.minecraft.client.gui.components.MultiLineTextWidget;
 import net.minecraft.client.gui.screens.Screen;
 import net.minecraft.network.chat.Component;
-
-/** Import entry point for Git histories, WorldArchive ZIP folders, and local rebuilds. */
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Where an import starts: a Git repository, a folder of WorldArchive ZIP backups, or the backups
+ * WorldArchive already stores. Each finds backups first and opens a preview; nothing is imported
+ * before the player chooses.
+ */
 public final class BackupImportScreen extends Screen {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
     private static final int CONTENT_MIN = 240;
 
     private static final int CONTENT_MAX = 430;
@@ -31,32 +37,22 @@ public final class BackupImportScreen extends Screen {
 
     private final BackupImportService imports;
 
+    private final ScreenCalls calls = new ScreenCalls(this);
+
     private String remote = "";
 
     private Component status = defaultStatus();
 
     private boolean busy;
 
-    private boolean active;
-
-    private long lifecycle;
-
-    private CancellableRequest<FolderSelectionResult> picker;
-
-    private EditBox remoteBox;
+    /** The folder picker that is open; cancelling it only ignores its answer. */
+    private CompletableFuture<FolderSelectionResult> picker;
 
     public BackupImportScreen(Screen parent, BackupClientFacade facade) {
         super(Component.literal("Import Backups"));
         this.parent = Objects.requireNonNull(parent, "parent");
         this.facade = Objects.requireNonNull(facade, "facade");
-        imports = Objects.requireNonNull(facade.importService(), "importService");
-    }
-
-    @Override
-    public void added() {
-        super.added();
-        active = true;
-        lifecycle++;
+        imports = facade.importService();
     }
 
     @Override
@@ -66,8 +62,7 @@ protected void init() {
         addRenderableOnly(Widgets.title(font, x, 12, contentWidth, 20, title));
         addRenderableOnly(Widgets.label(font, x, 34, contentWidth, 14, "From a repository"));
         addRenderableOnly(Widgets.label(font, x, 48, contentWidth, 14, "Repository address"));
-        remoteBox = new EditBox(
-                font, x, 62, contentWidth, 20, Component.literal("Repository address"));
+        EditBox remoteBox = new EditBox(font, x, 62, contentWidth, 20, Component.literal("Repository address"));
         remoteBox.setMaxLength(2048);
         remoteBox.setValue(remote);
         remoteBox.setResponder(value -> remote = value);
@@ -75,134 +70,96 @@ protected void init() {
         addRenderableWidget(remoteBox);
         Button gitPreview = Button.builder(
                         Component.literal("Find Backups from Repository"),
-                        ignored -> startPreview(() -> imports.previewGit(remote)))
+                        ignored -> preview(
+                                () -> imports.previewGit(remote),
+                                "Checking which backups can be imported..."))
                 .bounds(x, 86, contentWidth, 20).build();
         gitPreview.active = !busy && !remote.isBlank();
         addRenderableWidget(gitPreview);
         addRenderableOnly(Widgets.label(font, x, 114, contentWidth, 14, "From a backup folder"));
-        Button chooseZip = Button.builder(
-                        Component.literal("Choose Backup Folder"),
-                        ignored -> chooseZipFolder())
+        Button chooseZip = Button.builder(Component.literal("Choose Backup Folder"), ignored -> chooseZipFolder())
                 .bounds(x, 128, contentWidth, 20).build();
         chooseZip.active = !busy;
         addRenderableWidget(chooseZip);
-        addRenderableOnly(Widgets.label(
-                font, x, 156, contentWidth, 14, "Already stored by WorldArchive?"));
+        addRenderableOnly(Widgets.label(font, x, 156, contentWidth, 14, "Already stored by WorldArchive?"));
         Button rebuild = Button.builder(
                         Component.literal("Find Stored Backups"),
-                        ignored -> rebuildLocal())
+                        ignored -> preview(
+                                imports::previewLocal,
+                                "Looking for backups already stored by WorldArchive..."))
                 .bounds(x, 170, contentWidth, 20).build();
         rebuild.active = !busy;
         addRenderableWidget(rebuild);
         addRenderableOnly(new MultiLineTextWidget(x, 192, status, font)
                 .setMaxWidth(contentWidth).setMaxRows(2));
-        Button done = Button.builder(Component.literal("Back"), ignored -> onClose())
+        Button back = Button.builder(Component.literal("Back"), ignored -> onClose())
                 .bounds(x + (contentWidth - 120) / 2, height - 28, 120, 20).build();
-        done.active = !busy;
-        addRenderableWidget(done);
+        back.active = !busy;
+        addRenderableWidget(back);
     }
 
     private void chooseZipFolder() {
-        busy = true;
-        status = Component.literal("Choose the folder containing your backup files...")
-                .withStyle(ChatFormatting.GRAY);
-        rebuildWidgets();
-        CancellableRequest<FolderSelectionResult> request = ClientSettingsAccess.chooseFolder(
-                "Choose a folder containing WorldArchive backups", Optional.empty());
+        showBusy(Component.literal("Choose the folder containing your backup files...").withStyle(ChatFormatting.GRAY));
+        CompletableFuture<FolderSelectionResult> request = facade.pickFolder(
+                "Choose a folder containing WorldArchive backups");
         picker = request;
-        request.completion().whenComplete((result, throwable) -> minecraft.execute(() -> {
-            if (picker != request) {
-                return;
-            }
+        calls.start(() -> request, result -> {
             picker = null;
-            busy = false;
-            if (throwable != null || result == null) {
-                status = Component.literal("The backup folder could not be opened")
-                        .withStyle(ChatFormatting.RED);
-                rebuildWidgets();
-                return;
-            }
             switch (result) {
-                case FolderSelectionResult.Selected selected ->
-                        startPreview(() -> imports.previewZip(selected.path()));
-                case FolderSelectionResult.Cancelled ignored -> {
-                    status = Component.literal("No folder was selected")
-                            .withStyle(ChatFormatting.GRAY);
-                    rebuildWidgets();
-                }
-                case FolderSelectionResult.Unavailable unavailable -> {
-                    status = Component.literal(unavailable.message()).withStyle(ChatFormatting.RED);
-                    rebuildWidgets();
-                }
-                case FolderSelectionResult.Failed failed -> {
-                    status = Component.literal(failed.message()).withStyle(ChatFormatting.RED);
-                    rebuildWidgets();
-                }
+                case FolderSelectionResult.Selected selected -> preview(
+                        () -> imports.previewZip(selected.path()),
+                        "Checking which backups can be imported...");
+                case FolderSelectionResult.Cancelled ignored -> showStatus(
+                        Component.literal("No folder was selected").withStyle(ChatFormatting.GRAY));
+                case FolderSelectionResult.Failed failed -> showStatus(
+                        Component.literal(failed.message()).withStyle(ChatFormatting.RED));
             }
-        }));
+        }, failure -> {
+            picker = null;
+            LOGGER.warn("The backup folder picker failed: {}", FailureMessages.text(failure));
+            showStatus(Component.literal("The backup folder could not be opened").withStyle(ChatFormatting.RED));
+        });
     }
 
-    /** The import service throws synchronously while the runtime is still loading. */
-    private void startPreview(Supplier<CompletionStage<ImportPreview>> operation) {
-        CompletionStage<ImportPreview> started;
-        try {
-            started = operation.get();
-        } catch (RuntimeException exception) {
+    /**
+     * Finds the backups a source holds and opens the preview. A preview that arrives after the
+     * player left is discarded, so the import service can release what it holds for it.
+     */
+    private void preview(Supplier<CompletionStage<ImportPreview>> operation, String waiting) {
+        showBusy(Component.literal(waiting).withStyle(ChatFormatting.YELLOW));
+        calls.start(operation, found -> {
             busy = false;
-            status = Component.literal(FailureMessages.safe(exception, 200))
-                    .withStyle(ChatFormatting.RED);
-            rebuildWidgets();
-            return;
-        }
-        preview(started);
+            status = defaultStatus();
+            minecraft.setScreenAndShow(new BackupImportPreviewScreen(this, facade, found));
+        }, failure -> {
+            LOGGER.warn("Import preview failed: {}", FailureMessages.text(failure));
+            showStatus(Component.translatable("screen.worldarchive.import.read_failed", FailureMessages.text(failure))
+                    .withStyle(ChatFormatting.RED));
+        }, found -> imports.discard(found.token()));
     }
 
-    private void preview(CompletionStage<ImportPreview> operation) {
-        long token = lifecycle;
+    private void showBusy(Component message) {
         busy = true;
-        status = Component.literal("Checking which backups can be imported...")
-                .withStyle(ChatFormatting.YELLOW);
+        status = message;
         rebuildWidgets();
-        operation.whenComplete((preview, throwable) -> minecraft.execute(() -> {
-            if (!active || token != lifecycle) {
-                if (preview != null) {
-                    imports.discard(preview.token());
-                }
-                return;
-            }
-            busy = false;
-            if (throwable != null || preview == null) {
-                status = Component.literal("Those backups could not be read; nothing was changed")
-                        .withStyle(ChatFormatting.RED);
-                rebuildWidgets();
-                return;
-            }
-            status = defaultStatus();
-            minecraft.setScreenAndShow(new BackupImportPreviewScreen(this, facade, preview));
-        }));
     }
 
-    private static Component defaultStatus() {
-        return Component.literal("Choose where your existing backups are stored.")
-                .withStyle(ChatFormatting.GRAY);
+    private void showStatus(Component message) {
+        busy = false;
+        status = message;
+        rebuildWidgets();
     }
 
-    private void rebuildLocal() {
-        busy = true;
-        status = Component.literal("Looking for backups already stored by WorldArchive...")
-                .withStyle(ChatFormatting.YELLOW);
-        rebuildWidgets();
-        startPreview(imports::previewLocal);
+    private static Component defaultStatus() {
+        return Component.literal("Choose where your existing backups are stored.").withStyle(ChatFormatting.GRAY);
     }
 
     @Override
     public void removed() {
-        active = false;
-        lifecycle++;
-        CancellableRequest<FolderSelectionResult> request = picker;
+        CompletableFuture<FolderSelectionResult> request = picker;
         picker = null;
         if (request != null) {
-            request.cancel();
+            request.cancel(false);
         }
         super.removed();
     }
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/BackupOperationScreen.java b/src/client/java/dev/ishaanko/worldarchive/ui/BackupOperationScreen.java
index e8adef7..0fdff5c 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/BackupOperationScreen.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/BackupOperationScreen.java
@@ -1,34 +1,39 @@
 package dev.ishaanko.worldarchive.ui;
 
-import dev.ishaanko.worldarchive.core.AsyncTasks;
-import dev.ishaanko.worldarchive.core.BackupOperation;
-import dev.ishaanko.worldarchive.core.ProgressListener;
+import dev.ishaanko.worldarchive.core.CaptureChangedException;
 import dev.ishaanko.worldarchive.core.RestoreBackupResult;
+import dev.ishaanko.worldarchive.model.BackupOperation;
 import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.BackupStatus;
+import dev.ishaanko.worldarchive.model.OperationProgress;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.SafeText;
+import dev.ishaanko.worldarchive.support.AsyncTasks;
 import dev.ishaanko.worldarchive.ui.model.BackupOutcomeSummary;
+import dev.ishaanko.worldarchive.ui.model.BackupRow;
 import dev.ishaanko.worldarchive.ui.model.DeleteBatchSummary;
-import dev.ishaanko.worldarchive.ui.model.DestinationOutcomeView;
-import dev.ishaanko.worldarchive.ui.model.ProgressState;
 import dev.ishaanko.worldarchive.ui.model.ScreenGeometry;
-import java.util.ArrayList;
 import java.util.List;
-import java.util.Locale;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CompletionStage;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Consumer;
+import java.util.function.Function;
 import net.minecraft.ChatFormatting;
 import net.minecraft.client.gui.GuiGraphicsExtractor;
 import net.minecraft.client.gui.components.Button;
 import net.minecraft.client.gui.components.MultiLineTextWidget;
 import net.minecraft.client.gui.components.StringWidget;
 import net.minecraft.client.gui.screens.Screen;
+import net.minecraft.network.chat.CommonComponents;
 import net.minecraft.network.chat.Component;
 
 /**
- * Native asynchronous operation screen with credential-safe progress and partial outcomes.
- * A backup creation can be cancelled while it runs; other operations show a wait notice.
+ * Runs one backup operation and shows its progress and outcome. Create, Restore, Sync and Verify
+ * show Cancel while they run; Delete shows a wait notice until it finishes. A backup that failed
+ * because the world changed while it was copied offers Retry.
  */
 final class BackupOperationScreen<T> extends Screen {
     private static final int BAR_BACKGROUND = 0xFF303030;
@@ -37,6 +42,9 @@ final class BackupOperationScreen<T> extends Screen {
 
     private static final int BAR_BORDER = 0xFFA0A0A0;
 
+    /** The bar shows this much before the first progress event, so it never looks stuck at zero. */
+    private static final double STARTING_FRACTION = 0.05;
+
     private static final int CONTENT_MIN = 180;
 
     private static final int CONTENT_MAX = 440;
@@ -45,116 +53,107 @@ final class BackupOperationScreen<T> extends Screen {
 
     private final Screen parent;
 
-    private final OperationStarter<T> starter;
-
-    private final SuccessHandler<T> successHandler;
-
-    private final boolean cancellable;
+    private final BackupOperation operation;
 
-    private final AtomicReference<ProgressState> queuedProgress = new AtomicReference<>();
+    private final OperationStarter<T> starter;
 
-    // The running operation's future, kept so the Cancel button can stop it.
-    private CompletableFuture<T> runningOperation;
+    private final Function<T, Presentation> outcome;
 
-    private boolean cancelling;
+    private final Consumer<T> finished;
 
-    private ProgressState progress;
+    private final ScreenCalls calls = new ScreenCalls(this);
 
-    private Presentation presentation = Presentation.running("Queued");
+    /** The running attempt, kept so Cancel can stop it; null until the screen first shows. */
+    private CompletableFuture<T> attempt;
 
-    private boolean running = true;
+    /** Holds the newest progress event of the running attempt until the render thread reads it. */
+    private AtomicReference<OperationProgress> pendingProgress = new AtomicReference<>();
 
-    private boolean retryAvailable;
+    private OperationProgress progress;
 
-    private boolean started;
+    private State state = State.RUNNING;
 
-    private boolean active;
+    private Presentation presentation = Presentation.waiting(Component.literal("Queued"));
 
-    private long lifecycle;
+    /** Where the operation stands; the buttons, Esc and the progress bar follow it. */
+    private enum State {
+        RUNNING,
+        CANCELLING,
+        FINISHED,
+        /** Failed because the world changed while it was copied; trying again usually works. */
+        RETRYABLE
+    }
 
     private BackupOperationScreen(
             Screen parent,
+            BackupOperation operation,
             String title,
             OperationStarter<T> starter,
-            SuccessHandler<T> successHandler,
-            boolean cancellable) {
+            Function<T, Presentation> outcome,
+            Consumer<T> finished) {
         super(Component.literal(title));
         this.parent = Objects.requireNonNull(parent, "parent");
+        this.operation = Objects.requireNonNull(operation, "operation");
         this.starter = Objects.requireNonNull(starter, "starter");
-        this.successHandler = Objects.requireNonNull(successHandler, "successHandler");
-        this.cancellable = cancellable;
+        this.outcome = Objects.requireNonNull(outcome, "outcome");
+        this.finished = Objects.requireNonNull(finished, "finished");
     }
 
+    /** Creates, syncs or verifies one backup and shows its outcome per destination. */
     static BackupOperationScreen<BackupResult> backupResult(
             Screen parent,
-            String title,
-            OperationStarter<BackupResult> starter) {
-        return backupResult(parent, title, BackupOperation.CREATE, starter);
-    }
-
-    static BackupOperationScreen<BackupResult> backupResult(
-            Screen parent,
-            String title,
             BackupOperation operation,
+            String title,
             OperationStarter<BackupResult> starter) {
-        Objects.requireNonNull(operation, "operation");
-        return new BackupOperationScreen<>(
-                parent,
-                title,
-                starter,
-                result -> backupPresentation(operation, result),
-                operation == BackupOperation.CREATE);
+        return new BackupOperationScreen<>(parent, operation, title, starter, result -> {
+            BackupOutcomeSummary summary = BackupOutcomeSummary.from(operation, result);
+            return Presentation.finished(
+                    Component.literal(summary.headline()),
+                    color(summary.status(), operation),
+                    Presentation.lines(summary.lines()));
+        }, ignored -> {
+        });
     }
 
-    /** Shows one combined outcome for a multi-backup delete instead of one screen per backup. */
+    /** Deletes one or more backups and shows one combined outcome; {@code rows} name them in it. */
     static BackupOperationScreen<List<BackupResult>> deleteBatch(
             Screen parent,
             String title,
-            OperationStarter<List<BackupResult>> starter) {
-        return new BackupOperationScreen<>(parent, title, starter, results -> {
-            DeleteBatchSummary summary = DeleteBatchSummary.from(results);
-            ChatFormatting color = switch (summary.status()) {
-                case SUCCESS, SKIPPED -> ChatFormatting.GREEN;
-                case PARTIAL_SUCCESS -> ChatFormatting.YELLOW;
-                case FAILED -> ChatFormatting.RED;
-            };
-            return new Presentation(summary.headline(), summary.details(), color);
-        }, false);
+            OperationStarter<List<BackupResult>> starter,
+            List<BackupRow> rows) {
+        List<BackupRow> confirmed = List.copyOf(rows);
+        return new BackupOperationScreen<>(parent, BackupOperation.DELETE, title, starter, results -> {
+            DeleteBatchSummary summary = DeleteBatchSummary.from(results, confirmed);
+            return Presentation.finished(
+                    Component.literal(summary.headline()),
+                    color(summary.status(), BackupOperation.DELETE),
+                    Presentation.lines(summary.details()));
+        }, ignored -> {
+        });
     }
 
+    /** Restores a backup, then hands the result to {@code restored}, which opens the new world. */
     static BackupOperationScreen<RestoreBackupResult> restore(
             Screen parent,
             String title,
             OperationStarter<RestoreBackupResult> starter,
             Consumer<RestoreBackupResult> restored) {
-        Objects.requireNonNull(restored, "restored");
-        return new BackupOperationScreen<>(parent, title, starter, result -> {
-            restored.accept(result);
-            return new Presentation(
-                    "Restore completed",
-                    List.of("Created " + result.restoredWorldDirectory().getFileName()),
-                    ChatFormatting.GREEN);
-        }, false);
+        return new BackupOperationScreen<>(parent, BackupOperation.RESTORE, title, starter, result ->
+                Presentation.finished(
+                        Component.literal("Restore completed"),
+                        ChatFormatting.GREEN,
+                        Presentation.lines(List.of("Created " + result.restoredWorldDirectory().getFileName()))),
+                restored);
     }
 
     @Override
     public void added() {
         super.added();
-        active = true;
-        lifecycle++;
-        if (!started) {
-            started = true;
-            startOperation(lifecycle);
+        if (attempt == null) {
+            start();
         }
     }
 
-    @Override
-    public void removed() {
-        active = false;
-        lifecycle++;
-        super.removed();
-    }
-
     @Override
     protected void init() {
         int contentWidth = ScreenGeometry.contentWidth(width, CONTENT_MIN, CONTENT_MAX, CONTENT_MARGIN);
@@ -166,44 +165,61 @@ protected void init() {
                 contentWidth,
                 20,
                 title));
-        Component headline = Component.literal(presentation.headline())
-                .withStyle(presentation.color());
         addRenderableOnly(new StringWidget(
                 contentX,
                 ScreenGeometry.anchorMiddle(34, height, -62),
                 contentWidth,
                 20,
-                headline,
+                presentation.headline(),
                 font));
-
-        String details = String.join("\n", presentation.details());
-        if (!details.isBlank()) {
-            MultiLineTextWidget detailWidget = new MultiLineTextWidget(
+        if (!presentation.details().isEmpty()) {
+            MultiLineTextWidget details = new MultiLineTextWidget(
                             contentX,
                             ScreenGeometry.anchorMiddle(58, height, -36),
-                            Component.literal(details),
+                            CommonComponents.joinLines(presentation.details()),
                             font)
                     .setMaxWidth(contentWidth)
                     .setMaxRows(7)
                     .setCentered(true);
-            detailWidget.setWidth(contentWidth);
-            addRenderableOnly(detailWidget);
+            details.setWidth(contentWidth);
+            addRenderableOnly(details);
         }
+        addButtons();
+    }
 
+    private void addButtons() {
         int buttonY = Math.min(height - 28, height / 2 + 72);
-        int buttonWidth = retryAvailable ? 120 : 150;
-        int closeX = retryAvailable ? width / 2 + 3 : width / 2 - buttonWidth / 2;
-        Button closeButton = running
-                ? runningButton(closeX, buttonY, buttonWidth)
-                : Button.builder(Component.literal("Done"), ignored -> onClose())
-                        .bounds(closeX, buttonY, buttonWidth, 20)
-                        .build();
-        addRenderableWidget(closeButton);
-        if (retryAvailable) {
-            addRenderableWidget(Button.builder(Component.literal("Retry"), ignored -> retry())
-                    .bounds(width / 2 - buttonWidth - 3, buttonY, buttonWidth, 20)
+        if (state == State.RETRYABLE) {
+            addRenderableWidget(Button.builder(Component.literal("Retry"), ignored -> start())
+                    .bounds(width / 2 - 123, buttonY, 120, 20)
+                    .build());
+            addRenderableWidget(Button.builder(Component.literal("Done"), ignored -> onClose())
+                    .bounds(width / 2 + 3, buttonY, 120, 20)
                     .build());
+            return;
         }
+        Button button = state == State.FINISHED
+                ? Button.builder(Component.literal("Done"), ignored -> onClose()).build()
+                : runningButton();
+        button.setRectangle(150, 20, width / 2 - 75, buttonY);
+        addRenderableWidget(button);
+    }
+
+    /** Cancel while the operation can be stopped, otherwise a wait notice. */
+    private Button runningButton() {
+        Optional<CancelText> cancel = cancelText(operation);
+        if (cancel.isEmpty()) {
+            Button wait = Button.builder(Component.literal("Please wait…"), ignored -> {
+            }).build();
+            wait.active = false;
+            return wait;
+        }
+        Component label = state == State.CANCELLING
+                ? Component.translatable(cancel.orElseThrow().cancelling())
+                : Component.translatable("screen.worldarchive.operation.cancel");
+        Button button = Button.builder(label, ignored -> cancel()).build();
+        button.active = state == State.RUNNING;
+        return button;
     }
 
     @Override
@@ -213,7 +229,7 @@ public void extractRenderState(
             int mouseY,
             float partialTick) {
         super.extractRenderState(graphics, mouseX, mouseY, partialTick);
-        if (!running) {
+        if (state != State.RUNNING && state != State.CANCELLING) {
             return;
         }
         int barWidth = Math.min(360, Math.max(120, width - 48));
@@ -222,161 +238,98 @@ public void extractRenderState(
         graphics.fill(x, y, x + barWidth, y + 10, BAR_BACKGROUND);
         graphics.outline(x, y, barWidth, 10, BAR_BORDER);
         double fraction = progress == null
-                ? 0.05
-                : progress.fraction().orElse(0.05);
+                ? STARTING_FRACTION
+                : progress.fraction().orElse(STARTING_FRACTION);
         int filled = Math.max(1, (int) Math.round((barWidth - 2) * fraction));
         graphics.fill(x + 1, y + 1, x + 1 + filled, y + 9, BAR_PROGRESS);
     }
 
-    /** While the operation runs: Cancel when it can be stopped, otherwise a wait notice. */
-    private Button runningButton(int x, int y, int width) {
-        if (!cancellable) {
-            Button wait = Button.builder(Component.literal("Please wait…"), ignored -> { })
-                    .bounds(x, y, width, 20)
-                    .build();
-            wait.active = false;
-            return wait;
+    /** Starts the first attempt, or a retry after the world changed while it was copied. */
+    private void start() {
+        AtomicReference<OperationProgress> slot = new AtomicReference<>();
+        pendingProgress = slot;
+        progress = null;
+        state = State.RUNNING;
+        if (attempt != null) {
+            presentation = Presentation.waiting(Component.literal("Saving the world before retry…"));
+            rebuildIfInitialized();
         }
-        String key = cancelling
-                ? "screen.worldarchive.operation.cancelling"
-                : "screen.worldarchive.operation.cancel";
-        Button cancel = Button.builder(Component.translatable(key), ignored -> cancelOperation())
-                .bounds(x, y, width, 20)
-                .build();
-        cancel.active = !cancelling;
-        return cancel;
+        attempt = calls.start(() -> starter.start(update -> offerProgress(slot, update)), this::succeed, this::fail)
+                .toCompletableFuture();
     }
 
     /**
-     * Stops the running backup. The coordinator interrupts the capture or the destination
-     * writes and removes their partial files; the outcome arrives as a cancellation.
+     * Stops the running operation. The engine interrupts the work and removes partial files; the
+     * outcome then arrives as a cancellation, or as the real result when the work had already
+     * passed the point where it can stop.
      */
-    private void cancelOperation() {
-        CompletableFuture<T> current = runningOperation;
-        if (!running || cancelling || current == null) {
+    private void cancel() {
+        Optional<CancelText> cancel = cancelText(operation);
+        if (state != State.RUNNING || attempt == null || cancel.isEmpty()) {
             return;
         }
-        cancelling = true;
-        presentation = Presentation.running(
-                Component.translatable("screen.worldarchive.operation.cancelling").getString());
+        state = State.CANCELLING;
+        presentation = Presentation.waiting(Component.translatable(cancel.orElseThrow().cancelling()));
         rebuildIfInitialized();
-        current.cancel(true);
-    }
-
-    private void startOperation(long token) {
-        CompletionStage<T> operation;
-        try {
-            operation = Objects.requireNonNull(
-                    starter.start(value -> onProgress(token, value)),
-                    "operation result");
-        } catch (RuntimeException exception) {
-            finishFailure(token, exception);
-            return;
-        }
-        runningOperation = operation.toCompletableFuture();
-        operation.whenComplete((result, throwable) -> minecraft.execute(() -> {
-            if (!accepts(token)) {
-                return;
-            }
-            if (throwable != null || result == null) {
-                finishFailureOnClient(token, throwable == null
-                        ? new IllegalStateException("Operation returned no result")
-                        : throwable);
-                return;
-            }
-            try {
-                Presentation completed = successHandler.success(result);
-                if (!accepts(token)) {
-                    return;
-                }
-                running = false;
-                retryAvailable = false;
-                presentation = completed;
-                rebuildIfInitialized();
-            } catch (RuntimeException exception) {
-                finishFailureOnClient(token, exception);
-            }
-        }));
+        attempt.cancel(true);
     }
 
     /**
-     * Progress events arrive once per copied file; only the newest one matters. The
-     * reference coalesces bursts into at most one queued render-thread task, and the
-     * widgets rebuild only when the phase message changes — the bar itself reads
-     * {@link #progress} every frame without a rebuild.
+     * Progress arrives from worker threads, often once per copied file. Only the newest event of
+     * an attempt matters: the slot keeps it, and at most one render-thread task reads it.
      */
-    private void onProgress(long token, dev.ishaanko.worldarchive.core.OperationProgress value) {
-        if (value == null) {
-            return;
-        }
-        if (queuedProgress.getAndSet(ProgressState.from(value)) == null) {
-            minecraft.execute(() -> applyQueuedProgress(token));
+    private void offerProgress(AtomicReference<OperationProgress> slot, OperationProgress update) {
+        if (update != null && slot.getAndSet(update) == null) {
+            minecraft.schedule(() -> showProgress(slot));
         }
     }
 
-    private void applyQueuedProgress(long token) {
-        ProgressState updated = queuedProgress.getAndSet(null);
-        if (updated == null || !accepts(token) || !running) {
+    private void showProgress(AtomicReference<OperationProgress> slot) {
+        OperationProgress update = slot.getAndSet(null);
+        if (update == null || slot != pendingProgress) {
             return;
         }
-        boolean messageChanged = progress == null
-                || !progress.message().equals(updated.message());
-        progress = updated;
-        if (messageChanged) {
-            presentation = Presentation.running(updated.message());
+        boolean messageChanged = progress == null || !progress.message().equals(update.message());
+        progress = update;
+        if (state == State.RUNNING && messageChanged) {
+            presentation = Presentation.waiting(Component.literal(update.message()));
             rebuildIfInitialized();
         }
     }
 
-    private void finishFailure(long token, Throwable throwable) {
-        minecraft.execute(() -> finishFailureOnClient(token, throwable));
-    }
-
-    private void finishFailureOnClient(long token, Throwable throwable) {
-        if (!accepts(token)) {
-            return;
-        }
-        running = false;
-        cancelling = false;
-        if (AsyncTasks.isCancellation(throwable)) {
-            retryAvailable = false;
-            presentation = new Presentation(
-                    Component.translatable("screen.worldarchive.operation.cancelled").getString(),
-                    List.of(Component.translatable(
-                            "screen.worldarchive.operation.cancelled_detail").getString()),
-                    ChatFormatting.YELLOW);
-            rebuildIfInitialized();
-            return;
-        }
-        String failure = safeFailure(throwable);
-        retryAvailable = captureChanged(failure);
-        List<String> details = retryAvailable
-                ? List.of(
-                        failure,
-                        "The world changed while it was being copied. Wait a moment, then choose Retry.")
-                : List.of(failure);
-        presentation = new Presentation(
-                "Operation failed",
-                details,
-                ChatFormatting.RED);
+    private void succeed(T result) {
+        state = State.FINISHED;
+        presentation = outcome.apply(result);
         rebuildIfInitialized();
+        finished.accept(result);
     }
 
-    private void retry() {
-        if (running || !retryAvailable) {
-            return;
+    private void fail(Throwable failure) {
+        state = SafeText.unwrap(failure) instanceof CaptureChangedException ? State.RETRYABLE : State.FINISHED;
+        if (AsyncTasks.isCancellation(failure)) {
+            presentation = cancelText(operation)
+                    .map(cancel -> Presentation.finished(
+                            Component.translatable(cancel.cancelled()),
+                            ChatFormatting.YELLOW,
+                            List.of(Component.translatable(cancel.detail()))))
+                    .orElseGet(() -> Presentation.finished(
+                            Component.translatable("screen.worldarchive.operation.stopped"),
+                            ChatFormatting.YELLOW,
+                            List.of()));
+        } else if (state == State.RETRYABLE) {
+            presentation = Presentation.finished(
+                    Component.literal("Operation failed"),
+                    ChatFormatting.RED,
+                    Presentation.lines(List.of(
+                            FailureMessages.text(failure),
+                            "The world changed while it was being copied. Wait a moment, then choose Retry.")));
+        } else {
+            presentation = Presentation.finished(
+                    Component.literal("Operation failed"),
+                    ChatFormatting.RED,
+                    Presentation.lines(List.of(FailureMessages.text(failure))));
         }
-        running = true;
-        retryAvailable = false;
-        progress = null;
-        presentation = Presentation.running("Saving the world before retry…");
-        long token = ++lifecycle;
         rebuildIfInitialized();
-        startOperation(token);
-    }
-
-    private boolean accepts(long token) {
-        return active && lifecycle == token;
     }
 
     private void rebuildIfInitialized() {
@@ -387,69 +340,81 @@ private void rebuildIfInitialized() {
 
     @Override
     public void onClose() {
-        if (!running) {
+        if (state == State.FINISHED || state == State.RETRYABLE) {
             minecraft.setScreenAndShow(parent);
         }
     }
 
     @Override
     public boolean shouldCloseOnEsc() {
-        return !running;
+        return state == State.FINISHED || state == State.RETRYABLE;
     }
 
-    private static Presentation backupPresentation(
-            BackupOperation operation,
-            BackupResult result) {
-        BackupOutcomeSummary summary = BackupOutcomeSummary.from(operation, result);
-        List<String> details = new ArrayList<>();
-        for (DestinationOutcomeView destination : summary.destinations()) {
-            String detail = destination.detail().map(value -> " — " + value).orElse("");
-            details.add(destination.destination() + ": "
-                    + summary.destinationStatus(destination) + detail);
-        }
-        ChatFormatting color = switch (summary.status()) {
+    /** Green for success, yellow for a partial or skipped outcome, red for a failure. */
+    private static ChatFormatting color(BackupStatus status, BackupOperation operation) {
+        return switch (status) {
             case SUCCESS -> ChatFormatting.GREEN;
             case PARTIAL_SUCCESS -> ChatFormatting.YELLOW;
-            case SKIPPED -> operation == BackupOperation.DELETE
-                    ? ChatFormatting.GREEN
-                    : ChatFormatting.YELLOW;
+            case SKIPPED -> operation == BackupOperation.DELETE ? ChatFormatting.GREEN : ChatFormatting.YELLOW;
             case FAILED -> ChatFormatting.RED;
-            default -> throw new IllegalStateException("Unknown backup status: " + summary.status());
         };
-        return new Presentation(summary.headline(), details, color);
-    }
-
-    private static String safeFailure(Throwable throwable) {
-        return FailureMessages.safe(throwable, 300);
     }
 
-    static boolean captureChanged(String failure) {
-        String normalized = failure.toLowerCase(Locale.ROOT);
-        return normalized.contains("changed")
-                && normalized.contains("world")
-                && (normalized.contains("private capture")
-                        || normalized.contains("while it was being captured"));
+    /**
+     * The lang keys of an operation that can be cancelled. Delete has none, because a delete
+     * stopped halfway would leave a backup with only some of its copies. A cancelled restore
+     * removes the world it had started.
+     */
+    private static Optional<CancelText> cancelText(BackupOperation operation) {
+        return switch (operation) {
+            case CREATE -> Optional.of(new CancelText(
+                    "screen.worldarchive.operation.cancelling",
+                    "screen.worldarchive.operation.cancelled",
+                    "screen.worldarchive.operation.cancelled_detail"));
+            case SYNC -> Optional.of(new CancelText(
+                    "screen.worldarchive.operation.sync_cancelling",
+                    "screen.worldarchive.operation.sync_cancelled",
+                    "screen.worldarchive.operation.sync_cancelled_detail"));
+            case VERIFY -> Optional.of(new CancelText(
+                    "screen.worldarchive.operation.verify_cancelling",
+                    "screen.worldarchive.operation.verify_cancelled",
+                    "screen.worldarchive.operation.verify_cancelled_detail"));
+            case RESTORE -> Optional.of(new CancelText(
+                    "screen.worldarchive.operation.restore_cancelling",
+                    "screen.worldarchive.operation.restore_cancelled",
+                    "screen.worldarchive.operation.restore_cancelled_detail"));
+            case DELETE -> Optional.empty();
+        };
     }
 
+    /** Starts the operation with a listener for its progress. */
     @FunctionalInterface
     interface OperationStarter<T> {
         CompletionStage<T> start(ProgressListener listener);
     }
 
-    @FunctionalInterface
-    private interface SuccessHandler<T> {
-        Presentation success(T result);
+    /** Lang keys for the button while cancelling, and for the cancelled headline and detail. */
+    private record CancelText(String cancelling, String cancelled, String detail) {
     }
 
-    private record Presentation(String headline, List<String> details, ChatFormatting color) {
+    /** What the screen shows: a colored headline and plain detail lines. */
+    private record Presentation(Component headline, List<Component> details) {
         private Presentation {
             Objects.requireNonNull(headline, "headline");
             details = List.copyOf(details);
-            Objects.requireNonNull(color, "color");
         }
 
-        private static Presentation running(String message) {
-            return new Presentation(message, List.of(), ChatFormatting.GRAY);
+        private static Presentation waiting(Component message) {
+            return new Presentation(message.copy().withStyle(ChatFormatting.GRAY), List.of());
+        }
+
+        private static Presentation finished(Component headline, ChatFormatting color, List<Component> details) {
+            return new Presentation(headline.copy().withStyle(color), details);
+        }
+
+        /** Engine text such as destination outcomes, shown as it is. */
+        private static List<Component> lines(List<String> text) {
+            return text.stream().<Component>map(Component::literal).toList();
         }
     }
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/BackupRestoreScreen.java b/src/client/java/dev/ishaanko/worldarchive/ui/BackupRestoreScreen.java
index 7901f39..a5f2a16 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/BackupRestoreScreen.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/BackupRestoreScreen.java
@@ -2,17 +2,15 @@
 
 import dev.ishaanko.worldarchive.core.RestoreBackupRequest;
 import dev.ishaanko.worldarchive.core.RestoreBackupResult;
-import dev.ishaanko.worldarchive.runtime.RunningGameVersion;
-import dev.ishaanko.worldarchive.ui.model.ConfirmationKind;
-import dev.ishaanko.worldarchive.ui.model.ConfirmationState;
+import dev.ishaanko.worldarchive.ui.model.BackupRow;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
 import dev.ishaanko.worldarchive.ui.model.GameVersionNotice;
 import dev.ishaanko.worldarchive.ui.model.RestoreChoice;
-import dev.ishaanko.worldarchive.ui.model.BackupRow;
+import dev.ishaanko.worldarchive.ui.model.RestoreName;
 import dev.ishaanko.worldarchive.ui.model.ScreenGeometry;
-import java.util.Locale;
+import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
-import java.util.Set;
 import net.minecraft.ChatFormatting;
 import net.minecraft.client.gui.components.Button;
 import net.minecraft.client.gui.components.EditBox;
@@ -20,14 +18,13 @@
 import net.minecraft.client.gui.components.StringWidget;
 import net.minecraft.client.gui.screens.Screen;
 import net.minecraft.network.chat.Component;
+import net.minecraft.network.chat.MutableComponent;
 
-/** Copy-only restore name and post-restore navigation choice. */
+/**
+ * Asks for the folder name of a restored world copy and what to do after the restore: show it in
+ * the world list, or play it. A restore never replaces the world the backup came from.
+ */
 final class BackupRestoreScreen extends Screen {
-    private static final Set<String> WINDOWS_RESERVED_NAMES = Set.of(
-            "CON", "PRN", "AUX", "NUL",
-            "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9",
-            "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9");
-
     private static final int CONTENT_MIN = 180;
 
     private static final int CONTENT_MAX = 430;
@@ -64,7 +61,7 @@ final class BackupRestoreScreen extends Screen {
         this.world = Objects.requireNonNull(world, "world");
         this.row = Objects.requireNonNull(row, "row");
         this.facade = Objects.requireNonNull(facade, "facade");
-        restoredName = defaultRestoredName(world);
+        restoredName = RestoreName.suggest(world.displayName(), world.storageName());
     }
 
     @Override
@@ -81,9 +78,7 @@ protected void init() {
                         "A new world copy will be created. The selected world is never replaced."));
         addRenderableOnly(explanation);
 
-        GameVersionNotice notice = GameVersionNotice.of(
-                row.gameVersion(),
-                RunningGameVersion.current());
+        GameVersionNotice notice = GameVersionNotice.of(row.gameVersion(), facade.runningGameVersion());
         MultiLineTextWidget versionNotice = paragraph(
                 contentX,
                 explanation.getY() + explanation.getHeight() + 6,
@@ -99,7 +94,7 @@ protected void init() {
                 contentWidth,
                 20,
                 Component.literal("Restored world name"));
-        nameBox.setMaxLength(255);
+        nameBox.setMaxLength(RestoreBackupRequest.MAXIMUM_NAME_LENGTH);
         nameBox.setValue(restoredName);
         nameBox.setHint(Component.literal("Restored world name"));
         nameBox.setResponder(value -> {
@@ -108,27 +103,15 @@ protected void init() {
         });
         addRenderableWidget(nameBox);
 
-        validationWidget = new StringWidget(
-                contentX,
-                nameTop + 23,
-                contentWidth,
-                18,
-                Component.empty(),
-                font);
+        validationWidget = new StringWidget(contentX, nameTop + 23, contentWidth, 18, Component.empty(), font);
         addRenderableOnly(validationWidget);
-        int buttonWidth = Math.max(50, (contentWidth - 6) / 3);
-        int buttonY = nameTop + 49;
-        selectButton = Button.builder(Component.literal("Restore"), ignored -> choose(RestoreChoice.SELECT))
-                .bounds(contentX, buttonY, buttonWidth, 20)
-                .build();
+        selectButton = Button.builder(Component.literal("Restore"), ignored -> choose(RestoreChoice.SELECT)).build();
+        playButton = Button.builder(Component.literal("Restore & Play"), ignored -> choose(RestoreChoice.PLAY)).build();
+        Button cancel = Button.builder(Component.literal("Cancel"), ignored -> onClose()).build();
+        Widgets.row(contentX, nameTop + 49, contentWidth, List.of(selectButton, playButton, cancel));
         addRenderableWidget(selectButton);
-        playButton = Button.builder(Component.literal("Restore & Play"), ignored -> choose(RestoreChoice.PLAY))
-                .bounds(contentX + buttonWidth + 3, buttonY, buttonWidth, 20)
-                .build();
         addRenderableWidget(playButton);
-        addRenderableWidget(Button.builder(Component.literal("Cancel"), ignored -> onClose())
-                .bounds(contentX + (buttonWidth + 3) * 2, buttonY, buttonWidth, 20)
-                .build());
+        addRenderableWidget(cancel);
         updateValidation();
         setInitialFocus(nameBox);
     }
@@ -150,105 +133,63 @@ private static ChatFormatting noticeStyle(GameVersionNotice notice) {
     }
 
     private void updateValidation() {
-        Optional<String> issue = validationIssue(restoredName);
-        boolean valid = issue.isEmpty();
-        if (selectButton != null) {
-            selectButton.active = valid;
-        }
-        if (playButton != null) {
-            playButton.active = valid;
-        }
-        if (validationWidget != null) {
-            validationWidget.setMessage(issue
-                    .<Component>map(value -> Component.literal(value).withStyle(ChatFormatting.RED))
-                    .orElseGet(() -> Component.literal("Restore returns to the world list")
-                            .withStyle(ChatFormatting.GRAY)));
-        }
-    }
-
-    private Optional<String> validationIssue(String candidate) {
-        String value = Objects.requireNonNull(candidate, "candidate");
-        if (value.isBlank()) {
-            return Optional.of("Enter a name for the restored copy");
-        }
-        if (value.endsWith(".") || value.endsWith(" ")) {
-            return Optional.of("The name cannot end with a dot or space");
-        }
-        if (value.chars().anyMatch(character -> "<>:\"/\\|?*".indexOf(character) >= 0)) {
-            return Optional.of("The name contains a character that is unsafe in a folder name");
-        }
-        String baseName = value.split("\\.", 2)[0].toUpperCase(Locale.ROOT);
-        if (WINDOWS_RESERVED_NAMES.contains(baseName)) {
-            return Optional.of("That name is reserved by Windows");
-        }
-        if (value.equalsIgnoreCase(world.storageName()) || !world.isDifferentRestoreDirectory(value)) {
-            return Optional.of("Choose a different name; restores never replace the selected world");
-        }
-        try {
-            new RestoreBackupRequest(row.backupId(), world.worldsDirectory(), value);
-        } catch (IllegalArgumentException exception) {
-            return Optional.of("The restored world name is not safe");
-        }
-        return Optional.empty();
+        Optional<RestoreName.Problem> problem = RestoreName.check(restoredName, world.storageName());
+        selectButton.active = problem.isEmpty();
+        playButton.active = problem.isEmpty();
+        validationWidget.setMessage(problem
+                .map(value -> message(value).withStyle(ChatFormatting.RED))
+                .orElseGet(() -> Component.literal("Restore returns to the world list")
+                        .withStyle(ChatFormatting.GRAY)));
     }
 
     private void choose(RestoreChoice choice) {
-        if (validationIssue(restoredName).isPresent()) {
-            updateValidation();
+        if (RestoreName.check(restoredName, world.storageName()).isPresent()) {
             return;
         }
-        String chosenName = restoredName;
-        ConfirmationState confirmation = new ConfirmationState(
-                ConfirmationKind.RESTORE,
+        RestoreBackupRequest request = new RestoreBackupRequest(
                 row.backupId(),
-                "Restore backup?",
-                "Create a new world named \"" + chosenName + "\"? If that name is taken, the next free name is used.",
-                Optional.of(choice),
-                false);
-        minecraft.setScreenAndShow(new BackupConfirmationScreen(this, confirmation, () -> {
-            RestoreBackupRequest request = new RestoreBackupRequest(
-                    row.backupId(),
-                    world.worldsDirectory(),
-                    chosenName);
-            minecraft.setScreenAndShow(BackupOperationScreen.restore(
-                    parent,
-                    "Restoring backup",
-                    listener -> facade.backupService().restoreBackup(request, listener),
-                    result -> finishRestore(choice, result)));
-        }));
+                world.worldsDirectory(),
+                restoredName);
+        MutableComponent prompt = Component.literal("Create a new world named \"" + restoredName
+                + "\"? If that name is taken, the next free name is used.");
+        if (minecraft.level != null || minecraft.hasSingleplayerServer()) {
+            // The runtime leaves the running world before it shows or opens the restored copy.
+            prompt.append("\n").append(Component.translatable("screen.worldarchive.restore.leaves_world"));
+        }
+        minecraft.setScreenAndShow(new BackupConfirmationScreen(
+                this,
+                Component.literal("Restore backup?"),
+                prompt,
+                Component.literal("Restore"),
+                () -> minecraft.setScreenAndShow(BackupOperationScreen.restore(
+                        parent,
+                        "Restoring backup",
+                        listener -> facade.backupService().restoreBackup(request, listener),
+                        result -> finishRestore(choice, result)))));
     }
 
     private void finishRestore(RestoreChoice choice, RestoreBackupResult result) {
-        switch (choice) {
-            case SELECT -> facade.selectRestoredWorld(selectWorldParent, result);
-            case PLAY -> facade.playRestoredWorld(selectWorldParent, result);
-            default -> throw new IllegalStateException("Unknown restore choice: " + choice);
-        }
+        Runnable next = switch (choice) {
+            case SELECT -> () -> facade.selectRestoredWorld(selectWorldParent, result);
+            case PLAY -> () -> facade.playRestoredWorld(selectWorldParent, result);
+        };
+        next.run();
+    }
+
+    private static MutableComponent message(RestoreName.Problem problem) {
+        return switch (problem) {
+            case BLANK -> Component.literal("Enter a name for the restored copy");
+            case TOO_LONG -> Component.translatable("screen.worldarchive.restore.name_too_long");
+            case ENDS_WITH_DOT_OR_SPACE -> Component.literal("The name cannot end with a dot or space");
+            case UNSAFE_CHARACTER -> Component.literal("The name contains a character that is unsafe in a folder name");
+            case RESERVED_BY_WINDOWS -> Component.literal("That name is reserved by Windows");
+            case SAME_AS_ORIGINAL -> Component.literal(
+                    "Choose a different name; restores never replace the selected world");
+        };
     }
 
     @Override
     public void onClose() {
         minecraft.setScreenAndShow(parent);
     }
-
-    private static String defaultRestoredName(BackupWorldContext world) {
-        String value = (world.displayName() + " - Restored")
-                .replaceAll("[<>:\"/\\\\|?*]", "_")
-                .replaceAll("[. ]+$", "")
-                .strip();
-        if (value.isBlank()) {
-            value = "Restored World";
-        }
-        if (value.equalsIgnoreCase(world.storageName())) {
-            value += " Copy";
-        }
-        if (value.length() > 255) {
-            value = value.substring(0, 255).replaceAll("[. ]+$", "");
-        }
-        if (value.equalsIgnoreCase(world.storageName())) {
-            String suffix = " Copy";
-            value = value.substring(0, Math.min(value.length(), 255 - suffix.length())) + suffix;
-        }
-        return value;
-    }
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/BackupRowButton.java b/src/client/java/dev/ishaanko/worldarchive/ui/BackupRowButton.java
index fe1f95d..074dcba 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/BackupRowButton.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/BackupRowButton.java
@@ -1,49 +1,36 @@
 package dev.ishaanko.worldarchive.ui;
 
 import dev.ishaanko.worldarchive.ui.model.BackupRow;
-import java.time.ZoneId;
-import java.time.format.DateTimeFormatter;
-import java.time.format.FormatStyle;
-import java.util.Locale;
 import java.util.Objects;
 import java.util.function.BiConsumer;
-import net.minecraft.client.Minecraft;
 import net.minecraft.client.gui.Font;
 import net.minecraft.client.gui.GuiGraphicsExtractor;
 import net.minecraft.client.gui.components.AbstractButton;
 import net.minecraft.client.gui.components.Tooltip;
 import net.minecraft.client.gui.narration.NarrationElementOutput;
-import net.minecraft.client.gui.screens.inventory.tooltip.ClientTooltipPositioner;
 import net.minecraft.client.input.InputWithModifiers;
 import net.minecraft.network.chat.Component;
-import org.joml.Vector2i;
-import org.joml.Vector2ic;
 
-/** Two-line vanilla button used for a dense but readable backup-browser row. */
+/**
+ * A two-line button for one backup-browser row. The browser builds its rows again on every layout
+ * pass, so the button lays out its text once, when it is built.
+ */
 final class BackupRowButton extends AbstractButton {
-    private static final DateTimeFormatter DATE_FORMAT = DateTimeFormatter
-            .ofLocalizedDateTime(FormatStyle.SHORT)
-            .withLocale(Locale.getDefault())
-            .withZone(ZoneId.systemDefault());
-
     private static final int PRIMARY_TEXT_COLOR = 0xFFFFFFFF;
 
     private static final int SECONDARY_TEXT_COLOR = 0xFFA0A0A0;
 
-    private static final int TOOLTIP_MARGIN = 4;
-
-    private static final int TOOLTIP_OFFSET = 12;
-
-    private static final ClientTooltipPositioner BOUNDED_TOOLTIP_POSITIONER =
-            BackupRowButton::boundedTooltipPosition;
+    private static final int TEXT_INSET = 5;
 
     private final BackupRow row;
 
     private final Font font;
 
-    private final BiConsumer<BackupRow, InputWithModifiers> onSelected;
+    private final BiConsumer<BackupRow, InputWithModifiers> clicked;
 
-    private final Tooltip detailsTooltip;
+    private final String title;
+
+    private final String details;
 
     private boolean selected;
 
@@ -54,14 +41,19 @@ final class BackupRowButton extends AbstractButton {
             int height,
             BackupRow row,
             Font font,
-            BiConsumer<BackupRow, InputWithModifiers> onSelected) {
-        super(x, y, width, height, narration(row));
+            BiConsumer<BackupRow, InputWithModifiers> clicked) {
+        super(x, y, width, height, Component.empty());
         this.row = Objects.requireNonNull(row, "row");
         this.font = Objects.requireNonNull(font, "font");
-        this.onSelected = Objects.requireNonNull(onSelected, "onSelected");
-        detailsTooltip = Tooltip.create(Component.literal(tooltip(row)));
+        this.clicked = Objects.requireNonNull(clicked, "clicked");
+        String fullTitle = BackupRowText.title(row);
+        String fullDetails = BackupRowText.details(row);
+        int textWidth = Math.max(1, width - TEXT_INSET * 2);
+        title = clip(font, fullTitle, textWidth);
+        details = clip(font, fullDetails, textWidth);
+        setMessage(Component.literal(fullTitle + ". " + fullDetails));
+        setTooltip(Tooltip.create(BackupRowText.tooltip(row)));
         setOverrideRenderHighlightedSprite(() -> selected);
-        setTooltip(detailsTooltip);
     }
 
     void setSelected(boolean selected) {
@@ -71,7 +63,7 @@ void setSelected(boolean selected) {
     /** Passes the click modifiers along so the browser can extend or toggle the selection. */
     @Override
     public void onPress(InputWithModifiers input) {
-        onSelected.accept(row, input);
+        clicked.accept(row, input);
     }
 
     @Override
@@ -81,60 +73,8 @@ protected void extractContents(
             int mouseY,
             float partialTick) {
         extractDefaultSprite(graphics);
-        int textWidth = Math.max(1, getWidth() - 10);
-        graphics.text(
-                font,
-                clip(primaryLine(row), textWidth),
-                getX() + 5,
-                getY() + 6,
-                PRIMARY_TEXT_COLOR);
-        graphics.text(
-                font,
-                clip(detailLine(row), textWidth),
-                getX() + 5,
-                getY() + 20,
-                SECONDARY_TEXT_COLOR);
-    }
-
-    @Override
-    protected void extractTooltipForNextRenderPass(
-            GuiGraphicsExtractor graphics,
-            int mouseX,
-            int mouseY) {
-        Minecraft minecraft = Minecraft.getInstance();
-        boolean hovered = isHovered();
-        boolean keyboardFocused = isFocused() && minecraft.getLastInputType().isKeyboard();
-        if (!hovered && !keyboardFocused) {
-            return;
-        }
-        int anchorX = hovered ? mouseX : getX() + getWidth() / 2;
-        int anchorY = hovered ? mouseY : getBottom();
-        graphics.setTooltipForNextFrame(
-                font,
-                detailsTooltip.toCharSequence(minecraft),
-                BOUNDED_TOOLTIP_POSITIONER,
-                anchorX,
-                anchorY,
-                keyboardFocused);
-    }
-
-    static Vector2ic boundedTooltipPosition(
-            int screenWidth,
-            int screenHeight,
-            int anchorX,
-            int anchorY,
-            int tooltipWidth,
-            int tooltipHeight) {
-        int maximumX = Math.max(TOOLTIP_MARGIN, screenWidth - tooltipWidth - TOOLTIP_MARGIN);
-        int x = Math.clamp(anchorX + TOOLTIP_OFFSET, TOOLTIP_MARGIN, maximumX);
-        int below = anchorY + TOOLTIP_OFFSET;
-        int above = anchorY - TOOLTIP_OFFSET - tooltipHeight;
-        int preferredY = below + tooltipHeight <= screenHeight - TOOLTIP_MARGIN
-                ? below
-                : above;
-        int maximumY = Math.max(TOOLTIP_MARGIN, screenHeight - tooltipHeight - TOOLTIP_MARGIN);
-        int y = Math.clamp(preferredY, TOOLTIP_MARGIN, maximumY);
-        return new Vector2i(x, y);
+        graphics.text(font, title, getX() + TEXT_INSET, getY() + 6, PRIMARY_TEXT_COLOR);
+        graphics.text(font, details, getX() + TEXT_INSET, getY() + 20, SECONDARY_TEXT_COLOR);
     }
 
     @Override
@@ -142,86 +82,11 @@ protected void updateWidgetNarration(NarrationElementOutput output) {
         defaultButtonNarrationText(output);
     }
 
-    private String clip(String text, int maximumWidth) {
+    private static String clip(Font font, String text, int maximumWidth) {
         if (font.width(text) <= maximumWidth) {
             return text;
         }
         String ellipsis = "…";
         return font.plainSubstrByWidth(text, Math.max(1, maximumWidth - font.width(ellipsis))) + ellipsis;
     }
-
-    private static Component narration(BackupRow row) {
-        return Component.literal(primaryLine(row) + ". " + detailLine(row));
-    }
-
-    /** One-line identity used by the row, its tooltip, and the multi-delete confirmation. */
-    static String primaryLine(BackupRow row) {
-        String label = row.label().map(value -> " — " + value).orElse("");
-        return DATE_FORMAT.format(row.createdAt()) + label + " · " + trigger(row);
-    }
-
-    private static String detailLine(BackupRow row) {
-        String remote = remote(row);
-        return storedIn(row)
-                + (remote.isEmpty() ? "" : " | " + remote)
-                + " | " + size(row.logicalSizeBytes());
-    }
-
-    private static String tooltip(BackupRow row) {
-        return primaryLine(row)
-                + "\n" + storedIn(row)
-                + (remote(row).isEmpty() ? "" : "\n" + remote(row))
-                + "\nSize: " + size(row.logicalSizeBytes())
-                + "\nBackup ID: " + row.backupId();
-    }
-
-    private static String trigger(BackupRow row) {
-        return switch (row.trigger()) {
-            case MANUAL -> "Manual";
-            case WORLD_EXIT -> "World exit";
-            case SCHEDULED -> "Scheduled";
-            default -> throw new IllegalStateException("Unknown backup trigger: " + row.trigger());
-        };
-    }
-
-    private static String storedIn(BackupRow row) {
-        boolean git = row.git().durable();
-        boolean zip = row.zip().durable();
-        if (git && zip) {
-            return "Saved in Git and ZIP";
-        }
-        if (git) {
-            return "Saved in Git";
-        }
-        if (zip) {
-            return "Saved as ZIP";
-        }
-        return "Backup unavailable";
-    }
-
-    private static String remote(BackupRow row) {
-        return switch (row.remoteSyncStatus()) {
-            case SYNCED -> "GitHub synced";
-            case PENDING -> "GitHub sync pending";
-            case FAILED -> "GitHub sync failed";
-            case NOT_SYNCED -> "GitHub not synced";
-            case NOT_CONFIGURED -> "";
-            default -> throw new IllegalStateException(
-                    "Unknown remote status: " + row.remoteSyncStatus());
-        };
-    }
-
-    private static String size(long bytes) {
-        if (bytes < 1_024) {
-            return bytes + " B";
-        }
-        double value = bytes;
-        String[] units = {"B", "KiB", "MiB", "GiB", "TiB"};
-        int unit = 0;
-        while (value >= 1_024 && unit < units.length - 1) {
-            value /= 1_024;
-            unit++;
-        }
-        return String.format(Locale.ROOT, "%.1f %s", value, units[unit]);
-    }
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/BackupRowText.java b/src/client/java/dev/ishaanko/worldarchive/ui/BackupRowText.java
new file mode 100644
index 0000000..b95473c
--- /dev/null
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/BackupRowText.java
@@ -0,0 +1,87 @@
+package dev.ishaanko.worldarchive.ui;
+
+import dev.ishaanko.worldarchive.ui.model.BackupRow;
+import dev.ishaanko.worldarchive.ui.model.BackupText;
+import java.util.Optional;
+import net.minecraft.network.chat.Component;
+
+/**
+ * The text of one backup row: its title, its detail line, its tooltip, and its line in a delete
+ * prompt. Every screen that names a backup row uses this, so the names match the browser.
+ */
+final class BackupRowText {
+    private BackupRowText() {
+    }
+
+    /** Date, label and trigger, such as {@code 9/22/26, 3:41 PM · Before the dragon · Manual}. */
+    static String title(BackupRow row) {
+        return BackupText.name(row) + BackupText.SEPARATOR + trigger(row);
+    }
+
+    /** Where the backup is saved, the state of its remote copy, and its size. */
+    static String details(BackupRow row) {
+        String stored = remote(row).map(remote -> storedIn(row) + " | " + remote).orElse(storedIn(row));
+        return stored + " | " + BackupText.bytes(row.logicalSizeBytes());
+    }
+
+    static Component tooltip(BackupRow row) {
+        StringBuilder text = new StringBuilder(title(row)).append('\n').append(storedIn(row));
+        remote(row).ifPresent(remote -> text.append('\n').append(remote));
+        text.append("\nSize: ").append(BackupText.bytes(row.logicalSizeBytes()));
+        text.append("\nBackup ID: ").append(row.backupId());
+        return Component.literal(text.toString());
+    }
+
+    /** The row as one line of a delete prompt: its title and which copies it has. */
+    static String promptLine(BackupRow row) {
+        return title(row) + BackupText.SEPARATOR + text(copies(row));
+    }
+
+    private static String trigger(BackupRow row) {
+        return switch (row.trigger()) {
+            case MANUAL -> "Manual";
+            case WORLD_EXIT -> "World exit";
+            case SCHEDULED -> "Scheduled";
+        };
+    }
+
+    private static String storedIn(BackupRow row) {
+        boolean git = row.git().durable();
+        boolean zip = row.zip().durable();
+        if (git && zip) {
+            return "Saved in Git and ZIP";
+        }
+        if (git) {
+            return "Saved in Git";
+        }
+        return zip ? "Saved as ZIP" : "Backup unavailable";
+    }
+
+    private static String copies(BackupRow row) {
+        if (row.git().durable() && row.zip().durable()) {
+            return "screen.worldarchive.row.copies_git_and_zip";
+        }
+        if (row.git().durable()) {
+            return "screen.worldarchive.row.copies_git";
+        }
+        return row.zip().durable() ? "screen.worldarchive.row.copies_zip" : "screen.worldarchive.row.copies_none";
+    }
+
+    /** The state of the Git copy on the remote; empty when there is no Git copy or no remote. */
+    private static Optional<String> remote(BackupRow row) {
+        if (!row.git().durable()) {
+            return Optional.empty();
+        }
+        return switch (row.git().syncStatus()) {
+            case SYNCED -> Optional.of(text("screen.worldarchive.row.remote_synced"));
+            case PENDING -> Optional.of(text("screen.worldarchive.row.remote_pending"));
+            case FAILED -> Optional.of(text("screen.worldarchive.row.remote_failed"));
+            case NOT_SYNCED -> Optional.of(text("screen.worldarchive.row.remote_not_synced"));
+            case NOT_CONFIGURED -> Optional.empty();
+        };
+    }
+
+    private static String text(String key) {
+        return Component.translatable(key).getString();
+    }
+}
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/BackupWorldContext.java b/src/client/java/dev/ishaanko/worldarchive/ui/BackupWorldContext.java
deleted file mode 100644
index a9d06cf..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/ui/BackupWorldContext.java
+++ /dev/null
@@ -1,48 +0,0 @@
-package dev.ishaanko.worldarchive.ui;
-
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.nio.file.Path;
-import java.util.Objects;
-
-/** Persistent identity and filesystem context for one backup browser. */
-public record BackupWorldContext(
-        WorldId worldId,
-        Path worldDirectory,
-        Path worldsDirectory,
-        String storageName,
-        String displayName) {
-    public BackupWorldContext {
-        Objects.requireNonNull(worldId, "worldId");
-        BackupWorldSelection selection = new BackupWorldSelection(
-                worldDirectory,
-                worldsDirectory,
-                storageName,
-                displayName);
-        worldDirectory = selection.worldDirectory();
-        worldsDirectory = selection.worldsDirectory();
-        storageName = selection.storageName();
-        displayName = selection.displayName();
-    }
-
-    public BackupWorldContext(WorldId worldId, BackupWorldSelection selection) {
-        this(
-                worldId,
-                Objects.requireNonNull(selection, "selection").worldDirectory(),
-                selection.worldsDirectory(),
-                selection.storageName(),
-                selection.displayName());
-    }
-
-    /** Guards UI restore requests from ever resolving to the selected live world directory. */
-    public boolean isDifferentRestoreDirectory(String restoredWorldName) {
-        Objects.requireNonNull(restoredWorldName, "restoredWorldName");
-        return !worldDirectory.equals(worldsDirectory.resolve(restoredWorldName).toAbsolutePath().normalize());
-    }
-
-    public boolean matches(BackupWorldSelection selection) {
-        Objects.requireNonNull(selection, "selection");
-        return worldDirectory.equals(selection.worldDirectory())
-                && worldsDirectory.equals(selection.worldsDirectory())
-                && storageName.equals(selection.storageName());
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/BackupWorldSelection.java b/src/client/java/dev/ishaanko/worldarchive/ui/BackupWorldSelection.java
deleted file mode 100644
index 4737512..0000000
--- a/src/client/java/dev/ishaanko/worldarchive/ui/BackupWorldSelection.java
+++ /dev/null
@@ -1,39 +0,0 @@
-package dev.ishaanko.worldarchive.ui;
-
-import java.nio.file.Path;
-import java.util.Objects;
-
-/** A validated Select World entry before WorldArchive resolves its persistent world identity. */
-public record BackupWorldSelection(
-        Path worldDirectory,
-        Path worldsDirectory,
-        String storageName,
-        String displayName) {
-    public BackupWorldSelection {
-        worldDirectory = normalize(worldDirectory, "worldDirectory");
-        worldsDirectory = normalize(worldsDirectory, "worldsDirectory");
-        storageName = requireText(storageName, "storageName");
-        displayName = requireText(displayName, "displayName");
-        if (!worldsDirectory.equals(worldDirectory.getParent())) {
-            throw new IllegalArgumentException("The selected world must be a direct child of the worlds directory");
-        }
-        Path fileName = worldDirectory.getFileName();
-        if (fileName == null || !storageName.equals(fileName.toString())) {
-            throw new IllegalArgumentException("The storage name does not match the selected world directory");
-        }
-    }
-
-    private static Path normalize(Path path, String name) {
-        return Objects.requireNonNull(path, name).toAbsolutePath().normalize();
-    }
-
-    private static String requireText(String value, String name) {
-        Objects.requireNonNull(value, name);
-        if (value.isBlank()
-                || value.length() > 255
-                || value.chars().anyMatch(character -> Character.isISOControl(character))) {
-            throw new IllegalArgumentException(name + " is blank, too long, or contains control characters");
-        }
-        return value;
-    }
-}
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/BackupWorldsScreen.java b/src/client/java/dev/ishaanko/worldarchive/ui/BackupWorldsScreen.java
index f8d5812..78dda06 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/BackupWorldsScreen.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/BackupWorldsScreen.java
@@ -1,10 +1,14 @@
 package dev.ishaanko.worldarchive.ui;
 
-import dev.ishaanko.worldarchive.settings.ClientSettingsAccess;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldEntry;
+import dev.ishaanko.worldarchive.ui.model.Paging;
 import dev.ishaanko.worldarchive.ui.model.ScreenGeometry;
+import java.util.ArrayList;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Objects;
-import java.util.HashSet;
 import java.util.Set;
 import net.minecraft.ChatFormatting;
 import net.minecraft.client.gui.components.Button;
@@ -13,7 +17,10 @@
 import net.minecraft.client.gui.screens.Screen;
 import net.minecraft.network.chat.Component;
 
-/** Recovery-aware chooser containing both live saves and catalog-only archived worlds. */
+/**
+ * The worlds that have backups: live saves, and archived worlds whose save is gone. A world whose
+ * backups use too much space is marked for a storage review.
+ */
 public final class BackupWorldsScreen extends Screen {
     private static final int ROW_HEIGHT = 24;
 
@@ -23,22 +30,29 @@ public final class BackupWorldsScreen extends Screen {
 
     private static final int CONTENT_MARGIN = 20;
 
+    private static final int MAXIMUM_FOOTER_BUTTON_WIDTH = 82;
+
     private final Screen parent;
 
     private final BackupClientFacade facade;
 
-    private List<BackupWorldEntry> worlds = List.of();
+    private final ScreenCalls loads = new ScreenCalls(this);
 
-    private final Set<dev.ishaanko.worldarchive.model.WorldId> storageReviews =
-            new HashSet<>();
+    private final ScreenCalls notices = new ScreenCalls(this);
 
-    private Component status = Component.literal("Loading worlds...").withStyle(ChatFormatting.GRAY);
+    /**
+     * Worlds whose storage notice this screen has claimed. A claim scans the world's storage, so
+     * the screen claims each world once, not on every return from another screen.
+     */
+    private final Set<WorldId> claimed = new HashSet<>();
 
-    private boolean loading = true;
+    private final Set<WorldId> storageReviews = new HashSet<>();
 
-    private boolean active;
+    private List<BackupWorldEntry> worlds = List.of();
 
-    private long lifecycle;
+    private Component status = Component.literal("Loading worlds...").withStyle(ChatFormatting.GRAY);
+
+    private boolean loading = true;
 
     private int page;
 
@@ -51,16 +65,15 @@ public BackupWorldsScreen(Screen parent, BackupClientFacade facade) {
     @Override
     public void added() {
         super.added();
-        active = true;
-        lifecycle++;
-        loadWorlds();
-    }
-
-    @Override
-    public void removed() {
-        active = false;
-        lifecycle++;
-        super.removed();
+        loading = true;
+        loads.dropPending();
+        loads.start(facade::backupWorlds, this::showWorlds, failure -> {
+            // Unreadable settings, for one, say why and that Settings can fix or reset them.
+            loading = false;
+            worlds = List.of();
+            status = FailureMessages.status(failure);
+            rebuildWidgets();
+        });
     }
 
     @Override
@@ -68,131 +81,94 @@ protected void init() {
         int contentWidth = ScreenGeometry.contentWidth(width, CONTENT_MIN, CONTENT_MAX, CONTENT_MARGIN);
         int x = ScreenGeometry.centerX(width, contentWidth);
         addRenderableOnly(Widgets.title(font, x, 12, contentWidth, 20, title));
-        int pageSize = Math.max(1, Math.min(8, (height - 116) / ROW_HEIGHT));
-        int pageCount = Math.max(1, (worlds.size() + pageSize - 1) / pageSize);
-        page = Math.min(page, pageCount - 1);
+        Paging paging = Paging.of(worlds.size(), Math.min(8, (height - 116) / ROW_HEIGHT), page);
+        page = paging.pageIndex();
         if (worlds.isEmpty()) {
             addRenderableOnly(new MultiLineTextWidget(x, 54, status, font)
                     .setMaxWidth(contentWidth)
                     .setMaxRows(4));
-        } else {
-            addWorldButtons(pageSize, x, contentWidth);
         }
-        addFooter(x, contentWidth, pageCount);
+        int y = 38;
+        for (BackupWorldEntry entry : paging.slice(worlds)) {
+            addRenderableWidget(worldButton(entry, x, y, contentWidth));
+            y += ROW_HEIGHT;
+        }
+        addFooter(x, contentWidth, paging);
     }
 
-    private void loadWorlds() {
-        long token = lifecycle;
-        loading = true;
-        facade.backupWorlds().whenComplete((loaded, throwable) -> minecraft.execute(() -> {
-            if (!active || token != lifecycle) {
-                return;
-            }
-            loading = false;
-            if (throwable != null || loaded == null) {
-                worlds = List.of();
-                status = Component.literal("Backup worlds could not be loaded")
-                        .withStyle(ChatFormatting.RED);
-            } else {
-                worlds = List.copyOf(loaded);
-                status = worlds.isEmpty()
-                        ? Component.literal("No live or archived backup worlds were found")
-                                .withStyle(ChatFormatting.GRAY)
-                        : Component.empty();
+    private void showWorlds(List<BackupWorldEntry> loaded) {
+        loading = false;
+        worlds = List.copyOf(loaded);
+        status = worlds.isEmpty()
+                ? Component.literal("No live or archived backup worlds were found").withStyle(ChatFormatting.GRAY)
+                : Component.empty();
+        page = 0;
+        rebuildWidgets();
+        for (BackupWorldEntry entry : worlds) {
+            WorldId worldId = entry.context().worldId();
+            if (claimed.add(worldId)) {
+                // A notice that arrives while another screen is open is kept for the next showing.
+                notices.start(
+                        () -> facade.claimStorageReviewNotice(worldId),
+                        recommended -> {
+                            if (keepNotice(worldId, recommended)) {
+                                rebuildWidgets();
+                            }
+                        },
+                        ignored -> {
+                        },
+                        recommended -> keepNotice(worldId, recommended));
             }
-            page = 0;
-            rebuildWidgets();
-            loadStorageNotices(token);
-        }));
+        }
     }
 
-    private void loadStorageNotices(long token) {
-        storageReviews.clear();
-        for (BackupWorldEntry entry : worlds) {
-            facade.claimStorageReviewNotice(entry.context().worldId())
-                    .whenComplete((recommended, throwable) -> minecraft.execute(() -> {
-                        if (!active || token != lifecycle) {
-                            return;
-                        }
-                        if (throwable == null && Boolean.TRUE.equals(recommended)) {
-                            storageReviews.add(entry.context().worldId());
-                            rebuildWidgets();
-                        }
-                    }));
-        }
+    /** Records a recommended storage review; true when the world was not marked before. */
+    private boolean keepNotice(WorldId worldId, boolean recommended) {
+        return recommended && storageReviews.add(worldId);
     }
 
-    private void addWorldButtons(int pageSize, int x, int contentWidth) {
-        int first = page * pageSize;
-        int limit = Math.min(worlds.size(), first + pageSize);
-        int y = 38;
-        for (int index = first; index < limit; index++) {
-            BackupWorldEntry entry = worlds.get(index);
-            String prefix = entry.recoveryOnly() ? "Archived: " : "";
-            String label = prefix + entry.context().displayName() + "  ["
-                    + entry.context().worldId().displayCode() + "]  "
-                    + entry.backupCount() + " backup(s)"
-                    + (storageReviews.contains(entry.context().worldId())
-                            ? "  · Storage review"
-                            : "");
-            Button open = Button.builder(
-                            Component.literal(label),
-                            ignored -> minecraft.setScreenAndShow(new BackupBrowserScreen(
-                                    this, entry.context(), facade)))
-                    .bounds(x, y, contentWidth, 20)
-                    .build();
-            String tooltip = entry.recoveryOnly()
-                    ? "The original save is missing. Restore and delete remain available."
-                    : entry.context().worldDirectory().toString();
-            if (storageReviews.contains(entry.context().worldId())) {
-                tooltip += "\nManaged storage is near or above this world's budget.";
-            }
-            open.setTooltip(Tooltip.create(Component.literal(tooltip)));
-            addRenderableWidget(open);
-            y += ROW_HEIGHT;
+    private Button worldButton(BackupWorldEntry entry, int x, int y, int contentWidth) {
+        BackupWorldContext world = entry.context();
+        boolean review = storageReviews.contains(world.worldId());
+        String label = (entry.recoveryOnly() ? "Archived: " : "")
+                + world.displayName() + "  [" + world.worldId().displayCode() + "]  "
+                + entry.backupCount() + " backup(s)"
+                + (review ? "  · Storage review" : "");
+        String tooltip = entry.recoveryOnly()
+                ? "The original save is missing. Restore and delete remain available."
+                : world.worldDirectory().toString();
+        if (review) {
+            tooltip += "\nManaged storage is near or above this world's budget.";
         }
+        Button open = Button.builder(
+                        Component.literal(label),
+                        ignored -> minecraft.setScreenAndShow(new BackupBrowserScreen(this, world, facade)))
+                .bounds(x, y, contentWidth, 20)
+                .build();
+        open.setTooltip(Tooltip.create(Component.literal(tooltip)));
+        return open;
     }
 
-    private void addFooter(int x, int contentWidth, int pageCount) {
-        int y = height - 28;
-        int buttonWidth = Math.min(82, (contentWidth - 16) / 5);
-        int totalWidth = buttonWidth * 5 + 16;
-        int buttonX = x + (contentWidth - totalWidth) / 2;
-        Button previous = Button.builder(Component.literal("<"), ignored -> {
-                    page--;
-                    rebuildWidgets();
-                })
-                .bounds(buttonX, y, buttonWidth, 20)
-                .build();
-        previous.active = page > 0 && !loading;
-        addRenderableWidget(previous);
-        Button next = Button.builder(Component.literal(">"), ignored -> {
-                    page++;
-                    rebuildWidgets();
-                })
-                .bounds(buttonX + buttonWidth + 4, y, buttonWidth, 20)
-                .build();
-        next.active = page + 1 < pageCount && !loading;
-        addRenderableWidget(next);
-        addRenderableWidget(Button.builder(
+    private void addFooter(int x, int contentWidth, Paging paging) {
+        List<Button> buttons = new ArrayList<>(Widgets.pageButtons(paging, index -> {
+            page = index;
+            rebuildWidgets();
+        }));
+        buttons.forEach(button -> button.active &= !loading);
+        buttons.add(Button.builder(
                         Component.literal("Import"),
-                        ignored -> openImport())
-                .bounds(buttonX + (buttonWidth + 4) * 2, y, buttonWidth, 20)
+                        ignored -> minecraft.setScreenAndShow(new BackupImportScreen(this, facade)))
                 .build());
-        addRenderableWidget(Button.builder(
+        buttons.add(Button.builder(
                         Component.translatable("screen.worldarchive.worlds.settings"),
-                        ignored -> minecraft.setScreenAndShow(ClientSettingsAccess.createScreen(this)))
-                .bounds(buttonX + (buttonWidth + 4) * 3, y, buttonWidth, 20)
+                        ignored -> facade.openSettings(this))
                 .build());
-        addRenderableWidget(Button.builder(
-                        Component.translatable("screen.worldarchive.worlds.done"),
-                        ignored -> onClose())
-                .bounds(buttonX + (buttonWidth + 4) * 4, y, buttonWidth, 20)
+        buttons.add(Button.builder(Component.translatable("screen.worldarchive.worlds.done"), ignored -> onClose())
                 .build());
-    }
-
-    private void openImport() {
-        minecraft.setScreenAndShow(new BackupImportScreen(this, facade));
+        int buttonWidth = Math.min(MAXIMUM_FOOTER_BUTTON_WIDTH, (contentWidth - Widgets.GAP * 4) / 5);
+        int rowWidth = buttonWidth * 5 + Widgets.GAP * 4;
+        Widgets.row(x + (contentWidth - rowWidth) / 2, height - 28, rowWidth, buttons);
+        buttons.forEach(this::addRenderableWidget);
     }
 
     @Override
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/CleanupConfirmationScreen.java b/src/client/java/dev/ishaanko/worldarchive/ui/CleanupConfirmationScreen.java
index 502736c..9de01e8 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/CleanupConfirmationScreen.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/CleanupConfirmationScreen.java
@@ -4,7 +4,10 @@
 import dev.ishaanko.worldarchive.storage.management.CleanupItem;
 import dev.ishaanko.worldarchive.storage.management.CleanupPlan;
 import dev.ishaanko.worldarchive.storage.management.CleanupRequest;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
+import dev.ishaanko.worldarchive.ui.model.Paging;
 import dev.ishaanko.worldarchive.ui.model.ScreenGeometry;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.Objects;
 import java.util.Set;
@@ -15,8 +18,13 @@
 import net.minecraft.client.gui.screens.Screen;
 import net.minecraft.network.chat.Component;
 
-/** Final explicit confirmation repeating every selected destructive action. */
+/**
+ * The final confirmation before a cleanup deletes anything. It lists every selected backup with
+ * the same text as the preview, and deletes only after the player checks that they reviewed them.
+ */
 final class CleanupConfirmationScreen extends Screen {
+    private static final int ROW_HEIGHT = 24;
+
     private static final int CONTENT_MIN = 240;
 
     private static final int CONTENT_MAX = 440;
@@ -37,12 +45,12 @@ final class CleanupConfirmationScreen extends Screen {
 
     private final List<CleanupItem> items;
 
+    private final ScreenCalls calls = new ScreenCalls(this);
+
     private boolean acknowledged;
 
     private boolean busy;
 
-    private boolean active;
-
     private int page;
 
     CleanupConfirmationScreen(
@@ -58,15 +66,14 @@ final class CleanupConfirmationScreen extends Screen {
         this.world = Objects.requireNonNull(world, "world");
         this.facade = Objects.requireNonNull(facade, "facade");
         this.plan = Objects.requireNonNull(plan, "plan");
-        this.selected = Set.copyOf(Objects.requireNonNull(selected, "selected"));
+        this.selected = Set.copyOf(selected);
         items = plan.items().stream()
-                .filter(item -> selected.contains(item.backupId()))
+                .filter(item -> this.selected.contains(item.backupId()))
                 .toList();
     }
 
     @Override
     protected void init() {
-        active = true;
         int contentWidth = ScreenGeometry.contentWidth(width, CONTENT_MIN, CONTENT_MAX, CONTENT_MARGIN);
         int x = ScreenGeometry.centerX(width, contentWidth);
         addRenderableOnly(Widgets.title(font, x, 9, contentWidth, 20, title));
@@ -75,112 +82,57 @@ protected void init() {
                 31,
                 contentWidth,
                 18,
-                Component.literal(
-                                "These backups will be deleted from this computer. This cannot be undone.")
+                Component.literal("These backups will be deleted from this computer. This cannot be undone.")
                         .withStyle(ChatFormatting.RED),
                 font));
-        int pageSize = Math.max(1, Math.min(6, (height - 142) / 24));
-        int pageCount = Math.max(1, (items.size() + pageSize - 1) / pageSize);
-        page = Math.min(page, pageCount - 1);
-        int first = page * pageSize;
-        int limit = Math.min(items.size(), first + pageSize);
+        Paging paging = Paging.of(items.size(), Math.min(6, (height - 142) / ROW_HEIGHT), page);
+        page = paging.pageIndex();
         int y = 56;
-        for (int index = first; index < limit; index++) {
-            CleanupItem item = items.get(index);
-            String label = item.backupId().toString().substring(0, 8)
-                    + " · "
-                    + item.label().orElse("unlabeled")
-                    + " · "
-                    + (plan.protectedBackups().contains(item.backupId())
-                            ? "local Git copy only"
-                            : (item.removeGit() ? "Git " : "") + (item.removeZip() ? "ZIP" : ""));
+        for (CleanupItem item : paging.slice(items)) {
             StringWidget row = new StringWidget(
-                    x,
-                    y,
-                    contentWidth,
-                    20,
-                    Component.literal(label),
-                    font);
-            row.setTooltip(Tooltip.create(Component.literal(
-                    CleanupPreviewScreen.details(item))));
+                    x, y, contentWidth, 20, Component.literal(CleanupText.row(plan, item)), font);
+            row.setTooltip(Tooltip.create(CleanupText.details(item)));
             addRenderableOnly(row);
-            y += 24;
+            y += ROW_HEIGHT;
         }
-        addFooter(x, contentWidth, pageCount);
+        addFooter(x, contentWidth, paging);
     }
 
-    private void addFooter(int x, int contentWidth, int pageCount) {
-        int y = height - 52;
+    private void addFooter(int x, int contentWidth, Paging paging) {
         Button acknowledgement = Button.builder(
-                        Component.literal(acknowledged
-                                ? "[x] I reviewed every item"
-                                : "[ ] I reviewed every item"),
+                        Widgets.checkbox(acknowledged, Component.literal("I reviewed every item")),
                         ignored -> {
                             acknowledged = !acknowledged;
                             rebuildWidgets();
                         })
-                .bounds(x, y, contentWidth, 20)
+                .bounds(x, height - 52, contentWidth, 20)
                 .build();
         acknowledgement.active = !busy;
         addRenderableWidget(acknowledgement);
 
-        int gap = 4;
-        int width = (contentWidth - gap * 3) / 4;
-        int buttonY = height - 28;
-        Button previous = Button.builder(Component.literal("Previous"), ignored -> {
-                    page--;
-                    rebuildWidgets();
-                })
-                .bounds(x, buttonY, width, 20)
-                .build();
-        previous.active = !busy && page > 0;
-        addRenderableWidget(previous);
-        Button next = Button.builder(Component.literal("Next"), ignored -> {
-                    page++;
-                    rebuildWidgets();
-                })
-                .bounds(x + width + gap, buttonY, width, 20)
-                .build();
-        next.active = !busy && page + 1 < pageCount;
-        addRenderableWidget(next);
-        Button clean = Button.builder(
-                        Component.literal("Delete " + items.size() + " Backup(s)")
-                                .withStyle(ChatFormatting.RED),
+        List<Button> buttons = new ArrayList<>(Widgets.pageButtons(paging, index -> {
+            page = index;
+            rebuildWidgets();
+        }));
+        Button delete = Button.builder(
+                        Component.literal("Delete " + items.size() + " Backup(s)").withStyle(ChatFormatting.RED),
                         ignored -> apply())
-                .bounds(x + (width + gap) * 2, buttonY, width, 20)
                 .build();
-        clean.active = !busy && acknowledged;
-        addRenderableWidget(clean);
-        Button back = Button.builder(Component.literal("Back"), ignored -> onClose())
-                .bounds(x + (width + gap) * 3, buttonY, width, 20)
-                .build();
-        back.active = !busy;
-        addRenderableWidget(back);
+        delete.active = acknowledged;
+        buttons.add(delete);
+        buttons.add(Button.builder(Component.literal("Back"), ignored -> onClose()).build());
+        buttons.forEach(button -> button.active &= !busy);
+        Widgets.row(x, height - 28, contentWidth, buttons);
+        buttons.forEach(this::addRenderableWidget);
     }
 
     private void apply() {
         busy = true;
         rebuildWidgets();
-        facade.applyCleanup(new CleanupRequest(plan.confirmationToken(), selected))
-                .whenComplete((result, throwable) -> minecraft.execute(() -> {
-                    busy = false;
-                    if (!active) {
-                        return;
-                    }
-                    if (throwable != null || result == null) {
-                        minecraft.setScreenAndShow(new CleanupResultScreen(
-                                returnTo,
-                                world,
-                                null,
-                                StorageScreen.failure(throwable)));
-                    } else {
-                        minecraft.setScreenAndShow(new CleanupResultScreen(
-                                returnTo,
-                                world,
-                                result,
-                                null));
-                    }
-                }));
+        calls.start(
+                () -> facade.applyCleanup(new CleanupRequest(plan.confirmationToken(), selected)),
+                result -> minecraft.setScreenAndShow(CleanupResultScreen.succeeded(returnTo, world, plan, result)),
+                failure -> minecraft.setScreenAndShow(CleanupResultScreen.failed(returnTo, world, failure)));
     }
 
     @Override
@@ -194,10 +146,4 @@ public void onClose() {
     public boolean shouldCloseOnEsc() {
         return !busy;
     }
-
-    @Override
-    public void removed() {
-        active = false;
-        super.removed();
-    }
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/CleanupPreviewScreen.java b/src/client/java/dev/ishaanko/worldarchive/ui/CleanupPreviewScreen.java
index d082e23..e76b997 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/CleanupPreviewScreen.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/CleanupPreviewScreen.java
@@ -1,17 +1,15 @@
 package dev.ishaanko.worldarchive.ui;
 
-import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.storage.management.CleanupItem;
 import dev.ishaanko.worldarchive.storage.management.CleanupPlan;
+import dev.ishaanko.worldarchive.ui.model.BackupText;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
+import dev.ishaanko.worldarchive.ui.model.CleanupSelection;
+import dev.ishaanko.worldarchive.ui.model.Paging;
 import dev.ishaanko.worldarchive.ui.model.ScreenGeometry;
-import java.time.ZoneId;
-import java.time.format.DateTimeFormatter;
-import java.time.format.FormatStyle;
-import java.util.HashSet;
+import java.util.ArrayList;
 import java.util.List;
-import java.util.Locale;
 import java.util.Objects;
-import java.util.Set;
 import net.minecraft.ChatFormatting;
 import net.minecraft.client.gui.components.Button;
 import net.minecraft.client.gui.components.MultiLineTextWidget;
@@ -20,12 +18,12 @@
 import net.minecraft.client.gui.screens.Screen;
 import net.minecraft.network.chat.Component;
 
-/** Selectable exact cleanup preview; no mutation occurs on this screen. */
+/**
+ * Lets the player choose which backups of a cleanup plan to delete. Nothing changes on this
+ * screen; Continue opens the final confirmation, and leaving discards the plan.
+ */
 final class CleanupPreviewScreen extends Screen {
-    private static final DateTimeFormatter DATE = DateTimeFormatter
-            .ofLocalizedDateTime(FormatStyle.SHORT)
-            .withLocale(Locale.getDefault())
-            .withZone(ZoneId.systemDefault());
+    private static final int ROW_HEIGHT = 24;
 
     private static final int CONTENT_MIN = 240;
 
@@ -41,7 +39,7 @@ final class CleanupPreviewScreen extends Screen {
 
     private final CleanupPlan plan;
 
-    private final Set<BackupId> selected = new HashSet<>();
+    private final CleanupSelection selection;
 
     private int page;
 
@@ -55,7 +53,7 @@ final class CleanupPreviewScreen extends Screen {
         this.world = Objects.requireNonNull(world, "world");
         this.facade = Objects.requireNonNull(facade, "facade");
         this.plan = Objects.requireNonNull(plan, "plan");
-        plan.items().forEach(item -> selected.add(item.backupId()));
+        selection = new CleanupSelection(plan);
     }
 
     @Override
@@ -63,119 +61,56 @@ protected void init() {
         int contentWidth = ScreenGeometry.contentWidth(width, CONTENT_MIN, CONTENT_MAX, CONTENT_MARGIN);
         int x = ScreenGeometry.centerX(width, contentWidth);
         addRenderableOnly(Widgets.title(font, x, 9, contentWidth, 20, title));
-        String summary = plan.items().isEmpty()
-                ? "Nothing to clean up right now. Your keep settings protect every backup."
-                : "Choose which backups to delete from this computer. Copies on GitHub are kept and stay listed; use Delete to remove one from GitHub.";
-        addRenderableOnly(new MultiLineTextWidget(
-                        x,
-                        31,
-                        Component.literal(summary),
-                        font)
+        Component summary = plan.items().isEmpty()
+                ? Component.literal("Nothing to clean up right now. Your keep settings protect every backup.")
+                : Component.translatable("screen.worldarchive.cleanup.choose");
+        addRenderableOnly(new MultiLineTextWidget(x, 31, summary, font)
                 .setMaxWidth(contentWidth)
                 .setMaxRows(2));
-        int pageSize = Math.max(1, Math.min(7, (height - 132) / 24));
-        int pageCount = Math.max(1, (plan.items().size() + pageSize - 1) / pageSize);
-        page = Math.min(page, pageCount - 1);
-        addItems(x, contentWidth, pageSize);
-        addFooter(x, contentWidth, pageCount);
-    }
-
-    private void addItems(int x, int contentWidth, int pageSize) {
-        int first = page * pageSize;
-        int limit = Math.min(plan.items().size(), first + pageSize);
+        Paging paging = Paging.of(plan.items().size(), Math.min(7, (height - 132) / ROW_HEIGHT), page);
+        page = paging.pageIndex();
         int y = 72;
-        for (int index = first; index < limit; index++) {
-            CleanupItem item = plan.items().get(index);
-            boolean checked = selected.contains(item.backupId());
-            String label = (checked ? "[x] " : "[ ] ")
-                    + DATE.format(item.createdAt())
-                    + " · "
-                    + identity(item)
-                    + " · "
-                    + actions(plan, item)
-                    + " · "
-                    + item.changedFileCount()
-                    + " changed";
-            Button row = Button.builder(Component.literal(label), ignored -> {
-                        toggle(item);
-                        rebuildWidgets();
-                    })
+        for (CleanupItem item : paging.slice(plan.items())) {
+            Button row = Button.builder(
+                            Widgets.checkbox(
+                                    selection.contains(item.backupId()),
+                                    Component.literal(CleanupText.row(plan, item))),
+                            ignored -> {
+                                selection.toggle(item.backupId());
+                                rebuildWidgets();
+                            })
                     .bounds(x, y, contentWidth, 20)
                     .build();
-            row.setTooltip(Tooltip.create(Component.literal(details(item))));
+            row.setTooltip(Tooltip.create(CleanupText.details(item)));
             addRenderableWidget(row);
-            y += 24;
-        }
-    }
-
-    /** Protected backups give up their local Git copies together or not at all. */
-    private void toggle(CleanupItem item) {
-        boolean removing = selected.contains(item.backupId());
-        if (!item.removeGit() || !plan.protectedBackups().contains(item.backupId())) {
-            if (removing) {
-                selected.remove(item.backupId());
-            } else {
-                selected.add(item.backupId());
-            }
-            return;
+            y += ROW_HEIGHT;
         }
-        plan.items().stream()
-                .filter(CleanupItem::removeGit)
-                .map(CleanupItem::backupId)
-                .filter(plan.protectedBackups()::contains)
-                .forEach(backupId -> {
-                    if (removing) {
-                        selected.remove(backupId);
-                    } else {
-                        selected.add(backupId);
-                    }
-                });
+        addFooter(x, contentWidth, paging);
     }
 
-    private void addFooter(int x, int contentWidth, int pageCount) {
-        long estimate = plan.items().stream()
-                .filter(item -> selected.contains(item.backupId()))
-                .mapToLong(CleanupItem::estimatedReclaimableBytes)
-                .sum();
-        boolean selectedTargetReachable =
-                Math.max(0, plan.currentBytes() - estimate) <= plan.targetBytes();
-        String total = selected.size() + " backup(s) selected · frees about "
-                + StorageScreen.bytes(estimate);
-        if (!selectedTargetReachable) {
-            total += plan.targetReachable()
-                    ? " · still over the limit; select more backups"
-                    : " · still over the limit; the rest is protected";
-        }
+    private void addFooter(int x, int contentWidth, Paging paging) {
+        String total = selection.selected().size() + " backup(s) selected · frees about "
+                + BackupText.bytes(selection.freedBytes());
+        CleanupSelection.Coverage coverage = selection.coverage();
+        total += switch (coverage) {
+            case REACHES_TARGET -> "";
+            case SELECT_MORE -> " · still over the limit; select more backups";
+            case REST_PROTECTED -> " · still over the limit; the rest is protected";
+        };
         addRenderableOnly(new StringWidget(
                 x,
                 height - 52,
                 contentWidth,
                 16,
-                        Component.literal(total).withStyle(
-                        selectedTargetReachable
-                                ? ChatFormatting.GRAY
-                                : ChatFormatting.YELLOW),
+                Component.literal(total).withStyle(coverage == CleanupSelection.Coverage.REACHES_TARGET
+                        ? ChatFormatting.GRAY
+                        : ChatFormatting.YELLOW),
                 font));
 
-        int gap = 4;
-        int width = (contentWidth - gap * 3) / 4;
-        int y = height - 28;
-        Button previous = Button.builder(Component.literal("Previous"), ignored -> {
-                    page--;
-                    rebuildWidgets();
-                })
-                .bounds(x, y, width, 20)
-                .build();
-        previous.active = page > 0;
-        addRenderableWidget(previous);
-        Button next = Button.builder(Component.literal("Next"), ignored -> {
-                    page++;
-                    rebuildWidgets();
-                })
-                .bounds(x + width + gap, y, width, 20)
-                .build();
-        next.active = page + 1 < pageCount;
-        addRenderableWidget(next);
+        List<Button> buttons = new ArrayList<>(Widgets.pageButtons(paging, index -> {
+            page = index;
+            rebuildWidgets();
+        }));
         Button continueButton = Button.builder(Component.literal("Continue"), ignored ->
                         minecraft.setScreenAndShow(new CleanupConfirmationScreen(
                                 this,
@@ -183,45 +118,17 @@ private void addFooter(int x, int contentWidth, int pageCount) {
                                 world,
                                 facade,
                                 plan,
-                                Set.copyOf(selected))))
-                .bounds(x + (width + gap) * 2, y, width, 20)
+                                selection.selected())))
                 .build();
-        continueButton.active = !selected.isEmpty();
-        addRenderableWidget(continueButton);
-        addRenderableWidget(Button.builder(Component.literal("Cancel"), ignored -> onClose())
-                .bounds(x + (width + gap) * 3, y, width, 20)
-                .build());
-    }
-
-    private static String identity(CleanupItem item) {
-        return item.label().orElse(item.backupId().toString().substring(0, 8));
-    }
-
-    private static String actions(CleanupPlan plan, CleanupItem item) {
-        if (plan.protectedBackups().contains(item.backupId())) {
-            return "local Git copy only";
-        }
-        if (item.removeGit() && item.removeZip()) {
-            return "delete Git + ZIP";
-        }
-        return item.removeGit() ? "delete Git" : "delete ZIP";
-    }
-
-    static String details(CleanupItem item) {
-        List<String> artifacts = new java.util.ArrayList<>();
-        item.gitRef().ifPresent(ref -> artifacts.add("Git ref: " + ref));
-        item.zipArtifactId().ifPresent(id -> artifacts.add("ZIP: " + id));
-        artifacts.add("Frees about "
-                + StorageScreen.bytes(item.estimatedReclaimableBytes()));
-        artifacts.add(item.removesRestorePoint()
-                ? "You cannot restore this backup after cleanup."
-                : "Another copy of this backup still exists.");
-        return String.join("\n", artifacts);
+        continueButton.active = !selection.selected().isEmpty();
+        buttons.add(continueButton);
+        buttons.add(Button.builder(Component.literal("Cancel"), ignored -> onClose()).build());
+        Widgets.row(x, height - 28, contentWidth, buttons);
+        buttons.forEach(this::addRenderableWidget);
     }
 
     @Override
     public void onClose() {
-        facade.discardCleanup(plan.confirmationToken());
         minecraft.setScreenAndShow(parent);
     }
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/CleanupResultScreen.java b/src/client/java/dev/ishaanko/worldarchive/ui/CleanupResultScreen.java
index 173f717..eab82d5 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/CleanupResultScreen.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/CleanupResultScreen.java
@@ -1,15 +1,28 @@
 package dev.ishaanko.worldarchive.ui;
 
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.SafeText;
+import dev.ishaanko.worldarchive.storage.management.CleanupItem;
+import dev.ishaanko.worldarchive.storage.management.CleanupPlan;
 import dev.ishaanko.worldarchive.storage.management.CleanupResult;
+import dev.ishaanko.worldarchive.ui.model.BackupText;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
 import dev.ishaanko.worldarchive.ui.model.ScreenGeometry;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
 import java.util.Objects;
 import net.minecraft.ChatFormatting;
 import net.minecraft.client.gui.components.Button;
 import net.minecraft.client.gui.components.MultiLineTextWidget;
 import net.minecraft.client.gui.screens.Screen;
+import net.minecraft.network.chat.CommonComponents;
 import net.minecraft.network.chat.Component;
 
-/** Actual cleanup outcome, including partial failures and measured reclaimed bytes. */
+/**
+ * What a cleanup did: the space it freed, each backup it could not delete and why, and work that
+ * failed after the deletes, such as freeing Git space. Or why the cleanup failed as a whole.
+ */
 final class CleanupResultScreen extends Screen {
     private static final int CONTENT_MIN = 220;
 
@@ -17,27 +30,61 @@ final class CleanupResultScreen extends Screen {
 
     private static final int CONTENT_MARGIN = 24;
 
+    /** Rows of kept backups the screen names; the rest are counted. */
+    private static final int MAXIMUM_NAMED = 5;
+
+    private static final int REASON_LIMIT = 160;
+
     private final Screen parent;
 
     private final BackupWorldContext world;
 
-    private final CleanupResult result;
+    private final Component message;
 
-    private final Component failure;
-
-    CleanupResultScreen(
-            Screen parent,
-            BackupWorldContext world,
-            CleanupResult result,
-            Component failure) {
+    private CleanupResultScreen(Screen parent, BackupWorldContext world, Component message) {
         super(Component.literal("Cleanup Result"));
         this.parent = Objects.requireNonNull(parent, "parent");
         this.world = Objects.requireNonNull(world, "world");
-        this.result = result;
-        this.failure = failure;
-        if ((result == null) == (failure == null)) {
-            throw new IllegalArgumentException("Cleanup result must contain success or failure");
+        this.message = Objects.requireNonNull(message, "message");
+    }
+
+    /** The result of an applied plan; {@code plan} names the backups the way the preview did. */
+    static CleanupResultScreen succeeded(Screen parent, BackupWorldContext world, CleanupPlan plan, CleanupResult result) {
+        List<Component> lines = new ArrayList<>();
+        lines.add(Component.translatable(
+                        "screen.worldarchive.cleanup.freed",
+                        BackupText.bytes(result.reclaimedBytes()),
+                        BackupText.bytes(result.bytesAfter()))
+                .withStyle(result.failures().isEmpty() ? ChatFormatting.GREEN : ChatFormatting.YELLOW));
+        if (!result.failures().isEmpty()) {
+            lines.add(Component.translatable("screen.worldarchive.cleanup.kept", result.failures().size())
+                    .withStyle(ChatFormatting.YELLOW));
+            List<Map.Entry<BackupId, String>> kept = List.copyOf(result.failures().entrySet());
+            kept.subList(0, Math.min(kept.size(), MAXIMUM_NAMED)).forEach(failure -> lines.add(Component.literal(
+                    name(plan, failure.getKey()) + BackupText.SEPARATOR + SafeText.clean(failure.getValue(), REASON_LIMIT))));
+            if (kept.size() > MAXIMUM_NAMED) {
+                lines.add(Component.translatable("screen.worldarchive.delete.more", kept.size() - MAXIMUM_NAMED));
+            }
         }
+        result.warning().ifPresent(warning -> lines.add(
+                Component.literal(SafeText.clean(warning, REASON_LIMIT)).withStyle(ChatFormatting.YELLOW)));
+        return new CleanupResultScreen(parent, world, CommonComponents.joinLines(lines));
+    }
+
+    static CleanupResultScreen failed(Screen parent, BackupWorldContext world, Throwable failure) {
+        return new CleanupResultScreen(parent, world, FailureMessages.status(failure));
+    }
+
+    private static String name(CleanupPlan plan, BackupId backupId) {
+        return plan.items().stream()
+                .filter(item -> item.backupId().equals(backupId))
+                .findFirst()
+                .map(CleanupResultScreen::name)
+                .orElseGet(backupId::toString);
+    }
+
+    private static String name(CleanupItem item) {
+        return BackupText.name(item.createdAt(), item.label());
     }
 
     @Override
@@ -45,31 +92,9 @@ protected void init() {
         int contentWidth = ScreenGeometry.contentWidth(width, CONTENT_MIN, CONTENT_MAX, CONTENT_MARGIN);
         int x = ScreenGeometry.centerX(width, contentWidth);
         addRenderableOnly(Widgets.title(font, x, 18, contentWidth, 20, title));
-        Component message;
-        if (failure != null) {
-            message = failure;
-        } else {
-            String text = "Freed "
-                    + StorageScreen.bytes(result.reclaimedBytes())
-                    + ". Backups now use "
-                    + StorageScreen.bytes(result.bytesAfter())
-                    + ".";
-            if (!result.failures().isEmpty()) {
-                text += " " + result.failures().size()
-                        + " backup(s) could not be deleted; the rest were deleted.";
-            }
-            message = Component.literal(text).withStyle(
-                    result.failures().isEmpty()
-                            ? ChatFormatting.GREEN
-                            : ChatFormatting.YELLOW);
-        }
-        addRenderableOnly(new MultiLineTextWidget(
-                        x,
-                        54,
-                        message,
-                        font)
+        addRenderableOnly(new MultiLineTextWidget(x, 54, message, font)
                 .setMaxWidth(contentWidth)
-                .setMaxRows(6));
+                .setMaxRows(12));
         addRenderableWidget(Button.builder(
                         Component.literal("Back to " + world.displayName()),
                         ignored -> onClose())
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/CleanupText.java b/src/client/java/dev/ishaanko/worldarchive/ui/CleanupText.java
new file mode 100644
index 0000000..7f7c27d
--- /dev/null
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/CleanupText.java
@@ -0,0 +1,46 @@
+package dev.ishaanko.worldarchive.ui;
+
+import dev.ishaanko.worldarchive.storage.management.CleanupItem;
+import dev.ishaanko.worldarchive.storage.management.CleanupPlan;
+import dev.ishaanko.worldarchive.ui.model.BackupText;
+import java.util.ArrayList;
+import java.util.List;
+import net.minecraft.network.chat.Component;
+
+/**
+ * The text of one cleanup item. The preview and the final confirmation show the same text, so
+ * the player can match each confirmed row to the row they reviewed.
+ */
+final class CleanupText {
+    private CleanupText() {
+    }
+
+    /** Date and label, what cleanup removes, and how many files the backup changed. */
+    static String row(CleanupPlan plan, CleanupItem item) {
+        return BackupText.name(item.createdAt(), item.label())
+                + BackupText.SEPARATOR + action(plan, item)
+                + BackupText.SEPARATOR + item.changedFileCount() + " changed";
+    }
+
+    /** Where the item's artifacts are and what the player loses; shown as the row's tooltip. */
+    static Component details(CleanupItem item) {
+        List<String> lines = new ArrayList<>();
+        item.gitRef().ifPresent(ref -> lines.add("Git ref: " + ref));
+        item.zipArtifactId().ifPresent(id -> lines.add("ZIP: " + id));
+        lines.add("Frees about " + BackupText.bytes(item.estimatedReclaimableBytes()));
+        lines.add(item.removesRestorePoint()
+                ? "You cannot restore this backup after cleanup."
+                : "Another copy of this backup still exists.");
+        return Component.literal(String.join("\n", lines));
+    }
+
+    private static String action(CleanupPlan plan, CleanupItem item) {
+        if (plan.protectedBackups().contains(item.backupId())) {
+            return "local Git copy only";
+        }
+        if (item.removeGit() && item.removeZip()) {
+            return "delete Git + ZIP";
+        }
+        return item.removeGit() ? "delete Git" : "delete ZIP";
+    }
+}
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/EditWorldBackupIntegration.java b/src/client/java/dev/ishaanko/worldarchive/ui/EditWorldBackupIntegration.java
index 47160c0..774a0cd 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/EditWorldBackupIntegration.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/EditWorldBackupIntegration.java
@@ -1,14 +1,14 @@
 package dev.ishaanko.worldarchive.ui;
 
+import dev.ishaanko.worldarchive.model.BackupOperation;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldSelection;
 import java.lang.ref.WeakReference;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.WeakHashMap;
-import java.util.concurrent.CompletionStage;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.function.Supplier;
 import net.fabricmc.fabric.api.client.screen.v1.ScreenEvents;
 import net.fabricmc.fabric.api.client.screen.v1.Screens;
 import net.minecraft.client.Minecraft;
@@ -16,11 +16,15 @@
 import net.minecraft.client.gui.components.Button;
 import net.minecraft.client.gui.components.Tooltip;
 import net.minecraft.client.gui.navigation.ScreenRectangle;
-import net.minecraft.client.gui.screens.Screen;
 import net.minecraft.client.gui.screens.worldselection.EditWorldScreen;
 import net.minecraft.network.chat.Component;
 import net.minecraft.network.chat.contents.TranslatableContents;
 
+/**
+ * Replaces the Make Backup and Backups Folder buttons of vanilla's Edit World screen with
+ * WorldArchive's Create and Backups actions for the edited world. The Edit World screen does not
+ * expose its world, so the world comes from the Select World integration's last selection.
+ */
 public final class EditWorldBackupIntegration {
     private static final String BACKUP_KEY = "selectWorld.edit.backup";
 
@@ -29,158 +33,105 @@ public final class EditWorldBackupIntegration {
     private static final String NO_WORLD_MESSAGE =
             "Open Edit World from the world list to use WorldArchive backups";
 
-    private static final String NOT_READY_MESSAGE = "Backups are not ready";
-
-    private static final AtomicBoolean REGISTERED = new AtomicBoolean();
-
+    /**
+     * Vanilla keeps the Edit World widgets when it shows the screen again, so each screen keeps
+     * the buttons it replaced across inits. Render thread only.
+     */
     private static final Map<EditWorldScreen, WeakReference<ScreenState>> STATES = new WeakHashMap<>();
 
-    private static volatile Supplier<? extends BackupClientFacade> facadeSupplier;
-
     private EditWorldBackupIntegration() {
     }
 
-    public static void register(Supplier<? extends BackupClientFacade> supplier) {
-        facadeSupplier = Objects.requireNonNull(supplier, "supplier");
-        if (REGISTERED.compareAndSet(false, true)) {
-            ScreenEvents.AFTER_INIT.register(EditWorldBackupIntegration::afterInit);
-        }
-    }
-
-    private static void afterInit(Minecraft minecraft, Screen screen, int width, int height) {
-        if (!(screen instanceof EditWorldScreen editWorldScreen)) {
-            return;
-        }
-        WeakReference<ScreenState> reference = STATES.get(editWorldScreen);
-        ScreenState state = reference == null ? null : reference.get();
-        if (state == null) {
-            state = new ScreenState(minecraft, editWorldScreen);
-            STATES.put(editWorldScreen, new WeakReference<>(state));
-        }
-        state.install();
-    }
-
-    private static BackupClientFacade currentFacade() {
-        Supplier<? extends BackupClientFacade> supplier = facadeSupplier;
-        if (supplier == null) {
-            throw new IllegalStateException("WorldArchive client facade has not been registered");
-        }
-        return Objects.requireNonNull(supplier.get(), "facadeSupplier result");
+    /** Registers the Edit World hook; the client initializer calls this once. */
+    public static void register(BackupClientFacade facade) {
+        Objects.requireNonNull(facade, "facade");
+        ScreenEvents.AFTER_INIT.register((minecraft, screen, width, height) -> {
+            if (screen instanceof EditWorldScreen editWorld) {
+                WeakReference<ScreenState> reference = STATES.get(editWorld);
+                ScreenState state = reference == null ? null : reference.get();
+                if (state == null) {
+                    state = new ScreenState(minecraft, editWorld, facade);
+                    STATES.put(editWorld, new WeakReference<>(state));
+                }
+                state.install();
+            }
+        });
     }
 
+    /** A vanilla button and the WorldArchive button shown in its place. */
     private record Slot(Button vanillaButton, Button replacement) {
         private static final Slot EMPTY = new Slot(null, null);
 
         private void mirrorBounds() {
-            if (vanillaButton == null || replacement == null) {
-                return;
+            if (vanillaButton != null && replacement != null) {
+                ScreenRectangle bounds = vanillaButton.getRectangle();
+                replacement.setRectangle(bounds.width(), bounds.height(), bounds.left(), bounds.top());
             }
-            ScreenRectangle bounds = vanillaButton.getRectangle();
-            replacement.setRectangle(bounds.width(), bounds.height(), bounds.left(), bounds.top());
         }
 
         private void apply(boolean enabled, String tooltip) {
-            if (replacement == null) {
-                return;
+            if (replacement != null) {
+                replacement.active = enabled;
+                replacement.setTooltip(Tooltip.create(Component.literal(tooltip)));
             }
-            replacement.active = enabled;
-            replacement.setTooltip(Tooltip.create(Component.literal(tooltip)));
         }
     }
 
+    /** The takeover of one Edit World screen: its replaced buttons and the edited world. */
     private static final class ScreenState {
         private final Minecraft minecraft;
 
         private final EditWorldScreen screen;
 
+        private final BackupClientFacade facade;
+
+        private final SelectedWorldResolver resolver;
+
         private Slot backupSlot = Slot.EMPTY;
 
         private Slot backupFolderSlot = Slot.EMPTY;
 
         private BackupWorldContext world;
 
-        private BackupWorldSelection selection;
-
-        private boolean active;
-
         private boolean layoutPending;
 
-        private long resolutionRevision;
-
-        private ScreenState(Minecraft minecraft, EditWorldScreen screen) {
+        private ScreenState(Minecraft minecraft, EditWorldScreen screen, BackupClientFacade facade) {
             this.minecraft = minecraft;
             this.screen = screen;
+            this.facade = Objects.requireNonNull(facade, "facade");
+            resolver = new SelectedWorldResolver(screen);
         }
 
-        private static Optional<Button> findVanillaButton(List<AbstractWidget> widgets, String key) {
-            return widgets.stream()
-                    .filter(Button.class::isInstance)
-                    .map(Button.class::cast)
-                    .filter(button -> hasKey(button.getMessage(), key))
-                    .findFirst();
-        }
-
-        private static boolean hasKey(Component message, String key) {
-            return message.getContents() instanceof TranslatableContents contents
-                    && key.equals(contents.getKey());
-        }
-
+        /** Takes the buttons over after each init and resolves the edited world again. */
         private void install() {
-            active = true;
             layoutPending = true;
-            long revision = ++resolutionRevision;
             ScreenEvents.afterTick(screen).register(ignored -> afterTick());
-            ScreenEvents.remove(screen).register(ignored -> removed());
-            selection = SelectWorldBackupIntegration.lastSelection().orElse(null);
-            BackupWorldContext remembered = SelectWorldBackupIntegration.lastResolvedWorld().orElse(null);
-            if (remembered != null) {
-                world = remembered;
-            } else if (selection == null || world == null || !world.matches(selection)) {
-                world = null;
-            }
             backupSlot = takeOver(backupSlot, BACKUP_KEY, "Make Backup", this::promptManualBackup);
             backupFolderSlot = takeOver(backupFolderSlot, BACKUP_FOLDER_KEY, "Backups", this::openBrowser);
-            if (world != null) {
-                applyWorld();
-            } else if (selection != null) {
-                disable("Loading world identity…");
-                resolveWorld(selection, revision);
-            } else {
-                applyWorld();
-            }
-        }
-
-        private void resolveWorld(BackupWorldSelection target, long revision) {
-            CompletionStage<Optional<BackupWorldContext>> resolution;
-            try {
-                resolution = Objects.requireNonNull(
-                        currentFacade().resolveWorld(target),
-                        "resolveWorld result");
-            } catch (RuntimeException exception) {
-                disable(NOT_READY_MESSAGE);
+            world = null;
+            Optional<BackupWorldSelection> selection = SelectWorldBackupIntegration.lastSelection();
+            if (selection.isEmpty()) {
+                resolver.cancel();
+                disable(NO_WORLD_MESSAGE);
                 return;
             }
-            resolution.whenComplete((resolved, throwable) -> minecraft.execute(() -> {
-                if (!active || revision != resolutionRevision || !target.equals(selection)) {
-                    return;
-                }
-                if (throwable != null || resolved == null || resolved.isEmpty()) {
-                    disable("Backups are unavailable for this world");
-                    return;
-                }
-                BackupWorldContext context = resolved.orElseThrow();
-                if (!context.matches(target)) {
-                    disable("World identity did not match the selection");
-                    return;
-                }
-                world = context;
-                applyWorld();
-            }));
+            disable("Loading world identity…");
+            resolver.resolve(facade, selection.orElseThrow(), this::enable, this::disable);
         }
 
+        /**
+         * Puts a WorldArchive button where the vanilla button with {@code key} was. After the
+         * first init the vanilla button is no longer in the widget list, so the slot remembers it.
+         */
         private Slot takeOver(Slot slot, String key, String label, Runnable action) {
             List<AbstractWidget> widgets = Screens.getWidgets(screen);
-            Button vanillaButton = findVanillaButton(widgets, key).orElse(slot.vanillaButton());
+            Button vanillaButton = widgets.stream()
+                    .filter(Button.class::isInstance)
+                    .map(Button.class::cast)
+                    .filter(button -> button.getMessage().getContents() instanceof TranslatableContents contents
+                            && key.equals(contents.getKey()))
+                    .findFirst()
+                    .orElse(slot.vanillaButton());
             if (vanillaButton == null) {
                 return Slot.EMPTY;
             }
@@ -199,44 +150,17 @@ private Slot takeOver(Slot slot, String key, String label, Runnable action) {
             return seated;
         }
 
+        /** Vanilla may lay its buttons out after the init hook; follow them once, one tick later. */
         private void afterTick() {
-            if (!active || !layoutPending) {
-                return;
-            }
-            layoutPending = false;
-            backupSlot.mirrorBounds();
-            backupFolderSlot.mirrorBounds();
-        }
-
-        private void removed() {
-            active = false;
-            resolutionRevision++;
-            world = null;
-            selection = null;
-            List<AbstractWidget> widgets = Screens.getWidgets(screen);
-            backupSlot = release(widgets, backupSlot);
-            backupFolderSlot = release(widgets, backupFolderSlot);
-        }
-
-        private Slot release(List<AbstractWidget> widgets, Slot slot) {
-            Button replacement = slot.replacement();
-            int index = replacement == null ? -1 : widgets.indexOf(replacement);
-            if (replacement != null) {
-                widgets.remove(replacement);
+            if (layoutPending) {
+                layoutPending = false;
+                backupSlot.mirrorBounds();
+                backupFolderSlot.mirrorBounds();
             }
-            Button vanillaButton = slot.vanillaButton();
-            if (vanillaButton != null && !widgets.contains(vanillaButton)) {
-                widgets.add(index < 0 || index > widgets.size() ? widgets.size() : index, vanillaButton);
-            }
-            return Slot.EMPTY;
         }
 
-        private void applyWorld() {
-            BackupWorldContext context = world;
-            if (context == null) {
-                disable(NO_WORLD_MESSAGE);
-                return;
-            }
+        private void enable(BackupWorldContext context) {
+            world = context;
             backupSlot.apply(true, "Create a WorldArchive backup of " + context.displayName());
             backupFolderSlot.apply(true, "Browse WorldArchive backups for " + context.displayName());
         }
@@ -248,35 +172,24 @@ private void disable(String message) {
 
         private void promptManualBackup() {
             BackupWorldContext context = world;
-            if (!active || context == null) {
+            if (context == null) {
                 disable(NO_WORLD_MESSAGE);
                 return;
             }
-            BackupClientFacade facade;
-            try {
-                facade = currentFacade();
-            } catch (RuntimeException exception) {
-                disable(NOT_READY_MESSAGE);
-                return;
-            }
             minecraft.setScreenAndShow(new BackupCreateScreen(screen, label -> minecraft.setScreenAndShow(
                     BackupOperationScreen.backupResult(
                             screen,
+                            BackupOperation.CREATE,
                             "Creating backup",
                             listener -> facade.createManualBackup(context, label, listener)))));
         }
 
         private void openBrowser() {
-            BackupWorldContext context = world;
-            if (!active || context == null) {
+            if (world == null) {
                 disable(NO_WORLD_MESSAGE);
                 return;
             }
-            try {
-                minecraft.setScreenAndShow(new BackupBrowserScreen(screen, context, currentFacade()));
-            } catch (RuntimeException exception) {
-                disable(NOT_READY_MESSAGE);
-            }
+            minecraft.setScreenAndShow(new BackupBrowserScreen(screen, world, facade));
         }
     }
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/FailureMessages.java b/src/client/java/dev/ishaanko/worldarchive/ui/FailureMessages.java
index c05b605..b1be42c 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/FailureMessages.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/FailureMessages.java
@@ -1,33 +1,23 @@
 package dev.ishaanko.worldarchive.ui;
 
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
-import java.util.Objects;
-import java.util.concurrent.CompletionException;
-import java.util.concurrent.ExecutionException;
+import dev.ishaanko.worldarchive.model.SafeText;
+import net.minecraft.ChatFormatting;
+import net.minecraft.network.chat.Component;
 
-/** Canonical failure-message formatting shared by the backup/storage/operation screens. */
+/** Turns a failure into the short, safe text that every backup, storage and import screen shows. */
 final class FailureMessages {
-    private FailureMessages() {}
+    private static final int MAXIMUM_LENGTH = 240;
 
-    /**
-     * Unwraps {@code throwable} down to its real cause, falls back to the cause's simple class
-     * name when it has no message, redacts sensitive data, strips control/format characters, and
-     * truncates to {@code maxLength} with a trailing ellipsis.
-     */
-    static String safe(Throwable throwable, int maxLength) {
-        Throwable current = Objects.requireNonNull(throwable, "throwable");
-        while (current.getCause() != null
-                && (current instanceof CompletionException || current instanceof ExecutionException)) {
-            current = current.getCause();
-        }
-        String message = current.getMessage();
-        if (message == null || message.isBlank()) {
-            message = current.getClass().getSimpleName();
-        }
-        String safe = SensitiveDataRedactor.redact(message).replaceAll("[\\p{Cc}\\p{Cf}]", "");
-        if (safe.length() > maxLength) {
-            safe = safe.substring(0, maxLength - 1) + "…";
-        }
-        return safe;
+    private FailureMessages() {
+    }
+
+    /** The safe message of the failure's real cause, or the cause's type name when it has none. */
+    static String text(Throwable failure) {
+        return SafeText.from(failure, SafeText.unwrap(failure).getClass().getSimpleName(), MAXIMUM_LENGTH);
+    }
+
+    /** The failure as a red status line. */
+    static Component status(Throwable failure) {
+        return Component.literal(text(failure)).withStyle(ChatFormatting.RED);
     }
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/IconRowBackupIntegration.java b/src/client/java/dev/ishaanko/worldarchive/ui/IconRowBackupIntegration.java
index 37eafc8..b9554d4 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/IconRowBackupIntegration.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/IconRowBackupIntegration.java
@@ -5,13 +5,10 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
-import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.function.Predicate;
-import java.util.function.Supplier;
 import java.util.stream.Collectors;
 import net.fabricmc.fabric.api.client.screen.v1.ScreenEvents;
 import net.fabricmc.fabric.api.client.screen.v1.Screens;
-import net.minecraft.client.Minecraft;
 import net.minecraft.client.gui.components.AbstractWidget;
 import net.minecraft.client.gui.components.Button;
 import net.minecraft.client.gui.components.FriendsButton;
@@ -27,46 +24,39 @@
 public final class IconRowBackupIntegration {
     private static final int GAP = 4;
 
-    private static final AtomicBoolean REGISTERED = new AtomicBoolean();
-
-    private static volatile Supplier<? extends BackupClientFacade> facadeSupplier;
-
-    private static volatile Predicate<Screen> openLiveWorldBackups;
-
     private IconRowBackupIntegration() {
     }
 
     /**
-     * Registers the global Fabric screen hook. Repeated calls update the actions.
+     * Registers the title and pause screen hook; the client initializer calls this once.
      *
-     * @param facade supplies the facade the world list needs
+     * @param facade what the world list needs
      * @param openLiveWorld opens the browser for the loaded world over the given screen and
      *     reports whether it did
      */
     public static void register(
-            Supplier<? extends BackupClientFacade> facade,
+            BackupClientFacade facade,
             Predicate<Screen> openLiveWorld) {
-        facadeSupplier = Objects.requireNonNull(facade, "facade");
-        openLiveWorldBackups = Objects.requireNonNull(openLiveWorld, "openLiveWorld");
-        if (REGISTERED.compareAndSet(false, true)) {
-            ScreenEvents.AFTER_INIT.register(IconRowBackupIntegration::afterInit);
-        }
+        Objects.requireNonNull(facade, "facade");
+        Objects.requireNonNull(openLiveWorld, "openLiveWorld");
+        ScreenEvents.AFTER_INIT.register((minecraft, screen, width, height) -> {
+            Button.OnPress action;
+            if (screen instanceof TitleScreen) {
+                action = ignored -> minecraft.setScreenAndShow(new BackupWorldsScreen(screen, facade));
+            } else if (screen instanceof PauseScreen && minecraft.hasSingleplayerServer()) {
+                action = ignored -> {
+                    if (!openLiveWorld.test(screen)) {
+                        minecraft.setScreenAndShow(new BackupWorldsScreen(screen, facade));
+                    }
+                };
+            } else {
+                return;
+            }
+            install(screen, width, action);
+        });
     }
 
-    private static void afterInit(Minecraft minecraft, Screen screen, int width, int height) {
-        Button.OnPress action;
-        if (screen instanceof TitleScreen) {
-            action = ignored -> minecraft.setScreenAndShow(
-                    new BackupWorldsScreen(screen, currentFacade()));
-        } else if (screen instanceof PauseScreen && minecraft.hasSingleplayerServer()) {
-            action = ignored -> {
-                if (!currentLiveWorldAction().test(screen)) {
-                    minecraft.setScreenAndShow(new BackupWorldsScreen(screen, currentFacade()));
-                }
-            };
-        } else {
-            return;
-        }
+    private static void install(Screen screen, int width, Button.OnPress action) {
         List<Button> iconRow = iconRow(Screens.getWidgets(screen));
         if (iconRow.isEmpty()) {
             // No icon row to join; stay out rather than guess a spot.
@@ -146,20 +136,4 @@ private static void recenter(List<Button> row, int centerX, int y, int screenWid
             x += button.getWidth() + GAP;
         }
     }
-
-    private static BackupClientFacade currentFacade() {
-        Supplier<? extends BackupClientFacade> supplier = facadeSupplier;
-        if (supplier == null) {
-            throw new IllegalStateException("WorldArchive client facade has not been registered");
-        }
-        return Objects.requireNonNull(supplier.get(), "facadeSupplier result");
-    }
-
-    private static Predicate<Screen> currentLiveWorldAction() {
-        Predicate<Screen> action = openLiveWorldBackups;
-        if (action == null) {
-            throw new IllegalStateException("WorldArchive backup action has not been registered");
-        }
-        return action;
-    }
 }
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/ScreenCalls.java b/src/client/java/dev/ishaanko/worldarchive/ui/ScreenCalls.java
new file mode 100644
index 0000000..26713ed
--- /dev/null
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/ScreenCalls.java
@@ -0,0 +1,72 @@
+package dev.ishaanko.worldarchive.ui;
+
+import java.util.Objects;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CompletionStage;
+import java.util.function.Consumer;
+import java.util.function.Supplier;
+import net.minecraft.client.Minecraft;
+import net.minecraft.client.gui.screens.Screen;
+
+/**
+ * Starts the facade calls of one screen and hands each outcome to the screen on the render
+ * thread. An outcome is dropped when the screen is no longer showing or {@link #dropPending} was
+ * called after the call started; a result dropped this way goes to the release action, so a held
+ * plan or preview can be given back. A call that throws instead of returning a stage fails like a
+ * failed stage, and an outcome never arrives before {@link #start} returns.
+ */
+final class ScreenCalls {
+    private final Screen screen;
+
+    /** Counts {@link #dropPending} calls; read and written on the render thread only. */
+    private long generation;
+
+    ScreenCalls(Screen screen) {
+        this.screen = Objects.requireNonNull(screen, "screen");
+    }
+
+    /** Drops the outcome of every call started so far; call it before a newer call replaces them. */
+    void dropPending() {
+        generation++;
+    }
+
+    /** Starts {@code call}; returns the stage it watches, so the screen can cancel it. */
+    <T> CompletionStage<T> start(
+            Supplier<? extends CompletionStage<T>> call,
+            Consumer<? super T> succeeded,
+            Consumer<Throwable> failed) {
+        return start(call, succeeded, failed, ignored -> {
+        });
+    }
+
+    /** Like {@link #start(Supplier, Consumer, Consumer)}; a dropped result goes to {@code release}. */
+    <T> CompletionStage<T> start(
+            Supplier<? extends CompletionStage<T>> call,
+            Consumer<? super T> succeeded,
+            Consumer<Throwable> failed,
+            Consumer<? super T> release) {
+        long started = generation;
+        Minecraft minecraft = Minecraft.getInstance();
+        CompletionStage<T> stage = stage(call);
+        stage.whenComplete((value, failure) -> minecraft.schedule(() -> {
+            if (started != generation || minecraft.gui.screen() != screen) {
+                if (failure == null) {
+                    release.accept(value);
+                }
+            } else if (failure == null) {
+                succeeded.accept(value);
+            } else {
+                failed.accept(failure);
+            }
+        }));
+        return stage;
+    }
+
+    private static <T> CompletionStage<T> stage(Supplier<? extends CompletionStage<T>> call) {
+        try {
+            return call.get();
+        } catch (RuntimeException exception) {
+            return CompletableFuture.failedFuture(exception);
+        }
+    }
+}
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/SelectWorldBackupIntegration.java b/src/client/java/dev/ishaanko/worldarchive/ui/SelectWorldBackupIntegration.java
index 6dc9046..74e19b6 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/SelectWorldBackupIntegration.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/SelectWorldBackupIntegration.java
@@ -1,5 +1,7 @@
 package dev.ishaanko.worldarchive.ui;
 
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldSelection;
 import java.lang.ref.WeakReference;
 import java.util.ArrayList;
 import java.util.Comparator;
@@ -8,92 +10,56 @@
 import java.util.Objects;
 import java.util.Optional;
 import java.util.WeakHashMap;
-import java.util.concurrent.CompletionStage;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.function.Supplier;
 import net.fabricmc.fabric.api.client.screen.v1.ScreenEvents;
 import net.fabricmc.fabric.api.client.screen.v1.Screens;
 import net.minecraft.client.Minecraft;
 import net.minecraft.client.gui.components.AbstractWidget;
 import net.minecraft.client.gui.components.Button;
 import net.minecraft.client.gui.components.Tooltip;
-import net.minecraft.client.gui.screens.Screen;
 import net.minecraft.client.gui.screens.worldselection.SelectWorldScreen;
 import net.minecraft.client.gui.screens.worldselection.WorldSelectionList;
 import net.minecraft.network.chat.Component;
 
-/** Adds the WorldArchive entry point to vanilla's Select World action bar. */
+/**
+ * Adds a Backups button to vanilla's Select World screen. It also records the selected world,
+ * because the Edit World screen that opens from there does not expose its world; the Edit World
+ * integration reads that record through {@link #lastSelection()}.
+ */
 public final class SelectWorldBackupIntegration {
-    private static final AtomicBoolean REGISTERED = new AtomicBoolean();
-
+    /**
+     * Vanilla keeps a Select World screen's widgets when it shows the screen again, so each
+     * screen keeps its state, and its button, across inits. Render thread only.
+     */
     private static final Map<SelectWorldScreen, WeakReference<ScreenState>> STATES = new WeakHashMap<>();
 
-    private static volatile Supplier<? extends BackupClientFacade> facadeSupplier;
-
-    private static volatile BackupWorldSelection rememberedSelection;
-
-    private static volatile BackupWorldContext rememberedWorld;
+    /** The valid world selected most recently in a Select World screen; null when none is. */
+    private static volatile BackupWorldSelection lastSelection;
 
     private SelectWorldBackupIntegration() {
     }
 
-    /** Registers the global Fabric screen hook. Repeated calls update the runtime facade supplier. */
-    public static void register(Supplier<? extends BackupClientFacade> supplier) {
-        facadeSupplier = Objects.requireNonNull(supplier, "supplier");
-        if (REGISTERED.compareAndSet(false, true)) {
-            ScreenEvents.AFTER_INIT.register(SelectWorldBackupIntegration::afterInit);
-        }
-    }
-
-    private static void afterInit(Minecraft minecraft, Screen screen, int width, int height) {
-        if (!(screen instanceof SelectWorldScreen selectWorldScreen)) {
-            return;
-        }
-        WeakReference<ScreenState> reference = STATES.get(selectWorldScreen);
-        ScreenState state = reference == null ? null : reference.get();
-        if (state == null) {
-            state = new ScreenState(minecraft, selectWorldScreen);
-            STATES.put(selectWorldScreen, new WeakReference<>(state));
-        }
-        ScreenState current = state;
-        ScreenEvents.afterTick(selectWorldScreen).register(ignored -> current.afterTick());
-        ScreenEvents.remove(selectWorldScreen).register(ignored -> current.removed());
-        state.install(width, height);
-    }
-
-    static Optional<BackupWorldContext> lastResolvedWorld() {
-        BackupWorldSelection selection = rememberedSelection;
-        BackupWorldContext world = rememberedWorld;
-        if (selection == null || world == null || !world.matches(selection)) {
-            return Optional.empty();
-        }
-        return Optional.of(world);
+    /** Registers the Select World hook; the client initializer calls this once. */
+    public static void register(BackupClientFacade facade) {
+        Objects.requireNonNull(facade, "facade");
+        ScreenEvents.AFTER_INIT.register((minecraft, screen, width, height) -> {
+            if (screen instanceof SelectWorldScreen selectWorld) {
+                WeakReference<ScreenState> reference = STATES.get(selectWorld);
+                ScreenState state = reference == null ? null : reference.get();
+                if (state == null) {
+                    state = new ScreenState(minecraft, selectWorld, facade);
+                    STATES.put(selectWorld, new WeakReference<>(state));
+                }
+                state.install(width, height);
+            }
+        });
     }
 
+    /** The world selected most recently in a Select World screen, for the Edit World screen it opens. */
     static Optional<BackupWorldSelection> lastSelection() {
-        return Optional.ofNullable(rememberedSelection);
-    }
-
-    private static void rememberSelection(BackupWorldSelection selection) {
-        if (!Objects.equals(rememberedSelection, selection)) {
-            rememberedSelection = selection;
-            rememberedWorld = null;
-        }
-    }
-
-    private static void rememberWorld(BackupWorldSelection selection, BackupWorldContext world) {
-        rememberedSelection = selection;
-        rememberedWorld = world;
-    }
-
-    private static BackupClientFacade currentFacade() {
-        Supplier<? extends BackupClientFacade> supplier = facadeSupplier;
-        if (supplier == null) {
-            throw new IllegalStateException("WorldArchive client facade has not been registered");
-        }
-        return Objects.requireNonNull(supplier.get(), "facadeSupplier result");
+        return Optional.ofNullable(lastSelection);
     }
 
+    /** The Backups button of one Select World screen and the world it would open. */
     private static final class ScreenState {
         private static final int GAP = 4;
 
@@ -103,55 +69,52 @@ private static final class ScreenState {
 
         private final SelectWorldScreen screen;
 
+        private final BackupClientFacade facade;
+
+        private final SelectedWorldResolver resolver;
+
         private WorldSelectionList worldList;
 
         private Button backupsButton;
 
-        private BackupWorldSelection selectedWorld;
+        private BackupWorldSelection selected;
 
-        private BackupWorldContext resolvedWorld;
-
-        private boolean active;
+        private BackupWorldContext resolved;
 
         private boolean layoutPending;
 
-        private long selectionRevision;
-
-        private ScreenState(Minecraft minecraft, SelectWorldScreen screen) {
+        private ScreenState(Minecraft minecraft, SelectWorldScreen screen, BackupClientFacade facade) {
             this.minecraft = minecraft;
             this.screen = screen;
+            this.facade = Objects.requireNonNull(facade, "facade");
+            resolver = new SelectedWorldResolver(screen);
         }
 
+        /** Adds the button again after each init; the button of an earlier init is removed first. */
         private void install(int width, int height) {
-            active = true;
+            if (backupsButton != null) {
+                Screens.getWidgets(screen).remove(backupsButton);
+            }
             layoutPending = true;
-            selectionRevision++;
-            selectedWorld = null;
-            resolvedWorld = null;
-            uninstallButton();
-            worldList = findWorldList();
+            selected = null;
+            resolved = null;
+            resolver.cancel();
+            worldList = Screens.getWidgets(screen).stream()
+                    .filter(WorldSelectionList.class::isInstance)
+                    .map(WorldSelectionList.class::cast)
+                    .findFirst()
+                    .orElse(null);
             backupsButton = Button.builder(Component.literal("Backups"), ignored -> openBrowser())
                     .bounds(Math.max(10, (width - 100) / 2), Math.max(5, height - 28), 100, 20)
                     .build();
-            backupsButton.active = false;
-            backupsButton.setTooltip(Tooltip.create(Component.literal("Select a valid world")));
+            disable("Select a valid world");
             Screens.getWidgets(screen).add(backupsButton);
+            ScreenEvents.afterTick(screen).register(ignored -> afterTick());
             relayoutBottomBar();
             updateSelection();
         }
 
-        private WorldSelectionList findWorldList() {
-            return Screens.getWidgets(screen).stream()
-                    .filter(WorldSelectionList.class::isInstance)
-                    .map(WorldSelectionList.class::cast)
-                    .findFirst()
-                    .orElse(null);
-        }
-
         private void afterTick() {
-            if (!active || backupsButton == null) {
-                return;
-            }
             if (layoutPending) {
                 layoutPending = false;
                 relayoutBottomBar();
@@ -159,48 +122,25 @@ private void afterTick() {
             updateSelection();
         }
 
-        private void removed() {
-            active = false;
-            selectionRevision++;
-            selectedWorld = null;
-            resolvedWorld = null;
-            worldList = null;
-            uninstallButton();
-        }
-
-        private void uninstallButton() {
-            Button installed = backupsButton;
-            backupsButton = null;
-            if (installed != null) {
-                Screens.getWidgets(screen).remove(installed);
-            }
-        }
-
+        /** Resolves the selected world whenever the selection changes. */
         private void updateSelection() {
-            Optional<WorldSelectionList.WorldListEntry> selected = worldList == null
-                    ? Optional.empty()
-                    : worldList.getSelectedOpt();
-            Optional<BackupWorldSelection> candidate = selected
+            Optional<BackupWorldSelection> candidate = Optional.ofNullable(worldList)
+                    .flatMap(WorldSelectionList::getSelectedOpt)
                     .filter(WorldSelectionList.WorldListEntry::canInteract)
                     .flatMap(this::selectionFor);
-            if (candidate.equals(Optional.ofNullable(selectedWorld))) {
-                if (candidate.isEmpty()) {
-                    rememberSelection(null);
-                    disable("Select a valid world");
-                }
+            if (candidate.equals(Optional.ofNullable(selected))) {
                 return;
             }
-
-            selectionRevision++;
-            selectedWorld = candidate.orElse(null);
-            resolvedWorld = null;
-            rememberSelection(selectedWorld);
-            if (selectedWorld == null) {
+            selected = candidate.orElse(null);
+            resolved = null;
+            lastSelection = selected;
+            if (selected == null) {
+                resolver.cancel();
                 disable("Select a valid world");
                 return;
             }
             disable("Loading world identity…");
-            resolveSelectedWorld(selectedWorld, selectionRevision);
+            resolver.resolve(facade, selected, this::enable, this::disable);
         }
 
         private Optional<BackupWorldSelection> selectionFor(WorldSelectionList.WorldListEntry entry) {
@@ -216,63 +156,28 @@ private Optional<BackupWorldSelection> selectionFor(WorldSelectionList.WorldList
             }
         }
 
-        private void resolveSelectedWorld(BackupWorldSelection selection, long revision) {
-            CompletionStage<Optional<BackupWorldContext>> resolution;
-            try {
-                resolution = Objects.requireNonNull(
-                        currentFacade().resolveWorld(selection),
-                        "resolveWorld result");
-            } catch (RuntimeException exception) {
-                disable("Backups are not ready");
-                return;
-            }
-            resolution.whenComplete((resolved, throwable) -> minecraft.execute(() -> {
-                if (!active || revision != selectionRevision || !selection.equals(selectedWorld)) {
-                    return;
-                }
-                if (throwable != null || resolved == null || resolved.isEmpty()) {
-                    disable("Backups are unavailable for this world");
-                    return;
-                }
-                BackupWorldContext context = resolved.orElseThrow();
-                if (!context.matches(selection)) {
-                    disable("World identity did not match the selection");
-                    return;
-                }
-                resolvedWorld = context;
-                rememberWorld(selection, context);
-                backupsButton.active = true;
-                backupsButton.setTooltip(Tooltip.create(
-                        Component.literal("Browse backups for " + context.displayName())));
-            }));
+        private void enable(BackupWorldContext context) {
+            resolved = context;
+            backupsButton.active = true;
+            backupsButton.setTooltip(Tooltip.create(
+                    Component.literal("Browse backups for " + context.displayName())));
         }
 
         private void disable(String message) {
-            if (backupsButton == null) {
-                return;
-            }
             backupsButton.active = false;
             backupsButton.setTooltip(Tooltip.create(Component.literal(message)));
         }
 
         private void openBrowser() {
-            BackupWorldContext context = resolvedWorld;
-            BackupWorldSelection selection = selectedWorld;
-            if (!active || context == null || selection == null || !context.matches(selection)) {
+            if (resolved == null) {
                 disable("Select a valid world");
                 return;
             }
-            try {
-                minecraft.setScreenAndShow(new BackupBrowserScreen(screen, context, currentFacade()));
-            } catch (RuntimeException exception) {
-                disable("Backups are not ready");
-            }
+            minecraft.setScreenAndShow(new BackupBrowserScreen(screen, resolved, facade));
         }
 
+        /** Puts the Backups button into vanilla's bottom row, before its last button, at equal widths. */
         private void relayoutBottomBar() {
-            if (backupsButton == null) {
-                return;
-            }
             List<Button> vanillaButtons = Screens.getWidgets(screen).stream()
                     .filter(Button.class::isInstance)
                     .map(Button.class::cast)
@@ -294,13 +199,9 @@ private void relayoutBottomBar() {
                         Math.max(5, screen.height - 28));
                 return;
             }
-
             bottomRow.add(bottomRow.size() - 1, backupsButton);
-            int availableWidth = Math.max(200, screen.width - 20);
-            int totalWidth = Math.min(MAXIMUM_BAR_WIDTH, availableWidth);
-            int buttonWidth = Math.max(
-                    32,
-                    (totalWidth - GAP * (bottomRow.size() - 1)) / bottomRow.size());
+            int totalWidth = Math.min(MAXIMUM_BAR_WIDTH, Math.max(200, screen.width - 20));
+            int buttonWidth = Math.max(32, (totalWidth - GAP * (bottomRow.size() - 1)) / bottomRow.size());
             int usedWidth = buttonWidth * bottomRow.size() + GAP * (bottomRow.size() - 1);
             int x = (screen.width - usedWidth) / 2;
             for (Button button : bottomRow) {
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/SelectedWorldResolver.java b/src/client/java/dev/ishaanko/worldarchive/ui/SelectedWorldResolver.java
new file mode 100644
index 0000000..bbf533e
--- /dev/null
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/SelectedWorldResolver.java
@@ -0,0 +1,43 @@
+package dev.ishaanko.worldarchive.ui;
+
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldSelection;
+import java.util.function.Consumer;
+import net.minecraft.client.gui.screens.Screen;
+
+/**
+ * Resolves the WorldArchive identity of a world picked in a vanilla world screen, for the
+ * WorldArchive buttons on that screen. The newest request wins; the answer to an older selection
+ * is dropped.
+ */
+final class SelectedWorldResolver {
+    private final ScreenCalls calls;
+
+    SelectedWorldResolver(Screen screen) {
+        calls = new ScreenCalls(screen);
+    }
+
+    /**
+     * Resolves {@code selection}. {@code resolved} receives the world; {@code unavailable} receives
+     * the text the buttons show when WorldArchive cannot back the world up.
+     */
+    void resolve(
+            BackupClientFacade facade,
+            BackupWorldSelection selection,
+            Consumer<BackupWorldContext> resolved,
+            Consumer<String> unavailable) {
+        calls.dropPending();
+        calls.start(() -> facade.resolveWorld(selection), world -> {
+            if (world.matches(selection)) {
+                resolved.accept(world);
+            } else {
+                unavailable.accept("World identity did not match the selection");
+            }
+        }, failure -> unavailable.accept(FailureMessages.text(failure)));
+    }
+
+    /** Drops the answer of a request that is still running. */
+    void cancel() {
+        calls.dropPending();
+    }
+}
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/StorageScreen.java b/src/client/java/dev/ishaanko/worldarchive/ui/StorageScreen.java
index 7c473fb..5361532 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/StorageScreen.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/StorageScreen.java
@@ -1,12 +1,17 @@
 package dev.ishaanko.worldarchive.ui;
 
 import dev.ishaanko.worldarchive.config.StoragePolicy;
+import dev.ishaanko.worldarchive.storage.management.CleanupPlan;
 import dev.ishaanko.worldarchive.storage.management.StorageForecast;
 import dev.ishaanko.worldarchive.storage.management.StorageOverview;
+import dev.ishaanko.worldarchive.ui.model.BackupText;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
 import dev.ishaanko.worldarchive.ui.model.ScreenGeometry;
-import java.math.BigDecimal;
-import java.math.RoundingMode;
+import dev.ishaanko.worldarchive.ui.model.StoragePolicyInput;
+import java.util.List;
 import java.util.Objects;
+import java.util.Optional;
+import java.util.function.Consumer;
 import net.minecraft.ChatFormatting;
 import net.minecraft.client.gui.components.Button;
 import net.minecraft.client.gui.components.EditBox;
@@ -16,10 +21,11 @@
 import net.minecraft.client.gui.screens.Screen;
 import net.minecraft.network.chat.Component;
 
-/** Calm per-world storage budget, forecast, and cleanup entry point. */
+/**
+ * One world's storage use, its storage limit and keep counts, and the way into a cleanup that the
+ * player reviews before anything is deleted.
+ */
 final class StorageScreen extends Screen {
-    private static final BigDecimal GIBIBYTE = BigDecimal.valueOf(1_073_741_824L);
-
     private static final int CONTENT_MIN = 230;
 
     private static final int CONTENT_MAX = 430;
@@ -32,12 +38,14 @@ final class StorageScreen extends Screen {
 
     private final BackupClientFacade facade;
 
+    private final ScreenCalls calls = new ScreenCalls(this);
+
     private StorageOverview overview;
 
     private Component status =
             Component.literal("Checking how much space backups use…").withStyle(ChatFormatting.GRAY);
 
-    private String budget = "";
+    private String limit = "";
 
     private String daily = Integer.toString(StoragePolicy.DEFAULT_DAILY_COPIES);
 
@@ -45,14 +53,11 @@ final class StorageScreen extends Screen {
 
     private String monthly = Integer.toString(StoragePolicy.DEFAULT_MONTHLY_COPIES);
 
-    private boolean active;
-
     private boolean busy = true;
 
+    /** The fields differ from the saved policy; cleanup would still use the saved one. */
     private boolean edited;
 
-    private long revision;
-
     StorageScreen(
             Screen parent,
             BackupWorldContext world,
@@ -66,31 +71,21 @@ final class StorageScreen extends Screen {
     @Override
     public void added() {
         super.added();
-        active = true;
         load();
     }
 
-    @Override
-    public void removed() {
-        active = false;
-        revision++;
-        super.removed();
-    }
-
     @Override
     protected void init() {
         int contentWidth = ScreenGeometry.contentWidth(width, CONTENT_MIN, CONTENT_MAX, CONTENT_MARGIN);
         int x = ScreenGeometry.centerX(width, contentWidth);
         addRenderableOnly(Widgets.title(font, x, 10, contentWidth, 20, title));
         if (overview == null) {
-            addRenderableOnly(new MultiLineTextWidget(
-                            x,
-                            42,
-                            status,
-                            font)
+            addRenderableOnly(new MultiLineTextWidget(x, 42, status, font)
                     .setMaxWidth(contentWidth)
                     .setMaxRows(4));
-            addBackButton(x, contentWidth);
+            addRenderableWidget(Button.builder(Component.literal("Back"), ignored -> onClose())
+                    .bounds(x, height - 28, contentWidth, 20)
+                    .build());
             return;
         }
         addUsage(x, contentWidth);
@@ -100,28 +95,29 @@ protected void init() {
 
     private void addUsage(int x, int contentWidth) {
         StoragePolicy policy = overview.policy();
-        String total = bytes(overview.totalBytes());
         String budgetLabel = policy.budgetEnabled()
-                ? "limit " + bytes(policy.budgetBytes())
+                ? "limit " + BackupText.bytes(policy.budgetBytes())
                 : "no limit set";
         addRenderableOnly(new StringWidget(
                 x,
                 38,
                 contentWidth,
                 18,
-                Component.literal(total + " used · " + budgetLabel),
+                Component.literal(BackupText.bytes(overview.totalBytes()) + " used · " + budgetLabel),
                 font));
-        String breakdown = "Git " + bytes(overview.gitBytes())
-                + "  ·  ZIP " + bytes(overview.zipBytes());
+        Component breakdown = Component.literal("Git " + BackupText.bytes(overview.gitBytes())
+                + "  ·  ZIP " + BackupText.bytes(overview.zipBytes()));
         if (overview.unmeteredStoragePresent()) {
-            breakdown += "  ·  copies on GitHub or in linked folders not counted";
+            breakdown = breakdown.copy()
+                    .append("  ·  ")
+                    .append(Component.translatable("screen.worldarchive.storage.not_counted"));
         }
         StringWidget breakdownWidget = new StringWidget(
                 x,
                 58,
                 contentWidth,
                 18,
-                Component.literal(breakdown).withStyle(ChatFormatting.GRAY),
+                breakdown.copy().withStyle(ChatFormatting.GRAY),
                 font);
         breakdownWidget.setTooltip(Tooltip.create(Component.literal(
                 "Counts backup files stored on this computer. Git backups share data"
@@ -137,34 +133,13 @@ private void addUsage(int x, int contentWidth) {
     private void addPolicyFields(int x, int contentWidth) {
         int labelWidth = Math.min(105, contentWidth / 3);
         addRenderableOnly(Widgets.label(font, x, 106, labelWidth, 20, "Limit (GiB)"));
-        EditBox budgetField = field(
-                x + labelWidth,
-                106,
-                contentWidth - labelWidth,
-                budget,
-                value -> {
-                    budget = value;
-                    edited = true;
-                });
-        budgetField.setHint(Component.literal("Empty = no limit"));
-
-        int gap = 4;
-        int fieldWidth = (contentWidth - gap * 2) / 3;
-        addCountField(x, 142, fieldWidth, "Daily", daily, value -> daily = value);
-        addCountField(
-                x + fieldWidth + gap,
-                142,
-                fieldWidth,
-                "Weekly",
-                weekly,
-                value -> weekly = value);
-        addCountField(
-                x + (fieldWidth + gap) * 2,
-                142,
-                fieldWidth,
-                "Monthly",
-                monthly,
-                value -> monthly = value);
+        field(x + labelWidth, 106, contentWidth - labelWidth, limit, value -> limit = value)
+                .setHint(Component.literal("Empty = no limit"));
+
+        int fieldWidth = (contentWidth - Widgets.GAP * 2) / 3;
+        addCountField(x, fieldWidth, "Daily", daily, value -> daily = value);
+        addCountField(x + fieldWidth + Widgets.GAP, fieldWidth, "Weekly", weekly, value -> weekly = value);
+        addCountField(x + (fieldWidth + Widgets.GAP) * 2, fieldWidth, "Monthly", monthly, value -> monthly = value);
         addRenderableOnly(new MultiLineTextWidget(
                         x,
                         184,
@@ -177,40 +152,20 @@ private void addPolicyFields(int x, int contentWidth) {
                 .setMaxRows(2));
     }
 
-    private void addCountField(
-            int x,
-            int y,
-            int width,
-            String label,
-            String value,
-            java.util.function.Consumer<String> update) {
-        addRenderableOnly(Widgets.label(font, x, y, width, 16, label));
-        field(x, y + 17, width, 20, value, next -> {
-            update.accept(next);
-            edited = true;
-        });
-    }
-
-    private EditBox field(
-            int x,
-            int y,
-            int width,
-            String value,
-            java.util.function.Consumer<String> update) {
-        return field(x, y, width, 20, value, update);
+    private void addCountField(int x, int width, String label, String value, Consumer<String> update) {
+        addRenderableOnly(Widgets.label(font, x, 142, width, 16, label));
+        field(x, 159, width, value, update);
     }
 
-    private EditBox field(
-            int x,
-            int y,
-            int width,
-            int height,
-            String value,
-            java.util.function.Consumer<String> update) {
-        EditBox field = new EditBox(font, x, y, width, height, Component.empty());
+    /** A text field that marks the policy as edited when its text changes. */
+    private EditBox field(int x, int y, int width, String value, Consumer<String> update) {
+        EditBox field = new EditBox(font, x, y, width, 20, Component.empty());
         field.setMaxLength(16);
         field.setValue(value);
-        field.setResponder(update);
+        field.setResponder(next -> {
+            update.accept(next);
+            edited = true;
+        });
         field.active = !busy;
         addRenderableWidget(field);
         return field;
@@ -218,29 +173,20 @@ private EditBox field(
 
     private void addActions(int x, int contentWidth) {
         int y = height - 28;
-        int gap = 4;
-        int buttonWidth = (contentWidth - gap * 2) / 3;
-        Button save = Button.builder(Component.literal("Save Policy"), ignored -> save())
-                .bounds(x, y, buttonWidth, 20)
-                .build();
+        Button save = Button.builder(Component.literal("Save Policy"), ignored -> save()).build();
         save.active = !busy;
-        addRenderableWidget(save);
-        Button review = Button.builder(
-                        Component.literal("Review Cleanup"),
-                        ignored -> review())
-                .bounds(x + buttonWidth + gap, y, buttonWidth, 20)
-                .build();
-        review.active = !busy && overview.policy().budgetEnabled();
-        if (!review.active) {
-            review.setTooltip(Tooltip.create(Component.literal(
-                    "Set and save a storage limit first")));
+        Button review = Button.builder(Component.literal("Review Cleanup"), ignored -> review()).build();
+        review.active = !busy && !edited && overview.policy().budgetEnabled();
+        if (edited) {
+            review.setTooltip(Tooltip.create(Component.translatable("screen.worldarchive.storage.save_first")));
+        } else if (!overview.policy().budgetEnabled()) {
+            review.setTooltip(Tooltip.create(Component.literal("Set and save a storage limit first")));
         }
-        addRenderableWidget(review);
-        Button back = Button.builder(Component.literal("Back"), ignored -> onClose())
-                .bounds(x + (buttonWidth + gap) * 2, y, buttonWidth, 20)
-                .build();
+        Button back = Button.builder(Component.literal("Back"), ignored -> onClose()).build();
         back.active = !busy;
-        addRenderableWidget(back);
+        List<Button> buttons = List.of(save, review, back);
+        Widgets.row(x, y, contentWidth, buttons);
+        buttons.forEach(this::addRenderableWidget);
         StringWidget statusWidget = new StringWidget(x, y - 20, contentWidth, 16, status, font);
         statusWidget.setTooltip(Tooltip.create(status));
         addRenderableOnly(statusWidget);
@@ -251,117 +197,62 @@ public boolean shouldCloseOnEsc() {
         return !busy;
     }
 
-    private void addBackButton(int x, int contentWidth) {
-        addRenderableWidget(Button.builder(Component.literal("Back"), ignored -> onClose())
-                .bounds(x, height - 28, contentWidth, 20)
-                .build());
-    }
-
     private void load() {
-        long token = ++revision;
         busy = true;
-        facade.storageOverview(world.worldId()).whenComplete((loaded, throwable) ->
-                minecraft.execute(() -> {
-                    if (!active || token != revision) {
-                        return;
-                    }
-                    busy = false;
-                    if (throwable != null || loaded == null) {
-                        status = failure(throwable);
-                    } else {
-                        overview = loaded;
-                        if (!edited) {
-                            StoragePolicy policy = loaded.policy();
-                            budget = policy.budgetEnabled()
-                                    ? gibibytes(policy.budgetBytes())
-                                    : "";
-                            daily = Integer.toString(policy.dailyCopies());
-                            weekly = Integer.toString(policy.weeklyCopies());
-                            monthly = Integer.toString(policy.monthlyCopies());
-                        }
-                        status = loaded.cleanupReviewRecommended()
-                                ? Component.literal("Backups are close to the limit · review cleanup")
-                                        .withStyle(ChatFormatting.YELLOW)
-                                : Component.literal("Up to date")
-                                        .withStyle(ChatFormatting.GRAY);
-                    }
-                    rebuildWidgets();
-                }));
+        calls.start(() -> facade.storageOverview(world.worldId()), this::showOverview, this::showFailure);
+    }
+
+    private void showOverview(StorageOverview loaded) {
+        busy = false;
+        overview = loaded;
+        if (!edited) {
+            StoragePolicy policy = loaded.policy();
+            limit = StoragePolicyInput.limitText(policy);
+            daily = Integer.toString(policy.dailyCopies());
+            weekly = Integer.toString(policy.weeklyCopies());
+            monthly = Integer.toString(policy.monthlyCopies());
+        }
+        status = loaded.cleanupReviewRecommended()
+                ? Component.literal("Backups are close to the limit · review cleanup")
+                        .withStyle(ChatFormatting.YELLOW)
+                : Component.literal("Up to date").withStyle(ChatFormatting.GRAY);
+        rebuildWidgets();
     }
 
     private void save() {
-        final StoragePolicy policy;
-        try {
-            policy = policy();
-        } catch (IllegalArgumentException exception) {
-            status = Component.literal(exception.getMessage()).withStyle(ChatFormatting.RED);
+        Optional<StoragePolicy> policy = StoragePolicyInput.parse(limit, daily, weekly, monthly);
+        if (policy.isEmpty()) {
+            status = Component.literal("Enter a number for the limit and whole numbers for the keep counts")
+                    .withStyle(ChatFormatting.RED);
             rebuildWidgets();
             return;
         }
-        long token = ++revision;
         busy = true;
         status = Component.literal("Saving…").withStyle(ChatFormatting.GRAY);
         rebuildWidgets();
-        facade.saveStoragePolicy(world.worldId(), policy).whenComplete((ignored, throwable) ->
-                minecraft.execute(() -> {
-                    if (!active || token != revision) {
-                        return;
-                    }
-                    busy = false;
-                    if (throwable != null) {
-                        status = failure(throwable);
-                        rebuildWidgets();
-                    } else {
-                        edited = false;
-                        load();
-                    }
-                }));
+        calls.start(() -> facade.saveStoragePolicy(world.worldId(), policy.orElseThrow()), ignored -> {
+            edited = false;
+            load();
+        }, this::showFailure);
     }
 
+    /** Prepares a cleanup plan from the saved policy; a plan left unused expires by itself. */
     private void review() {
-        long token = ++revision;
         busy = true;
-        status = Component.literal("Preparing cleanup preview…")
-                .withStyle(ChatFormatting.GRAY);
+        status = Component.literal("Preparing cleanup preview…").withStyle(ChatFormatting.GRAY);
         rebuildWidgets();
-        facade.prepareCleanup(world.worldId()).whenComplete((plan, throwable) ->
-                minecraft.execute(() -> {
-                    if (!active || token != revision) {
-                        if (plan != null) {
-                            facade.discardCleanup(plan.confirmationToken());
-                        }
-                        return;
-                    }
-                    busy = false;
-                    if (throwable != null || plan == null) {
-                        status = failure(throwable);
-                        rebuildWidgets();
-                    } else {
-                        minecraft.setScreenAndShow(new CleanupPreviewScreen(
-                                this,
-                                world,
-                                facade,
-                                plan));
-                    }
-                }));
+        calls.start(() -> facade.prepareCleanup(world.worldId()), this::showPlan, this::showFailure);
     }
 
-    private StoragePolicy policy() {
-        try {
-            BigDecimal value = budget.isBlank() ? BigDecimal.ZERO : new BigDecimal(budget);
-            long budgetBytes = value.multiply(GIBIBYTE)
-                    .setScale(0, RoundingMode.HALF_UP)
-                    .longValueExact();
-            return new StoragePolicy(
-                    budgetBytes,
-                    Integer.parseInt(daily),
-                    Integer.parseInt(weekly),
-                    Integer.parseInt(monthly));
-        } catch (ArithmeticException | NumberFormatException exception) {
-            throw new IllegalArgumentException(
-                    "Enter a number for the limit and whole numbers for the keep counts",
-                    exception);
-        }
+    private void showPlan(CleanupPlan plan) {
+        busy = false;
+        minecraft.setScreenAndShow(new CleanupPreviewScreen(this, world, facade, plan));
+    }
+
+    private void showFailure(Throwable failure) {
+        busy = false;
+        status = FailureMessages.status(failure);
+        rebuildWidgets();
     }
 
     private static String forecast(StorageForecast forecast) {
@@ -376,34 +267,6 @@ private static String forecast(StorageForecast forecast) {
         };
     }
 
-    static String bytes(long bytes) {
-        if (bytes < 1_024) {
-            return bytes + " B";
-        }
-        String[] units = {"KiB", "MiB", "GiB", "TiB"};
-        double value = bytes;
-        int unit = -1;
-        do {
-            value /= 1_024;
-            unit++;
-        } while (value >= 1_024 && unit < units.length - 1);
-        return String.format(java.util.Locale.ROOT, "%.1f %s", value, units[unit]);
-    }
-
-    private static String gibibytes(long bytes) {
-        return BigDecimal.valueOf(bytes)
-                .divide(GIBIBYTE, 2, RoundingMode.HALF_UP)
-                .stripTrailingZeros()
-                .toPlainString();
-    }
-
-    static Component failure(Throwable throwable) {
-        Throwable safe = throwable == null
-                ? new IllegalStateException("Storage operation returned no result")
-                : throwable;
-        return Component.literal(FailureMessages.safe(safe, 220)).withStyle(ChatFormatting.RED);
-    }
-
     @Override
     public void onClose() {
         minecraft.setScreenAndShow(parent);
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/Widgets.java b/src/client/java/dev/ishaanko/worldarchive/ui/Widgets.java
index 88704b1..677f6eb 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/Widgets.java
+++ b/src/client/java/dev/ishaanko/worldarchive/ui/Widgets.java
@@ -1,16 +1,22 @@
 package dev.ishaanko.worldarchive.ui;
 
+import dev.ishaanko.worldarchive.ui.model.Paging;
+import java.util.List;
+import java.util.function.IntConsumer;
 import net.minecraft.ChatFormatting;
 import net.minecraft.client.gui.Font;
+import net.minecraft.client.gui.components.AbstractWidget;
+import net.minecraft.client.gui.components.Button;
 import net.minecraft.client.gui.components.StringWidget;
 import net.minecraft.network.chat.Component;
 
-/**
- * Small reusable factories for the StringWidget idioms repeated across backup/cleanup/settings
- * screens.
- */
+/** Small widget factories and layouts shared by the backup, cleanup, import and settings screens. */
 public final class Widgets {
-    private Widgets() {}
+    /** The space between two widgets in a row. */
+    static final int GAP = 4;
+
+    private Widgets() {
+    }
 
     /** Bold title row, the screen's own {@code title} restyled and laid out at the top of the page. */
     public static StringWidget title(
@@ -45,4 +51,34 @@ public static StringWidget muted(
         return new StringWidget(
                 x, y, width, height, Component.literal(text).withStyle(ChatFormatting.GRAY), font);
     }
+
+    /** Places {@code widgets} left to right at equal widths across {@code width}, with a gap between. */
+    static void row(int x, int y, int width, List<? extends AbstractWidget> widgets) {
+        int each = Math.max(1, (width - GAP * (widgets.size() - 1)) / widgets.size());
+        int left = x;
+        for (AbstractWidget widget : widgets) {
+            widget.setRectangle(each, widget.getHeight(), left, y);
+            left += each + GAP;
+        }
+    }
+
+    /** The Previous and Next buttons of a paged list; each passes the page it opens to {@code showPage}. */
+    static List<Button> pageButtons(Paging paging, IntConsumer showPage) {
+        Button previous = Button.builder(
+                        Component.translatable("screen.worldarchive.page.previous"),
+                        ignored -> showPage.accept(paging.pageIndex() - 1))
+                .build();
+        previous.active = paging.hasPrevious();
+        Button next = Button.builder(
+                        Component.translatable("screen.worldarchive.page.next"),
+                        ignored -> showPage.accept(paging.pageIndex() + 1))
+                .build();
+        next.active = paging.hasNext();
+        return List.of(previous, next);
+    }
+
+    /** A checkbox drawn as button text, as the cleanup and import lists show one per row. */
+    static Component checkbox(boolean checked, Component label) {
+        return Component.literal(checked ? "[x] " : "[ ] ").append(label);
+    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/WorldArchiveMetadata.java b/src/main/java/dev/ishaanko/worldarchive/WorldArchiveMetadata.java
deleted file mode 100644
index 580ea73..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/WorldArchiveMetadata.java
+++ /dev/null
@@ -1,8 +0,0 @@
-package dev.ishaanko.worldarchive;
-
-public final class WorldArchiveMetadata {
-    public static final String MOD_NAME = "WorldArchive";
-
-    private WorldArchiveMetadata() {
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/catalog/BackupCatalog.java b/src/main/java/dev/ishaanko/worldarchive/catalog/BackupCatalog.java
index 6995f20..4248d11 100644
--- a/src/main/java/dev/ishaanko/worldarchive/catalog/BackupCatalog.java
+++ b/src/main/java/dev/ishaanko/worldarchive/catalog/BackupCatalog.java
@@ -4,44 +4,75 @@
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.io.IOException;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Map;
+import java.util.Objects;
 import java.util.Optional;
 import java.util.function.UnaryOperator;
 
-/** Durable metadata index. Implementations never delete backups automatically. */
+/**
+ * The persistent list of backups that the screens show. A read sees the catalog as it was at one
+ * moment. A change reads and writes the catalog once, however many records it touches, and
+ * nothing else changes the catalog in between. A catalog never deletes a backup's files.
+ */
 public interface BackupCatalog {
+    /** Adds a new record; an identical record is accepted, a different one with the same ID is refused. */
     void add(BackupRecord record) throws IOException;
 
-    /** Idempotently adds or augments a record without overwriting conflicting metadata. */
-    default CatalogMergeResult merge(BackupRecord discovered) throws IOException {
-        Optional<BackupRecord> existing = find(discovered.manifest().backupId());
-        if (existing.isEmpty()) {
-            add(discovered);
-            return new CatalogMergeResult(CatalogMergeStatus.ADDED, discovered);
-        }
-        CatalogMergeResult merged = BackupRecordMerger.merge(existing.orElseThrow(), discovered);
-        if (merged.status() == CatalogMergeStatus.MERGED) {
-            update(discovered.manifest().backupId(), ignored -> merged.record());
-        }
-        return merged;
-    }
-
-    /** Non-mutating preview of what {@link #merge} would decide, without writing anything. */
-    default CatalogMergeStatus previewMerge(BackupRecord discovered) throws IOException {
-        Optional<BackupRecord> existing = find(discovered.manifest().backupId());
-        return existing.isEmpty()
-                ? CatalogMergeStatus.ADDED
-                : BackupRecordMerger.merge(existing.orElseThrow(), discovered).status();
-    }
-
     Optional<BackupRecord> find(BackupId backupId) throws IOException;
 
+    /** Every record, newest first. */
     List<BackupRecord> listAll() throws IOException;
 
+    /** The records of one world, newest first. */
     List<BackupRecord> list(WorldId worldId) throws IOException;
 
-    /** Atomically transforms one record while holding the catalog's process lock. */
-    Optional<BackupRecord> update(BackupId backupId, UnaryOperator<BackupRecord> update) throws IOException;
+    /**
+     * Changes several records at once. Each change receives the record with its ID, or empty when
+     * the catalog has none, and returns the record to keep, or empty to have none. A record keeps
+     * its backup and world IDs.
+     *
+     * @return the record each ID has afterwards, or empty when it has none
+     */
+    Map<BackupId, Optional<BackupRecord>> updateAll(Map<BackupId, UnaryOperator<Optional<BackupRecord>>> changes)
+            throws IOException;
 
-    boolean remove(BackupId backupId) throws IOException;
+    /**
+     * Whether a damaged catalog file was set aside since this catalog was opened. The records that
+     * no longer read in it are lost, so a rebuild asks each world's remote which copies are there.
+     */
+    boolean lostRecords();
+
+    /** Replaces one record; returns empty and changes nothing when the catalog has none. */
+    default Optional<BackupRecord> update(BackupId backupId, UnaryOperator<BackupRecord> update) throws IOException {
+        Objects.requireNonNull(update, "update");
+        return updateAll(Map.of(backupId, current -> current.map(update))).get(backupId);
+    }
+
+    /**
+     * Merges discovered records at once, each by {@link CatalogMergeResult#merge}. Each backup may
+     * appear once.
+     */
+    default Map<BackupId, CatalogMergeResult> mergeAll(Collection<BackupRecord> discovered) throws IOException {
+        Map<BackupId, CatalogMergeResult> results = new HashMap<>();
+        Map<BackupId, UnaryOperator<Optional<BackupRecord>>> changes = new LinkedHashMap<>();
+        for (BackupRecord record : discovered) {
+            BackupId backupId = record.manifest().backupId();
+            UnaryOperator<Optional<BackupRecord>> merge = current -> {
+                CatalogMergeResult result = CatalogMergeResult.merge(current, record);
+                results.put(backupId, result);
+                return Optional.of(result.record());
+            };
+            if (changes.putIfAbsent(backupId, merge) != null) {
+                throw new IllegalArgumentException("Backup " + backupId + " was discovered twice");
+            }
+        }
+        if (!changes.isEmpty()) {
+            updateAll(changes);
+        }
+        return results;
+    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/catalog/BackupDeletionRegistry.java b/src/main/java/dev/ishaanko/worldarchive/catalog/BackupDeletionRegistry.java
deleted file mode 100644
index d502840..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/catalog/BackupDeletionRegistry.java
+++ /dev/null
@@ -1,29 +0,0 @@
-package dev.ishaanko.worldarchive.catalog;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import java.io.IOException;
-
-/** Durable intent that prevents automatic catalog repair from reviving a manual deletion. */
-public interface BackupDeletionRegistry {
-    BackupDeletionRegistry NONE = new BackupDeletionRegistry() {
-        @Override
-        public boolean contains(BackupId backupId) {
-            return false;
-        }
-
-        @Override
-        public void record(BackupId backupId) {
-        }
-
-        @Override
-        public void restore(BackupId backupId) {
-        }
-    };
-
-    boolean contains(BackupId backupId) throws IOException;
-
-    void record(BackupId backupId) throws IOException;
-
-    /** Clears a deletion marker after an explicit user-selected reimport. */
-    void restore(BackupId backupId) throws IOException;
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/catalog/BackupRecordMerger.java b/src/main/java/dev/ishaanko/worldarchive/catalog/BackupRecordMerger.java
deleted file mode 100644
index e0289d4..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/catalog/BackupRecordMerger.java
+++ /dev/null
@@ -1,69 +0,0 @@
-package dev.ishaanko.worldarchive.catalog;
-
-import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.EnumMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-
-/** Exact, non-destructive merge policy shared by catalog implementations. */
-final class BackupRecordMerger {
-    private BackupRecordMerger() {
-    }
-
-    static CatalogMergeResult merge(BackupRecord existing, BackupRecord discovered) {
-        Objects.requireNonNull(existing, "existing");
-        Objects.requireNonNull(discovered, "discovered");
-        if (!existing.manifest().equals(discovered.manifest())) {
-            return new CatalogMergeResult(CatalogMergeStatus.CONFLICT, existing);
-        }
-        Map<DestinationType, DestinationResult> destinations = new EnumMap<>(DestinationType.class);
-        existing.result().destinations().forEach(result ->
-                destinations.put(result.destination(), result));
-        boolean changed = false;
-        for (DestinationResult candidate : discovered.result().destinations()) {
-            DestinationResult current = destinations.get(candidate.destination());
-            if (current == null) {
-                destinations.put(candidate.destination(), candidate);
-                changed = true;
-            } else if (!sameArtifact(current, candidate)) {
-                return new CatalogMergeResult(CatalogMergeStatus.CONFLICT, existing);
-            }
-        }
-        if (!changed) {
-            return new CatalogMergeResult(CatalogMergeStatus.UNCHANGED, existing);
-        }
-        List<DestinationResult> mergedDestinations = new ArrayList<>();
-        for (DestinationType type : DestinationType.values()) {
-            DestinationResult destination = destinations.get(type);
-            if (destination != null) {
-                mergedDestinations.add(destination);
-            }
-        }
-        Instant completedAt = existing.result().completedAt().isAfter(discovered.result().completedAt())
-                ? existing.result().completedAt()
-                : discovered.result().completedAt();
-        BackupRecord merged = new BackupRecord(
-                existing.manifest(),
-                BackupResult.aggregate(
-                        existing.manifest().backupId(),
-                        existing.manifest().worldId(),
-                        List.copyOf(mergedDestinations),
-                        completedAt));
-        return new CatalogMergeResult(CatalogMergeStatus.MERGED, merged);
-    }
-
-    private static boolean sameArtifact(
-            DestinationResult current,
-            DestinationResult candidate) {
-        return current.destination() == candidate.destination()
-                && current.artifactId().equals(candidate.artifactId())
-                && current.ownership() == candidate.ownership()
-                && current.importSourceId().equals(candidate.importSourceId());
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/catalog/CatalogMergeResult.java b/src/main/java/dev/ishaanko/worldarchive/catalog/CatalogMergeResult.java
index 670438d..69be5ec 100644
--- a/src/main/java/dev/ishaanko/worldarchive/catalog/CatalogMergeResult.java
+++ b/src/main/java/dev/ishaanko/worldarchive/catalog/CatalogMergeResult.java
@@ -1,12 +1,66 @@
 package dev.ishaanko.worldarchive.catalog;
 
 import dev.ishaanko.worldarchive.model.BackupRecord;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import java.time.Instant;
+import java.util.EnumMap;
+import java.util.List;
+import java.util.Map;
 import java.util.Objects;
+import java.util.Optional;
 
-/** Result of an import-safe catalog merge. */
+/**
+ * What merging one discovered backup into the catalog does, and the record the catalog keeps. A
+ * merge only adds: a backup the catalog lacks, or a copy that a listed backup lacks. It never
+ * changes what the catalog already says; a discovered backup that disagrees is a conflict.
+ */
 public record CatalogMergeResult(CatalogMergeStatus status, BackupRecord record) {
     public CatalogMergeResult {
         Objects.requireNonNull(status, "status");
         Objects.requireNonNull(record, "record");
     }
+
+    /** Merges a discovered record into the record the catalog has for the same backup, if any. */
+    public static CatalogMergeResult merge(Optional<BackupRecord> existing, BackupRecord discovered) {
+        Objects.requireNonNull(discovered, "discovered");
+        if (Objects.requireNonNull(existing, "existing").isEmpty()) {
+            return new CatalogMergeResult(CatalogMergeStatus.ADDED, discovered);
+        }
+        BackupRecord current = existing.get();
+        if (!current.manifest().equals(discovered.manifest())) {
+            return new CatalogMergeResult(CatalogMergeStatus.CONFLICT, current);
+        }
+        Map<DestinationType, DestinationResult> destinations = new EnumMap<>(DestinationType.class);
+        current.result().destinations().forEach(destination -> destinations.put(destination.destination(), destination));
+        boolean added = false;
+        for (DestinationResult candidate : discovered.result().destinations()) {
+            DestinationResult known = destinations.putIfAbsent(candidate.destination(), candidate);
+            if (known == null) {
+                added = true;
+            } else if (!sameArtifact(known, candidate)) {
+                return new CatalogMergeResult(CatalogMergeStatus.CONFLICT, current);
+            }
+        }
+        if (!added) {
+            return new CatalogMergeResult(CatalogMergeStatus.UNCHANGED, current);
+        }
+        Instant completedAt = current.result().completedAt().isAfter(discovered.result().completedAt())
+                ? current.result().completedAt()
+                : discovered.result().completedAt();
+        BackupResult merged = new BackupResult(
+                current.manifest().backupId(),
+                current.manifest().worldId(),
+                List.copyOf(destinations.values()),
+                completedAt);
+        return new CatalogMergeResult(CatalogMergeStatus.MERGED, new BackupRecord(current.manifest(), merged));
+    }
+
+    /** The same copy: the same artifact, owned the same way; verification and sync state may differ. */
+    private static boolean sameArtifact(DestinationResult known, DestinationResult candidate) {
+        return known.artifactId().equals(candidate.artifactId())
+                && known.ownership() == candidate.ownership()
+                && known.importSourceId().equals(candidate.importSourceId());
+    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/catalog/DamagedFileException.java b/src/main/java/dev/ishaanko/worldarchive/catalog/DamagedFileException.java
new file mode 100644
index 0000000..d81cff4
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/catalog/DamagedFileException.java
@@ -0,0 +1,13 @@
+package dev.ishaanko.worldarchive.catalog;
+
+import java.io.IOException;
+
+/**
+ * A catalog or registry file that WorldArchive wrote but can no longer decode. Unlike other
+ * {@link IOException}s, reading it again will not help, so the file is moved aside.
+ */
+final class DamagedFileException extends IOException {
+    DamagedFileException(String message, Throwable cause) {
+        super(message, cause);
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/catalog/DamagedFiles.java b/src/main/java/dev/ishaanko/worldarchive/catalog/DamagedFiles.java
new file mode 100644
index 0000000..565de3a
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/catalog/DamagedFiles.java
@@ -0,0 +1,65 @@
+package dev.ishaanko.worldarchive.catalog;
+
+import dev.ishaanko.worldarchive.support.AtomicFiles;
+import java.io.IOException;
+import java.nio.charset.CharacterCodingException;
+import java.nio.file.FileAlreadyExistsException;
+import java.nio.file.Files;
+import java.nio.file.NoSuchFileException;
+import java.nio.file.Path;
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
+import java.util.Optional;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Reads the catalog's own metadata files and moves a damaged one aside, to
+ * {@code <name>.corrupt-<UTC time>}, so WorldArchive can start over without losing it.
+ */
+final class DamagedFiles {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
+    private static final DateTimeFormatter STAMP = DateTimeFormatter.ofPattern("uuuuMMdd'T'HHmmss'Z'")
+            .withZone(ZoneOffset.UTC);
+
+    private static final int MAXIMUM_NAME_ATTEMPTS = 100;
+
+    private DamagedFiles() {
+    }
+
+    /** The file's text, or empty when there is no file; text that is not UTF-8 is damage. */
+    static Optional<String> read(Path file, int maximumBytes) throws IOException {
+        try {
+            return Optional.of(AtomicFiles.readUtf8(file, maximumBytes));
+        } catch (NoSuchFileException missing) {
+            return Optional.empty();
+        } catch (IOException failure) {
+            if (failure.getCause() instanceof CharacterCodingException) {
+                throw new DamagedFileException(file.getFileName() + " is not valid UTF-8 text", failure);
+            }
+            throw failure;
+        }
+    }
+
+    /** Renames the damaged file next to itself and logs where it went; the caller holds its lock. */
+    static void moveAside(Path file, DamagedFileException damage) throws IOException {
+        String stamp = STAMP.format(Instant.now());
+        for (int attempt = 1; ; attempt++) {
+            Path aside = file.resolveSibling(file.getFileName() + ".corrupt-" + stamp + (attempt == 1 ? "" : "-" + attempt));
+            try {
+                Files.move(file, aside);
+                LOGGER.warn("{} could not be read and was moved to {}; WorldArchive starts it over. {}",
+                        file, aside, damage.getMessage());
+                return;
+            } catch (FileAlreadyExistsException taken) {
+                if (attempt == MAXIMUM_NAME_ATTEMPTS) {
+                    throw taken;
+                }
+            } catch (NoSuchFileException gone) {
+                return;
+            }
+        }
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/catalog/FileBackupCatalog.java b/src/main/java/dev/ishaanko/worldarchive/catalog/FileBackupCatalog.java
index 6063454..4f5e815 100644
--- a/src/main/java/dev/ishaanko/worldarchive/catalog/FileBackupCatalog.java
+++ b/src/main/java/dev/ishaanko/worldarchive/catalog/FileBackupCatalog.java
@@ -5,51 +5,56 @@
 import com.google.gson.JsonArray;
 import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
-import com.google.gson.JsonParseException;
 import com.google.gson.JsonParser;
-import com.google.gson.JsonPrimitive;
-import dev.ishaanko.worldarchive.core.AtomicFiles;
+import com.google.gson.stream.JsonReader;
+import dev.ishaanko.worldarchive.model.ArtifactOwnership;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.BackupManifestJson;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.BackupStatus;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.ArtifactOwnership;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationStatus;
 import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.GameVersionStamp;
 import dev.ishaanko.worldarchive.model.ImportSourceId;
 import dev.ishaanko.worldarchive.model.SyncStatus;
 import dev.ishaanko.worldarchive.model.VerificationStatus;
 import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.support.AtomicFiles;
+import dev.ishaanko.worldarchive.support.JsonFields;
+import dev.ishaanko.worldarchive.support.LockedFile;
 import java.io.IOException;
-import java.math.BigDecimal;
-import java.nio.channels.FileChannel;
-import java.nio.channels.FileLock;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
+import java.io.StringReader;
 import java.nio.file.Path;
-import java.nio.file.StandardOpenOption;
-import java.time.Instant;
-import java.time.format.DateTimeParseException;
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.Comparator;
-import java.util.HashSet;
+import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
-import java.util.Set;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentMap;
-import java.util.concurrent.locks.ReentrantLock;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.function.UnaryOperator;
-
-/** Thread- and process-safe JSON catalog with atomic publication. */
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * The catalog in one JSON file. Reads take no lock: every change publishes a whole new file with
+ * an atomic rename, so a reader sees the catalog as it was before or after a change. A change
+ * holds the file's lock across threads and processes from its read to its write.
+ *
+ * <p>A file that cannot be decoded is moved aside to {@code catalog.json.corrupt-<UTC time>} and
+ * the catalog starts over with every record that still reads in it; the start-up rebuild then
+ * lists the backups on disk again. A file from a newer version of WorldArchive is refused
+ * instead, so this version never drops what it cannot read.</p>
+ */
 public final class FileBackupCatalog implements BackupCatalog {
     public static final int CURRENT_SCHEMA_VERSION = 3;
 
+    /** 0.1.0 wrote schema 2; schema 3 added imported artifacts. */
+    private static final int OLDEST_SCHEMA_VERSION = 2;
+
     private static final Gson GSON = new GsonBuilder()
             .setPrettyPrinting()
             .disableHtmlEscaping()
@@ -63,187 +68,212 @@ public final class FileBackupCatalog implements BackupCatalog {
     /** The catalog grows with every backup, so it gets a ceiling well above generic metadata. */
     private static final int MAXIMUM_CATALOG_BYTES = 256 * 1_024 * 1_024;
 
-    private static final ConcurrentMap<Path, ReentrantLock> JVM_LOCKS = new ConcurrentHashMap<>();
+    private static final JsonFields<DamagedFileException> FIELDS = new JsonFields<>(DamagedFileException::new);
+
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
 
     private final Path file;
 
-    private final Path lockFile;
+    private final LockedFile lock;
 
-    private final ReentrantLock jvmLock;
+    private final AtomicBoolean lostRecords = new AtomicBoolean();
 
     public FileBackupCatalog(Path file) {
-        this.file = file.toAbsolutePath().normalize();
-        this.lockFile = this.file.resolveSibling(this.file.getFileName() + ".lock");
-        this.jvmLock = JVM_LOCKS.computeIfAbsent(this.file, ignored -> new ReentrantLock());
+        this.lock = new LockedFile(file);
+        this.file = lock.file();
     }
 
     @Override
     public void add(BackupRecord record) throws IOException {
-        withLock(() -> {
-            List<BackupRecord> records = readRecords();
-            for (BackupRecord existing : records) {
-                if (existing.manifest().backupId().equals(record.manifest().backupId())) {
-                    if (existing.equals(record)) {
-                        return null;
-                    }
-                    throw new IOException("Catalog already contains a different record for backup "
-                            + record.manifest().backupId());
-                }
+        Objects.requireNonNull(record, "record");
+        lock.withLock(() -> {
+            Map<BackupId, BackupRecord> records = readForChange();
+            BackupRecord existing = records.putIfAbsent(record.manifest().backupId(), record);
+            if (existing == null) {
+                write(records.values());
+            } else if (!existing.equals(record)) {
+                throw new IOException("Catalog already contains a different record for backup "
+                        + record.manifest().backupId());
             }
-            records.add(record);
-            writeRecords(records);
             return null;
         });
     }
 
-    @Override
-    public CatalogMergeResult merge(BackupRecord discovered) throws IOException {
-        Objects.requireNonNull(discovered, "discovered");
-        return withLock(() -> {
-            List<BackupRecord> records = readRecords();
-            for (int index = 0; index < records.size(); index++) {
-                BackupRecord existing = records.get(index);
-                if (!existing.manifest().backupId().equals(discovered.manifest().backupId())) {
-                    continue;
-                }
-                CatalogMergeResult result = BackupRecordMerger.merge(existing, discovered);
-                if (result.status() == CatalogMergeStatus.MERGED) {
-                    records.set(index, result.record());
-                    writeRecords(records);
-                }
-                return result;
-            }
-            records.add(discovered);
-            writeRecords(records);
-            return new CatalogMergeResult(CatalogMergeStatus.ADDED, discovered);
-        });
-    }
-
     @Override
     public Optional<BackupRecord> find(BackupId backupId) throws IOException {
-        return withLock(() -> readRecords().stream()
-                .filter(record -> record.manifest().backupId().equals(backupId))
-                .findFirst());
+        Objects.requireNonNull(backupId, "backupId");
+        return Optional.ofNullable(read().get(backupId));
     }
 
     @Override
     public List<BackupRecord> listAll() throws IOException {
-        return withLock(() -> sorted(readRecords()));
+        return sorted(read().values());
     }
 
     @Override
     public List<BackupRecord> list(WorldId worldId) throws IOException {
-        return withLock(() -> sorted(readRecords().stream()
+        Objects.requireNonNull(worldId, "worldId");
+        return sorted(read().values().stream()
                 .filter(record -> record.manifest().worldId().equals(worldId))
-                .toList()));
+                .toList());
     }
 
     @Override
-    public Optional<BackupRecord> update(
-            BackupId backupId,
-            UnaryOperator<BackupRecord> update) throws IOException {
-        return withLock(() -> {
-            List<BackupRecord> records = readRecords();
-            for (int index = 0; index < records.size(); index++) {
-                BackupRecord existing = records.get(index);
-                if (existing.manifest().backupId().equals(backupId)) {
-                    BackupRecord replacement = Objects.requireNonNull(
-                            update.apply(existing),
-                            "Catalog update returned null");
-                    if (!replacement.manifest().backupId().equals(backupId)
-                            || !replacement.manifest().worldId().equals(existing.manifest().worldId())) {
-                        throw new IOException("Catalog update must preserve backup and world identities");
-                    }
-                    records.set(index, replacement);
-                    writeRecords(records);
-                    return Optional.of(replacement);
-                }
-            }
-            return Optional.empty();
-        });
+    public boolean lostRecords() {
+        return lostRecords.get();
     }
 
     @Override
-    public boolean remove(BackupId backupId) throws IOException {
-        return withLock(() -> {
-            List<BackupRecord> records = readRecords();
-            boolean removed = records.removeIf(record -> record.manifest().backupId().equals(backupId));
-            if (removed) {
-                writeRecords(records);
+    public Map<BackupId, Optional<BackupRecord>> updateAll(
+            Map<BackupId, UnaryOperator<Optional<BackupRecord>>> changes) throws IOException {
+        Map<BackupId, UnaryOperator<Optional<BackupRecord>>> requested =
+                new LinkedHashMap<>(Objects.requireNonNull(changes, "changes"));
+        return lock.withLock(() -> {
+            Map<BackupId, BackupRecord> records = readForChange();
+            Map<BackupId, Optional<BackupRecord>> results = new LinkedHashMap<>();
+            boolean changed = false;
+            for (Map.Entry<BackupId, UnaryOperator<Optional<BackupRecord>>> change : requested.entrySet()) {
+                BackupId backupId = change.getKey();
+                Optional<BackupRecord> current = Optional.ofNullable(records.get(backupId));
+                Optional<BackupRecord> replacement = Objects.requireNonNull(
+                        change.getValue().apply(current), "A catalog change returned null");
+                if (replacement.isPresent()) {
+                    requireSameIdentity(backupId, current, replacement.get());
+                    records.put(backupId, replacement.get());
+                } else {
+                    records.remove(backupId);
+                }
+                changed |= !replacement.equals(current);
+                results.put(backupId, replacement);
+            }
+            if (changed) {
+                write(records.values());
             }
-            return removed;
+            return results;
         });
     }
 
-    public Path file() {
-        return file;
+    private static void requireSameIdentity(
+            BackupId backupId,
+            Optional<BackupRecord> current,
+            BackupRecord replacement) throws IOException {
+        boolean sameBackup = replacement.manifest().backupId().equals(backupId);
+        boolean sameWorld = current.isEmpty()
+                || current.get().manifest().worldId().equals(replacement.manifest().worldId());
+        if (!sameBackup || !sameWorld) {
+            throw new IOException("A catalog change must keep the backup and world IDs of " + backupId);
+        }
     }
 
-    private <T> T withLock(IoSupplier<T> operation) throws IOException {
-        jvmLock.lock();
+    /** The records by ID, read without the lock; a damaged file is first moved aside under the lock. */
+    private Map<BackupId, BackupRecord> read() throws IOException {
         try {
-            Path parent = file.getParent();
-            if (parent == null) {
-                throw new IOException("Catalog path has no parent directory: " + file);
-            }
-            Files.createDirectories(parent);
-            if (Files.isSymbolicLink(lockFile)) {
-                throw new IOException("Catalog lock file must not be a symbolic link");
-            }
-            try (FileChannel channel = FileChannel.open(
-                            lockFile,
-                            StandardOpenOption.CREATE,
-                            StandardOpenOption.WRITE,
-                            LinkOption.NOFOLLOW_LINKS);
-                    FileLock ignored = channel.lock()) {
-                return operation.get();
+            return decode(DamagedFiles.read(file, MAXIMUM_CATALOG_BYTES));
+        } catch (DamagedFileException damaged) {
+            return lock.withLock(this::readForChange);
+        }
+    }
+
+    /** The records by ID for a change, whose caller holds the lock; a damaged file is moved aside. */
+    private Map<BackupId, BackupRecord> readForChange() throws IOException {
+        Optional<String> json;
+        try {
+            json = DamagedFiles.read(file, MAXIMUM_CATALOG_BYTES);
+        } catch (DamagedFileException notText) {
+            return startOver(new LinkedHashMap<>(), notText);
+        }
+        try {
+            return decode(json);
+        } catch (DamagedFileException damaged) {
+            return startOver(json.map(FileBackupCatalog::salvage).orElseGet(LinkedHashMap::new), damaged);
+        }
+    }
+
+    /** Moves the damaged file aside and starts over with the records that still read in it; the caller holds the lock. */
+    private Map<BackupId, BackupRecord> startOver(Map<BackupId, BackupRecord> salvaged, DamagedFileException damage)
+            throws IOException {
+        DamagedFiles.moveAside(file, damage);
+        lostRecords.set(true);
+        if (!salvaged.isEmpty()) {
+            write(salvaged.values());
+            LOGGER.warn("WorldArchive kept the {} backups that the damaged backup list still named", salvaged.size());
+        }
+        return salvaged;
+    }
+
+    /**
+     * The records of a damaged file that still decode. A record that does not decode is left out
+     * and the next one is read; damage to the JSON itself ends the reading, and the records before
+     * it are kept. A file of a schema this version does not read gives none.
+     */
+    private static Map<BackupId, BackupRecord> salvage(String json) {
+        Map<BackupId, BackupRecord> records = new LinkedHashMap<>();
+        try (JsonReader reader = new JsonReader(new StringReader(json))) {
+            int schemaVersion = CURRENT_SCHEMA_VERSION;
+            reader.beginObject();
+            while (reader.hasNext()) {
+                String name = reader.nextName();
+                if (name.equals("schemaVersion")) {
+                    schemaVersion = reader.nextInt();
+                } else if (name.equals("records")
+                        && schemaVersion >= OLDEST_SCHEMA_VERSION && schemaVersion <= CURRENT_SCHEMA_VERSION) {
+                    salvageRecords(reader, schemaVersion, records);
+                } else {
+                    reader.skipValue();
+                }
             }
-        } finally {
-            jvmLock.unlock();
+        } catch (IOException | RuntimeException damaged) {
+            // The rest of the file cannot be read; what was read before the damage is kept.
         }
+        return records;
     }
 
-    private List<BackupRecord> readRecords() throws IOException {
-        if (!Files.exists(file, LinkOption.NOFOLLOW_LINKS)) {
-            return new ArrayList<>();
+    private static void salvageRecords(JsonReader reader, int schemaVersion, Map<BackupId, BackupRecord> records)
+            throws IOException {
+        reader.beginArray();
+        while (reader.hasNext()) {
+            JsonElement encoded = JsonParser.parseReader(reader);
+            try {
+                if (encoded.isJsonObject()) {
+                    BackupRecord record = decodeRecord(encoded.getAsJsonObject(), schemaVersion);
+                    records.putIfAbsent(record.manifest().backupId(), record);
+                }
+            } catch (DamagedFileException | RuntimeException unreadable) {
+                // This record is lost; the next one may still read.
+            }
         }
-        if (Files.isSymbolicLink(file) || !Files.isRegularFile(file, LinkOption.NOFOLLOW_LINKS)) {
-            throw new IOException("Catalog is not a regular file: " + file);
+        reader.endArray();
+    }
+
+    private Map<BackupId, BackupRecord> decode(Optional<String> json) throws IOException {
+        Map<BackupId, BackupRecord> records = new LinkedHashMap<>();
+        if (json.isEmpty()) {
+            return records;
         }
-        String json = AtomicFiles.readUtf8(file, MAXIMUM_CATALOG_BYTES);
         try {
-            JsonElement parsed = JsonParser.parseString(json);
-            if (!parsed.isJsonObject()) {
-                throw new IOException("Catalog root must be a JSON object");
-            }
-            JsonObject root = parsed.getAsJsonObject();
-            int schemaVersion = requiredInteger(root, "schemaVersion");
+            JsonObject root = FIELDS.parseObject(json.get(), "The backup list");
+            int schemaVersion = FIELDS.requiredInt(root, "schemaVersion");
             if (schemaVersion > CURRENT_SCHEMA_VERSION) {
-                throw new IOException("Unsupported future catalog schema: " + schemaVersion);
+                throw new IOException("The backup list " + file + " was written by a newer version of"
+                        + " WorldArchive (schema " + schemaVersion + "). Update WorldArchive to use it.");
             }
-            if (schemaVersion < 1) {
-                throw new IOException("Unsupported catalog schema: " + schemaVersion);
+            if (schemaVersion < OLDEST_SCHEMA_VERSION) {
+                throw new DamagedFileException("The backup list has an unknown schema " + schemaVersion, null);
             }
-            JsonArray array = requiredArray(root, "records");
-            List<BackupRecord> records = new ArrayList<>(array.size());
-            Set<BackupId> ids = new HashSet<>();
-            for (JsonElement element : array) {
-                if (!element.isJsonObject()) {
-                    throw new IOException("Catalog record must be a JSON object");
+            for (JsonObject encoded : FIELDS.requiredObjects(root, "records")) {
+                BackupRecord record = decodeRecord(encoded, schemaVersion);
+                if (records.putIfAbsent(record.manifest().backupId(), record) != null) {
+                    throw new DamagedFileException(
+                            "The backup list names backup " + record.manifest().backupId() + " twice", null);
                 }
-                BackupRecord record = decodeRecord(element.getAsJsonObject(), schemaVersion);
-                if (!ids.add(record.manifest().backupId())) {
-                    throw new IOException("Catalog contains duplicate backup IDs");
-                }
-                records.add(record);
             }
             return records;
-        } catch (JsonParseException | IllegalArgumentException exception) {
-            throw new IOException("Catalog is malformed or invalid", exception);
+        } catch (IllegalArgumentException invalid) {
+            throw new DamagedFileException("The backup list holds an invalid record", invalid);
         }
     }
 
-    private void writeRecords(List<BackupRecord> records) throws IOException {
+    private void write(Collection<BackupRecord> records) throws IOException {
         JsonObject root = new JsonObject();
         root.addProperty("schemaVersion", CURRENT_SCHEMA_VERSION);
         JsonArray encodedRecords = new JsonArray();
@@ -252,40 +282,20 @@ private void writeRecords(List<BackupRecord> records) throws IOException {
         AtomicFiles.writeUtf8(file, GSON.toJson(root) + "\n", MAXIMUM_CATALOG_BYTES);
     }
 
-    private static List<BackupRecord> sorted(List<BackupRecord> records) {
+    private static List<BackupRecord> sorted(Collection<BackupRecord> records) {
         return records.stream().sorted(NEWEST_FIRST).toList();
     }
 
     private static JsonObject encodeRecord(BackupRecord record) {
+        JsonObject manifest = new JsonObject();
+        BackupManifestJson.write(record.manifest(), manifest);
         JsonObject encoded = new JsonObject();
-        encoded.add("manifest", encodeManifest(record.manifest()));
+        encoded.add("manifest", manifest);
         encoded.add("result", encodeResult(record.result()));
         return encoded;
     }
 
-    private static JsonObject encodeManifest(BackupManifest manifest) {
-        JsonObject encoded = new JsonObject();
-        encoded.addProperty("formatVersion", manifest.formatVersion());
-        encoded.addProperty("backupId", manifest.backupId().toString());
-        encoded.addProperty("worldId", manifest.worldId().toString());
-        encoded.addProperty("worldName", manifest.worldName());
-        manifest.label().ifPresent(label -> encoded.addProperty("label", label));
-        encoded.addProperty("createdAt", manifest.createdAt().toString());
-        encoded.addProperty("trigger", manifest.trigger().name());
-        encoded.addProperty("sourceFileCount", manifest.sourceFileCount());
-        encoded.addProperty("sourceByteCount", manifest.sourceByteCount());
-        encoded.addProperty("changedFileCount", manifest.changedFileCount());
-        encoded.addProperty("contentSha256", manifest.contentSha256());
-        encoded.addProperty("inventorySha256", manifest.inventorySha256());
-        manifest.gameVersion().ifPresent(stamp -> {
-            JsonObject encodedVersion = new JsonObject();
-            encodedVersion.addProperty("name", stamp.name());
-            encodedVersion.addProperty("dataVersion", stamp.dataVersion());
-            encoded.add("gameVersion", encodedVersion);
-        });
-        return encoded;
-    }
-
+    /** Writes the derived status too, so the file stays readable by older versions. */
     private static JsonObject encodeResult(BackupResult result) {
         JsonObject encoded = new JsonObject();
         encoded.addProperty("backupId", result.backupId().toString());
@@ -307,183 +317,45 @@ private static JsonObject encodeDestination(DestinationResult result) {
         encoded.addProperty("verificationStatus", result.verificationStatus().name());
         encoded.addProperty("syncStatus", result.syncStatus().name());
         encoded.addProperty("ownership", result.ownership().name());
-        result.importSourceId().ifPresent(value ->
-                encoded.addProperty("importSourceId", value.toString()));
+        result.importSourceId().ifPresent(value -> encoded.addProperty("importSourceId", value.toString()));
         return encoded;
     }
 
-    private static BackupRecord decodeRecord(JsonObject encoded, int schemaVersion) throws IOException {
-        BackupManifest manifest = decodeManifest(requiredObject(encoded, "manifest"), schemaVersion);
-        BackupResult result = decodeResult(requiredObject(encoded, "result"), schemaVersion);
+    private static BackupRecord decodeRecord(JsonObject encoded, int schemaVersion) throws DamagedFileException {
+        BackupManifest manifest = BackupManifestJson.read(FIELDS.requiredObject(encoded, "manifest"), FIELDS);
+        BackupResult result = decodeResult(FIELDS.requiredObject(encoded, "result"), schemaVersion);
         return new BackupRecord(manifest, result);
     }
 
-    private static BackupManifest decodeManifest(JsonObject encoded, int schemaVersion) throws IOException {
-        if (schemaVersion == 1) {
-            return new BackupManifest(
-                    requiredInteger(encoded, "formatVersion"),
-                    BackupId.parse(requiredString(encoded, "backupId")),
-                    WorldId.parse(requiredString(encoded, "worldId")),
-                    requiredString(encoded, "worldName"),
-                    requiredInstant(encoded, "createdAt"),
-                    requiredEnum(encoded, "trigger", BackupTrigger.class),
-                    requiredLong(encoded, "sourceFileCount"),
-                    requiredLong(encoded, "sourceByteCount"),
-                    requiredString(encoded, "sourceSha256"));
-        }
-        return new BackupManifest(
-                requiredInteger(encoded, "formatVersion"),
-                BackupId.parse(requiredString(encoded, "backupId")),
-                WorldId.parse(requiredString(encoded, "worldId")),
-                requiredString(encoded, "worldName"),
-                optionalString(encoded, "label"),
-                requiredInstant(encoded, "createdAt"),
-                requiredEnum(encoded, "trigger", BackupTrigger.class),
-                requiredLong(encoded, "sourceFileCount"),
-                requiredLong(encoded, "sourceByteCount"),
-                requiredLong(encoded, "changedFileCount"),
-                requiredString(encoded, "contentSha256"),
-                requiredString(encoded, "inventorySha256"),
-                optionalGameVersion(encoded));
-    }
-
-    private static Optional<GameVersionStamp> optionalGameVersion(JsonObject object) throws IOException {
-        JsonElement element = object.get("gameVersion");
-        if (element == null || element.isJsonNull()) {
-            return Optional.empty();
-        }
-        if (!element.isJsonObject()) {
-            throw new IOException("Catalog game version is not an object");
-        }
-        JsonObject encoded = element.getAsJsonObject();
-        return Optional.of(new GameVersionStamp(
-                requiredString(encoded, "name"),
-                requiredInteger(encoded, "dataVersion")));
-    }
-
-    private static BackupResult decodeResult(JsonObject encoded, int schemaVersion) throws IOException {
-        JsonArray destinations = requiredArray(encoded, "destinations");
-        List<DestinationResult> decodedDestinations = new ArrayList<>(destinations.size());
-        for (JsonElement destination : destinations) {
-            if (!destination.isJsonObject()) {
-                throw new IOException("Destination result must be a JSON object");
-            }
-            decodedDestinations.add(decodeDestination(destination.getAsJsonObject(), schemaVersion));
+    /** The stored status is derived from the destinations, so it is written but never read. */
+    private static BackupResult decodeResult(JsonObject encoded, int schemaVersion) throws DamagedFileException {
+        List<DestinationResult> destinations = new ArrayList<>();
+        for (JsonObject destination : FIELDS.requiredObjects(encoded, "destinations")) {
+            destinations.add(decodeDestination(destination, schemaVersion));
         }
         return new BackupResult(
-                BackupId.parse(requiredString(encoded, "backupId")),
-                WorldId.parse(requiredString(encoded, "worldId")),
-                requiredEnum(encoded, "status", BackupStatus.class),
-                decodedDestinations,
-                requiredInstant(encoded, "completedAt"));
+                BackupId.parse(FIELDS.requiredString(encoded, "backupId")),
+                WorldId.parse(FIELDS.requiredString(encoded, "worldId")),
+                destinations,
+                FIELDS.requiredInstant(encoded, "completedAt"));
     }
 
-    private static DestinationResult decodeDestination(JsonObject encoded, int schemaVersion) throws IOException {
-        VerificationStatus verification = schemaVersion == 1
-                ? VerificationStatus.NOT_VERIFIED
-                : requiredEnum(encoded, "verificationStatus", VerificationStatus.class);
-        SyncStatus sync = schemaVersion == 1
-                ? SyncStatus.NOT_CONFIGURED
-                : requiredEnum(encoded, "syncStatus", SyncStatus.class);
-        ArtifactOwnership ownership = schemaVersion < 3
-                ? ArtifactOwnership.MANAGED
-                : requiredEnum(encoded, "ownership", ArtifactOwnership.class);
-        Optional<ImportSourceId> sourceId = schemaVersion < 3
-                ? Optional.empty()
-                : optionalString(encoded, "importSourceId").map(ImportSourceId::parse);
+    /** Schema 2 predates imports, so every artifact it lists is WorldArchive's own. */
+    private static DestinationResult decodeDestination(JsonObject encoded, int schemaVersion)
+            throws DamagedFileException {
+        boolean imports = schemaVersion >= 3;
         return new DestinationResult(
-                requiredEnum(encoded, "destination", DestinationType.class),
-                requiredEnum(encoded, "status", DestinationStatus.class),
-                optionalString(encoded, "artifactId"),
-                optionalString(encoded, "message"),
-                verification,
-                sync,
-                ownership,
-                sourceId);
-    }
-
-    private static JsonObject requiredObject(JsonObject object, String name) throws IOException {
-        JsonElement element = object.get(name);
-        if (element == null || !element.isJsonObject()) {
-            throw new IOException("Required object is missing or invalid: " + name);
-        }
-        return element.getAsJsonObject();
-    }
-
-    private static JsonArray requiredArray(JsonObject object, String name) throws IOException {
-        JsonElement element = object.get(name);
-        if (element == null || !element.isJsonArray()) {
-            throw new IOException("Required array is missing or invalid: " + name);
-        }
-        return element.getAsJsonArray();
-    }
-
-    private static String requiredString(JsonObject object, String name) throws IOException {
-        JsonElement element = object.get(name);
-        if (element == null
-                || !element.isJsonPrimitive()
-                || !element.getAsJsonPrimitive().isString()) {
-            throw new IOException("Required string is missing or invalid: " + name);
-        }
-        return element.getAsString();
-    }
-
-    private static Optional<String> optionalString(JsonObject object, String name) throws IOException {
-        JsonElement element = object.get(name);
-        if (element == null || element.isJsonNull()) {
-            return Optional.empty();
-        }
-        if (!element.isJsonPrimitive() || !element.getAsJsonPrimitive().isString()) {
-            throw new IOException("Expected a string: " + name);
-        }
-        return Optional.of(element.getAsString());
-    }
-
-    private static int requiredInteger(JsonObject object, String name) throws IOException {
-        long value = requiredLong(object, name);
-        if (value < Integer.MIN_VALUE || value > Integer.MAX_VALUE) {
-            throw new IOException("Integer is out of range: " + name);
-        }
-        return (int) value;
-    }
-
-    private static long requiredLong(JsonObject object, String name) throws IOException {
-        JsonElement element = object.get(name);
-        if (element == null || !element.isJsonPrimitive()) {
-            throw new IOException("Required number is missing or invalid: " + name);
-        }
-        JsonPrimitive primitive = element.getAsJsonPrimitive();
-        if (!primitive.isNumber()) {
-            throw new IOException("Required number is missing or invalid: " + name);
-        }
-        try {
-            return new BigDecimal(primitive.getAsString()).longValueExact();
-        } catch (ArithmeticException | NumberFormatException exception) {
-            throw new IOException("Required number is not an integer: " + name, exception);
-        }
-    }
-
-    private static Instant requiredInstant(JsonObject object, String name) throws IOException {
-        try {
-            return Instant.parse(requiredString(object, name));
-        } catch (DateTimeParseException exception) {
-            throw new IOException("Required timestamp is invalid: " + name, exception);
-        }
-    }
-
-    private static <E extends Enum<E>> E requiredEnum(
-            JsonObject object,
-            String name,
-            Class<E> enumType) throws IOException {
-        try {
-            return Enum.valueOf(enumType, requiredString(object, name));
-        } catch (IllegalArgumentException exception) {
-            throw new IOException("Enum value is invalid: " + name, exception);
-        }
-    }
-
-    @FunctionalInterface
-    private interface IoSupplier<T> {
-        T get() throws IOException;
+                FIELDS.requiredEnum(encoded, "destination", DestinationType.class),
+                FIELDS.requiredEnum(encoded, "status", DestinationStatus.class),
+                FIELDS.optionalString(encoded, "artifactId"),
+                FIELDS.optionalString(encoded, "message"),
+                FIELDS.requiredEnum(encoded, "verificationStatus", VerificationStatus.class),
+                FIELDS.requiredEnum(encoded, "syncStatus", SyncStatus.class),
+                imports
+                        ? FIELDS.requiredEnum(encoded, "ownership", ArtifactOwnership.class)
+                        : ArtifactOwnership.MANAGED,
+                imports
+                        ? FIELDS.optionalString(encoded, "importSourceId").map(ImportSourceId::parse)
+                        : Optional.empty());
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/catalog/FileBackupDeletionRegistry.java b/src/main/java/dev/ishaanko/worldarchive/catalog/FileBackupDeletionRegistry.java
index adcfe74..654569b 100644
--- a/src/main/java/dev/ishaanko/worldarchive/catalog/FileBackupDeletionRegistry.java
+++ b/src/main/java/dev/ishaanko/worldarchive/catalog/FileBackupDeletionRegistry.java
@@ -1,126 +1,121 @@
 package dev.ishaanko.worldarchive.catalog;
 
-import dev.ishaanko.worldarchive.core.AtomicFiles;
 import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.support.AtomicFiles;
+import dev.ishaanko.worldarchive.support.LockedFile;
 import java.io.IOException;
-import java.nio.channels.FileChannel;
-import java.nio.channels.FileLock;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
 import java.nio.file.Path;
-import java.nio.file.StandardOpenOption;
+import java.util.Collection;
 import java.util.HashSet;
 import java.util.List;
-import java.util.Objects;
+import java.util.Optional;
 import java.util.Set;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentMap;
-import java.util.concurrent.locks.ReentrantLock;
+import java.util.function.Consumer;
 
-/** Process-safe, atomically published set of backups explicitly deleted by the user. */
-public final class FileBackupDeletionRegistry implements BackupDeletionRegistry {
-    private static final String HEADER = "worldarchive-deleted-backups-v1";
+/**
+ * The backups the player deleted, one ID per line in {@code deleted-backups.txt}. The start-up
+ * rebuild never lists a marked backup again, even when a crash left one of its files behind; an
+ * explicit import unmarks what it imports. A delete marks its backups before it touches their
+ * files and unmarks the ones that stay listed. Reads take no lock, like the catalog's, and a
+ * damaged file is moved aside the same way.
+ */
+public final class FileBackupDeletionRegistry {
+    private static final String HEADER_PREFIX = "worldarchive-deleted-backups-v";
 
-    private static final ConcurrentMap<Path, ReentrantLock> JVM_LOCKS = new ConcurrentHashMap<>();
+    private static final String HEADER = HEADER_PREFIX + "1";
 
-    private final Path file;
+    private static final int MAXIMUM_FILE_BYTES = 64 * 1_024 * 1_024;
 
-    private final Path lockFile;
+    private final LockedFile lock;
 
-    private final ReentrantLock jvmLock;
+    private final Path file;
 
     public FileBackupDeletionRegistry(Path file) {
-        this.file = Objects.requireNonNull(file, "file").toAbsolutePath().normalize();
-        lockFile = this.file.resolveSibling(this.file.getFileName() + ".lock");
-        jvmLock = JVM_LOCKS.computeIfAbsent(this.file, ignored -> new ReentrantLock());
+        this.lock = new LockedFile(file);
+        this.file = lock.file();
+    }
+
+    /** The marked backups. */
+    public Set<BackupId> marked() throws IOException {
+        try {
+            return decode(DamagedFiles.read(file, MAXIMUM_FILE_BYTES));
+        } catch (DamagedFileException damaged) {
+            return lock.withLock(this::readForChange);
+        }
     }
 
-    @Override
-    public boolean contains(BackupId backupId) throws IOException {
-        Objects.requireNonNull(backupId, "backupId");
-        return withLock(() -> read().contains(backupId));
+    public void mark(Collection<BackupId> backupIds) throws IOException {
+        List<BackupId> marks = List.copyOf(backupIds);
+        if (!marks.isEmpty()) {
+            change(values -> values.addAll(marks));
+        }
     }
 
-    @Override
-    public void record(BackupId backupId) throws IOException {
-        update(backupId, true);
+    public void unmark(Collection<BackupId> backupIds) throws IOException {
+        List<BackupId> marks = List.copyOf(backupIds);
+        if (!marks.isEmpty()) {
+            change(values -> marks.forEach(values::remove));
+        }
     }
 
-    @Override
-    public void restore(BackupId backupId) throws IOException {
-        update(backupId, false);
+    /** Unmarks every backup outside {@code stored}, the backups that a complete scan found files of. */
+    public void unmarkAllExcept(Set<BackupId> stored) throws IOException {
+        Set<BackupId> kept = Set.copyOf(stored);
+        if (!kept.containsAll(marked())) {
+            change(values -> values.retainAll(kept));
+        }
     }
 
-    private void update(BackupId backupId, boolean deleted) throws IOException {
-        Objects.requireNonNull(backupId, "backupId");
-        withLock(() -> {
-            Set<BackupId> values = read();
-            boolean changed = deleted ? values.add(backupId) : values.remove(backupId);
-            if (changed) {
-                write(values);
+    private void change(Consumer<Set<BackupId>> edit) throws IOException {
+        lock.withLock(() -> {
+            Set<BackupId> before = readForChange();
+            Set<BackupId> after = new HashSet<>(before);
+            edit.accept(after);
+            if (!after.equals(before)) {
+                write(after);
             }
             return null;
         });
     }
 
-    private Set<BackupId> read() throws IOException {
-        if (!Files.exists(file, LinkOption.NOFOLLOW_LINKS)) {
+    private Set<BackupId> readForChange() throws IOException {
+        try {
+            return decode(DamagedFiles.read(file, MAXIMUM_FILE_BYTES));
+        } catch (DamagedFileException damaged) {
+            DamagedFiles.moveAside(file, damaged);
             return new HashSet<>();
         }
-        if (Files.isSymbolicLink(file) || !Files.isRegularFile(file, LinkOption.NOFOLLOW_LINKS)) {
-            throw new IOException("Backup deletion registry is not a safe regular file");
+    }
+
+    private Set<BackupId> decode(Optional<String> text) throws IOException {
+        Set<BackupId> values = new HashSet<>();
+        if (text.isEmpty()) {
+            return values;
         }
-        List<String> lines = AtomicFiles.readUtf8(file).lines().toList();
-        if (lines.isEmpty() || !HEADER.equals(lines.getFirst())) {
-            throw new IOException("Backup deletion registry has an unsupported format");
+        List<String> lines = text.get().lines().toList();
+        String header = lines.isEmpty() ? "" : lines.getFirst();
+        if (!header.equals(HEADER)) {
+            if (header.startsWith(HEADER_PREFIX)) {
+                throw new IOException("The deleted-backup list " + file + " was written by a newer version of"
+                        + " WorldArchive. Update WorldArchive to use it.");
+            }
+            throw new DamagedFileException("The deleted-backup list does not start with its header", null);
         }
-        Set<BackupId> values = new HashSet<>();
         try {
             for (String line : lines.subList(1, lines.size())) {
-                if (!line.isBlank() && !values.add(BackupId.parse(line))) {
-                    throw new IOException("Backup deletion registry contains duplicate IDs");
+                if (!line.isBlank()) {
+                    values.add(BackupId.parse(line));
                 }
             }
-        } catch (IllegalArgumentException exception) {
-            throw new IOException("Backup deletion registry contains an invalid ID", exception);
+        } catch (IllegalArgumentException invalid) {
+            throw new DamagedFileException("The deleted-backup list holds an invalid backup ID", invalid);
         }
         return values;
     }
 
     private void write(Set<BackupId> values) throws IOException {
-        StringBuilder content = new StringBuilder(HEADER).append("\n");
-        values.stream().sorted().forEach(value -> content
-                .append(value)
-                .append("\n"));
-        AtomicFiles.writeUtf8(file, content.toString());
-    }
-
-    private <T> T withLock(IoSupplier<T> operation) throws IOException {
-        jvmLock.lock();
-        try {
-            Path parent = file.getParent();
-            if (parent == null) {
-                throw new IOException("Backup deletion registry has no parent directory");
-            }
-            Files.createDirectories(parent);
-            if (Files.isSymbolicLink(lockFile)) {
-                throw new IOException("Backup deletion registry lock must not be symbolic");
-            }
-            try (FileChannel channel = FileChannel.open(
-                            lockFile,
-                            StandardOpenOption.CREATE,
-                            StandardOpenOption.WRITE,
-                            LinkOption.NOFOLLOW_LINKS);
-                    FileLock ignored = channel.lock()) {
-                return operation.get();
-            }
-        } finally {
-            jvmLock.unlock();
-        }
-    }
-
-    @FunctionalInterface
-    private interface IoSupplier<T> {
-        T get() throws IOException;
+        StringBuilder content = new StringBuilder(HEADER).append('\n');
+        values.stream().sorted().forEach(value -> content.append(value).append('\n'));
+        AtomicFiles.writeUtf8(file, content.toString(), MAXIMUM_FILE_BYTES);
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/config/DefaultDestinations.java b/src/main/java/dev/ishaanko/worldarchive/config/DefaultDestinations.java
new file mode 100644
index 0000000..7084e92
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/config/DefaultDestinations.java
@@ -0,0 +1,61 @@
+package dev.ishaanko.worldarchive.config;
+
+import java.io.IOException;
+import java.nio.file.Path;
+import java.util.Objects;
+import java.util.Optional;
+
+/**
+ * The folders backups go to when the settings name none: {@code git} and {@code archives} in
+ * WorldArchive's folder of the game directory. The store fills them in when it reads the
+ * settings and leaves them out when it writes, so a copied or moved game folder uses its own
+ * folders instead of the original's.
+ */
+public final class DefaultDestinations {
+    private final Path gitRepository;
+
+    private final Path zipFolder;
+
+    /** @param storageRoot WorldArchive's folder, {@code <game directory>/worldarchive} */
+    public DefaultDestinations(Path storageRoot) {
+        Path root = Objects.requireNonNull(storageRoot, "storageRoot").toAbsolutePath().normalize();
+        this.gitRepository = root.resolve("git");
+        this.zipFolder = root.resolve("archives");
+    }
+
+    /** Fills in each destination folder the settings leave empty. */
+    public WorldArchiveConfig resolve(WorldArchiveConfig config) {
+        GitDestinationConfig git = config.git();
+        ZipDestinationConfig zip = config.zip();
+        return config
+                .withGit(git.withRepository(git.repository().or(() -> Optional.of(gitRepository))))
+                .withZip(zip.withDestination(zip.destination().or(() -> Optional.of(zipFolder))));
+    }
+
+    /** Whether {@code folder} is one of the default folders, compared in canonical form, or one the player chose. */
+    public FolderOrigin origin(Path folder) throws IOException {
+        Path canonical = PathSafety.canonicalize(folder);
+        boolean isDefault = canonical.equals(PathSafety.canonicalize(gitRepository))
+                || canonical.equals(PathSafety.canonicalize(zipFolder));
+        return isDefault
+                ? FolderOrigin.DEFAULT
+                : FolderOrigin.CHOSEN;
+    }
+
+    /** Leaves out each destination folder that is the default one, compared in canonical form. */
+    public WorldArchiveConfig withoutDefaults(WorldArchiveConfig config) throws IOException {
+        GitDestinationConfig git = config.git();
+        ZipDestinationConfig zip = config.zip();
+        return config
+                .withGit(git.withRepository(unlessDefault(git.repository(), gitRepository)))
+                .withZip(zip.withDestination(unlessDefault(zip.destination(), zipFolder)));
+    }
+
+    private static Optional<Path> unlessDefault(Optional<Path> configured, Path defaultFolder) throws IOException {
+        if (configured.isPresent()
+                && PathSafety.canonicalize(configured.get()).equals(PathSafety.canonicalize(defaultFolder))) {
+            return Optional.empty();
+        }
+        return configured;
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/config/FolderOrigin.java b/src/main/java/dev/ishaanko/worldarchive/config/FolderOrigin.java
new file mode 100644
index 0000000..9392fad
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/config/FolderOrigin.java
@@ -0,0 +1,25 @@
+package dev.ishaanko.worldarchive.config;
+
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.Path;
+
+/** Who chose a backup folder, which decides what a missing one means. */
+public enum FolderOrigin {
+    /** WorldArchive's default folder in the game directory, created when a backup first needs it. */
+    DEFAULT,
+    /**
+     * A folder the player chose, often on another drive. When it is missing, its drive is away,
+     * so a backup there fails and nothing creates the folder in its place.
+     */
+    CHOSEN;
+
+    /**
+     * Whether a listing of {@code folder} sees every backup it may hold: the folder exists, or it
+     * is a default folder that no backup created yet. A missing chosen folder, or a link whose
+     * target is gone, may hold backups on a drive that is away.
+     */
+    public boolean listable(Path folder) {
+        return Files.isDirectory(folder) || this == DEFAULT && Files.notExists(folder, LinkOption.NOFOLLOW_LINKS);
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/config/GitDestinationConfig.java b/src/main/java/dev/ishaanko/worldarchive/config/GitDestinationConfig.java
index e843ea7..4e90f88 100644
--- a/src/main/java/dev/ishaanko/worldarchive/config/GitDestinationConfig.java
+++ b/src/main/java/dev/ishaanko/worldarchive/config/GitDestinationConfig.java
@@ -1,7 +1,5 @@
 package dev.ishaanko.worldarchive.config;
 
-import dev.ishaanko.worldarchive.model.DestinationHealth;
-import dev.ishaanko.worldarchive.model.DestinationType;
 import java.nio.file.Path;
 import java.util.LinkedHashSet;
 import java.util.List;
@@ -10,17 +8,17 @@
 import java.util.Set;
 import java.util.regex.Pattern;
 
-/** Configuration for isolated per-world Git repositories and optional legacy storage. */
+/**
+ * Settings of the Git destination: one repository per world inside {@code repository}, each
+ * pushed to its world's own remote. An empty repository means the default folder
+ * ({@link DefaultDestinations}).
+ */
 public record GitDestinationConfig(
         boolean enabled,
         Optional<Path> repository,
         String remoteName,
-        Optional<String> remoteUrl,
         DestinationTriggerConfig triggers,
-        List<String> lfsPatterns,
-        DestinationHealth health,
-        Optional<Path> legacyRepository,
-        Optional<String> legacyRemoteUrl) {
+        List<String> lfsPatterns) {
     public static final String DEFAULT_REMOTE_NAME = "origin";
 
     public static final List<String> DEFAULT_LFS_PATTERNS = List.of(
@@ -33,77 +31,16 @@ public record GitDestinationConfig(
 
     private static final Pattern REMOTE_NAME = Pattern.compile("[A-Za-z0-9._-]{1,64}");
 
+    private static final int MAXIMUM_LFS_PATTERNS = 128;
+
+    private static final int MAXIMUM_LFS_PATTERN_LENGTH = 256;
+
     public GitDestinationConfig {
         repository = Objects.requireNonNull(repository, "repository")
                 .map(path -> path.toAbsolutePath().normalize());
-        Objects.requireNonNull(remoteName, "remoteName");
-        if (!REMOTE_NAME.matcher(remoteName).matches()
-                || remoteName.startsWith("-")
-                || remoteName.equals(".")
-                || remoteName.equals("..")) {
-            throw new IllegalArgumentException("Git remote name is unsafe");
-        }
-        remoteUrl = Objects.requireNonNull(remoteUrl, "remoteUrl").map(RemoteUrlPolicy::validate);
+        validateRemoteName(remoteName);
         Objects.requireNonNull(triggers, "triggers");
-        lfsPatterns = validatePatterns(lfsPatterns);
-        Objects.requireNonNull(health, "health");
-        if (health.destination() != DestinationType.GIT) {
-            throw new IllegalArgumentException("Git health state must describe the Git destination");
-        }
-        legacyRepository = Objects.requireNonNull(legacyRepository, "legacyRepository")
-                .map(path -> path.toAbsolutePath().normalize());
-        legacyRemoteUrl = Objects.requireNonNull(legacyRemoteUrl, "legacyRemoteUrl")
-                .map(RemoteUrlPolicy::validateConfiguredPlain);
-    }
-
-    /** Compatibility constructor for callers that predate isolated-repository migration fields. */
-    public GitDestinationConfig(
-            boolean enabled,
-            Optional<Path> repository,
-            String remoteName,
-            Optional<String> remoteUrl,
-            DestinationTriggerConfig triggers,
-            List<String> lfsPatterns,
-            DestinationHealth health) {
-        this(
-                enabled,
-                repository,
-                remoteName,
-                remoteUrl,
-                triggers,
-                lfsPatterns,
-                health,
-                Optional.empty(),
-                Optional.empty());
-    }
-
-    /** Compatibility constructor for callers that predate persisted destination health. */
-    public GitDestinationConfig(
-            boolean enabled,
-            Optional<Path> repository,
-            String remoteName,
-            Optional<String> remoteUrl,
-            DestinationTriggerConfig triggers,
-            List<String> lfsPatterns) {
-        this(
-                enabled,
-                repository,
-                remoteName,
-                remoteUrl,
-                triggers,
-                lfsPatterns,
-                DestinationHealth.notChecked(DestinationType.GIT),
-                Optional.empty(),
-                Optional.empty());
-    }
-
-    /** Compatibility constructor for callers that predate per-destination settings. */
-    public GitDestinationConfig(
-            boolean enabled,
-            Optional<Path> repository,
-            String remoteName,
-            Optional<String> remoteUrl) {
-        this(enabled, repository, remoteName, remoteUrl, DestinationTriggerConfig.defaults(), DEFAULT_LFS_PATTERNS);
+        lfsPatterns = validateLfsPatterns(lfsPatterns);
     }
 
     public static GitDestinationConfig defaults() {
@@ -111,34 +48,45 @@ public static GitDestinationConfig defaults() {
                 true,
                 Optional.empty(),
                 DEFAULT_REMOTE_NAME,
-                Optional.empty(),
                 DestinationTriggerConfig.defaults(),
-                DEFAULT_LFS_PATTERNS,
-                DestinationHealth.notChecked(DestinationType.GIT),
-                Optional.empty(),
-                Optional.empty());
+                DEFAULT_LFS_PATTERNS);
+    }
+
+    public GitDestinationConfig withRepository(Optional<Path> repository) {
+        return new GitDestinationConfig(enabled, repository, remoteName, triggers, lfsPatterns);
     }
 
-    public static boolean isPerWorldRemoteTemplate(String remoteUrl) {
-        return RemoteUrlPolicy.isWorldIdTemplate(remoteUrl);
+    /**
+     * Checks a name for the remote inside each world's repository.
+     *
+     * @return the name, unchanged
+     * @throws IllegalArgumentException when Git could read the name as an option or a path
+     */
+    public static String validateRemoteName(String remoteName) {
+        Objects.requireNonNull(remoteName, "remoteName");
+        if (!REMOTE_NAME.matcher(remoteName).matches()
+                || remoteName.startsWith("-")
+                || remoteName.equals(".")
+                || remoteName.equals("..")) {
+            throw new IllegalArgumentException("Git remote name is unsafe");
+        }
+        return remoteName;
     }
 
-    private static List<String> validatePatterns(List<String> patterns) {
+    /**
+     * Checks the Git attribute patterns whose files are stored with Git LFS.
+     *
+     * @return the patterns in order, as an immutable list
+     * @throws IllegalArgumentException naming the first unsafe or repeated pattern
+     */
+    public static List<String> validateLfsPatterns(List<String> patterns) {
         Objects.requireNonNull(patterns, "lfsPatterns");
-        if (patterns.isEmpty() || patterns.size() > 128) {
+        if (patterns.isEmpty() || patterns.size() > MAXIMUM_LFS_PATTERNS) {
             throw new IllegalArgumentException("At least one and no more than 128 LFS patterns are required");
         }
         Set<String> unique = new LinkedHashSet<>();
         for (String pattern : patterns) {
-            Objects.requireNonNull(pattern, "lfsPattern");
-            if (pattern.isBlank()
-                    || pattern.length() > 256
-                    || pattern.startsWith("!")
-                    || pattern.startsWith("-")
-                    || pattern.contains("\\")
-                    || pattern.contains("..")
-                    || pattern.chars().anyMatch(Character::isWhitespace)
-                    || pattern.chars().anyMatch(character -> Character.isISOControl(character))) {
+            if (isUnsafeLfsPattern(Objects.requireNonNull(pattern, "lfsPattern"))) {
                 throw new IllegalArgumentException("Unsafe Git LFS pattern: " + pattern);
             }
             if (!unique.add(pattern)) {
@@ -147,4 +95,16 @@ private static List<String> validatePatterns(List<String> patterns) {
         }
         return List.copyOf(unique);
     }
+
+    /** A pattern Git could read as a negation or an option, or one that leaves the world folder. */
+    private static boolean isUnsafeLfsPattern(String pattern) {
+        return pattern.isBlank()
+                || pattern.length() > MAXIMUM_LFS_PATTERN_LENGTH
+                || pattern.startsWith("!")
+                || pattern.startsWith("-")
+                || pattern.contains("\\")
+                || pattern.contains("..")
+                || pattern.chars().anyMatch(character ->
+                        Character.isWhitespace(character) || Character.isISOControl(character));
+    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/config/LockedFileStore.java b/src/main/java/dev/ishaanko/worldarchive/config/LockedFileStore.java
deleted file mode 100644
index 56de54d..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/config/LockedFileStore.java
+++ /dev/null
@@ -1,110 +0,0 @@
-package dev.ishaanko.worldarchive.config;
-
-import java.io.IOException;
-import java.nio.channels.FileChannel;
-import java.nio.channels.FileLock;
-import java.nio.file.FileAlreadyExistsException;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.nio.file.StandardOpenOption;
-import java.nio.file.attribute.BasicFileAttributes;
-import java.nio.file.attribute.FileTime;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentMap;
-import java.util.concurrent.locks.ReentrantLock;
-import java.util.function.Function;
-
-/**
- * Process-safe atomic access to a single file, guarded by a sibling {@code .lock} file.
- * Rejects symbolic links on both paths and re-verifies the lock file's identity between
- * opening it and acquiring the OS-level lock, closing the TOCTOU window where it could be
- * swapped out from under a waiting process. Callers supply an exception factory so failures
- * surface as their own domain exception rather than a generic {@link IOException}.
- */
-final class LockedFileStore {
-    private static final ConcurrentMap<Path, ReentrantLock> JVM_LOCKS = new ConcurrentHashMap<>();
-
-    private final Path file;
-
-    private final Path lockFile;
-
-    private final ReentrantLock jvmLock;
-
-    private final Function<String, ? extends IOException> exceptionFactory;
-
-    LockedFileStore(Path file, Function<String, ? extends IOException> exceptionFactory) {
-        this.file = file;
-        this.lockFile = file.resolveSibling(file.getFileName() + ".lock");
-        this.jvmLock = JVM_LOCKS.computeIfAbsent(this.file, ignored -> new ReentrantLock());
-        this.exceptionFactory = exceptionFactory;
-    }
-
-    <T> T withLock(IoSupplier<T> operation) throws IOException {
-        rejectSymlink(file);
-        rejectSymlink(lockFile);
-        jvmLock.lock();
-        try {
-            rejectSymlink(file);
-            rejectSymlink(lockFile);
-            LockIdentity beforeOpen = ensureLockFile(lockFile);
-            try (FileChannel channel = FileChannel.open(
-                            lockFile,
-                            StandardOpenOption.WRITE,
-                            LinkOption.NOFOLLOW_LINKS)) {
-                LockIdentity afterOpen = readLockIdentity(lockFile);
-                requireSameLock(beforeOpen, afterOpen);
-                try (FileLock ignored = channel.lock()) {
-                    requireSameLock(afterOpen, readLockIdentity(lockFile));
-                    rejectSymlink(file);
-                    return operation.get();
-                }
-            }
-        } finally {
-            jvmLock.unlock();
-        }
-    }
-
-    private void rejectSymlink(Path path) throws IOException {
-        if (Files.isSymbolicLink(path)) {
-            throw exceptionFactory.apply(path + " must not be a symbolic link");
-        }
-    }
-
-    private LockIdentity ensureLockFile(Path lockFile) throws IOException {
-        try {
-            Files.createFile(lockFile);
-        } catch (FileAlreadyExistsException exception) {
-            // The persistent lock already exists; its identity is verified below.
-        }
-        return readLockIdentity(lockFile);
-    }
-
-    private LockIdentity readLockIdentity(Path lockFile) throws IOException {
-        BasicFileAttributes attributes = Files.readAttributes(
-                lockFile,
-                BasicFileAttributes.class,
-                LinkOption.NOFOLLOW_LINKS);
-        if (attributes.isSymbolicLink() || !attributes.isRegularFile()) {
-            throw exceptionFactory.apply("Lock file must be a regular non-symbolic file: " + lockFile);
-        }
-        return new LockIdentity(attributes.fileKey(), attributes.creationTime());
-    }
-
-    private void requireSameLock(LockIdentity expected, LockIdentity actual) throws IOException {
-        boolean same = expected.fileKey() != null || actual.fileKey() != null
-                ? expected.fileKey() != null && expected.fileKey().equals(actual.fileKey())
-                : expected.creationTime().equals(actual.creationTime());
-        if (!same) {
-            throw exceptionFactory.apply("Lock file changed while it was being acquired: " + lockFile);
-        }
-    }
-
-    @FunctionalInterface
-    interface IoSupplier<T> {
-        T get() throws IOException;
-    }
-
-    private record LockIdentity(Object fileKey, FileTime creationTime) {
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/config/PathSafety.java b/src/main/java/dev/ishaanko/worldarchive/config/PathSafety.java
index c78119f..a46a89f 100644
--- a/src/main/java/dev/ishaanko/worldarchive/config/PathSafety.java
+++ b/src/main/java/dev/ishaanko/worldarchive/config/PathSafety.java
@@ -3,24 +3,31 @@
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
+import java.nio.file.NoSuchFileException;
 import java.nio.file.Path;
 import java.util.ArrayDeque;
 import java.util.Collection;
 import java.util.Deque;
+import java.util.LinkedHashSet;
+import java.util.List;
 import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
 
-/** Canonical path validation shared by destination configuration entry points. */
+/** Canonical path rules shared by every destination setting. */
 public final class PathSafety {
     private PathSafety() {
     }
 
-    /** Canonicalizes an existing path or resolves a missing suffix from its nearest real ancestor. */
+    /**
+     * The real path of an existing path, or the real path of its nearest existing ancestor with
+     * the missing names added back. A path with no existing ancestor, such as a folder on a
+     * drive that is not connected, comes back absolute and normalized, so an offline destination
+     * never stops settings from loading; so does a path whose nearest existing ancestor is a link
+     * or a Windows junction to such a drive.
+     */
     public static Path canonicalize(Path path) throws IOException {
-        Objects.requireNonNull(path, "path");
-        Path absolute = path.toAbsolutePath().normalize();
-        if (Files.exists(absolute, LinkOption.NOFOLLOW_LINKS)) {
-            return absolute.toRealPath();
-        }
+        Path absolute = Objects.requireNonNull(path, "path").toAbsolutePath().normalize();
         Deque<Path> missing = new ArrayDeque<>();
         Path ancestor = absolute;
         while (ancestor != null && !Files.exists(ancestor, LinkOption.NOFOLLOW_LINKS)) {
@@ -31,48 +38,54 @@ public static Path canonicalize(Path path) throws IOException {
             ancestor = ancestor.getParent();
         }
         if (ancestor == null) {
-            throw new IOException("Path has no existing ancestor: " + absolute);
+            return absolute;
+        }
+        Path canonical;
+        try {
+            canonical = ancestor.toRealPath();
+        } catch (NoSuchFileException offline) {
+            return absolute;
         }
-        Path canonical = ancestor.toRealPath();
         while (!missing.isEmpty()) {
             canonical = canonical.resolve(missing.pop());
         }
         return canonical.normalize();
     }
 
-    /**
-     * Returns a canonical destination after proving that it is not nested in a source world.
-     * Path text is compared first; then every existing ancestor of the destination is compared
-     * to the world by file identity, which catches case-insensitive volumes and links that
-     * the text comparison cannot see.
-     */
-    public static Path requireOutsideWorlds(Path destination, Collection<Path> sourceWorlds) throws IOException {
-        Objects.requireNonNull(sourceWorlds, "sourceWorlds");
-        Path absoluteDestination = destination.toAbsolutePath().normalize();
-        Path canonicalDestination = canonicalize(destination);
-        for (Path sourceWorld : sourceWorlds) {
-            Path world = Objects.requireNonNull(sourceWorld, "sourceWorld");
-            Path absoluteWorld = world.toAbsolutePath().normalize();
-            Path canonicalWorld = canonicalize(world);
-            if (absoluteDestination.startsWith(absoluteWorld)
-                    || canonicalDestination.startsWith(canonicalWorld)
-                    || sharesIdentityWithAncestor(canonicalDestination, canonicalWorld)) {
-                throw new IOException("Backup destination must not be inside a source world: "
-                        + canonicalDestination);
-            }
+    /** The canonical form of each path, each once, in the order given. */
+    public static List<Path> canonicalizeAll(Collection<Path> paths) throws IOException {
+        Set<Path> canonical = new LinkedHashSet<>();
+        for (Path path : paths) {
+            canonical.add(canonicalize(path));
         }
-        return canonicalDestination;
+        return List.copyOf(canonical);
     }
 
-    private static boolean sharesIdentityWithAncestor(Path destination, Path world) throws IOException {
-        if (!Files.exists(world, LinkOption.NOFOLLOW_LINKS)) {
-            return false;
+    /** The path itself when it exists, otherwise its nearest existing ancestor; empty when none exists. */
+    public static Optional<Path> nearestExisting(Path path) {
+        Path existing = Objects.requireNonNull(path, "path").toAbsolutePath().normalize();
+        while (existing != null && !Files.exists(existing, LinkOption.NOFOLLOW_LINKS)) {
+            existing = existing.getParent();
         }
-        for (Path ancestor = destination; ancestor != null; ancestor = ancestor.getParent()) {
-            if (Files.exists(ancestor, LinkOption.NOFOLLOW_LINKS) && Files.isSameFile(ancestor, world)) {
-                return true;
+        return Optional.ofNullable(existing);
+    }
+
+    /**
+     * Returns the canonical destination after checking that it is not inside a source world.
+     * The worlds must already be canonical (see {@link #canonicalizeAll}). The destination is
+     * compared both as written and in canonical form, so a destination typed inside a world is
+     * refused even when a link in that world points somewhere else.
+     *
+     * @throws IOException when the destination is inside one of the worlds
+     */
+    public static Path requireOutsideWorlds(Path destination, Collection<Path> canonicalWorlds) throws IOException {
+        Path written = Objects.requireNonNull(destination, "destination").toAbsolutePath().normalize();
+        Path canonical = canonicalize(written);
+        for (Path world : canonicalWorlds) {
+            if (canonical.startsWith(world) || written.startsWith(world)) {
+                throw new IOException("Backup destination must not be inside a source world: " + canonical);
             }
         }
-        return false;
+        return canonical;
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/config/RemoteUrlPolicy.java b/src/main/java/dev/ishaanko/worldarchive/config/RemoteUrlPolicy.java
index 0a7618e..48fd9c3 100644
--- a/src/main/java/dev/ishaanko/worldarchive/config/RemoteUrlPolicy.java
+++ b/src/main/java/dev/ishaanko/worldarchive/config/RemoteUrlPolicy.java
@@ -1,6 +1,5 @@
 package dev.ishaanko.worldarchive.config;
 
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URLDecoder;
@@ -9,21 +8,24 @@
 import java.nio.file.Path;
 import java.util.Locale;
 import java.util.Objects;
-import java.util.UUID;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
-/** Strictly whitelists credential-free URL, SCP, and absolute local Git remote forms. */
+/**
+ * Accepts the Git remote forms WorldArchive can use without storing a secret: an https, ssh or
+ * file URL, the SCP form {@code [user@]host:path}, and an absolute local path. Credentials
+ * belong in Git's credential helper, so a URL that carries a password, a query, a fragment or
+ * an access token is refused. The checks are structural: text that only looks like a secret,
+ * such as a folder named "Basic Training", is fine.
+ */
 public final class RemoteUrlPolicy {
-    static final String WORLD_ID_PLACEHOLDER = "{worldId}";
+    private static final int MAXIMUM_LENGTH = 2_048;
 
-    private static final UUID VALIDATION_WORLD_ID = UUID.fromString(
-            "00000000-0000-0000-0000-000000000000");
-
-    private static final int MAXIMUM_DECODE_ROUNDS = 4;
+    /** A URL decoded this many times without settling hides something on purpose. */
+    private static final int MAXIMUM_DECODE_ROUNDS = 3;
 
     private static final Pattern SCP_REMOTE = Pattern.compile(
-            "(?<user>[A-Za-z0-9._-]{1,64})@"
+            "(?:[A-Za-z0-9._-]{1,64}@)?"
                     + "(?<host>[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?):"
                     + "(?<path>[\\p{L}\\p{N}._~@%+\\-/]{1,1024})");
 
@@ -31,156 +33,139 @@ public final class RemoteUrlPolicy {
     private static final Pattern LOCAL_REMOTE = Pattern.compile(
             "(?:[A-Za-z]:[\\\\/]|\\\\\\\\|/)[^<>\"|?*\\p{Cntrl}]{1,2046}");
 
-    private RemoteUrlPolicy() {
-    }
+    /** Access tokens of the common Git hosts, only where no letter or digit comes before them. */
+    private static final Pattern ACCESS_TOKEN = Pattern.compile(
+            "(?<![A-Za-z0-9])(?:github_pat_|gh[pousr]_|glpat-)[A-Za-z0-9_-]{16,}");
 
-    static String validate(String remoteUrl) {
-        Objects.requireNonNull(remoteUrl, "remoteUrl");
-        int placeholders = countWorldIdPlaceholders(remoteUrl);
-        if (placeholders > 1) {
-            throw new IllegalArgumentException(
-                    "Git remote URL template must contain exactly one {worldId} placeholder");
-        }
-        String validationUrl = placeholders == 1
-                ? remoteUrl.replace(WORLD_ID_PLACEHOLDER, VALIDATION_WORLD_ID.toString())
-                : remoteUrl;
-        validateConcrete(validationUrl, false);
-        return remoteUrl;
+    private RemoteUrlPolicy() {
     }
 
-    /** Validates one configured per-world remote without a template. */
+    /**
+     * Checks a world's own remote, which WorldArchive pushes to and fetches from.
+     *
+     * @return the remote, unchanged
+     * @throws IllegalArgumentException saying what is wrong with it
+     */
     public static String validateConfiguredPlain(String remoteUrl) {
-        Objects.requireNonNull(remoteUrl, "remoteUrl");
-        if (countWorldIdPlaceholders(remoteUrl) != 0) {
-            throw new IllegalArgumentException("Git remote URL must not contain {worldId}");
-        }
-        validateConcrete(remoteUrl, false);
+        validate(remoteUrl, false);
         return remoteUrl;
     }
 
-    /** Validates an import source, including the read-only Git transport. */
+    /**
+     * Checks the source of an import, which may also use the read-only {@code git://} protocol.
+     *
+     * @return the remote, unchanged
+     * @throws IllegalArgumentException saying what is wrong with it
+     */
     public static String validatePlain(String remoteUrl) {
-        Objects.requireNonNull(remoteUrl, "remoteUrl");
-        if (countWorldIdPlaceholders(remoteUrl) != 0) {
-            throw new IllegalArgumentException("Git import URL must not contain {worldId}");
-        }
-        validateConcrete(remoteUrl, true);
+        validate(remoteUrl, true);
         return remoteUrl;
     }
 
-    static boolean isWorldIdTemplate(String remoteUrl) {
-        return countWorldIdPlaceholders(Objects.requireNonNull(remoteUrl, "remoteUrl")) == 1;
-    }
-
-    static String resolveWorldId(String remoteUrl, UUID worldId) {
-        String validated = validate(remoteUrl);
-        if (!isWorldIdTemplate(validated)) {
-            throw new IllegalArgumentException("Git remote URL is not a per-world template");
-        }
-        return validated.replace(
-                WORLD_ID_PLACEHOLDER,
-                Objects.requireNonNull(worldId, "worldId").toString());
-    }
-
-    private static int countWorldIdPlaceholders(String remoteUrl) {
-        int count = 0;
-        int offset = 0;
-        while ((offset = remoteUrl.indexOf(WORLD_ID_PLACEHOLDER, offset)) >= 0) {
-            count++;
-            offset += WORLD_ID_PLACEHOLDER.length();
-        }
-        return count;
-    }
-
-    private static void validateConcrete(String remoteUrl, boolean allowReadOnlyGitProtocol) {
+    private static void validate(String remoteUrl, boolean readOnlyGitProtocolAllowed) {
+        Objects.requireNonNull(remoteUrl, "remoteUrl");
         if (remoteUrl.isBlank()
-                || remoteUrl.length() > 2_048
+                || remoteUrl.length() > MAXIMUM_LENGTH
                 || !remoteUrl.equals(remoteUrl.strip())) {
             throw new IllegalArgumentException("Git remote URL is blank, padded, or too long");
         }
-        if (remoteUrl.chars().anyMatch(character -> Character.isISOControl(character))) {
+        if (remoteUrl.chars().anyMatch(Character::isISOControl)) {
             throw new IllegalArgumentException("Git remote URL contains control characters");
         }
-        rejectSensitiveData(remoteUrl);
         if (remoteUrl.contains("://")) {
-            validateUri(remoteUrl, allowReadOnlyGitProtocol);
-            return;
+            validateUrl(remoteUrl, readOnlyGitProtocolAllowed);
+        } else if (LOCAL_REMOTE.matcher(remoteUrl).matches()) {
+            validateLocalPath(remoteUrl);
+        } else {
+            validateScp(remoteUrl);
         }
-        Matcher scp = SCP_REMOTE.matcher(remoteUrl);
-        if (scp.matches()) {
-            if (scp.group("path").startsWith("-")) {
-                throw new IllegalArgumentException("Git SCP remote path must not start with a dash");
-            }
-            return;
+    }
+
+    private static void validateUrl(String remoteUrl, boolean readOnlyGitProtocolAllowed) {
+        URI uri;
+        try {
+            uri = new URI(remoteUrl);
+        } catch (URISyntaxException exception) {
+            throw new IllegalArgumentException("Git remote URL is malformed", exception);
         }
-        if (!LOCAL_REMOTE.matcher(remoteUrl).matches()) {
-            throw new IllegalArgumentException("Git remote must be an approved URL, SCP form, or absolute local path");
+        String scheme = uri.getScheme() == null ? "" : uri.getScheme().toLowerCase(Locale.ROOT);
+        if (!isSupportedScheme(scheme, readOnlyGitProtocolAllowed)) {
+            throw new IllegalArgumentException("Unsupported Git remote URL scheme");
         }
-        try {
-            if (!Path.of(remoteUrl).isAbsolute()) {
-                throw new IllegalArgumentException("Local Git remote path must be absolute");
-            }
-        } catch (InvalidPathException exception) {
-            throw new IllegalArgumentException("Local Git remote path is malformed", exception);
+        if (uri.getRawQuery() != null || uri.getRawFragment() != null) {
+            throw new IllegalArgumentException("Git remote URL must not contain a query or a fragment");
+        }
+        String userInfo = uri.getRawUserInfo();
+        if (userInfo != null && (!scheme.equals("ssh") || userInfo.contains(":"))) {
+            throw new IllegalArgumentException(
+                    "Git remote URL must not contain a password; only ssh URLs may name a user");
         }
+        requireRepositoryPath(uri, scheme);
+        rejectAccessTokens(remoteUrl);
     }
 
-    private static void validateUri(String remoteUrl, boolean allowReadOnlyGitProtocol) {
-        try {
-            URI uri = new URI(remoteUrl);
-            if (uri.getRawUserInfo() != null || uri.getRawQuery() != null || uri.getRawFragment() != null) {
-                throw new IllegalArgumentException(
-                        "Git remote URL must not contain user information, a query, or a fragment");
-            }
-            String scheme = uri.getScheme();
-            if (scheme == null || !isSupportedScheme(scheme, allowReadOnlyGitProtocol)) {
-                throw new IllegalArgumentException("Unsupported Git remote URL scheme");
-            }
-            if ("file".equalsIgnoreCase(scheme)) {
-                if (uri.getRawPath() == null || uri.getRawPath().isBlank() || !uri.getRawPath().startsWith("/")) {
-                    throw new IllegalArgumentException("File Git remote URL must have an absolute path");
-                }
-            } else if (uri.getHost() == null
-                    || uri.getRawPath() == null
-                    || uri.getRawPath().isBlank()
-                    || "/".equals(uri.getRawPath())) {
-                throw new IllegalArgumentException("Network Git remote URL must have a host and repository path");
+    private static boolean isSupportedScheme(String scheme, boolean readOnlyGitProtocolAllowed) {
+        return switch (scheme) {
+            case "https", "ssh", "file" -> true;
+            case "git" -> readOnlyGitProtocolAllowed;
+            default -> false;
+        };
+    }
+
+    private static void requireRepositoryPath(URI uri, String scheme) {
+        String path = uri.getRawPath();
+        if (scheme.equals("file")) {
+            if (path == null || !path.startsWith("/")) {
+                throw new IllegalArgumentException("File Git remote URL must have an absolute path");
             }
-        } catch (URISyntaxException exception) {
-            throw new IllegalArgumentException("Git remote URL is malformed", exception);
+        } else if (uri.getHost() == null || path == null || path.isBlank() || path.equals("/")) {
+            throw new IllegalArgumentException("Network Git remote URL must have a host and repository path");
         }
     }
 
-    private static void rejectSensitiveData(String value) {
-        String current = value;
+    /** Looks for a token in the URL as written and in each percent-decoded form of it. */
+    private static void rejectAccessTokens(String remoteUrl) {
+        String current = remoteUrl;
         for (int round = 0; round <= MAXIMUM_DECODE_ROUNDS; round++) {
-            if (SensitiveDataRedactor.containsSensitiveData(current)) {
-                throw new IllegalArgumentException(
-                        "Git remote must not contain credentials or known token formats");
+            if (ACCESS_TOKEN.matcher(current).find()) {
+                throw new IllegalArgumentException("Git remote URL must not contain an access token");
             }
             String decoded;
             try {
-                decoded = URLDecoder.decode(current, StandardCharsets.UTF_8);
+                decoded = URLDecoder.decode(current.replace("+", "%2B"), StandardCharsets.UTF_8);
             } catch (IllegalArgumentException exception) {
-                throw new IllegalArgumentException("Git remote contains malformed percent encoding", exception);
+                throw new IllegalArgumentException("Git remote URL contains malformed percent encoding", exception);
             }
             if (decoded.equals(current)) {
                 return;
             }
-            if (round == MAXIMUM_DECODE_ROUNDS) {
-                throw new IllegalArgumentException("Git remote is excessively percent encoded");
-            }
             current = decoded;
         }
+        throw new IllegalArgumentException("Git remote URL is percent-encoded too many times");
     }
 
-    private static boolean isSupportedScheme(
-            String scheme,
-            boolean allowReadOnlyGitProtocol) {
-        return switch (scheme.toLowerCase(Locale.ROOT)) {
-            case "https", "ssh", "file" -> true;
-            case "git" -> allowReadOnlyGitProtocol;
-            default -> false;
-        };
+    private static void validateScp(String remoteUrl) {
+        Matcher scp = SCP_REMOTE.matcher(remoteUrl);
+        if (!scp.matches()) {
+            throw new IllegalArgumentException(
+                    "Git remote must be an https, ssh or file URL, host:path, or an absolute local path");
+        }
+        if (scp.group("path").startsWith("-")) {
+            throw new IllegalArgumentException("Git SCP remote path must not start with a dash");
+        }
+        if (ACCESS_TOKEN.matcher(remoteUrl).find()) {
+            throw new IllegalArgumentException("Git remote must not contain an access token");
+        }
+    }
+
+    /** A local path is a folder name, not a URL, so it is not percent-decoded. */
+    private static void validateLocalPath(String remoteUrl) {
+        try {
+            if (!Path.of(remoteUrl).isAbsolute()) {
+                throw new IllegalArgumentException("Local Git remote path must be absolute");
+            }
+        } catch (InvalidPathException exception) {
+            throw new IllegalArgumentException("Local Git remote path is malformed", exception);
+        }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/config/TriggerConfig.java b/src/main/java/dev/ishaanko/worldarchive/config/TriggerConfig.java
index eb98ef3..e6a35e9 100644
--- a/src/main/java/dev/ishaanko/worldarchive/config/TriggerConfig.java
+++ b/src/main/java/dev/ishaanko/worldarchive/config/TriggerConfig.java
@@ -1,6 +1,12 @@
 package dev.ishaanko.worldarchive.config;
 
-/** Immutable backup trigger settings. */
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import java.util.Objects;
+
+/**
+ * Which triggers may start a backup at all, and the minutes between scheduled backups. Each
+ * destination narrows the triggers further with its {@link DestinationTriggerConfig}.
+ */
 public record TriggerConfig(
         boolean manualEnabled,
         boolean worldExitEnabled,
@@ -11,8 +17,7 @@ public record TriggerConfig(
     public static final int MAXIMUM_SCHEDULE_INTERVAL_MINUTES = 10_080;
 
     public TriggerConfig {
-        if (scheduleIntervalMinutes < 1
-                || scheduleIntervalMinutes > MAXIMUM_SCHEDULE_INTERVAL_MINUTES) {
+        if (!isValidInterval(scheduleIntervalMinutes)) {
             throw new IllegalArgumentException("Schedule interval must be between 1 minute and 7 days");
         }
     }
@@ -20,4 +25,17 @@ public record TriggerConfig(
     public static TriggerConfig defaults() {
         return new TriggerConfig(true, true, false, DEFAULT_SCHEDULE_INTERVAL_MINUTES);
     }
+
+    public boolean enabledFor(BackupTrigger trigger) {
+        return switch (Objects.requireNonNull(trigger, "trigger")) {
+            case MANUAL -> manualEnabled;
+            case WORLD_EXIT -> worldExitEnabled;
+            case SCHEDULED -> scheduledEnabled;
+        };
+    }
+
+    /** True for a whole number of minutes from 1 to {@link #MAXIMUM_SCHEDULE_INTERVAL_MINUTES}. */
+    public static boolean isValidInterval(int minutes) {
+        return minutes >= 1 && minutes <= MAXIMUM_SCHEDULE_INTERVAL_MINUTES;
+    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/config/UnreadableConfigurationException.java b/src/main/java/dev/ishaanko/worldarchive/config/UnreadableConfigurationException.java
new file mode 100644
index 0000000..d29b7bd
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/config/UnreadableConfigurationException.java
@@ -0,0 +1,23 @@
+package dev.ishaanko.worldarchive.config;
+
+import java.io.IOException;
+import java.nio.file.Path;
+import java.util.Objects;
+
+/**
+ * The settings file exists but cannot be read or understood. Nothing is written over such a
+ * file; resetting the settings keeps it under a new name. The cause says what is wrong.
+ */
+public final class UnreadableConfigurationException extends IOException {
+    private final Path file;
+
+    public UnreadableConfigurationException(Path file, Throwable cause) {
+        super("WorldArchive settings in " + file + " could not be read: "
+                + Objects.requireNonNullElse(cause.getMessage(), cause.getClass().getSimpleName()), cause);
+        this.file = file;
+    }
+
+    public Path file() {
+        return file;
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/config/UnsupportedSchemaVersionException.java b/src/main/java/dev/ishaanko/worldarchive/config/UnsupportedSchemaVersionException.java
index 48f3a81..cdf8976 100644
--- a/src/main/java/dev/ishaanko/worldarchive/config/UnsupportedSchemaVersionException.java
+++ b/src/main/java/dev/ishaanko/worldarchive/config/UnsupportedSchemaVersionException.java
@@ -1,15 +1,28 @@
 package dev.ishaanko.worldarchive.config;
 
-/** Refuses configuration written by a newer, potentially incompatible WorldArchive version. */
+/**
+ * Refuses settings written with a schema this version cannot read: one from a newer
+ * WorldArchive, or one older than WorldArchive 0.1.1.
+ */
 public final class UnsupportedSchemaVersionException extends ConfigurationException {
     private final int schemaVersion;
 
     public UnsupportedSchemaVersionException(int schemaVersion) {
-        super("Unsupported future WorldArchive configuration schema: " + schemaVersion);
+        super(message(schemaVersion));
         this.schemaVersion = schemaVersion;
     }
 
-    public int schemaVersion() {
-        return schemaVersion;
+    /** True when a newer WorldArchive wrote the settings. */
+    public boolean newer() {
+        return schemaVersion > WorldArchiveConfig.CURRENT_SCHEMA_VERSION;
+    }
+
+    private static String message(int schemaVersion) {
+        return schemaVersion > WorldArchiveConfig.CURRENT_SCHEMA_VERSION
+                ? "The settings were saved by a newer WorldArchive (schema " + schemaVersion
+                        + "). Update WorldArchive, or reset the settings."
+                : "The settings are from WorldArchive 0.1.0 or older (schema " + schemaVersion
+                        + ") and can no longer be read. Reset the settings, then use Import with the old"
+                        + " Git repository to bring back its backups.";
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/config/WorldArchiveConfig.java b/src/main/java/dev/ishaanko/worldarchive/config/WorldArchiveConfig.java
index 06b269c..00a7a2b 100644
--- a/src/main/java/dev/ishaanko/worldarchive/config/WorldArchiveConfig.java
+++ b/src/main/java/dev/ishaanko/worldarchive/config/WorldArchiveConfig.java
@@ -6,36 +6,33 @@
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.HashSet;
+import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
+import java.util.function.UnaryOperator;
 
-/** Immutable, versioned user configuration with safe product defaults. */
+/**
+ * Immutable user configuration with safe product defaults. Change one part with the
+ * {@code with...} methods; they keep every other field.
+ */
 public record WorldArchiveConfig(
-        int schemaVersion,
         TriggerConfig triggers,
         GitDestinationConfig git,
         ZipDestinationConfig zip,
         List<WorldConfig> worlds) {
+    /** The schema version that {@link WorldArchiveConfigStore} writes. */
     public static final int CURRENT_SCHEMA_VERSION = 7;
 
     public WorldArchiveConfig {
-        if (schemaVersion != CURRENT_SCHEMA_VERSION) {
-            throw new IllegalArgumentException("Unsupported configuration schema: " + schemaVersion);
-        }
         Objects.requireNonNull(triggers, "triggers");
         Objects.requireNonNull(git, "git");
-        if (git.remoteUrl().isPresent()) {
-            throw new IllegalArgumentException(
-                    "Global Git remote templates are not supported; configure each world instead");
-        }
         Objects.requireNonNull(zip, "zip");
         worlds = List.copyOf(worlds);
         Set<WorldId> worldIds = new HashSet<>();
         Set<Path> worldPaths = new HashSet<>();
         for (WorldConfig world : worlds) {
-            Objects.requireNonNull(world, "world");
             if (!worldIds.add(world.worldId())) {
                 throw new IllegalArgumentException("Duplicate per-world configuration: " + world.worldId());
             }
@@ -45,76 +42,92 @@ public record WorldArchiveConfig(
         }
     }
 
-    /** Compatibility constructor for configurations without per-world overrides. */
-    public WorldArchiveConfig(
-            int schemaVersion,
-            TriggerConfig triggers,
-            GitDestinationConfig git,
-            ZipDestinationConfig zip) {
-        this(schemaVersion, triggers, git, zip, List.of());
-    }
-
     public static WorldArchiveConfig defaults() {
         return new WorldArchiveConfig(
-                CURRENT_SCHEMA_VERSION,
                 TriggerConfig.defaults(),
                 GitDestinationConfig.defaults(),
                 ZipDestinationConfig.defaults(),
                 List.of());
     }
 
-    /** Canonicalizes worlds and destinations and rejects destinations nested inside any known world. */
-    public WorldArchiveConfig validateDestinations(Collection<Path> knownWorldPaths) throws IOException {
-        Objects.requireNonNull(knownWorldPaths, "knownWorldPaths");
-        List<WorldConfig> canonicalWorlds = new ArrayList<>(worlds.size());
-        List<Path> allWorldPaths = new ArrayList<>(knownWorldPaths.size() + worlds.size());
-        for (Path knownWorld : knownWorldPaths) {
-            allWorldPaths.add(PathSafety.canonicalize(Objects.requireNonNull(knownWorld, "knownWorld")));
+    public WorldArchiveConfig withGit(GitDestinationConfig git) {
+        return new WorldArchiveConfig(triggers, git, zip, worlds);
+    }
+
+    public WorldArchiveConfig withZip(ZipDestinationConfig zip) {
+        return new WorldArchiveConfig(triggers, git, zip, worlds);
+    }
+
+    public WorldArchiveConfig withWorlds(List<WorldConfig> worlds) {
+        return new WorldArchiveConfig(triggers, git, zip, worlds);
+    }
+
+    /**
+     * Replaces the settings of one configured world and keeps the order of the list.
+     *
+     * @throws IllegalArgumentException when no world with this ID is configured
+     */
+    public WorldArchiveConfig withWorld(WorldId worldId, UnaryOperator<WorldConfig> update) {
+        Objects.requireNonNull(update, "update");
+        if (world(worldId).isEmpty()) {
+            throw new IllegalArgumentException("No settings exist for world " + worldId);
         }
-        List<Path> canonicalWorldPaths = new ArrayList<>(worlds.size());
+        return withWorlds(worlds.stream()
+                .map(world -> world.worldId().equals(worldId) ? update.apply(world) : world)
+                .toList());
+    }
+
+    /** The settings of one world, when it is configured. */
+    public Optional<WorldConfig> world(WorldId worldId) {
+        Objects.requireNonNull(worldId, "worldId");
+        return worlds.stream().filter(world -> world.worldId().equals(worldId)).findFirst();
+    }
+
+    /**
+     * The same configuration with every world and destination path in canonical form (see
+     * {@link PathSafety#canonicalize}).
+     */
+    public WorldArchiveConfig canonicalize() throws IOException {
+        List<WorldConfig> canonicalWorlds = new ArrayList<>(worlds.size());
         for (WorldConfig world : worlds) {
-            Path canonicalPath = PathSafety.canonicalize(world.path());
-            canonicalWorldPaths.add(canonicalPath);
-            allWorldPaths.add(canonicalPath);
-        }
-        for (int index = 0; index < worlds.size(); index++) {
-            WorldConfig world = worlds.get(index);
-            canonicalWorlds.add(new WorldConfig(
-                    world.worldId(),
-                    world.enabled(),
-                    canonicalWorldPaths.get(index),
-                    world.remoteUrl(),
-                    canonicalizeDestination(world.zipDestination(), allWorldPaths),
-                    world.storagePolicy()));
+            canonicalWorlds.add(world
+                    .withPath(PathSafety.canonicalize(world.path()))
+                    .withZipDestination(canonical(world.zipDestination())));
         }
-        Optional<Path> gitRepository = canonicalizeDestination(git.repository(), allWorldPaths);
-        Optional<Path> legacyGitRepository = canonicalizeDestination(
-                git.legacyRepository(),
-                allWorldPaths);
-        Optional<Path> zipDestination = canonicalizeDestination(zip.destination(), allWorldPaths);
         return new WorldArchiveConfig(
-                CURRENT_SCHEMA_VERSION,
                 triggers,
-                new GitDestinationConfig(
-                        git.enabled(),
-                        gitRepository,
-                        git.remoteName(),
-                        git.remoteUrl(),
-                        git.triggers(),
-                        git.lfsPatterns(),
-                        git.health(),
-                        legacyGitRepository,
-                        git.legacyRemoteUrl()),
-                new ZipDestinationConfig(zip.enabled(), zipDestination, zip.triggers(), zip.health()),
+                git.withRepository(canonical(git.repository())),
+                zip.withDestination(canonical(zip.destination())),
                 canonicalWorlds);
     }
 
-    private static Optional<Path> canonicalizeDestination(
-            Optional<Path> destination,
-            Collection<Path> sourceWorlds) throws IOException {
-        if (destination.isEmpty()) {
-            return Optional.empty();
+    /**
+     * Canonicalizes (see {@link #canonicalize}) and refuses any destination inside a world: a
+     * configured world or one of the given world folders. Destinations that are switched off
+     * are checked too, so switching one on later can never start writing into a world.
+     *
+     * @throws IOException when a destination is inside a world
+     */
+    public WorldArchiveConfig validateDestinations(Collection<Path> knownWorldPaths) throws IOException {
+        WorldArchiveConfig canonical = canonicalize();
+        Set<Path> sourceWorlds = new LinkedHashSet<>(PathSafety.canonicalizeAll(knownWorldPaths));
+        canonical.worlds().forEach(world -> sourceWorlds.add(world.path()));
+        for (Path destination : canonical.destinations()) {
+            PathSafety.requireOutsideWorlds(destination, sourceWorlds);
         }
-        return Optional.of(PathSafety.requireOutsideWorlds(destination.get(), sourceWorlds));
+        return canonical;
+    }
+
+    /** Every destination folder the settings name: the Git folder, the ZIP folder, and each world's own ZIP folder. */
+    public List<Path> destinations() {
+        List<Path> destinations = new ArrayList<>(worlds.size() + 2);
+        git.repository().ifPresent(destinations::add);
+        zip.destination().ifPresent(destinations::add);
+        worlds.forEach(world -> world.zipDestination().ifPresent(destinations::add));
+        return destinations;
+    }
+
+    private static Optional<Path> canonical(Optional<Path> path) throws IOException {
+        return path.isEmpty() ? path : Optional.of(PathSafety.canonicalize(path.get()));
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/config/WorldArchiveConfigStore.java b/src/main/java/dev/ishaanko/worldarchive/config/WorldArchiveConfigStore.java
index d697a0d..c0dc8ff 100644
--- a/src/main/java/dev/ishaanko/worldarchive/config/WorldArchiveConfigStore.java
+++ b/src/main/java/dev/ishaanko/worldarchive/config/WorldArchiveConfigStore.java
@@ -5,375 +5,344 @@
 import com.google.gson.JsonArray;
 import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
-import com.google.gson.JsonParseException;
-import com.google.gson.JsonParser;
-import com.google.gson.JsonPrimitive;
-import dev.ishaanko.worldarchive.core.AtomicFiles;
-import dev.ishaanko.worldarchive.model.DestinationHealth;
-import dev.ishaanko.worldarchive.model.DestinationHealthStatus;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
+import dev.ishaanko.worldarchive.model.SafeText;
 import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.support.AtomicFiles;
+import dev.ishaanko.worldarchive.support.JsonFields;
+import dev.ishaanko.worldarchive.support.LockedFile;
 import java.io.IOException;
-import java.math.BigDecimal;
 import java.nio.file.Files;
+import java.nio.file.InvalidPathException;
 import java.nio.file.LinkOption;
 import java.nio.file.Path;
 import java.time.Instant;
-import java.time.format.DateTimeParseException;
+import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 import java.util.Locale;
+import java.util.Map;
+import java.util.Objects;
 import java.util.Optional;
-
-/** Atomic UTF-8 JSON persistence and migration for {@link WorldArchiveConfig}. */
+import java.util.function.UnaryOperator;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Reads and writes {@link WorldArchiveConfig} as UTF-8 JSON. Each write replaces the file
+ * atomically while a lock shared by threads and game instances is held, and each change is
+ * applied to what the file holds at that moment. Destination folders equal to the defaults
+ * ({@link DefaultDestinations}) are left out of the file and filled in when it is read.
+ *
+ * <p>A file that exists but cannot be read is never written over: every read fails with
+ * {@link UnreadableConfigurationException} until {@link #reset} keeps the file under a new
+ * name. Schemas 4 (WorldArchive 0.1.1) to 7 are read; an older schema is upgraded on load,
+ * after the old file is kept as {@code <name>.schema<N>.bak}.</p>
+ */
 public final class WorldArchiveConfigStore {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
+    /** WorldArchive 0.1.1 wrote schema 4; the schema 3 of 0.1.0 is no longer read. */
+    private static final int OLDEST_SCHEMA_VERSION = 4;
+
+    /** Schema 4 kept one remote URL for every world, with {@code {worldId}} for each world's ID. */
+    private static final int REMOTE_TEMPLATE_SCHEMA_VERSION = 4;
+
+    /** Schema 7 added each world's storage policy. */
+    private static final int STORAGE_POLICY_SCHEMA_VERSION = 7;
+
+    private static final String WORLD_ID_PLACEHOLDER = "{worldId}";
+
     private static final int MAXIMUM_CONFIG_BYTES = 1_048_576;
 
+    private static final int MESSAGE_LIMIT = 512;
+
+    private static final DateTimeFormatter KEPT_COPY_TIME = DateTimeFormatter
+            .ofPattern("uuuuMMdd'T'HHmmss'Z'", Locale.ROOT)
+            .withZone(ZoneOffset.UTC);
+
     private static final Gson GSON = new GsonBuilder()
             .setPrettyPrinting()
             .disableHtmlEscaping()
             .create();
 
+    private static final JsonFields<ConfigurationException> FIELDS =
+            new JsonFields<>(ConfigurationException::new);
+
     private final Path file;
 
-    private final LockedFileStore lockedFileStore;
+    private final LockedFile lock;
+
+    private final DefaultDestinations defaults;
 
-    public WorldArchiveConfigStore(Path file) throws IOException {
-        Path normalized = file.toAbsolutePath().normalize();
-        rejectSymlink(normalized, "Configuration file");
-        this.file = PathSafety.canonicalize(normalized);
-        this.lockedFileStore = new LockedFileStore(this.file, ConfigurationException::new);
+    public WorldArchiveConfigStore(Path file, DefaultDestinations defaults) {
+        this.file = Objects.requireNonNull(file, "file").toAbsolutePath().normalize();
+        this.lock = new LockedFile(this.file);
+        this.defaults = Objects.requireNonNull(defaults, "defaults");
     }
 
-    /** Loads and, when needed, atomically migrates using the complete set of known source worlds. */
-    public WorldArchiveConfig load(Collection<Path> knownWorldPaths) throws IOException {
-        return withLock(() -> loadUnlocked(knownWorldPaths));
+    /**
+     * Reads the settings, with the default folders filled in and every path canonical;
+     * product defaults when the file does not exist.
+     *
+     * @throws UnreadableConfigurationException when the file exists but cannot be read or understood
+     */
+    public WorldArchiveConfig load() throws UnreadableConfigurationException {
+        try {
+            return lock.withLock(() -> {
+                Stored stored = read();
+                WorldArchiveConfig kept = defaults.withoutDefaults(stored.config());
+                if (stored.outdated() || !kept.equals(stored.config())) {
+                    upgradeInPlace(kept, stored);
+                }
+                return defaults.resolve(kept).canonicalize();
+            });
+        } catch (UnreadableConfigurationException exception) {
+            throw exception;
+        } catch (IOException | RuntimeException exception) {
+            throw new UnreadableConfigurationException(file, exception);
+        }
     }
 
-    /** Atomically saves only after checking every destination against all known source worlds. */
-    public void save(WorldArchiveConfig config, Collection<Path> knownWorldPaths) throws IOException {
-        withLock(() -> {
-            writeUnlocked(config.validateDestinations(knownWorldPaths));
-            return null;
+    /**
+     * Applies a change to the settings the file holds now and writes the result, so a change
+     * saved meanwhile by another game instance is kept. The change receives the settings as
+     * {@link #load} returns them. Nothing is written when it returns them unchanged. Before
+     * writing, every destination is checked against the configured worlds and the given world
+     * folders.
+     *
+     * @return the settings as written, in canonical form
+     * @throws UnreadableConfigurationException when the file cannot be read; it is left as it is
+     */
+    public WorldArchiveConfig update(
+            UnaryOperator<WorldArchiveConfig> change,
+            Collection<Path> knownWorldPaths) throws IOException {
+        Objects.requireNonNull(change, "change");
+        List<Path> worlds = List.copyOf(knownWorldPaths);
+        return lock.withLock(() -> {
+            Stored stored = read();
+            WorldArchiveConfig current = defaults.resolve(stored.config()).canonicalize();
+            WorldArchiveConfig changed = Objects.requireNonNull(change.apply(current), "changed settings");
+            if (changed.equals(current)) {
+                return current;
+            }
+            WorldArchiveConfig validated = changed.validateDestinations(worlds);
+            write(defaults.withoutDefaults(validated), stored);
+            return validated;
         });
     }
 
-    public Path file() {
-        return file;
+    /**
+     * Keeps the unreadable file as {@code <name>.unreadable-<UTC time>} and writes new settings
+     * that {@code start} builds from the product defaults. When the new file cannot be written,
+     * the old one is moved back. Settings that read now, as after another game instance fixed the
+     * file, are never replaced: the result is then empty and nothing changes.
+     */
+    public Optional<Reset> reset(
+            UnaryOperator<WorldArchiveConfig> start,
+            Collection<Path> knownWorldPaths,
+            Instant now) throws IOException {
+        Objects.requireNonNull(start, "start");
+        Objects.requireNonNull(now, "now");
+        List<Path> worlds = List.copyOf(knownWorldPaths);
+        return lock.withLock(() -> {
+            if (readable()) {
+                return Optional.empty();
+            }
+            WorldArchiveConfig fresh = start.apply(defaults.resolve(WorldArchiveConfig.defaults()))
+                    .validateDestinations(worlds);
+            Path keptCopy = file.resolveSibling(file.getFileName() + ".unreadable-" + KEPT_COPY_TIME.format(now));
+            Files.move(file, keptCopy);
+            try {
+                AtomicFiles.writeUtf8(file, encode(defaults.withoutDefaults(fresh)), MAXIMUM_CONFIG_BYTES);
+            } catch (IOException | RuntimeException exception) {
+                moveBack(keptCopy, exception);
+                throw exception;
+            }
+            return Optional.of(new Reset(fresh, keptCopy));
+        });
     }
 
-    private WorldArchiveConfig loadUnlocked(Collection<Path> knownWorldPaths) throws IOException {
-        if (!Files.exists(file, LinkOption.NOFOLLOW_LINKS)) {
-            return WorldArchiveConfig.defaults();
-        }
-        rejectSymlink(file, "Configuration file");
-        if (!Files.isRegularFile(file, LinkOption.NOFOLLOW_LINKS)) {
-            throw new ConfigurationException("Configuration path is not a regular file");
-        }
-        if (Files.size(file) > MAXIMUM_CONFIG_BYTES) {
-            throw new ConfigurationException("Configuration file is unexpectedly large");
-        }
-        JsonObject root = parseObject(AtomicFiles.readUtf8(file, MAXIMUM_CONFIG_BYTES));
-        rejectCredentialData(root);
-        int schemaVersion = optionalInteger(root, "schemaVersion").orElse(0);
-        if (schemaVersion > WorldArchiveConfig.CURRENT_SCHEMA_VERSION) {
-            throw new UnsupportedSchemaVersionException(schemaVersion);
-        }
-        if (schemaVersion < 0) {
-            throw new ConfigurationException("Configuration schema version must not be negative");
-        }
+    /** Whether the file reads now, or there is none; the caller holds the lock. */
+    private boolean readable() {
         try {
-            boolean migrated = schemaVersion != WorldArchiveConfig.CURRENT_SCHEMA_VERSION;
-            WorldArchiveConfig parsed = parseSchema(root, schemaVersion);
-            WorldArchiveConfig validated = parsed.validateDestinations(knownWorldPaths);
-            if (migrated) {
-                writeUnlocked(validated);
-            }
-            return validated;
-        } catch (IllegalArgumentException exception) {
-            throw new ConfigurationException("WorldArchive configuration is invalid: " + exception.getMessage(), exception);
+            read();
+            return true;
+        } catch (UnreadableConfigurationException unreadable) {
+            return false;
         }
     }
 
-    private WorldArchiveConfig parseCurrent(
-            JsonObject root,
-            boolean storagePolicyPresent) throws IOException {
-        TriggerConfig triggers = parseGlobalTriggers(requiredObject(root, "triggers"));
-        JsonObject destinations = requiredObject(root, "destinations");
-        GitDestinationConfig git = parseCurrentGit(requiredObject(destinations, "git"));
-        ZipDestinationConfig zip = parseCurrentZip(requiredObject(destinations, "zip"));
-        return new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                triggers,
-                git,
-                zip,
-                parseWorlds(requiredArray(root, "worlds"), storagePolicyPresent));
+    private void moveBack(Path copy, Exception failure) {
+        try {
+            Files.move(copy, file);
+        } catch (IOException | RuntimeException exception) {
+            failure.addSuppressed(exception);
+        }
     }
 
-    private WorldArchiveConfig migrateVersionOne(JsonObject root) throws IOException {
-        TriggerConfig triggers = parseGlobalTriggers(requiredObject(root, "triggers"));
-        JsonObject destinations = requiredObject(root, "destinations");
-        JsonObject gitObject = requiredObject(destinations, "git");
-        GitDestinationConfig git = migratedGit(
-                requiredBoolean(gitObject, "enabled"),
-                optionalPath(gitObject, "repository"),
-                requiredString(gitObject, "remoteName"),
-                optionalString(gitObject, "remoteUrl"),
-                DestinationTriggerConfig.defaults(),
-                GitDestinationConfig.DEFAULT_LFS_PATTERNS);
-        JsonObject zipObject = requiredObject(destinations, "zip");
-        ZipDestinationConfig zip = new ZipDestinationConfig(
-                requiredBoolean(zipObject, "enabled"),
-                optionalPath(zipObject, "destination"));
-        return new WorldArchiveConfig(WorldArchiveConfig.CURRENT_SCHEMA_VERSION, triggers, git, zip, List.of());
+    private Stored read() throws UnreadableConfigurationException {
+        if (!Files.exists(file, LinkOption.NOFOLLOW_LINKS)) {
+            return new Stored(WorldArchiveConfig.defaults(), WorldArchiveConfig.CURRENT_SCHEMA_VERSION, "");
+        }
+        try {
+            String text = AtomicFiles.readUtf8(file, MAXIMUM_CONFIG_BYTES);
+            JsonObject root = FIELDS.parseObject(text, "WorldArchive settings");
+            rejectCredentialFields(root);
+            int schemaVersion = FIELDS.requiredInt(root, "schemaVersion");
+            return new Stored(parse(root, schemaVersion), schemaVersion, text);
+        } catch (IOException | RuntimeException exception) {
+            throw new UnreadableConfigurationException(file, exception);
+        }
     }
 
-    private WorldArchiveConfig migrateVersionTwo(JsonObject root) throws IOException {
-        TriggerConfig triggers = parseGlobalTriggers(requiredObject(root, "triggers"));
-        JsonObject destinations = requiredObject(root, "destinations");
-        JsonObject gitObject = requiredObject(destinations, "git");
-        GitDestinationConfig git = migratedGit(
-                requiredBoolean(gitObject, "enabled"),
-                optionalPath(gitObject, "repository"),
-                requiredString(gitObject, "remoteName"),
-                optionalString(gitObject, "remoteUrl"),
-                parseDestinationTriggers(requiredObject(gitObject, "triggers")),
-                requiredStringArray(gitObject, "lfsPatterns"));
-        JsonObject zipObject = requiredObject(destinations, "zip");
-        ZipDestinationConfig zip = new ZipDestinationConfig(
-                requiredBoolean(zipObject, "enabled"),
-                optionalPath(zipObject, "destination"),
-                parseDestinationTriggers(requiredObject(zipObject, "triggers")));
-        return new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                triggers,
-                git,
-                zip,
-                parseWorlds(requiredArray(root, "worlds")));
+    /**
+     * Writes an older schema, or default folders an older version stored, in the current form.
+     * A failure is only logged: the settings were read, and the next change writes the file.
+     */
+    private void upgradeInPlace(WorldArchiveConfig config, Stored stored) {
+        try {
+            write(config, stored);
+        } catch (IOException exception) {
+            LOGGER.warn("WorldArchive settings could not be upgraded in place: {}",
+                    SafeText.from(exception, "the file could not be written", MESSAGE_LIMIT));
+        }
     }
 
-    private WorldArchiveConfig migrateVersionThree(JsonObject root) throws IOException {
-        TriggerConfig triggers = parseGlobalTriggers(requiredObject(root, "triggers"));
-        JsonObject destinations = requiredObject(root, "destinations");
-        JsonObject gitObject = requiredObject(destinations, "git");
-        GitDestinationConfig git = migratedGit(
-                requiredBoolean(gitObject, "enabled"),
-                optionalPath(gitObject, "repository"),
-                requiredString(gitObject, "remoteName"),
-                optionalString(gitObject, "remoteUrl"),
-                parseDestinationTriggers(requiredObject(gitObject, "triggers")),
-                requiredStringArray(gitObject, "lfsPatterns"));
-        ZipDestinationConfig zip = parseCurrentZip(requiredObject(destinations, "zip"));
-        return new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                triggers,
-                git,
-                zip,
-                parseWorlds(requiredArray(root, "worlds")));
+    private void write(WorldArchiveConfig config, Stored replaced) throws IOException {
+        if (replaced.outdated()) {
+            Path backup = file.resolveSibling(file.getFileName() + ".schema" + replaced.schemaVersion() + ".bak");
+            if (!Files.exists(backup, LinkOption.NOFOLLOW_LINKS)) {
+                AtomicFiles.writeUtf8(backup, replaced.text(), MAXIMUM_CONFIG_BYTES);
+            }
+        }
+        AtomicFiles.writeUtf8(file, encode(config), MAXIMUM_CONFIG_BYTES);
     }
 
-    /** Moves the schema-4 global URL template onto the worlds that it previously covered. */
-    private WorldArchiveConfig migrateVersionFour(JsonObject root) throws IOException {
-        TriggerConfig triggers = parseGlobalTriggers(requiredObject(root, "triggers"));
-        JsonObject destinations = requiredObject(root, "destinations");
-        JsonObject gitObject = requiredObject(destinations, "git");
-        Optional<String> template = optionalString(gitObject, "remoteUrlTemplate");
-        if (template.isPresent()
-                && !GitDestinationConfig.isPerWorldRemoteTemplate(template.orElseThrow())) {
-            throw new ConfigurationException(
-                    "Git remoteUrlTemplate must include exactly one {worldId} placeholder");
+    private WorldArchiveConfig parse(JsonObject root, int schemaVersion) throws ConfigurationException {
+        if (schemaVersion < OLDEST_SCHEMA_VERSION || schemaVersion > WorldArchiveConfig.CURRENT_SCHEMA_VERSION) {
+            throw new UnsupportedSchemaVersionException(schemaVersion);
         }
-        GitDestinationConfig git = new GitDestinationConfig(
-                requiredBoolean(gitObject, "enabled"),
-                optionalPath(gitObject, "repositoryRoot"),
-                requiredString(gitObject, "remoteName"),
-                Optional.empty(),
-                parseDestinationTriggers(requiredObject(gitObject, "triggers")),
-                requiredStringArray(gitObject, "lfsPatterns"),
-                parseHealth(requiredObject(gitObject, "health"), DestinationType.GIT),
-                optionalPath(gitObject, "legacySharedRepository"),
-                optionalString(gitObject, "legacyRemoteUrl"));
-        List<WorldConfig> worlds = parseWorlds(requiredArray(root, "worlds"), false).stream()
-                .map(world -> new WorldConfig(
-                        world.worldId(),
-                        world.enabled(),
-                        world.path(),
-                        template.map(value -> RemoteUrlPolicy.resolveWorldId(
-                                value,
-                                world.worldId().value())),
-                        world.zipDestination(),
-                        world.storagePolicy()))
-                .toList();
+        JsonObject destinations = FIELDS.requiredObject(root, "destinations");
+        JsonObject git = FIELDS.requiredObject(destinations, "git");
+        Optional<String> remoteTemplate = schemaVersion == REMOTE_TEMPLATE_SCHEMA_VERSION
+                ? FIELDS.optionalString(git, "remoteUrlTemplate")
+                : Optional.empty();
         return new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                triggers,
-                git,
-                parseCurrentZip(requiredObject(destinations, "zip")),
-                worlds);
+                parseGlobalTriggers(FIELDS.requiredObject(root, "triggers")),
+                parseGit(git),
+                parseZip(FIELDS.requiredObject(destinations, "zip")),
+                parseWorlds(FIELDS.requiredObjects(root, "worlds"), schemaVersion, remoteTemplate));
     }
 
-    /** Migrates the unversioned prototype layout that preceded schema version 1. */
-    private WorldArchiveConfig migrateLegacy(JsonObject root) throws IOException {
-        TriggerConfig triggers = new TriggerConfig(
-                optionalBoolean(root, "manualBackups").orElse(true),
-                optionalBoolean(root, "exitBackups").orElse(true),
-                optionalBoolean(root, "scheduleEnabled").orElse(false),
-                optionalInteger(root, "scheduleMinutes")
-                        .orElse(TriggerConfig.DEFAULT_SCHEDULE_INTERVAL_MINUTES));
-        GitDestinationConfig git = migratedGit(
-                optionalBoolean(root, "gitEnabled").orElse(true),
-                optionalPath(root, "gitRepository"),
-                optionalString(root, "gitRemoteName").orElse(GitDestinationConfig.DEFAULT_REMOTE_NAME),
-                optionalString(root, "gitRemoteUrl"),
-                DestinationTriggerConfig.defaults(),
-                GitDestinationConfig.DEFAULT_LFS_PATTERNS);
-        ZipDestinationConfig zip = new ZipDestinationConfig(
-                optionalBoolean(root, "zipEnabled").orElse(true),
-                optionalPath(root, "zipDestination"));
-        return new WorldArchiveConfig(WorldArchiveConfig.CURRENT_SCHEMA_VERSION, triggers, git, zip, List.of());
-    }
-
-    private TriggerConfig parseGlobalTriggers(JsonObject object) throws ConfigurationException {
+    private static TriggerConfig parseGlobalTriggers(JsonObject object) throws ConfigurationException {
         return new TriggerConfig(
-                requiredBoolean(object, "manualEnabled"),
-                requiredBoolean(object, "worldExitEnabled"),
-                requiredBoolean(object, "scheduledEnabled"),
-                requiredInteger(object, "scheduleIntervalMinutes"));
+                FIELDS.requiredBoolean(object, "manualEnabled"),
+                FIELDS.requiredBoolean(object, "worldExitEnabled"),
+                FIELDS.requiredBoolean(object, "scheduledEnabled"),
+                FIELDS.requiredInt(object, "scheduleIntervalMinutes"));
     }
 
-    private GitDestinationConfig parseCurrentGit(JsonObject object) throws IOException {
+    /** Fields that older versions wrote here (health, the 0.1.0 shared repository) are ignored. */
+    private GitDestinationConfig parseGit(JsonObject object) throws ConfigurationException {
         return new GitDestinationConfig(
-                requiredBoolean(object, "enabled"),
+                FIELDS.requiredBoolean(object, "enabled"),
                 optionalPath(object, "repositoryRoot"),
-                requiredString(object, "remoteName"),
-                Optional.empty(),
-                parseDestinationTriggers(requiredObject(object, "triggers")),
-                requiredStringArray(object, "lfsPatterns"),
-                parseHealth(requiredObject(object, "health"), DestinationType.GIT),
-                optionalPath(object, "legacySharedRepository"),
-                optionalString(object, "legacyRemoteUrl"));
-    }
-
-    private static GitDestinationConfig migratedGit(
-            boolean enabled,
-            Optional<Path> legacyRepository,
-            String remoteName,
-            Optional<String> legacyRemoteUrl,
-            DestinationTriggerConfig triggers,
-            List<String> lfsPatterns) {
-        return new GitDestinationConfig(
-                enabled,
-                Optional.empty(),
-                remoteName,
-                Optional.empty(),
-                triggers,
-                lfsPatterns,
-                DestinationHealth.notChecked(DestinationType.GIT),
-                legacyRepository,
-                legacyRemoteUrl);
+                FIELDS.requiredString(object, "remoteName"),
+                parseDestinationTriggers(FIELDS.requiredObject(object, "triggers")),
+                FIELDS.requiredStrings(object, "lfsPatterns"));
     }
 
-    private ZipDestinationConfig parseCurrentZip(JsonObject object) throws IOException {
+    private ZipDestinationConfig parseZip(JsonObject object) throws ConfigurationException {
         return new ZipDestinationConfig(
-                requiredBoolean(object, "enabled"),
+                FIELDS.requiredBoolean(object, "enabled"),
                 optionalPath(object, "destination"),
-                parseDestinationTriggers(requiredObject(object, "triggers")),
-                parseHealth(requiredObject(object, "health"), DestinationType.ZIP));
+                parseDestinationTriggers(FIELDS.requiredObject(object, "triggers")));
     }
 
     private static DestinationTriggerConfig parseDestinationTriggers(JsonObject object)
             throws ConfigurationException {
         return new DestinationTriggerConfig(
-                requiredBoolean(object, "manualEnabled"),
-                requiredBoolean(object, "worldExitEnabled"),
-                requiredBoolean(object, "scheduledEnabled"));
+                FIELDS.requiredBoolean(object, "manualEnabled"),
+                FIELDS.requiredBoolean(object, "worldExitEnabled"),
+                FIELDS.requiredBoolean(object, "scheduledEnabled"));
     }
 
-    private static DestinationHealth parseHealth(JsonObject object, DestinationType destination)
-            throws ConfigurationException {
-        return new DestinationHealth(
-                destination,
-                requiredEnum(object, "status", DestinationHealthStatus.class),
-                requiredString(object, "message"),
-                requiredInstant(object, "checkedAt"));
+    private List<WorldConfig> parseWorlds(
+            List<JsonObject> encodedWorlds,
+            int schemaVersion,
+            Optional<String> remoteTemplate) throws ConfigurationException {
+        List<WorldConfig> worlds = new ArrayList<>(encodedWorlds.size());
+        for (JsonObject world : encodedWorlds) {
+            WorldId worldId = WorldId.parse(FIELDS.requiredString(world, "worldId"));
+            Optional<String> remoteUrl = remoteTemplate.isPresent()
+                    ? Optional.of(remoteFromTemplate(remoteTemplate.get(), worldId))
+                    : FIELDS.optionalString(world, "remoteUrl");
+            StoragePolicy storagePolicy = schemaVersion >= STORAGE_POLICY_SCHEMA_VERSION
+                    ? parseStoragePolicy(FIELDS.requiredObject(world, "storage"))
+                    : StoragePolicy.defaults();
+            worlds.add(new WorldConfig(
+                    worldId,
+                    FIELDS.requiredBoolean(world, "enabled"),
+                    requiredPath(world, "path"),
+                    remoteUrl,
+                    optionalPath(world, "zipDestination"),
+                    storagePolicy));
+        }
+        return worlds;
     }
 
-    /** Applies the same credential check as load, so a save never produces a file load rejects. */
-    private WorldArchiveConfig parseSchema(JsonObject root, int schemaVersion) throws IOException {
-        return switch (schemaVersion) {
-            case 0 -> {
-                if (!looksLikeLegacyConfiguration(root)) {
-                    throw new ConfigurationException(
-                            "Configuration has no schema version and does not match the legacy layout");
-                }
-                yield migrateLegacy(root);
-            }
-            case 1 -> migrateVersionOne(root);
-            case 2 -> migrateVersionTwo(root);
-            case 3 -> migrateVersionThree(root);
-            case 4 -> migrateVersionFour(root);
-            case 5, 6 -> parseCurrent(root, false);
-            case WorldArchiveConfig.CURRENT_SCHEMA_VERSION -> parseCurrent(root, true);
-            default -> throw new UnsupportedSchemaVersionException(schemaVersion);
-        };
+    private static String remoteFromTemplate(String template, WorldId worldId) throws ConfigurationException {
+        int first = template.indexOf(WORLD_ID_PLACEHOLDER);
+        if (first < 0 || template.indexOf(WORLD_ID_PLACEHOLDER, first + 1) >= 0) {
+            throw new ConfigurationException(
+                    "Git remoteUrlTemplate must include exactly one {worldId} placeholder");
+        }
+        return template.replace(WORLD_ID_PLACEHOLDER, worldId.toString());
+    }
+
+    private static StoragePolicy parseStoragePolicy(JsonObject object) throws ConfigurationException {
+        return new StoragePolicy(
+                FIELDS.requiredLong(object, "budgetBytes"),
+                FIELDS.requiredInt(object, "dailyCopies"),
+                FIELDS.requiredInt(object, "weeklyCopies"),
+                FIELDS.requiredInt(object, "monthlyCopies"));
+    }
+
+    private Path requiredPath(JsonObject object, String name) throws ConfigurationException {
+        return optionalPath(object, name)
+                .orElseThrow(() -> new ConfigurationException("Required filesystem path is missing: " + name));
     }
 
-    private void writeUnlocked(WorldArchiveConfig config) throws IOException {
-        rejectSymlink(file, "Configuration file");
-        JsonObject encoded = encode(config);
-        rejectCredentialData(encoded);
-        AtomicFiles.writeUtf8(file, GSON.toJson(encoded) + "\n", MAXIMUM_CONFIG_BYTES);
+    /** A relative path is read from the folder that holds the settings file. */
+    private Optional<Path> optionalPath(JsonObject object, String name) throws ConfigurationException {
+        Optional<String> path = FIELDS.optionalString(object, name);
+        if (path.isEmpty()) {
+            return Optional.empty();
+        }
+        if (path.get().isBlank()) {
+            throw new ConfigurationException("Filesystem path must not be blank: " + name);
+        }
+        try {
+            return Optional.of(file.resolveSibling(path.get()).normalize());
+        } catch (InvalidPathException exception) {
+            throw new ConfigurationException("Invalid filesystem path in " + name, exception);
+        }
     }
 
-    private static JsonObject encode(WorldArchiveConfig config) {
+    private static String encode(WorldArchiveConfig config) {
         JsonObject root = new JsonObject();
-        root.addProperty("schemaVersion", config.schemaVersion());
+        root.addProperty("schemaVersion", WorldArchiveConfig.CURRENT_SCHEMA_VERSION);
         root.add("triggers", encodeGlobalTriggers(config.triggers()));
-
         JsonObject destinations = new JsonObject();
-        JsonObject git = new JsonObject();
-        git.addProperty("enabled", config.git().enabled());
-        config.git().repository().ifPresent(path -> git.addProperty("repositoryRoot", path.toString()));
-        git.addProperty("remoteName", config.git().remoteName());
-        config.git().legacyRepository()
-                .ifPresent(path -> git.addProperty("legacySharedRepository", path.toString()));
-        config.git().legacyRemoteUrl().ifPresent(url -> git.addProperty("legacyRemoteUrl", url));
-        git.add("triggers", encodeDestinationTriggers(config.git().triggers()));
-        JsonArray lfsPatterns = new JsonArray();
-        config.git().lfsPatterns().forEach(lfsPatterns::add);
-        git.add("lfsPatterns", lfsPatterns);
-        git.add("health", encodeHealth(config.git().health()));
-        destinations.add("git", git);
-
-        JsonObject zip = new JsonObject();
-        zip.addProperty("enabled", config.zip().enabled());
-        config.zip().destination().ifPresent(path -> zip.addProperty("destination", path.toString()));
-        zip.add("triggers", encodeDestinationTriggers(config.zip().triggers()));
-        zip.add("health", encodeHealth(config.zip().health()));
-        destinations.add("zip", zip);
+        destinations.add("git", encodeGit(config.git()));
+        destinations.add("zip", encodeZip(config.zip()));
         root.add("destinations", destinations);
-
         JsonArray worlds = new JsonArray();
-        for (WorldConfig worldConfig : config.worlds()) {
-            JsonObject world = new JsonObject();
-            world.addProperty("worldId", worldConfig.worldId().toString());
-            world.addProperty("enabled", worldConfig.enabled());
-            world.addProperty("path", worldConfig.path().toString());
-            worldConfig.remoteUrl().ifPresent(url -> world.addProperty("remoteUrl", url));
-            worldConfig.zipDestination()
-                    .ifPresent(path -> world.addProperty("zipDestination", path.toString()));
-            JsonObject storage = new JsonObject();
-            storage.addProperty("budgetBytes", worldConfig.storagePolicy().budgetBytes());
-            storage.addProperty("dailyCopies", worldConfig.storagePolicy().dailyCopies());
-            storage.addProperty("weeklyCopies", worldConfig.storagePolicy().weeklyCopies());
-            storage.addProperty("monthlyCopies", worldConfig.storagePolicy().monthlyCopies());
-            world.add("storage", storage);
-            worlds.add(world);
-        }
+        config.worlds().forEach(world -> worlds.add(encodeWorld(world)));
         root.add("worlds", worlds);
-        return root;
+        return GSON.toJson(root) + "\n";
     }
 
     private static JsonObject encodeGlobalTriggers(TriggerConfig config) {
@@ -385,12 +354,39 @@ private static JsonObject encodeGlobalTriggers(TriggerConfig config) {
         return triggers;
     }
 
-    private static JsonObject encodeHealth(DestinationHealth health) {
-        JsonObject encoded = new JsonObject();
-        encoded.addProperty("status", health.status().name());
-        encoded.addProperty("message", health.message());
-        encoded.addProperty("checkedAt", health.checkedAt().toString());
-        return encoded;
+    private static JsonObject encodeGit(GitDestinationConfig config) {
+        JsonObject git = new JsonObject();
+        git.addProperty("enabled", config.enabled());
+        config.repository().ifPresent(path -> git.addProperty("repositoryRoot", path.toString()));
+        git.addProperty("remoteName", config.remoteName());
+        git.add("triggers", encodeDestinationTriggers(config.triggers()));
+        JsonArray lfsPatterns = new JsonArray();
+        config.lfsPatterns().forEach(lfsPatterns::add);
+        git.add("lfsPatterns", lfsPatterns);
+        git.add("health", healthPlaceholder());
+        return git;
+    }
+
+    private static JsonObject encodeZip(ZipDestinationConfig config) {
+        JsonObject zip = new JsonObject();
+        zip.addProperty("enabled", config.enabled());
+        config.destination().ifPresent(path -> zip.addProperty("destination", path.toString()));
+        zip.add("triggers", encodeDestinationTriggers(config.triggers()));
+        zip.add("health", healthPlaceholder());
+        return zip;
+    }
+
+    /**
+     * WorldArchive 0.3.9 and older refuse a destination without this object, and a version that
+     * cannot read its settings replaces them with defaults. Writing it keeps a downgrade from
+     * losing the settings; it is ignored when read.
+     */
+    private static JsonObject healthPlaceholder() {
+        JsonObject health = new JsonObject();
+        health.addProperty("status", "UNCONFIGURED");
+        health.addProperty("message", "Not checked");
+        health.addProperty("checkedAt", Instant.EPOCH.toString());
+        return health;
     }
 
     private static JsonObject encodeDestinationTriggers(DestinationTriggerConfig config) {
@@ -401,255 +397,61 @@ private static JsonObject encodeDestinationTriggers(DestinationTriggerConfig con
         return triggers;
     }
 
-    private <T> T withLock(LockedFileStore.IoSupplier<T> operation) throws IOException {
-        Path parent = file.getParent();
-        if (parent == null) {
-            throw new ConfigurationException("Configuration path has no parent directory");
-        }
-        Files.createDirectories(parent);
-        return lockedFileStore.withLock(operation);
-    }
-
-    private static JsonObject parseObject(String json) throws ConfigurationException {
-        try {
-            JsonElement element = JsonParser.parseString(json);
-            if (!element.isJsonObject()) {
-                throw new ConfigurationException("WorldArchive configuration root must be a JSON object");
-            }
-            return element.getAsJsonObject();
-        } catch (JsonParseException exception) {
-            throw new ConfigurationException("WorldArchive configuration is malformed JSON", exception);
-        }
-    }
-
-    private static JsonObject requiredObject(JsonObject object, String name) throws ConfigurationException {
-        JsonElement element = object.get(name);
-        if (element == null || !element.isJsonObject()) {
-            throw new ConfigurationException("Required object is missing or invalid: " + name);
-        }
-        return element.getAsJsonObject();
-    }
-
-    private static JsonArray requiredArray(JsonObject object, String name) throws ConfigurationException {
-        JsonElement element = object.get(name);
-        if (element == null || !element.isJsonArray()) {
-            throw new ConfigurationException("Required array is missing or invalid: " + name);
-        }
-        return element.getAsJsonArray();
-    }
-
-    private static boolean requiredBoolean(JsonObject object, String name) throws ConfigurationException {
-        return optionalBoolean(object, name)
-                .orElseThrow(() -> new ConfigurationException("Required boolean is missing: " + name));
-    }
-
-    private static Optional<Boolean> optionalBoolean(JsonObject object, String name)
-            throws ConfigurationException {
-        JsonElement element = object.get(name);
-        if (element == null || element.isJsonNull()) {
-            return Optional.empty();
-        }
-        if (!element.isJsonPrimitive() || !element.getAsJsonPrimitive().isBoolean()) {
-            throw new ConfigurationException("Expected a boolean: " + name);
-        }
-        return Optional.of(element.getAsBoolean());
-    }
-
-    private static int requiredInteger(JsonObject object, String name) throws ConfigurationException {
-        return optionalInteger(object, name)
-                .orElseThrow(() -> new ConfigurationException("Required integer is missing: " + name));
-    }
-
-    private static long requiredLong(JsonObject object, String name)
-            throws ConfigurationException {
-        JsonElement element = object.get(name);
-        if (element == null
-                || !element.isJsonPrimitive()
-                || !element.getAsJsonPrimitive().isNumber()) {
-            throw new ConfigurationException("Required long is missing or invalid: " + name);
-        }
-        try {
-            return new BigDecimal(element.getAsString()).longValueExact();
-        } catch (ArithmeticException | NumberFormatException exception) {
-            throw new ConfigurationException("Expected a long: " + name, exception);
-        }
-    }
-
-    private static Optional<Integer> optionalInteger(JsonObject object, String name)
-            throws ConfigurationException {
-        JsonElement element = object.get(name);
-        if (element == null || element.isJsonNull()) {
-            return Optional.empty();
-        }
-        if (!element.isJsonPrimitive()) {
-            throw new ConfigurationException("Expected an integer: " + name);
-        }
-        JsonPrimitive primitive = element.getAsJsonPrimitive();
-        if (!primitive.isNumber()) {
-            throw new ConfigurationException("Expected an integer: " + name);
-        }
-        try {
-            return Optional.of(new BigDecimal(primitive.getAsString()).intValueExact());
-        } catch (ArithmeticException | NumberFormatException exception) {
-            throw new ConfigurationException("Expected an integer: " + name, exception);
-        }
-    }
-
-    private static String requiredString(JsonObject object, String name) throws ConfigurationException {
-        return optionalString(object, name)
-                .orElseThrow(() -> new ConfigurationException("Required string is missing: " + name));
-    }
-
-    private static Optional<String> optionalString(JsonObject object, String name)
-            throws ConfigurationException {
-        JsonElement element = object.get(name);
-        if (element == null || element.isJsonNull()) {
-            return Optional.empty();
-        }
-        if (!element.isJsonPrimitive() || !element.getAsJsonPrimitive().isString()) {
-            throw new ConfigurationException("Expected a string: " + name);
-        }
-        return Optional.of(element.getAsString());
-    }
-
-    private static List<String> requiredStringArray(JsonObject object, String name)
-            throws ConfigurationException {
-        JsonArray array = requiredArray(object, name);
-        List<String> values = new ArrayList<>(array.size());
-        for (JsonElement element : array) {
-            if (!element.isJsonPrimitive() || !element.getAsJsonPrimitive().isString()) {
-                throw new ConfigurationException("Expected an array of strings: " + name);
-            }
-            values.add(element.getAsString());
-        }
-        return values;
-    }
-
-    private static Instant requiredInstant(JsonObject object, String name) throws ConfigurationException {
-        try {
-            return Instant.parse(requiredString(object, name));
-        } catch (DateTimeParseException exception) {
-            throw new ConfigurationException("Expected an ISO-8601 instant: " + name, exception);
-        }
-    }
-
-    private static <E extends Enum<E>> E requiredEnum(
-            JsonObject object,
-            String name,
-            Class<E> enumType) throws ConfigurationException {
-        try {
-            return Enum.valueOf(enumType, requiredString(object, name));
-        } catch (IllegalArgumentException exception) {
-            throw new ConfigurationException("Enum value is invalid: " + name, exception);
-        }
-    }
-
-    private List<WorldConfig> parseWorlds(JsonArray worldsArray) throws IOException {
-        return parseWorlds(worldsArray, false);
-    }
-
-    private List<WorldConfig> parseWorlds(
-            JsonArray worldsArray,
-            boolean storagePolicyPresent) throws IOException {
-        List<WorldConfig> worlds = new ArrayList<>(worldsArray.size());
-        for (JsonElement element : worldsArray) {
-            if (!element.isJsonObject()) {
-                throw new ConfigurationException("Per-world configuration must be an object");
-            }
-            JsonObject world = element.getAsJsonObject();
-            StoragePolicy storagePolicy = storagePolicyPresent
-                    ? parseStoragePolicy(requiredObject(world, "storage"))
-                    : StoragePolicy.defaults();
-            worlds.add(new WorldConfig(
-                    WorldId.parse(requiredString(world, "worldId")),
-                    requiredBoolean(world, "enabled"),
-                    requiredPath(world, "path"),
-                    optionalString(world, "remoteUrl"),
-                    optionalPath(world, "zipDestination"),
-                    storagePolicy));
-        }
-        return worlds;
-    }
-
-    private static StoragePolicy parseStoragePolicy(JsonObject object)
-            throws ConfigurationException {
-        return new StoragePolicy(
-                requiredLong(object, "budgetBytes"),
-                requiredInteger(object, "dailyCopies"),
-                requiredInteger(object, "weeklyCopies"),
-                requiredInteger(object, "monthlyCopies"));
-    }
-
-    private Path requiredPath(JsonObject object, String name) throws IOException {
-        return optionalPath(object, name)
-                .orElseThrow(() -> new ConfigurationException("Required filesystem path is missing: " + name));
-    }
-
-    private Optional<Path> optionalPath(JsonObject object, String name) throws IOException {
-        Optional<String> path = optionalString(object, name);
-        if (path.isEmpty()) {
-            return Optional.empty();
-        }
-        if (path.get().isBlank()) {
-            throw new ConfigurationException("Filesystem path must not be blank: " + name);
-        }
-        try {
-            Path parsed = Path.of(path.get());
-            if (!parsed.isAbsolute()) {
-                Path parent = file.getParent();
-                if (parent == null) {
-                    throw new ConfigurationException("Configuration path has no parent directory");
-                }
-                parsed = parent.resolve(parsed);
-            }
-            return Optional.of(PathSafety.canonicalize(parsed));
-        } catch (RuntimeException exception) {
-            throw new ConfigurationException("Invalid filesystem path in " + name, exception);
-        }
-    }
-
-    private static boolean looksLikeLegacyConfiguration(JsonObject root) {
-        return root.has("manualBackups")
-                || root.has("exitBackups")
-                || root.has("scheduleEnabled")
-                || root.has("scheduleMinutes")
-                || root.has("gitEnabled")
-                || root.has("gitRepository")
-                || root.has("gitRemoteName")
-                || root.has("gitRemoteUrl")
-                || root.has("zipEnabled")
-                || root.has("zipDestination");
-    }
-
-    private static void rejectCredentialData(JsonElement element) throws ConfigurationException {
+    private static JsonObject encodeWorld(WorldConfig config) {
+        JsonObject world = new JsonObject();
+        world.addProperty("worldId", config.worldId().toString());
+        world.addProperty("enabled", config.enabled());
+        world.addProperty("path", config.path().toString());
+        config.remoteUrl().ifPresent(url -> world.addProperty("remoteUrl", url));
+        config.zipDestination().ifPresent(path -> world.addProperty("zipDestination", path.toString()));
+        JsonObject storage = new JsonObject();
+        storage.addProperty("budgetBytes", config.storagePolicy().budgetBytes());
+        storage.addProperty("dailyCopies", config.storagePolicy().dailyCopies());
+        storage.addProperty("weeklyCopies", config.storagePolicy().weeklyCopies());
+        storage.addProperty("monthlyCopies", config.storagePolicy().monthlyCopies());
+        world.add("storage", storage);
+        return world;
+    }
+
+    /** Refuses a hand-written file that keeps a password or token under its own key; WorldArchive never writes one. */
+    private static void rejectCredentialFields(JsonElement element) throws ConfigurationException {
         if (element.isJsonObject()) {
-            JsonObject object = element.getAsJsonObject();
-            for (String name : object.keySet()) {
-                String normalized = name.toLowerCase(Locale.ROOT).replace("_", "").replace("-", "");
-                if (normalized.contains("password")
-                        || normalized.contains("passwd")
-                        || normalized.contains("token")
-                        || normalized.contains("secret")
-                        || normalized.contains("credential")
-                        || normalized.contains("apikey")) {
+            for (Map.Entry<String, JsonElement> field : element.getAsJsonObject().entrySet()) {
+                if (isCredentialName(field.getKey())) {
                     throw new ConfigurationException(
                             "Credential fields are not permitted in WorldArchive configuration");
                 }
-                rejectCredentialData(object.get(name));
+                rejectCredentialFields(field.getValue());
             }
         } else if (element.isJsonArray()) {
             for (JsonElement value : element.getAsJsonArray()) {
-                rejectCredentialData(value);
+                rejectCredentialFields(value);
             }
-        } else if (element.isJsonPrimitive() && element.getAsJsonPrimitive().isString()
-                && SensitiveDataRedactor.containsSensitiveData(element.getAsString())) {
-            throw new ConfigurationException("Sensitive values are not permitted in WorldArchive configuration");
         }
     }
 
-    private static void rejectSymlink(Path path, String description) throws ConfigurationException {
-        if (Files.isSymbolicLink(path)) {
-            throw new ConfigurationException(description + " must not be a symbolic link");
+    private static boolean isCredentialName(String name) {
+        String normalized = name.toLowerCase(Locale.ROOT).replace("_", "").replace("-", "");
+        return normalized.contains("password")
+                || normalized.contains("passwd")
+                || normalized.contains("token")
+                || normalized.contains("secret")
+                || normalized.contains("credential")
+                || normalized.contains("apikey");
+    }
+
+    /** The settings written by {@link #reset}, and where the unreadable file was kept. */
+    public record Reset(WorldArchiveConfig config, Path keptCopy) {
+        public Reset {
+            Objects.requireNonNull(config, "config");
+            Objects.requireNonNull(keptCopy, "keptCopy");
+        }
+    }
+
+    /** What the file held: the settings as written in it, its schema version, and its text. */
+    private record Stored(WorldArchiveConfig config, int schemaVersion, String text) {
+        boolean outdated() {
+            return schemaVersion < WorldArchiveConfig.CURRENT_SCHEMA_VERSION;
         }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/config/WorldConfig.java b/src/main/java/dev/ishaanko/worldarchive/config/WorldConfig.java
index 3707457..3a150e8 100644
--- a/src/main/java/dev/ishaanko/worldarchive/config/WorldConfig.java
+++ b/src/main/java/dev/ishaanko/worldarchive/config/WorldConfig.java
@@ -5,7 +5,7 @@
 import java.util.Objects;
 import java.util.Optional;
 
-/** Per-world enablement, source path, and optional destination overrides. */
+/** One world's settings: whether it is backed up, where its folder is, and its own remote and ZIP folder. */
 public record WorldConfig(
         WorldId worldId,
         boolean enabled,
@@ -23,30 +23,28 @@ public record WorldConfig(
         Objects.requireNonNull(storagePolicy, "storagePolicy");
     }
 
-    public WorldConfig(
-            WorldId worldId,
-            boolean enabled,
-            Path path,
-            Optional<String> remoteUrl,
-            Optional<Path> zipDestination) {
-        this(
-                worldId,
-                enabled,
-                path,
-                remoteUrl,
-                zipDestination,
-                StoragePolicy.defaults());
+    /** Settings for a world seen for the first time: backed up, with no remote or own ZIP folder. */
+    public static WorldConfig defaults(WorldId worldId, Path path) {
+        return new WorldConfig(worldId, true, path, Optional.empty(), Optional.empty(), StoragePolicy.defaults());
     }
 
-    public WorldConfig(
-            WorldId worldId,
-            boolean enabled,
-            Path path,
-            Optional<String> remoteUrl) {
-        this(worldId, enabled, path, remoteUrl, Optional.empty());
+    public WorldConfig withEnabled(boolean enabled) {
+        return new WorldConfig(worldId, enabled, path, remoteUrl, zipDestination, storagePolicy);
     }
 
-    public WorldConfig(WorldId worldId, boolean enabled, Path path) {
-        this(worldId, enabled, path, Optional.empty(), Optional.empty());
+    public WorldConfig withPath(Path path) {
+        return new WorldConfig(worldId, enabled, path, remoteUrl, zipDestination, storagePolicy);
+    }
+
+    public WorldConfig withRemoteUrl(Optional<String> remoteUrl) {
+        return new WorldConfig(worldId, enabled, path, remoteUrl, zipDestination, storagePolicy);
+    }
+
+    public WorldConfig withZipDestination(Optional<Path> zipDestination) {
+        return new WorldConfig(worldId, enabled, path, remoteUrl, zipDestination, storagePolicy);
+    }
+
+    public WorldConfig withStoragePolicy(StoragePolicy storagePolicy) {
+        return new WorldConfig(worldId, enabled, path, remoteUrl, zipDestination, storagePolicy);
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/config/WorldIdentityStore.java b/src/main/java/dev/ishaanko/worldarchive/config/WorldIdentityStore.java
index 5b35c1b..1c9966a 100644
--- a/src/main/java/dev/ishaanko/worldarchive/config/WorldIdentityStore.java
+++ b/src/main/java/dev/ishaanko/worldarchive/config/WorldIdentityStore.java
@@ -2,22 +2,25 @@
 
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
-import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
-import com.google.gson.JsonParseException;
-import com.google.gson.JsonParser;
-import dev.ishaanko.worldarchive.core.AtomicFiles;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.WorldId;
 import dev.ishaanko.worldarchive.model.WorldIdentity;
+import dev.ishaanko.worldarchive.support.AtomicFiles;
+import dev.ishaanko.worldarchive.support.JsonFields;
+import dev.ishaanko.worldarchive.support.LockedFile;
 import java.io.IOException;
-import java.math.BigDecimal;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
 import java.nio.file.Path;
+import java.util.Objects;
 import java.util.Optional;
 
-/** Stable, versioned per-world identity with atomic creation and restored-copy provenance. */
+/**
+ * The identity each world folder carries in {@code .worldarchive/world.json}, so its backups
+ * stay its own when the folder is renamed or moved. Identities are created and replaced under a
+ * lock and published atomically, so readers never see half a file.
+ */
 public final class WorldIdentityStore {
     private static final String METADATA_DIRECTORY = ".worldarchive";
 
@@ -30,7 +33,9 @@ public final class WorldIdentityStore {
             .disableHtmlEscaping()
             .create();
 
-    /** Compatibility helper for callers that only need the stable UUID. */
+    private static final JsonFields<IOException> FIELDS = new JsonFields<>(IOException::new);
+
+    /** The world's ID; a new identity is created when the folder has none. */
     public WorldId loadOrCreate(Path worldDirectory) throws IOException {
         return loadOrCreateIdentity(worldDirectory).worldId();
     }
@@ -47,27 +52,19 @@ public WorldIdentity loadOrCreateIdentity(Path worldDirectory) throws IOExceptio
         });
     }
 
-    /** Reads an existing identity without creating one; empty when the folder carries none. */
+    /** Reads an existing identity without creating any file; empty when the folder carries none. */
     public Optional<WorldIdentity> loadExisting(Path worldDirectory) throws IOException {
         Path world = worldDirectory.toRealPath();
+        Path identityFile = world.resolve(METADATA_DIRECTORY).resolve(IDENTITY_FILE);
         if (!Files.isDirectory(world, LinkOption.NOFOLLOW_LINKS)) {
             throw new IOException("World path is not a directory: " + world);
         }
-        Path metadata = world.resolve(METADATA_DIRECTORY);
-        if (Files.isSymbolicLink(metadata)) {
+        if (Files.isSymbolicLink(identityFile.getParent())) {
             throw new IOException("World identity metadata directory must not be a symbolic link");
         }
-        if (!Files.isDirectory(metadata, LinkOption.NOFOLLOW_LINKS)) {
-            return Optional.empty();
-        }
-        Path realMetadata = metadata.toRealPath();
-        if (!realMetadata.startsWith(world)) {
-            throw new IOException("World identity metadata escaped the world directory");
-        }
-        return withLock(realMetadata, identityFile ->
-                Files.exists(identityFile, LinkOption.NOFOLLOW_LINKS)
-                        ? Optional.of(read(identityFile))
-                        : Optional.empty());
+        return Files.exists(identityFile, LinkOption.NOFOLLOW_LINKS)
+                ? Optional.of(read(identityFile))
+                : Optional.empty();
     }
 
     /** Explicitly replaces a copied source identity with a fresh restored-world identity. */
@@ -82,6 +79,26 @@ public WorldIdentity createFreshRestoredCopyIdentity(
         });
     }
 
+    /**
+     * Gives a world folder copied in a file manager its own identity, so its backups never mix
+     * with the original's. Nothing changes when the folder no longer carries {@code copiedId}.
+     *
+     * @return the identity the folder carries afterwards
+     */
+    public WorldIdentity giveCopyItsOwnIdentity(Path copyDirectory, WorldId copiedId) throws IOException {
+        Objects.requireNonNull(copiedId, "copiedId");
+        Path metadata = prepareMetadata(copyDirectory);
+        return withLock(metadata, identityFile -> {
+            WorldIdentity current = read(identityFile);
+            if (!current.worldId().equals(copiedId)) {
+                return current;
+            }
+            WorldIdentity own = WorldIdentity.original(WorldId.create());
+            write(identityFile, own);
+            return own;
+        });
+    }
+
     private static Path prepareMetadata(Path worldDirectory) throws IOException {
         Path world = worldDirectory.toRealPath();
         if (!Files.isDirectory(world, LinkOption.NOFOLLOW_LINKS)) {
@@ -101,41 +118,32 @@ private static Path prepareMetadata(Path worldDirectory) throws IOException {
 
     private static <T> T withLock(Path metadata, IdentityOperation<T> operation) throws IOException {
         Path identityFile = metadata.resolve(IDENTITY_FILE);
-        return new LockedFileStore(identityFile, IOException::new)
-                .withLock(() -> operation.apply(identityFile));
+        return new LockedFile(identityFile).withLock(() -> operation.apply(identityFile));
     }
 
+    /** Refuses links, special files, and oversized files through {@link AtomicFiles#readUtf8}. */
     private static WorldIdentity read(Path identityFile) throws IOException {
-        rejectSymlink(identityFile, "World identity file");
-        if (!Files.isRegularFile(identityFile, LinkOption.NOFOLLOW_LINKS)) {
-            throw new IOException("World identity is not a regular file");
-        }
-        if (Files.size(identityFile) > MAXIMUM_IDENTITY_BYTES) {
-            throw new IOException("World identity file is unexpectedly large");
+        JsonObject object = FIELDS.parseObject(
+                AtomicFiles.readUtf8(identityFile, MAXIMUM_IDENTITY_BYTES),
+                "World identity");
+        int schemaVersion = FIELDS.requiredInt(object, "schemaVersion");
+        if (schemaVersion != WorldIdentity.CURRENT_SCHEMA_VERSION) {
+            throw new IOException("Unsupported world identity schema: " + schemaVersion);
         }
         try {
-            JsonElement parsed = JsonParser.parseString(
-                    AtomicFiles.readUtf8(identityFile, MAXIMUM_IDENTITY_BYTES));
-            if (!parsed.isJsonObject()) {
-                throw new IOException("World identity root must be a JSON object");
-            }
-            JsonObject object = parsed.getAsJsonObject();
-            int schemaVersion = requiredInteger(object, "schemaVersion");
-            if (schemaVersion > WorldIdentity.CURRENT_SCHEMA_VERSION) {
-                throw new IOException("Unsupported future world identity schema: " + schemaVersion);
-            }
-            WorldId worldId = WorldId.parse(requiredString(object, "worldId"));
-            Optional<BackupId> sourceBackupId = optionalString(object, "sourceBackupId").map(BackupId::parse);
-            return new WorldIdentity(schemaVersion, worldId, sourceBackupId);
-        } catch (JsonParseException | IllegalArgumentException exception) {
+            WorldId worldId = WorldId.parse(FIELDS.requiredString(object, "worldId"));
+            Optional<BackupId> sourceBackupId = FIELDS.optionalString(object, "sourceBackupId")
+                    .map(BackupId::parse);
+            return new WorldIdentity(worldId, sourceBackupId);
+        } catch (IllegalArgumentException exception) {
             throw new IOException("World identity is malformed or invalid", exception);
         }
     }
 
+    /** {@link AtomicFiles#writeUtf8} replaces the file by renaming, so it never writes through a link. */
     private static void write(Path identityFile, WorldIdentity identity) throws IOException {
-        rejectSymlink(identityFile, "World identity file");
         JsonObject object = new JsonObject();
-        object.addProperty("schemaVersion", identity.schemaVersion());
+        object.addProperty("schemaVersion", WorldIdentity.CURRENT_SCHEMA_VERSION);
         object.addProperty("worldId", identity.worldId().toString());
         identity.sourceBackupId().ifPresent(id -> object.addProperty("sourceBackupId", id.toString()));
         AtomicFiles.writeUtf8(
@@ -144,40 +152,6 @@ private static void write(Path identityFile, WorldIdentity identity) throws IOEx
                 MAXIMUM_IDENTITY_BYTES);
     }
 
-    private static void rejectSymlink(Path path, String description) throws IOException {
-        if (Files.isSymbolicLink(path)) {
-            throw new IOException(description + " must not be a symbolic link");
-        }
-    }
-
-    private static int requiredInteger(JsonObject object, String name) throws IOException {
-        JsonElement element = object.get(name);
-        if (element == null || !element.isJsonPrimitive() || !element.getAsJsonPrimitive().isNumber()) {
-            throw new IOException("Required world identity integer is missing or invalid: " + name);
-        }
-        try {
-            return new BigDecimal(element.getAsString()).intValueExact();
-        } catch (ArithmeticException | NumberFormatException exception) {
-            throw new IOException("World identity integer is invalid: " + name, exception);
-        }
-    }
-
-    private static String requiredString(JsonObject object, String name) throws IOException {
-        return optionalString(object, name)
-                .orElseThrow(() -> new IOException("Required world identity string is missing: " + name));
-    }
-
-    private static Optional<String> optionalString(JsonObject object, String name) throws IOException {
-        JsonElement element = object.get(name);
-        if (element == null || element.isJsonNull()) {
-            return Optional.empty();
-        }
-        if (!element.isJsonPrimitive() || !element.getAsJsonPrimitive().isString()) {
-            throw new IOException("World identity value must be a string: " + name);
-        }
-        return Optional.of(element.getAsString());
-    }
-
     @FunctionalInterface
     private interface IdentityOperation<T> {
         T apply(Path identityFile) throws IOException;
diff --git a/src/main/java/dev/ishaanko/worldarchive/config/ZipDestinationConfig.java b/src/main/java/dev/ishaanko/worldarchive/config/ZipDestinationConfig.java
index de36ef1..7788da6 100644
--- a/src/main/java/dev/ishaanko/worldarchive/config/ZipDestinationConfig.java
+++ b/src/main/java/dev/ishaanko/worldarchive/config/ZipDestinationConfig.java
@@ -1,45 +1,28 @@
 package dev.ishaanko.worldarchive.config;
 
-import dev.ishaanko.worldarchive.model.DestinationHealth;
-import dev.ishaanko.worldarchive.model.DestinationType;
 import java.nio.file.Path;
 import java.util.Objects;
 import java.util.Optional;
 
-/** Configuration for local or desktop-synced ZIP archives. */
+/**
+ * Settings of the ZIP destination. An empty destination means the default folder
+ * ({@link DefaultDestinations}); a world can name its own folder in {@link WorldConfig}.
+ */
 public record ZipDestinationConfig(
         boolean enabled,
         Optional<Path> destination,
-        DestinationTriggerConfig triggers,
-        DestinationHealth health) {
+        DestinationTriggerConfig triggers) {
     public ZipDestinationConfig {
         destination = Objects.requireNonNull(destination, "destination")
                 .map(path -> path.toAbsolutePath().normalize());
         Objects.requireNonNull(triggers, "triggers");
-        Objects.requireNonNull(health, "health");
-        if (health.destination() != DestinationType.ZIP) {
-            throw new IllegalArgumentException("ZIP health state must describe the ZIP destination");
-        }
     }
 
-    /** Compatibility constructor for callers that predate persisted destination health. */
-    public ZipDestinationConfig(
-            boolean enabled,
-            Optional<Path> destination,
-            DestinationTriggerConfig triggers) {
-        this(enabled, destination, triggers, DestinationHealth.notChecked(DestinationType.ZIP));
-    }
-
-    /** Compatibility constructor for callers that predate per-destination triggers. */
-    public ZipDestinationConfig(boolean enabled, Optional<Path> destination) {
-        this(enabled, destination, DestinationTriggerConfig.defaults());
+    public static ZipDestinationConfig defaults() {
+        return new ZipDestinationConfig(true, Optional.empty(), DestinationTriggerConfig.defaults());
     }
 
-    public static ZipDestinationConfig defaults() {
-        return new ZipDestinationConfig(
-                true,
-                Optional.empty(),
-                DestinationTriggerConfig.defaults(),
-                DestinationHealth.notChecked(DestinationType.ZIP));
+    public ZipDestinationConfig withDestination(Optional<Path> destination) {
+        return new ZipDestinationConfig(enabled, destination, triggers);
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/BackupBackend.java b/src/main/java/dev/ishaanko/worldarchive/core/BackupBackend.java
index 456332a..5fe82d3 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/BackupBackend.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/BackupBackend.java
@@ -2,22 +2,24 @@
 
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
-import java.util.concurrent.CompletionStage;
+import dev.ishaanko.worldarchive.model.ProgressListener;
 
 /**
- * Independent asynchronous backup destination.
- *
- * <p>Implementations must be thread-safe, must not perform blocking work on the calling thread,
- * and must complete with a result for recoverable destination failures. Exceptional completion is
- * reserved for programming errors or failures that prevent a trustworthy destination result.</p>
- *
- * <p>Return the stage from {@link AsyncTasks#supplyInterruptible} directly, not a stage
- * composed from it. The coordinator stops a cancelled write through that future so the
- * destination's own outcome, such as a snapshot published before an interrupted push, is
- * still recorded. Any other stage is cancelled outright and its outcome is lost.</p>
+ * One backup destination. The coordinator runs {@link #createBackup} for every destination on a
+ * worker of its own and cancels a write by interrupting that worker.
  */
 public interface BackupBackend {
     DestinationType destinationType();
 
-    CompletionStage<DestinationResult> createBackup(BackupCapture capture, ProgressListener progressListener);
+    /**
+     * Writes one backup of the capture and blocks until it is done. Implementations must be
+     * thread-safe. A destination problem is a result, not an exception.
+     *
+     * <p>An interrupt asks the write to stop. A destination that already made a durable copy
+     * returns it, for example a Git snapshot whose push was cut short returns PENDING_SYNC; one
+     * that made nothing returns a failed result or throws {@link InterruptedException}. Any
+     * other exception means no trustworthy result exists.</p>
+     */
+    DestinationResult createBackup(BackupCapture capture, ProgressListener progressListener)
+            throws InterruptedException;
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/BackupCapture.java b/src/main/java/dev/ishaanko/worldarchive/core/BackupCapture.java
index 99aecb6..f35d14c 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/BackupCapture.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/BackupCapture.java
@@ -4,12 +4,17 @@
 import java.nio.file.Path;
 import java.util.Objects;
 
-/** A flushed source tree and the manifest shared by all enabled destinations. */
-public record BackupCapture(Path worldDirectory, BackupManifest manifest) {
+/**
+ * A private copy of a world that every enabled destination backs up; destinations only read it.
+ * The inventory lists each file's size and SHA-256, so a destination can use them without hashing
+ * again; the manifest's counts and digests are derived from it.
+ */
+public record BackupCapture(Path worldDirectory, BackupManifest manifest, WorldInventory inventory) {
     public BackupCapture {
         worldDirectory = Objects.requireNonNull(worldDirectory, "worldDirectory")
                 .toAbsolutePath()
                 .normalize();
         Objects.requireNonNull(manifest, "manifest");
+        Objects.requireNonNull(inventory, "inventory");
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/BackupCaptureFactory.java b/src/main/java/dev/ishaanko/worldarchive/core/BackupCaptureFactory.java
deleted file mode 100644
index eac053f..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/core/BackupCaptureFactory.java
+++ /dev/null
@@ -1,17 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import java.io.IOException;
-import java.time.Instant;
-import java.util.Optional;
-
-/** Synchronously prepares one immutable source tree while its caller holds the capture gate. */
-public interface BackupCaptureFactory {
-    CapturedBackup capture(
-            CreateBackupRequest request,
-            BackupId backupId,
-            Instant createdAt,
-            Optional<WorldInventory> previousInventory,
-            CaptureProgressListener progressListener)
-            throws IOException, InterruptedException;
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/BackupCaptureGate.java b/src/main/java/dev/ishaanko/worldarchive/core/BackupCaptureGate.java
deleted file mode 100644
index f72626f..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/core/BackupCaptureGate.java
+++ /dev/null
@@ -1,20 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import java.io.IOException;
-
-/** Marshals the short immutable-copy phase onto a caller-controlled capture thread. */
-@FunctionalInterface
-public interface BackupCaptureGate {
-    BackupCaptureGate DIRECT = CaptureTask::capture;
-
-    /**
-     * Runs the task and returns only after the gated thread has fully left the capture section.
-     * Destination work is not started until this method returns.
-     */
-    CapturedBackup capture(CaptureTask task) throws IOException, InterruptedException;
-
-    @FunctionalInterface
-    interface CaptureTask {
-        CapturedBackup capture() throws IOException, InterruptedException;
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/BackupCoordinator.java b/src/main/java/dev/ishaanko/worldarchive/core/BackupCoordinator.java
deleted file mode 100644
index 1e692cf..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/core/BackupCoordinator.java
+++ /dev/null
@@ -1,36 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.util.Optional;
-import java.util.concurrent.CompletionStage;
-
-/**
- * Serialized lifecycle-facing backup service.
- *
- * <p>Implementations coalesce compatible concurrent triggers for the same world, serialize
- * incompatible operations, and allow different worlds to proceed independently.</p>
- */
-public interface BackupCoordinator {
-    CompletionStage<BackupResult> createBackup(
-            CreateBackupRequest request,
-            ProgressListener progressListener);
-
-    /** Captures synchronously on the calling thread, suitable for an integrated-server save hook. */
-    PreparedBackup prepareCapture(
-            CreateBackupRequest request,
-            CaptureProgressListener progressListener)
-            throws IOException, InterruptedException;
-
-    /** Transfers an already captured source into the serialized destination queue. */
-    CompletionStage<BackupResult> createPreparedBackup(
-            PreparedBackup preparedBackup,
-            ProgressListener progressListener);
-
-    Optional<OperationProgress> currentOperation(WorldId worldId);
-
-    default boolean isBusy(WorldId worldId) {
-        return currentOperation(worldId).isPresent();
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/BackupDestinationSelector.java b/src/main/java/dev/ishaanko/worldarchive/core/BackupDestinationSelector.java
index 0e3f684..1bc6ab5 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/BackupDestinationSelector.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/BackupDestinationSelector.java
@@ -2,13 +2,8 @@
 
 import java.util.List;
 
-/** Resolves an immutable destination plan for one create request. */
+/** Chooses the destinations of one backup request; each destination type appears at most once. */
 @FunctionalInterface
 public interface BackupDestinationSelector {
     List<BackupBackend> select(CreateBackupRequest request);
-
-    static BackupDestinationSelector fixed(List<BackupBackend> destinations) {
-        List<BackupBackend> fixed = List.copyOf(destinations);
-        return ignored -> fixed;
-    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/BackupMaintenanceService.java b/src/main/java/dev/ishaanko/worldarchive/core/BackupMaintenanceService.java
deleted file mode 100644
index 69dcb89..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/core/BackupMaintenanceService.java
+++ /dev/null
@@ -1,45 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.DestinationHealth;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.util.List;
-import java.util.Optional;
-import java.util.concurrent.CompletionStage;
-
-/** Non-create operations composed with the create coordinator. */
-public interface BackupMaintenanceService {
-    CompletionStage<List<BackupRecord>> listBackups(Optional<WorldId> worldId);
-
-    CompletionStage<Optional<BackupRecord>> findBackup(BackupId backupId);
-
-    CompletionStage<RestoreBackupResult> restoreBackup(
-            RestoreBackupRequest request,
-            ProgressListener progressListener);
-
-    CompletionStage<DeletePreparation> prepareDelete(BackupId backupId);
-
-    CompletionStage<BackupResult> deleteBackup(
-            DeleteBackupRequest request,
-            ProgressListener progressListener);
-
-    /**
-     * Deletes several confirmed backups as one operation. Results arrive in request order;
-     * a backup that could not be deleted is reported as failed instead of failing the batch.
-     */
-    CompletionStage<List<BackupResult>> deleteBackups(
-            List<DeleteBackupRequest> requests,
-            ProgressListener progressListener);
-
-    CompletionStage<BackupResult> verifyBackup(
-            BackupId backupId,
-            ProgressListener progressListener);
-
-    CompletionStage<BackupResult> syncBackup(
-            BackupId backupId,
-            ProgressListener progressListener);
-
-    CompletionStage<List<DestinationHealth>> health(Optional<WorldId> worldId);
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/BackupService.java b/src/main/java/dev/ishaanko/worldarchive/core/BackupService.java
index a8a98dd..a399c2e 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/BackupService.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/BackupService.java
@@ -3,37 +3,32 @@
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.DestinationHealth;
+import dev.ishaanko.worldarchive.model.ProgressListener;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.util.List;
 import java.util.Optional;
 import java.util.concurrent.CompletionStage;
 
 /**
- * Shared asynchronous API used by commands, screens, and lifecycle integration.
+ * Lists, restores, deletes, verifies, and syncs backups. The recovery service implements it, and
+ * the client runtime wraps it for the screens. Backups are created through
+ * {@link SerializedBackupCoordinator} instead.
  *
  * <p>Implementations must be thread-safe. Returned stages must never depend on a render or server
  * thread continuing to execute blocking storage work.</p>
  */
 public interface BackupService {
-    CompletionStage<BackupResult> createBackup(
-            CreateBackupRequest request,
-            ProgressListener progressListener);
-
     CompletionStage<List<BackupRecord>> listBackups(Optional<WorldId> worldId);
 
-    CompletionStage<Optional<BackupRecord>> findBackup(BackupId backupId);
-
     CompletionStage<RestoreBackupResult> restoreBackup(
             RestoreBackupRequest request,
             ProgressListener progressListener);
 
-    CompletionStage<DeletePreparation> prepareDelete(BackupId backupId);
-
-    CompletionStage<BackupResult> deleteBackup(
-            DeleteBackupRequest request,
-            ProgressListener progressListener);
-
+    /**
+     * Deletes the backups the player confirmed, one or many, as one operation. Results arrive in
+     * request order; a backup that could not be deleted, or that changed since it was confirmed,
+     * is reported as failed instead of failing the others.
+     */
     CompletionStage<List<BackupResult>> deleteBackups(
             List<DeleteBackupRequest> requests,
             ProgressListener progressListener);
@@ -45,6 +40,4 @@ CompletionStage<BackupResult> verifyBackup(
     CompletionStage<BackupResult> syncBackup(
             BackupId backupId,
             ProgressListener progressListener);
-
-    CompletionStage<List<DestinationHealth>> health(Optional<WorldId> worldId);
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/CancellationState.java b/src/main/java/dev/ishaanko/worldarchive/core/CancellationState.java
deleted file mode 100644
index 2a33fb1..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/core/CancellationState.java
+++ /dev/null
@@ -1,12 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-/**
- * Point-of-no-return tracking for a create operation's cancellation window. A backup can be
- * cancelled while it captures the world and while its destinations write; once the result is
- * being recorded in the catalog it is committed.
- */
-enum CancellationState {
-    CANCELLABLE,
-    CANCELLATION_REQUESTED,
-    COMMITTING
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/CaptureChangedException.java b/src/main/java/dev/ishaanko/worldarchive/core/CaptureChangedException.java
new file mode 100644
index 0000000..0e503f7
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/core/CaptureChangedException.java
@@ -0,0 +1,14 @@
+package dev.ishaanko.worldarchive.core;
+
+import java.io.IOException;
+
+/**
+ * The world changed while it was copied, so the copy is not trustworthy. A capture retries on
+ * its own a few times; when this reaches the caller, trying again later usually works, and the
+ * UI offers a Retry button for it.
+ */
+public final class CaptureChangedException extends IOException {
+    CaptureChangedException(String message) {
+        super(message);
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/CaptureKind.java b/src/main/java/dev/ishaanko/worldarchive/core/CaptureKind.java
new file mode 100644
index 0000000..ca04a16
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/core/CaptureKind.java
@@ -0,0 +1,15 @@
+package dev.ishaanko.worldarchive.core;
+
+/** Whether the game may still write the world while a capture copies it, which decides how the copy is checked. */
+public enum CaptureKind {
+    /**
+     * The world the integrated server runs. Autosave is paused, but the game can still write a
+     * file, so every file is read and hashed a second time after the copy.
+     */
+    OPEN_WORLD,
+    /**
+     * A world no game runs, or one whose server stopped after its final save. A file is read a
+     * second time only when its state changed during the copy or its time is recent.
+     */
+    CLOSED_WORLD
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/CaptureWorkspace.java b/src/main/java/dev/ishaanko/worldarchive/core/CaptureWorkspace.java
index b8e7a32..af9c4a1 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/CaptureWorkspace.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/CaptureWorkspace.java
@@ -1,12 +1,9 @@
 package dev.ishaanko.worldarchive.core;
 
 import java.io.IOException;
-import java.nio.ByteBuffer;
 import java.nio.channels.FileChannel;
-import java.nio.channels.FileLock;
 import java.nio.channels.OverlappingFileLockException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.FileAlreadyExistsException;
+import java.nio.file.AccessDeniedException;
 import java.nio.file.FileVisitResult;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
@@ -18,486 +15,235 @@
 import java.nio.file.attribute.DosFileAttributeView;
 import java.nio.file.attribute.PosixFileAttributeView;
 import java.nio.file.attribute.PosixFilePermission;
-import java.util.Arrays;
-import java.util.Comparator;
 import java.util.EnumSet;
 import java.util.List;
 import java.util.Objects;
-import java.util.Optional;
+import java.util.Set;
 import java.util.UUID;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.regex.Pattern;
 import java.util.stream.Stream;
 
-/** Owns allocation, recovery, sealing, and deletion of private capture directories. */
+/**
+ * The private folders that hold world captures, below one capture root. A workspace keeps its
+ * captures in a folder named after a random owner ID and locks {@code <owner>.lock} next to it
+ * for as long as the process runs. Another game instance that shares the storage folder can
+ * therefore tell a capture in use from one that a crash left behind: {@link #removeAbandoned}
+ * deletes only folders whose lock it can take. Everything else under the root is kept.
+ */
 final class CaptureWorkspace {
-    private static final String CAPTURE_PREFIX = ".capture-";
+    private static final String LOCK_SUFFIX = ".lock";
 
-    private static final String OWNERSHIP_SUFFIX = ".worldarchive-owner";
+    private static final Pattern OWNER_ID = Pattern.compile(
+            "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}");
 
-    private static final String OWNERSHIP_HEADER = "worldarchive-private-capture-v1:";
+    /** WorldArchive 0.3.9 named a capture {@code .capture-<id>} and kept an owner marker file beside it. */
+    private static final Pattern LEGACY_CAPTURE = Pattern.compile(
+            "\\.capture-" + OWNER_ID.pattern() + "(\\.worldarchive-owner)?");
 
-    private final Path directory;
+    /**
+     * Owners in this JVM. Their lock files are never opened a second time here, because closing
+     * any channel on a file releases this process's POSIX lock on it.
+     */
+    private static final Set<String> LOCAL_OWNERS = ConcurrentHashMap.newKeySet();
 
-    CaptureWorkspace(Path directory) {
-        this.directory = Objects.requireNonNull(directory, "directory")
-                .toAbsolutePath()
-                .normalize();
-        cleanupAtStartup();
-    }
+    private final Path root;
 
-    Lease open(Path source) throws IOException {
-        Path normalizedSource = source.toAbsolutePath().normalize();
-        if (normalizedSource.startsWith(directory) || directory.startsWith(normalizedSource)) {
-            throw new IOException("Private captures must be stored outside the live world");
-        }
-        requireSafeDirectory(source, "World source is not a safe directory");
-        Files.createDirectories(directory);
-        requireSafeDirectory(directory, "Capture directory is not a safe directory");
-        cleanupAbandonedCaptures();
-        Path realSource = source.toRealPath(LinkOption.NOFOLLOW_LINKS);
-        Path realCaptures = directory.toRealPath(LinkOption.NOFOLLOW_LINKS);
-        if (realSource.startsWith(realCaptures) || realCaptures.startsWith(realSource)) {
-            throw new IOException("Private captures must be stored outside the live world");
-        }
-        return Lease.create(directory);
-    }
+    private final String owner = UUID.randomUUID().toString();
 
-    private void cleanupAtStartup() {
-        try {
-            requireSafeDirectory(directory, "Capture directory is not a safe directory");
-            cleanupAbandonedCaptures();
-        } catch (NoSuchFileException ignored) {
-            // The capture root is created lazily on the first backup.
-        } catch (IOException ignored) {
-            // Unsafe or unavailable roots are rejected by open rather than mutated at startup.
-        }
+    // Guarded by this. Opened with the first capture and never closed: the lock must last as
+    // long as the process, and the operating system releases it when the process ends.
+    private FileChannel ownerLock;
+
+    CaptureWorkspace(Path root) {
+        this.root = Objects.requireNonNull(root, "root").toAbsolutePath().normalize();
     }
 
-    private void cleanupAbandonedCaptures() {
-        List<Path> candidates;
-        try (Stream<Path> entries = Files.list(directory)) {
-            candidates = entries.sorted().toList();
-        } catch (IOException exception) {
-            return;
-        }
-        for (Path candidate : candidates) {
-            if (candidate.getFileName().toString().endsWith(OWNERSHIP_SUFFIX)) {
-                cleanupOrphanedMarker(candidate);
-            } else {
-                cleanupAbandonedCapture(candidate);
-            }
-        }
+    /** Creates an empty private folder for one capture of {@code world}. */
+    Lease open(Path world) throws IOException {
+        requireOutside(world);
+        Path capture = ownFolder().resolve(UUID.randomUUID().toString());
+        Files.createDirectory(capture);
+        return new Lease(capture);
     }
 
     /**
-     * A marker outlives its capture directory when the process died between deleting the tree
-     * and deleting the marker. The directory is always created before the marker, so a marker
-     * with no directory is never a capture that is still starting.
+     * Deletes the capture folders of game instances that have ended, such as after a crash, and
+     * the leftovers of WorldArchive 0.3.9. Run it once at startup, off the render thread.
      */
-    private static void cleanupOrphanedMarker(Path marker) {
-        String name = marker.getFileName().toString();
-        Path captureRoot = marker.resolveSibling(
-                name.substring(0, name.length() - OWNERSHIP_SUFFIX.length()));
-        Optional<UUID> captureId = parseCaptureId(captureRoot);
-        if (captureId.isEmpty()) {
-            return;
-        }
-        try {
-            if (!isAbsent(captureRoot)) {
-                return;
-            }
-        } catch (IOException exception) {
-            return;
-        }
-        deleteOwnershipMarkerIfSafe(marker, ownershipMarkerContents(captureId.orElseThrow()));
-    }
-
-    private static void cleanupAbandonedCapture(Path candidate) {
-        Optional<UUID> captureId = parseCaptureId(candidate);
-        if (captureId.isEmpty()) {
+    void removeAbandoned() throws IOException {
+        List<Path> entries;
+        try (Stream<Path> listed = Files.list(root)) {
+            entries = listed.toList();
+        } catch (NoSuchFileException exception) {
             return;
         }
-        Path marker = ownershipMarker(candidate);
-        byte[] expectedMarker = ownershipMarkerContents(captureId.orElseThrow());
-        boolean deleted = false;
-        try {
-            requireSafeDirectory(candidate, "Private capture is not a safe directory");
-            requireSafeOwnershipMarker(marker, expectedMarker);
-            try (FileChannel channel = openOwnershipMarker(marker)) {
-                FileLock lock;
-                try {
-                    lock = channel.tryLock();
-                } catch (OverlappingFileLockException exception) {
-                    return;
-                }
-                if (lock == null) {
-                    return;
-                }
-                try (lock) {
-                    requireSafeOwnershipMarkerPath(marker, expectedMarker.length);
-                    if (!hasExactContents(channel, expectedMarker)) {
-                        return;
-                    }
-                    requireSafeCaptureTree(candidate);
-                    deleteTree(candidate);
-                    deleted = isAbsent(candidate);
+        IOException failure = null;
+        for (Path entry : entries) {
+            try {
+                removeIfAbandoned(entry);
+            } catch (IOException exception) {
+                if (failure == null) {
+                    failure = exception;
+                } else {
+                    failure.addSuppressed(exception);
                 }
             }
-        } catch (IOException | RuntimeException exception) {
-            return;
         }
-        if (deleted) {
-            deleteOwnershipMarkerIfSafe(marker, expectedMarker);
+        if (failure != null) {
+            throw failure;
         }
     }
 
-    private static Optional<UUID> parseCaptureId(Path candidate) {
-        Path namePath = candidate.getFileName();
-        if (namePath == null) {
-            return Optional.empty();
+    private void removeIfAbandoned(Path entry) throws IOException {
+        String name = entry.getFileName().toString();
+        if (LEGACY_CAPTURE.matcher(name).matches()) {
+            deleteTree(entry);
+            return;
         }
-        String name = namePath.toString();
-        if (!name.startsWith(CAPTURE_PREFIX)) {
-            return Optional.empty();
+        String entryOwner = name.endsWith(LOCK_SUFFIX)
+                ? name.substring(0, name.length() - LOCK_SUFFIX.length())
+                : "";
+        if (!OWNER_ID.matcher(entryOwner).matches() || LOCAL_OWNERS.contains(entryOwner)) {
+            return;
         }
-        String encodedId = name.substring(CAPTURE_PREFIX.length());
+        FileChannel channel;
         try {
-            UUID captureId = UUID.fromString(encodedId);
-            return captureId.toString().equals(encodedId)
-                    ? Optional.of(captureId)
-                    : Optional.empty();
-        } catch (IllegalArgumentException exception) {
-            return Optional.empty();
+            channel = FileChannel.open(entry, StandardOpenOption.WRITE, LinkOption.NOFOLLOW_LINKS);
+        } catch (IOException exception) {
+            return;
         }
-    }
-
-    private static Path ownershipMarker(Path captureRoot) {
-        return captureRoot.resolveSibling(captureRoot.getFileName() + OWNERSHIP_SUFFIX);
-    }
-
-    private static byte[] ownershipMarkerContents(UUID captureId) {
-        return (OWNERSHIP_HEADER + captureId + '\n').getBytes(StandardCharsets.UTF_8);
-    }
-
-    private static FileChannel openOwnershipMarker(Path marker) throws IOException {
-        return FileChannel.open(
-                marker,
-                StandardOpenOption.READ,
-                StandardOpenOption.WRITE,
-                LinkOption.NOFOLLOW_LINKS);
-    }
-
-    private static void requireSafeOwnershipMarker(Path marker, byte[] expected) throws IOException {
-        requireSafeOwnershipMarkerPath(marker, expected.length);
-        try (FileChannel channel = FileChannel.open(
-                marker,
-                StandardOpenOption.READ,
-                LinkOption.NOFOLLOW_LINKS)) {
-            if (!hasExactContents(channel, expected)) {
-                throw new IOException("Capture ownership marker is unsafe");
+        try (channel) {
+            if (!tryLock(channel)) {
+                return;
             }
+            deleteTree(root.resolve(entryOwner));
+            // Delete the lock file while holding it, so no instance sees a half-removed owner.
+            Files.deleteIfExists(entry);
         }
     }
 
-    private static void requireSafeOwnershipMarkerPath(Path marker, int expectedSize)
-            throws IOException {
-        BasicFileAttributes attributes = Files.readAttributes(
-                marker,
-                BasicFileAttributes.class,
-                LinkOption.NOFOLLOW_LINKS);
-        if (!FileSystemSafety.isOrdinaryRegularFile(marker, attributes)
-                || attributes.size() != expectedSize) {
-            throw new IOException("Capture ownership marker is unsafe");
-        }
-    }
-
-    private static boolean hasExactContents(FileChannel channel, byte[] expected) throws IOException {
-        if (channel.size() != expected.length) {
+    /** False when another process holds the lock, or when it cannot be taken at all. */
+    private static boolean tryLock(FileChannel channel) {
+        try {
+            return channel.tryLock() != null;
+        } catch (IOException | OverlappingFileLockException exception) {
             return false;
         }
-        channel.position(0);
-        ByteBuffer contents = ByteBuffer.allocate(expected.length);
-        while (contents.hasRemaining()) {
-            if (channel.read(contents) < 0) {
-                return false;
-            }
-        }
-        return Arrays.equals(contents.array(), expected);
     }
 
-    private static void deleteOwnershipMarkerIfSafe(Path marker, byte[] expected) {
-        boolean interrupted = Thread.interrupted();
-        try {
-            requireSafeOwnershipMarker(marker, expected);
-            Files.deleteIfExists(marker);
-        } catch (IOException ignored) {
-            // A changed or unavailable marker is preserved instead of deleting an uncertain path.
-        } finally {
-            if (interrupted) {
-                Thread.currentThread().interrupt();
+    private synchronized Path ownFolder() throws IOException {
+        if (ownerLock == null) {
+            Files.createDirectories(root);
+            FileChannel channel = FileChannel.open(
+                    root.resolve(owner + LOCK_SUFFIX),
+                    StandardOpenOption.CREATE_NEW,
+                    StandardOpenOption.WRITE);
+            try {
+                channel.lock();
+            } catch (IOException | RuntimeException exception) {
+                channel.close();
+                throw exception;
             }
+            LOCAL_OWNERS.add(owner);
+            ownerLock = channel;
         }
+        // Created again if someone deleted it while the game ran.
+        return Files.createDirectories(root.resolve(owner));
     }
 
-    private static void requireSafeDirectory(Path path, String message) throws IOException {
-        BasicFileAttributes attributes = Files.readAttributes(
-                path,
-                BasicFileAttributes.class,
-                LinkOption.NOFOLLOW_LINKS);
-        if (!FileSystemSafety.isOrdinaryDirectory(path, attributes)) {
-            throw new IOException(message);
-        }
-    }
-
-    private static void deleteTree(Path root) throws IOException {
-        if (isAbsent(root)) {
-            return;
-        }
-        requireSafeCaptureTree(root);
-        IOException failure = null;
-        try (Stream<Path> paths = Files.walk(root)) {
-            List<Path> capturedPaths = paths.toList();
-            for (Path path : capturedPaths) {
-                try {
-                    makeWritable(path);
-                } catch (IOException exception) {
-                    failure = accumulate(failure, exception);
-                }
-            }
-            for (Path path : capturedPaths.stream().sorted(Comparator.reverseOrder()).toList()) {
-                try {
-                    Files.deleteIfExists(path);
-                } catch (IOException exception) {
-                    failure = accumulate(failure, exception);
-                }
-            }
-        }
-        if (failure != null) {
-            throw failure;
+    private void requireOutside(Path world) throws IOException {
+        Path normalized = world.toAbsolutePath().normalize();
+        if (normalized.startsWith(root) || root.startsWith(normalized)) {
+            throw overlap();
         }
-    }
-
-    private static IOException accumulate(IOException failure, IOException addition) {
-        if (failure == null) {
-            return addition;
+        Files.createDirectories(root);
+        Path realWorld = world.toRealPath();
+        Path realRoot = root.toRealPath();
+        if (realWorld.startsWith(realRoot) || realRoot.startsWith(realWorld)) {
+            throw overlap();
         }
-        failure.addSuppressed(addition);
-        return failure;
     }
 
-    private static boolean isAbsent(Path path) throws IOException {
-        try {
-            Files.readAttributes(path, BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
-            return false;
-        } catch (NoSuchFileException exception) {
-            return true;
-        }
+    private IOException overlap() {
+        return new IOException("The capture folder " + root + " overlaps the world folder, so the world "
+                + "cannot be copied safely. Keep the WorldArchive folder outside the saves folder.");
     }
 
-    private static void requireSafeCaptureTree(Path root) throws IOException {
-        requireSafeDirectory(root, "Private capture is not a safe directory");
-        Files.walkFileTree(root, new SimpleFileVisitor<>() {
+    /**
+     * Deletes a folder tree without following links: a symbolic link or junction inside it is
+     * removed itself, never its target. A missing tree is already deleted.
+     */
+    static void deleteTree(Path tree) throws IOException {
+        Files.walkFileTree(tree, new SimpleFileVisitor<>() {
             @Override
             public FileVisitResult preVisitDirectory(Path directory, BasicFileAttributes attributes)
                     throws IOException {
-                requireSafeDirectory(directory, "Private capture contains an unsafe directory");
+                if (attributes.isOther()) {
+                    delete(directory);
+                    return FileVisitResult.SKIP_SUBTREE;
+                }
                 return FileVisitResult.CONTINUE;
             }
 
             @Override
-            public FileVisitResult visitFile(Path file, BasicFileAttributes attributes)
-                    throws IOException {
-                if (!FileSystemSafety.isOrdinaryRegularFile(file, attributes)) {
-                    throw new IOException("Private capture contains an unsafe file");
-                }
+            public FileVisitResult visitFile(Path file, BasicFileAttributes attributes) throws IOException {
+                delete(file);
                 return FileVisitResult.CONTINUE;
             }
 
             @Override
-            public FileVisitResult visitFileFailed(Path file, IOException exception)
-                    throws IOException {
-                throw new IOException("Private capture could not be inspected safely", exception);
+            public FileVisitResult visitFileFailed(Path file, IOException failure) throws IOException {
+                if (failure instanceof NoSuchFileException) {
+                    return FileVisitResult.CONTINUE;
+                }
+                throw failure;
             }
 
             @Override
-            public FileVisitResult postVisitDirectory(Path directory, IOException exception)
-                    throws IOException {
-                if (exception != null) {
-                    throw new IOException("Private capture could not be inspected safely", exception);
+            public FileVisitResult postVisitDirectory(Path directory, IOException failure) throws IOException {
+                if (failure != null) {
+                    throw failure;
                 }
+                delete(directory);
                 return FileVisitResult.CONTINUE;
             }
         });
     }
 
-    private static void makeReadOnly(Path root) throws IOException {
-        try (Stream<Path> paths = Files.walk(root)) {
-            for (Path path : paths.sorted(Comparator.reverseOrder()).toList()) {
-                PosixFileAttributeView posix = Files.getFileAttributeView(
-                        path,
-                        PosixFileAttributeView.class,
-                        LinkOption.NOFOLLOW_LINKS);
-                if (posix != null) {
-                    posix.setPermissions(Files.isDirectory(path, LinkOption.NOFOLLOW_LINKS)
-                            ? EnumSet.of(
-                                    PosixFilePermission.OWNER_READ,
-                                    PosixFilePermission.OWNER_EXECUTE)
-                            : EnumSet.of(PosixFilePermission.OWNER_READ));
-                } else {
-                    DosFileAttributeView dos = Files.getFileAttributeView(
-                            path,
-                            DosFileAttributeView.class,
-                            LinkOption.NOFOLLOW_LINKS);
-                    if (dos != null) {
-                        dos.setReadOnly(true);
-                    }
-                }
-            }
+    /** Deletes one entry. A capture left by WorldArchive 0.3.9 is read-only, so it is made writable first. */
+    private static void delete(Path path) throws IOException {
+        try {
+            Files.deleteIfExists(path);
+        } catch (AccessDeniedException exception) {
+            makeWritable(path.getParent());
+            makeWritable(path);
+            Files.deleteIfExists(path);
         }
     }
 
     private static void makeWritable(Path path) throws IOException {
         PosixFileAttributeView posix = Files.getFileAttributeView(
-                path,
-                PosixFileAttributeView.class,
-                LinkOption.NOFOLLOW_LINKS);
+                path, PosixFileAttributeView.class, LinkOption.NOFOLLOW_LINKS);
         if (posix != null) {
-            posix.setPermissions(Files.isDirectory(path, LinkOption.NOFOLLOW_LINKS)
-                    ? EnumSet.of(
-                            PosixFilePermission.OWNER_READ,
-                            PosixFilePermission.OWNER_WRITE,
-                            PosixFilePermission.OWNER_EXECUTE)
-                    : EnumSet.of(
-                            PosixFilePermission.OWNER_READ,
-                            PosixFilePermission.OWNER_WRITE));
-        } else {
-            DosFileAttributeView dos = Files.getFileAttributeView(
-                    path,
-                    DosFileAttributeView.class,
-                    LinkOption.NOFOLLOW_LINKS);
-            if (dos != null) {
-                dos.setReadOnly(false);
-            }
-        }
-    }
-
-    static final class Lease implements AutoCloseable {
-        private static final int MAXIMUM_CREATE_ATTEMPTS = 16;
-
-        private final Path captureRoot;
-
-        private final Path marker;
-
-        private final byte[] markerContents;
-
-        private final FileChannel markerChannel;
-
-        private final FileLock markerLock;
-
-        private boolean closed;
-
-        private Lease(
-                Path captureRoot,
-                Path marker,
-                byte[] markerContents,
-                FileChannel markerChannel,
-                FileLock markerLock) {
-            this.captureRoot = captureRoot;
-            this.marker = marker;
-            this.markerContents = markerContents;
-            this.markerChannel = markerChannel;
-            this.markerLock = markerLock;
-        }
-
-        private static Lease create(Path captureDirectory) throws IOException {
-            for (int attempt = 0; attempt < MAXIMUM_CREATE_ATTEMPTS; attempt++) {
-                UUID captureId = UUID.randomUUID();
-                Path captureRoot = captureDirectory.resolve(CAPTURE_PREFIX + captureId);
-                Path marker = ownershipMarker(captureRoot);
-                byte[] markerContents = ownershipMarkerContents(captureId);
-                try {
-                    Files.createDirectory(captureRoot);
-                } catch (FileAlreadyExistsException exception) {
-                    continue;
-                }
-                FileChannel channel;
-                try {
-                    channel = FileChannel.open(
-                            marker,
-                            StandardOpenOption.CREATE_NEW,
-                            StandardOpenOption.READ,
-                            StandardOpenOption.WRITE,
-                            LinkOption.NOFOLLOW_LINKS);
-                } catch (FileAlreadyExistsException exception) {
-                    deleteFreshCapture(captureRoot, exception);
-                    if (exception.getSuppressed().length > 0) {
-                        throw exception;
-                    }
-                    continue;
-                } catch (IOException | RuntimeException | Error failure) {
-                    deleteFreshCapture(captureRoot, failure);
-                    throw failure;
-                }
-                FileLock lock = null;
-                try {
-                    lock = channel.lock();
-                    writeMarker(channel, markerContents);
-                    return new Lease(captureRoot, marker, markerContents, channel, lock);
-                } catch (IOException | RuntimeException | Error failure) {
-                    closeControlFile(lock, channel, failure);
-                    deleteOwnershipMarkerIfSafe(marker, markerContents);
-                    deleteFreshCapture(captureRoot, failure);
-                    throw failure;
-                }
-            }
-            throw new IOException("Could not allocate a unique private capture directory");
-        }
-
-        private static void deleteFreshCapture(Path captureRoot, Throwable failure) {
-            try {
-                Files.deleteIfExists(captureRoot);
-            } catch (IOException cleanupFailure) {
-                failure.addSuppressed(cleanupFailure);
-            }
-        }
-
-        private static void writeMarker(FileChannel channel, byte[] contents) throws IOException {
-            channel.position(0);
-            ByteBuffer buffer = ByteBuffer.wrap(contents);
-            while (buffer.hasRemaining()) {
-                channel.write(buffer);
-            }
-            channel.force(true);
-        }
-
-        Path path() {
-            return captureRoot;
+            posix.setPermissions(EnumSet.of(
+                    PosixFilePermission.OWNER_READ,
+                    PosixFilePermission.OWNER_WRITE,
+                    PosixFilePermission.OWNER_EXECUTE));
+            return;
         }
-
-        void seal() throws IOException {
-            makeReadOnly(captureRoot);
+        DosFileAttributeView dos = Files.getFileAttributeView(
+                path, DosFileAttributeView.class, LinkOption.NOFOLLOW_LINKS);
+        if (dos != null) {
+            dos.setReadOnly(false);
         }
+    }
 
+    /** One private capture folder; closing the lease deletes the folder, and closing again does nothing. */
+    record Lease(Path path) implements AutoCloseable {
         @Override
-        public synchronized void close() throws IOException {
-            if (closed) {
-                return;
-            }
-            closed = true;
-            IOException failure = null;
-            boolean deleted = false;
-            try {
-                deleteTree(captureRoot);
-                deleted = isAbsent(captureRoot);
-            } catch (IOException exception) {
-                failure = exception;
-            }
-            failure = closeControlFile(markerLock, markerChannel, failure);
-            if (deleted) {
-                deleteOwnershipMarkerIfSafe(marker, markerContents);
-            }
-            if (failure != null) {
-                throw failure;
-            }
+        public void close() throws IOException {
+            deleteTree(path);
         }
 
         void closeAfterFailure(Throwable failure) {
@@ -507,33 +253,5 @@ void closeAfterFailure(Throwable failure) {
                 failure.addSuppressed(cleanupFailure);
             }
         }
-
-        private static IOException closeControlFile(
-                FileLock lock,
-                FileChannel channel,
-                Throwable priorFailure) {
-            IOException failure = priorFailure instanceof IOException exception ? exception : null;
-            if (lock != null && lock.isValid()) {
-                try {
-                    lock.release();
-                } catch (IOException exception) {
-                    failure = accumulate(failure, exception);
-                    if (priorFailure != null && priorFailure != failure) {
-                        priorFailure.addSuppressed(exception);
-                    }
-                }
-            }
-            if (channel.isOpen()) {
-                try {
-                    channel.close();
-                } catch (IOException exception) {
-                    failure = accumulate(failure, exception);
-                    if (priorFailure != null && priorFailure != failure) {
-                        priorFailure.addSuppressed(exception);
-                    }
-                }
-            }
-            return failure;
-        }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/CapturedBackup.java b/src/main/java/dev/ishaanko/worldarchive/core/CapturedBackup.java
index 05cf2c3..6fd3cef 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/CapturedBackup.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/CapturedBackup.java
@@ -8,18 +8,12 @@
 public final class CapturedBackup implements AutoCloseable {
     private final BackupCapture capture;
 
-    private final WorldInventory inventory;
-
     private final CloseAction closeAction;
 
     private final AtomicBoolean closed = new AtomicBoolean();
 
-    CapturedBackup(
-            BackupCapture capture,
-            WorldInventory inventory,
-            CloseAction closeAction) {
+    CapturedBackup(BackupCapture capture, CloseAction closeAction) {
         this.capture = Objects.requireNonNull(capture, "capture");
-        this.inventory = Objects.requireNonNull(inventory, "inventory");
         this.closeAction = Objects.requireNonNull(closeAction, "closeAction");
     }
 
@@ -30,10 +24,6 @@ public BackupCapture capture() {
         return capture;
     }
 
-    public WorldInventory inventory() {
-        return inventory;
-    }
-
     @Override
     public void close() throws IOException {
         if (closed.compareAndSet(false, true)) {
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/ConfiguredBackupDestinationSelector.java b/src/main/java/dev/ishaanko/worldarchive/core/ConfiguredBackupDestinationSelector.java
index a500411..d9dac91 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/ConfiguredBackupDestinationSelector.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/ConfiguredBackupDestinationSelector.java
@@ -1,19 +1,20 @@
 package dev.ishaanko.worldarchive.core;
 
+import dev.ishaanko.worldarchive.config.DestinationTriggerConfig;
 import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
-import dev.ishaanko.worldarchive.config.TriggerConfig;
 import dev.ishaanko.worldarchive.config.WorldConfig;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
 import dev.ishaanko.worldarchive.model.DestinationType;
 import java.util.ArrayList;
 import java.util.EnumMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
-import java.util.Optional;
 import java.util.function.Supplier;
 
-/** Applies current global, per-world, destination, and trigger gates to registered backends. */
+/**
+ * Picks the registered destinations that the current settings allow for a request: the trigger
+ * must be on globally and for the destination, and the world must not be turned off.
+ */
 public final class ConfiguredBackupDestinationSelector implements BackupDestinationSelector {
     private final Supplier<WorldArchiveConfig> configuration;
 
@@ -23,10 +24,8 @@ public ConfiguredBackupDestinationSelector(
             Supplier<WorldArchiveConfig> configuration,
             List<BackupBackend> backends) {
         this.configuration = Objects.requireNonNull(configuration, "configuration");
-        Objects.requireNonNull(backends, "backends");
         EnumMap<DestinationType, BackupBackend> registered = new EnumMap<>(DestinationType.class);
         for (BackupBackend backend : backends) {
-            Objects.requireNonNull(backend, "backend");
             if (registered.putIfAbsent(backend.destinationType(), backend) != null) {
                 throw new IllegalArgumentException("Each backup destination may be registered only once");
             }
@@ -34,43 +33,45 @@ public ConfiguredBackupDestinationSelector(
         this.backends = Map.copyOf(registered);
     }
 
+    /**
+     * The destinations to write, in type order.
+     *
+     * @throws IllegalArgumentException when the settings bind this world's identity to another folder
+     */
     @Override
     public List<BackupBackend> select(CreateBackupRequest request) {
-        Objects.requireNonNull(request, "request");
         WorldArchiveConfig config = Objects.requireNonNull(configuration.get(), "configuration result");
-        Optional<WorldConfig> configuredWorld = config.worlds().stream()
-                        .filter(world -> world.worldId().equals(request.worldId()))
-                        .findFirst();
-        if (configuredWorld.isPresent()
-                && !configuredWorld.orElseThrow().path().equals(request.worldDirectory())) {
-            throw new IllegalArgumentException(
-                    "World identity is configured for a different source folder");
-        }
-        if (!globallyEnabled(config.triggers(), request.trigger())
-                || configuredWorld.map(world -> !world.enabled()).orElse(false)) {
+        if (!worldEnabled(config, request) || !config.triggers().enabledFor(request.trigger())) {
             return List.of();
         }
-        List<BackupBackend> selected = new ArrayList<>(DestinationType.values().length);
-        BackupBackend git = backends.get(DestinationType.GIT);
-        if (git != null
-                && config.git().enabled()
-                && config.git().triggers().enabledFor(request.trigger())) {
-            selected.add(git);
-        }
-        BackupBackend zip = backends.get(DestinationType.ZIP);
-        if (zip != null
-                && config.zip().enabled()
-                && config.zip().triggers().enabledFor(request.trigger())) {
-            selected.add(zip);
-        }
+        List<BackupBackend> selected = new ArrayList<>(backends.size());
+        addIfEnabled(selected, DestinationType.GIT, config.git().enabled(), config.git().triggers(), request);
+        addIfEnabled(selected, DestinationType.ZIP, config.zip().enabled(), config.zip().triggers(), request);
         return List.copyOf(selected);
     }
 
-    private static boolean globallyEnabled(TriggerConfig config, BackupTrigger trigger) {
-        return switch (trigger) {
-            case MANUAL -> config.manualEnabled();
-            case WORLD_EXIT -> config.worldExitEnabled();
-            case SCHEDULED -> config.scheduledEnabled();
-        };
+    private void addIfEnabled(
+            List<BackupBackend> selected,
+            DestinationType destination,
+            boolean enabled,
+            DestinationTriggerConfig triggers,
+            CreateBackupRequest request) {
+        BackupBackend backend = backends.get(destination);
+        if (backend != null && enabled && triggers.enabledFor(request.trigger())) {
+            selected.add(backend);
+        }
+    }
+
+    private static boolean worldEnabled(WorldArchiveConfig config, CreateBackupRequest request) {
+        for (WorldConfig world : config.worlds()) {
+            if (world.worldId().equals(request.worldId())) {
+                if (!world.path().equals(request.worldDirectory())) {
+                    throw new IllegalArgumentException(
+                            "World identity is configured for a different source folder");
+                }
+                return world.enabled();
+            }
+        }
+        return true;
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/ConfirmationLedger.java b/src/main/java/dev/ishaanko/worldarchive/core/ConfirmationLedger.java
index 6688c95..4f0f4e5 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/ConfirmationLedger.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/ConfirmationLedger.java
@@ -8,15 +8,11 @@
 import java.util.concurrent.ConcurrentMap;
 import java.util.function.Function;
 import java.util.function.Predicate;
-import java.util.function.Supplier;
 
 /**
- * Thread-safe store of short-lived, one-time confirmation entries keyed by {@code K}.
- *
- * <p>Supports both a token-keyed usage (the key itself is the confirmation token, minted by
- * {@link #putUnique}) and an entity-keyed usage with eviction (the key is a domain entity such
- * as a world, and issuing a new entry for that key replaces any previous one via {@link #put}).
- * Either way, {@link #claim} and {@link #claimMatching} remove an entry at most once.
+ * Thread-safe store of short-lived, one-time confirmations, one per key: a new entry for a key
+ * replaces the previous one, and {@link #claimMatching} removes an entry at most once. The cleanup
+ * preview keeps its plans here, one per world.
  */
 public final class ConfirmationLedger<K, V> {
     private final ConcurrentMap<K, V> entries = new ConcurrentHashMap<>();
@@ -42,25 +38,6 @@ public void put(K key, V value) {
         entries.put(Objects.requireNonNull(key, "key"), Objects.requireNonNull(value, "value"));
     }
 
-    /**
-     * Generates keys via {@code keyGenerator} and builds a value for each candidate until one
-     * is inserted without colliding with an existing entry.
-     */
-    public Issued<K, V> putUnique(Supplier<K> keyGenerator, Function<K, V> valueFactory) {
-        K key;
-        V value;
-        do {
-            key = Objects.requireNonNull(keyGenerator.get(), "generated key");
-            value = Objects.requireNonNull(valueFactory.apply(key), "generated value");
-        } while (entries.putIfAbsent(key, value) != null);
-        return new Issued<>(key, value);
-    }
-
-    /** Removes and returns the entry at {@code key}, if any, regardless of its expiry. */
-    public Optional<V> claim(K key) {
-        return Optional.ofNullable(entries.remove(key));
-    }
-
     /**
      * Expires stale entries as of {@code now}, then removes and returns the first remaining
      * entry whose value satisfies {@code matcher}.
@@ -75,12 +52,4 @@ public Optional<V> claimMatching(Instant now, Predicate<V> matcher) {
         }
         return Optional.empty();
     }
-
-    /** A freshly minted key/value pair returned by {@link #putUnique}. */
-    public record Issued<K, V>(K key, V value) {
-        public Issued {
-            Objects.requireNonNull(key, "key");
-            Objects.requireNonNull(value, "value");
-        }
-    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/CreateBackupRequest.java b/src/main/java/dev/ishaanko/worldarchive/core/CreateBackupRequest.java
index bddb6a5..4a2a0a6 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/CreateBackupRequest.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/CreateBackupRequest.java
@@ -1,13 +1,14 @@
 package dev.ishaanko.worldarchive.core;
 
+import dev.ishaanko.worldarchive.model.BackupManifest;
 import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
+import dev.ishaanko.worldarchive.model.SafeText;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.nio.file.Path;
 import java.util.Objects;
 import java.util.Optional;
 
-/** A request to capture the current durable state of a world. */
+/** A request to capture the current durable state of a world; the label is kept exactly as typed. */
 public record CreateBackupRequest(
         WorldId worldId,
         Path worldDirectory,
@@ -19,29 +20,9 @@ public record CreateBackupRequest(
         worldDirectory = Objects.requireNonNull(worldDirectory, "worldDirectory")
                 .toAbsolutePath()
                 .normalize();
-        worldName = requireText(worldName, "worldName", 255);
+        worldName = SafeText.require(worldName, "worldName", 255);
         label = Objects.requireNonNull(label, "label")
-                .map(SensitiveDataRedactor::redact)
-                .map(value -> requireText(value, "label", 128));
+                .map(value -> SafeText.require(value, "label", BackupManifest.MAXIMUM_LABEL_LENGTH));
         Objects.requireNonNull(trigger, "trigger");
     }
-
-    /** Compatibility constructor for unlabeled backup requests. */
-    public CreateBackupRequest(
-            WorldId worldId,
-            Path worldDirectory,
-            String worldName,
-            BackupTrigger trigger) {
-        this(worldId, worldDirectory, worldName, Optional.empty(), trigger);
-    }
-
-    private static String requireText(String value, String name, int maximumLength) {
-        Objects.requireNonNull(value, name);
-        if (value.isBlank()
-                || value.length() > maximumLength
-                || value.chars().anyMatch(character -> Character.isISOControl(character))) {
-            throw new IllegalArgumentException(name + " is blank, too long, or contains control characters");
-        }
-        return value;
-    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/DeleteBackupRequest.java b/src/main/java/dev/ishaanko/worldarchive/core/DeleteBackupRequest.java
index e7f5929..df767d2 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/DeleteBackupRequest.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/DeleteBackupRequest.java
@@ -1,12 +1,23 @@
 package dev.ishaanko.worldarchive.core;
 
 import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.WorldId;
+import java.util.List;
 import java.util.Objects;
 
-/** A deletion request carrying the exact confirmation token returned by prepareDelete. */
-public record DeleteBackupRequest(BackupId backupId, OperationId confirmationToken) {
+/**
+ * A delete the player confirmed: the backup, its world, and the copies the player saw listed for
+ * it. The delete goes ahead only while the backup list still names exactly these copies, checked
+ * inside the world's gate; a backup that changed in the meantime is left alone.
+ */
+public record DeleteBackupRequest(WorldId worldId, BackupId backupId, List<DestinationResult> copies) {
     public DeleteBackupRequest {
+        Objects.requireNonNull(worldId, "worldId");
         Objects.requireNonNull(backupId, "backupId");
-        Objects.requireNonNull(confirmationToken, "confirmationToken");
+        copies = List.copyOf(copies);
+        if (copies.stream().noneMatch(DestinationResult::isDurable)) {
+            throw new IllegalArgumentException("A delete must name at least one copy of the backup");
+        }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/DeletePreparation.java b/src/main/java/dev/ishaanko/worldarchive/core/DeletePreparation.java
deleted file mode 100644
index 28d5c1b..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/core/DeletePreparation.java
+++ /dev/null
@@ -1,25 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
-import java.time.Instant;
-import java.util.Objects;
-
-/** Short-lived confirmation issued before an explicit destructive delete. */
-public record DeletePreparation(
-        BackupId backupId,
-        OperationId confirmationToken,
-        String description,
-        Instant expiresAt) {
-    public DeletePreparation {
-        Objects.requireNonNull(backupId, "backupId");
-        Objects.requireNonNull(confirmationToken, "confirmationToken");
-        description = SensitiveDataRedactor.redact(Objects.requireNonNull(description, "description"));
-        if (description.isBlank()
-                || description.length() > 512
-                || description.chars().anyMatch(character -> Character.isISOControl(character))) {
-            throw new IllegalArgumentException("Delete description is blank, too long, or unsafe");
-        }
-        Objects.requireNonNull(expiresAt, "expiresAt");
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/DestinationPlan.java b/src/main/java/dev/ishaanko/worldarchive/core/DestinationPlan.java
deleted file mode 100644
index 9677ad5..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/core/DestinationPlan.java
+++ /dev/null
@@ -1,21 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import dev.ishaanko.worldarchive.model.DestinationType;
-import java.util.EnumSet;
-import java.util.List;
-import java.util.Objects;
-import java.util.Set;
-
-/** Resolved, deduplicated set of destinations selected for one create operation. */
-record DestinationPlan(List<BackupBackend> backends) {
-    DestinationPlan {
-        backends = List.copyOf(Objects.requireNonNull(backends, "backends"));
-        Set<DestinationType> destinations = EnumSet.noneOf(DestinationType.class);
-        for (BackupBackend backend : backends) {
-            Objects.requireNonNull(backend, "backend");
-            if (!destinations.add(backend.destinationType())) {
-                throw new IllegalArgumentException("Each destination may be selected only once");
-            }
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/DestinationProgressAggregator.java b/src/main/java/dev/ishaanko/worldarchive/core/DestinationProgressAggregator.java
index 4b1d7dd..20cb416 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/DestinationProgressAggregator.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/DestinationProgressAggregator.java
@@ -1,6 +1,8 @@
 package dev.ishaanko.worldarchive.core;
 
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.OperationPhase;
+import dev.ishaanko.worldarchive.model.OperationProgress;
 import java.util.Collection;
 import java.util.Map;
 import java.util.Objects;
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/DirectoryIdentityMarker.java b/src/main/java/dev/ishaanko/worldarchive/core/DirectoryIdentityMarker.java
deleted file mode 100644
index 9932928..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/core/DirectoryIdentityMarker.java
+++ /dev/null
@@ -1,81 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import java.io.IOException;
-import java.nio.ByteBuffer;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.nio.file.attribute.UserDefinedFileAttributeView;
-import java.util.Objects;
-import java.util.Optional;
-import java.util.UUID;
-
-/** Random filesystem metadata that supplements platform directory identity when supported. */
-public final class DirectoryIdentityMarker {
-    private static final String ATTRIBUTE = "worldarchive.restore-identity";
-
-    private static final int MAXIMUM_MARKER_BYTES = 128;
-
-    private DirectoryIdentityMarker() {
-    }
-
-    /** Preserves an existing marker or creates and verifies one when supported. */
-    public static Optional<String> create(Path directory) throws IOException {
-        UserDefinedFileAttributeView view = view(directory);
-        if (view == null) {
-            return Optional.empty();
-        }
-        Optional<String> existing = read(view);
-        if (existing.isPresent()) {
-            return existing;
-        }
-        String marker = UUID.randomUUID().toString();
-        try {
-            view.write(ATTRIBUTE, StandardCharsets.UTF_8.encode(marker));
-        } catch (IOException | UnsupportedOperationException exception) {
-            // The store reports xattr support per filesystem type; exFAT, SMB, and synced
-            // folders can still refuse the write, and the marker is only a supplement.
-            return Optional.empty();
-        }
-        if (!Optional.of(marker).equals(read(view))) {
-            throw new IOException("Private restore directory identity marker could not be verified");
-        }
-        return Optional.of(marker);
-    }
-
-    /** Reads the marker without following the directory pathname itself. */
-    public static Optional<String> read(Path directory) throws IOException {
-        UserDefinedFileAttributeView view = view(directory);
-        return view == null ? Optional.empty() : read(view);
-    }
-
-    private static Optional<String> read(UserDefinedFileAttributeView view) throws IOException {
-        if (!view.list().contains(ATTRIBUTE)) {
-            return Optional.empty();
-        }
-        int size = view.size(ATTRIBUTE);
-        if (size < 1 || size > MAXIMUM_MARKER_BYTES) {
-            throw new IOException("Private restore directory identity marker is invalid");
-        }
-        ByteBuffer encoded = ByteBuffer.allocate(size);
-        int read = view.read(ATTRIBUTE, encoded);
-        if (read != size) {
-            throw new IOException("Private restore directory identity marker changed while reading");
-        }
-        encoded.flip();
-        return Optional.of(StandardCharsets.UTF_8.decode(encoded).toString());
-    }
-
-    private static UserDefinedFileAttributeView view(Path directory) throws IOException {
-        Path required = Objects.requireNonNull(directory, "directory");
-        if (!Files.getFileStore(required)
-                .supportsFileAttributeView(UserDefinedFileAttributeView.class)) {
-            return null;
-        }
-        return Files.getFileAttributeView(
-                required,
-                UserDefinedFileAttributeView.class,
-                LinkOption.NOFOLLOW_LINKS);
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/FileSystemBackupCaptureFactory.java b/src/main/java/dev/ishaanko/worldarchive/core/FileSystemBackupCaptureFactory.java
index 84925e5..91dc260 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/FileSystemBackupCaptureFactory.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/FileSystemBackupCaptureFactory.java
@@ -1,124 +1,101 @@
 package dev.ishaanko.worldarchive.core;
 
+import dev.ishaanko.worldarchive.core.WorldTree.FileState;
+import dev.ishaanko.worldarchive.core.WorldTree.Folder;
+import dev.ishaanko.worldarchive.core.WorldTree.SourceFile;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.CaptureProgressListener;
 import dev.ishaanko.worldarchive.model.GameVersionStamp;
+import dev.ishaanko.worldarchive.support.Digests;
+import dev.ishaanko.worldarchive.support.Observers;
+import dev.ishaanko.worldarchive.support.PortablePath;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InterruptedIOException;
 import java.io.OutputStream;
-import java.nio.file.FileVisitResult;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
+import java.nio.file.NoSuchFileException;
 import java.nio.file.Path;
-import java.nio.file.SimpleFileVisitor;
 import java.nio.file.StandardOpenOption;
-import java.nio.file.attribute.BasicFileAttributes;
 import java.nio.file.attribute.FileTime;
 import java.security.MessageDigest;
+import java.time.DateTimeException;
+import java.time.Duration;
 import java.time.Instant;
-import java.util.ArrayList;
 import java.util.Comparator;
-import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
-
-/** Copies a stable world view into private outside-world staging. */
-public final class FileSystemBackupCaptureFactory implements BackupCaptureFactory {
-    // A live world can write a handful of small files (player data, level.dat,
-    // POI data) even while chunk autosaving is paused. A capture that observed a
-    // change starts over; the writes are rare, so a retry almost always succeeds.
-    private static final int MAXIMUM_CAPTURE_ATTEMPTS = 3;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * Copies a world into a private folder outside it and proves the copy matches the world. A live
+ * world can still write a few files while autosave is paused, so a capture that sees a change
+ * tries again, up to three times, and then throws {@link CaptureChangedException}. A retry keeps
+ * every copy whose file did not change.
+ *
+ * <p>Each file is read once while it is copied and hashed, and checked again afterwards. A
+ * capture of the open world reads and hashes every file a second time, because the game can still
+ * write one within a single timestamp tick. A capture of a closed world checks each file with a
+ * direct stat and reads it a second time only when its state changed, or when its time is within
+ * ten seconds of the newest file's or of the clock when the file was copied, or later: timestamps
+ * are coarse, so only an older file is certain to show a later write in its timestamp. Up to four
+ * workers copy and check files at once.</p>
+ */
+public final class FileSystemBackupCaptureFactory {
+    private static final int MAXIMUM_ATTEMPTS = 3;
+
+    private static final Duration RECENT = Duration.ofSeconds(10);
+
+    private static final int WORKERS = Math.min(4, Runtime.getRuntime().availableProcessors());
 
     private final CaptureWorkspace workspace;
 
-    private final SourceCaptureObserver observer;
-
     private final Optional<GameVersionStamp> gameVersion;
 
-    public FileSystemBackupCaptureFactory(Path captureDirectory) {
-        this(captureDirectory, SourceCaptureObserver.NONE);
-    }
+    private final SourceCaptureObserver observer;
 
+    /**
+     * Captures go below {@code captureDirectory}, which must be outside every world. Each manifest
+     * records {@code gameVersion}, the version of the running game when it is known. Production
+     * passes {@link SourceCaptureObserver#NONE}; tests use the observer to change a world mid-copy.
+     */
     public FileSystemBackupCaptureFactory(
             Path captureDirectory,
+            Optional<GameVersionStamp> gameVersion,
             SourceCaptureObserver observer) {
-        this(captureDirectory, observer, Optional.empty());
-    }
-
-    public FileSystemBackupCaptureFactory(
-            Path captureDirectory,
-            Optional<GameVersionStamp> gameVersion) {
-        this(captureDirectory, SourceCaptureObserver.NONE, gameVersion);
-    }
-
-    public FileSystemBackupCaptureFactory(
-            Path captureDirectory,
-            SourceCaptureObserver observer,
-            Optional<GameVersionStamp> gameVersion) {
         this.workspace = new CaptureWorkspace(captureDirectory);
-        this.observer = Objects.requireNonNull(observer, "observer");
         this.gameVersion = Objects.requireNonNull(gameVersion, "gameVersion");
+        this.observer = Objects.requireNonNull(observer, "observer");
     }
 
-    @Override
+    /**
+     * Copies the world of {@code request} and returns the private copy, which the caller closes.
+     * {@code kind} says whether the game may still write the world. Interrupting the calling
+     * thread stops the copy and deletes it.
+     */
     public CapturedBackup capture(
             CreateBackupRequest request,
+            CaptureKind kind,
             BackupId backupId,
             Instant createdAt,
             Optional<WorldInventory> previousInventory,
             CaptureProgressListener progressListener)
             throws IOException, InterruptedException {
-        Objects.requireNonNull(request, "request");
+        Objects.requireNonNull(kind, "kind");
         Objects.requireNonNull(backupId, "backupId");
         Objects.requireNonNull(createdAt, "createdAt");
         Objects.requireNonNull(previousInventory, "previousInventory");
         Objects.requireNonNull(progressListener, "progressListener");
-        SourceChangedException lastChange = null;
-        for (int attempt = 0; attempt < MAXIMUM_CAPTURE_ATTEMPTS; attempt++) {
-            requireNotInterrupted();
-            try {
-                return captureOnce(
-                        request,
-                        backupId,
-                        createdAt,
-                        previousInventory,
-                        progressListener);
-            } catch (SourceChangedException exception) {
-                lastChange = exception;
-            }
-        }
-        throw lastChange;
-    }
-
-    private CapturedBackup captureOnce(
-            CreateBackupRequest request,
-            BackupId backupId,
-            Instant createdAt,
-            Optional<WorldInventory> previousInventory,
-            CaptureProgressListener progressListener)
-            throws IOException, InterruptedException {
-        Path source = request.worldDirectory();
-        CaptureWorkspace.Lease lease = workspace.open(source);
-        Path staging = lease.path();
+        Path world = realWorld(request.worldDirectory());
+        CaptureWorkspace.Lease lease = workspace.open(world);
         try {
-            TreeSnapshot before = TreeSnapshot.scan(source);
-            createDirectories(staging, before.directories());
-            List<WorldInventory.Entry> inventoryEntries = copyFiles(
-                    staging,
-                    before,
-                    progressListener);
-            TreeSnapshot after = TreeSnapshot.scan(source);
-            before.requireStableMatch(after);
-            proveSourceContentMatchesCapture(before, inventoryEntries);
-            WorldInventory inventory = WorldInventory.create(inventoryEntries);
-            long changedFiles = previousInventory
-                    .map(inventory::changedFilesSince)
-                    .orElse(inventory.fileCount());
+            WorldInventory inventory = new Copy(world, kind, lease.path(), progressListener).untilStable();
             BackupManifest manifest = BackupManifest.create(
                     backupId,
                     request.worldId(),
@@ -128,431 +105,242 @@ private CapturedBackup captureOnce(
                     request.trigger(),
                     inventory.fileCount(),
                     inventory.byteCount(),
-                    changedFiles,
+                    previousInventory.map(inventory::changedFilesSince).orElse(inventory.fileCount()),
                     inventory.contentSha256(),
                     inventory.inventorySha256(),
                     gameVersion);
-            lease.seal();
-            return new CapturedBackup(
-                    new BackupCapture(staging, manifest),
-                    inventory,
-                    lease::close);
+            return new CapturedBackup(new BackupCapture(lease.path(), manifest, inventory), lease::close);
         } catch (IOException | InterruptedException | RuntimeException | Error failure) {
             lease.closeAfterFailure(failure);
             throw failure;
         }
     }
 
-    private List<WorldInventory.Entry> copyFiles(
-            Path staging,
-            TreeSnapshot snapshot,
-            CaptureProgressListener progressListener)
-            throws IOException, InterruptedException {
-        List<WorldInventory.Entry> inventory = new ArrayList<>(snapshot.files().size());
-        long completed = 0;
-        safeProgress(progressListener, 0, snapshot.byteCount());
-        for (SourceFile file : snapshot.files()) {
-            requireNotInterrupted();
-            observer.beforeFileCopy(Path.of(file.portablePath()));
-            Path target = PortableWorldPath.resolveInside(staging, file.portablePath());
-            CopyResult copied = copyFile(file.path(), target);
-            observer.afterFileCopy(Path.of(file.portablePath()));
-            if (copied.size() != file.fingerprint().size()) {
-                throw new SourceChangedException(
-                        "World file changed size while it was being captured: "
-                                + file.portablePath());
-            }
-            inventory.add(new WorldInventory.Entry(
-                    file.portablePath(),
-                    copied.size(),
-                    copied.sha256()));
-            completed = Math.addExact(completed, copied.size());
-            safeProgress(progressListener, completed, snapshot.byteCount());
-        }
-        return inventory;
+    /**
+     * Deletes the captures that ended game instances left behind, such as after a crash. The
+     * runtime calls it once at startup on a worker thread; captures of running instances are kept.
+     */
+    public void removeAbandonedCaptures() throws IOException {
+        workspace.removeAbandoned();
     }
 
-    private static void proveSourceContentMatchesCapture(
-            TreeSnapshot snapshot,
-            List<WorldInventory.Entry> inventory)
-            throws IOException {
-        Map<String, WorldInventory.Entry> capturedByPath = new HashMap<>();
-        for (WorldInventory.Entry entry : inventory) {
-            capturedByPath.put(entry.path(), entry);
-        }
-        for (SourceFile file : snapshot.files()) {
-            file.requireStableAttributes();
-            CopyResult current = hashFile(file.path());
-            file.requireStableAttributes();
-            WorldInventory.Entry captured = capturedByPath.get(file.portablePath());
-            if (captured == null
-                    || current.size() != captured.size()
-                    || !current.sha256().equals(captured.sha256())) {
-                throw new SourceChangedException(
-                        "World file contents changed while its private capture was being created: "
-                                + file.portablePath());
-            }
-        }
-    }
-
-    private static void createDirectories(Path staging, List<SourceDirectory> directories)
-            throws IOException {
-        for (SourceDirectory directory : directories) {
-            if (!directory.portablePath().isEmpty()) {
-                Files.createDirectory(PortableWorldPath.resolveInside(
-                        staging,
-                        directory.portablePath()));
-            }
-        }
-    }
-
-    private static CopyResult copyFile(Path source, Path target) throws IOException {
-        try (InputStream input = Files.newInputStream(source, LinkOption.NOFOLLOW_LINKS);
-                OutputStream output = Files.newOutputStream(
-                        target,
-                        StandardOpenOption.CREATE_NEW,
-                        StandardOpenOption.WRITE)) {
-            return copyAndHash(input, output);
-        }
-    }
-
-    private static CopyResult hashFile(Path source) throws IOException {
-        try (InputStream input = Files.newInputStream(source, LinkOption.NOFOLLOW_LINKS)) {
-            return copyAndHash(input, OutputStream.nullOutputStream());
-        }
-    }
-
-    private static CopyResult copyAndHash(InputStream input, OutputStream output) throws IOException {
-        MessageDigest digest = Digests.sha256();
-        byte[] buffer = new byte[Digests.COPY_BUFFER_BYTES];
-        long size = 0;
-        int read;
-        while ((read = input.read(buffer)) >= 0) {
-            requireNotInterrupted();
-            if (read == 0) {
-                continue;
-            }
-            output.write(buffer, 0, read);
-            digest.update(buffer, 0, read);
-            try {
-                size = Math.addExact(size, read);
-            } catch (ArithmeticException exception) {
-                throw new IOException("World file size overflowed capture accounting", exception);
-            }
-            if (size > WorldInventory.MAXIMUM_BYTES) {
-                throw new IOException("World file exceeds the capture size limit");
-            }
-        }
-        return new CopyResult(size, Digests.hex(digest.digest()));
-    }
-
-    private static void safeProgress(
-            CaptureProgressListener listener,
-            long completed,
-            long total) {
+    /** The world folder with links above it resolved; links inside it are still refused. */
+    private static Path realWorld(Path world) throws IOException {
         try {
-            listener.onProgress(completed, total);
-        } catch (RuntimeException ignored) {
-            // Observers cannot invalidate a correctly captured source tree.
+            return world.toRealPath();
+        } catch (NoSuchFileException exception) {
+            throw new IOException("The world folder " + world + " does not exist", exception);
         }
     }
 
-    private static void requireNotInterrupted() throws InterruptedIOException {
-        if (Thread.currentThread().isInterrupted()) {
-            throw new InterruptedIOException("World capture was interrupted");
-        }
-    }
+    /** One capture: the private folder and the copy of each file made so far, kept across attempts. */
+    private final class Copy {
+        private final Path world;
 
-    private static void requireSafeDirectory(Path path, String message) throws IOException {
-        BasicFileAttributes attributes = Files.readAttributes(
-                path,
-                BasicFileAttributes.class,
-                LinkOption.NOFOLLOW_LINKS);
-        if (!FileSystemSafety.isOrdinaryDirectory(path, attributes)) {
-            throw new IOException(message);
-        }
-    }
+        private final CaptureKind kind;
 
-    private static void requireSafeFile(Path path, BasicFileAttributes attributes) throws IOException {
-        if (!FileSystemSafety.isOrdinaryRegularFile(path, attributes)) {
-            throw new IOException("World source contains a link or special file");
-        }
-    }
+        private final Path staging;
 
-    private record TreeSnapshot(
-            List<SourceDirectory> directories,
-            List<SourceFile> files,
-            long byteCount) {
-        private TreeSnapshot {
-            directories = List.copyOf(directories);
-            files = List.copyOf(files);
-            if (byteCount < 0) {
-                throw new IllegalArgumentException("Source snapshot byte count is negative");
-            }
-        }
+        private final CaptureProgressListener listener;
 
-        private static TreeSnapshot scan(Path source) throws IOException {
-            requireNotInterrupted();
-            ScanVisitor visitor = new ScanVisitor(source);
-            Files.walkFileTree(source, visitor);
-            visitor.directories.sort(Comparator
-                    .comparingInt((SourceDirectory value) -> depth(value.portablePath()))
-                    .thenComparing(SourceDirectory::portablePath));
-            visitor.files.sort(Comparator.comparing(SourceFile::portablePath));
-            return new TreeSnapshot(visitor.directories, visitor.files, visitor.byteCount);
-        }
+        private final Map<String, CopiedFile> copies = new ConcurrentHashMap<>();
 
-        private static int depth(String portablePath) {
-            if (portablePath.isEmpty()) {
-                return 0;
-            }
-            return (int) portablePath.chars().filter(character -> character == '/').count() + 1;
+        private final Set<String> stagedFolders = new HashSet<>();
+
+        private Copy(Path world, CaptureKind kind, Path staging, CaptureProgressListener listener) {
+            this.world = world;
+            this.kind = kind;
+            this.staging = staging;
+            this.listener = listener;
         }
 
-        private void requireStableMatch(TreeSnapshot current) throws IOException {
-            if (byteCount != current.byteCount
-                    || !directories.equals(current.directories)
-                    || files.size() != current.files.size()) {
-                throw new SourceChangedException(
-                        "World tree changed while its private capture was being created");
+        private WorldInventory untilStable() throws IOException, InterruptedException {
+            CaptureChangedException lastChange = null;
+            for (int attempt = 0; attempt < MAXIMUM_ATTEMPTS; attempt++) {
+                try {
+                    return attempt();
+                } catch (CaptureChangedException exception) {
+                    lastChange = exception;
+                }
             }
-            for (int index = 0; index < files.size(); index++) {
-                SourceFile expected = files.get(index);
-                SourceFile observed = current.files.get(index);
-                if (!expected.hasSameStableFile(observed)) {
-                    throw new SourceChangedException(
-                            "World tree changed while its private capture was being created");
+            throw lastChange;
+        }
+
+        private WorldInventory attempt() throws IOException, InterruptedException {
+            WorldTree before = WorldTree.scan(world);
+            matchFolders(before);
+            ByteProgress progress = new ByteProgress(listener, before.byteCount());
+            ParallelWork.forEach(before.files(), WORKERS, file -> copyIfStale(file, progress));
+            before.requireUnchanged(WorldTree.scan(world));
+            FileTime newestWindow = recentSince(before.newestModified());
+            ParallelWork.forEach(before.files(), WORKERS, file -> verify(file, newestWindow));
+            return WorldInventory.create(before.files().stream()
+                    .map(file -> copies.get(file.portablePath()).entry(file.portablePath()))
+                    .toList());
+        }
+
+        /** Removes copies of files and folders that the world no longer has, and creates new folders. */
+        private void matchFolders(WorldTree tree) throws IOException {
+            Set<String> files = new HashSet<>();
+            tree.files().forEach(file -> files.add(file.portablePath()));
+            for (String copied : List.copyOf(copies.keySet())) {
+                if (!files.contains(copied)) {
+                    Files.deleteIfExists(PortablePath.resolveInside(staging, copied));
+                    copies.remove(copied);
                 }
             }
-        }
-    }
-
-    private static final class ScanVisitor extends SimpleFileVisitor<Path> {
-        private final Path source;
-
-        private final List<SourceDirectory> directories = new ArrayList<>();
-
-        private final List<SourceFile> files = new ArrayList<>();
-
-        private final Map<String, EntryKind> collisionKinds = new HashMap<>();
-
-        private final Set<String> observedPortablePaths = new HashSet<>();
-
-        private long byteCount;
-
-        private ScanVisitor(Path source) {
-            this.source = source;
-        }
-
-        @Override
-        public FileVisitResult preVisitDirectory(Path directory, BasicFileAttributes attributes)
-                throws IOException {
-            requireNotInterrupted();
-            Path relative = source.relativize(directory);
-            if (!relative.toString().isEmpty() && isExcluded(relative)) {
-                return FileVisitResult.SKIP_SUBTREE;
+            Set<String> folders = new HashSet<>();
+            tree.folders().forEach(folder -> folders.add(folder.portablePath()));
+            List<String> removed = stagedFolders.stream()
+                    .filter(folder -> !folders.contains(folder))
+                    .sorted(Comparator.reverseOrder())
+                    .toList();
+            for (String folder : removed) {
+                CaptureWorkspace.deleteTree(PortablePath.resolveInside(staging, folder));
+                stagedFolders.remove(folder);
             }
-            requireSafeDirectory(directory, "World source contains a link or special directory");
-            String portable = relative.toString().isEmpty() ? "" : portable(relative);
-            if (!portable.isEmpty()) {
-                register(portable, EntryKind.DIRECTORY);
+            for (Folder folder : tree.folders()) {
+                if (!folder.portablePath().isEmpty() && stagedFolders.add(folder.portablePath())) {
+                    Files.createDirectory(PortablePath.resolveInside(staging, folder.portablePath()));
+                }
             }
-            directories.add(new SourceDirectory(
-                    directory,
-                    portable,
-                    DirectoryFingerprint.create(attributes)));
-            requireCapacity();
-            return FileVisitResult.CONTINUE;
         }
 
-        @Override
-        public FileVisitResult visitFile(Path file, BasicFileAttributes attributes) throws IOException {
-            requireNotInterrupted();
-            Path relative = source.relativize(file);
-            if (isExcluded(relative) || isSessionLock(relative)) {
-                return FileVisitResult.CONTINUE;
-            }
-            requireSafeFile(file, attributes);
-            String portable = portable(relative);
-            register(portable, EntryKind.FILE);
-            files.add(new SourceFile(file, portable, FileFingerprint.create(attributes)));
-            try {
-                byteCount = Math.addExact(byteCount, attributes.size());
-            } catch (ArithmeticException exception) {
-                throw new IOException("World size overflowed capture accounting", exception);
+        /** Copies the file unless an earlier attempt copied it and it has not changed since. */
+        private void copyIfStale(SourceFile file, ByteProgress progress)
+                throws IOException, InterruptedException {
+            CopiedFile existing = copies.get(file.portablePath());
+            if (existing != null && existing.source().equals(FileState.read(file))) {
+                progress.add(existing.size());
+                return;
             }
-            if (byteCount > WorldInventory.MAXIMUM_BYTES) {
-                throw new IOException("World is too large to capture");
+            // The copy overwrites the staged file, so no entry may vouch for it until the new copy is complete.
+            copies.remove(file.portablePath());
+            Path relative = Path.of(file.portablePath());
+            observer.beforeFileCopy(relative);
+            Instant statedAt = Instant.now();
+            FileState source = FileState.read(file);
+            Digest copied;
+            try (InputStream input = Files.newInputStream(file.path(), LinkOption.NOFOLLOW_LINKS);
+                    OutputStream output = Files.newOutputStream(
+                            PortablePath.resolveInside(staging, file.portablePath()),
+                            StandardOpenOption.CREATE,
+                            StandardOpenOption.TRUNCATE_EXISTING,
+                            StandardOpenOption.WRITE,
+                            LinkOption.NOFOLLOW_LINKS)) {
+                copied = copyAndHash(input, output);
+            } catch (NoSuchFileException exception) {
+                throw file.path().toString().equals(exception.getFile())
+                        ? WorldTree.changed("\"" + file.portablePath() + "\" disappeared")
+                        : exception;
             }
-            requireCapacity();
-            return FileVisitResult.CONTINUE;
-        }
-
-        @Override
-        public FileVisitResult visitFileFailed(Path file, IOException exception) throws IOException {
-            throw new IOException("A world source entry could not be read", exception);
-        }
-
-        @Override
-        public FileVisitResult postVisitDirectory(Path directory, IOException exception) throws IOException {
-            if (exception != null) {
-                throw new IOException("The world source could not be traversed", exception);
+            observer.afterFileCopy(relative);
+            if (copied.size() != source.size()) {
+                throw WorldTree.changed("\"" + file.portablePath() + "\" was written");
             }
-            return FileVisitResult.CONTINUE;
-        }
-
-        private void register(String portable, EntryKind kind) throws IOException {
-            if (!observedPortablePaths.add(portable)) {
-                throw new IOException("World contains a duplicate portable path");
+            copies.put(file.portablePath(), new CopiedFile(source, statedAt, copied.size(), copied.sha256()));
+            progress.add(copied.size());
+        }
+
+        /**
+         * Trusts the copy of a closed world's file when the file's state is unchanged and its time
+         * is not recent; reads the file again otherwise, and always in the open world. A mismatch
+         * drops the copy, so the next attempt copies it again.
+         *
+         * @param newestWindow ten seconds before the newest file's time
+         */
+        private void verify(SourceFile file, FileTime newestWindow) throws IOException {
+            CopiedFile copy = copies.get(file.portablePath());
+            Instant statedAt = Instant.now();
+            FileState now = FileState.read(file);
+            if (kind == CaptureKind.CLOSED_WORLD && now.equals(copy.source()) && !copy.recent(newestWindow)) {
+                return;
             }
-            String[] segments = portable.split("/");
-            StringBuilder prefix = new StringBuilder();
-            for (int index = 0; index < segments.length; index++) {
-                if (!prefix.isEmpty()) {
-                    prefix.append('/');
-                }
-                prefix.append(segments[index]);
-                String key = PortableWorldPath.collisionKey(prefix.toString());
-                EntryKind expected = index == segments.length - 1 ? kind : EntryKind.DIRECTORY;
-                EntryKind previous = collisionKinds.putIfAbsent(key, expected);
-                if (previous != null && (previous != expected || index == segments.length - 1)) {
-                    throw new IOException("World contains paths that collide on another platform");
-                }
+            Digest current;
+            try (InputStream input = Files.newInputStream(file.path(), LinkOption.NOFOLLOW_LINKS)) {
+                current = copyAndHash(input, OutputStream.nullOutputStream());
+            } catch (NoSuchFileException exception) {
+                throw WorldTree.changed("\"" + file.portablePath() + "\" disappeared");
             }
-        }
-
-        private void requireCapacity() throws IOException {
-            if (files.size() > WorldInventory.MAXIMUM_FILES
-                    || directories.size() > WorldInventory.MAXIMUM_FILES) {
-                throw new IOException("World contains too many entries");
+            if (!FileState.read(file).equals(now) || !current.matches(copy)) {
+                copies.remove(file.portablePath());
+                throw WorldTree.changed("\"" + file.portablePath() + "\" was written");
             }
-        }
-
-        private static String portable(Path relative) throws IOException {
-            try {
-                return PortableWorldPath.fromRelativePath(relative);
-            } catch (IllegalArgumentException exception) {
-                throw new IOException("World contains a path that cannot be restored safely", exception);
-            }
-        }
-
-        private static boolean isExcluded(Path relative) {
-            return relative.getNameCount() > 0
-                    && relative.getName(0).toString().equalsIgnoreCase(".worldarchive");
-        }
-
-        private static boolean isSessionLock(Path relative) {
-            return relative.getNameCount() == 1
-                    && relative.getFileName().toString().equalsIgnoreCase("session.lock");
+            copies.put(file.portablePath(), new CopiedFile(now, statedAt, copy.size(), copy.sha256()));
         }
     }
 
-    private record SourceDirectory(
-            Path path,
-            String portablePath,
-            DirectoryFingerprint fingerprint) {
-        private SourceDirectory {
-            Objects.requireNonNull(path, "path");
-            Objects.requireNonNull(portablePath, "portablePath");
-            Objects.requireNonNull(fingerprint, "fingerprint");
+    /** Ten seconds before the newest file; an extreme timestamp counts every file as recent. */
+    private static FileTime recentSince(FileTime newest) {
+        try {
+            return FileTime.from(newest.toInstant().minus(RECENT));
+        } catch (DateTimeException exception) {
+            return FileTime.fromMillis(Long.MIN_VALUE);
         }
     }
 
-    private record SourceFile(
-            Path path,
-            String portablePath,
-            FileFingerprint fingerprint) {
-        private SourceFile {
-            Objects.requireNonNull(path, "path");
-            Objects.requireNonNull(portablePath, "portablePath");
-            Objects.requireNonNull(fingerprint, "fingerprint");
-        }
-
-        private void requireStableAttributes() throws IOException {
-            BasicFileAttributes current = Files.readAttributes(
-                    path,
-                    BasicFileAttributes.class,
-                    LinkOption.NOFOLLOW_LINKS);
-            requireSafeFile(path, current);
-            FileFingerprint currentFingerprint = FileFingerprint.create(current);
-            if (!fingerprint.hasSameStableAttributes(currentFingerprint)) {
-                throw changedFileException();
+    private static Digest copyAndHash(InputStream input, OutputStream output) throws IOException {
+        MessageDigest digest = Digests.sha256();
+        byte[] buffer = new byte[Digests.COPY_BUFFER_BYTES];
+        long size = 0;
+        int read;
+        while ((read = input.read(buffer)) >= 0) {
+            if (Thread.currentThread().isInterrupted()) {
+                throw new InterruptedIOException("World capture was interrupted");
             }
-        }
-
-        private boolean hasSameStableFile(SourceFile other) {
-            return path.equals(other.path)
-                    && portablePath.equals(other.portablePath)
-                    && fingerprint.hasSameStableAttributes(other.fingerprint);
-        }
-
-        private IOException changedFileException() {
-            return new SourceChangedException(
-                    "World file changed while its private capture was being created: "
-                            + portablePath);
-        }
-    }
-
-    private record FileFingerprint(
-            Object fileKey,
-            long size,
-            FileTime creationTime) {
-        private FileFingerprint {
-            if (size < 0) {
-                throw new IllegalArgumentException("Source fingerprint size is negative");
+            output.write(buffer, 0, read);
+            digest.update(buffer, 0, read);
+            size += read;
+            if (size > WorldInventory.MAXIMUM_BYTES) {
+                throw new IOException("A world file is larger than WorldArchive can back up");
             }
-            Objects.requireNonNull(creationTime, "creationTime");
-        }
-
-        private static FileFingerprint create(BasicFileAttributes attributes) {
-            return new FileFingerprint(
-                    attributes.fileKey(),
-                    attributes.size(),
-                    identityCreationTime(attributes));
         }
+        return new Digest(size, Digests.hex(digest.digest()));
+    }
 
-        private boolean hasSameStableAttributes(FileFingerprint other) {
-            return Objects.equals(fileKey, other.fileKey)
-                    && size == other.size
-                    && creationTime.equals(other.creationTime);
+    /** The size and SHA-256 of bytes read from a file. */
+    private record Digest(long size, String sha256) {
+        boolean matches(CopiedFile copy) {
+            return size == copy.size() && sha256.equals(copy.sha256());
         }
-
     }
 
-    /** Directory mtimes are deferred on Windows; identity and membership remain authoritative. */
-    private record DirectoryFingerprint(
-            Object fileKey,
-            FileTime creationTime) {
-        private DirectoryFingerprint {
-            Objects.requireNonNull(creationTime, "creationTime");
+    /** A copied file, with the state its source had just before the copy and the clock when that state was read. */
+    private record CopiedFile(FileState source, Instant statedAt, long size, String sha256) {
+        /**
+         * Whether a later write can still hide in the file's timestamp: its time is at or after
+         * {@code newestWindow}, or within ten seconds of the clock when its state was read, or later.
+         * The clock covers a file dated in the future, which moves the newest time ahead.
+         */
+        boolean recent(FileTime newestWindow) {
+            FileTime modified = source.modified();
+            return modified.compareTo(newestWindow) >= 0
+                    || modified.toInstant().compareTo(statedAt.minus(RECENT)) >= 0;
         }
 
-        private static DirectoryFingerprint create(BasicFileAttributes attributes) {
-            return new DirectoryFingerprint(
-                    attributes.fileKey(),
-                    identityCreationTime(attributes));
+        WorldInventory.Entry entry(String portablePath) {
+            return new WorldInventory.Entry(portablePath, size, sha256);
         }
     }
 
-    /** macOS may move birth time backwards when an older modification time is applied. */
-    private static final boolean IGNORE_CREATION_TIME = System.getProperty("os.name").startsWith("Mac");
+    /** Reports copied bytes in increasing order, although several workers copy at once. */
+    private static final class ByteProgress {
+        private final CaptureProgressListener listener;
 
-    private static FileTime identityCreationTime(BasicFileAttributes attributes) {
-        return IGNORE_CREATION_TIME ? FileTime.fromMillis(0) : attributes.creationTime();
-    }
+        private final long total;
 
-    private record CopyResult(long size, String sha256) {
-    }
+        // Guarded by this.
+        private long completed;
 
-    /** The live world wrote a file mid-capture; the capture restarts from scratch. */
-    private static final class SourceChangedException extends IOException {
-        private SourceChangedException(String message) {
-            super(message);
+        private ByteProgress(CaptureProgressListener listener, long total) {
+            this.listener = listener;
+            this.total = total;
+            Observers.safely(() -> listener.onProgress(0, total));
         }
-    }
 
-    private enum EntryKind {
-        DIRECTORY,
-        FILE
+        private synchronized void add(long bytes) {
+            completed = Math.min(total, completed + bytes);
+            Observers.safely(() -> listener.onProgress(completed, total));
+        }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/FileSystemSafety.java b/src/main/java/dev/ishaanko/worldarchive/core/FileSystemSafety.java
deleted file mode 100644
index 6260b6e..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/core/FileSystemSafety.java
+++ /dev/null
@@ -1,56 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.nio.file.attribute.BasicFileAttributes;
-import java.util.Map;
-
-/** Canonical no-follow classification for filesystem entries used by storage boundaries. */
-public final class FileSystemSafety {
-    private static final int WINDOWS_REPARSE_POINT = 0x400;
-
-    private FileSystemSafety() {
-    }
-
-    public static boolean isOrdinaryDirectory(
-            Path path,
-            BasicFileAttributes attributes) throws IOException {
-        return attributes.isDirectory()
-                && !attributes.isSymbolicLink()
-                && !attributes.isOther()
-                && !isWindowsReparsePoint(path);
-    }
-
-    public static boolean isOrdinaryRegularFile(
-            Path path,
-            BasicFileAttributes attributes) throws IOException {
-        return attributes.isRegularFile()
-                && !attributes.isSymbolicLink()
-                && !attributes.isOther()
-                && !isWindowsReparsePoint(path);
-    }
-
-    public static boolean isWindowsReparsePoint(Path path) throws IOException {
-        if (!"\\".equals(path.getFileSystem().getSeparator())) {
-            return false;
-        }
-        try {
-            Map<String, Object> attributes = Files.readAttributes(
-                    path,
-                    "dos:attributes",
-                    LinkOption.NOFOLLOW_LINKS);
-            Object raw = attributes.get("attributes");
-            if (!(raw instanceof Integer value)) {
-                throw new IOException(
-                        "Windows reparse-point attributes are unavailable");
-            }
-            return (value & WINDOWS_REPARSE_POINT) != 0;
-        } catch (UnsupportedOperationException | IllegalArgumentException exception) {
-            throw new IOException(
-                    "Windows reparse-point attributes are unavailable",
-                    exception);
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/FileWorldInventoryStore.java b/src/main/java/dev/ishaanko/worldarchive/core/FileWorldInventoryStore.java
index ed39444..216799d 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/FileWorldInventoryStore.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/FileWorldInventoryStore.java
@@ -3,41 +3,32 @@
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
 import com.google.gson.JsonArray;
-import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
-import com.google.gson.JsonParseException;
-import com.google.gson.JsonParser;
-import com.google.gson.JsonPrimitive;
 import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.support.AtomicFiles;
+import dev.ishaanko.worldarchive.support.JsonFields;
 import java.io.IOException;
-import java.math.BigDecimal;
-import java.nio.channels.FileChannel;
-import java.nio.channels.FileLock;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
+import java.nio.file.NoSuchFileException;
 import java.nio.file.Path;
-import java.nio.file.StandardOpenOption;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentMap;
-import java.util.concurrent.locks.ReentrantLock;
 
-/** Atomic, process-safe JSON persistence for unchanged-world detection. */
-public final class FileWorldInventoryStore implements WorldInventoryStore {
-    public static final int CURRENT_SCHEMA_VERSION = 1;
+/**
+ * One JSON file per world holding the inventory of its last recorded capture. The next capture
+ * compares against it to count changed files. The coordinator writes one world's file at a time
+ * and replaces it atomically, so readers always see a whole file and no lock is needed.
+ */
+public final class FileWorldInventoryStore {
+    private static final int SCHEMA_VERSION = 1;
 
-    private static final Gson GSON = new GsonBuilder()
-            .setPrettyPrinting()
-            .disableHtmlEscaping()
-            .create();
+    private static final Gson GSON = new GsonBuilder().disableHtmlEscaping().create();
 
     /** A 500,000-file inventory encodes to well over the generic metadata ceiling. */
     private static final int MAXIMUM_INVENTORY_BYTES = 256 * 1_024 * 1_024;
 
-    private static final ConcurrentMap<Path, ReentrantLock> JVM_LOCKS = new ConcurrentHashMap<>();
+    private static final JsonFields<IOException> FIELDS = new JsonFields<>(IOException::new);
 
     private final Path directory;
 
@@ -47,85 +38,34 @@ public FileWorldInventoryStore(Path directory) {
                 .normalize();
     }
 
-    public Path directory() {
-        return directory;
-    }
-
-    @Override
+    /** The world's last inventory, or empty when none was saved yet. A damaged file is an IOException. */
     public Optional<WorldInventory> load(WorldId worldId) throws IOException {
-        Objects.requireNonNull(worldId, "worldId");
-        return withLock(worldId, () -> {
-            Path file = file(worldId);
-            if (!Files.exists(file, LinkOption.NOFOLLOW_LINKS)) {
-                return Optional.empty();
-            }
-            requireRegularFile(file, "World inventory is not a regular file");
-            try {
-                JsonElement parsed = JsonParser.parseString(AtomicFiles.readUtf8(file, MAXIMUM_INVENTORY_BYTES));
-                if (!parsed.isJsonObject()) {
-                    throw new IOException("World inventory root must be a JSON object");
-                }
-                return Optional.of(decode(worldId, parsed.getAsJsonObject()));
-            } catch (JsonParseException | IllegalArgumentException exception) {
-                throw new IOException("World inventory is malformed or invalid", exception);
-            }
-        });
-    }
-
-    @Override
-    public void save(WorldId worldId, WorldInventory inventory) throws IOException {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(inventory, "inventory");
-        withLock(worldId, () -> {
-            AtomicFiles.writeUtf8(
-                    file(worldId),
-                    GSON.toJson(encode(worldId, inventory)) + "\n",
-                    MAXIMUM_INVENTORY_BYTES);
-            return null;
-        });
-    }
-
-    private <T> T withLock(WorldId worldId, IoSupplier<T> operation) throws IOException {
-        Path lockPath = lockFile(worldId);
-        ReentrantLock jvmLock = JVM_LOCKS.computeIfAbsent(lockPath, ignored -> new ReentrantLock());
-        jvmLock.lock();
+        String json;
         try {
-            createSafeDirectory();
-            if (Files.exists(lockPath, LinkOption.NOFOLLOW_LINKS)) {
-                requireRegularFile(lockPath, "World inventory lock is not a regular file");
-            }
-            try (FileChannel channel = FileChannel.open(
-                            lockPath,
-                            StandardOpenOption.CREATE,
-                            StandardOpenOption.WRITE,
-                            LinkOption.NOFOLLOW_LINKS);
-                    FileLock ignored = channel.lock()) {
-                return operation.get();
-            }
-        } finally {
-            jvmLock.unlock();
+            json = AtomicFiles.readUtf8(file(worldId), MAXIMUM_INVENTORY_BYTES);
+        } catch (NoSuchFileException exception) {
+            return Optional.empty();
         }
-    }
-
-    private void createSafeDirectory() throws IOException {
-        Files.createDirectories(directory);
-        if (Files.isSymbolicLink(directory)
-                || !Files.isDirectory(directory, LinkOption.NOFOLLOW_LINKS)) {
-            throw new IOException("World inventory directory is unsafe");
+        try {
+            return Optional.of(decode(worldId, FIELDS.parseObject(json, "World inventory")));
+        } catch (IllegalArgumentException exception) {
+            throw new IOException("World inventory is malformed or invalid", exception);
         }
     }
 
-    private Path file(WorldId worldId) {
-        return directory.resolve(worldId + ".json");
+    public void save(WorldId worldId, WorldInventory inventory) throws IOException {
+        Objects.requireNonNull(inventory, "inventory");
+        String json = GSON.toJson(encode(worldId, inventory)) + "\n";
+        AtomicFiles.writeUtf8(file(worldId), json, MAXIMUM_INVENTORY_BYTES);
     }
 
-    private Path lockFile(WorldId worldId) {
-        return directory.resolve(worldId + ".lock");
+    private Path file(WorldId worldId) {
+        return directory.resolve(Objects.requireNonNull(worldId, "worldId") + ".json");
     }
 
     private static JsonObject encode(WorldId worldId, WorldInventory inventory) {
         JsonObject root = new JsonObject();
-        root.addProperty("schemaVersion", CURRENT_SCHEMA_VERSION);
+        root.addProperty("schemaVersion", SCHEMA_VERSION);
         root.addProperty("worldId", worldId.toString());
         JsonArray files = new JsonArray();
         for (WorldInventory.Entry entry : inventory.files()) {
@@ -140,82 +80,24 @@ private static JsonObject encode(WorldId worldId, WorldInventory inventory) {
     }
 
     private static WorldInventory decode(WorldId expectedWorldId, JsonObject root) throws IOException {
-        int schemaVersion = requiredInteger(root, "schemaVersion");
-        if (schemaVersion != CURRENT_SCHEMA_VERSION) {
+        int schemaVersion = FIELDS.requiredInt(root, "schemaVersion");
+        if (schemaVersion != SCHEMA_VERSION) {
             throw new IOException("Unsupported world inventory schema: " + schemaVersion);
         }
-        WorldId storedWorldId = WorldId.parse(requiredString(root, "worldId"));
-        if (!storedWorldId.equals(expectedWorldId)) {
+        if (!WorldId.parse(FIELDS.requiredString(root, "worldId")).equals(expectedWorldId)) {
             throw new IOException("World inventory identity does not match its file name");
         }
-        JsonArray encodedFiles = requiredArray(root, "files");
+        List<JsonObject> encodedFiles = FIELDS.requiredObjects(root, "files");
         if (encodedFiles.size() > WorldInventory.MAXIMUM_FILES) {
             throw new IOException("World inventory contains too many files");
         }
         List<WorldInventory.Entry> files = new ArrayList<>(encodedFiles.size());
-        for (JsonElement encoded : encodedFiles) {
-            if (!encoded.isJsonObject()) {
-                throw new IOException("World inventory entry must be an object");
-            }
-            JsonObject object = encoded.getAsJsonObject();
+        for (JsonObject encoded : encodedFiles) {
             files.add(new WorldInventory.Entry(
-                    requiredString(object, "path"),
-                    requiredLong(object, "size"),
-                    requiredString(object, "sha256")));
+                    FIELDS.requiredString(encoded, "path"),
+                    FIELDS.requiredLong(encoded, "size"),
+                    FIELDS.requiredString(encoded, "sha256")));
         }
         return WorldInventory.create(files);
     }
-
-    private static void requireRegularFile(Path path, String message) throws IOException {
-        if (Files.isSymbolicLink(path) || !Files.isRegularFile(path, LinkOption.NOFOLLOW_LINKS)) {
-            throw new IOException(message);
-        }
-    }
-
-    private static JsonArray requiredArray(JsonObject object, String name) throws IOException {
-        JsonElement element = object.get(name);
-        if (element == null || !element.isJsonArray()) {
-            throw new IOException("Required array is missing or invalid: " + name);
-        }
-        return element.getAsJsonArray();
-    }
-
-    private static String requiredString(JsonObject object, String name) throws IOException {
-        JsonElement element = object.get(name);
-        if (element == null
-                || !element.isJsonPrimitive()
-                || !element.getAsJsonPrimitive().isString()) {
-            throw new IOException("Required string is missing or invalid: " + name);
-        }
-        return element.getAsString();
-    }
-
-    private static int requiredInteger(JsonObject object, String name) throws IOException {
-        long value = requiredLong(object, name);
-        if (value < Integer.MIN_VALUE || value > Integer.MAX_VALUE) {
-            throw new IOException("Required integer is out of range: " + name);
-        }
-        return (int) value;
-    }
-
-    private static long requiredLong(JsonObject object, String name) throws IOException {
-        JsonElement element = object.get(name);
-        if (element == null || !element.isJsonPrimitive()) {
-            throw new IOException("Required number is missing or invalid: " + name);
-        }
-        JsonPrimitive primitive = element.getAsJsonPrimitive();
-        if (!primitive.isNumber()) {
-            throw new IOException("Required number is missing or invalid: " + name);
-        }
-        try {
-            return new BigDecimal(primitive.getAsString()).longValueExact();
-        } catch (ArithmeticException | NumberFormatException exception) {
-            throw new IOException("Required number is not an integer: " + name, exception);
-        }
-    }
-
-    @FunctionalInterface
-    private interface IoSupplier<T> {
-        T get() throws IOException;
-    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/NoCatchUpSchedule.java b/src/main/java/dev/ishaanko/worldarchive/core/NoCatchUpSchedule.java
deleted file mode 100644
index ddb9a26..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/core/NoCatchUpSchedule.java
+++ /dev/null
@@ -1,59 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import dev.ishaanko.worldarchive.config.TriggerConfig;
-import java.time.Duration;
-import java.time.Instant;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Thread-safe interval clock that emits at most one run after any period of inactivity. */
-public final class NoCatchUpSchedule {
-    private final Duration interval;
-
-    private Instant nextRunAt;
-
-    public NoCatchUpSchedule(Duration interval, Instant startedAt) {
-        this.interval = requireInterval(interval);
-        reset(startedAt);
-    }
-
-    public static NoCatchUpSchedule minutes(int intervalMinutes, Instant startedAt) {
-        if (intervalMinutes < 1
-                || intervalMinutes > TriggerConfig.MAXIMUM_SCHEDULE_INTERVAL_MINUTES) {
-            throw new IllegalArgumentException("Schedule interval must be between one minute and seven days");
-        }
-        return new NoCatchUpSchedule(Duration.ofMinutes(intervalMinutes), startedAt);
-    }
-
-    /** Returns the due instant once, then schedules from now instead of replaying missed intervals. */
-    public synchronized Optional<Instant> poll(Instant now) {
-        Objects.requireNonNull(now, "now");
-        if (now.isBefore(nextRunAt)) {
-            return Optional.empty();
-        }
-        Instant due = nextRunAt;
-        nextRunAt = now.plus(interval);
-        return Optional.of(due);
-    }
-
-    /** Starts a fresh interval, as on world open or application restart. */
-    public synchronized void reset(Instant now) {
-        Objects.requireNonNull(now, "now");
-        nextRunAt = now.plus(interval);
-    }
-
-    public synchronized Instant nextRunAt() {
-        return nextRunAt;
-    }
-
-    private static Duration requireInterval(Duration interval) {
-        Objects.requireNonNull(interval, "interval");
-        if (interval.isZero() || interval.isNegative()) {
-            throw new IllegalArgumentException("Schedule interval must be positive");
-        }
-        if (interval.compareTo(Duration.ofDays(7)) > 0) {
-            throw new IllegalArgumentException("Schedule interval must not exceed seven days");
-        }
-        return interval;
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/OperationPhase.java b/src/main/java/dev/ishaanko/worldarchive/core/OperationPhase.java
deleted file mode 100644
index 7bf9e35..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/core/OperationPhase.java
+++ /dev/null
@@ -1,13 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-/** Monotonic phases used for concise operation progress. */
-public enum OperationPhase {
-    QUEUED,
-    PREPARING,
-    READING,
-    WRITING,
-    VERIFYING,
-    PUBLISHING,
-    COMPLETE,
-    FAILED
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/ParallelWork.java b/src/main/java/dev/ishaanko/worldarchive/core/ParallelWork.java
new file mode 100644
index 0000000..915b66f
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/core/ParallelWork.java
@@ -0,0 +1,99 @@
+package dev.ishaanko.worldarchive.core;
+
+import java.io.IOException;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.concurrent.atomic.AtomicReference;
+
+/**
+ * Runs one task per item on a few virtual threads and waits for all of them. The first failure
+ * stops the other workers. An interrupt of the waiting thread interrupts every worker and waits
+ * until they have stopped, so a cancelled capture never leaves a copy running.
+ */
+final class ParallelWork {
+    private ParallelWork() {
+    }
+
+    /** Blocking work for one item. */
+    @FunctionalInterface
+    interface Task<T> {
+        void run(T item) throws IOException, InterruptedException;
+    }
+
+    static <T> void forEach(List<T> items, int parallelism, Task<T> task)
+            throws IOException, InterruptedException {
+        int workers = Math.min(parallelism, items.size());
+        if (workers <= 1) {
+            for (T item : items) {
+                task.run(item);
+            }
+            return;
+        }
+        AtomicInteger next = new AtomicInteger();
+        AtomicReference<Throwable> failure = new AtomicReference<>();
+        Thread[] threads = new Thread[workers];
+        for (int worker = 0; worker < workers; worker++) {
+            threads[worker] = Thread.ofVirtual().name("worldarchive-capture-" + worker).unstarted(() -> {
+                try {
+                    for (int index = next.getAndIncrement();
+                            index < items.size() && failure.get() == null;
+                            index = next.getAndIncrement()) {
+                        task.run(items.get(index));
+                    }
+                } catch (Throwable throwable) {
+                    // The worker's boundary: the waiting thread rethrows the first failure.
+                    if (failure.compareAndSet(null, throwable)) {
+                        interruptOthers(threads);
+                    }
+                }
+            });
+        }
+        for (Thread thread : threads) {
+            thread.start();
+        }
+        joinAll(threads);
+        rethrow(failure.get());
+    }
+
+    private static void interruptOthers(Thread[] threads) {
+        for (Thread thread : threads) {
+            if (thread != Thread.currentThread()) {
+                thread.interrupt();
+            }
+        }
+    }
+
+    /** Waits for every worker even when interrupted, so none keeps writing after the caller gives up. */
+    private static void joinAll(Thread[] threads) throws InterruptedException {
+        InterruptedException interrupted = null;
+        for (Thread thread : threads) {
+            while (thread.isAlive()) {
+                try {
+                    thread.join();
+                } catch (InterruptedException exception) {
+                    if (interrupted == null) {
+                        interrupted = exception;
+                        for (Thread worker : threads) {
+                            worker.interrupt();
+                        }
+                    }
+                }
+            }
+        }
+        if (interrupted != null) {
+            throw interrupted;
+        }
+    }
+
+    private static void rethrow(Throwable failure) throws IOException, InterruptedException {
+        switch (failure) {
+            case null -> {
+            }
+            case IOException exception -> throw exception;
+            case InterruptedException exception -> throw exception;
+            case RuntimeException exception -> throw exception;
+            case Error error -> throw error;
+            default -> throw new IOException(failure);
+        }
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/PathGuards.java b/src/main/java/dev/ishaanko/worldarchive/core/PathGuards.java
deleted file mode 100644
index cebc940..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/core/PathGuards.java
+++ /dev/null
@@ -1,108 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import java.io.IOException;
-import java.nio.file.FileAlreadyExistsException;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.nio.file.attribute.BasicFileAttributes;
-import java.util.function.Supplier;
-
-/**
- * Shared segment-by-segment, no-follow-symlink directory validation and creation used by the
- * Git and ZIP storage backends. Callers supply how each failure is turned into their own checked
- * exception type and how a component's attributes are read, so each backend's exact behavior
- * (message text, exception type, and read-failure translation) is preserved.
- */
-public final class PathGuards {
-    private PathGuards() {
-    }
-
-    /** Reads a path component's attributes, translating a raw {@link IOException} if required. */
-    @FunctionalInterface
-    public interface AttributeReader<E extends Exception> {
-        BasicFileAttributes read(Path path) throws IOException, E;
-    }
-
-    /**
-     * Creates every missing component of {@code directory}, validating only the component just
-     * created or observed after each step.
-     */
-    public static <E extends Exception> void createDirectories(
-            Path directory,
-            Supplier<E> onMissingRoot,
-            AttributeReader<E> reader,
-            Supplier<E> onInvalidComponent) throws IOException, E {
-        create(directory, onMissingRoot, reader, onInvalidComponent, false);
-    }
-
-    /**
-     * Creates every missing component of {@code directory}, re-validating the whole prefix after
-     * each step. Path resolution follows links in every component except the last, so checking
-     * only the newest component cannot see an already-validated ancestor that was swapped for a
-     * link mid-walk; re-walking the prefix rejects that race.
-     */
-    public static <E extends Exception> void createDirectoriesRevalidatingPrefix(
-            Path directory,
-            Supplier<E> onMissingRoot,
-            AttributeReader<E> reader,
-            Supplier<E> onInvalidComponent) throws IOException, E {
-        create(directory, onMissingRoot, reader, onInvalidComponent, true);
-    }
-
-    private static <E extends Exception> void create(
-            Path directory,
-            Supplier<E> onMissingRoot,
-            AttributeReader<E> reader,
-            Supplier<E> onInvalidComponent,
-            boolean revalidatePrefix) throws IOException, E {
-        Path absolute = directory.toAbsolutePath().normalize();
-        Path current = absolute.getRoot();
-        if (current == null) {
-            throw onMissingRoot.get();
-        }
-        requireDirectoryComponent(current, reader, onInvalidComponent);
-        for (Path segment : absolute) {
-            current = current.resolve(segment);
-            if (!Files.exists(current, LinkOption.NOFOLLOW_LINKS)) {
-                try {
-                    Files.createDirectory(current);
-                } catch (FileAlreadyExistsException exception) {
-                    // A racing creator is accepted only after validation below.
-                }
-            }
-            if (revalidatePrefix) {
-                requireDirectory(current, onMissingRoot, reader, onInvalidComponent);
-            } else {
-                requireDirectoryComponent(current, reader, onInvalidComponent);
-            }
-        }
-    }
-
-    public static <E extends Exception> void requireDirectory(
-            Path directory,
-            Supplier<E> onMissingRoot,
-            AttributeReader<E> reader,
-            Supplier<E> onInvalidComponent) throws IOException, E {
-        Path absolute = directory.toAbsolutePath().normalize();
-        Path current = absolute.getRoot();
-        if (current == null) {
-            throw onMissingRoot.get();
-        }
-        requireDirectoryComponent(current, reader, onInvalidComponent);
-        for (Path segment : absolute) {
-            current = current.resolve(segment);
-            requireDirectoryComponent(current, reader, onInvalidComponent);
-        }
-    }
-
-    public static <E extends Exception> void requireDirectoryComponent(
-            Path component,
-            AttributeReader<E> reader,
-            Supplier<E> onInvalidComponent) throws IOException, E {
-        BasicFileAttributes attributes = reader.read(component);
-        if (!FileSystemSafety.isOrdinaryDirectory(component, attributes)) {
-            throw onInvalidComponent.get();
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/PortableWorldPath.java b/src/main/java/dev/ishaanko/worldarchive/core/PortableWorldPath.java
deleted file mode 100644
index fcdc8fa..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/core/PortableWorldPath.java
+++ /dev/null
@@ -1,92 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Path;
-import java.text.Normalizer;
-import java.util.Locale;
-import java.util.Set;
-
-/** Cross-platform validation used before a source path enters a portable backup. */
-final class PortableWorldPath {
-    private static final int MAXIMUM_PATH_BYTES = 4_096;
-
-    private static final int MAXIMUM_SEGMENT_BYTES = 255;
-
-    private static final Set<String> WINDOWS_DEVICES = Set.of(
-            "CON", "PRN", "AUX", "NUL",
-            "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9",
-            "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9");
-
-    private static final String WINDOWS_INVALID = "<>\"|?*";
-
-    private PortableWorldPath() {
-    }
-
-    static String fromRelativePath(Path relative) {
-        StringBuilder portable = new StringBuilder();
-        for (Path segment : relative) {
-            if (!portable.isEmpty()) {
-                portable.append('/');
-            }
-            portable.append(segment);
-        }
-        return validate(portable.toString());
-    }
-
-    static String validate(String value) {
-        if (value == null
-                || value.isEmpty()
-                || value.indexOf('\0') >= 0
-                || value.indexOf('\\') >= 0
-                || value.startsWith("/")
-                || hasDrivePrefix(value)
-                || value.endsWith("/")
-                || value.getBytes(StandardCharsets.UTF_8).length > MAXIMUM_PATH_BYTES) {
-            throw new IllegalArgumentException("World path is not portable");
-        }
-        for (String segment : value.split("/", -1)) {
-            validateSegment(segment);
-        }
-        return value;
-    }
-
-    static String collisionKey(String value) {
-        return Normalizer.normalize(validate(value), Normalizer.Form.NFC)
-                .toLowerCase(Locale.ROOT);
-    }
-
-    static Path resolveInside(Path root, String portable) {
-        Path result = root;
-        for (String segment : validate(portable).split("/")) {
-            result = result.resolve(segment);
-        }
-        result = result.normalize();
-        if (result.equals(root) || !result.startsWith(root)) {
-            throw new IllegalArgumentException("World path escapes its private capture");
-        }
-        return result;
-    }
-
-    private static boolean hasDrivePrefix(String value) {
-        return value.length() >= 2 && Character.isLetter(value.charAt(0)) && value.charAt(1) == ':';
-    }
-
-    private static void validateSegment(String segment) {
-        if (segment.isEmpty()
-                || segment.equals(".")
-                || segment.equals("..")
-                || segment.endsWith(".")
-                || segment.endsWith(" ")
-                || segment.getBytes(StandardCharsets.UTF_8).length > MAXIMUM_SEGMENT_BYTES
-                || segment.indexOf(':') >= 0
-                || segment.indexOf('\uFFFD') >= 0
-                || segment.chars().anyMatch(character -> WINDOWS_INVALID.indexOf(character) >= 0)
-                || segment.chars().anyMatch(Character::isISOControl)) {
-            throw new IllegalArgumentException("World path contains an unsafe segment");
-        }
-        String base = segment.split("\\.", 2)[0].toUpperCase(Locale.ROOT);
-        if (WINDOWS_DEVICES.contains(base)) {
-            throw new IllegalArgumentException("World path uses a reserved device name");
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/PreparedBackup.java b/src/main/java/dev/ishaanko/worldarchive/core/PreparedBackup.java
index 5f1951d..07a0564 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/PreparedBackup.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/PreparedBackup.java
@@ -1,128 +1,70 @@
 package dev.ishaanko.worldarchive.core;
 
-import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.OperationId;
 import java.io.IOException;
 import java.util.Objects;
 import java.util.concurrent.atomic.AtomicReference;
 
-/** Owned synchronous capture awaiting transfer to the destination queue. */
+/**
+ * A world capture made by {@link SerializedBackupCoordinator#prepareCapture}. The caller hands it
+ * to {@link SerializedBackupCoordinator#createPreparedBackup}, which takes it over, or closes it,
+ * which deletes the capture. Until then the world counts as busy.
+ */
 public final class PreparedBackup implements AutoCloseable {
-    private final CreateBackupRequest request;
+    private final SerializedBackupCoordinator owner;
 
-    private final BackupId backupId;
+    private final CreateBackupRequest request;
 
     private final OperationId operationId;
 
-    private final boolean previousInventoryPresent;
-
-    private final AtomicReference<Resources> ownership;
+    private final AtomicReference<CapturedBackup> capture;
 
-    private final AtomicReference<Runnable> releaseObserver;
+    private final Runnable onClose;
 
     PreparedBackup(
+            SerializedBackupCoordinator owner,
             CreateBackupRequest request,
-            CapturedBackup capturedBackup,
-            boolean previousInventoryPresent,
             OperationId operationId,
-            Runnable releaseObserver) {
+            CapturedBackup capture,
+            Runnable onClose) {
+        this.owner = Objects.requireNonNull(owner, "owner");
         this.request = Objects.requireNonNull(request, "request");
-        CapturedBackup captured = Objects.requireNonNull(capturedBackup, "capturedBackup");
-        this.backupId = captured.capture().manifest().backupId();
         this.operationId = Objects.requireNonNull(operationId, "operationId");
-        this.previousInventoryPresent = previousInventoryPresent;
-        this.ownership = new AtomicReference<>(new Resources(captured));
-        this.releaseObserver = new AtomicReference<>(Objects.requireNonNull(
-                releaseObserver,
-                "releaseObserver"));
+        this.capture = new AtomicReference<>(Objects.requireNonNull(capture, "capture"));
+        this.onClose = Objects.requireNonNull(onClose, "onClose");
     }
 
     public CreateBackupRequest request() {
         return request;
     }
 
-    public BackupId backupId() {
-        return backupId;
-    }
-
-    boolean previousInventoryPresent() {
-        return previousInventoryPresent;
+    SerializedBackupCoordinator owner() {
+        return owner;
     }
 
     OperationId operationId() {
         return operationId;
     }
 
-    /** Adds an observer that runs once when this capture is claimed or closed. */
-    public void addReleaseObserver(Runnable observer) {
-        Runnable additional = Objects.requireNonNull(observer, "observer");
-        while (true) {
-            Runnable current = releaseObserver.get();
-            if (current == null) {
-                safeNotify(additional);
-                return;
-            }
-            Runnable chained = () -> {
-                try {
-                    current.run();
-                } finally {
-                    additional.run();
-                }
-            };
-            if (releaseObserver.compareAndSet(current, chained)) {
-                return;
-            }
+    /** Takes the capture over; the new owner also ends the world's busy state. */
+    CapturedBackup claim() {
+        CapturedBackup claimed = capture.getAndSet(null);
+        if (claimed == null) {
+            throw new IllegalStateException("The prepared capture was already used or closed");
         }
+        return claimed;
     }
 
-    Resources claim() {
-        Resources resources = ownership.getAndSet(null);
-        if (resources == null) {
-            throw new IllegalStateException("Prepared backup ownership was already transferred or closed");
-        }
-        try {
-            notifyReleased();
-        } catch (Error failure) {
-            try {
-                resources.close();
-            } catch (IOException closeFailure) {
-                failure.addSuppressed(closeFailure);
-            }
-            throw failure;
-        }
-        return resources;
-    }
-
+    /** Deletes the capture unless it was handed on; closing again does nothing. */
     @Override
     public void close() throws IOException {
-        Resources resources = ownership.getAndSet(null);
-        if (resources != null) {
+        CapturedBackup unclaimed = capture.getAndSet(null);
+        if (unclaimed != null) {
             try {
-                resources.close();
+                unclaimed.close();
             } finally {
-                notifyReleased();
+                onClose.run();
             }
         }
     }
-
-    private void notifyReleased() {
-        Runnable observer = releaseObserver.getAndSet(null);
-        if (observer != null) {
-            safeNotify(observer);
-        }
-    }
-
-    private static void safeNotify(Runnable observer) {
-        Observers.safely(observer);
-    }
-
-    record Resources(CapturedBackup capturedBackup) implements AutoCloseable {
-        Resources {
-            Objects.requireNonNull(capturedBackup, "capturedBackup");
-        }
-
-        @Override
-        public void close() throws IOException {
-            capturedBackup.close();
-        }
-    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/RestoreBackupRequest.java b/src/main/java/dev/ishaanko/worldarchive/core/RestoreBackupRequest.java
index 9cd9f7b..9c98e83 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/RestoreBackupRequest.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/RestoreBackupRequest.java
@@ -9,6 +9,9 @@ public record RestoreBackupRequest(
         BackupId sourceBackupId,
         Path worldsDirectory,
         String restoredWorldName) {
+    /** The longest restored folder name in UTF-16 units; the Restore screen's name box stops here too. */
+    public static final int MAXIMUM_NAME_LENGTH = 255;
+
     public RestoreBackupRequest {
         Objects.requireNonNull(sourceBackupId, "sourceBackupId");
         worldsDirectory = Objects.requireNonNull(worldsDirectory, "worldsDirectory")
@@ -16,7 +19,7 @@ public record RestoreBackupRequest(
                 .normalize();
         Objects.requireNonNull(restoredWorldName, "restoredWorldName");
         if (restoredWorldName.isBlank()
-                || restoredWorldName.length() > 255
+                || restoredWorldName.length() > MAXIMUM_NAME_LENGTH
                 || restoredWorldName.contains("/")
                 || restoredWorldName.contains("\\")
                 || restoredWorldName.equals(".")
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/RestoreBackupResult.java b/src/main/java/dev/ishaanko/worldarchive/core/RestoreBackupResult.java
index 14590ce..87e9b6b 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/RestoreBackupResult.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/RestoreBackupResult.java
@@ -1,17 +1,12 @@
 package dev.ishaanko.worldarchive.core;
 
-import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.nio.file.Path;
 import java.util.Objects;
 
 /** Result of a restore that always points to a fresh world copy. */
-public record RestoreBackupResult(
-        BackupId sourceBackupId,
-        WorldId restoredWorldId,
-        Path restoredWorldDirectory) {
+public record RestoreBackupResult(WorldId restoredWorldId, Path restoredWorldDirectory) {
     public RestoreBackupResult {
-        Objects.requireNonNull(sourceBackupId, "sourceBackupId");
         Objects.requireNonNull(restoredWorldId, "restoredWorldId");
         restoredWorldDirectory = Objects.requireNonNull(restoredWorldDirectory, "restoredWorldDirectory")
                 .toAbsolutePath()
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/SerializedBackupCoordinator.java b/src/main/java/dev/ishaanko/worldarchive/core/SerializedBackupCoordinator.java
index f12d0ab..a11c48f 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/SerializedBackupCoordinator.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/SerializedBackupCoordinator.java
@@ -3,773 +3,483 @@
 import dev.ishaanko.worldarchive.catalog.BackupCatalog;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.BackupOperation;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.BackupStatus;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
 import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationStatus;
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.OperationId;
+import dev.ishaanko.worldarchive.model.OperationPhase;
+import dev.ishaanko.worldarchive.model.OperationProgress;
+import dev.ishaanko.worldarchive.model.ProgressListener;
 import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
 import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.support.AsyncTasks;
+import dev.ishaanko.worldarchive.support.AsyncTasks.InterruptibleFuture;
+import dev.ishaanko.worldarchive.support.Observers;
 import java.io.IOException;
 import java.time.Clock;
 import java.time.Instant;
+import java.util.ArrayDeque;
 import java.util.ArrayList;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
+import java.util.Set;
 import java.util.concurrent.CancellationException;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CompletionStage;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
-import java.util.concurrent.CopyOnWriteArrayList;
 import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Future;
 import java.util.concurrent.RejectedExecutionException;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.concurrent.atomic.AtomicReference;
 
 /**
- * Create coordinator with FIFO per-world lanes and independent parallel destination attempts.
+ * Runs backups. A backup first copies its world into a private capture; only one capture of a
+ * world runs at a time. The selected destinations then write that capture in parallel while the
+ * world's operation gate keeps restore, delete and cleanup of the same world out. The backups of
+ * one world write in the order their captures finished; different worlds proceed independently.
+ * The result is recorded in the catalog.
  *
- * <p>Capture is the only phase allowed through {@link BackupCaptureGate}; every backend starts
- * after that gate has returned and consumes the same private source tree.</p>
+ * <p>Cancelling a returned stage stops a backup that captures or waits. While destinations write,
+ * a cancel interrupts them; a destination that already made a copy keeps it and it is recorded.
+ * Once recording starts, a cancel is refused and the backup completes normally.</p>
  */
-public final class SerializedBackupCoordinator implements BackupCoordinator {
+public final class SerializedBackupCoordinator {
+    private static final String WAITING_MESSAGE = "Waiting for the previous backup of this world";
+
     private final BackupCatalog catalog;
 
-    private final BackupCaptureFactory captureFactory;
+    private final FileSystemBackupCaptureFactory captureFactory;
 
-    private final WorldInventoryStore inventoryStore;
+    private final FileWorldInventoryStore inventoryStore;
 
     private final BackupDestinationSelector destinationSelector;
 
-    private final BackupMaintenanceService maintenanceService;
-
-    private final BackupCaptureGate captureGate;
-
     private final WorldOperationGate captureMutex;
 
     private final WorldOperationGate operationGate;
 
-    private final ExecutorService coordinatorExecutor;
+    private final ExecutorService executor;
 
     private final Clock clock;
 
-    private final ConcurrentMap<WorldId, WorldLane<CreateOperation>> lanes = new ConcurrentHashMap<>();
-
-    private final ConcurrentMap<WorldId, OperationProgress> capturePreparations = new ConcurrentHashMap<>();
-
-    public SerializedBackupCoordinator(
-            BackupCatalog catalog,
-            BackupCaptureFactory captureFactory,
-            WorldInventoryStore inventoryStore,
-            BackupDestinationSelector destinationSelector,
-            BackupMaintenanceService maintenanceService,
-            ExecutorService coordinatorExecutor,
-            Clock clock) {
-        this(
-                catalog,
-                captureFactory,
-                inventoryStore,
-                destinationSelector,
-                maintenanceService,
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate(),
-                new LockingWorldOperationGate(),
-                coordinatorExecutor,
-                clock);
-    }
-
-    public SerializedBackupCoordinator(
-            BackupCatalog catalog,
-            BackupCaptureFactory captureFactory,
-            WorldInventoryStore inventoryStore,
-            BackupDestinationSelector destinationSelector,
-            BackupMaintenanceService maintenanceService,
-            BackupCaptureGate captureGate,
-            WorldOperationGate operationGate,
-            ExecutorService coordinatorExecutor,
-            Clock clock) {
-        this(
-                catalog,
-                captureFactory,
-                inventoryStore,
-                destinationSelector,
-                maintenanceService,
-                captureGate,
-                new LockingWorldOperationGate(),
-                operationGate,
-                coordinatorExecutor,
-                clock);
-    }
+    /** Never removed, so every operation of a world finds the same lane. */
+    private final ConcurrentMap<WorldId, Lane> lanes = new ConcurrentHashMap<>();
 
+    /**
+     * Both gates may be shared with coordinators that replaced this one after a settings change:
+     * {@code captureMutex} admits one capture per world, and {@code operationGate} is the per-world
+     * gate that restore, delete and cleanup also enter.
+     */
     public SerializedBackupCoordinator(
             BackupCatalog catalog,
-            BackupCaptureFactory captureFactory,
-            WorldInventoryStore inventoryStore,
+            FileSystemBackupCaptureFactory captureFactory,
+            FileWorldInventoryStore inventoryStore,
             BackupDestinationSelector destinationSelector,
-            BackupMaintenanceService maintenanceService,
-            BackupCaptureGate captureGate,
             WorldOperationGate captureMutex,
             WorldOperationGate operationGate,
-            ExecutorService coordinatorExecutor,
+            ExecutorService executor,
             Clock clock) {
         this.catalog = Objects.requireNonNull(catalog, "catalog");
         this.captureFactory = Objects.requireNonNull(captureFactory, "captureFactory");
         this.inventoryStore = Objects.requireNonNull(inventoryStore, "inventoryStore");
         this.destinationSelector = Objects.requireNonNull(destinationSelector, "destinationSelector");
-        this.maintenanceService = Objects.requireNonNull(maintenanceService, "maintenanceService");
-        this.captureGate = Objects.requireNonNull(captureGate, "captureGate");
         this.captureMutex = Objects.requireNonNull(captureMutex, "captureMutex");
         this.operationGate = Objects.requireNonNull(operationGate, "operationGate");
-        this.coordinatorExecutor = Objects.requireNonNull(coordinatorExecutor, "coordinatorExecutor");
+        this.executor = Objects.requireNonNull(executor, "executor");
         this.clock = Objects.requireNonNull(clock, "clock");
     }
 
-    @Override
+    /**
+     * Captures the world on the calling thread, for a save hook that must copy the world right
+     * after a save; {@code kind} says whether the game still runs it. Waits while another capture
+     * of the same world runs. Interrupting the calling thread stops the capture.
+     */
     public PreparedBackup prepareCapture(
             CreateBackupRequest request,
-            CaptureProgressListener progressListener)
-            throws IOException, InterruptedException {
-        Objects.requireNonNull(request, "request");
-        Objects.requireNonNull(progressListener, "progressListener");
-        BackupId backupId = BackupId.create();
-        OperationId operationId = OperationId.create();
-        OperationProgress queued = progressFor(
-                operationId,
-                request.worldId(),
-                backupId,
-                OperationPhase.QUEUED,
-                0,
-                0,
-                "Waiting for another world capture");
-        if (capturePreparations.putIfAbsent(request.worldId(), queued) != null) {
-            throw new IllegalStateException("A synchronous capture is already pending for this world");
-        }
-        CapturedBackup captured = null;
-        boolean transferred = false;
-        try (WorldOperationGate.Permit ignored = captureMutex.enter(request.worldId())) {
-            capturePreparations.put(request.worldId(), progressFor(
-                    operationId,
-                    request.worldId(),
-                    backupId,
-                    OperationPhase.PREPARING,
-                    0,
-                    0,
-                    "Preparing private world capture"));
-            Optional<WorldInventory> previous = loadInventoryOrFallback(request.worldId(), () ->
-                    capturePreparations.put(request.worldId(), progressFor(
-                            operationId,
-                            request.worldId(),
-                            backupId,
-                            OperationPhase.PREPARING,
-                            0,
-                            0,
-                            "Change inventory is unavailable; capturing a full baseline")));
-            captured = captureFactory.capture(
-                    request,
-                    backupId,
-                    clock.instant(),
-                    previous,
-                    (completed, total) -> {
-                        capturePreparations.put(request.worldId(), progressFor(
-                                operationId,
-                                request.worldId(),
-                                backupId,
-                                OperationPhase.READING,
-                                completed,
-                                total,
-                                "Capturing world files"));
-                        progressListener.onProgress(completed, total);
-                    });
-            capturePreparations.put(request.worldId(), progressFor(
-                    operationId,
-                    request.worldId(),
-                    backupId,
-                    OperationPhase.PREPARING,
-                    1,
-                    1,
-                    "Private capture prepared"));
+            CaptureKind kind,
+            ProgressListener progressListener) throws IOException, InterruptedException {
+        Progress progress = new Progress(
+                OperationId.create(), request.worldId(), BackupId.create(), progressListener);
+        Lane lane = lane(request.worldId());
+        lane.register(progress.operationId);
+        boolean handedOver = false;
+        try {
+            CapturedBackup captured = capture(request, kind, progress);
             PreparedBackup prepared = new PreparedBackup(
-                    request,
-                    captured,
-                    previous.isPresent(),
-                    operationId,
-                    () -> capturePreparations.remove(request.worldId()));
-            transferred = true;
+                    this, request, progress.operationId, captured, () -> lane.unregister(progress.operationId));
+            handedOver = true;
             return prepared;
         } finally {
-            if (!transferred) {
-                capturePreparations.remove(request.worldId());
-                if (captured != null) {
-                    captured.close();
-                }
+            if (!handedOver) {
+                lane.unregister(progress.operationId);
             }
         }
     }
 
-    @Override
+    /** Queues destination work for a capture from {@link #prepareCapture}; the backup owns it from here on. */
     public CompletionStage<BackupResult> createPreparedBackup(
-            PreparedBackup preparedBackup,
+            PreparedBackup prepared,
             ProgressListener progressListener) {
-        Objects.requireNonNull(preparedBackup, "preparedBackup");
         Objects.requireNonNull(progressListener, "progressListener");
-        PreparedBackup.Resources resources = preparedBackup.claim();
-        CapturedBackup captured = resources.capturedBackup();
+        CapturedBackup captured;
         try {
-            validatePrepared(preparedBackup.request(), captured.capture().manifest());
-            DestinationPlan plan = selectDestinations(preparedBackup.request());
-            if (plan.backends().isEmpty()) {
-                BackupResult skipped = BackupResult.aggregate(
-                        captured.capture().manifest().backupId(),
-                        preparedBackup.request().worldId(),
-                        List.of(),
-                        completionTime(captured.capture().manifest()));
-                resources.close();
-                return CompletableFuture.completedFuture(skipped);
+            if (prepared.owner() != this) {
+                throw new IllegalArgumentException("The prepared capture belongs to another coordinator");
             }
-            CreateOperation operation = new CreateOperation(
-                    preparedBackup.request(),
-                    plan,
-                    captured.capture().manifest().backupId(),
-                    preparedBackup.operationId(),
-                    false,
-                    captured,
-                    preparedBackup.previousInventoryPresent(),
-                    progressListener);
-            return enqueue(operation);
-        } catch (IOException | RuntimeException exception) {
-            closeAfterFailure(resources, exception);
+            captured = prepared.claim();
+        } catch (RuntimeException exception) {
+            return CompletableFuture.failedFuture(exception);
+        }
+        CreateBackupRequest request = prepared.request();
+        BackupId backupId = captured.capture().manifest().backupId();
+        Progress progress = new Progress(prepared.operationId(), request.worldId(), backupId, progressListener);
+        List<BackupBackend> backends;
+        try {
+            backends = selectDestinations(request);
+        } catch (RuntimeException exception) {
+            discard(captured, progress, exception);
             return CompletableFuture.failedFuture(exception);
         }
+        if (backends.isEmpty()) {
+            discard(captured, progress, null);
+            return CompletableFuture.completedFuture(skipped(progress.backupId, request));
+        }
+        Operation operation = new Operation(request, progress, backends);
+        enqueue(operation, captured);
+        return operation.result;
     }
 
-    @Override
+    /** Captures a world that no game runs on a worker, then queues destination work. */
     public CompletionStage<BackupResult> createBackup(
             CreateBackupRequest request,
             ProgressListener progressListener) {
-        Objects.requireNonNull(request, "request");
-        Objects.requireNonNull(progressListener, "progressListener");
-        final DestinationPlan plan;
+        Progress progress = new Progress(
+                OperationId.create(), request.worldId(), BackupId.create(), progressListener);
+        List<BackupBackend> backends;
         try {
-            plan = selectDestinations(request);
+            backends = selectDestinations(request);
         } catch (RuntimeException exception) {
             return CompletableFuture.failedFuture(exception);
         }
-        BackupId backupId = BackupId.create();
-        if (plan.backends().isEmpty()) {
-            return CompletableFuture.completedFuture(BackupResult.aggregate(
-                    backupId,
-                    request.worldId(),
-                    List.of(),
-                    clock.instant()));
-        }
-        return enqueue(new CreateOperation(
-                request,
-                plan,
-                backupId,
-                OperationId.create(),
-                true,
-                null,
-                false,
-                progressListener));
+        if (backends.isEmpty()) {
+            return CompletableFuture.completedFuture(skipped(progress.backupId, request));
+        }
+        Operation operation = new Operation(request, progress, backends);
+        operation.lane.register(progress.operationId);
+        InterruptibleFuture<CapturedBackup> capturing = AsyncTasks.supplyInterruptible(
+                executor, () -> capture(request, CaptureKind.CLOSED_WORLD, progress));
+        operation.attach(capturing);
+        capturing.whenComplete((captured, failure) -> {
+            if (failure == null) {
+                enqueue(operation, captured);
+            } else {
+                finish(operation, null, failure);
+            }
+        });
+        return operation.result;
     }
 
-    @Override
-    public Optional<OperationProgress> currentOperation(WorldId worldId) {
-        Objects.requireNonNull(worldId, "worldId");
-        OperationProgress preparation = capturePreparations.get(worldId);
-        if (preparation != null && preparation.phase() != OperationPhase.QUEUED) {
-            return Optional.of(preparation);
-        }
-        WorldLane<CreateOperation> lane = lanes.get(worldId);
-        if (lane != null) {
-            synchronized (lane) {
-                if (lane.active != null) {
-                    return Optional.ofNullable(lane.active.progress.get());
-                }
-            }
-        }
-        return Optional.ofNullable(preparation);
+    /** True while a backup of the world captures, waits, writes, or records. */
+    public boolean isBusy(WorldId worldId) {
+        Lane lane = lanes.get(Objects.requireNonNull(worldId, "worldId"));
+        return lane != null && lane.busy();
     }
 
-    /** Non-create operations composed with this coordinator; exposed for direct routing by callers. */
-    public BackupMaintenanceService maintenanceService() {
-        return maintenanceService;
+    /**
+     * Completes once no backup of the world captures, waits, writes, or records. A cancelled
+     * backup's stage completes before its workers have stopped; this stage completes after they
+     * have, so a caller that must not change destination folders under a backup waits for it.
+     */
+    public CompletionStage<Void> whenIdle(WorldId worldId) {
+        Lane lane = lanes.get(Objects.requireNonNull(worldId, "worldId"));
+        return lane == null ? CompletableFuture.completedFuture(null) : lane.whenIdle();
     }
 
-    private CompletionStage<BackupResult> enqueue(CreateOperation operation) {
-        WorldLane<CreateOperation> lane = lanes.computeIfAbsent(
-                operation.request.worldId(), ignored -> new WorldLane<>());
-        operation.lane = lane;
-        CreateOperation start = null;
-        synchronized (lane) {
-            if (operation.coalescible) {
-                CreateOperation compatible = compatibleOperation(lane, operation);
-                if (compatible != null) {
-                    compatible.listeners.addAll(operation.listeners);
-                    OperationProgress current = compatible.progress.get();
-                    if (current != null) {
-                        safeNotify(operation.listeners.getFirst(), current);
-                    }
-                    return compatible.result;
-                }
-            }
-            lane.queue.addLast(operation);
-            report(operation, OperationPhase.QUEUED, 0, 0, "Backup queued");
-            if (lane.active == null) {
-                start = activateNext(lane);
-            }
-        }
-        if (start != null) {
-            startOperation(start);
-        }
-        return operation.result;
+    private Lane lane(WorldId worldId) {
+        return lanes.computeIfAbsent(worldId, ignored -> new Lane());
     }
 
-    private static CreateOperation compatibleOperation(
-            WorldLane<CreateOperation> lane,
-            CreateOperation requested) {
-        if (lane.active != null && lane.active.isCompatibleWith(requested)) {
-            return lane.active;
-        }
-        CreateOperation queued = lane.queue.peekLast();
-        if (queued != null && queued.isCompatibleWith(requested)) {
-            return queued;
+    private CapturedBackup capture(CreateBackupRequest request, CaptureKind kind, Progress progress)
+            throws IOException, InterruptedException {
+        progress.report(OperationPhase.PREPARING, 0, 0, "Preparing private world capture");
+        try (WorldOperationGate.Permit ignored = captureMutex.enter(request.worldId())) {
+            Optional<WorldInventory> previous = previousInventory(request.worldId(), progress);
+            return captureFactory.capture(
+                    request,
+                    kind,
+                    progress.backupId,
+                    clock.instant(),
+                    previous,
+                    (completed, total) -> progress.report(
+                            OperationPhase.READING, completed, total, "Capturing world files"));
         }
-        return null;
     }
 
-    private static CreateOperation activateNext(WorldLane<CreateOperation> lane) {
-        CreateOperation next = lane.queue.pollFirst();
-        lane.active = next;
-        return next;
+    /** The last recorded inventory; without one, every file counts as changed. */
+    private Optional<WorldInventory> previousInventory(WorldId worldId, Progress progress) {
+        try {
+            return inventoryStore.load(worldId);
+        } catch (IOException exception) {
+            progress.report(OperationPhase.PREPARING, 0, 0,
+                    "Change inventory is unavailable; capturing a full baseline");
+            return Optional.empty();
+        }
     }
 
-    private void startOperation(CreateOperation operation) {
-        report(operation, OperationPhase.PREPARING, 0, 0, "Preparing private world capture");
-        try {
-            Future<?> worker = coordinatorExecutor.submit(() -> {
-                operation.workerStarted.set(true);
-                execute(operation);
-            });
-            operation.worker.set(worker);
-            if (operation.cancelled.get()) {
-                boolean preventedStart = worker.cancel(operation.interruptRequested.get());
-                if (preventedStart && !operation.workerStarted.get()) {
-                    finish(operation, null, new CancellationException("Backup was cancelled"));
-                }
+    /**
+     * Starts the operation's destination work, or queues it behind the backup of the same world
+     * that is writing. The waiting report comes first, so it never follows the writing report.
+     */
+    private void enqueue(Operation operation, CapturedBackup captured) {
+        Lane lane = operation.lane;
+        if (lane.hasWriter()) {
+            operation.progress.report(OperationPhase.QUEUED, 0, 0, WAITING_MESSAGE);
+        }
+        boolean cancelled;
+        boolean writeNow = false;
+        synchronized (lane) {
+            operation.capture = captured;
+            cancelled = operation.cancelRequested;
+            if (!cancelled && lane.writer == null) {
+                lane.writer = operation;
+                operation.stage = Stage.WRITING;
+                writeNow = true;
+            } else if (!cancelled) {
+                lane.waiting.addLast(operation);
+                operation.stage = Stage.WAITING;
             }
-        } catch (RejectedExecutionException exception) {
-            finish(operation, null, exception);
+        }
+        if (cancelled) {
+            finish(operation, null, cancellation());
+        } else if (writeNow) {
+            startWriting(operation);
         }
     }
 
-    private void execute(CreateOperation operation) {
-        try {
-            if (operation.cancelled.get()) {
-                throw new CancellationException("Backup was cancelled");
-            }
-            if (operation.permit.get() == null) {
-                WorldOperationGate.Permit permit = operationGate.enter(operation.request.worldId());
-                if (!operation.permit.compareAndSet(null, permit)) {
-                    permit.close();
-                    throw new IllegalStateException("Backup operation already owns a world permit");
-                }
-            }
-            CapturedBackup captured = operation.capture.get();
-            if (captured == null) {
-                try (WorldOperationGate.Permit ignored = captureMutex.enter(
-                        operation.request.worldId())) {
-                    Optional<WorldInventory> previous = loadInventoryOrFallback(
-                            operation.request.worldId(), () -> report(
-                                    operation,
-                                    OperationPhase.PREPARING,
-                                    0,
-                                    0,
-                                    "Change inventory is unavailable; capturing a full baseline"));
-                    operation.previousInventoryPresent = previous.isPresent();
-                    captured = captureGate.capture(() -> captureFactory.capture(
-                            operation.request,
-                            operation.backupId,
-                            clock.instant(),
-                            previous,
-                            (completed, total) -> report(
-                                    operation,
-                                    OperationPhase.READING,
-                                    completed,
-                                    total,
-                                    "Capturing world files")));
-                }
-                if (!operation.capture.compareAndSet(null, captured)) {
-                    captured.close();
-                    throw new IllegalStateException("Backup operation already owns a private capture");
-                }
-            }
-            if (operation.cancelled.get()) {
-                throw new CancellationException("Backup was cancelled");
-            }
-            BackupManifest manifest = captured.capture().manifest();
-            if (operation.request.trigger() == BackupTrigger.SCHEDULED
-                    && operation.previousInventoryPresent
-                    && manifest.changedFileCount() == 0) {
-                List<DestinationResult> skipped = operation.plan.backends().stream()
-                        .map(backend -> DestinationResult.skipped(
-                                backend.destinationType(),
-                                "World is unchanged"))
-                        .toList();
-                finish(
-                        operation,
-                        BackupResult.aggregate(
-                                operation.backupId,
-                                operation.request.worldId(),
-                                skipped,
-                                completionTime(manifest)),
-                        null);
-                return;
+    private void startWriting(Operation operation) {
+        InterruptibleFuture<WorldOperationGate.Permit> entering = AsyncTasks.supplyInterruptible(
+                executor, () -> operationGate.enter(operation.request.worldId()));
+        operation.attach(entering);
+        entering.whenComplete((permit, failure) -> {
+            if (failure == null) {
+                writeDestinations(operation, permit);
+            } else {
+                finish(operation, null, failure);
             }
-            startDestinations(operation, captured);
-        } catch (Throwable throwable) {
-            finish(operation, null, throwable);
-        }
+        });
     }
 
-    private void startDestinations(
-            CreateOperation operation,
-            CapturedBackup captured) {
-        synchronized (operation) {
-            if (operation.cancelled.get()) {
-                finish(operation, null, new CancellationException("Backup was cancelled"));
+    /** Starts one worker per destination; each can be interrupted and still reports the copy it made. */
+    private void writeDestinations(Operation operation, WorldOperationGate.Permit permit) {
+        try {
+            BackupCapture capture = operation.admit(permit);
+            if (capture == null) {
+                finish(operation, null, cancellation());
                 return;
             }
-        }
-        if (operation.terminal.get()) {
-            return;
-        }
-        report(
-                operation,
-                OperationPhase.WRITING,
-                0,
-                captured.capture().manifest().sourceByteCount(),
-                DestinationProgressAggregator.WRITING_MESSAGE);
-        DestinationProgressAggregator aggregator = new DestinationProgressAggregator(
-                operation.plan.backends().stream().map(BackupBackend::destinationType).toList(),
-                captured.capture().manifest().sourceByteCount());
-        List<CompletableFuture<DestinationResult>> outcomes = new ArrayList<>(operation.plan.backends().size());
-        for (BackupBackend backend : operation.plan.backends()) {
-            DestinationType expectedDestination = backend.destinationType();
-            CompletableFuture<DestinationResult> source;
-            try {
-                CompletionStage<DestinationResult> stage = Objects.requireNonNull(
-                        backend.createBackup(
-                                captured.capture(),
-                                progress -> forwardDestinationProgress(
-                                        operation,
-                                        aggregator,
-                                        expectedDestination,
-                                        progress)),
-                        "Backup backend returned a null stage");
-                source = stage.toCompletableFuture();
-            } catch (Throwable throwable) {
-                source = CompletableFuture.failedFuture(throwable);
-            }
-            operation.destinationTasks.add(source);
-            if (operation.cancelled.get()) {
-                // A cancellation that raced this loop already stopped the earlier tasks.
-                stopDestination(source, operation.interruptRequested.get());
+            long total = capture.manifest().sourceByteCount();
+            operation.progress.report(
+                    OperationPhase.WRITING, 0, total, DestinationProgressAggregator.WRITING_MESSAGE);
+            DestinationProgressAggregator aggregator = new DestinationProgressAggregator(
+                    operation.backends.stream().map(BackupBackend::destinationType).toList(), total);
+            List<CompletableFuture<DestinationResult>> outcomes = new ArrayList<>(operation.backends.size());
+            for (BackupBackend backend : operation.backends) {
+                DestinationType destination = backend.destinationType();
+                InterruptibleFuture<DestinationResult> write = AsyncTasks.supplyInterruptible(
+                        executor,
+                        () -> backend.createBackup(capture, progress -> forwardDestinationProgress(
+                                operation, aggregator, destination, progress)));
+                operation.addDestination(write);
+                outcomes.add(write.handle(
+                        (result, failure) -> destinationOutcome(destination, result, failure)));
             }
-            outcomes.add(source.handle((result, throwable) -> destinationOutcome(
-                    expectedDestination,
-                    result,
-                    throwable)));
+            CompletableFuture.allOf(outcomes.toArray(CompletableFuture[]::new))
+                    .whenComplete((ignored, failure) -> commitOnExecutor(operation, outcomes));
+        } catch (Throwable throwable) {
+            // A continuation must always release the permit and the lane.
+            finish(operation, null, throwable);
         }
-        CompletableFuture.allOf(outcomes.toArray(CompletableFuture[]::new))
-                .whenComplete((ignored, throwable) -> finalizeDestinations(operation, outcomes));
     }
 
     /**
-     * Records what the destinations produced. Recording is the point of no return: a
-     * cancellation that arrives later is refused. A cancellation that arrived while the
-     * destinations wrote still records any destination that had already finished, so a
-     * complete artifact is never left out of the catalog.
+     * Records the outcomes on a coordinator worker, never on the destination worker that
+     * finished last: a cancelled write can leave that thread interrupted, and file locks fail on
+     * an interrupted thread, so the record of a finished copy would be lost.
      */
-    private void finalizeDestinations(
-            CreateOperation operation,
-            List<CompletableFuture<DestinationResult>> outcomes) {
-        synchronized (operation) {
-            operation.cancellationState.compareAndSet(
-                    CancellationState.CANCELLABLE,
-                    CancellationState.COMMITTING);
-        }
-        boolean cancelled = operation.cancelled.get();
+    private void commitOnExecutor(Operation operation, List<CompletableFuture<DestinationResult>> outcomes) {
         try {
-            List<DestinationResult> destinations = outcomes.stream()
-                    .map(CompletableFuture::join)
-                    .toList();
-            BackupManifest manifest = Objects.requireNonNull(operation.capture.get(), "capture")
-                    .capture()
-                    .manifest();
-            BackupResult result = BackupResult.aggregate(
-                    operation.backupId,
-                    operation.request.worldId(),
-                    destinations,
-                    completionTime(manifest));
-            if (hasDurableDestination(destinations)) {
-                report(
-                        operation,
-                        OperationPhase.PUBLISHING,
-                        manifest.sourceByteCount(),
-                        manifest.sourceByteCount(),
-                        "Recording backup metadata");
-                catalog.add(new BackupRecord(manifest, result));
-                try {
-                    inventoryStore.save(
-                            operation.request.worldId(),
-                            operation.capture.get().inventory());
-                } catch (IOException exception) {
-                    report(
-                            operation,
-                            OperationPhase.PUBLISHING,
-                            manifest.sourceByteCount(),
-                            manifest.sourceByteCount(),
-                            "Backup complete; change inventory could not be updated");
-                }
+            executor.execute(() -> commit(operation, outcomes));
+        } catch (RejectedExecutionException exception) {
+            // The game is closing. Recording here beats losing a finished copy.
+            commit(operation, outcomes);
+        }
+    }
+
+    /** Records every destination that made a copy, even when the backup was cancelled meanwhile. */
+    private void commit(Operation operation, List<CompletableFuture<DestinationResult>> outcomes) {
+        try {
+            boolean cancelled = operation.beginCommit();
+            BackupCapture capture = operation.capture();
+            BackupManifest manifest = capture.manifest();
+            List<DestinationResult> destinations = outcomes.stream().map(CompletableFuture::join).toList();
+            BackupResult result = new BackupResult(
+                    manifest.backupId(), operation.request.worldId(), destinations, completionTime(manifest));
+            if (destinations.stream().anyMatch(DestinationResult::isDurable)) {
+                record(operation, capture, result);
             }
             if (cancelled) {
-                finish(operation, null, new CancellationException("Backup was cancelled"));
-                return;
+                finish(operation, null, cancellation());
+            } else {
+                finish(operation, result, null);
             }
-            finish(operation, result, null);
         } catch (Throwable throwable) {
+            // A continuation must always release the permit and the lane.
             finish(operation, null, throwable);
         }
     }
 
-    private void cancel(CreateOperation operation, boolean mayInterrupt) {
-        operation.cancelled.set(true);
-        operation.interruptRequested.compareAndSet(false, mayInterrupt);
-        WorldLane<CreateOperation> lane = operation.lane;
-        boolean queued = false;
-        if (lane != null) {
-            synchronized (lane) {
-                if (lane.active != operation) {
-                    queued = lane.queue.remove(operation);
-                    if (lane.active == null && lane.queue.isEmpty()) {
-                        lanes.remove(operation.request.worldId(), lane);
-                    }
-                }
-            }
-        }
-        if (queued) {
-            finish(operation, null, new CancellationException("Queued backup was cancelled"));
-            return;
-        }
-        Future<?> worker = operation.worker.get();
-        if (worker != null) {
-            boolean preventedStart = worker.cancel(mayInterrupt);
-            if (preventedStart && !operation.workerStarted.get()) {
-                finish(operation, null, new CancellationException("Backup was cancelled"));
-                return;
-            }
+    private void record(Operation operation, BackupCapture capture, BackupResult result) throws IOException {
+        long bytes = capture.manifest().sourceByteCount();
+        operation.progress.report(OperationPhase.PUBLISHING, bytes, bytes, "Recording backup metadata");
+        try {
+            catalog.add(new BackupRecord(capture.manifest(), result));
+        } catch (IOException exception) {
+            throw new IOException("The backup was saved, but WorldArchive could not add it to its backup list ("
+                    + exception.getMessage() + "). It appears in the list after the game restarts.", exception);
         }
-        for (CompletableFuture<?> destination : operation.destinationTasks) {
-            stopDestination(destination, mayInterrupt);
+        try {
+            inventoryStore.save(operation.request.worldId(), capture.inventory());
+        } catch (IOException exception) {
+            // The backup is recorded; the next backup of this world counts every file as changed.
+            operation.progress.report(OperationPhase.PUBLISHING, bytes, bytes,
+                    "Backup complete; change inventory could not be updated");
         }
     }
 
     /**
-     * Stops one destination's work. A destination that can be interrupted keeps its own
-     * outcome, so a snapshot it already published is still recorded; any other stage is
-     * cancelled outright.
+     * Ends the operation once: deletes its capture, releases its permit and its place in the lane,
+     * reports and completes its stage, and starts the next backup of the world.
      */
-    private static void stopDestination(CompletableFuture<?> destination, boolean mayInterrupt) {
-        if (destination instanceof AsyncTasks.InterruptibleFuture<?> interruptible) {
-            interruptible.stop(mayInterrupt);
-        } else {
-            destination.cancel(mayInterrupt);
+    private void finish(Operation operation, BackupResult result, Throwable failure) {
+        Lane lane = operation.lane;
+        CapturedBackup capture;
+        WorldOperationGate.Permit permit;
+        Operation next = null;
+        List<CompletableFuture<Void>> idle;
+        synchronized (lane) {
+            if (operation.stage == Stage.DONE) {
+                return;
+            }
+            operation.stage = Stage.DONE;
+            capture = operation.capture;
+            operation.capture = null;
+            permit = operation.permit;
+            operation.permit = null;
+            idle = lane.remove(operation.progress.operationId);
+            lane.waiting.remove(operation);
+            if (lane.writer == operation) {
+                next = lane.waiting.pollFirst();
+                lane.writer = next;
+                if (next != null) {
+                    next.stage = Stage.WRITING;
+                }
+            }
         }
-    }
-
-    private void finish(
-            CreateOperation operation,
-            BackupResult result,
-            Throwable failure) {
-        if (!operation.terminal.compareAndSet(false, true)) {
-            return;
+        release(capture, failure);
+        if (permit != null) {
+            permit.close();
         }
-        Throwable terminalFailure = releaseOperationResources(operation, failure, result != null);
-        reportTerminalProgress(operation, result, terminalFailure);
-        CreateOperation next = releaseLane(operation);
-        completeOperation(operation, result, terminalFailure);
+        if (failure == null) {
+            reportCompleted(operation, result);
+            operation.result.complete(result);
+        } else {
+            // A cancelled operation is silenced, so this reports real failures only.
+            operation.progress.report(OperationPhase.FAILED, 0, 0, "Backup could not be completed");
+            operation.result.completeExceptionally(failure);
+        }
+        // Waiters learn that the world is idle only once its capture is deleted and its permit released.
+        idle.forEach(waiter -> waiter.complete(null));
         if (next != null) {
-            startOperation(next);
+            startWriting(next);
         }
     }
 
     /**
-     * Releases the capture and the world permit. Once a result exists the backup is recorded,
-     * so a failure while releasing must not turn that success into a reported failure.
+     * Deletes the capture. When the backup succeeded, a folder that could not be deleted does not
+     * turn it into a failure; the next game start removes it.
      */
-    private static Throwable releaseOperationResources(
-            CreateOperation operation,
-            Throwable failure,
-            boolean recorded) {
-        Throwable terminalFailure = failure;
-        CapturedBackup captured = operation.capture.getAndSet(null);
-        if (captured != null) {
-            try {
-                captured.close();
-            } catch (IOException exception) {
-                if (terminalFailure != null) {
-                    terminalFailure.addSuppressed(exception);
-                }
-            }
+    private static void release(CapturedBackup capture, Throwable failure) {
+        if (capture == null) {
+            return;
         }
-        WorldOperationGate.Permit permit = operation.permit.getAndSet(null);
-        if (permit != null) {
-            try {
-                permit.close();
-            } catch (RuntimeException exception) {
-                if (terminalFailure != null) {
-                    terminalFailure.addSuppressed(exception);
-                } else if (!recorded) {
-                    terminalFailure = exception;
-                }
+        try {
+            capture.close();
+        } catch (IOException exception) {
+            if (failure != null) {
+                failure.addSuppressed(exception);
             }
         }
-        return terminalFailure;
     }
 
-    private void reportTerminalProgress(
-            CreateOperation operation,
-            BackupResult result,
-            Throwable terminalFailure) {
-        if (terminalFailure == null && result.status() != BackupStatus.FAILED) {
-            report(operation, OperationPhase.COMPLETE, 1, 1, completionMessage(result));
-        } else if (terminalFailure == null) {
-            report(operation, OperationPhase.FAILED, 0, 0, completionMessage(result));
-        } else if (!operation.cancelled.get()) {
-            report(operation, OperationPhase.FAILED, 0, 0, "Backup could not be completed");
-        }
+    /** Ends a claimed capture that never became an operation. */
+    private void discard(CapturedBackup captured, Progress progress, Throwable failure) {
+        release(captured, failure);
+        lane(progress.worldId).unregister(progress.operationId);
     }
 
-    private CreateOperation releaseLane(CreateOperation operation) {
-        CreateOperation next = null;
-        WorldLane<CreateOperation> lane = operation.lane;
-        if (lane != null) {
-            synchronized (lane) {
-                if (lane.active == operation) {
-                    lane.active = null;
-                    if (!lane.queue.isEmpty()) {
-                        next = activateNext(lane);
-                    } else {
-                        lanes.remove(operation.request.worldId(), lane);
-                    }
-                }
-            }
-        }
-        return next;
-    }
-
-    private static void completeOperation(
-            CreateOperation operation,
-            BackupResult result,
-            Throwable terminalFailure) {
-        if (!operation.result.isCancelled()) {
-            if (terminalFailure == null) {
-                operation.result.complete(result);
-            } else {
-                operation.result.completeExceptionally(terminalFailure);
-            }
+    private static void reportCompleted(Operation operation, BackupResult result) {
+        Progress progress = operation.progress;
+        switch (result.status()) {
+            case SUCCESS -> progress.report(OperationPhase.COMPLETE, 1, 1, "Backup complete");
+            case PARTIAL_SUCCESS ->
+                    progress.report(OperationPhase.COMPLETE, 1, 1, "Backup complete with warnings");
+            case SKIPPED -> progress.report(OperationPhase.COMPLETE, 1, 1, "Backup skipped");
+            case FAILED -> progress.report(OperationPhase.FAILED, 0, 0, "Backup destinations failed");
+            default -> throw new IllegalStateException("Unknown backup status: " + result.status());
         }
     }
 
     /**
-     * Reports the progress of one destination.
-     *
-     * <p>While more than one destination writes, the progress of all of them is combined into one
-     * stream. The phase and the message of a single backend must not reach the listeners then,
-     * because a backend that completes first would look like the whole backup is complete.</p>
+     * Reports one destination's progress. While more than one destination writes, their progress
+     * is combined into one stream, so a destination that finishes first cannot make the whole
+     * backup look complete. A single destination's own phases are passed on, except that its end
+     * is still part of writing: recording follows.
      */
-    private void forwardDestinationProgress(
-            CreateOperation operation,
+    private static void forwardDestinationProgress(
+            Operation operation,
             DestinationProgressAggregator aggregator,
             DestinationType destination,
             OperationProgress progress) {
-        if (operation.cancelled.get()) {
-            return;
-        }
         if (aggregator.aggregates()) {
-            report(
-                    operation,
+            operation.progress.report(
                     OperationPhase.WRITING,
                     aggregator.accept(destination, progress),
                     aggregator.totalUnits(),
                     DestinationProgressAggregator.WRITING_MESSAGE);
             return;
         }
-        report(
-                operation,
-                progress.phase(),
+        boolean destinationDone = progress.phase() == OperationPhase.COMPLETE
+                || progress.phase() == OperationPhase.FAILED;
+        operation.progress.report(
+                destinationDone ? OperationPhase.WRITING : progress.phase(),
                 progress.completedUnits(),
                 progress.totalUnits(),
                 SensitiveDataRedactor.redact(progress.message()));
     }
 
-    /** Loads the previous inventory, falling back to an empty baseline (and notifying via {@code onUnavailable}) on IOException. */
-    private Optional<WorldInventory> loadInventoryOrFallback(WorldId worldId, Runnable onUnavailable) {
-        try {
-            return inventoryStore.load(worldId);
-        } catch (IOException exception) {
-            onUnavailable.run();
-            return Optional.empty();
-        }
-    }
-
-    private static OperationProgress progressFor(
-            OperationId operationId,
-            WorldId worldId,
-            BackupId backupId,
-            OperationPhase phase,
-            long completed,
-            long total,
-            String message) {
-        return new OperationProgress(
-                operationId,
-                worldId,
-                Optional.of(backupId),
-                BackupOperation.CREATE,
-                phase,
-                completed,
-                total,
-                message);
-    }
-
-    private void report(
-            CreateOperation operation,
-            OperationPhase phase,
-            long completed,
-            long total,
-            String message) {
-        OperationProgress progress = progressFor(
-                operation.operationId,
-                operation.request.worldId(),
-                operation.backupId,
-                phase,
-                completed,
-                total,
-                message);
-        operation.progress.set(progress);
-        for (ProgressListener listener : operation.listeners) {
-            safeNotify(listener, progress);
+    private List<BackupBackend> selectDestinations(CreateBackupRequest request) {
+        List<BackupBackend> backends = List.copyOf(destinationSelector.select(request));
+        if (backends.stream().map(BackupBackend::destinationType).distinct().count() != backends.size()) {
+            throw new IllegalStateException("Each destination may be selected only once");
         }
+        return backends;
     }
 
-    private DestinationPlan selectDestinations(CreateBackupRequest request) {
-        return new DestinationPlan(destinationSelector.select(request));
+    private BackupResult skipped(BackupId backupId, CreateBackupRequest request) {
+        return new BackupResult(backupId, request.worldId(), List.of(), clock.instant());
     }
 
     private Instant completionTime(BackupManifest manifest) {
@@ -777,159 +487,262 @@ private Instant completionTime(BackupManifest manifest) {
         return now.isBefore(manifest.createdAt()) ? manifest.createdAt() : now;
     }
 
-    private static void validatePrepared(
-            CreateBackupRequest request,
-            BackupManifest manifest) {
-        if (!manifest.worldId().equals(request.worldId())
-                || !manifest.worldName().equals(request.worldName())
-                || !manifest.label().equals(request.label())
-                || manifest.trigger() != request.trigger()) {
-            throw new IllegalArgumentException("Prepared capture does not match its create request");
-        }
-    }
-
     private static DestinationResult destinationOutcome(
-            DestinationType expectedDestination,
+            DestinationType destination,
             DestinationResult result,
-            Throwable throwable) {
-        if (throwable instanceof CancellationException) {
-            return DestinationResult.failed(
-                    expectedDestination,
-                    "Cancelled before this destination finished");
+            Throwable failure) {
+        if (failure instanceof CancellationException || failure instanceof InterruptedException) {
+            return DestinationResult.failed(destination, "Cancelled before this destination finished");
         }
-        if (throwable != null || result == null || result.destination() != expectedDestination) {
+        if (failure != null || result == null || result.destination() != destination) {
             return DestinationResult.failed(
-                    expectedDestination,
-                    "Destination failed before a trustworthy result was available");
+                    destination, "Destination failed before a trustworthy result was available");
         }
         return result;
     }
 
-    private static boolean hasDurableDestination(List<DestinationResult> destinations) {
-        return destinations.stream().anyMatch(result -> result.status() == DestinationStatus.SUCCESS
-                || result.status() == DestinationStatus.PENDING_SYNC);
+    private static CancellationException cancellation() {
+        return new CancellationException("Backup was cancelled");
     }
 
-    private static String completionMessage(BackupResult result) {
-        return switch (result.status()) {
-            case SUCCESS -> "Backup complete";
-            case PARTIAL_SUCCESS -> "Backup complete with warnings";
-            case FAILED -> "Backup destinations failed";
-            case SKIPPED -> "Backup skipped";
-        };
+    /** Where an operation is; every stage but DONE counts as busy. */
+    private enum Stage {
+        CAPTURING,
+        WAITING,
+        WRITING,
+        COMMITTING,
+        DONE
     }
 
-    private static void safeNotify(
-            ProgressListener listener,
-            OperationProgress progress) {
-        Observers.safely(() -> listener.onProgress(progress));
-    }
+    /**
+     * One world's unfinished operations: the backup whose destinations write and the captured
+     * backups that wait behind it. Its monitor also guards the mutable fields of every operation
+     * of the world, so a cancel and a stage change never interleave.
+     */
+    private static final class Lane {
+        private final Set<OperationId> unfinished = new HashSet<>();
 
-    private static void closeAfterFailure(
-            PreparedBackup.Resources resources,
-            Exception failure) {
-        try {
-            resources.close();
-        } catch (IOException closeFailure) {
-            failure.addSuppressed(closeFailure);
+        private final ArrayDeque<Operation> waiting = new ArrayDeque<>();
+
+        private final List<CompletableFuture<Void>> idleWaiters = new ArrayList<>();
+
+        private Operation writer;
+
+        private synchronized void register(OperationId operationId) {
+            unfinished.add(operationId);
         }
-    }
 
-    private final class CreateOperation {
-        private final CreateBackupRequest request;
+        private void unregister(OperationId operationId) {
+            List<CompletableFuture<Void>> idle;
+            synchronized (this) {
+                idle = remove(operationId);
+            }
+            idle.forEach(waiter -> waiter.complete(null));
+        }
 
-        private final DestinationPlan plan;
+        /** Removes an operation; returns the idle waiters to complete, outside the lock, when it was the last. */
+        private List<CompletableFuture<Void>> remove(OperationId operationId) {
+            unfinished.remove(operationId);
+            if (!unfinished.isEmpty() || idleWaiters.isEmpty()) {
+                return List.of();
+            }
+            List<CompletableFuture<Void>> idle = List.copyOf(idleWaiters);
+            idleWaiters.clear();
+            return idle;
+        }
 
-        private final BackupId backupId;
+        private synchronized CompletionStage<Void> whenIdle() {
+            if (unfinished.isEmpty()) {
+                return CompletableFuture.completedFuture(null);
+            }
+            CompletableFuture<Void> waiter = new CompletableFuture<>();
+            idleWaiters.add(waiter);
+            return waiter;
+        }
 
+        private synchronized boolean busy() {
+            return !unfinished.isEmpty();
+        }
+
+        private synchronized boolean hasWriter() {
+            return writer != null;
+        }
+    }
+
+    /** Sends one operation's progress to its listener; after a cancel it reports nothing more. */
+    private static final class Progress {
         private final OperationId operationId;
 
-        private final boolean coalescible;
+        private final WorldId worldId;
+
+        private final BackupId backupId;
 
-        private final CopyOnWriteArrayList<ProgressListener> listeners = new CopyOnWriteArrayList<>();
+        private final ProgressListener listener;
 
-        private final OperationFuture result;
+        private volatile boolean silenced;
 
-        private final AtomicReference<CapturedBackup> capture;
+        private Progress(
+                OperationId operationId,
+                WorldId worldId,
+                BackupId backupId,
+                ProgressListener listener) {
+            this.operationId = operationId;
+            this.worldId = worldId;
+            this.backupId = backupId;
+            this.listener = Objects.requireNonNull(listener, "listener");
+        }
+
+        /** A listener or an invalid event never affects the backup. */
+        private void report(OperationPhase phase, long completed, long total, String message) {
+            if (!silenced) {
+                Observers.safely(() -> listener.onProgress(new OperationProgress(
+                        operationId,
+                        worldId,
+                        Optional.of(backupId),
+                        BackupOperation.CREATE,
+                        phase,
+                        completed,
+                        total,
+                        message)));
+            }
+        }
+    }
 
-        private final AtomicReference<WorldOperationGate.Permit> permit;
+    /** One backup from its capture to its catalog record. Mutable fields are guarded by the lane. */
+    private final class Operation {
+        private final CreateBackupRequest request;
 
-        private final AtomicReference<OperationProgress> progress = new AtomicReference<>();
+        private final Progress progress;
 
-        private final AtomicReference<Future<?>> worker = new AtomicReference<>();
+        private final List<BackupBackend> backends;
 
-        private final CopyOnWriteArrayList<CompletableFuture<?>> destinationTasks = new CopyOnWriteArrayList<>();
+        private final Lane lane;
 
-        private final AtomicBoolean workerStarted = new AtomicBoolean();
+        private final OperationFuture result = new OperationFuture(this);
 
-        private final AtomicBoolean cancelled = new AtomicBoolean();
+        private final List<InterruptibleFuture<DestinationResult>> destinations = new ArrayList<>();
 
-        private final AtomicReference<CancellationState> cancellationState =
-                new AtomicReference<>(CancellationState.CANCELLABLE);
+        private Stage stage = Stage.CAPTURING;
 
-        private final AtomicBoolean interruptRequested = new AtomicBoolean();
+        private boolean cancelRequested;
 
-        private final AtomicBoolean terminal = new AtomicBoolean();
+        private InterruptibleFuture<?> worker;
 
-        private volatile boolean previousInventoryPresent;
+        private CapturedBackup capture;
 
-        private volatile WorldLane<CreateOperation> lane;
+        private WorldOperationGate.Permit permit;
 
-        private CreateOperation(
-                CreateBackupRequest request,
-                DestinationPlan plan,
-                BackupId backupId,
-                OperationId operationId,
-                boolean coalescible,
-                CapturedBackup capture,
-                boolean previousInventoryPresent,
-                ProgressListener listener) {
+        private Operation(CreateBackupRequest request, Progress progress, List<BackupBackend> backends) {
             this.request = request;
-            this.plan = plan;
-            this.backupId = backupId;
-            this.operationId = operationId;
-            this.coalescible = coalescible;
-            this.capture = new AtomicReference<>(capture);
-            this.permit = new AtomicReference<>();
-            this.previousInventoryPresent = previousInventoryPresent;
-            this.listeners.add(listener);
-            this.result = new OperationFuture(this);
+            this.progress = progress;
+            this.backends = backends;
+            this.lane = lane(request.worldId());
         }
 
-        private boolean isCompatibleWith(CreateOperation other) {
-            return coalescible
-                    && other.coalescible
-                    && request.equals(other.request)
-                    && plan.equals(other.plan);
+        /** Accepts a cancel unless the operation is recording or done; from here on it reports nothing. */
+        private boolean acceptCancel() {
+            synchronized (lane) {
+                if (stage == Stage.COMMITTING || stage == Stage.DONE) {
+                    return false;
+                }
+                cancelRequested = true;
+                progress.silenced = true;
+                return true;
+            }
+        }
+
+        /**
+         * Interrupts the running work. The worker or commit path then ends the operation; only a
+         * waiting operation, which no path would reach again, is taken out of the queue and ended
+         * on a worker, because ending it deletes its capture and a cancel may come from the render
+         * thread.
+         */
+        private void stopWork() {
+            List<InterruptibleFuture<?>> running = new ArrayList<>();
+            boolean dequeued;
+            synchronized (lane) {
+                dequeued = stage == Stage.WAITING && lane.waiting.remove(this);
+                if (worker != null) {
+                    running.add(worker);
+                }
+                running.addAll(destinations);
+            }
+            running.forEach(task -> task.stop(true));
+            if (dequeued) {
+                try {
+                    executor.execute(() -> finish(this, null, cancellation()));
+                } catch (RejectedExecutionException exception) {
+                    finish(this, null, cancellation());
+                }
+            }
+        }
+
+        private void attach(InterruptibleFuture<?> task) {
+            boolean stop;
+            synchronized (lane) {
+                worker = task;
+                stop = cancelRequested;
+            }
+            if (stop) {
+                task.stop(true);
+            }
+        }
+
+        private void addDestination(InterruptibleFuture<DestinationResult> write) {
+            boolean stop;
+            synchronized (lane) {
+                destinations.add(write);
+                stop = cancelRequested;
+            }
+            if (stop) {
+                write.stop(true);
+            }
+        }
+
+        /** Takes the world permit; null when the backup was cancelled while it waited for it. */
+        private BackupCapture admit(WorldOperationGate.Permit worldPermit) {
+            synchronized (lane) {
+                permit = worldPermit;
+                return cancelRequested ? null : capture.capture();
+            }
+        }
+
+        /** The point of no return; true when a cancel arrived before it. */
+        private boolean beginCommit() {
+            synchronized (lane) {
+                stage = Stage.COMMITTING;
+                return cancelRequested;
+            }
+        }
+
+        private BackupCapture capture() {
+            synchronized (lane) {
+                return capture.capture();
+            }
         }
     }
 
-    private final class OperationFuture extends CompletableFuture<BackupResult> {
-        private final CreateOperation operation;
+    /** The stage handed to callers; cancelling it cancels the operation. */
+    private static final class OperationFuture extends CompletableFuture<BackupResult> {
+        private final Operation operation;
 
-        private OperationFuture(CreateOperation operation) {
+        private OperationFuture(Operation operation) {
             this.operation = operation;
         }
 
+        /**
+         * Refused once the backup is recording. The stage completes as cancelled before the work is
+         * stopped, so an interrupted worker cannot complete it with its own failure first. Running
+         * work is interrupted whatever the flag says.
+         */
         @Override
         public boolean cancel(boolean mayInterruptIfRunning) {
-            synchronized (operation) {
-                if (!operation.cancellationState.compareAndSet(
-                        CancellationState.CANCELLABLE,
-                        CancellationState.CANCELLATION_REQUESTED)) {
-                    return false;
-                }
-                boolean cancelled = super.cancel(mayInterruptIfRunning);
-                if (cancelled) {
-                    SerializedBackupCoordinator.this.cancel(operation, mayInterruptIfRunning);
-                } else {
-                    operation.cancellationState.compareAndSet(
-                            CancellationState.CANCELLATION_REQUESTED,
-                            CancellationState.CANCELLABLE);
-                }
-                return cancelled;
+            if (!operation.acceptCancel()) {
+                return false;
             }
+            boolean cancelled = super.cancel(mayInterruptIfRunning);
+            operation.stopWork();
+            return cancelled;
         }
     }
-
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/SourceCaptureObserver.java b/src/main/java/dev/ishaanko/worldarchive/core/SourceCaptureObserver.java
index 548fb2b..99e6bb6 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/SourceCaptureObserver.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/SourceCaptureObserver.java
@@ -3,7 +3,10 @@
 import java.io.IOException;
 import java.nio.file.Path;
 
-/** Optional capture boundary hooks for instrumentation and lifecycle coordination tests. */
+/**
+ * Hooks around each file copy of a capture, which tests use to change or block a world while it
+ * is copied. Several copy workers call them at once, for different files.
+ */
 public interface SourceCaptureObserver {
     SourceCaptureObserver NONE = new SourceCaptureObserver() {
     };
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/WorldInventory.java b/src/main/java/dev/ishaanko/worldarchive/core/WorldInventory.java
index 6db756b..ef3ac37 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/WorldInventory.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/WorldInventory.java
@@ -1,5 +1,7 @@
 package dev.ishaanko.worldarchive.core;
 
+import dev.ishaanko.worldarchive.support.Digests;
+import dev.ishaanko.worldarchive.support.PortablePath;
 import java.nio.ByteBuffer;
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
@@ -13,104 +15,77 @@
 import java.util.Set;
 import java.util.regex.Pattern;
 
-/** Canonical identity of the regular files in one captured world tree. */
-public record WorldInventory(
-        List<Entry> files,
-        long fileCount,
-        long byteCount,
-        String contentSha256,
-        String inventorySha256) {
+/**
+ * The regular files of one captured world tree, sorted by portable path, with the size and
+ * SHA-256 of each. Every destination derives the same two digests from it and every stored
+ * manifest holds them, so their framing must never change: {@link #contentSha256()} covers
+ * each file's size and digest in path order, and {@link #inventorySha256()} covers each path,
+ * size and digest.
+ */
+public record WorldInventory(List<Entry> files) {
     public static final int MAXIMUM_FILES = 500_000;
 
     public static final long MAXIMUM_BYTES = 8L * 1_024 * 1_024 * 1_024 * 1_024;
 
     private static final Pattern SHA256 = Pattern.compile("[0-9a-f]{64}");
 
+    /** Requires strictly sorted entries whose paths do not collide on any supported system. */
     public WorldInventory {
         files = List.copyOf(Objects.requireNonNull(files, "files"));
-        if (files.size() != fileCount || fileCount < 0 || fileCount > MAXIMUM_FILES) {
-            throw new IllegalArgumentException("World inventory file count is invalid");
+        if (files.size() > MAXIMUM_FILES) {
+            throw new IllegalArgumentException("World contains more than " + MAXIMUM_FILES + " files");
         }
-        if (byteCount < 0 || byteCount > MAXIMUM_BYTES) {
-            throw new IllegalArgumentException("World inventory byte count is invalid");
+        requireSortedWithoutCollisions(files);
+        long bytes = 0;
+        for (Entry file : files) {
+            bytes += file.size();
+            if (bytes > MAXIMUM_BYTES) {
+                throw new IllegalArgumentException("World is too large to capture");
+            }
         }
-        requireSha256(contentSha256, "contentSha256");
-        requireSha256(inventorySha256, "inventorySha256");
+    }
 
-        long actualBytes = validateEntries(files);
-        if (actualBytes != byteCount) {
-            throw new IllegalArgumentException(
-                    "World inventory byte count does not match its files");
-        }
-        if (!contentSha256.equals(contentDigest(files))
-                || !inventorySha256.equals(inventoryDigest(files))) {
-            throw new IllegalArgumentException(
-                    "World inventory digest does not match its files");
-        }
+    /** Sorts the entries by path, then validates them as the canonical constructor does. */
+    public static WorldInventory create(List<Entry> entries) {
+        List<Entry> sorted = new ArrayList<>(Objects.requireNonNull(entries, "entries"));
+        sorted.sort(null);
+        return new WorldInventory(sorted);
     }
 
-    private static long validateEntries(List<Entry> files) {
-        String previous = null;
-        long actualBytes = 0;
-        Set<String> collisionKeys = new HashSet<>();
-        Set<String> directoryKeys = new HashSet<>();
-        try {
-            for (Entry file : files) {
-                Objects.requireNonNull(file, "file");
-                if (previous != null && previous.compareTo(file.path()) >= 0) {
-                    throw new IllegalArgumentException("World inventory paths must be strictly sorted");
-                }
-                String collisionKey = PortableWorldPath.collisionKey(file.path());
-                if (!collisionKeys.add(collisionKey) || directoryKeys.contains(collisionKey)) {
-                    throw new IllegalArgumentException("World inventory contains colliding paths");
-                }
-                String[] segments = file.path().split("/");
-                StringBuilder prefix = new StringBuilder();
-                for (int index = 0; index < segments.length - 1; index++) {
-                    if (!prefix.isEmpty()) {
-                        prefix.append('/');
-                    }
-                    prefix.append(segments[index]);
-                    String prefixKey = PortableWorldPath.collisionKey(prefix.toString());
-                    if (collisionKeys.contains(prefixKey)) {
-                        throw new IllegalArgumentException(
-                                "World inventory contains a file/directory path conflict");
-                    }
-                    directoryKeys.add(prefixKey);
-                }
-                actualBytes = Math.addExact(actualBytes, file.size());
-                previous = file.path();
-            }
-        } catch (ArithmeticException exception) {
-            throw new IllegalArgumentException("World inventory size overflowed", exception);
-        }
-        return actualBytes;
+    public long fileCount() {
+        return files.size();
     }
 
-    public static WorldInventory create(List<Entry> entries) {
-        Objects.requireNonNull(entries, "entries");
-        if (entries.size() > MAXIMUM_FILES) {
-            throw new IllegalArgumentException("World contains too many files");
+    public long byteCount() {
+        return files.stream().mapToLong(Entry::size).sum();
+    }
+
+    /** SHA-256 over each file's size (8 bytes, big-endian) and raw digest, in path order. */
+    public String contentSha256() {
+        MessageDigest digest = Digests.sha256();
+        ByteBuffer number = ByteBuffer.allocate(Long.BYTES);
+        for (Entry entry : files) {
+            putLong(digest, number, entry.size);
+            digest.update(HexFormat.of().parseHex(entry.sha256));
         }
-        List<Entry> sorted = new ArrayList<>(entries);
-        sorted.sort(Entry::compareTo);
-        long bytes = 0;
-        try {
-            for (Entry entry : sorted) {
-                bytes = Math.addExact(bytes, Objects.requireNonNull(entry, "entry").size());
-                if (bytes > MAXIMUM_BYTES) {
-                    throw new IllegalArgumentException("World is too large to capture");
-                }
-            }
-        } catch (ArithmeticException exception) {
-            throw new IllegalArgumentException("World size overflowed", exception);
+        return Digests.hex(digest.digest());
+    }
+
+    /**
+     * SHA-256 over each file's UTF-8 path length (8 bytes), path bytes, size (8 bytes) and raw
+     * digest, in path order.
+     */
+    public String inventorySha256() {
+        MessageDigest digest = Digests.sha256();
+        ByteBuffer number = ByteBuffer.allocate(Long.BYTES);
+        for (Entry entry : files) {
+            byte[] path = entry.path.getBytes(StandardCharsets.UTF_8);
+            putLong(digest, number, path.length);
+            digest.update(path);
+            putLong(digest, number, entry.size);
+            digest.update(HexFormat.of().parseHex(entry.sha256));
         }
-        return new WorldInventory(
-                sorted,
-                sorted.size(),
-                bytes,
-                contentDigest(sorted),
-                inventoryDigest(sorted));
+        return Digests.hex(digest.digest());
     }
 
     /** Counts additions, modifications, and deletions since the supplied inventory. */
@@ -130,27 +105,32 @@ public long changedFilesSince(WorldInventory previous) {
         return changed + earlier.size();
     }
 
-    private static String contentDigest(List<Entry> entries) {
-        MessageDigest digest = Digests.sha256();
-        ByteBuffer number = ByteBuffer.allocate(Long.BYTES);
-        for (Entry entry : entries) {
-            putLong(digest, number, entry.size);
-            digest.update(HexFormat.of().parseHex(entry.sha256));
-        }
-        return Digests.hex(digest.digest());
-    }
-
-    private static String inventoryDigest(List<Entry> entries) {
-        MessageDigest digest = Digests.sha256();
-        ByteBuffer number = ByteBuffer.allocate(Long.BYTES);
-        for (Entry entry : entries) {
-            byte[] path = entry.path.getBytes(StandardCharsets.UTF_8);
-            putLong(digest, number, path.length);
-            digest.update(path);
-            putLong(digest, number, entry.size);
-            digest.update(HexFormat.of().parseHex(entry.sha256));
+    private static void requireSortedWithoutCollisions(List<Entry> files) {
+        String previous = null;
+        Set<String> fileKeys = new HashSet<>();
+        Set<String> directoryKeys = new HashSet<>();
+        for (Entry file : files) {
+            Objects.requireNonNull(file, "file");
+            if (previous != null && previous.compareTo(file.path) >= 0) {
+                throw new IllegalArgumentException("World inventory paths must be strictly sorted");
+            }
+            String key = PortablePath.collisionKey(file.path);
+            if (!fileKeys.add(key) || directoryKeys.contains(key)) {
+                throw new IllegalArgumentException(
+                        "Path \"" + file.path + "\" collides with another path on Windows or macOS");
+            }
+            int slash = file.path.indexOf('/');
+            while (slash >= 0) {
+                String directoryKey = PortablePath.collisionKey(file.path.substring(0, slash));
+                if (fileKeys.contains(directoryKey)) {
+                    throw new IllegalArgumentException(
+                            "Path \"" + file.path + "\" needs a folder where a file of the same name is");
+                }
+                directoryKeys.add(directoryKey);
+                slash = file.path.indexOf('/', slash + 1);
+            }
+            previous = file.path;
         }
-        return Digests.hex(digest.digest());
     }
 
     private static void putLong(MessageDigest digest, ByteBuffer number, long value) {
@@ -159,21 +139,17 @@ private static void putLong(MessageDigest digest, ByteBuffer number, long value)
         digest.update(number.array());
     }
 
-    private static void requireSha256(String value, String name) {
-        Objects.requireNonNull(value, name);
-        if (!SHA256.matcher(value).matches()) {
-            throw new IllegalArgumentException(name + " must be lowercase SHA-256");
-        }
-    }
-
     /** One portable regular file in a captured tree. */
     public record Entry(String path, long size, String sha256) implements Comparable<Entry> {
         public Entry {
-            path = PortableWorldPath.validate(Objects.requireNonNull(path, "path"));
+            path = PortablePath.validate(Objects.requireNonNull(path, "path"));
             if (size < 0 || size > MAXIMUM_BYTES) {
-                throw new IllegalArgumentException("World inventory entry size is invalid");
+                throw new IllegalArgumentException("Size of \"" + path + "\" is out of range");
+            }
+            Objects.requireNonNull(sha256, "sha256");
+            if (!SHA256.matcher(sha256).matches()) {
+                throw new IllegalArgumentException("SHA-256 of \"" + path + "\" is not 64 lowercase hex digits");
             }
-            requireSha256(sha256, "sha256");
         }
 
         @Override
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/WorldInventoryStore.java b/src/main/java/dev/ishaanko/worldarchive/core/WorldInventoryStore.java
deleted file mode 100644
index 3d5f64a..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/core/WorldInventoryStore.java
+++ /dev/null
@@ -1,12 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.util.Optional;
-
-/** Durable per-world capture state stored outside every live world. */
-public interface WorldInventoryStore {
-    Optional<WorldInventory> load(WorldId worldId) throws IOException;
-
-    void save(WorldId worldId, WorldInventory inventory) throws IOException;
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/WorldLane.java b/src/main/java/dev/ishaanko/worldarchive/core/WorldLane.java
deleted file mode 100644
index 6c346dc..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/core/WorldLane.java
+++ /dev/null
@@ -1,11 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import java.util.ArrayDeque;
-import java.util.Deque;
-
-/** Per-world FIFO queue of pending operations plus the one currently active. */
-final class WorldLane<T> {
-    final Deque<T> queue = new ArrayDeque<>();
-
-    T active;
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/WorldOperationGate.java b/src/main/java/dev/ishaanko/worldarchive/core/WorldOperationGate.java
index 535768e..ce5c402 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/WorldOperationGate.java
+++ b/src/main/java/dev/ishaanko/worldarchive/core/WorldOperationGate.java
@@ -2,12 +2,18 @@
 
 import dev.ishaanko.worldarchive.model.WorldId;
 
-/** Injectable per-world lane shared by capture and maintenance operations. */
+/**
+ * Lets one operation at a time work on a world. The coordinator uses one gate so that only one
+ * capture copies a world at a time, and a second gate, shared with restore, delete and cleanup,
+ * for the storage work of a world. Neither is the save gate of the open world, which pauses
+ * autosave.
+ */
 @FunctionalInterface
 public interface WorldOperationGate {
+    /** Waits until the world is free; interrupting the waiting thread gives up. */
     Permit enter(WorldId worldId) throws InterruptedException;
 
-    /** One acquired, transferable world lane permit. */
+    /** The right to work on one world until it is closed; closing it twice does nothing. */
     @FunctionalInterface
     interface Permit extends AutoCloseable {
         @Override
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/WorldTree.java b/src/main/java/dev/ishaanko/worldarchive/core/WorldTree.java
new file mode 100644
index 0000000..6776d11
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/core/WorldTree.java
@@ -0,0 +1,269 @@
+package dev.ishaanko.worldarchive.core;
+
+import dev.ishaanko.worldarchive.support.FileSystemSafety;
+import dev.ishaanko.worldarchive.support.PortablePath;
+import java.io.IOException;
+import java.io.InterruptedIOException;
+import java.nio.file.FileVisitResult;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.NoSuchFileException;
+import java.nio.file.Path;
+import java.nio.file.SimpleFileVisitor;
+import java.nio.file.attribute.BasicFileAttributes;
+import java.nio.file.attribute.FileTime;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+
+/**
+ * One walk of a world folder: the folders and plain files that a backup keeps, and the newest
+ * file modification time. The walk skips WorldArchive's {@code .worldarchive} folder and the
+ * game's {@code session.lock} at the top of the world, and every entry named {@code .git} at any
+ * depth, because Git cannot store one. It refuses links, special files, and names that another
+ * operating system cannot restore, and every such error names the path.
+ */
+record WorldTree(List<Folder> folders, List<SourceFile> files, long byteCount, FileTime newestModified) {
+    WorldTree {
+        folders = List.copyOf(folders);
+        files = List.copyOf(files);
+        Objects.requireNonNull(newestModified, "newestModified");
+    }
+
+    /** Walks {@code world}; a file that disappears during the walk is a {@link CaptureChangedException}. */
+    static WorldTree scan(Path world) throws IOException {
+        Scanner scanner = new Scanner(world);
+        Files.walkFileTree(world, scanner);
+        scanner.folders.sort(Comparator
+                .comparingInt((Folder folder) -> depth(folder.portablePath()))
+                .thenComparing(Folder::portablePath));
+        scanner.files.sort(Comparator.comparing(SourceFile::portablePath));
+        return new WorldTree(scanner.folders, scanner.files, scanner.byteCount, scanner.newestModified);
+    }
+
+    /** Requires {@code later} to list the same folders and the same files, with the same identity and size. */
+    void requireUnchanged(WorldTree later) throws CaptureChangedException {
+        if (!folders.equals(later.folders) || files.size() != later.files.size()) {
+            throw changed("files or folders were added or removed");
+        }
+        for (int index = 0; index < files.size(); index++) {
+            SourceFile expected = files.get(index);
+            SourceFile observed = later.files.get(index);
+            if (!expected.portablePath().equals(observed.portablePath())
+                    || !expected.state().sameFile(observed.state())) {
+                throw changed("\"" + observed.portablePath() + "\" was replaced or resized");
+            }
+        }
+    }
+
+    static CaptureChangedException changed(String detail) {
+        return new CaptureChangedException(
+                "The world changed while its private capture was being made (" + detail + ")."
+                        + " Try the backup again.");
+    }
+
+    private static int depth(String portablePath) {
+        return portablePath.isEmpty()
+                ? 0
+                : (int) portablePath.chars().filter(character -> character == '/').count() + 1;
+    }
+
+    /** A folder of the world; the empty path is the world folder itself. */
+    record Folder(String portablePath, Object fileKey, FileTime created) {
+    }
+
+    /** A plain file of the world with the state the walk saw. */
+    record SourceFile(Path path, String portablePath, FileState state) {
+    }
+
+    /**
+     * The identity, size and times of a file, read without following links. On macOS the
+     * creation time is left out, because setting an older modification time can move it.
+     */
+    record FileState(Object fileKey, long size, FileTime modified, FileTime created) {
+        private static final boolean IGNORE_CREATION_TIME = System.getProperty("os.name").startsWith("Mac");
+
+        static FileState of(BasicFileAttributes attributes) {
+            return new FileState(
+                    attributes.fileKey(),
+                    attributes.size(),
+                    attributes.lastModifiedTime(),
+                    creationTime(attributes));
+        }
+
+        /** Reads the file itself, not a directory listing, which Windows updates late for open files. */
+        static FileState read(SourceFile file) throws IOException {
+            BasicFileAttributes attributes;
+            try {
+                attributes = Files.readAttributes(
+                        file.path(), BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
+            } catch (NoSuchFileException exception) {
+                throw changed("\"" + file.portablePath() + "\" disappeared");
+            }
+            if (!FileSystemSafety.isOrdinaryRegularFile(attributes)) {
+                throw changed("\"" + file.portablePath() + "\" was replaced");
+            }
+            return of(attributes);
+        }
+
+        /** Same file and size; not the modification time, which a directory walk can report late. */
+        boolean sameFile(FileState other) {
+            return Objects.equals(fileKey, other.fileKey)
+                    && size == other.size
+                    && created.equals(other.created);
+        }
+
+        private static FileTime creationTime(BasicFileAttributes attributes) {
+            return IGNORE_CREATION_TIME ? FileTime.fromMillis(0) : attributes.creationTime();
+        }
+    }
+
+    private static final class Scanner extends SimpleFileVisitor<Path> {
+        private final Path world;
+
+        private final List<Folder> folders = new ArrayList<>();
+
+        private final List<SourceFile> files = new ArrayList<>();
+
+        /** Collision key of every path seen so far, and whether it names a file. */
+        private final Map<String, Boolean> seenAsFile = new HashMap<>();
+
+        private long byteCount;
+
+        private FileTime newestModified = FileTime.fromMillis(0);
+
+        private Scanner(Path world) {
+            this.world = world;
+        }
+
+        @Override
+        public FileVisitResult preVisitDirectory(Path directory, BasicFileAttributes attributes)
+                throws IOException {
+            requireNotInterrupted();
+            Path relative = world.relativize(directory);
+            boolean isWorld = relative.toString().isEmpty();
+            if (!isWorld && isSkipped(relative, true)) {
+                return FileVisitResult.SKIP_SUBTREE;
+            }
+            if (!FileSystemSafety.isOrdinaryDirectory(attributes)) {
+                throw unsupported("\"" + relative + "\" is a link or a special folder."
+                        + " Move it out of the world folder, then try again.");
+            }
+            String portable = isWorld ? "" : portable(relative);
+            if (!isWorld) {
+                register(portable, false);
+            }
+            folders.add(new Folder(portable, attributes.fileKey(), FileState.of(attributes).created()));
+            requireCapacity();
+            return FileVisitResult.CONTINUE;
+        }
+
+        @Override
+        public FileVisitResult visitFile(Path file, BasicFileAttributes attributes) throws IOException {
+            requireNotInterrupted();
+            Path relative = world.relativize(file);
+            if (isSkipped(relative, false)) {
+                return FileVisitResult.CONTINUE;
+            }
+            if (!FileSystemSafety.isOrdinaryRegularFile(attributes)) {
+                throw unsupported("\"" + relative + "\" is a link or a special file."
+                        + " Move it out of the world folder, then try again.");
+            }
+            String portable = portable(relative);
+            register(portable, true);
+            FileState state = FileState.of(attributes);
+            if (state.size() > WorldInventory.MAXIMUM_BYTES - byteCount) {
+                throw unsupported("It is larger than " + (WorldInventory.MAXIMUM_BYTES >> 40) + " TiB.");
+            }
+            files.add(new SourceFile(file, portable, state));
+            byteCount += state.size();
+            if (state.modified().compareTo(newestModified) > 0) {
+                newestModified = state.modified();
+            }
+            requireCapacity();
+            return FileVisitResult.CONTINUE;
+        }
+
+        @Override
+        public FileVisitResult visitFileFailed(Path file, IOException failure) throws IOException {
+            throw unreadable(file, failure);
+        }
+
+        @Override
+        public FileVisitResult postVisitDirectory(Path directory, IOException failure) throws IOException {
+            if (failure != null) {
+                throw unreadable(directory, failure);
+            }
+            return FileVisitResult.CONTINUE;
+        }
+
+        private IOException unreadable(Path entry, IOException failure) {
+            Path relative = world.relativize(entry);
+            if (failure instanceof NoSuchFileException) {
+                return changed("\"" + relative + "\" disappeared");
+            }
+            return new IOException(
+                    "World entry \"" + relative + "\" could not be read: " + failure.getMessage(), failure);
+        }
+
+        /**
+         * Refuses a second path that Windows or macOS would treat as the same one, because they
+         * ignore letter case and Unicode normalization, and a file where another path needs a folder.
+         */
+        private void register(String portable, boolean isFile) throws IOException {
+            String[] segments = portable.split("/");
+            StringBuilder prefix = new StringBuilder();
+            for (int index = 0; index < segments.length; index++) {
+                if (!prefix.isEmpty()) {
+                    prefix.append('/');
+                }
+                prefix.append(segments[index]);
+                boolean last = index == segments.length - 1;
+                Boolean previous = seenAsFile.putIfAbsent(
+                        PortablePath.collisionKey(prefix.toString()), last && isFile);
+                if (previous != null && (last || previous)) {
+                    throw unsupported("\"" + portable + "\" has the same name as another file or folder"
+                            + " on Windows and macOS. Rename one of them, then try again.");
+                }
+            }
+        }
+
+        private void requireCapacity() throws IOException {
+            if (files.size() > WorldInventory.MAXIMUM_FILES || folders.size() > WorldInventory.MAXIMUM_FILES) {
+                throw unsupported("It has more than " + WorldInventory.MAXIMUM_FILES + " files or folders.");
+            }
+        }
+
+        private static String portable(Path relative) throws IOException {
+            try {
+                return PortablePath.fromRelativePath(relative);
+            } catch (IllegalArgumentException exception) {
+                throw unsupported(exception.getMessage() + ". Rename or remove it, then try again.");
+            }
+        }
+
+        /** {@code .git} at any depth; {@code .worldarchive} and the {@code session.lock} file at the top. */
+        private static boolean isSkipped(Path relative, boolean isFolder) {
+            String name = relative.getFileName().toString();
+            if (name.equalsIgnoreCase(".git")) {
+                return true;
+            }
+            return relative.getNameCount() == 1
+                    && (name.equalsIgnoreCase(".worldarchive")
+                            || !isFolder && name.equalsIgnoreCase("session.lock"));
+        }
+
+        private static IOException unsupported(String reason) {
+            return new IOException("This world cannot be backed up. " + reason);
+        }
+
+        private static void requireNotInterrupted() throws InterruptedIOException {
+            if (Thread.currentThread().isInterrupted()) {
+                throw new InterruptedIOException("World capture was interrupted");
+            }
+        }
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/importing/BackupImportService.java b/src/main/java/dev/ishaanko/worldarchive/importing/BackupImportService.java
index 8363427..88c4df1 100644
--- a/src/main/java/dev/ishaanko/worldarchive/importing/BackupImportService.java
+++ b/src/main/java/dev/ishaanko/worldarchive/importing/BackupImportService.java
@@ -6,7 +6,7 @@
 import java.util.UUID;
 import java.util.concurrent.CompletionStage;
 
-/** Preview-first import and local catalog reconstruction API. */
+/** The import screens' API: preview a source first, then import the backups the player chose. */
 public interface BackupImportService {
     CompletionStage<ImportPreview> previewZip(Path folder);
 
@@ -15,14 +15,9 @@ public interface BackupImportService {
     /** Finds locally managed backups without adding them to the catalog yet. */
     CompletionStage<ImportPreview> previewLocal();
 
-    CompletionStage<ImportSummary> execute(UUID token);
-
     /** Imports only the chosen backups from a previously validated preview. */
     CompletionStage<ImportSummary> execute(UUID token, Set<BackupId> selected);
 
     /** Releases an unused preview and any temporary storage retained for it. */
     CompletionStage<Void> discard(UUID token);
-
-    /** Reconciles managed local Git refs and ZIP archives without contacting a network. */
-    CompletionStage<ImportSummary> rebuildLocal();
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/importing/FileBackupImportService.java b/src/main/java/dev/ishaanko/worldarchive/importing/FileBackupImportService.java
index f85d570..2c38f37 100644
--- a/src/main/java/dev/ishaanko/worldarchive/importing/FileBackupImportService.java
+++ b/src/main/java/dev/ishaanko/worldarchive/importing/FileBackupImportService.java
@@ -1,18 +1,17 @@
 package dev.ishaanko.worldarchive.importing;
 
 import dev.ishaanko.worldarchive.catalog.BackupCatalog;
-import dev.ishaanko.worldarchive.catalog.BackupDeletionRegistry;
-import dev.ishaanko.worldarchive.config.RemoteUrlPolicy;
 import dev.ishaanko.worldarchive.catalog.CatalogMergeResult;
 import dev.ishaanko.worldarchive.catalog.CatalogMergeStatus;
-import dev.ishaanko.worldarchive.core.AsyncTasks;
+import dev.ishaanko.worldarchive.catalog.FileBackupDeletionRegistry;
+import dev.ishaanko.worldarchive.config.RemoteUrlPolicy;
+import dev.ishaanko.worldarchive.core.WorldOperationGate;
 import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
 import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.BackupResult;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
 import dev.ishaanko.worldarchive.model.ImportSourceId;
+import dev.ishaanko.worldarchive.model.SafeText;
 import dev.ishaanko.worldarchive.model.SyncStatus;
 import dev.ishaanko.worldarchive.model.VerificationStatus;
 import dev.ishaanko.worldarchive.model.WorldId;
@@ -25,19 +24,19 @@
 import dev.ishaanko.worldarchive.storage.zip.ZipBackupStore;
 import dev.ishaanko.worldarchive.storage.zip.ZipBackupStoreResolver;
 import dev.ishaanko.worldarchive.storage.zip.ZipImportCandidate;
-import dev.ishaanko.worldarchive.storage.zip.ZipImportIssue;
 import dev.ishaanko.worldarchive.storage.zip.ZipImportScan;
 import dev.ishaanko.worldarchive.storage.zip.ZipImportScanner;
+import dev.ishaanko.worldarchive.support.AsyncTasks;
 import java.io.IOException;
 import java.nio.file.Path;
 import java.time.Clock;
 import java.time.Duration;
 import java.time.Instant;
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.Collections;
 import java.util.Comparator;
 import java.util.EnumMap;
-import java.util.HashSet;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
@@ -52,26 +51,39 @@
 import java.util.concurrent.ConcurrentMap;
 import java.util.concurrent.Executor;
 import java.util.concurrent.RejectedExecutionException;
+import java.util.function.Function;
 import java.util.function.Supplier;
 import java.util.stream.Collectors;
-
-/** Durable preview-first implementation for ZIP/Git import and managed local rebuilds. */
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Brings backups into the catalog: ZIP archives from a folder the player picks, Git snapshots
+ * from a repository, and the backups stored on this computer. Each import is previewed first and
+ * then runs only for the backups the player keeps selected. Merges only add to the catalog, one
+ * world at a time inside that world's operation gate, so they never race a backup or a delete of
+ * the same world.
+ */
 public final class FileBackupImportService implements BackupImportService, AutoCloseable {
     static final Duration PREVIEW_LIFETIME = Duration.ofMinutes(15);
 
     static final int MAXIMUM_PREPARED_PREVIEWS = 16;
 
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
     private final BackupCatalog catalog;
 
-    private final ImportSourceRegistry sources;
+    private final FileImportSourceRegistry sources;
 
-    private final BackupDeletionRegistry deletions;
+    private final FileBackupDeletionRegistry deletions;
 
     private final WorldGitSnapshotStore git;
 
     private final ZipBackupStoreResolver zipStores;
 
-    private final Supplier<Set<WorldId>> configuredWorlds;
+    private final LocalBackupScan localScan;
+
+    private final WorldOperationGate operationGate;
 
     private final Executor executor;
 
@@ -81,48 +93,12 @@ public final class FileBackupImportService implements BackupImportService, AutoC
 
     public FileBackupImportService(
             BackupCatalog catalog,
-            ImportSourceRegistry sources,
-            WorldGitSnapshotStore git,
-            ZipBackupStoreResolver zipStores,
-            Supplier<Set<WorldId>> configuredWorlds,
-            Executor executor) {
-        this(
-                catalog,
-                sources,
-                BackupDeletionRegistry.NONE,
-                git,
-                zipStores,
-                configuredWorlds,
-                executor,
-                Clock.systemUTC());
-    }
-
-    public FileBackupImportService(
-            BackupCatalog catalog,
-            ImportSourceRegistry sources,
-            BackupDeletionRegistry deletions,
-            WorldGitSnapshotStore git,
-            ZipBackupStoreResolver zipStores,
-            Supplier<Set<WorldId>> configuredWorlds,
-            Executor executor) {
-        this(
-                catalog,
-                sources,
-                deletions,
-                git,
-                zipStores,
-                configuredWorlds,
-                executor,
-                Clock.systemUTC());
-    }
-
-    FileBackupImportService(
-            BackupCatalog catalog,
-            ImportSourceRegistry sources,
-            BackupDeletionRegistry deletions,
+            FileImportSourceRegistry sources,
+            FileBackupDeletionRegistry deletions,
             WorldGitSnapshotStore git,
             ZipBackupStoreResolver zipStores,
             Supplier<Set<WorldId>> configuredWorlds,
+            WorldOperationGate operationGate,
             Executor executor,
             Clock clock) {
         this.catalog = Objects.requireNonNull(catalog, "catalog");
@@ -130,35 +106,33 @@ public FileBackupImportService(
         this.deletions = Objects.requireNonNull(deletions, "deletions");
         this.git = Objects.requireNonNull(git, "git");
         this.zipStores = Objects.requireNonNull(zipStores, "zipStores");
-        this.configuredWorlds = Objects.requireNonNull(configuredWorlds, "configuredWorlds");
+        this.operationGate = Objects.requireNonNull(operationGate, "operationGate");
         this.executor = Objects.requireNonNull(executor, "executor");
         this.clock = Objects.requireNonNull(clock, "clock");
+        this.localScan = new LocalBackupScan(catalog, deletions, sources, git, zipStores, configuredWorlds);
     }
 
     @Override
     public CompletionStage<ImportPreview> previewZip(Path folder) {
         Path selected = Objects.requireNonNull(folder, "folder").toAbsolutePath().normalize();
-        return AsyncTasks.supply(executor, () -> {
-            try {
-                ZipImportScan scan = new ZipImportScanner().scan(selected);
-                UUID token = UUID.randomUUID();
-                ZipPlan plan = new ZipPlan(token, selected, scan);
-                ImportPreview preview = zipPreview(plan);
-                retain(plan);
-                return preview;
-            } catch (IOException exception) {
-                throw new CompletionException(exception);
-            }
+        return AsyncTasks.supplyChecked(executor, () -> {
+            ZipPlan plan = new ZipPlan(UUID.randomUUID(), new ZipImportScanner().scan(selected));
+            ImportPreview preview = new ImportPreview(plan.token(), ImportKind.ZIP,
+                    previewItems(plan.records()),
+                    plan.scan().issues().stream().map(issue -> issue.path() + ": " + issue.message()).toList());
+            retain(plan);
+            return preview;
         });
     }
 
     @Override
     public CompletionStage<ImportPreview> previewGit(String remote) {
         return git.prepareImport(remote).thenApply(fetched -> {
-            UUID token = UUID.randomUUID();
-            GitPlan plan = new GitPlan(token, fetched);
+            GitPlan plan = new GitPlan(UUID.randomUUID(), fetched);
             try {
-                ImportPreview preview = gitPreview(plan);
+                ImportPreview preview = new ImportPreview(plan.token(), ImportKind.GIT,
+                        previewItems(plan.records()),
+                        fetched.issues().stream().map(issue -> issue.location() + ": " + issue.message()).toList());
                 retain(plan);
                 return preview;
             } catch (IOException | RuntimeException exception) {
@@ -170,62 +144,28 @@ public CompletionStage<ImportPreview> previewGit(String remote) {
 
     @Override
     public CompletionStage<ImportPreview> previewLocal() {
-        return AsyncTasks.supply(executor, () -> {
-            try {
-                UUID token = UUID.randomUUID();
-                LocalScan scan = scanLocal();
-                LocalPlan plan = new LocalPlan(token, scan.records(), scan.issues());
-                List<ImportPreviewItem> items = new ArrayList<>();
-                for (BackupRecord record : plan.records()) {
-                    items.add(localPreviewItem(record));
-                }
-                ImportPreview preview = new ImportPreview(
-                        token,
-                        ImportKind.LOCAL_REBUILD,
-                        "WorldArchive storage",
-                        items,
-                        Collections.nCopies(
-                                scan.issues(), "A stored backup could not be read safely"));
-                retain(plan);
-                return preview;
-            } catch (Exception exception) {
-                throw new CompletionException(exception);
-            }
+        return AsyncTasks.supplyChecked(executor, () -> {
+            LocalPlan plan = new LocalPlan(UUID.randomUUID(), localScan.scan());
+            List<ImportPreviewItem> items = new ArrayList<>();
+            plan.found().listed().forEach(record -> items.add(previewItem(record, CatalogMergeStatus.UNCHANGED)));
+            items.addAll(previewItems(plan.found().discovered()));
+            ImportPreview preview = new ImportPreview(plan.token(), ImportKind.LOCAL_REBUILD,
+                    items, Collections.nCopies(
+                            plan.found().issues(), "A stored backup could not be read; the game log says why"));
+            retain(plan);
+            return preview;
         });
     }
 
-    @Override
-    public CompletionStage<ImportSummary> execute(UUID token) {
-        return execute(token, null);
-    }
-
     @Override
     public CompletionStage<ImportSummary> execute(UUID token, Set<BackupId> selected) {
-        Objects.requireNonNull(token, "token");
-        PreparedPlan plan = claim(token);
-        if (plan == null) {
-            return CompletableFuture.failedFuture(
-                    new IllegalArgumentException("Import preview is missing, expired, or already used"));
-        }
-        try {
-            return CompletableFuture.supplyAsync(() -> {
-                try (plan) {
-                    Set<BackupId> chosen = selected == null
-                            ? plan.backupIds()
-                            : validateSelection(plan, selected);
-                    return switch (plan) {
-                        case ZipPlan zip -> executeZip(zip, chosen);
-                        case GitPlan gitPlan -> executeGit(gitPlan, chosen);
-                        case LocalPlan local -> executeLocal(local, chosen);
-                    };
-                } catch (Exception exception) {
-                    throw new CompletionException(exception);
-                }
-            }, executor);
-        } catch (RejectedExecutionException exception) {
-            plan.close();
-            return CompletableFuture.failedFuture(exception);
-        }
+        Set<BackupId> chosen = Set.copyOf(Objects.requireNonNull(selected, "selected"));
+        return run(token, plan -> {
+            if (!plan.backupIds().containsAll(chosen)) {
+                throw new IllegalArgumentException("Selected backups are not part of this preview");
+            }
+            return chosen;
+        });
     }
 
     @Override
@@ -239,14 +179,18 @@ public CompletionStage<Void> discard(UUID token) {
         return CompletableFuture.completedFuture(null);
     }
 
-    @Override
+    /**
+     * Lists the stored backups that the catalog lacks, at every start and settings change. Deleted
+     * backups stay out; their marks are dropped once a complete scan finds none of their files.
+     */
     public CompletionStage<ImportSummary> rebuildLocal() {
-        return AsyncTasks.supply(executor, () -> {
-            try {
-                return rebuildLocalBlocking();
-            } catch (Exception exception) {
-                throw new CompletionException(exception);
+        return AsyncTasks.supplyChecked(executor, () -> {
+            LocalBackupScan.Result found = localScan.scan();
+            ImportSummary summary = executeLocal(found, found.backupIds());
+            if (found.complete()) {
+                deletions.unmarkAllExcept(found.stored());
             }
+            return summary;
         });
     }
 
@@ -259,21 +203,46 @@ public synchronized void close() {
         });
     }
 
+    private CompletionStage<ImportSummary> run(UUID token, Function<PreparedPlan, Set<BackupId>> selection) {
+        Objects.requireNonNull(token, "token");
+        expirePrepared(clock.instant());
+        RetainedPlan retained = prepared.remove(token);
+        if (retained == null) {
+            return CompletableFuture.failedFuture(
+                    new IllegalArgumentException("Import preview is missing, expired, or already used"));
+        }
+        PreparedPlan plan = retained.plan();
+        try {
+            return CompletableFuture.supplyAsync(() -> {
+                try (plan) {
+                    Set<BackupId> chosen = selection.apply(plan);
+                    return switch (plan) {
+                        case ZipPlan zip -> executeZip(zip, chosen);
+                        case GitPlan gitPlan -> executeGit(gitPlan, chosen);
+                        case LocalPlan local -> executeLocal(local.found(), chosen);
+                    };
+                } catch (RuntimeException exception) {
+                    throw exception;
+                } catch (Exception exception) {
+                    throw new CompletionException(exception);
+                }
+            }, executor);
+        } catch (RejectedExecutionException exception) {
+            plan.close();
+            return CompletableFuture.failedFuture(exception);
+        }
+    }
+
     private synchronized void retain(PreparedPlan plan) {
         Instant now = clock.instant();
         expirePrepared(now);
-        RetainedPlan retained = new RetainedPlan(
-                plan,
-                now.plus(PREVIEW_LIFETIME));
-        if (prepared.putIfAbsent(plan.token(), retained) != null) {
+        if (prepared.putIfAbsent(plan.token(), new RetainedPlan(plan, now.plus(PREVIEW_LIFETIME))) != null) {
             plan.close();
             throw new IllegalStateException("Import preview token is already retained");
         }
         while (prepared.size() > MAXIMUM_PREPARED_PREVIEWS) {
             Map.Entry<UUID, RetainedPlan> oldest = prepared.entrySet().stream()
-                    .min(Comparator
-                            .comparing((Map.Entry<UUID, RetainedPlan> entry) ->
-                                    entry.getValue().expiresAt())
+                    .min(Comparator.comparing((Map.Entry<UUID, RetainedPlan> entry) -> entry.getValue().expiresAt())
                             .thenComparing(Map.Entry::getKey))
                     .orElseThrow();
             if (prepared.remove(oldest.getKey(), oldest.getValue())) {
@@ -282,173 +251,124 @@ private synchronized void retain(PreparedPlan plan) {
         }
     }
 
-    private PreparedPlan claim(UUID token) {
-        expirePrepared(clock.instant());
-        RetainedPlan retained = prepared.remove(token);
-        return retained == null ? null : retained.plan();
-    }
-
     private void expirePrepared(Instant now) {
         prepared.forEach((token, retained) -> {
-            if (!now.isBefore(retained.expiresAt())
-                    && prepared.remove(token, retained)) {
+            if (!now.isBefore(retained.expiresAt()) && prepared.remove(token, retained)) {
                 retained.close();
             }
         });
     }
 
-    private ImportPreview zipPreview(ZipPlan plan) throws IOException {
-        List<ImportPreviewItem> items = new ArrayList<>();
-        for (ZipImportCandidate candidate : plan.scan().candidates()) {
-            DestinationResult destination = DestinationResult.success(
-                            DestinationType.ZIP,
-                            zipPreviewArtifactId(candidate.manifest()))
-                    .withVerification(VerificationStatus.VERIFIED);
-            items.add(previewItem(candidate.manifest(), destination));
-        }
-        List<String> issues = plan.scan().issues().stream()
-                .map(FileBackupImportService::zipIssue)
-                .toList();
-        return new ImportPreview(plan.token(), ImportKind.ZIP, plan.folder().toString(), items, issues);
-    }
-
-    private ImportPreview gitPreview(GitPlan plan) throws IOException {
-        List<ImportPreviewItem> items = new ArrayList<>();
-        ImportSourceId previewSource = gitSourceId(plan.fetched().remote());
-        for (GitImportCandidate candidate : plan.fetched().candidates()) {
-            DestinationResult destination = DestinationResult.importedSuccess(
-                    DestinationType.GIT,
-                    GitSnapshot.refName(
-                            candidate.manifest().worldId(),
-                            candidate.manifest().backupId()),
-                    previewSource,
-                    VerificationStatus.VERIFIED,
-                    SyncStatus.SYNCED);
-            items.add(previewItem(candidate.manifest(), destination));
-        }
-        List<String> issues = plan.fetched().issues().stream()
-                .map(issue -> issue.location() + ": " + issue.message())
+    /** What importing each record would do, judged against one read of the catalog. */
+    private List<ImportPreviewItem> previewItems(List<BackupRecord> records) throws IOException {
+        Map<BackupId, BackupRecord> listed = catalog.listAll().stream()
+                .collect(Collectors.toMap(record -> record.manifest().backupId(), Function.identity()));
+        return records.stream()
+                .map(record -> previewItem(record, CatalogMergeResult.merge(
+                        Optional.ofNullable(listed.get(record.manifest().backupId())), record).status()))
                 .toList();
-        return new ImportPreview(
-                plan.token(), ImportKind.GIT, plan.fetched().remote(), items, issues);
     }
 
-    private ImportPreviewItem previewItem(
-            BackupManifest manifest,
-            DestinationResult destination) throws IOException {
-        ImportDisposition disposition = disposition(catalog.previewMerge(record(manifest, destination)));
-        return previewItem(manifest, destination.destination(), disposition);
-    }
-
-    private ImportPreviewItem localPreviewItem(BackupRecord record) throws IOException {
-        DestinationResult display = record.result().destinations().getFirst();
-        return previewItem(record.manifest(), display.destination(), disposition(catalog.previewMerge(record)));
-    }
-
-    private static ImportPreviewItem previewItem(
-            BackupManifest manifest,
-            DestinationType destination,
-            ImportDisposition disposition) {
-        String detail = switch (disposition) {
-            case ADD -> "Add recovered backup";
-            case MERGE -> "Attach recovered destination to existing backup";
-            case UNCHANGED -> "Already indexed identically";
-            case CONFLICT -> "Conflict; existing metadata will not be overwritten";
-        };
-        return new ImportPreviewItem(manifest, destination, disposition, detail);
-    }
-
-    static ImportDisposition disposition(CatalogMergeStatus status) {
-        return switch (status) {
+    private static ImportPreviewItem previewItem(BackupRecord record, CatalogMergeStatus status) {
+        return new ImportPreviewItem(record.manifest(), switch (status) {
             case ADDED -> ImportDisposition.ADD;
             case MERGED -> ImportDisposition.MERGE;
             case UNCHANGED -> ImportDisposition.UNCHANGED;
             case CONFLICT -> ImportDisposition.CONFLICT;
-        };
-    }
-
-    private static Set<BackupId> validateSelection(PreparedPlan plan, Set<BackupId> selected) {
-        Set<BackupId> chosen = Set.copyOf(Objects.requireNonNull(selected, "selected"));
-        if (!plan.backupIds().containsAll(chosen)) {
-            throw new IllegalArgumentException("Selected backups are not part of this preview");
-        }
-        return chosen;
+        });
     }
 
-    private ImportSummary executeZip(ZipPlan plan, Set<BackupId> selected) throws IOException {
-        MutableSummary summary = new MutableSummary(ImportKind.ZIP, plan.scan().issues().size());
-        List<ZipImportCandidate> candidates = selectedZipCandidates(plan, selected);
-        for (ZipImportCandidate candidate : candidates) {
-            ZipBackupStore
-                    .requireUnchangedImportCandidate(candidate);
-        }
-        for (ZipImportCandidate candidate : candidates) {
-            DestinationResult destination = importZipDestination(candidate);
-            deletions.restore(candidate.manifest().backupId());
-            merge(summary, record(candidate.manifest(), destination));
+    /**
+     * Copies each chosen archive into the managed ZIP folder, checking it against the preview in
+     * the same pass. An archive that changed since the preview is an issue; the others still import.
+     */
+    private ImportSummary executeZip(ZipPlan plan, Set<BackupId> selected) throws Exception {
+        Summary summary = new Summary(plan.scan().issues().size());
+        List<BackupRecord> imported = new ArrayList<>();
+        for (ZipImportCandidate candidate : plan.scan().candidates()) {
+            if (!selected.contains(candidate.manifest().backupId())) {
+                continue;
+            }
+            try {
+                ZipBackupArtifact artifact = zipStores.store(candidate.manifest().worldId()).importCopy(candidate);
+                imported.add(LocalBackupScan.record(candidate.manifest(), zipCopy(artifact.artifactId())));
+            } catch (IOException failure) {
+                summary.issues++;
+                LOGGER.warn("The ZIP import left out {}: {}", candidate.archivePath(),
+                        SafeText.from(failure, "it could not be copied", 512));
+            }
         }
+        deletions.unmark(idsOf(imported));
+        summary.add(mergeByWorld(imported, (world, records) -> records));
         return summary.finish(Map.of());
     }
 
-    private DestinationResult importZipDestination(ZipImportCandidate candidate) throws IOException {
-        ZipBackupArtifact artifact = zipStores.store(
-                candidate.manifest().worldId()).importCopy(candidate);
-        return DestinationResult.success(DestinationType.ZIP, artifact.artifactId())
-                .withVerification(VerificationStatus.VERIFIED);
-    }
-
-    private static List<ZipImportCandidate> selectedZipCandidates(
-            ZipPlan plan,
-            Set<BackupId> selected) {
-        return plan.scan().candidates().stream()
-                .filter(candidate -> selected.contains(candidate.manifest().backupId()))
-                .toList();
-    }
-
+    /**
+     * Installs the chosen snapshots after checking each in full, records where they came from, and
+     * offers the repository as the remote of each world it holds.
+     */
     private ImportSummary executeGit(GitPlan plan, Set<BackupId> selected) throws Exception {
-        List<GitImportCandidate> candidates = plan.fetched().candidates().stream()
+        GitPreparedImport fetched = plan.fetched();
+        List<GitImportCandidate> candidates = fetched.candidates().stream()
                 .filter(candidate -> selected.contains(candidate.manifest().backupId()))
                 .toList();
-        Map<BackupId, GitImportInstallStatus> installs = git.installImport(
-                plan.fetched(), candidates, true).toCompletableFuture().get();
-        MutableSummary summary = new MutableSummary(
-                ImportKind.GIT, plan.fetched().issues().size());
-        ImportSourceId sourceId = gitSourceId(plan.fetched().remote());
+        Map<BackupId, GitImportInstallStatus> installs = AsyncTasks.await(git.installImport(fetched, candidates));
+        Summary summary = new Summary(fetched.issues().size());
+        ImportSourceId sourceId = gitSourceId(fetched.remote());
         Map<BackupId, ImportArtifactBinding> bindings = new LinkedHashMap<>();
+        List<BackupRecord> installed = new ArrayList<>();
         for (GitImportCandidate candidate : candidates) {
-            if (installs.get(candidate.manifest().backupId()) != GitImportInstallStatus.CONFLICT) {
-                bindings.put(candidate.manifest().backupId(), new ImportArtifactBinding(
-                        candidate.manifest().worldId(),
-                        candidate.manifest().backupId(),
-                        candidate.sourceRef(),
-                        candidate.commitId()));
+            BackupId backupId = candidate.manifest().backupId();
+            GitImportInstallStatus status = installs.getOrDefault(backupId, GitImportInstallStatus.FAILED);
+            if (status == GitImportInstallStatus.CONFLICT) {
+                summary.count(CatalogMergeStatus.CONFLICT);
+            } else if (status == GitImportInstallStatus.FAILED) {
+                summary.issues++;
+            } else {
+                bindings.put(backupId, new ImportArtifactBinding(
+                        candidate.manifest().worldId(), backupId, candidate.sourceRef(), candidate.commitId()));
+                installed.add(LocalBackupScan.record(candidate.manifest(), importedGitCopy(candidate, sourceId)));
             }
         }
         if (!bindings.isEmpty()) {
-            sources.put(ImportSource.git(sourceId, plan.fetched().remote(), bindings));
+            sources.put(ImportSource.git(sourceId, fetched.remote(), bindings));
         }
-        for (GitImportCandidate candidate : candidates) {
-            if (installs.get(candidate.manifest().backupId()) == GitImportInstallStatus.CONFLICT) {
-                summary.conflicts++;
-                summary.worlds.add(candidate.manifest().worldId());
-                continue;
-            }
-            DestinationResult destination = gitDestination(candidate, sourceId);
-            deletions.restore(candidate.manifest().backupId());
-            merge(summary, record(candidate.manifest(), destination));
+        deletions.unmark(idsOf(installed));
+        summary.add(mergeByWorld(installed, (world, records) -> records));
+        Map<WorldId, String> connections = new LinkedHashMap<>();
+        if (connectableRemote(fetched.remote())) {
+            installed.forEach(record -> connections.putIfAbsent(record.manifest().worldId(), fetched.remote()));
         }
-        Map<WorldId, String> connections = connectableRemote(plan.fetched().remote())
-                ? candidates.stream()
-                        .filter(candidate -> installs.get(candidate.manifest().backupId())
-                                != GitImportInstallStatus.CONFLICT)
-                        .collect(Collectors.toMap(
-                        candidate -> candidate.manifest().worldId(),
-                        ignored -> plan.fetched().remote(),
-                        (first, ignored) -> first))
-                : Map.of();
         return summary.finish(connections);
     }
 
+    /** Lists stored backups again; a copy that is gone by the time its world is free is left out. */
+    private ImportSummary executeLocal(LocalBackupScan.Result found, Set<BackupId> selected) throws Exception {
+        Summary summary = new Summary(found.issues());
+        found.listed().stream()
+                .filter(record -> selected.contains(record.manifest().backupId()))
+                .forEach(record -> summary.count(CatalogMergeStatus.UNCHANGED));
+        List<BackupRecord> discovered = found.discovered().stream()
+                .filter(record -> selected.contains(record.manifest().backupId()))
+                .toList();
+        summary.add(mergeByWorld(discovered, localScan::stillStored));
+        return summary.finish(Map.of());
+    }
+
+    /** Merges records one world at a time, each inside that world's gate, with one catalog write per world. */
+    private Map<BackupId, CatalogMergeResult> mergeByWorld(Collection<BackupRecord> records, WorldFilter filter)
+            throws Exception {
+        Map<WorldId, List<BackupRecord>> byWorld = records.stream().collect(Collectors.groupingBy(
+                record -> record.manifest().worldId(), LinkedHashMap::new, Collectors.toList()));
+        Map<BackupId, CatalogMergeResult> results = new LinkedHashMap<>();
+        for (Map.Entry<WorldId, List<BackupRecord>> world : byWorld.entrySet()) {
+            try (WorldOperationGate.Permit ignored = operationGate.enter(world.getKey())) {
+                results.putAll(catalog.mergeAll(filter.keep(world.getKey(), world.getValue())));
+            }
+        }
+        return results;
+    }
+
     static boolean connectableRemote(String remote) {
         try {
             RemoteUrlPolicy.validateConfiguredPlain(remote);
@@ -458,184 +378,39 @@ static boolean connectableRemote(String remote) {
         }
     }
 
-    private static DestinationResult gitDestination(
-            GitImportCandidate candidate,
-            ImportSourceId sourceId) {
-        String artifact = GitSnapshot.refName(
-                candidate.manifest().worldId(), candidate.manifest().backupId());
+    private static DestinationResult zipCopy(String artifactId) {
+        return DestinationResult.success(DestinationType.ZIP, artifactId).withVerification(VerificationStatus.VERIFIED);
+    }
+
+    private static DestinationResult importedGitCopy(GitImportCandidate candidate, ImportSourceId sourceId) {
         return DestinationResult.importedSuccess(
                 DestinationType.GIT,
-                artifact,
+                GitSnapshot.refName(candidate.manifest().worldId(), candidate.manifest().backupId()),
                 sourceId,
                 VerificationStatus.VERIFIED,
                 SyncStatus.SYNCED);
     }
 
-    private ImportSummary rebuildLocalBlocking() throws Exception {
-        LocalScan scan = scanLocal();
-        return executeLocal(
-                new LocalPlan(UUID.randomUUID(), scan.records(), scan.issues()),
-                scan.records().stream()
-                        .map(record -> record.manifest().backupId())
-                        .collect(Collectors.toUnmodifiableSet()));
-    }
-
-    private ImportSummary executeLocal(LocalPlan plan, Set<BackupId> selected) throws IOException {
-        MutableSummary summary = new MutableSummary(ImportKind.LOCAL_REBUILD, plan.issues());
-        for (BackupRecord record : plan.records()) {
-            if (selected.contains(record.manifest().backupId())) {
-                deletions.restore(record.manifest().backupId());
-                merge(summary, record);
-            }
-        }
-        return summary.finish(Map.of());
-    }
-
-    private LocalScan scanLocal() throws Exception {
-        LocalScan scan = new LocalScan();
-        git.rebuildSnapshotRefs().toCompletableFuture().get();
-        List<GitSnapshot> snapshots = git.listSnapshots(Optional.empty()).toCompletableFuture().get();
-        List<ImportSource> importSources = sources.list();
-        Set<WorldId> worlds = new HashSet<>(configuredWorlds.get());
-        for (GitSnapshot snapshot : snapshots) {
-            if (deletions.contains(snapshot.backupId())) {
-                continue;
-            }
-            worlds.add(snapshot.worldId());
-            try {
-                BackupManifest manifest = git.readManifest(
-                        snapshot.worldId(), snapshot.backupId()).toCompletableFuture().get();
-                DestinationResult destination = gitRebuildDestination(snapshot, importSources);
-                scan.add(record(manifest, destination));
-            } catch (InterruptedException exception) {
-                Thread.currentThread().interrupt();
-                throw exception;
-            } catch (Exception exception) {
-                scan.issue();
-            }
-        }
-        catalog.listAll().stream().map(record -> record.manifest().worldId()).forEach(worlds::add);
-        Set<Path> scannedZipRoots = new HashSet<>();
-        scannedZipRoots.add(zipStores.defaultStore().root());
-        scanDefaultZip(scan, worlds);
-        for (WorldId worldId : worlds) {
-            ZipBackupStore store = zipStores.store(worldId);
-            if (scannedZipRoots.add(store.root())) {
-                scanZipStore(scan, store);
-            }
-        }
-        return scan;
-    }
-
-    private static DestinationResult gitRebuildDestination(
-            GitSnapshot snapshot,
-            List<ImportSource> importSources) {
-        for (ImportSource source : importSources) {
-            if (source.mode() == ImportSourceMode.ZIP_LINK) {
-                continue;
-            }
-            Optional<ImportArtifactBinding> binding = source.artifact(snapshot.backupId());
-            if (binding.isEmpty()
-                    || !binding.orElseThrow().worldId().equals(snapshot.worldId())
-                    || !binding.orElseThrow().fingerprint().equals(snapshot.commitId())) {
-                continue;
-            }
-            return source.mode() == ImportSourceMode.GIT_FULL_DOWNLOAD
-                    ? DestinationResult.importedSuccess(
-                            DestinationType.GIT,
-                            snapshot.refName(),
-                            source.id(),
-                            VerificationStatus.NOT_VERIFIED,
-                            SyncStatus.SYNCED)
-                    : DestinationResult.externalSuccess(
-                            DestinationType.GIT,
-                            snapshot.refName(),
-                            source.id(),
-                            VerificationStatus.NOT_VERIFIED,
-                            SyncStatus.SYNCED);
-        }
-        return DestinationResult.success(DestinationType.GIT, snapshot.refName())
-                .withVerification(VerificationStatus.NOT_VERIFIED);
-    }
-
-    private void scanDefaultZip(LocalScan scan, Set<WorldId> worlds) {
-        try {
-            for (ZipBackupArtifact artifact : zipStores.defaultStore().listCompleteArchives()) {
-                if (deletions.contains(artifact.manifest().backupId())) {
-                    continue;
-                }
-                worlds.add(artifact.manifest().worldId());
-                scan.add(managedZipRecord(artifact));
-            }
-        } catch (IOException exception) {
-            scan.issue();
-        }
-    }
-
-    private void scanZipStore(
-            LocalScan scan,
-            ZipBackupStore store) {
-        try {
-            for (ZipBackupArtifact artifact : store.listCompleteArchives()) {
-                if (deletions.contains(artifact.manifest().backupId())) {
-                    continue;
-                }
-                scan.add(managedZipRecord(artifact));
-            }
-        } catch (IOException exception) {
-            scan.issue();
-        }
-    }
-
-    private static BackupRecord managedZipRecord(ZipBackupArtifact artifact) {
-        DestinationResult destination = DestinationResult.success(
-                DestinationType.ZIP, artifact.artifactId())
-                .withVerification(VerificationStatus.VERIFIED);
-        return record(artifact.manifest(), destination);
-    }
-
-    private void merge(MutableSummary summary, BackupRecord record) throws IOException {
-        CatalogMergeResult result = catalog.merge(record);
-        summary.worlds.add(record.manifest().worldId());
-        switch (result.status()) {
-            case ADDED -> summary.added++;
-            case MERGED -> summary.merged++;
-            case UNCHANGED -> summary.unchanged++;
-            case CONFLICT -> summary.conflicts++;
-            default -> throw new IllegalStateException("Unsupported catalog merge status");
-        }
-    }
-
-    private static BackupRecord record(
-            BackupManifest manifest,
-            DestinationResult destination) {
-        return new BackupRecord(
-                manifest,
-                BackupResult.aggregate(
-                        manifest.backupId(),
-                        manifest.worldId(),
-                        List.of(destination),
-                        manifest.createdAt()));
-    }
-
-    static String zipPreviewArtifactId(BackupManifest manifest) {
-        return manifest.worldId() + "/" + ZipBackupStore.archiveFilename(manifest);
-    }
-
-    private static String zipIssue(ZipImportIssue issue) {
-        return issue.path() + ": " + issue.message();
+    private static List<BackupId> idsOf(List<BackupRecord> records) {
+        return records.stream().map(record -> record.manifest().backupId()).toList();
     }
 
+    /**
+     * The identity of a Git import source. The literal prefix matches the historical
+     * {@code GitHydrationMode.FULL_DOWNLOAD} derivation, so sources imported by older versions keep
+     * their identity and merge instead of duplicating on a new import.
+     */
     private static ImportSourceId gitSourceId(String remote) {
-        // The literal prefix matches the historical GitHydrationMode.FULL_DOWNLOAD
-        // derivation so that already-imported full-download sources keep the same
-        // identity and continue to merge instead of duplicating on re-import.
         return ImportSourceId.derived("FULL_DOWNLOAD\0" + remote);
     }
 
-    private record RetainedPlan(
-            PreparedPlan plan,
-            Instant expiresAt) implements AutoCloseable {
+    /** Which records of one world to merge, decided while that world's gate is held. */
+    @FunctionalInterface
+    private interface WorldFilter {
+        List<BackupRecord> keep(WorldId worldId, List<BackupRecord> records) throws Exception;
+    }
+
+    private record RetainedPlan(PreparedPlan plan, Instant expiresAt) implements AutoCloseable {
         private RetainedPlan {
             Objects.requireNonNull(plan, "plan");
             Objects.requireNonNull(expiresAt, "expiresAt");
@@ -647,6 +422,7 @@ public void close() {
         }
     }
 
+    /** A previewed import, kept until the player runs it, discards it, or it expires. */
     private sealed interface PreparedPlan extends AutoCloseable permits ZipPlan, GitPlan, LocalPlan {
         UUID token();
 
@@ -657,21 +433,24 @@ default void close() {
         }
     }
 
-    private record ZipPlan(
-            UUID token,
-            Path folder,
-            ZipImportScan scan) implements PreparedPlan {
+    private record ZipPlan(UUID token, ZipImportScan scan) implements PreparedPlan {
         @Override
         public Set<BackupId> backupIds() {
             return scan.candidates().stream()
                     .map(candidate -> candidate.manifest().backupId())
                     .collect(Collectors.toUnmodifiableSet());
         }
+
+        /** Each candidate as the record an import would add; the archive name is the managed one. */
+        List<BackupRecord> records() {
+            return scan.candidates().stream()
+                    .map(candidate -> LocalBackupScan.record(candidate.manifest(), zipCopy(
+                            candidate.manifest().worldId() + "/" + ZipBackupStore.archiveFilename(candidate.manifest()))))
+                    .toList();
+        }
     }
 
-    private record GitPlan(
-            UUID token,
-            GitPreparedImport fetched) implements PreparedPlan {
+    private record GitPlan(UUID token, GitPreparedImport fetched) implements PreparedPlan {
         @Override
         public Set<BackupId> backupIds() {
             return fetched.candidates().stream()
@@ -679,108 +458,52 @@ public Set<BackupId> backupIds() {
                     .collect(Collectors.toUnmodifiableSet());
         }
 
+        List<BackupRecord> records() {
+            ImportSourceId sourceId = gitSourceId(fetched.remote());
+            return fetched.candidates().stream()
+                    .map(candidate -> LocalBackupScan.record(candidate.manifest(), importedGitCopy(candidate, sourceId)))
+                    .toList();
+        }
+
         @Override
         public void close() {
             fetched.close();
         }
     }
 
-    private record LocalPlan(
-            UUID token,
-            List<BackupRecord> records,
-            int issues) implements PreparedPlan {
-        private LocalPlan {
-            records = List.copyOf(records);
-        }
-
+    private record LocalPlan(UUID token, LocalBackupScan.Result found) implements PreparedPlan {
         @Override
         public Set<BackupId> backupIds() {
-            return records.stream()
-                    .map(record -> record.manifest().backupId())
-                    .collect(Collectors.toUnmodifiableSet());
+            return found.backupIds();
         }
     }
 
-    private static final class LocalScan {
-        private final Map<BackupId, BackupRecord> records = new LinkedHashMap<>();
+    /** Totals of one import as it runs. */
+    private static final class Summary {
+        private final Map<CatalogMergeStatus, Integer> counts = new EnumMap<>(CatalogMergeStatus.class);
 
         private int issues;
 
-        private void add(BackupRecord candidate) {
-            BackupId backupId = candidate.manifest().backupId();
-            BackupRecord existing = records.get(backupId);
-            if (existing == null) {
-                records.put(backupId, candidate);
-                return;
-            }
-            if (!existing.manifest().equals(candidate.manifest())) {
-                issues++;
-                return;
-            }
-            Map<DestinationType, DestinationResult> destinations = new EnumMap<>(
-                    DestinationType.class);
-            existing.result().destinations().forEach(value ->
-                    destinations.put(value.destination(), value));
-            for (DestinationResult value : candidate.result().destinations()) {
-                DestinationResult current = destinations.putIfAbsent(value.destination(), value);
-                if (current != null && !sameArtifact(current, value)) {
-                    issues++;
-                    return;
-                }
-            }
-            records.put(backupId, new BackupRecord(
-                    existing.manifest(),
-                    BackupResult.aggregate(
-                            backupId,
-                            existing.manifest().worldId(),
-                            List.copyOf(destinations.values()),
-                            existing.result().completedAt())));
-        }
-
-        private void issue() {
-            issues++;
-        }
-
-        private List<BackupRecord> records() {
-            return List.copyOf(records.values());
-        }
-
-        private int issues() {
-            return issues;
+        private Summary(int issues) {
+            this.issues = issues;
         }
 
-        private static boolean sameArtifact(
-                DestinationResult first,
-                DestinationResult second) {
-            return first.artifactId().equals(second.artifactId())
-                    && first.ownership() == second.ownership()
-                    && first.importSourceId().equals(second.importSourceId());
+        private void count(CatalogMergeStatus status) {
+            counts.merge(status, 1, Integer::sum);
         }
-    }
-
-    private static final class MutableSummary {
-        private final ImportKind kind;
-
-        private final Set<WorldId> worlds = new HashSet<>();
-
-        private int added;
 
-        private int merged;
-
-        private int unchanged;
-
-        private int conflicts;
-
-        private int issues;
-
-        private MutableSummary(ImportKind kind, int issues) {
-            this.kind = kind;
-            this.issues = issues;
+        private void add(Map<BackupId, CatalogMergeResult> results) {
+            results.values().forEach(result -> count(result.status()));
         }
 
         private ImportSummary finish(Map<WorldId, String> connections) {
             return new ImportSummary(
-                    kind, added, merged, unchanged, conflicts, issues, worlds, connections);
+                    counts.getOrDefault(CatalogMergeStatus.ADDED, 0),
+                    counts.getOrDefault(CatalogMergeStatus.MERGED, 0),
+                    counts.getOrDefault(CatalogMergeStatus.UNCHANGED, 0),
+                    counts.getOrDefault(CatalogMergeStatus.CONFLICT, 0),
+                    issues,
+                    connections);
         }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/importing/FileImportSourceRegistry.java b/src/main/java/dev/ishaanko/worldarchive/importing/FileImportSourceRegistry.java
index 6257013..4dede18 100644
--- a/src/main/java/dev/ishaanko/worldarchive/importing/FileImportSourceRegistry.java
+++ b/src/main/java/dev/ishaanko/worldarchive/importing/FileImportSourceRegistry.java
@@ -3,32 +3,30 @@
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
 import com.google.gson.JsonArray;
-import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
-import com.google.gson.JsonParseException;
-import com.google.gson.JsonParser;
-import dev.ishaanko.worldarchive.core.AtomicFiles;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.ImportSourceId;
 import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.support.AtomicFiles;
+import dev.ishaanko.worldarchive.support.JsonFields;
+import dev.ishaanko.worldarchive.support.LockedFile;
 import java.io.IOException;
-import java.nio.channels.FileChannel;
-import java.nio.channels.FileLock;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
 import java.nio.file.Path;
-import java.nio.file.StandardOpenOption;
 import java.util.Comparator;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentMap;
-import java.util.concurrent.locks.ReentrantLock;
 
-/** Process-safe JSON registry for read-only import sources. */
-public final class FileImportSourceRegistry implements ImportSourceRegistry {
+/**
+ * The repositories that Git imports came from, and which imported backup came from which, in
+ * {@code import-sources.json}. The start-up rebuild uses it to list an imported snapshot as
+ * imported, and a delete unlinks what it deleted. Changes hold the file's lock across threads
+ * and processes.
+ */
+public final class FileImportSourceRegistry {
     private static final int CURRENT_SCHEMA_VERSION = 1;
 
     private static final Gson GSON = new GsonBuilder()
@@ -36,23 +34,20 @@ public final class FileImportSourceRegistry implements ImportSourceRegistry {
             .disableHtmlEscaping()
             .create();
 
-    private static final ConcurrentMap<Path, ReentrantLock> JVM_LOCKS = new ConcurrentHashMap<>();
+    private static final JsonFields<IOException> FIELDS = new JsonFields<>(IOException::new);
 
-    private final Path file;
-
-    private final Path lockFile;
+    private final LockedFile lock;
 
-    private final ReentrantLock jvmLock;
+    private final Path file;
 
     public FileImportSourceRegistry(Path file) {
-        this.file = file.toAbsolutePath().normalize();
-        this.lockFile = this.file.resolveSibling(this.file.getFileName() + ".lock");
-        this.jvmLock = JVM_LOCKS.computeIfAbsent(this.file, ignored -> new ReentrantLock());
+        this.lock = new LockedFile(file);
+        this.file = lock.file();
     }
 
-    @Override
+    /** Adds a source, or adds the source's bindings to the one already recorded for its location. */
     public void put(ImportSource source) throws IOException {
-        withLock(() -> {
+        lock.withLock(() -> {
             Map<ImportSourceId, ImportSource> sources = readSources();
             ImportSource current = sources.get(source.id());
             if (current != null
@@ -76,32 +71,35 @@ public void put(ImportSource source) throws IOException {
         });
     }
 
-    @Override
     public Optional<ImportSource> find(ImportSourceId sourceId) throws IOException {
-        return withLock(() -> Optional.ofNullable(readSources().get(sourceId)));
+        return lock.withLock(() -> Optional.ofNullable(readSources().get(sourceId)));
     }
 
-    @Override
     public List<ImportSource> list() throws IOException {
-        return withLock(() -> readSources().values().stream()
+        return lock.withLock(() -> readSources().values().stream()
                 .sorted(Comparator.comparing(ImportSource::id))
                 .toList());
     }
 
-    @Override
-    public void unlink(ImportSourceId sourceId, BackupId backupId) throws IOException {
-        withLock(() -> {
+    /** Unlinks deleted backups from the sources they came from; a source left with none goes too. */
+    public void unlink(Map<BackupId, ImportSourceId> deleted) throws IOException {
+        Map<BackupId, ImportSourceId> artifacts = Map.copyOf(deleted);
+        if (artifacts.isEmpty()) {
+            return;
+        }
+        lock.withLock(() -> {
             Map<ImportSourceId, ImportSource> sources = readSources();
-            ImportSource source = sources.get(sourceId);
-            if (source == null) {
-                return null;
-            }
-            ImportSource updated = source.withoutArtifact(backupId);
-            if (updated.artifacts().isEmpty()) {
-                sources.remove(sourceId);
-            } else {
-                sources.put(sourceId, updated);
-            }
+            artifacts.forEach((backupId, sourceId) -> {
+                ImportSource source = sources.get(sourceId);
+                if (source != null) {
+                    ImportSource updated = source.withoutArtifact(backupId);
+                    if (updated.artifacts().isEmpty()) {
+                        sources.remove(sourceId);
+                    } else {
+                        sources.put(sourceId, updated);
+                    }
+                }
+            });
             writeSources(sources);
             return null;
         });
@@ -111,29 +109,21 @@ private Map<ImportSourceId, ImportSource> readSources() throws IOException {
         if (!Files.exists(file, LinkOption.NOFOLLOW_LINKS)) {
             return new LinkedHashMap<>();
         }
-        if (Files.isSymbolicLink(file) || !Files.isRegularFile(file, LinkOption.NOFOLLOW_LINKS)) {
-            throw new IOException("Import source registry is not a safe regular file");
-        }
         try {
-            JsonElement parsed = JsonParser.parseString(AtomicFiles.readUtf8(file));
-            if (!parsed.isJsonObject()) {
-                throw new IOException("Import source registry root must be an object");
-            }
-            JsonObject root = parsed.getAsJsonObject();
-            int schemaVersion = root.get("schemaVersion").getAsInt();
+            JsonObject root = FIELDS.parseObject(AtomicFiles.readUtf8(file), "Import source registry");
+            int schemaVersion = FIELDS.requiredInt(root, "schemaVersion");
             if (schemaVersion != CURRENT_SCHEMA_VERSION) {
                 throw new IOException("Unsupported import source registry schema: " + schemaVersion);
             }
-            JsonArray encodedSources = root.getAsJsonArray("sources");
             Map<ImportSourceId, ImportSource> sources = new LinkedHashMap<>();
-            for (JsonElement element : encodedSources) {
-                ImportSource source = decodeSource(element.getAsJsonObject());
+            for (JsonObject encoded : FIELDS.requiredObjects(root, "sources")) {
+                ImportSource source = decodeSource(encoded);
                 if (sources.putIfAbsent(source.id(), source) != null) {
                     throw new IOException("Import source registry contains duplicate source IDs");
                 }
             }
             return sources;
-        } catch (JsonParseException | IllegalArgumentException | NullPointerException exception) {
+        } catch (IllegalArgumentException exception) {
             throw new IOException("Import source registry is malformed or invalid", exception);
         }
     }
@@ -172,13 +162,12 @@ private static JsonObject encodeBinding(ImportArtifactBinding binding) {
     }
 
     private static ImportSource decodeSource(JsonObject encoded) throws IOException {
-        ImportSourceId id = ImportSourceId.parse(requiredString(encoded, "id"));
-        ImportSourceMode mode = ImportSourceMode.valueOf(requiredString(encoded, "mode"));
-        String location = requiredString(encoded, "location");
-        JsonArray artifacts = encoded.getAsJsonArray("artifacts");
+        ImportSourceId id = ImportSourceId.parse(FIELDS.requiredString(encoded, "id"));
+        ImportSourceMode mode = FIELDS.requiredEnum(encoded, "mode", ImportSourceMode.class);
+        String location = FIELDS.requiredString(encoded, "location");
         Map<BackupId, ImportArtifactBinding> bindings = new LinkedHashMap<>();
-        for (JsonElement element : artifacts) {
-            ImportArtifactBinding binding = decodeBinding(element.getAsJsonObject());
+        for (JsonObject encodedBinding : FIELDS.requiredObjects(encoded, "artifacts")) {
+            ImportArtifactBinding binding = decodeBinding(encodedBinding);
             if (bindings.putIfAbsent(binding.backupId(), binding) != null) {
                 throw new IOException("Import source contains duplicate backup IDs");
             }
@@ -188,46 +177,9 @@ private static ImportSource decodeSource(JsonObject encoded) throws IOException
 
     private static ImportArtifactBinding decodeBinding(JsonObject encoded) throws IOException {
         return new ImportArtifactBinding(
-                WorldId.parse(requiredString(encoded, "worldId")),
-                BackupId.parse(requiredString(encoded, "backupId")),
-                requiredString(encoded, "locator"),
-                requiredString(encoded, "fingerprint"));
-    }
-
-    private static String requiredString(JsonObject encoded, String name) throws IOException {
-        JsonElement value = encoded.get(name);
-        if (value == null || !value.isJsonPrimitive() || !value.getAsJsonPrimitive().isString()) {
-            throw new IOException("Import source field is missing or invalid: " + name);
-        }
-        return value.getAsString();
-    }
-
-    private <T> T withLock(IoSupplier<T> operation) throws IOException {
-        jvmLock.lock();
-        try {
-            Path parent = file.getParent();
-            if (parent == null) {
-                throw new IOException("Import source registry path has no parent");
-            }
-            Files.createDirectories(parent);
-            if (Files.isSymbolicLink(lockFile)) {
-                throw new IOException("Import source registry lock must not be symbolic");
-            }
-            try (FileChannel channel = FileChannel.open(
-                            lockFile,
-                            StandardOpenOption.CREATE,
-                            StandardOpenOption.WRITE,
-                            LinkOption.NOFOLLOW_LINKS);
-                    FileLock ignored = channel.lock()) {
-                return operation.get();
-            }
-        } finally {
-            jvmLock.unlock();
-        }
-    }
-
-    @FunctionalInterface
-    private interface IoSupplier<T> {
-        T get() throws IOException;
+                WorldId.parse(FIELDS.requiredString(encoded, "worldId")),
+                BackupId.parse(FIELDS.requiredString(encoded, "backupId")),
+                FIELDS.requiredString(encoded, "locator"),
+                FIELDS.requiredString(encoded, "fingerprint"));
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/importing/ImportPreview.java b/src/main/java/dev/ishaanko/worldarchive/importing/ImportPreview.java
index 98f2c98..5f6b6f3 100644
--- a/src/main/java/dev/ishaanko/worldarchive/importing/ImportPreview.java
+++ b/src/main/java/dev/ishaanko/worldarchive/importing/ImportPreview.java
@@ -8,13 +8,11 @@
 public record ImportPreview(
         UUID token,
         ImportKind kind,
-        String source,
         List<ImportPreviewItem> items,
         List<String> issues) {
     public ImportPreview {
         Objects.requireNonNull(token, "token");
         Objects.requireNonNull(kind, "kind");
-        source = Objects.requireNonNull(source, "source");
         items = List.copyOf(Objects.requireNonNull(items, "items"));
         issues = List.copyOf(Objects.requireNonNull(issues, "issues"));
     }
diff --git a/src/main/java/dev/ishaanko/worldarchive/importing/ImportPreviewItem.java b/src/main/java/dev/ishaanko/worldarchive/importing/ImportPreviewItem.java
index 89ade0e..06fb4f3 100644
--- a/src/main/java/dev/ishaanko/worldarchive/importing/ImportPreviewItem.java
+++ b/src/main/java/dev/ishaanko/worldarchive/importing/ImportPreviewItem.java
@@ -1,19 +1,12 @@
 package dev.ishaanko.worldarchive.importing;
 
 import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.DestinationType;
 import java.util.Objects;
 
 /** One exact artifact in a user-confirmable import preview. */
-public record ImportPreviewItem(
-        BackupManifest manifest,
-        DestinationType destination,
-        ImportDisposition disposition,
-        String detail) {
+public record ImportPreviewItem(BackupManifest manifest, ImportDisposition disposition) {
     public ImportPreviewItem {
         Objects.requireNonNull(manifest, "manifest");
-        Objects.requireNonNull(destination, "destination");
         Objects.requireNonNull(disposition, "disposition");
-        detail = Objects.requireNonNull(detail, "detail");
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/importing/ImportSourceRegistry.java b/src/main/java/dev/ishaanko/worldarchive/importing/ImportSourceRegistry.java
deleted file mode 100644
index f4ece5b..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/importing/ImportSourceRegistry.java
+++ /dev/null
@@ -1,18 +0,0 @@
-package dev.ishaanko.worldarchive.importing;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.ImportSourceId;
-import java.io.IOException;
-import java.util.List;
-import java.util.Optional;
-
-/** Durable lookup for external sources referenced by catalog destinations. */
-public interface ImportSourceRegistry {
-    void put(ImportSource source) throws IOException;
-
-    Optional<ImportSource> find(ImportSourceId sourceId) throws IOException;
-
-    List<ImportSource> list() throws IOException;
-
-    void unlink(ImportSourceId sourceId, BackupId backupId) throws IOException;
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/importing/ImportSummary.java b/src/main/java/dev/ishaanko/worldarchive/importing/ImportSummary.java
index c4cc525..617e8ad 100644
--- a/src/main/java/dev/ishaanko/worldarchive/importing/ImportSummary.java
+++ b/src/main/java/dev/ishaanko/worldarchive/importing/ImportSummary.java
@@ -3,31 +3,22 @@
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.util.Map;
 import java.util.Objects;
-import java.util.Set;
 
 /** Final reconciliation totals and optional per-world remote connections. */
 public record ImportSummary(
-        ImportKind kind,
         int added,
         int merged,
         int unchanged,
         int conflicts,
         int issues,
-        Set<WorldId> worlds,
         Map<WorldId, String> connections) {
     public ImportSummary {
-        Objects.requireNonNull(kind, "kind");
         if (added < 0 || merged < 0 || unchanged < 0 || conflicts < 0 || issues < 0) {
             throw new IllegalArgumentException("Import totals must not be negative");
         }
-        worlds = Set.copyOf(Objects.requireNonNull(worlds, "worlds"));
         connections = Map.copyOf(Objects.requireNonNull(connections, "connections"));
     }
 
-    public int discovered() {
-        return added + merged + unchanged + conflicts;
-    }
-
     public String message() {
         return "Recovered " + (added + merged) + " backup(s); "
                 + unchanged + " already indexed, " + conflicts + " conflict(s), "
diff --git a/src/main/java/dev/ishaanko/worldarchive/importing/LocalBackupScan.java b/src/main/java/dev/ishaanko/worldarchive/importing/LocalBackupScan.java
new file mode 100644
index 0000000..d47df9e
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/importing/LocalBackupScan.java
@@ -0,0 +1,492 @@
+package dev.ishaanko.worldarchive.importing;
+
+import dev.ishaanko.worldarchive.catalog.BackupCatalog;
+import dev.ishaanko.worldarchive.catalog.CatalogMergeResult;
+import dev.ishaanko.worldarchive.catalog.CatalogMergeStatus;
+import dev.ishaanko.worldarchive.catalog.FileBackupDeletionRegistry;
+import dev.ishaanko.worldarchive.model.ArtifactOwnership;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.BackupRecord;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.SafeText;
+import dev.ishaanko.worldarchive.model.SyncStatus;
+import dev.ishaanko.worldarchive.model.VerificationStatus;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.storage.git.GitSnapshot;
+import dev.ishaanko.worldarchive.storage.git.WorldGitSnapshotStore;
+import dev.ishaanko.worldarchive.storage.zip.ZipArchiveSize;
+import dev.ishaanko.worldarchive.storage.zip.ZipBackupArtifact;
+import dev.ishaanko.worldarchive.storage.zip.ZipBackupStore;
+import dev.ishaanko.worldarchive.storage.zip.ZipBackupStoreResolver;
+import dev.ishaanko.worldarchive.support.AsyncTasks;
+import java.io.IOException;
+import java.nio.file.DirectoryStream;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import java.util.function.Function;
+import java.util.function.Supplier;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Finds the backups stored on this computer: the snapshots in the per-world Git repositories and
+ * the archives in the ZIP folders. A copy the catalog already lists costs a ref or a file name;
+ * manifests are read only for copies it does not list, so a start with every backup listed opens
+ * no archive, which matters for ZIP folders in OneDrive and similar synced folders. Backups the
+ * player deleted stay out. Nothing is written, and the network is used only after the catalog
+ * lost records, to ask each world's remote which of the Git copies found here it has.
+ */
+final class LocalBackupScan {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
+    private static final String REPOSITORY_SUFFIX = ".git";
+
+    private final BackupCatalog catalog;
+
+    private final FileBackupDeletionRegistry deletions;
+
+    private final FileImportSourceRegistry sources;
+
+    private final WorldGitSnapshotStore git;
+
+    private final ZipBackupStoreResolver zipStores;
+
+    private final Supplier<Set<WorldId>> configuredWorlds;
+
+    LocalBackupScan(
+            BackupCatalog catalog,
+            FileBackupDeletionRegistry deletions,
+            FileImportSourceRegistry sources,
+            WorldGitSnapshotStore git,
+            ZipBackupStoreResolver zipStores,
+            Supplier<Set<WorldId>> configuredWorlds) {
+        this.catalog = Objects.requireNonNull(catalog, "catalog");
+        this.deletions = Objects.requireNonNull(deletions, "deletions");
+        this.sources = Objects.requireNonNull(sources, "sources");
+        this.git = Objects.requireNonNull(git, "git");
+        this.zipStores = Objects.requireNonNull(zipStores, "zipStores");
+        this.configuredWorlds = Objects.requireNonNull(configuredWorlds, "configuredWorlds");
+    }
+
+    /**
+     * What one scan found.
+     *
+     * @param listed catalog records of backups whose found copies the catalog lists
+     * @param discovered records built from found copies that the catalog does not list
+     * @param stored every backup with a stored file, deleted or not
+     * @param issues copies that could not be read, and backups whose copies disagree
+     * @param complete whether every repository and folder could be listed, and every folder
+     *        that should hold a listed copy is there; only a complete scan shows which deleted
+     *        backups have no file left
+     */
+    record Result(
+            List<BackupRecord> listed,
+            List<BackupRecord> discovered,
+            Set<BackupId> stored,
+            int issues,
+            boolean complete) {
+        Result {
+            listed = List.copyOf(listed);
+            discovered = List.copyOf(discovered);
+            stored = Set.copyOf(stored);
+        }
+
+        /** The backups found, listed or not. */
+        Set<BackupId> backupIds() {
+            return Stream.concat(listed.stream(), discovered.stream())
+                    .map(record -> record.manifest().backupId())
+                    .collect(Collectors.toUnmodifiableSet());
+        }
+    }
+
+    Result scan() throws Exception {
+        List<BackupRecord> listed = catalog.listAll();
+        Found found = new Found(listed, deletions.marked());
+        requireListedFolders(found, listed);
+        Set<WorldId> worlds = new HashSet<>(configuredWorlds.get());
+        worlds.addAll(found.catalogWorlds());
+        worlds.addAll(scanGit(found, catalog.lostRecords()));
+        scanZip(found, worlds);
+        return found.result();
+    }
+
+    /**
+     * Counts the scan as incomplete when a folder that should hold a listed copy is missing, such
+     * as on a drive that is away: files of deleted backups may be there too.
+     */
+    private void requireListedFolders(Found found, List<BackupRecord> listed) {
+        Set<Path> repositories = new HashSet<>();
+        Set<Path> zipFolders = new HashSet<>();
+        for (BackupRecord record : listed) {
+            WorldId world = record.manifest().worldId();
+            for (DestinationResult copy : record.result().destinations()) {
+                if (!copy.isDurable() || copy.ownership() == ArtifactOwnership.EXTERNAL) {
+                    continue;
+                }
+                if (copy.destination() == DestinationType.GIT) {
+                    repositories.add(git.repositoryFor(world));
+                } else {
+                    zipFolders.add(zipStores.store(world).root().resolve(world.toString()));
+                }
+            }
+        }
+        // A repository must be an ordinary folder; a world's ZIP folder may be a link, which the store follows.
+        if (repositories.stream().anyMatch(folder -> !Files.isDirectory(folder, LinkOption.NOFOLLOW_LINKS))
+                || zipFolders.stream().anyMatch(folder -> !Files.isDirectory(folder))) {
+            found.incomplete();
+        }
+    }
+
+    /**
+     * The copies of scanned records whose files still exist. Run inside the world's operation
+     * gate before merging, so a copy that a delete or cleanup removed after the scan is not
+     * listed again.
+     */
+    List<BackupRecord> stillStored(WorldId worldId, List<BackupRecord> records) throws Exception {
+        boolean anyGit = records.stream().anyMatch(record -> destination(record, DestinationType.GIT).isPresent());
+        Set<String> refs = anyGit
+                ? AsyncTasks.await(git.listSnapshots(Optional.of(worldId))).stream()
+                        .map(GitSnapshot::refName)
+                        .collect(Collectors.toSet())
+                : Set.of();
+        Path zipRoot = zipStores.store(worldId).root();
+        List<BackupRecord> kept = new ArrayList<>();
+        for (BackupRecord record : records) {
+            List<DestinationResult> copies = record.result().destinations().stream()
+                    .filter(copy -> switch (copy.destination()) {
+                        case GIT -> refs.contains(copy.artifactId().orElseThrow());
+                        case ZIP -> Files.isRegularFile(
+                                zipRoot.resolve(copy.artifactId().orElseThrow()), LinkOption.NOFOLLOW_LINKS);
+                    })
+                    .toList();
+            if (!copies.isEmpty()) {
+                kept.add(withCopies(record, copies));
+            }
+        }
+        return kept;
+    }
+
+    /**
+     * Lists each world repository on its own, so one broken repository hides no other backup.
+     * After the catalog lost records, each world's remote is asked once which found copies it has.
+     */
+    private Set<WorldId> scanGit(Found found, boolean askRemotes) throws InterruptedException {
+        if (!git.rootListable()) {
+            found.incomplete();
+        }
+        Set<WorldId> worlds;
+        try {
+            worlds = gitWorlds();
+        } catch (IOException failure) {
+            found.unreadable("the Git folder " + git.repositoryRoot(), failure);
+            return Set.of();
+        }
+        for (WorldId world : worlds) {
+            List<GitSnapshot> snapshots;
+            try {
+                snapshots = AsyncTasks.await(git.listSnapshots(Optional.of(world)));
+            } catch (InterruptedException interrupted) {
+                throw interrupted;
+            } catch (Exception failure) {
+                found.unreadable("the Git repository " + git.repositoryFor(world), failure);
+                continue;
+            }
+            List<GitSnapshot> unlisted = new ArrayList<>();
+            for (GitSnapshot snapshot : snapshots) {
+                if (found.unlisted(snapshot.backupId(), DestinationType.GIT, snapshot.refName())) {
+                    unlisted.add(snapshot);
+                }
+            }
+            if (!unlisted.isEmpty()) {
+                discoverGit(found, world, unlisted, askRemotes ? remoteCommits(world) : Map.of());
+            }
+        }
+        return worlds;
+    }
+
+    /**
+     * Each backup's commit on the world's remote; empty without a remote, and when the remote
+     * cannot be reached, which is only logged: the copies are then listed as not synced.
+     */
+    private Map<BackupId, String> remoteCommits(WorldId world) throws InterruptedException {
+        if (!git.remoteConfigured(world)) {
+            return Map.of();
+        }
+        try {
+            return AsyncTasks.await(git.remoteSnapshotCommits(world));
+        } catch (InterruptedException interrupted) {
+            throw interrupted;
+        } catch (Exception unreachable) {
+            LOGGER.warn("Stored backups: the Git remote of world {} could not tell which backups it holds: {}",
+                    world, SafeText.from(unreachable, "it cannot be reached", 512));
+            return Map.of();
+        }
+    }
+
+    private void discoverGit(Found found, WorldId world, List<GitSnapshot> unlisted, Map<BackupId, String> onRemote)
+            throws InterruptedException {
+        Map<BackupId, BackupManifest> manifests;
+        List<ImportSource> imports;
+        try {
+            manifests = AsyncTasks.await(git.readManifests(world, unlisted));
+            imports = sources.list();
+        } catch (InterruptedException interrupted) {
+            throw interrupted;
+        } catch (Exception failure) {
+            found.issue("the Git snapshots of world " + world, failure);
+            return;
+        }
+        for (GitSnapshot snapshot : unlisted) {
+            BackupManifest manifest = manifests.get(snapshot.backupId());
+            if (manifest == null || !manifest.worldId().equals(world)) {
+                found.issue(snapshot.refName(), new IOException("Its manifest is missing or does not match"));
+            } else {
+                found.discover(record(manifest, gitCopy(snapshot, imports, onRemote)));
+            }
+        }
+    }
+
+    /**
+     * The Git copy of a snapshot: imported when an import recorded this exact commit, otherwise
+     * WorldArchive's own, synced when the remote has the same commit. Nothing was checked yet, so
+     * it is not verified.
+     */
+    private static DestinationResult gitCopy(
+            GitSnapshot snapshot,
+            List<ImportSource> imports,
+            Map<BackupId, String> onRemote) {
+        for (ImportSource source : imports) {
+            boolean boundHere = source.mode() != ImportSourceMode.ZIP_LINK && source.artifact(snapshot.backupId())
+                    .filter(binding -> binding.worldId().equals(snapshot.worldId())
+                            && binding.fingerprint().equals(snapshot.commitId()))
+                    .isPresent();
+            if (boundHere) {
+                return source.mode() == ImportSourceMode.GIT_FULL_DOWNLOAD
+                        ? DestinationResult.importedSuccess(DestinationType.GIT, snapshot.refName(), source.id(),
+                                VerificationStatus.NOT_VERIFIED, SyncStatus.SYNCED)
+                        : DestinationResult.externalSuccess(DestinationType.GIT, snapshot.refName(), source.id(),
+                                VerificationStatus.NOT_VERIFIED, SyncStatus.SYNCED);
+            }
+        }
+        DestinationResult own = DestinationResult.success(DestinationType.GIT, snapshot.refName());
+        return snapshot.commitId().equals(onRemote.get(snapshot.backupId())) ? own.withSync(SyncStatus.SYNCED) : own;
+    }
+
+    /**
+     * Lists each ZIP folder that a world uses. A world's archives are found only in the folder the
+     * world uses now: the catalog names an archive by world and file name, and restore looks for
+     * it in that world's folder.
+     */
+    private void scanZip(Found found, Set<WorldId> worlds) {
+        Map<Path, ZipBackupStore> stores = new LinkedHashMap<>();
+        ZipBackupStore defaultStore = zipStores.defaultStore();
+        stores.put(defaultStore.root(), defaultStore);
+        for (WorldId world : worlds) {
+            ZipBackupStore store = zipStores.store(world);
+            stores.putIfAbsent(store.root(), store);
+        }
+        stores.values().forEach(store -> scanZipFolder(found, store));
+    }
+
+    private void scanZipFolder(Found found, ZipBackupStore store) {
+        if (!store.rootListable()) {
+            found.incomplete();
+        }
+        Set<WorldId> worlds;
+        try {
+            worlds = worldFolders(store.root());
+        } catch (IOException failure) {
+            found.unreadable("the ZIP folder " + store.root(), failure);
+            return;
+        }
+        Set<String> unlisted = new HashSet<>();
+        for (WorldId world : worlds) {
+            if (!zipStores.store(world).root().equals(store.root())) {
+                continue;
+            }
+            try {
+                for (ZipArchiveSize archive : store.listSizes(world)) {
+                    String artifactId = world + "/" + archive.archivePath().getFileName();
+                    if (found.unlisted(archive.backupId(), DestinationType.ZIP, artifactId)) {
+                        unlisted.add(artifactId);
+                    }
+                }
+            } catch (IOException failure) {
+                found.unreadable("the ZIP folder " + store.root().resolve(world.toString()), failure);
+            }
+        }
+        if (!unlisted.isEmpty()) {
+            discoverZip(found, store, unlisted);
+        }
+    }
+
+    /** Reads the manifest at the start of each archive in the folder and keeps the unlisted ones. */
+    private void discoverZip(Found found, ZipBackupStore store, Set<String> unlisted) {
+        List<ZipBackupArtifact> artifacts;
+        try {
+            artifacts = store.listArchives();
+        } catch (IOException failure) {
+            found.issue("the ZIP folder " + store.root(), failure);
+            return;
+        }
+        for (ZipBackupArtifact artifact : artifacts) {
+            if (unlisted.remove(artifact.artifactId())) {
+                found.discover(record(artifact.manifest(), DestinationResult.success(DestinationType.ZIP, artifact.artifactId())));
+            }
+        }
+        unlisted.forEach(artifactId -> found.issue(artifactId, new IOException("It cannot be read; Verify says why")));
+    }
+
+    /** The worlds that have a repository in the Git folder, by the store's own naming rule. */
+    private Set<WorldId> gitWorlds() throws IOException {
+        Set<WorldId> worlds = new HashSet<>();
+        Path root = git.repositoryRoot();
+        if (!Files.isDirectory(root, LinkOption.NOFOLLOW_LINKS)) {
+            return worlds;
+        }
+        try (DirectoryStream<Path> folders = Files.newDirectoryStream(root, "*" + REPOSITORY_SUFFIX)) {
+            for (Path folder : folders) {
+                String name = folder.getFileName().toString();
+                parseWorld(name.substring(0, name.length() - REPOSITORY_SUFFIX.length()))
+                        .filter(world -> git.repositoryFor(world).equals(folder))
+                        .ifPresent(worlds::add);
+            }
+        }
+        return worlds;
+    }
+
+    /**
+     * The world folders in a ZIP folder, links included, as the store follows them; a folder that
+     * does not exist holds none.
+     */
+    private static Set<WorldId> worldFolders(Path root) throws IOException {
+        Set<WorldId> worlds = new HashSet<>();
+        if (!Files.isDirectory(root, LinkOption.NOFOLLOW_LINKS)) {
+            return worlds;
+        }
+        try (DirectoryStream<Path> entries = Files.newDirectoryStream(root)) {
+            for (Path entry : entries) {
+                if (Files.isDirectory(entry)) {
+                    parseWorld(entry.getFileName().toString()).ifPresent(worlds::add);
+                }
+            }
+        }
+        return worlds;
+    }
+
+    private static Optional<WorldId> parseWorld(String name) {
+        try {
+            return Optional.of(WorldId.parse(name));
+        } catch (IllegalArgumentException notAWorld) {
+            return Optional.empty();
+        }
+    }
+
+    private static Optional<DestinationResult> destination(BackupRecord record, DestinationType type) {
+        return record.result().destinations().stream().filter(copy -> copy.destination() == type).findFirst();
+    }
+
+    private static BackupRecord withCopies(BackupRecord record, List<DestinationResult> copies) {
+        return new BackupRecord(record.manifest(), new BackupResult(
+                record.manifest().backupId(), record.manifest().worldId(), copies, record.result().completedAt()));
+    }
+
+    /** A record of one found copy; the backup counts as completed when it was made. */
+    static BackupRecord record(BackupManifest manifest, DestinationResult copy) {
+        return new BackupRecord(manifest, new BackupResult(
+                manifest.backupId(), manifest.worldId(), List.of(copy), manifest.createdAt()));
+    }
+
+    /** What the scan has found so far, compared with the catalog as it was when the scan began. */
+    private static final class Found {
+        private final Map<BackupId, BackupRecord> catalog;
+
+        private final Set<BackupId> deleted;
+
+        private final Set<BackupId> stored = new HashSet<>();
+
+        private final Set<BackupId> listedFound = new HashSet<>();
+
+        private final Map<BackupId, BackupRecord> discovered = new LinkedHashMap<>();
+
+        private int issues;
+
+        private boolean complete = true;
+
+        private Found(List<BackupRecord> catalog, Set<BackupId> deleted) {
+            this.catalog = catalog.stream().collect(Collectors.toMap(
+                    record -> record.manifest().backupId(), Function.identity(), (first, second) -> first, HashMap::new));
+            this.deleted = deleted;
+        }
+
+        private Set<WorldId> catalogWorlds() {
+            return catalog.values().stream().map(record -> record.manifest().worldId()).collect(Collectors.toSet());
+        }
+
+        /** Notes a stored copy; true when it is neither deleted nor listed, so its manifest is needed. */
+        private boolean unlisted(BackupId backupId, DestinationType type, String artifactId) {
+            stored.add(backupId);
+            if (deleted.contains(backupId)) {
+                return false;
+            }
+            boolean listed = Optional.ofNullable(catalog.get(backupId))
+                    .flatMap(record -> destination(record, type))
+                    .flatMap(DestinationResult::artifactId)
+                    .filter(artifactId::equals)
+                    .isPresent();
+            if (listed) {
+                listedFound.add(backupId);
+            }
+            return !listed;
+        }
+
+        /** Adds a found copy; copies of one backup that disagree are an issue, and the first stays. */
+        private void discover(BackupRecord record) {
+            BackupId backupId = record.manifest().backupId();
+            CatalogMergeResult merged = CatalogMergeResult.merge(Optional.ofNullable(discovered.get(backupId)), record);
+            if (merged.status() == CatalogMergeStatus.CONFLICT) {
+                issue("backup " + backupId, new IOException("Its Git and ZIP copies describe different backups"));
+            } else {
+                discovered.put(backupId, merged.record());
+            }
+        }
+
+        private void issue(String what, Exception failure) {
+            issues++;
+            LOGGER.warn("Stored backups: {} was left out: {}", what, SafeText.from(failure, "it cannot be read", 512));
+        }
+
+        private void unreadable(String what, Exception failure) {
+            complete = false;
+            issue(what, failure);
+        }
+
+        /** A folder that may hold stored copies cannot be seen now, which is not an issue of a copy. */
+        private void incomplete() {
+            complete = false;
+        }
+
+        private Result result() {
+            List<BackupRecord> listed = listedFound.stream()
+                    .filter(backupId -> !discovered.containsKey(backupId))
+                    .map(catalog::get)
+                    .toList();
+            return new Result(listed, List.copyOf(discovered.values()), stored, issues, complete);
+        }
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/model/BackupManifest.java b/src/main/java/dev/ishaanko/worldarchive/model/BackupManifest.java
index 3c2102a..271a43f 100644
--- a/src/main/java/dev/ishaanko/worldarchive/model/BackupManifest.java
+++ b/src/main/java/dev/ishaanko/worldarchive/model/BackupManifest.java
@@ -1,6 +1,5 @@
 package dev.ishaanko.worldarchive.model;
 
-import java.nio.charset.StandardCharsets;
 import java.time.DateTimeException;
 import java.time.Instant;
 import java.time.ZoneOffset;
@@ -25,6 +24,9 @@ public record BackupManifest(
         Optional<GameVersionStamp> gameVersion) {
     public static final int CURRENT_FORMAT_VERSION = 1;
 
+    /** The longest label in UTF-16 units; the Create screen's label box stops here too. */
+    public static final int MAXIMUM_LABEL_LENGTH = 128;
+
     private static final Pattern SHA256 = Pattern.compile("[0-9a-f]{64}");
 
     public BackupManifest {
@@ -33,10 +35,9 @@ public record BackupManifest(
         }
         Objects.requireNonNull(backupId, "backupId");
         Objects.requireNonNull(worldId, "worldId");
-        worldName = requireText(worldName, "worldName", 255);
+        worldName = SafeText.require(worldName, "worldName", 255);
         label = Objects.requireNonNull(label, "label")
-                .map(SensitiveDataRedactor::redact)
-                .map(value -> requireText(value, "label", 128));
+                .map(value -> SafeText.require(value, "label", MAXIMUM_LABEL_LENGTH));
         createdAt = requirePortableCreatedAt(createdAt);
         Objects.requireNonNull(trigger, "trigger");
         if (sourceFileCount < 0) {
@@ -53,109 +54,7 @@ public record BackupManifest(
         Objects.requireNonNull(gameVersion, "gameVersion");
     }
 
-    public BackupManifest(
-            int formatVersion,
-            BackupId backupId,
-            WorldId worldId,
-            String worldName,
-            Optional<String> label,
-            Instant createdAt,
-            BackupTrigger trigger,
-            long sourceFileCount,
-            long sourceByteCount,
-            long changedFileCount,
-            String contentSha256,
-            String inventorySha256) {
-        this(
-                formatVersion,
-                backupId,
-                worldId,
-                worldName,
-                label,
-                createdAt,
-                trigger,
-                sourceFileCount,
-                sourceByteCount,
-                changedFileCount,
-                contentSha256,
-                inventorySha256,
-                Optional.empty());
-    }
-
-    /** Compatibility constructor for the initial single-digest manifest contract. */
-    public BackupManifest(
-            int formatVersion,
-            BackupId backupId,
-            WorldId worldId,
-            String worldName,
-            Instant createdAt,
-            BackupTrigger trigger,
-            long sourceFileCount,
-            long sourceByteCount,
-            String sourceSha256) {
-        this(
-                formatVersion,
-                backupId,
-                worldId,
-                worldName,
-                Optional.empty(),
-                createdAt,
-                trigger,
-                sourceFileCount,
-                sourceByteCount,
-                sourceFileCount,
-                sourceSha256,
-                sourceSha256);
-    }
-
-    public static BackupManifest create(
-            BackupId backupId,
-            WorldId worldId,
-            String worldName,
-            Instant createdAt,
-            BackupTrigger trigger,
-            long sourceFileCount,
-            long sourceByteCount,
-            String sourceSha256) {
-        return new BackupManifest(
-                CURRENT_FORMAT_VERSION,
-                backupId,
-                worldId,
-                worldName,
-                createdAt,
-                trigger,
-                sourceFileCount,
-                sourceByteCount,
-                sourceSha256);
-    }
-
-    public static BackupManifest create(
-            BackupId backupId,
-            WorldId worldId,
-            String worldName,
-            Optional<String> label,
-            Instant createdAt,
-            BackupTrigger trigger,
-            long sourceFileCount,
-            long sourceByteCount,
-            long changedFileCount,
-            String contentSha256,
-            String inventorySha256) {
-        return new BackupManifest(
-                CURRENT_FORMAT_VERSION,
-                backupId,
-                worldId,
-                worldName,
-                label,
-                createdAt,
-                trigger,
-                sourceFileCount,
-                sourceByteCount,
-                changedFileCount,
-                contentSha256,
-                inventorySha256);
-    }
-
+    /** A manifest in the current format, as a capture writes it. */
     public static BackupManifest create(
             BackupId backupId,
             WorldId worldId,
@@ -185,25 +84,6 @@ public static BackupManifest create(
                 gameVersion);
     }
 
-    /** Compatibility alias for callers that previously consumed the single source digest. */
-    public String sourceSha256() {
-        return contentSha256;
-    }
-
-    private static String requireText(String value, String name, int maximumLength) {
-        Objects.requireNonNull(value, name);
-        if (value.isBlank() || value.length() > maximumLength) {
-            throw new IllegalArgumentException(name + " must contain between 1 and " + maximumLength + " characters");
-        }
-        if (value.chars().anyMatch(character -> Character.isISOControl(character))) {
-            throw new IllegalArgumentException(name + " must not contain control characters");
-        }
-        if (!StandardCharsets.UTF_8.newEncoder().canEncode(value)) {
-            throw new IllegalArgumentException(name + " must contain valid Unicode text");
-        }
-        return value;
-    }
-
     private static String requireSha256(String value, String name) {
         Objects.requireNonNull(value, name);
         if (!SHA256.matcher(value).matches()) {
diff --git a/src/main/java/dev/ishaanko/worldarchive/model/BackupManifestJson.java b/src/main/java/dev/ishaanko/worldarchive/model/BackupManifestJson.java
new file mode 100644
index 0000000..f8b1b40
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/model/BackupManifestJson.java
@@ -0,0 +1,66 @@
+package dev.ishaanko.worldarchive.model;
+
+import com.google.gson.JsonObject;
+import dev.ishaanko.worldarchive.support.JsonFields;
+import java.util.Optional;
+
+/**
+ * The JSON fields of a {@link BackupManifest}, in the order that the catalog, the Git snapshot
+ * manifest and the ZIP manifest write them. The bytes of every stored manifest depend on the
+ * names and the order, so change neither. Callers add their own fields before or after.
+ */
+public final class BackupManifestJson {
+    private BackupManifestJson() {
+    }
+
+    /** Appends the manifest fields to {@code target}; an absent label or game version is omitted. */
+    public static void write(BackupManifest manifest, JsonObject target) {
+        target.addProperty("formatVersion", manifest.formatVersion());
+        target.addProperty("backupId", manifest.backupId().toString());
+        target.addProperty("worldId", manifest.worldId().toString());
+        target.addProperty("worldName", manifest.worldName());
+        manifest.label().ifPresent(label -> target.addProperty("label", label));
+        target.addProperty("createdAt", manifest.createdAt().toString());
+        target.addProperty("trigger", manifest.trigger().name());
+        target.addProperty("sourceFileCount", manifest.sourceFileCount());
+        target.addProperty("sourceByteCount", manifest.sourceByteCount());
+        target.addProperty("changedFileCount", manifest.changedFileCount());
+        target.addProperty("contentSha256", manifest.contentSha256());
+        target.addProperty("inventorySha256", manifest.inventorySha256());
+        manifest.gameVersion().ifPresent(stamp -> {
+            JsonObject version = new JsonObject();
+            version.addProperty("name", stamp.name());
+            version.addProperty("dataVersion", stamp.dataVersion());
+            target.add("gameVersion", version);
+        });
+    }
+
+    /**
+     * Reads the fields that {@link #write} adds. A missing or mistyped field throws the
+     * caller's exception; a value the model rejects throws {@link IllegalArgumentException}.
+     */
+    public static <E extends Exception> BackupManifest read(JsonObject source, JsonFields<E> fields)
+            throws E {
+        Optional<JsonObject> version = fields.optionalObject(source, "gameVersion");
+        Optional<GameVersionStamp> gameVersion = Optional.empty();
+        if (version.isPresent()) {
+            gameVersion = Optional.of(new GameVersionStamp(
+                    fields.requiredString(version.get(), "name"),
+                    fields.requiredInt(version.get(), "dataVersion")));
+        }
+        return new BackupManifest(
+                fields.requiredInt(source, "formatVersion"),
+                BackupId.parse(fields.requiredString(source, "backupId")),
+                WorldId.parse(fields.requiredString(source, "worldId")),
+                fields.requiredString(source, "worldName"),
+                fields.optionalString(source, "label"),
+                fields.requiredInstant(source, "createdAt"),
+                fields.requiredEnum(source, "trigger", BackupTrigger.class),
+                fields.requiredLong(source, "sourceFileCount"),
+                fields.requiredLong(source, "sourceByteCount"),
+                fields.requiredLong(source, "changedFileCount"),
+                fields.requiredString(source, "contentSha256"),
+                fields.requiredString(source, "inventorySha256"),
+                gameVersion);
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/BackupOperation.java b/src/main/java/dev/ishaanko/worldarchive/model/BackupOperation.java
similarity index 79%
rename from src/main/java/dev/ishaanko/worldarchive/core/BackupOperation.java
rename to src/main/java/dev/ishaanko/worldarchive/model/BackupOperation.java
index beb90d7..61da746 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/BackupOperation.java
+++ b/src/main/java/dev/ishaanko/worldarchive/model/BackupOperation.java
@@ -1,4 +1,4 @@
-package dev.ishaanko.worldarchive.core;
+package dev.ishaanko.worldarchive.model;
 
 /** User-visible operation kinds reported by the service layer. */
 public enum BackupOperation {
diff --git a/src/main/java/dev/ishaanko/worldarchive/model/BackupResult.java b/src/main/java/dev/ishaanko/worldarchive/model/BackupResult.java
index c1af891..0005801 100644
--- a/src/main/java/dev/ishaanko/worldarchive/model/BackupResult.java
+++ b/src/main/java/dev/ishaanko/worldarchive/model/BackupResult.java
@@ -4,62 +4,44 @@
 import java.util.List;
 import java.util.Objects;
 
-/** Aggregate result that retains every independent destination outcome. */
+/**
+ * The outcome of one backup across its destinations. The overall {@link #status()} is derived
+ * from the destinations and never stored on its own, so a change to the rules cannot make an
+ * old catalog record invalid.
+ */
 public record BackupResult(
         BackupId backupId,
         WorldId worldId,
-        BackupStatus status,
         List<DestinationResult> destinations,
         Instant completedAt) {
     public BackupResult {
         Objects.requireNonNull(backupId, "backupId");
         Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(status, "status");
         destinations = List.copyOf(destinations);
         if (destinations.stream().map(DestinationResult::destination).distinct().count() != destinations.size()) {
             throw new IllegalArgumentException("Each destination may appear at most once");
         }
-        BackupStatus expected = aggregateStatus(destinations);
-        if (status != expected) {
-            throw new IllegalArgumentException("Status " + status + " does not match destination results: " + expected);
-        }
         Objects.requireNonNull(completedAt, "completedAt");
     }
 
-    public static BackupResult aggregate(
-            BackupId backupId,
-            WorldId worldId,
-            List<DestinationResult> destinations,
-            Instant completedAt) {
-        List<DestinationResult> immutableDestinations = List.copyOf(destinations);
-        return new BackupResult(
-                backupId,
-                worldId,
-                aggregateStatus(immutableDestinations),
-                immutableDestinations,
-                completedAt);
-    }
-
-    public static BackupStatus aggregateStatus(List<DestinationResult> destinations) {
-        Objects.requireNonNull(destinations, "destinations");
+    /**
+     * SUCCESS when a copy exists and nothing failed or waits; PARTIAL_SUCCESS when a copy exists
+     * but another destination failed or a remote still waits for its push; FAILED when only
+     * failures remain; SKIPPED when no destination ran.
+     */
+    public BackupStatus status() {
         boolean succeeded = destinations.stream()
                 .anyMatch(result -> result.status() == DestinationStatus.SUCCESS);
         boolean failed = destinations.stream()
                 .anyMatch(result -> result.status() == DestinationStatus.FAILED);
         boolean pendingSync = destinations.stream()
                 .anyMatch(result -> result.status() == DestinationStatus.PENDING_SYNC);
-        if (pendingSync) {
-            return BackupStatus.PARTIAL_SUCCESS;
-        }
-        if (succeeded && failed) {
+        if (pendingSync || succeeded && failed) {
             return BackupStatus.PARTIAL_SUCCESS;
         }
         if (succeeded) {
             return BackupStatus.SUCCESS;
         }
-        if (failed) {
-            return BackupStatus.FAILED;
-        }
-        return BackupStatus.SKIPPED;
+        return failed ? BackupStatus.FAILED : BackupStatus.SKIPPED;
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/CaptureProgressListener.java b/src/main/java/dev/ishaanko/worldarchive/model/CaptureProgressListener.java
similarity index 87%
rename from src/main/java/dev/ishaanko/worldarchive/core/CaptureProgressListener.java
rename to src/main/java/dev/ishaanko/worldarchive/model/CaptureProgressListener.java
index 7842ae9..b2419de 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/CaptureProgressListener.java
+++ b/src/main/java/dev/ishaanko/worldarchive/model/CaptureProgressListener.java
@@ -1,4 +1,4 @@
-package dev.ishaanko.worldarchive.core;
+package dev.ishaanko.worldarchive.model;
 
 /** Byte progress emitted while the live world is copied into private staging. */
 @FunctionalInterface
diff --git a/src/main/java/dev/ishaanko/worldarchive/model/DestinationHealth.java b/src/main/java/dev/ishaanko/worldarchive/model/DestinationHealth.java
deleted file mode 100644
index da000e8..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/model/DestinationHealth.java
+++ /dev/null
@@ -1,30 +0,0 @@
-package dev.ishaanko.worldarchive.model;
-
-import java.time.Instant;
-import java.util.Objects;
-
-/** Credential-safe health snapshot for status screens and commands. */
-public record DestinationHealth(
-        DestinationType destination,
-        DestinationHealthStatus status,
-        String message,
-        Instant checkedAt) {
-    public DestinationHealth {
-        Objects.requireNonNull(destination, "destination");
-        Objects.requireNonNull(status, "status");
-        message = SensitiveDataRedactor.redact(Objects.requireNonNull(message, "message"));
-        if (message.length() > 2_048
-                || message.chars().anyMatch(character -> Character.isISOControl(character))) {
-            throw new IllegalArgumentException("Health message is too long or contains control characters");
-        }
-        Objects.requireNonNull(checkedAt, "checkedAt");
-    }
-
-    public static DestinationHealth notChecked(DestinationType destination) {
-        return new DestinationHealth(
-                destination,
-                DestinationHealthStatus.UNCONFIGURED,
-                "Not checked",
-                Instant.EPOCH);
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/model/DestinationHealthStatus.java b/src/main/java/dev/ishaanko/worldarchive/model/DestinationHealthStatus.java
deleted file mode 100644
index 82e50ad..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/model/DestinationHealthStatus.java
+++ /dev/null
@@ -1,12 +0,0 @@
-package dev.ishaanko.worldarchive.model;
-
-/** Runtime readiness of a configured destination. */
-public enum DestinationHealthStatus {
-    HEALTHY,
-    DISABLED,
-    UNCONFIGURED,
-    TOOL_MISSING,
-    DEGRADED,
-    UNAVAILABLE,
-    AUTHENTICATION_REQUIRED
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/model/DestinationResult.java b/src/main/java/dev/ishaanko/worldarchive/model/DestinationResult.java
index 0e79486..5628ad3 100644
--- a/src/main/java/dev/ishaanko/worldarchive/model/DestinationResult.java
+++ b/src/main/java/dev/ishaanko/worldarchive/model/DestinationResult.java
@@ -3,7 +3,13 @@
 import java.util.Objects;
 import java.util.Optional;
 
-/** Immutable outcome from one independent destination. */
+/**
+ * Immutable outcome from one independent destination.
+ *
+ * <p>The canonical constructor also decodes catalog records, so it does not redact: the
+ * {@link #failed} and {@link #pendingSync} factories redact where a message is created, and the
+ * constructor only cleans control characters and cuts the length.</p>
+ */
 public record DestinationResult(
         DestinationType destination,
         DestinationStatus status,
@@ -13,23 +19,25 @@ public record DestinationResult(
         SyncStatus syncStatus,
         ArtifactOwnership ownership,
         Optional<ImportSourceId> importSourceId) {
-    private static final int MAXIMUM_TEXT_LENGTH = 2_048;
+    private static final int MAXIMUM_ARTIFACT_ID_LENGTH = 2_048;
+
+    /** Fits the 2,048 UTF-16 units that older versions accept, even with emoji. */
+    private static final int MAXIMUM_MESSAGE_CODE_POINTS = 1_024;
 
     public DestinationResult {
         Objects.requireNonNull(destination, "destination");
         Objects.requireNonNull(status, "status");
-        artifactId = validateOptionalText(artifactId, "artifactId");
-        if (artifactId.isPresent() && SensitiveDataRedactor.containsSensitiveData(artifactId.get())) {
-            throw new IllegalArgumentException("artifactId must not contain sensitive data");
-        }
-        message = validateOptionalText(message, "message").map(SensitiveDataRedactor::redact);
+        artifactId = Objects.requireNonNull(artifactId, "artifactId")
+                .map(value -> SafeText.require(value, "artifactId", MAXIMUM_ARTIFACT_ID_LENGTH));
+        message = Objects.requireNonNull(message, "message")
+                .map(value -> SafeText.clean(value, MAXIMUM_MESSAGE_CODE_POINTS))
+                .filter(value -> !value.isEmpty());
         Objects.requireNonNull(verificationStatus, "verificationStatus");
         Objects.requireNonNull(syncStatus, "syncStatus");
         Objects.requireNonNull(ownership, "ownership");
         importSourceId = Objects.requireNonNull(importSourceId, "importSourceId");
         validateOwnership(ownership, importSourceId);
-        if ((status == DestinationStatus.SUCCESS || status == DestinationStatus.PENDING_SYNC)
-                && artifactId.isEmpty()) {
+        if (isDurable(status) && artifactId.isEmpty()) {
             throw new IllegalArgumentException("A durable destination result must identify its artifact");
         }
         if ((status == DestinationStatus.FAILED || status == DestinationStatus.PENDING_SYNC)
@@ -53,42 +61,6 @@ private static void validateOwnership(
         }
     }
 
-    /** Compatibility constructor for initial destination implementations. */
-    public DestinationResult(
-            DestinationType destination,
-            DestinationStatus status,
-            Optional<String> artifactId,
-            Optional<String> message,
-            VerificationStatus verificationStatus,
-            SyncStatus syncStatus) {
-        this(
-                destination,
-                status,
-                artifactId,
-                message,
-                verificationStatus,
-                syncStatus,
-                ArtifactOwnership.MANAGED,
-                Optional.empty());
-    }
-
-    /** Compatibility constructor for initial destination implementations. */
-    public DestinationResult(
-            DestinationType destination,
-            DestinationStatus status,
-            Optional<String> artifactId,
-            Optional<String> message) {
-        this(
-                destination,
-                status,
-                artifactId,
-                message,
-                VerificationStatus.NOT_VERIFIED,
-                defaultSyncStatus(status),
-                ArtifactOwnership.MANAGED,
-                Optional.empty());
-    }
-
     public static DestinationResult success(DestinationType destination, String artifactId) {
         return new DestinationResult(
                 destination,
@@ -101,19 +73,20 @@ public static DestinationResult success(DestinationType destination, String arti
                 Optional.empty());
     }
 
+    /** A destination that kept no copy; the message is redacted here. */
     public static DestinationResult failed(DestinationType destination, String message) {
         return new DestinationResult(
                 destination,
                 DestinationStatus.FAILED,
                 Optional.empty(),
-                Optional.of(message),
+                Optional.of(SafeText.of(message, "The destination did not finish", MAXIMUM_MESSAGE_CODE_POINTS)),
                 VerificationStatus.NOT_VERIFIED,
                 SyncStatus.FAILED,
                 ArtifactOwnership.MANAGED,
                 Optional.empty());
     }
 
-    /** A durable local backup whose optional remote synchronization must be retried. */
+    /** A durable local backup whose remote copy must be retried; the message is redacted here. */
     public static DestinationResult pendingSync(
             DestinationType destination,
             String artifactId,
@@ -122,7 +95,8 @@ public static DestinationResult pendingSync(
                 destination,
                 DestinationStatus.PENDING_SYNC,
                 Optional.of(artifactId),
-                Optional.of(message),
+                Optional.of(SafeText.of(
+                        message, "The remote copy is not up to date yet", MAXIMUM_MESSAGE_CODE_POINTS)),
                 VerificationStatus.NOT_VERIFIED,
                 SyncStatus.PENDING,
                 ArtifactOwnership.MANAGED,
@@ -177,6 +151,15 @@ public static DestinationResult importedSuccess(
                 Optional.of(Objects.requireNonNull(sourceId, "sourceId")));
     }
 
+    /** True when this destination holds a copy: SUCCESS, or PENDING_SYNC with its local copy. */
+    public boolean isDurable() {
+        return isDurable(status);
+    }
+
+    private static boolean isDurable(DestinationStatus status) {
+        return status == DestinationStatus.SUCCESS || status == DestinationStatus.PENDING_SYNC;
+    }
+
     public DestinationResult withVerification(VerificationStatus verification) {
         return new DestinationResult(
                 destination,
@@ -214,28 +197,4 @@ public DestinationResult withState(
                 ownership,
                 importSourceId);
     }
-
-    private static Optional<String> validateOptionalText(Optional<String> value, String name) {
-        Objects.requireNonNull(value, name);
-        if (value.isEmpty()) {
-            return value;
-        }
-        String text = Objects.requireNonNull(value.get(), name);
-        if (text.isBlank() || text.length() > MAXIMUM_TEXT_LENGTH) {
-            throw new IllegalArgumentException(name + " must contain between 1 and "
-                    + MAXIMUM_TEXT_LENGTH + " characters when present");
-        }
-        if (text.chars().anyMatch(character -> Character.isISOControl(character))) {
-            throw new IllegalArgumentException(name + " must not contain control characters");
-        }
-        return Optional.of(text);
-    }
-
-    private static SyncStatus defaultSyncStatus(DestinationStatus status) {
-        return switch (status) {
-            case PENDING_SYNC -> SyncStatus.PENDING;
-            case FAILED -> SyncStatus.FAILED;
-            default -> SyncStatus.NOT_CONFIGURED;
-        };
-    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/model/GameVersionStamp.java b/src/main/java/dev/ishaanko/worldarchive/model/GameVersionStamp.java
index 0b9eb77..73133e3 100644
--- a/src/main/java/dev/ishaanko/worldarchive/model/GameVersionStamp.java
+++ b/src/main/java/dev/ishaanko/worldarchive/model/GameVersionStamp.java
@@ -1,6 +1,5 @@
 package dev.ishaanko.worldarchive.model;
 
-import java.nio.charset.StandardCharsets;
 import java.util.Objects;
 
 /** The Minecraft version a backup was made with: display name plus the world data version. */
@@ -27,20 +26,10 @@ public String displayName() {
     }
 
     private static String requireName(String value) {
-        Objects.requireNonNull(value, "name");
-        if (value.isBlank() || value.length() > MAXIMUM_NAME_LENGTH) {
-            throw new IllegalArgumentException(
-                    "name must contain between 1 and " + MAXIMUM_NAME_LENGTH + " characters");
-        }
+        SafeText.require(value, "name", MAXIMUM_NAME_LENGTH);
         if (!value.equals(value.strip())) {
             throw new IllegalArgumentException("name must not have leading or trailing whitespace");
         }
-        if (value.chars().anyMatch(character -> Character.isISOControl(character))) {
-            throw new IllegalArgumentException("name must not contain control characters");
-        }
-        if (!StandardCharsets.UTF_8.newEncoder().canEncode(value)) {
-            throw new IllegalArgumentException("name must contain valid Unicode text");
-        }
         return value;
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/model/ImportSourceId.java b/src/main/java/dev/ishaanko/worldarchive/model/ImportSourceId.java
index 3a363a8..d6360e9 100644
--- a/src/main/java/dev/ishaanko/worldarchive/model/ImportSourceId.java
+++ b/src/main/java/dev/ishaanko/worldarchive/model/ImportSourceId.java
@@ -1,8 +1,8 @@
 package dev.ishaanko.worldarchive.model;
 
+import java.nio.charset.StandardCharsets;
 import java.util.Objects;
 import java.util.UUID;
-import java.nio.charset.StandardCharsets;
 
 /** Opaque identity for a durable external import source. */
 public record ImportSourceId(UUID value) implements Comparable<ImportSourceId> {
@@ -10,10 +10,6 @@ public record ImportSourceId(UUID value) implements Comparable<ImportSourceId> {
         Objects.requireNonNull(value, "value");
     }
 
-    public static ImportSourceId create() {
-        return new ImportSourceId(UUID.randomUUID());
-    }
-
     /** Stable identity used to make importing the same external source idempotent. */
     public static ImportSourceId derived(String sourceIdentity) {
         String identity = Objects.requireNonNull(sourceIdentity, "sourceIdentity");
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/OperationId.java b/src/main/java/dev/ishaanko/worldarchive/model/OperationId.java
similarity index 93%
rename from src/main/java/dev/ishaanko/worldarchive/core/OperationId.java
rename to src/main/java/dev/ishaanko/worldarchive/model/OperationId.java
index e8871e3..368a078 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/OperationId.java
+++ b/src/main/java/dev/ishaanko/worldarchive/model/OperationId.java
@@ -1,4 +1,4 @@
-package dev.ishaanko.worldarchive.core;
+package dev.ishaanko.worldarchive.model;
 
 import java.util.Objects;
 import java.util.UUID;
diff --git a/src/main/java/dev/ishaanko/worldarchive/model/OperationPhase.java b/src/main/java/dev/ishaanko/worldarchive/model/OperationPhase.java
new file mode 100644
index 0000000..940f6a7
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/model/OperationPhase.java
@@ -0,0 +1,16 @@
+package dev.ishaanko.worldarchive.model;
+
+/**
+ * The phase of an operation's progress. Phases usually follow this order, but not always: a
+ * backup that waits for another backup of its world reports QUEUED after its capture.
+ */
+public enum OperationPhase {
+    QUEUED,
+    PREPARING,
+    READING,
+    WRITING,
+    VERIFYING,
+    PUBLISHING,
+    COMPLETE,
+    FAILED
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/OperationProgress.java b/src/main/java/dev/ishaanko/worldarchive/model/OperationProgress.java
similarity index 92%
rename from src/main/java/dev/ishaanko/worldarchive/core/OperationProgress.java
rename to src/main/java/dev/ishaanko/worldarchive/model/OperationProgress.java
index 1cf8a41..d89ce50 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/OperationProgress.java
+++ b/src/main/java/dev/ishaanko/worldarchive/model/OperationProgress.java
@@ -1,7 +1,5 @@
-package dev.ishaanko.worldarchive.core;
+package dev.ishaanko.worldarchive.model;
 
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.WorldId;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.OptionalDouble;
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/ProgressListener.java b/src/main/java/dev/ishaanko/worldarchive/model/ProgressListener.java
similarity index 85%
rename from src/main/java/dev/ishaanko/worldarchive/core/ProgressListener.java
rename to src/main/java/dev/ishaanko/worldarchive/model/ProgressListener.java
index f371933..c3ff79b 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/ProgressListener.java
+++ b/src/main/java/dev/ishaanko/worldarchive/model/ProgressListener.java
@@ -1,4 +1,4 @@
-package dev.ishaanko.worldarchive.core;
+package dev.ishaanko.worldarchive.model;
 
 /** Receives ordered progress events from an asynchronous service operation. */
 @FunctionalInterface
diff --git a/src/main/java/dev/ishaanko/worldarchive/model/SafeText.java b/src/main/java/dev/ishaanko/worldarchive/model/SafeText.java
new file mode 100644
index 0000000..837cff6
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/model/SafeText.java
@@ -0,0 +1,110 @@
+package dev.ishaanko.worldarchive.model;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Objects;
+import java.util.concurrent.CompletionException;
+import java.util.concurrent.ExecutionException;
+
+/**
+ * The one sanitizer for text shown to players or written to logs, and the one rule for text
+ * that must already be safe to store.
+ *
+ * <p>{@link #of} and {@link #from} redact secrets, turn each run of spaces, line breaks and
+ * other control characters into one space, drop invisible format characters, trim, and cut long
+ * text at a code point boundary with an ellipsis. Use them where a message is created.
+ * {@link #clean} does the same without redaction, for text that was redacted when it was made,
+ * such as a message read back from the catalog.</p>
+ */
+public final class SafeText {
+    private static final String ELLIPSIS = "…";
+
+    /** The redactor replaces longer text wholesale, and callers keep far less than this. */
+    private static final int REDACTION_WINDOW = 2_048;
+
+    private SafeText() {
+    }
+
+    /** Safe text for a message; the fallback when nothing readable is left. */
+    public static String of(String text, String fallback, int maxCodePoints) {
+        Objects.requireNonNull(fallback, "fallback");
+        if (text == null) {
+            return fallback;
+        }
+        String window = text.length() > REDACTION_WINDOW ? text.substring(0, REDACTION_WINDOW) : text;
+        String safe = clean(SensitiveDataRedactor.redact(window), maxCodePoints);
+        return safe.isEmpty() ? fallback : safe;
+    }
+
+    /**
+     * Safe text for the message of a failure's real cause, below any {@link CompletionException}
+     * or {@link ExecutionException}; the fallback when that cause has no message.
+     */
+    public static String from(Throwable failure, String fallback, int maxCodePoints) {
+        return of(unwrap(failure).getMessage(), fallback, maxCodePoints);
+    }
+
+    /** The innermost cause below {@link CompletionException} and {@link ExecutionException} wrappers. */
+    public static Throwable unwrap(Throwable failure) {
+        Throwable current = Objects.requireNonNull(failure, "failure");
+        while ((current instanceof CompletionException || current instanceof ExecutionException)
+                && current.getCause() != null) {
+            current = current.getCause();
+        }
+        return current;
+    }
+
+    /** Cleans and cuts text without redacting it; the result may be empty. */
+    public static String clean(String text, int maxCodePoints) {
+        Objects.requireNonNull(text, "text");
+        if (maxCodePoints < 1) {
+            throw new IllegalArgumentException("maxCodePoints must be positive");
+        }
+        StringBuilder cleaned = new StringBuilder(text.length());
+        text.codePoints().forEach(codePoint -> appendClean(cleaned, codePoint));
+        String trimmed = cleaned.toString().strip();
+        if (trimmed.codePointCount(0, trimmed.length()) <= maxCodePoints) {
+            return trimmed;
+        }
+        int end = trimmed.offsetByCodePoints(0, maxCodePoints - 1);
+        return trimmed.substring(0, end).stripTrailing() + ELLIPSIS;
+    }
+
+    private static void appendClean(StringBuilder cleaned, int codePoint) {
+        int type = Character.getType(codePoint);
+        if (type == Character.FORMAT) {
+            return;
+        }
+        if (Character.isWhitespace(codePoint)
+                || Character.isISOControl(codePoint)
+                || type == Character.LINE_SEPARATOR
+                || type == Character.PARAGRAPH_SEPARATOR) {
+            if (!cleaned.isEmpty() && cleaned.charAt(cleaned.length() - 1) != ' ') {
+                cleaned.append(' ');
+            }
+            return;
+        }
+        cleaned.appendCodePoint(type == Character.SURROGATE ? '\uFFFD' : codePoint);
+    }
+
+    /**
+     * Requires text that is safe to store as it is: not blank, at most {@code maxLength} UTF-16
+     * units, no control characters, and valid Unicode.
+     *
+     * @return the text, unchanged
+     * @throws IllegalArgumentException naming the field when a rule is broken
+     */
+    public static String require(String text, String name, int maxLength) {
+        Objects.requireNonNull(text, name);
+        if (text.isBlank() || text.length() > maxLength) {
+            throw new IllegalArgumentException(
+                    name + " must contain between 1 and " + maxLength + " characters");
+        }
+        if (text.chars().anyMatch(Character::isISOControl)) {
+            throw new IllegalArgumentException(name + " must not contain control characters");
+        }
+        if (!StandardCharsets.UTF_8.newEncoder().canEncode(text)) {
+            throw new IllegalArgumentException(name + " must contain valid Unicode text");
+        }
+        return text;
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/model/SyncStatus.java b/src/main/java/dev/ishaanko/worldarchive/model/SyncStatus.java
index 5bd5c94..04318a9 100644
--- a/src/main/java/dev/ishaanko/worldarchive/model/SyncStatus.java
+++ b/src/main/java/dev/ishaanko/worldarchive/model/SyncStatus.java
@@ -3,6 +3,7 @@
 /** Last known optional-remote synchronization state for a destination artifact. */
 public enum SyncStatus {
     NOT_CONFIGURED,
+    /** No code sets this now; it stays because backup lists written by older versions can hold it. */
     NOT_SYNCED,
     PENDING,
     SYNCED,
diff --git a/src/main/java/dev/ishaanko/worldarchive/model/WorldIdentity.java b/src/main/java/dev/ishaanko/worldarchive/model/WorldIdentity.java
index 191e337..32ebe58 100644
--- a/src/main/java/dev/ishaanko/worldarchive/model/WorldIdentity.java
+++ b/src/main/java/dev/ishaanko/worldarchive/model/WorldIdentity.java
@@ -3,26 +3,23 @@
 import java.util.Objects;
 import java.util.Optional;
 
-/** Versioned identity persisted inside a world, including restored-copy provenance. */
-public record WorldIdentity(
-        int schemaVersion,
-        WorldId worldId,
-        Optional<BackupId> sourceBackupId) {
+/**
+ * The identity persisted inside a world, including where a restored copy came from. The store
+ * writes {@link #CURRENT_SCHEMA_VERSION} next to it and refuses any other version.
+ */
+public record WorldIdentity(WorldId worldId, Optional<BackupId> sourceBackupId) {
     public static final int CURRENT_SCHEMA_VERSION = 1;
 
     public WorldIdentity {
-        if (schemaVersion != CURRENT_SCHEMA_VERSION) {
-            throw new IllegalArgumentException("Unsupported world identity schema: " + schemaVersion);
-        }
         Objects.requireNonNull(worldId, "worldId");
         sourceBackupId = Objects.requireNonNull(sourceBackupId, "sourceBackupId");
     }
 
     public static WorldIdentity original(WorldId worldId) {
-        return new WorldIdentity(CURRENT_SCHEMA_VERSION, worldId, Optional.empty());
+        return new WorldIdentity(worldId, Optional.empty());
     }
 
     public static WorldIdentity restoredCopy(WorldId worldId, BackupId sourceBackupId) {
-        return new WorldIdentity(CURRENT_SCHEMA_VERSION, worldId, Optional.of(sourceBackupId));
+        return new WorldIdentity(worldId, Optional.of(sourceBackupId));
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/recovery/BackupRecoveryService.java b/src/main/java/dev/ishaanko/worldarchive/recovery/BackupRecoveryService.java
index 887b7d2..7e51621 100644
--- a/src/main/java/dev/ishaanko/worldarchive/recovery/BackupRecoveryService.java
+++ b/src/main/java/dev/ishaanko/worldarchive/recovery/BackupRecoveryService.java
@@ -1,27 +1,25 @@
 package dev.ishaanko.worldarchive.recovery;
 
 import dev.ishaanko.worldarchive.catalog.BackupCatalog;
-import dev.ishaanko.worldarchive.catalog.BackupDeletionRegistry;
+import dev.ishaanko.worldarchive.catalog.FileBackupDeletionRegistry;
 import dev.ishaanko.worldarchive.config.WorldIdentityStore;
-import dev.ishaanko.worldarchive.importing.ImportSourceRegistry;
-import dev.ishaanko.worldarchive.core.BackupMaintenanceService;
+import dev.ishaanko.worldarchive.core.BackupService;
 import dev.ishaanko.worldarchive.core.DeleteBackupRequest;
-import dev.ishaanko.worldarchive.core.DeletePreparation;
-import dev.ishaanko.worldarchive.core.ProgressListener;
 import dev.ishaanko.worldarchive.core.RestoreBackupRequest;
 import dev.ishaanko.worldarchive.core.RestoreBackupResult;
 import dev.ishaanko.worldarchive.core.WorldOperationGate;
+import dev.ishaanko.worldarchive.importing.FileImportSourceRegistry;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.DestinationHealth;
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.ProgressListener;
 import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.storage.git.GitSnapshotStore;
+import dev.ishaanko.worldarchive.storage.git.WorldGitSnapshotStore;
 import dev.ishaanko.worldarchive.storage.zip.ZipBackupStoreResolver;
-import java.nio.file.Files;
+import dev.ishaanko.worldarchive.support.AsyncTasks;
 import java.time.Clock;
-import java.time.Duration;
+import java.util.EnumMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
@@ -30,12 +28,12 @@
 import java.util.concurrent.Executor;
 import java.util.concurrent.RejectedExecutionException;
 
-/** Thread-safe, Minecraft-independent implementation of all non-create backup operations. */
-public final class BackupRecoveryService implements BackupMaintenanceService {
-    public static final Duration DEFAULT_CONFIRMATION_LIFETIME = Duration.ofMinutes(1);
-
-    private static final Duration MAXIMUM_CONFIRMATION_LIFETIME = Duration.ofMinutes(5);
-
+/**
+ * Lists, restores, deletes, verifies and syncs backups, on worker threads, with no Minecraft
+ * code. Restore, delete, verify and sync return a {@link CancellableTask}: cancelling it stops the
+ * operation at its next safe point and completes it once the work has stopped.
+ */
+public final class BackupRecoveryService implements BackupService {
     private final BackupCatalog catalog;
 
     private final Executor executor;
@@ -48,165 +46,42 @@ public final class BackupRecoveryService implements BackupMaintenanceService {
 
     public BackupRecoveryService(
             BackupCatalog catalog,
-            Optional<? extends GitSnapshotStore> gitBackend,
-            Optional<? extends ZipBackupStoreResolver> zipStore,
-            WorldIdentityStore identityStore,
-            RestoredWorldMetadataFinalizer metadataFinalizer,
-            Executor executor,
-            WorldOperationGate operationGate) {
-        this(
-                catalog,
-                RecoveryDestinations.create(gitBackend, zipStore, Optional.empty(), Clock.systemUTC()),
-                BackupDeletionRegistry.NONE,
-                identityStore,
-                metadataFinalizer,
-                executor,
-                Clock.systemUTC(),
-                DEFAULT_CONFIRMATION_LIFETIME,
-                operationGate,
-                Files::move);
-    }
-
-    public BackupRecoveryService(
-            BackupCatalog catalog,
-            Optional<? extends GitSnapshotStore> gitBackend,
-            Optional<? extends ZipBackupStoreResolver> zipStore,
-            ImportSourceRegistry sources,
-            BackupDeletionRegistry deletions,
+            WorldGitSnapshotStore git,
+            ZipBackupStoreResolver zipStores,
+            FileImportSourceRegistry importSources,
+            FileBackupDeletionRegistry deletions,
             WorldIdentityStore identityStore,
             RestoredWorldMetadataFinalizer metadataFinalizer,
             Executor executor,
             WorldOperationGate operationGate,
             Clock clock) {
-        this(
-                catalog,
-                RecoveryDestinations.create(
-                        gitBackend,
-                        zipStore,
-                        Optional.of(Objects.requireNonNull(sources, "sources")),
-                        clock),
-                deletions,
-                identityStore,
-                metadataFinalizer,
-                executor,
-                clock,
-                DEFAULT_CONFIRMATION_LIFETIME,
-                operationGate,
-                Files::move);
-    }
-
-    BackupRecoveryService(
-            BackupCatalog catalog,
-            Map<DestinationType, RecoveryDestination> destinations,
-            WorldIdentityStore identityStore,
-            RestoredWorldMetadataFinalizer metadataFinalizer,
-            Executor executor,
-            Clock clock,
-            Duration confirmationLifetime,
-            WorldOperationGate operationGate) {
-        this(
-                catalog,
-                RecoveryDestinations.of(destinations),
-                BackupDeletionRegistry.NONE,
-                identityStore,
-                metadataFinalizer,
-                executor,
-                clock,
-                confirmationLifetime,
-                operationGate,
-                Files::move);
-    }
-
-    BackupRecoveryService(
-            BackupCatalog catalog,
-            Map<DestinationType, RecoveryDestination> destinations,
-            BackupDeletionRegistry deletions,
-            WorldIdentityStore identityStore,
-            RestoredWorldMetadataFinalizer metadataFinalizer,
-            Executor executor,
-            Clock clock,
-            Duration confirmationLifetime,
-            WorldOperationGate operationGate,
-            DirectoryMove directoryMove) {
-        this(
-                catalog,
-                RecoveryDestinations.of(destinations),
-                deletions,
-                identityStore,
-                metadataFinalizer,
-                executor,
-                clock,
-                confirmationLifetime,
-                operationGate,
-                directoryMove);
-    }
-
-    private BackupRecoveryService(
-            BackupCatalog catalog,
-            RecoveryDestinations destinations,
-            BackupDeletionRegistry deletions,
-            WorldIdentityStore identityStore,
-            RestoredWorldMetadataFinalizer metadataFinalizer,
-            Executor executor,
-            Clock clock,
-            Duration confirmationLifetime,
-            WorldOperationGate operationGate,
-            DirectoryMove directoryMove) {
         this.catalog = Objects.requireNonNull(catalog, "catalog");
         this.executor = Objects.requireNonNull(executor, "executor");
-        Objects.requireNonNull(destinations, "destinations");
-        Objects.requireNonNull(deletions, "deletions");
-        Objects.requireNonNull(identityStore, "identityStore");
-        Objects.requireNonNull(metadataFinalizer, "metadataFinalizer");
-        Objects.requireNonNull(clock, "clock");
-        Objects.requireNonNull(operationGate, "operationGate");
-        Objects.requireNonNull(directoryMove, "directoryMove");
+        GitRecoveryDestination gitCopies = new GitRecoveryDestination(git, importSources);
+        Map<DestinationType, RecoveryDestination> destinations = new EnumMap<>(DestinationType.class);
+        destinations.put(DestinationType.GIT, gitCopies);
+        destinations.put(DestinationType.ZIP, new ZipRecoveryDestination(zipStores));
         this.restoreOperation = new RecoveryRestoreOperation(
-                catalog, destinations, identityStore, metadataFinalizer, operationGate, directoryMove);
-        this.deleteOperation = new RecoveryDeleteOperation(
-                catalog, destinations, deletions, operationGate, executor, clock,
-                requireShortLifetime(confirmationLifetime));
-        this.healthOperations = new RecoveryHealthOperations(catalog, destinations, operationGate, clock);
+                catalog, destinations, identityStore, metadataFinalizer, operationGate, clock);
+        this.deleteOperation = new RecoveryDeleteOperation(catalog, destinations, deletions, operationGate, clock);
+        this.healthOperations = new RecoveryHealthOperations(catalog, destinations, gitCopies, operationGate);
     }
 
     @Override
     public CompletionStage<List<BackupRecord>> listBackups(Optional<WorldId> worldId) {
         Objects.requireNonNull(worldId, "worldId");
-        return submit(() -> worldId.isPresent()
-                ? catalog.list(worldId.orElseThrow())
+        return AsyncTasks.supplyChecked(executor, () -> worldId.isPresent()
+                ? catalog.list(worldId.get())
                 : catalog.listAll());
     }
 
-    @Override
-    public CompletionStage<Optional<BackupRecord>> findBackup(BackupId backupId) {
-        Objects.requireNonNull(backupId, "backupId");
-        return submit(() -> catalog.find(backupId));
-    }
-
     @Override
     public CompletionStage<RestoreBackupResult> restoreBackup(
             RestoreBackupRequest request,
             ProgressListener progressListener) {
         Objects.requireNonNull(request, "request");
         Objects.requireNonNull(progressListener, "progressListener");
-        return submit(cancellation ->
-                restoreOperation.restoreBlocking(request, progressListener, cancellation));
-    }
-
-    @Override
-    public CompletionStage<DeletePreparation> prepareDelete(BackupId backupId) {
-        Objects.requireNonNull(backupId, "backupId");
-        return submit(() -> deleteOperation.prepareDeleteBlocking(backupId));
-    }
-
-    @Override
-    public CompletionStage<BackupResult> deleteBackup(
-            DeleteBackupRequest request,
-            ProgressListener progressListener) {
-        Objects.requireNonNull(request, "request");
-        Objects.requireNonNull(progressListener, "progressListener");
-        return submit(cancellation ->
-                deleteOperation.deleteBlocking(request, progressListener, cancellation));
+        return submit(task -> restoreOperation.restore(request, progressListener, task));
     }
 
     @Override
@@ -215,8 +90,7 @@ public CompletionStage<List<BackupResult>> deleteBackups(
             ProgressListener progressListener) {
         List<DeleteBackupRequest> copy = List.copyOf(requests);
         Objects.requireNonNull(progressListener, "progressListener");
-        return submit(cancellation ->
-                deleteOperation.deleteManyBlocking(copy, progressListener, cancellation));
+        return submit(task -> deleteOperation.delete(copy, progressListener, task));
     }
 
     @Override
@@ -225,8 +99,7 @@ public CompletionStage<BackupResult> verifyBackup(
             ProgressListener progressListener) {
         Objects.requireNonNull(backupId, "backupId");
         Objects.requireNonNull(progressListener, "progressListener");
-        return submit(cancellation ->
-                healthOperations.verifyBlocking(backupId, progressListener, cancellation));
+        return submit(task -> healthOperations.verify(backupId, progressListener, task));
     }
 
     @Override
@@ -235,18 +108,7 @@ public CompletionStage<BackupResult> syncBackup(
             ProgressListener progressListener) {
         Objects.requireNonNull(backupId, "backupId");
         Objects.requireNonNull(progressListener, "progressListener");
-        return submit(cancellation ->
-                healthOperations.syncBlocking(backupId, progressListener, cancellation));
-    }
-
-    @Override
-    public CompletionStage<List<DestinationHealth>> health(Optional<WorldId> worldId) {
-        Objects.requireNonNull(worldId, "worldId");
-        return submit(() -> healthOperations.healthBlocking(worldId));
-    }
-
-    private <T> CompletionStage<T> submit(CheckedSupplier<T> operation) {
-        return submit(cancellation -> operation.get());
+        return submit(task -> healthOperations.sync(backupId, progressListener, task));
     }
 
     private <T> CompletionStage<T> submit(CancellableTask.Operation<T> operation) {
@@ -258,24 +120,4 @@ private <T> CompletionStage<T> submit(CancellableTask.Operation<T> operation) {
         }
         return task;
     }
-
-    private static Duration requireShortLifetime(Duration lifetime) {
-        Objects.requireNonNull(lifetime, "confirmationLifetime");
-        if (lifetime.isZero()
-                || lifetime.isNegative()
-                || lifetime.compareTo(MAXIMUM_CONFIRMATION_LIFETIME) > 0) {
-            throw new IllegalArgumentException(
-                    "Delete confirmation lifetime must be positive and no longer than five minutes");
-        }
-        return lifetime;
-    }
-
-    @FunctionalInterface
-    private interface CheckedSupplier<T> {
-        T get() throws Exception;
-    }
-
-    @FunctionalInterface
-    interface DirectoryMove extends RestoreWorkspace.DirectoryMove {
-    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/recovery/CancellableTask.java b/src/main/java/dev/ishaanko/worldarchive/recovery/CancellableTask.java
index 8289097..9b51745 100644
--- a/src/main/java/dev/ishaanko/worldarchive/recovery/CancellableTask.java
+++ b/src/main/java/dev/ishaanko/worldarchive/recovery/CancellableTask.java
@@ -1,125 +1,171 @@
 package dev.ishaanko.worldarchive.recovery;
 
 import java.util.Objects;
+import java.util.concurrent.CancellationException;
 import java.util.concurrent.CompletableFuture;
 
-/** Future-backed maintenance task that preserves mandatory commits during cancellation. */
-final class CancellableTask<T> extends CompletableFuture<T>
-        implements Runnable, OperationCancellation {
+/**
+ * The future of one recovery operation, which also tells the operation where it may stop. The
+ * operation runs on one worker thread and receives this task.
+ *
+ * <p>Cancel records the request and interrupts the worker, unless the worker is inside a commit:
+ * a storage change that must finish so the catalog matches the files. The future completes only
+ * once the worker has stopped, with a {@link CancellationException} when the request stopped the
+ * work, or with the operation's result when the work was past its last stopping point. So, unlike
+ * a plain {@link CompletableFuture}, {@link #isDone()} can still be false right after a successful
+ * {@link #cancel}; that is what keeps dependents from running while the operation still writes.
+ * A task cancelled before it starts never runs. After the point of no return, such as the rename
+ * that publishes a restored world, cancel has no effect.</p>
+ */
+final class CancellableTask<T> extends CompletableFuture<T> implements Runnable {
     private final Operation<T> operation;
 
-    private Thread runner;
+    // Guarded by this.
+    private State state = State.WAITING;
 
-    private boolean cancellationRequested;
+    private Thread worker;
 
-    private boolean interruptRequested;
+    private boolean cancelRequested;
 
-    private int mandatoryCommitDepth;
+    private boolean interruptWanted;
 
-    private boolean pointOfNoReturn;
+    private int commitDepth;
 
     CancellableTask(Operation<T> operation) {
         this.operation = Objects.requireNonNull(operation, "operation");
     }
 
+    /** One recovery operation; it calls the task's checkpoints and commits as it goes. */
+    @FunctionalInterface
+    interface Operation<T> {
+        T run(CancellableTask<T> task) throws Exception;
+    }
+
+    /** Storage work inside a commit. */
+    @FunctionalInterface
+    interface Commit<R> {
+        R run() throws Exception;
+    }
+
+    private enum State {
+        WAITING,
+        CANCELLED_BEFORE_START,
+        RUNNING,
+        PAST_POINT_OF_NO_RETURN,
+        FINISHED
+    }
+
     @Override
     public void run() {
         synchronized (this) {
-            if (isDone()) {
+            if (state != State.WAITING) {
                 return;
             }
-            runner = Thread.currentThread();
+            state = State.RUNNING;
+            worker = Thread.currentThread();
         }
+        T value = null;
+        Throwable failure = null;
         try {
             checkpoint();
-            complete(operation.get(this));
-        } catch (Throwable exception) {
-            if (!isCancelled()) {
-                completeExceptionally(exception);
-            }
-        } finally {
-            synchronized (this) {
-                runner = null;
+            value = operation.run(this);
+        } catch (Throwable throwable) {
+            failure = throwable;
+        }
+        boolean cancelled;
+        synchronized (this) {
+            state = State.FINISHED;
+            worker = null;
+            cancelled = cancelRequested;
+            if (cancelled && interruptWanted) {
+                // The interrupt was this task's own; the next task on this thread must not see it.
+                Thread.interrupted();
             }
         }
+        if (failure == null) {
+            complete(value);
+        } else if (cancelled) {
+            CancellationException cancellation = new CancellationException("The operation was cancelled");
+            cancellation.initCause(failure);
+            completeExceptionally(cancellation);
+        } else {
+            completeExceptionally(failure);
+        }
     }
 
     @Override
     public boolean cancel(boolean mayInterruptIfRunning) {
         synchronized (this) {
-            if (pointOfNoReturn || isDone() || !super.cancel(false)) {
-                return false;
+            if (state == State.RUNNING) {
+                cancelRequested = true;
+                interruptWanted |= mayInterruptIfRunning;
+                if (mayInterruptIfRunning && commitDepth == 0) {
+                    worker.interrupt();
+                }
+                return true;
             }
-            cancellationRequested = true;
-            interruptRequested = mayInterruptIfRunning;
-            if (mayInterruptIfRunning && mandatoryCommitDepth == 0 && runner != null) {
-                runner.interrupt();
+            if (state != State.WAITING) {
+                return false;
             }
+            state = State.CANCELLED_BEFORE_START;
         }
-        return true;
+        return super.cancel(false);
     }
 
-    @Override
-    public void checkpoint() throws InterruptedException {
-        boolean cancelled;
+    /** Stops here when cancel was requested or the worker was interrupted. */
+    void checkpoint() throws InterruptedException {
+        boolean requested;
         synchronized (this) {
-            cancelled = cancellationRequested;
+            requested = cancelRequested;
         }
-        if (cancelled || Thread.currentThread().isInterrupted()) {
-            throw new InterruptedException("Backup maintenance operation was cancelled");
+        if (requested || Thread.currentThread().isInterrupted()) {
+            throw new InterruptedException("The operation was cancelled");
         }
     }
 
-    @Override
-    public <R> R mandatoryCommit(CheckedSupplier<R> commit) throws Exception {
-        return commit(commit, false);
-    }
-
-    @Override
-    public <R> R commitIfActive(CheckedSupplier<R> commit) throws Exception {
-        return commit(commit, true);
+    /** Runs a commit unless cancel was already requested; a later request waits until it ends. */
+    <R> R commitIfActive(Commit<R> commit) throws Exception {
+        synchronized (this) {
+            if (cancelRequested || Thread.currentThread().isInterrupted()) {
+                throw new InterruptedException("The operation was cancelled");
+            }
+            commitDepth++;
+        }
+        return runCommit(commit);
     }
 
-    @Override
-    public <R> R pointOfNoReturn(CheckedSupplier<R> publication) throws Exception {
-        Objects.requireNonNull(publication, "publication");
+    /** Runs a commit even after a cancel request; the interrupt waits until it ends. */
+    <R> R mandatoryCommit(Commit<R> commit) throws Exception {
         synchronized (this) {
-            if (cancellationRequested || Thread.currentThread().isInterrupted()) {
-                throw new InterruptedException("Backup maintenance operation was cancelled");
-            }
-            pointOfNoReturn = true;
+            commitDepth++;
         }
-        return publication.get();
+        return runCommit(commit);
     }
 
-    private <R> R commit(CheckedSupplier<R> commit, boolean requireActive) throws Exception {
-        Objects.requireNonNull(commit, "commit");
+    /** Runs the publication that ends the operation; from here on, cancel has no effect. */
+    <R> R pointOfNoReturn(Commit<R> publication) throws Exception {
         synchronized (this) {
-            if (requireActive
-                    && (cancellationRequested || Thread.currentThread().isInterrupted())) {
-                throw new InterruptedException("Backup maintenance operation was cancelled");
+            if (cancelRequested || Thread.currentThread().isInterrupted()) {
+                throw new InterruptedException("The operation was cancelled");
             }
-            mandatoryCommitDepth++;
+            state = State.PAST_POINT_OF_NO_RETURN;
         }
-        boolean interruptedBeforeCommit = Thread.interrupted();
+        return publication.run();
+    }
+
+    private <R> R runCommit(Commit<R> commit) throws Exception {
+        boolean interruptedBefore = Thread.interrupted();
         try {
-            return commit.get();
+            return commit.run();
         } finally {
-            boolean restoreInterrupt;
+            boolean deliver;
             synchronized (this) {
-                mandatoryCommitDepth--;
-                restoreInterrupt = mandatoryCommitDepth == 0 && interruptRequested;
+                commitDepth--;
+                deliver = interruptedBefore || commitDepth == 0 && cancelRequested && interruptWanted;
             }
-            if (interruptedBeforeCommit
-                    || restoreInterrupt
-                    || Thread.currentThread().isInterrupted()) {
+            if (deliver) {
                 Thread.currentThread().interrupt();
             }
         }
     }
-
-    @FunctionalInterface
-    interface Operation<T> {
-        T get(OperationCancellation cancellation) throws Exception;
-    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/recovery/DeleteConfirmation.java b/src/main/java/dev/ishaanko/worldarchive/recovery/DeleteConfirmation.java
index 2569b81..41cb470 100644
--- a/src/main/java/dev/ishaanko/worldarchive/recovery/DeleteConfirmation.java
+++ b/src/main/java/dev/ishaanko/worldarchive/recovery/DeleteConfirmation.java
@@ -1,75 +1,53 @@
 package dev.ishaanko.worldarchive.recovery;
 
 import dev.ishaanko.worldarchive.model.ArtifactOwnership;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationStatus;
 import dev.ishaanko.worldarchive.model.DestinationType;
 import dev.ishaanko.worldarchive.model.ImportSourceId;
-import java.time.Instant;
-import java.util.Objects;
+import dev.ishaanko.worldarchive.model.SyncStatus;
+import java.util.Collection;
 import java.util.Optional;
 import java.util.Set;
 import java.util.stream.Collectors;
 
-/** Exact backup and artifact scope approved by one delete preview. */
-record DeleteConfirmation(
-        BackupId backupId,
-        BackupManifest manifest,
-        Set<ConfirmedDestination> destinations,
-        Instant expiresAt) {
+/** The copies of a backup that the player saw when confirming its delete. */
+record DeleteConfirmation(Set<ConfirmedCopy> copies) {
     DeleteConfirmation {
-        Objects.requireNonNull(backupId, "backupId");
-        Objects.requireNonNull(manifest, "manifest");
-        destinations = Set.copyOf(Objects.requireNonNull(destinations, "destinations"));
-        Objects.requireNonNull(expiresAt, "expiresAt");
+        copies = Set.copyOf(copies);
     }
 
-    static DeleteConfirmation create(BackupRecord record, Instant expiresAt) {
-        return new DeleteConfirmation(
-                record.manifest().backupId(),
-                record.manifest(),
-                destinations(record),
-                expiresAt);
+    /** What a delete request confirmed: its copies that hold the backup. */
+    static DeleteConfirmation of(Collection<DestinationResult> shown) {
+        return new DeleteConfirmation(shown.stream()
+                .filter(DestinationResult::isDurable)
+                .map(ConfirmedCopy::of)
+                .collect(Collectors.toUnmodifiableSet()));
     }
 
-    /** Destination types the user approved; used to report a deletion that never started. */
-    Set<DestinationType> destinationTypes() {
-        return destinations.stream()
-                .map(ConfirmedDestination::type)
-                .collect(Collectors.toUnmodifiableSet());
+    /** Whether the record still lists exactly the copies that were confirmed. */
+    boolean matches(BackupRecord current) {
+        return copies.equals(of(current.result().destinations()).copies());
     }
 
-    void requireMatches(BackupRecord current) {
-        if (!manifest.equals(current.manifest())
-                || !destinations.equals(destinations(current))) {
-            throw new BackupRecoveryException(
-                    "The backup changed after deletion was confirmed");
-        }
-    }
-
-    private static Set<ConfirmedDestination> destinations(BackupRecord record) {
-        return record.result().destinations().stream()
-                .filter(result -> result.artifactId().isPresent()
-                        && (result.status() == DestinationStatus.SUCCESS
-                                || result.status() == DestinationStatus.PENDING_SYNC))
-                .map(ConfirmedDestination::from)
-                .collect(Collectors.toUnmodifiableSet());
+    /** The kinds of copy that were confirmed, to report a delete that did not start. */
+    Set<DestinationType> copyTypes() {
+        return copies.stream().map(ConfirmedCopy::type).collect(Collectors.toUnmodifiableSet());
     }
 
-    private record ConfirmedDestination(
+    /**
+     * One confirmed copy: which artifact, whose, and whether it was on a remote. The prompt names a
+     * remote copy only for a synced backup, so a copy synced after the player confirmed is another copy.
+     */
+    record ConfirmedCopy(
             DestinationType type,
             String artifactId,
             ArtifactOwnership ownership,
-            Optional<ImportSourceId> importSourceId) {
-        private static ConfirmedDestination from(DestinationResult result) {
-            return new ConfirmedDestination(
-                    result.destination(),
-                    result.artifactId().orElseThrow(),
-                    result.ownership(),
-                    result.importSourceId());
+            Optional<ImportSourceId> importSourceId,
+            SyncStatus syncStatus) {
+        private static ConfirmedCopy of(DestinationResult result) {
+            return new ConfirmedCopy(result.destination(), result.artifactId().orElseThrow(), result.ownership(),
+                    result.importSourceId(), result.syncStatus());
         }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/recovery/GitRecoveryDestination.java b/src/main/java/dev/ishaanko/worldarchive/recovery/GitRecoveryDestination.java
index 5a2c591..3e9ba8e 100644
--- a/src/main/java/dev/ishaanko/worldarchive/recovery/GitRecoveryDestination.java
+++ b/src/main/java/dev/ishaanko/worldarchive/recovery/GitRecoveryDestination.java
@@ -1,251 +1,215 @@
 package dev.ishaanko.worldarchive.recovery;
 
+import dev.ishaanko.worldarchive.importing.FileImportSourceRegistry;
 import dev.ishaanko.worldarchive.importing.ImportArtifactBinding;
 import dev.ishaanko.worldarchive.importing.ImportSource;
 import dev.ishaanko.worldarchive.importing.ImportSourceMode;
-import dev.ishaanko.worldarchive.importing.ImportSourceRegistry;
 import dev.ishaanko.worldarchive.model.ArtifactOwnership;
+import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.DestinationHealth;
-import dev.ishaanko.worldarchive.model.DestinationHealthStatus;
 import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.DestinationStatus;
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.ImportSourceId;
+import dev.ishaanko.worldarchive.model.SafeText;
+import dev.ishaanko.worldarchive.model.SyncStatus;
 import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.storage.git.GitBackupBackend;
-import dev.ishaanko.worldarchive.storage.git.GitSnapshotStore;
+import dev.ishaanko.worldarchive.storage.git.GitDeletion;
 import dev.ishaanko.worldarchive.storage.git.GitSnapshot;
-import dev.ishaanko.worldarchive.storage.git.GitToolHealth;
 import dev.ishaanko.worldarchive.storage.git.GitVerification;
+import dev.ishaanko.worldarchive.storage.git.WorldGitSnapshotStore;
 import java.nio.file.Path;
-import java.time.Clock;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
-import java.util.concurrent.CompletionException;
-import java.util.concurrent.CompletionStage;
-import java.util.concurrent.ExecutionException;
-
-/** Recovery adapter for the native Git and Git LFS destination. */
+import java.util.Set;
+import java.util.stream.Collectors;
+
+/**
+ * Git copies: a snapshot in the world's repository on this computer and, when the world has a
+ * remote, the same snapshot there. Imported snapshots came from a repository an import recorded;
+ * legacy linked ones still live only in that repository.
+ */
 final class GitRecoveryDestination implements RecoveryDestination {
-    private final GitSnapshotStore backend;
+    private static final String DELETED_HERE_ONLY = "Deleted from this computer. This world has no Git remote in"
+            + " its settings now, so the copy uploaded to its remote before was not deleted there.";
 
-    private final Clock clock;
+    private static final String KEPT_ON_REMOTE = "Only a copy on a Git remote is left, and this world has no"
+            + " remote in its settings, so the backup was kept. Add the remote again in the world's settings,"
+            + " then delete the backup again.";
 
-    private final Optional<ImportSourceRegistry> sources;
+    private final WorldGitSnapshotStore git;
 
-    GitRecoveryDestination(GitSnapshotStore backend, Clock clock) {
-        this(backend, clock, Optional.empty());
-    }
+    private final FileImportSourceRegistry sources;
 
-    GitRecoveryDestination(
-            GitSnapshotStore backend,
-            Clock clock,
-            Optional<ImportSourceRegistry> sources) {
-        this.backend = Objects.requireNonNull(backend, "backend");
-        this.clock = Objects.requireNonNull(clock, "clock");
+    GitRecoveryDestination(WorldGitSnapshotStore git, FileImportSourceRegistry sources) {
+        this.git = Objects.requireNonNull(git, "git");
         this.sources = Objects.requireNonNull(sources, "sources");
     }
 
     @Override
-    public DestinationType destinationType() {
+    public DestinationType type() {
         return DestinationType.GIT;
     }
 
+    /**
+     * Checks the copy a restore would use. With a remote, a damaged or missing copy here is
+     * replaced from the remote; without one, damage here is a failed check.
+     */
     @Override
-    public VerificationOutcome verify(BackupRecord record, DestinationResult destination)
-            throws Exception {
-        requireArtifact(record, destination);
-        GitVerification verification = destination.ownership() == ArtifactOwnership.EXTERNAL
-                ? hydrateExternal(record, destination)
-                : awaitDrained(backend.verifyRestorableSnapshot(
-                        record.manifest().worldId(),
-                        record.manifest().backupId(),
-                        record.manifest()));
-        return verificationOutcome(record, destination, verification);
-    }
-
-    static VerificationOutcome verificationOutcome(
-            BackupRecord record,
-            DestinationResult destination,
-            GitVerification verification) {
-        Objects.requireNonNull(record, "record");
-        Objects.requireNonNull(destination, "destination");
-        Objects.requireNonNull(verification, "verification");
-        GitSnapshot snapshot = verification.snapshot();
-        if (!snapshot.worldId().equals(record.manifest().worldId())
-                || !snapshot.backupId().equals(record.manifest().backupId())
-                || !snapshot.refName().equals(destination.artifactId().orElseThrow())) {
-            return VerificationOutcome.failed("Git snapshot identity does not match the catalog");
+    public VerificationOutcome verify(BackupRecord record, DestinationResult copy) throws Exception {
+        WorldId worldId = record.manifest().worldId();
+        BackupId backupId = record.manifest().backupId();
+        requireArtifact(record, copy);
+        GitVerification verification;
+        if (copy.ownership() == ArtifactOwnership.EXTERNAL) {
+            verification = hydrateExternal(record, copy);
+        } else if (git.remoteConfigured(worldId)) {
+            verification = RecoverySupport.awaitStopped(git.verifyRestorableSnapshot(worldId, backupId, record.manifest()));
+        } else {
+            verification = RecoverySupport.awaitStopped(git.verifyCurrentSnapshot(worldId, backupId));
         }
-        if (verification.valid()
-                && (verification.manifest().isEmpty()
-                        || !verification.manifest().orElseThrow().equals(record.manifest()))) {
-            return VerificationOutcome.failed(
-                    "Git snapshot manifest does not exactly match the catalog");
+        if (!verification.valid()) {
+            return VerificationOutcome.failed(verification.message());
         }
-        return verification.valid()
-                ? VerificationOutcome.verified(verification.message())
-                : VerificationOutcome.failed(verification.message());
+        return verification.manifest().filter(record.manifest()::equals).isPresent()
+                ? VerificationOutcome.verified()
+                : VerificationOutcome.failed("The Git snapshot holds a different backup than the backup list says");
     }
 
     @Override
-    public Materialization materialize(
-            BackupRecord record,
-            DestinationResult destination,
-            Path emptyTarget) throws Exception {
-        requireArtifact(record, destination);
-        if (destination.ownership() == ArtifactOwnership.EXTERNAL) {
-            hydrateExternal(record, destination);
-        }
-        GitBackupBackend.RestoreResult restored = awaitDrained(
-                backend.restoreSnapshotForRecovery(
-                record.manifest().worldId(),
-                record.manifest().backupId(),
-                record.manifest(),
-                emptyTarget));
-        if (!restored.path().equals(emptyTarget.toAbsolutePath().normalize())) {
-            throw new BackupRecoveryException("Git restored to an unexpected directory");
+    public void restore(BackupRecord record, DestinationResult copy, Path emptyStaging) throws Exception {
+        requireArtifact(record, copy);
+        if (copy.ownership() == ArtifactOwnership.EXTERNAL) {
+            GitVerification hydrated = hydrateExternal(record, copy);
+            if (!hydrated.valid()) {
+                throw new BackupRecoveryException(hydrated.message());
+            }
         }
-        return Materialization.replaced(
-                restored.path(),
-                restored.fileKey(),
-                restored.creationTime(),
-                restored.directoryIdentityMarker(),
-                restored.publicationProblem());
+        RecoverySupport.awaitStopped(git.restoreSnapshot(
+                record.manifest().worldId(), record.manifest().backupId(), record.manifest(), emptyStaging));
     }
 
+    /**
+     * Deletes the snapshots everywhere the world keeps them, with one Git operation for all of them.
+     * A copy on a remote that the world no longer has in its settings cannot be deleted from here,
+     * so a backup whose only copy is there is kept. Legacy linked snapshots are only unlinked.
+     */
     @Override
-    public boolean delete(BackupRecord record, DestinationResult destination) throws Exception {
-        requireArtifact(record, destination);
-        if (destination.ownership() != ArtifactOwnership.MANAGED) {
-            await(backend.deleteLocalSnapshot(
-                    record.manifest().worldId(), record.manifest().backupId()));
-            sources.orElseThrow(() -> new BackupRecoveryException(
-                    "Imported Git source registry is unavailable"))
-                    .unlink(destination.importSourceId().orElseThrow(), record.manifest().backupId());
-        } else {
-            await(backend.deleteSnapshot(record.manifest().worldId(), record.manifest().backupId()));
+    public Map<BackupId, DestinationResult> delete(WorldId worldId, List<BackupRecord> records) {
+        Map<BackupId, DestinationResult> copies = new LinkedHashMap<>();
+        records.forEach(record -> copies.put(record.manifest().backupId(),
+                RecoverySupport.copy(record, DestinationType.GIT).orElseThrow()));
+        Map<BackupId, DestinationResult> results = new LinkedHashMap<>();
+        Set<BackupId> stored = copies.entrySet().stream()
+                .filter(entry -> entry.getValue().ownership() != ArtifactOwnership.EXTERNAL)
+                .map(Map.Entry::getKey)
+                .collect(Collectors.toSet());
+        if (!stored.isEmpty()) {
+            results.putAll(deleteStored(worldId, stored, copies));
         }
-        // A false backend result means the exact local and configured remote refs are absent.
-        return true;
+        copies.forEach((backupId, copy) -> {
+            if (copy.ownership() == ArtifactOwnership.EXTERNAL) {
+                results.put(backupId, deleteLocalOnly(worldId, backupId, copy));
+            }
+        });
+        unlinkImported(copies, results);
+        return results;
     }
 
-    @Override
-    public DestinationResult sync(BackupRecord record, DestinationResult destination)
-            throws Exception {
-        requireArtifact(record, destination);
-        if (destination.ownership() != ArtifactOwnership.MANAGED) {
-            return destination;
+    private Map<BackupId, DestinationResult> deleteStored(
+            WorldId worldId,
+            Set<BackupId> backupIds,
+            Map<BackupId, DestinationResult> copies) {
+        Map<BackupId, GitDeletion> deletions;
+        try {
+            deletions = RecoverySupport.awaitStopped(git.deleteSnapshots(worldId, backupIds));
+        } catch (Exception failure) {
+            String reason = SafeText.from(failure, "The Git delete failed", 1_024);
+            return backupIds.stream().collect(Collectors.toMap(
+                    backupId -> backupId, backupId -> DestinationResult.failed(DestinationType.GIT, reason)));
         }
-        DestinationResult result = awaitDrained(backend.syncSnapshot(
-                record.manifest().worldId(), record.manifest().backupId()));
-        if (result.destination() != DestinationType.GIT) {
-            throw new BackupRecoveryException("Git returned a result for another destination");
+        boolean remote = git.remoteConfigured(worldId);
+        Map<BackupId, DestinationResult> results = new LinkedHashMap<>();
+        for (BackupId backupId : backupIds) {
+            DestinationResult copy = copies.get(backupId);
+            GitDeletion deletion = deletions.getOrDefault(backupId, new GitDeletion(
+                    GitDeletion.Outcome.FAILED, "Git did not report on this backup; delete it again"));
+            boolean synced = copy.syncStatus() == SyncStatus.SYNCED;
+            results.put(backupId, switch (deletion.outcome()) {
+                case DELETED -> deleted(copy, !remote && synced ? Optional.of(DELETED_HERE_ONLY) : Optional.empty());
+                case NOT_FOUND -> deleted(copy, Optional.empty());
+                case REMOTE_NOT_CONFIGURED -> synced
+                        ? DestinationResult.failed(DestinationType.GIT, KEPT_ON_REMOTE)
+                        : deleted(copy, Optional.empty());
+                case FAILED -> DestinationResult.failed(DestinationType.GIT, deletion.message());
+            });
         }
-        result.artifactId().ifPresent(artifact -> {
-            if (!artifact.equals(destination.artifactId().orElseThrow())) {
-                throw new BackupRecoveryException("Git returned a different snapshot identity");
-            }
-        });
-        return result;
+        return results;
     }
 
-    @Override
-    public DestinationHealth health(Optional<WorldId> worldId) throws Exception {
-        GitToolHealth tools = await(backend.probeTools());
-        if (!tools.available()) {
-            return new DestinationHealth(
-                    DestinationType.GIT,
-                    DestinationHealthStatus.TOOL_MISSING,
-                    tools.summary(),
-                    clock.instant());
+    private DestinationResult deleteLocalOnly(WorldId worldId, BackupId backupId, DestinationResult copy) {
+        try {
+            RecoverySupport.awaitStopped(git.deleteLocalSnapshot(worldId, backupId));
+            return deleted(copy, Optional.empty());
+        } catch (Exception failure) {
+            return DestinationResult.failed(DestinationType.GIT, SafeText.from(failure, "The Git delete failed", 1_024));
         }
-        await(backend.listSnapshots(worldId));
-        return new DestinationHealth(
-                DestinationType.GIT,
-                DestinationHealthStatus.HEALTHY,
-                tools.summary(),
-                clock.instant());
     }
 
-    private static void requireArtifact(BackupRecord record, DestinationResult destination) {
-        Objects.requireNonNull(record, "record");
-        Objects.requireNonNull(destination, "destination");
-        String expected = GitSnapshot.refName(
-                record.manifest().worldId(), record.manifest().backupId());
-        if (destination.destination() != DestinationType.GIT
-                || destination.artifactId().isEmpty()
-                || !destination.artifactId().orElseThrow().equals(expected)) {
-            throw new BackupRecoveryException("Git artifact identity does not match the catalog");
+    /** Forgets where deleted imported snapshots came from; a failure there leaves only a stale link. */
+    private void unlinkImported(Map<BackupId, DestinationResult> copies, Map<BackupId, DestinationResult> results) {
+        Map<BackupId, ImportSourceId> unlinked = new LinkedHashMap<>();
+        copies.forEach((backupId, copy) -> copy.importSourceId()
+                .filter(ignored -> results.get(backupId).status() == DestinationStatus.SUCCESS)
+                .ifPresent(sourceId -> unlinked.put(backupId, sourceId)));
+        try {
+            sources.unlink(unlinked);
+        } catch (Exception failure) {
+            unlinked.keySet().forEach(backupId -> results.computeIfPresent(backupId, (ignored, result) ->
+                    result.withState(DestinationStatus.SUCCESS, Optional.of("Deleted. The record of where it was"
+                            + " imported from could not be updated: " + SafeText.from(failure, "", 512)),
+                            result.syncStatus())));
         }
     }
 
-    private GitVerification hydrateExternal(
-            BackupRecord record,
-            DestinationResult destination) throws Exception {
-        ImportSource source = sources.orElseThrow(() -> new BackupRecoveryException(
-                "Imported Git source registry is unavailable"))
-                .find(destination.importSourceId().orElseThrow())
-                .orElseThrow(() -> new BackupRecoveryException(
-                        "Imported Git source is no longer linked"));
-        if (source.mode() != ImportSourceMode.GIT_REMOTE_BACKED) {
-            throw new BackupRecoveryException("Imported Git source mode is invalid");
-        }
-        ImportArtifactBinding binding = source.artifact(record.manifest().backupId())
-                .orElseThrow(() -> new BackupRecoveryException(
-                        "Imported Git artifact binding is missing"));
-        if (!binding.worldId().equals(record.manifest().worldId())) {
-            throw new BackupRecoveryException("Imported Git world identity does not match");
+    /** Uploads this computer's copy to the world's remote; imported copies are left as they are. */
+    DestinationResult sync(BackupRecord record, DestinationResult copy) throws Exception {
+        requireArtifact(record, copy);
+        if (copy.ownership() != ArtifactOwnership.MANAGED) {
+            return copy;
         }
-        return awaitDrained(backend.hydrateExternalSnapshot(
-                record.manifest().worldId(),
-                record.manifest().backupId(),
-                record.manifest(),
-                binding.fingerprint(),
-                source.location()));
+        return RecoverySupport.awaitStopped(git.syncSnapshot(record.manifest().worldId(), record.manifest().backupId()));
     }
 
-    private static <T> T await(CompletionStage<T> stage) throws Exception {
-        try {
-            return stage.toCompletableFuture().get();
-        } catch (InterruptedException exception) {
-            Thread.currentThread().interrupt();
-            throw exception;
-        } catch (ExecutionException exception) {
-            Throwable cause = exception.getCause();
-            if (cause instanceof Exception checked) {
-                throw checked;
-            }
-            if (cause instanceof Error error) {
-                throw error;
-            }
-            throw new CompletionException(cause);
-        }
+    private static DestinationResult deleted(DestinationResult copy, Optional<String> note) {
+        return copy.withState(DestinationStatus.SUCCESS, note, copy.syncStatus());
     }
 
-    static <T> T awaitDrained(CompletionStage<T> stage) throws Exception {
-        try {
-            return await(stage);
-        } catch (InterruptedException exception) {
-            try {
-                return joinAfterInterrupt(stage);
-            } finally {
-                Thread.currentThread().interrupt();
-            }
+    private static void requireArtifact(BackupRecord record, DestinationResult copy) {
+        String expected = GitSnapshot.refName(record.manifest().worldId(), record.manifest().backupId());
+        if (!copy.artifactId().filter(expected::equals).isPresent()) {
+            throw new BackupRecoveryException("The backup list names another Git snapshot for this backup");
         }
     }
 
-    private static <T> T joinAfterInterrupt(CompletionStage<T> stage) throws Exception {
-        try {
-            return stage.toCompletableFuture().join();
-        } catch (CompletionException exception) {
-            Throwable cause = exception.getCause();
-            if (cause instanceof Exception checked) {
-                throw checked;
-            }
-            if (cause instanceof Error error) {
-                throw error;
-            }
-            throw exception;
-        }
+    /** Downloads a legacy linked snapshot's objects from the repository it is linked to, and checks it. */
+    private GitVerification hydrateExternal(BackupRecord record, DestinationResult copy) throws Exception {
+        ImportSource source = sources.find(copy.importSourceId().orElseThrow())
+                .filter(found -> found.mode() == ImportSourceMode.GIT_REMOTE_BACKED)
+                .orElseThrow(() -> new BackupRecoveryException("The repository this backup is linked to is no"
+                        + " longer recorded. Import the repository again."));
+        ImportArtifactBinding binding = source.artifact(record.manifest().backupId())
+                .filter(found -> found.worldId().equals(record.manifest().worldId()))
+                .orElseThrow(() -> new BackupRecoveryException("The linked repository no longer lists this"
+                        + " backup. Import the repository again."));
+        return RecoverySupport.awaitStopped(git.hydrateExternalSnapshot(
+                record.manifest().worldId(),
+                record.manifest().backupId(),
+                record.manifest(),
+                binding.fingerprint(),
+                source.location()));
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/recovery/OperationCancellation.java b/src/main/java/dev/ishaanko/worldarchive/recovery/OperationCancellation.java
deleted file mode 100644
index e019c5b..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/recovery/OperationCancellation.java
+++ /dev/null
@@ -1,17 +0,0 @@
-package dev.ishaanko.worldarchive.recovery;
-
-/** Cancellation contract for maintenance work with explicit commit boundaries. */
-interface OperationCancellation {
-    void checkpoint() throws InterruptedException;
-
-    <T> T mandatoryCommit(CheckedSupplier<T> operation) throws Exception;
-
-    <T> T commitIfActive(CheckedSupplier<T> operation) throws Exception;
-
-    <T> T pointOfNoReturn(CheckedSupplier<T> operation) throws Exception;
-
-    @FunctionalInterface
-    interface CheckedSupplier<T> {
-        T get() throws Exception;
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryDeleteOperation.java b/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryDeleteOperation.java
index ac320ff..2b32ef0 100644
--- a/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryDeleteOperation.java
+++ b/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryDeleteOperation.java
@@ -1,503 +1,267 @@
 package dev.ishaanko.worldarchive.recovery;
 
 import dev.ishaanko.worldarchive.catalog.BackupCatalog;
-import dev.ishaanko.worldarchive.catalog.BackupDeletionRegistry;
-import dev.ishaanko.worldarchive.core.BackupOperation;
-import dev.ishaanko.worldarchive.core.ConfirmationLedger;
+import dev.ishaanko.worldarchive.catalog.FileBackupDeletionRegistry;
 import dev.ishaanko.worldarchive.core.DeleteBackupRequest;
-import dev.ishaanko.worldarchive.core.DeletePreparation;
-import dev.ishaanko.worldarchive.core.OperationId;
-import dev.ishaanko.worldarchive.core.OperationPhase;
-import dev.ishaanko.worldarchive.core.OperationProgress;
-import dev.ishaanko.worldarchive.core.ProgressListener;
 import dev.ishaanko.worldarchive.core.WorldOperationGate;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.BackupOperation;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.BackupResult;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationStatus;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.OperationId;
+import dev.ishaanko.worldarchive.model.OperationPhase;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.SafeText;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.io.IOException;
 import java.time.Clock;
-import java.time.Duration;
 import java.time.Instant;
 import java.util.ArrayList;
+import java.util.EnumMap;
+import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
-import java.util.Queue;
 import java.util.Set;
-import java.util.concurrent.CompletionException;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentLinkedQueue;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.Executor;
-import java.util.concurrent.RejectedExecutionException;
-import java.util.concurrent.atomic.AtomicInteger;
-import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.UnaryOperator;
+import java.util.stream.Collectors;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
-/** Executes delete confirmation issuance and the destination-deletion operation. */
+/**
+ * Deletes confirmed backups with every copy they have. The backups of one world are deleted
+ * together inside that world's gate: one Git operation for their snapshots, their ZIP archives
+ * one by one, and one catalog write. Each backup gets its own result. A backup whose listed copies
+ * are no longer the ones the player confirmed is left alone; a copy that could not be deleted
+ * stays listed, and a backup with no copy left leaves the catalog. Cancel stops the delete before
+ * the next world; a world that started finishes, so the list matches the files unless the list
+ * could not be saved, which the results of that world then say.
+ */
 final class RecoveryDeleteOperation {
-    private static final int MAXIMUM_FAILURE_REASON_LENGTH = 200;
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
+    private static final String GONE = "This backup is no longer in the backup list; it may have been deleted already.";
+
+    private static final String CHANGED = "This backup changed after you confirmed the delete. Select Delete again.";
 
     private final BackupCatalog catalog;
 
-    private final RecoveryDestinations destinations;
+    private final Map<DestinationType, RecoveryDestination> destinations;
 
-    private final BackupDeletionRegistry deletions;
+    private final FileBackupDeletionRegistry deletions;
 
     private final WorldOperationGate operationGate;
 
-    private final Executor executor;
-
     private final Clock clock;
 
-    private final Duration confirmationLifetime;
-
-    private final ConfirmationLedger<OperationId, DeleteConfirmation> confirmations =
-            new ConfirmationLedger<>(DeleteConfirmation::expiresAt);
-
     RecoveryDeleteOperation(
             BackupCatalog catalog,
-            RecoveryDestinations destinations,
-            BackupDeletionRegistry deletions,
+            Map<DestinationType, RecoveryDestination> destinations,
+            FileBackupDeletionRegistry deletions,
             WorldOperationGate operationGate,
-            Executor executor,
-            Clock clock,
-            Duration confirmationLifetime) {
+            Clock clock) {
         this.catalog = Objects.requireNonNull(catalog, "catalog");
-        this.destinations = Objects.requireNonNull(destinations, "destinations");
+        this.destinations = new EnumMap<>(destinations);
         this.deletions = Objects.requireNonNull(deletions, "deletions");
         this.operationGate = Objects.requireNonNull(operationGate, "operationGate");
-        this.executor = Objects.requireNonNull(executor, "executor");
         this.clock = Objects.requireNonNull(clock, "clock");
-        this.confirmationLifetime =
-                Objects.requireNonNull(confirmationLifetime, "confirmationLifetime");
-    }
-
-    DeletePreparation prepareDeleteBlocking(BackupId backupId) throws IOException {
-        BackupRecord record = RecoverySupport.requireRecord(catalog, backupId);
-        Instant now = clock.instant();
-        confirmations.expireStaleEntries(now);
-        ConfirmationLedger.Issued<OperationId, DeleteConfirmation> issued = confirmations.putUnique(
-                OperationId::create,
-                token -> DeleteConfirmation.create(record, now.plus(confirmationLifetime)));
-        long artifacts = RecoverySupport.presentDestinations(record).size();
-        String description = "Delete backup " + backupId + " for "
-                + record.manifest().worldName() + " from " + artifacts + " destination(s)";
-        return new DeletePreparation(
-                backupId, issued.key(), description, issued.value().expiresAt());
-    }
-
-    BackupResult deleteBlocking(
-            DeleteBackupRequest request,
-            ProgressListener progressListener,
-            OperationCancellation cancellation) throws Exception {
-        cancellation.checkpoint();
-        DeleteConfirmation confirmation = claimConfirmation(request);
-        BackupRecord record = RecoverySupport.requireRecord(catalog, request.backupId());
-        try (WorldOperationGate.Permit ignored = operationGate.enter(record.manifest().worldId())) {
-            return deleteInsideGate(confirmation, progressListener, cancellation);
-        }
     }
 
     /**
-     * Deletes several confirmed backups in one operation. Every confirmation is claimed
-     * before any storage changes, so one bad token deletes nothing. Backups in the same
-     * world share one gate permit and run concurrently; each destination store still
-     * serializes its own writes. Results come back in request order, and a backup whose
-     * deletion could not start is reported as failed rather than dropped.
+     * Deletes the confirmed backups, world by world. A world whose backup list cannot be read, or
+     * whose backups cannot be marked deleted, fails its own backups with nothing deleted, and the
+     * next world still runs. Results come back in request order.
      */
-    List<BackupResult> deleteManyBlocking(
+    List<BackupResult> delete(
             List<DeleteBackupRequest> requests,
-            ProgressListener progressListener,
-            OperationCancellation cancellation) throws Exception {
-        cancellation.checkpoint();
+            ProgressListener listener,
+            CancellableTask<?> task) throws Exception {
+        task.checkpoint();
         if (requests.isEmpty()) {
             throw new BackupRecoveryException("Select at least one backup to delete");
         }
-        Map<BackupId, DeleteConfirmation> claimed = claimAll(requests);
-        Map<WorldId, List<DeleteConfirmation>> byWorld = new LinkedHashMap<>();
-        for (DeleteConfirmation confirmation : claimed.values()) {
-            byWorld.computeIfAbsent(confirmation.manifest().worldId(), ignored -> new ArrayList<>())
-                    .add(confirmation);
+        if (requests.stream().map(DeleteBackupRequest::backupId).distinct().count() != requests.size()) {
+            throw new BackupRecoveryException("The same backup was selected twice");
         }
-        OperationId operationId = OperationId.create();
-        int total = claimed.size();
-        AtomicInteger completed = new AtomicInteger();
-        Map<BackupId, BackupResult> results = new ConcurrentHashMap<>();
-        Set<BackupId> started = ConcurrentHashMap.newKeySet();
-        try {
-            for (Map.Entry<WorldId, List<DeleteConfirmation>> world : byWorld.entrySet()) {
-                RecoverySupport.report(progressListener, batchProgress(
-                        operationId, world.getKey(), OperationPhase.PREPARING,
-                        completed.get(), total, "Preparing to delete " + total + " backups"));
-                try (WorldOperationGate.Permit ignored = operationGate.enter(world.getKey())) {
-                    cancellation.checkpoint();
-                    List<Runnable> tasks = new ArrayList<>();
-                    for (DeleteConfirmation confirmation : world.getValue()) {
-                        tasks.add(() -> {
-                            started.add(confirmation.backupId());
-                            results.put(confirmation.backupId(), deleteOrReport(
-                                    confirmation, cancellation));
-                            int done = completed.incrementAndGet();
-                            RecoverySupport.report(progressListener, batchProgress(
-                                    operationId, world.getKey(), OperationPhase.WRITING,
-                                    done, total, "Deleting backups (" + done + " of " + total + ")"));
-                        });
-                    }
-                    runAll(tasks);
-                }
-            }
-        } catch (Exception exception) {
-            // A backup whose task never ran keeps its confirmation, so the same token works
-            // again once the user retries. A task that threw may already have removed the
-            // record, so its token stays consumed.
-            for (DeleteBackupRequest request : requests) {
-                if (!started.contains(request.backupId())) {
-                    confirmations.put(request.confirmationToken(), claimed.get(request.backupId()));
-                }
+        Map<WorldId, List<DeleteBackupRequest>> byWorld = new LinkedHashMap<>();
+        requests.forEach(request -> byWorld
+                .computeIfAbsent(request.worldId(), ignored -> new ArrayList<>())
+                .add(request));
+        Progress progress = new Progress(listener, requests.size());
+        Map<BackupId, BackupResult> results = new HashMap<>();
+        for (Map.Entry<WorldId, List<DeleteBackupRequest>> world : byWorld.entrySet()) {
+            try {
+                results.putAll(deleteWorld(world.getKey(), world.getValue(), progress, task));
+            } catch (IOException failure) {
+                task.checkpoint();
+                String reason = "Nothing of this backup was deleted, because WorldArchive could not read or save"
+                        + " its backup list (" + SafeText.from(failure, "no details", 300) + "). Try again.";
+                world.getValue().forEach(request -> results.put(request.backupId(), failed(request, reason)));
+                progress.finished(world.getKey(), world.getValue().size());
             }
-            throw exception;
-        }
-        RecoverySupport.report(progressListener, batchProgress(
-                operationId, byWorld.keySet().iterator().next(), OperationPhase.COMPLETE,
-                total, total, "Finished deleting backups"));
-        return requests.stream()
-                .map(request -> results.get(request.backupId()))
-                .toList();
-    }
-
-    private BackupResult deleteOrReport(
-            DeleteConfirmation confirmation,
-            OperationCancellation cancellation) {
-        try {
-            return deleteInsideGate(confirmation, ProgressListener.NO_OP, cancellation);
-        } catch (InterruptedException exception) {
-            Thread.currentThread().interrupt();
-            return failedResult(confirmation, exception);
-        } catch (Exception exception) {
-            return failedResult(confirmation, exception);
         }
+        progress.report(byWorld.keySet().iterator().next(), OperationPhase.COMPLETE, "Finished deleting backups");
+        return requests.stream().map(request -> results.get(request.backupId())).toList();
     }
 
-    /**
-     * Runs the tasks with the executor and this thread pulling from one shared queue. The
-     * caller never blocks on work that only the executor could start, so a bounded or
-     * single-threaded executor cannot deadlock. Every task finishes even after an
-     * interrupt, because each one is committing storage changes.
-     */
-    private void runAll(List<Runnable> tasks) throws InterruptedException {
-        Queue<Runnable> pending = new ConcurrentLinkedQueue<>(tasks);
-        CountDownLatch finished = new CountDownLatch(tasks.size());
-        AtomicReference<Throwable> failure = new AtomicReference<>();
-        Runnable drain = () -> {
-            Runnable task;
-            while ((task = pending.poll()) != null) {
-                try {
-                    task.run();
-                } catch (Throwable exception) {
-                    failure.compareAndSet(null, exception);
-                } finally {
-                    finished.countDown();
+    /** Deletes one world's confirmed backups; a backup that changed since it was confirmed is left alone. */
+    private Map<BackupId, BackupResult> deleteWorld(
+            WorldId worldId,
+            List<DeleteBackupRequest> confirmed,
+            Progress progress,
+            CancellableTask<?> task) throws Exception {
+        try (WorldOperationGate.Permit ignored = operationGate.enter(worldId)) {
+            progress.report(worldId, OperationPhase.PREPARING, "Deleting " + confirmed.size() + " backups");
+            Map<BackupId, BackupRecord> listed = new HashMap<>();
+            catalog.list(worldId).forEach(record -> listed.put(record.manifest().backupId(), record));
+            Map<BackupId, BackupResult> results = new LinkedHashMap<>();
+            List<BackupRecord> matched = new ArrayList<>();
+            for (DeleteBackupRequest request : confirmed) {
+                BackupRecord record = listed.get(request.backupId());
+                if (record == null) {
+                    results.put(request.backupId(), failed(request, GONE));
+                } else if (!DeleteConfirmation.of(request.copies()).matches(record)) {
+                    results.put(request.backupId(), failed(request, CHANGED));
+                } else {
+                    matched.add(record);
                 }
             }
-        };
-        for (int helper = 1; helper < tasks.size(); helper++) {
-            try {
-                executor.execute(drain);
-            } catch (RejectedExecutionException exception) {
-                break;
-            }
-        }
-        drain.run();
-        boolean interrupted = false;
-        while (true) {
-            try {
-                finished.await();
-                break;
-            } catch (InterruptedException exception) {
-                interrupted = true;
+            if (!matched.isEmpty()) {
+                results.putAll(task.commitIfActive(() -> deleteMatched(worldId, matched, progress)));
             }
-        }
-        if (interrupted) {
-            Thread.currentThread().interrupt();
-        }
-        Throwable failed = failure.get();
-        if (failed != null) {
-            throw new CompletionException(failed);
-        }
-        if (Thread.currentThread().isInterrupted()) {
-            throw new InterruptedException("Backup deletion was cancelled");
+            progress.finished(worldId, confirmed.size());
+            return results;
         }
     }
 
     /**
-     * Claims every token or none. A rejected batch hands the already claimed tokens back
-     * to the ledger, so the caller can fix the bad request and retry with the same tokens.
+     * Marks the backups deleted before any file changes, deletes every copy, and then updates the
+     * catalog and the marks once each: a backup that keeps a copy stays listed and unmarked.
      */
-    private Map<BackupId, DeleteConfirmation> claimAll(List<DeleteBackupRequest> requests) {
-        Map<BackupId, DeleteConfirmation> claimed = new LinkedHashMap<>();
-        Map<OperationId, DeleteConfirmation> restorable = new LinkedHashMap<>();
-        try {
-            for (DeleteBackupRequest request : requests) {
-                if (claimed.containsKey(request.backupId())) {
-                    throw new BackupRecoveryException("The same backup was selected twice");
-                }
-                // Record the token before validating it, so a mismatch also rolls back.
-                DeleteConfirmation issued = confirmations.claim(request.confirmationToken())
-                        .orElse(null);
-                if (issued != null) {
-                    restorable.put(request.confirmationToken(), issued);
-                }
-                claimed.put(request.backupId(), requireValid(request, issued));
+    private Map<BackupId, BackupResult> deleteMatched(WorldId worldId, List<BackupRecord> records, Progress progress)
+            throws IOException {
+        List<BackupId> backupIds = records.stream().map(record -> record.manifest().backupId()).toList();
+        deletions.mark(backupIds);
+        Map<DestinationType, Map<BackupId, DestinationResult>> outcomes = new EnumMap<>(DestinationType.class);
+        for (RecoveryDestination destination : destinations.values()) {
+            List<BackupRecord> holding = records.stream()
+                    .filter(record -> RecoverySupport.copy(record, destination.type()).isPresent())
+                    .toList();
+            if (!holding.isEmpty()) {
+                progress.report(worldId, OperationPhase.WRITING, "Deleting " + label(destination.type()) + " copies");
+                outcomes.put(destination.type(), destination.delete(worldId, holding));
             }
-            return claimed;
-        } catch (RuntimeException exception) {
-            restorable.forEach(confirmations::put);
-            throw exception;
-        }
-    }
-
-    private DeleteConfirmation claimConfirmation(DeleteBackupRequest request) {
-        return requireValid(
-                request, confirmations.claim(request.confirmationToken()).orElse(null));
-    }
-
-    private DeleteConfirmation requireValid(
-            DeleteBackupRequest request,
-            DeleteConfirmation confirmation) {
-        Instant now = clock.instant();
-        if (confirmation == null
-                || !confirmation.backupId().equals(request.backupId())
-                || !now.isBefore(confirmation.expiresAt())) {
-            throw new BackupRecoveryException("Delete confirmation is invalid, expired, or already used");
         }
-        return confirmation;
-    }
-
-    private BackupResult deleteInsideGate(
-            DeleteConfirmation confirmation,
-            ProgressListener progressListener,
-            OperationCancellation cancellation) throws Exception {
-        BackupId backupId = confirmation.backupId();
-        boolean deletionIntentRecorded = false;
+        Set<BackupId> listed = unlist(records, outcomes);
         try {
-            cancellation.checkpoint();
-            BackupRecord current = RecoverySupport.requireRecord(catalog, backupId);
-            confirmation.requireMatches(current);
-            deletions.record(current.manifest().backupId());
-            deletionIntentRecorded = true;
-            OperationId operationId = OperationId.create();
-            List<DestinationResult> present = RecoverySupport.presentDestinations(current);
-            List<DestinationResult> attempts = new ArrayList<>();
-            RecoverySupport.report(progressListener, RecoverySupport.progress(
-                    operationId, current, BackupOperation.DELETE, OperationPhase.PREPARING,
-                    0, present.size(), "Preparing destination deletion"));
-            if (present.isEmpty()) {
-                cancellation.commitIfActive(() -> {
-                    removeRecordWithoutArtifacts(current);
-                    return null;
-                });
-                cancellation.checkpoint();
-            }
-            for (DestinationResult destination : present) {
-                cancellation.checkpoint();
-                RecoveryDestination adapter = destinations.get(destination.destination());
-                boolean removed = false;
-                Optional<String> failureReason = Optional.empty();
-                if (adapter != null) {
-                    try {
-                        DeletionOutcome outcome = cancellation.commitIfActive(() ->
-                                deleteAndPersist(current, destination, adapter));
-                        removed = outcome.removed();
-                        failureReason = outcome.failureReason();
-                    } catch (InterruptedException exception) {
-                        Thread.currentThread().interrupt();
-                        throw exception;
-                    }
-                }
-                if (removed) {
-                    attempts.add(destination.withState(
-                            DestinationStatus.SUCCESS,
-                            Optional.empty(),
-                            destination.syncStatus()));
-                } else {
-                    attempts.add(DestinationResult.failed(
-                            destination.destination(), deletionFailureMessage(failureReason)));
-                }
-                RecoverySupport.report(progressListener, RecoverySupport.progress(
-                        operationId, current, BackupOperation.DELETE, OperationPhase.WRITING,
-                        attempts.size(), present.size(), "Deleting destination artifacts"));
-                cancellation.checkpoint();
-            }
-            BackupResult result = BackupResult.aggregate(
-                    current.manifest().backupId(),
-                    current.manifest().worldId(),
-                    attempts,
-                    completionTime(current.manifest()));
-            RecoverySupport.report(progressListener, RecoverySupport.progress(
-                    operationId, current, BackupOperation.DELETE, OperationPhase.COMPLETE,
-                    present.size(), present.size(), "Destination deletion complete"));
-            restoreDeletionIntent(backupId, deletionIntentRecorded, null);
-            return result;
-        } catch (Exception exception) {
-            restoreDeletionIntent(backupId, deletionIntentRecorded, exception);
-            throw exception;
+            deletions.unmark(backupIds.stream().filter(listed::contains).toList());
+        } catch (IOException failure) {
+            LOGGER.warn("Backups that kept a copy are still marked deleted, so a rebuild of the backup list"
+                    + " will not list them again: {}", failure.toString());
+        }
+        Map<BackupId, BackupResult> results = new LinkedHashMap<>();
+        for (BackupRecord record : records) {
+            List<DestinationResult> attempts = RecoverySupport.copies(record).stream()
+                    .map(copy -> outcomes.get(copy.destination()).get(record.manifest().backupId()))
+                    .toList();
+            results.put(record.manifest().backupId(), result(record.manifest(), attempts));
         }
+        return results;
     }
 
-    /** Clears the recorded intent when the record survived; never hides the failure that led here. */
-    private void restoreDeletionIntent(BackupId backupId, boolean recorded, Exception failure)
-            throws IOException {
-        if (!recorded) {
-            return;
+    /**
+     * Removes the deleted copies from the catalog in one write, and each backup with no copy left.
+     * Returns the backups that stay listed. When the write fails, every backup stays listed, so
+     * each deleted copy is reported as failed with the reason.
+     */
+    private Set<BackupId> unlist(
+            List<BackupRecord> records,
+            Map<DestinationType, Map<BackupId, DestinationResult>> outcomes) {
+        Map<BackupId, UnaryOperator<Optional<BackupRecord>>> changes = new LinkedHashMap<>();
+        for (BackupRecord record : records) {
+            changes.put(record.manifest().backupId(), current -> current
+                    .map(existing -> withoutDeletedCopies(existing, outcomes))
+                    .filter(existing -> existing.result().destinations().stream().anyMatch(DestinationResult::isDurable)));
         }
         try {
-            if (catalog.find(backupId).isPresent()) {
-                deletions.restore(backupId);
-            }
-        } catch (IOException | RuntimeException exception) {
-            if (failure == null) {
-                throw exception;
-            }
-            failure.addSuppressed(exception);
+            return catalog.updateAll(changes).entrySet().stream()
+                    .filter(entry -> entry.getValue().isPresent())
+                    .map(Map.Entry::getKey)
+                    .collect(Collectors.toSet());
+        } catch (IOException failure) {
+            String reason = "Deleted, but the backup list could not be saved ("
+                    + SafeText.from(failure, "it could not be written", 300)
+                    + "), so the backup is still listed. Delete it again to update the list.";
+            outcomes.replaceAll((type, deleted) -> deleted.entrySet().stream().collect(Collectors.toMap(
+                    Map.Entry::getKey,
+                    entry -> entry.getValue().status() == DestinationStatus.SUCCESS
+                            ? DestinationResult.failed(type, reason)
+                            : entry.getValue())));
+            return changes.keySet();
         }
     }
 
-    private DeletionOutcome deleteAndPersist(
-            BackupRecord current,
-            DestinationResult destination,
-            RecoveryDestination adapter) throws Exception {
-        boolean removed;
-        try {
-            removed = adapter.delete(current, destination);
-        } catch (InterruptedException exception) {
-            Thread.currentThread().interrupt();
-            throw exception;
-        } catch (Exception exception) {
-            return DeletionOutcome.failed(safeFailureReason(exception));
-        }
-        if (removed) {
-            persistSuccessfulDeletion(current, RecoverySupport.DestinationKey.from(destination));
-        }
-        return removed ? DeletionOutcome.succeeded() : DeletionOutcome.failed(Optional.empty());
+    private static BackupRecord withoutDeletedCopies(
+            BackupRecord record,
+            Map<DestinationType, Map<BackupId, DestinationResult>> outcomes) {
+        BackupId backupId = record.manifest().backupId();
+        return RecoverySupport.withDestinations(record, record.result().destinations().stream()
+                .filter(destination -> !Optional.ofNullable(outcomes.get(destination.destination()))
+                        .map(deleted -> deleted.get(backupId))
+                        .filter(outcome -> outcome.status() == DestinationStatus.SUCCESS
+                                && outcome.artifactId().equals(destination.artifactId()))
+                        .isPresent())
+                .toList());
     }
 
-    /**
-     * Turns a deletion that could not start into a result the caller can show next to the
-     * others. Every destination the user confirmed is marked failed with the reason. A
-     * confirmation without destinations has nothing to mark, so that failure propagates.
-     */
-    private BackupResult failedResult(DeleteConfirmation confirmation, Exception failure) {
-        if (confirmation.destinationTypes().isEmpty()) {
-            throw failure instanceof RuntimeException unchecked
-                    ? unchecked
-                    : new CompletionException(failure);
-        }
-        String reason = deletionFailureMessage(safeFailureReason(failure));
-        List<DestinationResult> attempts = confirmation.destinationTypes().stream()
+    /** The result of a delete that did not start: each confirmed copy failed with the reason. */
+    private BackupResult failed(DeleteBackupRequest request, String reason) {
+        return new BackupResult(request.backupId(), request.worldId(), DeleteConfirmation.of(request.copies())
+                .copyTypes().stream()
                 .sorted()
                 .map(type -> DestinationResult.failed(type, reason))
-                .toList();
-        return BackupResult.aggregate(
-                confirmation.backupId(),
-                confirmation.manifest().worldId(),
-                attempts,
-                completionTime(confirmation.manifest()));
+                .toList(), clock.instant());
     }
 
-    private static OperationProgress batchProgress(
-            OperationId operationId,
-            WorldId worldId,
-            OperationPhase phase,
-            long completed,
-            long total,
-            String message) {
-        return new OperationProgress(
-                operationId,
-                worldId,
-                Optional.empty(),
-                BackupOperation.DELETE,
-                phase,
-                completed,
-                total,
-                message);
+    private BackupResult result(BackupManifest manifest, List<DestinationResult> attempts) {
+        Instant now = clock.instant();
+        return new BackupResult(manifest.backupId(), manifest.worldId(), attempts,
+                now.isBefore(manifest.createdAt()) ? manifest.createdAt() : now);
     }
 
-    private static Optional<String> safeFailureReason(Exception exception) {
-        String message = exception.getMessage();
-        if (message == null || message.isBlank()) {
-            return Optional.of(exception.getClass().getSimpleName());
-        }
-        String redacted = SensitiveDataRedactor.redact(message);
-        if (redacted.codePointCount(0, redacted.length()) <= MAXIMUM_FAILURE_REASON_LENGTH) {
-            return Optional.of(redacted);
-        }
-        int end = redacted.offsetByCodePoints(0, MAXIMUM_FAILURE_REASON_LENGTH - 1);
-        return Optional.of(redacted.substring(0, end) + "…");
+    private static String label(DestinationType type) {
+        return type == DestinationType.ZIP ? "ZIP" : "Git";
     }
 
-    private static String deletionFailureMessage(Optional<String> reason) {
-        return reason
-                .map(text -> "Destination artifact could not be deleted: " + text)
-                .orElse("Destination artifact could not be deleted");
-    }
+    /** Progress of one delete, counted in backups. */
+    private static final class Progress {
+        private final ProgressListener listener;
 
-    private record DeletionOutcome(boolean removed, Optional<String> failureReason) {
-        static DeletionOutcome succeeded() {
-            return new DeletionOutcome(true, Optional.empty());
-        }
+        private final OperationId operationId = OperationId.create();
 
-        static DeletionOutcome failed(Optional<String> failureReason) {
-            return new DeletionOutcome(false, failureReason);
-        }
-    }
+        private final int total;
 
-    private void removeRecordWithoutArtifacts(BackupRecord expected) throws IOException {
-        BackupRecord current = RecoverySupport.requireRecord(catalog, expected.manifest().backupId());
-        RecoverySupport.requireSameManifest(expected, current);
-        if (!RecoverySupport.presentDestinations(current).isEmpty()) {
-            throw new BackupRecoveryException(
-                    "Backup gained a destination before the catalog was updated");
-        }
-        if (!catalog.remove(current.manifest().backupId())) {
-            throw new BackupRecoveryException("Backup disappeared while updating the catalog");
-        }
-    }
+        private int finished;
 
-    private void persistSuccessfulDeletion(
-            BackupRecord expected,
-            RecoverySupport.DestinationKey deleted) throws IOException {
-        BackupRecord current = RecoverySupport.requireRecord(catalog, expected.manifest().backupId());
-        RecoverySupport.requireSameManifest(expected, current);
-        boolean stillPresent = current.result().destinations().stream()
-                .anyMatch(destination -> deleted.equals(RecoverySupport.DestinationKey.from(destination))
-                        && RecoverySupport.isPresent(destination));
-        if (!stillPresent) {
-            throw new BackupRecoveryException(
-                    "Deleted destination disappeared before the catalog was updated");
+        private Progress(ProgressListener listener, int total) {
+            this.listener = listener;
+            this.total = total;
         }
-        List<DestinationResult> remaining = current.result().destinations().stream()
-                .filter(destination -> !deleted.equals(RecoverySupport.DestinationKey.from(destination)))
-                .toList();
-        if (remaining.stream().noneMatch(RecoverySupport::isPresent)) {
-            if (!catalog.remove(current.manifest().backupId())) {
-                throw new BackupRecoveryException("Backup disappeared while updating the catalog");
-            }
-            return;
+
+        private void report(WorldId worldId, OperationPhase phase, String message) {
+            RecoverySupport.report(listener, RecoverySupport.worldProgress(
+                    operationId, worldId, BackupOperation.DELETE, phase, finished, total, message));
         }
-        RecoverySupport.updateCatalog(catalog, current.manifest().backupId(), existing -> existing.stream()
-                .filter(destination -> !deleted.equals(RecoverySupport.DestinationKey.from(destination)))
-                .toList());
-    }
 
-    private Instant completionTime(BackupManifest manifest) {
-        Instant now = clock.instant();
-        return now.isBefore(manifest.createdAt()) ? manifest.createdAt() : now;
+        private void finished(WorldId worldId, int backups) {
+            finished += backups;
+            report(worldId, OperationPhase.WRITING, "Deleted " + finished + " of " + total + " backups");
+        }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryDestination.java b/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryDestination.java
index 02a11c6..a1fd88b 100644
--- a/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryDestination.java
+++ b/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryDestination.java
@@ -1,81 +1,34 @@
 package dev.ishaanko.worldarchive.recovery;
 
+import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.DestinationHealth;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.nio.file.Path;
-import java.nio.file.attribute.FileTime;
-import java.util.Objects;
-import java.util.Optional;
+import java.util.List;
+import java.util.Map;
 
-/** Blocking worker-thread adapter for the independent destination implementations. */
+/**
+ * One kind of copy, Git or ZIP, as the recovery operations use it. Every method blocks on the
+ * calling worker thread; the copy passed in is the record's durable destination of this kind.
+ */
 interface RecoveryDestination {
-    DestinationType destinationType();
-
-    VerificationOutcome verify(BackupRecord record, DestinationResult destination) throws Exception;
-
-    default VerificationOutcome verifyForRestore(
-            BackupRecord record,
-            DestinationResult destination) throws Exception {
-        return verify(record, destination);
-    }
-
-    Materialization materialize(
-            BackupRecord record,
-            DestinationResult destination,
-            Path emptyTarget)
-            throws Exception;
-
-    /** Returns true when the exact artifact was removed or its exact absence was confirmed. */
-    boolean delete(BackupRecord record, DestinationResult destination) throws Exception;
-
-    DestinationResult sync(BackupRecord record, DestinationResult destination) throws Exception;
-
-    DestinationHealth health(Optional<WorldId> worldId) throws Exception;
-
-    record Materialization(
-            Path path,
-            boolean preservesDirectoryIdentity,
-            Object fileKey,
-            FileTime creationTime,
-            Optional<String> directoryIdentityMarker,
-            Optional<String> postMaterializationProblem) {
-        public Materialization {
-            path = Objects.requireNonNull(path, "path").toAbsolutePath().normalize();
-            postMaterializationProblem = Objects.requireNonNull(
-                    postMaterializationProblem, "postMaterializationProblem");
-            directoryIdentityMarker = Objects.requireNonNull(
-                    directoryIdentityMarker, "directoryIdentityMarker");
-            if (!preservesDirectoryIdentity) {
-                Objects.requireNonNull(creationTime, "creationTime");
-            }
-        }
-
-        static Materialization preserved(Path path) {
-            return new Materialization(
-                    path,
-                    true,
-                    null,
-                    null,
-                    Optional.empty(),
-                    Optional.empty());
-        }
-
-        static Materialization replaced(
-                Path path,
-                Object fileKey,
-                FileTime creationTime,
-                Optional<String> directoryIdentityMarker,
-                Optional<String> postMaterializationProblem) {
-            return new Materialization(
-                    path,
-                    false,
-                    fileKey,
-                    creationTime,
-                    directoryIdentityMarker,
-                    postMaterializationProblem);
-        }
-    }
+    DestinationType type();
+
+    /** Checks the copy in full; damage is a failed outcome, a copy that cannot be read throws. */
+    VerificationOutcome verify(BackupRecord record, DestinationResult copy) throws Exception;
+
+    /**
+     * Writes the backup's world into an empty staging folder, checking every file against the
+     * record's manifest; throws, with a reason the player can read, when this copy cannot.
+     */
+    void restore(BackupRecord record, DestinationResult copy, Path emptyStaging) throws Exception;
+
+    /**
+     * Deletes the copies of several backups of one world, together where the storage allows. Each
+     * backup gets a result: SUCCESS when its copy is gone, FAILED with the reason when it was kept.
+     * An interrupt does not stop the delete; the results always say what happened.
+     */
+    Map<BackupId, DestinationResult> delete(WorldId worldId, List<BackupRecord> records);
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryDestinations.java b/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryDestinations.java
deleted file mode 100644
index cce5091..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryDestinations.java
+++ /dev/null
@@ -1,55 +0,0 @@
-package dev.ishaanko.worldarchive.recovery;
-
-import dev.ishaanko.worldarchive.importing.ImportSourceRegistry;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.storage.git.GitSnapshotStore;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupStoreResolver;
-import java.time.Clock;
-import java.util.EnumMap;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Registry of the destination-specific recovery adapters, keyed by destination type. */
-final class RecoveryDestinations {
-    private final Map<DestinationType, RecoveryDestination> byType;
-
-    private RecoveryDestinations(Map<DestinationType, RecoveryDestination> byType) {
-        this.byType = byType;
-    }
-
-    static RecoveryDestinations of(Map<DestinationType, RecoveryDestination> destinations) {
-        Objects.requireNonNull(destinations, "destinations");
-        EnumMap<DestinationType, RecoveryDestination> validated =
-                new EnumMap<>(DestinationType.class);
-        destinations.forEach((type, destination) -> {
-            Objects.requireNonNull(type, "destination type");
-            Objects.requireNonNull(destination, "destination");
-            if (type != destination.destinationType()) {
-                throw new IllegalArgumentException("Destination map key does not match its adapter");
-            }
-            validated.put(type, destination);
-        });
-        return new RecoveryDestinations(Map.copyOf(validated));
-    }
-
-    static RecoveryDestinations create(
-            Optional<? extends GitSnapshotStore> gitBackend,
-            Optional<? extends ZipBackupStoreResolver> zipStore,
-            Optional<ImportSourceRegistry> sources,
-            Clock clock) {
-        Objects.requireNonNull(gitBackend, "gitBackend");
-        Objects.requireNonNull(zipStore, "zipStore");
-        EnumMap<DestinationType, RecoveryDestination> result =
-                new EnumMap<>(DestinationType.class);
-        gitBackend.ifPresent(backend -> result.put(
-                DestinationType.GIT, new GitRecoveryDestination(backend, clock, sources)));
-        zipStore.ifPresent(store -> result.put(
-                DestinationType.ZIP, new ZipRecoveryDestination(store, clock)));
-        return of(result);
-    }
-
-    RecoveryDestination get(DestinationType type) {
-        return byType.get(type);
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryHealthOperations.java b/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryHealthOperations.java
index cdd59d5..22fe5fe 100644
--- a/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryHealthOperations.java
+++ b/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryHealthOperations.java
@@ -1,245 +1,187 @@
 package dev.ishaanko.worldarchive.recovery;
 
 import dev.ishaanko.worldarchive.catalog.BackupCatalog;
-import dev.ishaanko.worldarchive.core.BackupOperation;
-import dev.ishaanko.worldarchive.core.OperationId;
-import dev.ishaanko.worldarchive.core.OperationPhase;
-import dev.ishaanko.worldarchive.core.ProgressListener;
 import dev.ishaanko.worldarchive.core.WorldOperationGate;
 import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupOperation;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.DestinationHealth;
-import dev.ishaanko.worldarchive.model.DestinationHealthStatus;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationStatus;
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.OperationId;
+import dev.ishaanko.worldarchive.model.OperationPhase;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.SafeText;
 import dev.ishaanko.worldarchive.model.SyncStatus;
 import dev.ishaanko.worldarchive.model.VerificationStatus;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.time.Clock;
-import java.util.ArrayList;
-import java.util.Comparator;
-import java.util.HashMap;
+import java.io.IOException;
+import java.util.EnumMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
+import java.util.function.UnaryOperator;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
-/** Executes verify, sync, and health-check maintenance operations. */
+/**
+ * Verifies a backup's copies and uploads its pending Git copy. Verify and sync record their outcome in the catalog; a cancelled verify
+ * records nothing, and a sync records what the upload did before it stopped.
+ */
 final class RecoveryHealthOperations {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
     private final BackupCatalog catalog;
 
-    private final RecoveryDestinations destinations;
+    private final Map<DestinationType, RecoveryDestination> destinations;
 
-    private final WorldOperationGate operationGate;
+    private final GitRecoveryDestination git;
 
-    private final Clock clock;
+    private final WorldOperationGate operationGate;
 
     RecoveryHealthOperations(
             BackupCatalog catalog,
-            RecoveryDestinations destinations,
-            WorldOperationGate operationGate,
-            Clock clock) {
+            Map<DestinationType, RecoveryDestination> destinations,
+            GitRecoveryDestination git,
+            WorldOperationGate operationGate) {
         this.catalog = Objects.requireNonNull(catalog, "catalog");
-        this.destinations = Objects.requireNonNull(destinations, "destinations");
+        this.destinations = new EnumMap<>(destinations);
+        this.git = Objects.requireNonNull(git, "git");
         this.operationGate = Objects.requireNonNull(operationGate, "operationGate");
-        this.clock = Objects.requireNonNull(clock, "clock");
     }
 
-    BackupResult verifyBlocking(
-            BackupId backupId,
-            ProgressListener progressListener,
-            OperationCancellation cancellation) throws Exception {
-        cancellation.checkpoint();
+    /**
+     * Checks every copy in full and records VERIFIED, FAILED, or UNAVAILABLE for each. The result
+     * shows each warning a check found, such as a missing checksum file, in place of the copy's
+     * message; the warnings are not recorded.
+     */
+    BackupResult verify(BackupId backupId, ProgressListener listener, CancellableTask<?> task) throws Exception {
+        task.checkpoint();
         BackupRecord record = RecoverySupport.requireRecord(catalog, backupId);
         try (WorldOperationGate.Permit ignored = operationGate.enter(record.manifest().worldId())) {
-            cancellation.checkpoint();
+            task.checkpoint();
             BackupRecord current = RecoverySupport.requireRecord(catalog, backupId);
             RecoverySupport.requireSameManifest(record, current);
             OperationId operationId = OperationId.create();
-            List<DestinationResult> present = RecoverySupport.presentDestinations(current);
-            Map<RecoverySupport.DestinationKey, VerificationStatus> updates = new HashMap<>();
-            RecoverySupport.report(progressListener, RecoverySupport.progress(
-                    operationId, current, BackupOperation.VERIFY, OperationPhase.PREPARING,
-                    0, present.size(), "Preparing backup verification"));
-            int completed = 0;
-            for (DestinationResult destination : present) {
-                cancellation.checkpoint();
-                VerificationStatus status = VerificationStatus.UNAVAILABLE;
-                RecoveryDestination adapter = destinations.get(destination.destination());
-                if (adapter != null) {
-                    try {
-                        status = adapter.verify(current, destination).status();
-                    } catch (InterruptedException exception) {
-                        Thread.currentThread().interrupt();
-                        throw exception;
-                    } catch (Exception exception) {
-                        // The destination could not be checked; UNAVAILABLE already says so.
-                    }
-                }
-                updates.put(RecoverySupport.DestinationKey.from(destination), status);
-                completed++;
-                RecoverySupport.report(progressListener, RecoverySupport.progress(
-                        operationId, current, BackupOperation.VERIFY, OperationPhase.VERIFYING,
-                        completed, present.size(), "Verifying destination artifacts"));
+            List<DestinationResult> copies = RecoverySupport.copies(current);
+            report(listener, operationId, current, BackupOperation.VERIFY, OperationPhase.PREPARING, 0,
+                    copies.size(), "Preparing backup verification");
+            Map<DestinationType, VerificationOutcome> outcomes = new EnumMap<>(DestinationType.class);
+            for (DestinationResult copy : copies) {
+                task.checkpoint();
+                outcomes.put(copy.destination(), check(current, copy));
+                report(listener, operationId, current, BackupOperation.VERIFY, OperationPhase.VERIFYING,
+                        outcomes.size(), copies.size(), "Verifying destination artifacts");
             }
-            BackupRecord updated = cancellation.commitIfActive(() ->
-                    RecoverySupport.updateCatalog(catalog, backupId, existing -> existing.stream()
-                            .map(destination -> Optional.ofNullable(
-                                            updates.get(RecoverySupport.DestinationKey.from(destination)))
-                                    .map(destination::withVerification)
-                                    .orElse(destination))
-                            .toList()));
-            cancellation.checkpoint();
-            RecoverySupport.report(progressListener, RecoverySupport.progress(
-                    operationId, updated, BackupOperation.VERIFY, OperationPhase.COMPLETE,
-                    present.size(), present.size(), "Backup verification complete"));
-            return updated.result();
+            task.checkpoint();
+            BackupRecord updated = task.commitIfActive(() -> update(backupId, existing -> existing.isDurable()
+                    && outcomes.containsKey(existing.destination())
+                    ? existing.withVerification(outcomes.get(existing.destination()).status())
+                    : existing));
+            report(listener, operationId, updated, BackupOperation.VERIFY, OperationPhase.COMPLETE, copies.size(),
+                    copies.size(), "Backup verification complete");
+            return RecoverySupport.withDestinations(updated, updated.result().destinations().stream()
+                    .map(copy -> withWarning(copy, outcomes.get(copy.destination())))
+                    .toList()).result();
         }
     }
 
-    BackupResult syncBlocking(
-            BackupId backupId,
-            ProgressListener progressListener,
-            OperationCancellation cancellation) throws Exception {
-        cancellation.checkpoint();
+    /** Uploads this computer's Git copy to the world's remote; a copy already there is left alone. */
+    BackupResult sync(BackupId backupId, ProgressListener listener, CancellableTask<?> task) throws Exception {
+        task.checkpoint();
         BackupRecord record = RecoverySupport.requireRecord(catalog, backupId);
         try (WorldOperationGate.Permit ignored = operationGate.enter(record.manifest().worldId())) {
-            cancellation.checkpoint();
+            task.checkpoint();
             BackupRecord current = RecoverySupport.requireRecord(catalog, backupId);
             RecoverySupport.requireSameManifest(record, current);
-            Optional<DestinationResult> git = current.result().destinations().stream()
-                    .filter(RecoverySupport::isPresent)
-                    .filter(destination -> destination.destination() == DestinationType.GIT)
-                    .findFirst();
-            if (git.isEmpty()) {
+            Optional<DestinationResult> gitCopy = RecoverySupport.copy(current, DestinationType.GIT);
+            if (gitCopy.isEmpty()) {
                 return current.result();
             }
-            DestinationResult local = git.orElseThrow();
+            DestinationResult local = gitCopy.get();
             OperationId operationId = OperationId.create();
-            // The catalog already knows this snapshot is on the remote. Another verify and push
-            // would repeat all the hashing and network work and change nothing.
-            if (local.status() == DestinationStatus.SUCCESS
-                    && local.syncStatus() == SyncStatus.SYNCED) {
-                RecoverySupport.report(progressListener, RecoverySupport.progress(
-                        operationId, current, BackupOperation.SYNC, OperationPhase.COMPLETE,
-                        1, 1, "Backup is already synchronized"));
+            if (local.status() == DestinationStatus.SUCCESS && local.syncStatus() == SyncStatus.SYNCED) {
+                report(listener, operationId, current, BackupOperation.SYNC, OperationPhase.COMPLETE, 1, 1,
+                        "Backup is already synchronized");
                 return current.result();
             }
-            RecoverySupport.report(progressListener, RecoverySupport.progress(
-                    operationId, current, BackupOperation.SYNC, OperationPhase.PREPARING,
-                    0, 1, "Preparing Git synchronization"));
-            DestinationResult synchronizedResult;
-            RecoveryDestination adapter = destinations.get(DestinationType.GIT);
-            if (adapter == null) {
-                synchronizedResult = pendingSync(
-                        local, "Git destination is unavailable", SyncStatus.FAILED);
-            } else {
-                try {
-                    cancellation.checkpoint();
-                    synchronizedResult = mergeSync(local, adapter.sync(current, local));
-                } catch (InterruptedException exception) {
-                    Thread.currentThread().interrupt();
-                    throw exception;
-                } catch (Exception exception) {
-                    synchronizedResult = pendingSync(
-                            local, "Git synchronization failed", SyncStatus.FAILED);
-                }
-            }
-            RecoverySupport.DestinationKey key = RecoverySupport.DestinationKey.from(local);
-            DestinationResult replacement = synchronizedResult;
-            BackupRecord updated = cancellation.mandatoryCommit(() ->
-                    RecoverySupport.updateCatalog(catalog, backupId, existing -> existing.stream()
-                            .map(destination -> RecoverySupport.DestinationKey.from(destination).equals(key)
-                                    ? replacement
-                                    : destination)
-                            .toList()));
-            cancellation.checkpoint();
-            RecoverySupport.report(progressListener, RecoverySupport.progress(
-                    operationId, updated, BackupOperation.SYNC, OperationPhase.COMPLETE,
-                    1, 1, "Git synchronization complete"));
+            report(listener, operationId, current, BackupOperation.SYNC, OperationPhase.PREPARING, 0, 1,
+                    "Preparing Git synchronization");
+            DestinationResult synced = upload(current, local);
+            BackupRecord updated = task.mandatoryCommit(() -> update(backupId, existing ->
+                    existing.destination() == DestinationType.GIT && existing.isDurable() ? synced : existing));
+            task.checkpoint();
+            report(listener, operationId, updated, BackupOperation.SYNC, OperationPhase.COMPLETE, 1, 1,
+                    "Git synchronization complete");
             return updated.result();
         }
     }
 
-    List<DestinationHealth> healthBlocking(Optional<WorldId> worldId) {
-        List<DestinationHealth> health = new ArrayList<>();
-        for (DestinationType type : DestinationType.values()) {
-            RecoveryDestination destination = destinations.get(type);
-            if (destination == null) {
-                health.add(new DestinationHealth(
-                        type,
-                        DestinationHealthStatus.UNCONFIGURED,
-                        type + " destination is not configured",
-                        clock.instant()));
-                continue;
-            }
-            try {
-                DestinationHealth item = destination.health(worldId);
-                if (item.destination() != type) {
-                    throw new BackupRecoveryException("Destination returned mismatched health");
-                }
-                health.add(item);
-            } catch (InterruptedException exception) {
-                Thread.currentThread().interrupt();
-                health.add(new DestinationHealth(
-                        type,
-                        DestinationHealthStatus.UNAVAILABLE,
-                        type + " health check was interrupted",
-                        clock.instant()));
-                break;
-            } catch (Exception exception) {
-                health.add(new DestinationHealth(
-                        type,
-                        DestinationHealthStatus.UNAVAILABLE,
-                        type + " destination could not be checked",
-                        clock.instant()));
-            }
-        }
-        for (DestinationType type : DestinationType.values()) {
-            if (health.stream().noneMatch(item -> item.destination() == type)) {
-                health.add(new DestinationHealth(
-                        type,
-                        DestinationHealthStatus.UNAVAILABLE,
-                        type + " health check was cancelled",
-                        clock.instant()));
+    /** Checks one copy; one that cannot be read is UNAVAILABLE, and the log says why. */
+    private VerificationOutcome check(BackupRecord record, DestinationResult copy) throws InterruptedException {
+        try {
+            VerificationOutcome outcome = destinations.get(copy.destination()).verify(record, copy);
+            if (outcome.status() != VerificationStatus.VERIFIED) {
+                LOGGER.warn("Verify: the {} copy of backup {} is damaged: {}",
+                        copy.destination(), record.manifest().backupId(), outcome.message().orElse(""));
             }
+            return outcome;
+        } catch (InterruptedException interrupted) {
+            throw interrupted;
+        } catch (Exception failure) {
+            LOGGER.warn("Verify: the {} copy of backup {} could not be checked: {}", copy.destination(),
+                    record.manifest().backupId(), SafeText.from(failure, "it cannot be read", 512));
+            return VerificationOutcome.unavailable();
         }
-        health.sort(Comparator.comparing(DestinationHealth::destination));
-        return List.copyOf(health);
     }
 
-    private static DestinationResult mergeSync(
-            DestinationResult local,
-            DestinationResult synchronizedResult) {
-        if (synchronizedResult.destination() != DestinationType.GIT) {
-            throw new BackupRecoveryException("Git returned a result for another destination");
+    /** The copy with the warning its check found as its message, for the player to read; other copies as they are. */
+    private static DestinationResult withWarning(DestinationResult copy, VerificationOutcome outcome) {
+        return outcome != null && outcome.status() == VerificationStatus.VERIFIED && outcome.message().isPresent()
+                ? copy.withState(copy.status(), outcome.message(), copy.syncStatus())
+                : copy;
+    }
+
+    /** The Git copy after an upload attempt; any failure leaves it pending, ready to try again. */
+    private DestinationResult upload(BackupRecord record, DestinationResult local) throws InterruptedException {
+        DestinationResult uploaded;
+        try {
+            uploaded = git.sync(record, local);
+        } catch (InterruptedException interrupted) {
+            throw interrupted;
+        } catch (Exception failure) {
+            return pending(local, "Git synchronization failed: " + SafeText.from(failure, "Git failed", 512),
+                    SyncStatus.FAILED);
         }
-        synchronizedResult.artifactId().ifPresent(artifact -> {
-            if (!local.artifactId().orElseThrow().equals(artifact)) {
-                throw new BackupRecoveryException("Git returned a different snapshot identity");
-            }
-        });
-        return switch (synchronizedResult.syncStatus()) {
-            case SYNCED, NOT_CONFIGURED -> local.withState(
-                    DestinationStatus.SUCCESS,
-                    Optional.empty(),
-                    synchronizedResult.syncStatus());
-            case NOT_SYNCED, PENDING, FAILED -> pendingSync(
-                    local,
-                    synchronizedResult.message().orElse("Git synchronization must be retried"),
-                    synchronizedResult.syncStatus());
+        return switch (uploaded.syncStatus()) {
+            case SYNCED, NOT_CONFIGURED ->
+                    local.withState(DestinationStatus.SUCCESS, Optional.empty(), uploaded.syncStatus());
+            case NOT_SYNCED, PENDING, FAILED -> pending(
+                    local, uploaded.message().orElse("Git synchronization must be retried"), uploaded.syncStatus());
         };
     }
 
-    private static DestinationResult pendingSync(
-            DestinationResult local,
-            String message,
-            SyncStatus status) {
-        return local.withState(
-                DestinationStatus.PENDING_SYNC,
-                Optional.of(message),
-                status);
+    private BackupRecord update(BackupId backupId, UnaryOperator<DestinationResult> change) throws IOException {
+        return catalog.update(backupId, existing -> RecoverySupport.withDestinations(
+                        existing, existing.result().destinations().stream().map(change).toList()))
+                .orElseThrow(() -> new BackupRecoveryException("This backup left the backup list while it was checked"));
+    }
+
+    private static DestinationResult pending(DestinationResult local, String message, SyncStatus status) {
+        return local.withState(DestinationStatus.PENDING_SYNC, Optional.of(message), status);
+    }
+
+    private static void report(
+            ProgressListener listener,
+            OperationId operationId,
+            BackupRecord record,
+            BackupOperation operation,
+            OperationPhase phase,
+            long completed,
+            long total,
+            String message) {
+        RecoverySupport.report(listener, RecoverySupport.progress(
+                operationId, record, operation, phase, completed, total, message));
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryRestoreOperation.java b/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryRestoreOperation.java
index 72bd729..d19cab5 100644
--- a/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryRestoreOperation.java
+++ b/src/main/java/dev/ishaanko/worldarchive/recovery/RecoveryRestoreOperation.java
@@ -2,31 +2,43 @@
 
 import dev.ishaanko.worldarchive.catalog.BackupCatalog;
 import dev.ishaanko.worldarchive.config.WorldIdentityStore;
-import dev.ishaanko.worldarchive.core.BackupOperation;
-import dev.ishaanko.worldarchive.core.OperationId;
-import dev.ishaanko.worldarchive.core.OperationPhase;
-import dev.ishaanko.worldarchive.core.ProgressListener;
 import dev.ishaanko.worldarchive.core.RestoreBackupRequest;
 import dev.ishaanko.worldarchive.core.RestoreBackupResult;
 import dev.ishaanko.worldarchive.core.WorldOperationGate;
+import dev.ishaanko.worldarchive.model.BackupOperation;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.OperationId;
+import dev.ishaanko.worldarchive.model.OperationPhase;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.SafeText;
 import dev.ishaanko.worldarchive.model.WorldIdentity;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
 import java.nio.file.Path;
+import java.time.Clock;
+import java.util.ArrayList;
 import java.util.Comparator;
 import java.util.List;
+import java.util.Map;
 import java.util.Objects;
-import java.util.Optional;
 
-/** Executes the restore-backup operation: private staging through atomic publication. */
+/**
+ * Restores a backup into a new world, from its ZIP copy first and then from its Git copy. A copy
+ * writes the world into a fresh private staging folder and checks every file as it writes; the
+ * world then gets a new identity and its display name, and one rename publishes it. The source
+ * world is never touched, and a restore that fails or is cancelled leaves nothing in the saves
+ * folder. When no copy works, the error names each copy's reason.
+ */
 final class RecoveryRestoreOperation {
+    private static final Comparator<DestinationResult> RESTORE_ORDER =
+            Comparator.comparing(copy -> copy.destination() == DestinationType.ZIP ? 0 : 1);
+
     private final BackupCatalog catalog;
 
-    private final RecoveryDestinations destinations;
+    private final Map<DestinationType, RecoveryDestination> destinations;
 
     private final WorldIdentityStore identityStore;
 
@@ -34,247 +46,130 @@ final class RecoveryRestoreOperation {
 
     private final WorldOperationGate operationGate;
 
-    private final BackupRecoveryService.DirectoryMove directoryMove;
+    private final Clock clock;
 
     RecoveryRestoreOperation(
             BackupCatalog catalog,
-            RecoveryDestinations destinations,
+            Map<DestinationType, RecoveryDestination> destinations,
             WorldIdentityStore identityStore,
             RestoredWorldMetadataFinalizer metadataFinalizer,
             WorldOperationGate operationGate,
-            BackupRecoveryService.DirectoryMove directoryMove) {
+            Clock clock) {
         this.catalog = Objects.requireNonNull(catalog, "catalog");
-        this.destinations = Objects.requireNonNull(destinations, "destinations");
+        this.destinations = Map.copyOf(destinations);
         this.identityStore = Objects.requireNonNull(identityStore, "identityStore");
         this.metadataFinalizer = Objects.requireNonNull(metadataFinalizer, "metadataFinalizer");
         this.operationGate = Objects.requireNonNull(operationGate, "operationGate");
-        this.directoryMove = Objects.requireNonNull(directoryMove, "directoryMove");
+        this.clock = Objects.requireNonNull(clock, "clock");
     }
 
-    RestoreBackupResult restoreBlocking(
+    RestoreBackupResult restore(
             RestoreBackupRequest request,
-            ProgressListener progressListener,
-            OperationCancellation cancellation) throws Exception {
-        cancellation.checkpoint();
+            ProgressListener listener,
+            CancellableTask<?> task) throws Exception {
+        task.checkpoint();
         BackupRecord record = RecoverySupport.requireRecord(catalog, request.sourceBackupId());
         try (WorldOperationGate.Permit ignored = operationGate.enter(record.manifest().worldId())) {
-            cancellation.checkpoint();
+            task.checkpoint();
             BackupRecord current = RecoverySupport.requireRecord(catalog, request.sourceBackupId());
             RecoverySupport.requireSameManifest(record, current);
-            OperationId operationId = OperationId.create();
-            RecoverySupport.report(progressListener, RecoverySupport.progress(
-                    operationId, current, BackupOperation.RESTORE, OperationPhase.PREPARING,
-                    0, 0, "Preparing restored world copy"));
-            RestoreWorkspace workspace = openRestoreWorkspace(
-                    request, progressListener, operationId, current);
-            List<DestinationCandidate> candidates = restorableCandidates(current);
-            for (int index = 0; index < candidates.size(); index++) {
-                DestinationCandidate candidate = candidates.get(index);
-                if (!verifyRestoreSource(
-                        current,
-                        candidate,
-                        progressListener,
-                        operationId,
-                        cancellation,
-                        index,
-                        candidates.size())) {
+            Progress progress = new Progress(listener, current);
+            progress.report(OperationPhase.PREPARING, "Preparing restored world copy");
+            RestoreWorkspace workspace = openWorkspace(request);
+            List<String> failures = new ArrayList<>();
+            for (DestinationResult copy : RecoverySupport.copies(current).stream().sorted(RESTORE_ORDER).toList()) {
+                progress.report(OperationPhase.WRITING, "Restoring from the " + label(copy) + " copy");
+                Path staging = workspace.createStaging();
+                try {
+                    destinations.get(copy.destination()).restore(current, copy, staging);
+                    requireNoIdentityFolder(staging);
+                } catch (InterruptedException interrupted) {
+                    discard(workspace, staging, interrupted);
+                    throw interrupted;
+                } catch (Exception failure) {
+                    discard(workspace, staging, failure);
+                    task.checkpoint();
+                    failures.add(label(copy) + ": " + SafeText.from(failure, "the copy could not be restored", 300));
                     continue;
                 }
-                Optional<RestoreBackupResult> restored = restoreFromCandidate(
-                        request,
-                        current,
-                        candidate,
-                        workspace,
-                        progressListener,
-                        operationId,
-                        cancellation);
-                if (restored.isPresent()) {
-                    return restored.orElseThrow();
-                }
+                return finish(request, current, workspace, staging, progress, task);
             }
-            RecoverySupport.reportFailure(progressListener, operationId, current, BackupOperation.RESTORE,
-                    "No valid restore source is available");
-            throw new BackupRecoveryException("No valid destination can restore this backup");
+            progress.report(OperationPhase.FAILED, "No copy of this backup could be restored");
+            throw new BackupRecoveryException(failures.isEmpty()
+                    ? "This backup has no copy left to restore from."
+                    : "This backup could not be restored from any of its copies. " + String.join(" ", failures));
         }
     }
 
-    private RestoreWorkspace openRestoreWorkspace(
-            RestoreBackupRequest request,
-            ProgressListener progressListener,
-            OperationId operationId,
-            BackupRecord record) {
+    private RestoreWorkspace openWorkspace(RestoreBackupRequest request) {
         try {
-            return RestoreWorkspace.open(request.worldsDirectory(), directoryMove);
+            return RestoreWorkspace.open(request.worldsDirectory(), clock);
         } catch (IOException exception) {
-            RecoverySupport.reportFailure(progressListener, operationId, record, BackupOperation.RESTORE,
-                    "Worlds directory is unavailable or unsafe");
-            throw new BackupRecoveryException(
-                    "Worlds directory is unavailable or unsafe", exception);
-        }
-    }
-
-    private boolean verifyRestoreSource(
-            BackupRecord record,
-            DestinationCandidate candidate,
-            ProgressListener progressListener,
-            OperationId operationId,
-            OperationCancellation cancellation,
-            int completed,
-            int total) throws InterruptedException {
-        cancellation.checkpoint();
-        RecoverySupport.report(progressListener, RecoverySupport.progress(
-                operationId, record, BackupOperation.RESTORE, OperationPhase.VERIFYING,
-                completed, total, "Verifying restore source"));
-        try {
-            VerificationOutcome outcome = candidate.adapter().verifyForRestore(
-                    record, candidate.result());
-            cancellation.checkpoint();
-            return outcome.valid();
-        } catch (InterruptedException exception) {
-            Thread.currentThread().interrupt();
-            throw exception;
-        } catch (Exception exception) {
-            // Another independently stored destination may still be valid.
-            return false;
+            throw new BackupRecoveryException("The worlds folder " + request.worldsDirectory() + " cannot be used: "
+                    + SafeText.from(exception, "it cannot be opened", 300), exception);
         }
     }
 
-    private Optional<RestoreBackupResult> restoreFromCandidate(
+    /** Names the restored world, gives it a new identity, and publishes it. */
+    private RestoreBackupResult finish(
             RestoreBackupRequest request,
             BackupRecord record,
-            DestinationCandidate candidate,
             RestoreWorkspace workspace,
-            ProgressListener progressListener,
-            OperationId operationId,
-            OperationCancellation cancellation) throws Exception {
-        RecoverySupport.report(progressListener, RecoverySupport.progress(
-                operationId, record, BackupOperation.RESTORE, OperationPhase.WRITING,
-                0, 0, "Materializing a private restored copy"));
-        RestoreWorkspace.Staging staging = workspace.createStaging();
-        Optional<RestoreWorkspace.Staging> materialized = materializeCandidate(
-                record, candidate, workspace, staging, cancellation);
-        if (materialized.isEmpty()) {
-            return Optional.empty();
-        }
-        staging = materialized.orElseThrow();
-        WorldIdentity identity = finalizeRestoredIdentity(
-                request, record, workspace, staging, cancellation);
-        RecoverySupport.report(progressListener, RecoverySupport.progress(
-                operationId, record, BackupOperation.RESTORE, OperationPhase.PUBLISHING,
-                0, 0, "Publishing restored world copy"));
-        Path published = publishRestoredWorld(
-                request, workspace, staging, cancellation);
-        RestoreBackupResult result = new RestoreBackupResult(
-                record.manifest().backupId(), identity.worldId(), published);
-        RecoverySupport.report(progressListener, RecoverySupport.progress(
-                operationId, record, BackupOperation.RESTORE, OperationPhase.COMPLETE,
-                1, 1, "Restored world copy is ready"));
-        return Optional.of(result);
-    }
-
-    private static Optional<RestoreWorkspace.Staging> materializeCandidate(
-            BackupRecord record,
-            DestinationCandidate candidate,
-            RestoreWorkspace workspace,
-            RestoreWorkspace.Staging initialStaging,
-            OperationCancellation cancellation) throws InterruptedException {
-        RestoreWorkspace.Staging staging = initialStaging;
+            Path staging,
+            Progress progress,
+            CancellableTask<?> task) throws Exception {
         try {
-            RecoveryDestination.Materialization materialization = candidate.adapter().materialize(
-                    record, candidate.result(), staging.path());
-            boolean interruptedAfterMaterialization = Thread.interrupted();
-            try {
-                staging = staging.afterMaterialization(materialization);
-            } finally {
-                if (interruptedAfterMaterialization) {
-                    Thread.currentThread().interrupt();
-                }
-            }
-            if (materialization.postMaterializationProblem().isPresent()) {
-                throw new BackupRecoveryException(
-                        materialization.postMaterializationProblem().orElseThrow());
-            }
-            cancellation.checkpoint();
-            staging.requireUnchanged();
-            if (Files.exists(
-                    staging.path().resolve(".worldarchive"), LinkOption.NOFOLLOW_LINKS)) {
-                throw new IOException("Restore source contains internal metadata");
-            }
-            return Optional.of(staging);
-        } catch (InterruptedException exception) {
-            Thread.currentThread().interrupt();
-            workspace.cleanup(staging, exception);
-            throw exception;
-        } catch (Exception exception) {
-            if (!workspace.cleanup(staging, exception)) {
-                throw new BackupRecoveryException(
-                        "Private restore staging could not be cleaned safely", exception);
-            }
-            return Optional.empty();
+            task.checkpoint();
+            metadataFinalizer.finalizeDisplayName(staging, request.restoredWorldName());
+            WorldIdentity identity = identityStore.createFreshRestoredCopyIdentity(staging, record.manifest().backupId());
+            task.checkpoint();
+            progress.report(OperationPhase.PUBLISHING, "Publishing restored world copy");
+            Path published = workspace.publish(staging, request.restoredWorldName(), task);
+            progress.report(OperationPhase.COMPLETE, "Restored world copy is ready");
+            return new RestoreBackupResult(identity.worldId(), published);
+        } catch (InterruptedException interrupted) {
+            discard(workspace, staging, interrupted);
+            throw interrupted;
+        } catch (Exception failure) {
+            discard(workspace, staging, failure);
+            throw new BackupRecoveryException("The restored world could not be finished: "
+                    + SafeText.from(failure, "it could not be written", 300), failure);
         }
     }
 
-    private WorldIdentity finalizeRestoredIdentity(
-            RestoreBackupRequest request,
-            BackupRecord record,
-            RestoreWorkspace workspace,
-            RestoreWorkspace.Staging staging,
-            OperationCancellation cancellation) throws InterruptedException {
-        try {
-            cancellation.checkpoint();
-            staging.requireUnchanged();
-            metadataFinalizer.finalizeDisplayName(staging.path(), request.restoredWorldName());
-            cancellation.checkpoint();
-            staging.requireUnchanged();
-            WorldIdentity identity = identityStore.createFreshRestoredCopyIdentity(
-                    staging.path(), record.manifest().backupId());
-            cancellation.checkpoint();
-            staging.requireUnchanged();
-            return identity;
-        } catch (InterruptedException exception) {
-            Thread.currentThread().interrupt();
-            workspace.cleanup(staging, exception);
-            throw exception;
-        } catch (IOException | RuntimeException exception) {
-            workspace.cleanup(staging, exception);
-            throw new BackupRecoveryException(
-                    "Restored world metadata could not be finalized", exception);
+    /** A backup never holds WorldArchive's identity folder; a copy that does is not restored. */
+    private static void requireNoIdentityFolder(Path staging) throws IOException {
+        if (Files.exists(staging.resolve(".worldarchive"), LinkOption.NOFOLLOW_LINKS)) {
+            throw new IOException("The copy holds WorldArchive's own identity folder (.worldarchive)");
         }
     }
 
-    private static Path publishRestoredWorld(
-            RestoreBackupRequest request,
-            RestoreWorkspace workspace,
-            RestoreWorkspace.Staging staging,
-            OperationCancellation cancellation) throws InterruptedException {
+    /** Removes a staging folder after a failure; one that cannot be removed is reported. */
+    private static void discard(RestoreWorkspace workspace, Path staging, Exception failure) {
         try {
-            return workspace.publish(staging, request.restoredWorldName(), cancellation);
-        } catch (InterruptedException exception) {
-            Thread.currentThread().interrupt();
-            workspace.cleanup(staging, exception);
-            throw exception;
-        } catch (Exception exception) {
-            workspace.cleanup(staging, exception);
-            throw new BackupRecoveryException(
-                    "Restored world copy could not be published", exception);
+            workspace.delete(staging);
+        } catch (IOException | RuntimeException cleanup) {
+            failure.addSuppressed(cleanup);
+            throw new BackupRecoveryException("Part of the restored world could not be removed from " + staging
+                    + ". Delete that folder, then try again.", failure);
         }
     }
 
-    private List<DestinationCandidate> restorableCandidates(BackupRecord record) {
-        return RecoverySupport.presentDestinations(record).stream()
-                .map(result -> new DestinationCandidate(result, destinations.get(result.destination())))
-                .filter(candidate -> candidate.adapter() != null)
-                .sorted(Comparator.comparingInt(candidate -> restorePriority(
-                        candidate.result().destination())))
-                .toList();
+    private static String label(DestinationResult copy) {
+        return copy.destination() == DestinationType.ZIP ? "ZIP" : "Git";
     }
 
-    private static int restorePriority(DestinationType type) {
-        return type == DestinationType.ZIP ? 0 : 1;
-    }
+    /** Progress of one restore. */
+    private record Progress(ProgressListener listener, BackupRecord record, OperationId operationId) {
+        private Progress(ProgressListener listener, BackupRecord record) {
+            this(listener, record, OperationId.create());
+        }
 
-    private record DestinationCandidate(
-            DestinationResult result,
-            RecoveryDestination adapter) {
+        /** A restore has no countable steps; it reports one unit, done when complete. */
+        private void report(OperationPhase phase, String message) {
+            long units = phase == OperationPhase.COMPLETE ? 1 : 0;
+            RecoverySupport.report(listener, RecoverySupport.progress(
+                    operationId, record, BackupOperation.RESTORE, phase, units, units, message));
+        }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/recovery/RecoverySupport.java b/src/main/java/dev/ishaanko/worldarchive/recovery/RecoverySupport.java
index 91059a4..1fa12ae 100644
--- a/src/main/java/dev/ishaanko/worldarchive/recovery/RecoverySupport.java
+++ b/src/main/java/dev/ishaanko/worldarchive/recovery/RecoverySupport.java
@@ -1,67 +1,88 @@
 package dev.ishaanko.worldarchive.recovery;
 
 import dev.ishaanko.worldarchive.catalog.BackupCatalog;
-import dev.ishaanko.worldarchive.core.BackupOperation;
-import dev.ishaanko.worldarchive.core.OperationId;
-import dev.ishaanko.worldarchive.core.OperationPhase;
-import dev.ishaanko.worldarchive.core.OperationProgress;
-import dev.ishaanko.worldarchive.core.ProgressListener;
 import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupOperation;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.BackupResult;
 import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationStatus;
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.OperationId;
+import dev.ishaanko.worldarchive.model.OperationPhase;
+import dev.ishaanko.worldarchive.model.OperationProgress;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.support.AsyncTasks;
+import dev.ishaanko.worldarchive.support.Observers;
 import java.io.IOException;
 import java.util.Comparator;
 import java.util.List;
 import java.util.Optional;
-import java.util.function.UnaryOperator;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CompletionException;
+import java.util.concurrent.CompletionStage;
 
-/** Small helpers shared across the recovery operation classes. */
+/** Small helpers shared by the recovery operations. */
 final class RecoverySupport {
     private RecoverySupport() {
     }
 
     static BackupRecord requireRecord(BackupCatalog catalog, BackupId backupId) throws IOException {
-        return catalog.find(backupId).orElseThrow(
-                () -> new BackupRecoveryException("Backup was not found in the catalog"));
+        return catalog.find(backupId).orElseThrow(() -> new BackupRecoveryException(
+                "This backup is no longer in the backup list. Open the list again."));
     }
 
     static void requireSameManifest(BackupRecord expected, BackupRecord current) {
         if (!expected.manifest().equals(current.manifest())) {
-            throw new BackupRecoveryException("Backup catalog identity changed during the operation");
+            throw new BackupRecoveryException("The backup changed while the operation waited. Try again.");
         }
     }
 
-    static List<DestinationResult> presentDestinations(BackupRecord record) {
+    /** The destinations that hold a copy, Git before ZIP. */
+    static List<DestinationResult> copies(BackupRecord record) {
         return record.result().destinations().stream()
-                .filter(RecoverySupport::isPresent)
+                .filter(DestinationResult::isDurable)
                 .sorted(Comparator.comparing(DestinationResult::destination))
                 .toList();
     }
 
-    static boolean isPresent(DestinationResult destination) {
-        return destination.artifactId().isPresent()
-                && (destination.status() == DestinationStatus.SUCCESS
-                        || destination.status() == DestinationStatus.PENDING_SYNC);
+    static Optional<DestinationResult> copy(BackupRecord record, DestinationType type) {
+        return copies(record).stream().filter(copy -> copy.destination() == type).findFirst();
     }
 
-    static BackupRecord updateCatalog(
-            BackupCatalog catalog,
-            BackupId backupId,
-            UnaryOperator<List<DestinationResult>> destinationUpdate) throws IOException {
-        return catalog.update(backupId, existing -> {
-            List<DestinationResult> replacements = List.copyOf(
-                    destinationUpdate.apply(existing.result().destinations()));
-            BackupResult result = BackupResult.aggregate(
-                    existing.manifest().backupId(),
-                    existing.manifest().worldId(),
-                    replacements,
-                    existing.result().completedAt());
-            return new BackupRecord(existing.manifest(), result);
-        }).orElseThrow(() -> new BackupRecoveryException(
-                "Backup disappeared while updating the catalog"));
+    /** The record with its destinations replaced, keeping its completion time. */
+    static BackupRecord withDestinations(BackupRecord record, List<DestinationResult> destinations) {
+        return new BackupRecord(record.manifest(), new BackupResult(
+                record.manifest().backupId(),
+                record.manifest().worldId(),
+                destinations,
+                record.result().completedAt()));
+    }
+
+    /**
+     * Waits for a storage operation even when this thread is interrupted: the operation is then
+     * asked to stop, and its outcome is still awaited, so nothing it writes outlives the wait. The
+     * interrupt is restored afterwards.
+     */
+    static <T> T awaitStopped(CompletionStage<T> stage) throws Exception {
+        CompletableFuture<T> future = stage.toCompletableFuture();
+        try {
+            return AsyncTasks.await(future);
+        } catch (InterruptedException interrupted) {
+            if (future instanceof AsyncTasks.InterruptibleFuture<T> running) {
+                running.stop(true);
+            }
+            try {
+                return future.join();
+            } catch (CompletionException failure) {
+                if (failure.getCause() instanceof Exception cause) {
+                    throw cause;
+                }
+                throw failure;
+            } finally {
+                Thread.currentThread().interrupt();
+            }
+        }
     }
 
     static OperationProgress progress(
@@ -72,39 +93,23 @@ static OperationProgress progress(
             long completed,
             long total,
             String message) {
-        return new OperationProgress(
-                operationId,
-                record.manifest().worldId(),
-                Optional.of(record.manifest().backupId()),
-                operation,
-                phase,
-                completed,
-                total,
-                message);
+        return new OperationProgress(operationId, record.manifest().worldId(), Optional.of(record.manifest().backupId()),
+                operation, phase, completed, total, message);
     }
 
-    static void reportFailure(
-            ProgressListener listener,
+    static OperationProgress worldProgress(
             OperationId operationId,
-            BackupRecord record,
+            WorldId worldId,
             BackupOperation operation,
+            OperationPhase phase,
+            long completed,
+            long total,
             String message) {
-        report(listener, progress(
-                operationId, record, operation, OperationPhase.FAILED, 0, 0, message));
+        return new OperationProgress(operationId, worldId, Optional.empty(), operation, phase, completed, total, message);
     }
 
+    /** Tells the listener; a listener that throws never changes the outcome. */
     static void report(ProgressListener listener, OperationProgress progress) {
-        try {
-            listener.onProgress(progress);
-        } catch (RuntimeException exception) {
-            // Storage outcomes cannot depend on observers.
-        }
-    }
-
-    record DestinationKey(DestinationType type, String artifactId) {
-        static DestinationKey from(DestinationResult result) {
-            return new DestinationKey(
-                    result.destination(), result.artifactId().orElse("<none>"));
-        }
+        Observers.safely(() -> listener.onProgress(progress));
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/recovery/RestoreWorkspace.java b/src/main/java/dev/ishaanko/worldarchive/recovery/RestoreWorkspace.java
index 4dd5693..c89055f 100644
--- a/src/main/java/dev/ishaanko/worldarchive/recovery/RestoreWorkspace.java
+++ b/src/main/java/dev/ishaanko/worldarchive/recovery/RestoreWorkspace.java
@@ -1,9 +1,8 @@
 package dev.ishaanko.worldarchive.recovery;
 
-import dev.ishaanko.worldarchive.core.DirectoryIdentityMarker;
-import dev.ishaanko.worldarchive.core.FileSystemSafety;
+import dev.ishaanko.worldarchive.support.FileSystemSafety;
 import java.io.IOException;
-import java.nio.file.CopyOption;
+import java.nio.file.DirectoryStream;
 import java.nio.file.FileAlreadyExistsException;
 import java.nio.file.FileVisitResult;
 import java.nio.file.Files;
@@ -14,257 +13,107 @@
 import java.nio.file.attribute.BasicFileAttributes;
 import java.nio.file.attribute.FileTime;
 import java.text.Normalizer;
+import java.time.Clock;
+import java.time.Duration;
 import java.util.HashSet;
 import java.util.Locale;
 import java.util.Objects;
-import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 import java.util.concurrent.locks.ReentrantLock;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * The saves folder as a restore uses it. A restore writes into a private staging folder there,
+ * {@code .worldarchive-restore-*}, and publishes it with one atomic rename to a free name, so a
+ * half-restored world never appears under a world name and no existing folder is overwritten. A
+ * saves folder that the game reaches through a link or junction is used where it really is.
+ */
+public final class RestoreWorkspace {
+    /** The start of the name of every staging folder, which the settings' world scan skips. */
+    public static final String STAGING_PREFIX = ".worldarchive-restore-";
+
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
+    private static final Duration STALE_STAGING_AGE = Duration.ofDays(1);
 
-/** Owns the private staging and atomic publication boundary for restored worlds. */
-final class RestoreWorkspace {
     private static final int MAXIMUM_DIRECTORY_NAME_CODE_POINTS = 96;
 
-    private static final Set<String> WINDOWS_DEVICE_NAMES = windowsDeviceNames();
+    private static final int MAXIMUM_NAME_ATTEMPTS = 10_000;
 
-    private static final ConcurrentMap<Path, ReentrantLock> PUBLICATION_LOCKS =
-            new ConcurrentHashMap<>();
+    private static final String DEFAULT_NAME = "Restored World";
 
-    private final Root root;
+    private static final Set<String> WINDOWS_DEVICE_NAMES = windowsDeviceNames();
+
+    /** One restore at a time picks a name in a saves folder, so two never take the same one. */
+    private static final ConcurrentMap<Path, ReentrantLock> PUBLICATION_LOCKS = new ConcurrentHashMap<>();
 
-    private final DirectoryMove directoryMove;
+    private final Path root;
 
-    private RestoreWorkspace(Root root, DirectoryMove directoryMove) {
+    private RestoreWorkspace(Path root) {
         this.root = root;
-        this.directoryMove = directoryMove;
     }
 
-    static RestoreWorkspace open(Path worldsDirectory, DirectoryMove directoryMove)
-            throws IOException {
-        return new RestoreWorkspace(
-                Root.open(worldsDirectory),
-                Objects.requireNonNull(directoryMove, "directoryMove"));
+    /** Opens the saves folder, creating it when missing, and logs staging folders a crash left there. */
+    static RestoreWorkspace open(Path worldsDirectory, Clock clock) throws IOException {
+        Files.createDirectories(worldsDirectory);
+        Path root = worldsDirectory.toRealPath();
+        if (root.getParent() == null) {
+            throw new IOException("The worlds folder " + root + " is the root of a drive; choose a folder in it.");
+        }
+        logStaleStaging(root, clock);
+        return new RestoreWorkspace(root);
     }
 
-    Staging createStaging() throws IOException {
-        return createStaging(ignored -> {
-        });
+    Path createStaging() throws IOException {
+        return Files.createTempDirectory(root, STAGING_PREFIX);
     }
 
-    Staging createStaging(StagingCreationHook stagingCreationHook) throws IOException {
-        Objects.requireNonNull(stagingCreationHook, "stagingCreationHook");
-        root.requireUnchanged();
-        Path path = Files.createTempDirectory(root.path(), ".worldarchive-restore-");
-        try {
-            stagingCreationHook.afterCreate(path);
-            BasicFileAttributes attributes = Files.readAttributes(
-                    path, BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
-            if (!FileSystemSafety.isOrdinaryDirectory(path, attributes)) {
-                throw new IOException("Private restore staging is unsafe");
-            }
-            Optional<String> identityMarker = DirectoryIdentityMarker.create(path);
-            if (attributes.fileKey() == null && identityMarker.isEmpty()) {
-                throw new IOException("Private restore staging has no stable identity");
-            }
-            root.requireUnchanged();
-            return new Staging(
-                    path,
-                    attributes.fileKey(),
-                    attributes.creationTime(),
-                    identityMarker);
-        } catch (IOException | RuntimeException exception) {
-            try {
-                deleteTree(root.path(), path);
-            } catch (IOException | RuntimeException cleanupFailure) {
-                exception.addSuppressed(cleanupFailure);
-            }
-            throw exception;
-        }
-    }
-
-    Path publish(
-            Staging staging,
-            String requestedName,
-            OperationCancellation cancellation) throws Exception {
+    /**
+     * Moves the staging folder to the first free name based on the requested one. The rename is
+     * the point of no return: once it starts, the restore can no longer be cancelled.
+     */
+    Path publish(Path staging, String requestedName, CancellableTask<?> task) throws Exception {
         String base = safeDirectoryName(requestedName);
-        ReentrantLock lock = PUBLICATION_LOCKS.computeIfAbsent(
-                root.path(), ignored -> new ReentrantLock(true));
-        try {
-            lock.lockInterruptibly();
-        } catch (InterruptedException exception) {
-            Thread.currentThread().interrupt();
-            throw new IOException("Restore publication was interrupted", exception);
-        }
+        ReentrantLock lock = PUBLICATION_LOCKS.computeIfAbsent(root, ignored -> new ReentrantLock());
+        lock.lockInterruptibly();
         try {
-            root.requireUnchanged();
-            staging.requireUnchanged();
-            for (int index = 1; index <= 10_000; index++) {
-                String filename = index == 1 ? base : appendSuffix(base, index);
-                Path target = root.path().resolve(filename).normalize();
-                if (!Objects.equals(target.getParent(), root.path())) {
-                    throw new IOException("Restore target escaped the worlds directory");
+            for (int index = 1; index <= MAXIMUM_NAME_ATTEMPTS; index++) {
+                Path target = root.resolve(index == 1 ? base : appendSuffix(base, index));
+                if (!root.equals(target.getParent())) {
+                    throw new IOException("The restored world's name leads outside the worlds folder");
                 }
                 if (Files.exists(target, LinkOption.NOFOLLOW_LINKS)) {
                     continue;
                 }
                 try {
-                    return cancellation.pointOfNoReturn(
-                            () -> publishAt(staging, target));
-                } catch (FileAlreadyExistsException exception) {
-                    continue;
+                    return task.pointOfNoReturn(() -> move(staging, target));
+                } catch (FileAlreadyExistsException taken) {
+                    // Another program took the name after the check; try the next one.
                 }
             }
-            throw new IOException("No unique restore target name is available");
+            throw new IOException("No free folder name is left for the restored world in " + root);
         } finally {
             lock.unlock();
         }
     }
 
-    boolean cleanup(Staging staging, Throwable failure) {
-        boolean interrupted = Thread.interrupted();
-        try {
-            root.requireUnchanged();
-            staging.requireUnchanged();
-            deleteTree(root.path(), staging.path());
-            return true;
-        } catch (IOException | RuntimeException cleanupFailure) {
-            failure.addSuppressed(cleanupFailure);
-            return false;
-        } finally {
-            if (interrupted) {
-                Thread.currentThread().interrupt();
-            }
-        }
-    }
-
-    void deletePublished(Path published) throws IOException {
-        deleteTree(root.path(), published);
-    }
-
-    private Path publishAt(Staging staging, Path target) throws IOException {
-        try {
-            directoryMove.move(staging.path(), target, StandardCopyOption.ATOMIC_MOVE);
-        } catch (IOException moveFailure) {
-            return reconcileAmbiguousPublication(staging, target, moveFailure);
+    /** Removes a staging folder of this workspace; links inside it are removed, never followed. */
+    void delete(Path staging) throws IOException {
+        Path target = staging.toAbsolutePath().normalize();
+        if (!root.equals(target.getParent()) || !target.getFileName().toString().startsWith(STAGING_PREFIX)) {
+            throw new IOException("Refusing to remove " + target + ", which is not a restore staging folder");
         }
-        try {
-            return requirePublishedRestore(staging, target);
-        } catch (IOException | RuntimeException validationFailure) {
-            cleanupPublishedStaging(staging, target, validationFailure);
-            throw validationFailure;
-        }
-    }
-
-    private Path reconcileAmbiguousPublication(
-            Staging staging,
-            Path target,
-            IOException moveFailure) throws IOException {
-        try {
-            return requirePublishedRestore(staging, target);
-        } catch (IOException | RuntimeException validationFailure) {
-            moveFailure.addSuppressed(validationFailure);
-            cleanupPublishedStaging(staging, target, moveFailure);
-            throw moveFailure;
-        }
-    }
-
-    private void cleanupPublishedStaging(
-            Staging staging,
-            Path target,
-            Throwable failure) {
-        try {
-            staging.requireIdentityAt(target);
-            deleteTree(root.path(), target);
-        } catch (IOException | RuntimeException cleanupFailure) {
-            failure.addSuppressed(cleanupFailure);
-        }
-    }
-
-    private Path requirePublishedRestore(Staging staging, Path target) throws IOException {
-        root.requireUnchanged();
-        BasicFileAttributes attributes = Files.readAttributes(
-                target,
-                BasicFileAttributes.class,
-                LinkOption.NOFOLLOW_LINKS);
-        if (!FileSystemSafety.isOrdinaryDirectory(target, attributes)
-                || !Objects.equals(target.toRealPath().getParent(), root.path())) {
-            throw new IOException("Published restore target is unsafe");
-        }
-        staging.requireIdentityAt(target);
-        return target;
-    }
-
-    private static String safeDirectoryName(String requestedName) {
-        String normalized = Normalizer.normalize(
-                Objects.requireNonNull(requestedName, "requestedName"), Normalizer.Form.NFKC);
-        StringBuilder safe = new StringBuilder();
-        normalized.codePoints().forEach(codePoint -> {
-            if (codePoint < 32
-                    || codePoint == 127
-                    || "<>:\"/\\|?*".indexOf(codePoint) >= 0) {
-                safe.append('_');
-            } else {
-                safe.appendCodePoint(codePoint);
-            }
-        });
-        String result = safe.toString().strip();
-        while (!result.isEmpty() && (result.endsWith(".") || result.endsWith(" "))) {
-            result = result.substring(0, result.length() - 1);
-        }
-        if (result.isBlank() || result.equals(".") || result.equals("..")) {
-            result = "Restored World";
-        }
-        result = truncateCodePoints(result, MAXIMUM_DIRECTORY_NAME_CODE_POINTS);
-        while (!result.isEmpty() && (result.endsWith(".") || result.endsWith(" "))) {
-            result = result.substring(0, result.length() - 1);
-        }
-        if (result.isBlank()) {
-            result = "Restored World";
-        }
-        String stem = result.split("\\.", 2)[0].toUpperCase(Locale.ROOT);
-        return WINDOWS_DEVICE_NAMES.contains(stem) ? "_" + result : result;
-    }
-
-    private static String appendSuffix(String base, int index) {
-        String suffix = " (" + index + ")";
-        int maximumBase = MAXIMUM_DIRECTORY_NAME_CODE_POINTS
-                - suffix.codePointCount(0, suffix.length());
-        return truncateCodePoints(base, maximumBase) + suffix;
-    }
-
-    private static String truncateCodePoints(String value, int maximum) {
-        int count = value.codePointCount(0, value.length());
-        return count <= maximum
-                ? value
-                : value.substring(0, value.offsetByCodePoints(0, maximum));
-    }
-
-    private static Set<String> windowsDeviceNames() {
-        Set<String> names = new HashSet<>(Set.of("CON", "PRN", "AUX", "NUL", "CLOCK$"));
-        for (int index = 1; index <= 9; index++) {
-            names.add("COM" + index);
-            names.add("LPT" + index);
-        }
-        return Set.copyOf(names);
-    }
-
-    private static void deleteTree(Path root, Path target) throws IOException {
-        Path safeRoot = root.toAbsolutePath().normalize();
-        Path safeTarget = target.toAbsolutePath().normalize();
-        if (safeTarget.equals(safeRoot) || !Objects.equals(safeTarget.getParent(), safeRoot)) {
-            throw new IOException("Refusing to remove a path outside the worlds directory");
-        }
-        if (!Files.exists(safeTarget, LinkOption.NOFOLLOW_LINKS)) {
+        if (!Files.exists(target, LinkOption.NOFOLLOW_LINKS)) {
             return;
         }
-        Files.walkFileTree(safeTarget, new SimpleFileVisitor<>() {
+        Files.walkFileTree(target, new SimpleFileVisitor<>() {
             @Override
-            public FileVisitResult preVisitDirectory(
-                    Path directory,
-                    BasicFileAttributes attributes) throws IOException {
-                if (!FileSystemSafety.isOrdinaryDirectory(directory, attributes)) {
+            public FileVisitResult preVisitDirectory(Path directory, BasicFileAttributes attributes)
+                    throws IOException {
+                if (!FileSystemSafety.isOrdinaryDirectory(attributes)) {
                     Files.delete(directory);
                     return FileVisitResult.SKIP_SUBTREE;
                 }
@@ -272,15 +121,13 @@ public FileVisitResult preVisitDirectory(
             }
 
             @Override
-            public FileVisitResult visitFile(Path file, BasicFileAttributes attributes)
-                    throws IOException {
+            public FileVisitResult visitFile(Path file, BasicFileAttributes attributes) throws IOException {
                 Files.delete(file);
                 return FileVisitResult.CONTINUE;
             }
 
             @Override
-            public FileVisitResult postVisitDirectory(Path directory, IOException exception)
-                    throws IOException {
+            public FileVisitResult postVisitDirectory(Path directory, IOException exception) throws IOException {
                 if (exception != null) {
                     throw exception;
                 }
@@ -290,99 +137,98 @@ public FileVisitResult postVisitDirectory(Path directory, IOException exception)
         });
     }
 
-    record Staging(
-            Path path,
-            Object fileKey,
-            FileTime creationTime,
-            Optional<String> identityMarker) {
-        Staging afterMaterialization(
-                RecoveryDestination.Materialization materialization) throws IOException {
-            if (!path.equals(materialization.path())) {
-                throw new IOException("Restore destination changed its staging path");
-            }
-            if (materialization.preservesDirectoryIdentity()) {
-                requireUnchanged();
-                return this;
-            }
-            if (materialization.fileKey() == null
-                    && materialization.directoryIdentityMarker().isEmpty()) {
-                throw new IOException("Restored directory has no stable identity");
+    /**
+     * A rename can report a failure after it happened, for example on a network share. The name
+     * was free a moment ago under the publication lock, so a target that exists while the staging
+     * folder is gone is this restore.
+     */
+    private static Path move(Path staging, Path target) throws IOException {
+        try {
+            return Files.move(staging, target, StandardCopyOption.ATOMIC_MOVE);
+        } catch (FileAlreadyExistsException taken) {
+            throw taken;
+        } catch (IOException failure) {
+            if (Files.notExists(staging, LinkOption.NOFOLLOW_LINKS)
+                    && Files.isDirectory(target, LinkOption.NOFOLLOW_LINKS)) {
+                return target;
+            }
+            throw failure;
+        }
+    }
+
+    /**
+     * Staging folders older than a day were left by a restore that stopped, for example when the
+     * game crashed. They are only named in the log: a folder is never deleted by its name alone.
+     */
+    private static void logStaleStaging(Path root, Clock clock) {
+        FileTime staleBefore = FileTime.from(clock.instant().minus(STALE_STAGING_AGE));
+        try (DirectoryStream<Path> leftovers = Files.newDirectoryStream(root, STAGING_PREFIX + "*")) {
+            for (Path leftover : leftovers) {
+                if (Files.getLastModifiedTime(leftover, LinkOption.NOFOLLOW_LINKS).compareTo(staleBefore) < 0) {
+                    LOGGER.warn("An unfinished restore left the folder {}. It may hold part of a world;"
+                            + " delete it when no restore is running.", leftover);
+                }
             }
-            Staging replacement = new Staging(
-                    path,
-                    materialization.fileKey(),
-                    materialization.creationTime(),
-                    materialization.directoryIdentityMarker());
-            replacement.requireUnchanged();
-            return replacement;
+        } catch (IOException exception) {
+            LOGGER.warn("The worlds folder {} could not be checked for unfinished restores: {}",
+                    root, exception.toString());
         }
+    }
 
-        void requireUnchanged() throws IOException {
-            requireIdentityAt(path);
+    /**
+     * A folder name that works on every system: unsafe characters become underscores, trailing
+     * dots and spaces go, the length is limited, and a Windows device name gets a leading
+     * underscore. The world keeps the exact requested name as its display name.
+     */
+    static String safeDirectoryName(String requestedName) {
+        String normalized = Normalizer.normalize(
+                Objects.requireNonNull(requestedName, "requestedName"), Normalizer.Form.NFKC);
+        String name = withoutTrailingDotsAndSpaces(replaceUnsafeCharacters(normalized).strip());
+        if (name.isEmpty()) {
+            name = DEFAULT_NAME;
         }
-
-        void requireIdentityAt(Path candidate) throws IOException {
-            BasicFileAttributes attributes = Files.readAttributes(
-                    candidate, BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
-            Optional<String> currentMarker = identityMarker.isPresent()
-                    ? DirectoryIdentityMarker.read(candidate)
-                    : Optional.empty();
-            boolean sameIdentity = fileKey != null
-                    ? Objects.equals(fileKey, attributes.fileKey())
-                    : identityMarker.isPresent() && identityMarker.equals(currentMarker);
-            boolean sameMarker = identityMarker.isEmpty() || identityMarker.equals(currentMarker);
-            if (!sameIdentity
-                    || !sameMarker
-                    || !FileSystemSafety.isOrdinaryDirectory(candidate, attributes)) {
-                throw new IOException("Private restore staging changed during restoration");
-            }
+        name = withoutTrailingDotsAndSpaces(truncateCodePoints(name, MAXIMUM_DIRECTORY_NAME_CODE_POINTS));
+        if (name.isEmpty()) {
+            name = DEFAULT_NAME;
         }
+        String stem = name.split("\\.", 2)[0].toUpperCase(Locale.ROOT);
+        return WINDOWS_DEVICE_NAMES.contains(stem) ? "_" + name : name;
     }
 
-    private record Root(Path path, Object fileKey, FileTime creationTime) {
-        private static Root open(Path requested) throws IOException {
-            Path normalized = Objects.requireNonNull(requested, "requested")
-                    .toAbsolutePath()
-                    .normalize();
-            Files.createDirectories(normalized);
-            if (Files.isSymbolicLink(normalized)
-                    || FileSystemSafety.isWindowsReparsePoint(normalized)) {
-                throw new IOException("Worlds directory must not be a link or reparse point");
-            }
-            Path real = normalized.toRealPath();
-            if (real.getParent() == null || real.getFileName() == null) {
-                throw new IOException("Worlds directory must not be a filesystem root");
-            }
-            BasicFileAttributes attributes = Files.readAttributes(
-                    real, BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
-            if (!FileSystemSafety.isOrdinaryDirectory(real, attributes)) {
-                throw new IOException("Worlds directory is unsafe");
-            }
-            return new Root(real, attributes.fileKey(), attributes.creationTime());
-        }
+    private static String replaceUnsafeCharacters(String name) {
+        StringBuilder safe = new StringBuilder(name.length());
+        name.codePoints().forEach(codePoint -> {
+            boolean unsafe = codePoint < 32 || codePoint == 127 || "<>:\"/\\|?*".indexOf(codePoint) >= 0;
+            safe.appendCodePoint(unsafe ? '_' : codePoint);
+        });
+        return safe.toString();
+    }
 
-        private void requireUnchanged() throws IOException {
-            if (!path.toRealPath().equals(path)) {
-                throw new IOException("Worlds directory changed during restore");
-            }
-            BasicFileAttributes attributes = Files.readAttributes(
-                    path, BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
-            boolean sameIdentity = fileKey != null
-                    ? Objects.equals(fileKey, attributes.fileKey())
-                    : Objects.equals(creationTime, attributes.creationTime());
-            if (!sameIdentity || !FileSystemSafety.isOrdinaryDirectory(path, attributes)) {
-                throw new IOException("Worlds directory changed during restore");
-            }
+    private static String withoutTrailingDotsAndSpaces(String name) {
+        int end = name.length();
+        while (end > 0 && (name.charAt(end - 1) == '.' || name.charAt(end - 1) == ' ')) {
+            end--;
         }
+        return name.substring(0, end);
+    }
+
+    private static String appendSuffix(String base, int index) {
+        String suffix = " (" + index + ")";
+        return truncateCodePoints(base, MAXIMUM_DIRECTORY_NAME_CODE_POINTS - suffix.length()) + suffix;
     }
 
-    @FunctionalInterface
-    interface DirectoryMove {
-        Path move(Path source, Path target, CopyOption... options) throws IOException;
+    private static String truncateCodePoints(String value, int maximum) {
+        return value.codePointCount(0, value.length()) <= maximum
+                ? value
+                : value.substring(0, value.offsetByCodePoints(0, maximum));
     }
 
-    @FunctionalInterface
-    interface StagingCreationHook {
-        void afterCreate(Path path) throws IOException;
+    private static Set<String> windowsDeviceNames() {
+        Set<String> names = new HashSet<>(Set.of("CON", "PRN", "AUX", "NUL", "CLOCK$"));
+        for (int index = 1; index <= 9; index++) {
+            names.add("COM" + index);
+            names.add("LPT" + index);
+        }
+        return Set.copyOf(names);
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/recovery/VerificationOutcome.java b/src/main/java/dev/ishaanko/worldarchive/recovery/VerificationOutcome.java
index d89c3e2..cc33c49 100644
--- a/src/main/java/dev/ishaanko/worldarchive/recovery/VerificationOutcome.java
+++ b/src/main/java/dev/ishaanko/worldarchive/recovery/VerificationOutcome.java
@@ -1,33 +1,34 @@
 package dev.ishaanko.worldarchive.recovery;
 
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
 import dev.ishaanko.worldarchive.model.VerificationStatus;
 import java.util.Objects;
+import java.util.Optional;
 
-/** Destination-neutral verification state used by the maintenance service. */
-record VerificationOutcome(VerificationStatus status, String message) {
+/**
+ * The result of checking one copy: verified, perhaps with a warning that the player sees in the
+ * result of Verify, or failed with the reason.
+ */
+record VerificationOutcome(VerificationStatus status, Optional<String> message) {
     VerificationOutcome {
         Objects.requireNonNull(status, "status");
-        if (status != VerificationStatus.VERIFIED && status != VerificationStatus.FAILED) {
-            throw new IllegalArgumentException("A completed verification must pass or fail");
-        }
-        message = SensitiveDataRedactor.redact(Objects.requireNonNull(message, "message"));
-        if (message.isBlank()
-                || message.length() > 2_048
-                || message.chars().anyMatch(Character::isISOControl)) {
-            throw new IllegalArgumentException("Verification message must be safe display text");
-        }
+        Objects.requireNonNull(message, "message");
     }
 
-    static VerificationOutcome verified(String message) {
-        return new VerificationOutcome(VerificationStatus.VERIFIED, message);
+    static VerificationOutcome verified() {
+        return new VerificationOutcome(VerificationStatus.VERIFIED, Optional.empty());
     }
 
-    static VerificationOutcome failed(String message) {
-        return new VerificationOutcome(VerificationStatus.FAILED, message);
+    /** A copy that restores, with something the player should know, such as a missing checksum file. */
+    static VerificationOutcome verifiedWithWarning(String warning) {
+        return new VerificationOutcome(VerificationStatus.VERIFIED, Optional.of(warning));
     }
 
-    boolean valid() {
-        return status == VerificationStatus.VERIFIED;
+    static VerificationOutcome failed(String reason) {
+        return new VerificationOutcome(VerificationStatus.FAILED, Optional.of(reason));
+    }
+
+    /** A copy that could not be read at all, which says nothing about the copy itself. */
+    static VerificationOutcome unavailable() {
+        return new VerificationOutcome(VerificationStatus.UNAVAILABLE, Optional.empty());
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/recovery/ZipRecoveryDestination.java b/src/main/java/dev/ishaanko/worldarchive/recovery/ZipRecoveryDestination.java
index 9e69140..8e05787 100644
--- a/src/main/java/dev/ishaanko/worldarchive/recovery/ZipRecoveryDestination.java
+++ b/src/main/java/dev/ishaanko/worldarchive/recovery/ZipRecoveryDestination.java
@@ -1,164 +1,123 @@
 package dev.ishaanko.worldarchive.recovery;
 
 import dev.ishaanko.worldarchive.model.ArtifactOwnership;
+import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupManifest;
 import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.DestinationHealth;
-import dev.ishaanko.worldarchive.model.DestinationHealthStatus;
 import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.DestinationStatus;
 import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.SyncStatus;
+import dev.ishaanko.worldarchive.model.SafeText;
 import dev.ishaanko.worldarchive.model.WorldId;
 import dev.ishaanko.worldarchive.storage.zip.ZipBackupStore;
 import dev.ishaanko.worldarchive.storage.zip.ZipBackupStoreResolver;
 import dev.ishaanko.worldarchive.storage.zip.ZipVerification;
+import java.io.IOException;
 import java.nio.file.Path;
-import java.time.Clock;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
 
-/** Recovery adapter for independently verifiable ZIP archives. */
+/**
+ * ZIP copies: one archive per backup in the world's ZIP folder, named in the catalog by world and
+ * file name. A legacy linked archive, from an import mode that no longer exists, is treated like
+ * a managed archive whose file is missing.
+ */
 final class ZipRecoveryDestination implements RecoveryDestination {
-    /**
-     * Zip link-in-place import was removed, so a catalog entry can no longer point at
-     * an artifact WorldArchive does not own. Any record still carrying
-     * {@link ArtifactOwnership#EXTERNAL} for a ZIP destination predates that removal;
-     * it is treated exactly like a managed archive whose file is missing, using the
-     * same wording {@code ZipBackupStore} uses for that case.
-     */
-    private static final String MISSING_ARCHIVE_MESSAGE =
-            "The selected ZIP archive is missing or is not a regular file.";
+    private static final String MISSING_ARCHIVE = "The ZIP archive is missing or is not a regular file.";
 
     private final ZipBackupStoreResolver stores;
 
-    private final Clock clock;
-
-    ZipRecoveryDestination(ZipBackupStore store, Clock clock) {
-        this((ZipBackupStoreResolver) store, clock);
-    }
-
-    ZipRecoveryDestination(ZipBackupStoreResolver stores, Clock clock) {
+    ZipRecoveryDestination(ZipBackupStoreResolver stores) {
         this.stores = Objects.requireNonNull(stores, "stores");
-        this.clock = Objects.requireNonNull(clock, "clock");
     }
 
     @Override
-    public DestinationType destinationType() {
+    public DestinationType type() {
         return DestinationType.ZIP;
     }
 
     @Override
-    public VerificationOutcome verify(BackupRecord record, DestinationResult destination) {
-        if (destination.ownership() == ArtifactOwnership.EXTERNAL) {
-            return VerificationOutcome.failed(MISSING_ARCHIVE_MESSAGE);
+    public VerificationOutcome verify(BackupRecord record, DestinationResult copy) throws IOException {
+        if (copy.ownership() == ArtifactOwnership.EXTERNAL) {
+            return VerificationOutcome.failed(MISSING_ARCHIVE);
         }
-        Path archive = archivePath(record, destination);
-        ZipBackupStore store = store(record);
-        ZipVerification verification = store.verify(archive);
+        ZipVerification verification = store(record).verify(archivePath(record, copy));
         if (!verification.valid()) {
-            return VerificationOutcome.failed(verification.problems().isEmpty()
-                    ? "ZIP archive verification failed"
-                    : verification.problems().getFirst());
+            return VerificationOutcome.failed(verification.problems().getFirst());
         }
-        Optional<BackupManifest> actual = verification.manifest();
-        if (actual.isEmpty() || !actual.orElseThrow().equals(record.manifest())) {
-            return VerificationOutcome.failed("ZIP manifest does not exactly match the catalog");
+        if (verification.manifest().filter(record.manifest()::equals).isEmpty()) {
+            return VerificationOutcome.failed("The ZIP archive holds a different backup than the backup list says");
         }
-        return VerificationOutcome.verified("ZIP archive and checksum verified");
+        return verification.warnings().isEmpty()
+                ? VerificationOutcome.verified()
+                : VerificationOutcome.verifiedWithWarning(String.join(" ", verification.warnings()));
     }
 
+    /** Extracts and checks the archive in one pass; the manifest must be the record's. */
     @Override
-    public Materialization materialize(
-            BackupRecord record,
-            DestinationResult destination,
-            Path emptyTarget) throws Exception {
-        if (destination.ownership() == ArtifactOwnership.EXTERNAL) {
-            throw new BackupRecoveryException(MISSING_ARCHIVE_MESSAGE);
+    public void restore(BackupRecord record, DestinationResult copy, Path emptyStaging) throws Exception {
+        if (copy.ownership() == ArtifactOwnership.EXTERNAL) {
+            throw new BackupRecoveryException(MISSING_ARCHIVE);
         }
-        Path archive = archivePath(record, destination);
-        ZipBackupStore store = store(record);
-        store.materialize(archive, emptyTarget);
-        VerificationOutcome after = verify(record, destination);
-        if (!after.valid()) {
-            throw new BackupRecoveryException(
-                    "ZIP artifact changed during restoration: " + after.message());
+        BackupManifest restored = store(record).materialize(archivePath(record, copy), emptyStaging);
+        if (!restored.equals(record.manifest())) {
+            throw new BackupRecoveryException("The ZIP archive holds a different backup than the backup list says");
         }
-        return Materialization.preserved(emptyTarget);
     }
 
+    /**
+     * Deletes each archive and its checksum file. An archive that is already gone counts as
+     * deleted; so does one found under the name this backup gets today when the catalog's name is
+     * missing. A linked legacy archive was never WorldArchive's to delete.
+     */
     @Override
-    public boolean delete(BackupRecord record, DestinationResult destination) throws Exception {
-        if (destination.ownership() == ArtifactOwnership.EXTERNAL) {
-            // Nothing is owned in managed storage for a legacy linked record; only the
-            // catalog entry, which the caller removes, ever needs to go away.
-            return true;
-        }
-        ZipBackupStore store = store(record);
-        Path catalogArchive = archivePath(record, destination);
-        boolean removed = store.delete(catalogArchive);
-        if (!removed) {
-            Path canonicalArchive = store.root()
-                    .resolve(record.manifest().worldId().toString())
-                    .resolve(ZipBackupStore.archiveFilename(record.manifest()))
-                    .normalize();
-            if (!canonicalArchive.equals(catalogArchive)) {
-                store.delete(canonicalArchive);
+    public Map<BackupId, DestinationResult> delete(WorldId worldId, List<BackupRecord> records) {
+        Map<BackupId, DestinationResult> results = new LinkedHashMap<>();
+        for (BackupRecord record : records) {
+            DestinationResult copy = RecoverySupport.copy(record, DestinationType.ZIP).orElseThrow();
+            try {
+                if (copy.ownership() != ArtifactOwnership.EXTERNAL) {
+                    deleteArchive(record, copy);
+                }
+                results.put(record.manifest().backupId(), copy.withState(
+                        DestinationStatus.SUCCESS, Optional.empty(), copy.syncStatus()));
+            } catch (IOException | RuntimeException failure) {
+                results.put(record.manifest().backupId(), DestinationResult.failed(
+                        DestinationType.ZIP, SafeText.from(failure, "The ZIP archive could not be deleted", 1_024)));
             }
         }
-        // A safe catalog or canonical path also reconciles an already-absent managed pair.
-        return true;
+        return results;
     }
 
-    @Override
-    public DestinationResult sync(BackupRecord record, DestinationResult destination) {
-        if (destination.ownership() == ArtifactOwnership.EXTERNAL) {
-            return destination.withSync(SyncStatus.NOT_CONFIGURED);
-        }
-        archivePath(record, destination);
-        return destination.withSync(SyncStatus.NOT_CONFIGURED);
-    }
-
-    @Override
-    public DestinationHealth health(Optional<WorldId> worldId) throws Exception {
-        Objects.requireNonNull(worldId, "worldId");
-        if (worldId.isPresent()) {
-            stores.store(worldId.orElseThrow()).listArchives();
-        } else {
-            stores.defaultStore().listArchives();
+    private void deleteArchive(BackupRecord record, DestinationResult copy) throws IOException {
+        ZipBackupStore store = store(record);
+        Path listed = archivePath(record, copy);
+        if (!store.delete(listed)) {
+            Path current = store.root()
+                    .resolve(record.manifest().worldId().toString())
+                    .resolve(ZipBackupStore.archiveFilename(record.manifest()));
+            if (!current.equals(listed)) {
+                store.delete(current);
+            }
         }
-        return new DestinationHealth(
-                DestinationType.ZIP,
-                DestinationHealthStatus.HEALTHY,
-                "ZIP destination is available",
-                clock.instant());
     }
 
-    private Path archivePath(BackupRecord record, DestinationResult destination) {
-        Objects.requireNonNull(record, "record");
-        Objects.requireNonNull(destination, "destination");
-        if (destination.destination() != DestinationType.ZIP || destination.artifactId().isEmpty()) {
-            throw new BackupRecoveryException("ZIP artifact identity is missing from the catalog");
-        }
-        String artifact = destination.artifactId().orElseThrow();
+    /** The archive the catalog names, which must lie directly in the world's folder of its ZIP store. */
+    private Path archivePath(BackupRecord record, DestinationResult copy) {
         String prefix = record.manifest().worldId() + "/";
-        if (!artifact.startsWith(prefix)
-                || artifact.length() == prefix.length()
-                || artifact.indexOf('/', prefix.length()) >= 0
-                || artifact.indexOf('\\') >= 0) {
-            throw new BackupRecoveryException("ZIP artifact identity does not match the catalog");
-        }
-        String filename = artifact.substring(prefix.length());
-        String identitySuffix = record.manifest().backupId() + ".zip";
-        if (!filename.endsWith("_" + identitySuffix)
-                && !filename.endsWith(" - " + identitySuffix)) {
-            throw new BackupRecoveryException("ZIP artifact backup ID does not match the catalog");
-        }
-        Path worldDirectory = store(record).root()
-                .resolve(record.manifest().worldId().toString())
-                .normalize();
-        Path archive = worldDirectory.resolve(filename).normalize();
-        if (!archive.getParent().equals(worldDirectory)) {
-            throw new BackupRecoveryException("ZIP artifact path escapes its managed world directory");
+        String artifact = copy.artifactId().orElseThrow();
+        String filename = artifact.startsWith(prefix) ? artifact.substring(prefix.length()) : "";
+        String identity = record.manifest().backupId() + ".zip";
+        boolean ownName = (filename.endsWith("_" + identity) || filename.endsWith(" - " + identity))
+                && filename.indexOf('/') < 0
+                && filename.indexOf('\\') < 0;
+        Path folder = store(record).root().resolve(record.manifest().worldId().toString());
+        Path archive = folder.resolve(filename).normalize();
+        if (!ownName || !folder.equals(archive.getParent())) {
+            throw new BackupRecoveryException("The backup list names another ZIP archive for this backup");
         }
         return archive;
     }
diff --git a/src/main/java/dev/ishaanko/worldarchive/runtime/BackgroundNotices.java b/src/main/java/dev/ishaanko/worldarchive/runtime/BackgroundNotices.java
new file mode 100644
index 0000000..40b8ea5
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/BackgroundNotices.java
@@ -0,0 +1,90 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.SafeText;
+import dev.ishaanko.worldarchive.support.AsyncTasks;
+import java.util.List;
+import java.util.Optional;
+
+/**
+ * What the player reads about world-exit and scheduled backups, which run while no WorldArchive
+ * screen is open. A cancel is the player's own choice, so it never becomes a warning; a scheduled
+ * backup that succeeded or was skipped says nothing.
+ */
+public final class BackgroundNotices {
+    private static final int REASON_LIMIT = 200;
+
+    private BackgroundNotices() {
+    }
+
+    /** The toast of a world-exit backup that just started. */
+    public static Notice exitStarted() {
+        return notice(Notice.Severity.WARNING, "screen.worldarchive.notice.exit_started");
+    }
+
+    /** How a world-exit backup ended. */
+    public static Notice exitOutcome(BackupResult result, Throwable failure) {
+        if (AsyncTasks.isCancellation(failure)) {
+            return notice(Notice.Severity.WARNING, "screen.worldarchive.notice.exit_cancelled");
+        }
+        if (failure != null) {
+            return exitNotMade(reason(failure));
+        }
+        return switch (result.status()) {
+            case SUCCESS -> notice(Notice.Severity.SUCCESS, "screen.worldarchive.notice.exit_done");
+            case PARTIAL_SUCCESS -> notice(Notice.Severity.WARNING, "screen.worldarchive.notice.exit_warnings");
+            case FAILED -> notice(Notice.Severity.ERROR, "screen.worldarchive.notice.exit_failed");
+            case SKIPPED -> notice(Notice.Severity.WARNING, "screen.worldarchive.notice.exit_skipped");
+        };
+    }
+
+    /** A world-exit backup that was not made; the world itself was saved. */
+    public static Notice exitNotMade(String reason) {
+        return new Notice(Notice.Severity.ERROR, "screen.worldarchive.notice.exit_not_made",
+                List.of(SafeText.clean(reason, REASON_LIMIT)));
+    }
+
+    /** The game closed the world without its final save, so no backup could be made of it. */
+    public static Notice saveMissing() {
+        return notice(Notice.Severity.ERROR, "screen.worldarchive.notice.save_missing");
+    }
+
+    /** Kept for the next start: the game closed while a world-exit backup still ran. */
+    public static Notice exitInterrupted() {
+        return notice(Notice.Severity.ERROR, "screen.worldarchive.notice.exit_interrupted");
+    }
+
+    /** Kept for the next start: the game closed while other WorldArchive work still ran. */
+    public static Notice workInterrupted() {
+        return notice(Notice.Severity.WARNING, "screen.worldarchive.notice.work_interrupted");
+    }
+
+    /** The warning of a scheduled backup; empty when there is nothing to tell. */
+    public static Optional<Notice> scheduledOutcome(BackupResult result, Throwable failure) {
+        if (AsyncTasks.isCancellation(failure)) {
+            return Optional.empty();
+        }
+        if (failure != null) {
+            return Optional.of(scheduledNotMade(reason(failure)));
+        }
+        return switch (result.status()) {
+            case SUCCESS, SKIPPED -> Optional.empty();
+            case PARTIAL_SUCCESS -> Optional.of(notice(Notice.Severity.WARNING, "screen.worldarchive.notice.scheduled_warnings"));
+            case FAILED -> Optional.of(notice(Notice.Severity.WARNING, "screen.worldarchive.notice.scheduled_failed"));
+        };
+    }
+
+    /** A scheduled backup that could not start. */
+    public static Notice scheduledNotMade(String reason) {
+        return new Notice(Notice.Severity.WARNING, "screen.worldarchive.notice.scheduled_not_made",
+                List.of(SafeText.clean(reason, REASON_LIMIT)));
+    }
+
+    private static String reason(Throwable failure) {
+        return SafeText.from(failure, "no reason was given", REASON_LIMIT);
+    }
+
+    private static Notice notice(Notice.Severity severity, String key) {
+        return new Notice(severity, key, List.of());
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/runtime/BackgroundReports.java b/src/main/java/dev/ishaanko/worldarchive/runtime/BackgroundReports.java
new file mode 100644
index 0000000..1e3c267
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/BackgroundReports.java
@@ -0,0 +1,23 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import dev.ishaanko.worldarchive.model.ProgressListener;
+
+/**
+ * Where {@link LiveWorldBackups} tells the player about the backups nobody watches on a screen.
+ * The client shows toasts and chat lines; the calls come from worker and server threads.
+ */
+public interface BackgroundReports {
+    /** A world-exit backup started; {@code cancel} asks it to stop, as the toast's Cancel button does. */
+    ExitReport exitStarted(Runnable cancel);
+
+    /** No world-exit backup was made; the notice says why. */
+    void exitNotMade(Notice notice);
+
+    /** A scheduled backup could not be made or had a problem. */
+    void scheduledWarning(Notice notice);
+
+    /** One running world-exit backup: it takes the backup's progress, then its outcome. */
+    interface ExitReport extends ProgressListener {
+        void finished(Notice notice);
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/runtime/BackupWorldList.java b/src/main/java/dev/ishaanko/worldarchive/runtime/BackupWorldList.java
new file mode 100644
index 0000000..f8c10bf
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/BackupWorldList.java
@@ -0,0 +1,68 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.config.WorldConfig;
+import dev.ishaanko.worldarchive.model.BackupRecord;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldEntry;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+/**
+ * The worlds of the World Backups screen: each configured world whose folder is there or that has
+ * backups, and each world known only from its backups. A world without its folder offers restore
+ * and delete only; its context names a folder that does not exist, so it can never be backed up.
+ */
+public final class BackupWorldList {
+    private BackupWorldList() {
+    }
+
+    /** The list, sorted by name; {@code savesDirectory} is where restores of each world go. */
+    public static List<BackupWorldEntry> build(WorldArchiveConfig config, List<BackupRecord> records, Path savesDirectory) {
+        Map<WorldId, List<BackupRecord>> byWorld = records.stream()
+                .collect(Collectors.groupingBy(record -> record.manifest().worldId()));
+        Map<WorldId, BackupWorldEntry> entries = new HashMap<>();
+        for (WorldConfig world : config.worlds()) {
+            boolean present = isWorldFolder(world.path());
+            int backups = byWorld.getOrDefault(world.worldId(), List.of()).size();
+            if (present || backups > 0) {
+                String name = world.path().getFileName().toString();
+                entries.put(world.worldId(), new BackupWorldEntry(
+                        new BackupWorldContext(world.worldId(), world.path(), savesDirectory, name, name),
+                        !present,
+                        backups));
+            }
+        }
+        byWorld.forEach((worldId, backups) -> entries.computeIfAbsent(worldId, ignored -> missingWorld(
+                worldId, backups, savesDirectory)));
+        List<BackupWorldEntry> sorted = new ArrayList<>(entries.values());
+        sorted.sort(Comparator.comparing(entry -> entry.context().displayName(), String.CASE_INSENSITIVE_ORDER));
+        return List.copyOf(sorted);
+    }
+
+    /** True when the folder is there and holds the world's {@code level.dat}. */
+    public static boolean isWorldFolder(Path world) {
+        return Files.isDirectory(world, LinkOption.NOFOLLOW_LINKS)
+                && Files.isRegularFile(world.resolve("level.dat"), LinkOption.NOFOLLOW_LINKS);
+    }
+
+    private static BackupWorldEntry missingWorld(WorldId worldId, List<BackupRecord> backups, Path savesDirectory) {
+        BackupRecord newest = backups.stream()
+                .max(Comparator.comparing(record -> record.manifest().createdAt()))
+                .orElseThrow();
+        String folder = ".worldarchive-missing-" + worldId;
+        return new BackupWorldEntry(
+                new BackupWorldContext(
+                        worldId, savesDirectory.resolve(folder), savesDirectory, folder, newest.manifest().worldName()),
+                true,
+                backups.size());
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/runtime/ConfigurationGate.java b/src/main/java/dev/ishaanko/worldarchive/runtime/ConfigurationGate.java
new file mode 100644
index 0000000..bed2739
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/ConfigurationGate.java
@@ -0,0 +1,102 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import java.time.Duration;
+import java.util.Objects;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+/**
+ * Keeps backup folders from moving while WorldArchive writes into them. Work that writes backups,
+ * restores, deletes or imports holds a permit from {@link #enterWork}. A settings save that moves
+ * a backup folder takes {@link #enterFolderChange}, which is refused while any permit is held; new
+ * work is refused while that save runs. Neither waits: a refusal is an exception whose message
+ * the player can act on. Only {@link #awaitIdle}, for shutdown, waits.
+ */
+public final class ConfigurationGate {
+    private final Runnable idle;
+
+    // Guarded by this.
+    private int work;
+
+    private boolean folderChange;
+
+    /** @param idle runs outside the gate's lock each time the last work permit is released */
+    public ConfigurationGate(Runnable idle) {
+        this.idle = Objects.requireNonNull(idle, "idle");
+    }
+
+    /** A permit for work that writes backups; refused while a settings save moves backup folders. */
+    public synchronized Permit enterWork() {
+        if (folderChange) {
+            throw new IllegalStateException("WorldArchive settings are being saved. Try again in a moment.");
+        }
+        work++;
+        return new Permit(this::leaveWork);
+    }
+
+    /**
+     * A permit for work that a settings change itself starts, such as the first catalog scan of
+     * the new folders. It is granted even while that change runs.
+     */
+    synchronized Permit enterSettingsWork() {
+        work++;
+        return new Permit(this::leaveWork);
+    }
+
+    /** A permit for a settings save that moves backup folders; refused while any work runs. */
+    public synchronized Permit enterFolderChange() {
+        if (folderChange || work > 0) {
+            throw new IllegalStateException("Backup folders cannot change while a backup, restore, delete or"
+                    + " import is running. Try again when it has finished.");
+        }
+        folderChange = true;
+        return new Permit(this::leaveFolderChange);
+    }
+
+    /** Waits until no work holds a permit, for at most {@code timeout}; true when none does. */
+    public synchronized boolean awaitIdle(Duration timeout) throws InterruptedException {
+        long deadline = System.nanoTime() + timeout.toNanos();
+        while (work > 0) {
+            long remaining = deadline - System.nanoTime();
+            if (remaining <= 0) {
+                return false;
+            }
+            TimeUnit.NANOSECONDS.timedWait(this, remaining);
+        }
+        return true;
+    }
+
+    private void leaveWork() {
+        boolean nowIdle;
+        synchronized (this) {
+            work--;
+            nowIdle = work == 0;
+            notifyAll();
+        }
+        if (nowIdle) {
+            idle.run();
+        }
+    }
+
+    private synchronized void leaveFolderChange() {
+        folderChange = false;
+    }
+
+    /** One hold on the gate; closing it releases the hold once, from any thread. */
+    public static final class Permit implements AutoCloseable {
+        private final AtomicBoolean closed = new AtomicBoolean();
+
+        private final Runnable release;
+
+        private Permit(Runnable release) {
+            this.release = release;
+        }
+
+        @Override
+        public void close() {
+            if (closed.compareAndSet(false, true)) {
+                release.run();
+            }
+        }
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/runtime/LiveBackup.java b/src/main/java/dev/ishaanko/worldarchive/runtime/LiveBackup.java
new file mode 100644
index 0000000..b7d3374
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/LiveBackup.java
@@ -0,0 +1,177 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import dev.ishaanko.worldarchive.core.CreateBackupRequest;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.WorldId;
+import java.util.Objects;
+import java.util.concurrent.CancellationException;
+import java.util.concurrent.CompletableFuture;
+
+/**
+ * One backup of the open or the just-closed world, from its request to its result. A cancel stops
+ * it wherever it is: before the copy, during the copy, or while its destinations write, unless the
+ * coordinator already records the result. {@link LiveWorldBackups} drives it.
+ */
+final class LiveBackup {
+    /** No tick was recorded: the backup did not save a running world. */
+    static final int NO_TICK = -1;
+
+    final LiveServer server;
+
+    final RuntimeState state;
+
+    final CreateBackupRequest request;
+
+    final CompletableFuture<BackupResult> result = new CompletableFuture<>();
+
+    private final Owner owner;
+
+    /** The server's tick count when it saved the world for this backup; set on the server thread before the copy. */
+    private volatile int savedAtTick = NO_TICK;
+
+    // Guarded by this. A cancel interrupts the copy, or cancels the destinations once they write.
+    private boolean cancelRequested;
+
+    private boolean captureStarted;
+
+    private Thread captureThread;
+
+    private CompletableFuture<BackupResult> operation;
+
+    /** @param permit a work permit, released once the backup settled and its world's backup work stopped */
+    LiveBackup(
+            LiveServer server,
+            RuntimeState state,
+            CreateBackupRequest request,
+            ConfigurationGate.Permit permit,
+            Owner owner) {
+        this.server = Objects.requireNonNull(server, "server");
+        this.state = Objects.requireNonNull(state, "state");
+        this.request = Objects.requireNonNull(request, "request");
+        this.owner = Objects.requireNonNull(owner, "owner");
+        // A cancelled backup settles before its destinations stopped; the folders stay put until then.
+        result.whenComplete((ignored, failure) -> state.coordinator().whenIdle(request.worldId())
+                .whenComplete((idle, error) -> permit.close()));
+    }
+
+    /** What the backup tells {@link LiveWorldBackups}, which owns the save queue and the schedule. */
+    interface Owner {
+        /** Forgets the backup's save that still waits for the server thread. */
+        void dropSave(LiveBackup backup);
+
+        /** The backup kept a copy of the world as the server saved it at {@code tick}. */
+        void keptAt(LiveBackup backup, int tick);
+    }
+
+    WorldId worldId() {
+        return request.worldId();
+    }
+
+    void savedAt(int tick) {
+        savedAtTick = tick;
+    }
+
+    /**
+     * Asks the backup to stop. A backup whose copy has not started never copies; a copy that runs
+     * is interrupted; destinations that write are cancelled unless the result is being recorded.
+     * True when the backup ends as cancelled.
+     */
+    boolean cancel() {
+        CompletableFuture<BackupResult> running;
+        synchronized (this) {
+            if (result.isDone()) {
+                return false;
+            }
+            cancelRequested = true;
+            if (captureThread != null) {
+                captureThread.interrupt();
+                return true;
+            }
+            if (captureStarted && operation == null) {
+                // Between the copy and the destinations: dispatched() sees the request.
+                return true;
+            }
+            running = operation;
+        }
+        if (running == null) {
+            owner.dropSave(this);
+            fail(cancellation());
+            return true;
+        }
+        return running.cancel(true);
+    }
+
+    /** Claims the calling thread for the copy; false when a cancel came first. */
+    synchronized boolean beginCapture() {
+        captureStarted = true;
+        if (cancelRequested) {
+            return false;
+        }
+        captureThread = Thread.currentThread();
+        return true;
+    }
+
+    /** Ends the copy and clears an interrupt a cancel left; false when the backup must stop here. */
+    boolean endCapture() {
+        boolean proceed;
+        synchronized (this) {
+            captureThread = null;
+            proceed = !cancelRequested;
+        }
+        if (!proceed) {
+            Thread.interrupted();
+        }
+        return proceed;
+    }
+
+    /** Records the destinations' work, and cancels it when a cancel arrived meanwhile. */
+    void dispatched(CompletableFuture<BackupResult> running) {
+        boolean cancel;
+        synchronized (this) {
+            operation = running;
+            cancel = cancelRequested;
+        }
+        if (cancel) {
+            running.cancel(true);
+        }
+    }
+
+    /** Completes the backup with its outcome; a kept copy of a saved world marks the tick the schedule compares with. */
+    void settle(BackupResult value, Throwable failure) {
+        if (failure != null) {
+            fail(failure);
+            return;
+        }
+        if (savedAtTick != NO_TICK && value.destinations().stream().anyMatch(DestinationResult::isDurable)) {
+            owner.keptAt(this, savedAtTick);
+        }
+        result.complete(value);
+    }
+
+    void fail(Throwable failure) {
+        result.completeExceptionally(failure);
+    }
+
+    /** The stage handed to the player's screen: it follows the result, and cancelling it cancels the backup. */
+    CompletableFuture<BackupResult> view() {
+        CompletableFuture<BackupResult> view = new CompletableFuture<>() {
+            @Override
+            public boolean cancel(boolean mayInterruptIfRunning) {
+                return LiveBackup.this.cancel() && (super.cancel(mayInterruptIfRunning) || isCancelled());
+            }
+        };
+        result.whenComplete((value, failure) -> {
+            if (failure == null) {
+                view.complete(value);
+            } else {
+                view.completeExceptionally(failure);
+            }
+        });
+        return view;
+    }
+
+    static CancellationException cancellation() {
+        return new CancellationException("Backup was cancelled");
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/runtime/LiveServer.java b/src/main/java/dev/ishaanko/worldarchive/runtime/LiveServer.java
new file mode 100644
index 0000000..3d535d1
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/LiveServer.java
@@ -0,0 +1,39 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import java.nio.file.Path;
+
+/**
+ * The integrated server as {@link LiveWorldBackups} sees it. The Fabric adapter implements it
+ * around Minecraft's server, and tests implement it without Minecraft. Two instances are equal
+ * when they stand for the same server.
+ */
+public interface LiveServer {
+    /** The world's folder as the game names it; links in it are not resolved. */
+    Path worldDirectory();
+
+    /** The name the player gave the world. */
+    String levelName();
+
+    /**
+     * Runs {@code task} on the server thread between ticks. A stopped server may run it at once
+     * on the calling thread instead; see {@link #isServerThread}.
+     *
+     * @throws java.util.concurrent.RejectedExecutionException when the server takes no more tasks
+     */
+    void execute(Runnable task);
+
+    /** True on the server's own thread. */
+    boolean isServerThread();
+
+    /** Writes every loaded chunk and all player data to disk now; server thread only. */
+    void saveAll();
+
+    /** True unless the player or a capture turned saving off; server thread only. */
+    boolean isAutoSave();
+
+    /** Turns saving on or off for every level; server thread only. */
+    void setAutoSave(boolean enabled);
+
+    /** Ticks since the server started. A paused game does not tick, so the count stays. */
+    int tickCount();
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/runtime/LiveWorldBackups.java b/src/main/java/dev/ishaanko/worldarchive/runtime/LiveWorldBackups.java
new file mode 100644
index 0000000..28e7b00
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/LiveWorldBackups.java
@@ -0,0 +1,796 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import dev.ishaanko.worldarchive.core.CaptureKind;
+import dev.ishaanko.worldarchive.core.CreateBackupRequest;
+import dev.ishaanko.worldarchive.core.PreparedBackup;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.SafeText;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldSelection;
+import java.io.IOException;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.RejectedExecutionException;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.function.LongSupplier;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Backs up the world the integrated server runs. A manual or scheduled backup of the open world
+ * asks the server to save on its own thread, then copies the world on a worker while autosave is
+ * paused. A world-exit backup copies the world on a worker after the server's final save, when
+ * nothing writes to it any more. The Fabric adapter reports the server's events here through
+ * {@link LiveServer}; every event method returns at once, and a backup problem is reported to the
+ * player instead of thrown.
+ *
+ * <p>A scheduled backup is skipped without a word when the player turned it off, when a backup of
+ * the world is running, and when the server has not ticked since the last backup of the world
+ * in this session, which is the case while the game is paused.</p>
+ */
+public final class LiveWorldBackups {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
+    private static final long FIRST_RETRY_NANOS = Duration.ofMillis(250).toNanos();
+
+    private static final long LAST_RETRY_NANOS = Duration.ofSeconds(30).toNanos();
+
+    private static final int NAME_LIMIT = 120;
+
+    private final ServiceGraph graph;
+
+    private final WorldIdentityResolver resolver;
+
+    private final BackgroundReports reports;
+
+    private final LongSupplier nanoTime;
+
+    private final Object lock = new Object();
+
+    /** The last background warning of each world, for its backup browser. */
+    private final Map<WorldId, Notice> warnings = new ConcurrentHashMap<>();
+
+    private final AtomicInteger exitBackups = new AtomicInteger();
+
+    private final LiveBackup.Owner owner = new LiveBackup.Owner() {
+        @Override
+        public void dropSave(LiveBackup backup) {
+            dropPending(backup);
+        }
+
+        @Override
+        public void keptAt(LiveBackup backup, int tick) {
+            backedUpAt(backup.server, backup.worldId(), tick);
+        }
+    };
+
+    // Guarded by lock: the open world, the save waiting for the server thread, and the autosave
+    // pauses of servers whose world is being copied.
+    private Session session;
+
+    private Pending pending;
+
+    private final Map<LiveServer, Pause> pauses = new HashMap<>();
+
+    private boolean closed;
+
+    /** @param nanoTime a monotonic clock in nanoseconds, such as {@link System#nanoTime} */
+    public LiveWorldBackups(
+            ServiceGraph graph,
+            WorldIdentityResolver resolver,
+            BackgroundReports reports,
+            LongSupplier nanoTime) {
+        this.graph = Objects.requireNonNull(graph, "graph");
+        this.resolver = Objects.requireNonNull(resolver, "resolver");
+        this.reports = Objects.requireNonNull(reports, "reports");
+        this.nanoTime = Objects.requireNonNull(nanoTime, "nanoTime");
+    }
+
+    /** Whether a world is the one the server runs, and whether its identity is known yet. */
+    public enum OpenWorld {
+        NOT_OPEN,
+        LOADING,
+        READY
+    }
+
+    /** The server finished starting a world; server thread. */
+    public void started(LiveServer server) {
+        BackupWorldSelection selection = selection(server);
+        if (!resolver.inSaves(selection)) {
+            return;
+        }
+        Path world = realPath(selection.worldDirectory());
+        Pending stale;
+        synchronized (lock) {
+            if (closed) {
+                return;
+            }
+            // A world that closed without the server reporting its stop leaves its save behind.
+            stale = pending;
+            pending = null;
+            session = new Session(server, selection, world, nanoTime.getAsLong());
+        }
+        abandon(stale, "The previous world closed before its backup could start");
+        resolve();
+    }
+
+    /** The server begins to stop, before its final save; server thread. */
+    public void stopping(LiveServer server) {
+        Optional<RuntimeState> state = graph.current();
+        Pending displaced;
+        synchronized (lock) {
+            if (session == null || !session.server.equals(server)) {
+                return;
+            }
+            session.stopping = true;
+            displaced = pending;
+            // Without settings, as when the file cannot be read, the exit still reports that no backup was made.
+            boolean exitBackup = !closed && state
+                    .map(current -> TriggerCheck.anyDestinationTakes(current.config(), BackupTrigger.WORLD_EXIT))
+                    .orElse(true);
+            pending = exitBackup ? new ExitSave(server, false) : null;
+        }
+        abandon(displaced, "The world closed before the backup could save it");
+    }
+
+    /** The server saved its levels; server thread. The final save of a stopping server allows its world-exit backup. */
+    public void saved(LiveServer server, boolean flush, boolean force) {
+        synchronized (lock) {
+            if (pending instanceof ExitSave exit && exit.server().equals(server) && flush && !force) {
+                pending = new ExitSave(server, true);
+            }
+        }
+    }
+
+    /** The server stopped; server thread. Starts the world-exit backup when the final save happened. */
+    public void stopped(LiveServer server) {
+        ExitSave exit = null;
+        Session ended = null;
+        synchronized (lock) {
+            if (pending instanceof ExitSave candidate && candidate.server().equals(server)) {
+                exit = candidate;
+                pending = null;
+            }
+            if (session != null && session.server.equals(server)) {
+                ended = session;
+                session = null;
+            }
+        }
+        if (exit == null || ended == null) {
+            return;
+        }
+        if (exit.saved()) {
+            startExitBackup(ended);
+        } else {
+            reports.exitNotMade(BackgroundNotices.saveMissing());
+        }
+    }
+
+    /** Fails the save waiting on {@code server} after an event handler of that server failed. */
+    public void abandon(LiveServer server, Throwable failure) {
+        Pending taken = null;
+        synchronized (lock) {
+            if (pending != null && pending.server().equals(server)) {
+                taken = pending;
+                pending = null;
+            }
+        }
+        abandon(taken, "WorldArchive failed while the world changed state: "
+                + SafeText.from(failure, "no reason was given", 200));
+    }
+
+    /** Runs every client tick: resolves the open world's identity, then starts a scheduled backup that is due. */
+    public void tick() {
+        resolve();
+        graph.current().ifPresent(this::startScheduledBackup);
+    }
+
+    /** The settings changed: the open world is resolved again when its claim changed, and refusals are forgotten. */
+    public void reconcile() {
+        synchronized (lock) {
+            Session current = session;
+            if (current == null) {
+                return;
+            }
+            current.generation++;
+            current.resolving = false;
+            current.refused = false;
+            current.retryDelay = FIRST_RETRY_NANOS;
+            current.nextAttempt = nanoTime.getAsLong();
+            if (current.world != null
+                    && !resolver.isRegistered(current.world.worldId(), current.world.worldDirectory())) {
+                current.world = null;
+            }
+        }
+    }
+
+    /** Takes no more work; a save that waits for the server fails, and backups that run finish. */
+    public void close() {
+        Pending taken;
+        synchronized (lock) {
+            closed = true;
+            taken = pending;
+            pending = null;
+        }
+        abandon(taken, "Minecraft is closing");
+    }
+
+    /** The open world, once its identity is known. */
+    public Optional<BackupWorldContext> liveWorld() {
+        synchronized (lock) {
+            return session == null || session.stopping ? Optional.empty() : Optional.ofNullable(session.world);
+        }
+    }
+
+    /** Whether {@code world} is the world the server runs; compared by the real folder, so a link cannot hide it. */
+    public OpenWorld openWorld(BackupWorldContext world) {
+        synchronized (lock) {
+            if (session == null || !session.realWorld.equals(world.worldDirectory())) {
+                return OpenWorld.NOT_OPEN;
+            }
+            return session.world != null && !session.stopping && session.world.worldId().equals(world.worldId())
+                    ? OpenWorld.READY
+                    : OpenWorld.LOADING;
+        }
+    }
+
+    /** True while a backup of the world waits for the server to save it. */
+    public boolean hasPending(WorldId worldId) {
+        synchronized (lock) {
+            return pending instanceof RequestedSave requested && requested.backup().worldId().equals(worldId);
+        }
+    }
+
+    /** The last warning of the world's world-exit or scheduled backups; empty after a success. */
+    public Optional<Notice> warning(WorldId worldId) {
+        return Optional.ofNullable(warnings.get(worldId));
+    }
+
+    /** True while a world-exit backup has not settled. */
+    public boolean exitBackupsRunning() {
+        return exitBackups.get() > 0;
+    }
+
+    /**
+     * Backs up the open world: the server saves it on its thread, then a worker copies it while
+     * autosave is paused. Cancelling the returned stage asks the backup to stop, and returns true
+     * only when the backup then ends as cancelled.
+     *
+     * @param permit a work permit, which the backup releases once it and its destinations stopped
+     */
+    public CompletableFuture<BackupResult> backUpOpenWorld(
+            RuntimeState state,
+            CreateBackupRequest request,
+            ProgressListener listener,
+            ConfigurationGate.Permit permit) {
+        LiveBackup backup = null;
+        String refusal;
+        synchronized (lock) {
+            refusal = requestRefusal(request.worldId());
+            if (refusal == null) {
+                backup = new LiveBackup(session.server, state, request, permit, owner);
+                pending = new RequestedSave(session.server, backup);
+            }
+        }
+        if (refusal != null) {
+            permit.close();
+            return CompletableFuture.failedFuture(new IllegalStateException(refusal));
+        }
+        LiveBackup requested = backup;
+        try {
+            requested.server.execute(() -> saveAndCapture(requested, listener));
+        } catch (RejectedExecutionException closing) {
+            dropPending(requested);
+            requested.fail(new IllegalStateException("The world closed before the backup could save it"));
+        }
+        return requested.view();
+    }
+
+    private String requestRefusal(WorldId worldId) {
+        if (closed || session == null || session.stopping || session.world == null
+                || !session.world.worldId().equals(worldId)) {
+            return "The world is closing. Try again from the world list.";
+        }
+        if (pauses.containsKey(session.server)) {
+            return "A backup is still copying this world. Try again in a moment.";
+        }
+        if (pending != null) {
+            return "Another backup of this world is starting. Try again in a moment.";
+        }
+        return null;
+    }
+
+    /** Saves the world and starts the copy; server thread. */
+    private void saveAndCapture(LiveBackup backup, ProgressListener listener) {
+        LiveServer server = backup.server;
+        if (!server.isServerThread()) {
+            // A stopped server runs a task at once on the caller's thread; the world must not be saved from there.
+            dropPending(backup);
+            backup.fail(new IllegalStateException("The world closed before the backup could save it"));
+            return;
+        }
+        boolean autoSave = server.isAutoSave();
+        synchronized (lock) {
+            if (!(pending instanceof RequestedSave requested) || requested.backup() != backup) {
+                // Cancelled, or replaced by the world-exit save; whoever took it failed the backup.
+                return;
+            }
+            pending = null;
+            pauses.computeIfAbsent(server, ignored -> new Pause(autoSave)).captures++;
+        }
+        backup.savedAt(server.tickCount());
+        try {
+            server.saveAll();
+        } catch (RuntimeException failure) {
+            resumeSaving(server);
+            LOGGER.warn("The world could not be saved for a backup: {}", SafeText.from(failure, "no reason", 300));
+            backup.fail(new IllegalStateException("The world could not be saved, so no backup was made. "
+                    + SafeText.from(failure, "", 300)));
+            return;
+        }
+        server.setAutoSave(false);
+        AtomicBoolean paused = new AtomicBoolean(true);
+        Runnable resume = () -> {
+            if (paused.getAndSet(false)) {
+                resumeSaving(server);
+            }
+        };
+        submit(backup, () -> {
+            try {
+                capture(backup, CaptureKind.OPEN_WORLD, listener, resume);
+            } finally {
+                resume.run();
+            }
+        });
+    }
+
+    private void startScheduledBackup(RuntimeState state) {
+        ScheduledRun run;
+        synchronized (lock) {
+            run = dueScheduledRun(state);
+        }
+        if (run == null || run.lastBackupTick() != LiveBackup.NO_TICK && run.server().tickCount() == run.lastBackupTick()) {
+            // Nothing ran on the server since the last backup of this world, so nothing changed.
+            return;
+        }
+        WorldId worldId = run.world().worldId();
+        if (graph.busy(worldId)) {
+            return;
+        }
+        CreateBackupRequest request;
+        switch (TriggerCheck.evaluate(state, resolver.storageIssue(), run.world(),
+                BackupTrigger.SCHEDULED, Optional.empty())) {
+            case TriggerCheck.Decision.Proceed proceed -> request = proceed.request();
+            case TriggerCheck.Decision.Refused refused -> {
+                if (!refused.reason().silentFor(BackupTrigger.SCHEDULED)) {
+                    warn(worldId, BackgroundNotices.scheduledNotMade(refused.message()));
+                }
+                return;
+            }
+        }
+        ConfigurationGate.Permit permit;
+        try {
+            permit = graph.gate().enterWork();
+        } catch (IllegalStateException settingsBeingSaved) {
+            return;
+        }
+        backUpOpenWorld(state, request, ProgressListener.NO_OP, permit).whenComplete((result, failure) -> {
+            Optional<Notice> warning = BackgroundNotices.scheduledOutcome(result, failure);
+            if (warning.isPresent()) {
+                warn(worldId, warning.get());
+            } else if (failure == null) {
+                warnings.remove(worldId);
+            }
+        });
+    }
+
+    /**
+     * The scheduled backup to start now, or null. A due run is used up whether it starts or not, so
+     * missed runs are never replayed; the first run is due one interval after the world opened.
+     */
+    private ScheduledRun dueScheduledRun(RuntimeState state) {
+        Session current = session;
+        if (closed || current == null || current.world == null || current.stopping) {
+            return null;
+        }
+        if (!state.config().triggers().scheduledEnabled()) {
+            current.scheduleInterval = 0;
+            return null;
+        }
+        long interval = TimeUnit.MINUTES.toNanos(state.config().triggers().scheduleIntervalMinutes());
+        long now = nanoTime.getAsLong();
+        if (current.scheduleInterval != interval) {
+            current.scheduleInterval = interval;
+            current.nextScheduled = now + interval;
+            return null;
+        }
+        if (now - current.nextScheduled < 0) {
+            return null;
+        }
+        current.nextScheduled = now + interval;
+        if (pending != null || pauses.containsKey(current.server)) {
+            return null;
+        }
+        return new ScheduledRun(current.server, current.world, current.lastBackupTick);
+    }
+
+    private void startExitBackup(Session ended) {
+        ConfigurationGate.Permit permit;
+        try {
+            permit = graph.gate().enterWork();
+        } catch (IllegalStateException refused) {
+            reports.exitNotMade(BackgroundNotices.exitNotMade(refused.getMessage()));
+            return;
+        }
+        exitBackups.incrementAndGet();
+        try {
+            graph.executor().execute(() -> runExitBackup(ended, permit));
+        } catch (RejectedExecutionException shuttingDown) {
+            exitBackups.decrementAndGet();
+            permit.close();
+            reports.exitNotMade(BackgroundNotices.exitNotMade("WorldArchive is shutting down"));
+        }
+    }
+
+    /** Checks and starts the world-exit backup of a world that just closed; worker thread. */
+    private void runExitBackup(Session ended, ConfigurationGate.Permit permit) {
+        LiveBackup backup = null;
+        try {
+            backup = exitBackup(ended, permit);
+        } catch (IOException | RuntimeException failure) {
+            reports.exitNotMade(BackgroundNotices.exitNotMade(SafeText.from(
+                    failure, "WorldArchive could not read the world's identity", 200)));
+        } finally {
+            if (backup == null) {
+                permit.close();
+                exitBackups.decrementAndGet();
+            }
+        }
+        if (backup != null) {
+            LiveBackup started = backup;
+            BackgroundReports.ExitReport report = reports.exitStarted(started::cancel);
+            started.result.whenComplete((result, failure) -> {
+                exitBackups.decrementAndGet();
+                Notice outcome = BackgroundNotices.exitOutcome(result, failure);
+                report.finished(outcome);
+                if (outcome.severity() == Notice.Severity.SUCCESS) {
+                    warnings.remove(started.worldId());
+                } else {
+                    warnings.put(started.worldId(), outcome);
+                }
+            });
+            // The server stopped, so nothing writes to the world any more: copy it on this worker.
+            try {
+                capture(started, CaptureKind.CLOSED_WORLD, report, () -> { });
+            } catch (RuntimeException | Error unexpected) {
+                started.fail(unexpected);
+                throw unexpected;
+            }
+        }
+    }
+
+    /** The backup to make of a world that just closed; null when there is none, which was reported. */
+    private LiveBackup exitBackup(Session ended, ConfigurationGate.Permit permit) throws IOException {
+        BackupWorldContext world = ended.world;
+        if (world == null) {
+            switch (resolver.resolve(ended.selection)) {
+                case WorldIdentityResolver.Resolution.Resolved resolved -> world = resolved.world();
+                case WorldIdentityResolver.Resolution.Refused refused -> {
+                    reports.exitNotMade(BackgroundNotices.exitNotMade(refused.reason()));
+                    return null;
+                }
+            }
+        }
+        Optional<RuntimeState> current = graph.current();
+        if (current.isEmpty()) {
+            reports.exitNotMade(BackgroundNotices.exitNotMade(
+                    "WorldArchive settings could not be loaded. Open WorldArchive settings to see why"));
+            return null;
+        }
+        RuntimeState state = current.get();
+        switch (TriggerCheck.evaluate(state, resolver.storageIssue(), world,
+                BackupTrigger.WORLD_EXIT, Optional.empty())) {
+            case TriggerCheck.Decision.Proceed proceed -> {
+                return new LiveBackup(ended.server, state, proceed.request(), permit, owner);
+            }
+            case TriggerCheck.Decision.Refused refused -> {
+                if (!refused.reason().silentFor(BackupTrigger.WORLD_EXIT)) {
+                    reports.exitNotMade(BackgroundNotices.exitNotMade(refused.message()));
+                }
+                return null;
+            }
+        }
+    }
+
+    /**
+     * Copies the world on the calling worker, runs {@code afterCopy}, then hands the copy to the
+     * destinations. A cancel during the copy interrupts it; one that arrives before it skips it.
+     */
+    private void capture(LiveBackup backup, CaptureKind kind, ProgressListener listener, Runnable afterCopy) {
+        if (!backup.beginCapture()) {
+            afterCopy.run();
+            backup.fail(LiveBackup.cancellation());
+            return;
+        }
+        PreparedBackup prepared = null;
+        Exception failure = null;
+        try {
+            prepared = backup.state.coordinator().prepareCapture(backup.request, kind, listener);
+        } catch (IOException | InterruptedException | RuntimeException exception) {
+            failure = exception;
+        }
+        boolean proceed = backup.endCapture();
+        afterCopy.run();
+        if (failure instanceof InterruptedException && proceed) {
+            // Not our cancel: the executor is stopping, so keep the interrupt for it.
+            Thread.currentThread().interrupt();
+        }
+        if (!proceed) {
+            closeQuietly(prepared);
+            backup.fail(LiveBackup.cancellation());
+            return;
+        }
+        if (failure != null) {
+            backup.fail(failure);
+            return;
+        }
+        CompletableFuture<BackupResult> operation =
+                backup.state.coordinator().createPreparedBackup(prepared, listener).toCompletableFuture();
+        backup.dispatched(operation);
+        operation.whenComplete(backup::settle);
+    }
+
+    private void submit(LiveBackup backup, Runnable work) {
+        try {
+            graph.executor().execute(() -> {
+                try {
+                    work.run();
+                } catch (RuntimeException | Error unexpected) {
+                    backup.fail(unexpected);
+                    throw unexpected;
+                }
+            });
+        } catch (RejectedExecutionException shuttingDown) {
+            resumeSaving(backup.server);
+            backup.fail(new IllegalStateException("WorldArchive is shutting down"));
+        }
+    }
+
+    /**
+     * Ends a capture's autosave pause; the last capture of a server restores the saving the player
+     * had, on the server thread. The pause stays until then, so a backup requested meanwhile is
+     * refused instead of reading the paused autosave as the player's own.
+     */
+    private void resumeSaving(LiveServer server) {
+        synchronized (lock) {
+            Pause pause = pauses.get(server);
+            if (pause == null || --pause.captures > 0) {
+                return;
+            }
+        }
+        try {
+            server.execute(() -> restoreAutoSave(server));
+        } catch (RejectedExecutionException stopped) {
+            synchronized (lock) {
+                pauses.remove(server);
+            }
+            LOGGER.debug("The server stopped before autosave could be restored");
+        }
+    }
+
+    /** Ends the autosave pause of a server whose captures all ended; server thread. */
+    private void restoreAutoSave(LiveServer server) {
+        boolean restore;
+        boolean running;
+        synchronized (lock) {
+            Pause pause = pauses.get(server);
+            if (pause == null || pause.captures > 0) {
+                return;
+            }
+            pauses.remove(server);
+            restore = pause.autoSaveBefore;
+            running = session != null && session.server.equals(server) && !session.stopping;
+        }
+        // A stopping server turns saving on for its final save by itself; never touch it then.
+        if (server.isServerThread() && running) {
+            server.setAutoSave(restore);
+        }
+    }
+
+    private void backedUpAt(LiveServer server, WorldId worldId, int tick) {
+        synchronized (lock) {
+            if (session != null && session.server.equals(server) && session.world != null
+                    && session.world.worldId().equals(worldId)) {
+                session.lastBackupTick = tick;
+            }
+        }
+    }
+
+    private void warn(WorldId worldId, Notice notice) {
+        warnings.put(worldId, notice);
+        reports.scheduledWarning(notice);
+    }
+
+    /** Starts resolving the open world's identity on a worker, unless that runs, failed recently or was refused. */
+    private void resolve() {
+        Session current;
+        long generation;
+        synchronized (lock) {
+            current = session;
+            if (closed || current == null || current.world != null || current.resolving || current.refused
+                    || nanoTime.getAsLong() - current.nextAttempt < 0) {
+                return;
+            }
+            current.resolving = true;
+            generation = current.generation;
+        }
+        try {
+            graph.executor().execute(() -> resolved(current, generation));
+        } catch (RejectedExecutionException shuttingDown) {
+            synchronized (lock) {
+                current.resolving = false;
+            }
+        }
+    }
+
+    private void resolved(Session resolving, long generation) {
+        WorldIdentityResolver.Resolution resolution = null;
+        Exception failure = null;
+        try {
+            resolution = resolver.resolve(resolving.selection);
+        } catch (IOException | RuntimeException exception) {
+            failure = exception;
+        }
+        String log = null;
+        synchronized (lock) {
+            if (session != resolving || resolving.generation != generation) {
+                return;
+            }
+            resolving.resolving = false;
+            if (resolution instanceof WorldIdentityResolver.Resolution.Resolved resolved) {
+                resolving.world = resolved.world();
+            } else if (resolution instanceof WorldIdentityResolver.Resolution.Refused refused) {
+                resolving.refused = true;
+                log = refused.reason();
+            } else {
+                resolving.nextAttempt = nanoTime.getAsLong() + resolving.retryDelay;
+                resolving.retryDelay = Math.min(resolving.retryDelay * 2, LAST_RETRY_NANOS);
+                if (!resolving.failureLogged) {
+                    resolving.failureLogged = true;
+                    log = SafeText.from(failure, "the identity could not be read", 300) + "; trying again";
+                }
+            }
+        }
+        if (log != null) {
+            LOGGER.warn("WorldArchive does not back up the open world yet: {}", log);
+        }
+    }
+
+    private void dropPending(LiveBackup backup) {
+        synchronized (lock) {
+            if (pending instanceof RequestedSave requested && requested.backup() == backup) {
+                pending = null;
+            }
+        }
+    }
+
+    /** Ends a save that no longer waits for its server: a requested backup fails, a world-exit save reports it. */
+    private void abandon(Pending taken, String reason) {
+        if (taken instanceof RequestedSave requested) {
+            requested.backup().fail(new IllegalStateException(reason));
+        } else if (taken instanceof ExitSave) {
+            reports.exitNotMade(BackgroundNotices.saveMissing());
+        }
+    }
+
+    /** The world as the server names it; a level name with nothing readable falls back to the folder name. */
+    private static BackupWorldSelection selection(LiveServer server) {
+        Path world = server.worldDirectory().toAbsolutePath().normalize();
+        Path saves = world.getParent();
+        Path folder = world.getFileName();
+        if (saves == null || folder == null) {
+            throw new IllegalStateException("The open world has no saves folder");
+        }
+        String levelName = server.levelName() == null ? "" : SafeText.clean(server.levelName(), NAME_LIMIT);
+        return new BackupWorldSelection(
+                world, saves, folder.toString(), levelName.isEmpty() ? folder.toString() : levelName);
+    }
+
+    private static Path realPath(Path world) {
+        try {
+            return world.toRealPath();
+        } catch (IOException missing) {
+            return world;
+        }
+    }
+
+    private static void closeQuietly(PreparedBackup prepared) {
+        if (prepared == null) {
+            return;
+        }
+        try {
+            prepared.close();
+        } catch (IOException exception) {
+            LOGGER.warn("A cancelled world copy could not be removed; the next start removes it: {}",
+                    SafeText.from(exception, "no reason", 300));
+        }
+    }
+
+    /** The world the server runs, from its start until it stopped. Guarded by the lock. */
+    private static final class Session {
+        private final LiveServer server;
+
+        private final BackupWorldSelection selection;
+
+        /** The real folder of the open world; decides whether a world in a list is the open one. */
+        private final Path realWorld;
+
+        private BackupWorldContext world;
+
+        private boolean stopping;
+
+        private boolean resolving;
+
+        private boolean refused;
+
+        private boolean failureLogged;
+
+        private long generation;
+
+        private long nextAttempt;
+
+        private long retryDelay = FIRST_RETRY_NANOS;
+
+        private long scheduleInterval;
+
+        private long nextScheduled;
+
+        private int lastBackupTick = LiveBackup.NO_TICK;
+
+        private Session(LiveServer server, BackupWorldSelection selection, Path realWorld, long now) {
+            this.server = server;
+            this.selection = selection;
+            this.realWorld = realWorld;
+            this.nextAttempt = now;
+        }
+    }
+
+    /** The captures that pause one server's autosave, and the saving the player had before. */
+    private static final class Pause {
+        private final boolean autoSaveBefore;
+
+        private int captures;
+
+        private Pause(boolean autoSaveBefore) {
+            this.autoSaveBefore = autoSaveBefore;
+        }
+    }
+
+    /** A save the server still has to run: one a backup asked for, or the final save of a stopping server. */
+    private sealed interface Pending permits RequestedSave, ExitSave {
+        LiveServer server();
+    }
+
+    /** A manual or scheduled backup waiting for the server thread to save the world. */
+    private record RequestedSave(LiveServer server, LiveBackup backup) implements Pending {
+    }
+
+    /** A stopping server's world-exit backup, waiting for the final save; {@code saved} once it happened. */
+    private record ExitSave(LiveServer server, boolean saved) implements Pending {
+    }
+
+    /** A scheduled backup that is due, and the tick of the world's last backup in this session. */
+    private record ScheduledRun(LiveServer server, BackupWorldContext world, int lastBackupTick) {
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/runtime/Notice.java b/src/main/java/dev/ishaanko/worldarchive/runtime/Notice.java
new file mode 100644
index 0000000..ebea5ff
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/Notice.java
@@ -0,0 +1,23 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import java.util.List;
+import java.util.Objects;
+
+/**
+ * A message for the player about a backup that ran while no WorldArchive screen was open: how
+ * serious it is, a lang key, and the arguments the key's text takes.
+ */
+public record Notice(Severity severity, String key, List<String> arguments) {
+    public Notice {
+        Objects.requireNonNull(severity, "severity");
+        Objects.requireNonNull(key, "key");
+        arguments = List.copyOf(arguments);
+    }
+
+    /** How the client colors the notice. */
+    public enum Severity {
+        SUCCESS,
+        WARNING,
+        ERROR
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationPathGuard.java b/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationPathGuard.java
new file mode 100644
index 0000000..7995d8e
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationPathGuard.java
@@ -0,0 +1,43 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import dev.ishaanko.worldarchive.model.BackupRecord;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.WorldId;
+import java.util.List;
+import java.util.Objects;
+
+/**
+ * Refuses a settings save that would move a backup folder away from the backups the catalog lists
+ * in it: WorldArchive would no longer find them. Folders without listed backups may move freely.
+ */
+final class RuntimeDestinationPathGuard {
+    private RuntimeDestinationPathGuard() {
+    }
+
+    /** Throws when {@code replacement} moves a folder that holds a copy one of {@code records} lists. */
+    static void requireAllowed(
+            RuntimeStoragePaths current,
+            RuntimeStoragePaths replacement,
+            List<BackupRecord> records) {
+        Objects.requireNonNull(current, "current");
+        Objects.requireNonNull(replacement, "replacement");
+        boolean gitMoves = !current.gitRepository().equals(replacement.gitRepository());
+        for (BackupRecord record : records) {
+            WorldId worldId = record.manifest().worldId();
+            if (gitMoves && holds(record, DestinationType.GIT)) {
+                throw new IllegalArgumentException("The Git folder cannot change while it holds backups that"
+                        + " WorldArchive lists. Keep the folder, or delete those backups first.");
+            }
+            if (!current.zipDirectory(worldId).equals(replacement.zipDirectory(worldId))
+                    && holds(record, DestinationType.ZIP)) {
+                throw new IllegalArgumentException("A ZIP folder cannot change while it holds backups that"
+                        + " WorldArchive lists. Keep the folder, or delete those backups first.");
+            }
+        }
+    }
+
+    private static boolean holds(BackupRecord record, DestinationType type) {
+        return record.result().destinations().stream()
+                .anyMatch(result -> result.destination() == type && result.isDurable());
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationSelector.java b/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationSelector.java
new file mode 100644
index 0000000..c7e06a0
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationSelector.java
@@ -0,0 +1,71 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import dev.ishaanko.worldarchive.core.BackupBackend;
+import dev.ishaanko.worldarchive.core.BackupDestinationSelector;
+import dev.ishaanko.worldarchive.core.ConfiguredBackupDestinationSelector;
+import dev.ishaanko.worldarchive.core.CreateBackupRequest;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.concurrent.atomic.AtomicReference;
+
+/**
+ * Picks the destinations of a backup: the ones the settings turn on, without Git until the check
+ * of Git and Git LFS that runs when the settings load has passed. So ZIP backups keep working on a
+ * computer without Git, as the README promises.
+ */
+public final class RuntimeDestinationSelector implements BackupDestinationSelector {
+    private final ConfiguredBackupDestinationSelector configured;
+
+    private final AtomicReference<GitTools> gitTools = new AtomicReference<>(GitTools.UNCHECKED);
+
+    RuntimeDestinationSelector(ConfiguredBackupDestinationSelector configured) {
+        this.configured = Objects.requireNonNull(configured, "configured");
+    }
+
+    /** What the last check found out about Git and Git LFS. */
+    enum GitTools {
+        UNCHECKED,
+        AVAILABLE,
+        MISSING,
+        CHECK_FAILED,
+        TURNED_OFF
+    }
+
+    /**
+     * @throws IllegalArgumentException when the settings bind the request's world identity to
+     *         another folder
+     */
+    @Override
+    public List<BackupBackend> select(CreateBackupRequest request) {
+        return configured.select(request).stream()
+                .filter(backend -> backend.destinationType() != DestinationType.GIT
+                        || gitTools.get() == GitTools.AVAILABLE)
+                .toList();
+    }
+
+    /** True when the settings turn on a destination for the request, whether or not Git works. */
+    boolean hasConfiguredDestination(CreateBackupRequest request) {
+        return !configured.select(Objects.requireNonNull(request, "request")).isEmpty();
+    }
+
+    void gitTools(GitTools checked) {
+        gitTools.set(Objects.requireNonNull(checked, "checked"));
+    }
+
+    GitTools gitTools() {
+        return gitTools.get();
+    }
+
+    /** Why Git backups are off although the settings turn them on; empty when they are not off. */
+    public Optional<String> warning() {
+        return switch (gitTools.get()) {
+            case MISSING -> Optional.of(
+                    "Git backups are off because Git or Git LFS is missing. Install both, then restart the game.");
+            case CHECK_FAILED -> Optional.of(
+                    "Git backups are off because WorldArchive could not check Git. Restart the game to try again.");
+            case UNCHECKED, AVAILABLE, TURNED_OFF -> Optional.empty();
+        };
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeNoticeStore.java b/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeNoticeStore.java
new file mode 100644
index 0000000..535821f
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeNoticeStore.java
@@ -0,0 +1,61 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import dev.ishaanko.worldarchive.support.AtomicFiles;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.function.Consumer;
+
+/**
+ * Keeps one notice across a restart: the one the player could not see because the game closed.
+ * A kept notice is not replaced before it was shown, and it is forgotten only after the display
+ * took it, so a display that fails shows it at the next start instead.
+ */
+public final class RuntimeNoticeStore {
+    private static final int MAXIMUM_BYTES = 1_024;
+
+    private final Path file;
+
+    public RuntimeNoticeStore(Path file) {
+        this.file = Objects.requireNonNull(file, "file").toAbsolutePath().normalize();
+    }
+
+    /** Keeps {@code notice} for the next start, unless a notice that was not shown yet is kept. */
+    public synchronized void keep(Notice notice) throws IOException {
+        if (read().isPresent()) {
+            return;
+        }
+        String text = String.join("\n", notice.severity().name(), notice.key(), String.join("\n", notice.arguments()));
+        AtomicFiles.writeUtf8(file, text + "\n", MAXIMUM_BYTES);
+    }
+
+    /**
+     * Hands the kept notice, if any, to {@code display}, and forgets it once the display returned.
+     * A file this version cannot read, such as the plain text notice of WorldArchive 0.3.9, is removed.
+     */
+    public synchronized void showKept(Consumer<Notice> display) throws IOException {
+        read().ifPresent(display);
+        Files.deleteIfExists(file);
+    }
+
+    private Optional<Notice> read() throws IOException {
+        if (!Files.isRegularFile(file)) {
+            return Optional.empty();
+        }
+        List<String> lines = Arrays.asList(AtomicFiles.readUtf8(file, MAXIMUM_BYTES).split("\n", -1));
+        if (lines.size() < 3) {
+            return Optional.empty();
+        }
+        try {
+            Notice.Severity severity = Notice.Severity.valueOf(lines.get(0));
+            List<String> arguments = lines.subList(2, lines.size()).stream().filter(line -> !line.isEmpty()).toList();
+            return Optional.of(new Notice(severity, lines.get(1), arguments));
+        } catch (IllegalArgumentException damaged) {
+            return Optional.empty();
+        }
+    }
+}
diff --git a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeState.java b/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeState.java
similarity index 66%
rename from src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeState.java
rename to src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeState.java
index a40570e..3b0fbb3 100644
--- a/src/client/java/dev/ishaanko/worldarchive/runtime/RuntimeState.java
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeState.java
@@ -1,38 +1,39 @@
 package dev.ishaanko.worldarchive.runtime;
 
 import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
-import dev.ishaanko.worldarchive.core.CreateBackupRequest;
 import dev.ishaanko.worldarchive.core.SerializedBackupCoordinator;
 import dev.ishaanko.worldarchive.importing.FileBackupImportService;
+import dev.ishaanko.worldarchive.recovery.BackupRecoveryService;
 import dev.ishaanko.worldarchive.storage.git.WorldGitSnapshotStore;
 import dev.ishaanko.worldarchive.storage.management.ManagedStorageService;
 import java.util.Objects;
 
-/** One immutable, internally consistent runtime service graph. */
-record RuntimeState(
+/**
+ * The services built from one version of the settings. {@link ServiceGraph} builds a new state for
+ * each settings change; work that started on an older state finishes there.
+ */
+public record RuntimeState(
         WorldArchiveConfig config,
         RuntimeStoragePaths storagePaths,
-        WorldGitSnapshotStore gitBackend,
+        WorldGitSnapshotStore git,
         RuntimeDestinationSelector selector,
         SerializedBackupCoordinator coordinator,
+        BackupRecoveryService recovery,
         FileBackupImportService imports,
         ManagedStorageService storage) {
-    RuntimeState {
+    public RuntimeState {
         Objects.requireNonNull(config, "config");
         Objects.requireNonNull(storagePaths, "storagePaths");
-        Objects.requireNonNull(gitBackend, "gitBackend");
+        Objects.requireNonNull(git, "git");
         Objects.requireNonNull(selector, "selector");
         Objects.requireNonNull(coordinator, "coordinator");
+        Objects.requireNonNull(recovery, "recovery");
         Objects.requireNonNull(imports, "imports");
         Objects.requireNonNull(storage, "storage");
     }
 
-    boolean enabledDestinations(CreateBackupRequest request) {
-        return !selector.select(request).isEmpty();
-    }
-
+    /** Releases the import previews prepared on this state. */
     void close() {
         imports.close();
-        gitBackend.close();
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeStoragePaths.java b/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeStoragePaths.java
new file mode 100644
index 0000000..cff5764
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeStoragePaths.java
@@ -0,0 +1,45 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.config.WorldConfig;
+import dev.ishaanko.worldarchive.model.WorldId;
+import java.nio.file.Path;
+import java.util.Map;
+import java.util.Objects;
+import java.util.stream.Collectors;
+
+/** The backup folders of one runtime state: the Git root, the ZIP folder, and each world's own ZIP folder. */
+public record RuntimeStoragePaths(
+        Path gitRepository,
+        Path zipDirectory,
+        Map<WorldId, Path> worldZipDirectories) {
+    public RuntimeStoragePaths {
+        gitRepository = normalize(gitRepository, "gitRepository");
+        zipDirectory = normalize(zipDirectory, "zipDirectory");
+        worldZipDirectories = Map.copyOf(Objects.requireNonNull(worldZipDirectories, "worldZipDirectories"));
+    }
+
+    /**
+     * The folders of settings whose default folders are filled in, as
+     * {@link dev.ishaanko.worldarchive.config.DefaultDestinations#resolve} does.
+     */
+    static RuntimeStoragePaths from(WorldArchiveConfig config) {
+        return new RuntimeStoragePaths(
+                config.git().repository().orElseThrow(() -> new IllegalArgumentException("The Git folder is not set")),
+                config.zip().destination().orElseThrow(() -> new IllegalArgumentException("The ZIP folder is not set")),
+                config.worlds().stream()
+                        .filter(world -> world.zipDestination().isPresent())
+                        .collect(Collectors.toUnmodifiableMap(
+                                WorldConfig::worldId,
+                                world -> normalize(world.zipDestination().orElseThrow(), "worldZipDestination"))));
+    }
+
+    /** The ZIP folder of one world: its own folder when it has one, otherwise the shared one. */
+    public Path zipDirectory(WorldId worldId) {
+        return worldZipDirectories.getOrDefault(Objects.requireNonNull(worldId, "worldId"), zipDirectory);
+    }
+
+    private static Path normalize(Path path, String name) {
+        return Objects.requireNonNull(path, name).toAbsolutePath().normalize();
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeZipBackupStores.java b/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeZipBackupStores.java
new file mode 100644
index 0000000..42e988d
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/RuntimeZipBackupStores.java
@@ -0,0 +1,38 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import dev.ishaanko.worldarchive.config.FolderOrigin;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.storage.zip.ZipBackupStore;
+import dev.ishaanko.worldarchive.storage.zip.ZipBackupStoreResolver;
+import java.nio.file.Path;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Objects;
+import java.util.function.Function;
+
+/** The ZIP stores of one runtime state: each world's own ZIP folder, or the shared one. */
+final class RuntimeZipBackupStores implements ZipBackupStoreResolver {
+    private final RuntimeStoragePaths paths;
+
+    /** The origin of each ZIP folder, decided once, because the stores are asked for often. */
+    private final Map<Path, FolderOrigin> origins;
+
+    RuntimeZipBackupStores(RuntimeStoragePaths paths, Function<Path, FolderOrigin> origin) {
+        this.paths = Objects.requireNonNull(paths, "paths");
+        Map<Path, FolderOrigin> decided = new HashMap<>();
+        decided.put(paths.zipDirectory(), origin.apply(paths.zipDirectory()));
+        paths.worldZipDirectories().values().forEach(folder -> decided.computeIfAbsent(folder, origin));
+        this.origins = Map.copyOf(decided);
+    }
+
+    @Override
+    public ZipBackupStore store(WorldId worldId) {
+        Path root = paths.zipDirectory(worldId);
+        return new ZipBackupStore(root, origins.get(root));
+    }
+
+    @Override
+    public ZipBackupStore defaultStore() {
+        return new ZipBackupStore(paths.zipDirectory(), origins.get(paths.zipDirectory()));
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/runtime/ServiceGraph.java b/src/main/java/dev/ishaanko/worldarchive/runtime/ServiceGraph.java
new file mode 100644
index 0000000..342dbff
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/ServiceGraph.java
@@ -0,0 +1,334 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import dev.ishaanko.worldarchive.catalog.FileBackupCatalog;
+import dev.ishaanko.worldarchive.catalog.FileBackupDeletionRegistry;
+import dev.ishaanko.worldarchive.config.DefaultDestinations;
+import dev.ishaanko.worldarchive.config.FolderOrigin;
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.config.WorldConfig;
+import dev.ishaanko.worldarchive.config.WorldIdentityStore;
+import dev.ishaanko.worldarchive.core.ConfiguredBackupDestinationSelector;
+import dev.ishaanko.worldarchive.core.FileSystemBackupCaptureFactory;
+import dev.ishaanko.worldarchive.core.FileWorldInventoryStore;
+import dev.ishaanko.worldarchive.core.LockingWorldOperationGate;
+import dev.ishaanko.worldarchive.core.SerializedBackupCoordinator;
+import dev.ishaanko.worldarchive.importing.FileBackupImportService;
+import dev.ishaanko.worldarchive.importing.FileImportSourceRegistry;
+import dev.ishaanko.worldarchive.model.SafeText;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.recovery.BackupRecoveryService;
+import dev.ishaanko.worldarchive.recovery.RestoredWorldMetadataFinalizer;
+import dev.ishaanko.worldarchive.storage.git.GitBackendSettings;
+import dev.ishaanko.worldarchive.storage.git.SystemGitCommandRunner;
+import dev.ishaanko.worldarchive.storage.git.WorldGitSnapshotStore;
+import dev.ishaanko.worldarchive.storage.management.FileStorageHistoryStore;
+import dev.ishaanko.worldarchive.storage.management.ManagedStorageService;
+import dev.ishaanko.worldarchive.storage.zip.ZipBackupBackend;
+import dev.ishaanko.worldarchive.storage.zip.ZipBackupStoreResolver;
+import dev.ishaanko.worldarchive.support.AsyncTasks;
+import java.io.IOException;
+import java.nio.file.Path;
+import java.time.Clock;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CompletionStage;
+import java.util.concurrent.ExecutorService;
+import java.util.stream.Collectors;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * WorldArchive's backup engine as the game runs it. It keeps what lives as long as the game: the
+ * catalog, the change inventories, the world captures, the per-world gates and the worker
+ * executor. From each version of the settings it builds a {@link RuntimeState} of services. New
+ * work uses the newest state; work that started on an older state finishes there, and older states
+ * are closed once no work holds a {@link ConfigurationGate} permit. The e2e tests build the engine
+ * through this class as well.
+ */
+public final class ServiceGraph {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
+    private static final int MESSAGE_LIMIT = 512;
+
+    private final DefaultDestinations defaults;
+
+    private final FileBackupCatalog catalog;
+
+    private final FileWorldInventoryStore inventories;
+
+    private final FileSystemBackupCaptureFactory captures;
+
+    private final WorldIdentityStore identities = new WorldIdentityStore();
+
+    private final FileImportSourceRegistry importSources;
+
+    private final FileBackupDeletionRegistry deletions;
+
+    private final FileStorageHistoryStore history;
+
+    private final LockingWorldOperationGate captureMutex = new LockingWorldOperationGate();
+
+    private final LockingWorldOperationGate operationGate = new LockingWorldOperationGate();
+
+    private final RestoredWorldMetadataFinalizer finalizer;
+
+    private final ExecutorService executor;
+
+    private final Clock clock;
+
+    private final ConfigurationGate gate;
+
+    /** The state new work uses; written under this object's lock, read without it every client tick. */
+    private volatile RuntimeState current;
+
+    // Guarded by this: every state that is not closed yet.
+    private final List<RuntimeState> open = new ArrayList<>();
+
+    private boolean closed;
+
+    /**
+     * @param storageRoot WorldArchive's folder in the game directory
+     * @param captures copies worlds into {@code capture-temp} in {@code storageRoot}
+     * @param finalizer gives a restored world the name the player chose
+     * @param executor runs all background work; it belongs to the caller, who also stops it
+     * @param clock the clock of backup times; its zone decides the local days of the storage history
+     */
+    public ServiceGraph(
+            Path storageRoot,
+            FileSystemBackupCaptureFactory captures,
+            RestoredWorldMetadataFinalizer finalizer,
+            ExecutorService executor,
+            Clock clock) {
+        Path root = Objects.requireNonNull(storageRoot, "storageRoot").toAbsolutePath().normalize();
+        this.captures = Objects.requireNonNull(captures, "captures");
+        this.finalizer = Objects.requireNonNull(finalizer, "finalizer");
+        this.executor = Objects.requireNonNull(executor, "executor");
+        this.clock = Objects.requireNonNull(clock, "clock");
+        this.defaults = new DefaultDestinations(root);
+        this.catalog = new FileBackupCatalog(root.resolve("catalog.json"));
+        this.inventories = new FileWorldInventoryStore(root.resolve("inventories"));
+        this.importSources = new FileImportSourceRegistry(root.resolve("import-sources.json"));
+        this.deletions = new FileBackupDeletionRegistry(root.resolve("deleted-backups.txt"));
+        this.history = new FileStorageHistoryStore(root.resolve("storage-history"));
+        // The last permit may be released on the render thread, and closing a state deletes its
+        // import previews, so a worker closes the retired states.
+        this.gate = new ConfigurationGate(() -> AsyncTasks.run(executor, this::closeRetiredStates));
+    }
+
+    /** The state new work uses; empty until the settings first load. */
+    public Optional<RuntimeState> current() {
+        return Optional.ofNullable(current);
+    }
+
+    /**
+     * Builds the services for {@code config}, with default folders filled in, and routes new work
+     * to them. Returns the new state, or empty when the settings did not change.
+     */
+    public synchronized Optional<RuntimeState> install(WorldArchiveConfig config) {
+        if (closed) {
+            throw new IllegalStateException("WorldArchive is shutting down");
+        }
+        WorldArchiveConfig resolved = defaults.resolve(Objects.requireNonNull(config, "config"));
+        if (current != null && current.config().equals(resolved)) {
+            return Optional.empty();
+        }
+        RuntimeState state = build(resolved);
+        current = state;
+        open.add(state);
+        return Optional.of(state);
+    }
+
+    /**
+     * Readies a state that {@link #install} just built. The Git tools are checked again unless the
+     * previous state checked them with the same Git settings, and the catalog learns the backups
+     * the folders hold only when the folders changed, such as at the first load. The catalog scan
+     * holds a work permit, so a settings save cannot move the folders while it runs.
+     */
+    public CompletionStage<Void> prime(Optional<RuntimeState> previous, RuntimeState state) {
+        CompletableFuture<Void> tools = previous
+                .filter(before -> before.config().git().equals(state.config().git())
+                        && before.selector().gitTools() != RuntimeDestinationSelector.GitTools.UNCHECKED)
+                .map(before -> {
+                    state.selector().gitTools(before.selector().gitTools());
+                    return CompletableFuture.<Void>completedFuture(null);
+                })
+                .orElseGet(() -> checkGitTools(state).toCompletableFuture());
+        if (previous.filter(before -> before.storagePaths().equals(state.storagePaths())).isPresent()) {
+            return tools;
+        }
+        ConfigurationGate.Permit permit = gate.enterSettingsWork();
+        CompletableFuture<Void> scan = state.imports().rebuildLocal().handle((summary, failure) -> {
+            if (failure != null) {
+                LOGGER.warn("WorldArchive could not list the backups in its folders: {}",
+                        SafeText.from(failure, "the folders could not be read", MESSAGE_LIMIT));
+            } else if (summary.conflicts() > 0 || summary.issues() > 0) {
+                LOGGER.warn("WorldArchive listed the backups in its folders with problems: {}", summary.message());
+            }
+            return (Void) null;
+        }).toCompletableFuture();
+        scan.whenComplete((ignored, failure) -> permit.close());
+        return CompletableFuture.allOf(tools, scan);
+    }
+
+    /** Checks Git and Git LFS for a state, so its backups use Git only when both work. */
+    public CompletionStage<Void> checkGitTools(RuntimeState state) {
+        if (!state.config().git().enabled()) {
+            state.selector().gitTools(RuntimeDestinationSelector.GitTools.TURNED_OFF);
+            return CompletableFuture.completedFuture(null);
+        }
+        return state.git().probeTools().handle((health, failure) -> {
+            if (failure != null) {
+                LOGGER.warn("WorldArchive could not check Git: {}",
+                        SafeText.from(failure, "the check failed", MESSAGE_LIMIT));
+                state.selector().gitTools(RuntimeDestinationSelector.GitTools.CHECK_FAILED);
+            } else {
+                state.selector().gitTools(health.available()
+                        ? RuntimeDestinationSelector.GitTools.AVAILABLE
+                        : RuntimeDestinationSelector.GitTools.MISSING);
+            }
+            return null;
+        });
+    }
+
+    /**
+     * Admits a settings change before it is saved. A change that moves a backup folder takes the
+     * folder-change permit, which is refused while backup work runs, and is refused when the
+     * catalog lists backups in a folder that would move. The returned release runs once the change
+     * was saved and published.
+     *
+     * @throws IllegalStateException when backup work runs or the catalog cannot be read
+     * @throws IllegalArgumentException when the change would move a folder away from its backups
+     */
+    public Runnable admitSettingsChange(WorldArchiveConfig config) {
+        Optional<RuntimeState> state = current();
+        if (state.isEmpty()) {
+            return () -> { };
+        }
+        RuntimeStoragePaths before = state.get().storagePaths();
+        RuntimeStoragePaths after = RuntimeStoragePaths.from(defaults.resolve(config));
+        if (before.equals(after)) {
+            return () -> { };
+        }
+        ConfigurationGate.Permit permit = gate.enterFolderChange();
+        try {
+            RuntimeDestinationPathGuard.requireAllowed(before, after, catalog.listAll());
+            return permit::close;
+        } catch (IOException failure) {
+            permit.close();
+            throw new IllegalStateException("The backup folders cannot change now, because the backup list could"
+                    + " not be read: " + SafeText.from(failure, "no reason was given", MESSAGE_LIMIT), failure);
+        } catch (RuntimeException failure) {
+            permit.close();
+            throw failure;
+        }
+    }
+
+    /** True while a backup of the world captures, waits or writes on any state. */
+    public boolean busy(WorldId worldId) {
+        return openStates().stream().anyMatch(state -> state.coordinator().isBusy(worldId));
+    }
+
+    /** Stops routing work and releases every state; work already running is not stopped here. */
+    public void close() {
+        List<RuntimeState> closing;
+        synchronized (this) {
+            closed = true;
+            current = null;
+            closing = List.copyOf(open);
+            open.clear();
+        }
+        closing.forEach(ServiceGraph::closeQuietly);
+    }
+
+    public ConfigurationGate gate() {
+        return gate;
+    }
+
+    public FileBackupCatalog catalog() {
+        return catalog;
+    }
+
+    public WorldIdentityStore identities() {
+        return identities;
+    }
+
+    public FileSystemBackupCaptureFactory captures() {
+        return captures;
+    }
+
+    public ExecutorService executor() {
+        return executor;
+    }
+
+    private synchronized List<RuntimeState> openStates() {
+        return List.copyOf(open);
+    }
+
+    /** Closes the states that no work can use any more: every state but the current one. */
+    private void closeRetiredStates() {
+        List<RuntimeState> retired;
+        synchronized (this) {
+            retired = open.stream().filter(state -> state != current).toList();
+            open.removeAll(retired);
+        }
+        retired.forEach(ServiceGraph::closeQuietly);
+    }
+
+    private static void closeQuietly(RuntimeState state) {
+        try {
+            state.close();
+        } catch (RuntimeException exception) {
+            LOGGER.warn("WorldArchive could not release old services: {}",
+                    SafeText.from(exception, "they could not be closed", MESSAGE_LIMIT));
+        }
+    }
+
+    /**
+     * Whether a backup folder is one of WorldArchive's default folders, which a backup creates
+     * when needed, or one the player chose; a folder whose place cannot be read counts as chosen.
+     */
+    private FolderOrigin origin(Path folder) {
+        try {
+            return defaults.origin(folder);
+        } catch (IOException unreadable) {
+            return FolderOrigin.CHOSEN;
+        }
+    }
+
+    private RuntimeState build(WorldArchiveConfig config) {
+        RuntimeStoragePaths paths = RuntimeStoragePaths.from(config);
+        WorldGitSnapshotStore git = new WorldGitSnapshotStore(
+                GitBackendSettings.from(config.git(), origin(paths.gitRepository())),
+                config.worlds().stream()
+                        .filter(world -> world.remoteUrl().isPresent())
+                        .collect(Collectors.toUnmodifiableMap(WorldConfig::worldId, world -> world.remoteUrl().get())),
+                new SystemGitCommandRunner(),
+                executor);
+        ZipBackupStoreResolver zipStores = new RuntimeZipBackupStores(paths, this::origin);
+        RuntimeDestinationSelector selector = new RuntimeDestinationSelector(new ConfiguredBackupDestinationSelector(
+                () -> config, List.of(git, new ZipBackupBackend(zipStores))));
+        Set<WorldId> configuredWorlds = config.worlds().stream()
+                .map(WorldConfig::worldId)
+                .collect(Collectors.toUnmodifiableSet());
+        return new RuntimeState(
+                config,
+                paths,
+                git,
+                selector,
+                new SerializedBackupCoordinator(
+                        catalog, captures, inventories, selector, captureMutex, operationGate, executor, clock),
+                new BackupRecoveryService(
+                        catalog, git, zipStores, importSources, deletions, identities, finalizer, executor,
+                        operationGate, clock),
+                new FileBackupImportService(
+                        catalog, importSources, deletions, git, zipStores, () -> configuredWorlds, operationGate,
+                        executor, clock),
+                new ManagedStorageService(
+                        () -> config, catalog, deletions, git, zipStores, history, operationGate, executor, clock,
+                        clock.getZone()));
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/runtime/TriggerCheck.java b/src/main/java/dev/ishaanko/worldarchive/runtime/TriggerCheck.java
new file mode 100644
index 0000000..20c9909
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/TriggerCheck.java
@@ -0,0 +1,112 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import dev.ishaanko.worldarchive.config.DestinationTriggerConfig;
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.core.CreateBackupRequest;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
+import java.util.Objects;
+import java.util.Optional;
+
+/**
+ * The one rule for whether a manual, scheduled or world-exit backup of a world may start now.
+ * Triggers differ only in what they do with a refusal: a manual backup reports every refusal, while
+ * a scheduled or world-exit backup stays silent when the player turned it off.
+ */
+public final class TriggerCheck {
+    private TriggerCheck() {
+    }
+
+    /** Why a backup may not start. */
+    public enum Reason {
+        /** A backup folder is inside a known world. */
+        STORAGE_PROBLEM,
+        /** The settings link the world's identity to another folder. */
+        IDENTITY_ELSEWHERE,
+        /** The player turned backups off for this world. */
+        WORLD_OFF,
+        /** No destination takes backups from this trigger. */
+        TRIGGER_OFF,
+        /** Only Git takes this trigger, and Git or Git LFS is missing. */
+        GIT_MISSING;
+
+        /** True when the refusal follows the player's own settings, so the trigger reports nothing. */
+        public boolean silentFor(BackupTrigger trigger) {
+            return trigger != BackupTrigger.MANUAL && (this == WORLD_OFF || this == TRIGGER_OFF);
+        }
+    }
+
+    /** The outcome of a check: the request to run, or why none may start. */
+    public sealed interface Decision {
+        /** The backup may start with this request. */
+        record Proceed(CreateBackupRequest request) implements Decision {
+            public Proceed {
+                Objects.requireNonNull(request, "request");
+            }
+        }
+
+        /** The backup may not start; {@code message} says why, for the player. */
+        record Refused(Reason reason, String message) implements Decision {
+            public Refused {
+                Objects.requireNonNull(reason, "reason");
+                Objects.requireNonNull(message, "message");
+            }
+        }
+    }
+
+    /**
+     * Decides whether {@code trigger} may back up {@code world} with the services of {@code state}.
+     *
+     * @param storageIssue why backups are paused, from {@link WorldIdentityResolver#storageIssue()}
+     */
+    public static Decision evaluate(
+            RuntimeState state,
+            Optional<String> storageIssue,
+            BackupWorldContext world,
+            BackupTrigger trigger,
+            Optional<String> label) {
+        if (storageIssue.isPresent()) {
+            return new Decision.Refused(Reason.STORAGE_PROBLEM, storageIssue.get());
+        }
+        CreateBackupRequest request = new CreateBackupRequest(
+                world.worldId(), world.worldDirectory(), world.displayName(), label, trigger);
+        boolean selected;
+        try {
+            selected = !state.selector().select(request).isEmpty();
+        } catch (IllegalArgumentException identityElsewhere) {
+            return new Decision.Refused(Reason.IDENTITY_ELSEWHERE, "WorldArchive settings link this world's backups"
+                    + " to another folder. Open the world list once so WorldArchive can update them, then try again.");
+        }
+        if (selected) {
+            return new Decision.Proceed(request);
+        }
+        if (state.config().world(world.worldId()).filter(configured -> !configured.enabled()).isPresent()) {
+            return new Decision.Refused(Reason.WORLD_OFF, "Backups are off for this world in WorldArchive settings.");
+        }
+        if (state.selector().hasConfiguredDestination(request)) {
+            return new Decision.Refused(Reason.GIT_MISSING, state.selector().warning()
+                    .orElse("Git backups are off until WorldArchive has checked Git. Try again in a moment."));
+        }
+        return new Decision.Refused(Reason.TRIGGER_OFF, "No backup destination takes " + name(trigger)
+                + " backups. Turn one on in WorldArchive settings.");
+    }
+
+    /** True when some destination takes backups from {@code trigger}, whatever the world. */
+    public static boolean anyDestinationTakes(WorldArchiveConfig config, BackupTrigger trigger) {
+        return config.triggers().enabledFor(trigger)
+                && (takes(config.git().enabled(), config.git().triggers(), trigger)
+                        || takes(config.zip().enabled(), config.zip().triggers(), trigger));
+    }
+
+    private static boolean takes(boolean enabled, DestinationTriggerConfig triggers, BackupTrigger trigger) {
+        return enabled && triggers.enabledFor(trigger);
+    }
+
+    private static String name(BackupTrigger trigger) {
+        return switch (trigger) {
+            case MANUAL -> "manual";
+            case SCHEDULED -> "scheduled";
+            case WORLD_EXIT -> "world-exit";
+        };
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/runtime/WorldIdentityResolver.java b/src/main/java/dev/ishaanko/worldarchive/runtime/WorldIdentityResolver.java
new file mode 100644
index 0000000..be16a38
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/runtime/WorldIdentityResolver.java
@@ -0,0 +1,229 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.config.WorldConfig;
+import dev.ishaanko.worldarchive.config.WorldIdentityStore;
+import dev.ishaanko.worldarchive.model.SafeText;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.settings.WorldFolderDiscovery;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldSelection;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.stream.Collectors;
+
+/**
+ * Finds the WorldArchive identity of a world the game lists or opens, and keeps one folder per
+ * identity for the game session. A world is keyed by its real folder: a saves folder or a world
+ * folder that is a link or junction is followed, the way the settings list worlds; links inside a
+ * world stay refused by the capture. A folder that copies a world still found in its own folder is
+ * refused, and the settings scan then gives the copy an identity of its own.
+ *
+ * <p>The claims start from the settings on each change ({@link #configure}), and the settings
+ * always win. Resolving reads the disk on the caller's thread, so call it from a worker; the
+ * checks that the render thread makes read memory only.</p>
+ */
+public final class WorldIdentityResolver {
+    private static final int MESSAGE_LIMIT = 300;
+
+    private final Path savesDirectory;
+
+    private final WorldIdentityStore identities;
+
+    private final Listener listener;
+
+    // Guarded by this. Each world's folder and each folder's world, the two kept in step.
+    private final Map<WorldId, Path> pathsByWorld = new HashMap<>();
+
+    private final Map<Path, WorldId> worldsByPath = new HashMap<>();
+
+    private Map<WorldId, Path> configured = Map.of();
+
+    private WorldArchiveConfig settings;
+
+    /** Changes with the settings and with every claim, so a storage check knows when it is out of date. */
+    private long version;
+
+    private Optional<String> storageIssue = Optional.empty();
+
+    /**
+     * @param savesDirectory the saves folder as the game names it
+     * @param listener learns what the settings should record
+     */
+    public WorldIdentityResolver(Path savesDirectory, WorldIdentityStore identities, Listener listener) {
+        this.savesDirectory = Objects.requireNonNull(savesDirectory, "savesDirectory").toAbsolutePath().normalize();
+        this.identities = Objects.requireNonNull(identities, "identities");
+        this.listener = Objects.requireNonNull(listener, "listener");
+    }
+
+    /** What the settings should learn about the worlds the resolver meets. */
+    public interface Listener {
+        /** A world was found in a folder the settings do not list for it. */
+        void found(WorldId worldId, Path worldDirectory);
+
+        /** A folder copies a world that is still in its own folder; a settings scan gives the copy its own identity. */
+        void copyFound(Path copy);
+    }
+
+    /** The outcome of {@link #resolve}: the world, or why WorldArchive does not back it up. */
+    public sealed interface Resolution {
+        /** The world and its identity. */
+        record Resolved(BackupWorldContext world) implements Resolution {
+            public Resolved {
+                Objects.requireNonNull(world, "world");
+            }
+        }
+
+        /** A reason the player can read; asking again gives the same answer until the settings change. */
+        record Refused(String reason) implements Resolution {
+            public Refused {
+                Objects.requireNonNull(reason, "reason");
+            }
+        }
+    }
+
+    /** True when the game keeps the world directly in the saves folder, where WorldArchive backs worlds up. */
+    public boolean inSaves(BackupWorldSelection selection) {
+        return WorldFolderDiscovery.isDirectChild(savesDirectory, selection.worldDirectory());
+    }
+
+    /**
+     * Finds the identity of the selected world, creating one for a world that has none, and
+     * claims its real folder for it.
+     *
+     * @throws IOException when the world's identity file cannot be read or written
+     */
+    public Resolution resolve(BackupWorldSelection selection) throws IOException {
+        if (!inSaves(selection)) {
+            return new Resolution.Refused("WorldArchive backs up only the worlds in the saves folder.");
+        }
+        Optional<Path> world = WorldFolderDiscovery.realWorld(selection.worldDirectory());
+        if (world.isEmpty()) {
+            return new Resolution.Refused("This folder has no level.dat, so it is not a world WorldArchive can back up.");
+        }
+        WorldId worldId = identities.loadOrCreate(world.get());
+        if (!register(worldId, world.get())) {
+            listener.copyFound(world.get());
+            return new Resolution.Refused("This world is a copy of another world. WorldArchive gives the copy its"
+                    + " own backups in a moment; try again then.");
+        }
+        return new Resolution.Resolved(new BackupWorldContext(
+                worldId, world.get(), selection.worldsDirectory(), selection.storageName(), selection.displayName()));
+    }
+
+    /**
+     * Claims {@code worldDirectory}, which carries {@code worldId}, for that identity. The claim is
+     * refused while another folder still carries the identity: this folder is then a copy. A claim
+     * whose folder is gone, or carries another identity now, is stale and released.
+     */
+    public boolean register(WorldId worldId, Path worldDirectory) {
+        Path world = Objects.requireNonNull(worldDirectory, "worldDirectory").toAbsolutePath().normalize();
+        boolean unlisted;
+        boolean moved;
+        synchronized (this) {
+            Path claimed = pathsByWorld.get(Objects.requireNonNull(worldId, "worldId"));
+            if (claimed != null && !claimed.equals(world) && carries(claimed, worldId)) {
+                return false;
+            }
+            long before = version;
+            claim(worldId, world);
+            moved = version != before;
+            unlisted = !world.equals(configured.get(worldId));
+        }
+        if (moved) {
+            checkStorage();
+        }
+        if (unlisted) {
+            listener.found(worldId, world);
+        }
+        return true;
+    }
+
+    /** Starts the claims from the settings, which win over every earlier claim, and checks the backup folders. */
+    public void configure(WorldArchiveConfig config) {
+        synchronized (this) {
+            settings = config;
+            configured = config.worlds().stream().collect(Collectors.toUnmodifiableMap(
+                    WorldConfig::worldId, world -> world.path().toAbsolutePath().normalize()));
+            configured.forEach(this::claim);
+            version++;
+        }
+        checkStorage();
+    }
+
+    /** True when the world's folder is the one claimed for its identity. */
+    public synchronized boolean isRegistered(WorldId worldId, Path worldDirectory) {
+        Path world = worldDirectory.toAbsolutePath().normalize();
+        return world.equals(pathsByWorld.get(worldId)) && worldId.equals(worldsByPath.get(world));
+    }
+
+    /**
+     * Why backups must stop because a backup folder is inside a known world; empty when none is.
+     * The answer comes from the last check, which runs when the settings or the known worlds change.
+     */
+    public synchronized Optional<String> storageIssue() {
+        return storageIssue;
+    }
+
+    /** Checks the backup folders of the settings against every known world; the disk is read outside the lock. */
+    private void checkStorage() {
+        WorldArchiveConfig checked;
+        List<Path> worlds;
+        long checkedAt;
+        synchronized (this) {
+            if (settings == null) {
+                return;
+            }
+            checked = settings;
+            worlds = List.copyOf(worldsByPath.keySet());
+            checkedAt = version;
+        }
+        Optional<String> issue;
+        try {
+            checked.validateDestinations(worlds);
+            issue = Optional.empty();
+        } catch (IOException failure) {
+            issue = Optional.of("Backups are paused: " + SafeText.from(failure, "a backup folder is inside a world",
+                    MESSAGE_LIMIT) + ". Choose another backup folder in WorldArchive settings.");
+        }
+        synchronized (this) {
+            if (version == checkedAt) {
+                storageIssue = issue;
+            }
+        }
+    }
+
+    private void claim(WorldId worldId, Path world) {
+        Path previousPath = pathsByWorld.put(worldId, world);
+        if (previousPath != null && !previousPath.equals(world)) {
+            worldsByPath.remove(previousPath, worldId);
+        }
+        WorldId previousWorld = worldsByPath.put(world, worldId);
+        if (previousWorld != null && !previousWorld.equals(worldId)) {
+            pathsByWorld.remove(previousWorld, world);
+        }
+        if (!world.equals(previousPath)) {
+            version++;
+        }
+    }
+
+    /** True unless the folder is gone or carries another identity; a folder that cannot be read still counts. */
+    private boolean carries(Path folder, WorldId worldId) {
+        if (!Files.isDirectory(folder)) {
+            return false;
+        }
+        try {
+            return identities.loadExisting(folder)
+                    .map(identity -> identity.worldId().equals(worldId))
+                    .orElse(false);
+        } catch (IOException exception) {
+            return true;
+        }
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/CancellableRequest.java b/src/main/java/dev/ishaanko/worldarchive/settings/CancellableRequest.java
deleted file mode 100644
index 7cfc583..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/settings/CancellableRequest.java
+++ /dev/null
@@ -1,16 +0,0 @@
-package dev.ishaanko.worldarchive.settings;
-
-import java.util.Objects;
-import java.util.concurrent.CompletionStage;
-
-/** Completion plus explicit cancellation for debounced background work. */
-public record CancellableRequest<T>(CompletionStage<T> completion, Runnable cancellation) {
-    public CancellableRequest {
-        Objects.requireNonNull(completion, "completion");
-        Objects.requireNonNull(cancellation, "cancellation");
-    }
-
-    public void cancel() {
-        cancellation.run();
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/DiscoveredWorld.java b/src/main/java/dev/ishaanko/worldarchive/settings/DiscoveredWorld.java
index 879de8b..3cd2450 100644
--- a/src/main/java/dev/ishaanko/worldarchive/settings/DiscoveredWorld.java
+++ b/src/main/java/dev/ishaanko/worldarchive/settings/DiscoveredWorld.java
@@ -1,37 +1,13 @@
 package dev.ishaanko.worldarchive.settings;
 
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.nio.file.Path;
 import java.util.Objects;
-import java.util.Optional;
 
-/** One off-thread world identity discovery outcome. */
-public record DiscoveredWorld(Path path, Optional<WorldId> worldId, Optional<String> error) {
+/** A world folder found on disk and the identity it carries. */
+public record DiscoveredWorld(Path path, WorldId worldId) {
     public DiscoveredWorld {
         path = Objects.requireNonNull(path, "path").toAbsolutePath().normalize();
-        worldId = Objects.requireNonNull(worldId, "worldId");
-        error = Objects.requireNonNull(error, "error").map(DiscoveredWorld::safeError);
-        if (worldId.isPresent() == error.isPresent()) {
-            throw new IllegalArgumentException("A discovered world must contain either an identity or an error");
-        }
-    }
-
-    public static DiscoveredWorld success(Path path, WorldId worldId) {
-        return new DiscoveredWorld(path, Optional.of(worldId), Optional.empty());
-    }
-
-    public static DiscoveredWorld failure(Path path, String error) {
-        return new DiscoveredWorld(path, Optional.empty(), Optional.of(error));
-    }
-
-    private static String safeError(String error) {
-        String redacted = SensitiveDataRedactor.redact(Objects.requireNonNull(error, "error")).strip();
-        if (redacted.isEmpty()
-                || redacted.length() > 512
-                || redacted.chars().anyMatch(Character::isISOControl)) {
-            throw new IllegalArgumentException("World discovery error is invalid");
-        }
-        return redacted;
+        Objects.requireNonNull(worldId, "worldId");
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/FolderSelectionController.java b/src/main/java/dev/ishaanko/worldarchive/settings/FolderSelectionController.java
deleted file mode 100644
index cca590d..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/settings/FolderSelectionController.java
+++ /dev/null
@@ -1,62 +0,0 @@
-package dev.ishaanko.worldarchive.settings;
-
-import java.nio.file.Path;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Prevents cancelled, failed, or stale native picker results from replacing typed paths. */
-public final class FolderSelectionController {
-    private long revision;
-
-    public synchronized Request begin(String currentValue) {
-        Objects.requireNonNull(currentValue, "currentValue");
-        long requestRevision = ++revision;
-        return new Request(requestRevision, SettingsPaths.parseAbsolute(currentValue));
-    }
-
-    public synchronized void noteManualEdit() {
-        revision++;
-    }
-
-    public synchronized Application apply(
-            Request request,
-            FolderSelectionResult result,
-            String currentValue) {
-        Objects.requireNonNull(request, "request");
-        Objects.requireNonNull(result, "result");
-        Objects.requireNonNull(currentValue, "currentValue");
-        if (request.revision() != revision) {
-            return new Application(false, currentValue, Optional.empty());
-        }
-        revision++;
-        return switch (result) {
-            case FolderSelectionResult.Selected selected ->
-                    new Application(true, selected.path().toString(), Optional.empty());
-            case FolderSelectionResult.Cancelled ignored ->
-                    new Application(true, currentValue, Optional.empty());
-            case FolderSelectionResult.Unavailable unavailable ->
-                    new Application(true, currentValue, Optional.of(unavailable.message()));
-            case FolderSelectionResult.Failed failed ->
-                    new Application(true, currentValue, Optional.of(failed.message()));
-        };
-    }
-
-    public record Request(long revision, Optional<Path> initialDirectory) {
-        public Request {
-            if (revision < 1) {
-                throw new IllegalArgumentException("Folder picker revision must be positive");
-            }
-            Objects.requireNonNull(initialDirectory, "initialDirectory");
-        }
-    }
-
-    public record Application(
-            boolean applied,
-            String value,
-            Optional<String> message) {
-        public Application {
-            Objects.requireNonNull(value, "value");
-            Objects.requireNonNull(message, "message");
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/FolderSelectionResult.java b/src/main/java/dev/ishaanko/worldarchive/settings/FolderSelectionResult.java
deleted file mode 100644
index aa8bcb8..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/settings/FolderSelectionResult.java
+++ /dev/null
@@ -1,44 +0,0 @@
-package dev.ishaanko.worldarchive.settings;
-
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
-import java.nio.file.Path;
-import java.util.Objects;
-
-/** Credential-free outcome of a platform folder picker. */
-public sealed interface FolderSelectionResult {
-    /** The user selected a directory. */
-    record Selected(Path path) implements FolderSelectionResult {
-        public Selected {
-            path = Objects.requireNonNull(path, "path").toAbsolutePath().normalize();
-        }
-    }
-
-    /** The user intentionally dismissed the picker. */
-    record Cancelled() implements FolderSelectionResult {
-    }
-
-    /** No native picker is available on this runtime. */
-    record Unavailable(String message) implements FolderSelectionResult {
-        public Unavailable {
-            message = requireSafeMessage(message);
-        }
-    }
-
-    /** The picker failed without changing the current setting. */
-    record Failed(String message) implements FolderSelectionResult {
-        public Failed {
-            message = requireSafeMessage(message);
-        }
-    }
-
-    private static String requireSafeMessage(String message) {
-        Objects.requireNonNull(message, "message");
-        String normalized = SensitiveDataRedactor.redact(message).strip();
-        if (normalized.isEmpty()
-                || normalized.length() > 512
-                || normalized.chars().anyMatch(Character::isISOControl)) {
-            throw new IllegalArgumentException("Folder picker message is invalid");
-        }
-        return normalized;
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/NativeFolderChooser.java b/src/main/java/dev/ishaanko/worldarchive/settings/NativeFolderChooser.java
deleted file mode 100644
index 7324d92..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/settings/NativeFolderChooser.java
+++ /dev/null
@@ -1,12 +0,0 @@
-package dev.ishaanko.worldarchive.settings;
-
-import java.nio.file.Path;
-import java.util.Optional;
-
-/** Non-blocking, best-effort cancellable platform folder selection contract. */
-@FunctionalInterface
-public interface NativeFolderChooser {
-    CancellableRequest<FolderSelectionResult> chooseFolder(
-            String title,
-            Optional<Path> initialDirectory);
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsDefaults.java b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsDefaults.java
deleted file mode 100644
index 3eff8b2..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsDefaults.java
+++ /dev/null
@@ -1,84 +0,0 @@
-package dev.ishaanko.worldarchive.settings;
-
-import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
-import dev.ishaanko.worldarchive.config.GitDestinationConfig;
-import dev.ishaanko.worldarchive.config.WorldConfig;
-import dev.ishaanko.worldarchive.config.ZipDestinationConfig;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Resolves operational destination defaults beside the WorldArchive configuration. */
-public final class SettingsDefaults {
-    private static final String GIT_REPOSITORY_DIRECTORY_NAME = "git";
-
-    private static final String ZIP_DIRECTORY_NAME = "archives";
-
-    private final Path storageRoot;
-
-    public SettingsDefaults(Path storageRoot) {
-        this.storageRoot = Objects.requireNonNull(storageRoot, "storageRoot")
-                .toAbsolutePath()
-                .normalize();
-    }
-
-    public WorldArchiveConfig resolve(WorldArchiveConfig config) {
-        Objects.requireNonNull(config, "config");
-        GitDestinationConfig git = config.git();
-        ZipDestinationConfig zip = config.zip();
-        return new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                config.triggers(),
-                new GitDestinationConfig(
-                        git.enabled(),
-                        git.repository().or(() -> Optional.of(gitRepository())),
-                        git.remoteName(),
-                        git.remoteUrl(),
-                        git.triggers(),
-                        git.lfsPatterns(),
-                        git.health(),
-                        git.legacyRepository(),
-                        git.legacyRemoteUrl()),
-                new ZipDestinationConfig(
-                        zip.enabled(),
-                        zip.destination().or(() -> Optional.of(zipDirectory())),
-                        zip.triggers(),
-                        zip.health()),
-                config.worlds());
-    }
-
-    /** Resolves the product storage root beside Minecraft's {@code config} directory. */
-    public static SettingsDefaults fromConfigFile(Path configFile) {
-        Path absoluteFile = Objects.requireNonNull(configFile, "configFile")
-                .toAbsolutePath()
-                .normalize();
-        Path configDirectory = absoluteFile.getParent();
-        if (configDirectory == null || configDirectory.getParent() == null) {
-            throw new IllegalArgumentException("Configuration file must have a game directory parent");
-        }
-        return new SettingsDefaults(configDirectory.getParent().resolve("worldarchive"));
-    }
-
-    public WorldArchiveConfig defaultsKeepingWorlds(List<WorldConfig> worlds) {
-        WorldArchiveConfig defaults = WorldArchiveConfig.defaults();
-        return resolve(new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                defaults.triggers(),
-                defaults.git(),
-                defaults.zip(),
-                List.copyOf(Objects.requireNonNull(worlds, "worlds"))));
-    }
-
-    public Path gitRepository() {
-        return storageRoot.resolve(GIT_REPOSITORY_DIRECTORY_NAME);
-    }
-
-    public Path zipDirectory() {
-        return storageRoot.resolve(ZIP_DIRECTORY_NAME);
-    }
-
-    public Path storageRoot() {
-        return storageRoot;
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsDraft.java b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsDraft.java
index 26177b6..59773cc 100644
--- a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsDraft.java
+++ b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsDraft.java
@@ -1,38 +1,58 @@
 package dev.ishaanko.worldarchive.settings;
 
-import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
 import dev.ishaanko.worldarchive.config.DestinationTriggerConfig;
 import dev.ishaanko.worldarchive.config.GitDestinationConfig;
 import dev.ishaanko.worldarchive.config.PathSafety;
+import dev.ishaanko.worldarchive.config.RemoteUrlPolicy;
 import dev.ishaanko.worldarchive.config.TriggerConfig;
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
 import dev.ishaanko.worldarchive.config.WorldConfig;
 import dev.ishaanko.worldarchive.config.ZipDestinationConfig;
-import dev.ishaanko.worldarchive.model.DestinationHealth;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.SafeText;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.InvalidPathException;
-import java.nio.file.LinkOption;
 import java.nio.file.Path;
-import java.time.Instant;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collection;
+import java.util.EnumMap;
+import java.util.EnumSet;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
-
-/** Mutable presentation model that validates every settings entry point identically. */
+import java.util.function.Consumer;
+import java.util.function.Function;
+import java.util.function.UnaryOperator;
+
+/**
+ * What the settings screen edits: every setting as the player typed it. {@link #validate}
+ * checks the text and builds the configuration to save; {@link #changes} turns that into a
+ * change that applies only what the player edited, so a change saved meanwhile by a world
+ * registration or another game window is kept. Not thread-safe: hand a {@link #copy} to
+ * another thread.
+ */
 public final class SettingsDraft {
-    private final WorldArchiveConfig base;
+    private static final int MESSAGE_LIMIT = 512;
+
+    private static final String GIT_REPOSITORY_LABEL = "Git repository root";
 
-    private final Map<WorldId, Boolean> worldEnabled;
+    private static final String ZIP_FOLDER_LABEL = "ZIP folder";
+
+    private static final String REQUIRED_WHILE_ENABLED = " is required while this destination is enabled";
+
+    private static final String UNCHECKED_DESTINATION = "The destination path could not be validated";
+
+    private final WorldArchiveConfig base;
 
-    private final Map<WorldId, String> worldRemoteUrls;
+    private final Map<DestinationType, EnumSet<BackupTrigger>> triggers = new EnumMap<>(DestinationType.class);
 
-    private final Map<WorldId, String> worldZipDestinations;
+    private final Map<WorldId, WorldEdit> worlds = new LinkedHashMap<>();
 
     private String scheduleInterval;
 
@@ -42,403 +62,304 @@ public final class SettingsDraft {
 
     private String gitRemoteName;
 
-    private boolean gitManualEnabled;
-
-    private boolean gitWorldExitEnabled;
-
-    private boolean gitScheduledEnabled;
-
     private String gitLfsPatterns;
 
     private boolean zipEnabled;
 
     private String zipDestination;
 
-    private boolean zipManualEnabled;
-
-    private boolean zipWorldExitEnabled;
-
-    private boolean zipScheduledEnabled;
-
-    private DestinationHealth gitHealth;
-
-    private DestinationHealth zipHealth;
-
-    private SettingsDraft(WorldArchiveConfig config) {
-        base = Objects.requireNonNull(config, "config");
-        scheduleInterval = Integer.toString(config.triggers().scheduleIntervalMinutes());
-        gitEnabled = config.git().enabled();
-        gitRepository = config.git().repository().map(Path::toString).orElse("");
-        gitRemoteName = config.git().remoteName();
-        gitManualEnabled = config.triggers().manualEnabled()
-                && config.git().triggers().manualEnabled();
-        gitWorldExitEnabled = config.triggers().worldExitEnabled()
-                && config.git().triggers().worldExitEnabled();
-        gitScheduledEnabled = config.triggers().scheduledEnabled()
-                && config.git().triggers().scheduledEnabled();
-        gitLfsPatterns = String.join(", ", config.git().lfsPatterns());
-        zipEnabled = config.zip().enabled();
-        zipDestination = config.zip().destination().map(Path::toString).orElse("");
-        zipManualEnabled = config.triggers().manualEnabled()
-                && config.zip().triggers().manualEnabled();
-        zipWorldExitEnabled = config.triggers().worldExitEnabled()
-                && config.zip().triggers().worldExitEnabled();
-        zipScheduledEnabled = config.triggers().scheduledEnabled()
-                && config.zip().triggers().scheduledEnabled();
-        gitHealth = config.git().health();
-        zipHealth = config.zip().health();
-        worldEnabled = new LinkedHashMap<>();
-        worldRemoteUrls = new LinkedHashMap<>();
-        worldZipDestinations = new LinkedHashMap<>();
-        config.worlds().forEach(world -> {
-            worldEnabled.put(world.worldId(), world.enabled());
-            worldRemoteUrls.put(world.worldId(), world.remoteUrl().orElse(""));
-            worldZipDestinations.put(
-                    world.worldId(),
-                    world.zipDestination().map(Path::toString).orElse(""));
-        });
+    /**
+     * @param base the settings the screen opened with
+     * @param values the settings the fields start from
+     */
+    private SettingsDraft(WorldArchiveConfig base, WorldArchiveConfig values) {
+        this.base = Objects.requireNonNull(base, "base");
+        scheduleInterval = Integer.toString(values.triggers().scheduleIntervalMinutes());
+        gitEnabled = values.git().enabled();
+        gitRepository = pathText(values.git().repository());
+        gitRemoteName = values.git().remoteName();
+        gitLfsPatterns = String.join(", ", values.git().lfsPatterns());
+        zipEnabled = values.zip().enabled();
+        zipDestination = pathText(values.zip().destination());
+        triggers.put(DestinationType.GIT, enabledTriggers(values.triggers(), values.git().triggers()));
+        triggers.put(DestinationType.ZIP, enabledTriggers(values.triggers(), values.zip().triggers()));
+        values.worlds().forEach(world -> worlds.put(world.worldId(), new WorldEdit(world)));
     }
 
     private SettingsDraft(SettingsDraft source) {
         base = source.base;
-        worldEnabled = new LinkedHashMap<>(source.worldEnabled);
-        worldRemoteUrls = new LinkedHashMap<>(source.worldRemoteUrls);
-        worldZipDestinations = new LinkedHashMap<>(source.worldZipDestinations);
         scheduleInterval = source.scheduleInterval;
         gitEnabled = source.gitEnabled;
         gitRepository = source.gitRepository;
         gitRemoteName = source.gitRemoteName;
-        gitManualEnabled = source.gitManualEnabled;
-        gitWorldExitEnabled = source.gitWorldExitEnabled;
-        gitScheduledEnabled = source.gitScheduledEnabled;
         gitLfsPatterns = source.gitLfsPatterns;
         zipEnabled = source.zipEnabled;
         zipDestination = source.zipDestination;
-        zipManualEnabled = source.zipManualEnabled;
-        zipWorldExitEnabled = source.zipWorldExitEnabled;
-        zipScheduledEnabled = source.zipScheduledEnabled;
-        gitHealth = source.gitHealth;
-        zipHealth = source.zipHealth;
+        source.triggers.forEach((destination, enabled) -> triggers.put(destination, EnumSet.copyOf(enabled)));
+        source.worlds.forEach((worldId, edit) -> worlds.put(worldId, new WorldEdit(edit)));
     }
 
     public static SettingsDraft from(WorldArchiveConfig config) {
-        return new SettingsDraft(config);
+        return new SettingsDraft(config, config);
+    }
+
+    /**
+     * Product defaults for every setting except where backups are kept: the Git repository
+     * folder, the ZIP folder, and each world's remote and ZIP folder stay as saved, so existing
+     * backups stay reachable. Every world is switched back on.
+     */
+    public SettingsDraft withDefaults() {
+        WorldArchiveConfig defaults = WorldArchiveConfig.defaults();
+        return new SettingsDraft(base, defaults
+                .withGit(defaults.git().withRepository(base.git().repository()))
+                .withZip(defaults.zip().withDestination(base.zip().destination()))
+                .withWorlds(base.worlds().stream().map(world -> world.withEnabled(true)).toList()));
     }
 
     public SettingsDraft copy() {
         return new SettingsDraft(this);
     }
 
-    /** Restores product defaults without losing discovered per-world identities and paths. */
-    public static SettingsDraft defaultsKeepingWorlds(WorldArchiveConfig current) {
-        Objects.requireNonNull(current, "current");
-        WorldArchiveConfig defaults = WorldArchiveConfig.defaults();
-        GitDestinationConfig git = new GitDestinationConfig(
-                defaults.git().enabled(),
-                current.git().repository(),
-                defaults.git().remoteName(),
-                defaults.git().remoteUrl(),
-                defaults.git().triggers(),
-                defaults.git().lfsPatterns(),
-                defaults.git().health(),
-                defaults.git().legacyRepository(),
-                defaults.git().legacyRemoteUrl());
-        ZipDestinationConfig zip = new ZipDestinationConfig(
-                defaults.zip().enabled(),
-                current.zip().destination(),
-                defaults.zip().triggers(),
-                defaults.zip().health());
-        return resetToDefaults(current, enableAllWorlds(current.worlds()), git, zip, defaults.triggers());
-    }
-
-    public static SettingsDraft defaultsKeepingWorlds(
-            WorldArchiveConfig current,
-            SettingsDefaults defaults) {
-        Objects.requireNonNull(current, "current");
-        Objects.requireNonNull(defaults, "defaults");
-        List<WorldConfig> worlds = enableAllWorlds(current.worlds());
-        WorldArchiveConfig reset = defaults.defaultsKeepingWorlds(worlds);
-        return resetToDefaults(current, worlds, reset.git(), reset.zip(), reset.triggers());
+    /** The settings the screen opened with. */
+    public WorldArchiveConfig base() {
+        return base;
     }
 
     /**
-     * Applies the shared reset policy: every world force-enabled, and the git destination's
-     * hidden legacy repository/URL carried over from {@code current} regardless of where the
-     * rest of the git and zip destinations were resolved from.
+     * Checks every field and builds the configuration to save. A folder must be absolute, must
+     * not be a file, and must not be inside a world: a configured world or one of
+     * {@code knownWorldPaths}. Whether a folder can be reached right now is not checked here;
+     * the health footer warns about that, and saving still works.
      */
-    private static SettingsDraft resetToDefaults(
-            WorldArchiveConfig current,
-            List<WorldConfig> worlds,
-            GitDestinationConfig git,
-            ZipDestinationConfig zip,
-            TriggerConfig triggers) {
-        return new SettingsDraft(new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                triggers,
-                withLegacyGitFields(git, current.git()),
-                zip,
-                worlds));
-    }
-
-    private static List<WorldConfig> enableAllWorlds(List<WorldConfig> worlds) {
-        return worlds.stream()
-                .map(world -> new WorldConfig(
-                        world.worldId(),
-                        true,
-                        world.path(),
-                        world.remoteUrl(),
-                        world.zipDestination(),
-                        world.storagePolicy()))
-                .toList();
-    }
-
-    private static GitDestinationConfig withLegacyGitFields(
-            GitDestinationConfig fresh,
-            GitDestinationConfig current) {
-        return new GitDestinationConfig(
-                fresh.enabled(),
-                fresh.repository(),
-                fresh.remoteName(),
-                fresh.remoteUrl(),
-                fresh.triggers(),
-                fresh.lfsPatterns(),
-                fresh.health(),
-                current.legacyRepository(),
-                current.legacyRemoteUrl());
-    }
-
-    /** Builds a config only when fields, permissions, and recursive-destination rules all pass. */
     public SettingsValidation validate(Collection<Path> knownWorldPaths) {
-        Objects.requireNonNull(knownWorldPaths, "knownWorldPaths");
-        Map<SettingsField, String> issues = new LinkedHashMap<>();
-        int interval = parseScheduleInterval(issues);
-        List<Path> sourceWorlds = collectWorldPaths(knownWorldPaths);
-        Optional<Path> repository = validatePath(
-                gitRepository,
-                gitEnabled,
-                "Git repository root",
-                SettingsField.GIT_REPOSITORY,
-                sourceWorlds,
-                issues);
-        Optional<Path> archiveDirectory = validatePath(
-                zipDestination,
-                zipEnabled,
-                "ZIP folder",
-                SettingsField.ZIP_DESTINATION,
-                sourceWorlds,
-                issues);
-        List<String> patterns = parseLfsPatterns(issues);
-        List<WorldConfig> worlds = updatedWorlds(sourceWorlds, issues);
-
-        GitDestinationConfig git = null;
-        if (!issues.containsKey(SettingsField.GIT_REPOSITORY)
-                && !issues.containsKey(SettingsField.GIT_LFS_PATTERNS)) {
-            git = buildGitConfig(repository, patterns, issues);
+        Map<SettingsField, String> issues = new EnumMap<>(SettingsField.class);
+        List<Path> sourceWorlds = sourceWorlds(knownWorldPaths, issues);
+        int interval = scheduleIntervalMinutes(issues);
+        Optional<Path> repository = folder(gitRepository, GIT_REPOSITORY_LABEL, sourceWorlds,
+                issue -> issues.put(SettingsField.GIT_REPOSITORY, issue));
+        if (gitEnabled && gitRepository.isBlank()) {
+            issues.put(SettingsField.GIT_REPOSITORY, GIT_REPOSITORY_LABEL + REQUIRED_WHILE_ENABLED);
         }
-        ZipDestinationConfig zip = new ZipDestinationConfig(
-                zipEnabled,
-                archiveDirectory,
-                new DestinationTriggerConfig(
-                        zipManualEnabled,
-                        zipWorldExitEnabled,
-                        zipScheduledEnabled),
-                zipHealth);
-
-        if (!issues.isEmpty() || git == null) {
-            return new SettingsValidation(Optional.empty(), issues);
+        Optional<Path> zipFolder = folder(zipDestination, ZIP_FOLDER_LABEL, sourceWorlds,
+                issue -> issues.put(SettingsField.ZIP_DESTINATION, issue));
+        if (zipEnabled && zipDestination.isBlank()) {
+            issues.put(SettingsField.ZIP_DESTINATION, ZIP_FOLDER_LABEL + REQUIRED_WHILE_ENABLED);
         }
-        WorldArchiveConfig candidate = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
+        problem(() -> GitDestinationConfig.validateRemoteName(gitRemoteName))
+                .ifPresent(issue -> issues.put(SettingsField.GIT_REMOTE_NAME, issue));
+        List<String> patterns = lfsPatterns();
+        problem(() -> GitDestinationConfig.validateLfsPatterns(patterns))
+                .ifPresent(issue -> issues.put(SettingsField.GIT_LFS_PATTERNS, issue));
+        Map<WorldId, Map<SettingsField, String>> worldIssues = new LinkedHashMap<>();
+        List<WorldConfig> editedWorlds = editedWorlds(sourceWorlds, worldIssues);
+        if (!issues.isEmpty() || !worldIssues.isEmpty()) {
+            return SettingsValidation.invalid(issues, worldIssues);
+        }
+        return SettingsValidation.valid(new WorldArchiveConfig(
                 new TriggerConfig(
-                        gitManualEnabled || zipManualEnabled,
-                        gitWorldExitEnabled || zipWorldExitEnabled,
-                        gitScheduledEnabled || zipScheduledEnabled,
+                        anyDestination(BackupTrigger.MANUAL),
+                        anyDestination(BackupTrigger.WORLD_EXIT),
+                        anyDestination(BackupTrigger.SCHEDULED),
                         interval),
-                git,
-                zip,
-                worlds);
-        try {
-            return new SettingsValidation(
-                    Optional.of(candidate.validateDestinations(sourceWorlds)),
-                    Map.of());
-        } catch (IOException exception) {
-            issues.put(SettingsField.DESTINATIONS, safePathMessage(exception));
-            return new SettingsValidation(Optional.empty(), issues);
+                new GitDestinationConfig(
+                        gitEnabled, repository, gitRemoteName, destinationTriggers(DestinationType.GIT), patterns),
+                new ZipDestinationConfig(zipEnabled, zipFolder, destinationTriggers(DestinationType.ZIP)),
+                editedWorlds));
+    }
+
+    /**
+     * The player's edits as a change to the settings as they are when the save runs: each value
+     * that differs from what the screen opened with replaces the current one, and every other
+     * value stays as it is now. {@code edited} is the configuration {@link #validate} built.
+     */
+    public UnaryOperator<WorldArchiveConfig> changes(WorldArchiveConfig edited) {
+        Objects.requireNonNull(edited, "edited");
+        WorldArchiveConfig opened = base;
+        return current -> merge(opened, edited, current);
+    }
+
+    private static WorldArchiveConfig merge(
+            WorldArchiveConfig opened,
+            WorldArchiveConfig edited,
+            WorldArchiveConfig current) {
+        TriggerConfig openedTriggers = opened.triggers();
+        TriggerConfig editedTriggers = edited.triggers();
+        TriggerConfig currentTriggers = current.triggers();
+        GitDestinationConfig openedGit = opened.git();
+        GitDestinationConfig editedGit = edited.git();
+        GitDestinationConfig currentGit = current.git();
+        ZipDestinationConfig openedZip = opened.zip();
+        ZipDestinationConfig editedZip = edited.zip();
+        ZipDestinationConfig currentZip = current.zip();
+        return new WorldArchiveConfig(
+                new TriggerConfig(
+                        pick(openedTriggers, editedTriggers, currentTriggers, TriggerConfig::manualEnabled),
+                        pick(openedTriggers, editedTriggers, currentTriggers, TriggerConfig::worldExitEnabled),
+                        pick(openedTriggers, editedTriggers, currentTriggers, TriggerConfig::scheduledEnabled),
+                        pick(openedTriggers, editedTriggers, currentTriggers, TriggerConfig::scheduleIntervalMinutes)),
+                new GitDestinationConfig(
+                        pick(openedGit, editedGit, currentGit, GitDestinationConfig::enabled),
+                        pick(openedGit, editedGit, currentGit, GitDestinationConfig::repository),
+                        pick(openedGit, editedGit, currentGit, GitDestinationConfig::remoteName),
+                        pick(openedGit, editedGit, currentGit, GitDestinationConfig::triggers),
+                        pick(openedGit, editedGit, currentGit, GitDestinationConfig::lfsPatterns)),
+                new ZipDestinationConfig(
+                        pick(openedZip, editedZip, currentZip, ZipDestinationConfig::enabled),
+                        pick(openedZip, editedZip, currentZip, ZipDestinationConfig::destination),
+                        pick(openedZip, editedZip, currentZip, ZipDestinationConfig::triggers)),
+                current.worlds().stream().map(world -> mergeWorld(opened, edited, world)).toList());
+    }
+
+    /** A world keeps its current folder and storage policy; only the fields the screen edits can change. */
+    private static WorldConfig mergeWorld(WorldArchiveConfig opened, WorldArchiveConfig edited, WorldConfig current) {
+        Optional<WorldConfig> before = opened.world(current.worldId());
+        Optional<WorldConfig> after = edited.world(current.worldId());
+        if (before.isEmpty() || after.isEmpty()) {
+            return current;
         }
+        return current
+                .withEnabled(pick(before.get(), after.get(), current, WorldConfig::enabled))
+                .withRemoteUrl(pick(before.get(), after.get(), current, WorldConfig::remoteUrl))
+                .withZipDestination(pick(before.get(), after.get(), current, WorldConfig::zipDestination));
     }
 
-    private GitDestinationConfig buildGitConfig(
-            Optional<Path> repository,
-            List<String> patterns,
-            Map<SettingsField, String> issues) {
-        String remoteName = gitRemoteName;
+    /** The edited value when the player changed it, otherwise the current one. */
+    private static <R, T> T pick(R opened, R edited, R current, Function<R, T> field) {
+        T mine = field.apply(edited);
+        return mine.equals(field.apply(opened)) ? field.apply(current) : mine;
+    }
+
+    /** The folders destinations must stay out of, canonical and each once. */
+    private List<Path> sourceWorlds(Collection<Path> knownWorldPaths, Map<SettingsField, String> issues) {
+        List<Path> sourceWorlds = new ArrayList<>(knownWorldPaths);
+        base.worlds().forEach(world -> sourceWorlds.add(world.path()));
         try {
-            return new GitDestinationConfig(
-                    gitEnabled,
-                    repository,
-                    remoteName,
-                    Optional.empty(),
-                    new DestinationTriggerConfig(
-                            gitManualEnabled,
-                            gitWorldExitEnabled,
-                            gitScheduledEnabled),
-                    patterns,
-                    gitHealth,
-                    base.git().legacyRepository(),
-                    base.git().legacyRemoteUrl());
-        } catch (IllegalArgumentException exception) {
-            SettingsField field = exception.getMessage().contains("remote name")
-                    ? SettingsField.GIT_REMOTE_NAME
-                    : SettingsField.GIT_LFS_PATTERNS;
-            issues.put(field, exception.getMessage());
-            return null;
+            return PathSafety.canonicalizeAll(sourceWorlds);
+        } catch (IOException exception) {
+            issues.put(SettingsField.DESTINATIONS, SafeText.from(exception, UNCHECKED_DESTINATION, MESSAGE_LIMIT));
+            return List.of();
         }
     }
 
-    private int parseScheduleInterval(Map<SettingsField, String> issues) {
-        try {
-            int interval = Integer.parseInt(scheduleInterval.strip());
-            if (interval < 1 || interval > TriggerConfig.MAXIMUM_SCHEDULE_INTERVAL_MINUTES) {
-                throw new NumberFormatException("out of range");
-            }
-            return interval;
-        } catch (NumberFormatException exception) {
+    private int scheduleIntervalMinutes(Map<SettingsField, String> issues) {
+        Optional<Integer> interval = parsedInterval().filter(TriggerConfig::isValidInterval);
+        if (interval.isEmpty()) {
             issues.put(SettingsField.SCHEDULE_INTERVAL, "Use a whole number from 1 to "
                     + TriggerConfig.MAXIMUM_SCHEDULE_INTERVAL_MINUTES + " minutes");
             return TriggerConfig.DEFAULT_SCHEDULE_INTERVAL_MINUTES;
         }
+        return interval.get();
     }
 
-    private List<Path> collectWorldPaths(Collection<Path> knownWorldPaths) {
-        List<Path> paths = new ArrayList<>(knownWorldPaths.size() + base.worlds().size());
-        for (Path path : knownWorldPaths) {
-            paths.add(Objects.requireNonNull(path, "knownWorldPath"));
+    private Optional<Integer> parsedInterval() {
+        try {
+            return Optional.of(Integer.parseInt(scheduleInterval.strip()));
+        } catch (NumberFormatException exception) {
+            return Optional.empty();
         }
-        base.worlds().forEach(world -> paths.add(world.path()));
-        return List.copyOf(paths);
     }
 
-    private static Optional<Path> validatePath(
-            String value,
-            boolean enabled,
-            String label,
-            SettingsField field,
-            Collection<Path> worldPaths,
-            Map<SettingsField, String> issues) {
-        if (value.isBlank()) {
-            if (enabled) {
-                issues.put(field, label + " is required while this destination is enabled");
+    private List<String> lfsPatterns() {
+        return Arrays.stream(gitLfsPatterns.split("[,\\r\\n]+"))
+                .map(String::strip)
+                .filter(pattern -> !pattern.isEmpty())
+                .toList();
+    }
+
+    private List<WorldConfig> editedWorlds(
+            List<Path> sourceWorlds,
+            Map<WorldId, Map<SettingsField, String>> worldIssues) {
+        List<WorldConfig> edited = new ArrayList<>(base.worlds().size());
+        for (WorldConfig world : base.worlds()) {
+            WorldEdit edit = edit(world.worldId());
+            String code = world.worldId().displayCode();
+            Map<SettingsField, String> issues = new EnumMap<>(SettingsField.class);
+            Optional<Path> zipFolder = folder(edit.zipDestination, "ZIP override for world " + code, sourceWorlds,
+                    issue -> issues.put(SettingsField.WORLD_ZIP_DESTINATION, issue));
+            Optional<String> remoteUrl = remoteUrl(edit.remoteUrl, code,
+                    issue -> issues.put(SettingsField.WORLD_REMOTE_URL, issue));
+            if (!issues.isEmpty()) {
+                worldIssues.put(world.worldId(), issues);
             }
+            edited.add(world.withEnabled(edit.enabled).withRemoteUrl(remoteUrl).withZipDestination(zipFolder));
+        }
+        return edited;
+    }
+
+    /**
+     * The canonical folder a field names; empty when the field is blank or has a problem. A
+     * problem is reported to {@code issue}.
+     */
+    private static Optional<Path> folder(String value, String label, List<Path> sourceWorlds, Consumer<String> issue) {
+        if (value.isBlank()) {
             return Optional.empty();
         }
+        Path path;
         try {
-            Path path = Path.of(SettingsPaths.expandHome(value));
-            if (!path.isAbsolute()) {
-                issues.put(field, label + " must be an absolute path");
-                return Optional.empty();
-            }
-            Path destination = PathSafety.requireOutsideWorlds(path, worldPaths);
-            Optional<String> accessIssue = directoryAccessIssue(destination);
-            if (accessIssue.isPresent()) {
-                issues.put(field, label + " " + accessIssue.get());
+            path = Path.of(SettingsPaths.expandHome(value));
+        } catch (InvalidPathException exception) {
+            issue.accept(label + " is not a valid filesystem path");
+            return Optional.empty();
+        }
+        if (!path.isAbsolute()) {
+            issue.accept(label + " must be an absolute path");
+            return Optional.empty();
+        }
+        try {
+            Path destination = PathSafety.requireOutsideWorlds(path, sourceWorlds);
+            if (PathSafety.nearestExisting(destination).filter(existing -> !Files.isDirectory(existing)).isPresent()) {
+                issue.accept(label + " or its nearest existing parent is not a folder");
                 return Optional.empty();
             }
             return Optional.of(destination);
-        } catch (InvalidPathException exception) {
-            issues.put(field, label + " is not a valid filesystem path");
         } catch (IOException exception) {
-            issues.put(field, safePathMessage(exception));
+            issue.accept(SafeText.from(exception, UNCHECKED_DESTINATION, MESSAGE_LIMIT));
+            return Optional.empty();
         }
-        return Optional.empty();
     }
 
-    private static Optional<String> directoryAccessIssue(Path destination) throws IOException {
-        Path existing = destination;
-        while (existing != null && !Files.exists(existing, LinkOption.NOFOLLOW_LINKS)) {
-            existing = existing.getParent();
-        }
-        if (existing == null) {
-            return Optional.of("has no accessible parent folder");
-        }
-        Path realExisting = existing.toRealPath();
-        if (!Files.isDirectory(realExisting)) {
-            return Optional.of("or its nearest existing parent is not a folder");
-        }
-        if (!Files.isReadable(realExisting)) {
-            return Optional.of("is not readable");
+    private static Optional<String> remoteUrl(String value, String worldCode, Consumer<String> issue) {
+        if (value.isBlank()) {
+            return Optional.empty();
         }
-        if (!Files.isWritable(realExisting)) {
-            return Optional.of("is not writable");
+        try {
+            return Optional.of(RemoteUrlPolicy.validateConfiguredPlain(value));
+        } catch (IllegalArgumentException exception) {
+            issue.accept("Git remote for world " + worldCode + " is invalid: " + exception.getMessage());
+            return Optional.empty();
         }
-        return Optional.empty();
     }
 
-    private List<String> parseLfsPatterns(Map<SettingsField, String> issues) {
-        List<String> patterns = List.of(gitLfsPatterns.split("[,\\r\\n]+"));
-        patterns = patterns.stream().map(String::strip).filter(pattern -> !pattern.isEmpty()).toList();
+    private static Optional<String> problem(Runnable check) {
         try {
-            new GitDestinationConfig(
-                    false,
-                    Optional.empty(),
-                    GitDestinationConfig.DEFAULT_REMOTE_NAME,
-                    Optional.empty(),
-                    DestinationTriggerConfig.defaults(),
-                    patterns,
-                    gitHealth);
-            return patterns;
+            check.run();
+            return Optional.empty();
         } catch (IllegalArgumentException exception) {
-            issues.put(SettingsField.GIT_LFS_PATTERNS, exception.getMessage());
-            return GitDestinationConfig.DEFAULT_LFS_PATTERNS;
+            return Optional.of(exception.getMessage());
         }
     }
 
-    private List<WorldConfig> updatedWorlds(
-            Collection<Path> sourceWorlds,
-            Map<SettingsField, String> issues) {
-        List<WorldConfig> worlds = new ArrayList<>(base.worlds().size());
-        for (WorldConfig world : base.worlds()) {
-            String remoteUrl = worldRemoteUrls.getOrDefault(world.worldId(), "");
-            String zipDestination = worldZipDestinations.getOrDefault(world.worldId(), "");
-            Optional<Path> archiveDirectory = validatePath(
-                    zipDestination,
-                    false,
-                    "ZIP override for world " + world.worldId().displayCode(),
-                    SettingsField.WORLD_ZIP_DESTINATION,
-                    sourceWorlds,
-                    issues);
-            try {
-                worlds.add(new WorldConfig(
-                        world.worldId(),
-                        worldEnabled.getOrDefault(world.worldId(), world.enabled()),
-                        world.path(),
-                        remoteUrl.isBlank() ? Optional.empty() : Optional.of(remoteUrl),
-                        archiveDirectory,
-                        world.storagePolicy()));
-            } catch (IllegalArgumentException exception) {
-                issues.put(
-                        SettingsField.WORLD_REMOTE_URL,
-                        "Git remote for world " + world.worldId().displayCode()
-                                + " is invalid: " + exception.getMessage());
-                worlds.add(world);
+    /** A trigger shows as on for a destination only when both the global and the destination switch allow it. */
+    private static EnumSet<BackupTrigger> enabledTriggers(TriggerConfig global, DestinationTriggerConfig destination) {
+        EnumSet<BackupTrigger> enabled = EnumSet.noneOf(BackupTrigger.class);
+        for (BackupTrigger trigger : BackupTrigger.values()) {
+            if (global.enabledFor(trigger) && destination.enabledFor(trigger)) {
+                enabled.add(trigger);
             }
         }
-        return List.copyOf(worlds);
+        return enabled;
     }
 
-    private static String safePathMessage(IOException exception) {
-        String message = exception.getMessage();
-        if (message == null || message.isBlank()) {
-            return "The destination path could not be validated";
-        }
-        String redacted = SensitiveDataRedactor.redact(message).strip();
-        if (redacted.isEmpty() || redacted.chars().anyMatch(Character::isISOControl)) {
-            return "The destination path could not be validated";
-        }
-        return redacted.length() <= 512 ? redacted : redacted.substring(0, 512);
+    private DestinationTriggerConfig destinationTriggers(DestinationType destination) {
+        return new DestinationTriggerConfig(
+                trigger(destination, BackupTrigger.MANUAL),
+                trigger(destination, BackupTrigger.WORLD_EXIT),
+                trigger(destination, BackupTrigger.SCHEDULED));
     }
 
-    public WorldArchiveConfig base() {
-        return base;
+    /** The global switch of a trigger is on while any destination uses it. */
+    private boolean anyDestination(BackupTrigger trigger) {
+        return triggers.values().stream().anyMatch(enabled -> enabled.contains(trigger));
     }
 
     public String scheduleInterval() {
@@ -454,10 +375,7 @@ public boolean gitEnabled() {
     }
 
     public void setGitEnabled(boolean enabled) {
-        if (gitEnabled != enabled) {
-            gitEnabled = enabled;
-            resetGitHealth();
-        }
+        gitEnabled = enabled;
     }
 
     public String gitRepository() {
@@ -465,11 +383,7 @@ public String gitRepository() {
     }
 
     public void setGitRepository(String value) {
-        String next = Objects.requireNonNull(value, "value");
-        if (!gitRepository.equals(next)) {
-            gitRepository = next;
-            resetGitHealth();
-        }
+        gitRepository = Objects.requireNonNull(value, "value");
     }
 
     public String gitRemoteName() {
@@ -477,35 +391,7 @@ public String gitRemoteName() {
     }
 
     public void setGitRemoteName(String value) {
-        String next = Objects.requireNonNull(value, "value");
-        if (!gitRemoteName.equals(next)) {
-            gitRemoteName = next;
-            resetGitHealth();
-        }
-    }
-
-    public boolean gitManualEnabled() {
-        return gitManualEnabled;
-    }
-
-    public void setGitManualEnabled(boolean enabled) {
-        gitManualEnabled = enabled;
-    }
-
-    public boolean gitWorldExitEnabled() {
-        return gitWorldExitEnabled;
-    }
-
-    public void setGitWorldExitEnabled(boolean enabled) {
-        gitWorldExitEnabled = enabled;
-    }
-
-    public boolean gitScheduledEnabled() {
-        return gitScheduledEnabled;
-    }
-
-    public void setGitScheduledEnabled(boolean enabled) {
-        gitScheduledEnabled = enabled;
+        gitRemoteName = Objects.requireNonNull(value, "value");
     }
 
     public String gitLfsPatterns() {
@@ -513,11 +399,7 @@ public String gitLfsPatterns() {
     }
 
     public void setGitLfsPatterns(String value) {
-        String next = Objects.requireNonNull(value, "value");
-        if (!gitLfsPatterns.equals(next)) {
-            gitLfsPatterns = next;
-            resetGitHealth();
-        }
+        gitLfsPatterns = Objects.requireNonNull(value, "value");
     }
 
     public boolean zipEnabled() {
@@ -525,10 +407,7 @@ public boolean zipEnabled() {
     }
 
     public void setZipEnabled(boolean enabled) {
-        if (zipEnabled != enabled) {
-            zipEnabled = enabled;
-            resetZipHealth();
-        }
+        zipEnabled = enabled;
     }
 
     public String zipDestination() {
@@ -536,116 +415,119 @@ public String zipDestination() {
     }
 
     public void setZipDestination(String value) {
-        String next = Objects.requireNonNull(value, "value");
-        if (!zipDestination.equals(next)) {
-            zipDestination = next;
-            resetZipHealth();
-        }
-    }
-
-    public boolean zipManualEnabled() {
-        return zipManualEnabled;
-    }
-
-    public void setZipManualEnabled(boolean enabled) {
-        zipManualEnabled = enabled;
-    }
-
-    public boolean zipWorldExitEnabled() {
-        return zipWorldExitEnabled;
-    }
-
-    public void setZipWorldExitEnabled(boolean enabled) {
-        zipWorldExitEnabled = enabled;
+        zipDestination = Objects.requireNonNull(value, "value");
     }
 
-    public boolean zipScheduledEnabled() {
-        return zipScheduledEnabled;
+    /** Whether a trigger starts backups to a destination. */
+    public boolean trigger(DestinationType destination, BackupTrigger trigger) {
+        return triggers.get(Objects.requireNonNull(destination, "destination"))
+                .contains(Objects.requireNonNull(trigger, "trigger"));
     }
 
-    public void setZipScheduledEnabled(boolean enabled) {
-        zipScheduledEnabled = enabled;
+    public void setTrigger(DestinationType destination, BackupTrigger trigger, boolean enabled) {
+        EnumSet<BackupTrigger> destinationTriggers = triggers.get(Objects.requireNonNull(destination, "destination"));
+        if (enabled) {
+            destinationTriggers.add(Objects.requireNonNull(trigger, "trigger"));
+        } else {
+            destinationTriggers.remove(Objects.requireNonNull(trigger, "trigger"));
+        }
     }
 
     public boolean worldEnabled(WorldId worldId) {
-        return worldEnabled.getOrDefault(Objects.requireNonNull(worldId, "worldId"), true);
+        return edit(worldId).enabled;
     }
 
     public void setWorldEnabled(WorldId worldId, boolean enabled) {
-        if (!worldEnabled.containsKey(Objects.requireNonNull(worldId, "worldId"))) {
-            throw new IllegalArgumentException("Unknown world configuration: " + worldId);
-        }
-        worldEnabled.put(worldId, enabled);
+        edit(worldId).enabled = enabled;
     }
 
     public String worldRemoteUrl(WorldId worldId) {
-        String value = worldRemoteUrls.get(Objects.requireNonNull(worldId, "worldId"));
-        if (value == null) {
-            throw new IllegalArgumentException("Unknown world configuration: " + worldId);
-        }
-        return value;
+        return edit(worldId).remoteUrl;
     }
 
     public void setWorldRemoteUrl(WorldId worldId, String remoteUrl) {
-        WorldId id = Objects.requireNonNull(worldId, "worldId");
-        if (!worldRemoteUrls.containsKey(id)) {
-            throw new IllegalArgumentException("Unknown world configuration: " + id);
+        edit(worldId).remoteUrl = Objects.requireNonNull(remoteUrl, "remoteUrl");
+    }
+
+    /** Whether the world uses its own ZIP folder instead of the one on the ZIP tab. */
+    public boolean worldZipOverride(WorldId worldId) {
+        return edit(worldId).zipOverride;
+    }
+
+    /**
+     * Ticking the box starts from the folder typed before it was last unticked, or else from the
+     * ZIP tab's folder. Unticking it clears the world's folder and remembers it.
+     */
+    public void setWorldZipOverride(WorldId worldId, boolean override) {
+        WorldEdit edit = edit(worldId);
+        if (override == edit.zipOverride) {
+            return;
         }
-        String next = Objects.requireNonNull(remoteUrl, "remoteUrl");
-        if (!worldRemoteUrls.get(id).equals(next)) {
-            worldRemoteUrls.put(id, next);
-            resetGitHealth();
+        edit.zipOverride = override;
+        if (override) {
+            edit.zipDestination = edit.rememberedZipDestination.isEmpty()
+                    ? zipDestination
+                    : edit.rememberedZipDestination;
+        } else {
+            edit.rememberedZipDestination = edit.zipDestination;
+            edit.zipDestination = "";
         }
     }
 
     public String worldZipDestination(WorldId worldId) {
-        String value = worldZipDestinations.get(Objects.requireNonNull(worldId, "worldId"));
-        if (value == null) {
-            throw new IllegalArgumentException("Unknown world configuration: " + worldId);
-        }
-        return value;
+        return edit(worldId).zipDestination;
     }
 
     public void setWorldZipDestination(WorldId worldId, String destination) {
-        WorldId id = Objects.requireNonNull(worldId, "worldId");
-        if (!worldZipDestinations.containsKey(id)) {
-            throw new IllegalArgumentException("Unknown world configuration: " + id);
-        }
-        worldZipDestinations.put(id, Objects.requireNonNull(destination, "destination"));
+        edit(worldId).zipDestination = Objects.requireNonNull(destination, "destination");
     }
 
+    /** What the health footer checks for the fields as they are now. */
     public SettingsProbeRequest probeRequest() {
         return new SettingsProbeRequest(
                 gitEnabled,
-                "git",
                 SettingsPaths.parseAbsolute(gitRepository),
-                worldRemoteUrls.values().stream().anyMatch(value -> !value.isBlank()),
                 zipEnabled,
                 SettingsPaths.parseAbsolute(zipDestination));
     }
 
-    public void applyHealth(SettingsHealthSnapshot health, Instant checkedAt) {
-        Objects.requireNonNull(health, "health");
-        Objects.requireNonNull(checkedAt, "checkedAt");
-        gitHealth = health.gitDestinationHealth(checkedAt);
-        zipHealth = health.zipDestinationHealth(checkedAt);
+    private WorldEdit edit(WorldId worldId) {
+        WorldEdit edit = worlds.get(Objects.requireNonNull(worldId, "worldId"));
+        if (edit == null) {
+            throw new IllegalArgumentException("Unknown world configuration: " + worldId);
+        }
+        return edit;
     }
 
-    public DestinationHealth gitHealth() {
-        return gitHealth;
+    private static String pathText(Optional<Path> path) {
+        return path.map(Path::toString).orElse("");
     }
 
-    public DestinationHealth zipHealth() {
-        return zipHealth;
-    }
+    /** One world's fields as typed. */
+    private static final class WorldEdit {
+        private boolean enabled;
 
-    private void resetGitHealth() {
-        gitHealth = SettingsHealthSnapshot.unchecked(probeRequest())
-                .gitDestinationHealth(Instant.EPOCH);
-    }
+        private String remoteUrl;
+
+        private boolean zipOverride;
+
+        private String zipDestination;
 
-    private void resetZipHealth() {
-        zipHealth = SettingsHealthSnapshot.unchecked(probeRequest())
-                .zipDestinationHealth(Instant.EPOCH);
+        private String rememberedZipDestination = "";
+
+        private WorldEdit(WorldConfig world) {
+            enabled = world.enabled();
+            remoteUrl = world.remoteUrl().orElse("");
+            zipDestination = pathText(world.zipDestination());
+            zipOverride = !zipDestination.isEmpty();
+        }
+
+        private WorldEdit(WorldEdit source) {
+            enabled = source.enabled;
+            remoteUrl = source.remoteUrl;
+            zipOverride = source.zipOverride;
+            zipDestination = source.zipDestination;
+            rememberedZipDestination = source.rememberedZipDestination;
+        }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsHealthItem.java b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsHealthItem.java
index 1dfb634..b7ab4e2 100644
--- a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsHealthItem.java
+++ b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsHealthItem.java
@@ -1,18 +1,12 @@
 package dev.ishaanko.worldarchive.settings;
 
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
 import java.util.Objects;
 
-/** Credential-safe status for one tool or destination component. */
+/** The state of one tool or folder in the settings footer, with a short message for its tooltip. */
 public record SettingsHealthItem(SettingsHealthStatus status, String message) {
     public SettingsHealthItem {
         Objects.requireNonNull(status, "status");
-        message = SensitiveDataRedactor.redact(Objects.requireNonNull(message, "message")).strip();
-        if (message.isEmpty()
-                || message.length() > 512
-                || message.chars().anyMatch(Character::isISOControl)) {
-            throw new IllegalArgumentException("Settings health message is invalid");
-        }
+        Objects.requireNonNull(message, "message");
     }
 
     public static SettingsHealthItem unchecked() {
@@ -22,4 +16,8 @@ public static SettingsHealthItem unchecked() {
     public static SettingsHealthItem disabled() {
         return new SettingsHealthItem(SettingsHealthStatus.DISABLED, "disabled");
     }
+
+    public static SettingsHealthItem unconfigured() {
+        return new SettingsHealthItem(SettingsHealthStatus.UNCONFIGURED, "not configured");
+    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsHealthProbe.java b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsHealthProbe.java
index 6ec1b9a..70ff2ff 100644
--- a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsHealthProbe.java
+++ b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsHealthProbe.java
@@ -1,7 +1,142 @@
 package dev.ishaanko.worldarchive.settings;
 
-/** Injectable blocking probe that callers must dispatch away from Minecraft threads. */
-@FunctionalInterface
-public interface SettingsHealthProbe {
-    SettingsHealthSnapshot probe(SettingsProbeRequest request) throws InterruptedException;
+import dev.ishaanko.worldarchive.config.FolderOrigin;
+import dev.ishaanko.worldarchive.config.GitDestinationConfig;
+import dev.ishaanko.worldarchive.config.PathSafety;
+import dev.ishaanko.worldarchive.storage.git.GitBackendSettings;
+import dev.ishaanko.worldarchive.storage.git.GitCommandRunner;
+import dev.ishaanko.worldarchive.storage.git.GitToolHealth;
+import dev.ishaanko.worldarchive.storage.git.GitToolProbe;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.util.Locale;
+import java.util.Objects;
+import java.util.Optional;
+
+/**
+ * Checks what the settings footer shows: whether Git and Git LFS run, and whether the
+ * repository and ZIP folders can be used. A folder that is offline or not writable is shown as
+ * unavailable, as a warning; it does not stop the settings from being saved. Git and Git LFS
+ * are started once per probe, and each settings screen uses its own probe, so reopening the
+ * screen checks them again. Blocking: call it off the render thread.
+ */
+public final class SettingsHealthProbe {
+    private static final Duration TOOL_TIMEOUT = Duration.ofSeconds(10);
+
+    private static final int OUTPUT_LIMIT = 64 * 1_024;
+
+    private final Path workingDirectory;
+
+    private final GitCommandRunner gitRunner;
+
+    private volatile GitToolHealth tools;
+
+    public SettingsHealthProbe(Path workingDirectory, GitCommandRunner gitRunner) {
+        this.workingDirectory = Objects.requireNonNull(workingDirectory, "workingDirectory")
+                .toAbsolutePath()
+                .normalize();
+        this.gitRunner = Objects.requireNonNull(gitRunner, "gitRunner");
+    }
+
+    public SettingsHealthSnapshot probe(SettingsProbeRequest request) throws InterruptedException {
+        Objects.requireNonNull(request, "request");
+        checkInterrupted();
+        SettingsHealthItem gitTool = SettingsHealthItem.disabled();
+        SettingsHealthItem lfsTool = SettingsHealthItem.disabled();
+        SettingsHealthItem repository = SettingsHealthItem.disabled();
+        if (request.gitEnabled()) {
+            GitToolHealth health = tools();
+            gitTool = toolItem(health.gitVersion(), health.gitFailure(), "Git");
+            lfsTool = toolItem(health.lfsVersion(), health.lfsFailure(), "Git LFS");
+            repository = folderItem(request.gitRepository(), "repository");
+        }
+        SettingsHealthItem zip = request.zipEnabled()
+                ? folderItem(request.zipFolder(), "archive folder")
+                : SettingsHealthItem.disabled();
+        checkInterrupted();
+        return new SettingsHealthSnapshot(gitTool, lfsTool, repository, zip);
+    }
+
+    /** The tools do not change while a screen is open, so they are started only for the first probe. */
+    private GitToolHealth tools() throws InterruptedException {
+        GitToolHealth checked = tools;
+        if (checked == null) {
+            GitBackendSettings settings = new GitBackendSettings(
+                    true,
+                    workingDirectory.resolve("worldarchive-health-probe.git"),
+                    FolderOrigin.DEFAULT,
+                    "git",
+                    GitDestinationConfig.DEFAULT_REMOTE_NAME,
+                    Optional.empty(),
+                    GitDestinationConfig.DEFAULT_LFS_PATTERNS,
+                    TOOL_TIMEOUT,
+                    OUTPUT_LIMIT);
+            checked = new GitToolProbe(settings, gitRunner).probe();
+            tools = checked;
+        }
+        return checked;
+    }
+
+    private static SettingsHealthItem toolItem(Optional<String> version, Optional<String> failure, String label) {
+        if (version.isPresent()) {
+            return new SettingsHealthItem(SettingsHealthStatus.HEALTHY, version.get());
+        }
+        String message = failure.filter(value -> !value.isBlank()).orElse(label + " is not installed");
+        return new SettingsHealthItem(SettingsHealthStatus.TOOL_MISSING, message);
+    }
+
+    /**
+     * A folder is usable when it, or the nearest folder above it that exists, can be read and
+     * written. Free space is shown when the file system reports it; network and FUSE drives
+     * often report none, so none is not an error.
+     */
+    private static SettingsHealthItem folderItem(Optional<Path> folder, String label) throws InterruptedException {
+        if (folder.isEmpty()) {
+            return SettingsHealthItem.unconfigured();
+        }
+        checkInterrupted();
+        Optional<Path> existing = PathSafety.nearestExisting(folder.get());
+        try {
+            if (existing.isEmpty()) {
+                return unavailable(label + " has no accessible parent folder");
+            }
+            Path directory = existing.get();
+            if (!Files.isDirectory(directory)) {
+                return unavailable(label + " or its nearest existing parent is not a folder");
+            }
+            if (!Files.isReadable(directory)) {
+                return unavailable(label + " is not readable");
+            }
+            if (!Files.isWritable(directory)) {
+                return unavailable(label + " is not writable");
+            }
+            long usableBytes = Files.getFileStore(directory).getUsableSpace();
+            return new SettingsHealthItem(SettingsHealthStatus.HEALTHY, usableBytes > 0
+                    ? label + " is ready (" + formatAvailableSpace(usableBytes) + " available)"
+                    : label + " is ready");
+        } catch (IOException | SecurityException exception) {
+            return unavailable(label + " is unavailable");
+        }
+    }
+
+    private static SettingsHealthItem unavailable(String message) {
+        return new SettingsHealthItem(SettingsHealthStatus.UNAVAILABLE, message);
+    }
+
+    private static String formatAvailableSpace(long bytes) {
+        double gibibytes = bytes / (1024.0 * 1024.0 * 1024.0);
+        if (gibibytes >= 0.1) {
+            return String.format(Locale.ROOT, "%.1f GiB", gibibytes);
+        }
+        double mebibytes = bytes / (1024.0 * 1024.0);
+        return String.format(Locale.ROOT, "%.1f MiB", mebibytes);
+    }
+
+    private static void checkInterrupted() throws InterruptedException {
+        if (Thread.currentThread().isInterrupted()) {
+            throw new InterruptedException("Settings health probe was cancelled");
+        }
+    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsHealthSnapshot.java b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsHealthSnapshot.java
index 23a88cb..7a926ee 100644
--- a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsHealthSnapshot.java
+++ b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsHealthSnapshot.java
@@ -1,145 +1,70 @@
 package dev.ishaanko.worldarchive.settings;
 
-import dev.ishaanko.worldarchive.model.DestinationHealth;
-import dev.ishaanko.worldarchive.model.DestinationHealthStatus;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import java.time.Instant;
 import java.util.Objects;
 
-/** Independent Git, LFS, repository, remote, and ZIP health for the settings UI. */
+/** The settings footer: Git, Git LFS, the repository folder and the ZIP folder, each checked on its own. */
 public record SettingsHealthSnapshot(
         SettingsHealthItem gitTool,
         SettingsHealthItem lfsTool,
         SettingsHealthItem repository,
-        SettingsHealthItem remote,
-        SettingsHealthItem zipDirectory) {
+        SettingsHealthItem zipFolder) {
     public SettingsHealthSnapshot {
         Objects.requireNonNull(gitTool, "gitTool");
         Objects.requireNonNull(lfsTool, "lfsTool");
         Objects.requireNonNull(repository, "repository");
-        Objects.requireNonNull(remote, "remote");
-        Objects.requireNonNull(zipDirectory, "zipDirectory");
+        Objects.requireNonNull(zipFolder, "zipFolder");
     }
 
+    /** What the footer shows while a probe runs. */
     public static SettingsHealthSnapshot unchecked(SettingsProbeRequest request) {
-        Objects.requireNonNull(request, "request");
-        SettingsHealthItem gitToolState = request.gitEnabled()
-                ? SettingsHealthItem.unchecked()
-                : SettingsHealthItem.disabled();
-        SettingsHealthItem repositoryState = configuredState(
-                request.gitEnabled(),
-                request.gitRepository().isPresent());
-        SettingsHealthItem remoteState = configuredState(
-                request.gitEnabled(),
-                request.remoteConfigured());
-        SettingsHealthItem zipState = configuredState(
-                request.zipEnabled(),
-                request.zipDirectory().isPresent());
-        return new SettingsHealthSnapshot(
-                gitToolState,
-                gitToolState,
-                repositoryState,
-                remoteState,
-                zipState);
+        return placeholder(request, SettingsHealthItem.unchecked());
     }
 
-    /** Produces a safe failed-probe result while preserving disabled and unconfigured states. */
+    /** What the footer shows when a probe failed. */
     public static SettingsHealthSnapshot unavailable(SettingsProbeRequest request, String message) {
-        Objects.requireNonNull(request, "request");
-        SettingsHealthItem unavailable = new SettingsHealthItem(
-                SettingsHealthStatus.UNAVAILABLE,
-                Objects.requireNonNull(message, "message"));
-        SettingsHealthItem disabled = SettingsHealthItem.disabled();
-        SettingsHealthItem unconfigured = new SettingsHealthItem(
-                SettingsHealthStatus.UNCONFIGURED,
-                "not configured");
-        SettingsHealthItem gitToolState = request.gitEnabled() ? unavailable : disabled;
-        SettingsHealthItem repositoryState = componentFailureState(
-                request.gitEnabled(),
-                request.gitRepository().isPresent(),
-                unavailable,
-                disabled,
-                unconfigured);
-        SettingsHealthItem remoteState = componentFailureState(
-                request.gitEnabled(),
-                request.remoteConfigured(),
-                unavailable,
-                disabled,
-                unconfigured);
-        SettingsHealthItem zipState = componentFailureState(
-                request.zipEnabled(),
-                request.zipDirectory().isPresent(),
-                unavailable,
-                disabled,
-                unconfigured);
-        return new SettingsHealthSnapshot(
-                gitToolState,
-                gitToolState,
-                repositoryState,
-                remoteState,
-                zipState);
+        return placeholder(request, new SettingsHealthItem(SettingsHealthStatus.UNAVAILABLE, message));
     }
 
-    private static SettingsHealthItem componentFailureState(
-            boolean enabled,
-            boolean configured,
-            SettingsHealthItem unavailable,
-            SettingsHealthItem disabled,
-            SettingsHealthItem unconfigured) {
-        if (!enabled) {
-            return disabled;
-        }
-        return configured ? unavailable : unconfigured;
+    /** Every part that is switched on and configured shows {@code checked}; the others say why they are not checked. */
+    private static SettingsHealthSnapshot placeholder(SettingsProbeRequest request, SettingsHealthItem checked) {
+        Objects.requireNonNull(request, "request");
+        SettingsHealthItem tools = request.gitEnabled() ? checked : SettingsHealthItem.disabled();
+        return new SettingsHealthSnapshot(
+                tools,
+                tools,
+                part(request.gitEnabled(), request.gitRepository().isPresent(), checked),
+                part(request.zipEnabled(), request.zipFolder().isPresent(), checked));
     }
 
-    private static SettingsHealthItem configuredState(boolean enabled, boolean configured) {
+    private static SettingsHealthItem part(boolean enabled, boolean configured, SettingsHealthItem checked) {
         if (!enabled) {
             return SettingsHealthItem.disabled();
         }
-        return configured
-                ? SettingsHealthItem.unchecked()
-                : new SettingsHealthItem(SettingsHealthStatus.UNCONFIGURED, "not configured");
+        return configured ? checked : SettingsHealthItem.unconfigured();
     }
 
-    public DestinationHealth gitDestinationHealth(Instant checkedAt) {
-        SettingsHealthStatus status = mostSevere(gitTool, lfsTool, repository);
-        return new DestinationHealth(
-                DestinationType.GIT,
-                destinationStatus(status),
-                gitSummary(),
-                Objects.requireNonNull(checkedAt, "checkedAt"));
-    }
-
-    public DestinationHealth zipDestinationHealth(Instant checkedAt) {
-        return new DestinationHealth(
-                DestinationType.ZIP,
-                destinationStatus(zipDirectory.status()),
-                "ZIP: " + zipDirectory.message(),
-                Objects.requireNonNull(checkedAt, "checkedAt"));
+    /** Short, stable wording for the settings footer. */
+    public String gitDisplaySummary() {
+        return "Git " + displayStatus(gitTool)
+                + " | LFS " + displayStatus(lfsTool)
+                + " | Repository " + displayStatus(repository);
     }
 
+    /** The full messages, for the footer's tooltip. */
     public String gitSummary() {
         return "Git " + gitTool.message()
                 + " | LFS " + lfsTool.message()
-                + " | repository " + repository.message()
-                + " | remote " + remote.message();
+                + " | repository " + repository.message();
     }
 
-    /** Short, stable wording for the constrained in-game settings footer. */
-    public String gitDisplaySummary() {
-        return "Git " + displayStatus(gitTool)
-                + " | LFS " + displayStatus(lfsTool)
-                + " | Repository " + displayStatus(repository)
-                + " | Remote " + displayStatus(remote);
+    /** Short, stable wording for the settings footer. */
+    public String zipDisplaySummary() {
+        return "ZIP Folder " + displayStatus(zipFolder);
     }
 
+    /** The full message, for the footer's tooltip. */
     public String zipSummary() {
-        return "ZIP " + zipDirectory.message();
-    }
-
-    /** Short, stable wording for the constrained in-game settings footer. */
-    public String zipDisplaySummary() {
-        return "ZIP Folder " + displayStatus(zipDirectory);
+        return "ZIP " + zipFolder.message();
     }
 
     private static String displayStatus(SettingsHealthItem item) {
@@ -152,35 +77,4 @@ private static String displayStatus(SettingsHealthItem item) {
             case UNAVAILABLE -> "Unavailable";
         };
     }
-
-    private static SettingsHealthStatus mostSevere(SettingsHealthItem... items) {
-        SettingsHealthStatus selected = SettingsHealthStatus.HEALTHY;
-        for (SettingsHealthItem item : items) {
-            if (priority(item.status()) > priority(selected)) {
-                selected = item.status();
-            }
-        }
-        return selected;
-    }
-
-    private static int priority(SettingsHealthStatus status) {
-        return switch (status) {
-            case UNAVAILABLE -> 6;
-            case TOOL_MISSING -> 5;
-            case UNCONFIGURED -> 4;
-            case UNCHECKED -> 3;
-            case DISABLED -> 2;
-            case HEALTHY -> 1;
-        };
-    }
-
-    private static DestinationHealthStatus destinationStatus(SettingsHealthStatus status) {
-        return switch (status) {
-            case HEALTHY -> DestinationHealthStatus.HEALTHY;
-            case DISABLED -> DestinationHealthStatus.DISABLED;
-            case UNCHECKED, UNCONFIGURED -> DestinationHealthStatus.UNCONFIGURED;
-            case TOOL_MISSING -> DestinationHealthStatus.TOOL_MISSING;
-            case UNAVAILABLE -> DestinationHealthStatus.UNAVAILABLE;
-        };
-    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsLayout.java b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsLayout.java
index 195d0a4..a712e57 100644
--- a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsLayout.java
+++ b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsLayout.java
@@ -1,8 +1,10 @@
 package dev.ishaanko.worldarchive.settings;
 
-/** Responsive screen geometry decisions that can be tested without Minecraft. */
+/**
+ * Geometry of the settings screen: where rows go, and when a short or narrow screen splits the
+ * Git and ZIP tabs into sections.
+ */
 public record SettingsLayout(
-        boolean compact,
         boolean paged,
         int statusY,
         int buttonsY,
@@ -61,10 +63,6 @@ public record SettingsLayout(
 
     private static final int BUTTONS_BOTTOM_OFFSET = 28;
 
-    public static SettingsLayout forHeight(int height) {
-        return forScreen(height, FULL_CONTENT_WIDTH);
-    }
-
     /**
      * Geometry for a screen of the given height and content width. The git/zip pages fall back to
      * their paged layout when the screen is either too short or too narrow for the single page.
@@ -73,12 +71,10 @@ public static SettingsLayout forScreen(int height, int contentWidth) {
         if (height < MINIMUM_HEIGHT) {
             throw new IllegalArgumentException("Settings screen height is too small");
         }
-        boolean compact = height < COMPACT_HEIGHT_THRESHOLD;
-        boolean paged = compact || contentWidth < FULL_CONTENT_WIDTH;
+        boolean paged = height < COMPACT_HEIGHT_THRESHOLD || contentWidth < FULL_CONTENT_WIDTH;
         int pageSize = Math.max(1, Math.min(MAXIMUM_WORLD_PAGE_SIZE,
                 (height - WORLD_LIST_CHROME_HEIGHT) / WORLD_ROW_HEIGHT));
         return new SettingsLayout(
-                compact,
                 paged,
                 height - STATUS_BOTTOM_OFFSET,
                 height - BUTTONS_BOTTOM_OFFSET,
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsProbeRequest.java b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsProbeRequest.java
index f05bdbd..c08f0d6 100644
--- a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsProbeRequest.java
+++ b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsProbeRequest.java
@@ -4,21 +4,15 @@
 import java.util.Objects;
 import java.util.Optional;
 
-/** Credential-free input for asynchronous settings health probing. */
+/** What the settings footer checks: the destinations that are switched on, and their folders. */
 public record SettingsProbeRequest(
         boolean gitEnabled,
-        String gitExecutable,
         Optional<Path> gitRepository,
-        boolean remoteConfigured,
         boolean zipEnabled,
-        Optional<Path> zipDirectory) {
+        Optional<Path> zipFolder) {
     public SettingsProbeRequest {
-        gitExecutable = Objects.requireNonNull(gitExecutable, "gitExecutable");
-        if (gitExecutable.isBlank() || gitExecutable.chars().anyMatch(Character::isISOControl)) {
-            throw new IllegalArgumentException("Git executable is invalid");
-        }
         gitRepository = normalize(gitRepository, "gitRepository");
-        zipDirectory = normalize(zipDirectory, "zipDirectory");
+        zipFolder = normalize(zipFolder, "zipFolder");
     }
 
     private static Optional<Path> normalize(Optional<Path> path, String name) {
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsScreenState.java b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsScreenState.java
deleted file mode 100644
index 6d09acf..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsScreenState.java
+++ /dev/null
@@ -1,103 +0,0 @@
-package dev.ishaanko.worldarchive.settings;
-
-import java.util.Optional;
-
-/** Pure lifecycle and revision gate for asynchronous settings-screen callbacks. */
-public final class SettingsScreenState {
-    private long lifecycleRevision = 1;
-
-    private long validationRevision;
-
-    private long healthRevision;
-
-    private boolean active;
-
-    private boolean closed;
-
-    private boolean saving;
-
-    public synchronized LifecycleToken lifecycleToken() {
-        return new LifecycleToken(lifecycleRevision);
-    }
-
-    public synchronized void activate() {
-        if (!closed) {
-            active = true;
-        }
-    }
-
-    public synchronized void deactivate() {
-        active = false;
-        lifecycleRevision++;
-        validationRevision++;
-        healthRevision++;
-        saving = false;
-    }
-
-    public synchronized void close() {
-        closed = true;
-        deactivate();
-    }
-
-    public synchronized boolean acceptsBeforeInitialization(LifecycleToken token) {
-        return !closed && token.revision() == lifecycleRevision;
-    }
-
-    public synchronized boolean acceptsActive(LifecycleToken token) {
-        return active && acceptsBeforeInitialization(token);
-    }
-
-    public synchronized RevisionToken nextValidation() {
-        return new RevisionToken(lifecycleRevision, ++validationRevision);
-    }
-
-    public synchronized boolean acceptsValidation(RevisionToken token) {
-        return active
-                && token.lifecycleRevision() == lifecycleRevision
-                && token.operationRevision() == validationRevision;
-    }
-
-    public synchronized RevisionToken nextHealthProbe() {
-        return new RevisionToken(lifecycleRevision, ++healthRevision);
-    }
-
-    public synchronized boolean acceptsHealthProbe(RevisionToken token) {
-        return active
-                && token.lifecycleRevision() == lifecycleRevision
-                && token.operationRevision() == healthRevision;
-    }
-
-    public synchronized Optional<LifecycleToken> beginSave() {
-        if (!active || closed || saving) {
-            return Optional.empty();
-        }
-        saving = true;
-        return Optional.of(lifecycleToken());
-    }
-
-    public synchronized void finishSave(LifecycleToken token) {
-        if (token.revision() == lifecycleRevision) {
-            saving = false;
-        }
-    }
-
-    public synchronized boolean saving() {
-        return saving;
-    }
-
-    public record LifecycleToken(long revision) {
-        public LifecycleToken {
-            if (revision < 1) {
-                throw new IllegalArgumentException("Lifecycle revision must be positive");
-            }
-        }
-    }
-
-    public record RevisionToken(long lifecycleRevision, long operationRevision) {
-        public RevisionToken {
-            if (lifecycleRevision < 1 || operationRevision < 1) {
-                throw new IllegalArgumentException("Async revisions must be positive");
-            }
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsService.java b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsService.java
new file mode 100644
index 0000000..91662bc
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsService.java
@@ -0,0 +1,407 @@
+package dev.ishaanko.worldarchive.settings;
+
+import dev.ishaanko.worldarchive.config.UnreadableConfigurationException;
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.config.WorldArchiveConfigStore;
+import dev.ishaanko.worldarchive.config.WorldIdentityStore;
+import dev.ishaanko.worldarchive.model.SafeText;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.support.AsyncTasks;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Clock;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CompletionStage;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.Executor;
+import java.util.concurrent.RejectedExecutionException;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Consumer;
+import java.util.function.Function;
+import java.util.function.UnaryOperator;
+import java.util.stream.Stream;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * The one owner of WorldArchive's settings for a game folder. It loads the settings file, keeps
+ * the world list in step with the saves folder, and applies every change as an update of what
+ * the file holds at that moment, so a change from another game window or a hand edit is kept.
+ *
+ * <p>When the file exists but cannot be read, every change is refused and nothing is written
+ * over the file; {@link #unreadable()} says why. {@link #load} can run again once the player
+ * fixed the file, and {@link #reset} starts over while keeping the old file under a new name.</p>
+ *
+ * <p>All file work runs on the executor, which must run one task at a time, and every method
+ * returns at once. Listeners and guards run on that executor too.</p>
+ */
+public final class SettingsService {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
+    private static final int MESSAGE_LIMIT = 512;
+
+    private final WorldArchiveConfigStore store;
+
+    private final Path savesDirectory;
+
+    private final WorldIdentityStore identities;
+
+    private final Executor executor;
+
+    private final Clock clock;
+
+    private final Set<Path> knownWorlds = ConcurrentHashMap.newKeySet();
+
+    private final List<Consumer<WorldArchiveConfig>> listeners = new CopyOnWriteArrayList<>();
+
+    private final List<Function<WorldArchiveConfig, Runnable>> guards = new CopyOnWriteArrayList<>();
+
+    private final AtomicReference<PendingValidation> pendingValidation = new AtomicReference<>();
+
+    private volatile WorldArchiveConfig current = WorldArchiveConfig.defaults();
+
+    private volatile UnreadableConfigurationException unreadable;
+
+    private volatile List<WorldNotice> notices = List.of();
+
+    public SettingsService(
+            WorldArchiveConfigStore store,
+            Path savesDirectory,
+            WorldIdentityStore identities,
+            Executor executor,
+            Clock clock) {
+        this.store = Objects.requireNonNull(store, "store");
+        this.savesDirectory = Objects.requireNonNull(savesDirectory, "savesDirectory").toAbsolutePath().normalize();
+        this.identities = Objects.requireNonNull(identities, "identities");
+        this.executor = Objects.requireNonNull(executor, "executor");
+        this.clock = Objects.requireNonNull(clock, "clock");
+    }
+
+    /**
+     * The settings as last loaded or saved, with the default folders filled in. Before the first
+     * load, and while the file cannot be read, these are product defaults that nothing saves.
+     */
+    public WorldArchiveConfig current() {
+        return current;
+    }
+
+    /** Why the settings file cannot be read; empty while it can. */
+    public Optional<UnreadableConfigurationException> unreadable() {
+        return Optional.ofNullable(unreadable);
+    }
+
+    /** What the last scan of the saves folder found that the player should know. */
+    public List<WorldNotice> notices() {
+        return notices;
+    }
+
+    /** Receives the settings after each load and each saved change. */
+    public void addConfigurationListener(Consumer<WorldArchiveConfig> listener) {
+        listeners.add(Objects.requireNonNull(listener, "listener"));
+    }
+
+    /**
+     * Sees each changed configuration before it is written and may refuse it by throwing. The
+     * returned release runs after the change was written and published, or failed.
+     */
+    public void addConfigurationGuard(Function<WorldArchiveConfig, Runnable> guard) {
+        guards.add(Objects.requireNonNull(guard, "guard"));
+    }
+
+    /**
+     * Reads the settings file and brings the world list in step with the saves folder. Fails
+     * with {@link UnreadableConfigurationException} when the file cannot be read. A failure to
+     * save the world list is only logged: the settings were read and are used.
+     */
+    public CompletionStage<WorldArchiveConfig> load() {
+        return AsyncTasks.supplyChecked(executor, this::loadNow);
+    }
+
+    /** Applies a change to the settings as the file holds them now; see {@link WorldArchiveConfigStore#update}. */
+    public CompletionStage<WorldArchiveConfig> update(UnaryOperator<WorldArchiveConfig> change) {
+        Objects.requireNonNull(change, "change");
+        return AsyncTasks.supplyChecked(executor, () -> updateNow(change));
+    }
+
+    /** The settings screen's save: its edits, plus worlds created since the last scan, in one update. */
+    public CompletionStage<WorldArchiveConfig> saveSettings(UnaryOperator<WorldArchiveConfig> edits) {
+        Objects.requireNonNull(edits, "edits");
+        return AsyncTasks.supplyChecked(executor, () -> refresh(edits));
+    }
+
+    /**
+     * Adds a world the game opened, or moves its settings to the folder it is in now. The folder
+     * counts as a world at once, so no destination can be saved inside it from then on.
+     */
+    public CompletionStage<WorldArchiveConfig> registerWorld(WorldId worldId, Path worldDirectory) {
+        DiscoveredWorld world = new DiscoveredWorld(worldDirectory, worldId);
+        remember(List.of(world.path()));
+        return update(config -> config.withWorlds(
+                WorldConfigReconciler.reconcile(config.worlds(), List.of(world)).worlds()));
+    }
+
+    /**
+     * Gives each listed world the remote its imported backups came from, when the world has no
+     * remote yet. A world that already has one keeps it, so importing from a copy on a USB drive
+     * does not redirect later uploads.
+     */
+    public CompletionStage<WorldArchiveConfig> connectWorldRemotes(Map<WorldId, String> connections) {
+        Map<WorldId, String> requested = Map.copyOf(connections);
+        if (requested.isEmpty()) {
+            return CompletableFuture.completedFuture(current);
+        }
+        return update(config -> config.withWorlds(config.worlds().stream()
+                .map(world -> world.remoteUrl().isEmpty() && requested.containsKey(world.worldId())
+                        ? world.withRemoteUrl(Optional.of(requested.get(world.worldId())))
+                        : world)
+                .toList()));
+    }
+
+    /**
+     * Starts over with product defaults and the worlds in the saves folder. The unreadable settings
+     * file is kept as {@code worldarchive.json.unreadable-<UTC time>}. A file that reads again, as
+     * after another game window fixed it, is loaded instead, and nothing is reset.
+     *
+     * @return where the unreadable file was kept; empty when nothing was reset
+     */
+    public CompletionStage<Optional<Path>> reset() {
+        return AsyncTasks.supplyChecked(executor, this::resetNow);
+    }
+
+    /**
+     * Checks a draft against every known world folder. Only the newest draft waiting is checked:
+     * one handed in while an older one waits replaces it, and the older result is cancelled. The
+     * draft must not change afterwards, so hand in a {@link SettingsDraft#copy}.
+     */
+    public CompletableFuture<SettingsValidation> validate(SettingsDraft draft) {
+        PendingValidation next = new PendingValidation(
+                Objects.requireNonNull(draft, "draft"),
+                new CompletableFuture<>());
+        PendingValidation replaced = pendingValidation.getAndSet(next);
+        if (replaced != null) {
+            replaced.result().cancel(false);
+        }
+        try {
+            executor.execute(this::validatePending);
+        } catch (RejectedExecutionException exception) {
+            pendingValidation.compareAndSet(next, null);
+            next.result().completeExceptionally(exception);
+        }
+        return next.result();
+    }
+
+    private void validatePending() {
+        PendingValidation pending = pendingValidation.getAndSet(null);
+        if (pending == null) {
+            return;
+        }
+        try {
+            pending.result().complete(pending.draft().validate(List.copyOf(knownWorlds)));
+        } catch (Throwable failure) {
+            pending.result().completeExceptionally(failure);
+        }
+    }
+
+    private WorldArchiveConfig loadNow() throws IOException {
+        WorldArchiveConfig loaded;
+        try {
+            loaded = store.load();
+        } catch (UnreadableConfigurationException exception) {
+            unreadable = exception;
+            throw exception;
+        }
+        unreadable = null;
+        current = loaded;
+        try {
+            refresh(UnaryOperator.identity());
+        } catch (IOException | RuntimeException exception) {
+            LOGGER.warn("WorldArchive could not save its list of worlds: {}",
+                    SafeText.from(exception, "the list could not be saved", MESSAGE_LIMIT));
+        }
+        if (current == loaded) {
+            // The refresh saved nothing new, so it published nothing; a retried load must still reach listeners.
+            publish(loaded);
+        }
+        return current;
+    }
+
+    /** Applies edits and brings the world list in step with the saves folder, as one update. */
+    private WorldArchiveConfig refresh(UnaryOperator<WorldArchiveConfig> edits) throws IOException {
+        requireReadable();
+        Scan scan = scan(current);
+        List<WorldNotice> reconciled = new ArrayList<>();
+        try {
+            return updateNow(config -> {
+                WorldArchiveConfig edited = edits.apply(config);
+                WorldReconciliation reconciliation = WorldConfigReconciler.reconcile(edited.worlds(), scan.worlds());
+                reconciled.addAll(reconciliation.notices());
+                return edited.withWorlds(reconciliation.worlds());
+            });
+        } finally {
+            notices = Stream.concat(scan.notices().stream(), reconciled.stream()).toList();
+        }
+    }
+
+    private WorldArchiveConfig updateNow(UnaryOperator<WorldArchiveConfig> change) throws IOException {
+        requireReadable();
+        List<Runnable> releases = new ArrayList<>();
+        try {
+            WorldArchiveConfig saved = store.update(fresh -> {
+                WorldArchiveConfig changed = change.apply(fresh);
+                if (!changed.equals(fresh)) {
+                    releases.addAll(acquireGuards(changed));
+                }
+                return changed;
+            }, List.copyOf(knownWorlds));
+            if (!saved.equals(current)) {
+                createNewFolders(current, saved);
+                current = saved;
+                publish(saved);
+            }
+            return saved;
+        } catch (UnreadableConfigurationException exception) {
+            unreadable = exception;
+            throw exception;
+        } finally {
+            release(releases);
+        }
+    }
+
+    /** Nothing is written while the file cannot be read; only {@link #reset} replaces it. */
+    private void requireReadable() throws UnreadableConfigurationException {
+        UnreadableConfigurationException failure = unreadable;
+        if (failure != null) {
+            throw new UnreadableConfigurationException(failure.file(), failure.getCause());
+        }
+    }
+
+    private Optional<Path> resetNow() throws IOException {
+        Scan scan = scan(WorldArchiveConfig.defaults());
+        List<WorldNotice> reconciled = new ArrayList<>();
+        List<Runnable> releases = new ArrayList<>();
+        try {
+            Optional<WorldArchiveConfigStore.Reset> reset = store.reset(defaults -> {
+                WorldReconciliation reconciliation = WorldConfigReconciler.reconcile(List.of(), scan.worlds());
+                reconciled.addAll(reconciliation.notices());
+                WorldArchiveConfig fresh = defaults.withWorlds(reconciliation.worlds());
+                releases.addAll(acquireGuards(fresh));
+                return fresh;
+            }, List.copyOf(knownWorlds), clock.instant());
+            if (reset.isEmpty()) {
+                loadNow();
+                return Optional.empty();
+            }
+            unreadable = null;
+            current = reset.get().config();
+            notices = Stream.concat(scan.notices().stream(), reconciled.stream()).toList();
+            publish(reset.get().config());
+            return Optional.of(reset.get().keptCopy());
+        } finally {
+            release(releases);
+        }
+    }
+
+    /**
+     * Reads the identity of each world folder in the saves folder. A folder that copies a world
+     * still found where {@code reference} expects it gets its own identity first.
+     */
+    private Scan scan(WorldArchiveConfig reference) throws IOException {
+        List<Path> folders = WorldFolderDiscovery.discover(savesDirectory);
+        remember(folders);
+        List<DiscoveredWorld> found = new ArrayList<>(folders.size());
+        List<WorldNotice> scanNotices = new ArrayList<>();
+        for (Path folder : folders) {
+            try {
+                found.add(new DiscoveredWorld(folder, identities.loadOrCreate(folder)));
+            } catch (IOException exception) {
+                scanNotices.add(new WorldNotice.IdentityUnreadable(folder, reason(exception)));
+            }
+        }
+        for (WorldConfigReconciler.Copy copy : WorldConfigReconciler.copies(reference.worlds(), found)) {
+            int index = found.indexOf(new DiscoveredWorld(copy.folder(), copy.copiedId()));
+            try {
+                WorldId own = identities.giveCopyItsOwnIdentity(copy.folder(), copy.copiedId()).worldId();
+                found.set(index, new DiscoveredWorld(copy.folder(), own));
+                scanNotices.add(new WorldNotice.CopyGotOwnIdentity(copy.folder(), copy.original()));
+            } catch (IOException exception) {
+                found.remove(index);
+                scanNotices.add(new WorldNotice.IdentityUnreadable(copy.folder(), reason(exception)));
+            }
+        }
+        return new Scan(found, scanNotices);
+    }
+
+    /**
+     * Creates each backup folder that the new settings name for the first time. Backups never
+     * create a folder the player chose, because a missing one means its drive is away; a folder
+     * that cannot be created now is only logged, and the settings show it as unavailable.
+     */
+    private static void createNewFolders(WorldArchiveConfig before, WorldArchiveConfig after) {
+        Set<Path> added = new LinkedHashSet<>(after.destinations());
+        added.removeAll(before.destinations());
+        for (Path folder : added) {
+            try {
+                Files.createDirectories(folder);
+            } catch (IOException | SecurityException failure) {
+                LOGGER.warn("WorldArchive could not create the backup folder {}: {}", folder,
+                        SafeText.from(failure, "no reason was given", MESSAGE_LIMIT));
+            }
+        }
+    }
+
+    private void remember(Collection<Path> worldFolders) {
+        worldFolders.forEach(folder -> knownWorlds.add(folder.toAbsolutePath().normalize()));
+    }
+
+    private List<Runnable> acquireGuards(WorldArchiveConfig config) {
+        List<Runnable> releases = new ArrayList<>(guards.size());
+        try {
+            for (Function<WorldArchiveConfig, Runnable> guard : guards) {
+                releases.add(Objects.requireNonNull(guard.apply(config), "configuration guard release"));
+            }
+            return releases;
+        } catch (RuntimeException | Error exception) {
+            release(releases);
+            throw exception;
+        }
+    }
+
+    private static void release(List<Runnable> releases) {
+        for (int index = releases.size() - 1; index >= 0; index--) {
+            releases.get(index).run();
+        }
+    }
+
+    private void publish(WorldArchiveConfig config) {
+        for (Consumer<WorldArchiveConfig> listener : listeners) {
+            try {
+                listener.accept(config);
+            } catch (RuntimeException exception) {
+                LOGGER.warn("WorldArchive configuration listener failed: {}",
+                        SafeText.from(exception, "Configuration listener failed", MESSAGE_LIMIT));
+            }
+        }
+    }
+
+    private static String reason(IOException exception) {
+        return SafeText.from(exception, "the identity file could not be read", MESSAGE_LIMIT);
+    }
+
+    /** The world folders a scan found, with the identity each carries, and what to tell the player. */
+    private record Scan(List<DiscoveredWorld> worlds, List<WorldNotice> notices) {
+    }
+
+    /** A draft waiting to be checked, and where its result goes. */
+    private record PendingValidation(SettingsDraft draft, CompletableFuture<SettingsValidation> result) {
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsValidation.java b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsValidation.java
index be5014d..f37f8d2 100644
--- a/src/main/java/dev/ishaanko/worldarchive/settings/SettingsValidation.java
+++ b/src/main/java/dev/ishaanko/worldarchive/settings/SettingsValidation.java
@@ -1,38 +1,45 @@
 package dev.ishaanko.worldarchive.settings;
 
 import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
+import dev.ishaanko.worldarchive.model.WorldId;
 import java.util.Collections;
 import java.util.LinkedHashMap;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
+import java.util.Set;
 
-/** A validated configuration candidate plus field-addressable errors. */
+/**
+ * The result of checking a {@link SettingsDraft}: the configuration to save, or what is wrong.
+ * Problems with the Git and ZIP tabs are keyed by field; problems with one world's own fields
+ * are keyed by that world and field, so two worlds with problems each keep their own.
+ */
 public record SettingsValidation(
         Optional<WorldArchiveConfig> config,
-        Map<SettingsField, String> issues) {
+        Map<SettingsField, String> issues,
+        Map<WorldId, Map<SettingsField, String>> worldIssues) {
     public SettingsValidation {
         Objects.requireNonNull(config, "config");
-        Map<SettingsField, String> safeIssues = new LinkedHashMap<>();
-        Objects.requireNonNull(issues, "issues").forEach((field, message) -> {
-            Objects.requireNonNull(field, "issue field");
-            String safeMessage = SensitiveDataRedactor.redact(
-                            Objects.requireNonNull(message, "issue message"))
-                    .strip();
-            if (safeMessage.isEmpty()
-                    || safeMessage.length() > 512
-                    || safeMessage.chars().anyMatch(Character::isISOControl)) {
-                throw new IllegalArgumentException("Settings issue message is invalid");
-            }
-            safeIssues.put(field, safeMessage);
-        });
-        issues = Collections.unmodifiableMap(safeIssues);
-        if (issues.isEmpty() != config.isPresent()) {
+        issues = Collections.unmodifiableMap(new LinkedHashMap<>(issues));
+        Map<WorldId, Map<SettingsField, String>> copied = new LinkedHashMap<>();
+        worldIssues.forEach((world, fields) ->
+                copied.put(world, Collections.unmodifiableMap(new LinkedHashMap<>(fields))));
+        worldIssues = Collections.unmodifiableMap(copied);
+        if ((issues.isEmpty() && worldIssues.isEmpty()) != config.isPresent()) {
             throw new IllegalArgumentException("A settings result must contain either a config or issues");
         }
     }
 
+    public static SettingsValidation valid(WorldArchiveConfig config) {
+        return new SettingsValidation(Optional.of(config), Map.of(), Map.of());
+    }
+
+    public static SettingsValidation invalid(
+            Map<SettingsField, String> issues,
+            Map<WorldId, Map<SettingsField, String>> worldIssues) {
+        return new SettingsValidation(Optional.empty(), issues, worldIssues);
+    }
+
     public boolean isValid() {
         return config.isPresent();
     }
@@ -41,7 +48,22 @@ public Optional<String> issue(SettingsField field) {
         return Optional.ofNullable(issues.get(Objects.requireNonNull(field, "field")));
     }
 
+    public Optional<String> issue(WorldId world, SettingsField field) {
+        return Optional.ofNullable(worldIssues.getOrDefault(world, Map.of()).get(field));
+    }
+
+    /** The worlds that have a problem, for marking them in the world list. */
+    public Set<WorldId> invalidWorlds() {
+        return worldIssues.keySet();
+    }
+
+    /** The first world problem, in world order. */
+    public Optional<String> firstWorldIssue() {
+        return worldIssues.values().stream().flatMap(fields -> fields.values().stream()).findFirst();
+    }
+
+    /** The first problem of any kind: the Git and ZIP tabs first, then the worlds. */
     public Optional<String> firstIssue() {
-        return issues.values().stream().findFirst();
+        return issues.values().stream().findFirst().or(this::firstWorldIssue);
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/SystemSettingsHealthProbe.java b/src/main/java/dev/ishaanko/worldarchive/settings/SystemSettingsHealthProbe.java
deleted file mode 100644
index b8ad267..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/settings/SystemSettingsHealthProbe.java
+++ /dev/null
@@ -1,164 +0,0 @@
-package dev.ishaanko.worldarchive.settings;
-
-import dev.ishaanko.worldarchive.config.GitDestinationConfig;
-import dev.ishaanko.worldarchive.storage.git.GitBackendSettings;
-import dev.ishaanko.worldarchive.storage.git.GitCommandRunner;
-import dev.ishaanko.worldarchive.storage.git.GitToolHealth;
-import dev.ishaanko.worldarchive.storage.git.GitToolProbe;
-import dev.ishaanko.worldarchive.storage.git.SystemGitCommandRunner;
-import java.io.IOException;
-import java.nio.file.FileStore;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.time.Duration;
-import java.util.Locale;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Concrete Git, Git LFS, and filesystem readiness probe for client settings. */
-public final class SystemSettingsHealthProbe implements SettingsHealthProbe {
-    private static final Duration TOOL_TIMEOUT = Duration.ofSeconds(10);
-
-    private static final int OUTPUT_LIMIT = 64 * 1_024;
-
-    private final Path workingDirectory;
-
-    private final GitCommandRunner gitRunner;
-
-    public SystemSettingsHealthProbe(Path workingDirectory) {
-        this(workingDirectory, new SystemGitCommandRunner());
-    }
-
-    SystemSettingsHealthProbe(Path workingDirectory, GitCommandRunner gitRunner) {
-        this.workingDirectory = Objects.requireNonNull(workingDirectory, "workingDirectory")
-                .toAbsolutePath()
-                .normalize();
-        this.gitRunner = Objects.requireNonNull(gitRunner, "gitRunner");
-    }
-
-    @Override
-    public SettingsHealthSnapshot probe(SettingsProbeRequest request) throws InterruptedException {
-        Objects.requireNonNull(request, "request");
-        checkInterrupted();
-        SettingsHealthItem gitTool = SettingsHealthItem.disabled();
-        SettingsHealthItem lfsTool = SettingsHealthItem.disabled();
-        SettingsHealthItem repository = SettingsHealthItem.disabled();
-        SettingsHealthItem remote = SettingsHealthItem.disabled();
-        if (request.gitEnabled()) {
-            GitToolHealth tools = probeGitTools(request);
-            gitTool = toolItem(
-                    tools.gitAvailable(),
-                    tools.gitVersion(),
-                    tools.gitFailure(),
-                    "Git");
-            lfsTool = toolItem(
-                    tools.lfsAvailable(),
-                    tools.lfsVersion(),
-                    tools.lfsFailure(),
-                    "Git LFS");
-            repository = probeDirectory(request.gitRepository(), "repository");
-            remote = request.remoteConfigured()
-                    ? new SettingsHealthItem(
-                            SettingsHealthStatus.HEALTHY,
-                            "configured; connectivity is checked during sync")
-                    : new SettingsHealthItem(SettingsHealthStatus.UNCONFIGURED, "not configured");
-        }
-
-        SettingsHealthItem zip = request.zipEnabled()
-                ? probeDirectory(request.zipDirectory(), "archive folder")
-                : SettingsHealthItem.disabled();
-        checkInterrupted();
-        return new SettingsHealthSnapshot(gitTool, lfsTool, repository, remote, zip);
-    }
-
-    private GitToolHealth probeGitTools(SettingsProbeRequest request) throws InterruptedException {
-        Path repository = request.gitRepository()
-                .orElseGet(() -> workingDirectory.resolve("worldarchive-health-probe.git"));
-        GitBackendSettings settings = new GitBackendSettings(
-                true,
-                repository,
-                request.gitExecutable(),
-                GitDestinationConfig.DEFAULT_REMOTE_NAME,
-                Optional.empty(),
-                GitDestinationConfig.DEFAULT_LFS_PATTERNS,
-                TOOL_TIMEOUT,
-                OUTPUT_LIMIT);
-        return new GitToolProbe(settings, gitRunner).probe();
-    }
-
-    private static SettingsHealthItem toolItem(
-            boolean available,
-            Optional<String> version,
-            Optional<String> failure,
-            String label) {
-        if (available) {
-            return new SettingsHealthItem(
-                    SettingsHealthStatus.HEALTHY,
-                    version.orElse(label + " is ready"));
-        }
-        String message = failure.filter(value -> !value.isBlank()).orElse(label + " is not installed");
-        return new SettingsHealthItem(SettingsHealthStatus.TOOL_MISSING, message);
-    }
-
-    private static SettingsHealthItem probeDirectory(
-            Optional<Path> configuredPath,
-            String label) throws InterruptedException {
-        if (configuredPath.isEmpty()) {
-            return new SettingsHealthItem(SettingsHealthStatus.UNCONFIGURED, "not configured");
-        }
-        checkInterrupted();
-        Path destination = configuredPath.orElseThrow().toAbsolutePath().normalize();
-        try {
-            Path existing = destination;
-            while (existing != null && !Files.exists(existing, LinkOption.NOFOLLOW_LINKS)) {
-                existing = existing.getParent();
-            }
-            if (existing == null) {
-                return unavailable(label + " has no accessible parent folder");
-            }
-            if (Files.isSymbolicLink(existing)) {
-                return unavailable(label + " uses a symbolic-link path component");
-            }
-            Path realExisting = existing.toRealPath();
-            if (!Files.isDirectory(realExisting, LinkOption.NOFOLLOW_LINKS)) {
-                return unavailable(label + " or its nearest existing parent is not a folder");
-            }
-            if (!Files.isReadable(realExisting)) {
-                return unavailable(label + " is not readable");
-            }
-            if (!Files.isWritable(realExisting)) {
-                return unavailable(label + " is not writable");
-            }
-            FileStore fileStore = Files.getFileStore(realExisting);
-            long usableBytes = fileStore.getUsableSpace();
-            if (usableBytes <= 0) {
-                return unavailable(label + " has no usable space");
-            }
-            return new SettingsHealthItem(
-                    SettingsHealthStatus.HEALTHY,
-                    label + " is ready (" + formatAvailableSpace(usableBytes) + " available)");
-        } catch (IOException | SecurityException exception) {
-            return unavailable(label + " is unavailable");
-        }
-    }
-
-    private static SettingsHealthItem unavailable(String message) {
-        return new SettingsHealthItem(SettingsHealthStatus.UNAVAILABLE, message);
-    }
-
-    private static String formatAvailableSpace(long bytes) {
-        double gibibytes = bytes / (1024.0 * 1024.0 * 1024.0);
-        if (gibibytes >= 0.1) {
-            return String.format(Locale.ROOT, "%.1f GiB", gibibytes);
-        }
-        double mebibytes = bytes / (1024.0 * 1024.0);
-        return String.format(Locale.ROOT, "%.1f MiB", mebibytes);
-    }
-
-    private static void checkInterrupted() throws InterruptedException {
-        if (Thread.currentThread().isInterrupted()) {
-            throw new InterruptedException("Settings health probe was cancelled");
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/WorldArchiveSettingsRepository.java b/src/main/java/dev/ishaanko/worldarchive/settings/WorldArchiveSettingsRepository.java
deleted file mode 100644
index ed9a6a8..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/settings/WorldArchiveSettingsRepository.java
+++ /dev/null
@@ -1,72 +0,0 @@
-package dev.ishaanko.worldarchive.settings;
-
-import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
-import dev.ishaanko.worldarchive.config.WorldArchiveConfigStore;
-import java.io.IOException;
-import java.nio.file.Path;
-import java.util.Collection;
-import java.util.List;
-import java.util.Objects;
-import java.util.function.Supplier;
-
-/** Shared settings access used by every UI and command entry point. */
-public final class WorldArchiveSettingsRepository {
-    private final WorldArchiveConfigStore store;
-
-    private final Supplier<? extends Collection<Path>> knownWorldPaths;
-
-    private final SettingsDefaults defaults;
-
-    private WorldArchiveConfig current;
-
-    public WorldArchiveSettingsRepository(
-            WorldArchiveConfigStore store,
-            Supplier<? extends Collection<Path>> knownWorldPaths) {
-        this(store, knownWorldPaths, SettingsDefaults.fromConfigFile(
-                Objects.requireNonNull(store, "store").file()));
-    }
-
-    public WorldArchiveSettingsRepository(
-            WorldArchiveConfigStore store,
-            Supplier<? extends Collection<Path>> knownWorldPaths,
-            SettingsDefaults defaults) {
-        this.store = Objects.requireNonNull(store, "store");
-        this.knownWorldPaths = Objects.requireNonNull(knownWorldPaths, "knownWorldPaths");
-        this.defaults = Objects.requireNonNull(defaults, "defaults");
-        current = defaults.resolve(WorldArchiveConfig.defaults());
-    }
-
-    public synchronized WorldArchiveConfig load() throws IOException {
-        List<Path> worlds = snapshotWorldPaths();
-        WorldArchiveConfig loaded = store.load(worlds);
-        WorldArchiveConfig resolved = defaults.resolve(loaded).validateDestinations(worlds);
-        if (!resolved.equals(loaded)) {
-            store.save(resolved, worlds);
-        }
-        current = resolved;
-        return current;
-    }
-
-    public synchronized void save(WorldArchiveConfig config) throws IOException {
-        Objects.requireNonNull(config, "config");
-        List<Path> worlds = snapshotWorldPaths();
-        WorldArchiveConfig validated = defaults.resolve(config).validateDestinations(worlds);
-        store.save(validated, worlds);
-        current = validated;
-    }
-
-    public synchronized WorldArchiveConfig current() {
-        return current;
-    }
-
-    public Path file() {
-        return store.file();
-    }
-
-    private List<Path> snapshotWorldPaths() {
-        Collection<Path> supplied = Objects.requireNonNull(
-                knownWorldPaths.get(),
-                "knownWorldPaths result");
-        return supplied.stream().map(path -> Objects.requireNonNull(path, "knownWorldPath")).toList();
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/WorldConfigReconciler.java b/src/main/java/dev/ishaanko/worldarchive/settings/WorldConfigReconciler.java
index 36dbff1..71c06f2 100644
--- a/src/main/java/dev/ishaanko/worldarchive/settings/WorldConfigReconciler.java
+++ b/src/main/java/dev/ishaanko/worldarchive/settings/WorldConfigReconciler.java
@@ -1,81 +1,119 @@
 package dev.ishaanko.worldarchive.settings;
 
 import dev.ishaanko.worldarchive.config.WorldConfig;
-import dev.ishaanko.worldarchive.config.StoragePolicy;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.nio.file.Path;
 import java.util.ArrayList;
-import java.util.HashMap;
 import java.util.HashSet;
+import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
+import java.util.function.Function;
+import java.util.stream.Collectors;
 
-/** Preserves settings only when a discovered world has the same stable identity. */
+/**
+ * Matches world folders found on disk to stored world settings by the identity each folder
+ * carries, so a world keeps its settings when its folder is renamed or moved. It reads nothing
+ * from disk; the settings service scans the folders and calls it.
+ */
 public final class WorldConfigReconciler {
     private WorldConfigReconciler() {
     }
 
-    public static WorldReconciliation reconcile(
-            List<WorldConfig> existing,
-            List<DiscoveredWorld> discovered) {
-        Objects.requireNonNull(existing, "existing");
-        Objects.requireNonNull(discovered, "discovered");
-        Map<WorldId, WorldConfig> existingById = new HashMap<>();
-        Map<Path, WorldConfig> existingByPath = new HashMap<>();
-        for (WorldConfig world : existing) {
-            existingById.put(world.worldId(), world);
-            existingByPath.put(world.path().toAbsolutePath().normalize(), world);
+    /**
+     * Folders that carry the identity of another folder found where the settings expect that
+     * identity: copies made in a file manager. The caller gives each its own identity before
+     * {@link #reconcile}, so a copy never takes over the original's settings or backup history.
+     */
+    public static List<Copy> copies(List<WorldConfig> stored, List<DiscoveredWorld> found) {
+        Map<WorldId, WorldConfig> storedById = byId(stored);
+        List<Copy> copies = new ArrayList<>();
+        for (Map.Entry<WorldId, List<Path>> group : groupById(found).entrySet()) {
+            WorldConfig known = storedById.get(group.getKey());
+            List<Path> folders = group.getValue();
+            if (folders.size() > 1 && known != null && folders.contains(known.path())) {
+                folders.stream()
+                        .filter(folder -> !folder.equals(known.path()))
+                        .forEach(folder -> copies.add(new Copy(folder, group.getKey(), known.path())));
+            }
+        }
+        return List.copyOf(copies);
+    }
+
+    /**
+     * The world settings after a scan. A folder with a known identity keeps that world's
+     * settings, at its new path when it moved; a new identity gets default settings. Stored
+     * worlds whose folder was not found stay. When several folders carry one identity, only the
+     * folder the settings expect keeps it; when none of them is that folder, none is added and
+     * the player is told.
+     */
+    public static WorldReconciliation reconcile(List<WorldConfig> stored, List<DiscoveredWorld> found) {
+        Map<WorldId, WorldConfig> storedById = byId(stored);
+        Set<Path> storedPaths = stored.stream().map(WorldConfig::path).collect(Collectors.toSet());
+        List<WorldConfig> worlds = new ArrayList<>();
+        List<WorldNotice> notices = new ArrayList<>();
+        for (Map.Entry<WorldId, List<Path>> group : groupById(found).entrySet()) {
+            WorldConfig known = storedById.get(group.getKey());
+            Optional<Path> owner = owner(group.getValue(), known);
+            if (owner.isEmpty()) {
+                notices.add(new WorldNotice.SharedIdentity(group.getValue()));
+            } else if (known != null) {
+                worlds.add(known.withPath(owner.get()));
+            } else {
+                worlds.add(WorldConfig.defaults(group.getKey(), owner.get()));
+                if (storedPaths.contains(owner.get())) {
+                    notices.add(new WorldNotice.IdentityReplaced(owner.get()));
+                }
+            }
         }
+        keepUnmatched(stored, worlds);
+        return new WorldReconciliation(worlds, notices);
+    }
 
-        List<WorldConfig> result = new ArrayList<>();
-        List<String> errors = new ArrayList<>();
+    /** The folder that keeps an identity: the only one, or the one the settings expect. */
+    private static Optional<Path> owner(List<Path> folders, WorldConfig known) {
+        if (folders.size() == 1) {
+            return Optional.of(folders.getFirst());
+        }
+        return known != null && folders.contains(known.path()) ? Optional.of(known.path()) : Optional.empty();
+    }
+
+    /** Adds the stored worlds whose identity and folder no scanned folder took. */
+    private static void keepUnmatched(List<WorldConfig> stored, List<WorldConfig> worlds) {
         Set<WorldId> usedIds = new HashSet<>();
         Set<Path> usedPaths = new HashSet<>();
-        for (DiscoveredWorld candidate : discovered) {
-            Path path = candidate.path();
-            if (candidate.error().isPresent()) {
-                errors.add(candidate.error().orElseThrow());
-                continue;
-            }
-            WorldId worldId = candidate.worldId().orElseThrow();
-            if (usedPaths.contains(path)) {
-                errors.add("Two WorldArchive world identities use the same save folder");
-                continue;
+        worlds.forEach(world -> {
+            usedIds.add(world.worldId());
+            usedPaths.add(world.path());
+        });
+        for (WorldConfig world : stored) {
+            if (!usedIds.contains(world.worldId()) && !usedPaths.contains(world.path())) {
+                worlds.add(world);
             }
-            if (usedIds.contains(worldId)) {
-                errors.add("Two save folders share one WorldArchive world identity");
-                continue;
-            }
-            WorldConfig stored = existingById.get(worldId);
-            if (stored == null && existingByPath.containsKey(path)) {
-                errors.add(
-                        "A saved folder has a different WorldArchive identity. "
-                                + "Destination settings were not copied.");
-            }
-            boolean enabled = stored == null || stored.enabled();
-            result.add(new WorldConfig(
-                    worldId,
-                    enabled,
-                    path,
-                    stored == null ? Optional.empty() : stored.remoteUrl(),
-                    stored == null ? Optional.empty() : stored.zipDestination(),
-                    stored == null ? StoragePolicy.defaults()
-                            : stored.storagePolicy()));
-            usedIds.add(worldId);
-            usedPaths.add(path);
         }
+    }
 
-        for (WorldConfig stored : existing) {
-            Path path = stored.path().toAbsolutePath().normalize();
-            if (!usedIds.contains(stored.worldId()) && !usedPaths.contains(path)) {
-                result.add(stored);
-                usedIds.add(stored.worldId());
-                usedPaths.add(path);
-            }
+    private static Map<WorldId, WorldConfig> byId(List<WorldConfig> stored) {
+        return stored.stream().collect(Collectors.toMap(WorldConfig::worldId, Function.identity()));
+    }
+
+    private static Map<WorldId, List<Path>> groupById(List<DiscoveredWorld> found) {
+        Map<WorldId, List<Path>> groups = new LinkedHashMap<>();
+        for (DiscoveredWorld world : found) {
+            groups.computeIfAbsent(world.worldId(), ignored -> new ArrayList<>()).add(world.path());
+        }
+        return groups;
+    }
+
+    /** A folder copied from {@code original}, still carrying its identity {@code copiedId}. */
+    public record Copy(Path folder, WorldId copiedId, Path original) {
+        public Copy {
+            Objects.requireNonNull(folder, "folder");
+            Objects.requireNonNull(copiedId, "copiedId");
+            Objects.requireNonNull(original, "original");
         }
-        return new WorldReconciliation(result, errors);
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/WorldFolderDiscovery.java b/src/main/java/dev/ishaanko/worldarchive/settings/WorldFolderDiscovery.java
index 75c0ead..7e52cd0 100644
--- a/src/main/java/dev/ishaanko/worldarchive/settings/WorldFolderDiscovery.java
+++ b/src/main/java/dev/ishaanko/worldarchive/settings/WorldFolderDiscovery.java
@@ -1,38 +1,44 @@
 package dev.ishaanko.worldarchive.settings;
 
+import dev.ishaanko.worldarchive.recovery.RestoreWorkspace;
 import java.io.IOException;
+import java.nio.file.DirectoryStream;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
 import java.nio.file.Path;
 import java.nio.file.attribute.BasicFileAttributes;
-import java.util.ArrayList;
-import java.util.Comparator;
 import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
+import java.util.Set;
+import java.util.TreeSet;
 
-/** Read-only discovery of direct, non-linked Minecraft save directories. */
+/**
+ * Finds the worlds in a saves folder without changing anything. The saves folder and each world
+ * folder may be links, as launchers that share saves between instances create; each world is
+ * reported once, by its real path. Links inside a world are left to the capture, which refuses them.
+ * A restore's staging folder is never a world, even while it holds a {@code level.dat}.
+ */
 public final class WorldFolderDiscovery {
     private static final String LEVEL_DATA_FILE = "level.dat";
 
     private WorldFolderDiscovery() {
     }
 
+    /** The real paths of the worlds in the saves folder, sorted; empty when the folder does not exist. */
     public static List<Path> discover(Path savesDirectory) throws IOException {
-        Path saves = Objects.requireNonNull(savesDirectory, "savesDirectory")
-                .toAbsolutePath()
-                .normalize();
-        if (!safeDirectory(saves)) {
+        Path saves = Objects.requireNonNull(savesDirectory, "savesDirectory").toAbsolutePath().normalize();
+        if (!Files.isDirectory(saves)) {
             return List.of();
         }
-        Path realSaves = saves.toRealPath();
-        List<Path> worlds = new ArrayList<>();
-        try (var children = Files.newDirectoryStream(saves)) {
+        Set<Path> worlds = new TreeSet<>();
+        try (DirectoryStream<Path> children = Files.newDirectoryStream(saves.toRealPath())) {
             for (Path child : children) {
-                safeWorldDirectory(child, realSaves).ifPresent(worlds::add);
+                if (!child.getFileName().toString().startsWith(RestoreWorkspace.STAGING_PREFIX)) {
+                    realWorld(child).ifPresent(worlds::add);
+                }
             }
         }
-        worlds.sort(Comparator.comparing(Path::toString));
         return List.copyOf(worlds);
     }
 
@@ -47,45 +53,21 @@ public static boolean isDirectChild(Path savesDirectory, Path worldDirectory) {
         return saves.equals(world.getParent());
     }
 
-    private static Optional<Path> safeWorldDirectory(Path candidate, Path realSaves) {
+    /**
+     * The real path of one world folder, which may be a link; empty when the folder is not a world.
+     * A folder is a world when it holds a non-empty {@code level.dat} that is a regular file, not a link.
+     */
+    public static Optional<Path> realWorld(Path candidate) {
         try {
-            if (!safeDirectory(candidate)) {
-                return Optional.empty();
-            }
-            Path realWorld = candidate.toRealPath();
-            if (!Objects.equals(realWorld.getParent(), realSaves)) {
-                return Optional.empty();
-            }
-            Path levelData = candidate.resolve(LEVEL_DATA_FILE);
-            BasicFileAttributes attributes = Files.readAttributes(
-                    levelData,
+            BasicFileAttributes levelData = Files.readAttributes(
+                    candidate.resolve(LEVEL_DATA_FILE),
                     BasicFileAttributes.class,
                     LinkOption.NOFOLLOW_LINKS);
-            if (!attributes.isRegularFile()
-                    || attributes.isSymbolicLink()
-                    || attributes.isOther()
-                    || attributes.size() == 0) {
-                return Optional.empty();
-            }
-            Path realLevelData = levelData.toRealPath();
-            return Objects.equals(realLevelData.getParent(), realWorld)
-                    ? Optional.of(realWorld)
+            return levelData.isRegularFile() && levelData.size() > 0
+                    ? Optional.of(candidate.toRealPath())
                     : Optional.empty();
         } catch (IOException | SecurityException exception) {
             return Optional.empty();
         }
     }
-
-    private static boolean safeDirectory(Path directory) throws IOException {
-        if (!Files.exists(directory, LinkOption.NOFOLLOW_LINKS)) {
-            return false;
-        }
-        BasicFileAttributes attributes = Files.readAttributes(
-                directory,
-                BasicFileAttributes.class,
-                LinkOption.NOFOLLOW_LINKS);
-        return attributes.isDirectory()
-                && !attributes.isSymbolicLink()
-                && !attributes.isOther();
-    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/WorldNotice.java b/src/main/java/dev/ishaanko/worldarchive/settings/WorldNotice.java
new file mode 100644
index 0000000..cfb43d7
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/settings/WorldNotice.java
@@ -0,0 +1,42 @@
+package dev.ishaanko.worldarchive.settings;
+
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Objects;
+
+/** Something the Worlds tab tells the player about a world folder after the saves folder is scanned. */
+public sealed interface WorldNotice {
+    /** The folder carried the identity of {@code original}, so it is a copy; it now has its own backup history. */
+    record CopyGotOwnIdentity(Path copy, Path original) implements WorldNotice {
+        public CopyGotOwnIdentity {
+            Objects.requireNonNull(copy, "copy");
+            Objects.requireNonNull(original, "original");
+        }
+    }
+
+    /**
+     * The folders carry one identity and none is the folder the settings know, so none of them
+     * is added. The one the player opens first keeps the backup history; the next scan gives
+     * the others their own.
+     */
+    record SharedIdentity(List<Path> folders) implements WorldNotice {
+        public SharedIdentity {
+            folders = List.copyOf(folders);
+        }
+    }
+
+    /** A folder that had settings now carries another identity, so its old settings were not carried over. */
+    record IdentityReplaced(Path folder) implements WorldNotice {
+        public IdentityReplaced {
+            Objects.requireNonNull(folder, "folder");
+        }
+    }
+
+    /** The folder's identity file could not be read or written, so the folder is left out. */
+    record IdentityUnreadable(Path folder, String reason) implements WorldNotice {
+        public IdentityUnreadable {
+            Objects.requireNonNull(folder, "folder");
+            Objects.requireNonNull(reason, "reason");
+        }
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/settings/WorldReconciliation.java b/src/main/java/dev/ishaanko/worldarchive/settings/WorldReconciliation.java
index ac31a46..8e3b784 100644
--- a/src/main/java/dev/ishaanko/worldarchive/settings/WorldReconciliation.java
+++ b/src/main/java/dev/ishaanko/worldarchive/settings/WorldReconciliation.java
@@ -2,12 +2,11 @@
 
 import dev.ishaanko.worldarchive.config.WorldConfig;
 import java.util.List;
-import java.util.Objects;
 
-/** Reconciled per-world settings plus safe discovery errors. */
-public record WorldReconciliation(List<WorldConfig> worlds, List<String> errors) {
+/** The world settings after a scan, and what the Worlds tab should tell the player about it. */
+public record WorldReconciliation(List<WorldConfig> worlds, List<WorldNotice> notices) {
     public WorldReconciliation {
-        worlds = List.copyOf(Objects.requireNonNull(worlds, "worlds"));
-        errors = List.copyOf(Objects.requireNonNull(errors, "errors"));
+        worlds = List.copyOf(worlds);
+        notices = List.copyOf(notices);
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitAsyncExecutor.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitAsyncExecutor.java
deleted file mode 100644
index c75fb6b..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitAsyncExecutor.java
+++ /dev/null
@@ -1,42 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import dev.ishaanko.worldarchive.core.AsyncTasks;
-import java.util.Objects;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.TimeUnit;
-
-/**
- * Cancellation-aware executor ownership for Git storage operations. A submitted operation
- * can be stopped through its future without losing the outcome it produces, which is how a
- * snapshot published before an interrupted push still reaches the catalog.
- */
-final class GitAsyncExecutor implements AutoCloseable {
-    private static final long SHUTDOWN_WAIT_SECONDS = 5;
-
-    private final ExecutorService executor;
-
-    private final boolean ownsExecutor;
-
-    GitAsyncExecutor(ExecutorService executor, boolean ownsExecutor) {
-        this.executor = Objects.requireNonNull(executor, "executor");
-        this.ownsExecutor = ownsExecutor;
-    }
-
-    <T> CompletableFuture<T> submit(AsyncTasks.InterruptibleOperation<T> operation) {
-        return AsyncTasks.supplyInterruptible(executor, operation);
-    }
-
-    @Override
-    public void close() {
-        if (!ownsExecutor) {
-            return;
-        }
-        executor.shutdownNow();
-        try {
-            executor.awaitTermination(SHUTDOWN_WAIT_SECONDS, TimeUnit.SECONDS);
-        } catch (InterruptedException exception) {
-            Thread.currentThread().interrupt();
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitBackendSettings.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitBackendSettings.java
index 6272198..cb50599 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitBackendSettings.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitBackendSettings.java
@@ -1,178 +1,102 @@
 package dev.ishaanko.worldarchive.storage.git;
 
+import dev.ishaanko.worldarchive.config.FolderOrigin;
 import dev.ishaanko.worldarchive.config.GitDestinationConfig;
-import dev.ishaanko.worldarchive.config.DestinationTriggerConfig;
-import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.config.RemoteUrlPolicy;
 import java.nio.file.Path;
 import java.time.Duration;
 import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
+import java.util.regex.Pattern;
 
-/** Complete native Git backend settings after application defaults have been resolved. */
+/**
+ * Git storage settings with every default resolved.
+ *
+ * @param enabled whether Git backups run at all
+ * @param repository the folder that holds one bare repository per world, or for a single
+ *        repository (a world's, an import preview's) that repository itself
+ * @param folderOrigin who chose the folder that holds the repositories: WorldArchive's default
+ *        folder is created when a backup needs it, and a folder the player chose never is
+ * @param executable the Git program, normally {@code git}
+ * @param remoteName the name the remote gets in each repository's configuration
+ * @param remoteUrl the remote of a single repository; the store's own settings have none,
+ *        because each world's remote is passed to the store separately
+ * @param lfsPatterns the Git attribute patterns whose files are stored as Git LFS objects
+ * @param commandTimeout how long a network command or a tool check may run without printing
+ *        anything before it is stopped; local commands have no limit because Cancel stops them
+ * @param maximumOutputBytes the most standard output or error kept from one command
+ */
 public record GitBackendSettings(
         boolean enabled,
         Path repository,
+        FolderOrigin folderOrigin,
         String executable,
         String remoteName,
         Optional<String> remoteUrl,
         List<String> lfsPatterns,
         Duration commandTimeout,
-        int maximumOutputBytes,
-        Optional<WorldId> isolatedWorldId) {
+        int maximumOutputBytes) {
     public static final List<String> DEFAULT_LFS_PATTERNS = GitDestinationConfig.DEFAULT_LFS_PATTERNS;
 
     public static final Duration DEFAULT_COMMAND_TIMEOUT = Duration.ofMinutes(5);
 
     public static final int DEFAULT_MAXIMUM_OUTPUT_BYTES = 8 * 1_024 * 1_024;
 
+    private static final Pattern REMOTE_NAME = Pattern.compile("[A-Za-z0-9._][A-Za-z0-9._-]{0,63}");
+
     public GitBackendSettings {
-        repository = Objects.requireNonNull(repository, "repository")
-                .toAbsolutePath()
-                .normalize();
-        executable = requireText(executable, "executable");
-        Optional<String> configuredRemote = Objects.requireNonNull(remoteUrl, "remoteUrl");
-        Optional<String> validationRemote = configuredRemote.map(GitBackendSettings::validationUrl);
-        GitDestinationConfig validated = new GitDestinationConfig(
-                enabled,
-                Optional.of(repository),
-                remoteName,
-                validationRemote,
-                DestinationTriggerConfig.defaults(),
-                lfsPatterns);
-        remoteName = validated.remoteName();
-        remoteUrl = configuredRemote;
-        lfsPatterns = validated.lfsPatterns();
-        commandTimeout = Objects.requireNonNull(commandTimeout, "commandTimeout");
+        repository = Objects.requireNonNull(repository, "repository").toAbsolutePath().normalize();
+        Objects.requireNonNull(folderOrigin, "folderOrigin");
+        Objects.requireNonNull(executable, "executable");
+        if (executable.isBlank() || executable.chars().anyMatch(Character::isISOControl)) {
+            throw new IllegalArgumentException("Git executable is blank or contains control characters");
+        }
+        Objects.requireNonNull(remoteName, "remoteName");
+        if (!REMOTE_NAME.matcher(remoteName).matches() || remoteName.equals(".") || remoteName.equals("..")) {
+            throw new IllegalArgumentException("Git remote name is unsafe");
+        }
+        remoteUrl = Objects.requireNonNull(remoteUrl, "remoteUrl").map(RemoteUrlPolicy::validatePlain);
+        lfsPatterns = GitSnapshotManifest.validatePatterns(lfsPatterns);
+        Objects.requireNonNull(commandTimeout, "commandTimeout");
         if (commandTimeout.isZero() || commandTimeout.isNegative()) {
             throw new IllegalArgumentException("Git command timeout must be positive");
         }
         if (maximumOutputBytes < 1_024 || maximumOutputBytes > 64 * 1_024 * 1_024) {
             throw new IllegalArgumentException("Git output limit must be between 1 KiB and 64 MiB");
         }
-        isolatedWorldId = Objects.requireNonNull(isolatedWorldId, "isolatedWorldId");
     }
 
-    /** Compatibility constructor for a repository that may contain multiple worlds. */
-    public GitBackendSettings(
-            boolean enabled,
-            Path repository,
-            String executable,
-            String remoteName,
-            Optional<String> remoteUrl,
-            List<String> lfsPatterns,
-            Duration commandTimeout,
-            int maximumOutputBytes) {
-        this(
-                enabled,
-                repository,
-                executable,
-                remoteName,
-                remoteUrl,
-                lfsPatterns,
-                commandTimeout,
-                maximumOutputBytes,
-                Optional.empty());
-    }
-
-    public static GitBackendSettings from(GitDestinationConfig config, Path defaultRepository) {
+    /**
+     * The store settings for a configuration whose Git folder is filled in, as
+     * {@link dev.ishaanko.worldarchive.config.DefaultDestinations#resolve} does. They name no
+     * remote: each world's remote comes from that world's settings and is given to the store separately.
+     */
+    public static GitBackendSettings from(GitDestinationConfig config, FolderOrigin folderOrigin) {
         Objects.requireNonNull(config, "config");
-        Path repository = config.repository().orElseGet(
-                () -> Objects.requireNonNull(defaultRepository, "defaultRepository"));
         return new GitBackendSettings(
                 config.enabled(),
-                repository,
+                config.repository().orElseThrow(() -> new IllegalArgumentException("The Git folder is not set")),
+                folderOrigin,
                 "git",
                 config.remoteName(),
-                config.remoteUrl(),
-                config.lfsPatterns(),
-                DEFAULT_COMMAND_TIMEOUT,
-                DEFAULT_MAXIMUM_OUTPUT_BYTES,
-                Optional.empty());
-    }
-
-    /** Resolves the preserved shared repository settings migrated from schema 3, when present. */
-    public static Optional<GitBackendSettings> legacyFrom(GitDestinationConfig config) {
-        Objects.requireNonNull(config, "config");
-        return config.legacyRepository().map(repository -> new GitBackendSettings(
-                config.enabled(),
-                repository,
-                "git",
-                config.remoteName(),
-                config.legacyRemoteUrl(),
+                Optional.empty(),
                 config.lfsPatterns(),
                 DEFAULT_COMMAND_TIMEOUT,
-                DEFAULT_MAXIMUM_OUTPUT_BYTES,
-                Optional.empty()));
+                DEFAULT_MAXIMUM_OUTPUT_BYTES);
     }
 
-    GitBackendSettings forWorld(
-            Path worldRepository,
-            WorldId worldId,
-            Optional<String> worldRemoteUrl) {
+    /** The same settings for one repository and its remote. */
+    GitBackendSettings withRepository(Path singleRepository, Optional<String> singleRemoteUrl) {
         return new GitBackendSettings(
                 enabled,
-                worldRepository,
+                singleRepository,
+                folderOrigin,
                 executable,
                 remoteName,
-                worldRemoteUrl,
+                singleRemoteUrl,
                 lfsPatterns,
                 commandTimeout,
-                maximumOutputBytes,
-                Optional.of(Objects.requireNonNull(worldId, "worldId")));
-    }
-
-    GitBackendSettings forLegacyRepository(Path legacyRepository, Optional<String> legacyRemoteUrl) {
-        return new GitBackendSettings(
-                enabled,
-                legacyRepository,
-                executable,
-                remoteName,
-                legacyRemoteUrl,
-                lfsPatterns,
-                commandTimeout,
-                maximumOutputBytes,
-                Optional.empty());
-    }
-
-    GitBackendSettings withoutRemote(Path probeRepository) {
-        return new GitBackendSettings(
-                enabled,
-                probeRepository,
-                executable,
-                remoteName,
-                Optional.empty(),
-                lfsPatterns,
-                commandTimeout,
-                maximumOutputBytes,
-                Optional.empty());
-    }
-
-    static boolean isWorldRemoteTemplate(String remoteUrl) {
-        return Objects.requireNonNull(remoteUrl, "remoteUrl").contains("{worldId}");
-    }
-
-    static String resolveWorldRemote(String template, WorldId worldId) {
-        if (!isWorldRemoteTemplate(template)) {
-            throw new IllegalArgumentException("Git remote URL is not a per-world template");
-        }
-        return template.replace("{worldId}", Objects.requireNonNull(worldId, "worldId").toString());
-    }
-
-    private static String validationUrl(String remoteUrl) {
-        if (!isWorldRemoteTemplate(remoteUrl)) {
-            return remoteUrl;
-        }
-        return resolveWorldRemote(
-                remoteUrl,
-                WorldId.parse("00000000-0000-0000-0000-000000000001"));
-    }
-
-    private static String requireText(String value, String name) {
-        Objects.requireNonNull(value, name);
-        if (value.isBlank() || value.chars().anyMatch(Character::isISOControl)) {
-            throw new IllegalArgumentException(name + " is blank or contains control characters");
-        }
-        return value;
+                maximumOutputBytes);
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitBackupBackend.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitBackupBackend.java
deleted file mode 100644
index b32bc4a..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitBackupBackend.java
+++ /dev/null
@@ -1,328 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.nio.file.Path;
-import java.nio.file.attribute.FileTime;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.CompletionStage;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-
-/** Native Git/Git LFS storage using one external bare repository. */
-public final class GitBackupBackend implements GitSnapshotStore {
-    static final String MANIFEST_PATH = ".worldarchive-manifest.json";
-
-    private final GitBackendSettings settings;
-
-    private final GitCommandRunner runner;
-
-    private final GitCommands commands;
-
-    private final GitSnapshotVerifier verifier;
-
-    private final GitRepositoryManager repository;
-
-    private final GitRefStore refs;
-
-    private final GitRemoteSnapshotStore remoteSnapshots;
-
-    private final GitSnapshotCreator snapshotCreator;
-
-    private final GitAsyncExecutor async;
-
-    private final GitRepositoryLock lock;
-
-    private final GitSnapshotOperations operations;
-
-    /** Identity of a directory atomically published by a recovery restore. */
-    public record RestoreResult(
-            Path path,
-            Object fileKey,
-            FileTime creationTime,
-            Optional<String> directoryIdentityMarker,
-            Optional<String> publicationProblem) {
-        public RestoreResult {
-            path = Objects.requireNonNull(path, "path").toAbsolutePath().normalize();
-            Objects.requireNonNull(creationTime, "creationTime");
-            directoryIdentityMarker = Objects.requireNonNull(
-                    directoryIdentityMarker, "directoryIdentityMarker");
-            publicationProblem = Objects.requireNonNull(
-                    publicationProblem, "publicationProblem");
-        }
-    }
-
-    public GitBackupBackend(GitBackendSettings settings) {
-        this(
-                settings,
-                new SystemGitCommandRunner(),
-                Executors.newThreadPerTaskExecutor(Thread.ofVirtual().name("worldarchive-git-", 0).factory()),
-                true);
-    }
-
-    public GitBackupBackend(
-            GitBackendSettings settings,
-            GitCommandRunner runner,
-            ExecutorService executor) {
-        this(settings, runner, executor, false);
-    }
-
-    private GitBackupBackend(
-            GitBackendSettings settings,
-            GitCommandRunner runner,
-            ExecutorService executor,
-            boolean ownsExecutor) {
-        this.settings = Objects.requireNonNull(settings, "settings");
-        this.runner = Objects.requireNonNull(runner, "runner");
-        this.commands = new GitCommands(settings, runner);
-        this.verifier = new GitSnapshotVerifier(settings, commands);
-        this.repository = new GitRepositoryManager(settings, commands);
-        this.refs = new GitRefStore(settings, commands, repository);
-        this.remoteSnapshots = new GitRemoteSnapshotStore(settings, repository, refs);
-        this.snapshotCreator = new GitSnapshotCreator(
-                settings,
-                commands,
-                repository,
-                refs,
-                verifier);
-        this.async = new GitAsyncExecutor(executor, ownsExecutor);
-        this.lock = new GitRepositoryLock(settings);
-        this.operations = new GitSnapshotOperations(
-                settings,
-                runner,
-                commands,
-                verifier,
-                repository,
-                refs,
-                remoteSnapshots,
-                snapshotCreator,
-                lock);
-    }
-
-    @Override
-    public DestinationType destinationType() {
-        return DestinationType.GIT;
-    }
-
-    public CompletionStage<GitToolHealth> probeTools() {
-        return submit(() -> new GitToolProbe(settings, runner).probe());
-    }
-
-    @Override
-    public CompletionStage<DestinationResult> createBackup(
-            BackupCapture capture,
-            ProgressListener progressListener) {
-        Objects.requireNonNull(capture, "capture");
-        Objects.requireNonNull(progressListener, "progressListener");
-        return submit(() -> createBackupBlocking(capture, progressListener));
-    }
-
-    /**
-     * Writes the snapshot on the calling thread. An interrupt after the local snapshot is
-     * published still returns that snapshot as pending sync, so a caller that runs this on
-     * its own interruptible worker keeps the outcome.
-     */
-    DestinationResult createBackupBlocking(
-            BackupCapture capture,
-            ProgressListener progressListener) {
-        return operations.createBackupBlocking(capture, progressListener);
-    }
-
-    /** Lists this repository's snapshots on the calling thread. */
-    List<GitSnapshot> listSnapshotsBlocking(Optional<WorldId> worldId)
-            throws IOException, InterruptedException, GitStorageException {
-        return lock.withLock(() -> operations.listSnapshotsBlocking(worldId));
-    }
-
-    public CompletionStage<List<GitSnapshot>> listSnapshots(Optional<WorldId> worldId) {
-        Objects.requireNonNull(worldId, "worldId");
-        return submit(() -> listSnapshotsBlocking(worldId));
-    }
-
-    public CompletionStage<GitVerification> verifySnapshot(WorldId worldId, BackupId backupId) {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(backupId, "backupId");
-        return submit(() -> lock.withLock(() -> operations.verifySnapshotBlocking(worldId, backupId)));
-    }
-
-    @Override
-    public CompletionStage<BackupManifest> readManifest(WorldId worldId, BackupId backupId) {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(backupId, "backupId");
-        return submit(() -> lock.withLock(() -> {
-            repository.requireWorld(worldId);
-            repository.requireBare();
-            GitSnapshot snapshot = refs.resolveSnapshot(worldId, backupId);
-            return verifier.verifyMetadata(snapshot).manifest().manifest();
-        }));
-    }
-
-    /** Verifies a local snapshot or safely fetches and installs its configured remote copy. */
-    public CompletionStage<GitVerification> verifyRestorableSnapshot(
-            WorldId worldId,
-            BackupId backupId,
-            BackupManifest expectedManifest) {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(backupId, "backupId");
-        Objects.requireNonNull(expectedManifest, "expectedManifest");
-        requireManifestIdentity(worldId, backupId, expectedManifest);
-        return submit(() -> lock.withLock(
-                () -> operations.verifyRestorableSnapshotBlocking(
-                        worldId, backupId, expectedManifest)));
-    }
-
-    public CompletionStage<Path> restoreSnapshot(WorldId worldId, BackupId backupId, Path emptyStaging) {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(backupId, "backupId");
-        Objects.requireNonNull(emptyStaging, "emptyStaging");
-        return submit(() -> lock.withLock(
-                () -> operations.restoreSnapshotBlocking(
-                        worldId, backupId, Optional.empty(), emptyStaging)));
-    }
-
-    /** Restores only when the verified embedded manifest exactly matches the catalog manifest. */
-    public CompletionStage<Path> restoreSnapshot(
-            WorldId worldId,
-            BackupId backupId,
-            BackupManifest expectedManifest,
-            Path emptyStaging) {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(backupId, "backupId");
-        Objects.requireNonNull(expectedManifest, "expectedManifest");
-        Objects.requireNonNull(emptyStaging, "emptyStaging");
-        requireManifestIdentity(worldId, backupId, expectedManifest);
-        return submit(() -> lock.withLock(
-                () -> operations.restoreSnapshotBlocking(
-                        worldId, backupId, Optional.of(expectedManifest), emptyStaging)));
-    }
-
-    /** Atomically replaces an empty recovery staging directory and returns its exact new identity. */
-    public CompletionStage<RestoreResult> restoreSnapshotForRecovery(
-            WorldId worldId,
-            BackupId backupId,
-            BackupManifest expectedManifest,
-            Path emptyStaging) {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(backupId, "backupId");
-        Objects.requireNonNull(expectedManifest, "expectedManifest");
-        Objects.requireNonNull(emptyStaging, "emptyStaging");
-        requireManifestIdentity(worldId, backupId, expectedManifest);
-        return submit(() -> lock.withLock(
-                () -> operations.restoreSnapshotResultBlocking(
-                        worldId,
-                        backupId,
-                        Optional.of(expectedManifest),
-                        emptyStaging)));
-    }
-
-    public CompletionStage<Boolean> deleteSnapshot(WorldId worldId, BackupId backupId) {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(backupId, "backupId");
-        return submit(() -> lock.withLock(() -> operations.deleteSnapshotBlocking(worldId, backupId)));
-    }
-
-    /** Proves that the current configured remote has the exact local snapshot commit. */
-    public CompletionStage<Boolean> currentRemoteContainsSnapshot(
-            WorldId worldId,
-            BackupId backupId) {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(backupId, "backupId");
-        return submit(() -> lock.withLock(
-                () -> remoteSnapshots.containsExactLocalSnapshot(worldId, backupId)));
-    }
-
-    @Override
-    public CompletionStage<Boolean> deleteLocalSnapshot(WorldId worldId, BackupId backupId) {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(backupId, "backupId");
-        return submit(() -> lock.withLock(() ->
-                new GitStorageCompactor(settings, repository, refs, commands, verifier)
-                        .deleteLocalSnapshot(worldId, backupId)));
-    }
-
-    /** Frees Git and LFS storage that no remaining snapshot in this repository uses. */
-    public CompletionStage<Void> compactStorage(WorldId worldId) {
-        Objects.requireNonNull(worldId, "worldId");
-        return submit(() -> lock.withLock(() -> {
-            repository.requireWorld(worldId);
-            repository.requireBare();
-            new GitStorageCompactor(settings, repository, refs, commands, verifier)
-                    .compact(worldId, operations.listSnapshotsBlocking(Optional.empty()));
-            return null;
-        }));
-    }
-
-    @Override
-    public CompletionStage<GitVerification> hydrateExternalSnapshot(
-            WorldId worldId,
-            BackupId backupId,
-            BackupManifest expectedManifest,
-            String expectedCommit,
-            String remoteUrl) {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(backupId, "backupId");
-        Objects.requireNonNull(expectedManifest, "expectedManifest");
-        String commit = GitImportValidation.objectId(expectedCommit);
-        String remote = dev.ishaanko.worldarchive.config.RemoteUrlPolicy.validatePlain(remoteUrl);
-        requireManifestIdentity(worldId, backupId, expectedManifest);
-        return submit(() -> lock.withLock(() -> importRepository().hydrateExternalSnapshot(
-                worldId, backupId, expectedManifest, commit, remote)));
-    }
-
-    CompletionStage<Map<BackupId, GitImportInstallStatus>> installImportedSnapshots(
-            Path sourceRepository,
-            List<GitImportCandidate> candidates,
-            String remoteUrl,
-            boolean fullDownload,
-            boolean preserveHistory) {
-        Path source = Objects.requireNonNull(sourceRepository, "sourceRepository").toAbsolutePath().normalize();
-        List<GitImportCandidate> immutable = List.copyOf(candidates);
-        String remote = dev.ishaanko.worldarchive.config.RemoteUrlPolicy.validatePlain(remoteUrl);
-        return submit(() -> lock.withLock(() -> importRepository().installSnapshots(
-                source, immutable, remote, fullDownload, preserveHistory)));
-    }
-
-    CompletionStage<Integer> rebuildSnapshotRefs() {
-        return submit(() -> lock.withLock(() -> importRepository().rebuildSnapshotRefs()));
-    }
-
-    private GitImportRepository importRepository() {
-        return new GitImportRepository(settings, commands, repository, refs, verifier);
-    }
-
-    public CompletionStage<DestinationResult> syncSnapshot(WorldId worldId, BackupId backupId) {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(backupId, "backupId");
-        return submit(() -> lock.withLock(() -> operations.syncSnapshotBlocking(worldId, backupId)));
-    }
-
-    private static void requireManifestIdentity(
-            WorldId worldId,
-            BackupId backupId,
-            BackupManifest expectedManifest) {
-        if (!expectedManifest.worldId().equals(worldId)
-                || !expectedManifest.backupId().equals(backupId)) {
-            throw new IllegalArgumentException(
-                    "Expected Git manifest identity does not match the snapshot");
-        }
-    }
-
-    private <T> CompletableFuture<T> submit(GitInterruptibleOperation<T> operation) {
-        return async.submit(operation::run);
-    }
-
-    @Override
-    public void close() {
-        async.close();
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommand.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommand.java
index 8fb357a..b3d53ad 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommand.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommand.java
@@ -1,63 +1,62 @@
 package dev.ishaanko.worldarchive.storage.git;
 
+import java.io.IOException;
+import java.io.OutputStream;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Path;
 import java.time.Duration;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
-import java.util.Set;
+import java.util.Optional;
 
-/** One argument-safe Git process invocation. */
+/**
+ * One Git process to run: the program and its arguments (never a shell), the working directory,
+ * extra environment, standard input, and an optional idle limit. A command with an idle limit
+ * is stopped when it writes nothing for that long; a command without one runs until it exits or
+ * its caller is interrupted.
+ */
 public record GitCommand(
         List<String> arguments,
         Path workingDirectory,
         Map<String, String> environment,
-        byte[] standardInput,
-        Set<String> secrets,
-        Duration timeout,
+        Input standardInput,
+        Optional<Duration> idleTimeout,
         int maximumOutputBytes) {
     public GitCommand {
         arguments = List.copyOf(Objects.requireNonNull(arguments, "arguments"));
-        if (arguments.isEmpty() || arguments.stream().anyMatch(Objects::isNull)) {
-            throw new IllegalArgumentException("A Git command requires non-null arguments");
+        if (arguments.isEmpty()) {
+            throw new IllegalArgumentException("A Git command needs a program");
         }
         workingDirectory = Objects.requireNonNull(workingDirectory, "workingDirectory")
                 .toAbsolutePath()
                 .normalize();
         environment = Map.copyOf(Objects.requireNonNull(environment, "environment"));
-        standardInput = Objects.requireNonNull(standardInput, "standardInput").clone();
-        secrets = Set.copyOf(Objects.requireNonNull(secrets, "secrets"));
-        timeout = Objects.requireNonNull(timeout, "timeout");
-        if (timeout.isZero() || timeout.isNegative()) {
-            throw new IllegalArgumentException("Git command timeout must be positive");
+        Objects.requireNonNull(standardInput, "standardInput");
+        Objects.requireNonNull(idleTimeout, "idleTimeout");
+        if (idleTimeout.filter(limit -> limit.isZero() || limit.isNegative()).isPresent()) {
+            throw new IllegalArgumentException("A Git idle limit must be positive");
         }
         if (maximumOutputBytes < 1_024) {
-            throw new IllegalArgumentException("Git command output limit must be at least 1024 bytes");
+            throw new IllegalArgumentException("A Git output limit must be at least 1 KiB");
         }
     }
 
-    public static GitCommand of(
-            List<String> arguments,
-            Path workingDirectory,
-            Duration timeout,
-            int maximumOutputBytes) {
-        return new GitCommand(
-                arguments,
-                workingDirectory,
-                Map.of(),
-                new byte[0],
-                Set.of(),
-                timeout,
-                maximumOutputBytes);
-    }
+    /** Writes a command's standard input. The runner calls it once, on a thread of its own. */
+    @FunctionalInterface
+    public interface Input {
+        Input NONE = output -> {
+        };
 
-    public static byte[] utf8Input(String value) {
-        return Objects.requireNonNull(value, "value").getBytes(StandardCharsets.UTF_8);
-    }
+        void writeTo(OutputStream output) throws IOException;
 
-    @Override
-    public byte[] standardInput() {
-        return standardInput.clone();
+        static Input of(byte[] bytes) {
+            byte[] copy = bytes.clone();
+            return output -> output.write(copy);
+        }
+
+        static Input utf8(String text) {
+            return of(text.getBytes(StandardCharsets.UTF_8));
+        }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommandResult.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommandResult.java
index 7f34848..e1b4668 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommandResult.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommandResult.java
@@ -1,48 +1,17 @@
 package dev.ishaanko.worldarchive.storage.git;
 
-import java.nio.charset.StandardCharsets;
-import java.util.HexFormat;
 import java.util.Objects;
-import java.util.regex.Pattern;
 
-/** Bounded and redacted output from one Git process. */
+/** The exit code and the bounded standard output and error of one Git process. */
 public record GitCommandResult(
         int exitCode,
         String standardOutput,
         String standardError,
         boolean standardOutputTruncated,
-        boolean standardErrorTruncated,
-        long standardOutputBytes,
-        String standardOutputSha256) {
-    private static final Pattern SHA256 = Pattern.compile("[0-9a-f]{64}");
-
+        boolean standardErrorTruncated) {
     public GitCommandResult {
         Objects.requireNonNull(standardOutput, "standardOutput");
         Objects.requireNonNull(standardError, "standardError");
-        if (standardOutputBytes < 0) {
-            throw new IllegalArgumentException("Git output byte count must not be negative");
-        }
-        Objects.requireNonNull(standardOutputSha256, "standardOutputSha256");
-        if (!SHA256.matcher(standardOutputSha256).matches()) {
-            throw new IllegalArgumentException("Git output digest must be lowercase SHA-256");
-        }
-    }
-
-    public GitCommandResult(
-            int exitCode,
-            String standardOutput,
-            String standardError,
-            boolean standardOutputTruncated,
-            boolean standardErrorTruncated) {
-        this(
-                exitCode,
-                standardOutput,
-                standardError,
-                standardOutputTruncated,
-                standardErrorTruncated,
-                standardOutput.getBytes(StandardCharsets.UTF_8).length,
-                HexFormat.of().formatHex(GitInventory.sha256()
-                        .digest(standardOutput.getBytes(StandardCharsets.UTF_8))));
     }
 
     public boolean successful() {
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommandRunner.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommandRunner.java
index 028da67..171b3c8 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommandRunner.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommandRunner.java
@@ -1,9 +1,31 @@
 package dev.ishaanko.worldarchive.storage.git;
 
+import java.io.ByteArrayInputStream;
 import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
 
-/** Injectable boundary around native Git process execution. */
+/** The boundary around native Git processes. Tests replace it with a function. */
 @FunctionalInterface
 public interface GitCommandRunner {
     GitCommandResult run(GitCommand command) throws IOException, InterruptedException;
+
+    /**
+     * Runs a command and hands its standard output to the reader while the command runs; the
+     * returned result then carries no standard output. This default runs {@link #run} and
+     * replays its text, which suits test fakes. The system runner streams.
+     */
+    default GitCommandResult stream(GitCommand command, OutputReader reader)
+            throws IOException, InterruptedException, GitStorageException {
+        GitCommandResult result = run(command);
+        reader.read(new ByteArrayInputStream(result.standardOutput().getBytes(StandardCharsets.UTF_8)));
+        return new GitCommandResult(
+                result.exitCode(), "", result.standardError(), false, result.standardErrorTruncated());
+    }
+
+    /** Consumes a command's standard output as Git produces it. */
+    @FunctionalInterface
+    interface OutputReader {
+        void read(InputStream output) throws IOException, InterruptedException, GitStorageException;
+    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommandTimeoutException.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommandTimeoutException.java
index abf3b5f..7abce62 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommandTimeoutException.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommandTimeoutException.java
@@ -4,9 +4,19 @@
 import java.time.Duration;
 import java.util.Objects;
 
-/** Signals that a native Git command exceeded its bounded runtime. */
+/** Signals that a Git command with an idle limit wrote nothing for that long and was stopped. */
 public final class GitCommandTimeoutException extends IOException {
-    public GitCommandTimeoutException(Duration timeout) {
-        super("Git command timed out after " + Objects.requireNonNull(timeout, "timeout"));
+    public GitCommandTimeoutException(Duration idleLimit) {
+        super("Git made no progress for " + describe(Objects.requireNonNull(idleLimit, "idleLimit"))
+                + " and was stopped. Check the network connection and try again.");
+    }
+
+    private static String describe(Duration limit) {
+        long seconds = Math.max(1, limit.toSeconds());
+        if (seconds % 60 == 0) {
+            long minutes = seconds / 60;
+            return minutes == 1 ? "1 minute" : minutes + " minutes";
+        }
+        return seconds == 1 ? "1 second" : seconds + " seconds";
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommands.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommands.java
deleted file mode 100644
index 5b14f91..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitCommands.java
+++ /dev/null
@@ -1,145 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import java.io.IOException;
-import java.nio.file.Path;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
-import java.util.regex.Pattern;
-
-/** Builds and executes bounded native Git commands for one backend configuration. */
-final class GitCommands {
-    private static final Pattern OBJECT_ID = Pattern.compile("[0-9a-f]{40}");
-
-    private final GitBackendSettings settings;
-
-    private final GitCommandRunner runner;
-
-    GitCommands(GitBackendSettings settings, GitCommandRunner runner) {
-        this.settings = Objects.requireNonNull(settings, "settings");
-        this.runner = Objects.requireNonNull(runner, "runner");
-    }
-
-    GitCommandResult checked(
-            List<String> arguments,
-            Path workingDirectory,
-            Map<String, String> environment,
-            byte[] input) throws IOException, InterruptedException, GitStorageException {
-        return checked(arguments, workingDirectory, environment, input, true);
-    }
-
-    /**
-     * Runs a checked command without injecting {@code --git-dir=}. Only the bootstrap {@code init
-     * --bare} call needs this: it must run before {@code settings.repository()} exists.
-     */
-    GitCommandResult checkedRaw(
-            List<String> arguments,
-            Path workingDirectory,
-            Map<String, String> environment,
-            byte[] input) throws IOException, InterruptedException, GitStorageException {
-        return checked(arguments, workingDirectory, environment, input, false);
-    }
-
-    private GitCommandResult checked(
-            List<String> arguments,
-            Path workingDirectory,
-            Map<String, String> environment,
-            byte[] input,
-            boolean injectGitDir) throws IOException, InterruptedException, GitStorageException {
-        GitCommandResult result = run(
-                arguments,
-                workingDirectory,
-                environment,
-                input,
-                settings.maximumOutputBytes(),
-                injectGitDir);
-        if (!result.successful()) {
-            throw new GitStorageException(failureMessage(result));
-        }
-        if (result.standardOutputTruncated() || result.standardErrorTruncated()) {
-            throw new GitStorageException(
-                    "Git command output exceeded its configured safety limit");
-        }
-        return result;
-    }
-
-    GitCommandResult run(
-            List<String> arguments,
-            Path workingDirectory,
-            Map<String, String> environment,
-            byte[] input) throws IOException, InterruptedException {
-        return run(
-                arguments,
-                workingDirectory,
-                environment,
-                input,
-                settings.maximumOutputBytes(),
-                true);
-    }
-
-    GitCommandResult run(
-            List<String> arguments,
-            Path workingDirectory,
-            Map<String, String> environment,
-            byte[] input,
-            int maximumOutputBytes) throws IOException, InterruptedException {
-        return run(arguments, workingDirectory, environment, input, maximumOutputBytes, true);
-    }
-
-    private GitCommandResult run(
-            List<String> arguments,
-            Path workingDirectory,
-            Map<String, String> environment,
-            byte[] input,
-            int maximumOutputBytes,
-            boolean injectGitDir) throws IOException, InterruptedException {
-        List<String> fullArguments = new ArrayList<>(arguments.size() + 2);
-        fullArguments.add(settings.executable());
-        if (injectGitDir) {
-            fullArguments.add("--git-dir=" + settings.repository());
-        }
-        fullArguments.addAll(arguments);
-        return runner.run(new GitCommand(
-                fullArguments,
-                workingDirectory,
-                environment,
-                input,
-                settings.remoteUrl().map(Set::of).orElseGet(Set::of),
-                settings.commandTimeout(),
-                maximumOutputBytes));
-    }
-
-    static Map<String, String> indexEnvironment(Path index, boolean smudge) {
-        Map<String, String> environment = new HashMap<>();
-        environment.put("GIT_INDEX_FILE", index.toString());
-        if (!smudge) {
-            environment.put("GIT_LFS_SKIP_SMUDGE", "1");
-        }
-        return environment;
-    }
-
-    static String objectId(String value) throws GitStorageException {
-        String objectId = value.trim();
-        if (!OBJECT_ID.matcher(objectId).matches()) {
-            throw new GitStorageException("Git returned an invalid object ID");
-        }
-        return objectId;
-    }
-
-    static String failureMessage(GitCommandResult result) {
-        String detail = SystemGitCommandRunner.redactPatterns(result.standardError().isBlank()
-                ? result.standardOutput()
-                : result.standardError());
-        detail = detail.replaceAll("\\p{Cntrl}+", " ").trim();
-        if (detail.isEmpty()) {
-            return "Git command failed with exit code " + result.exitCode();
-        }
-        if (detail.length() > 1_024) {
-            detail = detail.substring(0, 1_024);
-        }
-        return "Git command failed: " + detail;
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitDeletion.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitDeletion.java
new file mode 100644
index 0000000..6bc9581
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitDeletion.java
@@ -0,0 +1,49 @@
+package dev.ishaanko.worldarchive.storage.git;
+
+import dev.ishaanko.worldarchive.model.SafeText;
+import java.util.Objects;
+
+/** What deleting one backup's Git snapshot did; a failed delete says why and what to do. */
+public record GitDeletion(Outcome outcome, String message) {
+    public GitDeletion {
+        Objects.requireNonNull(outcome, "outcome");
+        message = SafeText.require(message, "message", 2_048);
+    }
+
+    /** The four ways one delete can end. */
+    public enum Outcome {
+        /** This computer's copy, the remote copy, or both were removed; none is left. */
+        DELETED,
+        /** Neither this computer nor the world's remote has the backup. */
+        NOT_FOUND,
+        /**
+         * This computer has no copy and the world has no remote, so a copy on a remote could not
+         * be checked. For a backup that was synced, the remote copy may still exist.
+         */
+        REMOTE_NOT_CONFIGURED,
+        /** Nothing more was removed than the message says; the backup still exists somewhere. */
+        FAILED
+    }
+
+    public boolean failed() {
+        return outcome == Outcome.FAILED;
+    }
+
+    static GitDeletion deleted() {
+        return new GitDeletion(Outcome.DELETED, "Deleted");
+    }
+
+    static GitDeletion notFound() {
+        return new GitDeletion(Outcome.NOT_FOUND, "Neither this computer nor the remote has this backup");
+    }
+
+    static GitDeletion remoteNotConfigured() {
+        return new GitDeletion(
+                Outcome.REMOTE_NOT_CONFIGURED,
+                "This computer has no copy, and the world has no remote to check for one");
+    }
+
+    static GitDeletion failed(String message) {
+        return new GitDeletion(Outcome.FAILED, SafeText.of(message, "The backup could not be deleted", 1_024));
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitHistoryImporter.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitHistoryImporter.java
deleted file mode 100644
index 9ec325c..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitHistoryImporter.java
+++ /dev/null
@@ -1,206 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import dev.ishaanko.worldarchive.config.RemoteUrlPolicy;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
-
-/** Fetches an arbitrary safe Git remote into a private repository for metadata-only preview. */
-final class GitHistoryImporter {
-    private static final String IMPORT_REFS = "refs/worldarchive/import/";
-
-    private static final int MAXIMUM_REFS = 256;
-
-    private static final int MAXIMUM_COMMITS = 10_000;
-
-    private final GitBackendSettings baseSettings;
-
-    private final GitCommandRunner runner;
-
-    GitHistoryImporter(GitBackendSettings baseSettings, GitCommandRunner runner) {
-        this.baseSettings = Objects.requireNonNull(baseSettings, "baseSettings");
-        this.runner = Objects.requireNonNull(runner, "runner");
-    }
-
-    GitPreparedImport prepare(String requestedRemote)
-            throws IOException, InterruptedException, GitStorageException {
-        String remote = RemoteUrlPolicy.validatePlain(requestedRemote);
-        Path workspace = Files.createTempDirectory("worldarchive-git-import-")
-                .toAbsolutePath().normalize();
-        Path temporary = workspace.resolve("repository.git");
-        boolean retained = false;
-        try {
-            GitBackendSettings settings = baseSettings.forLegacyRepository(
-                    temporary,
-                    java.util.Optional.of(remote));
-            GitCommands commands = new GitCommands(settings, runner);
-            GitRepositoryManager repository = new GitRepositoryManager(settings, commands);
-            repository.ensure();
-            requireBoundedAdvertisedHeads(settings, commands, repository);
-            commands.checked(
-                    List.of(
-                            "fetch",
-                            "--no-tags",
-                            "--no-write-fetch-head",
-                            settings.remoteName(),
-                            "+refs/heads/*:" + IMPORT_REFS + "*"),
-                    temporary,
-                    Map.of("GIT_LFS_SKIP_SMUDGE", "1"),
-                    new byte[0]);
-            GitPreparedImport prepared = inspect(remote, temporary, settings, commands);
-            retained = true;
-            return prepared;
-        } finally {
-            if (!retained) {
-                GitTemporaryFiles.deleteTree(workspace);
-            }
-        }
-    }
-
-    private static void requireBoundedAdvertisedHeads(
-            GitBackendSettings settings,
-            GitCommands commands,
-            GitRepositoryManager repository)
-            throws IOException, InterruptedException, GitStorageException {
-        GitRefStore refs = new GitRefStore(settings, commands, repository);
-        if (refs.resolveRemotePattern("refs/heads/*").size() > MAXIMUM_REFS) {
-            throw new GitStorageException("Git import contains too many branches");
-        }
-    }
-
-    private static GitPreparedImport inspect(
-            String remote,
-            Path repository,
-            GitBackendSettings settings,
-            GitCommands commands)
-            throws IOException, InterruptedException, GitStorageException {
-        List<String> refs = commands.checked(
-                List.of(
-                        "for-each-ref",
-                        "--format=%(refname)",
-                        IMPORT_REFS),
-                repository,
-                Map.of(),
-                new byte[0]).standardOutput().lines()
-                .filter(line -> line.startsWith(IMPORT_REFS))
-                .toList();
-        if (refs.size() > MAXIMUM_REFS) {
-            throw new GitStorageException("Git import contains too many branches");
-        }
-        Map<String, String> commitsToRefs = new LinkedHashMap<>();
-        for (String ref : refs) {
-            GitCommandResult history = commands.checked(
-                    List.of(
-                            "rev-list",
-                            "--reverse",
-                            "--topo-order",
-                            "--max-count=" + (MAXIMUM_COMMITS + 1),
-                            ref),
-                    repository,
-                    Map.of(),
-                    new byte[0]);
-            for (String line : history.standardOutput().lines().filter(value -> !value.isBlank()).toList()) {
-                commitsToRefs.putIfAbsent(GitCommands.objectId(line), ref);
-                if (commitsToRefs.size() > MAXIMUM_COMMITS) {
-                    throw new GitStorageException("Git import history is too large to inspect safely");
-                }
-            }
-        }
-        GitSnapshotVerifier verifier = new GitSnapshotVerifier(settings, commands);
-        Map<BackupId, GitImportCandidate> candidates = new LinkedHashMap<>();
-        Set<BackupId> rejected = new HashSet<>();
-        List<GitImportIssue> issues = new ArrayList<>();
-        for (Map.Entry<String, String> entry : commitsToRefs.entrySet()) {
-            inspectCommit(entry.getKey(), entry.getValue(), repository, commands, verifier)
-                    .ifPresent(candidate -> mergeCandidate(
-                            candidates, rejected, issues, candidate));
-        }
-        if (candidates.isEmpty()) {
-            issues.add(new GitImportIssue("remote", "No valid WorldArchive snapshot commits were found"));
-        }
-        List<GitImportCandidate> pinned = new ArrayList<>();
-        for (GitImportCandidate candidate : candidates.values()) {
-            String pinnedRef = "refs/worldarchive/candidates/" + candidate.manifest().backupId();
-            commands.checked(
-                    List.of(
-                            "update-ref",
-                            pinnedRef,
-                            candidate.commitId()),
-                    repository,
-                    Map.of(),
-                    new byte[0]);
-            pinned.add(new GitImportCandidate(
-                    candidate.manifest(), pinnedRef, candidate.commitId()));
-        }
-        return new GitPreparedImport(remote, repository, repository.getParent(), pinned, issues);
-    }
-
-    private static java.util.Optional<GitImportCandidate> inspectCommit(
-            String commit,
-            String sourceRef,
-            Path repository,
-            GitCommands commands,
-            GitSnapshotVerifier verifier)
-            throws IOException, InterruptedException {
-        GitCommandResult encoded = commands.run(
-                List.of(
-                        "show",
-                        commit + ":" + GitBackupBackend.MANIFEST_PATH),
-                repository,
-                Map.of(),
-                new byte[0]);
-        if (!encoded.successful() || encoded.standardOutputTruncated()) {
-            return java.util.Optional.empty();
-        }
-        BackupManifest manifest;
-        try {
-            manifest = GitSnapshotManifestCodec.decode(
-                    encoded.standardOutput().getBytes(StandardCharsets.UTF_8)).manifest();
-        } catch (IOException | IllegalArgumentException exception) {
-            return java.util.Optional.empty();
-        }
-        try {
-            GitSnapshot snapshot = new GitSnapshot(
-                    manifest.worldId(),
-                    manifest.backupId(),
-                    GitSnapshot.refName(manifest.worldId(), manifest.backupId()),
-                    commit,
-                    manifest.createdAt());
-            BackupManifest verified = verifier.verifyMetadata(snapshot).manifest().manifest();
-            return java.util.Optional.of(new GitImportCandidate(verified, sourceRef, commit));
-        } catch (GitStorageException | IllegalArgumentException exception) {
-            return java.util.Optional.empty();
-        }
-    }
-
-    static void mergeCandidate(
-            Map<BackupId, GitImportCandidate> candidates,
-            Set<BackupId> rejected,
-            List<GitImportIssue> issues,
-            GitImportCandidate candidate) {
-        BackupId backupId = candidate.manifest().backupId();
-        if (rejected.contains(backupId)) {
-            return;
-        }
-        GitImportCandidate existing = candidates.putIfAbsent(
-                backupId, candidate);
-        if (existing != null && (!existing.manifest().equals(candidate.manifest())
-                || !existing.commitId().equals(candidate.commitId()))) {
-            candidates.remove(backupId);
-            rejected.add(backupId);
-            issues.add(new GitImportIssue(
-                    backupId.toString(),
-                    "Conflicting commits use the same backup identity"));
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImportCandidate.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImportCandidate.java
index 03eac2c..5392d46 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImportCandidate.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImportCandidate.java
@@ -3,14 +3,17 @@
 import dev.ishaanko.worldarchive.model.BackupManifest;
 import java.util.Objects;
 
-/** A metadata-validated WorldArchive commit pinned in a private fetched repository. */
+/** A WorldArchive snapshot commit found by an import preview and pinned in its private repository. */
 public record GitImportCandidate(
         BackupManifest manifest,
         String sourceRef,
         String commitId) {
     public GitImportCandidate {
         Objects.requireNonNull(manifest, "manifest");
-        sourceRef = Objects.requireNonNull(sourceRef, "sourceRef");
-        commitId = GitImportValidation.objectId(commitId);
+        Objects.requireNonNull(sourceRef, "sourceRef");
+        Objects.requireNonNull(commitId, "commitId");
+        if (!GitRepository.isObjectId(commitId)) {
+            throw new IllegalArgumentException("Imported Git commit is not a SHA-1 object ID");
+        }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImportInstallStatus.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImportInstallStatus.java
index 8a6f0f4..3ee3743 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImportInstallStatus.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImportInstallStatus.java
@@ -1,8 +1,13 @@
 package dev.ishaanko.worldarchive.storage.git;
 
-/** Exact ref publication result for one imported Git snapshot. */
+/** What installing one imported snapshot did. */
 public enum GitImportInstallStatus {
+    /** The snapshot passed every check and is now a backup of its world. */
     ADDED,
+    /** The world already has this exact snapshot. */
     UNCHANGED,
-    CONFLICT
+    /** The world already has a different snapshot with the same backup ID; nothing changed. */
+    CONFLICT,
+    /** The snapshot or its LFS objects failed a check; nothing was installed for it. */
+    FAILED
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImportRepository.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImportRepository.java
deleted file mode 100644
index bf780c9..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImportRepository.java
+++ /dev/null
@@ -1,340 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.storage.git.GitSnapshotVerifier.VerifiedSnapshot;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.Set;
-import java.util.UUID;
-
-/** Installs, hydrates, and reconstructs imported refs inside one managed repository. */
-final class GitImportRepository {
-    private final GitBackendSettings settings;
-
-    private final GitCommands commands;
-
-    private final GitRepositoryManager repository;
-
-    private final GitRefStore refs;
-
-    private final GitSnapshotVerifier verifier;
-
-    GitImportRepository(
-            GitBackendSettings settings,
-            GitCommands commands,
-            GitRepositoryManager repository,
-            GitRefStore refs,
-            GitSnapshotVerifier verifier) {
-        this.settings = settings;
-        this.commands = commands;
-        this.repository = repository;
-        this.refs = refs;
-        this.verifier = verifier;
-    }
-
-    GitVerification hydrateExternalSnapshot(
-            WorldId worldId,
-            BackupId backupId,
-            BackupManifest expectedManifest,
-            String expectedCommit,
-            String remoteUrl)
-            throws IOException, InterruptedException, GitStorageException {
-        repository.requireWorld(worldId);
-        repository.ensure();
-        GitSnapshot snapshot = refs.resolveSnapshot(worldId, backupId);
-        if (!snapshot.commitId().equals(expectedCommit)) {
-            throw new GitStorageException(
-                    "Imported Git commit no longer matches its source binding");
-        }
-        BackupManifest actual = verifier.verifyMetadata(snapshot).manifest().manifest();
-        if (!actual.equals(expectedManifest)) {
-            throw new GitStorageException("Imported Git manifest does not match the catalog");
-        }
-        fetchExternalLfs(remoteUrl, snapshot.commitId());
-        VerifiedSnapshot verified = verifier.verify(snapshot);
-        return new GitVerification(
-                snapshot,
-                Optional.of(verified.manifest().manifest()),
-                true,
-                "Imported Git and Git LFS objects verified");
-    }
-
-    Map<BackupId, GitImportInstallStatus> installSnapshots(
-            Path sourceRepository,
-            List<GitImportCandidate> candidates,
-            String remoteUrl,
-            boolean fullDownload,
-            boolean preserveHistory)
-            throws IOException, InterruptedException, GitStorageException {
-        repository.ensure();
-        Map<BackupId, GitImportInstallStatus> outcomes = new LinkedHashMap<>();
-        for (GitImportCandidate candidate : candidates) {
-            repository.requireWorld(candidate.manifest().worldId());
-            outcomes.put(candidate.manifest().backupId(), installSnapshot(
-                    sourceRepository, candidate, remoteUrl, fullDownload));
-        }
-        if (preserveHistory) {
-            updateHistory(candidates, outcomes);
-        }
-        return Map.copyOf(outcomes);
-    }
-
-    int rebuildSnapshotRefs()
-            throws IOException, InterruptedException, GitStorageException {
-        if (!Files.isDirectory(settings.repository(), LinkOption.NOFOLLOW_LINKS)) {
-            return 0;
-        }
-        repository.requireBare();
-        List<String> historyRefs = historyRefs();
-        int rebuilt = 0;
-        Set<String> visited = new HashSet<>();
-        for (String historyRef : historyRefs) {
-            GitCommandResult history = commands.checked(
-                    List.of(
-                            "rev-list",
-                            "--reverse",
-                            "--first-parent",
-                            historyRef),
-                    settings.repository(),
-                    Map.of(),
-                    new byte[0]);
-            for (String line : history.standardOutput().lines()
-                    .filter(value -> !value.isBlank()).toList()) {
-                String commit = GitCommands.objectId(line);
-                if (visited.add(commit) && rebuildSnapshotRef(commit)) {
-                    rebuilt++;
-                }
-            }
-        }
-        return rebuilt;
-    }
-
-    private List<String> historyRefs()
-            throws IOException, InterruptedException, GitStorageException {
-        List<String> historyRefs = new ArrayList<>();
-        if (settings.isolatedWorldId().isPresent()
-                && refs.resolve("refs/heads/main").isPresent()) {
-            historyRefs.add("refs/heads/main");
-        }
-        GitCommandResult shared = commands.checked(
-                List.of(
-                        "for-each-ref",
-                        "--format=%(refname)",
-                        "refs/heads/worldarchive-history/"),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        shared.standardOutput().lines()
-                .filter(line -> line.startsWith("refs/heads/worldarchive-history/"))
-                .forEach(historyRefs::add);
-        return List.copyOf(historyRefs);
-    }
-
-    private boolean rebuildSnapshotRef(String commit)
-            throws IOException, InterruptedException, GitStorageException {
-        Optional<BackupManifest> decoded = manifest(commit);
-        if (decoded.isEmpty()) {
-            return false;
-        }
-        BackupManifest manifest = decoded.orElseThrow();
-        GitSnapshot snapshot = new GitSnapshot(
-                manifest.worldId(),
-                manifest.backupId(),
-                GitSnapshot.refName(manifest.worldId(), manifest.backupId()),
-                commit,
-                manifest.createdAt());
-        try {
-            verifier.verifyMetadata(snapshot);
-        } catch (IOException | GitStorageException exception) {
-            return false;
-        }
-        if (refs.resolve(snapshot.refName()).isPresent()) {
-            return false;
-        }
-        refs.updateWithRollback(snapshot.refName(), commit, Optional.empty());
-        return true;
-    }
-
-    private Optional<BackupManifest> manifest(String commit)
-            throws IOException, InterruptedException {
-        GitCommandResult encoded = commands.run(
-                List.of(
-                        "show",
-                        commit + ":" + GitBackupBackend.MANIFEST_PATH),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        if (!encoded.successful() || encoded.standardOutputTruncated()) {
-            return Optional.empty();
-        }
-        try {
-            return Optional.of(GitSnapshotManifestCodec.decode(
-                    encoded.standardOutput().getBytes(StandardCharsets.UTF_8)).manifest());
-        } catch (IOException | IllegalArgumentException exception) {
-            return Optional.empty();
-        }
-    }
-
-    private GitImportInstallStatus installSnapshot(
-            Path sourceRepository,
-            GitImportCandidate candidate,
-            String remoteUrl,
-            boolean fullDownload)
-            throws IOException, InterruptedException, GitStorageException {
-        BackupManifest manifest = candidate.manifest();
-        String snapshotRef = GitSnapshot.refName(manifest.worldId(), manifest.backupId());
-        Optional<String> existing = refs.resolve(snapshotRef);
-        if (existing.isPresent()) {
-            return existing.orElseThrow().equals(candidate.commitId())
-                    ? GitImportInstallStatus.UNCHANGED
-                    : GitImportInstallStatus.CONFLICT;
-        }
-        String incoming = "refs/worldarchive/import/" + UUID.randomUUID();
-        try {
-            fetchCandidate(sourceRepository, candidate, incoming);
-            String importedCommit = refs.resolve(incoming).orElseThrow(
-                    () -> new GitStorageException("Fetched Git snapshot is unavailable"));
-            requireCandidate(candidate, importedCommit);
-            if (fullDownload) {
-                fetchExternalLfs(remoteUrl, importedCommit);
-                verifier.verify(refs.snapshotForCommit(
-                        manifest.worldId(), manifest.backupId(), importedCommit));
-            }
-            refs.updateWithRollback(snapshotRef, importedCommit, Optional.empty());
-        } catch (IOException | InterruptedException | GitStorageException | RuntimeException exception) {
-            try {
-                refs.deleteIfPresent(incoming);
-            } catch (IOException | InterruptedException | GitStorageException | RuntimeException cleanupFailure) {
-                exception.addSuppressed(cleanupFailure);
-            }
-            throw exception;
-        }
-        refs.deleteIfPresent(incoming);
-        return GitImportInstallStatus.ADDED;
-    }
-
-    private void fetchCandidate(
-            Path sourceRepository,
-            GitImportCandidate candidate,
-            String incoming)
-            throws IOException, InterruptedException, GitStorageException {
-        commands.checked(
-                List.of(
-                        "fetch",
-                        "--no-tags",
-                        "--no-write-fetch-head",
-                        sourceRepository.toString(),
-                        "+" + candidate.sourceRef() + ":" + incoming),
-                settings.repository(),
-                Map.of("GIT_LFS_SKIP_SMUDGE", "1"),
-                new byte[0]);
-    }
-
-    private void requireCandidate(
-            GitImportCandidate candidate,
-            String importedCommit)
-            throws IOException, InterruptedException, GitStorageException {
-        if (!importedCommit.equals(candidate.commitId())) {
-            throw new GitStorageException("Fetched Git snapshot changed after preview");
-        }
-        BackupManifest manifest = candidate.manifest();
-        GitSnapshot snapshot = refs.snapshotForCommit(
-                manifest.worldId(), manifest.backupId(), importedCommit);
-        BackupManifest verifiedManifest = verifier.verifyMetadata(snapshot).manifest().manifest();
-        if (!verifiedManifest.equals(manifest)) {
-            throw new GitStorageException("Fetched Git manifest changed after preview");
-        }
-    }
-
-    private void fetchExternalLfs(String remoteUrl, String commit)
-            throws IOException, InterruptedException, GitStorageException {
-        String temporaryRemote = "worldarchive-recovery";
-        commands.checked(
-                List.of(
-                        "-c",
-                        "remote." + temporaryRemote + ".url=" + remoteUrl,
-                        "lfs",
-                        "fetch",
-                        temporaryRemote,
-                        commit),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-    }
-
-    private void updateHistory(
-            List<GitImportCandidate> candidates,
-            Map<BackupId, GitImportInstallStatus> outcomes)
-            throws IOException, InterruptedException, GitStorageException {
-        GitImportCandidate newestLegacy = null;
-        for (GitImportCandidate candidate : candidates) {
-            if (outcomes.get(candidate.manifest().backupId())
-                            == GitImportInstallStatus.CONFLICT
-                    || !hasParent(candidate.commitId())) {
-                continue;
-            }
-            if (newestLegacy == null
-                    || candidate.manifest().createdAt().isAfter(
-                            newestLegacy.manifest().createdAt())) {
-                newestLegacy = candidate;
-            }
-        }
-        if (newestLegacy == null) {
-            return;
-        }
-        GitImportCandidate candidate = newestLegacy;
-        String historyRef = repository.historyRef(candidate.manifest().worldId());
-        Optional<String> current = refs.resolve(historyRef);
-        if (current.equals(Optional.of(candidate.commitId()))) {
-            return;
-        }
-        if (current.isEmpty() || isAncestor(current.orElseThrow(), candidate.commitId())) {
-            refs.updateWithRollback(historyRef, candidate.commitId(), current);
-        }
-    }
-
-    private boolean hasParent(String commit)
-            throws IOException, InterruptedException, GitStorageException {
-        GitCommandResult result = commands.checked(
-                List.of(
-                        "rev-list",
-                        "--parents",
-                        "--max-count=1",
-                        commit),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        return result.standardOutput().trim().split("\\s+").length > 1;
-    }
-
-    private boolean isAncestor(String ancestor, String descendant)
-            throws IOException, InterruptedException, GitStorageException {
-        GitCommandResult result = commands.run(
-                List.of(
-                        "merge-base",
-                        "--is-ancestor",
-                        ancestor,
-                        descendant),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        if (result.exitCode() == 0) {
-            return true;
-        }
-        if (result.exitCode() == 1) {
-            return false;
-        }
-        throw new GitStorageException(GitCommands.failureMessage(result));
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImportValidation.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImportValidation.java
deleted file mode 100644
index 199d56a..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImportValidation.java
+++ /dev/null
@@ -1,20 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import java.util.Objects;
-import java.util.regex.Pattern;
-
-/** Small dependency-free validation shared by public import value objects. */
-final class GitImportValidation {
-    private static final Pattern OBJECT_ID = Pattern.compile("[0-9a-f]{40}");
-
-    private GitImportValidation() {
-    }
-
-    static String objectId(String value) {
-        String objectId = Objects.requireNonNull(value, "commitId");
-        if (!OBJECT_ID.matcher(objectId).matches()) {
-            throw new IllegalArgumentException("Imported Git commit is not a SHA-1 object ID");
-        }
-        return objectId;
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImporter.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImporter.java
new file mode 100644
index 0000000..b5fc87a
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitImporter.java
@@ -0,0 +1,226 @@
+package dev.ishaanko.worldarchive.storage.git;
+
+import dev.ishaanko.worldarchive.config.RemoteUrlPolicy;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.SafeText;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.temporal.ChronoUnit;
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Brings WorldArchive backups in from another repository in two steps. The preview fetches only
+ * WorldArchive's branches into a private repository and reads every snapshot's manifest with one
+ * Git process. Installing fetches the chosen commits into the world's repository, downloads their
+ * LFS objects in a few commands and flushes them to disk, checks every snapshot fully, and
+ * publishes the good ones in one ref transaction; the rest are reported as failed.
+ */
+final class GitImporter {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
+    /** The most commits a preview inspects. */
+    static final int MAXIMUM_COMMITS = 10_000;
+
+    private static final String IMPORT_REFS = "refs/worldarchive/import/";
+
+    private static final String CANDIDATE_REFS = "refs/worldarchive/candidates/";
+
+    /** Commits or refs per command, well below the Windows command line limit. */
+    private static final int PER_COMMAND = 200;
+
+    private final GitBackendSettings settings;
+
+    private final GitCommandRunner runner;
+
+    GitImporter(GitBackendSettings settings, GitCommandRunner runner) {
+        this.settings = Objects.requireNonNull(settings, "settings");
+        this.runner = Objects.requireNonNull(runner, "runner");
+    }
+
+    /** Fetches a repository's WorldArchive branches into a private repository and lists its backups. */
+    GitPreparedImport prepare(String requestedSource) throws IOException, InterruptedException, GitStorageException {
+        String source = RemoteUrlPolicy.validatePlain(requestedSource);
+        Path workspace = Files.createTempDirectory("worldarchive-git-import-").toAbsolutePath().normalize();
+        boolean kept = false;
+        try {
+            GitRepository preview = new GitRepository(
+                    settings.withRepository(workspace.resolve("repository.git"), Optional.of(source)), runner);
+            preview.prepare();
+            preview.connectRemote();
+            preview.network("fetch", "--no-tags", "--no-write-fetch-head", "--progress", settings.remoteName(),
+                    "+refs/heads/backups/*:" + IMPORT_REFS + "backups/*",
+                    "+refs/heads/worldarchive/*:" + IMPORT_REFS + "worldarchive/*");
+            GitPreparedImport prepared = inspect(source, preview, workspace);
+            kept = true;
+            return prepared;
+        } finally {
+            if (!kept) {
+                GitTemporaryFiles.deleteTree(workspace);
+            }
+        }
+    }
+
+    private static GitPreparedImport inspect(String source, GitRepository preview, Path workspace)
+            throws IOException, InterruptedException, GitStorageException {
+        List<String> commits = preview.git("rev-list", "--topo-order", "--max-count=" + (MAXIMUM_COMMITS + 1),
+                        "--glob=" + IMPORT_REFS.substring(0, IMPORT_REFS.length() - 1))
+                .lines().filter(line -> !line.isBlank()).toList();
+        if (commits.size() > MAXIMUM_COMMITS) {
+            throw new GitStorageException("This repository holds more than " + MAXIMUM_COMMITS
+                    + " commits, which is more than an import can inspect");
+        }
+        Map<String, BackupManifest> manifests = new GitSnapshotReader(preview, new GitLfsObjects(preview))
+                .manifestsByCommit(commits);
+        Map<BackupId, GitImportCandidate> candidates = new LinkedHashMap<>();
+        Set<BackupId> conflicting = new HashSet<>();
+        List<GitImportIssue> issues = new ArrayList<>();
+        manifests.forEach((commit, manifest) -> {
+            BackupId backupId = manifest.backupId();
+            if (conflicting.contains(backupId)) {
+                return;
+            }
+            if (candidates.putIfAbsent(backupId, new GitImportCandidate(manifest, CANDIDATE_REFS + backupId, commit)) != null) {
+                candidates.remove(backupId);
+                conflicting.add(backupId);
+                issues.add(new GitImportIssue(backupId.toString(), "Conflicting commits use the same backup identity"));
+            }
+        });
+        if (candidates.isEmpty()) {
+            issues.add(new GitImportIssue("remote", "No valid WorldArchive snapshot commits were found"));
+        }
+        preview.updateRefs(candidates.values().stream()
+                .map(candidate -> "update " + candidate.sourceRef() + " " + candidate.commitId())
+                .toList());
+        return new GitPreparedImport(source, preview.directory(), workspace, List.copyOf(candidates.values()), issues);
+    }
+
+    /**
+     * Installs chosen candidates of one world from a preview's private repository. Each snapshot
+     * is checked in full; one that fails is reported and not installed.
+     */
+    Map<BackupId, GitImportInstallStatus> install(
+            GitWorldRepository world,
+            Path previewRepository,
+            List<GitImportCandidate> candidates,
+            String source) throws IOException, InterruptedException, GitStorageException {
+        return world.locked(() -> {
+            GitRepository repository = world.repository();
+            repository.prepare();
+            Map<BackupId, GitImportInstallStatus> statuses = new LinkedHashMap<>();
+            Map<BackupId, String> existing = new LinkedHashMap<>();
+            world.snapshots().forEach(snapshot -> existing.put(snapshot.backupId(), snapshot.commitId()));
+            List<GitImportCandidate> incoming = new ArrayList<>();
+            for (GitImportCandidate candidate : candidates) {
+                String present = existing.get(candidate.manifest().backupId());
+                if (present == null) {
+                    incoming.add(candidate);
+                } else {
+                    statuses.put(candidate.manifest().backupId(), present.equals(candidate.commitId())
+                            ? GitImportInstallStatus.UNCHANGED
+                            : GitImportInstallStatus.CONFLICT);
+                }
+            }
+            List<String> privateRefs = new ArrayList<>();
+            try {
+                fetch(repository, previewRepository, incoming, privateRefs);
+                world.lfs().downloading(() -> {
+                    fetchLfsObjects(repository, incoming, source);
+                    return null;
+                });
+                List<String> instructions = checked(world, incoming, statuses);
+                privateRefs.forEach(ref -> instructions.add("delete " + ref));
+                repository.updateRefs(instructions);
+                privateRefs.clear();
+            } finally {
+                deleteQuietly(repository, privateRefs);
+            }
+            return statuses;
+        });
+    }
+
+    private static void fetch(GitRepository repository, Path previewRepository, List<GitImportCandidate> incoming,
+            List<String> privateRefs) throws IOException, InterruptedException, GitStorageException {
+        for (List<GitImportCandidate> batch : batches(incoming)) {
+            List<String> arguments = new ArrayList<>(List.of(
+                    "fetch", "--no-tags", "--no-write-fetch-head", previewRepository.toString()));
+            for (GitImportCandidate candidate : batch) {
+                String privateRef = IMPORT_REFS + candidate.manifest().backupId();
+                arguments.add("+" + candidate.sourceRef() + ":" + privateRef);
+                privateRefs.add(privateRef);
+            }
+            repository.git(arguments.toArray(String[]::new));
+        }
+    }
+
+    /** A failed download is only logged; the full check of each snapshot decides what is installed. */
+    private static void fetchLfsObjects(GitRepository repository, List<GitImportCandidate> incoming, String source)
+            throws InterruptedException {
+        for (List<GitImportCandidate> batch : batches(incoming)) {
+            List<String> arguments = new ArrayList<>(List.of(
+                    "-c", "remote.worldarchive-import.url=" + source, "lfs", "fetch", "worldarchive-import"));
+            batch.forEach(candidate -> arguments.add(candidate.commitId()));
+            try {
+                repository.network(arguments.toArray(String[]::new));
+            } catch (GitStorageException | IOException exception) {
+                LOGGER.warn("Some Git LFS objects of an import could not be downloaded: {}",
+                        SafeText.from(exception, "", 512));
+            }
+        }
+    }
+
+    /** Checks each fetched snapshot fully and returns the ref instructions that publish the good ones. */
+    private static List<String> checked(
+            GitWorldRepository world,
+            List<GitImportCandidate> incoming,
+            Map<BackupId, GitImportInstallStatus> statuses) throws InterruptedException {
+        List<String> instructions = new ArrayList<>();
+        for (GitImportCandidate candidate : incoming) {
+            BackupManifest manifest = candidate.manifest();
+            GitSnapshot snapshot = new GitSnapshot(world.worldId(), manifest.backupId(),
+                    GitSnapshot.refName(world.worldId(), manifest.backupId()), candidate.commitId(),
+                    manifest.createdAt().truncatedTo(ChronoUnit.SECONDS));
+            try {
+                GitSnapshotReader.Contents contents = world.reader().verify(snapshot, GitSnapshotReader.LfsCheck.CONTENT);
+                if (!contents.manifest().manifest().equals(manifest)) {
+                    throw new GitStorageException("The imported snapshot changed after the preview");
+                }
+                instructions.add("create " + snapshot.refName() + " " + snapshot.commitId());
+                statuses.put(manifest.backupId(), GitImportInstallStatus.ADDED);
+            } catch (IOException | GitStorageException exception) {
+                LOGGER.warn("Imported backup {} failed its check: {}", manifest.backupId(),
+                        SafeText.from(exception, "", 512));
+                statuses.put(manifest.backupId(), GitImportInstallStatus.FAILED);
+            }
+        }
+        return instructions;
+    }
+
+    private static void deleteQuietly(GitRepository repository, List<String> privateRefs) {
+        for (String privateRef : privateRefs) {
+            try {
+                GitRepository.uninterruptibly(() -> repository.result("update-ref", "-d", privateRef));
+            } catch (IOException | GitStorageException exception) {
+                LOGGER.warn("A private import ref stays until the next cleanup: {}", privateRef);
+            }
+        }
+    }
+
+    private static <T> List<List<T>> batches(List<T> items) {
+        List<List<T>> batches = new ArrayList<>();
+        for (int start = 0; start < items.size(); start += PER_COMMAND) {
+            batches.add(items.subList(start, Math.min(items.size(), start + PER_COMMAND)));
+        }
+        return batches;
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitInterruptibleOperation.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitInterruptibleOperation.java
index e1f6fe8..1339931 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitInterruptibleOperation.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitInterruptibleOperation.java
@@ -2,7 +2,7 @@
 
 import java.io.IOException;
 
-/** A blocking Git operation that may be interrupted while awaiting cooperative locks or I/O. */
+/** Blocking Git work that stops with {@link InterruptedException} when its thread is interrupted. */
 @FunctionalInterface
 interface GitInterruptibleOperation<T> {
     T run() throws IOException, InterruptedException, GitStorageException;
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitInventory.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitInventory.java
deleted file mode 100644
index 5522be8..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitInventory.java
+++ /dev/null
@@ -1,105 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import dev.ishaanko.worldarchive.core.Digests;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import java.nio.ByteBuffer;
-import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.HexFormat;
-import java.util.List;
-import java.util.Objects;
-import java.util.Set;
-
-/** Canonical inventory framing shared by source capture and committed-tree verification. */
-record GitInventory(
-        List<GitInventoryEntry> files,
-        long fileCount,
-        long byteCount,
-        String contentSha256,
-        String inventorySha256) {
-    static final int MAXIMUM_FILES = 500_000;
-
-    static final long MAXIMUM_BYTES = 8L * 1_024 * 1_024 * 1_024 * 1_024;
-
-    GitInventory {
-        files = List.copyOf(Objects.requireNonNull(files, "files"));
-        if (files.size() != fileCount || fileCount < 0 || byteCount < 0) {
-            throw new IllegalArgumentException("Git inventory aggregate counts are invalid");
-        }
-        Objects.requireNonNull(contentSha256, "contentSha256");
-        Objects.requireNonNull(inventorySha256, "inventorySha256");
-    }
-
-    static GitInventory create(List<GitInventoryEntry> entries) throws GitStorageException {
-        if (entries.size() > MAXIMUM_FILES) {
-            throw new GitStorageException("World contains too many files for a Git snapshot");
-        }
-        List<GitInventoryEntry> sorted = new ArrayList<>(entries);
-        sorted.sort(GitInventoryEntry::compareTo);
-        Set<String> collisionKeys = new HashSet<>();
-        long bytes = 0;
-        try {
-            for (GitInventoryEntry entry : sorted) {
-                if (!collisionKeys.add(GitPortablePath.collisionKey(entry.path()))) {
-                    throw new GitStorageException("World contains paths that collide on another platform");
-                }
-                bytes = Math.addExact(bytes, entry.size());
-                if (bytes > MAXIMUM_BYTES) {
-                    throw new GitStorageException("World is too large for a Git snapshot");
-                }
-            }
-        } catch (ArithmeticException exception) {
-            throw new GitStorageException("World size overflowed Git snapshot accounting", exception);
-        }
-        return new GitInventory(
-                sorted,
-                sorted.size(),
-                bytes,
-                contentDigest(sorted),
-                inventoryDigest(sorted));
-    }
-
-    void requireMatches(BackupManifest manifest) throws GitStorageException {
-        if (fileCount != manifest.sourceFileCount()
-                || byteCount != manifest.sourceByteCount()
-                || !contentSha256.equals(manifest.contentSha256())
-                || !inventorySha256.equals(manifest.inventorySha256())) {
-            throw new GitStorageException("World contents do not match the prepared backup manifest");
-        }
-    }
-
-    private static String contentDigest(List<GitInventoryEntry> entries) {
-        MessageDigest digest = sha256();
-        ByteBuffer number = ByteBuffer.allocate(Long.BYTES);
-        for (GitInventoryEntry entry : entries) {
-            putLong(digest, number, entry.size());
-            digest.update(HexFormat.of().parseHex(entry.sha256()));
-        }
-        return Digests.hex(digest.digest());
-    }
-
-    private static String inventoryDigest(List<GitInventoryEntry> entries) {
-        MessageDigest digest = sha256();
-        ByteBuffer number = ByteBuffer.allocate(Long.BYTES);
-        for (GitInventoryEntry entry : entries) {
-            byte[] path = entry.path().getBytes(StandardCharsets.UTF_8);
-            putLong(digest, number, path.length);
-            digest.update(path);
-            putLong(digest, number, entry.size());
-            digest.update(HexFormat.of().parseHex(entry.sha256()));
-        }
-        return Digests.hex(digest.digest());
-    }
-
-    private static void putLong(MessageDigest digest, ByteBuffer number, long value) {
-        number.clear();
-        number.putLong(value);
-        digest.update(number.array());
-    }
-
-    static MessageDigest sha256() {
-        return Digests.sha256();
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitInventoryEntry.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitInventoryEntry.java
deleted file mode 100644
index 5b1b4a9..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitInventoryEntry.java
+++ /dev/null
@@ -1,25 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import java.util.Objects;
-import java.util.regex.Pattern;
-
-/** One portable regular file and its actual (post-LFS-materialization) content identity. */
-record GitInventoryEntry(String path, long size, String sha256) implements Comparable<GitInventoryEntry> {
-    private static final Pattern SHA256 = Pattern.compile("[0-9a-f]{64}");
-
-    GitInventoryEntry {
-        path = GitPortablePath.validate(Objects.requireNonNull(path, "path"));
-        if (size < 0) {
-            throw new IllegalArgumentException("Git inventory size must not be negative");
-        }
-        Objects.requireNonNull(sha256, "sha256");
-        if (!SHA256.matcher(sha256).matches()) {
-            throw new IllegalArgumentException("Git inventory checksum must be lowercase SHA-256");
-        }
-    }
-
-    @Override
-    public int compareTo(GitInventoryEntry other) {
-        return path.compareTo(other.path);
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitLegacyRefMigration.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitLegacyRefMigration.java
deleted file mode 100644
index 260366c..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitLegacyRefMigration.java
+++ /dev/null
@@ -1,70 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-
-/** Migrates legacy (non-hierarchical) remote snapshot refs onto the current naming scheme. */
-final class GitLegacyRefMigration {
-    private final GitBackendSettings settings;
-
-    private final GitCommands commands;
-
-    private final GitRefStore refs;
-
-    private final SnapshotLister lister;
-
-    GitLegacyRefMigration(
-            GitBackendSettings settings,
-            GitCommands commands,
-            GitRefStore refs,
-            SnapshotLister lister) {
-        this.settings = settings;
-        this.commands = commands;
-        this.refs = refs;
-        this.lister = lister;
-    }
-
-    void migrateLegacyRemoteRefs(WorldId worldId)
-            throws IOException, InterruptedException, GitStorageException {
-        Map<String, String> legacy = refs.resolveRemotePattern(
-                "refs/heads/worldarchive/" + worldId + "/*");
-        if (legacy.isEmpty()) {
-            return;
-        }
-        Map<String, GitSnapshot> local = new LinkedHashMap<>();
-        for (GitSnapshot snapshot : lister.list(worldId)) {
-            local.put(snapshot.refName(), snapshot);
-        }
-        List<String> arguments = new ArrayList<>(List.of(
-                "push",
-                "--atomic",
-                "--porcelain",
-                settings.remoteName()));
-        for (Map.Entry<String, String> entry : legacy.entrySet()) {
-            GitSnapshot snapshot = local.get(entry.getKey());
-            if (snapshot == null) {
-                continue;
-            }
-            if (!snapshot.commitId().equals(entry.getValue())) {
-                throw new GitStorageException(
-                        "Legacy GitHub backup branch no longer matches local storage");
-            }
-            arguments.add(snapshot.refName() + ":" + GitRemoteSnapshotRef.current(snapshot));
-            arguments.add(":" + entry.getKey());
-        }
-        if (arguments.size() > 4) {
-            commands.checked(arguments, settings.repository(), Map.of(), new byte[0]);
-        }
-    }
-
-    /** Lists the current local snapshots for a world, without acquiring any repository lock. */
-    @FunctionalInterface
-    interface SnapshotLister {
-        List<GitSnapshot> list(WorldId worldId)
-                throws IOException, InterruptedException, GitStorageException;
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitLfsObjects.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitLfsObjects.java
new file mode 100644
index 0000000..727c6e8
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitLfsObjects.java
@@ -0,0 +1,244 @@
+package dev.ishaanko.worldarchive.storage.git;
+
+import dev.ishaanko.worldarchive.support.AtomicFiles;
+import dev.ishaanko.worldarchive.support.Digests;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.nio.channels.Channels;
+import java.nio.channels.FileChannel;
+import java.nio.file.AccessDeniedException;
+import java.nio.file.FileVisitResult;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.NoSuchFileException;
+import java.nio.file.Path;
+import java.nio.file.SimpleFileVisitor;
+import java.nio.file.StandardCopyOption;
+import java.nio.file.StandardOpenOption;
+import java.nio.file.attribute.BasicFileAttributes;
+import java.security.MessageDigest;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.UUID;
+
+/**
+ * The Git LFS objects of one repository, each stored as {@code lfs/objects/<aa>/<bb>/<sha256>}.
+ * Every check that reads an object's bytes hashes them, and an object whose bytes do not hash to
+ * its name is set aside at once, so a download or the next backup writes it again. Objects this
+ * class writes are hashed while they are copied, flushed to disk, and moved into place in one
+ * step; objects that Git LFS downloads are flushed after the download.
+ */
+final class GitLfsObjects {
+    private static final int BUFFER_BYTES = 64 * 1_024;
+
+    private final Path objects;
+
+    private final Path temporary;
+
+    GitLfsObjects(GitRepository repository) {
+        Objects.requireNonNull(repository, "repository");
+        this.objects = repository.directory().resolve("lfs").resolve("objects");
+        this.temporary = repository.temporaryFolder();
+    }
+
+    Path root() {
+        return objects;
+    }
+
+    Path path(String sha256) {
+        return objects.resolve(sha256.substring(0, 2)).resolve(sha256.substring(2, 4)).resolve(sha256);
+    }
+
+    /** Whether the object exists as a plain file of the pointer's size. */
+    boolean hasSize(GitLfsPointer pointer) throws IOException {
+        try {
+            BasicFileAttributes attributes = Files.readAttributes(
+                    path(pointer.sha256()), BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
+            return attributes.isRegularFile() && attributes.size() == pointer.size();
+        } catch (NoSuchFileException exception) {
+            return false;
+        }
+    }
+
+    /** Requires the object to exist with the pointer's size. */
+    void requireSize(GitLfsPointer pointer) throws IOException, GitStorageException {
+        if (!hasSize(pointer)) {
+            throw missing(pointer);
+        }
+    }
+
+    /** Requires the object's bytes to hash to the pointer. */
+    void requireContent(GitLfsPointer pointer) throws IOException, InterruptedException, GitStorageException {
+        copyTo(pointer, OutputStream.nullOutputStream());
+    }
+
+    /**
+     * Copies the object into a restored file, proving on the way that its bytes match the pointer.
+     * An object whose bytes do not match is set aside before this fails.
+     */
+    void copyTo(GitLfsPointer pointer, OutputStream target) throws IOException, InterruptedException, GitStorageException {
+        requireSize(pointer);
+        Path object = path(pointer.sha256());
+        GitLfsPointer read;
+        try (InputStream input = Files.newInputStream(object, LinkOption.NOFOLLOW_LINKS)) {
+            read = copy(input, target);
+        }
+        if (!read.equals(pointer)) {
+            GitStorageException damaged = missing(pointer);
+            setAside(object, damaged);
+            throw damaged;
+        }
+    }
+
+    /**
+     * Writes a captured file's bytes as the object for its SHA-256, replacing a damaged copy. The
+     * copy is hashed on the way and must match before it is flushed and moved into place.
+     *
+     * @param name the file's path in the world, for the message when it no longer matches
+     */
+    void store(Path source, String name, GitLfsPointer pointer)
+            throws IOException, InterruptedException, GitStorageException {
+        Files.createDirectories(temporary);
+        Path partial = temporary.resolve("lfs-" + UUID.randomUUID());
+        try {
+            try (InputStream input = Files.newInputStream(source, LinkOption.NOFOLLOW_LINKS);
+                    FileChannel channel = FileChannel.open(partial, StandardOpenOption.CREATE_NEW, StandardOpenOption.WRITE)) {
+                GitLfsPointer copied = copy(input, Channels.newOutputStream(channel));
+                channel.force(true);
+                if (!copied.equals(pointer)) {
+                    throw new GitStorageException("The captured file " + name + " changed. Try the backup again.");
+                }
+            }
+            Path target = path(pointer.sha256());
+            Files.createDirectories(target.getParent());
+            Files.move(partial, target, StandardCopyOption.ATOMIC_MOVE, StandardCopyOption.REPLACE_EXISTING);
+            AtomicFiles.flushDirectory(target.getParent());
+        } finally {
+            Files.deleteIfExists(partial);
+        }
+    }
+
+    /**
+     * Runs a Git LFS download and then flushes every object it wrote, also when it failed part
+     * way: Git LFS does not flush what it writes, and a later download skips an object that is
+     * already there. Call it before a restore or an import records what was downloaded. A
+     * cancelled download is left as it is; an object that a power loss then damages fails its
+     * next check, which sets it aside, so a download gets it again.
+     */
+    <T> T downloading(GitInterruptibleOperation<T> download)
+            throws IOException, InterruptedException, GitStorageException {
+        Map<Path, Long> before = sizes();
+        T result;
+        try {
+            result = download.run();
+        } catch (IOException | GitStorageException failure) {
+            try {
+                flushAddedSince(before);
+            } catch (IOException flushFailure) {
+                failure.addSuppressed(flushFailure);
+            }
+            throw failure;
+        }
+        flushAddedSince(before);
+        return result;
+    }
+
+    /**
+     * Flushes to disk each object that is new since {@code before} or has another size now, and on
+     * POSIX the folders that hold it, from its own folder up to the repository.
+     *
+     * @return the objects flushed
+     */
+    Set<Path> flushAddedSince(Map<Path, Long> before) throws IOException {
+        Set<Path> added = new HashSet<>();
+        sizes().forEach((object, size) -> {
+            if (!size.equals(before.get(object))) {
+                added.add(object);
+            }
+        });
+        Set<Path> folders = new HashSet<>();
+        for (Path object : added) {
+            force(object);
+            for (Path folder = object.getParent(); folder.startsWith(objects); folder = folder.getParent()) {
+                folders.add(folder);
+            }
+        }
+        if (!added.isEmpty()) {
+            folders.add(objects.getParent());
+            folders.add(objects.getParent().getParent());
+        }
+        folders.stream()
+                .sorted(Comparator.comparingInt(Path::getNameCount).reversed())
+                .forEach(AtomicFiles::flushDirectory);
+        return added;
+    }
+
+    /** The objects on disk, each with its size; what a download writes shows as a difference. */
+    Map<Path, Long> sizes() throws IOException {
+        Map<Path, Long> sizes = new HashMap<>();
+        if (!Files.isDirectory(objects, LinkOption.NOFOLLOW_LINKS)) {
+            return sizes;
+        }
+        Files.walkFileTree(objects, Set.of(), 3, new SimpleFileVisitor<>() {
+            @Override
+            public FileVisitResult visitFile(Path file, BasicFileAttributes attributes) {
+                if (attributes.isRegularFile()) {
+                    sizes.put(file, attributes.size());
+                }
+                return FileVisitResult.CONTINUE;
+            }
+        });
+        return sizes;
+    }
+
+    /**
+     * Moves a damaged object into the repository's temporary folder, which the next write to the
+     * repository empties. Left in place, it would stay damaged: a download skips an object of the
+     * right size, and the next backup of the file reuses it. A failed move is added to the damage.
+     */
+    private void setAside(Path object, GitStorageException damaged) {
+        try {
+            Files.createDirectories(temporary);
+            Files.move(object, temporary.resolve("damaged-" + UUID.randomUUID()), StandardCopyOption.ATOMIC_MOVE);
+        } catch (IOException failure) {
+            damaged.addSuppressed(failure);
+        }
+    }
+
+    /** Flushes one file to disk. Windows flushes only through a handle that may write; elsewhere reading is enough. */
+    private static void force(Path file) throws IOException {
+        try (FileChannel channel = FileChannel.open(file, StandardOpenOption.WRITE, LinkOption.NOFOLLOW_LINKS)) {
+            channel.force(true);
+        } catch (AccessDeniedException readOnly) {
+            try (FileChannel channel = FileChannel.open(file, StandardOpenOption.READ, LinkOption.NOFOLLOW_LINKS)) {
+                channel.force(true);
+            }
+        }
+    }
+
+    /** Copies every byte and returns what they describe as a pointer: their SHA-256 and count. */
+    private static GitLfsPointer copy(InputStream input, OutputStream target) throws IOException, InterruptedException {
+        MessageDigest digest = Digests.sha256();
+        byte[] buffer = new byte[BUFFER_BYTES];
+        long copied = 0;
+        int read;
+        while ((read = input.read(buffer)) >= 0) {
+            if (Thread.interrupted()) {
+                throw new InterruptedException("Copying a Git LFS object was cancelled");
+            }
+            digest.update(buffer, 0, read);
+            target.write(buffer, 0, read);
+            copied += read;
+        }
+        return new GitLfsPointer(Digests.hex(digest.digest()), copied);
+    }
+
+    private static GitStorageException missing(GitLfsPointer pointer) {
+        return new GitStorageException("A Git LFS object of this backup is missing or damaged: " + pointer.sha256());
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitLfsPointer.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitLfsPointer.java
index d2688ce..e1c7730 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitLfsPointer.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitLfsPointer.java
@@ -1,57 +1,66 @@
 package dev.ishaanko.worldarchive.storage.git;
 
-import java.nio.file.Path;
+import java.nio.charset.StandardCharsets;
+import java.util.Arrays;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
-/** Canonical Git LFS pointer discovered independently of mutable attributes. */
-record GitLfsPointer(String path, String sha256, long size) {
+/**
+ * A Git LFS pointer: the tree stores this small text in place of a file, and the file's bytes
+ * live in the repository's LFS object store under their SHA-256. A blob is recognized as a
+ * pointer by its content, never by mutable attributes.
+ */
+record GitLfsPointer(String sha256, long size) {
+    /** Git LFS never treats a blob of this many bytes or more as a pointer. */
+    static final int MAXIMUM_BYTES = 1_024;
+
     private static final String HEADER = "version https://git-lfs.github.com/spec/v1\n";
 
+    private static final byte[] HEADER_BYTES = HEADER.getBytes(StandardCharsets.US_ASCII);
+
+    /** How many bytes of a file tell whether it starts like a pointer. */
+    static final int HEADER_LENGTH = HEADER_BYTES.length;
+
     private static final Pattern CANONICAL = Pattern.compile(
             "\\Aversion https://git-lfs\\.github\\.com/spec/v1\\n"
                     + "oid sha256:([0-9a-f]{64})\\n"
-                    + "size (0|[1-9][0-9]*)\\n?\\z");
+                    + "size (0|[1-9][0-9]{0,18})\\n?\\z");
 
     GitLfsPointer {
-        Objects.requireNonNull(path, "path");
         Objects.requireNonNull(sha256, "sha256");
         if (size < 0) {
-            throw new IllegalArgumentException("Git LFS object size must not be negative");
+            throw new IllegalArgumentException("A Git LFS object size must not be negative");
         }
     }
 
-    static Optional<GitLfsPointer> parse(
-            GitTreeEntry entry,
-            String contents,
-            boolean truncated) throws GitStorageException {
-        if (!contents.startsWith(HEADER)) {
+    /** The pointer in a blob that starts like one; a blob that does not is ordinary content. */
+    static Optional<GitLfsPointer> parse(byte[] blob) throws GitStorageException {
+        if (blob.length >= MAXIMUM_BYTES || !startsWithHeader(blob)) {
             return Optional.empty();
         }
-        if (truncated) {
-            throw new GitStorageException("Git snapshot contains an oversized LFS pointer");
-        }
-        Matcher matcher = CANONICAL.matcher(contents);
+        Matcher matcher = CANONICAL.matcher(new String(blob, StandardCharsets.UTF_8));
         if (!matcher.matches()) {
-            throw new GitStorageException("Git snapshot contains a malformed LFS pointer");
+            throw new GitStorageException("The snapshot holds a malformed Git LFS pointer");
         }
         try {
-            return Optional.of(new GitLfsPointer(
-                    entry.path(),
-                    matcher.group(1),
-                    Long.parseLong(matcher.group(2))));
+            return Optional.of(new GitLfsPointer(matcher.group(1), Long.parseLong(matcher.group(2))));
         } catch (NumberFormatException exception) {
-            throw new GitStorageException("Git LFS pointer size is out of range", exception);
+            throw new GitStorageException("The snapshot holds a Git LFS pointer with an impossible size", exception);
         }
     }
 
-    Path objectPath(Path repository) {
-        return repository.resolve("lfs")
-                .resolve("objects")
-                .resolve(sha256.substring(0, 2))
-                .resolve(sha256.substring(2, 4))
-                .resolve(sha256);
+    /**
+     * Whether the bytes begin with the pointer header. A blob under {@link #MAXIMUM_BYTES} that
+     * does is read as a pointer.
+     */
+    static boolean startsWithHeader(byte[] bytes) {
+        return bytes.length >= HEADER_LENGTH && Arrays.equals(bytes, 0, HEADER_LENGTH, HEADER_BYTES, 0, HEADER_LENGTH);
+    }
+
+    /** The pointer text, byte for byte what Git LFS writes. */
+    String text() {
+        return HEADER + "oid sha256:" + sha256 + "\nsize " + size + "\n";
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitObjectStream.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitObjectStream.java
new file mode 100644
index 0000000..a08bd67
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitObjectStream.java
@@ -0,0 +1,124 @@
+package dev.ishaanko.worldarchive.storage.git;
+
+import dev.ishaanko.worldarchive.support.Digests;
+import java.io.BufferedInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.EOFException;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.util.Objects;
+
+/**
+ * Reads what {@code git cat-file --batch} prints for each request, in request order: a header
+ * line {@code <id> <type> <size>}, the object's bytes and a newline, or {@code <request> missing}
+ * for an object the repository does not have.
+ */
+final class GitObjectStream {
+    private static final int BUFFER_BYTES = 64 * 1_024;
+
+    private static final int MAXIMUM_HEADER_BYTES = 8 * 1_024;
+
+    private final InputStream input;
+
+    private final byte[] buffer = new byte[BUFFER_BYTES];
+
+    GitObjectStream(InputStream input) {
+        this.input = new BufferedInputStream(Objects.requireNonNull(input, "input"), BUFFER_BYTES);
+    }
+
+    /** One object header; a missing object has the type {@code missing} and no bytes. */
+    record Header(String type, long size) {
+        boolean missing() {
+            return type.equals("missing");
+        }
+    }
+
+    /** The header of the next object; the request names the object in errors. */
+    Header next(String request) throws IOException, GitStorageException {
+        String line = readHeaderLine(request);
+        if (line.endsWith(" missing") || line.endsWith(" ambiguous")) {
+            return new Header("missing", 0);
+        }
+        String[] fields = line.split(" ");
+        if (fields.length != 3 || !GitRepository.isObjectId(fields[0])) {
+            throw new GitStorageException("Git returned a malformed object header for " + request);
+        }
+        try {
+            long size = Long.parseLong(fields[2]);
+            if (size < 0) {
+                throw new NumberFormatException(fields[2]);
+            }
+            return new Header(fields[1], size);
+        } catch (NumberFormatException exception) {
+            throw new GitStorageException("Git returned an impossible object size for " + request, exception);
+        }
+    }
+
+    /** All bytes of a small object, which must be no larger than the limit. */
+    byte[] bytes(Header header, int maximumBytes) throws IOException, GitStorageException {
+        if (header.size() > maximumBytes) {
+            throw new GitStorageException("A Git object of " + header.size() + " bytes is larger than expected");
+        }
+        byte[] bytes = input.readNBytes((int) header.size());
+        if (bytes.length != header.size()) {
+            throw incomplete();
+        }
+        endObject();
+        return bytes;
+    }
+
+    /** Writes the object's bytes to the sink and returns their SHA-256. */
+    String copy(Header header, OutputStream sink) throws IOException, InterruptedException, GitStorageException {
+        MessageDigest digest = Digests.sha256();
+        long remaining = header.size();
+        while (remaining > 0) {
+            if (Thread.interrupted()) {
+                throw new InterruptedException("Reading a Git snapshot was cancelled");
+            }
+            int read = input.read(buffer, 0, (int) Math.min(buffer.length, remaining));
+            if (read < 0) {
+                throw incomplete();
+            }
+            digest.update(buffer, 0, read);
+            sink.write(buffer, 0, read);
+            remaining -= read;
+        }
+        endObject();
+        return Digests.hex(digest.digest());
+    }
+
+    /** Skips the object's bytes. */
+    void skip(Header header) throws IOException, GitStorageException {
+        try {
+            input.skipNBytes(header.size());
+        } catch (EOFException exception) {
+            throw incomplete();
+        }
+        endObject();
+    }
+
+    private void endObject() throws IOException, GitStorageException {
+        if (input.read() != '\n') {
+            throw incomplete();
+        }
+    }
+
+    private String readHeaderLine(String request) throws IOException, GitStorageException {
+        ByteArrayOutputStream line = new ByteArrayOutputStream(96);
+        int next;
+        while ((next = input.read()) != '\n') {
+            if (next < 0 || line.size() == MAXIMUM_HEADER_BYTES) {
+                throw new GitStorageException("Git stopped before it returned " + request);
+            }
+            line.write(next);
+        }
+        return line.toString(StandardCharsets.UTF_8);
+    }
+
+    private static GitStorageException incomplete() {
+        return new GitStorageException("Git returned incomplete object data");
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitPortablePath.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitPortablePath.java
deleted file mode 100644
index 60e1bbc..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitPortablePath.java
+++ /dev/null
@@ -1,110 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Path;
-import java.text.Normalizer;
-import java.util.Locale;
-import java.util.Set;
-
-/** Cross-platform validation and collision normalization for snapshot paths. */
-final class GitPortablePath {
-    private static final int MAXIMUM_PATH_BYTES = 4_096;
-
-    private static final int MAXIMUM_SEGMENT_BYTES = 255;
-
-    private static final Set<String> WINDOWS_DEVICES = Set.of(
-            "CON", "PRN", "AUX", "NUL",
-            "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9",
-            "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9");
-
-    private static final String WINDOWS_INVALID = "<>\"|?*";
-
-    private static final Set<String> INTERNAL_ROOT_NAMES = Set.of(
-            ".worldarchive",
-            GitBackupBackend.MANIFEST_PATH.toLowerCase(Locale.ROOT),
-            ".worldarchive.restore.lock");
-
-    private GitPortablePath() {
-    }
-
-    static String fromRelativePath(Path relative) {
-        StringBuilder portable = new StringBuilder();
-        for (Path segment : relative) {
-            if (!portable.isEmpty()) {
-                portable.append('/');
-            }
-            portable.append(segment);
-        }
-        return validate(portable.toString());
-    }
-
-    static String validate(String value) {
-        if (value == null
-                || value.isEmpty()
-                || value.indexOf('\0') >= 0
-                || value.indexOf('\\') >= 0
-                || value.startsWith("/")
-                || hasDrivePrefix(value)
-                || value.endsWith("/")
-                || value.getBytes(StandardCharsets.UTF_8).length > MAXIMUM_PATH_BYTES) {
-            throw new IllegalArgumentException("Git snapshot path is not portable");
-        }
-        for (String segment : value.split("/", -1)) {
-            validateSegment(segment);
-        }
-        return value;
-    }
-
-    static String collisionKey(String value) {
-        return Normalizer.normalize(validate(value), Normalizer.Form.NFC)
-                .toLowerCase(Locale.ROOT);
-    }
-
-    static void requireNotInternalRoot(String value) {
-        String rootName = value.split("/", 2)[0].toLowerCase(Locale.ROOT);
-        if (INTERNAL_ROOT_NAMES.contains(rootName)) {
-            throw new IllegalArgumentException("Git snapshot path uses an internal root name");
-        }
-    }
-
-    static Path resolveInside(Path root, String portable) throws GitStorageException {
-        String validated;
-        try {
-            validated = validate(portable);
-        } catch (IllegalArgumentException exception) {
-            throw new GitStorageException("Git snapshot contains an unsafe path", exception);
-        }
-        Path result = root;
-        for (String segment : validated.split("/")) {
-            result = result.resolve(segment);
-        }
-        result = result.normalize();
-        if (!result.startsWith(root) || result.equals(root)) {
-            throw new GitStorageException("Git snapshot path escapes its managed directory");
-        }
-        return result;
-    }
-
-    private static boolean hasDrivePrefix(String value) {
-        return value.length() >= 2 && Character.isLetter(value.charAt(0)) && value.charAt(1) == ':';
-    }
-
-    private static void validateSegment(String segment) {
-        if (segment.isEmpty()
-                || segment.equals(".")
-                || segment.equals("..")
-                || segment.endsWith(".")
-                || segment.endsWith(" ")
-                || segment.getBytes(StandardCharsets.UTF_8).length > MAXIMUM_SEGMENT_BYTES
-                || segment.indexOf(':') >= 0
-                || segment.indexOf('\uFFFD') >= 0
-                || segment.chars().anyMatch(character -> WINDOWS_INVALID.indexOf(character) >= 0)
-                || segment.chars().anyMatch(Character::isISOControl)) {
-            throw new IllegalArgumentException("Git snapshot path contains an unsafe segment");
-        }
-        String base = segment.split("\\.", 2)[0].toUpperCase(Locale.ROOT);
-        if (WINDOWS_DEVICES.contains(base) || segment.equalsIgnoreCase(".git")) {
-            throw new IllegalArgumentException("Git snapshot path uses a reserved name");
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitProgress.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitProgress.java
index 828305f..f61f19e 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitProgress.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitProgress.java
@@ -1,35 +1,38 @@
 package dev.ishaanko.worldarchive.storage.git;
 
-import dev.ishaanko.worldarchive.core.BackupOperation;
-import dev.ishaanko.worldarchive.core.OperationId;
-import dev.ishaanko.worldarchive.core.OperationPhase;
-import dev.ishaanko.worldarchive.core.OperationProgress;
-import dev.ishaanko.worldarchive.core.ProgressListener;
 import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.BackupOperation;
+import dev.ishaanko.worldarchive.model.OperationId;
+import dev.ishaanko.worldarchive.model.OperationPhase;
+import dev.ishaanko.worldarchive.model.OperationProgress;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.support.Observers;
+import java.util.Objects;
 import java.util.Optional;
 
-/** Reports Git backup progress without allowing observers to affect storage integrity. */
+/** Reports the phases of one Git backup; a failing listener never affects the backup. */
 final class GitProgress {
-    private GitProgress() {}
+    private final ProgressListener listener;
 
-    static void report(
-            ProgressListener listener,
-            OperationId operationId,
-            BackupManifest manifest,
-            OperationPhase phase,
-            String message) {
-        try {
-            listener.onProgress(new OperationProgress(
-                    operationId,
-                    manifest.worldId(),
-                    Optional.of(manifest.backupId()),
-                    BackupOperation.CREATE,
-                    phase,
-                    0,
-                    0,
-                    message));
-        } catch (RuntimeException ignored) {
-            // Storage integrity must not depend on an observer.
-        }
+    private final OperationId operationId;
+
+    private final BackupManifest manifest;
+
+    GitProgress(ProgressListener listener, BackupManifest manifest) {
+        this.listener = Objects.requireNonNull(listener, "listener");
+        this.manifest = Objects.requireNonNull(manifest, "manifest");
+        this.operationId = OperationId.create();
+    }
+
+    void report(OperationPhase phase, String message) {
+        Observers.safely(() -> listener.onProgress(new OperationProgress(
+                operationId,
+                manifest.worldId(),
+                Optional.of(manifest.backupId()),
+                BackupOperation.CREATE,
+                phase,
+                0,
+                0,
+                message)));
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRefStore.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRefStore.java
deleted file mode 100644
index 82c447e..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRefStore.java
+++ /dev/null
@@ -1,278 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Performs exact, rollback-aware mutations and lookups of WorldArchive Git refs. */
-final class GitRefStore {
-    private static final String ZERO_OBJECT_ID =
-            "0000000000000000000000000000000000000000";
-
-    private final GitBackendSettings settings;
-
-    private final GitCommands commands;
-
-    private final GitRepositoryManager repository;
-
-    GitRefStore(
-            GitBackendSettings settings,
-            GitCommands commands,
-            GitRepositoryManager repository) {
-        this.settings = Objects.requireNonNull(settings, "settings");
-        this.commands = Objects.requireNonNull(commands, "commands");
-        this.repository = Objects.requireNonNull(repository, "repository");
-    }
-
-    Optional<String> newestCommit(WorldId worldId)
-            throws IOException, InterruptedException, GitStorageException {
-        GitCommandResult result = commands.checked(
-                List.of(
-                        "for-each-ref",
-                        "--count=1",
-                        "--sort=-committerdate",
-                        "--format=%(objectname)",
-                        "refs/heads/worldarchive/" + worldId + "/"),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        String value = result.standardOutput().trim();
-        return value.isEmpty()
-                ? Optional.empty()
-                : Optional.of(GitCommands.objectId(value));
-    }
-
-    boolean exists(String refName)
-            throws IOException, InterruptedException, GitStorageException {
-        return resolve(refName).isPresent();
-    }
-
-    Optional<String> resolve(String refName)
-            throws IOException, InterruptedException, GitStorageException {
-        GitCommandResult result = commands.run(
-                List.of(
-                        "rev-parse",
-                        "--verify",
-                        "--quiet",
-                        "--end-of-options",
-                        refName + "^{commit}"),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        if (result.exitCode() == 1) {
-            return Optional.empty();
-        }
-        if (!result.successful()) {
-            throw new GitStorageException(GitCommands.failureMessage(result));
-        }
-        return Optional.of(GitCommands.objectId(result.standardOutput()));
-    }
-
-    Optional<String> resolveRemote(String refName)
-            throws IOException, InterruptedException, GitStorageException {
-        Map<String, String> matches = resolveRemotePattern(refName);
-        return Optional.ofNullable(matches.get(refName));
-    }
-
-    Map<String, String> resolveRemotePattern(String refPattern)
-            throws IOException, InterruptedException, GitStorageException {
-        repository.configureRemote();
-        GitCommandResult result = commands.checked(
-                List.of(
-                        "ls-remote",
-                        "--refs",
-                        settings.remoteName(),
-                        refPattern),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        List<String> lines = result.standardOutput().lines()
-                .filter(line -> !line.isBlank())
-                .toList();
-        Map<String, String> matches = new LinkedHashMap<>();
-        for (String line : lines) {
-            int separator = line.indexOf('\t');
-            if (separator < 1) {
-                throw new GitStorageException(
-                        "Configured Git remote returned an invalid snapshot ref");
-            }
-            String refName = line.substring(separator + 1);
-            String previous = matches.put(refName, GitCommands.objectId(
-                    line.substring(0, separator)));
-            if (previous != null) {
-                throw new GitStorageException(
-                        "Configured Git remote returned a duplicate snapshot ref");
-            }
-        }
-        return Map.copyOf(matches);
-    }
-
-    void updateWithRollback(
-            String refName,
-            String newCommit,
-            Optional<String> expectedOldCommit)
-            throws IOException, InterruptedException, GitStorageException {
-        if (expectedOldCommit.equals(Optional.of(newCommit))) {
-            return;
-        }
-        List<String> arguments = new ArrayList<>(List.of(
-                "update-ref",
-                refName,
-                newCommit));
-        arguments.add(expectedOldCommit.orElse(ZERO_OBJECT_ID));
-        try {
-            commands.checked(
-                    arguments,
-                    settings.repository(),
-                    Map.of(),
-                    new byte[0]);
-        } catch (IOException | InterruptedException | GitStorageException exception) {
-            boolean wasInterrupted = Thread.interrupted();
-            boolean restoreInterrupt = exception instanceof InterruptedException || wasInterrupted;
-            try {
-                rollbackAmbiguousUpdate(refName, newCommit, expectedOldCommit);
-            } catch (IOException | InterruptedException | GitStorageException cleanupFailure) {
-                exception.addSuppressed(cleanupFailure);
-            } finally {
-                if (restoreInterrupt) {
-                    Thread.currentThread().interrupt();
-                }
-            }
-            throw exception;
-        }
-    }
-
-    GitSnapshot resolveSnapshot(WorldId worldId, BackupId backupId)
-            throws IOException, InterruptedException, GitStorageException {
-        String refName = GitSnapshot.refName(worldId, backupId);
-        String commit = resolve(refName).orElseThrow(
-                () -> new GitStorageException("Git snapshot does not exist"));
-        return snapshotForCommit(worldId, backupId, commit);
-    }
-
-    GitSnapshot snapshotForCommit(WorldId worldId, BackupId backupId, String commit)
-            throws IOException, InterruptedException, GitStorageException {
-        GitCommandResult timestampResult = commands.checked(
-                List.of(
-                        "show",
-                        "-s",
-                        "--format=%ct",
-                        commit),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        try {
-            Instant timestamp = Instant.ofEpochSecond(
-                    Long.parseLong(timestampResult.standardOutput().trim()));
-            return new GitSnapshot(
-                    worldId,
-                    backupId,
-                    GitSnapshot.refName(worldId, backupId),
-                    commit,
-                    timestamp);
-        } catch (NumberFormatException exception) {
-            throw new GitStorageException(
-                    "Git snapshot has an invalid commit timestamp",
-                    exception);
-        }
-    }
-
-    void deleteExact(String refName, String expectedCommit)
-            throws IOException, InterruptedException, GitStorageException {
-        try {
-            commands.checked(
-                    List.of(
-                            "update-ref",
-                            "-d",
-                            refName,
-                            expectedCommit),
-                    settings.repository(),
-                    Map.of(),
-                    new byte[0]);
-        } catch (IOException | InterruptedException | GitStorageException exception) {
-            boolean wasInterrupted = Thread.interrupted();
-            boolean restoreInterrupt = exception instanceof InterruptedException || wasInterrupted;
-            try {
-                if (resolve(refName).isEmpty()) {
-                    return;
-                }
-            } catch (IOException | InterruptedException | GitStorageException verificationFailure) {
-                exception.addSuppressed(verificationFailure);
-                restoreInterrupt = restoreInterrupt
-                        || verificationFailure instanceof InterruptedException;
-            } finally {
-                if (restoreInterrupt) {
-                    Thread.currentThread().interrupt();
-                }
-            }
-            throw exception;
-        }
-        if (resolve(refName).isPresent()) {
-            throw new GitStorageException("Git ref could not be removed");
-        }
-    }
-
-    void deleteIfPresent(String refName)
-            throws IOException, InterruptedException, GitStorageException {
-        Optional<String> current = resolve(refName);
-        if (current.isPresent()) {
-            deleteExact(refName, current.get());
-        }
-    }
-
-    private void rollbackAmbiguousUpdate(
-            String refName,
-            String newCommit,
-            Optional<String> previousCommit)
-            throws IOException, InterruptedException, GitStorageException {
-        Optional<String> current = resolve(refName);
-        if (!current.equals(Optional.of(newCommit))) {
-            return;
-        }
-        List<String> rollback = new ArrayList<>(List.of("update-ref"));
-        if (previousCommit.isPresent()) {
-            rollback.add(refName);
-            rollback.add(previousCommit.get());
-            rollback.add(newCommit);
-        } else {
-            rollback.add("-d");
-            rollback.add(refName);
-            rollback.add(newCommit);
-        }
-        Exception rollbackFailure = null;
-        for (int attempt = 0; attempt < 2; attempt++) {
-            try {
-                commands.checked(
-                        rollback,
-                        settings.repository(),
-                        Map.of(),
-                        new byte[0]);
-            } catch (IOException | GitStorageException exception) {
-                if (rollbackFailure == null) {
-                    rollbackFailure = exception;
-                } else {
-                    rollbackFailure.addSuppressed(exception);
-                }
-            }
-            Optional<String> afterRollback = resolve(refName);
-            if (afterRollback.equals(previousCommit)) {
-                return;
-            }
-            if (!afterRollback.equals(Optional.of(newCommit))) {
-                throw new GitStorageException(
-                        "Git snapshot ref changed unexpectedly during publication rollback",
-                        rollbackFailure);
-            }
-        }
-        throw new GitStorageException(
-                "Git snapshot ref could not be rolled back after an interrupted publication",
-                rollbackFailure);
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRemote.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRemote.java
new file mode 100644
index 0000000..703eeff
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRemote.java
@@ -0,0 +1,186 @@
+package dev.ishaanko.worldarchive.storage.git;
+
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.WorldId;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import java.util.stream.Collectors;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * One world's remote. It lists the world's backup branches with one {@code ls-remote}, uploads a
+ * snapshot (LFS objects first, then the branch and {@code main} in one push), fetches a snapshot
+ * back, and changes several branches in one all-or-nothing push that leases every branch it
+ * touches, so a remote that refuses or changed meanwhile keeps every branch where it was.
+ */
+final class GitRemote {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
+    private final GitRepository repository;
+
+    private final WorldId worldId;
+
+    GitRemote(GitRepository repository, WorldId worldId) {
+        this.repository = Objects.requireNonNull(repository, "repository");
+        this.worldId = Objects.requireNonNull(worldId, "worldId");
+    }
+
+    /** Whether the upload also points {@code main} at the snapshot. */
+    enum MainBranch {
+        MOVE,
+        KEEP
+    }
+
+    /** One backup branch on the remote. */
+    record Branch(String refName, String commitId, BackupId backupId) {
+    }
+
+    /** The world's backup branches and the commit {@code main} points at, as one listing saw them. */
+    record Branches(Optional<String> main, List<Branch> snapshots) {
+        Branches {
+            Objects.requireNonNull(main, "main");
+            snapshots = List.copyOf(snapshots);
+        }
+
+        List<Branch> of(BackupId backupId) {
+            return snapshots.stream().filter(branch -> branch.backupId().equals(backupId)).toList();
+        }
+
+        /** Each backup's commit, for every backup whose branches agree on one commit. */
+        Map<BackupId, String> commits() {
+            Map<BackupId, Set<String>> commits = snapshots.stream().collect(Collectors.groupingBy(
+                    Branch::backupId, Collectors.mapping(Branch::commitId, Collectors.toSet())));
+            Map<BackupId, String> agreed = new HashMap<>();
+            commits.forEach((backupId, ids) -> {
+                if (ids.size() == 1) {
+                    agreed.put(backupId, ids.iterator().next());
+                }
+            });
+            return Map.copyOf(agreed);
+        }
+    }
+
+    /** A change of one remote branch: moved to a commit, or deleted when the commit is empty. */
+    record Change(String refName, String expectedCommit, Optional<String> newCommit) {
+        static Change delete(String refName, String expectedCommit) {
+            return new Change(refName, expectedCommit, Optional.empty());
+        }
+
+        static Change move(String refName, String expectedCommit, String newCommit) {
+            return new Change(refName, expectedCommit, Optional.of(newCommit));
+        }
+    }
+
+    Branches branches() throws IOException, InterruptedException, GitStorageException {
+        repository.connectRemote();
+        String listing = repository.network("ls-remote", "--refs", remoteName(),
+                GitRemoteSnapshotRef.DEFAULT_BRANCH, GitRemoteSnapshotRef.PATTERN,
+                GitRemoteSnapshotRef.legacyPattern(worldId));
+        Optional<String> main = Optional.empty();
+        List<Branch> snapshots = new ArrayList<>();
+        for (String line : listing.lines().filter(line -> !line.isBlank()).toList()) {
+            int tab = line.indexOf('\t');
+            if (tab < 0) {
+                throw new GitStorageException("The Git remote returned a malformed branch list");
+            }
+            String commit = GitRepository.objectId(line.substring(0, tab));
+            String refName = line.substring(tab + 1);
+            if (refName.equals(GitRemoteSnapshotRef.DEFAULT_BRANCH)) {
+                main = Optional.of(commit);
+            } else {
+                GitRemoteSnapshotRef.backupOf(refName, worldId)
+                        .ifPresent(backupId -> snapshots.add(new Branch(refName, commit, backupId)));
+            }
+        }
+        return new Branches(main, snapshots);
+    }
+
+    /**
+     * Uploads a snapshot: its LFS objects first, then its branch, and {@code main} in the same
+     * push when asked, so a new remote makes {@code main} its default branch. The branch must
+     * arrive; {@code main} may be protected. A host that refuses a whole push because of a
+     * protected {@code main} (as a pre-receive hook does) gets the branch alone in a second push.
+     */
+    void upload(GitSnapshot snapshot, MainBranch main) throws IOException, InterruptedException, GitStorageException {
+        repository.connectRemote();
+        repository.network("lfs", "push", remoteName(), snapshot.refName());
+        String branch = GitRemoteSnapshotRef.current(snapshot);
+        String branchRefspec = snapshot.refName() + ":" + branch;
+        GitCommandResult result = main == MainBranch.MOVE
+                ? push(branchRefspec, "+" + snapshot.refName() + ":" + GitRemoteSnapshotRef.DEFAULT_BRANCH)
+                : push(branchRefspec);
+        Map<String, Boolean> outcome = refOutcomes(result.standardOutput());
+        if (outcome.get(GitRemoteSnapshotRef.DEFAULT_BRANCH) == Boolean.FALSE) {
+            LOGGER.warn("The Git remote kept its main branch; it may be protected. {}",
+                    GitRepository.failureMessage(result));
+            if (outcome.get(branch) != Boolean.TRUE) {
+                result = push(branchRefspec);
+                outcome = refOutcomes(result.standardOutput());
+            }
+        }
+        if (outcome.get(branch) != Boolean.TRUE) {
+            throw new GitStorageException(GitRepository.failureMessage(result));
+        }
+    }
+
+    private GitCommandResult push(String... refspecs) throws IOException, InterruptedException {
+        List<String> arguments = new ArrayList<>(List.of("push", "--porcelain", "--no-verify", "--progress", remoteName()));
+        arguments.addAll(List.of(refspecs));
+        return repository.networkResult(arguments.toArray(String[]::new));
+    }
+
+    /** Fetches one remote branch into a private ref, without LFS objects, and returns its commit. */
+    String fetch(Branch branch, String privateRef) throws IOException, InterruptedException, GitStorageException {
+        repository.connectRemote();
+        repository.network("fetch", "--no-tags", "--no-write-fetch-head", "--progress", remoteName(),
+                "+" + branch.refName() + ":" + privateRef);
+        return repository.resolve(privateRef)
+                .orElseThrow(() -> new GitStorageException("The Git remote did not send the backup"));
+    }
+
+    /** Downloads the LFS objects that a fetched commit uses. */
+    void fetchLfsObjects(String commit) throws IOException, InterruptedException, GitStorageException {
+        repository.connectRemote();
+        repository.network("lfs", "fetch", remoteName(), commit);
+    }
+
+    /**
+     * Makes every change in one atomic push. Each branch is leased at the commit the caller saw,
+     * so the push fails, changing nothing, when the remote refuses any change or a branch moved.
+     */
+    void change(List<Change> changes) throws IOException, InterruptedException, GitStorageException {
+        List<String> arguments = new ArrayList<>(List.of("push", "--atomic", "--porcelain", "--no-verify", "--progress"));
+        for (Change change : changes) {
+            arguments.add("--force-with-lease=" + change.refName() + ":" + change.expectedCommit());
+        }
+        arguments.add(remoteName());
+        for (Change change : changes) {
+            arguments.add(change.newCommit().map(commit -> "+" + commit).orElse("") + ":" + change.refName());
+        }
+        repository.connectRemote();
+        repository.network(arguments.toArray(String[]::new));
+    }
+
+    private String remoteName() {
+        return repository.settings().remoteName();
+    }
+
+    /** Each destination ref a porcelain push reported, and whether the remote took it. */
+    private static Map<String, Boolean> refOutcomes(String porcelain) {
+        Map<String, Boolean> outcomes = new HashMap<>();
+        for (String line : porcelain.lines().toList()) {
+            String[] fields = line.split("\t");
+            if (fields.length >= 2 && fields[0].length() == 1 && fields[1].contains(":")) {
+                outcomes.put(fields[1].substring(fields[1].indexOf(':') + 1), !fields[0].equals("!"));
+            }
+        }
+        return outcomes;
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRemoteSnapshotRef.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRemoteSnapshotRef.java
index c68fb26..5b7bbc9 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRemoteSnapshotRef.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRemoteSnapshotRef.java
@@ -6,21 +6,34 @@
 import java.time.ZoneOffset;
 import java.time.format.DateTimeFormatter;
 import java.util.Objects;
+import java.util.Optional;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
-/** Human-readable remote branch names with compatibility for legacy UUID refs. */
+/**
+ * Names of backup branches on a remote. Each backup has its own branch,
+ * {@code backups/<date>/<time>Z-<backup id>}, and {@code main} follows the newest backup so a
+ * remote's front page shows it. Versions 0.1.0 to 0.1.3 named the branch
+ * {@code worldarchive/<world id>/<backup id>}; such branches are still found and deleted.
+ * Remote backups depend on these names, so they never change.
+ */
 final class GitRemoteSnapshotRef {
+    static final String DEFAULT_BRANCH = "refs/heads/main";
+
+    static final String PATTERN = "refs/heads/backups/*";
+
     private static final String PREFIX = "refs/heads/backups/";
 
     private static final DateTimeFormatter TIMESTAMP = DateTimeFormatter
             .ofPattern("uuuu-MM-dd/HH-mm-ss'Z'")
             .withZone(ZoneOffset.UTC);
 
+    private static final Pattern CURRENT = Pattern.compile(
+            "refs/heads/backups/\\d{4}-\\d{2}-\\d{2}/\\d{2}-\\d{2}-\\d{2}Z-([0-9a-f-]{36})");
+
     private GitRemoteSnapshotRef() {
     }
 
-    /** The remote branch that always tracks the newest backup. */
-    static final String DEFAULT_BRANCH = "refs/heads/main";
-
     static String current(GitSnapshot snapshot) {
         Objects.requireNonNull(snapshot, "snapshot");
         return current(snapshot.backupId(), snapshot.committedAt());
@@ -31,11 +44,22 @@ static String current(BackupId backupId, Instant committedAt) {
                 + "-" + Objects.requireNonNull(backupId, "backupId");
     }
 
-    static String searchPattern(BackupId backupId) {
-        return PREFIX + "*/*-" + Objects.requireNonNull(backupId, "backupId");
+    /** The ls-remote pattern for the old branches of one world. */
+    static String legacyPattern(WorldId worldId) {
+        return "refs/heads/worldarchive/" + Objects.requireNonNull(worldId, "worldId") + "/*";
     }
 
-    static String legacy(WorldId worldId, BackupId backupId) {
-        return GitSnapshot.refName(worldId, backupId);
+    /** The backup a remote branch holds, under either name; empty for any other branch. */
+    static Optional<BackupId> backupOf(String refName, WorldId worldId) {
+        Matcher current = CURRENT.matcher(refName);
+        String legacyPrefix = "refs/heads/worldarchive/" + worldId + "/";
+        String backup = current.matches()
+                ? current.group(1)
+                : refName.startsWith(legacyPrefix) ? refName.substring(legacyPrefix.length()) : "";
+        try {
+            return backup.isEmpty() ? Optional.empty() : Optional.of(BackupId.parse(backup));
+        } catch (IllegalArgumentException exception) {
+            return Optional.empty();
+        }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRemoteSnapshotStore.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRemoteSnapshotStore.java
deleted file mode 100644
index 6f7ecd8..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRemoteSnapshotStore.java
+++ /dev/null
@@ -1,75 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.time.Instant;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Resolves exact snapshot copies on the current configured remote. */
-final class GitRemoteSnapshotStore {
-    private final GitBackendSettings settings;
-
-    private final GitRepositoryManager repository;
-
-    private final GitRefStore refs;
-
-    GitRemoteSnapshotStore(
-            GitBackendSettings settings,
-            GitRepositoryManager repository,
-            GitRefStore refs) {
-        this.settings = Objects.requireNonNull(settings, "settings");
-        this.repository = Objects.requireNonNull(repository, "repository");
-        this.refs = Objects.requireNonNull(refs, "refs");
-    }
-
-    boolean containsExactLocalSnapshot(WorldId worldId, BackupId backupId)
-            throws IOException, InterruptedException, GitStorageException {
-        if (settings.remoteUrl().isEmpty()) {
-            return false;
-        }
-        repository.requireWorld(worldId);
-        repository.requireBare();
-        Optional<String> localCommit = refs.resolve(GitSnapshot.refName(worldId, backupId));
-        if (localCommit.isEmpty()) {
-            return false;
-        }
-        GitSnapshot snapshot = refs.snapshotForCommit(
-                worldId, backupId, localCommit.orElseThrow());
-        List<RemoteSnapshotRef> remote = find(
-                worldId, backupId, Optional.of(snapshot.committedAt()));
-        return !remote.isEmpty()
-                && remote.stream().allMatch(ref ->
-                        ref.commitId().equals(localCommit.orElseThrow()));
-    }
-
-    List<RemoteSnapshotRef> find(
-            WorldId worldId,
-            BackupId backupId,
-            Optional<Instant> committedAt)
-            throws IOException, InterruptedException, GitStorageException {
-        Map<String, String> matches = new LinkedHashMap<>();
-        if (committedAt.isPresent()) {
-            String currentRef = GitRemoteSnapshotRef.current(
-                    backupId,
-                    committedAt.orElseThrow());
-            refs.resolveRemote(currentRef).ifPresent(commit -> matches.put(currentRef, commit));
-        } else {
-            matches.putAll(refs.resolveRemotePattern(
-                    GitRemoteSnapshotRef.searchPattern(backupId)));
-        }
-        String legacyRef = GitRemoteSnapshotRef.legacy(worldId, backupId);
-        refs.resolveRemote(legacyRef).ifPresent(commit -> matches.put(legacyRef, commit));
-        if (matches.size() > 2) {
-            throw new GitStorageException(
-                    "Configured Git remote returned ambiguous backup branches");
-        }
-        return matches.entrySet().stream()
-                .map(entry -> new RemoteSnapshotRef(entry.getKey(), entry.getValue()))
-                .toList();
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRepository.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRepository.java
new file mode 100644
index 0000000..d89623c
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRepository.java
@@ -0,0 +1,394 @@
+package dev.ishaanko.worldarchive.storage.git;
+
+import dev.ishaanko.worldarchive.config.FolderOrigin;
+import dev.ishaanko.worldarchive.model.SafeText;
+import dev.ishaanko.worldarchive.support.AtomicFiles;
+import dev.ishaanko.worldarchive.support.FileSystemSafety;
+import java.io.IOException;
+import java.nio.file.FileAlreadyExistsException;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.NoSuchFileException;
+import java.nio.file.Path;
+import java.nio.file.attribute.BasicFileAttributes;
+import java.nio.file.attribute.FileTime;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.function.Predicate;
+import java.util.regex.Pattern;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+/**
+ * One bare repository and the Git commands WorldArchive runs in it.
+ *
+ * <p>{@link #prepare} readies the repository for a write: it creates a missing or half-created
+ * repository, applies WorldArchive's configuration when it differs (once per session for the
+ * parts that need Git), and removes lock and temporary files that a stopped operation left
+ * behind. WorldArchive's settings live in {@code worldarchive/config}, which the repository
+ * configuration includes, so a user's global configuration cannot install hooks, move LFS
+ * objects or change stored bytes, and settings never need a {@code git config} write per backup.
+ * Callers hold the repository lock for everything except reads.</p>
+ */
+final class GitRepository {
+    private static final Pattern OBJECT_ID = Pattern.compile("[0-9a-f]{40}");
+
+    private static final Pattern SHA256 = Pattern.compile("[0-9a-f]{64}");
+
+    private static final Pattern PROGRESS = Pattern.compile(
+            "(remote: )?(Enumerating objects|Counting objects|Compressing objects|Writing objects"
+                    + "|Receiving objects|Resolving deltas|Delta compression|Total \\d"
+                    + "|Uploading LFS objects|Downloading LFS objects).*");
+
+    private static final String MANAGED_CONFIG = "worldarchive/config";
+
+    private final Path directory;
+
+    private final GitBackendSettings settings;
+
+    private final GitCommandRunner runner;
+
+    /** Whether this session already checked the include directive and wrote the remote. */
+    private boolean includeChecked;
+
+    private Optional<String> connectedRemote = Optional.empty();
+
+    GitRepository(GitBackendSettings settings, GitCommandRunner runner) {
+        this.settings = Objects.requireNonNull(settings, "settings");
+        this.runner = Objects.requireNonNull(runner, "runner");
+        this.directory = settings.repository();
+    }
+
+    Path directory() {
+        return directory;
+    }
+
+    GitBackendSettings settings() {
+        return settings;
+    }
+
+    /** A temporary folder inside the repository, on the same volume as its objects. */
+    Path temporaryFolder() {
+        return directory.resolve("worldarchive").resolve("tmp");
+    }
+
+    /** Whether a bare repository exists here; checked on disk without starting Git. */
+    boolean exists() throws GitStorageException, IOException {
+        if (!Files.exists(directory, LinkOption.NOFOLLOW_LINKS)) {
+            return false;
+        }
+        requireOrdinaryFolder(directory, "WorldArchive does not use the Git repository " + directory
+                + " because it is a link or not a folder. Move it away and try again.");
+        return Files.isRegularFile(directory.resolve("HEAD"), LinkOption.NOFOLLOW_LINKS)
+                && Files.isDirectory(directory.resolve("objects"), LinkOption.NOFOLLOW_LINKS)
+                && Files.isDirectory(directory.resolve("refs"), LinkOption.NOFOLLOW_LINKS);
+    }
+
+    /**
+     * Whether this world's repository was removed from WorldArchive's default folder: that folder
+     * is reachable, or was never made, and the repository is gone without a trace. In a folder the
+     * player chose, a missing repository may sit on a drive that is away, so it never counts.
+     */
+    boolean removedFromDefaultFolder() {
+        return settings.folderOrigin() == FolderOrigin.DEFAULT
+                && Files.notExists(directory, LinkOption.NOFOLLOW_LINKS)
+                && FolderOrigin.DEFAULT.listable(directory.getParent());
+    }
+
+    /**
+     * Readies the folder that holds the repository, before the repository lock is taken there:
+     * WorldArchive's default folder is created when it is missing, and a folder the player chose
+     * must exist, because a missing one means its drive is away.
+     */
+    void requireFolder() throws IOException, GitStorageException {
+        Path folder = directory.getParent();
+        if (Files.isDirectory(folder)) {
+            return;
+        }
+        if (settings.folderOrigin() == FolderOrigin.CHOSEN) {
+            throw unreachable(folder);
+        }
+        try {
+            Files.createDirectories(folder);
+        } catch (FileAlreadyExistsException notAFolder) {
+            throw unreachable(folder);
+        }
+    }
+
+    /** Readies the repository for a write; the caller holds the repository lock. */
+    void prepare() throws IOException, InterruptedException, GitStorageException {
+        if (!exists()) {
+            requireFolder();
+            command(directory.getParent(), Map.of(), GitCommand.Input.NONE, Optional.empty(),
+                    List.of("init", "--bare", "--quiet", "--object-format=sha1", directory.toString()));
+            includeChecked = false;
+            connectedRemote = Optional.empty();
+        }
+        removeLeftovers();
+        Files.createDirectories(directory.resolve("worldarchive").resolve("hooks"));
+        writeIfChanged(directory.resolve(MANAGED_CONFIG), managedConfiguration());
+        writeIfChanged(directory.resolve("info").resolve("attributes"), attributes());
+        if (!includeChecked) {
+            GitCommandResult includes = result("config", "--local", "--get-all", "include.path");
+            if (includes.standardOutput().lines().noneMatch(MANAGED_CONFIG::equals)) {
+                git("config", "--local", "--add", "include.path", MANAGED_CONFIG);
+            }
+            includeChecked = true;
+        }
+    }
+
+    /** Points the configured remote name at this repository's remote, once per session. */
+    void connectRemote() throws IOException, InterruptedException, GitStorageException {
+        String url = settings.remoteUrl().orElseThrow(() -> new GitStorageException("This world has no Git remote"));
+        if (connectedRemote.filter(url::equals).isEmpty()) {
+            git("config", "--local", "--replace-all", "remote." + settings.remoteName() + ".url", url);
+            connectedRemote = Optional.of(url);
+        }
+    }
+
+    /** Runs a local command and returns its standard output. */
+    String git(String... arguments) throws IOException, InterruptedException, GitStorageException {
+        return git(GitCommand.Input.NONE, arguments);
+    }
+
+    /** Runs a local command with standard input and returns its standard output. */
+    String git(GitCommand.Input input, String... arguments)
+            throws IOException, InterruptedException, GitStorageException {
+        return git(directory, Map.of(), input, arguments);
+    }
+
+    /** Runs a local command in another working directory with extra environment. */
+    String git(Path workingDirectory, Map<String, String> environment, GitCommand.Input input, String... arguments)
+            throws IOException, InterruptedException, GitStorageException {
+        return checked(command(workingDirectory, environment, input, Optional.empty(), gitDirAnd(arguments)));
+    }
+
+    /** Runs a local command and returns its result whatever the exit code. */
+    GitCommandResult result(String... arguments) throws IOException, InterruptedException {
+        return command(directory, Map.of(), GitCommand.Input.NONE, Optional.empty(), gitDirAnd(arguments));
+    }
+
+    /** Runs a network command, which may stay silent no longer than the idle limit. */
+    String network(String... arguments) throws IOException, InterruptedException, GitStorageException {
+        return checked(networkResult(arguments));
+    }
+
+    /** Runs a network command and returns its result whatever the exit code. */
+    GitCommandResult networkResult(String... arguments) throws IOException, InterruptedException {
+        return command(directory, Map.of("GIT_LFS_FORCE_PROGRESS", "1"), GitCommand.Input.NONE,
+                Optional.of(settings.commandTimeout()), gitDirAnd(arguments));
+    }
+
+    /** Runs a local command whose standard output the reader consumes while Git writes it. */
+    void stream(GitCommand.Input input, GitCommandRunner.OutputReader reader, String... arguments)
+            throws IOException, InterruptedException, GitStorageException {
+        GitCommand command = new GitCommand(
+                full(gitDirAnd(arguments)), directory, Map.of(), input, Optional.empty(), settings.maximumOutputBytes());
+        GitCommandResult result = runner.stream(command, reader);
+        if (!result.successful()) {
+            throw new GitStorageException(failureMessage(result));
+        }
+    }
+
+    /** The commit a ref points at, if the ref exists. */
+    Optional<String> resolve(String refName) throws IOException, InterruptedException, GitStorageException {
+        GitCommandResult result = result("rev-parse", "--verify", "--quiet", "--end-of-options", refName + "^{commit}");
+        if (result.exitCode() == 1) {
+            return Optional.empty();
+        }
+        if (!result.successful()) {
+            throw new GitStorageException(failureMessage(result));
+        }
+        return Optional.of(objectId(result.standardOutput()));
+    }
+
+    /** Applies ref changes such as {@code create <ref> <commit>} in one all-or-nothing transaction. */
+    void updateRefs(List<String> instructions) throws IOException, InterruptedException, GitStorageException {
+        if (!instructions.isEmpty()) {
+            git(GitCommand.Input.utf8(String.join("\n", instructions) + "\n"), "update-ref", "--stdin");
+        }
+    }
+
+    /**
+     * Runs work that must finish even though the thread was interrupted, such as checking what
+     * an interrupted ref update did or removing a private ref. The interrupt flag is cleared so
+     * the Git process is not stopped at once, and set again afterwards.
+     */
+    static <T> T uninterruptibly(GitInterruptibleOperation<T> work) throws IOException, GitStorageException {
+        boolean interrupted = Thread.interrupted();
+        try {
+            return work.run();
+        } catch (InterruptedException exception) {
+            interrupted = true;
+            throw new GitStorageException("The operation was cancelled while it was finishing", exception);
+        } finally {
+            if (interrupted) {
+                Thread.currentThread().interrupt();
+            }
+        }
+    }
+
+    static String objectId(String value) throws GitStorageException {
+        String objectId = value.trim();
+        if (!OBJECT_ID.matcher(objectId).matches()) {
+            throw new GitStorageException("Git returned an invalid object ID");
+        }
+        return objectId;
+    }
+
+    static boolean isObjectId(String value) {
+        return OBJECT_ID.matcher(value).matches();
+    }
+
+    static boolean isSha256(String value) {
+        return SHA256.matcher(value).matches();
+    }
+
+    /** Git's own explanation of a failure without progress lines, redacted and cut to a safe length. */
+    static String failureMessage(GitCommandResult result) {
+        String text = result.standardError().isBlank() ? result.standardOutput() : result.standardError();
+        String detail = text.lines()
+                .map(String::strip)
+                .filter(line -> !line.isEmpty() && !PROGRESS.matcher(line).matches())
+                .collect(Collectors.joining(" "));
+        String safe = SafeText.of(detail, "", 1_024);
+        return safe.isEmpty()
+                ? "Git command failed with exit code " + result.exitCode()
+                : "Git command failed: " + safe;
+    }
+
+    private static GitStorageException unreachable(Path folder) {
+        return new GitStorageException("The Git folder " + folder + " cannot be reached. Check that its drive is"
+                + " connected, or choose another Git folder in the settings.");
+    }
+
+    /** Rejects a folder that is a link or a Windows junction; the folders above it may be links. */
+    static void requireOrdinaryFolder(Path folder, String problem) throws IOException, GitStorageException {
+        BasicFileAttributes attributes = Files.readAttributes(folder, BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
+        if (!FileSystemSafety.isOrdinaryDirectory(attributes)) {
+            throw new GitStorageException(problem);
+        }
+    }
+
+    private GitCommandResult command(
+            Path workingDirectory,
+            Map<String, String> environment,
+            GitCommand.Input input,
+            Optional<Duration> idleLimit,
+            List<String> arguments) throws IOException, InterruptedException {
+        return runner.run(new GitCommand(
+                full(arguments), workingDirectory, environment, input, idleLimit, settings.maximumOutputBytes()));
+    }
+
+    private String checked(GitCommandResult result) throws GitStorageException {
+        if (!result.successful()) {
+            throw new GitStorageException(failureMessage(result));
+        }
+        if (result.standardOutputTruncated()) {
+            throw new GitStorageException("Git printed more output than WorldArchive accepts");
+        }
+        return result.standardOutput();
+    }
+
+    private List<String> gitDirAnd(String... arguments) {
+        List<String> full = new ArrayList<>(arguments.length + 1);
+        full.add("--git-dir=" + directory);
+        full.addAll(List.of(arguments));
+        return full;
+    }
+
+    private List<String> full(List<String> arguments) {
+        List<String> full = new ArrayList<>(arguments.size() + 1);
+        full.add(settings.executable());
+        full.addAll(arguments);
+        return full;
+    }
+
+    /**
+     * WorldArchive's settings for this repository. No line-ending conversion, no hooks, LFS
+     * objects stay inside the repository, objects and refs reach the disk before Git reports
+     * success, and Git never packs or prunes on its own.
+     */
+    private String managedConfiguration() {
+        Path hooks = directory.resolve("worldarchive").resolve("hooks");
+        return """
+                # Written by WorldArchive; changes are overwritten.
+                [core]
+                    autocrlf = false
+                    filemode = false
+                    logAllRefUpdates = false
+                    longpaths = true
+                    fsmonitor = false
+                    hooksPath = %s
+                    fsync = committed,reference
+                    fsyncMethod = batch
+                [gc]
+                    auto = 0
+                [maintenance]
+                    auto = false
+                [lfs]
+                    storage = lfs
+                """.formatted(quoted(hooks.toString()));
+    }
+
+    /**
+     * The attributes that decide which files become LFS objects. The first line unsets every
+     * attribute that could change stored bytes, and this file outranks the global attributes.
+     */
+    private String attributes() {
+        StringBuilder attributes = new StringBuilder("# Written by WorldArchive; changes are overwritten.\n")
+                .append("* -text -filter -ident -working-tree-encoding\n");
+        for (String pattern : settings.lfsPatterns()) {
+            attributes.append(pattern).append(" filter=lfs diff=lfs merge=lfs -text\n");
+        }
+        return attributes.toString();
+    }
+
+    private static String quoted(String value) {
+        return '"' + value.replace("\\", "\\\\").replace("\"", "\\\"") + '"';
+    }
+
+    private static void writeIfChanged(Path file, String content) throws IOException {
+        if (Files.isRegularFile(file, LinkOption.NOFOLLOW_LINKS) && AtomicFiles.readUtf8(file).equals(content)) {
+            return;
+        }
+        AtomicFiles.writeUtf8(file, content);
+    }
+
+    /**
+     * Removes what a stopped Git left behind: lock files, fast-import crash reports and partial
+     * packs older than the idle limit, and every WorldArchive temporary file. While the caller
+     * holds the repository lock no WorldArchive Git process uses them; the age limit spares a Git
+     * command the player may be running by hand.
+     */
+    private void removeLeftovers() throws IOException {
+        Instant staleBefore = Instant.now().minus(settings.commandTimeout());
+        deleteStale(directory, 1, staleBefore, name -> name.endsWith(".lock") || name.startsWith("fast_import_crash_"));
+        deleteStale(directory.resolve("refs"), Integer.MAX_VALUE, staleBefore, name -> name.endsWith(".lock"));
+        deleteStale(directory.resolve("objects").resolve("pack"), 1, staleBefore, name -> name.startsWith("tmp_"));
+        GitTemporaryFiles.deleteContents(temporaryFolder());
+    }
+
+    private static void deleteStale(Path folder, int depth, Instant staleBefore, Predicate<String> leftover)
+            throws IOException {
+        if (!Files.isDirectory(folder, LinkOption.NOFOLLOW_LINKS)) {
+            return;
+        }
+        try (Stream<Path> files = Files.find(folder, depth, (path, attributes) -> attributes.isRegularFile()
+                && leftover.test(path.getFileName().toString())
+                && attributes.lastModifiedTime().compareTo(FileTime.from(staleBefore)) < 0)) {
+            for (Path file : files.toList()) {
+                try {
+                    Files.deleteIfExists(file);
+                } catch (NoSuchFileException ignored) {
+                    // Git removed it itself.
+                }
+            }
+        }
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRepositoryLock.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRepositoryLock.java
index 52a4c12..44b15e3 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRepositoryLock.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRepositoryLock.java
@@ -4,50 +4,56 @@
 import java.nio.channels.FileChannel;
 import java.nio.channels.FileLock;
 import java.nio.channels.OverlappingFileLockException;
+import java.nio.file.LinkOption;
 import java.nio.file.Path;
+import java.nio.file.StandardOpenOption;
 import java.time.Duration;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentMap;
 import java.util.concurrent.locks.ReentrantLock;
 
 /**
- * Serializes access to a Git repository across both in-process callers (a fair
- * {@link ReentrantLock}) and other OS processes (a {@link FileLock} on a sidecar lock file).
+ * Serializes WorldArchive's work on one repository. A fair lock per repository path covers every
+ * store in this game, including an old store that still finishes work after a settings change;
+ * a file lock beside the repository covers another game started on the same folder. The folder
+ * that holds the repository must exist; the lock never creates it.
  */
 final class GitRepositoryLock {
-    private final GitBackendSettings settings;
+    private static final ConcurrentMap<Path, ReentrantLock> LOCKS = new ConcurrentHashMap<>();
 
-    private final ReentrantLock processLock = new ReentrantLock(true);
+    private static final long RETRY_MILLIS = 25;
 
-    GitRepositoryLock(GitBackendSettings settings) {
-        this.settings = settings;
+    private GitRepositoryLock() {
     }
 
-    <T> T withLock(GitInterruptibleOperation<T> operation)
+    /**
+     * Runs the work while holding both locks; work that already holds them simply runs. Another
+     * program gets at most the wait limit to release the file lock, so a second game or a stale
+     * lock on a network share fails plainly instead of blocking a backup forever.
+     */
+    static <T> T withLock(Path repository, Duration crossProcessWait, GitInterruptibleOperation<T> work)
             throws IOException, InterruptedException, GitStorageException {
-        processLock.lockInterruptibly();
+        Path key = repository.toAbsolutePath().normalize();
+        ReentrantLock lock = LOCKS.computeIfAbsent(key, ignored -> new ReentrantLock(true));
+        if (lock.isHeldByCurrentThread()) {
+            return work.run();
+        }
+        lock.lockInterruptibly();
         try {
-            Path parent = settings.repository().getParent();
-            if (parent == null) {
-                throw new GitStorageException("Git repository path must have a parent directory");
-            }
-            GitRepositoryPathGuard.createDirectories(parent);
-            Path lockPath = parent.resolve(settings.repository().getFileName() + ".worldarchive.lock");
-            try (FileChannel channel = GitRepositoryPathGuard.openLockFile(lockPath);
-                    FileLock ignored = acquireFileLock(channel, settings.commandTimeout())) {
-                return operation.run();
+            Path lockFile = key.resolveSibling(key.getFileName() + ".worldarchive.lock");
+            try (FileChannel channel = FileChannel.open(
+                            lockFile, StandardOpenOption.CREATE, StandardOpenOption.WRITE, LinkOption.NOFOLLOW_LINKS);
+                    FileLock ignored = acquire(channel, crossProcessWait)) {
+                return work.run();
             }
         } finally {
-            processLock.unlock();
+            lock.unlock();
         }
     }
 
-    /**
-     * Waits for the cross-process lock no longer than one command timeout. A second game
-     * instance or a stale lock on a network share then gets a plain failure instead of a
-     * backup that never finishes.
-     */
-    private static FileLock acquireFileLock(FileChannel channel, Duration timeout)
+    private static FileLock acquire(FileChannel channel, Duration wait)
             throws IOException, InterruptedException, GitStorageException {
-        long deadline = System.nanoTime() + timeout.toNanos();
+        long deadline = System.nanoTime() + wait.toNanos();
         while (true) {
             try {
                 FileLock lock = channel.tryLock();
@@ -55,16 +61,13 @@ private static FileLock acquireFileLock(FileChannel channel, Duration timeout)
                     return lock;
                 }
             } catch (OverlappingFileLockException exception) {
-                // Another backend instance in this process owns the same repository lock.
-            }
-            if (Thread.interrupted()) {
-                throw new InterruptedException("Interrupted while waiting for the Git repository lock");
+                // The same file reached through another path; this game holds it elsewhere.
             }
             if (System.nanoTime() - deadline >= 0) {
                 throw new GitStorageException(
-                        "Another program is using this backup repository; close it and try again");
+                        "Another program is using this backup repository. Close it and try again.");
             }
-            Thread.sleep(25L);
+            Thread.sleep(RETRY_MILLIS);
         }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRepositoryManager.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRepositoryManager.java
deleted file mode 100644
index ef619b0..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRepositoryManager.java
+++ /dev/null
@@ -1,245 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import dev.ishaanko.worldarchive.core.AtomicFiles;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.nio.file.attribute.BasicFileAttributes;
-import java.util.ArrayList;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Creates and maintains WorldArchive-owned configuration in a bare Git repository. */
-final class GitRepositoryManager {
-    private static final String MANAGED_BEGIN = "# BEGIN WorldArchive managed";
-
-    private static final String MANAGED_END = "# END WorldArchive managed";
-
-    private static final String SHARED_HISTORY_PREFIX = "refs/heads/worldarchive-history/";
-
-    private final GitBackendSettings settings;
-
-    private final GitCommands commands;
-
-    GitRepositoryManager(GitBackendSettings settings, GitCommands commands) {
-        this.settings = Objects.requireNonNull(settings, "settings");
-        this.commands = Objects.requireNonNull(commands, "commands");
-    }
-
-    void ensure() throws IOException, InterruptedException, GitStorageException {
-        Path parent = settings.repository().getParent();
-        if (parent == null) {
-            throw new GitStorageException("Git repository path must have a parent directory");
-        }
-        GitRepositoryPathGuard.createDirectories(parent);
-        if (!Files.exists(settings.repository(), LinkOption.NOFOLLOW_LINKS)) {
-            commands.checkedRaw(
-                    List.of(
-                            "init",
-                            "--bare",
-                            "--object-format=sha1",
-                            settings.repository().toString()),
-                    parent,
-                    Map.of(),
-                    new byte[0]);
-        }
-        GitRepositoryPathGuard.requireDirectory(settings.repository());
-        requireBare();
-        if (settings.isolatedWorldId().isPresent()) {
-            commands.checked(
-                    List.of(
-                            "symbolic-ref",
-                            "HEAD",
-                            "refs/heads/main"),
-                    settings.repository(),
-                    Map.of(),
-                    new byte[0]);
-        }
-        configureRepository();
-    }
-
-    void requireBare() throws IOException, InterruptedException, GitStorageException {
-        GitRepositoryPathGuard.requireDirectory(settings.repository());
-        GitCommandResult result = commands.checked(
-                List.of(
-                        "rev-parse",
-                        "--is-bare-repository"),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        if (!result.standardOutput().trim().equals("true")) {
-            throw new GitStorageException("Configured Git repository is not bare");
-        }
-    }
-
-    void configureRemote() throws IOException, InterruptedException, GitStorageException {
-        String remoteUrl = settings.remoteUrl().orElseThrow(
-                () -> new GitStorageException("No Git remote URL is configured"));
-        configure("remote." + settings.remoteName() + ".url", remoteUrl);
-    }
-
-    void requireWorld(WorldId worldId) throws GitStorageException {
-        Optional<WorldId> isolated = settings.isolatedWorldId();
-        if (isolated.isPresent() && !isolated.orElseThrow().equals(worldId)) {
-            throw new GitStorageException(
-                    "The isolated Git repository belongs to a different world");
-        }
-    }
-
-    String historyRef(WorldId worldId) throws GitStorageException {
-        requireWorld(worldId);
-        return settings.isolatedWorldId().isPresent()
-                ? "refs/heads/main"
-                : SHARED_HISTORY_PREFIX + worldId;
-    }
-
-    private void configureRepository()
-            throws IOException, InterruptedException, GitStorageException {
-        configure("gc.auto", "0");
-        configure("maintenance.auto", "false");
-        configure("core.autocrlf", "false");
-        configure("core.filemode", "false");
-        configure("core.logAllRefUpdates", "false");
-        // Windows fails "git add" past 260 characters without this; other platforms ignore it.
-        configure("core.longpaths", "true");
-        updateManagedFile(settings.repository().resolve("info").resolve("exclude"), List.of(
-                "/.worldarchive/",
-                "/session.lock"));
-        List<String> lfsPatterns = appendOnlyLfsPatterns();
-        List<String> attributes = new ArrayList<>();
-        attributes.add("* -text");
-        for (String pattern : lfsPatterns) {
-            attributes.add(pattern + " filter=lfs diff=lfs merge=lfs -text");
-        }
-        updateManagedFile(
-                settings.repository().resolve("info").resolve("attributes"),
-                attributes);
-        commands.checked(
-                List.of(
-                        "lfs",
-                        "install",
-                        "--local"),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        if (settings.remoteUrl().isPresent()) {
-            configureRemote();
-        }
-    }
-
-    private List<String> appendOnlyLfsPatterns() throws IOException, GitStorageException {
-        LinkedHashSet<String> patterns = new LinkedHashSet<>(settings.lfsPatterns());
-        Path stateDirectory = settings.repository().resolve("worldarchive");
-        GitRepositoryPathGuard.createDirectories(stateDirectory);
-        Path state = stateDirectory.resolve("lfs-patterns");
-        if (Files.exists(state, LinkOption.NOFOLLOW_LINKS)) {
-            requireSafeRegularFile(state, "Git LFS pattern state is unsafe");
-            AtomicFiles.readUtf8(state).lines()
-                    .filter(line -> !line.isBlank())
-                    .forEach(patterns::add);
-        }
-        Path attributes = settings.repository().resolve("info").resolve("attributes");
-        GitRepositoryPathGuard.requireDirectory(attributes.getParent());
-        if (Files.exists(attributes, LinkOption.NOFOLLOW_LINKS)) {
-            requireSafeRegularFile(attributes, "Git attributes file is unsafe");
-            String suffix = " filter=lfs diff=lfs merge=lfs -text";
-            for (String line : AtomicFiles.readUtf8(attributes).lines().toList()) {
-                if (line.endsWith(suffix)) {
-                    patterns.add(line.substring(0, line.length() - suffix.length()));
-                }
-            }
-        }
-        List<String> validated;
-        try {
-            if (patterns.size() > 4_096) {
-                throw new IllegalArgumentException("Too many historical LFS patterns");
-            }
-            for (String pattern : patterns) {
-                GitSnapshotManifest.validatePatterns(List.of(pattern));
-            }
-            validated = List.copyOf(patterns);
-        } catch (IllegalArgumentException exception) {
-            throw new GitStorageException(
-                    "Repository contains unsafe persisted LFS patterns",
-                    exception);
-        }
-        AtomicFiles.writeUtf8(state, String.join("\n", validated) + "\n");
-        return validated;
-    }
-
-    private void configure(String key, String value)
-            throws IOException, InterruptedException, GitStorageException {
-        commands.checked(
-                List.of(
-                        "config",
-                        "--local",
-                        key,
-                        value),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-    }
-
-    private static void updateManagedFile(Path path, List<String> managedLines)
-            throws IOException, GitStorageException {
-        Path parent = path.getParent();
-        if (parent == null) {
-            throw new GitStorageException(
-                    "Managed Git metadata file has no parent directory");
-        }
-        GitRepositoryPathGuard.requireDirectory(parent);
-        boolean exists = Files.exists(path, LinkOption.NOFOLLOW_LINKS);
-        if (exists) {
-            requireSafeRegularFile(path, "Managed Git metadata file is unsafe");
-        }
-        String original = exists ? AtomicFiles.readUtf8(path) : "";
-        String withoutManaged = removeManagedBlock(original).stripTrailing();
-        StringBuilder content = new StringBuilder();
-        if (!withoutManaged.isEmpty()) {
-            content.append(withoutManaged).append("\n\n");
-        }
-        content.append(MANAGED_BEGIN).append('\n');
-        for (String line : managedLines) {
-            content.append(line).append('\n');
-        }
-        content.append(MANAGED_END).append('\n');
-        AtomicFiles.writeUtf8(path, content.toString());
-    }
-
-    private static String removeManagedBlock(String value) {
-        int begin = value.indexOf(MANAGED_BEGIN);
-        if (begin < 0) {
-            return value;
-        }
-        int end = value.indexOf(MANAGED_END, begin);
-        if (end < 0) {
-            return value.substring(0, begin);
-        }
-        int after = end + MANAGED_END.length();
-        if (after < value.length() && value.charAt(after) == '\r') {
-            after++;
-        }
-        if (after < value.length() && value.charAt(after) == '\n') {
-            after++;
-        }
-        return value.substring(0, begin) + value.substring(after);
-    }
-
-    private static void requireSafeRegularFile(Path path, String message)
-            throws IOException, GitStorageException {
-        BasicFileAttributes attributes = Files.readAttributes(
-                path,
-                BasicFileAttributes.class,
-                LinkOption.NOFOLLOW_LINKS);
-        if (!attributes.isRegularFile()
-                || attributes.isSymbolicLink()
-                || attributes.isOther()) {
-            throw new GitStorageException(message);
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRepositoryPathGuard.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRepositoryPathGuard.java
deleted file mode 100644
index de13b92..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRepositoryPathGuard.java
+++ /dev/null
@@ -1,74 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import dev.ishaanko.worldarchive.core.FileSystemSafety;
-import dev.ishaanko.worldarchive.core.PathGuards;
-import java.io.IOException;
-import java.nio.channels.FileChannel;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.OpenOption;
-import java.nio.file.Path;
-import java.nio.file.StandardOpenOption;
-import java.nio.file.attribute.BasicFileAttributes;
-import java.util.Set;
-
-/** Creates and opens repository control paths without following links. */
-final class GitRepositoryPathGuard {
-    private static final PathGuards.AttributeReader<GitStorageException> ATTRIBUTE_READER =
-            component -> Files.readAttributes(component, BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
-
-    private GitRepositoryPathGuard() {
-    }
-
-    static void createDirectories(Path directory) throws IOException, GitStorageException {
-        PathGuards.createDirectoriesRevalidatingPrefix(
-                directory,
-                () -> new GitStorageException("Git repository path has no filesystem root"),
-                ATTRIBUTE_READER,
-                () -> new GitStorageException("Git repository path contains a link or special entry"));
-    }
-
-    static void requireDirectory(Path directory) throws IOException, GitStorageException {
-        PathGuards.requireDirectory(
-                directory,
-                () -> new GitStorageException("Git repository path has no filesystem root"),
-                ATTRIBUTE_READER,
-                () -> new GitStorageException("Git repository path contains a link or special entry"));
-    }
-
-    static FileChannel openLockFile(Path lockPath) throws IOException, GitStorageException {
-        Path absolute = lockPath.toAbsolutePath().normalize();
-        Path parent = absolute.getParent();
-        if (parent == null) {
-            throw new GitStorageException("Git repository lock has no parent directory");
-        }
-        createDirectories(parent);
-        if (Files.exists(absolute, LinkOption.NOFOLLOW_LINKS)) {
-            BasicFileAttributes existing = Files.readAttributes(
-                    absolute,
-                    BasicFileAttributes.class,
-                    LinkOption.NOFOLLOW_LINKS);
-            if (!FileSystemSafety.isOrdinaryRegularFile(absolute, existing)) {
-                throw new GitStorageException("Git repository lock is not a regular file");
-            }
-        }
-        Set<OpenOption> options = Set.of(
-                StandardOpenOption.CREATE,
-                StandardOpenOption.WRITE,
-                LinkOption.NOFOLLOW_LINKS);
-        FileChannel channel = FileChannel.open(absolute, options);
-        try {
-            BasicFileAttributes attributes = Files.readAttributes(
-                    absolute,
-                    BasicFileAttributes.class,
-                    LinkOption.NOFOLLOW_LINKS);
-            if (!FileSystemSafety.isOrdinaryRegularFile(absolute, attributes)) {
-                throw new GitStorageException("Git repository lock is not a regular file");
-            }
-            return channel;
-        } catch (IOException | GitStorageException | RuntimeException exception) {
-            channel.close();
-            throw exception;
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRestorePublication.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRestorePublication.java
deleted file mode 100644
index 87d2af2..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitRestorePublication.java
+++ /dev/null
@@ -1,436 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import com.sun.nio.file.ExtendedOpenOption;
-import dev.ishaanko.worldarchive.core.DirectoryIdentityMarker;
-import java.io.IOException;
-import java.nio.channels.FileChannel;
-import java.nio.file.DirectoryStream;
-import java.nio.file.FileAlreadyExistsException;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.nio.file.SecureDirectoryStream;
-import java.nio.file.StandardCopyOption;
-import java.nio.file.StandardOpenOption;
-import java.nio.file.attribute.BasicFileAttributeView;
-import java.nio.file.attribute.BasicFileAttributes;
-import java.nio.file.attribute.FileTime;
-import java.nio.file.attribute.PosixFilePermission;
-import java.util.Objects;
-import java.util.Optional;
-import java.util.Set;
-import java.util.UUID;
-import java.util.stream.Stream;
-
-/** Owner-private, same-directory restore staging with one final atomic publication. */
-final class GitRestorePublication implements AutoCloseable {
-    private static final Set<PosixFilePermission> PRIVATE_PERMISSIONS = Set.of(
-            PosixFilePermission.OWNER_READ,
-            PosixFilePermission.OWNER_WRITE,
-            PosixFilePermission.OWNER_EXECUTE);
-
-    private final Path target;
-
-    private final String stagingName;
-
-    private final Path staging;
-
-    private final ParentPin parentPin;
-
-    private final TargetState originalTarget;
-
-    private final DirectoryIdentity stagingIdentity;
-
-    private boolean published;
-
-    private GitRestorePublication(
-            Path target,
-            String stagingName,
-            Path staging,
-            ParentPin parentPin,
-            TargetState originalTarget,
-            DirectoryIdentity stagingIdentity) {
-        this.target = target;
-        this.stagingName = stagingName;
-        this.staging = staging;
-        this.parentPin = parentPin;
-        this.originalTarget = originalTarget;
-        this.stagingIdentity = stagingIdentity;
-    }
-
-    static GitRestorePublication create(Path requestedTarget) throws IOException, GitStorageException {
-        Path target = Objects.requireNonNull(requestedTarget, "requestedTarget")
-                .toAbsolutePath()
-                .normalize();
-        Path parent = target.getParent();
-        Path filename = target.getFileName();
-        if (parent == null || filename == null) {
-            throw new GitStorageException("Git restore target must have a parent directory");
-        }
-        GitRepositoryPathGuard.createDirectories(parent);
-        ParentPin parentPin = ParentPin.open(parent);
-        Path staging = null;
-        try {
-            parentPin.revalidate();
-            TargetState originalTarget = TargetState.capture(
-                    target,
-                    parentPin.requiresFileKey());
-            String stagingName = ".worldarchive-restore-" + UUID.randomUUID() + ".partial";
-            staging = parent.resolve(stagingName);
-            Files.createDirectory(staging);
-            try {
-                Files.setPosixFilePermissions(staging, PRIVATE_PERMISSIONS);
-            } catch (UnsupportedOperationException exception) {
-                // Windows inherits the current user's ACL; the parent remains pinned below.
-            }
-            BasicFileAttributes stagingAttributes = safeDirectoryAttributes(
-                    staging,
-                    "Private Git restore staging is unsafe");
-            DirectoryIdentity stagingIdentity = DirectoryIdentity.capture(
-                    staging,
-                    stagingAttributes,
-                    parentPin.requiresFileKey(),
-                    true,
-                    "Private Git restore staging has no stable identity");
-            parentPin.revalidate();
-            return new GitRestorePublication(
-                    target,
-                    stagingName,
-                    staging,
-                    parentPin,
-                    originalTarget,
-                    stagingIdentity);
-        } catch (IOException | GitStorageException | RuntimeException exception) {
-            if (staging != null) {
-                GitTemporaryFiles.deleteTree(staging);
-            }
-            try {
-                parentPin.close();
-            } catch (IOException closeFailure) {
-                exception.addSuppressed(closeFailure);
-            }
-            throw exception;
-        }
-    }
-
-    Path staging() {
-        return staging;
-    }
-
-    void publish() throws IOException, GitStorageException {
-        if (published) {
-            throw new IllegalStateException("Git restore staging was already published");
-        }
-        parentPin.revalidate();
-        stagingIdentity.requireMatches(
-                staging,
-                safeDirectoryAttributes(staging, "Private Git restore staging changed before publication"),
-                "Private Git restore staging changed before publication");
-        originalTarget.requireUnchanged(target);
-
-        boolean removedOriginal = false;
-        boolean moved = false;
-        try {
-            if (originalTarget.existed()) {
-                parentPin.deleteEmptyDirectory(target.getFileName().toString());
-                removedOriginal = true;
-            } else if (Files.exists(target, LinkOption.NOFOLLOW_LINKS)) {
-                throw new FileAlreadyExistsException(target.toString());
-            }
-            parentPin.move(stagingName, target.getFileName().toString());
-            moved = true;
-            parentPin.revalidate();
-            stagingIdentity.requireMatches(
-                    target,
-                    safeDirectoryAttributes(target, "Published Git restore target is unsafe"),
-                    "Published Git restore target changed during publication");
-            published = true;
-        } catch (IOException | GitStorageException | RuntimeException exception) {
-            if (moved) {
-                try {
-                    parentPin.move(target.getFileName().toString(), stagingName);
-                    moved = false;
-                } catch (IOException rollbackFailure) {
-                    exception.addSuppressed(rollbackFailure);
-                }
-            }
-            if (removedOriginal && !Files.exists(target, LinkOption.NOFOLLOW_LINKS)) {
-                try {
-                    Files.createDirectory(target);
-                } catch (IOException rollbackFailure) {
-                    exception.addSuppressed(rollbackFailure);
-                }
-            }
-            throw exception;
-        }
-    }
-
-    DirectoryIdentity publishedIdentity() {
-        if (!published) {
-            throw new IllegalStateException("Git restore staging has not been published");
-        }
-        return stagingIdentity;
-    }
-
-    @Override
-    public void close() throws IOException {
-        IOException failure = null;
-        if (!published) {
-            GitTemporaryFiles.deleteTree(staging);
-            if (Files.exists(staging, LinkOption.NOFOLLOW_LINKS)) {
-                failure = new IOException("Private Git restore staging could not be rolled back");
-            }
-        }
-        try {
-            parentPin.close();
-        } catch (IOException exception) {
-            if (failure == null) {
-                failure = exception;
-            } else {
-                failure.addSuppressed(exception);
-            }
-        }
-        if (failure != null) {
-            throw failure;
-        }
-    }
-
-    private static BasicFileAttributes safeDirectoryAttributes(Path directory, String message)
-            throws IOException, GitStorageException {
-        GitRepositoryPathGuard.requireDirectory(directory);
-        BasicFileAttributes attributes = Files.readAttributes(
-                directory,
-                BasicFileAttributes.class,
-                LinkOption.NOFOLLOW_LINKS);
-        if (!attributes.isDirectory() || attributes.isSymbolicLink() || attributes.isOther()) {
-            throw new GitStorageException(message);
-        }
-        return attributes;
-    }
-
-    static record DirectoryIdentity(
-            Object fileKey,
-            FileTime creationTime,
-            Optional<String> marker) {
-        DirectoryIdentity {
-            Objects.requireNonNull(creationTime, "creationTime");
-            marker = Objects.requireNonNull(marker, "marker");
-        }
-
-        static DirectoryIdentity capture(
-                Path path,
-                BasicFileAttributes attributes,
-                boolean requireFileKey,
-                boolean createMarker,
-                String message) throws IOException, GitStorageException {
-            Object fileKey = attributes.fileKey();
-            if (requireFileKey && fileKey == null) {
-                throw new GitStorageException(message);
-            }
-            Optional<String> marker = createMarker
-                    ? DirectoryIdentityMarker.create(path)
-                    : DirectoryIdentityMarker.read(path);
-            if (fileKey == null && marker.isEmpty()) {
-                throw new GitStorageException(message);
-            }
-            return new DirectoryIdentity(fileKey, attributes.creationTime(), marker);
-        }
-
-        static DirectoryIdentity captureUnmarked(
-                BasicFileAttributes attributes,
-                boolean requireFileKey,
-                String message) throws GitStorageException {
-            Object fileKey = attributes.fileKey();
-            if (requireFileKey && fileKey == null) {
-                throw new GitStorageException(message);
-            }
-            return new DirectoryIdentity(
-                    fileKey, attributes.creationTime(), Optional.empty());
-        }
-
-        void requireMatches(Path path, BasicFileAttributes attributes, String message)
-                throws IOException, GitStorageException {
-            Optional<String> currentMarker = marker.isPresent()
-                    ? DirectoryIdentityMarker.read(path)
-                    : Optional.empty();
-            boolean sameIdentity = fileKey != null
-                    ? Objects.equals(fileKey, attributes.fileKey())
-                    : marker.isPresent()
-                            ? marker.equals(currentMarker)
-                            : Objects.equals(creationTime, attributes.creationTime());
-            boolean sameMarker = marker.isEmpty() || marker.equals(currentMarker);
-            if (!sameIdentity || !sameMarker) {
-                throw new GitStorageException(message);
-            }
-        }
-    }
-
-    private record TargetState(boolean existed, DirectoryIdentity identity) {
-        private static TargetState capture(Path target, boolean requireFileKey)
-                throws IOException, GitStorageException {
-            if (!Files.exists(target, LinkOption.NOFOLLOW_LINKS)) {
-                return new TargetState(false, null);
-            }
-            BasicFileAttributes attributes = safeDirectoryAttributes(
-                    target,
-                    "Git restore target is not a safe directory");
-            try (Stream<Path> children = Files.list(target)) {
-                if (children.findAny().isPresent()) {
-                    throw new GitStorageException("Git restore staging directory must be empty");
-                }
-            }
-            return new TargetState(true, DirectoryIdentity.capture(
-                    target,
-                    attributes,
-                    requireFileKey,
-                    false,
-                    "Git restore target has no stable identity"));
-        }
-
-        private void requireUnchanged(Path target) throws IOException, GitStorageException {
-            if (!existed) {
-                if (Files.exists(target, LinkOption.NOFOLLOW_LINKS)) {
-                    throw new GitStorageException("Git restore target appeared during restoration");
-                }
-                return;
-            }
-            BasicFileAttributes attributes = safeDirectoryAttributes(
-                    target,
-                    "Git restore target changed during restoration");
-            identity.requireMatches(
-                    target,
-                    attributes,
-                    "Git restore target changed during restoration");
-            try (Stream<Path> children = Files.list(target)) {
-                if (children.findAny().isPresent()) {
-                    throw new GitStorageException("Git restore target changed during restoration");
-                }
-            }
-        }
-    }
-
-    private static final class ParentPin implements AutoCloseable {
-        private final Path parent;
-
-        private final DirectoryIdentity identity;
-
-        private final SecureDirectoryStream<Path> secure;
-
-        private final FileChannel windowsPin;
-
-        private ParentPin(
-                Path parent,
-                DirectoryIdentity identity,
-                SecureDirectoryStream<Path> secure,
-                FileChannel windowsPin) {
-            this.parent = parent;
-            this.identity = identity;
-            this.secure = secure;
-            this.windowsPin = windowsPin;
-        }
-
-        private static ParentPin open(Path parent) throws IOException, GitStorageException {
-            BasicFileAttributes attributes = safeDirectoryAttributes(
-                    parent,
-                    "Git restore parent is unsafe");
-            DirectoryStream<Path> stream = Files.newDirectoryStream(parent);
-            if (stream instanceof SecureDirectoryStream<?> secureStream) {
-                @SuppressWarnings("unchecked")
-                SecureDirectoryStream<Path> typed = (SecureDirectoryStream<Path>) secureStream;
-                DirectoryIdentity identity = DirectoryIdentity.captureUnmarked(
-                        attributes,
-                        true,
-                        "Git restore parent has no stable identity");
-                return new ParentPin(parent, identity, typed, null);
-            }
-            stream.close();
-            if (!System.getProperty("os.name").startsWith("Windows")) {
-                throw new GitStorageException("Filesystem cannot pin the Git restore parent securely");
-            }
-            FileChannel pin = openWindowsPin(parent);
-            DirectoryIdentity identity = DirectoryIdentity.captureUnmarked(
-                    attributes,
-                    false,
-                    "Git restore parent has no stable identity");
-            return new ParentPin(parent, identity, null, pin);
-        }
-
-        private static FileChannel openWindowsPin(Path parent) throws IOException, GitStorageException {
-            try {
-                return FileChannel.open(
-                        parent,
-                        Set.of(
-                                StandardOpenOption.READ,
-                                LinkOption.NOFOLLOW_LINKS,
-                                ExtendedOpenOption.NOSHARE_DELETE));
-            } catch (IOException | UnsupportedOperationException directFailure) {
-                Path guard = parent.resolve(
-                        ".worldarchive-restore-parent-" + UUID.randomUUID() + ".lock");
-                try {
-                    return FileChannel.open(
-                            guard,
-                            Set.of(
-                                    StandardOpenOption.CREATE_NEW,
-                                    StandardOpenOption.READ,
-                                    StandardOpenOption.WRITE,
-                                    StandardOpenOption.DELETE_ON_CLOSE,
-                                    LinkOption.NOFOLLOW_LINKS,
-                                    ExtendedOpenOption.NOSHARE_DELETE));
-                } catch (IOException | UnsupportedOperationException exception) {
-                    exception.addSuppressed(directFailure);
-                    throw exception;
-                }
-            }
-        }
-
-        private boolean requiresFileKey() {
-            return secure != null;
-        }
-
-        private void revalidate() throws IOException, GitStorageException {
-            identity.requireMatches(
-                    parent,
-                    safeDirectoryAttributes(parent, "Git restore parent changed during restoration"),
-                    "Git restore parent changed during restoration");
-            if (secure != null) {
-                BasicFileAttributeView view = secure.getFileAttributeView(BasicFileAttributeView.class);
-                if (view == null) {
-                    throw new GitStorageException("Git restore parent handle is unavailable");
-                }
-                identity.requireMatches(
-                        parent,
-                        view.readAttributes(),
-                        "Git restore parent handle changed during restoration");
-            }
-        }
-
-        private void deleteEmptyDirectory(String name) throws IOException {
-            if (secure != null) {
-                secure.deleteDirectory(Path.of(name));
-            } else {
-                Files.delete(parent.resolve(name));
-            }
-        }
-
-        private void move(String source, String target) throws IOException {
-            if (secure != null) {
-                secure.move(Path.of(source), secure, Path.of(target));
-            } else {
-                Files.move(
-                        parent.resolve(source),
-                        parent.resolve(target),
-                        StandardCopyOption.ATOMIC_MOVE);
-            }
-        }
-
-        @Override
-        public void close() throws IOException {
-            if (secure != null) {
-                secure.close();
-            }
-            if (windowsPin != null) {
-                windowsPin.close();
-            }
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshot.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshot.java
index c404955..1d28ee4 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshot.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshot.java
@@ -4,17 +4,17 @@
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.time.Instant;
 import java.util.Objects;
-import java.util.regex.Pattern;
 
-/** One independently addressable parentless snapshot ref. */
+/**
+ * One backup's snapshot in its world's repository: the ref that names it, the commit it points
+ * at, and that commit's time. New snapshot commits have no parent; imported and older ones may.
+ */
 public record GitSnapshot(
         WorldId worldId,
         BackupId backupId,
         String refName,
         String commitId,
         Instant committedAt) {
-    private static final Pattern OBJECT_ID = Pattern.compile("[0-9a-f]{40}");
-
     public GitSnapshot {
         Objects.requireNonNull(worldId, "worldId");
         Objects.requireNonNull(backupId, "backupId");
@@ -24,7 +24,7 @@ public record GitSnapshot(
         if (!refName.equals(refName(worldId, backupId))) {
             throw new IllegalArgumentException("Snapshot ref does not match its identities");
         }
-        if (!OBJECT_ID.matcher(commitId).matches()) {
+        if (!GitRepository.isObjectId(commitId)) {
             throw new IllegalArgumentException("Snapshot commit is not a SHA-1 object ID");
         }
     }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotCreator.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotCreator.java
deleted file mode 100644
index d48e014..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotCreator.java
+++ /dev/null
@@ -1,215 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.core.OperationId;
-import dev.ishaanko.worldarchive.core.OperationPhase;
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Creates, verifies, and atomically publishes one local Git snapshot. */
-final class GitSnapshotCreator {
-    private final GitBackendSettings settings;
-
-    private final GitCommands commands;
-
-    private final GitRepositoryManager repository;
-
-    private final GitRefStore refs;
-
-    private final GitSnapshotVerifier verifier;
-
-    GitSnapshotCreator(
-            GitBackendSettings settings,
-            GitCommands commands,
-            GitRepositoryManager repository,
-            GitRefStore refs,
-            GitSnapshotVerifier verifier) {
-        this.settings = Objects.requireNonNull(settings, "settings");
-        this.commands = Objects.requireNonNull(commands, "commands");
-        this.repository = Objects.requireNonNull(repository, "repository");
-        this.refs = Objects.requireNonNull(refs, "refs");
-        this.verifier = Objects.requireNonNull(verifier, "verifier");
-    }
-
-    GitSnapshot create(
-            BackupCapture capture,
-            ProgressListener progressListener,
-            OperationId operationId)
-            throws IOException, InterruptedException, GitStorageException {
-        repository.ensure();
-        BackupManifest manifest = capture.manifest();
-        GitSnapshotManifest snapshotManifest = GitSnapshotManifest.create(
-                manifest,
-                settings.lfsPatterns());
-        String snapshotRef = GitSnapshot.refName(manifest.worldId(), manifest.backupId());
-        if (refs.exists(snapshotRef)) {
-            throw new GitStorageException("The exact Git snapshot ref already exists");
-        }
-
-        GitProgress.report(
-                progressListener,
-                operationId,
-                manifest,
-                OperationPhase.READING,
-                "Capturing current world files");
-        try (GitSourceCapture sourceCapture = GitSourceCapture.create(
-                capture.worldDirectory(),
-                manifest)) {
-            return createFromSource(
-                    sourceCapture.root(),
-                    snapshotManifest,
-                    snapshotRef,
-                    progressListener,
-                    operationId);
-        }
-    }
-
-    private GitSnapshot createFromSource(
-            Path workTree,
-            GitSnapshotManifest snapshotManifest,
-            String snapshotRef,
-            ProgressListener progressListener,
-            OperationId operationId)
-            throws IOException, InterruptedException, GitStorageException {
-        BackupManifest manifest = snapshotManifest.manifest();
-        Path temporary = Files.createTempDirectory("worldarchive-git-index-").toRealPath();
-        Path index = temporary.resolve("index");
-        Map<String, String> environment = GitCommands.indexEnvironment(index, false);
-        try {
-            Optional<String> previousCommit = refs.newestCommit(manifest.worldId());
-            readPreviousTree(previousCommit, workTree, environment);
-            String tree = stageTree(
-                    workTree,
-                    environment,
-                    snapshotManifest,
-                    progressListener,
-                    operationId);
-            String commit = createCommit(
-                    tree,
-                    workTree,
-                    environment,
-                    snapshotManifest);
-            GitProgress.report(
-                    progressListener,
-                    operationId,
-                    manifest,
-                    OperationPhase.VERIFYING,
-                    "Verifying Git and LFS objects");
-            GitSnapshot snapshot = new GitSnapshot(
-                    manifest.worldId(),
-                    manifest.backupId(),
-                    snapshotRef,
-                    commit,
-                    manifest.createdAt());
-            verifier.verify(snapshot);
-            refs.updateWithRollback(snapshotRef, commit, Optional.empty());
-            return snapshot;
-        } finally {
-            GitTemporaryFiles.deleteTree(temporary);
-        }
-    }
-
-    private void readPreviousTree(
-            Optional<String> previousCommit,
-            Path workTree,
-            Map<String, String> environment)
-            throws IOException, InterruptedException, GitStorageException {
-        List<String> arguments = previousCommit
-                .map(previous -> List.of("read-tree", previous))
-                .orElseGet(() -> List.of("read-tree", "--empty"));
-        commands.checked(arguments, workTree, environment, new byte[0]);
-    }
-
-    private String stageTree(
-            Path workTree,
-            Map<String, String> environment,
-            GitSnapshotManifest snapshotManifest,
-            ProgressListener progressListener,
-            OperationId operationId)
-            throws IOException, InterruptedException, GitStorageException {
-        GitProgress.report(
-                progressListener,
-                operationId,
-                snapshotManifest.manifest(),
-                OperationPhase.WRITING,
-                "Staging Git snapshot");
-        // --force: a .gitignore inside the world or the user's global excludes file must
-        // never drop world files from the snapshot. The capture already left out
-        // .worldarchive and session.lock, so nothing unwanted is in the work tree.
-        commands.checked(
-                List.of(
-                        "--work-tree=" + workTree,
-                        "add",
-                        "--all",
-                        "--force",
-                        "--",
-                        "."),
-                workTree,
-                environment,
-                new byte[0]);
-        injectManifest(snapshotManifest, workTree, environment);
-        String tree = GitCommands.objectId(commands.checked(
-                List.of("write-tree"),
-                workTree,
-                environment,
-                new byte[0]).standardOutput());
-        verifier.verifyTreeModes(tree);
-        return tree;
-    }
-
-    private String createCommit(
-            String tree,
-            Path workTree,
-            Map<String, String> indexEnvironment,
-            GitSnapshotManifest snapshotManifest)
-            throws IOException, InterruptedException, GitStorageException {
-        BackupManifest manifest = snapshotManifest.manifest();
-        Map<String, String> commitEnvironment = new HashMap<>(indexEnvironment);
-        commitEnvironment.put("GIT_AUTHOR_NAME", "WorldArchive");
-        commitEnvironment.put("GIT_AUTHOR_EMAIL", "worldarchive@localhost");
-        commitEnvironment.put("GIT_COMMITTER_NAME", "WorldArchive");
-        commitEnvironment.put("GIT_COMMITTER_EMAIL", "worldarchive@localhost");
-        commitEnvironment.put("GIT_AUTHOR_DATE", manifest.createdAt().toString());
-        commitEnvironment.put("GIT_COMMITTER_DATE", manifest.createdAt().toString());
-        return GitCommands.objectId(commands.checked(
-                List.of(
-                        "commit-tree",
-                        tree),
-                workTree,
-                commitEnvironment,
-                GitCommand.utf8Input(GitSnapshotVerifier.commitMessage(snapshotManifest)))
-                .standardOutput());
-    }
-
-    private void injectManifest(
-            GitSnapshotManifest manifest,
-            Path workingDirectory,
-            Map<String, String> environment)
-            throws IOException, InterruptedException, GitStorageException {
-        String blob = GitCommands.objectId(commands.checked(
-                List.of(
-                        "hash-object",
-                        "-w",
-                        "--stdin"),
-                workingDirectory,
-                environment,
-                GitSnapshotManifestCodec.encode(manifest)).standardOutput());
-        commands.checked(
-                List.of(
-                        "update-index",
-                        "--add",
-                        "--cacheinfo",
-                        "100644," + blob + "," + GitBackupBackend.MANIFEST_PATH),
-                workingDirectory,
-                environment,
-                new byte[0]);
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotDeleter.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotDeleter.java
new file mode 100644
index 0000000..cc63436
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotDeleter.java
@@ -0,0 +1,218 @@
+package dev.ishaanko.worldarchive.storage.git;
+
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.SafeText;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import java.util.UUID;
+
+/**
+ * Deletes several backups of one world as one operation. With a remote, one listing shows every
+ * remote branch, and one atomic push per batch removes the branches and, when {@code main}
+ * shows a deleted backup, moves it to the newest backup the remote keeps (or to an empty
+ * placeholder commit when none is left). A remote that refuses any part keeps every branch where
+ * it was, and then nothing local of that batch is deleted either. Local refs go last, in one
+ * transaction, only for backups that are gone from the remote.
+ */
+final class GitSnapshotDeleter {
+    /** A batch stays well below the Windows command line limit of 32,767 characters. */
+    private static final int BACKUPS_PER_PUSH = 100;
+
+    private static final String PLACEHOLDER_MESSAGE = "WorldArchive: all backups were deleted\n";
+
+    private final GitRepository repository;
+
+    private final Optional<GitRemote> remote;
+
+    private final List<String> privateRefs = new ArrayList<>();
+
+    GitSnapshotDeleter(GitRepository repository, Optional<GitRemote> remote) {
+        this.repository = Objects.requireNonNull(repository, "repository");
+        this.remote = Objects.requireNonNull(remote, "remote");
+    }
+
+    /** Deletes the requested backups; {@code local} lists every local snapshot of the world. */
+    Map<BackupId, GitDeletion> delete(Map<BackupId, GitSnapshot> local, Set<BackupId> requested)
+            throws IOException, InterruptedException, GitStorageException {
+        Map<BackupId, GitDeletion> results = new LinkedHashMap<>();
+        if (remote.isEmpty()) {
+            requested.stream().filter(id -> !local.containsKey(id))
+                    .forEach(id -> results.put(id, GitDeletion.remoteNotConfigured()));
+            deleteLocal(requested.stream().filter(local::containsKey).map(local::get).toList(), results);
+            return results;
+        }
+        GitRemote.Branches branches;
+        try {
+            branches = remote.get().branches();
+        } catch (IOException | GitStorageException exception) {
+            requested.forEach(id -> results.put(id, GitDeletion.failed(unreachable(exception))));
+            return results;
+        }
+        List<BackupId> onRemote = new ArrayList<>();
+        List<GitSnapshot> localOnly = new ArrayList<>();
+        for (BackupId backupId : requested) {
+            Optional<GitSnapshot> snapshot = Optional.ofNullable(local.get(backupId));
+            List<GitRemote.Branch> copies = branches.of(backupId);
+            if (snapshot.isEmpty() && copies.isEmpty()) {
+                results.put(backupId, GitDeletion.notFound());
+            } else if (!sameCommit(snapshot, copies)) {
+                results.put(backupId, GitDeletion.failed("The remote copy of this backup differs from this"
+                        + " computer's copy, so neither was deleted"));
+            } else if (copies.isEmpty()) {
+                localOnly.add(snapshot.orElseThrow());
+            } else {
+                onRemote.add(backupId);
+            }
+        }
+        List<BackupId> removed = deleteRemote(branches, onRemote, local, results);
+        List<GitSnapshot> localCopies = new ArrayList<>(localOnly);
+        removed.stream().filter(local::containsKey).map(local::get).forEach(localCopies::add);
+        removed.stream().filter(id -> !local.containsKey(id)).forEach(id -> results.put(id, GitDeletion.deleted()));
+        deleteLocal(localCopies, results);
+        return results;
+    }
+
+    private static boolean sameCommit(Optional<GitSnapshot> snapshot, List<GitRemote.Branch> copies) {
+        String expected = snapshot.map(GitSnapshot::commitId)
+                .orElseGet(() -> copies.isEmpty() ? "" : copies.getFirst().commitId());
+        return copies.stream().allMatch(copy -> copy.commitId().equals(expected));
+    }
+
+    /** Removes remote branches batch by batch and returns the backups whose branches are gone. */
+    private List<BackupId> deleteRemote(
+            GitRemote.Branches branches,
+            List<BackupId> onRemote,
+            Map<BackupId, GitSnapshot> local,
+            Map<BackupId, GitDeletion> results) throws IOException, InterruptedException, GitStorageException {
+        Optional<String> main = branches.main();
+        List<BackupId> ordered = new ArrayList<>(onRemote);
+        ordered.sort(Comparator.comparing((BackupId id) -> !shownByMain(branches, main, id)));
+        Optional<GitRemote.Change> moveMain = ordered.isEmpty() || !shownByMain(branches, main, ordered.getFirst())
+                ? Optional.empty()
+                : Optional.of(GitRemote.Change.move(
+                        GitRemoteSnapshotRef.DEFAULT_BRANCH, main.orElseThrow(), newMain(branches, onRemote, local)));
+        List<BackupId> removed = new ArrayList<>();
+        for (int start = 0; start < ordered.size(); start += BACKUPS_PER_PUSH) {
+            List<BackupId> batch = ordered.subList(start, Math.min(ordered.size(), start + BACKUPS_PER_PUSH));
+            List<GitRemote.Change> changes = new ArrayList<>();
+            if (start == 0) {
+                moveMain.ifPresent(changes::add);
+            }
+            batch.forEach(id -> branches.of(id).forEach(branch ->
+                    changes.add(GitRemote.Change.delete(branch.refName(), branch.commitId()))));
+            try {
+                remote.orElseThrow().change(changes);
+                removed.addAll(batch);
+            } catch (IOException | GitStorageException exception) {
+                if (goneFromRemote(batch)) {
+                    removed.addAll(batch);
+                } else {
+                    batch.forEach(id -> results.put(id, GitDeletion.failed(refused(exception))));
+                }
+            } catch (InterruptedException exception) {
+                ordered.subList(start, ordered.size()).forEach(id -> results.put(id,
+                        GitDeletion.failed("The delete was cancelled; delete the backup again to finish")));
+                Thread.currentThread().interrupt();
+                break;
+            }
+        }
+        return removed;
+    }
+
+    private static boolean shownByMain(GitRemote.Branches branches, Optional<String> main, BackupId backupId) {
+        return main.isPresent() && branches.of(backupId).stream()
+                .anyMatch(branch -> branch.commitId().equals(main.get()));
+    }
+
+    /**
+     * Where {@code main} goes when it shows a deleted backup: the newest backup the remote keeps,
+     * fetched first when this computer lacks it, or an empty placeholder commit when none is left.
+     */
+    private String newMain(GitRemote.Branches branches, List<BackupId> deleted, Map<BackupId, GitSnapshot> local)
+            throws IOException, InterruptedException, GitStorageException {
+        List<GitRemote.Branch> kept = branches.snapshots().stream()
+                .filter(branch -> !deleted.contains(branch.backupId()))
+                .sorted(Comparator.comparing((GitRemote.Branch branch) -> isDated(branch))
+                        .thenComparing(GitRemote.Branch::refName)
+                        .reversed())
+                .toList();
+        if (kept.isEmpty()) {
+            String tree = GitRepository.objectId(repository.git("mktree"));
+            return GitRepository.objectId(repository.git(repository.directory(), placeholderIdentity(),
+                    GitCommand.Input.utf8(PLACEHOLDER_MESSAGE), "commit-tree", tree));
+        }
+        for (GitRemote.Branch branch : kept) {
+            if (local.values().stream().anyMatch(snapshot -> snapshot.commitId().equals(branch.commitId()))) {
+                return branch.commitId();
+            }
+        }
+        String privateRef = "refs/worldarchive/fetch/" + UUID.randomUUID();
+        privateRefs.add(privateRef);
+        return remote.orElseThrow().fetch(kept.getFirst(), privateRef);
+    }
+
+    private static boolean isDated(GitRemote.Branch branch) {
+        return branch.refName().startsWith("refs/heads/backups/");
+    }
+
+    /** After a failed push, whether the remote applied it anyway before the connection ended. */
+    private boolean goneFromRemote(List<BackupId> batch) {
+        try {
+            GitRemote.Branches after = GitRepository.uninterruptibly(() -> remote.orElseThrow().branches());
+            return batch.stream().allMatch(id -> after.of(id).isEmpty());
+        } catch (IOException | GitStorageException exception) {
+            return false;
+        }
+    }
+
+    /** Deletes local refs in one transaction; after a failure, what the refs point at decides. */
+    private void deleteLocal(List<GitSnapshot> snapshots, Map<BackupId, GitDeletion> results)
+            throws IOException, GitStorageException {
+        List<String> instructions = new ArrayList<>();
+        snapshots.forEach(snapshot -> instructions.add("delete " + snapshot.refName() + " " + snapshot.commitId()));
+        privateRefs.forEach(ref -> instructions.add("delete " + ref));
+        try {
+            GitRepository.uninterruptibly(() -> {
+                repository.updateRefs(instructions);
+                return null;
+            });
+            snapshots.forEach(snapshot -> results.put(snapshot.backupId(), GitDeletion.deleted()));
+        } catch (IOException | GitStorageException failure) {
+            for (GitSnapshot snapshot : snapshots) {
+                boolean gone = GitRepository.uninterruptibly(() -> repository.resolve(snapshot.refName())).isEmpty();
+                results.put(snapshot.backupId(), gone
+                        ? GitDeletion.deleted()
+                        : GitDeletion.failed("This computer's Git copy could not be deleted: "
+                                + SafeText.from(failure, "Git failed", 512) + ". Try again."));
+            }
+        }
+    }
+
+    private static Map<String, String> placeholderIdentity() {
+        return Map.of(
+                "GIT_AUTHOR_NAME", "WorldArchive",
+                "GIT_AUTHOR_EMAIL", "worldarchive@localhost",
+                "GIT_AUTHOR_DATE", "1970-01-01T00:00:00Z",
+                "GIT_COMMITTER_NAME", "WorldArchive",
+                "GIT_COMMITTER_EMAIL", "worldarchive@localhost",
+                "GIT_COMMITTER_DATE", "1970-01-01T00:00:00Z");
+    }
+
+    private static String unreachable(Exception exception) {
+        return "The Git remote could not be reached, so nothing was deleted. Connect to the network and try"
+                + " again, or remove the world's remote in its settings to delete only this computer's copy. "
+                + SafeText.from(exception, "", 512);
+    }
+
+    private static String refused(Exception exception) {
+        return "The Git remote did not accept the delete, so nothing was deleted there or here. Check the"
+                + " remote's branch protection and try again. " + SafeText.from(exception, "", 512);
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotManifest.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotManifest.java
index 4952540..3162816 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotManifest.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotManifest.java
@@ -1,16 +1,18 @@
 package dev.ishaanko.worldarchive.storage.git;
 
-import dev.ishaanko.worldarchive.core.Digests;
 import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.support.Digests;
 import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
 import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Objects;
 import java.util.Set;
-import java.util.regex.Pattern;
 
-/** Snapshot-local metadata binding source identity and LFS behavior to one commit. */
+/**
+ * The metadata stored in every snapshot tree: the backup manifest, the LFS patterns the snapshot
+ * was written with, and a source identity that the commit message repeats, which binds the
+ * commit to exactly this manifest.
+ */
 record GitSnapshotManifest(
         int storageFormatVersion,
         BackupManifest manifest,
@@ -18,7 +20,9 @@ record GitSnapshotManifest(
         String sourceIdentity) {
     static final int CURRENT_STORAGE_FORMAT_VERSION = 1;
 
-    private static final Pattern SHA256 = Pattern.compile("[0-9a-f]{64}");
+    private static final int MAXIMUM_PATTERNS = 128;
+
+    private static final int MAXIMUM_PATTERN_LENGTH = 256;
 
     GitSnapshotManifest {
         if (storageFormatVersion != CURRENT_STORAGE_FORMAT_VERSION) {
@@ -27,8 +31,7 @@ record GitSnapshotManifest(
         Objects.requireNonNull(manifest, "manifest");
         lfsPatterns = validatePatterns(lfsPatterns);
         Objects.requireNonNull(sourceIdentity, "sourceIdentity");
-        if (!SHA256.matcher(sourceIdentity).matches()
-                || !sourceIdentity.equals(computeSourceIdentity(manifest))) {
+        if (!sourceIdentity.equals(computeSourceIdentity(manifest))) {
             throw new IllegalArgumentException("Git snapshot source identity is invalid");
         }
     }
@@ -41,6 +44,15 @@ static GitSnapshotManifest create(BackupManifest manifest, List<String> lfsPatte
                 computeSourceIdentity(manifest));
     }
 
+    /** The commit message that binds a snapshot commit to its manifest. */
+    String commitMessage() {
+        return "WorldArchive snapshot\n\n"
+                + "world-id: " + manifest.worldId() + "\n"
+                + "backup-id: " + manifest.backupId() + "\n"
+                + "source-identity: " + sourceIdentity + "\n";
+    }
+
+    /** SHA-256 of the manifest's canonical text; stored snapshots depend on this exact text. */
     static String computeSourceIdentity(BackupManifest manifest) {
         Objects.requireNonNull(manifest, "manifest");
         String canonical = "worldarchive-source-v1\n"
@@ -59,30 +71,32 @@ static String computeSourceIdentity(BackupManifest manifest) {
                 + manifest.gameVersion()
                         .map(stamp -> "gameVersion:" + stamp.name() + "\n" + stamp.dataVersion() + "\n")
                         .orElse("");
-        MessageDigest digest = Digests.sha256();
-        return Digests.hex(digest.digest(canonical.getBytes(StandardCharsets.UTF_8)));
+        return Digests.hex(Digests.sha256().digest(canonical.getBytes(StandardCharsets.UTF_8)));
     }
 
+    /** Between 1 and 128 distinct patterns, each safe to write into a Git attributes file. */
     static List<String> validatePatterns(List<String> patterns) {
         Objects.requireNonNull(patterns, "lfsPatterns");
-        if (patterns.isEmpty() || patterns.size() > 128) {
-            throw new IllegalArgumentException("Git snapshot has an invalid LFS pattern count");
+        if (patterns.isEmpty() || patterns.size() > MAXIMUM_PATTERNS) {
+            throw new IllegalArgumentException("Git LFS needs between 1 and " + MAXIMUM_PATTERNS + " patterns");
         }
         Set<String> unique = new LinkedHashSet<>();
         for (String pattern : patterns) {
-            Objects.requireNonNull(pattern, "lfsPattern");
-            if (pattern.isBlank()
-                    || pattern.length() > 256
-                    || pattern.startsWith("!")
-                    || pattern.startsWith("-")
-                    || pattern.contains("\\")
-                    || pattern.contains("..")
-                    || pattern.chars().anyMatch(Character::isWhitespace)
-                    || pattern.chars().anyMatch(Character::isISOControl)
-                    || !unique.add(pattern)) {
-                throw new IllegalArgumentException("Git snapshot has an unsafe LFS pattern");
+            if (!isSafePattern(Objects.requireNonNull(pattern, "lfsPattern")) || !unique.add(pattern)) {
+                throw new IllegalArgumentException("Git LFS pattern is unsafe or repeated: " + pattern);
             }
         }
         return List.copyOf(unique);
     }
+
+    private static boolean isSafePattern(String pattern) {
+        return !pattern.isBlank()
+                && pattern.length() <= MAXIMUM_PATTERN_LENGTH
+                && !pattern.startsWith("!")
+                && !pattern.startsWith("-")
+                && !pattern.contains("\\")
+                && !pattern.contains("..")
+                && pattern.chars().noneMatch(character -> Character.isWhitespace(character)
+                        || Character.isISOControl(character));
+    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotManifestCodec.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotManifestCodec.java
index f52805f..dbc5194 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotManifestCodec.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotManifestCodec.java
@@ -3,57 +3,32 @@
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
 import com.google.gson.JsonArray;
-import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
-import com.google.gson.JsonParseException;
-import com.google.gson.JsonParser;
-import com.google.gson.JsonPrimitive;
-import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.GameVersionStamp;
-import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.model.BackupManifestJson;
+import dev.ishaanko.worldarchive.support.JsonFields;
 import java.io.IOException;
-import java.math.BigDecimal;
 import java.nio.charset.StandardCharsets;
-import java.time.DateTimeException;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Optional;
 
-/** Strict codec for the metadata injected into every Git snapshot tree. */
+/**
+ * Strict JSON codec for the manifest file in every snapshot tree. Stored snapshots depend on the
+ * exact bytes, so the field order and the pretty printing never change.
+ */
 final class GitSnapshotManifestCodec {
     private static final Gson GSON = new GsonBuilder()
             .setPrettyPrinting()
             .disableHtmlEscaping()
             .create();
 
+    private static final JsonFields<IOException> FIELDS = new JsonFields<>(IOException::new);
+
     private GitSnapshotManifestCodec() {
     }
 
     static byte[] encode(GitSnapshotManifest snapshotManifest) {
-        BackupManifest manifest = snapshotManifest.manifest();
         JsonObject root = new JsonObject();
         root.addProperty("storageFormatVersion", snapshotManifest.storageFormatVersion());
-        root.addProperty("formatVersion", manifest.formatVersion());
-        root.addProperty("backupId", manifest.backupId().toString());
-        root.addProperty("worldId", manifest.worldId().toString());
-        root.addProperty("worldName", manifest.worldName());
-        manifest.label().ifPresent(label -> root.addProperty("label", label));
-        root.addProperty("createdAt", manifest.createdAt().toString());
-        root.addProperty("trigger", manifest.trigger().name());
-        root.addProperty("sourceFileCount", manifest.sourceFileCount());
-        root.addProperty("sourceByteCount", manifest.sourceByteCount());
-        root.addProperty("changedFileCount", manifest.changedFileCount());
-        root.addProperty("contentSha256", manifest.contentSha256());
-        root.addProperty("inventorySha256", manifest.inventorySha256());
-        manifest.gameVersion().ifPresent(stamp -> {
-            JsonObject encodedVersion = new JsonObject();
-            encodedVersion.addProperty("name", stamp.name());
-            encodedVersion.addProperty("dataVersion", stamp.dataVersion());
-            root.add("gameVersion", encodedVersion);
-        });
+        BackupManifestJson.write(snapshotManifest.manifest(), root);
         root.addProperty("sourceIdentity", snapshotManifest.sourceIdentity());
         JsonArray patterns = new JsonArray();
         snapshotManifest.lfsPatterns().forEach(patterns::add);
@@ -62,105 +37,16 @@ static byte[] encode(GitSnapshotManifest snapshotManifest) {
     }
 
     static GitSnapshotManifest decode(byte[] encoded) throws IOException {
+        JsonObject root = FIELDS.parseObject(new String(encoded, StandardCharsets.UTF_8), "Git snapshot manifest");
         try {
-            JsonElement parsed = JsonParser.parseString(new String(encoded, StandardCharsets.UTF_8));
-            if (!parsed.isJsonObject()) {
-                throw new IOException("Git snapshot manifest root is not an object");
-            }
-            JsonObject root = parsed.getAsJsonObject();
-            BackupManifest manifest = new BackupManifest(
-                    requiredInteger(root, "formatVersion"),
-                    BackupId.parse(requiredString(root, "backupId")),
-                    WorldId.parse(requiredString(root, "worldId")),
-                    requiredString(root, "worldName"),
-                    optionalString(root, "label"),
-                    Instant.parse(requiredString(root, "createdAt")),
-                    BackupTrigger.valueOf(requiredString(root, "trigger")),
-                    requiredLong(root, "sourceFileCount"),
-                    requiredLong(root, "sourceByteCount"),
-                    requiredLong(root, "changedFileCount"),
-                    requiredString(root, "contentSha256"),
-                    requiredString(root, "inventorySha256"),
-                    optionalGameVersion(root));
+            BackupManifest manifest = BackupManifestJson.read(root, FIELDS);
             return new GitSnapshotManifest(
-                    requiredInteger(root, "storageFormatVersion"),
+                    FIELDS.requiredInt(root, "storageFormatVersion"),
                     manifest,
-                    requiredStrings(root, "lfsPatterns"),
-                    requiredString(root, "sourceIdentity"));
-        } catch (JsonParseException | IllegalArgumentException | DateTimeException exception) {
+                    FIELDS.requiredStrings(root, "lfsPatterns"),
+                    FIELDS.requiredString(root, "sourceIdentity"));
+        } catch (IllegalArgumentException exception) {
             throw new IOException("Git snapshot manifest contains invalid data", exception);
         }
     }
-
-    private static List<String> requiredStrings(JsonObject root, String name) throws IOException {
-        JsonElement element = root.get(name);
-        if (element == null || !element.isJsonArray()) {
-            throw new IOException("Git snapshot manifest is missing array: " + name);
-        }
-        List<String> values = new ArrayList<>();
-        for (JsonElement value : element.getAsJsonArray()) {
-            if (!value.isJsonPrimitive() || !value.getAsJsonPrimitive().isString()) {
-                throw new IOException("Git snapshot manifest contains an invalid string array");
-            }
-            values.add(value.getAsString());
-        }
-        return List.copyOf(values);
-    }
-
-    private static String requiredString(JsonObject root, String name) throws IOException {
-        JsonElement element = root.get(name);
-        if (element == null || !element.isJsonPrimitive() || !element.getAsJsonPrimitive().isString()) {
-            throw new IOException("Git snapshot manifest is missing string: " + name);
-        }
-        return element.getAsString();
-    }
-
-    private static Optional<String> optionalString(JsonObject root, String name) throws IOException {
-        JsonElement element = root.get(name);
-        if (element == null || element.isJsonNull()) {
-            return Optional.empty();
-        }
-        if (!element.isJsonPrimitive() || !element.getAsJsonPrimitive().isString()) {
-            throw new IOException("Git snapshot manifest contains an invalid optional string");
-        }
-        return Optional.of(element.getAsString());
-    }
-
-    private static Optional<GameVersionStamp> optionalGameVersion(JsonObject root) throws IOException {
-        JsonElement element = root.get("gameVersion");
-        if (element == null || element.isJsonNull()) {
-            return Optional.empty();
-        }
-        if (!element.isJsonObject()) {
-            throw new IOException("Git snapshot manifest game version is not an object");
-        }
-        JsonObject encoded = element.getAsJsonObject();
-        return Optional.of(new GameVersionStamp(
-                requiredString(encoded, "name"),
-                requiredInteger(encoded, "dataVersion")));
-    }
-
-    private static int requiredInteger(JsonObject root, String name) throws IOException {
-        long value = requiredLong(root, name);
-        if (value < Integer.MIN_VALUE || value > Integer.MAX_VALUE) {
-            throw new IOException("Git snapshot manifest integer is out of range: " + name);
-        }
-        return (int) value;
-    }
-
-    private static long requiredLong(JsonObject root, String name) throws IOException {
-        JsonElement element = root.get(name);
-        if (element == null || !element.isJsonPrimitive()) {
-            throw new IOException("Git snapshot manifest is missing number: " + name);
-        }
-        JsonPrimitive primitive = element.getAsJsonPrimitive();
-        if (!primitive.isNumber()) {
-            throw new IOException("Git snapshot manifest value is not numeric: " + name);
-        }
-        try {
-            return new BigDecimal(primitive.getAsString()).longValueExact();
-        } catch (ArithmeticException | NumberFormatException exception) {
-            throw new IOException("Git snapshot manifest number is not an integer: " + name, exception);
-        }
-    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotOperations.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotOperations.java
deleted file mode 100644
index 2db432a..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotOperations.java
+++ /dev/null
@@ -1,732 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.core.OperationId;
-import dev.ishaanko.worldarchive.core.OperationPhase;
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
-import dev.ishaanko.worldarchive.model.SyncStatus;
-import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.storage.git.GitBackupBackend.RestoreResult;
-import dev.ishaanko.worldarchive.storage.git.GitSnapshotVerifier.VerifiedSnapshot;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.StandardCopyOption;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
-import java.util.UUID;
-import java.util.regex.Pattern;
-import java.util.stream.Stream;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/** The blocking Git snapshot operations behind {@link GitBackupBackend}'s async entry points. */
-final class GitSnapshotOperations {
-    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
-
-    private static final Pattern SNAPSHOT_REF = Pattern.compile("refs/heads/worldarchive/([0-9a-f-]{36})/([0-9a-f-]{36})");
-
-    private final GitBackendSettings settings;
-
-    private final GitCommandRunner runner;
-
-    private final GitCommands commands;
-
-    private final GitSnapshotVerifier verifier;
-
-    private final GitRepositoryManager repository;
-
-    private final GitRefStore refs;
-
-    private final GitRemoteSnapshotStore remoteSnapshots;
-
-    private final GitSnapshotCreator snapshotCreator;
-
-    private final GitRepositoryLock lock;
-
-    private final GitLegacyRefMigration legacyMigration;
-
-    GitSnapshotOperations(
-            GitBackendSettings settings,
-            GitCommandRunner runner,
-            GitCommands commands,
-            GitSnapshotVerifier verifier,
-            GitRepositoryManager repository,
-            GitRefStore refs,
-            GitRemoteSnapshotStore remoteSnapshots,
-            GitSnapshotCreator snapshotCreator,
-            GitRepositoryLock lock) {
-        this.settings = settings;
-        this.runner = runner;
-        this.commands = commands;
-        this.verifier = verifier;
-        this.repository = repository;
-        this.refs = refs;
-        this.remoteSnapshots = remoteSnapshots;
-        this.snapshotCreator = snapshotCreator;
-        this.lock = lock;
-        this.legacyMigration = new GitLegacyRefMigration(
-                settings,
-                commands,
-                refs,
-                worldId -> listSnapshotsBlocking(Optional.of(worldId)));
-    }
-
-    DestinationResult createBackupBlocking(
-            BackupCapture capture,
-            ProgressListener progressListener) {
-        if (!settings.enabled()) {
-            return DestinationResult.skipped(DestinationType.GIT, "Git backup destination is disabled");
-        }
-        OperationId operationId = OperationId.create();
-        GitProgress.report(progressListener, operationId, capture.manifest(), OperationPhase.PREPARING, "Checking Git tools");
-        try {
-            repository.requireWorld(capture.manifest().worldId());
-            GitToolHealth health = new GitToolProbe(settings, runner).probe();
-            if (!health.available()) {
-                return DestinationResult.failed(DestinationType.GIT, health.summary());
-            }
-            rejectRepositoryWorldOverlap(capture.worldDirectory());
-            return lock.withLock(() -> createAndSynchronizeLocked(
-                    capture,
-                    progressListener,
-                    operationId));
-        } catch (InterruptedException exception) {
-            Thread.currentThread().interrupt();
-            return DestinationResult.failed(DestinationType.GIT, "Git backup was cancelled");
-        } catch (IOException | GitStorageException exception) {
-            GitProgress.report(progressListener, operationId, capture.manifest(), OperationPhase.FAILED, "Git snapshot failed");
-            return DestinationResult.failed(DestinationType.GIT, safeMessage(exception));
-        }
-    }
-
-    private DestinationResult createAndSynchronizeLocked(
-            BackupCapture capture,
-            ProgressListener progressListener,
-            OperationId operationId) throws IOException, InterruptedException, GitStorageException {
-        GitSnapshot snapshot = snapshotCreator.create(capture, progressListener, operationId);
-        if (settings.remoteUrl().isEmpty()) {
-            GitProgress.report(progressListener, operationId, capture.manifest(), OperationPhase.COMPLETE, "Git snapshot complete");
-            return DestinationResult.success(DestinationType.GIT, snapshot.refName());
-        }
-        GitProgress.report(progressListener, operationId, capture.manifest(), OperationPhase.PUBLISHING, "Synchronizing Git snapshot");
-        try {
-            push(snapshot);
-            GitProgress.report(progressListener, operationId, capture.manifest(), OperationPhase.COMPLETE, "Git snapshot synchronized");
-            return synchronizedResult(snapshot);
-        } catch (InterruptedException exception) {
-            Thread.currentThread().interrupt();
-            return pendingSync(snapshot, "Remote synchronization was cancelled");
-        } catch (IOException | GitStorageException exception) {
-            return pendingSync(snapshot, "Remote synchronization failed: " + safeMessage(exception));
-        }
-    }
-
-    List<GitSnapshot> listSnapshotsBlocking(Optional<WorldId> worldId)
-            throws IOException, InterruptedException, GitStorageException {
-        if (worldId.isPresent()) {
-            repository.requireWorld(worldId.orElseThrow());
-        }
-        if (!Files.isDirectory(settings.repository())) {
-            return List.of();
-        }
-        repository.requireBare();
-        String prefix = "refs/heads/worldarchive/" + worldId.map(value -> value + "/").orElse("");
-        GitCommandResult result = commands.checked(
-                List.of(
-                        "for-each-ref",
-                        "--sort=-committerdate",
-                        "--format=%(refname)%09%(objectname)%09%(committerdate:unix)",
-                        prefix),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        List<GitSnapshot> snapshots = new ArrayList<>();
-        for (String line : result.standardOutput().lines().toList()) {
-            if (line.isBlank()) {
-                continue;
-            }
-            String[] fields = line.split("\\t", -1);
-            if (fields.length != 3) {
-                throw new GitStorageException("Git returned a malformed snapshot ref listing");
-            }
-            var matcher = SNAPSHOT_REF.matcher(fields[0]);
-            if (!matcher.matches()) {
-                continue;
-            }
-            try {
-                WorldId parsedWorld = WorldId.parse(matcher.group(1));
-                BackupId parsedBackup = BackupId.parse(matcher.group(2));
-                snapshots.add(new GitSnapshot(
-                        parsedWorld,
-                        parsedBackup,
-                        fields[0],
-                        fields[1],
-                        Instant.ofEpochSecond(Long.parseLong(fields[2]))));
-            } catch (IllegalArgumentException exception) {
-                throw new GitStorageException("Git returned an invalid WorldArchive snapshot ref", exception);
-            }
-        }
-        return List.copyOf(snapshots);
-    }
-
-    GitVerification verifySnapshotBlocking(WorldId worldId, BackupId backupId)
-            throws IOException, InterruptedException, GitStorageException {
-        repository.requireWorld(worldId);
-        repository.requireBare();
-        GitSnapshot snapshot = refs.resolveSnapshot(worldId, backupId);
-        try {
-            VerifiedSnapshot verified = verifier.verify(snapshot);
-            return new GitVerification(
-                    snapshot,
-                    Optional.of(verified.manifest().manifest()),
-                    true,
-                    "Git and Git LFS objects verified");
-        } catch (IOException | GitStorageException exception) {
-            return new GitVerification(
-                    snapshot,
-                    Optional.empty(),
-                    false,
-                    safeMessage(exception));
-        }
-    }
-
-    GitVerification verifyRestorableSnapshotBlocking(
-            WorldId worldId,
-            BackupId backupId,
-            BackupManifest expectedManifest)
-            throws IOException, InterruptedException, GitStorageException {
-        repository.requireWorld(worldId);
-        repository.ensure();
-        ResolvedSnapshot resolved = resolveVerifiedSnapshotForRestore(
-                worldId, backupId, Optional.of(expectedManifest));
-        return new GitVerification(
-                resolved.snapshot(),
-                Optional.of(resolved.verified().manifest().manifest()),
-                true,
-                "Git and Git LFS objects verified");
-    }
-
-    Path restoreSnapshotBlocking(
-            WorldId worldId,
-            BackupId backupId,
-            Optional<BackupManifest> expectedManifest,
-            Path emptyStaging)
-            throws IOException, InterruptedException, GitStorageException {
-        RestoreResult result = restoreSnapshotResultBlocking(
-                worldId, backupId, expectedManifest, emptyStaging);
-        if (result.publicationProblem().isPresent()) {
-            throw new GitStorageException(result.publicationProblem().orElseThrow());
-        }
-        return result.path();
-    }
-
-    RestoreResult restoreSnapshotResultBlocking(
-            WorldId worldId,
-            BackupId backupId,
-            Optional<BackupManifest> expectedManifest,
-            Path emptyStaging)
-            throws IOException, InterruptedException, GitStorageException {
-        repository.requireWorld(worldId);
-        repository.ensure();
-        ResolvedSnapshot resolved = resolveVerifiedSnapshotForRestore(
-                worldId, backupId, expectedManifest);
-        GitSnapshot snapshot = resolved.snapshot();
-        VerifiedSnapshot verified = resolved.verified();
-        Path target = emptyStaging.toAbsolutePath().normalize();
-        rejectRepositoryTargetOverlap(target);
-        GitRestorePublication publication = GitRestorePublication.create(target);
-        GitRestorePublication.DirectoryIdentity identity;
-        try {
-            materializeVerifiedSnapshot(snapshot, verified, publication.staging());
-            publication.publish();
-            identity = publication.publishedIdentity();
-        } catch (IOException
-                | InterruptedException
-                | GitStorageException
-                | RuntimeException
-                | Error exception) {
-            try {
-                publication.close();
-            } catch (IOException closeFailure) {
-                exception.addSuppressed(closeFailure);
-            }
-            throw exception;
-        }
-        Optional<String> publicationProblem = Optional.empty();
-        try {
-            publication.close();
-        } catch (IOException exception) {
-            publicationProblem = Optional.of(
-                    "Git restore publication could not release its filesystem guard");
-        }
-        return new RestoreResult(
-                target,
-                identity.fileKey(),
-                identity.creationTime(),
-                identity.marker(),
-                publicationProblem);
-    }
-
-    private void materializeVerifiedSnapshot(
-            GitSnapshot snapshot,
-            VerifiedSnapshot verified,
-            Path staging) throws IOException, InterruptedException, GitStorageException {
-        Path temporary = Files.createTempDirectory("worldarchive-git-restore-").toRealPath();
-        Path checkout = temporary.resolve("worktree");
-        Path index = temporary.resolve("index");
-        Map<String, String> environment = GitCommands.indexEnvironment(index, false);
-        try {
-            Files.createDirectory(checkout);
-            commands.checked(
-                    List.of(
-                            "read-tree",
-                            snapshot.commitId()),
-                    checkout,
-                    environment,
-                    new byte[0]);
-            commands.checked(
-                    List.of(
-                            "--work-tree=" + checkout,
-                            "checkout-index",
-                            "--all",
-                            "--force"),
-                    checkout,
-                    environment,
-                    new byte[0]);
-            verifier.materializeLfsPointers(checkout, verified.lfsPointers());
-            copyMaterializedWorktree(checkout, staging);
-            ensureNoGitMetadata(staging);
-            try (GitSourceCapture ignored = GitSourceCapture.create(
-                    staging,
-                    verified.manifest().manifest())) {
-                // Re-hash the fully materialized restore before returning it to its publisher.
-            }
-        } finally {
-            GitTemporaryFiles.deleteTree(temporary);
-        }
-    }
-
-    private static void requireExpectedManifest(
-            Optional<BackupManifest> expectedManifest,
-            VerifiedSnapshot verified) throws GitStorageException {
-        if (expectedManifest.isPresent()
-                && !expectedManifest.orElseThrow().equals(verified.manifest().manifest())) {
-            throw new GitStorageException(
-                    "Git snapshot manifest does not exactly match the catalog");
-        }
-    }
-
-    private ResolvedSnapshot resolveVerifiedSnapshotForRestore(
-            WorldId worldId,
-            BackupId backupId,
-            Optional<BackupManifest> expectedManifest)
-            throws IOException, InterruptedException, GitStorageException {
-        String refName = GitSnapshot.refName(worldId, backupId);
-        Optional<String> localCommit = refs.resolve(refName);
-        Exception localFailure = null;
-        if (localCommit.isPresent()) {
-            GitSnapshot local = refs.snapshotForCommit(worldId, backupId, localCommit.get());
-            try {
-                VerifiedSnapshot verified = verifier.verify(local);
-                requireExpectedManifest(expectedManifest, verified);
-                return new ResolvedSnapshot(local, verified);
-            } catch (IOException | GitStorageException exception) {
-                localFailure = exception;
-            }
-        }
-        if (settings.remoteUrl().isEmpty()) {
-            if (localFailure instanceof IOException ioException) {
-                throw ioException;
-            }
-            if (localFailure instanceof GitStorageException storageException) {
-                throw storageException;
-            }
-            throw new GitStorageException("Git snapshot does not exist");
-        }
-        try {
-            return fetchAndVerifyRemoteSnapshot(
-                    worldId, backupId, localCommit, expectedManifest);
-        } catch (IOException | InterruptedException | GitStorageException remoteFailure) {
-            if (localFailure != null) {
-                remoteFailure.addSuppressed(localFailure);
-            }
-            throw remoteFailure;
-        }
-    }
-
-    private ResolvedSnapshot fetchAndVerifyRemoteSnapshot(
-            WorldId worldId,
-            BackupId backupId,
-            Optional<String> previousLocalCommit,
-            Optional<BackupManifest> expectedManifest)
-            throws IOException, InterruptedException, GitStorageException {
-        repository.configureRemote();
-        String snapshotRef = GitSnapshot.refName(worldId, backupId);
-        Optional<Instant> committedAt = expectedManifest.map(BackupManifest::createdAt);
-        RemoteSnapshotRef remoteSnapshot = remoteSnapshots.find(
-                        worldId,
-                        backupId,
-                        committedAt)
-                .stream()
-                .findFirst()
-                .orElseThrow(() -> new GitStorageException(
-                        "Git remote did not provide the requested snapshot"));
-        String temporaryRef = "refs/worldarchive/fetch/" + UUID.randomUUID();
-        try {
-            commands.checked(
-                    List.of(
-                            "fetch",
-                            "--no-tags",
-                            "--no-write-fetch-head",
-                            settings.remoteName(),
-                            "+" + remoteSnapshot.refName() + ":" + temporaryRef),
-                    settings.repository(),
-                    Map.of("GIT_LFS_SKIP_SMUDGE", "1"),
-                    new byte[0]);
-            String commit = refs.resolve(temporaryRef)
-                    .orElseThrow(() -> new GitStorageException("Git remote did not provide the requested snapshot"));
-            commands.checked(
-                    List.of(
-                            "lfs",
-                            "fetch",
-                            settings.remoteName(),
-                            commit),
-                    settings.repository(),
-                    Map.of(),
-                    new byte[0]);
-            GitSnapshot candidate = refs.snapshotForCommit(worldId, backupId, commit);
-            VerifiedSnapshot verified = verifier.verify(candidate);
-            requireExpectedManifest(expectedManifest, verified);
-            refs.deleteExact(temporaryRef, commit);
-            refs.updateWithRollback(snapshotRef, commit, previousLocalCommit);
-            return new ResolvedSnapshot(candidate, verified);
-        } catch (IOException | InterruptedException | GitStorageException exception) {
-            boolean wasInterrupted = Thread.interrupted();
-            boolean restoreInterrupt = exception instanceof InterruptedException || wasInterrupted;
-            try {
-                refs.deleteIfPresent(temporaryRef);
-            } catch (IOException | InterruptedException | GitStorageException cleanupFailure) {
-                exception.addSuppressed(cleanupFailure);
-            } finally {
-                if (restoreInterrupt) {
-                    Thread.currentThread().interrupt();
-                }
-            }
-            throw exception;
-        }
-    }
-
-    private static void copyMaterializedWorktree(Path checkout, Path staging) throws IOException {
-        try (Stream<Path> paths = Files.walk(checkout)) {
-            for (Path source : paths.sorted().toList()) {
-                Path relative = checkout.relativize(source);
-                String portable = relative.toString().replace('\\', '/');
-                if (portable.isEmpty()
-                        || portable.equals(".git")
-                        || portable.equals(GitBackupBackend.MANIFEST_PATH)) {
-                    continue;
-                }
-                Path target = staging.resolve(relative).normalize();
-                if (Files.isDirectory(source)) {
-                    Files.createDirectories(target);
-                } else {
-                    Files.createDirectories(target.getParent());
-                    Files.copy(source, target, StandardCopyOption.COPY_ATTRIBUTES);
-                }
-            }
-        }
-    }
-
-    boolean deleteSnapshotBlocking(WorldId worldId, BackupId backupId)
-            throws IOException, InterruptedException, GitStorageException {
-        repository.requireWorld(worldId);
-        repository.requireBare();
-        String refName = GitSnapshot.refName(worldId, backupId);
-        Optional<String> current = refs.resolve(refName);
-        if (current.isEmpty()) {
-            if (settings.remoteUrl().isEmpty()) {
-                return false;
-            }
-            List<RemoteSnapshotRef> remoteRefs = remoteSnapshots.find(
-                    worldId, backupId, Optional.empty());
-            if (remoteRefs.isEmpty()) {
-                return false;
-            }
-            // Main moves off the deleted commit first: if that is blocked (branch
-            // protection), the deletion fails with nothing half-removed and every
-            // retry starts from the same state.
-            retargetDefaultBranchAfterDelete(remoteRefs.getFirst().commitId());
-            deleteRemoteSnapshotRefs(remoteRefs, remoteRefs.getFirst().commitId());
-            return true;
-        }
-        if (settings.remoteUrl().isPresent()) {
-            GitSnapshot snapshot = refs.snapshotForCommit(worldId, backupId, current.get());
-            retargetDefaultBranchAfterDelete(current.get());
-            deleteRemoteSnapshotRefs(remoteSnapshots.find(
-                    worldId,
-                    backupId,
-                    Optional.of(snapshot.committedAt())), current.get());
-        }
-        refs.deleteExact(refName, current.get());
-        return true;
-    }
-
-    private void deleteRemoteSnapshotRefs(
-            List<RemoteSnapshotRef> remoteRefs,
-            String expectedCommit)
-            throws IOException, InterruptedException, GitStorageException {
-        if (remoteRefs.isEmpty()) {
-            return;
-        }
-        for (RemoteSnapshotRef remoteRef : remoteRefs) {
-            if (!expectedCommit.equals(remoteRef.commitId())) {
-                throw new GitStorageException(
-                        "Configured Git remote snapshot no longer matches the local snapshot");
-            }
-        }
-        List<String> arguments = new ArrayList<>(List.of(
-                "push",
-                "--atomic",
-                "--porcelain"));
-        for (RemoteSnapshotRef remoteRef : remoteRefs) {
-            arguments.add("--force-with-lease=" + remoteRef.refName()
-                    + ":" + remoteRef.commitId());
-        }
-        arguments.add(settings.remoteName());
-        for (RemoteSnapshotRef remoteRef : remoteRefs) {
-            arguments.add(":" + remoteRef.refName());
-        }
-        try {
-            commands.checked(
-                    arguments,
-                    settings.repository(),
-                    Map.of(),
-                    new byte[0]);
-        } catch (IOException | GitStorageException exception) {
-            try {
-                if (remoteRefsAbsent(remoteRefs)) {
-                    return;
-                }
-            } catch (InterruptedException verificationFailure) {
-                exception.addSuppressed(verificationFailure);
-                Thread.currentThread().interrupt();
-                throw verificationFailure;
-            } catch (IOException | GitStorageException verificationFailure) {
-                exception.addSuppressed(verificationFailure);
-            }
-            throw exception;
-        }
-        for (RemoteSnapshotRef remoteRef : remoteRefs) {
-            if (refs.resolveRemote(remoteRef.refName()).isPresent()) {
-                throw new GitStorageException("Configured Git remote snapshot ref could not be removed");
-            }
-        }
-    }
-
-    private boolean remoteRefsAbsent(List<RemoteSnapshotRef> remoteRefs)
-            throws IOException, InterruptedException, GitStorageException {
-        for (RemoteSnapshotRef remoteRef : remoteRefs) {
-            if (refs.resolveRemote(remoteRef.refName()).isPresent()) {
-                return false;
-            }
-        }
-        return true;
-    }
-
-    DestinationResult syncSnapshotBlocking(WorldId worldId, BackupId backupId)
-            throws IOException, InterruptedException, GitStorageException {
-        repository.requireWorld(worldId);
-        repository.requireBare();
-        GitSnapshot snapshot = refs.resolveSnapshot(worldId, backupId);
-        verifier.verify(snapshot);
-        if (settings.remoteUrl().isEmpty()) {
-            return DestinationResult.success(DestinationType.GIT, snapshot.refName());
-        }
-        try {
-            push(snapshot);
-            return synchronizedResult(snapshot);
-        } catch (InterruptedException exception) {
-            Thread.currentThread().interrupt();
-            return pendingSync(snapshot, "Remote synchronization was cancelled");
-        } catch (IOException | GitStorageException exception) {
-            return pendingSync(snapshot, "Remote synchronization failed: " + safeMessage(exception));
-        }
-    }
-
-    private static DestinationResult pendingSync(GitSnapshot snapshot, String detail) {
-        return DestinationResult.pendingSync(
-                DestinationType.GIT,
-                snapshot.refName(),
-                "Local Git snapshot is safe; " + detail);
-    }
-
-    private static DestinationResult synchronizedResult(GitSnapshot snapshot) {
-        return DestinationResult.success(DestinationType.GIT, snapshot.refName())
-                .withSync(SyncStatus.SYNCED);
-    }
-
-    private void push(GitSnapshot snapshot) throws IOException, InterruptedException, GitStorageException {
-        repository.configureRemote();
-        commands.checked(
-                List.of(
-                        "lfs",
-                        "push",
-                        settings.remoteName(),
-                        snapshot.refName()),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        commands.checked(
-                List.of(
-                        "push",
-                        "--atomic",
-                        "--porcelain",
-                        settings.remoteName(),
-                        snapshot.refName() + ":" + GitRemoteSnapshotRef.current(snapshot)),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        legacyMigration.migrateLegacyRemoteRefs(snapshot.worldId());
-        try {
-            publishDefaultBranch(snapshot);
-        } catch (IOException | GitStorageException exception) {
-            // The snapshot branch is the source of truth; the default branch is a
-            // browsing convenience that branch protection may block without making
-            // the upload any less complete.
-            LOGGER.warn(
-                    "Remote default branch could not be updated: {}",
-                    safeMessage(exception));
-        }
-    }
-
-    /**
-     * Points the remote default branch at the given backup. Histories legitimately
-     * diverge when a world folder moves between machines, so the update is forced.
-     */
-    private void publishDefaultBranch(GitSnapshot snapshot)
-            throws IOException, InterruptedException, GitStorageException {
-        commands.checked(
-                List.of(
-                        "push",
-                        "--porcelain",
-                        settings.remoteName(),
-                        "+" + snapshot.refName() + ":" + GitRemoteSnapshotRef.DEFAULT_BRANCH),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-    }
-
-    /**
-     * A deleted backup must stop being reachable from the remote. When the default
-     * branch points at the deleted commit, it moves to the newest snapshot left in
-     * the whole repository (legacy shared repositories hold several worlds).
-     * Remotes refuse to delete the branch their HEAD points at, so the last deletion
-     * parks the branch on an empty placeholder commit instead. Failures propagate so
-     * the deletion reports honestly that the remote still holds the content.
-     */
-    private void retargetDefaultBranchAfterDelete(String deletedCommit)
-            throws IOException, InterruptedException, GitStorageException {
-        Optional<String> remoteMain = refs.resolveRemote(GitRemoteSnapshotRef.DEFAULT_BRANCH);
-        if (remoteMain.isEmpty() || !remoteMain.orElseThrow().equals(deletedCommit)) {
-            return;
-        }
-        try {
-            retargetDefaultBranch(deletedCommit);
-        } catch (IOException | GitStorageException exception) {
-            throw new GitStorageException(
-                    "The remote refused to move its main branch off the deleted backup"
-                            + " (branch protection?). The backup was not deleted because"
-                            + " its content would stay visible on main.",
-                    exception);
-        }
-    }
-
-    private void retargetDefaultBranch(String deletedCommit)
-            throws IOException, InterruptedException, GitStorageException {
-        Optional<GitSnapshot> newestRemaining = listSnapshotsBlocking(Optional.empty())
-                .stream()
-                .filter(snapshot -> !snapshot.commitId().equals(deletedCommit))
-                .findFirst();
-        if (newestRemaining.isPresent()) {
-            publishDefaultBranch(newestRemaining.orElseThrow());
-            return;
-        }
-        String emptyTree = GitCommands.objectId(commands.checked(
-                List.of("mktree"),
-                settings.repository(),
-                Map.of(),
-                GitCommand.utf8Input("")).standardOutput());
-        String placeholder = GitCommands.objectId(commands.checked(
-                List.of("commit-tree", emptyTree),
-                settings.repository(),
-                Map.of(
-                        "GIT_AUTHOR_NAME", "WorldArchive",
-                        "GIT_AUTHOR_EMAIL", "worldarchive@localhost",
-                        "GIT_COMMITTER_NAME", "WorldArchive",
-                        "GIT_COMMITTER_EMAIL", "worldarchive@localhost",
-                        "GIT_AUTHOR_DATE", "1970-01-01T00:00:00Z",
-                        "GIT_COMMITTER_DATE", "1970-01-01T00:00:00Z"),
-                GitCommand.utf8Input("WorldArchive: all backups were deleted"))
-                .standardOutput());
-        commands.checked(
-                List.of(
-                        "push",
-                        "--porcelain",
-                        settings.remoteName(),
-                        "+" + placeholder + ":" + GitRemoteSnapshotRef.DEFAULT_BRANCH),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-    }
-
-    private void rejectRepositoryWorldOverlap(Path worldDirectory) throws GitStorageException {
-        Path world = worldDirectory.toAbsolutePath().normalize();
-        if (settings.repository().startsWith(world) || world.startsWith(settings.repository())) {
-            throw new GitStorageException("Git repository and live world must be separate directories");
-        }
-    }
-
-    private void rejectRepositoryTargetOverlap(Path target) throws GitStorageException {
-        if (settings.repository().startsWith(target) || target.startsWith(settings.repository())) {
-            throw new GitStorageException("Git repository and restore staging must be separate directories");
-        }
-    }
-
-    private static void ensureNoGitMetadata(Path staging) throws IOException, GitStorageException {
-        try (Stream<Path> paths = Files.walk(staging)) {
-            if (paths.anyMatch(path -> path.getFileName() != null
-                    && path.getFileName().toString().equalsIgnoreCase(".git"))) {
-                throw new GitStorageException("Restored Git snapshot contains repository metadata");
-            }
-        }
-    }
-
-    private static String safeMessage(Exception exception) {
-        String message = exception.getMessage();
-        if (message == null || message.isBlank()) {
-            return "Git storage operation failed";
-        }
-        message = message.replaceAll("\\p{Cntrl}+", " ").trim();
-        message = message.length() > 1_024 ? message.substring(0, 1_024) : message;
-        return SensitiveDataRedactor.redact(message);
-    }
-
-    private record ResolvedSnapshot(
-            GitSnapshot snapshot,
-            VerifiedSnapshot verified) {
-        private ResolvedSnapshot {
-            Objects.requireNonNull(snapshot, "snapshot");
-            Objects.requireNonNull(verified, "verified");
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotReader.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotReader.java
new file mode 100644
index 0000000..74a6e53
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotReader.java
@@ -0,0 +1,419 @@
+package dev.ishaanko.worldarchive.storage.git;
+
+import dev.ishaanko.worldarchive.core.WorldInventory;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.support.Digests;
+import dev.ishaanko.worldarchive.support.PortablePath;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStream;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.Path;
+import java.nio.file.StandardOpenOption;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import java.util.stream.Stream;
+
+/**
+ * Reads snapshots back with two Git processes: {@code ls-tree} lists the files and one
+ * {@code cat-file --batch} returns the commit, the manifest and every file. Each file is hashed on
+ * the way, and the result must match the manifest before a snapshot counts as good. Nothing else
+ * in the repository is read, so a damaged object that no snapshot uses never fails a backup.
+ */
+final class GitSnapshotReader {
+    private static final int MAXIMUM_MANIFEST_BYTES = 1_024 * 1_024;
+
+    private static final int MAXIMUM_COMMIT_BYTES = 64 * 1_024;
+
+    private final GitRepository repository;
+
+    private final GitLfsObjects lfs;
+
+    GitSnapshotReader(GitRepository repository, GitLfsObjects lfs) {
+        this.repository = Objects.requireNonNull(repository, "repository");
+        this.lfs = Objects.requireNonNull(lfs, "lfs");
+    }
+
+    /** How much of each Git LFS object a read checks. */
+    enum LfsCheck {
+        /** Each object must exist with its size. */
+        SIZE,
+        /** Each object's bytes must hash to its pointer. */
+        CONTENT
+    }
+
+    /** What a read proved: the manifest, every file, and the LFS object behind each LFS file. */
+    record Contents(GitSnapshotManifest manifest, WorldInventory inventory, Map<String, GitLfsPointer> lfsFiles) {
+        Contents {
+            Objects.requireNonNull(manifest, "manifest");
+            Objects.requireNonNull(inventory, "inventory");
+            lfsFiles = Map.copyOf(lfsFiles);
+        }
+    }
+
+    /** Reads and checks a snapshot without writing anything. */
+    Contents verify(GitSnapshot snapshot, LfsCheck check)
+            throws IOException, InterruptedException, GitStorageException {
+        Contents contents = read(snapshot, Optional.empty());
+        for (GitLfsPointer pointer : contents.lfsFiles().values()) {
+            if (check == LfsCheck.SIZE) {
+                lfs.requireSize(pointer);
+            } else {
+                lfs.requireContent(pointer);
+            }
+        }
+        return contents;
+    }
+
+    /**
+     * Checks a snapshot that was just written from a capture: every file must equal the captured
+     * one, and a difference names the file. LFS objects are left to the writer, which made them.
+     */
+    Contents verifyWritten(GitSnapshot snapshot, WorldInventory captured)
+            throws IOException, InterruptedException, GitStorageException {
+        Contents contents = read(snapshot, Optional.empty());
+        if (!contents.inventory().equals(captured)) {
+            Set<WorldInventory.Entry> expected = new HashSet<>(captured.files());
+            String differing = Stream.concat(
+                            contents.inventory().files().stream().filter(file -> !expected.remove(file)),
+                            expected.stream())
+                    .map(WorldInventory.Entry::path)
+                    .findFirst()
+                    .orElse("a file");
+            throw new GitStorageException("Git stored " + differing + " differently from the captured world. Try the backup again.");
+        }
+        return contents;
+    }
+
+    /**
+     * Reads and checks a snapshot while writing its files into an empty staging folder. The
+     * commit and manifest are checked against the expected manifest before any file is written,
+     * and every LFS object is hashed as it is copied into place.
+     */
+    Contents restore(GitSnapshot snapshot, BackupManifest expected, Path staging)
+            throws IOException, InterruptedException, GitStorageException {
+        Contents contents = read(snapshot, Optional.of(new Restore(expected, staging)));
+        for (Map.Entry<String, GitLfsPointer> file : contents.lfsFiles().entrySet()) {
+            try (OutputStream target = create(staging, file.getKey())) {
+                lfs.copyTo(file.getValue(), target);
+            }
+        }
+        return contents;
+    }
+
+    /**
+     * The manifests of several snapshots, read with one Git process. A snapshot whose commit or
+     * manifest is missing or does not match is left out; the caller counts it as a problem.
+     */
+    Map<BackupId, BackupManifest> manifests(Collection<GitSnapshot> snapshots)
+            throws IOException, InterruptedException, GitStorageException {
+        Map<String, BackupManifest> byCommit = manifestsByCommit(snapshots.stream().map(GitSnapshot::commitId).toList());
+        Map<BackupId, BackupManifest> manifests = new LinkedHashMap<>();
+        for (GitSnapshot snapshot : snapshots) {
+            BackupManifest manifest = byCommit.get(snapshot.commitId());
+            if (manifest != null && names(snapshot, manifest)) {
+                manifests.put(snapshot.backupId(), manifest);
+            }
+        }
+        return manifests;
+    }
+
+    /**
+     * The manifest of each commit whose commit object repeats the manifest's identity and time,
+     * read with one Git process; other commits, such as ones WorldArchive did not write, are left out.
+     */
+    Map<String, BackupManifest> manifestsByCommit(List<String> commits)
+            throws IOException, InterruptedException, GitStorageException {
+        Map<String, BackupManifest> manifests = new LinkedHashMap<>();
+        if (commits.isEmpty()) {
+            return manifests;
+        }
+        StringBuilder request = new StringBuilder();
+        for (String commit : commits) {
+            request.append(commit).append('\n')
+                    .append(commit).append(':').append(GitTreeValidator.MANIFEST_PATH).append('\n');
+        }
+        repository.stream(GitCommand.Input.utf8(request.toString()), output -> {
+            GitObjectStream objects = new GitObjectStream(output);
+            for (String commitId : commits) {
+                Optional<Commit> commit = readCommit(objects, commitId);
+                Optional<GitSnapshotManifest> manifest = readManifest(objects, commitId);
+                if (commit.isPresent() && manifest.isPresent() && binds(commit.get(), manifest.get())) {
+                    manifests.put(commitId, manifest.get().manifest());
+                }
+            }
+        }, "cat-file", "--batch");
+        return manifests;
+    }
+
+    /**
+     * The LFS objects that any object in the repository points at. Compaction runs this after
+     * Git dropped every unreachable object, so the answer is what the remaining snapshots use.
+     */
+    Set<String> referencedLfsObjects() throws IOException, InterruptedException, GitStorageException {
+        List<String> smallBlobs = new ArrayList<>();
+        repository.stream(GitCommand.Input.NONE, output -> {
+            BufferedReader lines = new BufferedReader(new InputStreamReader(output, StandardCharsets.UTF_8));
+            for (String line = lines.readLine(); line != null; line = lines.readLine()) {
+                String[] fields = line.split(" ");
+                if (fields.length == 3 && fields[1].equals("blob")
+                        && fields[2].length() < 5 && Integer.parseInt(fields[2]) < GitLfsPointer.MAXIMUM_BYTES) {
+                    smallBlobs.add(fields[0]);
+                }
+            }
+        }, "cat-file", "--batch-all-objects", "--batch-check");
+        Set<String> referenced = new HashSet<>();
+        if (smallBlobs.isEmpty()) {
+            return referenced;
+        }
+        repository.stream(GitCommand.Input.utf8(String.join("\n", smallBlobs) + "\n"), output -> {
+            GitObjectStream objects = new GitObjectStream(output);
+            for (String blob : smallBlobs) {
+                GitObjectStream.Header header = objects.next(blob);
+                if (!header.missing()) {
+                    pointerOrEmpty(objects.bytes(header, GitLfsPointer.MAXIMUM_BYTES))
+                            .ifPresent(pointer -> referenced.add(pointer.sha256()));
+                }
+            }
+        }, "cat-file", "--batch");
+        return referenced;
+    }
+
+    /**
+     * Lists the tree, then reads the commit, the manifest and every file with one
+     * {@code cat-file --batch}, and requires the files to match the manifest. A restore also
+     * writes each ordinary file into its staging folder.
+     */
+    private Contents read(GitSnapshot snapshot, Optional<Restore> restore)
+            throws IOException, InterruptedException, GitStorageException {
+        List<GitTreeEntry> entries = new ArrayList<>();
+        repository.stream(GitCommand.Input.NONE, output -> entries.addAll(GitTreeValidator.read(output)),
+                "ls-tree", "-r", "-z", "--full-tree", snapshot.commitId());
+        GitTreeEntry manifestEntry = entries.stream()
+                .filter(entry -> entry.path().equals(GitTreeValidator.MANIFEST_PATH))
+                .findFirst()
+                .orElseThrow(() -> new GitStorageException("The Git snapshot has no WorldArchive manifest"));
+        entries.remove(manifestEntry);
+        FileReader files = new FileReader(snapshot, entries, restore);
+        StringBuilder request = new StringBuilder(snapshot.commitId()).append('\n')
+                .append(manifestEntry.objectId()).append('\n');
+        entries.forEach(entry -> request.append(entry.objectId()).append('\n'));
+        repository.stream(GitCommand.Input.utf8(request.toString()), files, "cat-file", "--batch");
+        WorldInventory inventory = files.inventory();
+        BackupManifest backup = files.manifest().manifest();
+        if (inventory.fileCount() != backup.sourceFileCount()
+                || inventory.byteCount() != backup.sourceByteCount()
+                || !inventory.contentSha256().equals(backup.contentSha256())
+                || !inventory.inventorySha256().equals(backup.inventorySha256())) {
+            throw new GitStorageException("The files in the Git snapshot do not match its manifest");
+        }
+        return new Contents(files.manifest(), inventory, files.lfsFiles);
+    }
+
+    /** What a restore must find and where it writes. */
+    private record Restore(BackupManifest expected, Path staging) {
+    }
+
+    /** The snapshot's manifest names this backup, and its commit repeats the manifest's identity and time. */
+    private static boolean matches(GitSnapshot snapshot, Commit commit, GitSnapshotManifest manifest) {
+        return names(snapshot, manifest.manifest()) && binds(commit, manifest);
+    }
+
+    private static boolean names(GitSnapshot snapshot, BackupManifest manifest) {
+        return manifest.worldId().equals(snapshot.worldId()) && manifest.backupId().equals(snapshot.backupId());
+    }
+
+    /** The commit's message repeats the manifest's source identity and the commit has the manifest's time. */
+    private static boolean binds(Commit commit, GitSnapshotManifest manifest) {
+        return commit.message().stripTrailing().equals(manifest.commitMessage().stripTrailing())
+                && commit.committedAt().getEpochSecond() == manifest.manifest().createdAt().getEpochSecond();
+    }
+
+    private static Optional<Commit> readCommit(GitObjectStream objects, String commitId)
+            throws IOException, GitStorageException {
+        GitObjectStream.Header header = objects.next(commitId);
+        if (header.missing()) {
+            return Optional.empty();
+        }
+        if (!header.type().equals("commit") || header.size() > MAXIMUM_COMMIT_BYTES) {
+            objects.skip(header);
+            return Optional.empty();
+        }
+        return Commit.parse(objects.bytes(header, MAXIMUM_COMMIT_BYTES));
+    }
+
+    private static Optional<GitSnapshotManifest> readManifest(GitObjectStream objects, String commitId)
+            throws IOException, GitStorageException {
+        GitObjectStream.Header header = objects.next(commitId + ":" + GitTreeValidator.MANIFEST_PATH);
+        if (header.missing()) {
+            return Optional.empty();
+        }
+        if (!header.type().equals("blob") || header.size() > MAXIMUM_MANIFEST_BYTES) {
+            objects.skip(header);
+            return Optional.empty();
+        }
+        try {
+            return Optional.of(GitSnapshotManifestCodec.decode(objects.bytes(header, MAXIMUM_MANIFEST_BYTES)));
+        } catch (IOException exception) {
+            return Optional.empty();
+        }
+    }
+
+    private static Optional<GitLfsPointer> pointerOrEmpty(byte[] blob) {
+        try {
+            return GitLfsPointer.parse(blob);
+        } catch (GitStorageException exception) {
+            return Optional.empty();
+        }
+    }
+
+    private static OutputStream create(Path staging, String path) throws IOException {
+        Path target = PortablePath.resolveInside(staging, path);
+        Files.createDirectories(target.getParent());
+        return Files.newOutputStream(target, StandardOpenOption.CREATE_NEW, StandardOpenOption.WRITE, LinkOption.NOFOLLOW_LINKS);
+    }
+
+    /** The committer time and message of a commit object. */
+    private record Commit(Instant committedAt, String message) {
+        static Optional<Commit> parse(byte[] object) {
+            String text = new String(object, StandardCharsets.UTF_8);
+            int end = text.indexOf("\n\n");
+            if (end < 0) {
+                return Optional.empty();
+            }
+            for (String line : text.substring(0, end).split("\n")) {
+                String[] fields = line.split(" ");
+                if (fields[0].equals("committer") && fields.length >= 3) {
+                    try {
+                        long seconds = Long.parseLong(fields[fields.length - 2]);
+                        return Optional.of(new Commit(Instant.ofEpochSecond(seconds), text.substring(end + 2)));
+                    } catch (NumberFormatException exception) {
+                        return Optional.empty();
+                    }
+                }
+            }
+            return Optional.empty();
+        }
+    }
+
+    /**
+     * Reads one snapshot from {@code cat-file --batch}: the commit and the manifest first, which
+     * must match each other, the snapshot's ref and any expected manifest before a file is read,
+     * then every file.
+     */
+    private static final class FileReader implements GitCommandRunner.OutputReader {
+        private final GitSnapshot snapshot;
+
+        private final List<GitTreeEntry> entries;
+
+        private final Optional<Restore> restore;
+
+        private final List<WorldInventory.Entry> files = new ArrayList<>();
+
+        private final Map<String, GitLfsPointer> lfsFiles = new HashMap<>();
+
+        private GitSnapshotManifest manifest;
+
+        FileReader(GitSnapshot snapshot, List<GitTreeEntry> entries, Optional<Restore> restore) {
+            this.snapshot = snapshot;
+            this.entries = entries;
+            this.restore = restore;
+        }
+
+        @Override
+        public void read(InputStream output) throws IOException, InterruptedException, GitStorageException {
+            GitObjectStream objects = new GitObjectStream(output);
+            Commit commit = readCommit(objects, snapshot.commitId())
+                    .orElseThrow(() -> new GitStorageException("The Git snapshot's commit is missing or damaged"));
+            GitObjectStream.Header header = objects.next(GitTreeValidator.MANIFEST_PATH);
+            if (header.missing() || !header.type().equals("blob")) {
+                throw new GitStorageException("The Git snapshot's manifest is missing");
+            }
+            manifest = decode(objects.bytes(header, MAXIMUM_MANIFEST_BYTES));
+            if (!matches(snapshot, commit, manifest)) {
+                throw new GitStorageException("The Git snapshot's commit does not match its manifest");
+            }
+            if (restore.filter(target -> !target.expected().equals(manifest.manifest())).isPresent()) {
+                throw new GitStorageException("The Git snapshot does not match the backup in the catalog");
+            }
+            for (GitTreeEntry entry : entries) {
+                if (Thread.interrupted()) {
+                    throw new InterruptedException("Reading a Git snapshot was cancelled");
+                }
+                GitObjectStream.Header file = objects.next(entry.path());
+                if (file.missing() || !file.type().equals("blob")) {
+                    throw new GitStorageException("The Git snapshot is missing the file " + entry.path());
+                }
+                files.add(readFile(entry, file, objects));
+            }
+        }
+
+        private WorldInventory.Entry readFile(GitTreeEntry entry, GitObjectStream.Header header, GitObjectStream objects)
+                throws IOException, InterruptedException, GitStorageException {
+            if (header.size() < GitLfsPointer.MAXIMUM_BYTES) {
+                byte[] bytes = objects.bytes(header, GitLfsPointer.MAXIMUM_BYTES);
+                Optional<GitLfsPointer> pointer = GitLfsPointer.parse(bytes);
+                if (pointer.isPresent()) {
+                    lfsFiles.put(entry.path(), pointer.get());
+                    return inventoryEntry(entry.path(), pointer.get().size(), pointer.get().sha256());
+                }
+                if (restore.isPresent()) {
+                    try (OutputStream target = create(restore.get().staging(), entry.path())) {
+                        target.write(bytes);
+                    }
+                }
+                return inventoryEntry(entry.path(), bytes.length, Digests.hex(Digests.sha256().digest(bytes)));
+            }
+            try (OutputStream target = restore.isPresent()
+                    ? create(restore.get().staging(), entry.path())
+                    : OutputStream.nullOutputStream()) {
+                return inventoryEntry(entry.path(), header.size(), objects.copy(header, target));
+            }
+        }
+
+        GitSnapshotManifest manifest() {
+            return manifest;
+        }
+
+        WorldInventory inventory() throws GitStorageException {
+            try {
+                return WorldInventory.create(files);
+            } catch (IllegalArgumentException exception) {
+                throw new GitStorageException("The Git snapshot holds files that cannot be restored: "
+                        + exception.getMessage(), exception);
+            }
+        }
+
+        private static GitSnapshotManifest decode(byte[] manifest) throws GitStorageException {
+            try {
+                return GitSnapshotManifestCodec.decode(manifest);
+            } catch (IOException exception) {
+                throw new GitStorageException("The Git snapshot's manifest cannot be read", exception);
+            }
+        }
+
+        private static WorldInventory.Entry inventoryEntry(String path, long size, String sha256)
+                throws GitStorageException {
+            try {
+                return new WorldInventory.Entry(path, size, sha256);
+            } catch (IllegalArgumentException exception) {
+                throw new GitStorageException("The Git snapshot holds a file that cannot be restored: "
+                        + exception.getMessage(), exception);
+            }
+        }
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotStore.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotStore.java
deleted file mode 100644
index 7c7c44c..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotStore.java
+++ /dev/null
@@ -1,57 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import dev.ishaanko.worldarchive.core.BackupBackend;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.Optional;
-import java.util.concurrent.CompletionStage;
-
-/** Git snapshot operations shared by one-repository and world-routed stores. */
-public interface GitSnapshotStore extends BackupBackend, AutoCloseable {
-    CompletionStage<GitToolHealth> probeTools();
-
-    CompletionStage<List<GitSnapshot>> listSnapshots(Optional<WorldId> worldId);
-
-    CompletionStage<GitVerification> verifySnapshot(WorldId worldId, BackupId backupId);
-
-    CompletionStage<BackupManifest> readManifest(WorldId worldId, BackupId backupId);
-
-    CompletionStage<GitVerification> verifyRestorableSnapshot(
-            WorldId worldId,
-            BackupId backupId,
-            BackupManifest expectedManifest);
-
-    CompletionStage<Path> restoreSnapshot(WorldId worldId, BackupId backupId, Path emptyStaging);
-
-    CompletionStage<Path> restoreSnapshot(
-            WorldId worldId,
-            BackupId backupId,
-            BackupManifest expectedManifest,
-            Path emptyStaging);
-
-    CompletionStage<GitBackupBackend.RestoreResult> restoreSnapshotForRecovery(
-            WorldId worldId,
-            BackupId backupId,
-            BackupManifest expectedManifest,
-            Path emptyStaging);
-
-    CompletionStage<Boolean> deleteSnapshot(WorldId worldId, BackupId backupId);
-
-    CompletionStage<Boolean> deleteLocalSnapshot(WorldId worldId, BackupId backupId);
-
-    CompletionStage<GitVerification> hydrateExternalSnapshot(
-            WorldId worldId,
-            BackupId backupId,
-            BackupManifest expectedManifest,
-            String expectedCommit,
-            String remoteUrl);
-
-    CompletionStage<DestinationResult> syncSnapshot(WorldId worldId, BackupId backupId);
-
-    @Override
-    void close();
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotVerifier.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotVerifier.java
deleted file mode 100644
index cf8eb56..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotVerifier.java
+++ /dev/null
@@ -1,327 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import dev.ishaanko.worldarchive.core.Digests;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.nio.file.StandardCopyOption;
-import java.nio.file.attribute.BasicFileAttributes;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Verifies snapshot identity, tree contents, inventory, and Git LFS objects. */
-final class GitSnapshotVerifier {
-    private static final int LFS_POINTER_OUTPUT_BYTES = 4 * 1_024;
-
-    private final GitBackendSettings settings;
-
-    private final GitCommands commands;
-
-    GitSnapshotVerifier(GitBackendSettings settings, GitCommands commands) {
-        this.settings = Objects.requireNonNull(settings, "settings");
-        this.commands = Objects.requireNonNull(commands, "commands");
-    }
-
-    VerifiedSnapshot verify(GitSnapshot snapshot)
-            throws IOException, InterruptedException, GitStorageException {
-        String commit = snapshot.commitId();
-        MetadataSnapshot metadata = verifyMetadata(snapshot);
-        GitSnapshotManifest snapshotManifest = metadata.manifest();
-        List<GitTreeEntry> treeEntries = metadata.treeEntries();
-        commands.checked(
-                List.of("fsck", "--strict", "--no-dangling", commit),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        List<GitLfsPointer> pointers = findAndVerifySnapshotFiles(
-                treeEntries,
-                snapshotManifest.manifest());
-        return new VerifiedSnapshot(snapshotManifest, pointers);
-    }
-
-    MetadataSnapshot verifyMetadata(GitSnapshot snapshot)
-            throws IOException, InterruptedException, GitStorageException {
-        String commit = snapshot.commitId();
-        commands.checked(
-                List.of("cat-file", "-e", commit + "^{commit}"),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        GitSnapshotManifest snapshotManifest = readSnapshotManifest(commit);
-        verifyAncestry(snapshot, commit, snapshotManifest);
-        List<GitTreeEntry> treeEntries = readTreeEntries(commit);
-        requireSnapshotIdentity(snapshot, snapshotManifest, commit);
-        return new MetadataSnapshot(snapshotManifest, treeEntries);
-    }
-
-    void verifyTreeModes(String treeish)
-            throws IOException, InterruptedException, GitStorageException {
-        readTreeEntries(treeish);
-    }
-
-    void materializeLfsPointers(Path checkout, List<GitLfsPointer> pointers)
-            throws IOException, GitStorageException {
-        for (GitLfsPointer pointer : pointers) {
-            Path target = checkout.resolve(pointer.path().replace(
-                    '/',
-                    checkout.getFileSystem().getSeparator().charAt(0))).normalize();
-            if (!target.startsWith(checkout)) {
-                throw new GitStorageException("Git LFS pointer path escapes its worktree");
-            }
-            BasicFileAttributes attributes = Files.readAttributes(
-                    target,
-                    BasicFileAttributes.class,
-                    LinkOption.NOFOLLOW_LINKS);
-            if (!attributes.isRegularFile()
-                    || attributes.isSymbolicLink()
-                    || attributes.isOther()) {
-                throw new GitStorageException("Git LFS materialization target is unsafe");
-            }
-            Files.copy(
-                    pointer.objectPath(settings.repository()),
-                    target,
-                    StandardCopyOption.REPLACE_EXISTING);
-            if (Files.size(target) != pointer.size()
-                    || !sha256(target).equals(pointer.sha256())) {
-                throw new GitStorageException(
-                        "Git LFS object could not be materialized exactly");
-            }
-        }
-    }
-
-    static String commitMessage(GitSnapshotManifest manifest) {
-        return "WorldArchive snapshot\n\n"
-                + "world-id: " + manifest.manifest().worldId() + "\n"
-                + "backup-id: " + manifest.manifest().backupId() + "\n"
-                + "source-identity: " + manifest.sourceIdentity() + "\n";
-    }
-
-    private void verifyAncestry(
-            GitSnapshot snapshot,
-            String commit,
-            GitSnapshotManifest snapshotManifest)
-            throws IOException, InterruptedException, GitStorageException {
-        GitCommandResult result = commands.checked(
-                List.of("cat-file", "-p", commit),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        List<String> parents = new ArrayList<>();
-        for (String line : result.standardOutput().lines().toList()) {
-            if (line.startsWith("parent ")) {
-                parents.add(GitCommands.objectId(line.substring("parent ".length())));
-            }
-            if (line.isEmpty()) {
-                break;
-            }
-        }
-        if (parents.size() > 1) {
-            throw new GitStorageException("WorldArchive snapshot commit has multiple parents");
-        }
-        if (parents.isEmpty()) {
-            return;
-        }
-        GitSnapshotManifest parentManifest = readSnapshotManifest(parents.getFirst());
-        if (!parentManifest.manifest().worldId().equals(snapshot.worldId())) {
-            throw new GitStorageException(
-                    "WorldArchive snapshot parent belongs to another world");
-        }
-        if (parentManifest.manifest().backupId().equals(snapshot.backupId())) {
-            throw new GitStorageException(
-                    "WorldArchive snapshot parent repeats its backup identity");
-        }
-        if (parentManifest.manifest().createdAt().isAfter(
-                snapshotManifest.manifest().createdAt())) {
-            throw new GitStorageException(
-                    "WorldArchive snapshot parent is newer than its child");
-        }
-        requireCommitMessage(parents.getFirst(), parentManifest);
-    }
-
-    private List<GitTreeEntry> readTreeEntries(String treeish)
-            throws IOException, InterruptedException, GitStorageException {
-        GitCommandResult result = commands.checked(
-                List.of(
-                        "ls-tree",
-                        "-r",
-                        "-z",
-                        "--full-tree",
-                        treeish),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        return GitTreeValidator.parse(result.standardOutput());
-    }
-
-    private GitSnapshotManifest readSnapshotManifest(String commit)
-            throws IOException, InterruptedException, GitStorageException {
-        GitCommandResult result = commands.checked(
-                List.of(
-                        "show",
-                        commit + ":" + GitBackupBackend.MANIFEST_PATH),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        return GitSnapshotManifestCodec.decode(
-                result.standardOutput().getBytes(StandardCharsets.UTF_8));
-    }
-
-    private void requireSnapshotIdentity(
-            GitSnapshot snapshot,
-            GitSnapshotManifest snapshotManifest,
-            String commit) throws IOException, InterruptedException, GitStorageException {
-        BackupManifest manifest = snapshotManifest.manifest();
-        if (!manifest.worldId().equals(snapshot.worldId())
-                || !manifest.backupId().equals(snapshot.backupId())
-                || manifest.createdAt().getEpochSecond()
-                        != snapshot.committedAt().getEpochSecond()) {
-            throw new GitStorageException(
-                    "Git snapshot manifest identity does not match its selected ref");
-        }
-        requireCommitMessage(commit, snapshotManifest);
-    }
-
-    private void requireCommitMessage(
-            String commit,
-            GitSnapshotManifest snapshotManifest)
-            throws IOException, InterruptedException, GitStorageException {
-        GitCommandResult message = commands.checked(
-                List.of(
-                        "show",
-                        "-s",
-                        "--format=%B",
-                        commit),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        if (!message.standardOutput().stripTrailing().equals(
-                commitMessage(snapshotManifest).stripTrailing())) {
-            throw new GitStorageException(
-                    "Git snapshot source identity does not match its commit");
-        }
-    }
-
-    /**
-     * Lists the LFS objects a snapshot tree points at without checking that the
-     * objects exist. Compaction uses this to decide which objects must stay.
-     */
-    List<GitLfsPointer> readLfsPointers(String commit)
-            throws IOException, InterruptedException, GitStorageException {
-        List<GitLfsPointer> pointers = new ArrayList<>();
-        for (GitTreeEntry entry : readTreeEntries(commit)) {
-            if (entry.path().equals(GitBackupBackend.MANIFEST_PATH)) {
-                continue;
-            }
-            readBlob(entry).pointer().ifPresent(pointers::add);
-        }
-        return List.copyOf(pointers);
-    }
-
-    private List<GitLfsPointer> findAndVerifySnapshotFiles(
-            List<GitTreeEntry> treeEntries,
-            BackupManifest manifest)
-            throws IOException, InterruptedException, GitStorageException {
-        List<GitLfsPointer> pointers = new ArrayList<>();
-        List<GitInventoryEntry> inventoryEntries = new ArrayList<>();
-        for (GitTreeEntry entry : treeEntries) {
-            if (entry.path().equals(GitBackupBackend.MANIFEST_PATH)) {
-                continue;
-            }
-            SnapshotBlob blob = readBlob(entry);
-            GitCommandResult contents = blob.contents();
-            Optional<GitLfsPointer> pointer = blob.pointer();
-            if (pointer.isPresent()) {
-                verifyLfsObject(pointer.get());
-                pointers.add(pointer.get());
-                inventoryEntries.add(new GitInventoryEntry(
-                        entry.path(),
-                        pointer.get().size(),
-                        pointer.get().sha256()));
-            } else {
-                inventoryEntries.add(new GitInventoryEntry(
-                        entry.path(),
-                        contents.standardOutputBytes(),
-                        contents.standardOutputSha256()));
-            }
-        }
-        GitInventory.create(inventoryEntries).requireMatches(manifest);
-        return List.copyOf(pointers);
-    }
-
-    /** Reads one tree blob up to the pointer size limit and parses it as an LFS pointer. */
-    private SnapshotBlob readBlob(GitTreeEntry entry)
-            throws IOException, InterruptedException, GitStorageException {
-        GitCommandResult contents = commands.run(
-                List.of(
-                        "cat-file",
-                        "blob",
-                        entry.objectId()),
-                settings.repository(),
-                Map.of(),
-                new byte[0],
-                LFS_POINTER_OUTPUT_BYTES);
-        if (!contents.successful()) {
-            throw new GitStorageException(GitCommands.failureMessage(contents));
-        }
-        if (contents.standardErrorTruncated()) {
-            throw new GitStorageException(
-                    "Git LFS pointer inspection exceeded its safety limit");
-        }
-        return new SnapshotBlob(contents, GitLfsPointer.parse(
-                entry,
-                contents.standardOutput(),
-                contents.standardOutputTruncated()));
-    }
-
-    private void verifyLfsObject(GitLfsPointer pointer) throws IOException, GitStorageException {
-        Path object = pointer.objectPath(settings.repository());
-        Path parent = object.getParent();
-        if (parent == null) {
-            throw new GitStorageException("Git LFS object has no parent directory");
-        }
-        GitRepositoryPathGuard.requireDirectory(parent);
-        BasicFileAttributes attributes = Files.readAttributes(
-                object,
-                BasicFileAttributes.class,
-                LinkOption.NOFOLLOW_LINKS);
-        if (!attributes.isRegularFile()
-                || attributes.isSymbolicLink()
-                || attributes.isOther()
-                || attributes.size() != pointer.size()
-                || !sha256(object).equals(pointer.sha256())) {
-            throw new GitStorageException("Git LFS object is missing or corrupt");
-        }
-    }
-
-    private static String sha256(Path path) throws IOException {
-        return Digests.sha256(path);
-    }
-
-    private record SnapshotBlob(GitCommandResult contents, Optional<GitLfsPointer> pointer) {
-    }
-
-    record VerifiedSnapshot(
-            GitSnapshotManifest manifest,
-            List<GitLfsPointer> lfsPointers) {
-        VerifiedSnapshot {
-            Objects.requireNonNull(manifest, "manifest");
-            lfsPointers = List.copyOf(
-                    Objects.requireNonNull(lfsPointers, "lfsPointers"));
-        }
-    }
-
-    record MetadataSnapshot(
-            GitSnapshotManifest manifest,
-            List<GitTreeEntry> treeEntries) {
-        MetadataSnapshot {
-            Objects.requireNonNull(manifest, "manifest");
-            treeEntries = List.copyOf(Objects.requireNonNull(treeEntries, "treeEntries"));
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotWriter.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotWriter.java
new file mode 100644
index 0000000..4be0151
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotWriter.java
@@ -0,0 +1,190 @@
+package dev.ishaanko.worldarchive.storage.git;
+
+import dev.ishaanko.worldarchive.core.BackupCapture;
+import dev.ishaanko.worldarchive.core.WorldInventory;
+import dev.ishaanko.worldarchive.support.Digests;
+import dev.ishaanko.worldarchive.support.PortablePath;
+import java.io.BufferedOutputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.Path;
+import java.security.MessageDigest;
+import java.util.HashSet;
+import java.util.Objects;
+import java.util.Set;
+import java.util.UUID;
+
+/**
+ * Writes the commit for one capture without publishing it, using the capture's inventory. Each
+ * file that matches the LFS patterns is kept once as an LFS object: a missing object, or one of
+ * another size, is copied from the capture, hashed on the way and flushed to disk, and one of the
+ * right size is reused without reading it. Verify and restore set aside an object whose bytes are
+ * damaged, so the next backup of its file writes it again. The tree then holds pointers for those
+ * files and the bytes of every other file and of the manifest, all written by one
+ * {@code git fast-import} to a private ref.
+ */
+final class GitSnapshotWriter {
+    private static final int BUFFER_BYTES = 64 * 1_024;
+
+    private final GitRepository repository;
+
+    private final GitLfsObjects lfs;
+
+    GitSnapshotWriter(GitRepository repository, GitLfsObjects lfs) {
+        this.repository = Objects.requireNonNull(repository, "repository");
+        this.lfs = Objects.requireNonNull(lfs, "lfs");
+    }
+
+    /** The new commit and the private ref that keeps it until it is published. */
+    record Written(String commitId, String privateRef) {
+    }
+
+    Written write(BackupCapture capture, GitSnapshotManifest manifest)
+            throws IOException, InterruptedException, GitStorageException {
+        Set<String> lfsPaths = lfsPaths(capture);
+        for (WorldInventory.Entry file : capture.inventory().files()) {
+            GitLfsPointer pointer = new GitLfsPointer(file.sha256(), file.size());
+            if (lfsPaths.contains(file.path()) && !lfs.hasSize(pointer)) {
+                lfs.store(captured(capture, file), file.path(), pointer);
+            }
+        }
+        String privateRef = "refs/worldarchive/staging/" + UUID.randomUUID();
+        String commit = GitRepository.objectId(repository.git(
+                output -> importStream(capture, lfsPaths, manifest, privateRef, output),
+                "fast-import", "--quiet", "--done"));
+        return new Written(commit, privateRef);
+    }
+
+    /**
+     * The files Git stores as LFS pointers: those whose {@code filter} attribute is {@code lfs},
+     * decided by Git itself from the repository's attributes, and every other file that the reader
+     * would take for a pointer. Empty files never are, as with Git LFS.
+     */
+    private Set<String> lfsPaths(BackupCapture capture) throws IOException, InterruptedException, GitStorageException {
+        WorldInventory inventory = capture.inventory();
+        StringBuilder request = new StringBuilder();
+        inventory.files().stream()
+                .filter(file -> file.size() > 0)
+                .forEach(file -> request.append(file.path()).append('\0'));
+        Set<String> lfsPaths = new HashSet<>();
+        if (request.isEmpty()) {
+            return lfsPaths;
+        }
+        repository.stream(GitCommand.Input.utf8(request.toString()), output -> {
+            for (String[] answer = next(output); answer != null; answer = next(output)) {
+                if (answer[2].equals("lfs")) {
+                    lfsPaths.add(answer[0]);
+                }
+            }
+        }, "check-attr", "-z", "--stdin", "filter");
+        for (WorldInventory.Entry file : inventory.files()) {
+            if (!lfsPaths.contains(file.path()) && readsAsPointer(capture, file)) {
+                lfsPaths.add(file.path());
+            }
+        }
+        return lfsPaths;
+    }
+
+    /**
+     * Whether the reader would take the file's bytes for a pointer: the file is smaller than a
+     * pointer can be and starts with the pointer header, as a file of a datapack cloned without
+     * Git LFS does. Stored as an LFS object, it reads back byte for byte.
+     */
+    private static boolean readsAsPointer(BackupCapture capture, WorldInventory.Entry file) throws IOException {
+        if (file.size() >= GitLfsPointer.MAXIMUM_BYTES || file.size() < GitLfsPointer.HEADER_LENGTH) {
+            return false;
+        }
+        try (InputStream input = Files.newInputStream(captured(capture, file), LinkOption.NOFOLLOW_LINKS)) {
+            return GitLfsPointer.startsWithHeader(input.readNBytes(GitLfsPointer.HEADER_LENGTH));
+        }
+    }
+
+    /** One {@code <path> NUL <attribute> NUL <value> NUL} answer of {@code check-attr -z}, or null at the end. */
+    private static String[] next(InputStream output) throws IOException, GitStorageException {
+        String[] answer = new String[3];
+        for (int field = 0; field < answer.length; field++) {
+            ByteArrayOutputStream bytes = new ByteArrayOutputStream();
+            int next;
+            while ((next = output.read()) > 0) {
+                bytes.write(next);
+            }
+            if (next < 0) {
+                if (field == 0 && bytes.size() == 0) {
+                    return null;
+                }
+                throw new GitStorageException("Git returned incomplete attributes");
+            }
+            answer[field] = bytes.toString(StandardCharsets.UTF_8);
+        }
+        return answer;
+    }
+
+    /** The fast-import commands for one parentless commit that holds the whole tree. */
+    private static void importStream(
+            BackupCapture capture,
+            Set<String> lfsPaths,
+            GitSnapshotManifest manifest,
+            String privateRef,
+            OutputStream pipe) throws IOException {
+        OutputStream output = new BufferedOutputStream(pipe, BUFFER_BYTES);
+        long time = manifest.manifest().createdAt().getEpochSecond();
+        text(output, "commit " + privateRef + "\nmark :1\n"
+                + "author WorldArchive <worldarchive@localhost> " + time + " +0000\n"
+                + "committer WorldArchive <worldarchive@localhost> " + time + " +0000\n");
+        data(output, manifest.commitMessage().getBytes(StandardCharsets.UTF_8));
+        for (WorldInventory.Entry file : capture.inventory().files()) {
+            text(output, "M 100644 inline " + file.path() + "\n");
+            if (lfsPaths.contains(file.path())) {
+                data(output, new GitLfsPointer(file.sha256(), file.size()).text().getBytes(StandardCharsets.US_ASCII));
+            } else {
+                copy(captured(capture, file), file, output);
+            }
+        }
+        text(output, "M 100644 inline " + GitTreeValidator.MANIFEST_PATH + "\n");
+        data(output, GitSnapshotManifestCodec.encode(manifest));
+        text(output, "\nget-mark :1\ndone\n");
+        output.flush();
+    }
+
+    /** Streams a captured file as fast-import data, proving on the way that it still matches the inventory. */
+    private static void copy(Path source, WorldInventory.Entry file, OutputStream output) throws IOException {
+        text(output, "data " + file.size() + "\n");
+        MessageDigest digest = Digests.sha256();
+        byte[] buffer = new byte[BUFFER_BYTES];
+        long remaining = file.size();
+        try (InputStream input = Files.newInputStream(source, LinkOption.NOFOLLOW_LINKS)) {
+            while (remaining > 0) {
+                int read = input.read(buffer, 0, (int) Math.min(buffer.length, remaining));
+                if (read < 0) {
+                    break;
+                }
+                digest.update(buffer, 0, read);
+                output.write(buffer, 0, read);
+                remaining -= read;
+            }
+            if (remaining != 0 || input.read() >= 0 || !Digests.hex(digest.digest()).equals(file.sha256())) {
+                throw new IOException("The captured file " + file.path() + " changed. Try the backup again.");
+            }
+        }
+        text(output, "\n");
+    }
+
+    private static void data(OutputStream output, byte[] bytes) throws IOException {
+        text(output, "data " + bytes.length + "\n");
+        output.write(bytes);
+        text(output, "\n");
+    }
+
+    private static void text(OutputStream output, String text) throws IOException {
+        output.write(text.getBytes(StandardCharsets.UTF_8));
+    }
+
+    private static Path captured(BackupCapture capture, WorldInventory.Entry file) {
+        return PortablePath.resolveInside(capture.worldDirectory(), file.path());
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSourceCapture.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSourceCapture.java
deleted file mode 100644
index ae6dc2b..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSourceCapture.java
+++ /dev/null
@@ -1,343 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import com.sun.nio.file.ExtendedOpenOption;
-import dev.ishaanko.worldarchive.core.Digests;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import java.io.IOException;
-import java.nio.ByteBuffer;
-import java.nio.channels.FileChannel;
-import java.nio.channels.SeekableByteChannel;
-import java.nio.file.FileVisitResult;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.OpenOption;
-import java.nio.file.Path;
-import java.nio.file.SimpleFileVisitor;
-import java.nio.file.StandardOpenOption;
-import java.nio.file.attribute.BasicFileAttributes;
-import java.nio.file.attribute.FileTime;
-import java.security.MessageDigest;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.HexFormat;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
-
-/** Immutable private capture that native Git may traverse without touching the live world. */
-final class GitSourceCapture implements AutoCloseable {
-    private final Path root;
-
-    private final GitInventory inventory;
-
-    private GitSourceCapture(Path root, GitInventory inventory) {
-        this.root = root;
-        this.inventory = inventory;
-    }
-
-    static GitSourceCapture create(Path source, BackupManifest manifest)
-            throws IOException, GitStorageException {
-        return create(source, manifest, CaptureHook.NONE);
-    }
-
-    static GitSourceCapture create(Path source, BackupManifest manifest, CaptureHook hook)
-            throws IOException, GitStorageException {
-        Objects.requireNonNull(source, "source");
-        Objects.requireNonNull(manifest, "manifest");
-        Objects.requireNonNull(hook, "hook");
-        Path privateRoot = Files.createTempDirectory("worldarchive-git-capture-").toRealPath();
-        try {
-            CaptureVisitor visitor = new CaptureVisitor(source, privateRoot, hook);
-            GitSourceScanner.requireSafeTree(source);
-            Files.walkFileTree(source, visitor);
-            visitor.requireDirectoriesUnchanged();
-            GitSourceScanner.requireSafeTree(source);
-            GitInventory inventory = GitInventory.create(visitor.files);
-            inventory.requireMatches(manifest);
-            return new GitSourceCapture(privateRoot, inventory);
-        } catch (IOException | GitStorageException | RuntimeException exception) {
-            GitTemporaryFiles.deleteTree(privateRoot);
-            throw exception;
-        }
-    }
-
-    Path root() {
-        return root;
-    }
-
-    GitInventory inventory() {
-        return inventory;
-    }
-
-    @Override
-    public void close() {
-        GitTemporaryFiles.deleteTree(root);
-    }
-
-    interface CaptureHook {
-        CaptureHook NONE = new CaptureHook() {
-        };
-
-        default void beforeFileCopy(Path relative) throws IOException {
-        }
-
-        default void afterFileCopy(Path relative) throws IOException {
-        }
-    }
-
-    private static final class CaptureVisitor extends SimpleFileVisitor<Path> {
-        private final Path source;
-
-        private final Path destination;
-
-        private final CaptureHook hook;
-
-        private final List<GitInventoryEntry> files = new ArrayList<>();
-
-        private final List<DirectoryFingerprint> directories = new ArrayList<>();
-
-        private final Map<String, PathKind> collisionKinds = new HashMap<>();
-
-        private int entries;
-
-        private CaptureVisitor(Path source, Path destination, CaptureHook hook) {
-            this.source = source;
-            this.destination = destination;
-            this.hook = hook;
-        }
-
-        @Override
-        public FileVisitResult preVisitDirectory(Path directory, BasicFileAttributes attributes)
-                throws IOException {
-            countEntry();
-            GitSourceScanner.requireDirectory(directory, attributes);
-            Path relative = source.relativize(directory);
-            if (directory.equals(source)) {
-                directories.add(DirectoryFingerprint.create(directory, attributes));
-                return FileVisitResult.CONTINUE;
-            }
-            if (relative.getNameCount() == 1
-                    && relative.getFileName().toString().equalsIgnoreCase(".worldarchive")) {
-                return FileVisitResult.SKIP_SUBTREE;
-            }
-            String portable = portable(relative);
-            register(portable, PathKind.DIRECTORY);
-            try {
-                Files.createDirectory(GitPortablePath.resolveInside(destination, portable));
-            } catch (GitStorageException exception) {
-                throw new UnsafeCaptureException(exception.getMessage(), exception);
-            }
-            directories.add(DirectoryFingerprint.create(directory, attributes));
-            return FileVisitResult.CONTINUE;
-        }
-
-        @Override
-        public FileVisitResult visitFile(Path file, BasicFileAttributes attributes) throws IOException {
-            countEntry();
-            GitSourceScanner.requireOrdinaryFile(file, attributes);
-            Path relative = source.relativize(file);
-            String portable = portable(relative);
-            if (relative.getNameCount() == 1 && portable.equalsIgnoreCase("session.lock")) {
-                return FileVisitResult.CONTINUE;
-            }
-            register(portable, PathKind.FILE);
-            Path target;
-            try {
-                target = GitPortablePath.resolveInside(destination, portable);
-            } catch (GitStorageException exception) {
-                throw new UnsafeCaptureException(exception.getMessage(), exception);
-            }
-            FileFingerprint before = FileFingerprint.create(attributes);
-            String sha256;
-            long size;
-            hook.beforeFileCopy(relative);
-            try {
-                CopyResult copied = copyFile(file, target);
-                sha256 = copied.sha256();
-                size = copied.size();
-            } finally {
-                hook.afterFileCopy(relative);
-            }
-            BasicFileAttributes after = Files.readAttributes(
-                    file,
-                    BasicFileAttributes.class,
-                    LinkOption.NOFOLLOW_LINKS);
-            GitSourceScanner.requireOrdinaryFile(file, after);
-            if (!before.equals(FileFingerprint.create(after)) || size != before.size()) {
-                throw new UnsafeCaptureException("A live-world file changed during Git capture");
-            }
-            files.add(new GitInventoryEntry(portable, size, sha256));
-            return FileVisitResult.CONTINUE;
-        }
-
-        @Override
-        public FileVisitResult visitFileFailed(Path file, IOException exception) throws IOException {
-            throw new UnsafeCaptureException("A live-world source entry could not be read", exception);
-        }
-
-        @Override
-        public FileVisitResult postVisitDirectory(Path directory, IOException exception) throws IOException {
-            if (exception != null) {
-                throw new UnsafeCaptureException("The live-world source could not be captured", exception);
-            }
-            return FileVisitResult.CONTINUE;
-        }
-
-        private void requireDirectoriesUnchanged() throws IOException {
-            for (DirectoryFingerprint directory : directories) {
-                BasicFileAttributes attributes = Files.readAttributes(
-                        directory.path(),
-                        BasicFileAttributes.class,
-                        LinkOption.NOFOLLOW_LINKS);
-                GitSourceScanner.requireDirectory(directory.path(), attributes);
-                if (!directory.matches(attributes)) {
-                    throw new UnsafeCaptureException("A live-world directory changed during Git capture");
-                }
-            }
-        }
-
-        private String portable(Path relative) throws UnsafeCaptureException {
-            try {
-                String result = GitPortablePath.fromRelativePath(relative);
-                GitPortablePath.requireNotInternalRoot(result);
-                return result;
-            } catch (IllegalArgumentException exception) {
-                throw new UnsafeCaptureException("Live-world source contains a non-portable path", exception);
-            }
-        }
-
-        private void register(String portable, PathKind kind) throws UnsafeCaptureException {
-            String[] segments = portable.split("/");
-            StringBuilder prefix = new StringBuilder();
-            for (int index = 0; index < segments.length; index++) {
-                if (!prefix.isEmpty()) {
-                    prefix.append('/');
-                }
-                prefix.append(segments[index]);
-                String key = GitPortablePath.collisionKey(prefix.toString());
-                PathKind expected = index == segments.length - 1 ? kind : PathKind.DIRECTORY;
-                PathKind previous = collisionKinds.putIfAbsent(key, expected);
-                if (previous != null && (previous != expected || index == segments.length - 1)) {
-                    throw new UnsafeCaptureException(
-                            "Live-world source contains paths that collide on another platform");
-                }
-            }
-        }
-
-        private void countEntry() throws UnsafeCaptureException {
-            if (++entries > GitInventory.MAXIMUM_FILES * 2) {
-                throw new UnsafeCaptureException("Live-world source contains too many entries");
-            }
-        }
-    }
-
-    private static CopyResult copyFile(Path source, Path target) throws IOException {
-        MessageDigest digest = GitInventory.sha256();
-        long size = 0;
-        ByteBuffer buffer = ByteBuffer.allocate(Digests.COPY_BUFFER_BYTES);
-        try (SeekableByteChannel input = Files.newByteChannel(source, readOptions());
-                FileChannel output = FileChannel.open(
-                        target,
-                        StandardOpenOption.CREATE_NEW,
-                        StandardOpenOption.WRITE,
-                        LinkOption.NOFOLLOW_LINKS)) {
-            while (input.read(buffer) >= 0) {
-                if (buffer.position() == 0) {
-                    continue;
-                }
-                size = Math.addExact(size, buffer.position());
-                if (size > GitInventory.MAXIMUM_BYTES) {
-                    throw new IOException("A live-world file exceeds the Git capture limit");
-                }
-                digest.update(buffer.array(), 0, buffer.position());
-                buffer.flip();
-                while (buffer.hasRemaining()) {
-                    output.write(buffer);
-                }
-                buffer.clear();
-            }
-            output.force(true);
-        } catch (ArithmeticException exception) {
-            throw new IOException("A live-world file size overflowed Git accounting", exception);
-        }
-        return new CopyResult(size, HexFormat.of().formatHex(digest.digest()));
-    }
-
-    private static Set<OpenOption> readOptions() {
-        Set<OpenOption> options = new HashSet<>();
-        options.add(StandardOpenOption.READ);
-        options.add(LinkOption.NOFOLLOW_LINKS);
-        if (isWindows()) {
-            options.add(ExtendedOpenOption.NOSHARE_DELETE);
-        }
-        return Set.copyOf(options);
-    }
-
-    private static boolean isWindows() {
-        return System.getProperty("os.name").startsWith("Windows");
-    }
-
-    private enum PathKind {
-        DIRECTORY,
-        FILE
-    }
-
-    private record CopyResult(long size, String sha256) {
-    }
-
-    /** Directory mtimes are deferred on Windows; identity and membership remain authoritative. */
-    private record DirectoryFingerprint(
-            Path path,
-            Object fileKey,
-            FileTime creationTime) {
-        private DirectoryFingerprint {
-            Objects.requireNonNull(path, "path");
-            Objects.requireNonNull(creationTime, "creationTime");
-        }
-
-        private static DirectoryFingerprint create(Path path, BasicFileAttributes attributes) {
-            return new DirectoryFingerprint(
-                    path,
-                    attributes.fileKey(),
-                    identityCreationTime(attributes));
-        }
-
-        private boolean matches(BasicFileAttributes attributes) {
-            return Objects.equals(fileKey, attributes.fileKey())
-                    && creationTime.equals(identityCreationTime(attributes));
-        }
-    }
-
-    private static FileTime identityCreationTime(BasicFileAttributes attributes) {
-        // macOS may move birth time backwards when an older modification time is applied.
-        return System.getProperty("os.name").startsWith("Mac")
-                ? FileTime.fromMillis(0)
-                : attributes.creationTime();
-    }
-
-    private record FileFingerprint(
-            Object fileKey,
-            long size,
-            FileTime lastModifiedTime,
-            FileTime creationTime) {
-        private static FileFingerprint create(BasicFileAttributes attributes) {
-            return new FileFingerprint(
-                    attributes.fileKey(),
-                    attributes.size(),
-                    attributes.lastModifiedTime(),
-                    attributes.creationTime());
-        }
-    }
-
-    private static final class UnsafeCaptureException extends IOException {
-        private UnsafeCaptureException(String message) {
-            super(message);
-        }
-
-        private UnsafeCaptureException(String message, Throwable cause) {
-            super(message, cause);
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSourceScanner.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSourceScanner.java
deleted file mode 100644
index 6f265e7..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitSourceScanner.java
+++ /dev/null
@@ -1,90 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import dev.ishaanko.worldarchive.core.FileSystemSafety;
-import java.io.IOException;
-import java.nio.file.FileVisitResult;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.nio.file.SimpleFileVisitor;
-import java.nio.file.attribute.BasicFileAttributes;
-
-/** Rejects linked or special live-world entries before Git can traverse the source. */
-final class GitSourceScanner {
-    private GitSourceScanner() {
-    }
-
-    static void requireSafeTree(Path worldDirectory) throws IOException, GitStorageException {
-        GitRepositoryPathGuard.requireDirectory(worldDirectory);
-        BasicFileAttributes root = read(worldDirectory);
-        try {
-            requireDirectory(worldDirectory, root);
-            Files.walkFileTree(worldDirectory, new SimpleFileVisitor<>() {
-                @Override
-                public FileVisitResult preVisitDirectory(Path directory, BasicFileAttributes attributes)
-                        throws IOException {
-                    requireDirectory(directory, attributes);
-                    Path relative = worldDirectory.relativize(directory);
-                    if (isExcludedTree(relative)) {
-                        return FileVisitResult.SKIP_SUBTREE;
-                    }
-                    return FileVisitResult.CONTINUE;
-                }
-
-                @Override
-                public FileVisitResult visitFile(Path file, BasicFileAttributes attributes) throws IOException {
-                    requireOrdinaryFile(file, attributes);
-                    return FileVisitResult.CONTINUE;
-                }
-
-                @Override
-                public FileVisitResult visitFileFailed(Path file, IOException exception) throws IOException {
-                    throw new UnsafeSourceException("A live-world source entry could not be read", exception);
-                }
-
-                @Override
-                public FileVisitResult postVisitDirectory(Path directory, IOException exception) throws IOException {
-                    if (exception != null) {
-                        throw new UnsafeSourceException("The live-world source could not be traversed", exception);
-                    }
-                    return FileVisitResult.CONTINUE;
-                }
-            });
-        } catch (UnsafeSourceException exception) {
-            throw new GitStorageException(exception.getMessage(), exception);
-        }
-    }
-
-    static void requireDirectory(Path path, BasicFileAttributes attributes)
-            throws IOException {
-        if (!FileSystemSafety.isOrdinaryDirectory(path, attributes)) {
-            throw new UnsafeSourceException("Live-world source contains a linked or special directory");
-        }
-    }
-
-    static void requireOrdinaryFile(Path path, BasicFileAttributes attributes)
-            throws IOException {
-        if (!FileSystemSafety.isOrdinaryRegularFile(path, attributes)) {
-            throw new UnsafeSourceException("Live-world source contains a link or special entry");
-        }
-    }
-
-    private static BasicFileAttributes read(Path path) throws IOException {
-        return Files.readAttributes(path, BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
-    }
-
-    private static boolean isExcludedTree(Path relative) {
-        return relative.getNameCount() > 0
-                && relative.getName(0).toString().equalsIgnoreCase(".worldarchive");
-    }
-
-    private static final class UnsafeSourceException extends IOException {
-        private UnsafeSourceException(String message) {
-            super(message);
-        }
-
-        private UnsafeSourceException(String message, Throwable cause) {
-            super(message, cause);
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitStorageCompactor.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitStorageCompactor.java
deleted file mode 100644
index d27bfd4..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitStorageCompactor.java
+++ /dev/null
@@ -1,128 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.model.BackupId;
-import java.io.IOException;
-import java.nio.file.FileVisitResult;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.nio.file.SimpleFileVisitor;
-import java.nio.file.attribute.BasicFileAttributes;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
-import java.util.regex.Pattern;
-
-/** Exact local-only compaction after confirmed snapshot-ref cleanup. */
-final class GitStorageCompactor {
-    private static final Pattern LFS_OBJECT_NAME = Pattern.compile("[0-9a-f]{64}");
-
-    private final GitBackendSettings settings;
-
-    private final GitRepositoryManager repository;
-
-    private final GitRefStore refs;
-
-    private final GitCommands commands;
-
-    private final GitSnapshotVerifier verifier;
-
-    GitStorageCompactor(
-            GitBackendSettings settings,
-            GitRepositoryManager repository,
-            GitRefStore refs,
-            GitCommands commands,
-            GitSnapshotVerifier verifier) {
-        this.settings = Objects.requireNonNull(settings, "settings");
-        this.repository = Objects.requireNonNull(repository, "repository");
-        this.refs = Objects.requireNonNull(refs, "refs");
-        this.commands = Objects.requireNonNull(commands, "commands");
-        this.verifier = Objects.requireNonNull(verifier, "verifier");
-    }
-
-    /**
-     * Reclaims space after snapshot refs were deliberately deleted. Snapshot commits
-     * chain onto each other, so Git's own reachability keeps every older commit alive
-     * and {@code git lfs prune} cannot tell a deleted snapshot from a kept one. The LFS
-     * objects that stay are therefore computed exactly: every object that a remaining
-     * snapshot's tree points at. Anything else under {@code lfs/objects} is removed.
-     *
-     * <p>The world's history ref exists so an import can rebuild snapshot refs that
-     * went missing by accident. After a deletion it would rebuild the deleted snapshot
-     * with its content gone, so it is removed here as well.
-     */
-    void compact(WorldId worldId, List<GitSnapshot> remainingSnapshots)
-            throws IOException, InterruptedException, GitStorageException {
-        Set<String> retained = new HashSet<>();
-        for (GitSnapshot snapshot : remainingSnapshots) {
-            for (GitLfsPointer pointer : verifier.readLfsPointers(snapshot.commitId())) {
-                retained.add(pointer.sha256());
-            }
-        }
-        refs.deleteIfPresent(repository.historyRef(worldId));
-        commands.checked(
-                List.of(
-                        "reflog",
-                        "expire",
-                        "--expire=now",
-                        "--all"),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        commands.checked(
-                List.of(
-                        "gc",
-                        "--prune=now"),
-                settings.repository(),
-                Map.of(),
-                new byte[0]);
-        deleteUnreferencedLfsObjects(retained);
-    }
-
-    boolean deleteLocalSnapshot(WorldId worldId, BackupId backupId)
-            throws IOException, InterruptedException, GitStorageException {
-        repository.requireWorld(worldId);
-        repository.requireBare();
-        String refName = GitSnapshot.refName(worldId, backupId);
-        java.util.Optional<String> current = refs.resolve(refName);
-        if (current.isEmpty()) {
-            return false;
-        }
-        refs.deleteExact(refName, current.orElseThrow());
-        return true;
-    }
-
-    private void deleteUnreferencedLfsObjects(Set<String> retained)
-            throws IOException, GitStorageException {
-        Path lfsObjects = settings.repository().resolve("lfs").resolve("objects");
-        if (!Files.isDirectory(lfsObjects, LinkOption.NOFOLLOW_LINKS)) {
-            return;
-        }
-        for (String sha256 : retained) {
-            Path object = lfsObjects.resolve(sha256.substring(0, 2))
-                    .resolve(sha256.substring(2, 4))
-                    .resolve(sha256);
-            if (!Files.isRegularFile(object, LinkOption.NOFOLLOW_LINKS)) {
-                throw new GitStorageException(
-                        "A Git LFS object needed by a remaining snapshot is missing");
-            }
-        }
-        Files.walkFileTree(lfsObjects, new SimpleFileVisitor<>() {
-            @Override
-            public FileVisitResult visitFile(Path file, BasicFileAttributes attributes)
-                    throws IOException {
-                String name = file.getFileName().toString();
-                if (attributes.isRegularFile()
-                        && !attributes.isSymbolicLink()
-                        && LFS_OBJECT_NAME.matcher(name).matches()
-                        && !retained.contains(name)) {
-                    Files.delete(file);
-                }
-                return FileVisitResult.CONTINUE;
-            }
-        });
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitTemporaryFiles.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitTemporaryFiles.java
index 94d95c6..c0a82fc 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitTemporaryFiles.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitTemporaryFiles.java
@@ -7,95 +7,69 @@
 import java.nio.file.Path;
 import java.nio.file.SimpleFileVisitor;
 import java.nio.file.attribute.BasicFileAttributes;
+import java.util.stream.Stream;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
-/** Bounded, no-follow cleanup for WorldArchive-owned temporary trees. */
+/**
+ * Deletes WorldArchive's own temporary trees without following links: a link or a Windows
+ * junction inside is removed itself, never its target.
+ */
 final class GitTemporaryFiles {
-    private static final int MAXIMUM_ENTRIES = GitInventory.MAXIMUM_FILES * 2;
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
 
     private GitTemporaryFiles() {
     }
 
-    /** Best-effort removal of a private tree this process created; its Git child has exited. */
+    /** Deletes a tree; a failure is logged and the rest stays for the next sweep. */
     static void deleteTree(Path root) {
-        if (!Files.exists(root, LinkOption.NOFOLLOW_LINKS)) {
-            return;
-        }
         try {
-            SafetyScan scan = new SafetyScan();
-            Files.walkFileTree(root, scan);
-            Files.walkFileTree(root, new DeletingVisitor());
-        } catch (IOException | RuntimeException ignored) {
-            // Private temporary data remains for operating-system or user recovery.
+            delete(root);
+        } catch (IOException exception) {
+            LOGGER.warn("WorldArchive could not remove temporary files in {}: {}", root, exception.toString());
         }
     }
 
-    private static final class SafetyScan extends SimpleFileVisitor<Path> {
-        private int entries;
-
-        @Override
-        public FileVisitResult preVisitDirectory(Path directory, BasicFileAttributes attributes)
-                throws IOException {
-            count();
-            requireSafe(attributes);
-            return FileVisitResult.CONTINUE;
-        }
-
-        @Override
-        public FileVisitResult visitFile(Path file, BasicFileAttributes attributes) throws IOException {
-            count();
-            if (!attributes.isRegularFile() || attributes.isSymbolicLink() || attributes.isOther()) {
-                throw new IOException("Temporary Git tree contains an unsafe entry");
-            }
-            return FileVisitResult.CONTINUE;
-        }
-
-        private void count() throws IOException {
-            if (++entries > MAXIMUM_ENTRIES) {
-                throw new IOException("Temporary Git tree exceeds its cleanup limit");
-            }
-        }
-
-        private static void requireSafe(BasicFileAttributes attributes) throws IOException {
-            if (!attributes.isDirectory() || attributes.isSymbolicLink() || attributes.isOther()) {
-                throw new IOException("Temporary Git tree contains an unsafe directory");
+    /** Deletes everything inside a folder and keeps the folder, creating it when missing. */
+    static void deleteContents(Path folder) throws IOException {
+        Files.createDirectories(folder);
+        try (Stream<Path> children = Files.list(folder)) {
+            for (Path child : children.toList()) {
+                delete(child);
             }
         }
     }
 
-    private static final class DeletingVisitor extends SimpleFileVisitor<Path> {
-        private int entries;
-
-        @Override
-        public FileVisitResult preVisitDirectory(Path directory, BasicFileAttributes attributes)
-                throws IOException {
-            count();
-            SafetyScan.requireSafe(attributes);
-            return FileVisitResult.CONTINUE;
+    /** Deletes a file or a tree, bottom up. */
+    static void delete(Path root) throws IOException {
+        if (!Files.exists(root, LinkOption.NOFOLLOW_LINKS)) {
+            return;
         }
-
-        @Override
-        public FileVisitResult visitFile(Path file, BasicFileAttributes attributes) throws IOException {
-            count();
-            if (!attributes.isRegularFile() || attributes.isSymbolicLink() || attributes.isOther()) {
-                throw new IOException("Temporary Git tree changed during cleanup");
+        Files.walkFileTree(root, new SimpleFileVisitor<>() {
+            @Override
+            public FileVisitResult preVisitDirectory(Path directory, BasicFileAttributes attributes)
+                    throws IOException {
+                if (attributes.isOther() || attributes.isSymbolicLink()) {
+                    Files.delete(directory);
+                    return FileVisitResult.SKIP_SUBTREE;
+                }
+                return FileVisitResult.CONTINUE;
             }
-            Files.delete(file);
-            return FileVisitResult.CONTINUE;
-        }
 
-        @Override
-        public FileVisitResult postVisitDirectory(Path directory, IOException exception) throws IOException {
-            if (exception != null) {
-                throw exception;
+            @Override
+            public FileVisitResult visitFile(Path file, BasicFileAttributes attributes) throws IOException {
+                Files.delete(file);
+                return FileVisitResult.CONTINUE;
             }
-            Files.delete(directory);
-            return FileVisitResult.CONTINUE;
-        }
 
-        private void count() throws IOException {
-            if (++entries > MAXIMUM_ENTRIES) {
-                throw new IOException("Temporary Git tree exceeds its cleanup limit");
+            @Override
+            public FileVisitResult postVisitDirectory(Path directory, IOException failure) throws IOException {
+                if (failure != null) {
+                    throw failure;
+                }
+                Files.delete(directory);
+                return FileVisitResult.CONTINUE;
             }
-        }
+        });
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitToolHealth.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitToolHealth.java
index 321bcf3..63f1f6e 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitToolHealth.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitToolHealth.java
@@ -1,48 +1,54 @@
 package dev.ishaanko.worldarchive.storage.git;
 
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
 import java.util.Objects;
 import java.util.Optional;
 
-/** Independent health results for Git and the Git LFS extension. */
+/**
+ * Whether Git and the Git LFS extension work, checked independently. A tool that works reports
+ * its version; one that does not reports why.
+ */
 public record GitToolHealth(
-        boolean gitAvailable,
-        boolean lfsAvailable,
         Optional<String> gitVersion,
         Optional<String> lfsVersion,
         Optional<String> gitFailure,
         Optional<String> lfsFailure) {
     public GitToolHealth {
-        gitVersion = safe(gitVersion, "gitVersion");
-        lfsVersion = safe(lfsVersion, "lfsVersion");
-        gitFailure = safe(gitFailure, "gitFailure");
-        lfsFailure = safe(lfsFailure, "lfsFailure");
-        if (gitAvailable != gitVersion.isPresent() || lfsAvailable != lfsVersion.isPresent()) {
-            throw new IllegalArgumentException("Available Git tools must report their versions");
+        Objects.requireNonNull(gitVersion, "gitVersion");
+        Objects.requireNonNull(lfsVersion, "lfsVersion");
+        Objects.requireNonNull(gitFailure, "gitFailure");
+        Objects.requireNonNull(lfsFailure, "lfsFailure");
+        if (gitVersion.isPresent() == gitFailure.isPresent() || lfsVersion.isPresent() == lfsFailure.isPresent()) {
+            throw new IllegalArgumentException("Each Git tool reports either its version or its failure");
         }
     }
 
+    public boolean gitAvailable() {
+        return gitVersion.isPresent();
+    }
+
+    public boolean lfsAvailable() {
+        return lfsVersion.isPresent();
+    }
+
+    /**
+     * True when Git backups can run. Git LFS is required although a local backup writes its LFS
+     * objects without it: sync, restore from the remote and import need it, and one rule for
+     * every Git backup is easier to understand than one that changes when a remote is added.
+     */
     public boolean available() {
-        return gitAvailable && lfsAvailable;
+        return gitAvailable() && lfsAvailable();
     }
 
     public String summary() {
-        if (!gitAvailable && !lfsAvailable) {
-            return "Git and Git LFS are unavailable";
+        if (!gitAvailable() && !lfsAvailable()) {
+            return "Git and Git LFS are not installed. Install Git with Git LFS and restart the game.";
         }
-        if (!gitAvailable) {
-            return "Git is unavailable";
+        if (!gitAvailable()) {
+            return "Git is not installed or could not be started. Install Git and make sure it is on PATH.";
         }
-        if (!lfsAvailable) {
-            return "Git LFS is unavailable";
+        if (!lfsAvailable()) {
+            return "Git LFS is not installed. Install Git LFS and restart the game.";
         }
         return "Git and Git LFS are available";
     }
-
-    private static Optional<String> safe(Optional<String> value, String name) {
-        return Objects.requireNonNull(value, name).map(text -> {
-            String bounded = text.length() > 2_048 ? text.substring(0, 2_048) : text;
-            return SensitiveDataRedactor.redact(bounded);
-        });
-    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitToolProbe.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitToolProbe.java
index c78d385..af621de 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitToolProbe.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitToolProbe.java
@@ -1,16 +1,26 @@
 package dev.ishaanko.worldarchive.storage.git;
 
+import dev.ishaanko.worldarchive.model.SafeText;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.List;
+import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
-/** Probes Git and Git LFS independently so partial installations are never reported healthy. */
+/**
+ * Checks Git and Git LFS independently, so a partial installation is never reported healthy.
+ * Each check may stay silent no longer than the settings' idle limit.
+ */
 public final class GitToolProbe {
+    /** The oldest Git whose options every command here uses ({@code --no-write-fetch-head}, {@code --object-format}). */
+    static final int[] MINIMUM_GIT_VERSION = {2, 29};
+
+    private static final Pattern GIT_VERSION = Pattern.compile("git version (\\d{1,6})\\.(\\d{1,6})\\b");
+
     private final GitBackendSettings settings;
 
     private final GitCommandRunner runner;
@@ -20,87 +30,59 @@ public GitToolProbe(GitBackendSettings settings, GitCommandRunner runner) {
         this.runner = Objects.requireNonNull(runner, "runner");
     }
 
-    /** The oldest Git whose flags every command here uses ({@code --no-write-fetch-head}, {@code --object-format}). */
-    static final int[] MINIMUM_GIT_VERSION = {2, 29};
-
-    private static final Pattern GIT_VERSION = Pattern.compile("git version (\\d{1,6})\\.(\\d{1,6})\\b");
-
     public GitToolHealth probe() throws InterruptedException {
-        ProbeResult git = requireSupportedVersion(run(List.of(settings.executable(), "--version")));
-        ProbeResult lfs = run(List.of(settings.executable(), "lfs", "version"));
-        return new GitToolHealth(
-                git.available(),
-                lfs.available(),
-                git.version(),
-                lfs.version(),
-                git.failure(),
-                lfs.failure());
+        Result git = requireSupportedVersion(run(List.of(settings.executable(), "--version")));
+        Result lfs = run(List.of(settings.executable(), "lfs", "version"));
+        return new GitToolHealth(git.version(), lfs.version(), git.failure(), lfs.failure());
     }
 
-    private ProbeResult run(List<String> arguments) throws InterruptedException {
+    private Result run(List<String> arguments) throws InterruptedException {
         Path workingDirectory = settings.repository().getParent();
         if (workingDirectory == null || !Files.isDirectory(workingDirectory)) {
-            workingDirectory = Path.of("").toAbsolutePath().normalize();
+            workingDirectory = Path.of("").toAbsolutePath();
         }
-        GitCommand command = GitCommand.of(
-                arguments,
-                workingDirectory,
-                settings.commandTimeout(),
-                settings.maximumOutputBytes());
+        GitCommand command = new GitCommand(arguments, workingDirectory, Map.of(), GitCommand.Input.NONE,
+                Optional.of(settings.commandTimeout()), settings.maximumOutputBytes());
         try {
             GitCommandResult result = runner.run(command);
-            if (!result.successful()) {
-                return ProbeResult.failure(safeMessage(result));
-            }
-            String version = firstNonBlank(result.standardOutput(), result.standardError());
-            return ProbeResult.available(version);
+            String output = result.standardOutput().isBlank() ? result.standardError() : result.standardOutput();
+            String text = SafeText.of(output, result.successful() ? "version reported" : "the check failed", 512);
+            return result.successful() ? Result.available(text) : Result.failed(text);
         } catch (IOException exception) {
-            return ProbeResult.failure("Tool process could not be started or completed");
+            return Result.failed(SafeText.from(exception, "the tool could not be started", 512));
         }
     }
 
     /**
-     * An old Git fails mid-backup on an unknown flag; report it up front instead. Real Git
+     * An old Git fails mid-backup on an unknown option; report it up front instead. Real Git
      * always prints "git version X.Y", so output that does not is not a Git this mod can trust.
      */
-    private static ProbeResult requireSupportedVersion(ProbeResult git) {
-        if (!git.available()) {
+    private static Result requireSupportedVersion(Result git) {
+        if (git.version().isEmpty()) {
             return git;
         }
-        String reported = git.version().orElseThrow();
+        String reported = git.version().get();
         Matcher matcher = GIT_VERSION.matcher(reported);
         if (!matcher.find()) {
-            return ProbeResult.failure("Git version could not be read from: " + reported);
+            return Result.failed("Git version could not be read from: " + reported);
         }
         int major = Integer.parseInt(matcher.group(1));
         int minor = Integer.parseInt(matcher.group(2));
-        if (major > MINIMUM_GIT_VERSION[0]
-                || major == MINIMUM_GIT_VERSION[0] && minor >= MINIMUM_GIT_VERSION[1]) {
+        if (major > MINIMUM_GIT_VERSION[0] || major == MINIMUM_GIT_VERSION[0] && minor >= MINIMUM_GIT_VERSION[1]) {
             return git;
         }
-        return ProbeResult.failure("Git " + MINIMUM_GIT_VERSION[0] + "." + MINIMUM_GIT_VERSION[1]
+        return Result.failed("Git " + MINIMUM_GIT_VERSION[0] + "." + MINIMUM_GIT_VERSION[1]
                 + " or newer is required (found " + major + "." + minor + ")");
     }
 
-    private static String firstNonBlank(String first, String second) {
-        String value = first.isBlank() ? second : first;
-        value = value.replaceAll("\\p{Cntrl}+", " ").trim();
-        return value.isEmpty() ? "version reported" : value;
-    }
-
-    private static String safeMessage(GitCommandResult result) {
-        String value = SystemGitCommandRunner.redactPatterns(
-                firstNonBlank(result.standardError(), result.standardOutput()));
-        return value.length() > 512 ? value.substring(0, 512) : value;
-    }
-
-    private record ProbeResult(boolean available, Optional<String> version, Optional<String> failure) {
-        private static ProbeResult available(String version) {
-            return new ProbeResult(true, Optional.of(version), Optional.empty());
+    /** One tool's version or the reason it cannot be used. */
+    private record Result(Optional<String> version, Optional<String> failure) {
+        static Result available(String version) {
+            return new Result(Optional.of(version), Optional.empty());
         }
 
-        private static ProbeResult failure(String failure) {
-            return new ProbeResult(false, Optional.empty(), Optional.of(failure));
+        static Result failed(String failure) {
+            return new Result(Optional.empty(), Optional.of(failure));
         }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitTreeEntry.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitTreeEntry.java
index 5c907e2..9d45c2e 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitTreeEntry.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitTreeEntry.java
@@ -1,20 +1,14 @@
 package dev.ishaanko.worldarchive.storage.git;
 
 import java.util.Objects;
-import java.util.regex.Pattern;
-
-/** One validated ordinary blob in a snapshot tree. */
-record GitTreeEntry(String mode, String objectId, String path) {
-    private static final Pattern OBJECT_ID = Pattern.compile("[0-9a-f]{40}");
 
+/** One ordinary file in a snapshot tree: its blob and its portable path. */
+record GitTreeEntry(String objectId, String path) {
     GitTreeEntry {
-        Objects.requireNonNull(mode, "mode");
         Objects.requireNonNull(objectId, "objectId");
         Objects.requireNonNull(path, "path");
-        if ((!mode.equals("100644") && !mode.equals("100755"))
-                || !OBJECT_ID.matcher(objectId).matches()
-                || path.isEmpty()) {
-            throw new IllegalArgumentException("Invalid ordinary Git tree entry");
+        if (!GitRepository.isObjectId(objectId) || path.isEmpty()) {
+            throw new IllegalArgumentException("Invalid Git tree entry");
         }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitTreeValidator.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitTreeValidator.java
index 845962a..3ca7468 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitTreeValidator.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitTreeValidator.java
@@ -1,79 +1,109 @@
 package dev.ishaanko.worldarchive.storage.git;
 
+import dev.ishaanko.worldarchive.support.PortablePath;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
-import java.util.HashMap;
+import java.util.HashSet;
 import java.util.List;
-import java.util.Map;
+import java.util.Set;
 
-/** Rejects tree entries that cannot be restored as ordinary world files. */
+/**
+ * Reads {@code git ls-tree -r -z --full-tree} output and rejects every entry that could not be
+ * restored as an ordinary world file: links, nested repositories, unknown modes, paths that are
+ * not portable or hold a {@code .git} folder, WorldArchive's own names, and paths that collide on
+ * Windows or macOS. The snapshot manifest at the root is the one internal name a tree holds.
+ */
 final class GitTreeValidator {
+    /** The manifest path inside every snapshot tree. */
+    static final String MANIFEST_PATH = ".worldarchive-manifest.json";
+
+    static final Set<String> INTERNAL_ROOT_NAMES = Set.of(
+            ".worldarchive", MANIFEST_PATH, ".worldarchive.restore.lock");
+
+    private static final int BUFFER_BYTES = 64 * 1_024;
+
     private GitTreeValidator() {
     }
 
-    static List<GitTreeEntry> parse(String treeOutput) throws GitStorageException {
+    /** The entries of one listing, in Git's order. */
+    static List<GitTreeEntry> read(InputStream listing) throws IOException, GitStorageException {
         List<GitTreeEntry> entries = new ArrayList<>();
-        Map<String, PathKind> collisionKinds = new HashMap<>();
-        for (String entry : treeOutput.split("\u0000", -1)) {
-            if (entry.isEmpty()) {
-                continue;
-            }
-            int firstSpace = entry.indexOf(' ');
-            int tab = entry.indexOf('\t');
-            int secondSpace = entry.indexOf(' ', firstSpace + 1);
-            if (firstSpace < 0 || secondSpace < 0 || tab < 0 || secondSpace > tab) {
-                throw new GitStorageException("Git tree contains a malformed entry");
-            }
-            String mode = entry.substring(0, firstSpace);
-            String type = entry.substring(firstSpace + 1, secondSpace);
-            String objectId = entry.substring(secondSpace + 1, tab);
-            String path = entry.substring(tab + 1);
-            if (mode.equals("120000")) {
-                throw new GitStorageException("Git snapshot contains a symbolic link");
-            }
-            if (mode.equals("160000")) {
-                throw new GitStorageException("Git snapshot contains a nested Git repository link");
-            }
-            if (!mode.equals("100644") && !mode.equals("100755")) {
-                throw new GitStorageException("Git snapshot contains an unsupported tree mode");
+        Collisions collisions = new Collisions();
+        ByteArrayOutputStream entry = new ByteArrayOutputStream(256);
+        byte[] buffer = new byte[BUFFER_BYTES];
+        int read;
+        while ((read = listing.read(buffer)) >= 0) {
+            int start = 0;
+            for (int index = 0; index < read; index++) {
+                if (buffer[index] == 0) {
+                    entry.write(buffer, start, index - start);
+                    entries.add(parse(entry.toString(StandardCharsets.UTF_8), collisions));
+                    entry.reset();
+                    start = index + 1;
+                }
             }
-            if (!type.equals("blob")) {
-                throw new GitStorageException("Git snapshot contains an unsupported tree object");
+            entry.write(buffer, start, read - start);
+        }
+        if (entry.size() > 0) {
+            throw new GitStorageException("Git returned an incomplete tree listing");
+        }
+        return entries;
+    }
+
+    private static GitTreeEntry parse(String entry, Collisions collisions) throws GitStorageException {
+        int tab = entry.indexOf('\t');
+        String[] fields = tab < 0 ? new String[0] : entry.substring(0, tab).split(" ");
+        if (fields.length != 3) {
+            throw new GitStorageException("Git returned a malformed tree entry");
+        }
+        String path = entry.substring(tab + 1);
+        switch (fields[0]) {
+            case "100644", "100755" -> {
             }
+            case "120000" -> throw new GitStorageException(
+                    "The snapshot stores " + path + " as a link, which WorldArchive never restores");
+            case "160000" -> throw new GitStorageException(
+                    "The snapshot stores " + path + " as a nested Git repository, which WorldArchive cannot restore");
+            default -> throw new GitStorageException(
+                    "The snapshot stores " + path + " with the unsupported Git mode " + fields[0]);
+        }
+        if (!fields[1].equals("blob") || !GitRepository.isObjectId(fields[2])) {
+            throw new GitStorageException("Git returned a malformed tree entry");
+        }
+        if (!path.equals(MANIFEST_PATH)) {
             try {
-                GitPortablePath.validate(path);
-                if (!path.equals(GitBackupBackend.MANIFEST_PATH)) {
-                    GitPortablePath.requireNotInternalRoot(path);
-                }
-                registerPortablePath(path, collisionKinds);
-                entries.add(new GitTreeEntry(mode, objectId, path));
+                PortablePath.requireGitSafe(path, INTERNAL_ROOT_NAMES);
+                collisions.add(path);
             } catch (IllegalArgumentException exception) {
-                throw new GitStorageException("Git tree contains an unsafe or colliding path", exception);
+                throw new GitStorageException(
+                        "The snapshot holds a file that cannot be restored: " + exception.getMessage(), exception);
             }
         }
-        return List.copyOf(entries);
+        return new GitTreeEntry(fields[2], path);
     }
 
-    private static void registerPortablePath(
-            String portable,
-            Map<String, PathKind> collisionKinds) {
-        String[] segments = portable.split("/");
-        StringBuilder prefix = new StringBuilder();
-        for (int index = 0; index < segments.length; index++) {
-            if (!prefix.isEmpty()) {
-                prefix.append('/');
+    /** Finds two paths that would name the same file or folder on Windows or macOS. */
+    private static final class Collisions {
+        private final Set<String> files = new HashSet<>();
+
+        private final Set<String> folders = new HashSet<>();
+
+        void add(String path) {
+            String key = PortablePath.collisionKey(path);
+            if (!files.add(key) || folders.contains(key)) {
+                throw new IllegalArgumentException("Path \"" + path + "\" collides with another path on Windows or macOS");
             }
-            prefix.append(segments[index]);
-            String key = GitPortablePath.collisionKey(prefix.toString());
-            PathKind expected = index == segments.length - 1 ? PathKind.FILE : PathKind.DIRECTORY;
-            PathKind previous = collisionKinds.putIfAbsent(key, expected);
-            if (previous != null && (previous != expected || expected == PathKind.FILE)) {
-                throw new IllegalArgumentException("Git tree paths collide on another platform");
+            for (int slash = path.indexOf('/'); slash >= 0; slash = path.indexOf('/', slash + 1)) {
+                String folder = PortablePath.collisionKey(path.substring(0, slash));
+                if (files.contains(folder)) {
+                    throw new IllegalArgumentException(
+                            "Path \"" + path + "\" needs a folder where a file of the same name is");
+                }
+                folders.add(folder);
             }
         }
     }
-
-    private enum PathKind {
-        DIRECTORY,
-        FILE
-    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitVerification.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitVerification.java
index b208910..44610e4 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitVerification.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitVerification.java
@@ -1,31 +1,25 @@
 package dev.ishaanko.worldarchive.storage.git;
 
 import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
+import dev.ishaanko.worldarchive.model.SafeText;
 import java.util.Objects;
 import java.util.Optional;
 
-/** Git and LFS integrity result for one exact snapshot. */
-public record GitVerification(
-        GitSnapshot snapshot,
-        Optional<BackupManifest> manifest,
-        boolean valid,
-        String message) {
+/** The result of checking one snapshot: valid snapshots expose the manifest they hold. */
+public record GitVerification(Optional<BackupManifest> manifest, boolean valid, String message) {
     public GitVerification {
-        Objects.requireNonNull(snapshot, "snapshot");
         manifest = Objects.requireNonNull(manifest, "manifest");
         if (valid && manifest.isEmpty()) {
             throw new IllegalArgumentException("A valid Git verification must expose its manifest");
         }
-        Objects.requireNonNull(message, "message");
-        message = SensitiveDataRedactor.redact(message);
-        if (message.isBlank() || message.chars().anyMatch(Character::isISOControl)) {
-            throw new IllegalArgumentException("Verification message must be safe display text");
-        }
+        message = SafeText.of(Objects.requireNonNull(message, "message"), "Git verification finished", 1_024);
+    }
+
+    static GitVerification verified(BackupManifest manifest) {
+        return new GitVerification(Optional.of(manifest), true, "Git and Git LFS objects verified");
     }
 
-    /** Compatibility constructor for a verification that cannot expose a trusted manifest. */
-    public GitVerification(GitSnapshot snapshot, boolean valid, String message) {
-        this(snapshot, Optional.empty(), valid, message);
+    static GitVerification failed(String message) {
+        return new GitVerification(Optional.empty(), false, message);
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/GitWorldRepository.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitWorldRepository.java
new file mode 100644
index 0000000..6a3b224
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/GitWorldRepository.java
@@ -0,0 +1,558 @@
+package dev.ishaanko.worldarchive.storage.git;
+
+import dev.ishaanko.worldarchive.core.BackupCapture;
+import dev.ishaanko.worldarchive.core.WorldInventory;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.OperationPhase;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.SafeText;
+import dev.ishaanko.worldarchive.model.SyncStatus;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.support.PortablePath;
+import java.io.IOException;
+import java.nio.channels.ClosedByInterruptException;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.Path;
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import java.util.UUID;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import java.util.stream.Stream;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * All Git work for one world's repository. Every method blocks. Work that writes, or reads
+ * objects that compaction could remove, holds the repository lock; listing refs does not.
+ * Problems are {@link GitStorageException}s whose message a player can act on.
+ */
+final class GitWorldRepository {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
+    private static final Pattern SNAPSHOT_REF = Pattern.compile(
+            "refs/heads/worldarchive/([0-9a-f-]{36})/([0-9a-f-]{36})");
+
+    /** Git packs loose objects past about this many; see {@code gc.auto}. */
+    private static final int LOOSE_OBJECT_LIMIT = 6_700;
+
+    /** Git repacks when a repository holds more packs than this; see {@code gc.autoPackLimit}. */
+    private static final int PACK_LIMIT = 50;
+
+    private final WorldId worldId;
+
+    private final GitRepository repository;
+
+    private final GitLfsObjects lfs;
+
+    private final GitSnapshotReader reader;
+
+    private final GitSnapshotWriter writer;
+
+    private final Optional<GitRemote> remote;
+
+    GitWorldRepository(WorldId worldId, GitBackendSettings settings, GitCommandRunner runner) {
+        this.worldId = Objects.requireNonNull(worldId, "worldId");
+        this.repository = new GitRepository(settings, runner);
+        this.lfs = new GitLfsObjects(repository);
+        this.reader = new GitSnapshotReader(repository, lfs);
+        this.writer = new GitSnapshotWriter(repository, lfs);
+        this.remote = settings.remoteUrl().map(ignored -> new GitRemote(repository, worldId));
+    }
+
+    GitRepository repository() {
+        return repository;
+    }
+
+    GitSnapshotReader reader() {
+        return reader;
+    }
+
+    GitLfsObjects lfs() {
+        return lfs;
+    }
+
+    WorldId worldId() {
+        return worldId;
+    }
+
+    /** Runs work while holding this repository's lock, whose file is in the folder that holds the repository. */
+    <T> T locked(GitInterruptibleOperation<T> work) throws IOException, InterruptedException, GitStorageException {
+        repository.requireFolder();
+        return GitRepositoryLock.withLock(repository.directory(), repository.settings().commandTimeout(), work);
+    }
+
+    /** Writes, verifies and publishes a snapshot of the capture, then uploads it when the world has a remote. */
+    DestinationResult createBackup(BackupCapture capture, ProgressListener listener) {
+        GitProgress progress = new GitProgress(listener, capture.manifest());
+        try {
+            requireStorablePaths(capture.inventory());
+            return locked(() -> {
+                // Decided before the publish, so after it only the upload can stop, and a cancel leaves it pending.
+                GitRemote.MainBranch main = remote.isPresent()
+                        ? mainBranch(capture.manifest().createdAt().truncatedTo(ChronoUnit.SECONDS))
+                        : GitRemote.MainBranch.KEEP;
+                progress.report(OperationPhase.WRITING, "Writing the Git snapshot");
+                GitSnapshot snapshot = writeAndPublish(capture, progress);
+                packIfNeeded();
+                if (remote.isEmpty()) {
+                    progress.report(OperationPhase.COMPLETE, "Git snapshot complete");
+                    return DestinationResult.success(DestinationType.GIT, snapshot.refName());
+                }
+                progress.report(OperationPhase.PUBLISHING, "Uploading the Git snapshot");
+                return upload(snapshot, main);
+            });
+        } catch (InterruptedException exception) {
+            Thread.currentThread().interrupt();
+            return DestinationResult.failed(DestinationType.GIT, "The Git backup was cancelled");
+        } catch (IOException | GitStorageException exception) {
+            if (exception instanceof ClosedByInterruptException || Thread.currentThread().isInterrupted()) {
+                return DestinationResult.failed(DestinationType.GIT, "The Git backup was cancelled");
+            }
+            progress.report(OperationPhase.FAILED, "Git snapshot failed");
+            return DestinationResult.failed(DestinationType.GIT, SafeText.from(exception, "Git storage failed", 1_024));
+        }
+    }
+
+    /** This world's snapshots, newest first, from one {@code for-each-ref}; takes no lock. */
+    List<GitSnapshot> snapshots() throws IOException, InterruptedException, GitStorageException {
+        if (!Files.isDirectory(repository.directory(), LinkOption.NOFOLLOW_LINKS)) {
+            return List.of();
+        }
+        String listing = repository.git("for-each-ref", "--sort=-committerdate",
+                "--format=%(refname)%09%(objectname)%09%(committerdate:unix)", "refs/heads/worldarchive/" + worldId + "/");
+        List<GitSnapshot> snapshots = new ArrayList<>();
+        for (String line : listing.lines().filter(line -> !line.isBlank()).toList()) {
+            String[] fields = line.split("\t", -1);
+            Matcher ref = SNAPSHOT_REF.matcher(fields[0]);
+            if (fields.length != 3 || !ref.matches()) {
+                continue;
+            }
+            try {
+                snapshots.add(new GitSnapshot(WorldId.parse(ref.group(1)), BackupId.parse(ref.group(2)),
+                        fields[0], fields[1], Instant.ofEpochSecond(Long.parseLong(fields[2]))));
+            } catch (IllegalArgumentException exception) {
+                throw new GitStorageException("Git returned an invalid WorldArchive snapshot ref", exception);
+            }
+        }
+        return List.copyOf(snapshots);
+    }
+
+    Optional<GitSnapshot> snapshot(BackupId backupId) throws IOException, InterruptedException, GitStorageException {
+        String refName = GitSnapshot.refName(worldId, backupId);
+        return snapshots().stream().filter(snapshot -> snapshot.refName().equals(refName)).findFirst();
+    }
+
+    Map<BackupId, BackupManifest> manifests(Collection<GitSnapshot> snapshots)
+            throws IOException, InterruptedException, GitStorageException {
+        return locked(() -> reader.manifests(snapshots));
+    }
+
+    /** Checks this computer's copy fully; a damaged copy is a failed verification, not an error. */
+    GitVerification verifyLocal(BackupId backupId) throws IOException, InterruptedException, GitStorageException {
+        return locked(() -> {
+            GitSnapshot snapshot = snapshot(backupId).orElseThrow(GitWorldRepository::noLocalCopy);
+            try {
+                return GitVerification.verified(
+                        reader.verify(snapshot, GitSnapshotReader.LfsCheck.CONTENT).manifest().manifest());
+            } catch (IOException | GitStorageException exception) {
+                return GitVerification.failed(SafeText.from(exception, "Git verification failed", 1_024));
+            }
+        });
+    }
+
+    /**
+     * Checks the copy a restore would use: this computer's, or when that is missing or damaged,
+     * the remote's, which is then downloaded and kept here in place of the damaged one.
+     */
+    GitVerification verifyRestorable(BackupId backupId, BackupManifest expected)
+            throws IOException, InterruptedException, GitStorageException {
+        return locked(() -> {
+            Optional<GitSnapshot> local = snapshot(backupId);
+            Optional<Exception> localProblem = Optional.empty();
+            if (local.isPresent()) {
+                try {
+                    requireExpected(reader.verify(local.get(), GitSnapshotReader.LfsCheck.CONTENT), expected);
+                    return GitVerification.verified(expected);
+                } catch (IOException | GitStorageException exception) {
+                    if (remote.isEmpty()) {
+                        throw exception;
+                    }
+                    localProblem = Optional.of(exception);
+                }
+            }
+            fromRemote(backupId, expected, local, Optional.empty(), localProblem);
+            return GitVerification.verified(expected);
+        });
+    }
+
+    /**
+     * Writes the backup's files into an empty staging folder, hashing each on the way. When this
+     * computer's copy is missing or damaged and the world has a remote, the folder is emptied and
+     * the remote copy is used and kept here.
+     */
+    void restore(BackupId backupId, BackupManifest expected, Path staging)
+            throws IOException, InterruptedException, GitStorageException {
+        requireEmptyFolder(staging);
+        requireFreeSpace(staging, expected.sourceByteCount());
+        locked(() -> {
+            Optional<GitSnapshot> local = snapshot(backupId);
+            Optional<Exception> localProblem = Optional.empty();
+            if (local.isPresent()) {
+                try {
+                    reader.restore(local.get(), expected, staging);
+                    return null;
+                } catch (IOException | GitStorageException exception) {
+                    if (remote.isEmpty() || Thread.currentThread().isInterrupted()) {
+                        throw exception;
+                    }
+                    localProblem = Optional.of(exception);
+                    GitTemporaryFiles.deleteContents(staging);
+                }
+            }
+            fromRemote(backupId, expected, local, Optional.of(staging), localProblem);
+            return null;
+        });
+    }
+
+    /**
+     * Deletes the backups everywhere they exist and then frees the space they used here. A
+     * repository that was removed by hand from WorldArchive's default folder holds no local copy
+     * any more, and its copies on the remote are still deleted. A repository that is missing from
+     * a folder the player chose, as on a drive that is away, fails the delete: it may still hold
+     * the backups, and nothing is created in its place.
+     */
+    Map<BackupId, GitDeletion> delete(Set<BackupId> backupIds) throws IOException, InterruptedException, GitStorageException {
+        if (!Files.isDirectory(repository.directory(), LinkOption.NOFOLLOW_LINKS)
+                && !repository.removedFromDefaultFolder()) {
+            throw new GitStorageException("This world's Git backups are in " + repository.directory() + ", which"
+                    + " cannot be reached, so nothing was deleted. Check that its drive is connected and try again.");
+        }
+        return locked(() -> {
+            Map<BackupId, GitSnapshot> local = new LinkedHashMap<>();
+            snapshots().forEach(snapshot -> local.put(snapshot.backupId(), snapshot));
+            if (remote.isPresent() || !local.isEmpty()) {
+                repository.prepare();
+            }
+            Map<BackupId, GitDeletion> results;
+            try {
+                results = new GitSnapshotDeleter(repository, remote).delete(local, backupIds);
+            } catch (IOException | GitStorageException exception) {
+                GitDeletion failed = GitDeletion.failed(SafeText.from(exception, "The Git delete failed", 1_024));
+                results = new LinkedHashMap<>();
+                for (BackupId backupId : backupIds) {
+                    results.put(backupId, failed);
+                }
+            }
+            boolean removedHere = results.entrySet().stream().anyMatch(result ->
+                    result.getValue().outcome() == GitDeletion.Outcome.DELETED && local.containsKey(result.getKey()));
+            if (removedHere && !Thread.currentThread().isInterrupted()) {
+                compactQuietly();
+            }
+            return results;
+        });
+    }
+
+    /** Deletes only this computer's copy; the remote is never contacted. */
+    boolean deleteLocal(BackupId backupId) throws IOException, InterruptedException, GitStorageException {
+        return locked(() -> {
+            Optional<GitSnapshot> snapshot = snapshot(backupId);
+            if (snapshot.isEmpty()) {
+                return false;
+            }
+            GitDeletion deletion = new GitSnapshotDeleter(repository, Optional.empty())
+                    .delete(Map.of(backupId, snapshot.get()), Set.of(backupId))
+                    .get(backupId);
+            if (deletion.failed()) {
+                throw new GitStorageException(deletion.message());
+            }
+            return true;
+        });
+    }
+
+    /** Each backup's commit on the remote, from one {@code ls-remote}; empty without a remote. */
+    Map<BackupId, String> remoteCommits() throws IOException, InterruptedException, GitStorageException {
+        if (remote.isEmpty()) {
+            return Map.of();
+        }
+        return locked(() -> remote.get().branches().commits());
+    }
+
+    /** Uploads this computer's copy of a backup; problems with the remote leave it pending. */
+    DestinationResult sync(BackupId backupId) throws IOException, InterruptedException, GitStorageException {
+        return locked(() -> {
+            GitSnapshot snapshot = snapshot(backupId).orElseThrow(GitWorldRepository::noLocalCopy);
+            reader.verify(snapshot, GitSnapshotReader.LfsCheck.SIZE);
+            if (remote.isEmpty()) {
+                return DestinationResult.success(DestinationType.GIT, snapshot.refName());
+            }
+            return upload(snapshot, mainBranch(snapshot.committedAt()));
+        });
+    }
+
+    /**
+     * Frees the space of deleted snapshots: drops the refs that could keep them alive (the old
+     * local history branch and private refs a stopped operation left), lets Git remove every
+     * unreachable object, then deletes each LFS object no remaining object points at.
+     */
+    void compact() throws IOException, InterruptedException, GitStorageException {
+        locked(() -> {
+            if (!repository.exists()) {
+                return null;
+            }
+            repository.prepare();
+            List<String> drops = new ArrayList<>();
+            String keeping = repository.git("for-each-ref", "--format=delete %(refname) %(objectname)",
+                    "refs/heads/main", "refs/worldarchive/");
+            keeping.lines().filter(line -> !line.isBlank()).forEach(drops::add);
+            repository.updateRefs(drops);
+            repository.git("gc", "--prune=now", "--quiet");
+            Set<String> referenced = reader.referencedLfsObjects();
+            deleteUnreferencedLfsObjects(referenced);
+            return null;
+        });
+    }
+
+    /** Downloads the LFS objects of an imported snapshot from its source and checks it fully. */
+    GitVerification hydrate(BackupId backupId, BackupManifest expected, String expectedCommit, String sourceUrl)
+            throws IOException, InterruptedException, GitStorageException {
+        return locked(() -> {
+            repository.prepare();
+            GitSnapshot snapshot = snapshot(backupId).orElseThrow(GitWorldRepository::noLocalCopy);
+            if (!snapshot.commitId().equals(expectedCommit)) {
+                throw new GitStorageException("The imported Git snapshot no longer matches its source");
+            }
+            lfs.downloading(() -> repository.network("-c", "remote.worldarchive-import.url=" + sourceUrl,
+                    "lfs", "fetch", "worldarchive-import", snapshot.commitId()));
+            requireExpected(reader.verify(snapshot, GitSnapshotReader.LfsCheck.CONTENT), expected);
+            return GitVerification.verified(expected);
+        });
+    }
+
+    private GitSnapshot writeAndPublish(BackupCapture capture, GitProgress progress)
+            throws IOException, InterruptedException, GitStorageException {
+        repository.prepare();
+        BackupManifest manifest = capture.manifest();
+        GitSnapshotWriter.Written written = writer.write(
+                capture, GitSnapshotManifest.create(manifest, repository.settings().lfsPatterns()));
+        GitSnapshot snapshot = new GitSnapshot(worldId, manifest.backupId(), GitSnapshot.refName(worldId, manifest.backupId()),
+                written.commitId(), manifest.createdAt().truncatedTo(ChronoUnit.SECONDS));
+        progress.report(OperationPhase.VERIFYING, "Verifying the Git snapshot");
+        reader.verifyWritten(snapshot, capture.inventory());
+        publish(snapshot, written.privateRef());
+        return snapshot;
+    }
+
+    /**
+     * Creates the snapshot ref and drops the private one in one transaction. After an interrupted
+     * or failed update, what the snapshot ref points at decides.
+     */
+    private void publish(GitSnapshot snapshot, String privateRef) throws IOException, InterruptedException, GitStorageException {
+        try {
+            repository.updateRefs(List.of(
+                    "create " + snapshot.refName() + " " + snapshot.commitId(),
+                    "delete " + privateRef + " " + snapshot.commitId()));
+        } catch (IOException | InterruptedException | GitStorageException failure) {
+            Optional<String> published = GitRepository.uninterruptibly(() -> repository.resolve(snapshot.refName()));
+            if (!published.equals(Optional.of(snapshot.commitId()))) {
+                throw failure;
+            }
+            if (failure instanceof InterruptedException) {
+                Thread.currentThread().interrupt();
+            }
+        }
+    }
+
+    /** Whether uploading a snapshot made at {@code committedAt} moves {@code main}: only when none here is newer. */
+    private GitRemote.MainBranch mainBranch(Instant committedAt)
+            throws IOException, InterruptedException, GitStorageException {
+        return snapshots().stream().anyMatch(snapshot -> snapshot.committedAt().isAfter(committedAt))
+                ? GitRemote.MainBranch.KEEP
+                : GitRemote.MainBranch.MOVE;
+    }
+
+    /** Uploads a published snapshot; a failed or cancelled upload leaves it pending. */
+    private DestinationResult upload(GitSnapshot snapshot, GitRemote.MainBranch main) {
+        try {
+            remote.orElseThrow().upload(snapshot, main);
+            return DestinationResult.success(DestinationType.GIT, snapshot.refName()).withSync(SyncStatus.SYNCED);
+        } catch (InterruptedException exception) {
+            Thread.currentThread().interrupt();
+            return pending(snapshot, "the upload was cancelled");
+        } catch (IOException | GitStorageException exception) {
+            return pending(snapshot, SafeText.from(exception, "the upload failed", 900));
+        }
+    }
+
+    private static DestinationResult pending(GitSnapshot snapshot, String reason) {
+        return DestinationResult.pendingSync(DestinationType.GIT, snapshot.refName(),
+                "This computer's Git copy is safe; " + reason + ". Sync the backup to try the upload again.");
+    }
+
+    /**
+     * Downloads the backup from the remote into a private ref, checks it (writing its files when
+     * restoring), and keeps it as this computer's copy. Without a remote this fails with the
+     * problem of the local copy, or with the fact that there is none.
+     */
+    private void fromRemote(
+            BackupId backupId,
+            BackupManifest expected,
+            Optional<GitSnapshot> local,
+            Optional<Path> staging,
+            Optional<Exception> localProblem) throws IOException, InterruptedException, GitStorageException {
+        if (remote.isEmpty()) {
+            throw noLocalCopy();
+        }
+        try {
+            downloadAndKeep(backupId, expected, local, staging);
+        } catch (IOException | GitStorageException exception) {
+            localProblem.ifPresent(exception::addSuppressed);
+            throw exception;
+        }
+    }
+
+    private void downloadAndKeep(BackupId backupId, BackupManifest expected, Optional<GitSnapshot> local,
+            Optional<Path> staging) throws IOException, InterruptedException, GitStorageException {
+        repository.prepare();
+        GitRemote.Branch branch = remote.orElseThrow().branches().of(backupId).stream().findFirst()
+                .orElseThrow(() -> new GitStorageException("The Git remote does not have this backup"));
+        String privateRef = "refs/worldarchive/fetch/" + UUID.randomUUID();
+        try {
+            String commit = remote.get().fetch(branch, privateRef);
+            lfs.downloading(() -> {
+                remote.get().fetchLfsObjects(commit);
+                return null;
+            });
+            String refName = GitSnapshot.refName(worldId, backupId);
+            GitSnapshot fetched = new GitSnapshot(worldId, backupId, refName, commit,
+                    expected.createdAt().truncatedTo(ChronoUnit.SECONDS));
+            if (staging.isPresent()) {
+                reader.restore(fetched, expected, staging.get());
+            } else {
+                requireExpected(reader.verify(fetched, GitSnapshotReader.LfsCheck.CONTENT), expected);
+            }
+            repository.updateRefs(List.of(
+                    local.map(old -> "update " + refName + " " + commit + " " + old.commitId())
+                            .orElse("create " + refName + " " + commit),
+                    "delete " + privateRef + " " + commit));
+        } finally {
+            GitRepository.uninterruptibly(() -> repository.result("update-ref", "-d", privateRef));
+        }
+    }
+
+    private static void requireExpected(GitSnapshotReader.Contents contents, BackupManifest expected)
+            throws GitStorageException {
+        if (!contents.manifest().manifest().equals(expected)) {
+            throw new GitStorageException("The Git snapshot does not match the backup in the catalog");
+        }
+    }
+
+    /** Refuses a world that holds a path Git cannot store, naming it and saying what to do. */
+    private static void requireStorablePaths(WorldInventory inventory) throws GitStorageException {
+        for (WorldInventory.Entry file : inventory.files()) {
+            try {
+                PortablePath.requireGitSafe(file.path(), GitTreeValidator.INTERNAL_ROOT_NAMES);
+            } catch (IllegalArgumentException exception) {
+                List<String> segments = List.of(file.path().split("/"));
+                int git = segments.stream().map(segment -> segment.equalsIgnoreCase(".git")).toList().indexOf(true);
+                if (git >= 0) {
+                    String folder = git == 0 ? "the world folder" : String.join("/", segments.subList(0, git));
+                    throw new GitStorageException("Git backups cannot store the nested Git repository in "
+                            + folder + ". Remove its .git folder or use ZIP backups.");
+                }
+                throw new GitStorageException("Git backups cannot store " + file.path()
+                        + " because WorldArchive uses that name itself. Rename it or use ZIP backups.");
+            }
+        }
+    }
+
+    private static void requireEmptyFolder(Path staging) throws IOException, GitStorageException {
+        GitRepository.requireOrdinaryFolder(staging, "A Git restore needs an empty folder that is not a link");
+        try (Stream<Path> children = Files.list(staging)) {
+            if (children.findAny().isPresent()) {
+                throw new GitStorageException("A Git restore needs an empty folder");
+            }
+        }
+    }
+
+    private static void requireFreeSpace(Path staging, long needed) throws IOException, GitStorageException {
+        long usable = Files.getFileStore(staging).getUsableSpace();
+        if (usable < needed) {
+            throw new GitStorageException("There is not enough free space to restore this backup: it needs "
+                    + megabytes(needed) + " and " + megabytes(usable) + " is free. Free some space and try again.");
+        }
+    }
+
+    private static String megabytes(long bytes) {
+        return Math.max(1, (bytes + 999_999) / 1_000_000) + " MB";
+    }
+
+    /** Lets Git pack loose objects when there are many, or merge packs when there are many. */
+    private void packIfNeeded() {
+        Path objects = repository.directory().resolve("objects");
+        try (Stream<Path> loose = listOrEmpty(objects.resolve("17"));
+                Stream<Path> packs = listOrEmpty(objects.resolve("pack"))) {
+            long looseEstimate = loose.count() * 256;
+            long packCount = packs.filter(pack -> pack.getFileName().toString().endsWith(".pack")).count();
+            if (looseEstimate > LOOSE_OBJECT_LIMIT || packCount > PACK_LIMIT) {
+                repository.git("-c", "gc.auto=" + LOOSE_OBJECT_LIMIT, "-c", "gc.autoDetach=false", "gc", "--auto", "--quiet");
+            }
+        } catch (IOException | GitStorageException exception) {
+            LOGGER.warn("Git could not pack the objects of world {}: {}", worldId, SafeText.from(exception, "", 512));
+        } catch (InterruptedException exception) {
+            Thread.currentThread().interrupt();
+        }
+    }
+
+    private static Stream<Path> listOrEmpty(Path folder) throws IOException {
+        return Files.isDirectory(folder, LinkOption.NOFOLLOW_LINKS) ? Files.list(folder) : Stream.empty();
+    }
+
+    /** A delete frees its space right away; a compaction problem never fails the delete. */
+    private void compactQuietly() {
+        try {
+            compact();
+        } catch (IOException | GitStorageException exception) {
+            LOGGER.warn("Git could not free the space of deleted backups of world {}: {}",
+                    worldId, SafeText.from(exception, "", 512));
+        } catch (InterruptedException exception) {
+            Thread.currentThread().interrupt();
+        }
+    }
+
+    private void deleteUnreferencedLfsObjects(Set<String> referenced) throws IOException {
+        Path root = lfs.root();
+        if (!Files.isDirectory(root, LinkOption.NOFOLLOW_LINKS)) {
+            return;
+        }
+        long missing = referenced.stream().filter(sha256 -> !Files.isRegularFile(lfs.path(sha256))).count();
+        if (missing > 0) {
+            LOGGER.warn("{} Git LFS objects that backups of world {} use are missing; Verify reports which backups",
+                    missing, worldId);
+        }
+        try (Stream<Path> files = Files.find(root, 3, (path, attributes) -> attributes.isRegularFile())) {
+            for (Path object : files.toList()) {
+                String name = object.getFileName().toString();
+                if (GitRepository.isSha256(name) && !referenced.contains(name)) {
+                    Files.deleteIfExists(object);
+                }
+            }
+        }
+    }
+
+    private static GitStorageException noLocalCopy() {
+        return new GitStorageException("This computer has no Git copy of the backup");
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/KnownGitToolDirectories.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/KnownGitToolDirectories.java
index d2446da..b66188c 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/KnownGitToolDirectories.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/KnownGitToolDirectories.java
@@ -1,204 +1,68 @@
 package dev.ishaanko.worldarchive.storage.git;
 
+import java.io.File;
 import java.nio.file.Files;
-import java.nio.file.InvalidPathException;
 import java.nio.file.Path;
-import java.util.ArrayList;
-import java.util.HashSet;
 import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
 import java.util.Set;
-import java.util.function.Predicate;
-import java.util.regex.Pattern;
+import java.util.stream.Stream;
 
 /**
- * Appends well-known Git and Git LFS install folders to a child process {@code PATH}.
- *
- * <p>Game clients are usually launched from a GUI launcher, which on macOS and Linux inherits a
- * minimal login {@code PATH} that excludes package-manager folders such as {@code
- * /opt/homebrew/bin}. Git may then resolve while {@code git-lfs} does not, or neither resolves at
- * all. Folders are only appended, never prepended, so an operator-configured {@code PATH} always
- * wins, and only folders that exist on this machine are added.</p>
+ * Finds Git and Git LFS where macOS package managers put them. A game started from the Dock gets
+ * a minimal {@code PATH} without {@code /opt/homebrew/bin}, and the Command Line Tools shim at
+ * {@code /usr/bin/git} opens an install dialog when those tools are missing. On macOS this class
+ * therefore prefers a package-manager Git and adds those folders to the end of the child's
+ * {@code PATH}, so the user's own tools still win. Elsewhere it changes nothing. The folders are
+ * looked up once.
  */
 final class KnownGitToolDirectories {
-    private KnownGitToolDirectories() {
-    }
-
-    static void augment(Map<String, String> environment) {
-        augment(
-                environment,
-                System.getProperty("os.name", ""),
-                Path.of(System.getProperty("user.home", "")),
-                KnownGitToolDirectories::isExistingDirectory);
-    }
-
-    static void augment(
-            Map<String, String> environment,
-            String osName,
-            Path userHome,
-            Predicate<Path> isDirectory) {
-        Objects.requireNonNull(environment, "environment");
-        Objects.requireNonNull(osName, "osName");
-        Objects.requireNonNull(userHome, "userHome");
-        Objects.requireNonNull(isDirectory, "isDirectory");
-        boolean windows = isWindows(osName);
-        String pathKey = environment.keySet().stream()
-                .filter(name -> name.equalsIgnoreCase("PATH"))
-                .findFirst()
-                .orElse(windows ? "Path" : "PATH");
-        String augmented = appendMissing(
-                environment.getOrDefault(pathKey, ""),
-                candidateDirectories(osName, environment, userHome),
-                windows,
-                isDirectory);
-        environment.put(pathKey, augmented);
-    }
-
-    static List<Path> candidateDirectories(
-            String osName,
-            Map<String, String> environment,
-            Path userHome) {
-        if (isWindows(osName)) {
-            return windowsCandidates(environment, userHome);
-        }
-        String os = osName.toLowerCase(Locale.ROOT);
-        if (os.contains("mac") || os.contains("darwin")) {
-            return macCandidates(userHome);
-        }
-        return linuxCandidates(userHome);
-    }
-
-    private static List<Path> macCandidates(Path userHome) {
-        List<Path> candidates = new ArrayList<>();
-        candidates.add(Path.of("/opt/homebrew/bin"));
-        candidates.add(Path.of("/usr/local/bin"));
-        candidates.add(Path.of("/usr/bin"));
-        candidates.add(Path.of("/bin"));
-        candidates.add(Path.of("/opt/local/bin"));
-        candidates.add(Path.of("/sw/bin"));
-        candidates.add(Path.of("/usr/local/git/bin"));
-        candidates.add(Path.of("/Library/Developer/CommandLineTools/usr/bin"));
-        candidates.add(Path.of("/Applications/Xcode.app/Contents/Developer/usr/bin"));
-        candidates.add(userHome.resolve(".local/bin"));
-        candidates.addAll(nixCandidates(userHome));
-        return List.copyOf(candidates);
-    }
-
-    private static List<Path> linuxCandidates(Path userHome) {
-        List<Path> candidates = new ArrayList<>();
-        candidates.add(Path.of("/usr/local/bin"));
-        candidates.add(Path.of("/usr/bin"));
-        candidates.add(Path.of("/bin"));
-        candidates.add(Path.of("/snap/bin"));
-        candidates.add(Path.of("/home/linuxbrew/.linuxbrew/bin"));
-        candidates.add(userHome.resolve(".linuxbrew/bin"));
-        candidates.add(userHome.resolve(".local/bin"));
-        candidates.addAll(nixCandidates(userHome));
-        return List.copyOf(candidates);
-    }
+    private static final List<Path> PREFERRED = isMac(System.getProperty("os.name", ""))
+            ? Stream.of("/opt/homebrew/bin", "/usr/local/bin", "/opt/local/bin")
+                    .map(Path::of)
+                    .filter(Files::isDirectory)
+                    .toList()
+            : List.of();
 
-    private static List<Path> nixCandidates(Path userHome) {
-        return List.of(
-                userHome.resolve(".nix-profile/bin"),
-                Path.of("/nix/var/nix/profiles/default/bin"),
-                Path.of("/run/current-system/sw/bin"));
+    private KnownGitToolDirectories() {
     }
 
-    private static List<Path> windowsCandidates(Map<String, String> environment, Path userHome) {
-        Set<Path> candidates = new LinkedHashSet<>();
-        Set<String> programRoots = new LinkedHashSet<>();
-        variable(environment, "ProgramFiles").ifPresent(programRoots::add);
-        variable(environment, "ProgramW6432").ifPresent(programRoots::add);
-        variable(environment, "ProgramFiles(x86)").ifPresent(programRoots::add);
-        programRoots.add("C:\\Program Files");
-        programRoots.add("C:\\Program Files (x86)");
-        for (String root : programRoots) {
-            addGitInstallation(candidates, root);
+    /** The program to start: a package-manager Git for plain {@code git}, otherwise unchanged. */
+    static String program(String executable) {
+        if (!executable.equals("git")) {
+            return executable;
         }
-        String localAppData = variable(environment, "LOCALAPPDATA")
-                .orElseGet(() -> userHome.resolve("AppData").resolve("Local").toString());
-        addGitInstallation(candidates, localAppData + "\\Programs");
-        String programData = variable(environment, "ProgramData")
-                .or(() -> variable(environment, "ALLUSERSPROFILE"))
-                .orElse("C:\\ProgramData");
-        addPath(candidates, variable(environment, "ChocolateyInstall")
-                .orElse(programData + "\\chocolatey") + "\\bin");
-        addPath(candidates, variable(environment, "SCOOP")
-                .map(scoop -> scoop + "\\shims")
-                .orElseGet(() -> userHome.resolve("scoop").resolve("shims").toString()));
-        addPath(candidates, variable(environment, "SCOOP_GLOBAL")
-                .orElse(programData + "\\scoop") + "\\shims");
-        return List.copyOf(candidates);
-    }
-
-    /** Adds the folders one Git for Windows or Git LFS installer places under a root. */
-    private static void addGitInstallation(Set<Path> candidates, String root) {
-        addPath(candidates, root + "\\Git\\cmd");
-        addPath(candidates, root + "\\Git\\mingw64\\bin");
-        addPath(candidates, root + "\\Git\\bin");
-        addPath(candidates, root + "\\Git LFS");
+        return PREFERRED.stream()
+                .map(folder -> folder.resolve("git"))
+                .filter(Files::isExecutable)
+                .map(Path::toString)
+                .findFirst()
+                .orElse(executable);
     }
 
-    private static void addPath(Set<Path> candidates, String value) {
-        try {
-            candidates.add(Path.of(value));
-        } catch (InvalidPathException ignored) {
-            // An unparsable environment value never becomes a candidate.
+    /** Adds the package-manager folders to the end of the child's {@code PATH}. */
+    static void extendPath(Map<String, String> environment) {
+        if (!PREFERRED.isEmpty()) {
+            environment.put("PATH", appendFolders(environment.getOrDefault("PATH", ""), PREFERRED));
         }
     }
 
-    private static Optional<String> variable(Map<String, String> environment, String name) {
-        return environment.entrySet().stream()
-                .filter(entry -> entry.getKey().equalsIgnoreCase(name))
-                .map(Map.Entry::getValue)
-                .filter(value -> value != null && !value.isBlank())
-                .findFirst();
-    }
-
-    private static String appendMissing(
-            String currentPath,
-            List<Path> candidates,
-            boolean windows,
-            Predicate<Path> isDirectory) {
-        String separator = windows ? ";" : ":";
-        List<String> entries = new ArrayList<>();
-        Set<String> present = new HashSet<>();
-        for (String entry : currentPath.split(Pattern.quote(separator))) {
+    /** The path list with each folder appended unless it is already listed. */
+    static String appendFolders(String path, List<Path> folders) {
+        Set<String> entries = new LinkedHashSet<>();
+        for (String entry : path.split(File.pathSeparator)) {
             if (!entry.isBlank()) {
                 entries.add(entry);
-                present.add(normalize(entry, windows));
-            }
-        }
-        for (Path candidate : candidates) {
-            String value = candidate.toString();
-            if (present.add(normalize(value, windows)) && isDirectory.test(candidate)) {
-                entries.add(value);
             }
         }
-        return String.join(separator, entries);
+        folders.forEach(folder -> entries.add(folder.toString()));
+        return String.join(File.pathSeparator, entries);
     }
 
-    private static String normalize(String entry, boolean windows) {
-        String value = entry.trim();
-        while (value.length() > 1 && (value.endsWith("/") || value.endsWith("\\"))) {
-            value = value.substring(0, value.length() - 1);
-        }
-        return windows ? value.toLowerCase(Locale.ROOT) : value;
-    }
-
-    private static boolean isExistingDirectory(Path path) {
-        try {
-            return Files.isDirectory(path);
-        } catch (SecurityException exception) {
-            return false;
-        }
-    }
-
-    private static boolean isWindows(String osName) {
-        return osName.toLowerCase(Locale.ROOT).startsWith("windows");
+    private static boolean isMac(String osName) {
+        String os = osName.toLowerCase(Locale.ROOT);
+        return os.contains("mac") || os.contains("darwin");
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/RemoteSnapshotRef.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/RemoteSnapshotRef.java
deleted file mode 100644
index 1c6e30b..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/RemoteSnapshotRef.java
+++ /dev/null
@@ -1,11 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import java.util.Objects;
-
-/** Remote ref and its observed commit, used for guarded snapshot mutation. */
-record RemoteSnapshotRef(String refName, String commitId) {
-    RemoteSnapshotRef {
-        Objects.requireNonNull(refName, "refName");
-        Objects.requireNonNull(commitId, "commitId");
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/SystemCredentialHelpers.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/SystemCredentialHelpers.java
deleted file mode 100644
index 66d2a65..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/SystemCredentialHelpers.java
+++ /dev/null
@@ -1,129 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Locale;
-import java.util.Map;
-import java.util.Objects;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.TimeUnit;
-
-/**
- * Reads credential helpers from the system Git configuration, once per executable.
- *
- * <p>Backup commands run with {@code GIT_CONFIG_NOSYSTEM=1} so system configuration cannot change
- * how snapshots are written. On macOS and Windows, however, the stock credential helper
- * ({@code osxkeychain}, {@code manager}) is configured exactly there, so hiding that file also
- * hides the only non-interactive credential source and every HTTPS push fails once terminal
- * prompts are disabled. Only the {@code credential.helper} values are read back, to be re-injected
- * as command-scoped configuration on network commands.</p>
- */
-final class SystemCredentialHelpers {
-    private static final Map<String, List<String>> RESOLVED = new ConcurrentHashMap<>();
-
-    private static final long PROBE_TIMEOUT_MILLIS = 10_000L;
-
-    private static final int MAXIMUM_OUTPUT_BYTES = 16_384;
-
-    private SystemCredentialHelpers() {
-    }
-
-    static List<String> resolve(String executable, Map<String, String> environment)
-            throws InterruptedException {
-        Objects.requireNonNull(executable, "executable");
-        Objects.requireNonNull(environment, "environment");
-        List<String> resolved = RESOLVED.get(executable);
-        if (resolved != null) {
-            return resolved;
-        }
-        List<String> helpers = probe(executable, environment);
-        if (helpers.isEmpty()) {
-            helpers = platformDefault(System.getProperty("os.name", ""));
-        }
-        RESOLVED.putIfAbsent(executable, helpers);
-        return helpers;
-    }
-
-    private static List<String> probe(String executable, Map<String, String> environment)
-            throws InterruptedException {
-        ProcessBuilder builder = new ProcessBuilder(
-                executable, "config", "--system", "--get-all", "credential.helper");
-        builder.redirectError(ProcessBuilder.Redirect.DISCARD);
-        Map<String, String> probeEnvironment = builder.environment();
-        probeEnvironment.clear();
-        probeEnvironment.putAll(environment);
-        probeEnvironment.remove("GIT_CONFIG_NOSYSTEM");
-        probeEnvironment.put("GIT_TERMINAL_PROMPT", "0");
-        Process process;
-        try {
-            process = builder.start();
-        } catch (IOException exception) {
-            return List.of();
-        }
-        ByteArrayOutputStream output = new ByteArrayOutputStream();
-        Thread reader = Thread.ofVirtual().name("worldarchive-credential-probe").start(
-                () -> copyBounded(process.getInputStream(), output));
-        try {
-            process.getOutputStream().close();
-        } catch (IOException ignored) {
-            // The probe never needs standard input.
-        }
-        try {
-            if (!process.waitFor(PROBE_TIMEOUT_MILLIS, TimeUnit.MILLISECONDS)) {
-                process.destroyForcibly();
-                return List.of();
-            }
-            reader.join(TimeUnit.SECONDS.toMillis(1L));
-        } catch (InterruptedException exception) {
-            process.destroyForcibly();
-            reader.interrupt();
-            throw exception;
-        }
-        return parse(process.exitValue(), output.toString(StandardCharsets.UTF_8));
-    }
-
-    private static void copyBounded(InputStream input, ByteArrayOutputStream output) {
-        byte[] buffer = new byte[4_096];
-        try (input) {
-            int count;
-            while ((count = input.read(buffer)) >= 0) {
-                int remaining = MAXIMUM_OUTPUT_BYTES - output.size();
-                if (remaining <= 0) {
-                    return;
-                }
-                output.write(buffer, 0, Math.min(remaining, count));
-            }
-        } catch (IOException ignored) {
-            // A partial read parses as whatever helpers were seen.
-        }
-    }
-
-    static List<String> parse(int exitCode, String output) {
-        if (exitCode != 0) {
-            return List.of();
-        }
-        List<String> helpers = new ArrayList<>();
-        for (String line : output.split("\\R")) {
-            String helper = line.strip();
-            if (!helper.isEmpty()) {
-                helpers.add(helper);
-            }
-        }
-        return List.copyOf(helpers);
-    }
-
-    static List<String> platformDefault(String osName) {
-        String os = osName.toLowerCase(Locale.ROOT);
-        if (os.contains("mac") || os.contains("darwin")) {
-            return List.of("osxkeychain");
-        }
-        if (os.startsWith("windows")) {
-            return List.of("manager");
-        }
-        return List.of();
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/SystemGitCommandRunner.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/SystemGitCommandRunner.java
index 79552d9..79c4a9c 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/SystemGitCommandRunner.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/SystemGitCommandRunner.java
@@ -1,505 +1,344 @@
 package dev.ishaanko.worldarchive.storage.git;
 
-import java.io.ByteArrayOutputStream;
+import java.io.FilterOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.OutputStream;
 import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Duration;
 import java.util.ArrayList;
 import java.util.Comparator;
-import java.util.HexFormat;
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.Set;
-import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicReference;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
+import java.util.function.LongSupplier;
 
 /**
- * Runs Git directly with {@link ProcessBuilder}; no shell is ever involved.
- *
- * <p>The portable Java process API has no process-group or Windows Job Object primitive. Descendants
- * are therefore sampled aggressively and recursively, but a child that is spawned and reparented
- * entirely between samples cannot be proven killable without a platform-specific launcher.</p>
+ * Runs Git with {@link ProcessBuilder}; no shell is ever involved. Standard output and error go
+ * to private temporary files, so a helper process that keeps a handle open (an SSH control
+ * master, a credential cache) can never hold a finished command back, and nothing polls the
+ * process while it runs. Commands never prompt: terminal and askpass prompts are off, and every
+ * inherited {@code GIT_} variable is removed. When the caller is interrupted, or a command with
+ * an idle limit stays silent that long, the whole process tree is stopped: politely first, so
+ * Git can remove its lock files, then forcibly.
  */
 public final class SystemGitCommandRunner implements GitCommandRunner {
-    private static final Pattern URI_CREDENTIALS = Pattern.compile(
-            "(?i)([a-z][a-z0-9+.-]*://)([^\\s/@]+(?::[^\\s/@]*)?@)");
+    private static final long TERMINATION_GRACE_MILLIS = 500;
 
-    private static final Pattern NAMED_SECRET = Pattern.compile(
-            "(?i)(password|passwd|access[_-]?token|refresh[_-]?token|token|secret|"
-                    + "api[_-]?key|access[_-]?key|credential)([=:]\\s*)([^\\s&;,]+)");
+    private static final long IDLE_CHECK_MILLIS = 250;
 
-    private static final Pattern AUTHORIZATION = Pattern.compile(
-            "(?i)(authorization\\s*:\\s*(?:Bearer|Basic)\\s+)([A-Za-z0-9._~+/=-]{8,})");
+    private static final long FAILED_EXIT_WAIT_MILLIS = 100;
 
-    private static final Pattern KNOWN_TOKEN = Pattern.compile(
-            "(?i)(?:github_pat_[A-Za-z0-9_]{20,}|gh[pousr]_[A-Za-z0-9]{20,}|"
-                    + "glpat-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|"
-                    + "xox[baprs]-[A-Za-z0-9-]{10,}|ya29\\.[A-Za-z0-9_-]{20,}|"
-                    + "(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}|"
-                    + "AKIA[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{30,})");
-
-    private static final Pattern JSON_WEB_TOKEN = Pattern.compile(
-            "eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}");
-
-    private static final long TERMINATION_GRACE_MILLIS = 500L;
-
-    private static final long PROCESS_POLL_MILLIS = 10L;
-
-    private static final Set<String> ALLOWED_COMMAND_GIT_ENVIRONMENT = Set.of(
+    /** The only {@code GIT_} variables a command may set; WorldArchive's own code sets them. */
+    private static final Set<String> COMMAND_VARIABLES = Set.of(
             "GIT_AUTHOR_DATE",
             "GIT_AUTHOR_EMAIL",
             "GIT_AUTHOR_NAME",
             "GIT_COMMITTER_DATE",
             "GIT_COMMITTER_EMAIL",
             "GIT_COMMITTER_NAME",
-            "GIT_INDEX_FILE",
-            "GIT_LFS_SKIP_SMUDGE");
-
-    private static final Set<String> NETWORK_SUBCOMMANDS = Set.of(
-            "clone", "fetch", "ls-remote", "pull", "push");
-
-    private final CredentialHelperResolver credentialHelpers;
-
-    public SystemGitCommandRunner() {
-        this(SystemCredentialHelpers::resolve);
-    }
-
-    SystemGitCommandRunner(CredentialHelperResolver credentialHelpers) {
-        this.credentialHelpers = Objects.requireNonNull(credentialHelpers, "credentialHelpers");
-    }
-
-    @FunctionalInterface
-    interface CredentialHelperResolver {
-        List<String> resolve(String executable, Map<String, String> environment)
-                throws InterruptedException;
-    }
+            "GIT_LFS_FORCE_PROGRESS");
 
     @Override
     public GitCommandResult run(GitCommand command) throws IOException, InterruptedException {
         Objects.requireNonNull(command, "command");
-        long deadlineNanos = deadline(command);
-        ProcessBuilder builder = new ProcessBuilder(command.arguments());
-        builder.directory(command.workingDirectory().toFile());
-        builder.redirectErrorStream(false);
-        Map<String, String> environment = builder.environment();
-        removeUnsafeGitEnvironment(environment);
-        applyCommandEnvironment(environment, command.environment());
-        KnownGitToolDirectories.augment(environment);
-        environment.put("GIT_CONFIG_NOSYSTEM", "1");
-        environment.put("GIT_ATTR_NOSYSTEM", "1");
-        environment.put("GIT_TERMINAL_PROMPT", "0");
-        environment.put("GCM_INTERACTIVE", "Never");
-        environment.put("GIT_ASKPASS", "");
-        environment.put("SSH_ASKPASS", "");
-        environment.remove("SSH_ASKPASS_REQUIRE");
-        environment.put("GIT_LFS_FORCE_PROGRESS", "0");
-        applySystemCredentialHelpers(command, environment);
-
-        Process process;
-        try {
-            process = builder.start();
-        } catch (IOException exception) {
-            throw new IOException("Unable to start the configured Git executable", exception);
+        try (OutputFile output = OutputFile.create(); OutputFile error = OutputFile.create()) {
+            ProcessBuilder builder = builder(command)
+                    .redirectOutput(output.path().toFile())
+                    .redirectError(error.path().toFile());
+            int exitCode = execute(builder, command, () -> output.size() + error.size(), process -> {
+            });
+            int limit = command.maximumOutputBytes();
+            return new GitCommandResult(
+                    exitCode, output.read(limit), error.read(limit), output.size() > limit, error.size() > limit);
         }
+    }
 
-        BoundedOutput output = new BoundedOutput(command.maximumOutputBytes());
-        BoundedOutput error = new BoundedOutput(command.maximumOutputBytes());
-        Thread outputReader = Thread.ofVirtual().name("worldarchive-git-stdout").start(
-                () -> output.read(process.getInputStream()));
-        Thread errorReader = Thread.ofVirtual().name("worldarchive-git-stderr").start(
-                () -> error.read(process.getErrorStream()));
-        AtomicReference<IOException> inputFailure = new AtomicReference<>();
-        byte[] standardInput = command.standardInput();
-        Thread inputWriter = Thread.ofVirtual().name("worldarchive-git-stdin").start(() -> {
-            try (var input = process.getOutputStream()) {
-                input.write(standardInput);
-            } catch (IOException exception) {
-                inputFailure.set(exception);
-            }
-        });
-        Set<ProcessHandle> observedDescendants = ConcurrentHashMap.newKeySet();
-        AtomicBoolean observeDescendants = new AtomicBoolean(true);
-        Thread descendantObserver = Thread.ofVirtual().name("worldarchive-git-descendants").start(() -> {
-            while (observeDescendants.get() && process.isAlive()) {
-                observeDescendantsRecursively(process, observedDescendants);
+    @Override
+    public GitCommandResult stream(GitCommand command, OutputReader reader)
+            throws IOException, InterruptedException, GitStorageException {
+        Objects.requireNonNull(command, "command");
+        Objects.requireNonNull(reader, "reader");
+        int limit = command.maximumOutputBytes();
+        try (OutputFile error = OutputFile.create()) {
+            ProcessBuilder builder = builder(command).redirectError(error.path().toFile());
+            int exitCode = execute(builder, command, error::size, process -> {
+                InputStream output = process.getInputStream();
                 try {
-                    Thread.sleep(1L);
-                } catch (InterruptedException exception) {
-                    Thread.currentThread().interrupt();
-                    break;
+                    reader.read(output);
+                } catch (IOException | GitStorageException exception) {
+                    Optional<GitStorageException> gitFailure = gitFailure(process, error, limit);
+                    if (gitFailure.isEmpty()) {
+                        throw exception;
+                    }
+                    gitFailure.get().addSuppressed(exception);
+                    throw gitFailure.get();
+                } finally {
+                    output.close();
                 }
-            }
-            observeDescendantsRecursively(process, observedDescendants);
-        });
-
-        try {
-            if (!waitForExit(process, observedDescendants, inputFailure, deadlineNanos)
-                    || !joinCommunicationsUntil(
-                            process,
-                            observedDescendants,
-                            inputWriter,
-                            outputReader,
-                            errorReader,
-                            deadlineNanos)) {
-                terminate(process, observedDescendants);
-                closeProcessStreams(process);
-                joinCommunicationsAfterTermination(inputWriter, outputReader, errorReader);
-                throw new GitCommandTimeoutException(command.timeout());
-            }
-            if (inputFailure.get() != null) {
-                throw new IOException("Unable to write Git process input", inputFailure.get());
-            }
-        } catch (InterruptedException exception) {
-            terminate(process, observedDescendants);
-            closeProcessStreams(process);
-            inputWriter.interrupt();
-            outputReader.interrupt();
-            errorReader.interrupt();
-            joinCommunicationsAfterTermination(inputWriter, outputReader, errorReader);
-            throw exception;
-        } catch (IOException exception) {
-            terminate(process, observedDescendants);
-            closeProcessStreams(process);
-            joinCommunicationsAfterTermination(inputWriter, outputReader, errorReader);
-            throw exception;
-        } finally {
-            observeDescendants.set(false);
-            descendantObserver.interrupt();
-            joinObserver(descendantObserver);
-            closeProcessStreams(process);
+            });
+            return new GitCommandResult(exitCode, "", error.read(limit), false, error.size() > limit);
         }
-
-        return result(process, command, output, error);
-    }
-
-    private static GitCommandResult result(
-            Process process,
-            GitCommand command,
-            BoundedOutput output,
-            BoundedOutput error) throws IOException {
-        return new GitCommandResult(
-                process.exitValue(),
-                output.truncated()
-                        ? redact(output.text(), command.secrets())
-                        : redactSecrets(output.text(), command.secrets()),
-                redact(error.text(), command.secrets()),
-                output.truncated(),
-                error.truncated(),
-                output.byteCount(),
-                output.sha256());
     }
 
     /**
-     * Restores the system-configured credential helpers that {@code GIT_CONFIG_NOSYSTEM} hides.
-     *
-     * <p>With terminal prompts disabled, network commands can only authenticate through a
-     * credential helper, and on macOS and Windows the stock helper lives in the system
-     * configuration file this runner suppresses. Only {@code credential.helper} is carried back
-     * over, as command-scoped configuration, and only for commands that may touch a remote.</p>
+     * Git's own failure when the process has already ended with an error: output that stops in
+     * the middle is then Git's doing, and its message explains more than the reader can.
      */
-    void applySystemCredentialHelpers(GitCommand command, Map<String, String> environment)
-            throws InterruptedException {
-        List<String> arguments = command.arguments();
-        if (arguments.stream().noneMatch(NETWORK_SUBCOMMANDS::contains)) {
-            return;
-        }
-        List<String> helpers = credentialHelpers.resolve(arguments.get(0), environment);
-        int count = 0;
-        for (String helper : helpers) {
-            environment.put("GIT_CONFIG_KEY_" + count, "credential.helper");
-            environment.put("GIT_CONFIG_VALUE_" + count, helper);
-            count++;
+    private static Optional<GitStorageException> gitFailure(Process process, OutputFile error, int limit)
+            throws IOException, InterruptedException {
+        if (!process.waitFor(FAILED_EXIT_WAIT_MILLIS, TimeUnit.MILLISECONDS) || process.exitValue() == 0) {
+            return Optional.empty();
         }
-        if (count > 0) {
-            environment.put("GIT_CONFIG_COUNT", Integer.toString(count));
-        }
-    }
-
-    static void removeUnsafeGitEnvironment(Map<String, String> environment) {
-        Objects.requireNonNull(environment, "environment");
-        environment.keySet().removeIf(name ->
-                name.toUpperCase(Locale.ROOT).startsWith("GIT_"));
-        environment.put("GIT_CONFIG_NOSYSTEM", "1");
-        environment.put("GIT_ATTR_NOSYSTEM", "1");
-    }
-
-    private static void applyCommandEnvironment(
-            Map<String, String> environment,
-            Map<String, String> commandEnvironment) {
-        commandEnvironment.forEach((name, value) -> {
-            String normalized = name.toUpperCase(Locale.ROOT);
-            if (!normalized.startsWith("GIT_")
-                    || ALLOWED_COMMAND_GIT_ENVIRONMENT.contains(normalized)) {
-                environment.put(name, value);
-            }
-        });
+        GitCommandResult result = new GitCommandResult(process.exitValue(), "", error.read(limit), false, false);
+        return Optional.of(new GitStorageException(GitRepository.failureMessage(result)));
     }
 
-    private static long deadline(GitCommand command) {
-        long now = System.nanoTime();
-        long timeout = command.timeout().toNanos();
-        return now > Long.MAX_VALUE - timeout ? Long.MAX_VALUE : now + timeout;
-    }
-
-    private static boolean waitForExit(
-            Process process,
-            Set<ProcessHandle> observedDescendants,
-            AtomicReference<IOException> inputFailure,
-            long deadlineNanos) throws IOException, InterruptedException {
-        while (true) {
-            if (inputFailure.get() != null) {
-                throw new IOException("Unable to write Git process input", inputFailure.get());
-            }
-            observeDescendants(process, observedDescendants);
-            if (!process.isAlive()) {
-                return true;
-            }
-            long remaining = deadlineNanos - System.nanoTime();
-            if (remaining <= 0) {
-                return false;
+    /**
+     * Starts the process, feeds its input, runs the body while it works and waits for its exit.
+     * Whatever ends this method early also ends the process tree.
+     */
+    private static <E extends Exception> int execute(
+            ProcessBuilder builder,
+            GitCommand command,
+            LongSupplier written,
+            ProcessBody<E> body) throws IOException, InterruptedException, E {
+        Process process = start(builder);
+        boolean exited = false;
+        try {
+            InputFeed input = InputFeed.start(process, command.standardInput());
+            body.accept(process);
+            awaitExit(process, command.idleTimeout(), written);
+            exited = true;
+            input.finish(process.exitValue());
+            return process.exitValue();
+        } finally {
+            if (!exited) {
+                terminate(process);
             }
-            long waitMillis = Math.max(
-                    1L,
-                    Math.min(PROCESS_POLL_MILLIS, TimeUnit.NANOSECONDS.toMillis(remaining)));
-            process.waitFor(waitMillis, TimeUnit.MILLISECONDS);
         }
     }
 
-    private static boolean joinCommunicationsUntil(
-            Process process,
-            Set<ProcessHandle> observedDescendants,
-            Thread inputWriter,
-            Thread outputReader,
-            Thread errorReader,
-            long deadlineNanos) throws InterruptedException {
-        while (inputWriter.isAlive() || outputReader.isAlive() || errorReader.isAlive()) {
-            observeDescendants(process, observedDescendants);
-            long remaining = deadlineNanos - System.nanoTime();
-            if (remaining <= 0) {
-                return false;
-            }
-            long waitMillis = Math.max(
-                    1L,
-                    Math.min(PROCESS_POLL_MILLIS, TimeUnit.NANOSECONDS.toMillis(remaining)));
-            inputWriter.join(waitMillis);
-            outputReader.join(waitMillis);
-            errorReader.join(waitMillis);
+    private static Process start(ProcessBuilder builder) throws IOException {
+        try {
+            return builder.start();
+        } catch (IOException exception) {
+            throw new IOException("Git could not be started. Install Git and make sure it is on PATH.", exception);
         }
-        return true;
     }
 
-    private static void observeDescendants(Process process, Set<ProcessHandle> observedDescendants) {
-        observeDescendantsRecursively(process, observedDescendants);
+    private static ProcessBuilder builder(GitCommand command) {
+        List<String> arguments = new ArrayList<>(command.arguments());
+        arguments.set(0, KnownGitToolDirectories.program(arguments.getFirst()));
+        ProcessBuilder builder = new ProcessBuilder(arguments).directory(command.workingDirectory().toFile());
+        Map<String, String> environment = builder.environment();
+        environment.keySet().removeIf(name -> name.toUpperCase(Locale.ROOT).startsWith("GIT_"));
+        environment.remove("SSH_ASKPASS_REQUIRE");
+        environment.put("GIT_TERMINAL_PROMPT", "0");
+        environment.put("GCM_INTERACTIVE", "Never");
+        environment.put("GIT_ASKPASS", "");
+        environment.put("SSH_ASKPASS", "");
+        command.environment().forEach((name, value) -> {
+            if (!COMMAND_VARIABLES.contains(name)) {
+                throw new IllegalArgumentException("Git command sets an unsupported variable: " + name);
+            }
+            environment.put(name, value);
+        });
+        KnownGitToolDirectories.extendPath(environment);
+        return builder;
     }
 
-    private static void observeDescendantsRecursively(
-            Process process,
-            Set<ProcessHandle> observedDescendants) {
-        process.descendants().forEach(observedDescendants::add);
-        for (ProcessHandle handle : List.copyOf(observedDescendants)) {
-            if (handle.isAlive()) {
-                handle.descendants().forEach(observedDescendants::add);
+    /** Waits for the exit; with an idle limit, gives up once the output stops growing that long. */
+    private static void awaitExit(Process process, Optional<Duration> idleLimit, LongSupplier written)
+            throws InterruptedException, GitCommandTimeoutException {
+        if (idleLimit.isEmpty()) {
+            process.waitFor();
+            return;
+        }
+        long limit = idleLimit.orElseThrow().toNanos();
+        long lastWritten = written.getAsLong();
+        long lastChange = System.nanoTime();
+        while (!process.waitFor(IDLE_CHECK_MILLIS, TimeUnit.MILLISECONDS)) {
+            long current = written.getAsLong();
+            if (current != lastWritten) {
+                lastWritten = current;
+                lastChange = System.nanoTime();
+            } else if (System.nanoTime() - lastChange >= limit) {
+                throw new GitCommandTimeoutException(idleLimit.orElseThrow());
             }
         }
     }
 
-    private static void terminate(Process process, Set<ProcessHandle> observedDescendants) {
-        observeDescendants(process, observedDescendants);
-        destroyObserved(observedDescendants, false);
+    /**
+     * Stops the process and every descendant it started. The tree is read once, while the root
+     * still runs, because Git for Windows' launcher and a transport helper both outlive a killed
+     * parent. Deeper processes are asked first; after a short grace period the rest is killed.
+     */
+    private static void terminate(Process process) {
+        List<ProcessHandle> tree = new ArrayList<>(process.descendants().toList());
+        tree.sort(Comparator.comparingInt((ProcessHandle handle) -> depth(handle, process.pid())).reversed());
+        tree.forEach(ProcessHandle::destroy);
         process.destroy();
-        long stopDeadline = System.nanoTime() + TimeUnit.MILLISECONDS.toNanos(TERMINATION_GRACE_MILLIS);
-        boolean interrupted = false;
-        while ((process.isAlive() || observedDescendants.stream().anyMatch(ProcessHandle::isAlive))
-                && System.nanoTime() < stopDeadline) {
-            observeDescendantsRecursively(process, observedDescendants);
-            destroyObserved(observedDescendants, false);
+        boolean interrupted = Thread.interrupted();
+        long deadline = System.nanoTime() + TimeUnit.MILLISECONDS.toNanos(TERMINATION_GRACE_MILLIS);
+        while (!interrupted
+                && (process.isAlive() || tree.stream().anyMatch(ProcessHandle::isAlive))
+                && System.nanoTime() < deadline) {
             try {
-                Thread.sleep(PROCESS_POLL_MILLIS);
+                Thread.sleep(10);
             } catch (InterruptedException exception) {
                 interrupted = true;
-                break;
             }
         }
-        observeDescendantsRecursively(process, observedDescendants);
-        destroyObserved(observedDescendants, true);
-        if (process.isAlive()) {
-            process.destroyForcibly();
-        }
+        tree.stream().filter(ProcessHandle::isAlive).forEach(ProcessHandle::destroyForcibly);
+        process.destroyForcibly();
         if (interrupted) {
             Thread.currentThread().interrupt();
         }
     }
 
-    private static void destroyObserved(Set<ProcessHandle> observedDescendants, boolean forcibly) {
-        List<ProcessHandle> handles = new ArrayList<>(observedDescendants);
-        handles.sort(Comparator.comparingLong(ProcessHandle::pid).reversed());
-        for (ProcessHandle handle : handles) {
-            if (handle.isAlive()) {
-                if (forcibly) {
-                    handle.destroyForcibly();
-                } else {
-                    handle.destroy();
-                }
-            }
+    private static int depth(ProcessHandle handle, long rootPid) {
+        int depth = 0;
+        Optional<ProcessHandle> current = Optional.of(handle);
+        while (current.isPresent() && current.get().pid() != rootPid && depth < 64) {
+            depth++;
+            current = current.get().parent();
         }
+        return depth;
     }
 
-    private static void joinObserver(Thread observer) {
-        boolean interrupted = false;
-        try {
-            observer.join(TERMINATION_GRACE_MILLIS);
-        } catch (InterruptedException exception) {
-            interrupted = true;
-        }
-        if (interrupted) {
-            Thread.currentThread().interrupt();
-        }
+    /** Work done while the process runs, such as reading its streamed output. */
+    @FunctionalInterface
+    private interface ProcessBody<E extends Exception> {
+        void accept(Process process) throws IOException, InterruptedException, E;
     }
 
-    private static void joinCommunicationsAfterTermination(
-            Thread inputWriter,
-            Thread outputReader,
-            Thread errorReader) {
-        long deadline = System.nanoTime() + TimeUnit.MILLISECONDS.toNanos(TERMINATION_GRACE_MILLIS);
-        boolean interrupted = false;
-        while ((inputWriter.isAlive() || outputReader.isAlive() || errorReader.isAlive())
-                && System.nanoTime() < deadline) {
+    /** One private temporary file that receives a process stream and is deleted afterwards. */
+    private record OutputFile(Path path) implements AutoCloseable {
+        static OutputFile create() throws IOException {
+            return new OutputFile(Files.createTempFile("worldarchive-git-", ".log"));
+        }
+
+        long size() {
             try {
-                inputWriter.join(PROCESS_POLL_MILLIS);
-                outputReader.join(PROCESS_POLL_MILLIS);
-                errorReader.join(PROCESS_POLL_MILLIS);
-            } catch (InterruptedException exception) {
-                interrupted = true;
-                break;
+                return Files.size(path);
+            } catch (IOException exception) {
+                return 0;
             }
         }
-        inputWriter.interrupt();
-        outputReader.interrupt();
-        errorReader.interrupt();
-        if (interrupted) {
-            Thread.currentThread().interrupt();
-        }
-    }
 
-    private static void closeProcessStreams(Process process) {
-        try {
-            process.getInputStream().close();
-        } catch (IOException ignored) {
-            // Closing is best-effort after bounded process handling.
-        }
-        try {
-            process.getErrorStream().close();
-        } catch (IOException ignored) {
-            // Closing is best-effort after bounded process handling.
-        }
-        try {
-            process.getOutputStream().close();
-        } catch (IOException ignored) {
-            // Closing is best-effort after bounded process handling.
+        String read(int maximumBytes) throws IOException {
+            try (InputStream input = Files.newInputStream(path)) {
+                return new String(input.readNBytes(maximumBytes), StandardCharsets.UTF_8);
+            }
         }
-    }
-
-    /** Full redaction for text that reaches a user: known secrets plus credential patterns. */
-    static String redact(String value, Iterable<String> secrets) {
-        return redactPatterns(redactSecrets(value, secrets));
-    }
 
-    /**
-     * Standard output is data the caller parses (manifests, trees, object IDs), so only the
-     * exact secrets the command was given are removed. Pattern redaction would corrupt a
-     * manifest whose world name reads "Secret: Base"; it is applied when output is displayed
-     * and to truncated output, which is never parsed.
-     */
-    static String redactSecrets(String value, Iterable<String> secrets) {
-        String redacted = value;
-        List<String> orderedSecrets = new ArrayList<>();
-        secrets.forEach(secret -> {
-            if (secret != null && !secret.isBlank()) {
-                orderedSecrets.add(secret);
+        @Override
+        public void close() {
+            try {
+                Files.deleteIfExists(path);
+            } catch (IOException ignored) {
+                // A descendant on Windows may still hold the file; it is small and in temp.
             }
-        });
-        orderedSecrets.sort(Comparator.comparingInt(String::length).reversed());
-        for (String secret : orderedSecrets) {
-            redacted = redacted.replace(secret, "[REDACTED]");
         }
-        return redacted;
     }
 
-    static String redactPatterns(String value) {
-        String redacted = URI_CREDENTIALS.matcher(value).replaceAll("$1[REDACTED]@");
-        Matcher matcher = NAMED_SECRET.matcher(redacted);
-        redacted = matcher.replaceAll("$1$2[REDACTED]");
-        redacted = AUTHORIZATION.matcher(redacted).replaceAll("$1[REDACTED]");
-        redacted = KNOWN_TOKEN.matcher(redacted).replaceAll("[REDACTED]");
-        return JSON_WEB_TOKEN.matcher(redacted).replaceAll("[REDACTED]");
-    }
+    /**
+     * Writes standard input on a virtual thread, so the caller can wait for or read from the
+     * process at the same time. A failure of the pipe itself is Git's doing and shows in its
+     * exit code; any other failure, such as an unreadable source file, is the command's.
+     */
+    private static final class InputFeed {
+        private final PipeOutput pipe;
 
-    private static final class BoundedOutput {
-        private final ByteArrayOutputStream bytes;
+        private final Thread writer;
 
-        private final int maximumBytes;
+        private final AtomicReference<IOException> failure;
 
-        private final MessageDigest digest = GitInventory.sha256();
+        private InputFeed(PipeOutput pipe, Thread writer, AtomicReference<IOException> failure) {
+            this.pipe = pipe;
+            this.writer = writer;
+            this.failure = failure;
+        }
 
-        private long byteCount;
+        static InputFeed start(Process process, GitCommand.Input input) {
+            PipeOutput pipe = new PipeOutput(process.getOutputStream());
+            AtomicReference<IOException> failure = new AtomicReference<>();
+            if (input == GitCommand.Input.NONE) {
+                pipe.closeQuietly();
+                return new InputFeed(pipe, null, failure);
+            }
+            Thread writer = Thread.ofVirtual().name("worldarchive-git-input").start(() -> {
+                try (pipe) {
+                    input.writeTo(pipe);
+                } catch (IOException exception) {
+                    failure.set(exception);
+                }
+            });
+            return new InputFeed(pipe, writer, failure);
+        }
 
-        private volatile boolean truncated;
+        void finish(int exitCode) throws IOException, InterruptedException {
+            if (writer == null) {
+                return;
+            }
+            writer.join();
+            IOException failed = failure.get();
+            if (failed == null || pipe.broken && exitCode != 0) {
+                return;
+            }
+            throw pipe.broken
+                    ? new IOException("Git stopped reading its input before it finished", failed)
+                    : failed;
+        }
+    }
 
-        private volatile IOException failure;
+    /** Standard input of the process; remembers whether writing to it failed. */
+    private static final class PipeOutput extends FilterOutputStream {
+        private volatile boolean broken;
 
-        private BoundedOutput(int maximumBytes) {
-            this.maximumBytes = maximumBytes;
-            bytes = new ByteArrayOutputStream(Math.min(maximumBytes, 8_192));
+        PipeOutput(OutputStream pipe) {
+            super(pipe);
         }
 
-        private void read(InputStream input) {
-            byte[] buffer = new byte[8_192];
-            try (input) {
-                int count;
-                while ((count = input.read(buffer)) >= 0) {
-                    try {
-                        byteCount = Math.addExact(byteCount, count);
-                    } catch (ArithmeticException exception) {
-                        throw new IOException("Git process output size overflowed", exception);
-                    }
-                    digest.update(buffer, 0, count);
-                    int remaining = maximumBytes - bytes.size();
-                    if (remaining > 0) {
-                        bytes.write(buffer, 0, Math.min(remaining, count));
-                    }
-                    if (count > remaining) {
-                        truncated = true;
-                    }
-                }
+        @Override
+        public void write(byte[] bytes, int offset, int length) throws IOException {
+            try {
+                out.write(bytes, offset, length);
             } catch (IOException exception) {
-                failure = exception;
+                broken = true;
+                throw exception;
             }
         }
 
-        private String text() throws IOException {
-            if (failure != null) {
-                throw new IOException("Unable to read bounded Git process output", failure);
-            }
-            return bytes.toString(StandardCharsets.UTF_8);
-        }
-
-        private boolean truncated() {
-            return truncated;
+        @Override
+        public void write(int value) throws IOException {
+            write(new byte[] {(byte) value}, 0, 1);
         }
 
-        private long byteCount() {
-            return byteCount;
+        @Override
+        public void close() throws IOException {
+            try {
+                out.close();
+            } catch (IOException exception) {
+                broken = true;
+                throw exception;
+            }
         }
 
-        private String sha256() {
-            return HexFormat.of().formatHex(digest.digest());
+        void closeQuietly() {
+            try {
+                close();
+            } catch (IOException ignored) {
+                // Git reads no input; a closed pipe changes nothing.
+            }
         }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/git/WorldGitSnapshotStore.java b/src/main/java/dev/ishaanko/worldarchive/storage/git/WorldGitSnapshotStore.java
index 2641932..0cb47f8 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/git/WorldGitSnapshotStore.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/git/WorldGitSnapshotStore.java
@@ -1,18 +1,22 @@
 package dev.ishaanko.worldarchive.storage.git;
 
-import dev.ishaanko.worldarchive.core.AsyncTasks;
+import dev.ishaanko.worldarchive.config.FolderOrigin;
+import dev.ishaanko.worldarchive.config.RemoteUrlPolicy;
+import dev.ishaanko.worldarchive.core.BackupBackend;
 import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.core.ProgressListener;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupManifest;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.ProgressListener;
 import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.support.AsyncTasks;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
 import java.nio.file.Path;
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.Comparator;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -22,125 +26,53 @@
 import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.CompletionException;
 import java.util.concurrent.CompletionStage;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.TimeUnit;
-import java.util.function.Function;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
-/** Routes every world to an isolated bare repository while retaining a legacy read fallback. */
-public final class WorldGitSnapshotStore implements GitSnapshotStore {
-    private static final String WORLD_REPOSITORY_SUFFIX = ".git";
+/**
+ * Git storage for every world: each world has its own bare repository,
+ * {@code <world id>.git} in the configured folder, and optionally its own remote. This is the
+ * entry point for Git backups; each operation runs on the executor, and cancelling its future
+ * with interruption stops the Git processes it started.
+ */
+public final class WorldGitSnapshotStore implements BackupBackend {
+    private static final String REPOSITORY_SUFFIX = ".git";
 
-    private static final String LEGACY_CHILD_ROOT_SUFFIX = ".worlds";
-
-    private final GitBackendSettings currentSettings;
-
-    private final Path repositoryRoot;
-
-    private final Optional<GitBackendSettings> legacySettings;
-
-    private final Optional<GitBackupBackend> legacyBackend;
+    private final GitBackendSettings settings;
 
     private final Map<WorldId, String> worldRemoteUrls;
 
-    private final GitBackupBackend probeBackend;
-
     private final GitCommandRunner runner;
 
     private final ExecutorService executor;
 
-    private final boolean ownsExecutor;
+    private final ConcurrentMap<WorldId, GitWorldRepository> worlds = new ConcurrentHashMap<>();
 
-    private final ConcurrentMap<WorldId, GitBackupBackend> children = new ConcurrentHashMap<>();
-
-    public WorldGitSnapshotStore(GitBackendSettings currentSettings) {
-        this(
-                currentSettings,
-                Optional.empty(),
-                Map.of(),
-                new SystemGitCommandRunner(),
-                Executors.newThreadPerTaskExecutor(
-                        Thread.ofVirtual().name("worldarchive-world-git-", 0).factory()),
-                true);
-    }
-
-    public WorldGitSnapshotStore(
-            GitBackendSettings currentSettings,
-            Optional<GitBackendSettings> legacySettings,
-            GitCommandRunner runner,
-            ExecutorService executor) {
-        this(currentSettings, legacySettings, Map.of(), runner, executor, false);
-    }
+    /** Set by the first check that finds both tools, so later backups skip the check. */
+    private final AtomicReference<GitToolHealth> workingTools = new AtomicReference<>();
 
+    /**
+     * @param settings the folder that holds the world repositories, and shared Git settings; it
+     *        has no remote, because each world's remote is given in {@code worldRemoteUrls}
+     * @param executor runs the store's work; it belongs to the caller, who also stops it
+     */
     public WorldGitSnapshotStore(
-            GitBackendSettings currentSettings,
-            Optional<GitBackendSettings> legacySettings,
+            GitBackendSettings settings,
             Map<WorldId, String> worldRemoteUrls,
             GitCommandRunner runner,
             ExecutorService executor) {
-        this(currentSettings, legacySettings, worldRemoteUrls, runner, executor, false);
-    }
-
-    private WorldGitSnapshotStore(
-            GitBackendSettings configuredSettings,
-            Optional<GitBackendSettings> configuredLegacySettings,
-            Map<WorldId, String> configuredWorldRemoteUrls,
-            GitCommandRunner runner,
-            ExecutorService executor,
-            boolean ownsExecutor) {
-        GitBackendSettings supplied = Objects.requireNonNull(configuredSettings, "currentSettings");
+        this.settings = Objects.requireNonNull(settings, "settings");
+        if (settings.remoteUrl().isPresent()) {
+            throw new IllegalArgumentException("Each world's Git remote is passed with the world, not in the settings");
+        }
+        this.worldRemoteUrls = Map.copyOf(Objects.requireNonNull(worldRemoteUrls, "worldRemoteUrls"));
         this.runner = Objects.requireNonNull(runner, "runner");
         this.executor = Objects.requireNonNull(executor, "executor");
-        this.ownsExecutor = ownsExecutor;
-        this.worldRemoteUrls = Map.copyOf(Objects.requireNonNull(
-                configuredWorldRemoteUrls,
-                "worldRemoteUrls"));
-
-        Optional<String> suppliedRemote = supplied.remoteUrl();
-        Optional<String> currentTemplate = suppliedRemote
-                .filter(GitBackendSettings::isWorldRemoteTemplate);
-        Optional<String> plainSuppliedRemote = suppliedRemote
-                .filter(remote -> !GitBackendSettings.isWorldRemoteTemplate(remote));
-        Optional<GitBackendSettings> explicitLegacy = Objects.requireNonNull(
-                configuredLegacySettings, "legacySettings");
-        explicitLegacy.ifPresent(settings -> {
-            if (settings.isolatedWorldId().isPresent()) {
-                throw new IllegalArgumentException("Legacy Git settings must not be world-isolated");
-            }
-        });
-
-        Path configuredRoot = supplied.repository();
-        boolean configuredPathIsLegacy = explicitLegacy.isEmpty() && looksLikeBareRepository(configuredRoot);
-        Path selectedRoot = configuredPathIsLegacy
-                ? legacyChildRoot(configuredRoot)
-                : configuredRoot;
-        Optional<GitBackendSettings> selectedLegacy = explicitLegacy;
-        if (configuredPathIsLegacy) {
-            selectedLegacy = Optional.of(supplied.forLegacyRepository(
-                    configuredRoot,
-                    plainSuppliedRemote));
-        }
-        if (selectedLegacy.isPresent()
-                && selectedLegacy.orElseThrow().repository().equals(selectedRoot)) {
-            selectedRoot = legacyChildRoot(selectedRoot);
-        }
-
-        this.repositoryRoot = selectedRoot.toAbsolutePath().normalize();
-        this.currentSettings = supplied.forLegacyRepository(repositoryRoot, currentTemplate);
-        this.legacySettings = selectedLegacy;
-        this.legacyBackend = selectedLegacy.map(settings -> new GitBackupBackend(
-                settings,
-                runner,
-                executor));
-        this.probeBackend = new GitBackupBackend(
-                supplied.withoutRemote(repositoryRoot.resolve(".worldarchive-probe.git")),
-                runner,
-                executor);
     }
 
     @Override
@@ -148,521 +80,256 @@ public DestinationType destinationType() {
         return DestinationType.GIT;
     }
 
-    @Override
     public CompletionStage<GitToolHealth> probeTools() {
-        return probeBackend.probeTools();
+        return submit(this::checkTools);
     }
 
+    /**
+     * Writes the snapshot on the calling thread. When the upload is cut short, the local
+     * snapshot is still returned as pending sync.
+     */
     @Override
-    public CompletionStage<DestinationResult> createBackup(
-            BackupCapture capture,
-            ProgressListener progressListener) {
+    public DestinationResult createBackup(BackupCapture capture, ProgressListener progressListener)
+            throws InterruptedException {
         Objects.requireNonNull(capture, "capture");
         Objects.requireNonNull(progressListener, "progressListener");
-        WorldId worldId = capture.manifest().worldId();
-        BackupId backupId = capture.manifest().backupId();
-        // One interruptible worker runs the whole write, so a cancellation reaches the
-        // Git thread directly and the coordinator still receives the snapshot it produced.
-        return AsyncTasks.supplyInterruptible(executor, () -> {
-            if (locateLocalBlocking(worldId, backupId) != SnapshotLocation.NONE) {
-                return DestinationResult.failed(
-                        DestinationType.GIT,
-                        "The exact Git snapshot already exists in managed storage");
-            }
-            return child(worldId).createBackupBlocking(capture, progressListener);
-        });
+        if (!settings.enabled()) {
+            return DestinationResult.skipped(DestinationType.GIT, "Git backups are turned off");
+        }
+        GitToolHealth tools = workingTools.get() != null ? workingTools.get() : checkTools();
+        if (!tools.available()) {
+            return DestinationResult.failed(DestinationType.GIT, tools.summary());
+        }
+        return world(capture.manifest().worldId()).createBackup(capture, progressListener);
     }
 
-    @Override
+    /** Every snapshot of one world, or of all worlds, newest first; one {@code for-each-ref} per world. */
     public CompletionStage<List<GitSnapshot>> listSnapshots(Optional<WorldId> worldId) {
         Objects.requireNonNull(worldId, "worldId");
-        if (worldId.isPresent()) {
-            WorldId selected = worldId.orElseThrow();
-            return child(selected).listSnapshots(worldId).thenCombine(
-                    legacySnapshots(worldId),
-                    WorldGitSnapshotStore::combineSnapshots);
-        }
-        List<CompletionStage<List<GitSnapshot>>> listings = new ArrayList<>();
-        try {
-            for (WorldId discovered : discoverWorlds()) {
-                listings.add(child(discovered).listSnapshots(Optional.of(discovered)));
+        return submit(() -> {
+            List<GitSnapshot> snapshots = new ArrayList<>();
+            for (WorldId world : worldId.isPresent() ? Set.of(worldId.get()) : discoverWorlds()) {
+                snapshots.addAll(world(world).snapshots());
             }
-        } catch (IOException exception) {
-            return CompletableFuture.failedFuture(exception);
-        }
-        legacyBackend.ifPresent(backend -> listings.add(backend.listSnapshots(Optional.empty())));
-        if (listings.isEmpty()) {
-            return CompletableFuture.completedFuture(List.of());
-        }
-        CompletableFuture<?>[] futures = listings.stream()
-                .map(CompletionStage::toCompletableFuture)
-                .toArray(CompletableFuture[]::new);
-        return CompletableFuture.allOf(futures).thenApply(ignored -> {
-            List<GitSnapshot> combined = new ArrayList<>();
-            for (CompletionStage<List<GitSnapshot>> listing : listings) {
-                combined = new ArrayList<>(combineSnapshots(
-                        combined,
-                        listing.toCompletableFuture().join()));
-            }
-            return List.copyOf(combined);
+            snapshots.sort(Comparator.comparing(GitSnapshot::committedAt).reversed());
+            return List.copyOf(snapshots);
         });
     }
 
-    /** Lists only the current isolated repository, excluding read-compatible legacy storage. */
-    public CompletionStage<List<GitSnapshot>> listCurrentSnapshots(WorldId worldId) {
-        Objects.requireNonNull(worldId, "worldId");
-        return child(worldId).listSnapshots(Optional.of(worldId));
-    }
-
-    @Override
-    public CompletionStage<GitVerification> verifySnapshot(WorldId worldId, BackupId backupId) {
-        return withLocatedLocal(
-                worldId,
-                backupId,
-                backend -> backend.verifySnapshot(worldId, backupId));
-    }
-
-    @Override
-    public CompletionStage<BackupManifest> readManifest(WorldId worldId, BackupId backupId) {
-        return withLocatedLocal(
-                worldId,
-                backupId,
-                backend -> backend.readManifest(worldId, backupId));
+    /**
+     * The manifests of several snapshots of one world, read with one Git process. A snapshot whose
+     * manifest is missing or does not match its commit is left out of the result.
+     */
+    public CompletionStage<Map<BackupId, BackupManifest>> readManifests(WorldId worldId, Collection<GitSnapshot> snapshots) {
+        List<GitSnapshot> requested = List.copyOf(Objects.requireNonNull(snapshots, "snapshots"));
+        return submit(() -> world(worldId).manifests(requested));
     }
 
-    @Override
+    /**
+     * Checks the copy a restore would use and fails when there is none. A missing or damaged
+     * local copy is replaced by the remote's when the world has a remote.
+     */
     public CompletionStage<GitVerification> verifyRestorableSnapshot(
             WorldId worldId,
             BackupId backupId,
             BackupManifest expectedManifest) {
-        Objects.requireNonNull(expectedManifest, "expectedManifest");
-        return withRestorableLocation(
-                worldId,
-                backupId,
-                backend -> backend.verifyRestorableSnapshot(
-                        worldId,
-                        backupId,
-                        expectedManifest));
+        if (!names(expectedManifest, worldId, backupId)) {
+            return mismatch();
+        }
+        return submit(() -> world(worldId).verifyRestorable(backupId, expectedManifest));
     }
 
-    @Override
-    public CompletionStage<Path> restoreSnapshot(
-            WorldId worldId,
-            BackupId backupId,
-            Path emptyStaging) {
-        Objects.requireNonNull(emptyStaging, "emptyStaging");
-        return withRestorableLocation(
-                worldId,
-                backupId,
-                backend -> backend.restoreSnapshot(worldId, backupId, emptyStaging));
+    /** Fully checks this computer's copy; a damaged copy gives an invalid verification. */
+    public CompletionStage<GitVerification> verifyCurrentSnapshot(WorldId worldId, BackupId backupId) {
+        Objects.requireNonNull(backupId, "backupId");
+        return submit(() -> world(worldId).verifyLocal(backupId));
     }
 
-    @Override
+    /**
+     * Restores a backup into an empty staging folder that the caller created and owns; each file
+     * is hashed as it is written and the whole must match the manifest. The folder is the result.
+     */
     public CompletionStage<Path> restoreSnapshot(
             WorldId worldId,
             BackupId backupId,
             BackupManifest expectedManifest,
             Path emptyStaging) {
-        Objects.requireNonNull(expectedManifest, "expectedManifest");
-        Objects.requireNonNull(emptyStaging, "emptyStaging");
-        return withRestorableLocation(
-                worldId,
-                backupId,
-                backend -> backend.restoreSnapshot(
-                        worldId,
-                        backupId,
-                        expectedManifest,
-                        emptyStaging));
-    }
-
-    @Override
-    public CompletionStage<GitBackupBackend.RestoreResult> restoreSnapshotForRecovery(
-            WorldId worldId,
-            BackupId backupId,
-            BackupManifest expectedManifest,
-            Path emptyStaging) {
-        Objects.requireNonNull(expectedManifest, "expectedManifest");
-        Objects.requireNonNull(emptyStaging, "emptyStaging");
-        return withRestorableLocation(
-                worldId,
-                backupId,
-                backend -> backend.restoreSnapshotForRecovery(
-                        worldId,
-                        backupId,
-                        expectedManifest,
-                        emptyStaging));
+        Path staging = Objects.requireNonNull(emptyStaging, "emptyStaging").toAbsolutePath().normalize();
+        if (!names(expectedManifest, worldId, backupId)) {
+            return mismatch();
+        }
+        if (staging.startsWith(settings.repository()) || settings.repository().startsWith(staging)) {
+            return CompletableFuture.failedFuture(
+                    new GitStorageException("A restore folder must be outside the Git storage folder"));
+        }
+        return submit(() -> {
+            world(worldId).restore(backupId, expectedManifest, staging);
+            return staging;
+        });
     }
 
-    @Override
-    public CompletionStage<Boolean> deleteSnapshot(WorldId worldId, BackupId backupId) {
-        return withRestorableLocation(
-                worldId,
-                backupId,
-                backend -> backend.deleteSnapshot(worldId, backupId));
+    /**
+     * Deletes several backups of one world everywhere they exist. With a remote this is one
+     * listing, one atomic push per 100 backups (a refused push changes no remote branch), and
+     * one local ref transaction; afterwards the space the backups used here is freed.
+     */
+    public CompletionStage<Map<BackupId, GitDeletion>> deleteSnapshots(WorldId worldId, Set<BackupId> backupIds) {
+        Set<BackupId> requested = Set.copyOf(Objects.requireNonNull(backupIds, "backupIds"));
+        return submit(() -> world(worldId).delete(requested));
     }
 
-    @Override
+    /** Deletes only this computer's copy and never contacts the remote. */
     public CompletionStage<Boolean> deleteLocalSnapshot(WorldId worldId, BackupId backupId) {
-        return withLocatedLocal(
-                worldId,
-                backupId,
-                backend -> backend.deleteLocalSnapshot(worldId, backupId));
-    }
-
-    /** Deletes only the current isolated local ref and never contacts a configured remote. */
-    public CompletionStage<Boolean> deleteCurrentLocalSnapshot(
-            WorldId worldId,
-            BackupId backupId) {
-        Objects.requireNonNull(worldId, "worldId");
         Objects.requireNonNull(backupId, "backupId");
-        return child(worldId).deleteLocalSnapshot(worldId, backupId);
+        return submit(() -> world(worldId).deleteLocal(backupId));
     }
 
-    /** Proves that this world's current configured remote has the exact local commit. */
-    public CompletionStage<Boolean> currentRemoteContainsSnapshot(
-            WorldId worldId,
-            BackupId backupId) {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(backupId, "backupId");
-        return child(worldId).currentRemoteContainsSnapshot(worldId, backupId);
+    /** Each backup's commit on the world's remote, from one {@code ls-remote}; empty without a remote. */
+    public CompletionStage<Map<BackupId, String>> remoteSnapshotCommits(WorldId worldId) {
+        return submit(() -> world(worldId).remoteCommits());
     }
 
+    /** Frees the space that deleted snapshots of the world used. */
     public CompletionStage<Void> compactCurrentStorage(WorldId worldId) {
-        Objects.requireNonNull(worldId, "worldId");
-        return child(worldId).compactStorage(worldId);
-    }
-
-    public CompletionStage<GitVerification> verifyCurrentSnapshot(
-            WorldId worldId,
-            BackupId backupId) {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(backupId, "backupId");
-        return child(worldId).verifySnapshot(worldId, backupId);
+        return submit(() -> {
+            world(worldId).compact();
+            return null;
+        });
     }
 
-    @Override
+    /**
+     * Downloads the LFS objects of an imported snapshot from the repository it came from, and
+     * checks it fully; the snapshot ref must still point at the imported commit.
+     */
     public CompletionStage<GitVerification> hydrateExternalSnapshot(
             WorldId worldId,
             BackupId backupId,
             BackupManifest expectedManifest,
             String expectedCommit,
             String remoteUrl) {
-        return withLocatedLocal(
-                worldId,
-                backupId,
-                backend -> backend.hydrateExternalSnapshot(
-                        worldId, backupId, expectedManifest, expectedCommit, remoteUrl));
+        if (!names(expectedManifest, worldId, backupId)
+                || expectedCommit == null
+                || !GitRepository.isObjectId(expectedCommit)) {
+            return mismatch();
+        }
+        String source;
+        try {
+            source = RemoteUrlPolicy.validatePlain(remoteUrl);
+        } catch (IllegalArgumentException exception) {
+            return CompletableFuture.failedFuture(exception);
+        }
+        return submit(() -> world(worldId).hydrate(backupId, expectedManifest, expectedCommit, source));
     }
 
-    @Override
+    /** Uploads this computer's copy to the world's remote; a remote problem leaves it pending sync. */
     public CompletionStage<DestinationResult> syncSnapshot(WorldId worldId, BackupId backupId) {
-        return withLocatedLocal(
-                worldId,
-                backupId,
-                backend -> backend.syncSnapshot(worldId, backupId));
+        Objects.requireNonNull(backupId, "backupId");
+        return submit(() -> world(worldId).sync(backupId));
     }
 
-    /** Returns the stable isolated repository path without creating it. */
+    /** The world's repository folder; nothing is created. */
     public Path repositoryFor(WorldId worldId) {
         Objects.requireNonNull(worldId, "worldId");
-        return repositoryRoot.resolve(worldId + WORLD_REPOSITORY_SUFFIX).normalize();
+        return settings.repository().resolve(worldId + REPOSITORY_SUFFIX).normalize();
     }
 
+    /** The folder that holds every world's repository. */
     public Path repositoryRoot() {
-        return repositoryRoot;
+        return settings.repository();
     }
 
-    public boolean remoteConfigured(WorldId worldId) {
-        Objects.requireNonNull(worldId, "worldId");
-        return currentRemote(worldId).isPresent()
-                || legacySettings.flatMap(GitBackendSettings::remoteUrl).isPresent();
+    /** Whether a listing of the repositories' folder sees every backup (see {@link FolderOrigin#listable}). */
+    public boolean rootListable() {
+        return settings.folderOrigin().listable(settings.repository());
     }
 
-    /** Fetches remote refs into a private repository without installing or downloading LFS data. */
-    public CompletionStage<GitPreparedImport> prepareImport(String remoteUrl) {
-        return AsyncTasks.supply(executor, () -> {
-            try {
-                return new GitHistoryImporter(currentSettings, runner).prepare(remoteUrl);
-            } catch (IOException | InterruptedException | GitStorageException exception) {
-                if (exception instanceof InterruptedException) {
-                    Thread.currentThread().interrupt();
-                }
-                throw new CompletionException(exception);
-            }
-        });
+    /** Whether the world has a remote of its own. */
+    public boolean remoteConfigured(WorldId worldId) {
+        return worldRemoteUrls.containsKey(Objects.requireNonNull(worldId, "worldId"));
     }
 
-    /** Installs only the exact commits retained by a prepared preview. */
-    public CompletionStage<Map<BackupId, GitImportInstallStatus>> installImport(
-            GitPreparedImport prepared,
-            boolean fullDownload) {
-        return installImport(prepared, prepared.candidates(), fullDownload);
+    /** Fetches a repository's WorldArchive branches into a private folder and lists its backups. */
+    public CompletionStage<GitPreparedImport> prepareImport(String remoteUrl) {
+        return submit(() -> new GitImporter(settings, runner).prepare(remoteUrl));
     }
 
-    /** Installs a chosen subset of the commits retained by a prepared preview. */
+    /**
+     * Installs chosen backups of a preview. Every snapshot is checked fully; the good ones are
+     * installed and a failed one is reported as {@link GitImportInstallStatus#FAILED}.
+     */
     public CompletionStage<Map<BackupId, GitImportInstallStatus>> installImport(
             GitPreparedImport prepared,
-            List<GitImportCandidate> candidates,
-            boolean fullDownload) {
+            List<GitImportCandidate> candidates) {
         Objects.requireNonNull(prepared, "prepared");
-        List<GitImportCandidate> selected = List.copyOf(
-                Objects.requireNonNull(candidates, "candidates"));
+        List<GitImportCandidate> selected = List.copyOf(Objects.requireNonNull(candidates, "candidates"));
         if (!prepared.candidates().containsAll(selected)) {
             return CompletableFuture.failedFuture(
                     new IllegalArgumentException("Selected Git imports are not part of this preview"));
         }
         Map<WorldId, List<GitImportCandidate>> byWorld = selected.stream()
-                .collect(java.util.stream.Collectors.groupingBy(
-                        candidate -> candidate.manifest().worldId()));
-        Map<WorldId, Set<BackupId>> completeWorlds = prepared.candidates().stream()
-                .collect(java.util.stream.Collectors.groupingBy(
-                        candidate -> candidate.manifest().worldId(),
-                        java.util.stream.Collectors.mapping(
-                                candidate -> candidate.manifest().backupId(),
-                                java.util.stream.Collectors.toSet())));
-        List<CompletionStage<Map<BackupId, GitImportInstallStatus>>> installations = byWorld
-                .entrySet().stream()
-                .map(entry -> child(entry.getKey()).installImportedSnapshots(
-                        prepared.repository(),
-                        entry.getValue(),
-                        prepared.remote(),
-                        fullDownload,
-                        entry.getValue().stream()
-                                .map(candidate -> candidate.manifest().backupId())
-                                .collect(java.util.stream.Collectors.toSet())
-                                .equals(completeWorlds.get(entry.getKey()))))
-                .toList();
-        CompletableFuture<?>[] futures = installations.stream()
-                .map(CompletionStage::toCompletableFuture)
-                .toArray(CompletableFuture[]::new);
-        return CompletableFuture.allOf(futures).thenApply(ignored -> {
-            Map<BackupId, GitImportInstallStatus> results = new HashMap<>();
-            installations.forEach(stage -> results.putAll(stage.toCompletableFuture().join()));
-            return Map.copyOf(results);
-        });
-    }
-
-    /** Recreates missing durable snapshot refs from local managed history refs only. */
-    public CompletionStage<Integer> rebuildSnapshotRefs() {
-        List<CompletionStage<Integer>> rebuilds = new ArrayList<>();
-        try {
-            for (WorldId worldId : discoverWorlds()) {
-                rebuilds.add(child(worldId).rebuildSnapshotRefs());
-            }
-        } catch (IOException exception) {
-            return CompletableFuture.failedFuture(exception);
-        }
-        legacyBackend.ifPresent(backend -> rebuilds.add(backend.rebuildSnapshotRefs()));
-        CompletableFuture<?>[] futures = rebuilds.stream()
-                .map(CompletionStage::toCompletableFuture)
-                .toArray(CompletableFuture[]::new);
-        return CompletableFuture.allOf(futures).thenApply(ignored -> rebuilds.stream()
-                .mapToInt(stage -> stage.toCompletableFuture().join())
-                .sum());
-    }
-
-    @Override
-    public void close() {
-        children.values().forEach(GitBackupBackend::close);
-        children.clear();
-        legacyBackend.ifPresent(GitBackupBackend::close);
-        probeBackend.close();
-        if (ownsExecutor) {
-            executor.shutdown();
-            boolean interrupted = false;
-            try {
-                if (!executor.awaitTermination(5, TimeUnit.SECONDS)) {
-                    executor.shutdownNow();
-                }
-            } catch (InterruptedException exception) {
-                interrupted = true;
-                executor.shutdownNow();
-            } finally {
-                if (interrupted) {
-                    Thread.currentThread().interrupt();
-                }
+                .collect(Collectors.groupingBy(candidate -> candidate.manifest().worldId()));
+        return submit(() -> {
+            Map<BackupId, GitImportInstallStatus> statuses = new HashMap<>();
+            GitImporter importer = new GitImporter(settings, runner);
+            for (Map.Entry<WorldId, List<GitImportCandidate>> world : byWorld.entrySet()) {
+                statuses.putAll(importer.install(
+                        world(world.getKey()), prepared.repository(), world.getValue(), prepared.remote()));
             }
-        }
-    }
-
-    private GitBackupBackend child(WorldId worldId) {
-        return children.computeIfAbsent(
-                Objects.requireNonNull(worldId, "worldId"),
-                selected -> new GitBackupBackend(
-                        currentSettings.forWorld(
-                                repositoryFor(selected),
-                                selected,
-                                currentRemote(selected)),
-                        runner,
-                        executor));
-    }
-
-    private CompletionStage<List<GitSnapshot>> legacySnapshots(Optional<WorldId> worldId) {
-        return legacyBackend
-                .<CompletionStage<List<GitSnapshot>>>map(backend -> backend.listSnapshots(worldId))
-                .orElseGet(() -> CompletableFuture.completedFuture(List.of()));
-    }
-
-    private CompletionStage<SnapshotLocation> locateLocal(WorldId worldId, BackupId backupId) {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(backupId, "backupId");
-        return child(worldId).listSnapshots(Optional.of(worldId)).thenCombine(
-                legacySnapshots(Optional.of(worldId)),
-                (childSnapshots, legacySnapshots) -> {
-                    try {
-                        return locate(childSnapshots, legacySnapshots, backupId);
-                    } catch (GitStorageException exception) {
-                        throw new CompletionException(exception);
-                    }
-                });
-    }
-
-    private SnapshotLocation locateLocalBlocking(WorldId worldId, BackupId backupId)
-            throws IOException, InterruptedException, GitStorageException {
-        List<GitSnapshot> childSnapshots = child(worldId).listSnapshotsBlocking(Optional.of(worldId));
-        List<GitSnapshot> legacySnapshots = legacyBackend.isPresent()
-                ? legacyBackend.orElseThrow().listSnapshotsBlocking(Optional.of(worldId))
-                : List.of();
-        return locate(childSnapshots, legacySnapshots, backupId);
-    }
-
-    private static SnapshotLocation locate(
-            List<GitSnapshot> childSnapshots,
-            List<GitSnapshot> legacySnapshots,
-            BackupId backupId) throws GitStorageException {
-        boolean childContains = contains(childSnapshots, backupId);
-        boolean legacyContains = contains(legacySnapshots, backupId);
-        if (childContains && legacyContains) {
-            throw new GitStorageException(
-                    "Git snapshot exists in both isolated and legacy repositories");
-        }
-        if (childContains) {
-            return SnapshotLocation.CHILD;
-        }
-        return legacyContains ? SnapshotLocation.LEGACY : SnapshotLocation.NONE;
-    }
-
-    /** Shared CHILD/LEGACY dispatch; the NONE case is delegated to the caller's strategy. */
-    private <T> CompletionStage<T> withLocation(
-            WorldId worldId,
-            BackupId backupId,
-            Function<GitBackupBackend, CompletionStage<T>> operation,
-            Function<WorldId, CompletionStage<T>> onNone) {
-        Objects.requireNonNull(operation, "operation");
-        Objects.requireNonNull(onNone, "onNone");
-        return locateLocal(worldId, backupId).thenCompose(location -> switch (location) {
-            case CHILD -> operation.apply(child(worldId));
-            case LEGACY -> operation.apply(legacyBackend.orElseThrow());
-            case NONE -> onNone.apply(worldId);
+            return Map.copyOf(statuses);
         });
     }
 
-    private <T> CompletionStage<T> withLocatedLocal(
-            WorldId worldId,
-            BackupId backupId,
-            Function<GitBackupBackend, CompletionStage<T>> operation) {
-        return withLocation(worldId, backupId, operation, w -> operation.apply(child(w)));
-    }
-
-    private <T> CompletionStage<T> withRestorableLocation(
-            WorldId worldId,
-            BackupId backupId,
-            Function<GitBackupBackend, CompletionStage<T>> operation) {
-        return withLocation(worldId, backupId, operation, w -> resolveAmbiguousRemote(w, operation));
-    }
-
-    private <T> CompletionStage<T> resolveAmbiguousRemote(
-            WorldId worldId,
-            Function<GitBackupBackend, CompletionStage<T>> operation) {
-        boolean childRemote = currentRemote(worldId).isPresent();
-        boolean legacyRemote = legacySettings.flatMap(GitBackendSettings::remoteUrl).isPresent();
-        if (childRemote && legacyRemote) {
-            return CompletableFuture.failedFuture(new GitStorageException(
-                    "Git snapshot location is ambiguous across configured remotes"));
-        }
-        if (legacyRemote) {
-            return operation.apply(legacyBackend.orElseThrow());
+    private GitToolHealth checkTools() throws InterruptedException {
+        GitToolHealth health = new GitToolProbe(settings, runner).probe();
+        if (health.available()) {
+            workingTools.set(health);
         }
-        return operation.apply(child(worldId));
+        return health;
     }
 
-    private Optional<String> currentRemote(WorldId worldId) {
-        String configured = worldRemoteUrls.get(Objects.requireNonNull(worldId, "worldId"));
-        if (configured != null) {
-            return Optional.of(configured);
-        }
-        return currentSettings.remoteUrl().map(template ->
-                GitBackendSettings.resolveWorldRemote(template, worldId));
+    private GitWorldRepository world(WorldId worldId) {
+        return worlds.computeIfAbsent(Objects.requireNonNull(worldId, "worldId"), world -> new GitWorldRepository(
+                world,
+                settings.withRepository(repositoryFor(world), Optional.ofNullable(worldRemoteUrls.get(world))),
+                runner));
     }
 
+    /** The worlds that have a repository folder, and the worlds this store already used. */
     private Set<WorldId> discoverWorlds() throws IOException {
-        Set<WorldId> worlds = new HashSet<>(children.keySet());
-        if (!Files.isDirectory(repositoryRoot, LinkOption.NOFOLLOW_LINKS)) {
-            return Set.copyOf(worlds);
+        Set<WorldId> discovered = new HashSet<>(worlds.keySet());
+        if (!Files.isDirectory(settings.repository(), LinkOption.NOFOLLOW_LINKS)) {
+            return discovered;
         }
-        try (Stream<Path> paths = Files.list(repositoryRoot)) {
-            for (Path path : paths.toList()) {
-                if (!Files.isDirectory(path, LinkOption.NOFOLLOW_LINKS)) {
-                    continue;
-                }
-                String name = path.getFileName().toString();
-                if (!name.endsWith(WORLD_REPOSITORY_SUFFIX)) {
-                    continue;
-                }
-                String identity = name.substring(0, name.length() - WORLD_REPOSITORY_SUFFIX.length());
-                try {
-                    worlds.add(WorldId.parse(identity));
-                } catch (IllegalArgumentException ignored) {
-                    // Unmanaged directories under the configured root are never opened.
+        try (Stream<Path> folders = Files.list(settings.repository())) {
+            for (Path folder : folders.filter(path -> Files.isDirectory(path, LinkOption.NOFOLLOW_LINKS)).toList()) {
+                String name = folder.getFileName().toString();
+                if (name.endsWith(REPOSITORY_SUFFIX)) {
+                    parseWorld(name.substring(0, name.length() - REPOSITORY_SUFFIX.length())).ifPresent(discovered::add);
                 }
             }
         }
-        return Set.copyOf(worlds);
+        return discovered;
     }
 
-    private static List<GitSnapshot> combineSnapshots(
-            List<GitSnapshot> first,
-            List<GitSnapshot> second) {
-        Map<String, GitSnapshot> byRef = new HashMap<>();
-        for (GitSnapshot snapshot : first) {
-            byRef.put(snapshot.refName(), snapshot);
-        }
-        for (GitSnapshot snapshot : second) {
-            GitSnapshot duplicate = byRef.putIfAbsent(snapshot.refName(), snapshot);
-            if (duplicate != null) {
-                throw new CompletionException(new GitStorageException(
-                        "Git snapshot exists in both isolated and legacy repositories"));
-            }
+    private static Optional<WorldId> parseWorld(String name) {
+        try {
+            return Optional.of(WorldId.parse(name));
+        } catch (IllegalArgumentException exception) {
+            return Optional.empty();
         }
-        return byRef.values().stream()
-                .sorted(Comparator.comparing(GitSnapshot::committedAt).reversed())
-                .toList();
-    }
-
-    private static boolean contains(List<GitSnapshot> snapshots, BackupId backupId) {
-        return snapshots.stream().anyMatch(snapshot -> snapshot.backupId().equals(backupId));
     }
 
-    private static boolean looksLikeBareRepository(Path path) {
-        Path normalized = Objects.requireNonNull(path, "path").toAbsolutePath().normalize();
-        return Files.isDirectory(normalized, LinkOption.NOFOLLOW_LINKS)
-                && Files.isRegularFile(normalized.resolve("HEAD"), LinkOption.NOFOLLOW_LINKS)
-                && Files.isDirectory(normalized.resolve("objects"), LinkOption.NOFOLLOW_LINKS)
-                && Files.isDirectory(normalized.resolve("refs"), LinkOption.NOFOLLOW_LINKS);
+    private static boolean names(BackupManifest manifest, WorldId worldId, BackupId backupId) {
+        return Objects.requireNonNull(manifest, "expectedManifest").worldId().equals(worldId)
+                && manifest.backupId().equals(backupId);
     }
 
-    private static Path legacyChildRoot(Path legacyRepository) {
-        Path parent = legacyRepository.getParent();
-        Path fileName = legacyRepository.getFileName();
-        if (parent == null || fileName == null) {
-            throw new IllegalArgumentException("Legacy Git repository must have a parent and name");
-        }
-        return parent.resolve(fileName + LEGACY_CHILD_ROOT_SUFFIX).toAbsolutePath().normalize();
+    private static <T> CompletionStage<T> mismatch() {
+        return CompletableFuture.failedFuture(
+                new IllegalArgumentException("The expected Git manifest or commit does not match the snapshot"));
     }
 
-    private enum SnapshotLocation {
-        NONE,
-        CHILD,
-        LEGACY
+    private <T> CompletionStage<T> submit(AsyncTasks.InterruptibleOperation<T> operation) {
+        return AsyncTasks.supplyInterruptible(executor, operation);
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupExecutor.java b/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupExecutor.java
index ac00729..2d15412 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupExecutor.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupExecutor.java
@@ -1,43 +1,52 @@
 package dev.ishaanko.worldarchive.storage.management;
 
 import dev.ishaanko.worldarchive.catalog.BackupCatalog;
-import dev.ishaanko.worldarchive.catalog.BackupDeletionRegistry;
+import dev.ishaanko.worldarchive.catalog.FileBackupDeletionRegistry;
 import dev.ishaanko.worldarchive.core.WorldOperationGate;
-import dev.ishaanko.worldarchive.model.ArtifactOwnership;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.BackupResult;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
+import dev.ishaanko.worldarchive.model.SafeText;
 import dev.ishaanko.worldarchive.model.SyncStatus;
 import dev.ishaanko.worldarchive.model.VerificationStatus;
-import dev.ishaanko.worldarchive.storage.git.GitVerification;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.storage.git.GitSnapshot;
 import dev.ishaanko.worldarchive.storage.git.WorldGitSnapshotStore;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupArtifact;
+import dev.ishaanko.worldarchive.storage.zip.ZipArchiveSize;
+import dev.ishaanko.worldarchive.support.AsyncTasks;
 import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.util.HashMap;
-import java.util.HashSet;
+import java.util.ArrayList;
+import java.util.EnumMap;
+import java.util.EnumSet;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
+import java.util.concurrent.CompletionException;
+import java.util.concurrent.CompletionStage;
+import java.util.function.UnaryOperator;
+import java.util.stream.Collectors;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
- * Applies a confirmed {@link CleanupPlan}. Cleanup frees space on this computer only.
- * It never changes the configured remote, but it does ask the remote whether a
- * synchronized snapshot is still there before the local copy goes. Such a backup keeps
- * its catalog record as a remote-only entry; a backup with no copy left anywhere
- * leaves the catalog.
+ * Applies a confirmed {@link CleanupPlan}. Cleanup frees space on this computer only: it never
+ * changes the world's remote, but asks it once whether each synchronized snapshot is still there
+ * before the local copy goes. The catalog changes first, in one write; then the local Git
+ * snapshots and ZIP archives go, and one more write lists again any copy that could not be
+ * deleted. A backup that keeps a copy on the remote stays listed as a remote-only entry, and a
+ * backup with no copy left leaves the catalog.
  */
 final class CleanupExecutor {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
     private final BackupCatalog catalog;
 
-    private final BackupDeletionRegistry deletions;
+    private final FileBackupDeletionRegistry deletions;
 
     private final WorldGitSnapshotStore git;
 
@@ -47,7 +56,7 @@ final class CleanupExecutor {
 
     CleanupExecutor(
             BackupCatalog catalog,
-            BackupDeletionRegistry deletions,
+            FileBackupDeletionRegistry deletions,
             WorldGitSnapshotStore git,
             WorldOperationGate operationGate,
             StorageOverviewBuilder overviewBuilder) {
@@ -59,356 +68,298 @@ final class CleanupExecutor {
     }
 
     CleanupResult apply(CleanupPlan plan, CleanupRequest request) throws Exception {
-        Map<BackupId, CleanupItem> prepared = new HashMap<>();
-        plan.items().forEach(item -> prepared.put(item.backupId(), item));
-        validateSelection(plan, request, prepared);
-        try (WorldOperationGate.Permit ignored = operationGate.enter(plan.worldId())) {
-            Snapshot current = overviewBuilder.snapshot(plan.worldId());
-            if (!current.fingerprint().equals(plan.fingerprint())) {
+        List<CleanupItem> selected = selection(plan, request);
+        WorldId worldId = plan.worldId();
+        try (WorldOperationGate.Permit ignored = operationGate.enter(worldId)) {
+            Snapshot before = overviewBuilder.snapshot(worldId);
+            if (!before.fingerprint().equals(plan.fingerprint())) {
                 throw new IOException("Storage changed after the preview; review cleanup again");
             }
-            requireVerifiedSafetyFloor(current, plan.verifiedSafetyFloor());
-            requireCurrentRemoteCopies(plan, request, current);
-            long before = current.totalBytes();
+            requireVerifiedSafetyFloor(before, plan.verifiedSafetyFloor());
             Map<BackupId, String> failures = new LinkedHashMap<>();
-            boolean removedGit = applyItems(plan, request, current, failures);
-            if (removedGit) {
-                try {
-                    ManagedStorageSupport.await(git.compactCurrentStorage(plan.worldId()));
-                } catch (InterruptedException exception) {
-                    Thread.currentThread().interrupt();
-                    throw exception;
-                } catch (Exception exception) {
-                    // Compaction belongs to no single backup; attach it to the first selected
-                    // Git removal so the result screen still shows it.
-                    failures.merge(
-                            plan.items().stream()
-                                    .filter(CleanupItem::removeGit)
-                                    .map(CleanupItem::backupId)
-                                    .filter(request.selectedBackups()::contains)
-                                    .findFirst()
-                                    .orElseThrow(),
-                            "Git cleanup completed but compaction failed: "
-                                    + safeMessage(exception),
-                            (first, second) -> first + " " + second);
-                }
+            List<CleanupItem> items = withRemoteCopies(worldId, before, selected, failures);
+            unlist(before, items);
+            Map<BackupId, Set<DestinationType>> kept = deleteCopies(worldId, before, items, failures);
+            List<String> warnings = new ArrayList<>();
+            relist(before, kept, warnings);
+            boolean gitDeleted = items.stream().anyMatch(item -> item.removeGit()
+                    && !kept.getOrDefault(item.backupId(), Set.of()).contains(DestinationType.GIT));
+            if (gitDeleted) {
+                compact(worldId, warnings);
             }
-            Snapshot after = overviewBuilder.snapshot(plan.worldId());
-            overviewBuilder.build(after, true);
-            return new CleanupResult(
-                    plan.worldId(),
-                    before,
-                    after.totalBytes(),
-                    failures);
+            long after = measureAfter(before, items, kept, warnings);
+            overviewBuilder.recordSample(worldId, after);
+            return new CleanupResult(before.totalBytes(), after, failures,
+                    warnings.isEmpty() ? Optional.empty() : Optional.of(String.join(" ", warnings)));
         }
     }
 
-    private static void validateSelection(
-            CleanupPlan plan,
-            CleanupRequest request,
-            Map<BackupId, CleanupItem> prepared) throws IOException {
-        boolean removesSafetyFloor = request.selectedBackups().stream()
-                .filter(prepared::containsKey)
-                .map(prepared::get)
-                .anyMatch(item -> item.backupId().equals(plan.verifiedSafetyFloor())
-                        && item.removesRestorePoint());
-        if (!prepared.keySet().containsAll(request.selectedBackups())
-                || removesSafetyFloor) {
-            throw new IOException("Cleanup selection does not match its preview");
+    /**
+     * The selected items, which must come from the plan. The protected backups whose local Git
+     * copies the plan groups together are selected all at once or not at all, so the space the
+     * preview promised is what the group frees.
+     */
+    private static List<CleanupItem> selection(CleanupPlan plan, CleanupRequest request) throws IOException {
+        Set<BackupId> planned = plan.items().stream().map(CleanupItem::backupId).collect(Collectors.toSet());
+        if (!planned.containsAll(request.selectedBackups())) {
+            throw new IOException("The cleanup selection does not match its preview; review cleanup again");
         }
-        // Protected backups lose their local Git copies as one group: the space only
-        // comes back once none of them keeps the shared history alive.
         Set<BackupId> gitGroup = plan.items().stream()
-                .filter(CleanupItem::removeGit)
+                .filter(item -> item.removeGit() && plan.protectedBackups().contains(item.backupId()))
                 .map(CleanupItem::backupId)
-                .filter(plan.protectedBackups()::contains)
-                .collect(java.util.stream.Collectors.toSet());
-        boolean someGitSelected = request.selectedBackups().stream()
-                .anyMatch(gitGroup::contains);
-        if (someGitSelected && !request.selectedBackups().containsAll(gitGroup)) {
-            throw new IOException(
-                    "Shared Git history must be selected or retained as one local group");
+                .collect(Collectors.toSet());
+        boolean partOfGroup = request.selectedBackups().stream().anyMatch(gitGroup::contains);
+        if (partOfGroup && !request.selectedBackups().containsAll(gitGroup)) {
+            throw new IOException("Select every protected backup whose local Git copy is offered, or none of them");
         }
+        return plan.items().stream().filter(item -> request.selectedBackups().contains(item.backupId())).toList();
     }
 
-    private boolean applyItems(
-            CleanupPlan plan,
-            CleanupRequest request,
-            Snapshot current,
-            Map<BackupId, String> failures) throws InterruptedException {
-        boolean removedGit = false;
-        for (CleanupItem item : plan.items()) {
-            if (!request.selectedBackups().contains(item.backupId())) {
-                continue;
-            }
+    /** The newest verified backup must still verify before anything goes. */
+    private void requireVerifiedSafetyFloor(Snapshot snapshot, BackupId safetyFloor) throws Exception {
+        BackupRecord record = snapshot.record(safetyFloor).orElseThrow(() -> unverifiedFloor());
+        ZipArchiveSize archive = snapshot.zipArchives().get(safetyFloor);
+        if (archive != null && verified(record, DestinationType.ZIP)) {
             try {
-                if (item.removeGit()) {
-                    boolean remoteCopy = requireRemoteCopyPromisedByPreview(
-                            plan, current, item.backupId());
-                    ManagedStorageSupport.await(git.deleteCurrentLocalSnapshot(
-                            plan.worldId(),
-                            item.backupId()));
-                    // A proven remote copy keeps the catalog record, so the backup stays
-                    // visible, verifiable, and deletable with Delete.
-                    removeDestination(item.backupId(), DestinationType.GIT, remoteCopy);
-                    removedGit = true;
-                }
-                if (item.removeZip()) {
-                    removeZip(current, item.backupId());
+                if (snapshot.zipStore().verify(archive.archivePath()).valid()) {
+                    return;
                 }
-            } catch (InterruptedException exception) {
-                Thread.currentThread().interrupt();
-                throw exception;
-            } catch (Exception exception) {
-                failures.put(item.backupId(), safeMessage(exception));
+            } catch (IOException unreadable) {
+                // The Git copy may still prove the backup below.
             }
         }
-        return removedGit;
-    }
-
-    void requireVerifiedSafetyFloor(
-            Snapshot snapshot,
-            BackupId safetyFloor) throws Exception {
-        BackupRecord record = ManagedStorageSupport.record(snapshot, safetyFloor);
-        DestinationResult zip = ManagedStorageSupport.destination(record, DestinationType.ZIP)
-                .orElse(null);
-        ZipBackupArtifact artifact = snapshot.zipArtifacts().get(safetyFloor);
-        if (zip != null
-                && artifact != null
-                && zip.verificationStatus() == VerificationStatus.VERIFIED
-                && snapshot.zipStore().verify(artifact.archivePath()).valid()) {
+        if (snapshot.localGitSnapshots().containsKey(safetyFloor) && verified(record, DestinationType.GIT)
+                && AsyncTasks.await(git.verifyCurrentSnapshot(snapshot.world().worldId(), safetyFloor)).valid()) {
             return;
         }
-        DestinationResult gitDestination = ManagedStorageSupport.destination(
-                        record, DestinationType.GIT)
-                .orElse(null);
-        if (gitDestination != null
-                && snapshot.localGitSnapshots().containsKey(safetyFloor)
-                && gitDestination.verificationStatus() == VerificationStatus.VERIFIED) {
-            GitVerification verification = ManagedStorageSupport.await(
-                    git.verifyCurrentSnapshot(snapshot.world().worldId(), safetyFloor));
-            if (verification.valid()) {
-                return;
-            }
-        }
-        throw new IOException("The protected local backup could not be verified");
+        throw unverifiedFloor();
     }
 
-    Optional<Set<BackupId>> protectedRemoteCopiesForGitRemoval(
+    /**
+     * Keeps the items whose promised remote copy the remote still has, with one listing. An item
+     * whose remote copy is gone, or cannot be checked, fails with nothing of it deleted.
+     */
+    private List<CleanupItem> withRemoteCopies(
+            WorldId worldId,
             Snapshot snapshot,
-            Set<BackupId> protectedIds,
-            BackupId safetyFloor) throws InterruptedException {
-        if (snapshot.localGitSnapshots().isEmpty()) {
-            return Optional.empty();
-        }
-        for (BackupId backupId : snapshot.localGitSnapshots().keySet()) {
-            Optional<BackupRecord> stored = snapshot.records().stream()
-                    .filter(record -> record.manifest().backupId().equals(backupId))
-                    .findFirst();
-            if (stored.isEmpty()
-                    || ManagedStorageSupport.destination(
-                                    stored.orElseThrow(), DestinationType.GIT)
-                            .filter(result ->
-                                    result.ownership() == ArtifactOwnership.MANAGED)
-                            .isEmpty()) {
-                return Optional.empty();
-            }
+            List<CleanupItem> selected,
+            Map<BackupId, String> failures) throws InterruptedException {
+        List<CleanupItem> relying = selected.stream()
+                .filter(item -> item.removeGit() && keepsRemoteCopy(snapshot, item.backupId()))
+                .toList();
+        if (relying.isEmpty()) {
+            return selected;
         }
-        BackupRecord safety = ManagedStorageSupport.record(snapshot, safetyFloor);
-        DestinationResult verifiedZip = ManagedStorageSupport.destination(
-                        safety, DestinationType.ZIP)
-                .filter(result -> result.verificationStatus() == VerificationStatus.VERIFIED)
-                .orElse(null);
-        if (verifiedZip == null || !snapshot.zipArtifacts().containsKey(safetyFloor)) {
-            return Optional.empty();
+        Map<BackupId, String> commits;
+        try {
+            commits = git.remoteConfigured(worldId) ? AsyncTasks.await(git.remoteSnapshotCommits(worldId)) : Map.of();
+        } catch (InterruptedException interrupted) {
+            throw interrupted;
+        } catch (Exception unreachable) {
+            String reason = "The Git remote could not be reached, so nothing of this backup was deleted ("
+                    + SafeText.from(unreachable, "no answer", 300) + "). Connect to the network and review cleanup again.";
+            relying.forEach(item -> failures.put(item.backupId(), reason));
+            return selected.stream().filter(item -> !relying.contains(item)).toList();
         }
-        Set<BackupId> remoteCopies = new HashSet<>();
-        for (BackupId backupId : snapshot.localGitSnapshots().keySet()) {
-            if (!protectedIds.contains(backupId)) {
-                continue;
-            }
-            BackupRecord protectedRecord = ManagedStorageSupport.record(snapshot, backupId);
-            boolean zipRemains = ManagedStorageSupport.managedDestination(
-                            protectedRecord,
-                            DestinationType.ZIP)
-                    && snapshot.zipArtifacts().containsKey(backupId);
-            if (!zipRemains) {
-                if (ManagedStorageSupport.destination(protectedRecord, DestinationType.GIT)
-                        .filter(result ->
-                                result.ownership() == ArtifactOwnership.MANAGED
-                                        && result.syncStatus() == SyncStatus.SYNCED)
-                        .isEmpty()) {
-                    return Optional.empty();
-                }
-                if (!currentRemoteContainsSnapshot(snapshot, backupId)) {
-                    return Optional.empty();
-                }
-                remoteCopies.add(backupId);
+        List<CleanupItem> confirmed = new ArrayList<>(selected);
+        for (CleanupItem item : relying) {
+            GitSnapshot local = snapshot.localGitSnapshots().get(item.backupId());
+            if (!local.commitId().equals(commits.get(item.backupId()))) {
+                failures.put(item.backupId(), git.remoteConfigured(worldId)
+                        ? "The Git remote no longer has this backup, so nothing of it was deleted. Review cleanup again."
+                        : "This world has no Git remote in its settings, so the copy there cannot be checked and"
+                                + " nothing of this backup was deleted.");
+                confirmed.remove(item);
             }
         }
-        return Optional.of(Set.copyOf(remoteCopies));
+        return confirmed;
     }
 
-    private boolean currentRemoteContainsSnapshot(Snapshot snapshot, BackupId backupId)
-            throws InterruptedException {
-        try {
-            return ManagedStorageSupport.await(git.currentRemoteContainsSnapshot(
-                    snapshot.world().worldId(), backupId));
-        } catch (InterruptedException exception) {
-            Thread.currentThread().interrupt();
-            throw exception;
-        } catch (Exception exception) {
-            return false;
-        }
+    /** The catalog first, in one write; backups that leave it are marked deleted. */
+    private void unlist(Snapshot snapshot, List<CleanupItem> items) throws IOException {
+        Map<BackupId, UnaryOperator<Optional<BackupRecord>>> changes = new LinkedHashMap<>();
+        items.forEach(item -> changes.put(item.backupId(), current -> current
+                .map(record -> withoutCopies(snapshot, record, item))
+                .filter(record -> record.result().destinations().stream().anyMatch(DestinationResult::isDurable))));
+        Map<BackupId, Optional<BackupRecord>> after = catalog.updateAll(changes);
+        deletions.mark(after.entrySet().stream()
+                .filter(entry -> entry.getValue().isEmpty())
+                .map(Map.Entry::getKey)
+                .toList());
     }
 
     /**
-     * The preview promised "another copy still exists" for a synchronized backup. This
-     * proves it against the configured remote before the local ref goes, because the
-     * check compares the remote commit with the local one. A remote that has lost the
-     * snapshot, or cannot be reached, fails the item with nothing deleted: cleanup is
-     * never more destructive than what the user confirmed.
+     * The record without the copies that the item deletes, and without copies whose files were
+     * already gone; a Git copy that the remote still has stays listed.
      */
-    private boolean requireRemoteCopyPromisedByPreview(
-            CleanupPlan plan,
-            Snapshot snapshot,
-            BackupId backupId) throws Exception {
-        if (!ManagedStorageSupport.synchronizedRemoteCopy(
-                ManagedStorageSupport.record(snapshot, backupId))) {
-            return false;
-        }
-        if (!ManagedStorageSupport.await(git.currentRemoteContainsSnapshot(
-                plan.worldId(), backupId))) {
-            throw new IOException(
-                    "The configured remote no longer has this backup; review cleanup again");
-        }
-        return true;
+    private static BackupRecord withoutCopies(Snapshot snapshot, BackupRecord record, CleanupItem item) {
+        BackupId backupId = record.manifest().backupId();
+        boolean zipOnDisk = snapshot.zipArchives().containsKey(backupId) && !item.removeZip();
+        boolean gitStaysListed = keepsRemoteCopy(snapshot, backupId)
+                || snapshot.localGitSnapshots().containsKey(backupId) && !item.removeGit();
+        List<DestinationResult> kept = record.result().destinations().stream()
+                .filter(destination -> !destination.isDurable() || switch (destination.destination()) {
+                    case GIT -> gitStaysListed || destination.syncStatus() == SyncStatus.SYNCED && !item.removeGit();
+                    case ZIP -> zipOnDisk;
+                })
+                .toList();
+        return new BackupRecord(record.manifest(), new BackupResult(
+                backupId, record.manifest().worldId(), kept, record.result().completedAt()));
     }
 
-    /** A protected backup may lose its last local copy only if the remote provably has it. */
-    private void requireCurrentRemoteCopies(
-            CleanupPlan plan,
-            CleanupRequest request,
-            Snapshot snapshot) throws Exception {
-        for (CleanupItem item : plan.items()) {
-            if (!request.selectedBackups().contains(item.backupId())
-                    || !item.removeGit()
-                    || !plan.protectedBackups().contains(item.backupId())) {
-                continue;
-            }
-            BackupRecord protectedRecord = ManagedStorageSupport.record(
-                    snapshot, item.backupId());
-            boolean zipRemains = !item.removeZip()
-                    && ManagedStorageSupport.managedDestination(
-                            protectedRecord, DestinationType.ZIP)
-                    && snapshot.zipArtifacts().containsKey(item.backupId());
-            if (zipRemains) {
-                continue;
+    /**
+     * Deletes each item's copies; returns, per backup, the kinds of copy that could not be deleted.
+     * A failed delete keeps its copy even when the file seems gone: a drive that is away cannot
+     * show that it is.
+     */
+    private Map<BackupId, Set<DestinationType>> deleteCopies(
+            WorldId worldId,
+            Snapshot snapshot,
+            List<CleanupItem> items,
+            Map<BackupId, String> failures) {
+        Map<BackupId, Set<DestinationType>> kept = new LinkedHashMap<>();
+        for (CleanupItem item : items) {
+            if (item.removeGit()) {
+                try {
+                    join(git.deleteLocalSnapshot(worldId, item.backupId()));
+                } catch (Exception failure) {
+                    keep(kept, failures, item.backupId(), DestinationType.GIT, failure);
+                }
             }
-            DestinationResult gitDestination = ManagedStorageSupport.destination(
-                            protectedRecord, DestinationType.GIT)
-                    .filter(result ->
-                            result.ownership() == ArtifactOwnership.MANAGED)
-                    .orElseThrow(() -> new IOException(
-                            "Protected Git ownership changed after the preview"));
-            if (gitDestination.syncStatus() != SyncStatus.SYNCED
-                    || !ManagedStorageSupport.await(git.currentRemoteContainsSnapshot(
-                            plan.worldId(), item.backupId()))) {
-                throw new IOException(
-                        "The configured remote changed after the cleanup preview");
+            ZipArchiveSize archive = snapshot.zipArchives().get(item.backupId());
+            if (item.removeZip() && archive != null) {
+                try {
+                    snapshot.zipStore().delete(archive.archivePath());
+                } catch (IOException failure) {
+                    keep(kept, failures, item.backupId(), DestinationType.ZIP, failure);
+                }
             }
         }
+        return kept;
+    }
+
+    private static void keep(
+            Map<BackupId, Set<DestinationType>> kept,
+            Map<BackupId, String> failures,
+            BackupId backupId,
+            DestinationType type,
+            Exception failure) {
+        kept.computeIfAbsent(backupId, ignored -> EnumSet.noneOf(DestinationType.class)).add(type);
+        failures.merge(backupId, SafeText.from(failure, "The copy could not be deleted", 300), (first, second) ->
+                first + " " + second);
     }
 
-    private void removeZip(Snapshot snapshot, BackupId backupId) throws Exception {
-        ZipBackupArtifact artifact = snapshot.zipArtifacts().get(backupId);
-        if (artifact == null) {
-            throw new IOException("Previewed ZIP artifact is no longer available");
+    /**
+     * Lists again, in one write, each copy that could not be deleted, and unmarks its backup. Each
+     * write is tried even when the other fails: an unmarked backup comes back with Find Stored
+     * Backups, and a listed one stays listed.
+     */
+    private void relist(Snapshot snapshot, Map<BackupId, Set<DestinationType>> kept, List<String> warnings) {
+        if (kept.isEmpty()) {
+            return;
         }
-        BackupRecord previous = catalog.find(backupId)
-                .orElseThrow(() -> new IOException("Cleanup catalog record disappeared"));
-        removeDestination(backupId, DestinationType.ZIP, false);
+        Map<BackupId, UnaryOperator<Optional<BackupRecord>>> changes = new LinkedHashMap<>();
+        kept.forEach((backupId, types) -> {
+            BackupRecord previous = snapshot.record(backupId).orElseThrow();
+            changes.put(backupId, current -> Optional.of(withCopiesOf(current, previous, types)));
+        });
+        boolean unmarked = unmark(kept.keySet());
         try {
-            snapshot.zipStore().delete(artifact);
-        } catch (IOException | RuntimeException exception) {
-            if (Files.notExists(artifact.archivePath(), LinkOption.NOFOLLOW_LINKS)) {
-                // The archive is gone, so the backup is deleted even though the sidecar
-                // failed; the catalog already agrees. Leave nothing behind if possible.
-                try {
-                    Files.deleteIfExists(artifact.checksumPath());
-                } catch (IOException | RuntimeException sidecarFailure) {
-                    exception.addSuppressed(sidecarFailure);
-                }
-                return;
-            }
-            if (snapshot.zipStore().verify(artifact.archivePath()).valid()) {
-                restoreRecord(previous, exception);
-            }
-            throw exception;
+            catalog.updateAll(changes);
+        } catch (IOException failure) {
+            String next = unmarked
+                    ? "use Import > Find Stored Backups to list them again."
+                    : "their files are kept, but they are still marked deleted. Remove their lines, which the game"
+                            + " log names, from deleted-backups.txt, then use Import > Find Stored Backups.";
+            warnings.add("Some copies that could not be deleted are no longer listed ("
+                    + SafeText.from(failure, "the backup list could not be saved", 300) + "); " + next);
         }
     }
 
-    private void restoreRecord(BackupRecord previous, Exception deletionFailure) {
-        BackupId backupId = previous.manifest().backupId();
+    /** Unmarks the backups that keep a copy; false when they stay marked, which the log then names. */
+    private boolean unmark(Set<BackupId> backupIds) {
         try {
-            if (catalog.update(backupId, ignored -> previous).isEmpty()) {
-                catalog.add(previous);
-            }
-        } catch (IOException | RuntimeException rollbackFailure) {
-            deletionFailure.addSuppressed(rollbackFailure);
+            deletions.unmark(backupIds);
+            return true;
+        } catch (IOException failure) {
+            LOGGER.warn("Backups {} kept a copy but are still marked deleted, so a rebuild of the backup list"
+                    + " will not list them again: {}", backupIds, failure.toString());
+            return false;
         }
+    }
+
+    /** The record as listed now, or none, with the given kinds of copy as they were listed before cleanup. */
+    private static BackupRecord withCopiesOf(
+            Optional<BackupRecord> current,
+            BackupRecord previous,
+            Set<DestinationType> types) {
+        Map<DestinationType, DestinationResult> destinations = new EnumMap<>(DestinationType.class);
+        current.ifPresent(record -> record.result().destinations()
+                .forEach(destination -> destinations.put(destination.destination(), destination)));
+        previous.result().destinations().stream()
+                .filter(destination -> types.contains(destination.destination()))
+                .forEach(destination -> destinations.put(destination.destination(), destination));
+        return new BackupRecord(previous.manifest(), new BackupResult(previous.manifest().backupId(),
+                previous.manifest().worldId(), List.copyOf(destinations.values()), previous.result().completedAt()));
+    }
+
+    /** Frees the space of the deleted snapshots once; a failure is a warning, the backups are gone. */
+    private void compact(WorldId worldId, List<String> warnings) {
         try {
-            deletions.restore(backupId);
-        } catch (IOException | RuntimeException rollbackFailure) {
-            deletionFailure.addSuppressed(rollbackFailure);
+            join(git.compactCurrentStorage(worldId));
+        } catch (Exception failure) {
+            warnings.add("The backups were deleted, but Git could not free their space yet ("
+                    + SafeText.from(failure, "Git failed", 300) + "); the next cleanup or delete tries again.");
         }
     }
 
-    private void removeDestination(
-            BackupId backupId,
-            DestinationType type,
-            boolean keep) throws IOException {
-        if (keep) {
-            return;
+    /** The storage after cleanup: the ZIP sizes known before minus what went, and the repository measured again. */
+    private long measureAfter(
+            Snapshot before,
+            List<CleanupItem> items,
+            Map<BackupId, Set<DestinationType>> kept,
+            List<String> warnings) {
+        long zipBytes = before.zipBytes();
+        for (CleanupItem item : items) {
+            boolean zipDeleted = item.removeZip()
+                    && !kept.getOrDefault(item.backupId(), Set.of()).contains(DestinationType.ZIP);
+            zipBytes -= zipDeleted ? item.exactZipBytes() : 0;
         }
-        BackupRecord current = catalog.find(backupId)
-                .orElseThrow(() -> new IOException("Cleanup catalog record disappeared"));
-        List<DestinationResult> remaining = current.result().destinations().stream()
-                .filter(result -> result.destination() != type)
-                .toList();
-        if (remaining.isEmpty()) {
-            deletions.record(backupId);
-            try {
-                if (!catalog.remove(backupId)) {
-                    throw new IOException("Cleanup catalog record disappeared");
-                }
-            } catch (IOException | RuntimeException exception) {
-                try {
-                    deletions.restore(backupId);
-                } catch (IOException rollbackFailure) {
-                    exception.addSuppressed(rollbackFailure);
-                }
-                throw exception;
-            }
-            return;
+        long gitBytes = before.gitBytes();
+        try {
+            gitBytes = overviewBuilder.repositoryBytes(before.world().worldId());
+        } catch (IOException | ArithmeticException failure) {
+            warnings.add("The space used after cleanup could not be measured ("
+                    + SafeText.from(failure, "the Git folder cannot be read", 300) + ").");
         }
-        catalog.update(backupId, record -> new BackupRecord(
-                record.manifest(),
-                BackupResult.aggregate(
-                        record.manifest().backupId(),
-                        record.manifest().worldId(),
-                        remaining,
-                        record.result().completedAt())));
+        return Math.max(0, zipBytes) + gitBytes;
+    }
+
+    /** True when the backup's own Git snapshot is on the remote, so its entry stays listed without a local copy. */
+    private static boolean keepsRemoteCopy(Snapshot snapshot, BackupId backupId) {
+        return snapshot.record(backupId).filter(ManagedStorageSupport::synchronizedRemoteCopy).isPresent();
+    }
+
+    private static boolean verified(BackupRecord record, DestinationType type) {
+        return ManagedStorageSupport.destination(record, type)
+                .filter(destination -> destination.verificationStatus() == VerificationStatus.VERIFIED)
+                .isPresent();
     }
 
-    private static String safeMessage(Exception exception) {
-        String message = exception.getMessage();
-        if (message == null || message.isBlank()) {
-            return exception.getClass().getSimpleName();
+    private static IOException unverifiedFloor() {
+        return new IOException("The newest verified backup could not be verified again, so nothing was deleted."
+                + " Verify it, then review cleanup again.");
+    }
+
+    /** Waits for Git work without being interruptible, so a started delete always reports its outcome. */
+    private static <T> T join(CompletionStage<T> stage) throws Exception {
+        try {
+            return stage.toCompletableFuture().join();
+        } catch (CompletionException failure) {
+            if (failure.getCause() instanceof Exception cause) {
+                throw cause;
+            }
+            throw failure;
         }
-        String redacted = SensitiveDataRedactor.redact(message);
-        return redacted.length() > 200
-                ? redacted.substring(0, 199) + "…"
-                : redacted;
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupItem.java b/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupItem.java
index b1a5321..e8a8655 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupItem.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupItem.java
@@ -6,17 +6,18 @@
 import java.util.Optional;
 
 /**
- * One local cleanup action shown before confirmation. {@code removeGit} drops the Git
- * copy on this computer only; a copy on the configured remote is never touched and
- * keeps the backup listed. A backup with no copy left anywhere leaves the catalog.
+ * One backup in a cleanup preview and the copies on this computer that cleanup would delete.
+ * A copy on the world's remote is never touched and keeps the backup listed; a backup with no
+ * copy left anywhere leaves the catalog, which {@code removesRestorePoint} warns about.
+ *
+ * @param gitRef the local Git snapshot to delete, if any
+ * @param zipArtifactId the ZIP archive to delete, as the catalog names it, if any
  */
 public record CleanupItem(
         BackupId backupId,
         Instant createdAt,
         Optional<String> label,
         long changedFileCount,
-        boolean removeGit,
-        boolean removeZip,
         Optional<String> gitRef,
         Optional<String> zipArtifactId,
         long estimatedGitBytes,
@@ -25,20 +26,25 @@ public record CleanupItem(
     public CleanupItem {
         Objects.requireNonNull(backupId, "backupId");
         Objects.requireNonNull(createdAt, "createdAt");
-        label = Objects.requireNonNull(label, "label");
-        gitRef = Objects.requireNonNull(gitRef, "gitRef");
-        zipArtifactId = Objects.requireNonNull(zipArtifactId, "zipArtifactId");
+        Objects.requireNonNull(label, "label");
+        Objects.requireNonNull(gitRef, "gitRef");
+        Objects.requireNonNull(zipArtifactId, "zipArtifactId");
         if (changedFileCount < 0 || estimatedGitBytes < 0 || exactZipBytes < 0) {
             throw new IllegalArgumentException("Cleanup counts must not be negative");
         }
-        if (!removeGit && !removeZip) {
-            throw new IllegalArgumentException("Cleanup item must remove at least one local artifact");
-        }
-        if (removeGit != gitRef.isPresent() || removeZip != zipArtifactId.isPresent()) {
-            throw new IllegalArgumentException("Cleanup artifact identities do not match their actions");
+        if (gitRef.isEmpty() && zipArtifactId.isEmpty()) {
+            throw new IllegalArgumentException("A cleanup item must delete at least one copy");
         }
     }
 
+    public boolean removeGit() {
+        return gitRef.isPresent();
+    }
+
+    public boolean removeZip() {
+        return zipArtifactId.isPresent();
+    }
+
     public long estimatedReclaimableBytes() {
         return Math.addExact(estimatedGitBytes, exactZipBytes);
     }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupPlan.java b/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupPlan.java
index 97b3807..b000e1c 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupPlan.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupPlan.java
@@ -1,7 +1,7 @@
 package dev.ishaanko.worldarchive.storage.management;
 
-import dev.ishaanko.worldarchive.core.OperationId;
 import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.OperationId;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.time.Instant;
 import java.util.List;
@@ -14,7 +14,6 @@ public record CleanupPlan(
         WorldId worldId,
         Instant expiresAt,
         long currentBytes,
-        long budgetBytes,
         long targetBytes,
         List<CleanupItem> items,
         Set<BackupId> protectedBackups,
@@ -25,7 +24,7 @@ public record CleanupPlan(
         Objects.requireNonNull(confirmationToken, "confirmationToken");
         Objects.requireNonNull(worldId, "worldId");
         Objects.requireNonNull(expiresAt, "expiresAt");
-        if (currentBytes < 0 || budgetBytes < 0 || targetBytes < 0) {
+        if (currentBytes < 0 || targetBytes < 0) {
             throw new IllegalArgumentException("Cleanup plan sizes must not be negative");
         }
         items = List.copyOf(Objects.requireNonNull(items, "items"));
@@ -39,12 +38,4 @@ public record CleanupPlan(
             throw new IllegalArgumentException("Cleanup fingerprint must not be blank");
         }
     }
-
-    public long estimatedReclaimableBytes() {
-        long total = 0;
-        for (CleanupItem item : items) {
-            total = Math.addExact(total, item.estimatedReclaimableBytes());
-        }
-        return total;
-    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupPlanner.java b/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupPlanner.java
index 704ecf7..c728edb 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupPlanner.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupPlanner.java
@@ -1,94 +1,96 @@
 package dev.ishaanko.worldarchive.storage.management;
 
 import dev.ishaanko.worldarchive.config.StoragePolicy;
-import dev.ishaanko.worldarchive.core.OperationId;
 import dev.ishaanko.worldarchive.model.ArtifactOwnership;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.OperationId;
+import dev.ishaanko.worldarchive.model.SafeText;
 import dev.ishaanko.worldarchive.model.VerificationStatus;
 import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupArtifact;
+import dev.ishaanko.worldarchive.storage.git.GitSnapshot;
 import java.io.IOException;
 import java.time.Clock;
 import java.time.Duration;
-import java.time.Instant;
 import java.time.ZoneId;
 import java.util.Comparator;
+import java.util.HashSet;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
-/** Computes a {@link CleanupPlan} preview from a storage {@link Snapshot}. */
+/**
+ * Builds a cleanup preview from a storage {@link Snapshot}. Every decision uses the copies that are
+ * on disk, so a backup whose other copy is already gone is shown as losing its last restore point.
+ */
 final class CleanupPlanner {
-    private static final Duration CONFIRMATION_LIFETIME = Duration.ofMinutes(15);
-
-    /** Cleanup targets 90% of budget, leaving headroom before the next review. */
-    private static final long CLEANUP_TARGET_BUDGET_NUMERATOR = 9;
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
 
-    private static final long CLEANUP_TARGET_BUDGET_DENOMINATOR = 10;
+    private static final Duration CONFIRMATION_LIFETIME = Duration.ofMinutes(15);
 
-    private final CleanupExecutor executor;
+    /** Cleanup targets 90% of the budget, leaving room before the next review. */
+    private static final long TARGET_PERCENT = 90;
 
     private final Clock clock;
 
     private final ZoneId zoneId;
 
-    CleanupPlanner(CleanupExecutor executor, Clock clock, ZoneId zoneId) {
-        this.executor = Objects.requireNonNull(executor, "executor");
+    CleanupPlanner(Clock clock, ZoneId zoneId) {
         this.clock = Objects.requireNonNull(clock, "clock");
         this.zoneId = Objects.requireNonNull(zoneId, "zoneId");
     }
 
+    /** The world's remote Git copies: each backup's commit there, read only when a plan needs it. */
+    @FunctionalInterface
+    interface RemoteCopies {
+        Map<BackupId, String> commits() throws Exception;
+    }
+
     /**
-     * Picks the lightest backups the keep settings do not protect and removes every
-     * local copy of each one. Only when that still leaves the world over its target
-     * does the plan drop the local Git copies of protected backups, and only when every
-     * one of them keeps a ZIP or a verified remote copy. Copies on the remote are never
-     * touched.
+     * Picks the lightest backups the keep settings do not protect and deletes every local copy of
+     * each. Only when that still leaves the world over its target does the plan delete the local
+     * Git copies of the rest, as one group, and only when every protected one keeps an intact ZIP
+     * or a copy on the remote. Copies on the remote are never touched.
      */
-    CleanupPlan prepare(WorldId worldId, Snapshot snapshot) throws Exception {
+    CleanupPlan prepare(WorldId worldId, Snapshot snapshot, RemoteCopies remote) throws IOException {
         BackupId safetyFloor = verifiedSafetyFloor(snapshot)
-                .orElseThrow(() -> new IOException(
-                        "Verify at least one local backup before reviewing cleanup"));
+                .orElseThrow(() -> new IOException("Verify at least one local backup before reviewing cleanup"));
         StoragePolicy policy = snapshot.world().storagePolicy();
-        Set<BackupId> protectedIds = RetentionPlanner.protectedBackups(
-                snapshot.records(),
-                policy,
-                zoneId,
-                Optional.of(safetyFloor));
-        List<BackupRecord> cleanupOrder = RetentionPlanner.cleanupOrder(
-                snapshot.records(),
-                protectedIds);
-        long target = Math.multiplyExact(policy.budgetBytes(), CLEANUP_TARGET_BUDGET_NUMERATOR)
-                / CLEANUP_TARGET_BUDGET_DENOMINATOR;
+        Set<BackupId> protectedIds = RetentionPlanner.protectedBackups(snapshot.records(), policy, zoneId, safetyFloor);
+        long target = Math.multiplyExact(policy.budgetBytes(), TARGET_PERCENT) / 100;
         long gitShare = snapshot.localGitSnapshots().isEmpty()
                 ? 0
                 : snapshot.gitBytes() / snapshot.localGitSnapshots().size();
         Map<BackupId, CleanupItem> selected = new LinkedHashMap<>();
-        long projected = deleteUnprotected(
-                snapshot, cleanupOrder, target, gitShare, selected);
+        long projected = snapshot.totalBytes();
+        for (BackupRecord record : RetentionPlanner.cleanupOrder(snapshot.records(), protectedIds)) {
+            if (projected <= target) {
+                break;
+            }
+            Optional<CleanupItem> item = deleteEveryLocalCopy(snapshot, record, gitShare);
+            if (item.isPresent()) {
+                selected.put(record.manifest().backupId(), item.get());
+                projected = Math.max(0, projected - item.get().estimatedReclaimableBytes());
+            }
+        }
         if (projected > target) {
-            Optional<Set<BackupId>> remoteCopies = executor.protectedRemoteCopiesForGitRemoval(
-                    snapshot, protectedIds, safetyFloor);
+            Optional<Set<BackupId>> remoteCopies = protectedRemoteCopies(snapshot, protectedIds, safetyFloor, remote);
             if (remoteCopies.isPresent()) {
-                projected = evictRemainingLocalGit(
-                        snapshot, remoteCopies.orElseThrow(), gitShare, projected, selected);
+                projected = deleteRemainingLocalGit(snapshot, remoteCopies.get(), gitShare, projected, selected);
             }
         }
-
-        OperationId token = OperationId.create();
-        Instant expiresAt = clock.instant().plus(CONFIRMATION_LIFETIME);
         return new CleanupPlan(
-                token,
+                OperationId.create(),
                 worldId,
-                expiresAt,
+                clock.instant().plus(CONFIRMATION_LIFETIME),
                 snapshot.totalBytes(),
-                policy.budgetBytes(),
                 target,
                 List.copyOf(selected.values()),
                 protectedIds,
@@ -97,130 +99,155 @@ CleanupPlan prepare(WorldId worldId, Snapshot snapshot) throws Exception {
                 snapshot.fingerprint());
     }
 
-    /** Removes the local copies of unprotected backups, lightest first, until the target is met. */
-    private static long deleteUnprotected(
-            Snapshot snapshot,
-            List<BackupRecord> cleanupOrder,
-            long target,
-            long gitShare,
-            Map<BackupId, CleanupItem> selected) throws IOException {
-        long projected = snapshot.totalBytes();
-        for (BackupRecord record : cleanupOrder) {
-            if (projected <= target) {
-                break;
-            }
-            BackupId backupId = record.manifest().backupId();
-            ZipBackupArtifact zip = snapshot.zipArtifacts().get(backupId);
-            boolean removeZip = zip != null
-                    && ManagedStorageSupport.managedDestination(record, DestinationType.ZIP);
-            boolean removeGit = snapshot.localGitSnapshots().containsKey(backupId)
-                    && ManagedStorageSupport.ownGitSnapshot(record);
-            if (!removeZip && !removeGit) {
-                continue;
-            }
-            long zipBytes = removeZip ? ManagedStorageSupport.artifactBytes(zip) : 0;
-            long gitBytes = removeGit ? gitShare : 0;
-            selected.put(backupId, item(
-                    record,
-                    new CleanupItemFlags(
-                            removeGit,
-                            removeZip,
-                            ManagedStorageSupport.synchronizedRemoteCopy(record),
-                            gitBytes,
-                            zipBytes)));
-            projected = Math.max(0, projected - zipBytes - gitBytes);
+    /** Deletes the backup's own local Git copy and its ZIP archive, whichever are on disk. */
+    private static Optional<CleanupItem> deleteEveryLocalCopy(Snapshot snapshot, BackupRecord record, long gitShare) {
+        BackupId backupId = record.manifest().backupId();
+        boolean zip = ownZipOnDisk(snapshot, record);
+        boolean git = snapshot.localGitSnapshots().containsKey(backupId) && ManagedStorageSupport.ownGitSnapshot(record);
+        if (!zip && !git) {
+            return Optional.empty();
         }
-        return projected;
+        return Optional.of(item(snapshot, record, git, zip, ManagedStorageSupport.synchronizedRemoteCopy(record),
+                git ? gitShare : 0));
     }
 
-    /** Drops the local Git copies that remain after whole-backup deletions, as one group. */
-    private static long evictRemainingLocalGit(
+    /** Adds the local Git copy of every backup that still has one, as one group. */
+    private static long deleteRemainingLocalGit(
             Snapshot snapshot,
             Set<BackupId> remoteCopies,
             long gitShare,
             long projected,
             Map<BackupId, CleanupItem> selected) {
-        List<BackupId> remainingGitIds = snapshot.localGitSnapshots().keySet().stream()
-                .filter(backupId -> !selected.containsKey(backupId)
-                        || !selected.get(backupId).removeGit())
-                .sorted()
-                .toList();
         long remaining = projected;
-        for (BackupId backupId : remainingGitIds) {
-            BackupRecord record = ManagedStorageSupport.record(snapshot, backupId);
+        List<BackupId> localGit = snapshot.localGitSnapshots().keySet().stream().sorted().toList();
+        for (BackupId backupId : localGit) {
             CleanupItem previous = selected.get(backupId);
-            selected.put(backupId, item(
-                    record,
-                    new CleanupItemFlags(
-                            true,
-                            previous != null && previous.removeZip(),
-                            remoteCopies.contains(backupId),
-                            gitShare,
-                            previous == null ? 0 : previous.exactZipBytes())));
+            if (previous != null && previous.removeGit()) {
+                continue;
+            }
+            boolean zip = previous != null && previous.removeZip();
+            BackupRecord record = snapshot.record(backupId).orElseThrow();
+            selected.put(backupId, item(snapshot, record, true, zip, remoteCopies.contains(backupId), gitShare));
             remaining = Math.max(0, remaining - gitShare);
         }
         return remaining;
     }
 
+    /**
+     * The protected backups whose local Git copy may go because the remote has the same commit;
+     * empty when the group cannot go. It cannot when a local snapshot belongs to no listed backup
+     * of WorldArchive's own, when the newest verified backup has no ZIP on disk, or when a
+     * protected backup would keep neither an intact ZIP nor a remote copy.
+     */
+    private static Optional<Set<BackupId>> protectedRemoteCopies(
+            Snapshot snapshot,
+            Set<BackupId> protectedIds,
+            BackupId safetyFloor,
+            RemoteCopies remote) {
+        boolean foreignSnapshot = snapshot.localGitSnapshots().keySet().stream().anyMatch(backupId ->
+                snapshot.record(backupId).filter(ManagedStorageSupport::ownGitSnapshot).isEmpty());
+        boolean floorHasZip = snapshot.zipArchives().containsKey(safetyFloor)
+                && snapshot.record(safetyFloor)
+                        .flatMap(record -> ManagedStorageSupport.destination(record, DestinationType.ZIP))
+                        .filter(zip -> zip.verificationStatus() == VerificationStatus.VERIFIED)
+                        .isPresent();
+        if (foreignSnapshot || !floorHasZip) {
+            return Optional.empty();
+        }
+        Set<BackupId> remoteCopies = new HashSet<>();
+        Map<BackupId, String> remoteCommits = null;
+        for (Map.Entry<BackupId, GitSnapshot> local : snapshot.localGitSnapshots().entrySet()) {
+            BackupRecord record = snapshot.record(local.getKey()).orElseThrow();
+            if (!protectedIds.contains(local.getKey()) || keepsIntactZip(snapshot, record)) {
+                continue;
+            }
+            if (!ManagedStorageSupport.synchronizedRemoteCopy(record)) {
+                return Optional.empty();
+            }
+            if (remoteCommits == null) {
+                remoteCommits = commitsOrNone(remote);
+            }
+            if (!local.getValue().commitId().equals(remoteCommits.get(local.getKey()))) {
+                return Optional.empty();
+            }
+            remoteCopies.add(local.getKey());
+        }
+        return Optional.of(Set.copyOf(remoteCopies));
+    }
+
+    /** The remote's commits, or none when it cannot be reached: the plan then keeps local Git copies. */
+    private static Map<BackupId, String> commitsOrNone(RemoteCopies remote) {
+        try {
+            return remote.commits();
+        } catch (Exception failure) {
+            if (failure instanceof InterruptedException) {
+                Thread.currentThread().interrupt();
+            }
+            LOGGER.warn("Cleanup could not list the Git remote, so it keeps protected local Git copies: {}",
+                    SafeText.from(failure, "the remote cannot be reached", 512));
+            return Map.of();
+        }
+    }
+
+    /** True when the backup's own ZIP archive is on disk, damaged or not. */
+    private static boolean ownZipOnDisk(Snapshot snapshot, BackupRecord record) {
+        return snapshot.zipArchives().containsKey(record.manifest().backupId())
+                && ManagedStorageSupport.listsOwnZip(record);
+    }
+
+    /**
+     * True when the backup's own ZIP archive is on disk and Verify has not found it damaged or
+     * unreadable. Only such a ZIP counts as a copy that keeps the backup restorable once its
+     * other copies go; a damaged one is deleted like any other copy.
+     */
+    private static boolean keepsIntactZip(Snapshot snapshot, BackupRecord record) {
+        return ownZipOnDisk(snapshot, record) && ManagedStorageSupport.destination(record, DestinationType.ZIP)
+                .map(DestinationResult::verificationStatus)
+                .filter(status -> status != VerificationStatus.FAILED && status != VerificationStatus.UNAVAILABLE)
+                .isPresent();
+    }
+
     private static Optional<BackupId> verifiedSafetyFloor(Snapshot snapshot) {
         return snapshot.records().stream()
-                .filter(record -> hasVerifiedLocalArtifact(snapshot, record))
-                .max(Comparator
-                        .comparing((BackupRecord record) ->
-                                record.manifest().createdAt())
-                        .thenComparing(record ->
-                                record.manifest().backupId()))
+                .filter(record -> hasVerifiedLocalCopy(snapshot, record))
+                .max(Comparator.comparing((BackupRecord record) -> record.manifest().createdAt())
+                        .thenComparing(record -> record.manifest().backupId()))
                 .map(record -> record.manifest().backupId());
     }
 
-    private static boolean hasVerifiedLocalArtifact(
-            Snapshot snapshot,
-            BackupRecord record) {
+    private static boolean hasVerifiedLocalCopy(Snapshot snapshot, BackupRecord record) {
         BackupId backupId = record.manifest().backupId();
         return record.result().destinations().stream().anyMatch(destination ->
                 destination.verificationStatus() == VerificationStatus.VERIFIED
                         && destination.ownership() != ArtifactOwnership.EXTERNAL
-                        && ((destination.destination() == DestinationType.ZIP
-                                        && snapshot.zipArtifacts().containsKey(backupId))
-                                || (destination.destination() == DestinationType.GIT
-                                        && snapshot.localGitSnapshots().containsKey(backupId))));
+                        && (destination.destination() == DestinationType.ZIP
+                                ? snapshot.zipArchives().containsKey(backupId)
+                                : snapshot.localGitSnapshots().containsKey(backupId)));
     }
 
-    private static CleanupItem item(BackupRecord record, CleanupItemFlags flags) {
-        boolean localGitRemains = ManagedStorageSupport.managedDestination(
-                        record, DestinationType.GIT)
-                && !flags.removeGit();
-        boolean localZipRemains = ManagedStorageSupport.managedDestination(
-                        record, DestinationType.ZIP)
-                && !flags.removeZip();
+    /**
+     * One item. It removes the last restore point when no copy would be left: no local Git copy
+     * and no intact ZIP on disk that it keeps, and no copy on the remote.
+     */
+    private static CleanupItem item(
+            Snapshot snapshot,
+            BackupRecord record,
+            boolean deleteGit,
+            boolean deleteZip,
+            boolean remoteCopyRemains,
+            long gitBytes) {
+        BackupId backupId = record.manifest().backupId();
+        boolean localGitRemains = !deleteGit && snapshot.localGitSnapshots().containsKey(backupId);
+        boolean localZipRemains = !deleteZip && keepsIntactZip(snapshot, record);
         return new CleanupItem(
-                record.manifest().backupId(),
+                backupId,
                 record.manifest().createdAt(),
                 record.manifest().label(),
                 record.manifest().changedFileCount(),
-                flags.removeGit(),
-                flags.removeZip(),
-                flags.removeGit()
-                        ? ManagedStorageSupport.destination(record, DestinationType.GIT)
-                                .flatMap(DestinationResult::artifactId)
-                        : Optional.empty(),
-                flags.removeZip()
-                        ? ManagedStorageSupport.destination(record, DestinationType.ZIP)
-                                .flatMap(DestinationResult::artifactId)
-                        : Optional.empty(),
-                flags.gitBytes(),
-                flags.zipBytes(),
-                !flags.remoteGitRemains()
-                        && !localGitRemains
-                        && !localZipRemains);
-    }
-
-    /** Boolean/byte flags describing one cleanup item's local and remote artifact fate. */
-    private record CleanupItemFlags(
-            boolean removeGit,
-            boolean removeZip,
-            boolean remoteGitRemains,
-            long gitBytes,
-            long zipBytes) {
+                deleteGit ? Optional.of(snapshot.localGitSnapshots().get(backupId).refName()) : Optional.empty(),
+                deleteZip ? snapshot.zipArtifactId(backupId) : Optional.empty(),
+                gitBytes,
+                deleteZip ? snapshot.zipArchives().get(backupId).bytes() : 0,
+                !remoteCopyRemains && !localGitRemains && !localZipRemains);
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupRequest.java b/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupRequest.java
index a825b08..a941b60 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupRequest.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupRequest.java
@@ -1,7 +1,7 @@
 package dev.ishaanko.worldarchive.storage.management;
 
-import dev.ishaanko.worldarchive.core.OperationId;
 import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.OperationId;
 import java.util.Objects;
 import java.util.Set;
 
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupResult.java b/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupResult.java
index 17f07fb..7e885b6 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupResult.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/management/CleanupResult.java
@@ -1,22 +1,25 @@
 package dev.ishaanko.worldarchive.storage.management;
 
 import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.WorldId;
 import java.util.Map;
 import java.util.Objects;
+import java.util.Optional;
 
-/** Per-item cleanup outcomes plus the actual post-operation measurement. */
+/**
+ * What a cleanup did: the storage used before and after, why each backup that kept its copies
+ * kept them, and a warning about work that failed after every delete, such as freeing Git space.
+ */
 public record CleanupResult(
-        WorldId worldId,
         long bytesBefore,
         long bytesAfter,
-        Map<BackupId, String> failures) {
+        Map<BackupId, String> failures,
+        Optional<String> warning) {
     public CleanupResult {
-        Objects.requireNonNull(worldId, "worldId");
         if (bytesBefore < 0 || bytesAfter < 0) {
             throw new IllegalArgumentException("Cleanup result sizes must not be negative");
         }
         failures = Map.copyOf(Objects.requireNonNull(failures, "failures"));
+        Objects.requireNonNull(warning, "warning");
     }
 
     public long reclaimedBytes() {
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/management/FileStorageHistoryStore.java b/src/main/java/dev/ishaanko/worldarchive/storage/management/FileStorageHistoryStore.java
index d6124a9..3439c2a 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/management/FileStorageHistoryStore.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/management/FileStorageHistoryStore.java
@@ -3,22 +3,24 @@
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
 import com.google.gson.JsonArray;
-import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
-import com.google.gson.JsonParser;
-import dev.ishaanko.worldarchive.core.AtomicFiles;
 import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.support.AtomicFiles;
+import dev.ishaanko.worldarchive.support.JsonFields;
 import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
+import java.nio.file.NoSuchFileException;
 import java.nio.file.Path;
-import java.time.Instant;
+import java.time.LocalDate;
+import java.time.ZoneId;
 import java.util.ArrayList;
 import java.util.Comparator;
 import java.util.List;
 import java.util.Objects;
 
-/** Atomic bounded history used only for storage growth forecasts. */
+/**
+ * Each world's measured storage over time, which the growth forecast reads: one small JSON file
+ * per world with at most one sample per local day, so a day with many screen visits counts once.
+ */
 public final class FileStorageHistoryStore {
     private static final int SCHEMA_VERSION = 1;
 
@@ -31,94 +33,68 @@ public final class FileStorageHistoryStore {
             .disableHtmlEscaping()
             .create();
 
+    private static final JsonFields<IOException> FIELDS = new JsonFields<>(IOException::new);
+
     private final Path directory;
 
     public FileStorageHistoryStore(Path directory) {
-        this.directory = Objects.requireNonNull(directory, "directory")
-                .toAbsolutePath()
-                .normalize();
+        this.directory = Objects.requireNonNull(directory, "directory").toAbsolutePath().normalize();
     }
 
+    /** The world's samples, oldest first; none when the world has no history yet. */
     public synchronized List<StorageSample> load(WorldId worldId) throws IOException {
-        Path file = file(worldId);
-        if (!Files.exists(file, LinkOption.NOFOLLOW_LINKS)) {
+        String json;
+        try {
+            json = AtomicFiles.readUtf8(file(worldId), MAXIMUM_FILE_BYTES);
+        } catch (NoSuchFileException missing) {
             return List.of();
         }
-        requireRegularFile(file);
-        if (Files.size(file) > MAXIMUM_FILE_BYTES) {
-            throw new IOException("Storage history is unexpectedly large");
-        }
         try {
-            JsonObject root = JsonParser.parseString(
-                    AtomicFiles.readUtf8(file, MAXIMUM_FILE_BYTES)).getAsJsonObject();
-            if (root.get("schemaVersion").getAsInt() != SCHEMA_VERSION
-                    || !worldId.toString().equals(root.get("worldId").getAsString())) {
+            JsonObject root = FIELDS.parseObject(json, "Storage history");
+            if (FIELDS.requiredInt(root, "schemaVersion") != SCHEMA_VERSION
+                    || !worldId.toString().equals(FIELDS.requiredString(root, "worldId"))) {
                 throw new IOException("Storage history identity or schema is invalid");
             }
             List<StorageSample> samples = new ArrayList<>();
-            JsonArray encoded = root.getAsJsonArray("samples");
-            if (encoded.size() > MAXIMUM_SAMPLES) {
-                throw new IOException("Storage history contains too many samples");
-            }
-            for (JsonElement element : encoded) {
-                JsonObject sample = element.getAsJsonObject();
+            for (JsonObject sample : FIELDS.requiredObjects(root, "samples")) {
                 samples.add(new StorageSample(
-                        Instant.parse(sample.get("measuredAt").getAsString()),
-                        sample.get("bytes").getAsLong()));
+                        FIELDS.requiredInstant(sample, "measuredAt"), FIELDS.requiredLong(sample, "bytes")));
             }
             samples.sort(Comparator.comparing(StorageSample::measuredAt));
-            return List.copyOf(samples);
-        } catch (RuntimeException exception) {
-            throw new IOException("Storage history is malformed or invalid", exception);
+            return List.copyOf(samples.subList(Math.max(0, samples.size() - MAXIMUM_SAMPLES), samples.size()));
+        } catch (IllegalArgumentException invalid) {
+            throw new IOException("Storage history is invalid", invalid);
         }
     }
 
-    public synchronized void append(WorldId worldId, StorageSample sample) throws IOException {
+    /** Records a measurement; it replaces an earlier sample from the same local day. A damaged history starts over. */
+    public synchronized void record(WorldId worldId, StorageSample sample, ZoneId zone) throws IOException {
         Objects.requireNonNull(sample, "sample");
         List<StorageSample> samples;
         try {
             samples = new ArrayList<>(load(worldId));
-        } catch (IOException exception) {
+        } catch (IOException damaged) {
             samples = new ArrayList<>();
         }
-        samples.removeIf(existing -> existing.measuredAt().equals(sample.measuredAt()));
+        LocalDate day = sample.measuredAt().atZone(zone).toLocalDate();
+        samples.removeIf(existing -> existing.measuredAt().atZone(zone).toLocalDate().equals(day));
         samples.add(sample);
         samples.sort(Comparator.comparing(StorageSample::measuredAt));
-        if (samples.size() > MAXIMUM_SAMPLES) {
-            samples = new ArrayList<>(
-                    samples.subList(samples.size() - MAXIMUM_SAMPLES, samples.size()));
-        }
-        Path file = file(worldId);
-        Files.createDirectories(directory);
-        if (Files.isSymbolicLink(directory) || Files.isSymbolicLink(file)) {
-            throw new IOException("Storage history path must not be a symbolic link");
-        }
-        JsonObject root = new JsonObject();
-        root.addProperty("schemaVersion", SCHEMA_VERSION);
-        root.addProperty("worldId", worldId.toString());
         JsonArray encoded = new JsonArray();
-        for (StorageSample stored : samples) {
+        for (StorageSample stored : samples.subList(Math.max(0, samples.size() - MAXIMUM_SAMPLES), samples.size())) {
             JsonObject item = new JsonObject();
             item.addProperty("measuredAt", stored.measuredAt().toString());
             item.addProperty("bytes", stored.bytes());
             encoded.add(item);
         }
+        JsonObject root = new JsonObject();
+        root.addProperty("schemaVersion", SCHEMA_VERSION);
+        root.addProperty("worldId", worldId.toString());
         root.add("samples", encoded);
-        AtomicFiles.writeUtf8(
-                file,
-                GSON.toJson(root) + "\n",
-                MAXIMUM_FILE_BYTES);
+        AtomicFiles.writeUtf8(file(worldId), GSON.toJson(root) + "\n", MAXIMUM_FILE_BYTES);
     }
 
     private Path file(WorldId worldId) {
-        Objects.requireNonNull(worldId, "worldId");
-        return directory.resolve(worldId + ".json").normalize();
-    }
-
-    private static void requireRegularFile(Path file) throws IOException {
-        if (Files.isSymbolicLink(file)
-                || !Files.isRegularFile(file, LinkOption.NOFOLLOW_LINKS)) {
-            throw new IOException("Storage history is not a regular file");
-        }
+        return directory.resolve(Objects.requireNonNull(worldId, "worldId") + ".json");
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/management/FileStorageReviewStore.java b/src/main/java/dev/ishaanko/worldarchive/storage/management/FileStorageReviewStore.java
deleted file mode 100644
index 289c0b7..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/management/FileStorageReviewStore.java
+++ /dev/null
@@ -1,61 +0,0 @@
-package dev.ishaanko.worldarchive.storage.management;
-
-import dev.ishaanko.worldarchive.core.AtomicFiles;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.time.Duration;
-import java.time.Instant;
-import java.time.format.DateTimeParseException;
-import java.util.Objects;
-
-/** Persists weekly suppression for non-modal storage review notices. */
-public final class FileStorageReviewStore {
-    private static final Duration CADENCE = Duration.ofDays(7);
-
-    private static final int MAXIMUM_FILE_BYTES = 128;
-
-    private final Path directory;
-
-    public FileStorageReviewStore(Path directory) {
-        this.directory = Objects.requireNonNull(directory, "directory")
-                .toAbsolutePath()
-                .normalize();
-    }
-
-    public synchronized boolean claimIfDue(WorldId worldId, Instant now)
-            throws IOException {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(now, "now");
-        Path file = directory.resolve(worldId + ".txt").normalize();
-        if (Files.exists(file, LinkOption.NOFOLLOW_LINKS)) {
-            if (Files.isSymbolicLink(file)
-                    || !Files.isRegularFile(file, LinkOption.NOFOLLOW_LINKS)) {
-                throw new IOException("Storage review state is not a regular file");
-            }
-            if (Files.size(file) > MAXIMUM_FILE_BYTES) {
-                throw new IOException("Storage review state is unexpectedly large");
-            }
-            try {
-                Instant previous = Instant.parse(
-                        AtomicFiles.readUtf8(file, MAXIMUM_FILE_BYTES).strip());
-                if (now.isBefore(previous.plus(CADENCE))) {
-                    return false;
-                }
-            } catch (DateTimeParseException exception) {
-                // Replace malformed local notice state with the current safe value.
-            }
-        }
-        Files.createDirectories(directory);
-        if (Files.isSymbolicLink(directory) || Files.isSymbolicLink(file)) {
-            throw new IOException("Storage review state path must not be a symbolic link");
-        }
-        AtomicFiles.writeUtf8(
-                file,
-                now + "\n",
-                MAXIMUM_FILE_BYTES);
-        return true;
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/management/ManagedStorageService.java b/src/main/java/dev/ishaanko/worldarchive/storage/management/ManagedStorageService.java
index ac94ca7..d607a12 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/management/ManagedStorageService.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/management/ManagedStorageService.java
@@ -1,32 +1,34 @@
 package dev.ishaanko.worldarchive.storage.management;
 
 import dev.ishaanko.worldarchive.catalog.BackupCatalog;
-import dev.ishaanko.worldarchive.catalog.BackupDeletionRegistry;
+import dev.ishaanko.worldarchive.catalog.FileBackupDeletionRegistry;
 import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
-import dev.ishaanko.worldarchive.core.AsyncTasks;
 import dev.ishaanko.worldarchive.core.ConfirmationLedger;
-import dev.ishaanko.worldarchive.core.OperationId;
 import dev.ishaanko.worldarchive.core.WorldOperationGate;
 import dev.ishaanko.worldarchive.model.WorldId;
 import dev.ishaanko.worldarchive.storage.git.WorldGitSnapshotStore;
 import dev.ishaanko.worldarchive.storage.zip.ZipBackupStoreResolver;
+import dev.ishaanko.worldarchive.support.AsyncTasks;
 import java.io.IOException;
 import java.time.Clock;
 import java.time.ZoneId;
 import java.util.Objects;
-import java.util.concurrent.CompletionException;
+import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CompletionStage;
 import java.util.concurrent.Executor;
 import java.util.function.Supplier;
 
-/** Measures, forecasts, previews, and explicitly applies storage cleanup. */
+/**
+ * Measures each world's managed storage, forecasts its growth, previews cleanup, and applies the
+ * cleanup the player confirms. Nothing is deleted without a confirmed preview.
+ */
 public final class ManagedStorageService {
-    private final FileStorageReviewStore reviews;
-
     private final Executor executor;
 
     private final Clock clock;
 
+    private final WorldGitSnapshotStore git;
+
     private final StorageOverviewBuilder overviewBuilder;
 
     private final CleanupPlanner cleanupPlanner;
@@ -39,103 +41,70 @@ public final class ManagedStorageService {
     public ManagedStorageService(
             Supplier<WorldArchiveConfig> config,
             BackupCatalog catalog,
-            BackupDeletionRegistry deletions,
+            FileBackupDeletionRegistry deletions,
             WorldGitSnapshotStore git,
             ZipBackupStoreResolver zipStores,
             FileStorageHistoryStore history,
-            FileStorageReviewStore reviews,
             WorldOperationGate operationGate,
             Executor executor,
             Clock clock,
             ZoneId zoneId) {
-        this.reviews = Objects.requireNonNull(reviews, "reviews");
         this.executor = Objects.requireNonNull(executor, "executor");
         this.clock = Objects.requireNonNull(clock, "clock");
-        Objects.requireNonNull(catalog, "catalog");
-        Objects.requireNonNull(deletions, "deletions");
-        Objects.requireNonNull(git, "git");
-        Objects.requireNonNull(zipStores, "zipStores");
-        Objects.requireNonNull(history, "history");
-        Objects.requireNonNull(operationGate, "operationGate");
-        Objects.requireNonNull(zoneId, "zoneId");
-        this.overviewBuilder = new StorageOverviewBuilder(
-                config, catalog, git, zipStores, history, clock);
-        this.cleanupExecutor = new CleanupExecutor(
-                catalog, deletions, git, operationGate, overviewBuilder);
-        this.cleanupPlanner = new CleanupPlanner(cleanupExecutor, clock, zoneId);
+        this.git = Objects.requireNonNull(git, "git");
+        this.overviewBuilder = new StorageOverviewBuilder(config, catalog, git, zipStores, history, clock, zoneId);
+        this.cleanupExecutor = new CleanupExecutor(catalog, deletions, git, operationGate, overviewBuilder);
+        this.cleanupPlanner = new CleanupPlanner(clock, zoneId);
     }
 
+    /** Measures the world now; with a budget, the measurement becomes today's forecast sample. */
     public CompletionStage<StorageOverview> overview(WorldId worldId) {
         Objects.requireNonNull(worldId, "worldId");
-        return AsyncTasks.supply(executor, () -> {
-            try {
-                Snapshot snapshot = overviewBuilder.snapshot(worldId);
-                return overviewBuilder.build(snapshot, true);
-            } catch (Exception exception) {
-                throw new CompletionException(exception);
-            }
+        return AsyncTasks.supplyChecked(executor, () -> {
+            Snapshot snapshot = overviewBuilder.snapshot(worldId);
+            overviewBuilder.recordSample(worldId, snapshot.totalBytes());
+            return overviewBuilder.build(snapshot);
         });
     }
 
     public CompletionStage<CleanupPlan> prepareCleanup(WorldId worldId) {
         Objects.requireNonNull(worldId, "worldId");
-        return AsyncTasks.supply(executor, () -> {
-            try {
-                return prepareCleanupBlocking(worldId);
-            } catch (Exception exception) {
-                throw new CompletionException(exception);
+        return AsyncTasks.supplyChecked(executor, () -> {
+            Snapshot snapshot = overviewBuilder.snapshot(worldId);
+            if (!snapshot.world().storagePolicy().budgetEnabled()) {
+                throw new IOException("Configure a storage budget before reviewing cleanup");
             }
+            CleanupPlan plan = cleanupPlanner.prepare(
+                    worldId, snapshot, () -> AsyncTasks.await(git.remoteSnapshotCommits(worldId)));
+            confirmations.expireStaleEntries(clock.instant());
+            confirmations.put(worldId, plan);
+            return plan;
         });
     }
 
+    /**
+     * Whether the Worlds screen should suggest a storage review for the world: its budget is on
+     * and cleanup is recommended. A world without a budget costs no disk access at all.
+     */
     public CompletionStage<Boolean> claimReviewNotice(WorldId worldId) {
         Objects.requireNonNull(worldId, "worldId");
-        return AsyncTasks.supply(executor, () -> {
-            try {
-                StorageOverview current = overviewBuilder.build(
-                        overviewBuilder.snapshot(worldId), true);
-                return current.cleanupReviewRecommended()
-                        && reviews.claimIfDue(worldId, clock.instant());
-            } catch (Exception exception) {
-                return false;
-            }
-        });
+        boolean budgetEnabled = overviewBuilder.world(worldId)
+                .filter(world -> world.storagePolicy().budgetEnabled())
+                .isPresent();
+        if (!budgetEnabled) {
+            return CompletableFuture.completedFuture(false);
+        }
+        return AsyncTasks.supplyChecked(executor, () ->
+                overviewBuilder.build(overviewBuilder.snapshot(worldId)).cleanupReviewRecommended());
     }
 
     public CompletionStage<CleanupResult> applyCleanup(CleanupRequest request) {
         Objects.requireNonNull(request, "request");
-        return AsyncTasks.supply(executor, () -> {
-            try {
-                return applyCleanupBlocking(request);
-            } catch (Exception exception) {
-                throw new CompletionException(exception);
-            }
+        return AsyncTasks.supplyChecked(executor, () -> {
+            CleanupPlan plan = confirmations.claimMatching(
+                            clock.instant(), candidate -> candidate.confirmationToken().equals(request.confirmationToken()))
+                    .orElseThrow(() -> new IOException("Cleanup confirmation is invalid, expired, or already used"));
+            return cleanupExecutor.apply(plan, request);
         });
     }
-
-    private CleanupPlan prepareCleanupBlocking(WorldId worldId) throws Exception {
-        Snapshot snapshot = overviewBuilder.snapshot(worldId);
-        if (!snapshot.world().storagePolicy().budgetEnabled()) {
-            throw new IOException("Configure a storage budget before reviewing cleanup");
-        }
-        CleanupPlan plan = cleanupPlanner.prepare(worldId, snapshot);
-        confirmations.expireStaleEntries(clock.instant());
-        confirmations.put(worldId, plan);
-        return plan;
-    }
-
-    private CleanupResult applyCleanupBlocking(CleanupRequest request) throws Exception {
-        CleanupPlan plan = claimConfirmation(request.confirmationToken());
-        if (plan == null) {
-            throw new IOException("Cleanup confirmation is invalid, expired, or already used");
-        }
-        return cleanupExecutor.apply(plan, request);
-    }
-
-    private CleanupPlan claimConfirmation(OperationId token) {
-        return confirmations.claimMatching(
-                clock.instant(),
-                plan -> plan.confirmationToken().equals(token))
-                .orElse(null);
-    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/management/ManagedStorageSupport.java b/src/main/java/dev/ishaanko/worldarchive/storage/management/ManagedStorageSupport.java
index cb47119..2e33125 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/management/ManagedStorageSupport.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/management/ManagedStorageSupport.java
@@ -1,89 +1,46 @@
 package dev.ishaanko.worldarchive.storage.management;
 
 import dev.ishaanko.worldarchive.model.ArtifactOwnership;
-import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
 import dev.ishaanko.worldarchive.model.SyncStatus;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupArtifact;
-import java.io.IOException;
-import java.nio.file.Files;
 import java.util.Optional;
-import java.util.concurrent.CompletionException;
-import java.util.concurrent.CompletionStage;
 
-/** Small lookups shared by the managed-storage overview, planner, and executor. */
+/** Questions about a backup's copies that the overview, the planner and the executor share. */
 final class ManagedStorageSupport {
     private ManagedStorageSupport() {
     }
 
-    static boolean managedDestination(
-            BackupRecord record,
-            DestinationType type) {
-        return destination(record, type)
-                .filter(result -> result.ownership() != ArtifactOwnership.EXTERNAL)
-                .filter(result -> result.artifactId().isPresent())
-                .isPresent();
+    static Optional<DestinationResult> destination(BackupRecord record, DestinationType type) {
+        return record.result().destinations().stream()
+                .filter(result -> result.destination() == type)
+                .findFirst();
     }
 
-    /**
-     * True when the catalog says this backup's own Git snapshot is on the configured
-     * remote. Imported snapshots are excluded: their sync status refers to the import
-     * source, which restore and verification do not search.
-     */
-    static boolean synchronizedRemoteCopy(BackupRecord record) {
-        return destination(record, DestinationType.GIT)
-                .filter(result -> result.ownership() == ArtifactOwnership.MANAGED
-                        && result.syncStatus() == SyncStatus.SYNCED)
+    /** True when the catalog lists a ZIP archive of this backup that WorldArchive owns. */
+    static boolean listsOwnZip(BackupRecord record) {
+        return destination(record, DestinationType.ZIP)
+                .filter(result -> result.ownership() != ArtifactOwnership.EXTERNAL && result.isDurable())
                 .isPresent();
     }
 
     /** True when this backup's Git snapshot is WorldArchive's own, not imported or linked. */
     static boolean ownGitSnapshot(BackupRecord record) {
         return destination(record, DestinationType.GIT)
-                .filter(result -> result.ownership() == ArtifactOwnership.MANAGED)
-                .filter(result -> result.artifactId().isPresent())
+                .filter(result -> result.ownership() == ArtifactOwnership.MANAGED && result.isDurable())
                 .isPresent();
     }
 
-    static Optional<DestinationResult> destination(
-            BackupRecord record,
-            DestinationType type) {
-        return record.result().destinations().stream()
-                .filter(result -> result.destination() == type)
-                .findFirst();
-    }
-
-    static BackupRecord record(Snapshot snapshot, BackupId backupId) {
-        return snapshot.records().stream()
-                .filter(record -> record.manifest().backupId().equals(backupId))
-                .findFirst()
-                .orElseThrow(() -> new IllegalStateException(
-                        "Snapshot does not contain cleanup record"));
-    }
-
-    static long artifactBytes(ZipBackupArtifact artifact) throws IOException {
-        return Math.addExact(
-                Files.size(artifact.archivePath()),
-                Files.size(artifact.checksumPath()));
-    }
-
-    static <T> T await(CompletionStage<T> stage) throws Exception {
-        try {
-            return stage.toCompletableFuture().get();
-        } catch (java.util.concurrent.ExecutionException exception) {
-            Throwable cause = exception.getCause();
-            if (cause instanceof Exception checked) {
-                throw checked;
-            }
-            if (cause instanceof Error error) {
-                throw error;
-            }
-            throw new CompletionException(cause);
-        } catch (InterruptedException exception) {
-            Thread.currentThread().interrupt();
-            throw exception;
-        }
+    /**
+     * True when the catalog says this backup's own Git snapshot is on the world's remote. Imported
+     * snapshots are excluded: their sync status refers to the repository they came from.
+     */
+    static boolean synchronizedRemoteCopy(BackupRecord record) {
+        return destination(record, DestinationType.GIT)
+                .filter(result -> result.ownership() == ArtifactOwnership.MANAGED
+                        && result.isDurable()
+                        && result.syncStatus() == SyncStatus.SYNCED)
+                .isPresent();
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/management/RetentionPlanner.java b/src/main/java/dev/ishaanko/worldarchive/storage/management/RetentionPlanner.java
index 9a44a6a..1e46f40 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/management/RetentionPlanner.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/management/RetentionPlanner.java
@@ -16,11 +16,15 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
-import java.util.Optional;
 import java.util.Set;
 import java.util.function.Function;
 
-/** Deterministic story-preserving daily, weekly, and monthly anchor selection. */
+/**
+ * Which backups cleanup keeps: every labeled backup, the newest verified one, and one per period
+ * for the most recent days, then weeks, then months that have backups. Within a period, a manual
+ * backup and one with more changed files is the one kept. Cleanup takes the rest in reverse order
+ * of that preference.
+ */
 public final class RetentionPlanner {
     private static final Comparator<BackupRecord> REPRESENTATIVE_ORDER = Comparator
             .comparing((BackupRecord record) ->
@@ -36,7 +40,7 @@ public static Set<BackupId> protectedBackups(
             List<BackupRecord> records,
             StoragePolicy policy,
             ZoneId zoneId,
-            Optional<BackupId> verifiedSafetyFloor) {
+            BackupId verifiedSafetyFloor) {
         Objects.requireNonNull(records, "records");
         Objects.requireNonNull(policy, "policy");
         Objects.requireNonNull(zoneId, "zoneId");
@@ -47,7 +51,7 @@ public static Set<BackupId> protectedBackups(
                 .filter(record -> record.manifest().label().isPresent())
                 .map(record -> record.manifest().backupId())
                 .forEach(protectedIds::add);
-        verifiedSafetyFloor.ifPresent(protectedIds::add);
+        protectedIds.add(verifiedSafetyFloor);
 
         List<BackupRecord> remaining = records.stream()
                 .sorted(Comparator
@@ -76,23 +80,15 @@ record -> YearMonth.from(
         return Set.copyOf(protectedIds);
     }
 
+    /** The unprotected backups, the ones cleanup should take first at the front. */
     public static List<BackupRecord> cleanupOrder(
             List<BackupRecord> records,
             Set<BackupId> protectedBackups) {
         Objects.requireNonNull(records, "records");
         Objects.requireNonNull(protectedBackups, "protectedBackups");
         return records.stream()
-                .filter(record -> !protectedBackups.contains(
-                        record.manifest().backupId()))
-                .sorted(Comparator
-                        .comparing((BackupRecord record) ->
-                                record.manifest().trigger() == BackupTrigger.MANUAL)
-                        .thenComparingLong(record ->
-                                record.manifest().changedFileCount())
-                        .thenComparing(record ->
-                                record.manifest().createdAt())
-                        .thenComparing(record ->
-                                record.manifest().backupId()))
+                .filter(record -> !protectedBackups.contains(record.manifest().backupId()))
+                .sorted(REPRESENTATIVE_ORDER)
                 .toList();
     }
 
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/management/Snapshot.java b/src/main/java/dev/ishaanko/worldarchive/storage/management/Snapshot.java
index 5f207a6..fd905b1 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/management/Snapshot.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/management/Snapshot.java
@@ -4,18 +4,27 @@
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.storage.git.GitSnapshot;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupArtifact;
+import dev.ishaanko.worldarchive.storage.zip.ZipArchiveSize;
 import dev.ishaanko.worldarchive.storage.zip.ZipBackupStore;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
+import java.util.Optional;
 
-/** Point-in-time measurement of a world's managed storage, bound to a fingerprint. */
+/**
+ * One world's managed storage at one moment: the catalog's records, and the copies that are on
+ * this computer. Cleanup decides from the copies on disk, never from the catalog alone, and
+ * applies a plan only while the fingerprint of a new snapshot still matches the preview's.
+ *
+ * @param zipArchives the world's archives by backup, from their file names and sizes
+ * @param localGitSnapshots the world's Git snapshots on this computer, by backup
+ * @param unmeteredStoragePresent whether some copies are stored where this snapshot cannot measure
+ */
 record Snapshot(
         WorldConfig world,
         List<BackupRecord> records,
         ZipBackupStore zipStore,
-        Map<BackupId, ZipBackupArtifact> zipArtifacts,
+        Map<BackupId, ZipArchiveSize> zipArchives,
         Map<BackupId, GitSnapshot> localGitSnapshots,
         long gitBytes,
         long zipBytes,
@@ -25,7 +34,7 @@ record Snapshot(
         Objects.requireNonNull(world, "world");
         records = List.copyOf(records);
         Objects.requireNonNull(zipStore, "zipStore");
-        zipArtifacts = Map.copyOf(zipArtifacts);
+        zipArchives = Map.copyOf(zipArchives);
         localGitSnapshots = Map.copyOf(localGitSnapshots);
         if (gitBytes < 0 || zipBytes < 0) {
             throw new IllegalArgumentException("Snapshot sizes must not be negative");
@@ -36,4 +45,14 @@ record Snapshot(
     long totalBytes() {
         return Math.addExact(gitBytes, zipBytes);
     }
+
+    Optional<BackupRecord> record(BackupId backupId) {
+        return records.stream().filter(record -> record.manifest().backupId().equals(backupId)).findFirst();
+    }
+
+    /** The catalog's name of this backup's archive on disk, {@code <world id>/<file name>}. */
+    Optional<String> zipArtifactId(BackupId backupId) {
+        return Optional.ofNullable(zipArchives.get(backupId))
+                .map(archive -> world.worldId() + "/" + archive.archivePath().getFileName());
+    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/management/StorageForecast.java b/src/main/java/dev/ishaanko/worldarchive/storage/management/StorageForecast.java
index 9358458..6d2cda5 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/management/StorageForecast.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/management/StorageForecast.java
@@ -3,17 +3,11 @@
 import java.util.OptionalLong;
 
 /** Honest forecast derived from observed managed-local growth. */
-public record StorageForecast(
-        State state,
-        OptionalLong daysRemaining,
-        double bytesPerDay) {
+public record StorageForecast(State state, OptionalLong daysRemaining) {
     public StorageForecast {
         if (daysRemaining.isPresent() && daysRemaining.getAsLong() < 0) {
             throw new IllegalArgumentException("Forecast days must not be negative");
         }
-        if (!Double.isFinite(bytesPerDay) || bytesPerDay < 0) {
-            throw new IllegalArgumentException("Forecast growth must be finite and non-negative");
-        }
         if ((state == State.ESTIMATED) != daysRemaining.isPresent()) {
             throw new IllegalArgumentException("Only estimated forecasts carry remaining days");
         }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/management/StorageForecastCalculator.java b/src/main/java/dev/ishaanko/worldarchive/storage/management/StorageForecastCalculator.java
index 91539ea..51d39ae 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/management/StorageForecastCalculator.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/management/StorageForecastCalculator.java
@@ -23,16 +23,10 @@ public static StorageForecast calculate(
             Instant now,
             List<StorageSample> history) {
         if (!policy.budgetEnabled()) {
-            return new StorageForecast(
-                    StorageForecast.State.DISABLED,
-                    OptionalLong.empty(),
-                    0);
+            return new StorageForecast(StorageForecast.State.DISABLED, OptionalLong.empty());
         }
         if (currentBytes >= policy.budgetBytes()) {
-            return new StorageForecast(
-                    StorageForecast.State.REACHED,
-                    OptionalLong.empty(),
-                    0);
+            return new StorageForecast(StorageForecast.State.REACHED, OptionalLong.empty());
         }
         Instant cutoff = now.minus(WINDOW);
         List<StorageSample> samples = history.stream()
@@ -45,24 +39,15 @@ public static StorageForecast calculate(
                                 samples.getFirst().measuredAt(),
                                 samples.getLast().measuredAt())
                         .compareTo(MINIMUM_SPAN) < 0) {
-            return new StorageForecast(
-                    StorageForecast.State.LEARNING,
-                    OptionalLong.empty(),
-                    0);
+            return new StorageForecast(StorageForecast.State.LEARNING, OptionalLong.empty());
         }
         double slope = medianPairwiseSlope(samples);
         if (slope <= 0) {
-            return new StorageForecast(
-                    StorageForecast.State.STABLE,
-                    OptionalLong.empty(),
-                    0);
+            return new StorageForecast(StorageForecast.State.STABLE, OptionalLong.empty());
         }
         long remaining = policy.budgetBytes() - currentBytes;
         long days = Math.max(1, (long) Math.ceil(remaining / slope));
-        return new StorageForecast(
-                StorageForecast.State.ESTIMATED,
-                OptionalLong.of(days),
-                slope);
+        return new StorageForecast(StorageForecast.State.ESTIMATED, OptionalLong.of(days));
     }
 
     private static double medianPairwiseSlope(List<StorageSample> samples) {
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/management/StorageOverview.java b/src/main/java/dev/ishaanko/worldarchive/storage/management/StorageOverview.java
index c8215e0..2b8c848 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/management/StorageOverview.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/management/StorageOverview.java
@@ -1,30 +1,22 @@
 package dev.ishaanko.worldarchive.storage.management;
 
 import dev.ishaanko.worldarchive.config.StoragePolicy;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.time.Instant;
 import java.util.Objects;
 
 /** Per-world storage measurement presented by the native client screen. */
 public record StorageOverview(
-        WorldId worldId,
-        String worldName,
         StoragePolicy policy,
         long gitBytes,
         long zipBytes,
         boolean unmeteredStoragePresent,
         StorageForecast forecast,
-        Instant measuredAt,
         boolean cleanupReviewRecommended) {
     public StorageOverview {
-        Objects.requireNonNull(worldId, "worldId");
-        Objects.requireNonNull(worldName, "worldName");
         Objects.requireNonNull(policy, "policy");
         if (gitBytes < 0 || zipBytes < 0) {
             throw new IllegalArgumentException("Storage usage must not be negative");
         }
         Objects.requireNonNull(forecast, "forecast");
-        Objects.requireNonNull(measuredAt, "measuredAt");
     }
 
     public long totalBytes() {
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/management/StorageOverviewBuilder.java b/src/main/java/dev/ishaanko/worldarchive/storage/management/StorageOverviewBuilder.java
index e80af6d..eedac3e 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/management/StorageOverviewBuilder.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/management/StorageOverviewBuilder.java
@@ -3,18 +3,21 @@
 import dev.ishaanko.worldarchive.catalog.BackupCatalog;
 import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
 import dev.ishaanko.worldarchive.config.WorldConfig;
-import dev.ishaanko.worldarchive.core.Digests;
 import dev.ishaanko.worldarchive.model.ArtifactOwnership;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupRecord;
+import dev.ishaanko.worldarchive.model.SafeText;
 import dev.ishaanko.worldarchive.model.SyncStatus;
 import dev.ishaanko.worldarchive.model.WorldId;
 import dev.ishaanko.worldarchive.storage.git.GitSnapshot;
 import dev.ishaanko.worldarchive.storage.git.WorldGitSnapshotStore;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupArtifact;
+import dev.ishaanko.worldarchive.storage.zip.ZipArchiveSize;
 import dev.ishaanko.worldarchive.storage.zip.ZipBackupStore;
 import dev.ishaanko.worldarchive.storage.zip.ZipBackupStoreResolver;
+import dev.ishaanko.worldarchive.support.AsyncTasks;
+import dev.ishaanko.worldarchive.support.Digests;
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.nio.file.FileVisitResult;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
@@ -24,16 +27,25 @@
 import java.security.MessageDigest;
 import java.time.Clock;
 import java.time.Instant;
+import java.time.ZoneId;
 import java.util.ArrayList;
-import java.util.Comparator;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.function.Supplier;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
-/** Computes per-world storage snapshots and the forecasted overview built on top of them. */
+/**
+ * Measures a world's managed storage and builds the overview and forecast on top of it. ZIP sizes
+ * come from file sizes alone, so a measurement never opens an archive; the Git size is the size
+ * of the world's repository folder.
+ */
 final class StorageOverviewBuilder {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
     private static final long REVIEW_WINDOW_DAYS = 30;
 
     private final Supplier<WorldArchiveConfig> config;
@@ -48,177 +60,141 @@ final class StorageOverviewBuilder {
 
     private final Clock clock;
 
+    private final ZoneId zoneId;
+
     StorageOverviewBuilder(
             Supplier<WorldArchiveConfig> config,
             BackupCatalog catalog,
             WorldGitSnapshotStore git,
             ZipBackupStoreResolver zipStores,
             FileStorageHistoryStore history,
-            Clock clock) {
+            Clock clock,
+            ZoneId zoneId) {
         this.config = Objects.requireNonNull(config, "config");
         this.catalog = Objects.requireNonNull(catalog, "catalog");
         this.git = Objects.requireNonNull(git, "git");
         this.zipStores = Objects.requireNonNull(zipStores, "zipStores");
         this.history = Objects.requireNonNull(history, "history");
         this.clock = Objects.requireNonNull(clock, "clock");
+        this.zoneId = Objects.requireNonNull(zoneId, "zoneId");
+    }
+
+    /** The configured world, or empty when the world has no settings of its own. */
+    Optional<WorldConfig> world(WorldId worldId) {
+        return config.get().worlds().stream().filter(world -> world.worldId().equals(worldId)).findFirst();
     }
 
     Snapshot snapshot(WorldId worldId) throws Exception {
-        WorldArchiveConfig currentConfig = config.get();
-        WorldConfig world = currentConfig.worlds().stream()
-                .filter(candidate -> candidate.worldId().equals(worldId))
-                .findFirst()
-                .orElseThrow(() -> new IOException(
-                        "Storage budgets are available only for configured worlds"));
+        WorldConfig world = world(worldId).orElseThrow(() -> new IOException(
+                "Storage budgets are available only for configured worlds"));
         List<BackupRecord> records = catalog.list(worldId);
-        Map<BackupId, ZipBackupArtifact> zipArtifacts = new HashMap<>();
         ZipBackupStore zipStore = zipStores.store(worldId);
-        for (ZipBackupArtifact artifact : zipStore.listArchives()) {
-            if (artifact.manifest().worldId().equals(worldId)) {
-                zipArtifacts.put(artifact.manifest().backupId(), artifact);
-            }
+        Map<BackupId, ZipArchiveSize> zipArchives = new HashMap<>();
+        long zipBytes = 0;
+        for (ZipArchiveSize archive : zipStore.listSizes(worldId)) {
+            zipArchives.put(archive.backupId(), archive);
+            zipBytes = Math.addExact(zipBytes, archive.bytes());
         }
         Map<BackupId, GitSnapshot> gitSnapshots = new HashMap<>();
-        for (GitSnapshot gitSnapshot : ManagedStorageSupport.await(
-                git.listCurrentSnapshots(worldId))) {
-            gitSnapshots.put(gitSnapshot.backupId(), gitSnapshot);
+        for (GitSnapshot snapshot : AsyncTasks.await(git.listSnapshots(Optional.of(worldId)))) {
+            gitSnapshots.put(snapshot.backupId(), snapshot);
         }
-        long zipBytes = 0;
-        for (ZipBackupArtifact artifact : zipArtifacts.values()) {
-            zipBytes = Math.addExact(zipBytes, ManagedStorageSupport.artifactBytes(artifact));
-        }
-        long gitBytes = directoryBytes(git.repositoryFor(worldId));
-        boolean unmetered = currentConfig.git().legacyRepository().isPresent()
-                || records.stream()
-                        .flatMap(record -> record.result().destinations().stream())
-                        .anyMatch(destination ->
-                                destination.ownership() == ArtifactOwnership.EXTERNAL
-                                        || destination.syncStatus() == SyncStatus.SYNCED);
-        String fingerprint = fingerprint(
-                world,
-                records,
-                zipArtifacts,
-                gitSnapshots,
-                gitBytes,
-                zipBytes);
-        return new Snapshot(
-                world,
-                records,
-                zipStore,
-                Map.copyOf(zipArtifacts),
-                Map.copyOf(gitSnapshots),
-                gitBytes,
-                zipBytes,
-                unmetered,
+        long gitBytes = repositoryBytes(worldId);
+        boolean unmetered = records.stream()
+                .flatMap(record -> record.result().destinations().stream())
+                .anyMatch(destination -> destination.ownership() == ArtifactOwnership.EXTERNAL
+                        || destination.syncStatus() == SyncStatus.SYNCED);
+        String fingerprint = fingerprint(world, records, zipArchives, gitSnapshots, gitBytes, zipBytes);
+        return new Snapshot(world, records, zipStore, zipArchives, gitSnapshots, gitBytes, zipBytes, unmetered,
                 fingerprint);
     }
 
-    StorageOverview build(Snapshot snapshot, boolean recordSample) throws IOException {
+    /** The overview of a snapshot, with a forecast from the recorded history and this measurement. */
+    StorageOverview build(Snapshot snapshot) {
         Instant now = clock.instant();
-        List<StorageSample> samples;
+        List<StorageSample> samples = new ArrayList<>();
         try {
-            samples = new ArrayList<>(history.load(snapshot.world().worldId()));
-        } catch (IOException exception) {
-            samples = new ArrayList<>();
-        }
-        StorageSample current = new StorageSample(now, snapshot.totalBytes());
-        samples.add(current);
-        if (recordSample) {
-            try {
-                history.append(snapshot.world().worldId(), current);
-            } catch (IOException ignored) {
-                // Forecast history is optional and must not block storage actions.
-            }
+            samples.addAll(history.load(snapshot.world().worldId()));
+        } catch (IOException damaged) {
+            LOGGER.warn("The storage history of world {} could not be read: {}", snapshot.world().worldId(),
+                    SafeText.from(damaged, "it is damaged", 512));
         }
+        samples.add(new StorageSample(now, snapshot.totalBytes()));
         StorageForecast forecast = StorageForecastCalculator.calculate(
-                snapshot.world().storagePolicy(),
-                snapshot.totalBytes(),
-                now,
-                samples);
+                snapshot.world().storagePolicy(), snapshot.totalBytes(), now, samples);
         boolean recommended = forecast.state() == StorageForecast.State.REACHED
-                || forecast.daysRemaining().stream()
-                        .anyMatch(days -> days <= REVIEW_WINDOW_DAYS);
+                || forecast.daysRemaining().stream().anyMatch(days -> days <= REVIEW_WINDOW_DAYS);
         return new StorageOverview(
-                snapshot.world().worldId(),
-                worldName(snapshot),
                 snapshot.world().storagePolicy(),
                 snapshot.gitBytes(),
                 snapshot.zipBytes(),
                 snapshot.unmeteredStoragePresent(),
                 forecast,
-                now,
                 recommended);
     }
 
-    private static long directoryBytes(Path root) throws IOException {
+    /** Records today's storage of a world with a budget; the forecast works without it. */
+    void recordSample(WorldId worldId, long totalBytes) {
+        Optional<WorldConfig> world = world(worldId);
+        if (world.isEmpty() || !world.get().storagePolicy().budgetEnabled()) {
+            return;
+        }
+        try {
+            history.record(worldId, new StorageSample(clock.instant(), totalBytes), zoneId);
+        } catch (IOException failure) {
+            LOGGER.warn("The storage history of world {} could not be saved: {}", worldId,
+                    SafeText.from(failure, "it cannot be written", 512));
+        }
+    }
+
+    /** The size of the world's Git repository folder; links in it are refused. */
+    long repositoryBytes(WorldId worldId) throws IOException {
+        Path root = git.repositoryFor(worldId);
         if (!Files.exists(root, LinkOption.NOFOLLOW_LINKS)) {
             return 0;
         }
-        if (Files.isSymbolicLink(root)
-                || !Files.isDirectory(root, LinkOption.NOFOLLOW_LINKS)) {
-            throw new IOException("Managed Git repository is not a safe directory");
+        if (!Files.isDirectory(root, LinkOption.NOFOLLOW_LINKS)) {
+            throw new IOException("The Git repository " + root + " is not a folder");
         }
-        // walkFileTree hands over the attributes it already read, so each file costs one
-        // stat instead of the three that separate link, type, and size checks would need.
         long[] total = {0};
-        try {
-            Files.walkFileTree(root, new SimpleFileVisitor<>() {
-                @Override
-                public FileVisitResult visitFile(Path file, BasicFileAttributes attributes)
-                        throws IOException {
-                    if (attributes.isSymbolicLink()) {
-                        throw new IOException("Managed Git repository contains a symbolic link");
-                    }
-                    if (attributes.isRegularFile()) {
-                        total[0] = Math.addExact(total[0], attributes.size());
-                    }
-                    return FileVisitResult.CONTINUE;
+        Files.walkFileTree(root, new SimpleFileVisitor<>() {
+            @Override
+            public FileVisitResult visitFile(Path file, BasicFileAttributes attributes) throws IOException {
+                if (attributes.isSymbolicLink()) {
+                    throw new IOException("The Git repository " + root + " contains a link: " + file);
                 }
-            });
-        } catch (ArithmeticException exception) {
-            throw new IOException("Managed Git repository size overflowed", exception);
-        }
+                total[0] = Math.addExact(total[0], attributes.isRegularFile() ? attributes.size() : 0);
+                return FileVisitResult.CONTINUE;
+            }
+        });
         return total[0];
     }
 
-    private static String worldName(Snapshot snapshot) {
-        return snapshot.records().stream()
-                .max(Comparator.comparing(record -> record.manifest().createdAt()))
-                .map(record -> record.manifest().worldName())
-                .orElseGet(() -> snapshot.world().path().getFileName().toString());
-    }
-
     private static String fingerprint(
             WorldConfig world,
             List<BackupRecord> records,
-            Map<BackupId, ZipBackupArtifact> zipArtifacts,
+            Map<BackupId, ZipArchiveSize> zipArchives,
             Map<BackupId, GitSnapshot> gitSnapshots,
             long gitBytes,
-            long zipBytes) throws IOException {
+            long zipBytes) {
         MessageDigest digest = Digests.sha256();
         update(digest, world.storagePolicy().toString());
         update(digest, Long.toString(gitBytes));
         update(digest, Long.toString(zipBytes));
-        for (BackupRecord record : records) {
-            update(digest, record.toString());
-        }
-        zipArtifacts.entrySet().stream()
-                .sorted(Map.Entry.comparingByKey())
-                .forEach(entry -> {
-                    update(digest, entry.getKey().toString());
-                    update(digest, entry.getValue().artifactId());
-                });
-        gitSnapshots.entrySet().stream()
-                .sorted(Map.Entry.comparingByKey())
-                .forEach(entry -> {
-                    update(digest, entry.getKey().toString());
-                    update(digest, entry.getValue().commitId());
-                });
+        records.forEach(record -> update(digest, record.toString()));
+        zipArchives.entrySet().stream().sorted(Map.Entry.comparingByKey()).forEach(entry -> {
+            update(digest, entry.getKey().toString());
+            update(digest, entry.getValue().archivePath().getFileName().toString());
+        });
+        gitSnapshots.entrySet().stream().sorted(Map.Entry.comparingByKey()).forEach(entry -> {
+            update(digest, entry.getKey().toString());
+            update(digest, entry.getValue().commitId());
+        });
         return Digests.hex(digest.digest());
     }
 
     private static void update(MessageDigest digest, String value) {
-        digest.update(value.getBytes(java.nio.charset.StandardCharsets.UTF_8));
+        digest.update(value.getBytes(StandardCharsets.UTF_8));
         digest.update((byte) 0);
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ExactArchiveCopy.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ExactArchiveCopy.java
deleted file mode 100644
index 2c88918..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ExactArchiveCopy.java
+++ /dev/null
@@ -1,245 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import dev.ishaanko.worldarchive.core.Digests;
-import dev.ishaanko.worldarchive.storage.zip.ZipArchiveInspector.Inspection;
-import java.io.IOException;
-import java.io.InterruptedIOException;
-import java.nio.ByteBuffer;
-import java.nio.channels.FileChannel;
-import java.nio.channels.SeekableByteChannel;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.nio.file.StandardOpenOption;
-import java.nio.file.attribute.BasicFileAttributes;
-import java.nio.file.attribute.FileTime;
-import java.nio.file.attribute.PosixFilePermission;
-import java.security.MessageDigest;
-import java.util.Set;
-
-/** One exact-open snapshot copied into an owner-private, locally trusted file. */
-final class ExactArchiveCopy implements AutoCloseable {
-    private static final Set<PosixFilePermission> PRIVATE_DIRECTORY_PERMISSIONS = Set.of(
-            PosixFilePermission.OWNER_READ,
-            PosixFilePermission.OWNER_WRITE,
-            PosixFilePermission.OWNER_EXECUTE);
-
-    private final Path directory;
-
-    private final Path archive;
-
-    private final String sha256;
-
-    private final long size;
-
-    private final SourceFingerprint sourceFingerprint;
-
-    private ExactArchiveCopy(
-            Path directory,
-            Path archive,
-            String sha256,
-            long size,
-            SourceFingerprint sourceFingerprint) {
-        this.directory = directory;
-        this.archive = archive;
-        this.sha256 = sha256;
-        this.size = size;
-        this.sourceFingerprint = sourceFingerprint;
-    }
-
-    static ExactArchiveCopy capture(ManagedDirectoryAccess sourceDirectory, String sourceName)
-            throws IOException {
-        sourceDirectory.requireRegularFile(
-                sourceName, "Managed ZIP source is not a safe regular file");
-        SourceFingerprint sourceBefore = SourceFingerprint.from(
-                sourceDirectory.attributes(sourceName));
-        Path privateDirectory = createPrivateDirectory();
-        Path privateArchive = privateDirectory.resolve("artifact.zip");
-        try {
-            CopyResult copied;
-            try (SeekableByteChannel source = sourceDirectory.openRead(sourceName);
-                    FileChannel target = FileChannel.open(
-                            privateArchive,
-                            StandardOpenOption.CREATE_NEW,
-                            StandardOpenOption.WRITE,
-                            LinkOption.NOFOLLOW_LINKS)) {
-                copied = copy(source, target);
-                target.force(true);
-            }
-            SourceFingerprint sourceAfter = SourceFingerprint.from(
-                    sourceDirectory.attributes(sourceName));
-            if (!sourceBefore.equals(sourceAfter)) {
-                throw new ZipBackupException("Managed ZIP source changed while being copied");
-            }
-            return new ExactArchiveCopy(
-                    privateDirectory,
-                    privateArchive,
-                    copied.sha256(),
-                    copied.size(),
-                    sourceBefore);
-        } catch (IOException | RuntimeException exception) {
-            cleanupWithSuppression(privateArchive, privateDirectory, exception);
-            throw exception;
-        }
-    }
-
-    Path path() {
-        return archive;
-    }
-
-    String sha256() {
-        return sha256;
-    }
-
-    boolean matches(ExactArchiveCopy other) {
-        return sourceFingerprint.equals(other.sourceFingerprint)
-                && sameContents(other);
-    }
-
-    boolean sameContents(ExactArchiveCopy other) {
-        return size == other.size && sha256.equals(other.sha256);
-    }
-
-    boolean sourceStillMatches(ManagedDirectoryAccess sourceDirectory, String sourceName)
-            throws IOException {
-        sourceDirectory.requireRegularFile(
-                sourceName, "Managed ZIP source is not a safe regular file");
-        return sourceFingerprint.equals(SourceFingerprint.from(
-                sourceDirectory.attributes(sourceName)));
-    }
-
-    Inspection inspect() throws IOException {
-        try (SeekableByteChannel channel = openRead()) {
-            return ZipArchiveInspector.inspect(channel);
-        }
-    }
-
-    SeekableByteChannel openRead() throws IOException {
-        return FileChannel.open(
-                archive,
-                Set.of(StandardOpenOption.READ, LinkOption.NOFOLLOW_LINKS));
-    }
-
-    void copyTo(ManagedDirectoryAccess targetDirectory, String targetName) throws IOException {
-        boolean created = false;
-        try (SeekableByteChannel source = openRead();
-                SeekableByteChannel target = targetDirectory.createNew(targetName)) {
-            created = true;
-            CopyResult copied = copy(source, target);
-            if (!copied.sha256().equals(sha256) || copied.size() != size) {
-                throw new ZipBackupException("Trusted ZIP copy changed during publication");
-            }
-            if (target instanceof FileChannel fileChannel) {
-                fileChannel.force(true);
-            }
-        } catch (IOException | RuntimeException exception) {
-            if (created) {
-                try {
-                    targetDirectory.deleteIfExists(targetName);
-                } catch (IOException cleanupFailure) {
-                    exception.addSuppressed(cleanupFailure);
-                }
-            }
-            throw exception;
-        }
-    }
-
-    @Override
-    public void close() throws IOException {
-        IOException failure = null;
-        try {
-            Files.deleteIfExists(archive);
-        } catch (IOException exception) {
-            failure = exception;
-        }
-        try {
-            Files.deleteIfExists(directory);
-        } catch (IOException exception) {
-            if (failure == null) {
-                failure = exception;
-            } else {
-                failure.addSuppressed(exception);
-            }
-        }
-        if (failure != null) {
-            throw failure;
-        }
-    }
-
-    private static Path createPrivateDirectory() throws IOException {
-        Path value = Files.createTempDirectory("worldarchive-zip-").toRealPath();
-        try {
-            Files.setPosixFilePermissions(value, PRIVATE_DIRECTORY_PERMISSIONS);
-        } catch (UnsupportedOperationException exception) {
-            // Windows temp directories inherit the current user's private ACL.
-        }
-        return value;
-    }
-
-    private static CopyResult copy(SeekableByteChannel source, SeekableByteChannel target)
-            throws IOException {
-        MessageDigest digest = Digests.sha256();
-        ByteBuffer buffer = ByteBuffer.allocate(Digests.COPY_BUFFER_BYTES);
-        long total = 0;
-        try {
-            while (true) {
-                if (Thread.currentThread().isInterrupted()) {
-                    throw new InterruptedIOException("ZIP operation was interrupted");
-                }
-                buffer.clear();
-                int read = source.read(buffer);
-                if (read < 0) {
-                    break;
-                }
-                if (read == 0) {
-                    continue;
-                }
-                total = Math.addExact(total, read);
-                if (total > ZipLimits.MAXIMUM_ARCHIVE_BYTES) {
-                    throw new ZipBackupException("ZIP archive exceeds its size limit");
-                }
-                digest.update(buffer.array(), 0, read);
-                buffer.flip();
-                while (buffer.hasRemaining()) {
-                    target.write(buffer);
-                }
-            }
-        } catch (ArithmeticException exception) {
-            throw new ZipBackupException("ZIP archive size overflow", exception);
-        }
-        return new CopyResult(total, Digests.hex(digest.digest()));
-    }
-
-    private static void cleanupWithSuppression(
-            Path archive,
-            Path directory,
-            Throwable failure) {
-        try {
-            Files.deleteIfExists(archive);
-        } catch (IOException cleanupFailure) {
-            failure.addSuppressed(cleanupFailure);
-        }
-        try {
-            Files.deleteIfExists(directory);
-        } catch (IOException cleanupFailure) {
-            failure.addSuppressed(cleanupFailure);
-        }
-    }
-
-    private record CopyResult(long size, String sha256) {
-    }
-
-    private record SourceFingerprint(
-            Object fileKey,
-            long size,
-            FileTime lastModifiedTime,
-            FileTime creationTime) {
-        static SourceFingerprint from(BasicFileAttributes attributes) {
-            return new SourceFingerprint(
-                    attributes.fileKey(),
-                    attributes.size(),
-                    attributes.lastModifiedTime(),
-                    attributes.creationTime());
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ManagedDirectoryAccess.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ManagedDirectoryAccess.java
deleted file mode 100644
index 6b650b3..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ManagedDirectoryAccess.java
+++ /dev/null
@@ -1,571 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import com.sun.nio.file.ExtendedOpenOption;
-import java.io.IOException;
-import java.nio.channels.FileChannel;
-import java.nio.channels.FileLock;
-import java.nio.channels.SeekableByteChannel;
-import java.nio.file.DirectoryStream;
-import java.nio.file.FileAlreadyExistsException;
-import java.nio.file.FileSystems;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.NoSuchFileException;
-import java.nio.file.OpenOption;
-import java.nio.file.Path;
-import java.nio.file.SecureDirectoryStream;
-import java.nio.file.StandardCopyOption;
-import java.nio.file.StandardOpenOption;
-import java.nio.file.attribute.BasicFileAttributeView;
-import java.nio.file.attribute.BasicFileAttributes;
-import java.nio.file.attribute.FileAttribute;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Objects;
-import java.util.Set;
-
-/** Pins a managed directory while all names are opened relative to that pinned parent. */
-final class ManagedDirectoryAccess implements AutoCloseable {
-    static final String WINDOWS_GUARD_NAME = ".worldarchive.guard";
-
-    private final Path root;
-
-    private final Path directory;
-
-    private final SecureDirectoryStream<Path> rootSecure;
-
-    private final SecureDirectoryStream<Path> directorySecure;
-
-    private final FileChannel rootPin;
-
-    private final FileChannel directoryPin;
-
-    private final Object rootFileKey;
-
-    private final Object directoryFileKey;
-
-    private ManagedDirectoryAccess(
-            Path root,
-            Path directory,
-            SecureDirectoryStream<Path> rootSecure,
-            SecureDirectoryStream<Path> directorySecure,
-            FileChannel rootPin,
-            FileChannel directoryPin,
-            Object rootFileKey,
-            Object directoryFileKey) {
-        this.root = root;
-        this.directory = directory;
-        this.rootSecure = rootSecure;
-        this.directorySecure = directorySecure;
-        this.rootPin = rootPin;
-        this.directoryPin = directoryPin;
-        this.rootFileKey = rootFileKey;
-        this.directoryFileKey = directoryFileKey;
-    }
-
-    static ManagedDirectoryAccess openRoot(Path root) throws IOException {
-        Path absoluteRoot = requireAbsolute(root);
-        ManagedPathGuard.requireDirectory(
-                absoluteRoot, "Managed ZIP root contains an unsafe path component");
-        DirectoryStream<Path> rootStream = Files.newDirectoryStream(absoluteRoot);
-        if (rootStream instanceof SecureDirectoryStream<?> secureStream) {
-            @SuppressWarnings("unchecked")
-            SecureDirectoryStream<Path> secureRoot = (SecureDirectoryStream<Path>) secureStream;
-            try {
-                Object rootFileKey = requireFileKey(requireSafeDirectory(
-                        secureRoot, "Managed ZIP root handle is unsafe"));
-                ManagedPathGuard.requireDirectory(
-                        absoluteRoot, "Managed ZIP root changed while being pinned");
-                requirePathIdentity(
-                        absoluteRoot, rootFileKey, "Managed ZIP root changed while being pinned");
-                return new ManagedDirectoryAccess(
-                        absoluteRoot,
-                        absoluteRoot,
-                        null,
-                        secureRoot,
-                        null,
-                        null,
-                        rootFileKey,
-                        rootFileKey);
-            } catch (IOException | RuntimeException exception) {
-                closeWithSuppression(secureRoot, exception);
-                throw exception;
-            }
-        }
-        rootStream.close();
-        requireDefaultWindowsFileSystem(absoluteRoot);
-        FileChannel rootHandle = openWindowsDirectoryPin(absoluteRoot);
-        try {
-            ManagedPathGuard.requireDirectory(
-                    absoluteRoot, "Managed ZIP root changed while being pinned");
-            return new ManagedDirectoryAccess(
-                    absoluteRoot,
-                    absoluteRoot,
-                    null,
-                    null,
-                    null,
-                    rootHandle,
-                    null,
-                    null);
-        } catch (IOException | RuntimeException exception) {
-            closeWithSuppression(rootHandle, exception);
-            throw exception;
-        }
-    }
-
-    static ManagedDirectoryAccess open(Path root, Path directory) throws IOException {
-        Path absoluteRoot = requireAbsolute(root);
-        Path absoluteDirectory = requireAbsolute(directory);
-        if (!Objects.equals(absoluteDirectory.getParent(), absoluteRoot)) {
-            throw new ZipBackupException("Managed world directory is not a direct root child");
-        }
-        ManagedPathGuard.requireDirectory(
-                absoluteRoot, "Managed ZIP root contains an unsafe path component");
-        ManagedPathGuard.requireDirectory(
-                absoluteDirectory, "Managed ZIP world contains an unsafe path component");
-
-        DirectoryStream<Path> rootStream = Files.newDirectoryStream(absoluteRoot);
-        if (rootStream instanceof SecureDirectoryStream<?> secureStream) {
-            @SuppressWarnings("unchecked")
-            SecureDirectoryStream<Path> secureRoot = (SecureDirectoryStream<Path>) secureStream;
-            SecureDirectoryStream<Path> secureDirectory = null;
-            try {
-                Object rootFileKey = requireFileKey(requireSafeDirectory(
-                        secureRoot, "Managed ZIP root handle is unsafe"));
-                secureDirectory = secureRoot.newDirectoryStream(
-                        absoluteDirectory.getFileName(), LinkOption.NOFOLLOW_LINKS);
-                Object directoryFileKey = requireFileKey(requireSafeDirectory(
-                        secureDirectory, "Managed ZIP world handle is unsafe"));
-                ManagedPathGuard.requireDirectory(
-                        absoluteRoot, "Managed ZIP root changed while being pinned");
-                ManagedPathGuard.requireDirectory(
-                        absoluteDirectory, "Managed ZIP world changed while being pinned");
-                requirePathIdentity(
-                        absoluteRoot, rootFileKey, "Managed ZIP root changed while being pinned");
-                requirePathIdentity(
-                        absoluteDirectory,
-                        directoryFileKey,
-                        "Managed ZIP world changed while being pinned");
-                return new ManagedDirectoryAccess(
-                        absoluteRoot,
-                        absoluteDirectory,
-                        secureRoot,
-                        secureDirectory,
-                        null,
-                        null,
-                        rootFileKey,
-                        directoryFileKey);
-            } catch (IOException | RuntimeException exception) {
-                closeWithSuppression(secureDirectory, exception);
-                closeWithSuppression(secureRoot, exception);
-                throw exception;
-            }
-        }
-        rootStream.close();
-        requireDefaultWindowsFileSystem(absoluteRoot);
-
-        FileChannel rootHandle = null;
-        FileChannel directoryHandle = null;
-        try {
-            rootHandle = openWindowsDirectoryPin(absoluteRoot);
-            directoryHandle = openWindowsDirectoryPin(absoluteDirectory);
-            ManagedPathGuard.requireDirectory(
-                    absoluteRoot, "Managed ZIP root changed while being pinned");
-            ManagedPathGuard.requireDirectory(
-                    absoluteDirectory, "Managed ZIP world changed while being pinned");
-            return new ManagedDirectoryAccess(
-                    absoluteRoot,
-                    absoluteDirectory,
-                    null,
-                    null,
-                    rootHandle,
-                    directoryHandle,
-                    null,
-                    null);
-        } catch (IOException | RuntimeException exception) {
-            closeWithSuppression(directoryHandle, exception);
-            closeWithSuppression(rootHandle, exception);
-            throw exception;
-        }
-    }
-
-    Path resolve(String name) {
-        return directory.resolve(requireFileName(name));
-    }
-
-    SeekableByteChannel openRead(String name) throws IOException {
-        Path relative = Path.of(requireFileName(name));
-        Set<OpenOption> options = Set.of(StandardOpenOption.READ, LinkOption.NOFOLLOW_LINKS);
-        if (directorySecure != null) {
-            return directorySecure.newByteChannel(relative, options);
-        }
-        return FileChannel.open(
-                directory.resolve(relative),
-                Set.of(
-                        StandardOpenOption.READ,
-                        LinkOption.NOFOLLOW_LINKS,
-                        ExtendedOpenOption.NOSHARE_WRITE,
-                        ExtendedOpenOption.NOSHARE_DELETE));
-    }
-
-    SeekableByteChannel createNew(String name) throws IOException {
-        Path relative = Path.of(requireFileName(name));
-        Set<OpenOption> options = Set.of(
-                StandardOpenOption.CREATE_NEW,
-                StandardOpenOption.WRITE,
-                LinkOption.NOFOLLOW_LINKS);
-        if (directorySecure != null) {
-            return directorySecure.newByteChannel(relative, options, new FileAttribute<?>[0]);
-        }
-        return FileChannel.open(
-                directory.resolve(relative),
-                Set.of(
-                        StandardOpenOption.CREATE_NEW,
-                        StandardOpenOption.WRITE,
-                        LinkOption.NOFOLLOW_LINKS,
-                        ExtendedOpenOption.NOSHARE_READ,
-                        ExtendedOpenOption.NOSHARE_WRITE,
-                        ExtendedOpenOption.NOSHARE_DELETE));
-    }
-
-    LockedFile acquireLock(String name) throws IOException {
-        Path relative = Path.of(requireFileName(name));
-        Set<OpenOption> options = Set.of(
-                StandardOpenOption.CREATE,
-                StandardOpenOption.WRITE,
-                LinkOption.NOFOLLOW_LINKS);
-        SeekableByteChannel opened = directorySecure != null
-                ? directorySecure.newByteChannel(relative, options, new FileAttribute<?>[0])
-                : FileChannel.open(directory.resolve(relative), options);
-        if (!(opened instanceof FileChannel channel)) {
-            opened.close();
-            throw new ZipBackupException(
-                    "Filesystem cannot lock the managed ZIP directory safely");
-        }
-        try {
-            requireRegularFile(name, "Managed ZIP operation lock is unsafe");
-            revalidatePinnedDirectories();
-            FileLock lock = channel.lock();
-            return new LockedFile(channel, lock);
-        } catch (IOException | RuntimeException exception) {
-            closeWithSuppression(channel, exception);
-            throw exception;
-        }
-    }
-
-    BasicFileAttributes attributes(String name) throws IOException {
-        Path relative = Path.of(requireFileName(name));
-        if (directorySecure != null) {
-            BasicFileAttributeView view = directorySecure.getFileAttributeView(
-                    relative, BasicFileAttributeView.class, LinkOption.NOFOLLOW_LINKS);
-            if (view == null) {
-                throw new ZipBackupException("Managed file attributes are unavailable");
-            }
-            return view.readAttributes();
-        }
-        return Files.readAttributes(
-                directory.resolve(relative), BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
-    }
-
-    boolean exists(String name) throws IOException {
-        try {
-            attributes(name);
-            return true;
-        } catch (NoSuchFileException exception) {
-            return false;
-        }
-    }
-
-    boolean isDirectory(String name) throws IOException {
-        BasicFileAttributes value = attributes(name);
-        return value.isDirectory() && !value.isSymbolicLink() && !value.isOther();
-    }
-
-    void createDirectory(String name) throws IOException {
-        String child = requireFileName(name);
-        if (exists(child)) {
-            if (!isDirectory(child)) {
-                throw new FileAlreadyExistsException(resolve(child).toString());
-            }
-            return;
-        }
-        try {
-            Files.createDirectory(resolve(child));
-        } catch (FileAlreadyExistsException exception) {
-            if (!isDirectory(child)) {
-                throw exception;
-            }
-        }
-        revalidatePinnedDirectories();
-        if (!isDirectory(child)) {
-            throw new ZipBackupException("Managed ZIP child directory changed during creation");
-        }
-    }
-
-    void requireRegularFile(String name, String message) throws IOException {
-        ManagedPathGuard.requireRegularFile(resolve(name), message);
-        BasicFileAttributes value = attributes(name);
-        if (!value.isRegularFile() || value.isSymbolicLink() || value.isOther()) {
-            throw new ZipBackupException(message);
-        }
-    }
-
-    List<String> listNames() throws IOException {
-        List<String> names = new ArrayList<>();
-        if (directorySecure != null) {
-            for (Path entry : directorySecure) {
-                addListedName(names, entry);
-            }
-        } else {
-            try (DirectoryStream<Path> entries = Files.newDirectoryStream(directory)) {
-                for (Path entry : entries) {
-                    addListedName(names, entry);
-                }
-            }
-        }
-        return List.copyOf(names);
-    }
-
-    void move(String source, String target) throws IOException {
-        String sourceName = requireFileName(source);
-        String targetName = requireFileName(target);
-        if (exists(targetName)) {
-            throw new FileAlreadyExistsException(resolve(targetName).toString());
-        }
-        if (directorySecure != null) {
-            directorySecure.move(Path.of(sourceName), directorySecure, Path.of(targetName));
-            return;
-        }
-        Files.move(resolve(sourceName), resolve(targetName), StandardCopyOption.ATOMIC_MOVE);
-    }
-
-    void delete(String name) throws IOException {
-        String filename = requireFileName(name);
-        if (directorySecure != null) {
-            directorySecure.deleteFile(Path.of(filename));
-            return;
-        }
-        requireRegularFile(filename, "Managed file changed before deletion");
-        Files.delete(resolve(filename));
-    }
-
-    void deleteIfExists(String name) throws IOException {
-        if (exists(name)) {
-            delete(name);
-        }
-    }
-
-    void revalidatePinnedDirectories() throws IOException {
-        if (rootSecure != null) {
-            requireIdentity(
-                    requireSafeDirectory(rootSecure, "Managed ZIP root handle became unsafe"),
-                    rootFileKey,
-                    "Managed ZIP root handle changed during operation");
-        }
-        if (directorySecure != null) {
-            requireIdentity(
-                    requireSafeDirectory(
-                            directorySecure, "Managed ZIP directory handle became unsafe"),
-                    directoryFileKey,
-                    "Managed ZIP directory handle changed during operation");
-        }
-        ManagedPathGuard.requireDirectory(root, "Managed ZIP root path changed during operation");
-        if (rootFileKey != null) {
-            requirePathIdentity(
-                    root, rootFileKey, "Managed ZIP root path changed during operation");
-        }
-        if (!directory.equals(root)) {
-            ManagedPathGuard.requireDirectory(
-                    directory, "Managed ZIP world path changed during operation");
-            if (directoryFileKey != null) {
-                requirePathIdentity(
-                        directory,
-                        directoryFileKey,
-                        "Managed ZIP world path changed during operation");
-            }
-        }
-    }
-
-    @Override
-    public void close() throws IOException {
-        IOException failure = null;
-        failure = close(directorySecure, failure);
-        failure = close(rootSecure, failure);
-        failure = close(directoryPin, failure);
-        failure = close(rootPin, failure);
-        if (failure != null) {
-            throw failure;
-        }
-    }
-
-    private static void addListedName(List<String> names, Path entry) throws ZipBackupException {
-        if (names.size() >= ZipLimits.MAXIMUM_MANAGED_DIRECTORY_ENTRIES) {
-            throw new ZipBackupException("Managed ZIP directory exceeds its entry limit");
-        }
-        Path filename = entry.getFileName();
-        if (filename == null) {
-            throw new ZipBackupException("Managed ZIP directory returned an unnamed entry");
-        }
-        names.add(requireFileName(filename.toString()));
-    }
-
-    private static BasicFileAttributes requireSafeDirectory(
-            SecureDirectoryStream<Path> directory,
-            String message) throws IOException {
-        BasicFileAttributeView view = directory.getFileAttributeView(BasicFileAttributeView.class);
-        if (view == null) {
-            throw new ZipBackupException(message);
-        }
-        BasicFileAttributes attributes = view.readAttributes();
-        if (!attributes.isDirectory() || attributes.isSymbolicLink() || attributes.isOther()) {
-            throw new ZipBackupException(message);
-        }
-        return attributes;
-    }
-
-    private static Object requireFileKey(BasicFileAttributes attributes)
-            throws ZipBackupException {
-        Object fileKey = attributes.fileKey();
-        if (fileKey == null) {
-            throw new ZipBackupException("Secure filesystem does not expose directory identity");
-        }
-        return fileKey;
-    }
-
-    private static void requireIdentity(
-            BasicFileAttributes attributes,
-            Object expectedFileKey,
-            String message) throws ZipBackupException {
-        if (!Objects.equals(attributes.fileKey(), expectedFileKey)) {
-            throw new ZipBackupException(message);
-        }
-    }
-
-    private static void requirePathIdentity(
-            Path path,
-            Object expectedFileKey,
-            String message) throws IOException {
-        BasicFileAttributes attributes = Files.readAttributes(
-                path, BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
-        requireIdentity(attributes, expectedFileKey, message);
-    }
-
-    private static FileChannel openWindowsDirectoryPin(Path directory) throws IOException {
-        try {
-            return FileChannel.open(
-                    directory,
-                    Set.of(
-                            StandardOpenOption.READ,
-                            LinkOption.NOFOLLOW_LINKS,
-                            ExtendedOpenOption.NOSHARE_DELETE));
-        } catch (IOException | UnsupportedOperationException directFailure) {
-            try {
-                return openWindowsGuardPin(directory);
-            } catch (IOException | RuntimeException guardFailure) {
-                guardFailure.addSuppressed(directFailure);
-                throw guardFailure;
-            }
-        }
-    }
-
-    private static FileChannel openWindowsGuardPin(Path directory) throws IOException {
-        Path guard = directory.resolve(WINDOWS_GUARD_NAME);
-        FileChannel channel = FileChannel.open(
-                guard,
-                Set.of(
-                        StandardOpenOption.CREATE,
-                        StandardOpenOption.READ,
-                        StandardOpenOption.WRITE,
-                        LinkOption.NOFOLLOW_LINKS,
-                        ExtendedOpenOption.NOSHARE_DELETE));
-        try {
-            BasicFileAttributes attributes = Files.readAttributes(
-                    guard, BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
-            if (!attributes.isRegularFile()
-                    || attributes.isSymbolicLink()
-                    || attributes.isOther()) {
-                throw new ZipBackupException("Managed ZIP guard file is unsafe");
-            }
-            ManagedPathGuard.requireRegularFile(guard, "Managed ZIP guard file is unsafe");
-            return channel;
-        } catch (IOException | RuntimeException exception) {
-            closeWithSuppression(channel, exception);
-            throw exception;
-        }
-    }
-
-    private static void requireDefaultWindowsFileSystem(Path path) throws ZipBackupException {
-        if (!path.getFileSystem().equals(FileSystems.getDefault())
-                || !FileSystems.getDefault().getSeparator().equals("\\")) {
-            throw new ZipBackupException("Filesystem cannot pin managed ZIP directories securely");
-        }
-    }
-
-    private static Path requireAbsolute(Path path) {
-        return Objects.requireNonNull(path, "path").toAbsolutePath().normalize();
-    }
-
-    private static String requireFileName(String name) {
-        Objects.requireNonNull(name, "name");
-        Path path = Path.of(name);
-        if (name.isBlank()
-                || path.isAbsolute()
-                || path.getNameCount() != 1
-                || !path.getFileName().toString().equals(name)
-                || name.equals(".")
-                || name.equals("..")) {
-            throw new IllegalArgumentException("Managed storage name is not a single file name");
-        }
-        return name;
-    }
-
-    private static void closeWithSuppression(AutoCloseable closeable, Throwable failure) {
-        if (closeable == null) {
-            return;
-        }
-        try {
-            closeable.close();
-        } catch (Exception closeException) {
-            failure.addSuppressed(closeException);
-        }
-    }
-
-    private static IOException close(AutoCloseable closeable, IOException failure) {
-        if (closeable == null) {
-            return failure;
-        }
-        try {
-            closeable.close();
-        } catch (Exception exception) {
-            IOException closeFailure = exception instanceof IOException ioException
-                    ? ioException
-                    : new IOException("Managed directory handle could not close", exception);
-            if (failure == null) {
-                return closeFailure;
-            }
-            failure.addSuppressed(closeFailure);
-        }
-        return failure;
-    }
-
-    static final class LockedFile implements AutoCloseable {
-        private final FileChannel channel;
-
-        private final FileLock lock;
-
-        private LockedFile(FileChannel channel, FileLock lock) {
-            this.channel = channel;
-            this.lock = lock;
-        }
-
-        @Override
-        public void close() throws IOException {
-            IOException failure = null;
-            failure = ManagedDirectoryAccess.close(lock, failure);
-            failure = ManagedDirectoryAccess.close(channel, failure);
-            if (failure != null) {
-                throw failure;
-            }
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ManagedPathGuard.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ManagedPathGuard.java
deleted file mode 100644
index 458905b..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ManagedPathGuard.java
+++ /dev/null
@@ -1,113 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import dev.ishaanko.worldarchive.core.FileSystemSafety;
-import dev.ishaanko.worldarchive.core.PathGuards;
-import java.io.IOException;
-import java.nio.file.FileAlreadyExistsException;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.nio.file.attribute.BasicFileAttributes;
-
-/** Rejects links, junctions, and other reparse components in managed storage paths. */
-final class ManagedPathGuard {
-    private ManagedPathGuard() {
-    }
-
-    static void createDirectories(Path directory, String message) throws IOException {
-        Path absolute = requireAbsolute(directory);
-        PathGuards.createDirectories(
-                absolute,
-                () -> new ZipBackupException(message),
-                attributeReader(message),
-                () -> new ZipBackupException(message));
-    }
-
-    static void requireDirectory(Path directory, String message) throws IOException {
-        Path absolute = requireAbsolute(directory);
-        PathGuards.requireDirectory(
-                absolute,
-                () -> new ZipBackupException(message),
-                attributeReader(message),
-                () -> new ZipBackupException(message));
-    }
-
-    static void requireExistingAncestors(Path path, String message) throws IOException {
-        Path absolute = requireAbsolute(path);
-        Path current = absolute.getRoot();
-        if (current == null) {
-            throw new ZipBackupException(message);
-        }
-        requireDirectoryComponent(current, message);
-        for (Path segment : absolute) {
-            current = current.resolve(segment);
-            if (!Files.exists(current, LinkOption.NOFOLLOW_LINKS)) {
-                return;
-            }
-            requireDirectoryComponent(current, message);
-        }
-    }
-
-    static BasicFileAttributes requireRegularFile(Path file, String message) throws IOException {
-        Path absolute = requireAbsolute(file);
-        Path parent = absolute.getParent();
-        if (parent == null) {
-            throw new ZipBackupException(message);
-        }
-        requireDirectory(parent, message);
-        BasicFileAttributes attributes = read(absolute, message);
-        if (!FileSystemSafety.isOrdinaryRegularFile(absolute, attributes)) {
-            throw new ZipBackupException(message);
-        }
-        return attributes;
-    }
-
-    static void createChildDirectories(Path trustedRoot, Path directory, String message)
-            throws IOException {
-        Path root = requireAbsolute(trustedRoot);
-        Path target = requireAbsolute(directory);
-        requireDirectory(root, message);
-        if (!target.startsWith(root)) {
-            throw new ZipBackupException(message);
-        }
-        Path current = root;
-        for (Path segment : root.relativize(target)) {
-            current = current.resolve(segment);
-            if (!Files.exists(current, LinkOption.NOFOLLOW_LINKS)) {
-                try {
-                    Files.createDirectory(current);
-                } catch (FileAlreadyExistsException exception) {
-                    // Validate the racing entry below.
-                }
-            }
-            requireDirectoryComponent(current, message);
-        }
-    }
-
-    private static Path requireAbsolute(Path path) throws ZipBackupException {
-        Path absolute = path.toAbsolutePath().normalize();
-        if (!absolute.isAbsolute()) {
-            throw new ZipBackupException("Managed path is not absolute");
-        }
-        return absolute;
-    }
-
-    private static void requireDirectoryComponent(Path component, String message) throws IOException {
-        BasicFileAttributes attributes = read(component, message);
-        if (!FileSystemSafety.isOrdinaryDirectory(component, attributes)) {
-            throw new ZipBackupException(message);
-        }
-    }
-
-    private static BasicFileAttributes read(Path path, String message) throws IOException {
-        try {
-            return Files.readAttributes(path, BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
-        } catch (IOException exception) {
-            throw new ZipBackupException(message, exception);
-        }
-    }
-
-    private static PathGuards.AttributeReader<ZipBackupException> attributeReader(String message) {
-        return path -> read(path, message);
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ManagedZipArchive.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ManagedZipArchive.java
index cdbf261..24e6270 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ManagedZipArchive.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ManagedZipArchive.java
@@ -4,34 +4,83 @@
 import dev.ishaanko.worldarchive.model.BackupManifest;
 import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
 import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Path;
 import java.time.ZoneOffset;
 import java.time.format.DateTimeFormatter;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
-/** The validated identity and paths for one managed ZIP archive pair. */
-record ManagedZipArchive(
-        WorldId worldId,
-        BackupId backupId,
-        Path archive,
-        Path checksum) {
+/**
+ * One archive in a store: {@code <root>/<world id>/<file name>}, next to its
+ * {@code .sha256} checksum file. Since 0.1.1 the file name reads
+ * {@code 2026-09-01_12-34-56Z - World - Label - <backup id>.zip}; 0.1.0 wrote
+ * {@code 20260901T123456789Z_<backup id>.zip}. Both forms stay valid, and the backup ID at the
+ * end of the name is the archive's identity.
+ */
+record ManagedZipArchive(WorldId worldId, BackupId backupId, Path archive) {
+    static final String CHECKSUM_SUFFIX = ".sha256";
+
+    static final String PARTIAL_SUFFIX = ".partial";
+
     private static final DateTimeFormatter FILE_TIMESTAMP = DateTimeFormatter
             .ofPattern("uuuu-MM-dd_HH-mm-ss'Z'")
             .withZone(ZoneOffset.UTC);
 
-    private static final int MAXIMUM_FILENAME_SEGMENT_UTF8_BYTES = 64;
+    private static final int MAXIMUM_NAME_SEGMENT_BYTES = 64;
 
-    private static final String BACKUP_ID_PATTERN =
-            "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
-
-    private static final Pattern ARCHIVE_NAME = Pattern.compile(
+    private static final Pattern FILENAME = Pattern.compile(
             "(?:[0-9]{8}T[0-9]{9}Z_"
                     + "|[0-9]{4}-[0-9]{2}-[0-9]{2}_[0-9]{2}-[0-9]{2}-[0-9]{2}Z - [^\\r\\n/\\\\]+ - )"
-                    + "(" + BACKUP_ID_PATTERN + ")\\.zip");
+                    + "([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\\.zip");
+
+    ManagedZipArchive {
+        Objects.requireNonNull(worldId, "worldId");
+        Objects.requireNonNull(backupId, "backupId");
+        Objects.requireNonNull(archive, "archive");
+    }
+
+    /** Where a store keeps the archive of this backup. */
+    static ManagedZipArchive of(Path root, BackupManifest manifest) {
+        return new ManagedZipArchive(
+                manifest.worldId(),
+                manifest.backupId(),
+                root.resolve(manifest.worldId().toString()).resolve(filename(manifest)));
+    }
+
+    /**
+     * Reads the identity of an archive path that must lie directly in a world folder of the
+     * root. Nothing is read from the disk.
+     */
+    static ManagedZipArchive resolve(Path root, Path archivePath) throws ZipBackupException {
+        Path archive = Objects.requireNonNull(archivePath, "archivePath").toAbsolutePath().normalize();
+        Path folder = archive.getParent();
+        Optional<BackupId> backupId = backupId(archive.getFileName().toString());
+        if (folder == null || !root.equals(folder.getParent()) || backupId.isEmpty()) {
+            throw new ZipBackupException("The file " + archive + " is not a WorldArchive ZIP backup in " + root + ".");
+        }
+        try {
+            return new ManagedZipArchive(WorldId.parse(folder.getFileName().toString()), backupId.get(), archive);
+        } catch (IllegalArgumentException exception) {
+            throw new ZipBackupException(
+                    "The file " + archive + " is not in the folder of a world in " + root + ".", exception);
+        }
+    }
+
+    /** The backup ID in a managed file name, or empty when the name is not one. */
+    static Optional<BackupId> backupId(String filename) {
+        Matcher matcher = FILENAME.matcher(filename);
+        if (!matcher.matches()) {
+            return Optional.empty();
+        }
+        try {
+            return Optional.of(BackupId.parse(matcher.group(1)));
+        } catch (IllegalArgumentException nilIdentifier) {
+            return Optional.empty();
+        }
+    }
 
     static String filename(BackupManifest manifest) {
         String description = manifest.label().orElseGet(() -> switch (manifest.trigger()) {
@@ -45,50 +94,31 @@ static String filename(BackupManifest manifest) {
                 + " - " + manifest.backupId() + ".zip";
     }
 
-    static boolean matchesFilename(String filename) {
-        return ARCHIVE_NAME.matcher(filename).matches();
+    Path folder() {
+        return archive.getParent();
     }
 
-    static ManagedZipArchive resolve(Path root, Path archivePath) throws IOException {
-        ManagedPathGuard.requireDirectory(root, "ZIP destination contains an unsafe path component");
-        Path archive = Objects.requireNonNull(archivePath, "archivePath")
-                .toAbsolutePath()
-                .normalize();
-        Path parent = archive.getParent();
-        if (parent == null || parent.getParent() == null || !parent.getParent().equals(root)) {
-            throw new ZipBackupException("ZIP archive is outside the configured destination");
-        }
-        ManagedPathGuard.requireDirectory(
-                parent, "ZIP archive parent contains an unsafe path component");
-        WorldId worldId;
-        BackupId backupId;
-        try {
-            worldId = WorldId.parse(parent.getFileName().toString());
-            Matcher matcher = ARCHIVE_NAME.matcher(archive.getFileName().toString());
-            if (!matcher.matches()) {
-                throw new IllegalArgumentException(
-                        "Archive filename does not match the managed format");
-            }
-            backupId = BackupId.parse(matcher.group(1));
-        } catch (IllegalArgumentException exception) {
-            throw new ZipBackupException(
-                    "ZIP archive does not have a managed identity", exception);
-        }
-        return new ManagedZipArchive(
-                worldId,
-                backupId,
-                archive,
-                parent.resolve(archive.getFileName().toString() + ".sha256"));
+    String name() {
+        return archive.getFileName().toString();
     }
 
-    String archiveName() {
-        return archive.getFileName().toString();
+    Path checksum() {
+        return archive.resolveSibling(name() + CHECKSUM_SUFFIX);
+    }
+
+    /** The file a create or an import writes before it renames it to the archive. */
+    Path partial() {
+        return archive.resolveSibling(name() + PARTIAL_SUFFIX);
     }
 
-    String checksumName() {
-        return checksum.getFileName().toString();
+    Path checksumPartial() {
+        return archive.resolveSibling(name() + CHECKSUM_SUFFIX + PARTIAL_SUFFIX);
     }
 
+    /**
+     * Keeps a readable name segment within a byte limit, without characters Windows forbids.
+     * Recovery and import recompute the names of stored archives, so the result must never change.
+     */
     private static String filenameSegment(String value, String fallback) {
         String sanitized = value
                 .replaceAll("[<>:\"/\\\\|?*\\p{Cntrl}]", " ")
@@ -98,23 +128,19 @@ private static String filenameSegment(String value, String fallback) {
         if (sanitized.isBlank() || SensitiveDataRedactor.containsSensitiveData(sanitized)) {
             return fallback;
         }
-        if (sanitized.getBytes(StandardCharsets.UTF_8).length
-                > MAXIMUM_FILENAME_SEGMENT_UTF8_BYTES) {
-            sanitized = truncateUtf8(
-                            sanitized,
-                            MAXIMUM_FILENAME_SEGMENT_UTF8_BYTES)
-                    .replaceAll("[. ]+$", "");
+        if (sanitized.getBytes(StandardCharsets.UTF_8).length > MAXIMUM_NAME_SEGMENT_BYTES) {
+            sanitized = truncateUtf8(sanitized).replaceAll("[. ]+$", "");
         }
         return sanitized.isBlank() ? fallback : sanitized;
     }
 
-    private static String truncateUtf8(String value, int maximumBytes) {
+    private static String truncateUtf8(String value) {
         int offset = 0;
         int bytes = 0;
         while (offset < value.length()) {
             int codePoint = value.codePointAt(offset);
             int encodedBytes = utf8Length(codePoint);
-            if (bytes + encodedBytes > maximumBytes) {
+            if (bytes + encodedBytes > MAXIMUM_NAME_SEGMENT_BYTES) {
                 break;
             }
             bytes += encodedBytes;
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/PortableZipPath.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/PortableZipPath.java
deleted file mode 100644
index 1f5a57a..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/PortableZipPath.java
+++ /dev/null
@@ -1,94 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Path;
-import java.text.Normalizer;
-import java.util.Locale;
-import java.util.Set;
-
-/** Cross-platform ZIP path validation and collision normalization. */
-final class PortableZipPath {
-    private static final Set<String> WINDOWS_DEVICES = Set.of(
-            "CON", "PRN", "AUX", "NUL",
-            "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9",
-            "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9");
-
-    private static final String WINDOWS_INVALID = "<>\"|?*";
-
-    private PortableZipPath() {
-    }
-
-    static String fromRelativePath(Path relative) {
-        StringBuilder portable = new StringBuilder();
-        for (Path segment : relative) {
-            if (!portable.isEmpty()) {
-                portable.append('/');
-            }
-            portable.append(segment);
-        }
-        String result = portable.toString();
-        validate(result, false);
-        return result;
-    }
-
-    static String collisionKey(String entryName, boolean directory) {
-        String value = validate(entryName, directory);
-        return Normalizer.normalize(value, Normalizer.Form.NFC).toLowerCase(Locale.ROOT);
-    }
-
-    static String validate(String entryName, boolean directory) {
-        if (entryName == null || entryName.isEmpty() || entryName.indexOf('\0') >= 0) {
-            throw new IllegalArgumentException("ZIP entry path is empty or contains NUL");
-        }
-        if (entryName.getBytes(StandardCharsets.UTF_8).length > ZipLimits.MAXIMUM_PATH_UTF8_BYTES) {
-            throw new IllegalArgumentException("ZIP entry path exceeds its portable byte limit");
-        }
-        if (entryName.startsWith("/") || entryName.startsWith("\\") || hasDrivePrefix(entryName)) {
-            throw new IllegalArgumentException("ZIP entry path is absolute");
-        }
-        if (entryName.indexOf('\\') >= 0) {
-            throw new IllegalArgumentException("ZIP entry path contains a non-portable separator");
-        }
-        String value = entryName;
-        if (directory) {
-            if (!value.endsWith("/") || value.length() == 1) {
-                throw new IllegalArgumentException("ZIP directory entry is malformed");
-            }
-            value = value.substring(0, value.length() - 1);
-        } else if (value.endsWith("/")) {
-            throw new IllegalArgumentException("ZIP file entry has a directory suffix");
-        }
-        String[] segments = value.split("/", -1);
-        for (String segment : segments) {
-            validateSegment(segment);
-        }
-        return value;
-    }
-
-    private static boolean hasDrivePrefix(String path) {
-        return path.length() >= 2 && Character.isLetter(path.charAt(0)) && path.charAt(1) == ':';
-    }
-
-    private static void validateSegment(String segment) {
-        if (segment.isEmpty() || segment.equals(".") || segment.equals("..")) {
-            throw new IllegalArgumentException("ZIP entry path contains an unsafe segment");
-        }
-        if (segment.getBytes(StandardCharsets.UTF_8).length
-                > ZipLimits.MAXIMUM_SEGMENT_UTF8_BYTES) {
-            throw new IllegalArgumentException("ZIP entry path segment exceeds its byte limit");
-        }
-        if (segment.endsWith(".") || segment.endsWith(" ")) {
-            throw new IllegalArgumentException("ZIP entry path has a non-portable suffix");
-        }
-        if (segment.indexOf(':') >= 0 || segment.chars().anyMatch(character -> WINDOWS_INVALID.indexOf(character) >= 0)) {
-            throw new IllegalArgumentException("ZIP entry path contains a non-portable character");
-        }
-        if (segment.chars().anyMatch(character -> Character.isISOControl(character))) {
-            throw new IllegalArgumentException("ZIP entry path contains a control character");
-        }
-        String base = segment.split("\\.", 2)[0].toUpperCase(Locale.ROOT);
-        if (WINDOWS_DEVICES.contains(base)) {
-            throw new IllegalArgumentException("ZIP entry path uses a reserved device name");
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveDamagedException.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveDamagedException.java
new file mode 100644
index 0000000..04f539d
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveDamagedException.java
@@ -0,0 +1,16 @@
+package dev.ishaanko.worldarchive.storage.zip;
+
+/**
+ * A ZIP file that is not a whole WorldArchive backup: damaged, cut short, changed after it was
+ * made, or never a WorldArchive backup. Other {@link java.io.IOException}s mean the file could
+ * not be read at all, so a later attempt may still succeed; this one will not.
+ */
+public final class ZipArchiveDamagedException extends ZipBackupException {
+    public ZipArchiveDamagedException(String message) {
+        super(message);
+    }
+
+    public ZipArchiveDamagedException(String message, Throwable cause) {
+        super(message, cause);
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveExtractor.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveExtractor.java
deleted file mode 100644
index a730688..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveExtractor.java
+++ /dev/null
@@ -1,229 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import dev.ishaanko.worldarchive.core.Digests;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InterruptedIOException;
-import java.io.OutputStream;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.DirectoryStream;
-import java.nio.file.FileVisitResult;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.nio.file.SimpleFileVisitor;
-import java.nio.file.StandardOpenOption;
-import java.nio.file.attribute.BasicFileAttributes;
-import java.nio.file.attribute.FileTime;
-import java.security.MessageDigest;
-import java.util.Enumeration;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipFile;
-
-/** Safely extracts an inventoried ZIP into one identity-pinned staging directory. */
-final class ZipArchiveExtractor {
-    private ZipArchiveExtractor() {
-    }
-
-    static StagingDirectory openEmpty(Path stagingDirectory) throws IOException {
-        Path staging = Objects.requireNonNull(stagingDirectory, "stagingDirectory")
-                .toAbsolutePath()
-                .normalize();
-        ManagedPathGuard.requireDirectory(
-                staging, "ZIP restore staging path contains an unsafe component");
-        try (DirectoryStream<Path> entries = Files.newDirectoryStream(staging)) {
-            if (entries.iterator().hasNext()) {
-                throw new ZipBackupException("ZIP restore staging directory must be empty");
-            }
-        }
-        BasicFileAttributes attributes = Files.readAttributes(
-                staging, BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
-        return new StagingDirectory(staging, DirectoryIdentity.from(attributes));
-    }
-
-    static void extract(
-            Path archive,
-            StagingDirectory staging,
-            ZipInventory inventory,
-            ZipStoreHooks hooks) throws IOException {
-        // Network shares and some virtual filesystems report zero when they cannot measure
-        // free space; zero means unknown, not full.
-        long usableSpace = Files.getFileStore(staging.path()).getUsableSpace();
-        if (usableSpace > 0 && inventory.byteCount() > usableSpace) {
-            throw new ZipBackupException(
-                    "ZIP restore staging storage has insufficient free space");
-        }
-        Map<String, ZipInventoryEntry> expected = new HashMap<>();
-        for (ZipInventoryEntry file : inventory.files()) {
-            expected.put(PortableZipPath.collisionKey(file.path(), false), file);
-        }
-        Set<String> seen = new HashSet<>();
-        byte[] buffer = new byte[Digests.COPY_BUFFER_BYTES];
-        try (ZipFile zip = new ZipFile(archive.toFile(), StandardCharsets.UTF_8)) {
-            Enumeration<? extends ZipEntry> entries = zip.entries();
-            while (entries.hasMoreElements()) {
-                requireNotInterrupted();
-                staging.requireIdentity();
-                ZipEntry entry = entries.nextElement();
-                String name = entry.getName();
-                if (name.equals(ZipArchiveFormat.MANIFEST_ENTRY)
-                        || name.equals(ZipArchiveFormat.INVENTORY_ENTRY)
-                        || name.equals(ZipArchiveFormat.WORLD_PREFIX)) {
-                    continue;
-                }
-                if (!name.startsWith(ZipArchiveFormat.WORLD_PREFIX)) {
-                    throw new ZipBackupException(
-                            "ZIP archive contains data outside the world namespace");
-                }
-                String relative = name.substring(ZipArchiveFormat.WORLD_PREFIX.length());
-                Path target = resolveInside(staging.path(), relative, entry.isDirectory());
-                if (entry.isDirectory()) {
-                    createSafeDirectories(staging.path(), target);
-                    hooks.restoreEntryExtracted(target);
-                    continue;
-                }
-                ZipInventoryEntry expectedFile = expectedFile(expected, seen, relative);
-                createSafeDirectories(staging.path(), target.getParent());
-                staging.requireIdentity();
-                extractFile(zip, entry, target, expectedFile, buffer);
-                hooks.restoreEntryExtracted(target);
-                staging.requireIdentity();
-            }
-        }
-        if (seen.size() != expected.size()) {
-            throw new ZipBackupException("ZIP archive is missing inventoried files");
-        }
-    }
-
-    static void cleanupFailure(StagingDirectory staging, Throwable failure) {
-        try {
-            staging.requireIdentity();
-            Files.walkFileTree(staging.path(), new SimpleFileVisitor<>() {
-                @Override
-                public FileVisitResult visitFile(Path file, BasicFileAttributes attributes)
-                        throws IOException {
-                    Files.delete(file);
-                    return FileVisitResult.CONTINUE;
-                }
-
-                @Override
-                public FileVisitResult postVisitDirectory(Path directory, IOException exception)
-                        throws IOException {
-                    if (exception != null) {
-                        throw exception;
-                    }
-                    if (!directory.equals(staging.path())) {
-                        Files.delete(directory);
-                    }
-                    return FileVisitResult.CONTINUE;
-                }
-            });
-            openEmpty(staging.path());
-        } catch (IOException | RuntimeException cleanupFailure) {
-            failure.addSuppressed(cleanupFailure);
-        }
-    }
-
-    private static ZipInventoryEntry expectedFile(
-            Map<String, ZipInventoryEntry> expected,
-            Set<String> seen,
-            String relative) throws ZipBackupException {
-        String key = PortableZipPath.collisionKey(relative, false);
-        ZipInventoryEntry file = expected.get(key);
-        if (file == null || !file.path().equals(relative) || !seen.add(key)) {
-            throw new ZipBackupException("ZIP archive inventory changed during restoration");
-        }
-        return file;
-    }
-
-    private static void extractFile(
-            ZipFile zip,
-            ZipEntry entry,
-            Path target,
-            ZipInventoryEntry expected,
-            byte[] buffer) throws IOException {
-        MessageDigest digest = Digests.sha256();
-        long written = 0;
-        try (InputStream input = zip.getInputStream(entry);
-                OutputStream output = Files.newOutputStream(
-                        target,
-                        StandardOpenOption.CREATE_NEW,
-                        StandardOpenOption.WRITE,
-                        LinkOption.NOFOLLOW_LINKS)) {
-            int read;
-            while ((read = input.read(buffer)) >= 0) {
-                requireNotInterrupted();
-                if (read == 0) {
-                    continue;
-                }
-                written = Math.addExact(written, read);
-                if (written > expected.size()) {
-                    throw new ZipBackupException("ZIP entry exceeds its inventoried size");
-                }
-                output.write(buffer, 0, read);
-                digest.update(buffer, 0, read);
-            }
-        } catch (ArithmeticException exception) {
-            throw new ZipBackupException("ZIP restoration size overflow", exception);
-        }
-        if (written != expected.size()
-                || !Digests.hex(digest.digest()).equals(expected.sha256())) {
-            throw new ZipBackupException(
-                    "ZIP entry failed integrity checking during restoration");
-        }
-    }
-
-    private static Path resolveInside(Path staging, String relative, boolean directory)
-            throws ZipBackupException {
-        String value;
-        try {
-            value = PortableZipPath.validate(relative, directory);
-        } catch (IllegalArgumentException exception) {
-            throw new ZipBackupException("ZIP entry path cannot be restored safely", exception);
-        }
-        Path resolved = staging;
-        for (String segment : value.split("/")) {
-            resolved = resolved.resolve(segment);
-        }
-        resolved = resolved.normalize();
-        if (!resolved.startsWith(staging) || resolved.equals(staging)) {
-            throw new ZipBackupException("ZIP entry escapes its staging directory");
-        }
-        return resolved;
-    }
-
-    private static void createSafeDirectories(Path staging, Path directory) throws IOException {
-        ManagedPathGuard.createChildDirectories(
-                staging, directory, "ZIP restore encountered a link or special directory");
-    }
-
-    private static void requireNotInterrupted() throws InterruptedIOException {
-        if (Thread.currentThread().isInterrupted()) {
-            throw new InterruptedIOException("ZIP operation was interrupted");
-        }
-    }
-
-    record StagingDirectory(Path path, DirectoryIdentity identity) {
-        void requireIdentity() throws IOException {
-            ManagedPathGuard.requireDirectory(
-                    path, "ZIP restore staging directory became unsafe");
-            BasicFileAttributes attributes = Files.readAttributes(
-                    path, BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
-            if (!identity.equals(DirectoryIdentity.from(attributes))) {
-                throw new ZipBackupException(
-                        "ZIP restore staging directory was replaced during extraction");
-            }
-        }
-    }
-
-    record DirectoryIdentity(Object fileKey, FileTime creationTime) {
-        private static DirectoryIdentity from(BasicFileAttributes attributes) {
-            return new DirectoryIdentity(attributes.fileKey(), attributes.creationTime());
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveFormat.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveFormat.java
index 84a693c..6e9f613 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveFormat.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveFormat.java
@@ -1,19 +1,130 @@
 package dev.ishaanko.worldarchive.storage.zip;
 
-/** Stable archive namespace shared by creation, verification, and restoration. */
-final class ZipArchiveFormat {
-    static final String METADATA_PREFIX = "META-INF/worldarchive/";
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import com.google.gson.JsonArray;
+import com.google.gson.JsonObject;
+import dev.ishaanko.worldarchive.core.WorldInventory;
+import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.BackupManifestJson;
+import dev.ishaanko.worldarchive.support.JsonFields;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.List;
 
-    static final String MANIFEST_ENTRY = METADATA_PREFIX + "manifest.json";
+/**
+ * The layout every WorldArchive ZIP has had since 0.1.0, and the JSON of its two metadata
+ * entries. The manifest is the first entry, the world follows under {@code world/} with an
+ * entry for every folder, and the inventory, with the size and SHA-256 of each file, is the last
+ * entry. Stored archives depend on the names and on the JSON bytes, so change neither.
+ */
+final class ZipArchiveFormat {
+    static final String MANIFEST_ENTRY = "META-INF/worldarchive/manifest.json";
 
-    static final String INVENTORY_ENTRY = METADATA_PREFIX + "inventory.json";
+    static final String INVENTORY_ENTRY = "META-INF/worldarchive/inventory.json";
 
     static final String WORLD_PREFIX = "world/";
 
-    static final int MAXIMUM_MANIFEST_BYTES = 1_024 * 1_024;
+    /** Far above any real manifest; bounds what a damaged archive can make a reader load. */
+    static final int MAXIMUM_MANIFEST_BYTES = 1 << 20;
+
+    /** A world at the {@link WorldInventory#MAXIMUM_FILES} limit needs about 100 MiB of JSON. */
+    static final int MAXIMUM_INVENTORY_BYTES = 256 << 20;
+
+    private static final int INVENTORY_FORMAT_VERSION = 1;
+
+    private static final String DIGEST_ALGORITHM = "SHA-256";
 
-    static final int MAXIMUM_INVENTORY_BYTES = 64 * 1_024 * 1_024;
+    private static final Gson GSON = new GsonBuilder().setPrettyPrinting().disableHtmlEscaping().create();
+
+    private static final JsonFields<IOException> JSON = new JsonFields<>(IOException::new);
 
     private ZipArchiveFormat() {
     }
+
+    static byte[] encodeManifest(BackupManifest manifest) {
+        JsonObject root = new JsonObject();
+        BackupManifestJson.write(manifest, root);
+        return encode(root);
+    }
+
+    static BackupManifest decodeManifest(byte[] encoded) throws ZipArchiveDamagedException {
+        JsonObject root;
+        int formatVersion;
+        try {
+            root = JSON.parseObject(new String(encoded, StandardCharsets.UTF_8), "ZIP manifest");
+            formatVersion = JSON.requiredInt(root, "formatVersion");
+        } catch (IOException exception) {
+            throw new ZipArchiveDamagedException("The backup manifest inside the ZIP file cannot be read.", exception);
+        }
+        if (formatVersion > BackupManifest.CURRENT_FORMAT_VERSION) {
+            throw new ZipArchiveDamagedException(
+                    "A newer version of WorldArchive made this ZIP backup. Update WorldArchive to use it.");
+        }
+        try {
+            return BackupManifestJson.read(root, JSON);
+        } catch (IOException | IllegalArgumentException exception) {
+            throw new ZipArchiveDamagedException("The backup manifest inside the ZIP file cannot be read.", exception);
+        }
+    }
+
+    static byte[] encodeInventory(WorldInventory inventory) {
+        JsonObject root = new JsonObject();
+        root.addProperty("formatVersion", INVENTORY_FORMAT_VERSION);
+        root.addProperty("algorithm", DIGEST_ALGORITHM);
+        root.addProperty("fileCount", inventory.fileCount());
+        root.addProperty("byteCount", inventory.byteCount());
+        root.addProperty("inventorySha256", inventory.inventorySha256());
+        JsonArray files = new JsonArray();
+        for (WorldInventory.Entry file : inventory.files()) {
+            JsonObject encoded = new JsonObject();
+            encoded.addProperty("path", file.path());
+            encoded.addProperty("size", file.size());
+            encoded.addProperty("sha256", file.sha256());
+            files.add(encoded);
+        }
+        root.add("files", files);
+        return encode(root);
+    }
+
+    /** Decodes an inventory whose entries are sorted, portable, and agree with its own totals. */
+    static WorldInventory decodeInventory(byte[] encoded) throws ZipArchiveDamagedException {
+        try {
+            JsonObject root = JSON.parseObject(new String(encoded, StandardCharsets.UTF_8), "ZIP inventory");
+            if (JSON.requiredInt(root, "formatVersion") != INVENTORY_FORMAT_VERSION
+                    || !DIGEST_ALGORITHM.equals(JSON.requiredString(root, "algorithm"))) {
+                throw new IOException("Unsupported inventory format");
+            }
+            List<JsonObject> files = JSON.requiredObjects(root, "files");
+            List<WorldInventory.Entry> entries = new ArrayList<>(files.size());
+            for (JsonObject file : files) {
+                entries.add(new WorldInventory.Entry(
+                        JSON.requiredString(file, "path"),
+                        JSON.requiredLong(file, "size"),
+                        JSON.requiredString(file, "sha256")));
+            }
+            WorldInventory inventory = new WorldInventory(entries);
+            if (JSON.requiredLong(root, "fileCount") != inventory.fileCount()
+                    || JSON.requiredLong(root, "byteCount") != inventory.byteCount()
+                    || !JSON.requiredString(root, "inventorySha256").equals(inventory.inventorySha256())) {
+                throw new IOException("Inventory totals do not match its files");
+            }
+            return inventory;
+        } catch (IOException | IllegalArgumentException exception) {
+            throw new ZipArchiveDamagedException("The file list inside the ZIP backup cannot be read.", exception);
+        }
+    }
+
+    /** True when the inventory holds exactly the files that the manifest's counts and digests describe. */
+    static boolean matches(WorldInventory inventory, BackupManifest manifest) {
+        return inventory.fileCount() == manifest.sourceFileCount()
+                && inventory.byteCount() == manifest.sourceByteCount()
+                && inventory.contentSha256().equals(manifest.contentSha256())
+                && inventory.inventorySha256().equals(manifest.inventorySha256());
+    }
+
+    private static byte[] encode(JsonObject object) {
+        return (GSON.toJson(object) + "\n").getBytes(StandardCharsets.UTF_8);
+    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveInspector.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveInspector.java
deleted file mode 100644
index 1d71c26..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveInspector.java
+++ /dev/null
@@ -1,706 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import dev.ishaanko.worldarchive.core.Digests;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InterruptedIOException;
-import java.nio.ByteBuffer;
-import java.nio.ByteOrder;
-import java.nio.channels.Channels;
-import java.nio.channels.SeekableByteChannel;
-import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.Set;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipInputStream;
-
-/** Defensive structural and byte-level verification over one already-open archive handle. */
-final class ZipArchiveInspector {
-    private static final int END_RECORD_BYTES = 22;
-
-    private static final int MAXIMUM_COMMENT_BYTES = 65_535;
-
-    private static final int ZIP64_LOCATOR_BYTES = 20;
-
-    private static final int ZIP64_END_MINIMUM_BYTES = 56;
-
-    private static final int CENTRAL_DIRECTORY_HEADER_BYTES = 46;
-
-    private static final int UNIX_FILE_TYPE_MASK = 0170000;
-
-    private static final int UNIX_REGULAR_FILE = 0100000;
-
-    private static final int UNIX_DIRECTORY = 0040000;
-
-    private static final int UNIX_SYMBOLIC_LINK = 0120000;
-
-    private static final int WINDOWS_REPARSE_POINT = 0x400;
-
-    private ZipArchiveInspector() {
-    }
-
-    static Inspection inspect(SeekableByteChannel archive) throws IOException {
-        long archiveSize = archive.size();
-        if (archiveSize <= 0 || archiveSize > ZipLimits.MAXIMUM_ARCHIVE_BYTES) {
-            throw new IOException("ZIP archive has an invalid size");
-        }
-        archive.position(0);
-        ArchiveScan scan = new ArchiveScan(
-                ZipLimits.maximumUncompressedBytes(archiveSize));
-        InputStream channelInput = new NonClosingInputStream(Channels.newInputStream(archive));
-        try (ZipInputStream zip = new ZipInputStream(channelInput, StandardCharsets.UTF_8)) {
-            ZipEntry entry;
-            while ((entry = zip.getNextEntry()) != null) {
-                scan.accept(entry, zip);
-                zip.closeEntry();
-            }
-        }
-        return scan.finish(archive, archiveSize);
-    }
-
-    /**
-     * Reads the embedded manifest without verifying the archive. The writer stores the
-     * manifest as the first entry, so this normally decompresses only that entry. It gives
-     * listings an identity and a creation time; call {@link #inspect} before trusting the
-     * world files.
-     */
-    static BackupManifest readLeadingManifest(SeekableByteChannel archive) throws IOException {
-        long archiveSize = archive.size();
-        if (archiveSize <= 0 || archiveSize > ZipLimits.MAXIMUM_ARCHIVE_BYTES) {
-            throw new IOException("ZIP archive has an invalid size");
-        }
-        archive.position(0);
-        long[] uncompressedBytes = {0, ZipLimits.maximumUncompressedBytes(archiveSize)};
-        InputStream channelInput = new NonClosingInputStream(Channels.newInputStream(archive));
-        try (ZipInputStream zip = new ZipInputStream(channelInput, StandardCharsets.UTF_8)) {
-            ZipEntry entry;
-            while ((entry = zip.getNextEntry()) != null) {
-                requireNotInterrupted();
-                if (entry.getName().equals(ZipArchiveFormat.MANIFEST_ENTRY)
-                        && !entry.isDirectory()) {
-                    byte[] encoded = readLimited(
-                            zip,
-                            entry.getSize(),
-                            ZipArchiveFormat.MAXIMUM_MANIFEST_BYTES,
-                            uncompressedBytes);
-                    return ZipMetadataCodec.decodeManifest(encoded);
-                }
-                drain(zip, uncompressedBytes);
-                zip.closeEntry();
-            }
-        }
-        throw new IOException("ZIP archive manifest is missing");
-    }
-
-    private static BackupManifest decodeManifest(byte[] encoded, Set<String> problems) {
-        if (encoded == null) {
-            problems.add("Archive manifest is missing.");
-            return null;
-        }
-        try {
-            return ZipMetadataCodec.decodeManifest(encoded);
-        } catch (IOException | RuntimeException exception) {
-            problems.add("Archive manifest is malformed.");
-            return null;
-        }
-    }
-
-    private static boolean registerPathKind(
-            String name,
-            boolean directory,
-            Map<String, Boolean> pathKinds) {
-        String value = PortableZipPath.validate(name, directory);
-        String[] segments = value.split("/");
-        StringBuilder prefix = new StringBuilder();
-        for (int index = 0; index < segments.length; index++) {
-            if (!prefix.isEmpty()) {
-                prefix.append('/');
-            }
-            prefix.append(segments[index]);
-            boolean expectedDirectory = directory || index < segments.length - 1;
-            String key = PortableZipPath.collisionKey(prefix.toString(), false);
-            Boolean previous = pathKinds.putIfAbsent(key, expectedDirectory);
-            if (previous != null && previous != expectedDirectory) {
-                return false;
-            }
-        }
-        return true;
-    }
-
-    private static ZipInventory decodeInventory(byte[] encoded, Set<String> problems) {
-        if (encoded == null) {
-            problems.add("Archive inventory is missing.");
-            return null;
-        }
-        try {
-            return ZipMetadataCodec.decodeInventory(encoded);
-        } catch (IOException | RuntimeException exception) {
-            problems.add("Archive inventory is malformed.");
-            return null;
-        }
-    }
-
-    private static VerificationCounts verifyInventory(
-            BackupManifest manifest,
-            ZipInventory inventory,
-            List<ObservedFile> observed,
-            Set<String> problems) {
-        if (manifest == null || inventory == null) {
-            return new VerificationCounts(0, 0);
-        }
-        if (!inventory.matches(manifest)) {
-            problems.add("Archive manifest digests do not match the ZIP inventory.");
-        }
-
-        Map<String, ZipInventoryEntry> expected = new HashMap<>();
-        for (ZipInventoryEntry file : inventory.files()) {
-            expected.put(PortableZipPath.collisionKey(file.path(), false), file);
-        }
-        Set<String> seen = new HashSet<>();
-        long verifiedFiles = 0;
-        long verifiedBytes = 0;
-        for (ObservedFile file : observed) {
-            String key = PortableZipPath.collisionKey(file.path(), false);
-            ZipInventoryEntry expectedFile = expected.get(key);
-            if (expectedFile == null || !expectedFile.path().equals(file.path())) {
-                problems.add("Archive contains a world file absent from its inventory.");
-                continue;
-            }
-            if (!seen.add(key)) {
-                problems.add("Archive contains duplicate inventory file data.");
-                continue;
-            }
-            if (file.size() != expectedFile.size()) {
-                problems.add("Archive entry byte count does not match its inventory.");
-                continue;
-            }
-            if (!file.sha256().equals(expectedFile.sha256())) {
-                problems.add("Archive entry checksum does not match its inventory.");
-                continue;
-            }
-            verifiedFiles++;
-            verifiedBytes = Math.addExact(verifiedBytes, file.size());
-        }
-        if (seen.size() != expected.size()) {
-            problems.add("Archive is missing one or more inventoried world files.");
-        }
-        return new VerificationCounts(verifiedFiles, verifiedBytes);
-    }
-
-    private static byte[] readLimited(
-            InputStream input,
-            long declaredSize,
-            int maximumBytes,
-            long[] aggregateBytes) throws IOException {
-        if (declaredSize > maximumBytes) {
-            throw new IOException("ZIP metadata exceeds its safety limit");
-        }
-        int initialCapacity = declaredSize >= 0
-                ? (int) Math.min(declaredSize, maximumBytes)
-                : Math.min(8_192, maximumBytes);
-        try (ByteArrayOutputStream output = new ByteArrayOutputStream(initialCapacity)) {
-            byte[] buffer = new byte[Math.min(Digests.COPY_BUFFER_BYTES, maximumBytes)];
-            int total = 0;
-            int read;
-            while ((read = input.read(buffer)) >= 0) {
-                requireNotInterrupted();
-                if (read == 0) {
-                    continue;
-                }
-                total = Math.addExact(total, read);
-                addUncompressed(aggregateBytes, read);
-                if (total > maximumBytes) {
-                    throw new IOException("ZIP metadata exceeds its safety limit");
-                }
-                output.write(buffer, 0, read);
-            }
-            return output.toByteArray();
-        } catch (ArithmeticException exception) {
-            throw new IOException("ZIP metadata size overflow", exception);
-        }
-    }
-
-    private static DigestResult digest(InputStream input, long[] aggregateBytes)
-            throws IOException {
-        MessageDigest digest = Digests.sha256();
-        byte[] buffer = new byte[Digests.COPY_BUFFER_BYTES];
-        long total = 0;
-        try {
-            int read;
-            while ((read = input.read(buffer)) >= 0) {
-                requireNotInterrupted();
-                if (read == 0) {
-                    continue;
-                }
-                total = Math.addExact(total, read);
-                addUncompressed(aggregateBytes, read);
-                digest.update(buffer, 0, read);
-            }
-        } catch (ArithmeticException exception) {
-            throw new IOException("ZIP entry size overflow", exception);
-        }
-        return new DigestResult(total, Digests.hex(digest.digest()));
-    }
-
-    private static long drain(InputStream input, long[] aggregateBytes) throws IOException {
-        byte[] buffer = new byte[Digests.COPY_BUFFER_BYTES];
-        long total = 0;
-        try {
-            int read;
-            while ((read = input.read(buffer)) >= 0) {
-                requireNotInterrupted();
-                if (read == 0) {
-                    continue;
-                }
-                total = Math.addExact(total, read);
-                addUncompressed(aggregateBytes, read);
-            }
-        } catch (ArithmeticException exception) {
-            throw new IOException("ZIP entry size overflow", exception);
-        }
-        return total;
-    }
-
-    private static void addUncompressed(long[] aggregateBytes, int read) throws IOException {
-        try {
-            aggregateBytes[0] = Math.addExact(aggregateBytes[0], read);
-        } catch (ArithmeticException exception) {
-            throw new IOException("ZIP uncompressed size overflow", exception);
-        }
-        if (aggregateBytes[0] > aggregateBytes[1]) {
-            throw new IOException("ZIP archive exceeds its uncompressed size limit");
-        }
-    }
-
-    private static void validateCentralDirectory(
-            SeekableByteChannel archive,
-            long archiveSize,
-            List<StreamedEntry> streamedEntries,
-            Set<String> problems) throws IOException {
-        int tailLength = (int) Math.min(
-                archiveSize, END_RECORD_BYTES + MAXIMUM_COMMENT_BYTES);
-        byte[] tail = readAt(archive, archiveSize - tailLength, tailLength);
-        int endIndex = findEndRecord(tail);
-        if (endIndex < 0) {
-            throw new IOException("ZIP central directory end record is missing");
-        }
-        long endOffset = archiveSize - tailLength + endIndex;
-        int disk = unsignedShort(tail, endIndex + 4);
-        int centralDisk = unsignedShort(tail, endIndex + 6);
-        int diskEntries = unsignedShort(tail, endIndex + 8);
-        int totalEntries = unsignedShort(tail, endIndex + 10);
-        long centralSize = unsignedInt(tail, endIndex + 12);
-        long centralOffset = unsignedInt(tail, endIndex + 16);
-        if (disk != 0 || centralDisk != 0 || diskEntries != totalEntries) {
-            throw new IOException("Multi-disk ZIP archives are unsupported");
-        }
-
-        boolean zip64 = totalEntries == 0xffff
-                || centralSize == 0xffff_ffffL
-                || centralOffset == 0xffff_ffffL;
-        long expectedCentralEnd = endOffset;
-        long entryCount = totalEntries;
-        if (zip64) {
-            Zip64End zip64End = readZip64End(archive, endOffset);
-            centralSize = zip64End.centralSize();
-            centralOffset = zip64End.centralOffset();
-            entryCount = zip64End.entryCount();
-            expectedCentralEnd = zip64End.offset();
-        }
-        if (entryCount < 0
-                || entryCount > ZipLimits.MAXIMUM_ARCHIVE_ENTRIES
-                || entryCount != streamedEntries.size()) {
-            throw new IOException("ZIP central directory entry count is invalid");
-        }
-        long centralEnd;
-        try {
-            centralEnd = Math.addExact(centralOffset, centralSize);
-        } catch (ArithmeticException exception) {
-            throw new IOException("ZIP central directory size overflow", exception);
-        }
-        if (centralOffset < 0 || centralSize < 0 || centralEnd != expectedCentralEnd) {
-            throw new IOException("ZIP central directory bounds are invalid");
-        }
-        inspectCentralDirectoryEntries(
-                archive, centralOffset, centralEnd, streamedEntries, problems);
-    }
-
-    private static void inspectCentralDirectoryEntries(
-            SeekableByteChannel archive,
-            long centralOffset,
-            long centralEnd,
-            List<StreamedEntry> streamedEntries,
-            Set<String> problems) throws IOException {
-        long offset = centralOffset;
-        for (int index = 0; index < streamedEntries.size(); index++) {
-            requireNotInterrupted();
-            if (offset < 0 || offset > centralEnd - CENTRAL_DIRECTORY_HEADER_BYTES) {
-                throw new IOException("ZIP central directory entry is truncated");
-            }
-            byte[] header = readAt(archive, offset, CENTRAL_DIRECTORY_HEADER_BYTES);
-            CentralEntryHeader metadata = centralEntryHeader(header);
-            byte[] centralName = readAt(
-                    archive,
-                    offset + CENTRAL_DIRECTORY_HEADER_BYTES,
-                    metadata.nameLength());
-            requireMatchingCentralName(centralName, streamedEntries.get(index));
-            if (containsSpecialEntry(metadata)) {
-                problems.add("Archive contains a symbolic-link or special entry.");
-            }
-            offset = nextCentralOffset(offset, metadata);
-            if (offset > centralEnd) {
-                throw new IOException("ZIP central directory entry exceeds its bounds");
-            }
-        }
-        if (offset != centralEnd) {
-            throw new IOException("ZIP central directory contains unaccounted data");
-        }
-    }
-
-    private static Zip64End readZip64End(SeekableByteChannel archive, long endOffset)
-            throws IOException {
-        long locatorOffset = endOffset - ZIP64_LOCATOR_BYTES;
-        if (locatorOffset < 0) {
-            throw new IOException("ZIP64 locator is missing");
-        }
-        byte[] locator = readAt(archive, locatorOffset, ZIP64_LOCATOR_BYTES);
-        if (unsignedInt(locator, 0) != 0x0706_4b50L
-                || unsignedInt(locator, 4) != 0
-                || unsignedInt(locator, 16) != 1) {
-            throw new IOException("ZIP64 locator is malformed");
-        }
-        long zip64Offset = signedLong(locator, 8);
-        if (zip64Offset < 0 || zip64Offset > locatorOffset - ZIP64_END_MINIMUM_BYTES) {
-            throw new IOException("ZIP64 end record offset is invalid");
-        }
-        byte[] record = readAt(archive, zip64Offset, ZIP64_END_MINIMUM_BYTES);
-        if (unsignedInt(record, 0) != 0x0606_4b50L
-                || signedLong(record, 4) < 44
-                || unsignedInt(record, 16) != 0
-                || unsignedInt(record, 20) != 0) {
-            throw new IOException("ZIP64 end record is malformed");
-        }
-        long diskEntries = signedLong(record, 24);
-        long totalEntries = signedLong(record, 32);
-        if (diskEntries != totalEntries) {
-            throw new IOException("Multi-disk ZIP64 archives are unsupported");
-        }
-        return new Zip64End(
-                zip64Offset,
-                totalEntries,
-                signedLong(record, 40),
-                signedLong(record, 48));
-    }
-
-    private static int findEndRecord(byte[] tail) {
-        for (int index = tail.length - END_RECORD_BYTES; index >= 0; index--) {
-            if (unsignedInt(tail, index) == 0x0605_4b50L) {
-                int commentLength = unsignedShort(tail, index + 20);
-                if (index + END_RECORD_BYTES + commentLength == tail.length) {
-                    return index;
-                }
-            }
-        }
-        return -1;
-    }
-
-    private static byte[] readAt(SeekableByteChannel channel, long offset, int length)
-            throws IOException {
-        ByteBuffer buffer = ByteBuffer.allocate(length);
-        channel.position(offset);
-        while (buffer.hasRemaining()) {
-            requireNotInterrupted();
-            int read = channel.read(buffer);
-            if (read < 0) {
-                throw new IOException("ZIP archive ended before expected metadata");
-            }
-            if (read == 0) {
-                continue;
-            }
-        }
-        return buffer.array();
-    }
-
-    private static void requireNotInterrupted() throws InterruptedIOException {
-        if (Thread.currentThread().isInterrupted()) {
-            throw new InterruptedIOException("ZIP inspection was interrupted");
-        }
-    }
-
-    private static int unsignedShort(byte[] value, int offset) {
-        return Short.toUnsignedInt(ByteBuffer.wrap(value, offset, Short.BYTES)
-                .order(ByteOrder.LITTLE_ENDIAN)
-                .getShort());
-    }
-
-    private static long unsignedInt(byte[] value, int offset) {
-        return Integer.toUnsignedLong(ByteBuffer.wrap(value, offset, Integer.BYTES)
-                .order(ByteOrder.LITTLE_ENDIAN)
-                .getInt());
-    }
-
-    private static long signedLong(byte[] value, int offset) {
-        return ByteBuffer.wrap(value, offset, Long.BYTES)
-                .order(ByteOrder.LITTLE_ENDIAN)
-                .getLong();
-    }
-
-    record Inspection(
-            Optional<BackupManifest> manifest,
-            Optional<ZipInventory> inventory,
-            long verifiedFileCount,
-            long verifiedByteCount,
-            List<String> problems) {
-    }
-
-    private record ObservedFile(String path, long size, String sha256) {
-    }
-
-    private record StreamedEntry(String name, boolean directory) {
-    }
-
-    private record DigestResult(long byteCount, String sha256) {
-    }
-
-    private record VerificationCounts(long files, long bytes) {
-    }
-
-    private record Zip64End(long offset, long entryCount, long centralSize, long centralOffset) {
-    }
-
-    private record CentralEntryHeader(
-            int hostSystem,
-            int nameLength,
-            int extraLength,
-            int commentLength,
-            long externalAttributes) {
-    }
-
-    private static final class ArchiveScan {
-        private final Set<String> problems = new LinkedHashSet<>();
-
-        private final Map<String, String> normalizedEntries = new HashMap<>();
-
-        private final Map<String, Boolean> pathKinds = new HashMap<>();
-
-        private final List<ObservedFile> worldFiles = new ArrayList<>();
-
-        private final List<StreamedEntry> streamedEntries = new ArrayList<>();
-
-        private final long[] uncompressedBytes;
-
-        private byte[] manifestBytes;
-
-        private byte[] inventoryBytes;
-
-        private int entryCount;
-
-        private ArchiveScan(long maximumUncompressedBytes) {
-            uncompressedBytes = new long[] {0, maximumUncompressedBytes};
-        }
-
-        private void accept(ZipEntry entry, ZipInputStream zip) throws IOException {
-            requireNotInterrupted();
-            entryCount++;
-            if (entryCount > ZipLimits.MAXIMUM_ARCHIVE_ENTRIES) {
-                throw new IOException("ZIP archive exceeds its entry limit");
-            }
-            String name = entry.getName();
-            boolean directory = entry.isDirectory();
-            streamedEntries.add(new StreamedEntry(name, directory));
-            registerPath(name, directory);
-            readPayload(entry, zip);
-        }
-
-        private void registerPath(String name, boolean directory) {
-            String normalized;
-            try {
-                normalized = PortableZipPath.collisionKey(name, directory);
-            } catch (IllegalArgumentException exception) {
-                problems.add("Archive contains an unsafe entry path.");
-                return;
-            }
-            if (normalizedEntries.putIfAbsent(normalized, name) != null) {
-                problems.add("Archive contains duplicate normalized entry paths.");
-            }
-            if (!registerPathKind(name, directory, pathKinds)) {
-                problems.add("Archive contains a file/directory path conflict.");
-            }
-        }
-
-        private void readPayload(ZipEntry entry, ZipInputStream zip) throws IOException {
-            String name = entry.getName();
-            if (name.equals(ZipArchiveFormat.MANIFEST_ENTRY) && !entry.isDirectory()) {
-                manifestBytes = readMetadata(
-                        zip,
-                        entry,
-                        manifestBytes,
-                        ZipArchiveFormat.MAXIMUM_MANIFEST_BYTES);
-            } else if (name.equals(ZipArchiveFormat.INVENTORY_ENTRY)
-                    && !entry.isDirectory()) {
-                inventoryBytes = readMetadata(
-                        zip,
-                        entry,
-                        inventoryBytes,
-                        ZipArchiveFormat.MAXIMUM_INVENTORY_BYTES);
-            } else if (name.equals(ZipArchiveFormat.WORLD_PREFIX)
-                    && entry.isDirectory()) {
-                requireEmptyDirectoryEntry(zip);
-            } else if (name.startsWith(ZipArchiveFormat.WORLD_PREFIX)
-                    && name.length() > ZipArchiveFormat.WORLD_PREFIX.length()) {
-                readWorldEntry(entry, zip);
-            } else {
-                problems.add(
-                        "Archive contains an entry outside its versioned namespaces.");
-                drain(zip, uncompressedBytes);
-            }
-        }
-
-        private byte[] readMetadata(
-                ZipInputStream zip,
-                ZipEntry entry,
-                byte[] existing,
-                int maximumBytes) throws IOException {
-            if (existing != null) {
-                problems.add("Archive contains duplicate normalized entry paths.");
-                drain(zip, uncompressedBytes);
-                return existing;
-            }
-            return readLimited(
-                    zip,
-                    entry.getSize(),
-                    maximumBytes,
-                    uncompressedBytes);
-        }
-
-        private void readWorldEntry(ZipEntry entry, ZipInputStream zip) throws IOException {
-            if (entry.isDirectory()) {
-                requireEmptyDirectoryEntry(zip);
-                return;
-            }
-            String relative = entry.getName().substring(
-                    ZipArchiveFormat.WORLD_PREFIX.length());
-            DigestResult digest = digest(zip, uncompressedBytes);
-            worldFiles.add(new ObservedFile(
-                    relative,
-                    digest.byteCount(),
-                    digest.sha256()));
-        }
-
-        private void requireEmptyDirectoryEntry(ZipInputStream zip) throws IOException {
-            if (drain(zip, uncompressedBytes) != 0) {
-                problems.add("Archive contains data in a directory entry.");
-            }
-        }
-
-        private Inspection finish(SeekableByteChannel archive, long archiveSize)
-                throws IOException {
-            validateCentralDirectory(archive, archiveSize, streamedEntries, problems);
-            BackupManifest manifest = decodeManifest(manifestBytes, problems);
-            ZipInventory inventory = decodeInventory(inventoryBytes, problems);
-            VerificationCounts counts = verifyInventory(
-                    manifest,
-                    inventory,
-                    worldFiles,
-                    problems);
-            return new Inspection(
-                    Optional.ofNullable(manifest),
-                    Optional.ofNullable(inventory),
-                    counts.files(),
-                    counts.bytes(),
-                    List.copyOf(problems));
-        }
-    }
-
-    private static CentralEntryHeader centralEntryHeader(byte[] header) throws IOException {
-        if (unsignedInt(header, 0) != 0x0201_4b50L) {
-            throw new IOException("ZIP central directory entry is malformed");
-        }
-        if (unsignedShort(header, 34) != 0) {
-            throw new IOException("Multi-disk ZIP archives are unsupported");
-        }
-        int nameLength = unsignedShort(header, 28);
-        if (nameLength <= 0 || nameLength > ZipLimits.MAXIMUM_PATH_UTF8_BYTES) {
-            throw new IOException("ZIP central directory entry name is invalid");
-        }
-        return new CentralEntryHeader(
-                unsignedShort(header, 4) >>> 8,
-                nameLength,
-                unsignedShort(header, 30),
-                unsignedShort(header, 32),
-                unsignedInt(header, 38));
-    }
-
-    private static void requireMatchingCentralName(
-            byte[] centralName,
-            StreamedEntry streamedEntry) throws IOException {
-        byte[] streamedName = streamedEntry.name().getBytes(StandardCharsets.UTF_8);
-        boolean centralDirectory = centralName[centralName.length - 1] == '/';
-        if (!Arrays.equals(centralName, streamedName)
-                || streamedEntry.directory() != centralDirectory) {
-            throw new IOException(
-                    "ZIP central directory does not match its streamed entries");
-        }
-    }
-
-    private static boolean containsSpecialEntry(CentralEntryHeader metadata) {
-        int unixType = (int) (metadata.externalAttributes() >>> 16)
-                & UNIX_FILE_TYPE_MASK;
-        boolean unixHost = metadata.hostSystem() == 3 || metadata.hostSystem() == 19;
-        boolean specialUnixType = unixType != 0
-                && unixType != UNIX_REGULAR_FILE
-                && unixType != UNIX_DIRECTORY;
-        return unixType == UNIX_SYMBOLIC_LINK
-                || (unixHost && specialUnixType)
-                || (metadata.externalAttributes() & WINDOWS_REPARSE_POINT) != 0;
-    }
-
-    private static long nextCentralOffset(
-            long offset,
-            CentralEntryHeader metadata) throws IOException {
-        try {
-            long variableLength = Math.addExact(
-                    metadata.nameLength(),
-                    Math.addExact(metadata.extraLength(), metadata.commentLength()));
-            long recordLength = Math.addExact(
-                    CENTRAL_DIRECTORY_HEADER_BYTES,
-                    variableLength);
-            return Math.addExact(offset, recordLength);
-        } catch (ArithmeticException exception) {
-            throw new IOException("ZIP central directory entry size overflow", exception);
-        }
-    }
-
-    private static final class NonClosingInputStream extends InputStream {
-        private final InputStream delegate;
-
-        NonClosingInputStream(InputStream delegate) {
-            this.delegate = delegate;
-        }
-
-        @Override
-        public int read() throws IOException {
-            return delegate.read();
-        }
-
-        @Override
-        public int read(byte[] bytes, int offset, int length) throws IOException {
-            return delegate.read(bytes, offset, length);
-        }
-
-        @Override
-        public void close() {
-            // The caller owns the exact archive handle.
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveReader.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveReader.java
new file mode 100644
index 0000000..6052c4e
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveReader.java
@@ -0,0 +1,407 @@
+package dev.ishaanko.worldarchive.storage.zip;
+
+import dev.ishaanko.worldarchive.core.WorldInventory;
+import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.support.Digests;
+import dev.ishaanko.worldarchive.support.PortablePath;
+import java.io.EOFException;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InterruptedIOException;
+import java.io.OutputStream;
+import java.nio.charset.StandardCharsets;
+import java.security.DigestInputStream;
+import java.security.MessageDigest;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.LongConsumer;
+import java.util.function.Supplier;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipException;
+import java.util.zip.ZipInputStream;
+
+/**
+ * Reads a WorldArchive ZIP in one streaming pass, for the check after a write, a Verify, a
+ * restore and an import alike. The manifest must be the first entry: its counts bound how many
+ * files and bytes the rest may hold, so a damaged or hostile archive cannot make the reader
+ * inflate or write more than the backup it claims to be. Every world file is hashed as it
+ * streams past and compared at the end with the inventory, whose digests must match the
+ * manifest. The same pass hashes the whole file for its {@code .sha256} checksum file and checks
+ * that the file ends with the end record of a central directory that counts every entry, which
+ * other ZIP programs need to open it.
+ *
+ * <p>A defect in the archive throws {@link ZipArchiveDamagedException}. Any other
+ * {@link IOException} means the file could not be read, and an interrupt stops the pass with an
+ * {@link InterruptedIOException}.</p>
+ */
+final class ZipArchiveReader {
+    static final int BUFFER_BYTES = 1 << 16;
+
+    private ZipArchiveReader() {
+    }
+
+    /** Reads only the manifest at the start of the archive, which costs a few kilobytes. */
+    static BackupManifest readManifest(InputStream archive) throws IOException {
+        try (ZipInputStream zip = new ZipInputStream(archive, StandardCharsets.UTF_8)) {
+            return leadingManifest(zip);
+        } catch (ZipException | EOFException exception) {
+            throw damaged("its data cannot be read", exception);
+        }
+    }
+
+    /**
+     * Reads the whole archive, hands every folder and file to the target, and returns what the
+     * pass proved. The progress receives the world bytes read so far.
+     */
+    static Contents read(InputStream archive, Target target, LongConsumer progress) throws IOException {
+        MessageDigest wholeFile = Digests.sha256();
+        TailInputStream tail = new TailInputStream(archive);
+        DigestInputStream hashed = new DigestInputStream(tail, wholeFile);
+        try (ZipInputStream zip = new ZipInputStream(hashed, StandardCharsets.UTF_8)) {
+            BackupManifest manifest = leadingManifest(zip);
+            target.start(manifest);
+            Pass pass = new Pass(manifest, target, progress);
+            long entries = 1;
+            for (ZipEntry entry = nextEntry(zip); entry != null; entry = nextEntry(zip)) {
+                pass.accept(entry, zip);
+                entries++;
+            }
+            pass.finish();
+            // The central directory at the end is not needed to read the entries, but the
+            // checksum file covers every byte of the archive, and other ZIP programs need it.
+            hashed.transferTo(OutputStream.nullOutputStream());
+            return new Contents(manifest, Digests.hex(wholeFile.digest()), tail.endRecordCounts(entries));
+        } catch (ZipException | EOFException exception) {
+            throw damaged("its data cannot be read or it is cut short", exception);
+        }
+    }
+
+    private static BackupManifest leadingManifest(ZipInputStream zip) throws IOException {
+        ZipEntry first = nextEntry(zip);
+        if (first == null || !first.getName().equals(ZipArchiveFormat.MANIFEST_ENTRY)) {
+            throw new ZipArchiveDamagedException("The file is not a WorldArchive ZIP backup.");
+        }
+        return ZipArchiveFormat.decodeManifest(readMetadata(zip, ZipArchiveFormat.MAXIMUM_MANIFEST_BYTES));
+    }
+
+    /** The next entry; a name that is not valid UTF-8 is damage, not a bug. */
+    private static ZipEntry nextEntry(ZipInputStream zip) throws IOException {
+        requireNotInterrupted();
+        try {
+            return zip.getNextEntry();
+        } catch (IllegalArgumentException exception) {
+            throw damaged("it holds an entry whose name cannot be read", exception);
+        }
+    }
+
+    private static byte[] readMetadata(ZipInputStream zip, int maximumBytes) throws IOException {
+        byte[] bytes = zip.readNBytes(maximumBytes + 1);
+        if (bytes.length > maximumBytes) {
+            throw damaged("its metadata is too large", null);
+        }
+        return bytes;
+    }
+
+    private static void requireNotInterrupted() throws InterruptedIOException {
+        if (Thread.currentThread().isInterrupted()) {
+            throw new InterruptedIOException("Reading the ZIP backup was interrupted");
+        }
+    }
+
+    private static ZipArchiveDamagedException damaged(String reason, Throwable cause) {
+        return new ZipArchiveDamagedException("The ZIP backup is damaged: " + reason + ".", cause);
+    }
+
+    /**
+     * What one full pass proved: the manifest that every file matches, the SHA-256 of the whole
+     * file, and whether the file ends with a central directory end record that counts every entry.
+     */
+    record Contents(BackupManifest manifest, String archiveSha256, boolean endRecordMatches) {
+    }
+
+    /** Where a pass puts the world: nowhere for a check, a folder for a restore. */
+    @FunctionalInterface
+    interface Target {
+        /** Hashes the world and keeps nothing. */
+        Target NONE = path -> OutputStream.nullOutputStream();
+
+        /** Called once, after the manifest is read and before any world entry. */
+        default void start(BackupManifest manifest) throws IOException {
+        }
+
+        /** Called for every folder entry, such as {@code region}; a file's parent may come later or never. */
+        default void directory(String path) throws IOException {
+        }
+
+        /** Opens the destination of one world file, such as {@code region/r.0.0.mca}; the pass closes it. */
+        OutputStream file(String path) throws IOException;
+    }
+
+    /** The state of one pass after the manifest: the limits it sets and the files seen so far. */
+    private static final class Pass {
+        private final BackupManifest manifest;
+
+        private final Target target;
+
+        private final LongConsumer progress;
+
+        private final Map<String, WorldInventory.Entry> files = new HashMap<>();
+
+        private final Set<String> fileKeys = new HashSet<>();
+
+        /** The keys of every folder entry and of the folders above it. */
+        private final Set<String> folderKeys = new HashSet<>();
+
+        private final byte[] buffer = new byte[BUFFER_BYTES];
+
+        private long worldBytes;
+
+        private long directories;
+
+        private WorldInventory inventory;
+
+        private Pass(BackupManifest manifest, Target target, LongConsumer progress) {
+            this.manifest = manifest;
+            this.target = target;
+            this.progress = progress;
+        }
+
+        private void accept(ZipEntry entry, ZipInputStream zip) throws IOException {
+            String name = entry.getName();
+            if (name.equals(ZipArchiveFormat.INVENTORY_ENTRY)) {
+                if (inventory != null) {
+                    throw damaged("it holds two file lists", null);
+                }
+                inventory = ZipArchiveFormat.decodeInventory(
+                        readMetadata(zip, ZipArchiveFormat.MAXIMUM_INVENTORY_BYTES));
+            } else if (name.equals(ZipArchiveFormat.WORLD_PREFIX)) {
+                requireNoData(zip, name);
+            } else if (name.startsWith(ZipArchiveFormat.WORLD_PREFIX) && entry.isDirectory()) {
+                directory(name, zip);
+            } else if (name.startsWith(ZipArchiveFormat.WORLD_PREFIX)) {
+                file(name.substring(ZipArchiveFormat.WORLD_PREFIX.length()), zip);
+            } else {
+                throw damaged("it holds an entry that is not part of the world", null);
+            }
+        }
+
+        private void directory(String name, ZipInputStream zip) throws IOException {
+            String path = portable(() -> PortablePath.validateDirectoryEntry(
+                    name.substring(ZipArchiveFormat.WORLD_PREFIX.length())));
+            if (++directories > WorldInventory.MAXIMUM_FILES) {
+                throw damaged("it holds more folders than any world backup", null);
+            }
+            requireNoData(zip, name);
+            for (String folder = path; folder != null; folder = parent(folder)) {
+                String key = PortablePath.collisionKey(folder);
+                if (fileKeys.contains(key)) {
+                    throw damaged("it holds a folder and a file named " + folder, null);
+                }
+                folderKeys.add(key);
+            }
+            target.directory(path);
+        }
+
+        private void file(String name, ZipInputStream zip) throws IOException {
+            String path = portable(() -> PortablePath.validate(name));
+            String key = PortablePath.collisionKey(path);
+            if (folderKeys.contains(key)) {
+                throw damaged("it holds a folder and a file named " + path, null);
+            }
+            if (!fileKeys.add(key)) {
+                throw damaged("it holds " + path + " twice", null);
+            }
+            if (files.size() >= manifest.sourceFileCount()) {
+                throw damaged("it holds more files than its manifest lists", null);
+            }
+            MessageDigest digest = Digests.sha256();
+            long size = 0;
+            try (OutputStream output = target.file(path)) {
+                for (int read = zip.read(buffer); read >= 0; read = zip.read(buffer)) {
+                    requireNotInterrupted();
+                    size += read;
+                    worldBytes += read;
+                    if (worldBytes > manifest.sourceByteCount()) {
+                        throw damaged("it holds more data than its manifest lists", null);
+                    }
+                    output.write(buffer, 0, read);
+                    digest.update(buffer, 0, read);
+                    progress.accept(worldBytes);
+                }
+            }
+            files.put(path, new WorldInventory.Entry(path, size, Digests.hex(digest.digest())));
+        }
+
+        /** Requires the file list that ends the archive and exactly the files it names. */
+        private void finish() throws ZipArchiveDamagedException {
+            if (inventory == null) {
+                throw damaged("it has no file list at its end, so it is probably cut short", null);
+            }
+            if (!ZipArchiveFormat.matches(inventory, manifest)) {
+                throw damaged("its file list does not match its manifest", null);
+            }
+            for (WorldInventory.Entry expected : inventory.files()) {
+                WorldInventory.Entry found = files.get(expected.path());
+                if (found == null) {
+                    throw damaged(expected.path() + " is missing", null);
+                }
+                if (!found.equals(expected)) {
+                    throw damaged(expected.path() + " does not match its checksum", null);
+                }
+            }
+            if (files.size() != inventory.files().size()) {
+                throw damaged("it holds files that its file list does not name", null);
+            }
+        }
+
+        /** The folder above a path, or null at the top of the world. */
+        private static String parent(String path) {
+            int slash = path.lastIndexOf('/');
+            return slash < 0 ? null : path.substring(0, slash);
+        }
+
+        private static void requireNoData(ZipInputStream zip, String name) throws IOException {
+            if (zip.read() >= 0) {
+                throw damaged("the folder entry " + name + " holds data", null);
+            }
+        }
+
+        /** Applies one {@link PortablePath} rule to a name from the archive. */
+        private static String portable(Supplier<String> rule) throws ZipArchiveDamagedException {
+            try {
+                return rule.get();
+            } catch (IllegalArgumentException exception) {
+                throw damaged("it holds an entry that cannot be restored safely", exception);
+            }
+        }
+    }
+
+    /**
+     * Passes every byte through and keeps the last ones, where a ZIP ends with the end record of
+     * its central directory. The inherited {@code skip} reads through
+     * {@link #read(byte[], int, int)}, so skipped bytes are kept too.
+     */
+    private static final class TailInputStream extends InputStream {
+        private static final int END_RECORD = 0x06054b50;
+
+        private static final int END_RECORD_BYTES = 22;
+
+        private static final int ZIP64_END_RECORD = 0x06064b50;
+
+        private static final int ZIP64_LOCATOR = 0x07064b50;
+
+        private static final int ZIP64_LOCATOR_BYTES = 20;
+
+        private static final int MAXIMUM_COMMENT_BYTES = 0xFFFF;
+
+        /** The count an end record gives when the ZIP64 end record holds the real one. */
+        private static final int ZIP64_COUNT = 0xFFFF;
+
+        private static final int ZIP64_END_RECORD_BYTES = 56;
+
+        /** The end record with the longest comment, after the ZIP64 end record and its locator. */
+        private static final int KEPT_BYTES =
+                ZIP64_END_RECORD_BYTES + ZIP64_LOCATOR_BYTES + END_RECORD_BYTES + MAXIMUM_COMMENT_BYTES;
+
+        private final InputStream source;
+
+        private final byte[] ring = new byte[KEPT_BYTES];
+
+        private long total;
+
+        private TailInputStream(InputStream source) {
+            this.source = source;
+        }
+
+        @Override
+        public int read() throws IOException {
+            int value = source.read();
+            if (value >= 0) {
+                keep(new byte[] {(byte) value}, 0, 1);
+            }
+            return value;
+        }
+
+        @Override
+        public int read(byte[] buffer, int offset, int length) throws IOException {
+            int read = source.read(buffer, offset, length);
+            if (read > 0) {
+                keep(buffer, offset, read);
+            }
+            return read;
+        }
+
+        @Override
+        public void close() throws IOException {
+            source.close();
+        }
+
+        /**
+         * Whether the bytes read so far end with an end record, with its comment, that counts
+         * {@code entries} entries. An archive with 65,535 entries or more counts them in the
+         * ZIP64 end record that the locator before the end record points at.
+         */
+        private boolean endRecordCounts(long entries) {
+            byte[] tail = tail();
+            for (int end = tail.length - END_RECORD_BYTES; end >= 0; end--) {
+                boolean endsHere = end + END_RECORD_BYTES + int16(tail, end + 20) == tail.length;
+                if (int32(tail, end) == END_RECORD && endsHere) {
+                    long counted = int16(tail, end + 10);
+                    return counted == ZIP64_COUNT ? zip64Count(tail, end) == entries : counted == entries;
+                }
+            }
+            return false;
+        }
+
+        /** The entry count of the ZIP64 end record, or -1 when there is none where the locator says. */
+        private long zip64Count(byte[] tail, int end) {
+            int locator = end - ZIP64_LOCATOR_BYTES;
+            if (locator < 0 || int32(tail, locator) != ZIP64_LOCATOR) {
+                return -1;
+            }
+            long record = int64(tail, locator + 8) - (total - tail.length);
+            boolean found = record >= 0 && record <= locator - ZIP64_END_RECORD_BYTES
+                    && int32(tail, (int) record) == ZIP64_END_RECORD;
+            if (!found) {
+                return -1;
+            }
+            return int64(tail, (int) record + 32);
+        }
+
+        private void keep(byte[] bytes, int offset, int length) {
+            int start = (int) (total % KEPT_BYTES);
+            total += length;
+            int kept = Math.min(length, KEPT_BYTES);
+            int from = offset + length - kept;
+            int position = (start + length - kept) % KEPT_BYTES;
+            int first = Math.min(kept, KEPT_BYTES - position);
+            System.arraycopy(bytes, from, ring, position, first);
+            System.arraycopy(bytes, from + first, ring, 0, kept - first);
+        }
+
+        /** The last bytes read, in order. */
+        private byte[] tail() {
+            int length = (int) Math.min(total, KEPT_BYTES);
+            byte[] tail = new byte[length];
+            int start = (int) ((total - length) % KEPT_BYTES);
+            int first = Math.min(length, KEPT_BYTES - start);
+            System.arraycopy(ring, start, tail, 0, first);
+            System.arraycopy(ring, 0, tail, first, length - first);
+            return tail;
+        }
+
+        private static int int16(byte[] bytes, int offset) {
+            return (bytes[offset] & 0xFF) | (bytes[offset + 1] & 0xFF) << 8;
+        }
+
+        private static int int32(byte[] bytes, int offset) {
+            return int16(bytes, offset) | int16(bytes, offset + 2) << 16;
+        }
+
+        private static long int64(byte[] bytes, int offset) {
+            return (int32(bytes, offset) & 0xFFFFFFFFL) | (long) int32(bytes, offset + 4) << 32;
+        }
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveSize.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveSize.java
new file mode 100644
index 0000000..844db9b
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveSize.java
@@ -0,0 +1,16 @@
+package dev.ishaanko.worldarchive.storage.zip;
+
+import dev.ishaanko.worldarchive.model.BackupId;
+import java.nio.file.Path;
+import java.util.Objects;
+
+/**
+ * One archive as storage accounting sees it: the backup ID from its file name, the archive,
+ * and its bytes on disk with the checksum file, from file sizes alone.
+ */
+public record ZipArchiveSize(BackupId backupId, Path archivePath, long bytes) {
+    public ZipArchiveSize {
+        Objects.requireNonNull(backupId, "backupId");
+        Objects.requireNonNull(archivePath, "archivePath");
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveWriter.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveWriter.java
index 5878bb1..91bdab4 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveWriter.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveWriter.java
@@ -1,132 +1,132 @@
 package dev.ishaanko.worldarchive.storage.zip;
 
 import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.core.Digests;
-import dev.ishaanko.worldarchive.storage.zip.ZipSourceScanner.SourceEntry;
+import dev.ishaanko.worldarchive.core.WorldInventory;
+import dev.ishaanko.worldarchive.support.PortablePath;
+import java.io.BufferedOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InterruptedIOException;
 import java.nio.channels.Channels;
 import java.nio.channels.FileChannel;
-import java.nio.channels.SeekableByteChannel;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.FileVisitResult;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
-import java.nio.file.OpenOption;
 import java.nio.file.Path;
+import java.nio.file.SimpleFileVisitor;
 import java.nio.file.StandardOpenOption;
-import java.security.MessageDigest;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Set;
+import java.nio.file.attribute.BasicFileAttributes;
+import java.util.Collection;
+import java.util.Map;
+import java.util.TreeMap;
 import java.util.function.LongConsumer;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
 
-/** Streams one prepared source snapshot into an unpublished ZIP archive. */
+/**
+ * Writes one capture as a WorldArchive ZIP in the layout of {@link ZipArchiveFormat}. The files
+ * come from the capture's inventory and the folders, empty ones included, from one walk of the
+ * sealed capture. The writer checks neither: the store reads the archive back and compares it
+ * with the manifest before it publishes it.
+ */
 final class ZipArchiveWriter {
-    private ZipArchiveWriter() {
+    private final BackupCapture capture;
+
+    private final ZipOutputStream zip;
+
+    private final LongConsumer progress;
+
+    private final long time;
+
+    private final byte[] buffer = new byte[ZipArchiveReader.BUFFER_BYTES];
+
+    private long written;
+
+    private ZipArchiveWriter(BackupCapture capture, ZipOutputStream zip, LongConsumer progress) {
+        this.capture = capture;
+        this.zip = zip;
+        this.progress = progress;
+        this.time = capture.manifest().createdAt().toEpochMilli();
     }
 
-    static void write(
-            ManagedDirectoryAccess destination,
-            String partialName,
-            BackupCapture capture,
-            List<SourceEntry> sourceEntries,
-            LongConsumer bytesWritten) throws IOException {
-        List<ZipInventoryEntry> inventoryEntries = new ArrayList<>();
-        byte[] buffer = new byte[Digests.COPY_BUFFER_BYTES];
-        long completedBytes = 0;
-        try (SeekableByteChannel channel = destination.createNew(partialName);
+    /**
+     * Creates {@code target}, which must not exist, writes the archive into it and flushes it to
+     * the disk. The progress receives the world bytes written so far.
+     */
+    static void write(BackupCapture capture, Path target, LongConsumer progress) throws IOException {
+        try (FileChannel channel = FileChannel.open(target, StandardOpenOption.CREATE_NEW, StandardOpenOption.WRITE);
                 ZipOutputStream zip = new ZipOutputStream(
-                        Channels.newOutputStream(channel), StandardCharsets.UTF_8)) {
-            long timestamp = capture.manifest().createdAt().toEpochMilli();
-            writeBytes(zip, ZipArchiveFormat.MANIFEST_ENTRY,
-                    ZipMetadataCodec.encodeManifest(capture.manifest()), timestamp);
-            writeDirectory(zip, ZipArchiveFormat.WORLD_PREFIX, timestamp);
-            for (SourceEntry source : sourceEntries) {
-                requireNotInterrupted();
-                String entryName = ZipArchiveFormat.WORLD_PREFIX + source.relativePath();
-                if (source.directory()) {
-                    writeDirectory(zip, entryName + "/", timestamp);
-                    continue;
-                }
-                ZipSourceScanner.requireUnchanged(source);
-                MessageDigest digest = Digests.sha256();
-                ZipEntry entry = new ZipEntry(entryName);
-                entry.setTime(timestamp);
-                zip.putNextEntry(entry);
-                long written = 0;
-                try (InputStream input = openSource(source.path())) {
-                    int read;
-                    while ((read = input.read(buffer)) >= 0) {
-                        requireNotInterrupted();
-                        if (read == 0) {
-                            continue;
-                        }
-                        zip.write(buffer, 0, read);
-                        digest.update(buffer, 0, read);
-                        written = Math.addExact(written, read);
-                        completedBytes = Math.addExact(completedBytes, read);
-                        bytesWritten.accept(completedBytes);
-                    }
-                } catch (ArithmeticException exception) {
-                    throw new ZipBackupException("World size overflowed ZIP accounting", exception);
-                } finally {
-                    zip.closeEntry();
-                }
-                if (written != source.size()) {
-                    throw new ZipBackupException("A world file changed size during ZIP creation");
-                }
-                ZipSourceScanner.requireUnchanged(source);
-                inventoryEntries.add(new ZipInventoryEntry(
-                        source.relativePath(), written, Digests.hex(digest.digest())));
-            }
-            ZipInventory inventory = ZipInventory.create(inventoryEntries);
-            requireNotInterrupted();
-            if (!inventory.matches(capture.manifest())) {
-                throw new ZipBackupException(
-                        "World contents no longer match the prepared backup manifest");
-            }
-            writeBytes(zip, ZipArchiveFormat.INVENTORY_ENTRY,
-                    ZipMetadataCodec.encodeInventory(inventory), timestamp);
+                        new BufferedOutputStream(Channels.newOutputStream(channel), ZipArchiveReader.BUFFER_BYTES),
+                        StandardCharsets.UTF_8)) {
+            new ZipArchiveWriter(capture, zip, progress).writeEntries();
             zip.finish();
             zip.flush();
-            if (channel instanceof FileChannel fileChannel) {
-                fileChannel.force(true);
+            channel.force(true);
+        }
+    }
+
+    private void writeEntries() throws IOException {
+        startEntry(ZipArchiveFormat.MANIFEST_ENTRY);
+        zip.write(ZipArchiveFormat.encodeManifest(capture.manifest()));
+        startEntry(ZipArchiveFormat.WORLD_PREFIX);
+        for (String name : worldEntryNames()) {
+            startEntry(name);
+            if (!name.endsWith("/")) {
+                copy(name.substring(ZipArchiveFormat.WORLD_PREFIX.length()));
             }
         }
+        startEntry(ZipArchiveFormat.INVENTORY_ENTRY);
+        zip.write(ZipArchiveFormat.encodeInventory(capture.inventory()));
     }
 
-    private static void writeBytes(ZipOutputStream zip, String name, byte[] value, long timestamp)
-            throws IOException {
-        ZipEntry entry = new ZipEntry(name);
-        entry.setTime(timestamp);
-        zip.putNextEntry(entry);
-        try {
-            zip.write(value);
-        } finally {
-            zip.closeEntry();
+    /** The entry of every folder and file, in the order of their paths, as 0.3.9 wrote them. */
+    private Collection<String> worldEntryNames() throws IOException {
+        Map<String, String> entries = new TreeMap<>();
+        Path root = capture.worldDirectory();
+        Files.walkFileTree(root, new SimpleFileVisitor<>() {
+            @Override
+            public FileVisitResult preVisitDirectory(Path directory, BasicFileAttributes attributes)
+                    throws IOException {
+                if (!directory.equals(root)) {
+                    String path = portable(root.relativize(directory));
+                    entries.put(path, ZipArchiveFormat.WORLD_PREFIX + path + "/");
+                }
+                return FileVisitResult.CONTINUE;
+            }
+        });
+        for (WorldInventory.Entry file : capture.inventory().files()) {
+            entries.put(file.path(), ZipArchiveFormat.WORLD_PREFIX + file.path());
         }
+        return entries.values();
     }
 
-    private static void writeDirectory(ZipOutputStream zip, String name, long timestamp)
-            throws IOException {
-        ZipEntry entry = new ZipEntry(name);
-        entry.setTime(timestamp);
-        zip.putNextEntry(entry);
-        zip.closeEntry();
+    private void copy(String path) throws IOException {
+        Path source = PortablePath.resolveInside(capture.worldDirectory(), path);
+        try (InputStream input = Files.newInputStream(source, LinkOption.NOFOLLOW_LINKS)) {
+            for (int read = input.read(buffer); read >= 0; read = input.read(buffer)) {
+                if (Thread.currentThread().isInterrupted()) {
+                    throw new InterruptedIOException("Writing the ZIP backup was interrupted");
+                }
+                zip.write(buffer, 0, read);
+                written += read;
+                progress.accept(written);
+            }
+        }
     }
 
-    private static InputStream openSource(Path source) throws IOException {
-        Set<OpenOption> options = Set.of(StandardOpenOption.READ, LinkOption.NOFOLLOW_LINKS);
-        SeekableByteChannel channel = Files.newByteChannel(source, options);
-        return Channels.newInputStream(channel);
+    /** Starts the next entry, which also ends the one before it. */
+    private void startEntry(String name) throws IOException {
+        ZipEntry entry = new ZipEntry(name);
+        entry.setTime(time);
+        zip.putNextEntry(entry);
     }
 
-    private static void requireNotInterrupted() throws InterruptedIOException {
-        if (Thread.currentThread().isInterrupted()) {
-            throw new InterruptedIOException("ZIP operation was interrupted");
+    private static String portable(Path relative) throws ZipBackupException {
+        try {
+            return PortablePath.fromRelativePath(relative);
+        } catch (IllegalArgumentException exception) {
+            throw new ZipBackupException(exception.getMessage() + ", so a ZIP backup cannot store it.", exception);
         }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupArtifact.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupArtifact.java
index a782db1..93c7c78 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupArtifact.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupArtifact.java
@@ -3,38 +3,15 @@
 import dev.ishaanko.worldarchive.model.BackupManifest;
 import java.nio.file.Path;
 import java.util.Objects;
-import java.util.regex.Pattern;
-
-/** A completely published ZIP archive and its integrity sidecar. */
-public record ZipBackupArtifact(
-        BackupManifest manifest,
-        Path archivePath,
-        Path checksumPath,
-        String archiveSha256) {
-    private static final Pattern SHA256 = Pattern.compile("[0-9a-f]{64}");
 
+/** A published archive of one backup; its checksum file sits next to it. */
+public record ZipBackupArtifact(BackupManifest manifest, Path archivePath) {
     public ZipBackupArtifact {
         Objects.requireNonNull(manifest, "manifest");
-        archivePath = Objects.requireNonNull(archivePath, "archivePath")
-                .toAbsolutePath()
-                .normalize();
-        checksumPath = Objects.requireNonNull(checksumPath, "checksumPath")
-                .toAbsolutePath()
-                .normalize();
-        if (!Objects.equals(archivePath.getParent(), checksumPath.getParent())) {
-            throw new IllegalArgumentException("ZIP archive and checksum must share a directory");
-        }
-        if (!checksumPath.getFileName().toString()
-                .equals(archivePath.getFileName().toString() + ".sha256")) {
-            throw new IllegalArgumentException("ZIP checksum name does not match its archive");
-        }
-        Objects.requireNonNull(archiveSha256, "archiveSha256");
-        if (!SHA256.matcher(archiveSha256).matches()) {
-            throw new IllegalArgumentException("ZIP checksum must be lowercase SHA-256");
-        }
+        archivePath = Objects.requireNonNull(archivePath, "archivePath").toAbsolutePath().normalize();
     }
 
-    /** Stable destination identifier suitable for persistence in a destination result. */
+    /** The {@code <world id>/<file name>} under which the catalog records the archive. */
     public String artifactId() {
         return manifest.worldId() + "/" + archivePath.getFileName();
     }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupBackend.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupBackend.java
index de54291..8b76266 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupBackend.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupBackend.java
@@ -1,49 +1,30 @@
 package dev.ishaanko.worldarchive.storage.zip;
 
-import dev.ishaanko.worldarchive.core.AsyncTasks;
 import dev.ishaanko.worldarchive.core.BackupBackend;
 import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.core.BackupOperation;
-import dev.ishaanko.worldarchive.core.OperationId;
-import dev.ishaanko.worldarchive.core.OperationPhase;
-import dev.ishaanko.worldarchive.core.Observers;
-import dev.ishaanko.worldarchive.core.OperationProgress;
-import dev.ishaanko.worldarchive.core.ProgressListener;
+import dev.ishaanko.worldarchive.model.BackupOperation;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.OperationId;
+import dev.ishaanko.worldarchive.model.OperationPhase;
+import dev.ishaanko.worldarchive.model.OperationProgress;
+import dev.ishaanko.worldarchive.model.ProgressListener;
 import dev.ishaanko.worldarchive.model.VerificationStatus;
+import dev.ishaanko.worldarchive.support.Observers;
 import java.io.IOException;
-import java.nio.file.AccessDeniedException;
-import java.nio.file.FileSystemException;
 import java.util.Objects;
 import java.util.Optional;
-import java.util.concurrent.CompletionStage;
-import java.util.concurrent.Executor;
 
-/** Asynchronous ZIP destination adapter over the synchronous, worker-safe store. */
+/**
+ * The ZIP destination of a backup: writes the archive on the calling thread into the store of
+ * the backup's world. The archive is read back before it is published, so a success is recorded
+ * as verified.
+ */
 public final class ZipBackupBackend implements BackupBackend {
     private final ZipBackupStoreResolver stores;
 
-    private final Executor executor;
-
-    public ZipBackupBackend(ZipBackupStore store, Executor executor) {
-        this((ZipBackupStoreResolver) store, executor);
-    }
-
-    public ZipBackupBackend(ZipBackupStoreResolver stores, Executor executor) {
+    public ZipBackupBackend(ZipBackupStoreResolver stores) {
         this.stores = Objects.requireNonNull(stores, "stores");
-        this.executor = Objects.requireNonNull(executor, "executor");
-    }
-
-    public ZipBackupBackend(java.nio.file.Path root, Executor executor) {
-        this(new ZipBackupStore(root), executor);
-    }
-
-    public ZipBackupStore store() {
-        if (stores instanceof ZipBackupStore store) {
-            return store;
-        }
-        throw new IllegalStateException("This ZIP backend uses per-world stores");
     }
 
     @Override
@@ -51,79 +32,73 @@ public DestinationType destinationType() {
         return DestinationType.ZIP;
     }
 
+    /** An interrupt stops the write; the store removes the partial archive and this throws. */
     @Override
-    public CompletionStage<DestinationResult> createBackup(
-            BackupCapture capture,
-            ProgressListener progressListener) {
-        Objects.requireNonNull(capture, "capture");
-        Objects.requireNonNull(progressListener, "progressListener");
-        OperationId operationId = OperationId.create();
-        long totalBytes = capture.manifest().sourceByteCount();
-        // Stopping the stage interrupts the write; the store discards the partial archive.
-        return AsyncTasks.supplyInterruptible(executor, () -> {
-            report(progressListener, progress(
-                    operationId, capture, OperationPhase.PREPARING, 0, totalBytes,
-                    "Preparing ZIP backup"));
-            try {
-                ZipBackupStore store = stores.store(capture.manifest().worldId());
-                ZipBackupArtifact artifact = store.create(capture, completed -> report(
-                        progressListener,
-                        progress(operationId, capture, OperationPhase.WRITING,
-                                boundedProgress(completed, totalBytes), totalBytes,
-                                "Writing ZIP backup")));
-                report(progressListener, progress(
-                        operationId, capture, OperationPhase.COMPLETE, totalBytes, totalBytes,
-                        "ZIP backup complete"));
-                return DestinationResult.success(DestinationType.ZIP, artifact.artifactId())
-                        .withVerification(VerificationStatus.VERIFIED);
-            } catch (IOException | SecurityException exception) {
-                report(progressListener, progress(
-                        operationId, capture, OperationPhase.FAILED, 0, totalBytes,
-                        "ZIP backup failed"));
-                return DestinationResult.failed(DestinationType.ZIP, safeFailure(exception));
+    public DestinationResult createBackup(BackupCapture capture, ProgressListener progressListener)
+            throws InterruptedException {
+        Progress progress = new Progress(capture, Objects.requireNonNull(progressListener, "progressListener"));
+        progress.report(OperationPhase.PREPARING, 0, "Preparing ZIP backup");
+        try {
+            ZipBackupArtifact artifact = stores.store(capture.manifest().worldId()).create(capture, progress::writing);
+            progress.report(OperationPhase.COMPLETE, progress.total, "ZIP backup complete");
+            return DestinationResult.success(DestinationType.ZIP, artifact.artifactId())
+                    .withVerification(VerificationStatus.VERIFIED);
+        } catch (IOException exception) {
+            if (Thread.interrupted()) {
+                InterruptedException cancelled = new InterruptedException("The ZIP backup was cancelled");
+                cancelled.initCause(exception);
+                throw cancelled;
             }
-        });
+            progress.report(OperationPhase.FAILED, 0, "ZIP backup failed");
+            return DestinationResult.failed(DestinationType.ZIP, failureMessage(exception));
+        }
     }
 
-    private static OperationProgress progress(
-            OperationId operationId,
-            BackupCapture capture,
-            OperationPhase phase,
-            long completed,
-            long total,
-            String message) {
-        return new OperationProgress(
-                operationId,
-                capture.manifest().worldId(),
-                Optional.of(capture.manifest().backupId()),
-                BackupOperation.CREATE,
-                phase,
-                completed,
-                total,
-                message);
+    private static String failureMessage(IOException exception) {
+        if (exception instanceof ZipBackupException) {
+            return exception.getMessage();
+        }
+        return "The ZIP backup could not be written (" + ZipBackupException.reason(exception) + ").";
     }
 
-    private static void report(ProgressListener listener, OperationProgress progress) {
-        Observers.safely(() -> listener.onProgress(progress));
-    }
+    /** Reports the progress of one write, once per whole percent. */
+    private static final class Progress {
+        private final BackupCapture capture;
 
-    private static long boundedProgress(long completed, long total) {
-        if (total == 0) {
-            return completed;
-        }
-        return Math.min(completed, total);
-    }
+        private final ProgressListener listener;
 
-    private static String safeFailure(Exception exception) {
-        if (exception instanceof ZipBackupException) {
-            return exception.getMessage();
+        private final OperationId operationId = OperationId.create();
+
+        private final long total;
+
+        private long reportedPercent = -1;
+
+        private Progress(BackupCapture capture, ProgressListener listener) {
+            this.capture = capture;
+            this.listener = listener;
+            this.total = capture.manifest().sourceByteCount();
         }
-        if (exception instanceof AccessDeniedException) {
-            return "ZIP destination denied filesystem access";
+
+        private void writing(long completed) {
+            long done = Math.min(completed, total);
+            long percent = total == 0 ? 100 : done * 100 / total;
+            if (percent != reportedPercent) {
+                reportedPercent = percent;
+                report(OperationPhase.WRITING, done, "Writing ZIP backup");
+            }
         }
-        if (exception instanceof FileSystemException) {
-            return "ZIP destination filesystem operation failed";
+
+        private void report(OperationPhase phase, long completed, String message) {
+            OperationProgress progress = new OperationProgress(
+                    operationId,
+                    capture.manifest().worldId(),
+                    Optional.of(capture.manifest().backupId()),
+                    BackupOperation.CREATE,
+                    phase,
+                    completed,
+                    total,
+                    message);
+            Observers.safely(() -> listener.onProgress(progress));
         }
-        return "ZIP backup could not be completed";
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupException.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupException.java
index 575800a..c3ef981 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupException.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupException.java
@@ -1,9 +1,14 @@
 package dev.ishaanko.worldarchive.storage.zip;
 
 import java.io.IOException;
+import java.nio.file.AccessDeniedException;
+import java.nio.file.FileAlreadyExistsException;
+import java.nio.file.FileSystemException;
+import java.nio.file.NoSuchFileException;
+import java.util.Objects;
 
-/** Checked failure from a ZIP operation with a user-safe summary. */
-public final class ZipBackupException extends IOException {
+/** A failed ZIP operation whose message the player can read: what happened and what to do. */
+public class ZipBackupException extends IOException {
     public ZipBackupException(String message) {
         super(message);
     }
@@ -11,4 +16,24 @@ public ZipBackupException(String message) {
     public ZipBackupException(String message, Throwable cause) {
         super(message, cause);
     }
+
+    /**
+     * A short reason for a file system failure to put in a message, such as "access was
+     * denied". Java names only the file in most of these exceptions, not what went wrong.
+     */
+    static String reason(IOException failure) {
+        if (failure instanceof AccessDeniedException) {
+            return "access was denied";
+        }
+        if (failure instanceof NoSuchFileException) {
+            return "a file or folder is missing";
+        }
+        if (failure instanceof FileAlreadyExistsException) {
+            return "a file is in the way";
+        }
+        if (failure instanceof FileSystemException system && system.getReason() != null) {
+            return system.getReason();
+        }
+        return Objects.requireNonNullElse(failure.getMessage(), failure.getClass().getSimpleName());
+    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupStore.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupStore.java
index 77c074a..5ae28c0 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupStore.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupStore.java
@@ -1,956 +1,555 @@
 package dev.ishaanko.worldarchive.storage.zip;
 
+import dev.ishaanko.worldarchive.config.FolderOrigin;
 import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.core.Digests;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupManifest;
 import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.storage.zip.ZipArchiveInspector.Inspection;
-import dev.ishaanko.worldarchive.storage.zip.ZipSourceScanner.SourceEntry;
-import dev.ishaanko.worldarchive.storage.zip.ZipSourceScanner.SourceSnapshot;
+import dev.ishaanko.worldarchive.storage.zip.ZipArchiveReader.Contents;
+import dev.ishaanko.worldarchive.storage.zip.ZipArchiveReader.Target;
+import dev.ishaanko.worldarchive.support.Digests;
+import dev.ishaanko.worldarchive.support.PortablePath;
+import java.io.BufferedInputStream;
+import java.io.BufferedOutputStream;
 import java.io.IOException;
-import java.io.InterruptedIOException;
-import java.nio.ByteBuffer;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.nio.channels.Channels;
 import java.nio.channels.FileChannel;
-import java.nio.channels.SeekableByteChannel;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.AtomicMoveNotSupportedException;
+import java.nio.file.DirectoryStream;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
+import java.nio.file.NoSuchFileException;
 import java.nio.file.Path;
-import java.nio.file.attribute.BasicFileAttributes;
+import java.nio.file.StandardOpenOption;
 import java.util.ArrayList;
 import java.util.Comparator;
 import java.util.List;
+import java.util.Locale;
 import java.util.Objects;
 import java.util.Optional;
-import java.util.Set;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentMap;
 import java.util.function.LongConsumer;
-import java.util.concurrent.locks.ReentrantLock;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
- * Crash-safe streamed ZIP storage rooted outside live worlds.
- *
- * <p>The embedded per-file inventory uses the same deterministic content and path framing as the
- * shared capture manifest, binding a published archive to the exact source tree prepared for every
- * enabled destination.</p>
+ * The ZIP backups under one root folder: {@code <root>/<world id>/<archive>.zip}, each with a
+ * {@code .sha256} checksum file. A create writes the archive once under a {@code .partial} name,
+ * reads it back to check every file against the manifest, and renames it into place; the
+ * rename is the moment the backup exists. Verify, restore and import read an archive in one
+ * streaming pass and never copy it anywhere else first. A world's folder may be a link to
+ * another drive; every operation follows it.
  */
-public final class ZipBackupStore implements ZipBackupStoreResolver {
-    static final String OPERATION_LOCK_NAME = ".worldarchive.lock";
+public final class ZipBackupStore {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
 
-    private static final ConcurrentMap<Path, ReentrantLock> PROCESS_LOCKS =
-            new ConcurrentHashMap<>();
+    /** The write deflates and takes about four times as long as the check that reads it back. */
+    private static final int WRITE_PERCENT = 80;
 
-    private static final Pattern CHECKSUM_LINE = Pattern.compile(
-            "([0-9a-f]{64})  ([^\\r\\n]+)(?:\\r?\\n)?");
+    /** Less free space than this after a failed write means the drive filled up. */
+    private static final long FULL_DRIVE_BYTES = 16L << 20;
 
-    private final Path root;
+    private static final String MISSING_CHECKSUM =
+            "The checksum file (.sha256) of this ZIP backup is missing or unreadable; the backup itself is fine.";
 
-    private final ZipStoreHooks hooks;
+    private static final String CUT_END = "The end of this ZIP backup is missing or cut short, and its checksum"
+            + " file (.sha256) is gone, so other ZIP programs cannot open it. WorldArchive can still restore it.";
 
-    public ZipBackupStore(Path root) {
-        this(root, new ZipStoreHooks() {
-        });
-    }
+    private static final Comparator<ZipBackupArtifact> NEWEST_FIRST = Comparator
+            .comparing((ZipBackupArtifact artifact) -> artifact.manifest().createdAt())
+            .thenComparing(artifact -> artifact.manifest().backupId())
+            .reversed();
+
+    private final Path root;
 
-    ZipBackupStore(Path root, ZipStoreHooks hooks) {
+    private final FolderOrigin rootOrigin;
+
+    /**
+     * @param rootOrigin who chose the root: WorldArchive's default folder is created when a backup
+     *     needs it, and a folder the player chose never is, because a missing one means its drive is away
+     */
+    public ZipBackupStore(Path root, FolderOrigin rootOrigin) {
         this.root = Objects.requireNonNull(root, "root").toAbsolutePath().normalize();
-        this.hooks = Objects.requireNonNull(hooks, "hooks");
+        this.rootOrigin = Objects.requireNonNull(rootOrigin, "rootOrigin");
     }
 
     public Path root() {
         return root;
     }
 
-    @Override
-    public ZipBackupStore store(WorldId worldId) {
-        Objects.requireNonNull(worldId, "worldId");
-        return this;
-    }
-
-    @Override
-    public ZipBackupStore defaultStore() {
-        return this;
+    /** Whether a listing of the root sees every backup it may hold (see {@link FolderOrigin#listable}). */
+    public boolean rootListable() {
+        return rootOrigin.listable(root);
     }
 
-    /** Creates and publishes one complete archive/checksum pair. */
-    public ZipBackupArtifact create(BackupCapture capture) throws IOException {
-        return create(capture, ignored -> {
-        });
+    /** The file name a backup gets in a store; the backup ID at its end is its identity. */
+    public static String archiveFilename(BackupManifest manifest) {
+        return ManagedZipArchive.filename(manifest);
     }
 
-    ZipBackupArtifact create(BackupCapture capture, LongConsumer bytesWritten) throws IOException {
+    /**
+     * Writes one archive of the capture, reads it back to check it against the manifest, and
+     * publishes it with its checksum file. Leftovers of interrupted earlier operations in the
+     * world's folder are removed first. On failure nothing of this backup stays behind.
+     *
+     * @param progress receives how many bytes of the capture are written so far
+     */
+    public ZipBackupArtifact create(BackupCapture capture, LongConsumer progress) throws IOException {
         Objects.requireNonNull(capture, "capture");
-        Objects.requireNonNull(bytesWritten, "bytesWritten");
-        requireNotInterrupted();
-        Path world = capture.worldDirectory();
-        ensureDestinationOutsideWorld(world);
-        ManagedPathGuard.requireExistingAncestors(
-                root, "ZIP destination contains an unsafe path component");
-        SourceSnapshot sourceSnapshot = ZipSourceScanner.snapshot(world);
-        List<SourceEntry> sourceEntries = sourceSnapshot.entries();
-        validateManifestCounts(capture.manifest(), sourceEntries);
-
-        ManagedPathGuard.createDirectories(root, "ZIP destination contains an unsafe path component");
-        ensureDestinationOutsideWorld(world);
-        Path worldDestination = root.resolve(capture.manifest().worldId().toString());
-        try (ManagedDirectoryAccess rootDirectory = ManagedDirectoryAccess.openRoot(root)) {
-            rootDirectory.createDirectory(capture.manifest().worldId().toString());
-            rootDirectory.revalidatePinnedDirectories();
-        }
-        String filename = archiveFilename(capture.manifest());
-        Path archive = worldDestination.resolve(filename);
-        Path checksum = worldDestination.resolve(filename + ".sha256");
-        String archivePartialName = filename + ".partial";
-        String checksumName = filename + ".sha256";
-        String checksumPartialName = checksumName + ".partial";
-
-        ReentrantLock processLock = processLock(worldDestination);
-        acquireProcessLock(processLock);
-        try {
-            return createLocked(
-                    capture,
-                    bytesWritten,
-                    sourceSnapshot,
-                    sourceEntries,
-                    worldDestination,
-                    filename,
-                    archive,
-                    checksum,
-                    archivePartialName,
-                    checksumName,
-                    checksumPartialName);
-        } finally {
-            processLock.unlock();
-        }
+        Objects.requireNonNull(progress, "progress");
+        BackupManifest manifest = capture.manifest();
+        if (!ZipArchiveFormat.matches(capture.inventory(), manifest)) {
+            throw new ZipBackupException(
+                    "The prepared copy of the world does not match its backup manifest. Try the backup again.");
+        }
+        ManagedZipArchive archive = ManagedZipArchive.of(root, manifest);
+        ZipFolder folder = openFolder(archive);
+        return folder.locked(() -> {
+            folder.sweep();
+            return writeAndPublish(capture, archive, progress);
+        });
     }
 
-    private ZipBackupArtifact createLocked(
-            BackupCapture capture,
-            LongConsumer bytesWritten,
-            SourceSnapshot sourceSnapshot,
-            List<SourceEntry> sourceEntries,
-            Path worldDestination,
-            String filename,
-            Path archive,
-            Path checksum,
-            String archivePartialName,
-            String checksumName,
-            String checksumPartialName) throws IOException {
-        boolean archivePublished = false;
-        boolean checksumPublished = false;
-        try (ManagedDirectoryAccess destination = ManagedDirectoryAccess.open(
-                        root, worldDestination);
-                ManagedDirectoryAccess.LockedFile ignored =
-                        destination.acquireLock(OPERATION_LOCK_NAME)) {
-            Optional<ZipBackupArtifact> recovered = recoverInterruptedCreate(
-                    destination,
-                    capture.manifest(),
-                    filename,
-                    archive,
-                    checksum,
-                    archivePartialName,
-                    checksumName,
-                    checksumPartialName);
-            if (recovered.isPresent()) {
-                return recovered.orElseThrow();
-            }
-            try {
-                ZipArchiveWriter.write(
-                        destination,
-                        archivePartialName,
-                        capture,
-                        sourceEntries,
-                        bytesWritten);
-                requireNotInterrupted();
-                sourceSnapshot.requireUnchanged();
-                Path archivePartial = destination.resolve(archivePartialName);
-                hooks.archiveCompleted(archivePartial);
-                try (ExactArchiveCopy inspected = ExactArchiveCopy.capture(
-                        destination, archivePartialName)) {
-                    requireValidInspection(inspected, capture.manifest());
-                    hooks.archiveInspected(archivePartial);
-                    requireSameSourceAndContents(
-                            destination,
-                            archivePartialName,
-                            inspected,
-                            "ZIP archive changed during structural verification");
-
-                    destination.delete(archivePartialName);
-                    inspected.copyTo(destination, archivePartialName);
-                    requireSameContents(
-                            destination,
-                            archivePartialName,
-                            inspected,
-                            "ZIP archive changed before publication");
-                    requireNotInterrupted();
-
-                    writeChecksum(
-                            destination, checksumPartialName, inspected.sha256(), filename);
-                    destination.revalidatePinnedDirectories();
-                    atomicPublish(destination, checksumPartialName, checksumName);
-                    checksumPublished = true;
-                    hooks.checksumPublished(archive, checksum);
-
-                    destination.revalidatePinnedDirectories();
-                    atomicPublish(destination, archivePartialName, filename);
-                    archivePublished = true;
-                    hooks.archivePublished(archive);
-                    requireSameContents(
-                            destination,
-                            filename,
-                            inspected,
-                            "ZIP destination changed the backup during publication");
-                    if (!inspected.sha256().equals(readChecksum(
-                            destination, checksumName, filename))) {
-                        throw new ZipBackupException(
-                                "ZIP destination changed the backup during publication");
-                    }
-                    destination.revalidatePinnedDirectories();
-                    return new ZipBackupArtifact(
-                            capture.manifest(), archive, checksum, inspected.sha256());
-                }
-            } catch (IOException | RuntimeException exception) {
-                cleanupFailure(
-                        exception,
-                        destination,
-                        archivePartialName,
-                        checksumPartialName,
-                        checksumPublished ? checksumName : null,
-                        archivePublished ? filename : null);
-                throw exception;
+    /**
+     * Lists every archive of every world from its file name and the manifest at its start,
+     * without reading the rest or the checksum file. A folder that cannot be listed fails the
+     * listing. One archive that cannot be read, is damaged, or names another backup is left out
+     * and logged, so it cannot hide the others; Verify reports it in full.
+     */
+    public List<ZipBackupArtifact> listArchives() throws IOException {
+        List<ZipBackupArtifact> artifacts = new ArrayList<>();
+        for (Path folder : worldFolders()) {
+            for (Path file : archiveFiles(folder)) {
+                readListed(file).ifPresent(artifacts::add);
             }
         }
+        artifacts.sort(NEWEST_FIRST);
+        return List.copyOf(artifacts);
     }
 
-    private Optional<ZipBackupArtifact> recoverInterruptedCreate(
-            ManagedDirectoryAccess destination,
-            BackupManifest manifest,
-            String archiveName,
-            Path archive,
-            Path checksum,
-            String archivePartialName,
-            String checksumName,
-            String checksumPartialName) throws IOException {
-        boolean archiveExists = destination.exists(archiveName);
-        boolean checksumExists = destination.exists(checksumName);
-        if (archiveExists) {
-            destination.requireRegularFile(
-                    archiveName, "Interrupted ZIP archive is not a safe regular file");
-        }
-        if (checksumExists) {
-            destination.requireRegularFile(
-                    checksumName, "Interrupted ZIP checksum is not a safe regular file");
-        }
-
-        destination.deleteIfExists(archivePartialName);
-        destination.deleteIfExists(checksumPartialName);
-        if (!archiveExists) {
-            if (checksumExists) {
-                destination.delete(checksumName);
-            }
-            return Optional.empty();
+    /**
+     * The archives of one world and their size on disk, checksum file included, for storage
+     * accounting. Reads file names and sizes only, never an archive.
+     */
+    public List<ZipArchiveSize> listSizes(WorldId worldId) throws IOException {
+        Path folder = root.resolve(worldId.toString());
+        if (!Files.isDirectory(folder)) {
+            return List.of();
         }
-
-        boolean checksumPublished = false;
-        try (ExactArchiveCopy recovered = ExactArchiveCopy.capture(
-                destination, archiveName)) {
-            requireValidInspection(recovered, manifest);
-            if (checksumExists) {
-                String recorded = readChecksum(destination, checksumName, archiveName);
-                if (!recorded.equals(recovered.sha256())) {
-                    throw new ZipBackupException(
-                            "Existing ZIP archive does not match its checksum sidecar");
-                }
-            } else {
-                writeChecksum(
-                        destination,
-                        checksumPartialName,
-                        recovered.sha256(),
-                        archiveName);
-                destination.revalidatePinnedDirectories();
-                atomicPublish(destination, checksumPartialName, checksumName);
-                checksumPublished = true;
-            }
-            requireSameSourceAndContents(
-                    destination,
-                    archiveName,
-                    recovered,
-                    "Interrupted ZIP archive changed during recovery");
-            destination.revalidatePinnedDirectories();
-            return Optional.of(new ZipBackupArtifact(
-                    manifest, archive, checksum, recovered.sha256()));
-        } catch (IOException | RuntimeException exception) {
-            cleanupFailure(
-                    exception,
-                    destination,
-                    checksumPartialName,
-                    checksumPublished ? checksumName : null);
-            throw exception;
+        List<ZipArchiveSize> sizes = new ArrayList<>();
+        for (Path file : archiveFiles(folder)) {
+            BackupId backupId = ManagedZipArchive.backupId(file.getFileName().toString()).orElseThrow();
+            Path checksum = file.resolveSibling(file.getFileName() + ManagedZipArchive.CHECKSUM_SUFFIX);
+            long checksumBytes = Files.isRegularFile(checksum, LinkOption.NOFOLLOW_LINKS) ? Files.size(checksum) : 0;
+            sizes.add(new ZipArchiveSize(backupId, file, Files.size(file) + checksumBytes));
         }
+        return List.copyOf(sizes);
     }
 
-    static void acquireProcessLock(ReentrantLock lock) throws InterruptedIOException {
+    /**
+     * Reads the archive in full, checks every world file against the manifest and the whole
+     * file against its checksum file when that exists. A missing checksum file is a warning, and
+     * then the file must end with the central directory that other ZIP programs need.
+     *
+     * @return the problems of a damaged archive or one that is not the backup its name says
+     * @throws IOException when the archive or its folder cannot be read at all, for example on a
+     *     disconnected drive; that says nothing about the archive itself
+     */
+    public ZipVerification verify(Path archivePath) throws IOException {
+        ManagedZipArchive archive;
         try {
-            lock.lockInterruptibly();
-        } catch (InterruptedException exception) {
-            Thread.currentThread().interrupt();
-            InterruptedIOException interrupted = new InterruptedIOException(
-                    "ZIP operation was interrupted while waiting for storage access");
-            interrupted.initCause(exception);
-            throw interrupted;
+            archive = ManagedZipArchive.resolve(root, archivePath);
+        } catch (ZipBackupException exception) {
+            return ZipVerification.failed(exception.getMessage());
         }
-    }
-
-    static ReentrantLock processLock(Path worldDirectory) {
-        Path key = Objects.requireNonNull(worldDirectory, "worldDirectory")
-                .toAbsolutePath()
-                .normalize();
-        return PROCESS_LOCKS.computeIfAbsent(key, ignored -> new ReentrantLock());
+        return check(archive);
     }
 
     /**
-     * Lists generated archives after copying, hashing, and fully inspecting each one. This
-     * is the import-grade listing: every returned artifact matched its checksum sidecar and
-     * passed structural verification. It reads every byte of the store, so callers that only
-     * need identities and sizes use {@link #listArchives()}.
+     * Restores the archive into an existing, empty folder in one pass and runs the checks of
+     * {@link #verify} along the way. On failure the folder may hold part of the world, and
+     * the caller deletes it; a restore publishes the folder only after this returns.
+     *
+     * @return the manifest of the restored backup, for the caller to match with its catalog
      */
-    public List<ZipBackupArtifact> listCompleteArchives() throws IOException {
-        return listArtifacts(this::collectCompleteArchives);
+    public BackupManifest materialize(Path archivePath, Path stagingDirectory) throws IOException {
+        ManagedZipArchive archive = ManagedZipArchive.resolve(root, archivePath);
+        Path staging = stagingDirectory.toAbsolutePath().normalize();
+        try (DirectoryStream<Path> entries = Files.newDirectoryStream(staging)) {
+            if (entries.iterator().hasNext()) {
+                throw new ZipBackupException("The folder to restore into must be empty: " + staging);
+            }
+        }
+        Contents contents;
+        try (InputStream input = open(archive.archive())) {
+            contents = ZipArchiveReader.read(input, new StagingTarget(staging), ignored -> {
+            });
+        }
+        List<String> problems = judge(archive, contents, ZipFolder.readChecksum(archive.checksum()));
+        if (!problems.isEmpty()) {
+            throw new ZipArchiveDamagedException(problems.getFirst());
+        }
+        return contents.manifest();
     }
 
     /**
-     * Lists managed archive pairs from their filenames, checksum sidecars, and embedded
-     * manifests. It never copies or hashes an archive, so storage overviews and health
-     * checks stay fast on large stores. The returned checksum is the sidecar value, not a
-     * recomputed digest; verify an archive before restoring from it.
+     * Deletes one archive and its checksum file. The archive goes first, so a failure leaves
+     * the backup whole; a checksum file left behind stays until a delete of the backup finds it.
+     * A world folder that is missing from WorldArchive's default folder was removed by hand, so
+     * its archive is already gone. In a folder the player chose, a missing world folder may sit
+     * on a drive that is away: the delete fails, and nothing is created in its place.
+     *
+     * @return true when the archive was deleted, false when it was already gone; its checksum
+     *     file is deleted either way
      */
-    public List<ZipBackupArtifact> listArchives() throws IOException {
-        return listArtifacts(this::collectArchives);
-    }
-
-    private List<ZipBackupArtifact> listArtifacts(ArchiveCollector collector) throws IOException {
-        if (!Files.exists(root, LinkOption.NOFOLLOW_LINKS)) {
-            ManagedPathGuard.requireExistingAncestors(
-                    root, "ZIP destination contains an unsafe path component");
-            return List.of();
-        }
-        List<ZipBackupArtifact> artifacts = new ArrayList<>();
-        try (ManagedDirectoryAccess rootDirectory = ManagedDirectoryAccess.openRoot(root)) {
-            for (String worldDirectoryName : rootDirectory.listNames()) {
-                WorldId worldId;
-                try {
-                    worldId = WorldId.parse(worldDirectoryName);
-                    if (!rootDirectory.isDirectory(worldDirectoryName)) {
-                        continue;
-                    }
-                } catch (IOException | IllegalArgumentException exception) {
-                    continue;
-                }
-                Path worldDirectory = root.resolve(worldDirectoryName);
-                try (ManagedDirectoryAccess directory = ManagedDirectoryAccess.open(
-                        root, worldDirectory)) {
-                    collector.collect(directory, worldId, artifacts);
-                } catch (IOException | RuntimeException exception) {
-                    // Unsafe or concurrently replaced world directories are not catalog entries.
-                }
+    public boolean delete(Path archivePath) throws IOException {
+        ManagedZipArchive archive = ManagedZipArchive.resolve(root, archivePath);
+        if (!Files.isDirectory(archive.folder())) {
+            if (removedFromDefaultFolder(archive.folder())) {
+                return false;
             }
-            rootDirectory.revalidatePinnedDirectories();
+            throw new ZipBackupException("The ZIP folder " + archive.folder() + " cannot be reached, so nothing"
+                    + " was deleted. Check that its drive is connected and try again.");
+        }
+        try {
+            return new ZipFolder(archive.folder()).locked(() -> deleteLocked(archive));
+        } catch (IOException exception) {
+            throw new ZipBackupException("The ZIP backup " + archive.name() + " could not be deleted ("
+                    + ZipBackupException.reason(exception) + "). Check that the ZIP folder is not read-only"
+                    + " and that no other program has the file open.", exception);
         }
-        artifacts.sort(Comparator
-                .comparing((ZipBackupArtifact artifact) -> artifact.manifest().createdAt())
-                .reversed()
-                .thenComparing(artifact -> artifact.manifest().backupId(), Comparator.reverseOrder()));
-        return List.copyOf(artifacts);
     }
 
-    /** Verifies the sidecar checksum, archive structure, inventory, and every world file. */
-    public ZipVerification verify(Path archivePath) {
-        ZipVerificationState verification = new ZipVerificationState();
-        ManagedZipArchive managed;
-        try {
-            managed = managedArchive(archivePath);
-        } catch (IOException | RuntimeException exception) {
-            verification.problems.add(
-                    "The selected ZIP archive is outside the managed destination.");
-            return verification.finish();
-        }
-        verifyManagedArchive(managed, verification);
-        return verification.finish();
+    /**
+     * Whether a world's folder was removed from WorldArchive's default folder: the default folder
+     * is reachable and the world's folder is gone without a trace, not even a dangling link.
+     */
+    private boolean removedFromDefaultFolder(Path worldFolder) {
+        return rootOrigin == FolderOrigin.DEFAULT
+                && rootOrigin.listable(root)
+                && Files.notExists(worldFolder, LinkOption.NOFOLLOW_LINKS);
     }
 
-    /** Atomically copies one fully inspected external archive into managed storage. */
+    /**
+     * Copies a previewed archive into this store and publishes it, checking the copy in the
+     * same pass that writes it; the copy must be the file the preview saw. When the store
+     * already holds the backup, the same file is accepted and a different one is refused.
+     */
     public ZipBackupArtifact importCopy(ZipImportCandidate candidate) throws IOException {
-        return new ZipImportPublisher(root).importCopy(candidate);
+        ManagedZipArchive archive = ManagedZipArchive.of(root, candidate.manifest());
+        ZipFolder folder = openFolder(archive);
+        return folder.locked(() -> {
+            folder.sweep();
+            if (Files.exists(archive.archive(), LinkOption.NOFOLLOW_LINKS)) {
+                requireSameFile(archive, candidate);
+            } else {
+                copyAndPublish(candidate, archive);
+            }
+            return new ZipBackupArtifact(candidate.manifest(), archive.archive());
+        });
     }
 
-    /** Reopens a previewed external archive and requires its exact pinned contents. */
-    public static void requireUnchangedImportCandidate(ZipImportCandidate candidate)
-            throws IOException {
-        Objects.requireNonNull(candidate, "candidate");
-        Path parent = candidate.archivePath().getParent();
-        if (parent == null) {
-            throw new ZipBackupException("Imported ZIP has no parent folder");
-        }
-        try (ManagedDirectoryAccess source = ManagedDirectoryAccess.openRoot(parent);
-                ExactArchiveCopy copy = ExactArchiveCopy.capture(
-                        source, candidate.archivePath().getFileName().toString())) {
-            ZipImportPublisher.requireCandidate(candidate, copy);
+    /** The world's folder, created when missing; a missing root is created only when it is the default folder. */
+    private ZipFolder openFolder(ManagedZipArchive archive) throws ZipBackupException {
+        try {
+            if (rootOrigin == FolderOrigin.DEFAULT) {
+                Files.createDirectories(archive.folder());
+            } else if (!Files.isDirectory(archive.folder())) {
+                Files.createDirectory(archive.folder());
+            }
+        } catch (NoSuchFileException missingRoot) {
+            throw new ZipBackupException("The ZIP folder " + root + " cannot be reached. Check that its drive is"
+                    + " connected, or choose another ZIP folder.", missingRoot);
+        } catch (IOException exception) {
+            throw new ZipBackupException("The ZIP folder " + root + " cannot be created or reached ("
+                    + ZipBackupException.reason(exception) + "). Check that its drive is connected,"
+                    + " or choose another ZIP folder.", exception);
         }
+        return new ZipFolder(archive.folder());
     }
 
-    private void verifyManagedArchive(
-            ManagedZipArchive managed,
-            ZipVerificationState verification) {
-        try (ManagedDirectoryAccess directory = ManagedDirectoryAccess.open(
-                root, managed.archive().getParent())) {
-            requireVerificationFiles(directory, managed, verification.problems);
-            if (!verification.problems.isEmpty()) {
-                return;
+    private static ZipBackupArtifact writeAndPublish(
+            BackupCapture capture,
+            ManagedZipArchive archive,
+            LongConsumer progress) throws IOException {
+        long total = capture.manifest().sourceByteCount();
+        try {
+            ZipArchiveWriter.write(capture, archive.partial(), written -> progress.accept(written * WRITE_PERCENT / 100));
+            Contents contents;
+            try (InputStream input = open(archive.partial())) {
+                contents = ZipArchiveReader.read(input, Target.NONE, checked -> progress.accept(
+                        total - (total - checked) * (100 - WRITE_PERCENT) / 100));
             }
-            ChecksumSnapshot checksum = verificationChecksum(
-                    directory,
-                    managed,
-                    verification.problems);
-            if (checksum != null) {
-                verifyPrivateCopy(directory, managed, checksum, verification);
+            if (!contents.manifest().equals(capture.manifest())) {
+                throw new ZipArchiveDamagedException("The ZIP backup is damaged: it holds another manifest.");
             }
-        } catch (IOException | RuntimeException exception) {
-            verification.problems.add("The selected ZIP archive could not be read.");
+            ZipFolder.publish(archive, contents.archiveSha256());
+            return new ZipBackupArtifact(capture.manifest(), archive.archive());
+        } catch (IOException failure) {
+            IOException reported = explainWriteFailure(archive, failure);
+            ZipFolder.deleteAfterFailure(reported, archive.partial());
+            throw reported;
+        } catch (RuntimeException failure) {
+            ZipFolder.deleteAfterFailure(failure, archive.partial());
+            throw failure;
         }
     }
 
-    private static void requireVerificationFiles(
-            ManagedDirectoryAccess directory,
-            ManagedZipArchive managed,
-            Set<String> problems) {
-        try {
-            directory.requireRegularFile(
-                    managed.archiveName(),
-                    "Selected ZIP archive contains an unsafe path component");
-        } catch (IOException | RuntimeException exception) {
-            problems.add(
-                    "The selected ZIP archive is missing or is not a regular file.");
+    /** Words the common failures of a write the way the player can act on them. */
+    private static IOException explainWriteFailure(ManagedZipArchive archive, IOException failure) {
+        if (Thread.currentThread().isInterrupted()) {
+            return failure;
         }
-        try {
-            directory.requireRegularFile(
-                    managed.checksumName(),
-                    "ZIP checksum contains an unsafe path component");
-        } catch (IOException | RuntimeException exception) {
-            problems.add(
-                    "The ZIP checksum sidecar is missing or is not a regular file.");
+        if (failure instanceof ZipArchiveDamagedException damaged) {
+            return new ZipBackupException("The new ZIP backup did not pass its check, so it was not kept. "
+                    + damaged.getMessage() + " Try the backup again.", failure);
         }
-    }
-
-    private static ChecksumSnapshot verificationChecksum(
-            ManagedDirectoryAccess directory,
-            ManagedZipArchive managed,
-            Set<String> problems) {
-        try {
-            return new ChecksumSnapshot(
-                    readChecksum(
-                            directory,
-                            managed.checksumName(),
-                            managed.archiveName()),
-                    fingerprint(directory.attributes(managed.checksumName())));
-        } catch (IOException | RuntimeException exception) {
-            problems.add("The ZIP checksum sidecar is malformed.");
-            return null;
+        if (failure instanceof ZipBackupException) {
+            return failure;
+        }
+        if (freeSpace(archive.folder()) < FULL_DRIVE_BYTES) {
+            return new ZipBackupException("The drive of the ZIP folder " + archive.folder().getParent()
+                    + " is full. Free some space or choose another ZIP folder.", failure);
         }
+        return new ZipBackupException("The ZIP backup could not be written to " + archive.folder().getParent()
+                + " (" + ZipBackupException.reason(failure) + ").", failure);
     }
 
-    private static void verifyPrivateCopy(
-            ManagedDirectoryAccess directory,
-            ManagedZipArchive managed,
-            ChecksumSnapshot checksum,
-            ZipVerificationState verification) {
-        try (ExactArchiveCopy archive = ExactArchiveCopy.capture(
-                directory, managed.archiveName())) {
-            if (!checksum.sha256().equals(archive.sha256())) {
-                verification.problems.add(
-                        "The ZIP archive checksum does not match its sidecar.");
-            }
-            inspectPrivateCopy(archive, managed, verification);
-            verifyCopyUnchanged(directory, managed, archive, checksum, verification.problems);
-        } catch (IOException | RuntimeException exception) {
-            verification.problems.add(
-                    "The ZIP archive is unreadable or structurally corrupt.");
+    private static long freeSpace(Path folder) {
+        try {
+            return Files.getFileStore(folder).getUsableSpace();
+        } catch (IOException exception) {
+            return Long.MAX_VALUE;
         }
     }
 
-    private static void inspectPrivateCopy(
-            ExactArchiveCopy archive,
-            ManagedZipArchive managed,
-            ZipVerificationState verification) {
+    private static boolean deleteLocked(ManagedZipArchive archive) throws IOException {
+        boolean deleted = ZipFolder.deleteIfExists(archive.archive());
         try {
-            Inspection inspection = archive.inspect();
-            verification.apply(inspection);
-            inspection.manifest().ifPresent(manifest -> {
-                if (!manifest.worldId().equals(managed.worldId())
-                        || !manifest.backupId().equals(managed.backupId())) {
-                    verification.problems.add(
-                            "Archive identity does not match its managed path.");
-                }
-            });
-        } catch (IOException | RuntimeException exception) {
-            verification.problems.add(
-                    "The ZIP archive is unreadable or structurally corrupt.");
+            ZipFolder.deleteIfExists(archive.checksum());
+        } catch (IOException exception) {
+            if (!deleted) {
+                throw exception;
+            }
+            LOGGER.warn("Deleted {} but not its checksum file: {}", archive.archive(), exception.toString());
         }
+        return deleted;
     }
 
-    private static void verifyCopyUnchanged(
-            ManagedDirectoryAccess directory,
-            ManagedZipArchive managed,
-            ExactArchiveCopy archive,
-            ChecksumSnapshot checksum,
-            Set<String> problems) {
+    private static void copyAndPublish(ZipImportCandidate candidate, ManagedZipArchive archive) throws IOException {
         try {
-            requireSameSourceAndContents(
-                    directory,
-                    managed.archiveName(),
-                    archive,
-                    "The ZIP artifact was replaced during verification.");
-            boolean checksumChanged = !checksum.fingerprint().equals(fingerprint(
-                    directory.attributes(managed.checksumName())));
-            boolean checksumTextChanged = !checksum.sha256().equals(readChecksum(
-                    directory,
-                    managed.checksumName(),
-                    managed.archiveName()));
-            if (checksumChanged || checksumTextChanged) {
-                problems.add("The ZIP artifact was replaced during verification.");
+            Contents contents;
+            try (InputStream source = open(candidate.archivePath());
+                    FileChannel channel = FileChannel.open(
+                            archive.partial(), StandardOpenOption.CREATE_NEW, StandardOpenOption.WRITE);
+                    OutputStream copy = new BufferedOutputStream(
+                            Channels.newOutputStream(channel), ZipArchiveReader.BUFFER_BYTES)) {
+                contents = ZipArchiveReader.read(new CopyingInputStream(source, copy), Target.NONE, ignored -> {
+                });
+                copy.flush();
+                channel.force(true);
             }
-            directory.revalidatePinnedDirectories();
-        } catch (IOException | RuntimeException exception) {
-            problems.add("The ZIP artifact was replaced during verification.");
+            requirePreviewed(candidate, contents);
+            ZipFolder.publish(archive, contents.archiveSha256());
+        } catch (IOException | RuntimeException failure) {
+            ZipFolder.deleteAfterFailure(failure, archive.partial());
+            throw failure;
         }
     }
 
-
-    /**
-     * Materializes a verified archive into an existing, empty staging directory.
-     * Existing files are never replaced and failures leave only the staging copy partially written.
-     */
-    public void materialize(Path archivePath, Path stagingDirectory) throws IOException {
-        ZipArchiveExtractor.StagingDirectory staging =
-                ZipArchiveExtractor.openEmpty(stagingDirectory);
-        ManagedZipArchive managed = managedArchive(archivePath);
-        try (ManagedDirectoryAccess directory = ManagedDirectoryAccess.open(
-                root, managed.archive().getParent())) {
-            directory.requireRegularFile(
-                    managed.archiveName(),
-                    "Selected ZIP archive contains an unsafe path component");
-            directory.requireRegularFile(
-                    managed.checksumName(),
-                    "Selected ZIP checksum contains an unsafe path component");
-            String expectedSha256 = readChecksum(
-                    directory, managed.checksumName(), managed.archiveName());
-            FileFingerprint checksumBefore = fingerprint(
-                    directory.attributes(managed.checksumName()));
-            try (ExactArchiveCopy privateCopy = ExactArchiveCopy.capture(
-                    directory, managed.archiveName())) {
-                hooks.restoreCopyCompleted(managed.archive(), privateCopy.path());
-                requireSameSourceAndContents(
-                        directory,
-                        managed.archiveName(),
-                        privateCopy,
-                        "ZIP artifact was replaced while making a restore copy");
-                if (!checksumBefore.equals(fingerprint(
-                                directory.attributes(managed.checksumName())))
-                        || !expectedSha256.equals(readChecksum(
-                                directory,
-                                managed.checksumName(),
-                                managed.archiveName()))) {
-                    throw new ZipBackupException(
-                            "ZIP artifact was replaced while making a restore copy");
-                }
-                if (!expectedSha256.equals(privateCopy.sha256())) {
-                    throw new ZipBackupException(
-                            "Private ZIP restore copy does not match its checksum");
-                }
-                Inspection inspection = requireValidInspection(
-                        privateCopy.inspect(), managed.worldId(), managed.backupId());
-                ZipInventory inventory = inspection.inventory()
-                        .orElseThrow(() -> new ZipBackupException(
-                                "ZIP archive inventory is missing"));
-                directory.revalidatePinnedDirectories();
-                ZipArchiveExtractor.StagingDirectory current =
-                        ZipArchiveExtractor.openEmpty(staging.path());
-                if (!staging.identity().equals(current.identity())) {
-                    throw new ZipBackupException(
-                            "ZIP restore staging directory was replaced before extraction");
-                }
-                try {
-                    ZipArchiveExtractor.extract(privateCopy.path(), staging, inventory, hooks);
-                    staging.requireIdentity();
-                    if (!privateCopy.sha256().equals(Digests.sha256(privateCopy.path()))) {
-                        throw new ZipBackupException(
-                                "Private ZIP restore copy changed during extraction");
-                    }
-                } catch (IOException | RuntimeException exception) {
-                    ZipArchiveExtractor.cleanupFailure(staging, exception);
-                    throw exception;
-                }
-            }
+    private static void requireSameFile(ManagedZipArchive archive, ZipImportCandidate candidate) throws IOException {
+        if (!Digests.sha256(archive.archive()).equals(candidate.archiveSha256())) {
+            throw new ZipBackupException("The ZIP folder already holds a different file for this backup, "
+                    + archive.name() + ". Delete that backup first to import this one.");
         }
     }
 
-    /** Deletes only the selected generated archive and its exact checksum sibling. */
-    public boolean delete(Path archivePath) throws IOException {
-        ManagedZipArchive managed = managedArchive(archivePath);
-        ReentrantLock processLock = processLock(managed.archive().getParent());
-        acquireProcessLock(processLock);
-        try {
-            return deleteLocked(managed);
-        } finally {
-            processLock.unlock();
+    private static void requirePreviewed(ZipImportCandidate candidate, Contents contents) throws ZipBackupException {
+        if (!contents.archiveSha256().equals(candidate.archiveSha256())
+                || !contents.manifest().equals(candidate.manifest())) {
+            throw new ZipBackupException("The ZIP file " + candidate.archivePath().getFileName()
+                    + " changed after the import preview. Preview the folder again.");
         }
     }
 
-    private boolean deleteLocked(ManagedZipArchive managed) throws IOException {
-        try (ManagedDirectoryAccess directory = ManagedDirectoryAccess.open(
-                        root, managed.archive().getParent());
-                ManagedDirectoryAccess.LockedFile ignored =
-                        directory.acquireLock(OPERATION_LOCK_NAME)) {
-            boolean archiveExists = directory.exists(managed.archiveName());
-            boolean checksumExists = directory.exists(managed.checksumName());
-            if (archiveExists) {
-                directory.requireRegularFile(
-                        managed.archiveName(),
-                        "Selected ZIP archive contains an unsafe path component");
-            }
-            if (checksumExists) {
-                directory.requireRegularFile(
-                        managed.checksumName(),
-                        "Selected ZIP checksum contains an unsafe path component");
-            }
-            boolean archiveDeleted = false;
-            if (archiveExists) {
-                hooks.beforeArchiveDelete(managed.archive());
-                directory.revalidatePinnedDirectories();
-                directory.requireRegularFile(
-                        managed.archiveName(), "Selected ZIP archive changed during deletion");
-                directory.delete(managed.archiveName());
-                if (directory.exists(managed.archiveName())) {
-                    throw new ZipBackupException("Selected ZIP archive survived deletion");
-                }
-                archiveDeleted = true;
-            }
-            boolean checksumDeleted = false;
-            if (checksumExists) {
-                directory.requireRegularFile(
-                        managed.checksumName(), "Selected ZIP checksum changed during deletion");
-                hooks.beforeChecksumDelete(managed.checksum());
-                directory.revalidatePinnedDirectories();
-                directory.requireRegularFile(
-                        managed.checksumName(), "Selected ZIP checksum changed during deletion");
-                directory.delete(managed.checksumName());
-                checksumDeleted = true;
-            }
-            directory.revalidatePinnedDirectories();
-            return checksumDeleted || archiveDeleted;
+    /** The full check behind {@link #verify}; an I/O failure is thrown, damage is reported. */
+    private static ZipVerification check(ManagedZipArchive archive) throws IOException {
+        if (Files.notExists(archive.archive(), LinkOption.NOFOLLOW_LINKS) && Files.isDirectory(archive.folder())) {
+            return ZipVerification.failed("The ZIP backup file " + archive.name() + " is missing.");
+        }
+        Contents contents;
+        try (InputStream input = open(archive.archive())) {
+            contents = ZipArchiveReader.read(input, Target.NONE, ignored -> {
+            });
+        } catch (ZipArchiveDamagedException damaged) {
+            return ZipVerification.failed(damaged.getMessage());
+        }
+        Optional<String> recorded = ZipFolder.readChecksum(archive.checksum());
+        List<String> problems = judge(archive, contents, recorded);
+        List<String> warnings = new ArrayList<>();
+        if (recorded.isEmpty() && contents.endRecordMatches()) {
+            warnings.add(MISSING_CHECKSUM);
+        } else if (recorded.isEmpty()) {
+            problems.add(CUT_END);
         }
+        return new ZipVerification(Optional.of(contents.manifest()), problems, warnings);
     }
 
-    public boolean delete(ZipBackupArtifact artifact) throws IOException {
-        Objects.requireNonNull(artifact, "artifact");
-        ManagedZipArchive managed = managedArchive(artifact.archivePath());
-        if (!managed.checksum().equals(artifact.checksumPath())
-                || !managed.worldId().equals(artifact.manifest().worldId())
-                || !managed.backupId().equals(artifact.manifest().backupId())) {
-            throw new ZipBackupException("ZIP artifact identity does not match its managed path");
+    /**
+     * The problems that a pass cannot find alone and that stop a restore as well: the archive
+     * must hold the backup its file name says, and match its checksum file when that exists.
+     */
+    private static List<String> judge(ManagedZipArchive archive, Contents contents, Optional<String> recorded) {
+        List<String> problems = new ArrayList<>();
+        if (!contents.manifest().worldId().equals(archive.worldId())
+                || !contents.manifest().backupId().equals(archive.backupId())) {
+            problems.add("The ZIP file " + archive.name() + " holds a different backup than its name says.");
+        }
+        if (recorded.isPresent() && !recorded.get().equals(contents.archiveSha256())) {
+            problems.add("The ZIP backup does not match its checksum file (.sha256), so it changed after it was made.");
         }
-        return delete(managed.archive());
+        return problems;
     }
 
-    private void collectCompleteArchives(
-            ManagedDirectoryAccess directory,
-            WorldId worldId,
-            List<ZipBackupArtifact> artifacts) throws IOException {
-        for (String archiveName : directory.listNames()) {
-            if (!ManagedZipArchive.matchesFilename(archiveName)) {
-                continue;
-            }
-            try {
-                ManagedZipArchive managed = managedArchive(directory.resolve(archiveName));
-                if (!managed.worldId().equals(worldId)) {
-                    continue;
-                }
-                directory.requireRegularFile(
-                        archiveName, "Managed ZIP archive is not a regular file");
-                directory.requireRegularFile(
-                        managed.checksumName(), "Managed ZIP checksum is not a regular file");
-                String checksum = readChecksum(
-                        directory, managed.checksumName(), archiveName);
-                try (ExactArchiveCopy archive = ExactArchiveCopy.capture(
-                        directory, archiveName)) {
-                    if (!checksum.equals(archive.sha256())) {
-                        continue;
-                    }
-                    Inspection inspection = archive.inspect();
-                    if (!inspection.problems().isEmpty() || inspection.manifest().isEmpty()) {
-                        continue;
-                    }
-                    BackupManifest manifest = inspection.manifest().orElseThrow();
-                    if (!manifest.worldId().equals(managed.worldId())
-                            || !manifest.backupId().equals(managed.backupId())) {
-                        continue;
-                    }
-                    artifacts.add(new ZipBackupArtifact(
-                            manifest,
-                            managed.archive(),
-                            managed.checksum(),
-                            checksum));
+    private List<Path> worldFolders() throws IOException {
+        if (!Files.exists(root, LinkOption.NOFOLLOW_LINKS)) {
+            return List.of();
+        }
+        List<Path> folders = new ArrayList<>();
+        try (DirectoryStream<Path> entries = Files.newDirectoryStream(root)) {
+            for (Path entry : entries) {
+                if (isWorldId(entry.getFileName().toString()) && Files.isDirectory(entry)) {
+                    folders.add(entry);
                 }
-            } catch (IOException | RuntimeException exception) {
-                // An incomplete or malformed pair is not a catalog entry; other pairs remain visible.
             }
         }
+        folders.sort(null);
+        return folders;
     }
 
-    private void collectArchives(
-            ManagedDirectoryAccess directory,
-            WorldId worldId,
-            List<ZipBackupArtifact> artifacts) throws IOException {
-        for (String archiveName : directory.listNames()) {
-            if (!ManagedZipArchive.matchesFilename(archiveName)) {
-                continue;
-            }
-            try {
-                ManagedZipArchive managed = managedArchive(directory.resolve(archiveName));
-                if (!managed.worldId().equals(worldId)) {
-                    continue;
-                }
-                directory.requireRegularFile(
-                        archiveName, "Managed ZIP archive is not a regular file");
-                String checksum = readChecksum(
-                        directory, managed.checksumName(), archiveName);
-                BackupManifest manifest;
-                try (SeekableByteChannel archive = directory.openRead(archiveName)) {
-                    manifest = ZipArchiveInspector.readLeadingManifest(archive);
-                }
-                if (!manifest.worldId().equals(managed.worldId())
-                        || !manifest.backupId().equals(managed.backupId())) {
-                    continue;
+    /** The files of a world folder whose name is an archive name, sorted by name. */
+    private static List<Path> archiveFiles(Path folder) throws IOException {
+        List<Path> files = new ArrayList<>();
+        try (DirectoryStream<Path> entries = Files.newDirectoryStream(folder)) {
+            for (Path entry : entries) {
+                if (ManagedZipArchive.backupId(entry.getFileName().toString()).isPresent()
+                        && Files.isRegularFile(entry, LinkOption.NOFOLLOW_LINKS)) {
+                    files.add(entry);
                 }
-                artifacts.add(new ZipBackupArtifact(
-                        manifest,
-                        managed.archive(),
-                        managed.checksum(),
-                        checksum));
-            } catch (IOException | RuntimeException exception) {
-                // An incomplete or malformed pair is not listed; other pairs remain visible.
             }
         }
+        files.sort(null);
+        return files;
     }
 
-    /** One strategy for turning a managed world directory into listed artifacts. */
-    @FunctionalInterface
-    private interface ArchiveCollector {
-        void collect(
-                ManagedDirectoryAccess directory,
-                WorldId worldId,
-                List<ZipBackupArtifact> artifacts) throws IOException;
-    }
-
-    private static Inspection requireValidInspection(
-            ExactArchiveCopy archive,
-            BackupManifest expectedManifest) throws IOException {
-        Inspection inspection = requireValidInspection(
-                archive.inspect(), expectedManifest.worldId(), expectedManifest.backupId());
-        if (!inspection.manifest().orElseThrow().equals(expectedManifest)) {
-            throw new ZipBackupException("ZIP archive manifest changed during creation");
+    private Optional<ZipBackupArtifact> readListed(Path file) throws IOException {
+        ManagedZipArchive archive = ManagedZipArchive.resolve(root, file);
+        BackupManifest manifest;
+        try (InputStream input = new BufferedInputStream(Files.newInputStream(file, LinkOption.NOFOLLOW_LINKS))) {
+            manifest = ZipArchiveReader.readManifest(input);
+        } catch (IOException failure) {
+            LOGGER.warn("Left out the ZIP backup {}: {}", file, unreadable(failure));
+            return Optional.empty();
         }
-        return inspection;
-    }
-
-    static Inspection requireValidInspection(
-            Inspection inspection,
-            WorldId expectedWorldId,
-            BackupId expectedBackupId) throws IOException {
-        if (!inspection.problems().isEmpty()
-                || inspection.manifest().isEmpty()
-                || inspection.inventory().isEmpty()) {
-            throw new ZipBackupException("ZIP archive failed structural and per-file verification");
-        }
-        BackupManifest manifest = inspection.manifest().orElseThrow();
-        if (!manifest.worldId().equals(expectedWorldId)
-                || !manifest.backupId().equals(expectedBackupId)) {
-            throw new ZipBackupException("ZIP archive identity does not match its managed path");
-        }
-        return inspection;
-    }
-
-    private static void requireSameSourceAndContents(
-            ManagedDirectoryAccess directory,
-            String name,
-            ExactArchiveCopy expected,
-            String message) throws IOException {
-        if (!expected.sourceStillMatches(directory, name)) {
-            throw new ZipBackupException(message);
-        }
-        try (ExactArchiveCopy current = ExactArchiveCopy.capture(directory, name)) {
-            if (!expected.matches(current)) {
-                throw new ZipBackupException(message);
-            }
+        if (!manifest.worldId().equals(archive.worldId()) || !manifest.backupId().equals(archive.backupId())) {
+            LOGGER.warn("Left out the ZIP backup {}: it holds a different backup than its name says", file);
+            return Optional.empty();
         }
+        return Optional.of(new ZipBackupArtifact(manifest, file));
     }
 
-    private static void requireSameContents(
-            ManagedDirectoryAccess directory,
-            String name,
-            ExactArchiveCopy expected,
-            String message) throws IOException {
-        try (ExactArchiveCopy current = ExactArchiveCopy.capture(directory, name)) {
-            if (!expected.sameContents(current)) {
-                throw new ZipBackupException(message);
-            }
+    /**
+     * Why a listing leaves out one archive it could not read, so the others stay listed. An
+     * interrupt says nothing about the archive and stops the listing instead.
+     */
+    private static String unreadable(IOException failure) throws IOException {
+        if (Thread.currentThread().isInterrupted()) {
+            throw failure;
         }
+        return failure instanceof ZipBackupException
+                ? failure.getMessage()
+                : "it cannot be read (" + ZipBackupException.reason(failure) + ")";
     }
 
-    private void ensureDestinationOutsideWorld(Path worldDirectory) throws IOException {
-        Path normalizedWorld = worldDirectory.toAbsolutePath().normalize();
-        if (root.startsWith(normalizedWorld)) {
-            throw new ZipBackupException("ZIP destination must be outside the live world");
-        }
-        Path realWorld = normalizedWorld.toRealPath();
-        if (Files.exists(root, LinkOption.NOFOLLOW_LINKS)) {
-            Path realRoot = root.toRealPath();
-            if (realRoot.startsWith(realWorld)) {
-                throw new ZipBackupException("ZIP destination must be outside the live world");
-            }
+    private static boolean isWorldId(String name) {
+        try {
+            WorldId.parse(name);
+            return true;
+        } catch (IllegalArgumentException notAWorld) {
+            return false;
         }
     }
 
-    private static void validateManifestCounts(BackupManifest manifest, List<SourceEntry> entries)
-            throws ZipBackupException {
-        long fileCount = 0;
-        long byteCount = 0;
-        try {
-            for (SourceEntry entry : entries) {
-                if (!entry.directory()) {
-                    fileCount++;
-                    byteCount = Math.addExact(byteCount, entry.size());
-                }
-            }
-        } catch (ArithmeticException exception) {
-            throw new ZipBackupException("World size overflowed manifest accounting", exception);
-        }
-        if (fileCount != manifest.sourceFileCount() || byteCount != manifest.sourceByteCount()) {
-            throw new ZipBackupException("World contents no longer match the prepared backup manifest");
-        }
+    private static InputStream open(Path file) throws IOException {
+        return new BufferedInputStream(Files.newInputStream(file, LinkOption.NOFOLLOW_LINKS), ZipArchiveReader.BUFFER_BYTES);
     }
 
-    static void writeChecksum(
-            ManagedDirectoryAccess destination,
-            String partialName,
-            String sha256,
-            String archiveName) throws IOException {
-        byte[] encoded = (sha256 + "  " + archiveName + System.lineSeparator())
-                .getBytes(StandardCharsets.UTF_8);
-        try (SeekableByteChannel channel = destination.createNew(partialName)) {
-            ByteBuffer buffer = ByteBuffer.wrap(encoded);
-            while (buffer.hasRemaining()) {
-                channel.write(buffer);
-            }
-            if (channel instanceof FileChannel fileChannel) {
-                fileChannel.force(true);
+    /** Restores the world into an empty folder once the manifest shows that it fits on the drive. */
+    private record StagingTarget(Path staging) implements Target {
+        @Override
+        public void start(BackupManifest manifest) throws IOException {
+            long usable = Files.getFileStore(staging).getUsableSpace();
+            // Network shares and some virtual file systems report zero when they cannot tell.
+            if (usable > 0 && manifest.sourceByteCount() > usable) {
+                throw new ZipBackupException(String.format(Locale.ROOT,
+                        "There is not enough free space to restore this backup: it needs %,.1f MB and"
+                                + " the drive has %,.1f MB free. Free some space and try again.",
+                        manifest.sourceByteCount() / 1e6, usable / 1e6));
             }
         }
-    }
 
-    static void atomicPublish(
-            ManagedDirectoryAccess destination,
-            String partialName,
-            String publishedName) throws IOException {
-        try {
-            destination.move(partialName, publishedName);
-        } catch (AtomicMoveNotSupportedException exception) {
-            throw new ZipBackupException("ZIP destination does not support atomic publication", exception);
+        @Override
+        public void directory(String path) throws IOException {
+            Files.createDirectories(PortablePath.resolveInside(staging, path));
         }
-    }
 
-    static void cleanupFailure(
-            Throwable failure,
-            ManagedDirectoryAccess destination,
-            String... names) {
-        for (String name : names) {
-            if (name == null) {
-                continue;
-            }
-            try {
-                destination.deleteIfExists(name);
-            } catch (IOException cleanupFailure) {
-                failure.addSuppressed(cleanupFailure);
-            }
+        @Override
+        public OutputStream file(String path) throws IOException {
+            Path target = PortablePath.resolveInside(staging, path);
+            Files.createDirectories(target.getParent());
+            // A pass hands over about 512 bytes at a time, as fast as it inflates them.
+            return new BufferedOutputStream(
+                    Files.newOutputStream(target, StandardOpenOption.CREATE_NEW, StandardOpenOption.WRITE),
+                    ZipArchiveReader.BUFFER_BYTES);
         }
     }
 
-    public static String archiveFilename(BackupManifest manifest) {
-        return ManagedZipArchive.filename(manifest);
-    }
+    /**
+     * Copies every byte it reads to a second stream, so one read of a file both checks and
+     * copies it. The inherited {@code skip} reads through {@link #read(byte[], int, int)}, so
+     * skipped bytes are copied too.
+     */
+    private static final class CopyingInputStream extends InputStream {
+        private final InputStream source;
 
-    private ManagedZipArchive managedArchive(Path archivePath) throws IOException {
-        return ManagedZipArchive.resolve(root, archivePath);
-    }
+        private final OutputStream copy;
 
-    static String readChecksum(
-            ManagedDirectoryAccess directory,
-            String checksumName,
-            String archiveName) throws IOException {
-        directory.requireRegularFile(
-                checksumName, "ZIP checksum contains an unsafe path component");
-        FileFingerprint before = fingerprint(directory.attributes(checksumName));
-        byte[] encoded;
-        try (SeekableByteChannel channel = directory.openRead(checksumName)) {
-            long size = channel.size();
-            if (size <= 0 || size > ZipLimits.MAXIMUM_CHECKSUM_BYTES) {
-                throw new IOException("ZIP checksum sidecar has an invalid size");
-            }
-            ByteBuffer buffer = ByteBuffer.allocate((int) size);
-            while (buffer.hasRemaining()) {
-                int read = channel.read(buffer);
-                if (read < 0) {
-                    throw new IOException("ZIP checksum sidecar ended unexpectedly");
-                }
-                if (read == 0) {
-                    continue;
-                }
-            }
-            if (channel.read(ByteBuffer.allocate(1)) >= 0) {
-                throw new IOException("ZIP checksum sidecar changed while being read");
-            }
-            encoded = buffer.array();
-        }
-        if (!before.equals(fingerprint(directory.attributes(checksumName)))) {
-            throw new IOException("ZIP checksum sidecar changed while being read");
+        private CopyingInputStream(InputStream source, OutputStream copy) {
+            this.source = source;
+            this.copy = copy;
         }
-        return parseChecksum(new String(encoded, StandardCharsets.UTF_8), archiveName);
-    }
 
-    private static String parseChecksum(String content, String archiveName) throws IOException {
-        Matcher matcher = CHECKSUM_LINE.matcher(content);
-        if (!matcher.matches() || !matcher.group(2).equals(archiveName)) {
-            throw new IOException("ZIP checksum sidecar has invalid content");
+        @Override
+        public int read() throws IOException {
+            int value = source.read();
+            if (value >= 0) {
+                copy.write(value);
+            }
+            return value;
         }
-        return matcher.group(1);
-    }
 
-    private static FileFingerprint fingerprint(BasicFileAttributes attributes) {
-        return new FileFingerprint(
-                attributes.fileKey(),
-                attributes.size(),
-                attributes.lastModifiedTime(),
-                attributes.creationTime());
-    }
+        @Override
+        public int read(byte[] buffer, int offset, int length) throws IOException {
+            int read = source.read(buffer, offset, length);
+            if (read > 0) {
+                copy.write(buffer, offset, read);
+            }
+            return read;
+        }
 
-    static void requireNotInterrupted() throws InterruptedIOException {
-        if (Thread.currentThread().isInterrupted()) {
-            throw new InterruptedIOException("ZIP operation was interrupted");
+        @Override
+        public void close() throws IOException {
+            source.close();
         }
     }
-
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipDigests.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipDigests.java
deleted file mode 100644
index f7c37da..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipDigests.java
+++ /dev/null
@@ -1,43 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import dev.ishaanko.worldarchive.core.Digests;
-import java.nio.ByteBuffer;
-import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
-import java.util.HexFormat;
-import java.util.List;
-
-/** Deterministic SHA-256 framing for ZIP inventories; plain hashing lives in {@link Digests}. */
-final class ZipDigests {
-    private ZipDigests() {
-    }
-
-    static String inventorySha256(List<ZipInventoryEntry> entries) {
-        MessageDigest digest = Digests.sha256();
-        ByteBuffer number = ByteBuffer.allocate(Long.BYTES);
-        for (ZipInventoryEntry entry : entries) {
-            byte[] path = entry.path().getBytes(StandardCharsets.UTF_8);
-            number.clear();
-            number.putLong(path.length);
-            digest.update(number.array());
-            digest.update(path);
-            number.clear();
-            number.putLong(entry.size());
-            digest.update(number.array());
-            digest.update(HexFormat.of().parseHex(entry.sha256()));
-        }
-        return Digests.hex(digest.digest());
-    }
-
-    static String contentSha256(List<ZipInventoryEntry> entries) {
-        MessageDigest digest = Digests.sha256();
-        ByteBuffer number = ByteBuffer.allocate(Long.BYTES);
-        for (ZipInventoryEntry entry : entries) {
-            number.clear();
-            number.putLong(entry.size());
-            digest.update(number.array());
-            digest.update(HexFormat.of().parseHex(entry.sha256()));
-        }
-        return Digests.hex(digest.digest());
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipFolder.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipFolder.java
new file mode 100644
index 0000000..c700b84
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipFolder.java
@@ -0,0 +1,208 @@
+package dev.ishaanko.worldarchive.storage.zip;
+
+import dev.ishaanko.worldarchive.support.AtomicFiles;
+import dev.ishaanko.worldarchive.support.LockedFile;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.ByteBuffer;
+import java.nio.channels.FileChannel;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.AccessDeniedException;
+import java.nio.file.DirectoryStream;
+import java.nio.file.FileAlreadyExistsException;
+import java.nio.file.FileSystemException;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.NoSuchFileException;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.nio.file.StandardOpenOption;
+import java.util.List;
+import java.util.Optional;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * The folder of one world's archives. Every change in it (create, import and delete) runs under
+ * {@link #locked}, so a sweep never removes a file that another operation is still writing, in
+ * this game or in a second game that shares the folder. On Windows, renames and deletes retry
+ * for up to a second, because Windows refuses them while a virus scanner or a sync client holds
+ * a new file.
+ */
+final class ZipFolder {
+    private static final Logger LOGGER = LoggerFactory.getLogger("WorldArchive");
+
+    /** The lock file is {@code .worldarchive.lock}, the name every WorldArchive version has used. */
+    private static final String LOCK_NAME = ".worldarchive";
+
+    /** 0.3.9 held this file open on Windows to pin the folder; it is never needed now. */
+    private static final String OLD_GUARD_NAME = ".worldarchive.guard";
+
+    /** Partial files of a create (and of an import since this version) and of an import in 0.3.9. */
+    private static final List<String> PARTIAL_SUFFIXES = List.of(ManagedZipArchive.PARTIAL_SUFFIX, ".importing");
+
+    private static final Pattern CHECKSUM_LINE = Pattern.compile("([0-9a-f]{64})  [^\\r\\n]+(?:\\r?\\n)?");
+
+    private static final int MAXIMUM_CHECKSUM_BYTES = 4_096;
+
+    private static final int ATTEMPTS = 5;
+
+    private static final long RETRY_MILLIS = 200;
+
+    private final Path path;
+
+    private final LockedFile lock;
+
+    ZipFolder(Path path) {
+        this.path = path;
+        this.lock = new LockedFile(path.resolve(LOCK_NAME));
+    }
+
+    /** Runs the operation while no other thread or game changes this folder; creates the folder. */
+    <T> T locked(LockedFile.IoSupplier<T> operation) throws IOException {
+        return lock.withLock(operation);
+    }
+
+    /**
+     * Deletes what an interrupted create or import left here: partial archives and checksum
+     * files. None of them is a backup. A checksum file whose archive is missing stays, because a
+     * sync tool may deliver the archive later, or the player moved it away for a moment. A file
+     * that cannot be deleted stays for the next sweep. Call it under the lock.
+     */
+    void sweep() {
+        try (DirectoryStream<Path> entries = Files.newDirectoryStream(path)) {
+            for (Path entry : entries) {
+                if (isLeftover(entry.getFileName().toString()) && Files.isRegularFile(entry, LinkOption.NOFOLLOW_LINKS)) {
+                    deleteLeftover(entry);
+                }
+            }
+        } catch (IOException exception) {
+            LOGGER.warn("Could not look for leftover files in {}: {}", path, exception.toString());
+        }
+    }
+
+    /**
+     * Turns a checked partial archive into a backup: writes and renames its checksum file first,
+     * then renames the archive, which is the moment the backup exists, and flushes the folder so
+     * both names survive a power loss. On failure the checksum file is removed again and the
+     * caller removes the partial archive; a backup that already has this name is never replaced.
+     */
+    static void publish(ManagedZipArchive archive, String sha256) throws IOException {
+        if (Files.exists(archive.archive(), LinkOption.NOFOLLOW_LINKS)) {
+            throw new FileAlreadyExistsException(archive.archive().toString());
+        }
+        try {
+            writeChecksum(archive.checksumPartial(), sha256, archive.name());
+            move(archive.checksumPartial(), archive.checksum());
+            move(archive.partial(), archive.archive());
+        } catch (IOException | RuntimeException failure) {
+            deleteAfterFailure(failure, archive.checksumPartial());
+            deleteAfterFailure(failure, archive.checksum());
+            throw failure;
+        }
+        AtomicFiles.flushDirectory(archive.folder());
+    }
+
+    /** The digest in a checksum file; empty when the file is missing or holds no checksum line. */
+    static Optional<String> readChecksum(Path checksum) throws IOException {
+        byte[] bytes;
+        try (InputStream input = Files.newInputStream(checksum, LinkOption.NOFOLLOW_LINKS)) {
+            bytes = input.readNBytes(MAXIMUM_CHECKSUM_BYTES + 1);
+        } catch (NoSuchFileException missing) {
+            return Optional.empty();
+        }
+        Matcher line = CHECKSUM_LINE.matcher(new String(bytes, StandardCharsets.UTF_8));
+        return bytes.length <= MAXIMUM_CHECKSUM_BYTES && line.matches()
+                ? Optional.of(line.group(1))
+                : Optional.empty();
+    }
+
+    /** Deletes a file, retrying while it is in use; false when there was nothing to delete. */
+    static boolean deleteIfExists(Path file) throws IOException {
+        return retrying(file, () -> Files.deleteIfExists(file));
+    }
+
+    /** Deletes a file after a failure, adding its own failure to the one being reported. */
+    static void deleteAfterFailure(Throwable failure, Path file) {
+        try {
+            deleteIfExists(file);
+        } catch (IOException cleanupFailure) {
+            failure.addSuppressed(cleanupFailure);
+        }
+    }
+
+    private static void writeChecksum(Path file, String sha256, String archiveName) throws IOException {
+        ByteBuffer line = ByteBuffer.wrap((sha256 + "  " + archiveName + "\n").getBytes(StandardCharsets.UTF_8));
+        try (FileChannel channel = FileChannel.open(file, StandardOpenOption.CREATE_NEW, StandardOpenOption.WRITE)) {
+            while (line.hasRemaining()) {
+                channel.write(line);
+            }
+            channel.force(true);
+        }
+    }
+
+    private static void move(Path source, Path target) throws IOException {
+        retrying(source, () -> Files.move(source, target, StandardCopyOption.ATOMIC_MOVE));
+    }
+
+    /**
+     * Runs a rename or a delete of the file, retrying while Windows reports it in use, as
+     * access denied or as a plain file system error. Other systems never refuse a file for
+     * being open, so there every failure is final at once.
+     */
+    private static <T> T retrying(Path file, LockedFile.IoSupplier<T> action) throws IOException {
+        boolean windows = "\\".equals(file.getFileSystem().getSeparator());
+        for (int attempt = 1; ; attempt++) {
+            try {
+                return action.get();
+            } catch (FileSystemException exception) {
+                boolean inUse = exception instanceof AccessDeniedException
+                        || exception.getClass() == FileSystemException.class;
+                if (!windows || !inUse || attempt == ATTEMPTS) {
+                    throw exception;
+                }
+                try {
+                    Thread.sleep(RETRY_MILLIS);
+                } catch (InterruptedException interrupted) {
+                    Thread.currentThread().interrupt();
+                    throw exception;
+                }
+            }
+        }
+    }
+
+    private static boolean isLeftover(String name) {
+        if (name.equals(OLD_GUARD_NAME)) {
+            return true;
+        }
+        for (String suffix : PARTIAL_SUFFIXES) {
+            if (name.endsWith(suffix)) {
+                String stem = name.substring(0, name.length() - suffix.length());
+                return isArchiveName(stem) || isChecksumName(stem);
+            }
+        }
+        return false;
+    }
+
+    private static boolean isChecksumName(String name) {
+        return name.endsWith(ManagedZipArchive.CHECKSUM_SUFFIX) && isArchiveName(archiveOf(name));
+    }
+
+    private static String archiveOf(String checksumName) {
+        return checksumName.substring(0, checksumName.length() - ManagedZipArchive.CHECKSUM_SUFFIX.length());
+    }
+
+    private static boolean isArchiveName(String name) {
+        return ManagedZipArchive.backupId(name).isPresent();
+    }
+
+    private static void deleteLeftover(Path file) {
+        try {
+            deleteIfExists(file);
+        } catch (IOException exception) {
+            LOGGER.warn("Could not delete the leftover file {}: {}", file, exception.toString());
+        }
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipImportPublisher.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipImportPublisher.java
deleted file mode 100644
index f637d51..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipImportPublisher.java
+++ /dev/null
@@ -1,184 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.storage.zip.ZipArchiveInspector.Inspection;
-import java.io.IOException;
-import java.nio.file.Path;
-import java.util.Objects;
-import java.util.concurrent.locks.ReentrantLock;
-
-/** Atomically publishes exact external ZIP copies into a managed archive root. */
-final class ZipImportPublisher {
-    private final Path root;
-
-    ZipImportPublisher(Path root) {
-        this.root = Objects.requireNonNull(root, "root").toAbsolutePath().normalize();
-    }
-
-    ZipBackupArtifact importCopy(ZipImportCandidate candidate) throws IOException {
-        Objects.requireNonNull(candidate, "candidate");
-        ZipBackupStore.requireNotInterrupted();
-        ManagedPathGuard.createDirectories(
-                root, "ZIP destination contains an unsafe path component");
-        BackupManifest manifest = candidate.manifest();
-        String worldName = manifest.worldId().toString();
-        try (ManagedDirectoryAccess rootDirectory = ManagedDirectoryAccess.openRoot(root)) {
-            rootDirectory.createDirectory(worldName);
-            rootDirectory.revalidatePinnedDirectories();
-        }
-        Path worldDirectory = root.resolve(worldName);
-        String archiveName = ZipBackupStore.archiveFilename(manifest);
-        String checksumName = archiveName + ".sha256";
-        Path archivePath = worldDirectory.resolve(archiveName);
-        Path checksumPath = worldDirectory.resolve(checksumName);
-        ReentrantLock processLock = ZipBackupStore.processLock(worldDirectory);
-        ZipBackupStore.acquireProcessLock(processLock);
-        try {
-            return importLocked(
-                    candidate,
-                    worldDirectory,
-                    archiveName,
-                    checksumName,
-                    archivePath,
-                    checksumPath);
-        } finally {
-            processLock.unlock();
-        }
-    }
-
-    private ZipBackupArtifact importLocked(
-            ZipImportCandidate candidate,
-            Path worldDirectory,
-            String archiveName,
-            String checksumName,
-            Path archivePath,
-            Path checksumPath) throws IOException {
-        Path sourceParent = candidate.archivePath().getParent();
-        if (sourceParent == null) {
-            throw new ZipBackupException("Imported ZIP has no parent folder");
-        }
-        try (ManagedDirectoryAccess source = ManagedDirectoryAccess.openRoot(sourceParent);
-                ExactArchiveCopy copy = ExactArchiveCopy.capture(
-                        source, candidate.archivePath().getFileName().toString());
-                ManagedDirectoryAccess destination = ManagedDirectoryAccess.open(
-                        root, worldDirectory);
-                ManagedDirectoryAccess.LockedFile ignored =
-                        destination.acquireLock(ZipBackupStore.OPERATION_LOCK_NAME)) {
-            requireCandidate(candidate, copy);
-            if (destination.exists(archiveName) || destination.exists(checksumName)) {
-                return existing(
-                        destination,
-                        copy,
-                        candidate,
-                        archiveName,
-                        checksumName,
-                        archivePath,
-                        checksumPath);
-            }
-            return publish(
-                    destination,
-                    copy,
-                    candidate,
-                    archiveName,
-                    checksumName,
-                    archivePath,
-                    checksumPath);
-        }
-    }
-
-    static void requireCandidate(
-            ZipImportCandidate candidate,
-            ExactArchiveCopy copy) throws IOException {
-        Inspection inspection = ZipBackupStore.requireValidInspection(
-                copy.inspect(),
-                candidate.manifest().worldId(),
-                candidate.manifest().backupId());
-        if (!candidate.archiveSha256().equals(copy.sha256())
-                || !inspection.manifest().orElseThrow().equals(candidate.manifest())) {
-            throw new ZipBackupException("Imported ZIP changed after preview");
-        }
-    }
-
-    private static ZipBackupArtifact publish(
-            ManagedDirectoryAccess destination,
-            ExactArchiveCopy copy,
-            ZipImportCandidate candidate,
-            String archiveName,
-            String checksumName,
-            Path archivePath,
-            Path checksumPath) throws IOException {
-        String archivePartial = archiveName + ".importing";
-        String checksumPartial = checksumName + ".importing";
-        destination.deleteIfExists(archivePartial);
-        destination.deleteIfExists(checksumPartial);
-        boolean checksumPublished = false;
-        try {
-            copy.copyTo(destination, archivePartial);
-            ZipBackupStore.writeChecksum(
-                    destination, checksumPartial, copy.sha256(), archiveName);
-            ZipBackupStore.atomicPublish(destination, checksumPartial, checksumName);
-            checksumPublished = true;
-            ZipBackupStore.atomicPublish(destination, archivePartial, archiveName);
-            return new ZipBackupArtifact(
-                    candidate.manifest(), archivePath, checksumPath, copy.sha256());
-        } catch (IOException | RuntimeException exception) {
-            ZipBackupStore.cleanupFailure(
-                    exception,
-                    destination,
-                    archivePartial,
-                    checksumPartial,
-                    checksumPublished ? checksumName : null);
-            throw exception;
-        }
-    }
-
-    private static ZipBackupArtifact existing(
-            ManagedDirectoryAccess destination,
-            ExactArchiveCopy copy,
-            ZipImportCandidate candidate,
-            String archiveName,
-            String checksumName,
-            Path archivePath,
-            Path checksumPath) throws IOException {
-        boolean archiveExists = destination.exists(archiveName);
-        boolean checksumExists = destination.exists(checksumName);
-        if (!archiveExists && checksumExists) {
-            String checksum = ZipBackupStore.readChecksum(
-                    destination, checksumName, archiveName);
-            if (!checksum.equals(candidate.archiveSha256())) {
-                throw new ZipBackupException(
-                        "Managed ZIP import destination contains an incomplete conflict");
-            }
-            String archivePartial = archiveName + ".importing";
-            destination.deleteIfExists(archivePartial);
-            try {
-                copy.copyTo(destination, archivePartial);
-                ZipBackupStore.atomicPublish(destination, archivePartial, archiveName);
-                return new ZipBackupArtifact(
-                        candidate.manifest(), archivePath, checksumPath, checksum);
-            } catch (IOException | RuntimeException exception) {
-                ZipBackupStore.cleanupFailure(exception, destination, archivePartial);
-                throw exception;
-            }
-        }
-        if (!archiveExists || !checksumExists) {
-            throw new ZipBackupException(
-                    "Managed ZIP import destination contains an incomplete conflict");
-        }
-        String checksum = ZipBackupStore.readChecksum(destination, checksumName, archiveName);
-        try (ExactArchiveCopy existing = ExactArchiveCopy.capture(destination, archiveName)) {
-            Inspection inspection = ZipBackupStore.requireValidInspection(
-                    existing.inspect(),
-                    candidate.manifest().worldId(),
-                    candidate.manifest().backupId());
-            if (!checksum.equals(candidate.archiveSha256())
-                    || !existing.sha256().equals(candidate.archiveSha256())
-                    || !inspection.manifest().orElseThrow().equals(candidate.manifest())) {
-                throw new ZipBackupException(
-                        "Managed ZIP import destination already contains a conflict");
-            }
-            return new ZipBackupArtifact(
-                    candidate.manifest(), archivePath, checksumPath, checksum);
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipImportScanner.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipImportScanner.java
index 14ddafc..5c0e685 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipImportScanner.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipImportScanner.java
@@ -1,57 +1,64 @@
 package dev.ishaanko.worldarchive.storage.zip;
 
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.storage.zip.ZipArchiveInspector.Inspection;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.SafeText;
+import dev.ishaanko.worldarchive.storage.zip.ZipArchiveReader.Contents;
+import dev.ishaanko.worldarchive.storage.zip.ZipArchiveReader.Target;
+import java.io.BufferedInputStream;
 import java.io.IOException;
 import java.io.InputStream;
-import java.nio.ByteBuffer;
-import java.nio.charset.StandardCharsets;
+import java.io.InterruptedIOException;
 import java.nio.file.FileVisitResult;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
 import java.nio.file.Path;
 import java.nio.file.SimpleFileVisitor;
-import java.nio.file.StandardOpenOption;
 import java.nio.file.attribute.BasicFileAttributes;
 import java.util.ArrayList;
 import java.util.Comparator;
-import java.util.HashMap;
+import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
+import java.util.Optional;
 
-/** Recursively discovers only fully valid WorldArchive ZIP archives. */
+/**
+ * Finds the WorldArchive backups among the ZIP files under a folder the player picked, and only
+ * reads. A ZIP that does not start with a WorldArchive manifest is rejected after its first
+ * entry; a WorldArchive backup is checked in full, so the preview offers only archives that
+ * will import. Byte-identical copies of one backup, for example in a duplicated folder, count
+ * once.
+ */
 public final class ZipImportScanner {
-    private static final Pattern CHECKSUM = Pattern.compile(
-            "([0-9a-f]{64})  ([^\\r\\n]+)(?:\\r?\\n)?");
+    private static final int MAXIMUM_ISSUE_LENGTH = 512;
 
+    /** Scans the folder and everything below it; an interrupt stops the scan. */
     public ZipImportScan scan(Path selectedRoot) throws IOException {
         Path root = selectedRoot.toAbsolutePath().normalize();
-        ManagedPathGuard.requireDirectory(
-                root, "ZIP import folder contains an unsafe path component");
-        List<ZipImportCandidate> candidates = new ArrayList<>();
+        if (!Files.isDirectory(root)) {
+            throw new ZipBackupException("The folder " + root + " does not exist or cannot be opened.");
+        }
+        List<ZipImportCandidate> found = new ArrayList<>();
         List<ZipImportIssue> issues = new ArrayList<>();
         Files.walkFileTree(root, new SimpleFileVisitor<>() {
             @Override
-            public FileVisitResult visitFile(Path file, BasicFileAttributes attributes) {
-                if (!attributes.isRegularFile()
-                        || attributes.isSymbolicLink()
-                        || !file.getFileName().toString().toLowerCase(Locale.ROOT).endsWith(".zip")) {
-                    return FileVisitResult.CONTINUE;
+            public FileVisitResult visitFile(Path file, BasicFileAttributes attributes) throws IOException {
+                requireNotInterrupted();
+                if (attributes.isRegularFile()
+                        && file.getFileName().toString().toLowerCase(Locale.ROOT).endsWith(".zip")) {
+                    inspect(file, found, issues);
                 }
-                inspect(file, candidates, issues);
                 return FileVisitResult.CONTINUE;
             }
 
             @Override
             public FileVisitResult visitFileFailed(Path file, IOException exception) {
-                issues.add(new ZipImportIssue(file, "Could not inspect this path safely"));
+                issues.add(issue(file, "This file or folder cannot be read"));
                 return FileVisitResult.CONTINUE;
             }
         });
-        rejectDuplicateIdentities(candidates, issues);
+        requireNotInterrupted();
+        List<ZipImportCandidate> candidates = withoutCopies(found, issues);
         candidates.sort(Comparator
                 .comparing((ZipImportCandidate candidate) -> candidate.manifest().createdAt())
                 .thenComparing(candidate -> candidate.manifest().backupId()));
@@ -59,79 +66,69 @@ public FileVisitResult visitFileFailed(Path file, IOException exception) {
         return new ZipImportScan(candidates, issues);
     }
 
-    private static void rejectDuplicateIdentities(
-            List<ZipImportCandidate> candidates,
-            List<ZipImportIssue> issues) {
-        Map<dev.ishaanko.worldarchive.model.BackupId, List<ZipImportCandidate>> byId =
-                new HashMap<>();
-        for (ZipImportCandidate candidate : candidates) {
-            byId.computeIfAbsent(
-                    candidate.manifest().backupId(), ignored -> new ArrayList<>()).add(candidate);
+    /** Reads one ZIP file in full and adds it as a candidate or as an issue. */
+    private static void inspect(Path file, List<ZipImportCandidate> found, List<ZipImportIssue> issues) {
+        Path checksum = file.resolveSibling(file.getFileName() + ManagedZipArchive.CHECKSUM_SUFFIX);
+        Contents contents;
+        Optional<String> recorded;
+        try (InputStream input = new BufferedInputStream(
+                Files.newInputStream(file, LinkOption.NOFOLLOW_LINKS), ZipArchiveReader.BUFFER_BYTES)) {
+            contents = ZipArchiveReader.read(input, Target.NONE, ignored -> {
+            });
+            recorded = ZipFolder.readChecksum(checksum);
+        } catch (ZipArchiveDamagedException damaged) {
+            issues.add(issue(file, damaged.getMessage()));
+            return;
+        } catch (IOException exception) {
+            issues.add(issue(file, "This file cannot be read (" + ZipBackupException.reason(exception) + ")"));
+            return;
         }
-        for (List<ZipImportCandidate> duplicates : byId.values()) {
-            if (duplicates.size() < 2) {
-                continue;
-            }
-            candidates.removeAll(duplicates);
-            duplicates.forEach(candidate -> issues.add(new ZipImportIssue(
-                    candidate.archivePath(),
-                    "Multiple ZIP archives use the same backup identity")));
+        if (recorded.isPresent() && !recorded.get().equals(contents.archiveSha256())) {
+            issues.add(issue(file, "The ZIP backup does not match its checksum file (.sha256), "
+                    + "so it changed after it was made"));
+            return;
+        }
+        if (recorded.isEmpty() && !contents.endRecordMatches()) {
+            issues.add(issue(file, "The end of this ZIP backup is missing or cut short, and it has no checksum"
+                    + " file (.sha256), so other ZIP programs cannot open it"));
+            return;
         }
+        found.add(new ZipImportCandidate(contents.manifest(), file, contents.archiveSha256()));
     }
 
-    private static void inspect(
-            Path file,
-            List<ZipImportCandidate> candidates,
+    /**
+     * Keeps one candidate per backup. Copies with the same bytes are one backup, and the one
+     * with the first path is kept. Different files that claim the same backup are all refused,
+     * because none of them can be trusted to be it.
+     */
+    private static List<ZipImportCandidate> withoutCopies(
+            List<ZipImportCandidate> found,
             List<ZipImportIssue> issues) {
-        Path parent = file.getParent();
-        if (parent == null) {
-            issues.add(new ZipImportIssue(file, "ZIP file has no safe parent folder"));
-            return;
+        Map<BackupId, List<ZipImportCandidate>> byBackup = new LinkedHashMap<>();
+        for (ZipImportCandidate candidate : found) {
+            byBackup.computeIfAbsent(candidate.manifest().backupId(), ignored -> new ArrayList<>()).add(candidate);
         }
-        try (ManagedDirectoryAccess directory = ManagedDirectoryAccess.openRoot(parent);
-                ExactArchiveCopy copy = ExactArchiveCopy.capture(
-                        directory, file.getFileName().toString())) {
-            Inspection inspection = copy.inspect();
-            if (!inspection.problems().isEmpty()
-                    || inspection.manifest().isEmpty()
-                    || inspection.inventory().isEmpty()) {
-                throw new ZipBackupException("ZIP is not a valid WorldArchive archive");
+        List<ZipImportCandidate> kept = new ArrayList<>();
+        for (List<ZipImportCandidate> copies : byBackup.values()) {
+            if (copies.stream().map(ZipImportCandidate::archiveSha256).distinct().count() == 1) {
+                kept.add(copies.stream()
+                        .min(Comparator.comparing(candidate -> candidate.archivePath().toString()))
+                        .orElseThrow());
+            } else {
+                copies.forEach(candidate -> issues.add(issue(candidate.archivePath(),
+                        "Other ZIP files claim to be the same backup but hold different data")));
             }
-            validateSidecar(file, copy.sha256());
-            BackupManifest manifest = inspection.manifest().orElseThrow();
-            candidates.add(new ZipImportCandidate(manifest, file, copy.sha256()));
-        } catch (IOException | RuntimeException exception) {
-            issues.add(new ZipImportIssue(file, "ZIP is not a valid WorldArchive archive"));
         }
+        return kept;
     }
 
-    private static void validateSidecar(Path archive, String sha256) throws IOException {
-        Path sidecar = archive.resolveSibling(archive.getFileName() + ".sha256");
-        if (!Files.exists(sidecar, LinkOption.NOFOLLOW_LINKS)) {
-            return;
-        }
-        if (Files.isSymbolicLink(sidecar)
-                || !Files.isRegularFile(sidecar, LinkOption.NOFOLLOW_LINKS)) {
-            throw new IOException("ZIP checksum sidecar is unsafe");
-        }
-        Matcher matcher = CHECKSUM.matcher(readSidecar(sidecar));
-        if (!matcher.matches()
-                || !matcher.group(1).equals(sha256)
-                || !matcher.group(2).equals(archive.getFileName().toString())) {
-            throw new IOException("ZIP checksum sidecar does not match the archive");
-        }
+    private static ZipImportIssue issue(Path file, String message) {
+        return new ZipImportIssue(file, SafeText.clean(message, MAXIMUM_ISSUE_LENGTH));
     }
 
-    static String readSidecar(Path sidecar) throws IOException {
-        try (InputStream input = Files.newInputStream(
-                sidecar, StandardOpenOption.READ, LinkOption.NOFOLLOW_LINKS)) {
-            byte[] bytes = input.readNBytes(ZipLimits.MAXIMUM_CHECKSUM_BYTES + 1);
-            if (bytes.length > ZipLimits.MAXIMUM_CHECKSUM_BYTES) {
-                throw new IOException("ZIP checksum sidecar is too large");
-            }
-            return StandardCharsets.UTF_8.newDecoder()
-                    .decode(ByteBuffer.wrap(bytes))
-                    .toString();
+    private static void requireNotInterrupted() throws InterruptedIOException {
+        if (Thread.currentThread().isInterrupted()) {
+            throw new InterruptedIOException("The ZIP import scan was interrupted");
         }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipInventory.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipInventory.java
deleted file mode 100644
index 29a1409..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipInventory.java
+++ /dev/null
@@ -1,89 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Objects;
-import java.util.Set;
-
-/** Versioned per-file integrity inventory embedded in each archive. */
-record ZipInventory(int formatVersion, List<ZipInventoryEntry> files, String inventorySha256) {
-    static final int CURRENT_FORMAT_VERSION = 1;
-
-    ZipInventory {
-        if (formatVersion != CURRENT_FORMAT_VERSION) {
-            throw new IllegalArgumentException("Unsupported ZIP inventory format version");
-        }
-        if (files.size() > ZipLimits.MAXIMUM_INVENTORY_FILES) {
-            throw new IllegalArgumentException("ZIP inventory exceeds its file limit");
-        }
-        files = List.copyOf(files);
-        Set<String> collisionKeys = new HashSet<>();
-        Set<String> directoryKeys = new HashSet<>();
-        String previous = null;
-        for (ZipInventoryEntry file : files) {
-            Objects.requireNonNull(file, "file");
-            if (previous != null && previous.compareTo(file.path()) >= 0) {
-                throw new IllegalArgumentException("ZIP inventory paths are not strictly sorted");
-            }
-            String collisionKey = PortableZipPath.collisionKey(file.path(), false);
-            if (!collisionKeys.add(collisionKey) || directoryKeys.contains(collisionKey)) {
-                throw new IllegalArgumentException("ZIP inventory contains colliding paths");
-            }
-            String[] segments = file.path().split("/");
-            StringBuilder prefix = new StringBuilder();
-            for (int index = 0; index < segments.length - 1; index++) {
-                if (!prefix.isEmpty()) {
-                    prefix.append('/');
-                }
-                prefix.append(segments[index]);
-                String prefixKey = PortableZipPath.collisionKey(prefix.toString(), false);
-                if (collisionKeys.contains(prefixKey)) {
-                    throw new IllegalArgumentException(
-                            "ZIP inventory contains a file/directory path conflict");
-                }
-                directoryKeys.add(prefixKey);
-            }
-            previous = file.path();
-        }
-        Objects.requireNonNull(inventorySha256, "inventorySha256");
-        String expected = ZipDigests.inventorySha256(files);
-        if (!inventorySha256.equals(expected)) {
-            throw new IllegalArgumentException("ZIP inventory digest does not match its entries");
-        }
-    }
-
-    static ZipInventory create(List<ZipInventoryEntry> files) {
-        if (files.size() > ZipLimits.MAXIMUM_INVENTORY_FILES) {
-            throw new IllegalArgumentException("ZIP inventory exceeds its file limit");
-        }
-        List<ZipInventoryEntry> sorted = new ArrayList<>(files);
-        sorted.sort(null);
-        return new ZipInventory(CURRENT_FORMAT_VERSION, sorted, ZipDigests.inventorySha256(sorted));
-    }
-
-    long fileCount() {
-        return files.size();
-    }
-
-    long byteCount() {
-        long total = 0;
-        try {
-            for (ZipInventoryEntry file : files) {
-                total = Math.addExact(total, file.size());
-            }
-        } catch (ArithmeticException exception) {
-            throw new IllegalArgumentException("ZIP inventory byte count overflow", exception);
-        }
-        return total;
-    }
-
-    boolean matches(BackupManifest manifest) {
-        Objects.requireNonNull(manifest, "manifest");
-        return fileCount() == manifest.sourceFileCount()
-                && byteCount() == manifest.sourceByteCount()
-                && ZipDigests.contentSha256(files).equals(manifest.contentSha256())
-                && inventorySha256.equals(manifest.inventorySha256());
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipInventoryEntry.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipInventoryEntry.java
deleted file mode 100644
index ab9577b..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipInventoryEntry.java
+++ /dev/null
@@ -1,25 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import java.util.Objects;
-import java.util.regex.Pattern;
-
-/** One regular file recorded in an archive inventory. */
-record ZipInventoryEntry(String path, long size, String sha256) implements Comparable<ZipInventoryEntry> {
-    private static final Pattern SHA256 = Pattern.compile("[0-9a-f]{64}");
-
-    ZipInventoryEntry {
-        path = PortableZipPath.validate(Objects.requireNonNull(path, "path"), false);
-        if (size < 0) {
-            throw new IllegalArgumentException("Inventory file size must not be negative");
-        }
-        Objects.requireNonNull(sha256, "sha256");
-        if (!SHA256.matcher(sha256).matches()) {
-            throw new IllegalArgumentException("Inventory checksum must be lowercase SHA-256");
-        }
-    }
-
-    @Override
-    public int compareTo(ZipInventoryEntry other) {
-        return path.compareTo(other.path);
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipLimits.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipLimits.java
deleted file mode 100644
index 45eb91a..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipLimits.java
+++ /dev/null
@@ -1,40 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-/** Conservative allocation and traversal limits for untrusted ZIP metadata. */
-final class ZipLimits {
-    private static final long MINIMUM_UNCOMPRESSED_ALLOWANCE =
-            256L * 1_024 * 1_024;
-
-    private static final long MAXIMUM_EXPANSION_RATIO = 1_000;
-
-    static final int MAXIMUM_ARCHIVE_ENTRIES = 200_000;
-
-    static final int MAXIMUM_INVENTORY_FILES = 200_000;
-
-    static final int MAXIMUM_MANAGED_DIRECTORY_ENTRIES = 400_000;
-
-    static final int MAXIMUM_PATH_UTF8_BYTES = 4_096;
-
-    static final int MAXIMUM_SEGMENT_UTF8_BYTES = 255;
-
-    static final int MAXIMUM_CHECKSUM_BYTES = 4_096;
-
-    static final long MAXIMUM_ARCHIVE_BYTES = 16L * 1_024 * 1_024 * 1_024 * 1_024;
-
-    static final long MAXIMUM_UNCOMPRESSED_BYTES = 64L * 1_024 * 1_024 * 1_024 * 1_024;
-
-    static long maximumUncompressedBytes(long archiveBytes) {
-        long proportional;
-        try {
-            proportional = Math.multiplyExact(archiveBytes, MAXIMUM_EXPANSION_RATIO);
-        } catch (ArithmeticException exception) {
-            proportional = Long.MAX_VALUE;
-        }
-        return Math.min(
-                MAXIMUM_UNCOMPRESSED_BYTES,
-                Math.max(MINIMUM_UNCOMPRESSED_ALLOWANCE, proportional));
-    }
-
-    private ZipLimits() {
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipMetadataCodec.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipMetadataCodec.java
deleted file mode 100644
index 27006f8..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipMetadataCodec.java
+++ /dev/null
@@ -1,229 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import com.google.gson.Gson;
-import com.google.gson.GsonBuilder;
-import com.google.gson.JsonArray;
-import com.google.gson.JsonElement;
-import com.google.gson.JsonObject;
-import com.google.gson.JsonParseException;
-import com.google.gson.JsonParser;
-import com.google.gson.JsonPrimitive;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.GameVersionStamp;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.math.BigDecimal;
-import java.nio.charset.StandardCharsets;
-import java.time.DateTimeException;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Optional;
-
-/** Strict JSON encoding for portable archive metadata. */
-final class ZipMetadataCodec {
-    private static final Gson GSON = new GsonBuilder()
-            .setPrettyPrinting()
-            .disableHtmlEscaping()
-            .create();
-
-    private ZipMetadataCodec() {
-    }
-
-    static byte[] encodeManifest(BackupManifest manifest) {
-        JsonObject root = new JsonObject();
-        root.addProperty("formatVersion", manifest.formatVersion());
-        root.addProperty("backupId", manifest.backupId().toString());
-        root.addProperty("worldId", manifest.worldId().toString());
-        root.addProperty("worldName", manifest.worldName());
-        manifest.label().ifPresent(label -> root.addProperty("label", label));
-        root.addProperty("createdAt", manifest.createdAt().toString());
-        root.addProperty("trigger", manifest.trigger().name());
-        root.addProperty("sourceFileCount", manifest.sourceFileCount());
-        root.addProperty("sourceByteCount", manifest.sourceByteCount());
-        root.addProperty("changedFileCount", manifest.changedFileCount());
-        root.addProperty("contentSha256", manifest.contentSha256());
-        root.addProperty("inventorySha256", manifest.inventorySha256());
-        manifest.gameVersion().ifPresent(stamp -> {
-            JsonObject encodedVersion = new JsonObject();
-            encodedVersion.addProperty("name", stamp.name());
-            encodedVersion.addProperty("dataVersion", stamp.dataVersion());
-            root.add("gameVersion", encodedVersion);
-        });
-        return encode(root);
-    }
-
-    static BackupManifest decodeManifest(byte[] encoded) throws IOException {
-        JsonObject root = parseObject(encoded, "ZIP manifest");
-        try {
-            int formatVersion = requiredInteger(root, "formatVersion");
-            BackupId backupId = BackupId.parse(requiredString(root, "backupId"));
-            WorldId worldId = WorldId.parse(requiredString(root, "worldId"));
-            String worldName = requiredString(root, "worldName");
-            Instant createdAt = Instant.parse(requiredString(root, "createdAt"));
-            BackupTrigger trigger = BackupTrigger.valueOf(requiredString(root, "trigger"));
-            long sourceFileCount = requiredLong(root, "sourceFileCount");
-            long sourceByteCount = requiredLong(root, "sourceByteCount");
-            if (root.has("contentSha256")) {
-                return new BackupManifest(
-                        formatVersion,
-                        backupId,
-                        worldId,
-                        worldName,
-                        optionalString(root, "label"),
-                        createdAt,
-                        trigger,
-                        sourceFileCount,
-                        sourceByteCount,
-                        requiredLong(root, "changedFileCount"),
-                        requiredString(root, "contentSha256"),
-                        requiredString(root, "inventorySha256"),
-                        optionalGameVersion(root));
-            }
-            return new BackupManifest(
-                    formatVersion,
-                    backupId,
-                    worldId,
-                    worldName,
-                    createdAt,
-                    trigger,
-                    sourceFileCount,
-                    sourceByteCount,
-                    requiredString(root, "sourceSha256"));
-        } catch (IllegalArgumentException | DateTimeException exception) {
-            throw new IOException("ZIP manifest contains invalid values", exception);
-        }
-    }
-
-    static byte[] encodeInventory(ZipInventory inventory) {
-        JsonObject root = new JsonObject();
-        root.addProperty("formatVersion", inventory.formatVersion());
-        root.addProperty("algorithm", "SHA-256");
-        root.addProperty("fileCount", inventory.fileCount());
-        root.addProperty("byteCount", inventory.byteCount());
-        root.addProperty("inventorySha256", inventory.inventorySha256());
-        JsonArray files = new JsonArray();
-        for (ZipInventoryEntry file : inventory.files()) {
-            JsonObject encodedFile = new JsonObject();
-            encodedFile.addProperty("path", file.path());
-            encodedFile.addProperty("size", file.size());
-            encodedFile.addProperty("sha256", file.sha256());
-            files.add(encodedFile);
-        }
-        root.add("files", files);
-        return encode(root);
-    }
-
-    static ZipInventory decodeInventory(byte[] encoded) throws IOException {
-        JsonObject root = parseObject(encoded, "ZIP inventory");
-        if (!"SHA-256".equals(requiredString(root, "algorithm"))) {
-            throw new IOException("ZIP inventory uses an unsupported digest algorithm");
-        }
-        JsonElement fileElement = root.get("files");
-        if (fileElement == null || !fileElement.isJsonArray()) {
-            throw new IOException("ZIP inventory is missing its file array");
-        }
-        if (fileElement.getAsJsonArray().size() > ZipLimits.MAXIMUM_INVENTORY_FILES) {
-            throw new IOException("ZIP inventory exceeds its file limit");
-        }
-        List<ZipInventoryEntry> files = new ArrayList<>();
-        try {
-            for (JsonElement element : fileElement.getAsJsonArray()) {
-                if (!element.isJsonObject()) {
-                    throw new IOException("ZIP inventory contains a non-object file entry");
-                }
-                JsonObject file = element.getAsJsonObject();
-                files.add(new ZipInventoryEntry(
-                        requiredString(file, "path"),
-                        requiredLong(file, "size"),
-                        requiredString(file, "sha256")));
-            }
-            ZipInventory inventory = new ZipInventory(
-                    requiredInteger(root, "formatVersion"),
-                    files,
-                    requiredString(root, "inventorySha256"));
-            if (requiredLong(root, "fileCount") != inventory.fileCount()
-                    || requiredLong(root, "byteCount") != inventory.byteCount()) {
-                throw new IOException("ZIP inventory aggregate counts do not match its entries");
-            }
-            return inventory;
-        } catch (IllegalArgumentException exception) {
-            throw new IOException("ZIP inventory contains invalid values", exception);
-        }
-    }
-
-    private static byte[] encode(JsonObject object) {
-        return (GSON.toJson(object) + "\n").getBytes(StandardCharsets.UTF_8);
-    }
-
-    private static JsonObject parseObject(byte[] encoded, String description) throws IOException {
-        try {
-            JsonElement element = JsonParser.parseString(new String(encoded, StandardCharsets.UTF_8));
-            if (!element.isJsonObject()) {
-                throw new IOException(description + " root is not an object");
-            }
-            return element.getAsJsonObject();
-        } catch (JsonParseException exception) {
-            throw new IOException(description + " is malformed JSON", exception);
-        }
-    }
-
-    private static String requiredString(JsonObject object, String name) throws IOException {
-        JsonElement element = object.get(name);
-        if (element == null || !element.isJsonPrimitive() || !element.getAsJsonPrimitive().isString()) {
-            throw new IOException("Required ZIP metadata string is missing: " + name);
-        }
-        return element.getAsString();
-    }
-
-    private static Optional<String> optionalString(JsonObject object, String name) throws IOException {
-        JsonElement element = object.get(name);
-        if (element == null || element.isJsonNull()) {
-            return Optional.empty();
-        }
-        if (!element.isJsonPrimitive() || !element.getAsJsonPrimitive().isString()) {
-            throw new IOException("Optional ZIP metadata string is invalid: " + name);
-        }
-        return Optional.of(element.getAsString());
-    }
-
-    private static Optional<GameVersionStamp> optionalGameVersion(JsonObject object) throws IOException {
-        JsonElement element = object.get("gameVersion");
-        if (element == null || element.isJsonNull()) {
-            return Optional.empty();
-        }
-        if (!element.isJsonObject()) {
-            throw new IOException("ZIP manifest game version is not an object");
-        }
-        JsonObject encoded = element.getAsJsonObject();
-        return Optional.of(new GameVersionStamp(
-                requiredString(encoded, "name"),
-                requiredInteger(encoded, "dataVersion")));
-    }
-
-    private static int requiredInteger(JsonObject object, String name) throws IOException {
-        long value = requiredLong(object, name);
-        if (value < Integer.MIN_VALUE || value > Integer.MAX_VALUE) {
-            throw new IOException("ZIP metadata integer is out of range: " + name);
-        }
-        return (int) value;
-    }
-
-    private static long requiredLong(JsonObject object, String name) throws IOException {
-        JsonElement element = object.get(name);
-        if (element == null || !element.isJsonPrimitive()) {
-            throw new IOException("Required ZIP metadata number is missing: " + name);
-        }
-        JsonPrimitive primitive = element.getAsJsonPrimitive();
-        if (!primitive.isNumber()) {
-            throw new IOException("Required ZIP metadata value is not numeric: " + name);
-        }
-        try {
-            return new BigDecimal(primitive.getAsString()).longValueExact();
-        } catch (ArithmeticException | NumberFormatException exception) {
-            throw new IOException("ZIP metadata value is not an integer: " + name, exception);
-        }
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipSourceScanner.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipSourceScanner.java
deleted file mode 100644
index 36d71a9..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipSourceScanner.java
+++ /dev/null
@@ -1,272 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import dev.ishaanko.worldarchive.core.FileSystemSafety;
-import java.io.IOException;
-import java.io.InterruptedIOException;
-import java.nio.file.FileVisitResult;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.nio.file.SimpleFileVisitor;
-import java.nio.file.attribute.BasicFileAttributes;
-import java.nio.file.attribute.FileTime;
-import java.util.ArrayList;
-import java.util.Comparator;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Objects;
-import java.util.Set;
-
-/** Finds a stable, portable set of regular world files without following links. */
-final class ZipSourceScanner {
-    private ZipSourceScanner() {
-    }
-
-    static SourceSnapshot snapshot(Path worldDirectory) throws IOException {
-        requireNotInterrupted();
-        BasicFileAttributes rootAttributes = readAttributes(worldDirectory);
-        requireDirectory(
-                worldDirectory,
-                rootAttributes,
-                "World source is not a regular directory");
-        List<SourceEntry> entries = new ArrayList<>();
-        Set<String> collisionKeys = new HashSet<>();
-        Files.walkFileTree(worldDirectory, new SimpleFileVisitor<>() {
-            @Override
-            public FileVisitResult preVisitDirectory(Path directory, BasicFileAttributes attributes)
-                    throws IOException {
-                requireNotInterrupted();
-                Path relative = worldDirectory.relativize(directory);
-                if (!relative.toString().isEmpty() && isExcludedTree(relative)) {
-                    return FileVisitResult.SKIP_SUBTREE;
-                }
-                requireDirectory(
-                        directory,
-                        attributes,
-                        "World source contains a link or special directory");
-                if (!relative.toString().isEmpty()) {
-                    String portable = portable(relative);
-                    addCollisionKey(collisionKeys, portable, true);
-                    requireEntryCapacity(entries);
-                    entries.add(SourceEntry.directory(directory, portable, attributes));
-                }
-                return FileVisitResult.CONTINUE;
-            }
-
-            @Override
-            public FileVisitResult visitFile(Path file, BasicFileAttributes attributes) throws IOException {
-                requireNotInterrupted();
-                Path relative = worldDirectory.relativize(file);
-                if (isExcludedTree(relative) || isRootSessionLock(relative)) {
-                    return FileVisitResult.CONTINUE;
-                }
-                if (!FileSystemSafety.isOrdinaryRegularFile(file, attributes)) {
-                    throw new ZipBackupException("World source contains a link or special file");
-                }
-                String portable = portable(relative);
-                addCollisionKey(collisionKeys, portable, false);
-                requireEntryCapacity(entries);
-                entries.add(SourceEntry.file(file, portable, attributes));
-                return FileVisitResult.CONTINUE;
-            }
-
-            @Override
-            public FileVisitResult visitFileFailed(Path file, IOException exception) throws IOException {
-                throw new ZipBackupException("A world source entry could not be read", exception);
-            }
-
-            @Override
-            public FileVisitResult postVisitDirectory(Path directory, IOException exception) throws IOException {
-                if (exception != null) {
-                    throw new ZipBackupException("The world source could not be traversed", exception);
-                }
-                return FileVisitResult.CONTINUE;
-            }
-        });
-        entries.sort(Comparator.comparing(SourceEntry::relativePath));
-        return new SourceSnapshot(
-                worldDirectory,
-                DirectoryFingerprint.from(rootAttributes),
-                List.copyOf(entries));
-    }
-
-    static void requireUnchanged(SourceEntry source) throws IOException {
-        BasicFileAttributes current = readAttributes(source.path());
-        if (!FileSystemSafety.isOrdinaryRegularFile(source.path(), current)
-                || current.size() != source.size()
-                || !current.lastModifiedTime().equals(source.lastModifiedTime())
-                || !identityCreationTime(current).equals(source.creationTime())
-                || !Objects.equals(current.fileKey(), source.fileKey())) {
-            throw new ZipBackupException("A world file changed while the ZIP backup was being created");
-        }
-    }
-
-    private static BasicFileAttributes readAttributes(Path path) throws IOException {
-        return Files.readAttributes(path, BasicFileAttributes.class, LinkOption.NOFOLLOW_LINKS);
-    }
-
-    private static void requireNotInterrupted() throws InterruptedIOException {
-        if (Thread.currentThread().isInterrupted()) {
-            throw new InterruptedIOException("ZIP source scan was interrupted");
-        }
-    }
-
-    private static void requireDirectory(
-            Path path,
-            BasicFileAttributes attributes,
-            String message)
-            throws ZipBackupException {
-        try {
-            if (!FileSystemSafety.isOrdinaryDirectory(path, attributes)) {
-                throw new ZipBackupException(message);
-            }
-        } catch (IOException exception) {
-            throw new ZipBackupException(message, exception);
-        }
-    }
-
-    private static void requireSameSnapshot(SourceSnapshot expected) throws IOException {
-        SourceSnapshot current = snapshot(expected.worldDirectory());
-        if (!expected.rootFingerprint().equals(current.rootFingerprint())
-                || !sameEntries(expected.entries(), current.entries())) {
-            throw new ZipBackupException(
-                    "The world tree changed while the ZIP backup was being created");
-        }
-    }
-
-    private static boolean sameEntries(
-            List<SourceEntry> expected,
-            List<SourceEntry> current) {
-        if (expected.size() != current.size()) {
-            return false;
-        }
-        for (int index = 0; index < expected.size(); index++) {
-            if (!expected.get(index).sameSource(current.get(index))) {
-                return false;
-            }
-        }
-        return true;
-    }
-
-    private static boolean isExcludedTree(Path relative) {
-        return relative.getNameCount() > 0
-                && relative.getName(0).toString().equalsIgnoreCase(".worldarchive");
-    }
-
-    private static boolean isRootSessionLock(Path relative) {
-        return relative.getNameCount() == 1
-                && relative.getFileName().toString().equalsIgnoreCase("session.lock");
-    }
-
-    private static String portable(Path relative) throws ZipBackupException {
-        try {
-            return PortableZipPath.fromRelativePath(relative);
-        } catch (IllegalArgumentException exception) {
-            throw new ZipBackupException("World source contains a path that cannot be restored safely", exception);
-        }
-    }
-
-    private static void addCollisionKey(Set<String> keys, String path, boolean directory)
-            throws ZipBackupException {
-        String key = PortableZipPath.collisionKey(path + (directory ? "/" : ""), directory);
-        if (!keys.add(key)) {
-            throw new ZipBackupException("World source contains paths that collide on another platform");
-        }
-    }
-
-    private static void requireEntryCapacity(List<SourceEntry> entries) throws ZipBackupException {
-        if (entries.size() >= ZipLimits.MAXIMUM_ARCHIVE_ENTRIES - 3) {
-            throw new ZipBackupException("World source exceeds the ZIP entry limit");
-        }
-    }
-
-    record SourceSnapshot(
-            Path worldDirectory,
-            DirectoryFingerprint rootFingerprint,
-            List<SourceEntry> entries) {
-        SourceSnapshot {
-            Objects.requireNonNull(worldDirectory, "worldDirectory");
-            Objects.requireNonNull(rootFingerprint, "rootFingerprint");
-            entries = List.copyOf(entries);
-        }
-
-        void requireUnchanged() throws IOException {
-            requireSameSnapshot(this);
-        }
-    }
-
-    /** Directory mtimes are deferred on Windows; identity and membership remain authoritative. */
-    private record DirectoryFingerprint(
-            Object fileKey,
-            FileTime creationTime) {
-        private DirectoryFingerprint {
-            Objects.requireNonNull(creationTime, "creationTime");
-        }
-
-        static DirectoryFingerprint from(BasicFileAttributes attributes) {
-            return new DirectoryFingerprint(
-                    attributes.fileKey(),
-                    identityCreationTime(attributes));
-        }
-    }
-
-    record SourceEntry(
-            Path path,
-            String relativePath,
-            boolean directory,
-            long size,
-            FileTime lastModifiedTime,
-            FileTime creationTime,
-            Object fileKey) {
-        SourceEntry {
-            Objects.requireNonNull(path, "path");
-            Objects.requireNonNull(relativePath, "relativePath");
-            Objects.requireNonNull(lastModifiedTime, "lastModifiedTime");
-            Objects.requireNonNull(creationTime, "creationTime");
-            if (size < 0) {
-                throw new IllegalArgumentException("Source size must not be negative");
-            }
-        }
-
-        static SourceEntry directory(Path path, String relativePath, BasicFileAttributes attributes) {
-            return new SourceEntry(
-                    path,
-                    relativePath,
-                    true,
-                    0,
-                    attributes.lastModifiedTime(),
-                    identityCreationTime(attributes),
-                    attributes.fileKey());
-        }
-
-        static SourceEntry file(Path path, String relativePath, BasicFileAttributes attributes) {
-            return new SourceEntry(
-                    path,
-                    relativePath,
-                    false,
-                    attributes.size(),
-                    attributes.lastModifiedTime(),
-                    identityCreationTime(attributes),
-                    attributes.fileKey());
-        }
-
-        boolean sameSource(SourceEntry other) {
-            if (!path.equals(other.path)
-                    || !relativePath.equals(other.relativePath)
-                    || directory != other.directory
-                    || !creationTime.equals(other.creationTime)
-                    || !Objects.equals(fileKey, other.fileKey)) {
-                return false;
-            }
-            return directory
-                    || size == other.size && lastModifiedTime.equals(other.lastModifiedTime);
-        }
-    }
-
-    /** macOS may move birth time backwards when an older modification time is applied. */
-    private static final boolean IGNORE_CREATION_TIME = System.getProperty("os.name").startsWith("Mac");
-
-    private static FileTime identityCreationTime(BasicFileAttributes attributes) {
-        return IGNORE_CREATION_TIME ? FileTime.fromMillis(0) : attributes.creationTime();
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipStoreHooks.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipStoreHooks.java
deleted file mode 100644
index 65dd748..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipStoreHooks.java
+++ /dev/null
@@ -1,31 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import java.io.IOException;
-import java.nio.file.Path;
-
-/** Package-private deterministic fault and mutation points used by adversarial storage tests. */
-interface ZipStoreHooks {
-    default void archiveCompleted(Path partialArchive) throws IOException {
-    }
-
-    default void archiveInspected(Path partialArchive) throws IOException {
-    }
-
-    default void archivePublished(Path archive) throws IOException {
-    }
-
-    default void checksumPublished(Path archive, Path checksum) throws IOException {
-    }
-
-    default void restoreCopyCompleted(Path archive, Path privateCopy) throws IOException {
-    }
-
-    default void restoreEntryExtracted(Path target) throws IOException {
-    }
-
-    default void beforeArchiveDelete(Path archive) throws IOException {
-    }
-
-    default void beforeChecksumDelete(Path checksum) throws IOException {
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipVerification.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipVerification.java
index 797b57d..a2b2693 100644
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipVerification.java
+++ b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipVerification.java
@@ -5,24 +5,23 @@
 import java.util.Objects;
 import java.util.Optional;
 
-/** Integrity result for one ZIP archive and its sidecar. */
-public record ZipVerification(
-        boolean valid,
-        Optional<BackupManifest> manifest,
-        long verifiedFileCount,
-        long verifiedByteCount,
-        List<String> problems) {
+/**
+ * What a full read of one archive found. A problem means the archive is damaged or is not the
+ * backup its name says; a warning, such as a missing checksum file, leaves the backup usable.
+ * The manifest is present once the archive's own manifest could be read.
+ */
+public record ZipVerification(Optional<BackupManifest> manifest, List<String> problems, List<String> warnings) {
     public ZipVerification {
-        manifest = Objects.requireNonNull(manifest, "manifest");
-        if (verifiedFileCount < 0 || verifiedByteCount < 0) {
-            throw new IllegalArgumentException("Verified counts must not be negative");
-        }
+        Objects.requireNonNull(manifest, "manifest");
         problems = List.copyOf(problems);
-        if (valid != problems.isEmpty()) {
-            throw new IllegalArgumentException("ZIP validity must match the problem list");
-        }
-        if (problems.stream().anyMatch(problem -> problem == null || problem.isBlank())) {
-            throw new IllegalArgumentException("ZIP verification problems must contain text");
-        }
+        warnings = List.copyOf(warnings);
+    }
+
+    static ZipVerification failed(String problem) {
+        return new ZipVerification(Optional.empty(), List.of(problem), List.of());
+    }
+
+    public boolean valid() {
+        return problems.isEmpty();
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipVerificationState.java b/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipVerificationState.java
deleted file mode 100644
index c3a3ec8..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/storage/zip/ZipVerificationState.java
+++ /dev/null
@@ -1,46 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.storage.zip.ZipArchiveInspector.Inspection;
-import java.nio.file.attribute.FileTime;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Optional;
-
-/** Mutable accumulator kept private to one ZIP verification operation. */
-final class ZipVerificationState {
-    final LinkedHashSet<String> problems = new LinkedHashSet<>();
-
-    private Optional<BackupManifest> manifest = Optional.empty();
-
-    private long verifiedFiles;
-
-    private long verifiedBytes;
-
-    void apply(Inspection inspection) {
-        manifest = inspection.manifest();
-        verifiedFiles = inspection.verifiedFileCount();
-        verifiedBytes = inspection.verifiedByteCount();
-        problems.addAll(inspection.problems());
-    }
-
-    ZipVerification finish() {
-        List<String> immutableProblems = List.copyOf(problems);
-        return new ZipVerification(
-                immutableProblems.isEmpty(),
-                manifest,
-                verifiedFiles,
-                verifiedBytes,
-                immutableProblems);
-    }
-}
-
-record ChecksumSnapshot(String sha256, FileFingerprint fingerprint) {
-}
-
-record FileFingerprint(
-        Object fileKey,
-        long size,
-        FileTime lastModifiedTime,
-        FileTime creationTime) {
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/AsyncTasks.java b/src/main/java/dev/ishaanko/worldarchive/support/AsyncTasks.java
similarity index 60%
rename from src/main/java/dev/ishaanko/worldarchive/core/AsyncTasks.java
rename to src/main/java/dev/ishaanko/worldarchive/support/AsyncTasks.java
index 7b550d6..b92d310 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/AsyncTasks.java
+++ b/src/main/java/dev/ishaanko/worldarchive/support/AsyncTasks.java
@@ -1,14 +1,19 @@
-package dev.ishaanko.worldarchive.core;
+package dev.ishaanko.worldarchive.support;
 
 import java.util.Objects;
 import java.util.concurrent.CancellationException;
 import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CompletionException;
 import java.util.concurrent.CompletionStage;
+import java.util.concurrent.ExecutionException;
 import java.util.concurrent.Executor;
 import java.util.concurrent.RejectedExecutionException;
 import java.util.function.Supplier;
 
-/** Starts asynchronous work without leaking executor rejection to the caller. */
+/**
+ * Starts asynchronous work and waits for it. An executor that rejects the work completes the
+ * returned stage with the rejection instead of throwing at the caller.
+ */
 public final class AsyncTasks {
     private AsyncTasks() {
     }
@@ -25,6 +30,26 @@ public static <T> CompletionStage<T> supply(
         }
     }
 
+    /**
+     * Like {@link #supply} for work that throws checked exceptions. A checked exception
+     * completes the stage wrapped in a {@link CompletionException}, the same shape that
+     * {@link CompletableFuture#supplyAsync} gives an unchecked one.
+     */
+    public static <T> CompletionStage<T> supplyChecked(
+            Executor executor,
+            CheckedSupplier<T> operation) {
+        Objects.requireNonNull(operation, "operation");
+        return supply(executor, () -> {
+            try {
+                return operation.get();
+            } catch (RuntimeException exception) {
+                throw exception;
+            } catch (Exception exception) {
+                throw new CompletionException(exception);
+            }
+        });
+    }
+
     /**
      * Runs an operation whose worker can be stopped through the returned future. Unlike a
      * plain cancel, {@link InterruptibleFuture#stop} keeps the operation's own outcome, so a
@@ -44,6 +69,29 @@ public static <T> InterruptibleFuture<T> supplyInterruptible(
         return result;
     }
 
+    /**
+     * Waits for a stage and rethrows the cause of its failure as it was thrown. An interrupt
+     * while waiting restores the thread's interrupt flag and throws
+     * {@link InterruptedException}; a cancelled stage throws {@link CancellationException}.
+     */
+    public static <T> T await(CompletionStage<T> stage) throws Exception {
+        try {
+            return stage.toCompletableFuture().get();
+        } catch (InterruptedException exception) {
+            Thread.currentThread().interrupt();
+            throw exception;
+        } catch (ExecutionException exception) {
+            Throwable cause = exception.getCause();
+            if (cause instanceof Exception checked) {
+                throw checked;
+            }
+            if (cause instanceof Error error) {
+                throw error;
+            }
+            throw new CompletionException(cause);
+        }
+    }
+
     /** True when a failure is a cancellation, directly or wrapped by a completion stage. */
     public static boolean isCancellation(Throwable failure) {
         return failure instanceof CancellationException
@@ -62,6 +110,12 @@ public static CompletionStage<Void> run(
         }
     }
 
+    /** Work for {@link #supplyChecked}. */
+    @FunctionalInterface
+    public interface CheckedSupplier<T> {
+        T get() throws Exception;
+    }
+
     /** One blocking operation that may be interrupted while it waits on locks or I/O. */
     @FunctionalInterface
     public interface InterruptibleOperation<T> {
@@ -104,6 +158,12 @@ public boolean cancel(boolean mayInterruptIfRunning) {
             return cancelled;
         }
 
+        /**
+         * Runs the operation, then detaches the worker and clears its interrupt before the
+         * future completes. Dependents that run on this thread, such as a catalog write, must
+         * never see an interrupt that was meant for the operation, because file locks and
+         * channel I/O fail on an interrupted thread.
+         */
         private void run(InterruptibleOperation<T> operation) {
             synchronized (lock) {
                 if (stopRequested || isDone()) {
@@ -113,18 +173,23 @@ private void run(InterruptibleOperation<T> operation) {
                 }
                 worker = Thread.currentThread();
             }
+            T value = null;
+            Throwable failure = null;
             try {
-                complete(operation.run());
+                value = operation.run();
             } catch (Throwable throwable) {
-                completeExceptionally(throwable);
-            } finally {
-                synchronized (lock) {
-                    worker = null;
-                }
-                // An interrupt that landed during the operation must not follow the thread
-                // back to its pool.
+                failure = throwable;
+            }
+            synchronized (lock) {
+                worker = null;
+                // No stop() can interrupt this thread once the worker is detached.
                 Thread.interrupted();
             }
+            if (failure == null) {
+                complete(value);
+            } else {
+                completeExceptionally(failure);
+            }
         }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/AtomicFiles.java b/src/main/java/dev/ishaanko/worldarchive/support/AtomicFiles.java
similarity index 75%
rename from src/main/java/dev/ishaanko/worldarchive/core/AtomicFiles.java
rename to src/main/java/dev/ishaanko/worldarchive/support/AtomicFiles.java
index b7cddf8..77ba2ea 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/AtomicFiles.java
+++ b/src/main/java/dev/ishaanko/worldarchive/support/AtomicFiles.java
@@ -1,4 +1,4 @@
-package dev.ishaanko.worldarchive.core;
+package dev.ishaanko.worldarchive.support;
 
 import java.io.IOException;
 import java.io.InputStream;
@@ -6,7 +6,9 @@
 import java.nio.channels.FileChannel;
 import java.nio.charset.CharacterCodingException;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.AccessDeniedException;
 import java.nio.file.AtomicMoveNotSupportedException;
+import java.nio.file.FileSystemException;
 import java.nio.file.Files;
 import java.nio.file.LinkOption;
 import java.nio.file.Path;
@@ -20,6 +22,11 @@
 public final class AtomicFiles {
     private static final int MAXIMUM_METADATA_BYTES = 64 * 1_024 * 1_024;
 
+    /** Windows refuses a replace while an antivirus or sync client holds the target open. */
+    private static final int REPLACE_ATTEMPTS = 5;
+
+    private static final long REPLACE_RETRY_MILLIS = 50;
+
     private AtomicFiles() {
     }
 
@@ -37,7 +44,7 @@ public static String readUtf8(Path source, int maximumBytes) throws IOException
                 absoluteSource,
                 BasicFileAttributes.class,
                 LinkOption.NOFOLLOW_LINKS);
-        if (!FileSystemSafety.isOrdinaryRegularFile(absoluteSource, attributes)) {
+        if (!FileSystemSafety.isOrdinaryRegularFile(attributes)) {
             throw new IOException("Metadata source is not a safe regular file: " + absoluteSource);
         }
         if (attributes.size() > maximumBytes) {
@@ -64,7 +71,8 @@ public static String readUtf8(Path source, int maximumBytes) throws IOException
     /**
      * Publishes complete UTF-8 content with a same-directory atomic move. The temporary file
      * is flushed before the move and the directory entry is flushed after it where the
-     * platform allows, so the new name survives a system crash.
+     * platform allows, so the new name survives a system crash. A failed write or replace
+     * leaves the previous file as it was and removes the temporary file.
      *
      * @throws AtomicMoveNotSupportedException when the filesystem cannot provide atomic publication
      */
@@ -103,11 +111,7 @@ public static void writeUtf8(
                 }
                 channel.force(true);
             }
-            Files.move(
-                    temporary,
-                    absoluteTarget,
-                    StandardCopyOption.ATOMIC_MOVE,
-                    StandardCopyOption.REPLACE_EXISTING);
+            replace(temporary, absoluteTarget);
         } catch (IOException | RuntimeException exception) {
             try {
                 Files.deleteIfExists(temporary);
@@ -119,6 +123,36 @@ public static void writeUtf8(
         flushDirectory(parent);
     }
 
+    /**
+     * Moves the temporary file over the target, retrying briefly while another program holds
+     * the target open. Windows reports that as access denied or as a plain file system error;
+     * every other failure, such as a missing atomic move, is final at once.
+     */
+    private static void replace(Path temporary, Path target) throws IOException {
+        for (int attempt = 1; ; attempt++) {
+            try {
+                Files.move(
+                        temporary,
+                        target,
+                        StandardCopyOption.ATOMIC_MOVE,
+                        StandardCopyOption.REPLACE_EXISTING);
+                return;
+            } catch (FileSystemException exception) {
+                boolean transientLock = exception instanceof AccessDeniedException
+                        || exception.getClass() == FileSystemException.class;
+                if (!transientLock || attempt == REPLACE_ATTEMPTS) {
+                    throw exception;
+                }
+                try {
+                    Thread.sleep(REPLACE_RETRY_MILLIS);
+                } catch (InterruptedException interrupted) {
+                    Thread.currentThread().interrupt();
+                    throw exception;
+                }
+            }
+        }
+    }
+
     /**
      * Flushes a directory so a rename inside it reaches the disk. Windows cannot open a
      * directory as a channel and some filesystems refuse the sync; both are ignored because
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/Digests.java b/src/main/java/dev/ishaanko/worldarchive/support/Digests.java
similarity index 96%
rename from src/main/java/dev/ishaanko/worldarchive/core/Digests.java
rename to src/main/java/dev/ishaanko/worldarchive/support/Digests.java
index e1bc34d..8e916f1 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/Digests.java
+++ b/src/main/java/dev/ishaanko/worldarchive/support/Digests.java
@@ -1,4 +1,4 @@
-package dev.ishaanko.worldarchive.core;
+package dev.ishaanko.worldarchive.support;
 
 import java.io.IOException;
 import java.io.InputStream;
diff --git a/src/main/java/dev/ishaanko/worldarchive/support/FileSystemSafety.java b/src/main/java/dev/ishaanko/worldarchive/support/FileSystemSafety.java
new file mode 100644
index 0000000..111bd28
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/support/FileSystemSafety.java
@@ -0,0 +1,22 @@
+package dev.ishaanko.worldarchive.support;
+
+import java.nio.file.LinkOption;
+import java.nio.file.attribute.BasicFileAttributes;
+
+/**
+ * Tells plain files and folders apart from links and special entries. Pass attributes read with
+ * {@link LinkOption#NOFOLLOW_LINKS}: a symbolic link then is neither a file nor a folder, and on
+ * Windows every other reparse point, such as a junction, reports {@code isOther()}.
+ */
+public final class FileSystemSafety {
+    private FileSystemSafety() {
+    }
+
+    public static boolean isOrdinaryDirectory(BasicFileAttributes attributes) {
+        return attributes.isDirectory() && !attributes.isOther();
+    }
+
+    public static boolean isOrdinaryRegularFile(BasicFileAttributes attributes) {
+        return attributes.isRegularFile();
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/support/JsonFields.java b/src/main/java/dev/ishaanko/worldarchive/support/JsonFields.java
new file mode 100644
index 0000000..d282265
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/support/JsonFields.java
@@ -0,0 +1,212 @@
+package dev.ishaanko.worldarchive.support;
+
+import com.google.gson.JsonArray;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParseException;
+import com.google.gson.JsonParser;
+import com.google.gson.JsonPrimitive;
+import java.math.BigDecimal;
+import java.time.Instant;
+import java.time.format.DateTimeParseException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.function.BiFunction;
+
+/**
+ * Strict readers for the fields of a Gson {@link JsonObject}. A field of the wrong type is an
+ * error, never a silent default, and numbers must be exact integers. Each store keeps its own
+ * exception type: create one instance per exception factory, for example
+ * {@code new JsonFields<>(IOException::new)}, and share it.
+ *
+ * @param <E> the exception thrown for missing or malformed fields
+ */
+public final class JsonFields<E extends Exception> {
+    private final BiFunction<String, Throwable, ? extends E> errors;
+
+    /** The factory receives a message and the underlying cause, which may be null. */
+    public JsonFields(BiFunction<String, Throwable, ? extends E> errors) {
+        this.errors = Objects.requireNonNull(errors, "errors");
+    }
+
+    /** Parses text that must hold one JSON object; the description names it in errors. */
+    public JsonObject parseObject(String json, String description) throws E {
+        JsonElement parsed;
+        try {
+            parsed = JsonParser.parseString(json);
+        } catch (JsonParseException exception) {
+            throw failure(description + " is not valid JSON", exception);
+        }
+        if (!parsed.isJsonObject()) {
+            throw failure(description + " must be a JSON object", null);
+        }
+        return parsed.getAsJsonObject();
+    }
+
+    public JsonObject requiredObject(JsonObject object, String name) throws E {
+        return optionalObject(object, name).orElseThrow(() -> missing("object", name));
+    }
+
+    /** An absent or null field is empty; any other non-object value is an error. */
+    public Optional<JsonObject> optionalObject(JsonObject object, String name) throws E {
+        JsonElement element = present(object, name);
+        if (element == null) {
+            return Optional.empty();
+        }
+        if (!element.isJsonObject()) {
+            throw invalid("an object", name);
+        }
+        return Optional.of(element.getAsJsonObject());
+    }
+
+    public JsonArray requiredArray(JsonObject object, String name) throws E {
+        JsonElement element = present(object, name);
+        if (element == null || !element.isJsonArray()) {
+            throw missing("array", name);
+        }
+        return element.getAsJsonArray();
+    }
+
+    /** An array whose every element must be an object. */
+    public List<JsonObject> requiredObjects(JsonObject object, String name) throws E {
+        JsonArray array = requiredArray(object, name);
+        List<JsonObject> values = new ArrayList<>(array.size());
+        for (JsonElement element : array) {
+            if (!element.isJsonObject()) {
+                throw invalid("an array of objects", name);
+            }
+            values.add(element.getAsJsonObject());
+        }
+        return values;
+    }
+
+    /** An array whose every element must be a string. */
+    public List<String> requiredStrings(JsonObject object, String name) throws E {
+        JsonArray array = requiredArray(object, name);
+        List<String> values = new ArrayList<>(array.size());
+        for (JsonElement element : array) {
+            if (!isString(element)) {
+                throw invalid("an array of strings", name);
+            }
+            values.add(element.getAsString());
+        }
+        return values;
+    }
+
+    public String requiredString(JsonObject object, String name) throws E {
+        return optionalString(object, name).orElseThrow(() -> missing("string", name));
+    }
+
+    /** An absent or null field is empty; any other non-string value is an error. */
+    public Optional<String> optionalString(JsonObject object, String name) throws E {
+        JsonElement element = present(object, name);
+        if (element == null) {
+            return Optional.empty();
+        }
+        if (!isString(element)) {
+            throw invalid("a string", name);
+        }
+        return Optional.of(element.getAsString());
+    }
+
+    public boolean requiredBoolean(JsonObject object, String name) throws E {
+        return optionalBoolean(object, name).orElseThrow(() -> missing("boolean", name));
+    }
+
+    /** An absent or null field is empty; any other non-boolean value is an error. */
+    public Optional<Boolean> optionalBoolean(JsonObject object, String name) throws E {
+        JsonElement element = present(object, name);
+        if (element == null) {
+            return Optional.empty();
+        }
+        if (!element.isJsonPrimitive() || !element.getAsJsonPrimitive().isBoolean()) {
+            throw invalid("a boolean", name);
+        }
+        return Optional.of(element.getAsBoolean());
+    }
+
+    /** A number that is exactly a {@code long}: no fraction and no overflow. */
+    public long requiredLong(JsonObject object, String name) throws E {
+        JsonElement element = present(object, name);
+        if (element == null) {
+            throw missing("integer", name);
+        }
+        return exactInteger(element, name).longValue();
+    }
+
+    /** A number that is exactly an {@code int}: no fraction and no overflow. */
+    public int requiredInt(JsonObject object, String name) throws E {
+        return optionalInt(object, name).orElseThrow(() -> missing("integer", name));
+    }
+
+    /** An absent or null field is empty; any other value must be an exact {@code int}. */
+    public Optional<Integer> optionalInt(JsonObject object, String name) throws E {
+        JsonElement element = present(object, name);
+        if (element == null) {
+            return Optional.empty();
+        }
+        BigDecimal value = exactInteger(element, name);
+        if (value.compareTo(BigDecimal.valueOf(Integer.MIN_VALUE)) < 0
+                || value.compareTo(BigDecimal.valueOf(Integer.MAX_VALUE)) > 0) {
+            throw failure("Integer field is out of range: " + name, null);
+        }
+        return Optional.of(value.intValue());
+    }
+
+    /** An ISO-8601 instant such as {@code 2026-09-01T12:00:00Z}. */
+    public Instant requiredInstant(JsonObject object, String name) throws E {
+        String value = requiredString(object, name);
+        try {
+            return Instant.parse(value);
+        } catch (DateTimeParseException exception) {
+            throw failure("Field is not an ISO-8601 instant: " + name, exception);
+        }
+    }
+
+    /** The exact name of one constant of the enum type. */
+    public <T extends Enum<T>> T requiredEnum(JsonObject object, String name, Class<T> type) throws E {
+        String value = requiredString(object, name);
+        try {
+            return Enum.valueOf(type, value);
+        } catch (IllegalArgumentException exception) {
+            throw failure("Field has an unknown value: " + name, exception);
+        }
+    }
+
+    private BigDecimal exactInteger(JsonElement element, String name) throws E {
+        if (!element.isJsonPrimitive() || !element.getAsJsonPrimitive().isNumber()) {
+            throw invalid("an integer", name);
+        }
+        JsonPrimitive primitive = element.getAsJsonPrimitive();
+        try {
+            BigDecimal value = new BigDecimal(primitive.getAsString());
+            value.longValueExact();
+            return value;
+        } catch (ArithmeticException | NumberFormatException exception) {
+            throw failure("Field is not an exact integer: " + name, exception);
+        }
+    }
+
+    private static JsonElement present(JsonObject object, String name) {
+        JsonElement element = Objects.requireNonNull(object, "object").get(name);
+        return element == null || element.isJsonNull() ? null : element;
+    }
+
+    private static boolean isString(JsonElement element) {
+        return element.isJsonPrimitive() && element.getAsJsonPrimitive().isString();
+    }
+
+    private E missing(String type, String name) {
+        return failure("Required " + type + " field is missing or invalid: " + name, null);
+    }
+
+    private E invalid(String type, String name) {
+        return failure("Field must be " + type + ": " + name, null);
+    }
+
+    private E failure(String message, Throwable cause) {
+        return errors.apply(message, cause);
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/support/LockedFile.java b/src/main/java/dev/ishaanko/worldarchive/support/LockedFile.java
new file mode 100644
index 0000000..9c92915
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/support/LockedFile.java
@@ -0,0 +1,78 @@
+package dev.ishaanko.worldarchive.support;
+
+import java.io.IOException;
+import java.nio.channels.FileChannel;
+import java.nio.channels.FileLock;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.Path;
+import java.nio.file.StandardOpenOption;
+import java.util.Objects;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentMap;
+import java.util.concurrent.locks.ReentrantLock;
+
+/**
+ * Serializes read-modify-write access to one file across threads and processes.
+ *
+ * <p>Threads of this JVM wait on a lock shared by every instance for the same path, because
+ * an OS file lock is held per process. Other processes, such as a second game instance on the
+ * same storage folder, wait on an OS lock of the sibling {@code <name>.lock} file. The lock file
+ * is created on first use and never deleted. Callers still publish the file itself through
+ * {@link AtomicFiles}, so a reader that skips the lock never sees a half-written file.</p>
+ */
+public final class LockedFile {
+    private static final ConcurrentMap<Path, ReentrantLock> JVM_LOCKS = new ConcurrentHashMap<>();
+
+    private final Path file;
+
+    private final Path lockFile;
+
+    private final ReentrantLock jvmLock;
+
+    public LockedFile(Path file) {
+        this.file = Objects.requireNonNull(file, "file").toAbsolutePath().normalize();
+        Path name = this.file.getFileName();
+        if (name == null) {
+            throw new IllegalArgumentException("A locked file needs a file name: " + this.file);
+        }
+        this.lockFile = this.file.resolveSibling(name + ".lock");
+        this.jvmLock = JVM_LOCKS.computeIfAbsent(this.file, ignored -> new ReentrantLock());
+    }
+
+    public Path file() {
+        return file;
+    }
+
+    /**
+     * Runs the operation while no other thread or process holds this file's lock. Creates the
+     * parent folder when it is missing. The lock file is opened without following links, so
+     * the lock never reaches through a link to another file.
+     *
+     * <p>An OS file lock fails on an interrupted thread, so call this only from a thread whose
+     * interrupt is not in use for cancellation.</p>
+     */
+    public <T> T withLock(IoSupplier<T> operation) throws IOException {
+        Objects.requireNonNull(operation, "operation");
+        jvmLock.lock();
+        try {
+            Files.createDirectories(lockFile.getParent());
+            try (FileChannel channel = FileChannel.open(
+                            lockFile,
+                            StandardOpenOption.CREATE,
+                            StandardOpenOption.WRITE,
+                            LinkOption.NOFOLLOW_LINKS);
+                    FileLock ignored = channel.lock()) {
+                return operation.get();
+            }
+        } finally {
+            jvmLock.unlock();
+        }
+    }
+
+    /** File work that runs under the lock. */
+    @FunctionalInterface
+    public interface IoSupplier<T> {
+        T get() throws IOException;
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/core/Observers.java b/src/main/java/dev/ishaanko/worldarchive/support/Observers.java
similarity index 90%
rename from src/main/java/dev/ishaanko/worldarchive/core/Observers.java
rename to src/main/java/dev/ishaanko/worldarchive/support/Observers.java
index c879870..6cdd660 100644
--- a/src/main/java/dev/ishaanko/worldarchive/core/Observers.java
+++ b/src/main/java/dev/ishaanko/worldarchive/support/Observers.java
@@ -1,4 +1,4 @@
-package dev.ishaanko.worldarchive.core;
+package dev.ishaanko.worldarchive.support;
 
 /** Runs an observer callback without letting it affect the caller's outcome. */
 public final class Observers {
diff --git a/src/main/java/dev/ishaanko/worldarchive/support/PortablePath.java b/src/main/java/dev/ishaanko/worldarchive/support/PortablePath.java
new file mode 100644
index 0000000..974585e
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/support/PortablePath.java
@@ -0,0 +1,164 @@
+package dev.ishaanko.worldarchive.support;
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Path;
+import java.text.Normalizer;
+import java.util.Locale;
+import java.util.Objects;
+import java.util.Set;
+
+/**
+ * The rules for a relative path that every backup format can store and that Windows, macOS and
+ * Linux can all restore. Segments are joined with {@code /}. A path must not be absolute or
+ * carry a drive letter, and a segment must not be empty, {@code .} or {@code ..}, end with a dot
+ * or a space, use a Windows device name or reserved character, or contain a control character
+ * or U+FFFD. Every rejection is an {@link IllegalArgumentException} that names the path.
+ */
+public final class PortablePath {
+    public static final int MAXIMUM_PATH_BYTES = 4_096;
+
+    public static final int MAXIMUM_SEGMENT_BYTES = 255;
+
+    private static final Set<String> WINDOWS_DEVICES = Set.of(
+            "CON", "PRN", "AUX", "NUL",
+            "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9",
+            "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9");
+
+    private static final String WINDOWS_RESERVED = "<>:\"|?*";
+
+    private PortablePath() {
+    }
+
+    /** Validates a file path such as {@code region/r.0.0.mca} and returns it unchanged. */
+    public static String validate(String path) {
+        Objects.requireNonNull(path, "path");
+        if (path.endsWith("/")) {
+            throw rejected(path, "ends with a slash");
+        }
+        requirePortable(path);
+        return path;
+    }
+
+    /**
+     * Validates a ZIP directory entry such as {@code region/}, which must end with one slash,
+     * and returns the directory path without it.
+     */
+    public static String validateDirectoryEntry(String entry) {
+        Objects.requireNonNull(entry, "entry");
+        if (!entry.endsWith("/")) {
+            throw rejected(entry, "is a directory entry without a trailing slash");
+        }
+        return validate(entry.substring(0, entry.length() - 1));
+    }
+
+    /** Joins the names of a relative file system path with slashes and validates the result. */
+    public static String fromRelativePath(Path relative) {
+        StringBuilder portable = new StringBuilder();
+        for (Path segment : Objects.requireNonNull(relative, "relative")) {
+            if (!portable.isEmpty()) {
+                portable.append('/');
+            }
+            portable.append(segment);
+        }
+        return validate(portable.toString());
+    }
+
+    /**
+     * The key under which two paths collide on a file system that ignores case or Unicode
+     * normalization, as Windows and macOS do by default.
+     */
+    public static String collisionKey(String path) {
+        return Normalizer.normalize(validate(path), Normalizer.Form.NFC).toLowerCase(Locale.ROOT);
+    }
+
+    /** Resolves a path below {@code root}; the root itself and anything outside it are refused. */
+    public static Path resolveInside(Path root, String path) {
+        Objects.requireNonNull(root, "root");
+        Path result = root;
+        for (String segment : validate(path).split("/")) {
+            result = result.resolve(segment);
+        }
+        result = result.normalize();
+        if (result.equals(root) || !result.startsWith(root)) {
+            throw rejected(path, "escapes its folder");
+        }
+        return result;
+    }
+
+    /**
+     * The extra rules of a Git snapshot tree: no {@code .git} segment at any depth, and a first
+     * segment that is none of the snapshot's own internal names. Both compare without case.
+     */
+    public static String requireGitSafe(String path, Set<String> internalRootNames) {
+        validate(path);
+        for (String segment : path.split("/")) {
+            if (segment.equalsIgnoreCase(".git")) {
+                throw rejected(path, "contains a .git folder, which Git cannot store");
+            }
+        }
+        String root = path.split("/", 2)[0];
+        if (internalRootNames.stream().anyMatch(root::equalsIgnoreCase)) {
+            throw rejected(path, "uses a name that WorldArchive keeps for itself");
+        }
+        return path;
+    }
+
+    private static void requirePortable(String path) {
+        if (path.isEmpty()) {
+            throw new IllegalArgumentException("Path is empty");
+        }
+        if (path.startsWith("/") || hasDrivePrefix(path)) {
+            throw rejected(path, "is absolute");
+        }
+        if (path.indexOf('\\') >= 0) {
+            throw rejected(path, "contains a backslash");
+        }
+        if (path.getBytes(StandardCharsets.UTF_8).length > MAXIMUM_PATH_BYTES) {
+            throw rejected(path, "is longer than " + MAXIMUM_PATH_BYTES + " bytes");
+        }
+        for (String segment : path.split("/", -1)) {
+            requirePortableSegment(path, segment);
+        }
+    }
+
+    private static void requirePortableSegment(String path, String segment) {
+        if (segment.isEmpty() || segment.equals(".") || segment.equals("..")) {
+            throw rejected(path, "has an empty, '.' or '..' segment");
+        }
+        if (segment.getBytes(StandardCharsets.UTF_8).length > MAXIMUM_SEGMENT_BYTES) {
+            throw rejected(path, "has a name longer than " + MAXIMUM_SEGMENT_BYTES + " bytes");
+        }
+        if (segment.endsWith(".") || segment.endsWith(" ")) {
+            throw rejected(path, "has a name that ends with a dot or a space");
+        }
+        if (segment.chars().anyMatch(character -> WINDOWS_RESERVED.indexOf(character) >= 0)) {
+            throw rejected(path, "contains one of the characters " + WINDOWS_RESERVED);
+        }
+        if (segment.chars().anyMatch(Character::isISOControl)) {
+            throw rejected(path, "contains a control character");
+        }
+        if (segment.indexOf('\uFFFD') >= 0) {
+            throw rejected(path, "contains a character that could not be decoded");
+        }
+        if (isWindowsDeviceName(segment)) {
+            throw rejected(path, "uses the Windows device name "
+                    + segment.split("\\.", 2)[0].toUpperCase(Locale.ROOT));
+        }
+    }
+
+    /**
+     * True when a file name, up to its first dot, is a Windows device name such as {@code CON}
+     * or {@code lpt1.txt}. Windows cannot create a file or folder with such a name.
+     */
+    public static boolean isWindowsDeviceName(String name) {
+        return WINDOWS_DEVICES.contains(name.split("\\.", 2)[0].toUpperCase(Locale.ROOT));
+    }
+
+    private static boolean hasDrivePrefix(String path) {
+        return path.length() >= 2 && Character.isLetter(path.charAt(0)) && path.charAt(1) == ':';
+    }
+
+    private static IllegalArgumentException rejected(String path, String reason) {
+        return new IllegalArgumentException("Path \"" + path + "\" " + reason);
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/ActionDisabledReason.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/ActionDisabledReason.java
index b53b476..5d26b9e 100644
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/ActionDisabledReason.java
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/ActionDisabledReason.java
@@ -1,11 +1,12 @@
 package dev.ishaanko.worldarchive.ui.model;
 
-/** Stable reason a browser action cannot currently run. */
+/** Why a backup-browser action cannot run; {@link #NONE} when it can. */
 public enum ActionDisabledReason {
     NONE,
     OPERATION_IN_PROGRESS,
     SOURCE_UNAVAILABLE,
-    NO_DESTINATION_CONFIGURED,
+    /** The world folder is there, but the settings let no new backup be made; see {@link BackupBrowserCapabilities#createBlock}. */
+    CREATE_BLOCKED,
     NO_SELECTION,
     MULTIPLE_SELECTED,
     NO_DURABLE_COPY,
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupAction.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupAction.java
index 75757c1..7c56fe0 100644
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupAction.java
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupAction.java
@@ -1,6 +1,6 @@
 package dev.ishaanko.worldarchive.ui.model;
 
-/** Backup-browser actions whose enablement is derived from presentation state. */
+/** The buttons of the backup browser; {@link BackupActionPolicy} decides which can run. */
 public enum BackupAction {
     CREATE,
     RESTORE,
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupActionAvailability.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupActionAvailability.java
deleted file mode 100644
index 90294b9..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupActionAvailability.java
+++ /dev/null
@@ -1,24 +0,0 @@
-package dev.ishaanko.worldarchive.ui.model;
-
-import java.util.Objects;
-
-/** Enablement and stable disabled reason for one action. */
-public record BackupActionAvailability(boolean enabled, ActionDisabledReason reason) {
-    public BackupActionAvailability {
-        Objects.requireNonNull(reason, "reason");
-        if (enabled != (reason == ActionDisabledReason.NONE)) {
-            throw new IllegalArgumentException("Enabled actions must have NONE as their reason");
-        }
-    }
-
-    public static BackupActionAvailability available() {
-        return new BackupActionAvailability(true, ActionDisabledReason.NONE);
-    }
-
-    public static BackupActionAvailability disabled(ActionDisabledReason reason) {
-        if (reason == ActionDisabledReason.NONE) {
-            throw new IllegalArgumentException("A disabled action requires a reason");
-        }
-        return new BackupActionAvailability(false, reason);
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupActionPolicy.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupActionPolicy.java
index c0c8879..6447292 100644
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupActionPolicy.java
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupActionPolicy.java
@@ -4,92 +4,91 @@
 import java.util.EnumMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Objects;
 
-/** Pure action policy shared by screens and screen tests. */
+/** Decides which backup-browser actions can run for the current selection, and why one cannot. */
 public final class BackupActionPolicy {
     private BackupActionPolicy() {
     }
 
     /**
-     * Evaluates every action for the current selection. Delete accepts any number of rows;
-     * restore, sync, and verify need exactly one.
+     * The reason each action cannot run, or {@link ActionDisabledReason#NONE} when it can. Delete
+     * accepts any number of backups; Restore, Sync and Verify need exactly one.
      */
-    public static Map<BackupAction, BackupActionAvailability> evaluate(
+    public static Map<BackupAction, ActionDisabledReason> evaluate(
             BackupBrowserCapabilities capabilities,
             List<BackupRow> selection) {
-        Objects.requireNonNull(capabilities, "capabilities");
-        Objects.requireNonNull(selection, "selection");
-        EnumMap<BackupAction, BackupActionAvailability> result = new EnumMap<>(BackupAction.class);
-        if (capabilities.operationInProgress()) {
-            for (BackupAction action : BackupAction.values()) {
-                result.put(action, disabled(ActionDisabledReason.OPERATION_IN_PROGRESS));
-            }
-            return Collections.unmodifiableMap(result);
+        EnumMap<BackupAction, ActionDisabledReason> reasons = new EnumMap<>(BackupAction.class);
+        for (BackupAction action : BackupAction.values()) {
+            reasons.put(action, capabilities.operationInProgress()
+                    ? ActionDisabledReason.OPERATION_IN_PROGRESS
+                    : reason(action, capabilities, selection));
         }
+        return Collections.unmodifiableMap(reasons);
+    }
 
-        result.put(
-                BackupAction.CREATE,
-                capabilities.createDestinationConfigured()
-                        ? enabled()
-                        : disabled(capabilities.sourceAvailable()
-                                ? ActionDisabledReason.NO_DESTINATION_CONFIGURED
-                                : ActionDisabledReason.SOURCE_UNAVAILABLE));
-        result.put(
-                BackupAction.OPEN_FOLDER,
-                capabilities.managedFolderAvailable()
-                        ? enabled()
-                        : disabled(ActionDisabledReason.FOLDER_UNAVAILABLE));
-        result.put(BackupAction.STORAGE, enabled());
-        result.put(BackupAction.SETTINGS, enabled());
+    private static ActionDisabledReason reason(
+            BackupAction action,
+            BackupBrowserCapabilities capabilities,
+            List<BackupRow> selection) {
+        return switch (action) {
+            case CREATE -> create(capabilities);
+            case RESTORE, VERIFY -> restoreOrVerify(selection);
+            case DELETE -> delete(selection);
+            case SYNC -> sync(capabilities, selection);
+            case OPEN_FOLDER -> capabilities.managedFolderAvailable()
+                    ? ActionDisabledReason.NONE
+                    : ActionDisabledReason.FOLDER_UNAVAILABLE;
+            case STORAGE, SETTINGS -> ActionDisabledReason.NONE;
+        };
+    }
 
-        if (selection.isEmpty()) {
-            disableSelectionActions(result, ActionDisabledReason.NO_SELECTION);
-            return Collections.unmodifiableMap(result);
-        }
-        boolean allDurable = selection.stream().allMatch(BackupRow::hasDurableCopy);
-        result.put(
-                BackupAction.DELETE,
-                allDurable ? enabled() : disabled(ActionDisabledReason.NO_DURABLE_COPY));
-        if (selection.size() > 1) {
-            result.put(BackupAction.RESTORE, disabled(ActionDisabledReason.MULTIPLE_SELECTED));
-            result.put(BackupAction.VERIFY, disabled(ActionDisabledReason.MULTIPLE_SELECTED));
-            result.put(BackupAction.SYNC, disabled(ActionDisabledReason.MULTIPLE_SELECTED));
-            return Collections.unmodifiableMap(result);
+    private static ActionDisabledReason create(BackupBrowserCapabilities capabilities) {
+        if (!capabilities.sourceAvailable()) {
+            return ActionDisabledReason.SOURCE_UNAVAILABLE;
         }
-        BackupRow row = selection.getFirst();
-        BackupActionAvailability durable = row.hasDurableCopy()
-                ? enabled()
-                : disabled(ActionDisabledReason.NO_DURABLE_COPY);
-        result.put(BackupAction.RESTORE, durable);
-        result.put(BackupAction.VERIFY, durable);
+        return capabilities.createBlock().isPresent()
+                ? ActionDisabledReason.CREATE_BLOCKED
+                : ActionDisabledReason.NONE;
+    }
 
-        BackupActionAvailability sync;
-        if (!row.git().durable()) {
-            sync = disabled(ActionDisabledReason.NO_DURABLE_COPY);
-        } else if (!capabilities.gitRemoteConfigured()) {
-            sync = disabled(ActionDisabledReason.REMOTE_NOT_CONFIGURED);
-        } else {
-            sync = enabled();
+    private static ActionDisabledReason delete(List<BackupRow> selection) {
+        if (selection.isEmpty()) {
+            return ActionDisabledReason.NO_SELECTION;
         }
-        result.put(BackupAction.SYNC, sync);
-        return Collections.unmodifiableMap(result);
+        return selection.stream().allMatch(BackupRow::hasDurableCopy)
+                ? ActionDisabledReason.NONE
+                : ActionDisabledReason.NO_DURABLE_COPY;
     }
 
-    private static void disableSelectionActions(
-            EnumMap<BackupAction, BackupActionAvailability> result,
-            ActionDisabledReason reason) {
-        result.put(BackupAction.RESTORE, disabled(reason));
-        result.put(BackupAction.DELETE, disabled(reason));
-        result.put(BackupAction.SYNC, disabled(reason));
-        result.put(BackupAction.VERIFY, disabled(reason));
+    private static ActionDisabledReason restoreOrVerify(List<BackupRow> selection) {
+        ActionDisabledReason count = exactlyOne(selection);
+        if (count != ActionDisabledReason.NONE) {
+            return count;
+        }
+        return selection.getFirst().hasDurableCopy()
+                ? ActionDisabledReason.NONE
+                : ActionDisabledReason.NO_DURABLE_COPY;
     }
 
-    private static BackupActionAvailability enabled() {
-        return BackupActionAvailability.available();
+    private static ActionDisabledReason sync(
+            BackupBrowserCapabilities capabilities,
+            List<BackupRow> selection) {
+        ActionDisabledReason count = exactlyOne(selection);
+        if (count != ActionDisabledReason.NONE) {
+            return count;
+        }
+        if (!selection.getFirst().git().durable()) {
+            return ActionDisabledReason.NO_DURABLE_COPY;
+        }
+        return capabilities.gitRemoteConfigured()
+                ? ActionDisabledReason.NONE
+                : ActionDisabledReason.REMOTE_NOT_CONFIGURED;
     }
 
-    private static BackupActionAvailability disabled(ActionDisabledReason reason) {
-        return BackupActionAvailability.disabled(reason);
+    private static ActionDisabledReason exactlyOne(List<BackupRow> selection) {
+        if (selection.isEmpty()) {
+            return ActionDisabledReason.NO_SELECTION;
+        }
+        return selection.size() > 1 ? ActionDisabledReason.MULTIPLE_SELECTED : ActionDisabledReason.NONE;
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupBrowserCapabilities.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupBrowserCapabilities.java
index dfec904..2b0bb64 100644
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupBrowserCapabilities.java
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupBrowserCapabilities.java
@@ -3,30 +3,43 @@
 import java.util.Objects;
 import java.util.Optional;
 
-/** External capabilities that cannot be inferred from catalog rows alone. */
+/**
+ * What the runtime knows about a world that its backup records cannot tell the browser: whether an
+ * operation runs, whether the world folder is there, why a new backup cannot be made, whether the
+ * Git remote and the backup folder are ready, and a warning to show.
+ */
 public record BackupBrowserCapabilities(
         boolean operationInProgress,
         boolean sourceAvailable,
-        boolean createDestinationConfigured,
+        Optional<CreateBlock> createBlock,
         boolean gitRemoteConfigured,
         boolean managedFolderAvailable,
         Optional<String> warning) {
     public BackupBrowserCapabilities {
-        warning = Objects.requireNonNull(warning, "warning");
+        Objects.requireNonNull(createBlock, "createBlock");
+        Objects.requireNonNull(warning, "warning");
     }
 
-    public BackupBrowserCapabilities(
-            boolean operationInProgress,
-            boolean sourceAvailable,
-            boolean createDestinationConfigured,
-            boolean gitRemoteConfigured,
-            boolean managedFolderAvailable) {
-        this(
-                operationInProgress,
+    /** Why the settings let no new backup of the world be made, although its folder is there. */
+    public enum CreateBlock {
+        /** The player turned backups off for this world. */
+        WORLD_OFF,
+        /** No destination takes manual backups. */
+        NO_DESTINATION,
+        /** Only Git takes manual backups, and Git or Git LFS is missing. */
+        GIT_MISSING,
+        /** A backup folder is inside a world, so every backup is paused. */
+        STORAGE_PROBLEM
+    }
+
+    /** A copy that reports an operation in progress, for while the browser itself waits. */
+    public BackupBrowserCapabilities withOperationInProgress() {
+        return new BackupBrowserCapabilities(
+                true,
                 sourceAvailable,
-                createDestinationConfigured,
+                createBlock,
                 gitRemoteConfigured,
                 managedFolderAvailable,
-                Optional.empty());
+                warning);
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupBrowserPage.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupBrowserPage.java
deleted file mode 100644
index 04f33df..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupBrowserPage.java
+++ /dev/null
@@ -1,110 +0,0 @@
-package dev.ishaanko.worldarchive.ui.model;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupRecord;
-import java.util.Comparator;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Locale;
-import java.util.Objects;
-import java.util.Set;
-
-/**
- * Materialized backup-browser page. {@code matchingBackupIds} lists every backup that passes
- * the filter across all pages, so select-all and the selection count cover hidden rows;
- * {@code selectedBackupIds} is the part of the selection that is visible on this page.
- */
-public record BackupBrowserPage(
-        List<BackupRow> rows,
-        long totalRows,
-        int pageIndex,
-        int pageCount,
-        int pageSize,
-        List<BackupId> matchingBackupIds,
-        Set<BackupId> selectedBackupIds) {
-    public BackupBrowserPage {
-        rows = List.copyOf(rows);
-        if (totalRows < 0 || pageIndex < 0 || pageCount < 1 || pageSize < 1) {
-            throw new IllegalArgumentException("Invalid page dimensions");
-        }
-        matchingBackupIds = List.copyOf(matchingBackupIds);
-        selectedBackupIds = Set.copyOf(selectedBackupIds);
-        for (BackupId selected : selectedBackupIds) {
-            if (rows.stream().noneMatch(row -> row.backupId().equals(selected))) {
-                throw new IllegalArgumentException("Selection must refer to visible rows");
-            }
-        }
-    }
-
-    public static BackupBrowserPage create(
-            List<BackupRecord> records,
-            BackupBrowserQuery query,
-            Set<BackupId> requestedSelection) {
-        Objects.requireNonNull(records, "records");
-        Objects.requireNonNull(query, "query");
-        Objects.requireNonNull(requestedSelection, "requestedSelection");
-        List<BackupRow> filtered = records.stream()
-                .map(BackupRow::from)
-                .filter(row -> matches(row, query.filter()))
-                .sorted(comparator(query.sort()))
-                .toList();
-        int pageCount = Math.max(1, (filtered.size() + query.pageSize() - 1) / query.pageSize());
-        int pageIndex = Math.min(query.pageIndex(), pageCount - 1);
-        int first = pageIndex * query.pageSize();
-        int last = Math.min(first + query.pageSize(), filtered.size());
-        List<BackupRow> rows = filtered.subList(first, last);
-        Set<BackupId> visibleSelection = new LinkedHashSet<>();
-        for (BackupRow row : rows) {
-            if (requestedSelection.contains(row.backupId())) {
-                visibleSelection.add(row.backupId());
-            }
-        }
-        return new BackupBrowserPage(
-                rows,
-                filtered.size(),
-                pageIndex,
-                pageCount,
-                query.pageSize(),
-                filtered.stream().map(BackupRow::backupId).toList(),
-                visibleSelection);
-    }
-
-    /** Visible selected rows in page order. */
-    public List<BackupRow> selectedRows() {
-        return rows.stream()
-                .filter(row -> selectedBackupIds.contains(row.backupId()))
-                .toList();
-    }
-
-    private static boolean matches(BackupRow row, String filter) {
-        if (filter.isEmpty()) {
-            return true;
-        }
-        String label = row.label().orElse("").toLowerCase(Locale.ROOT);
-        return row.backupId().toString().startsWith(filter)
-                || row.worldName().toLowerCase(Locale.ROOT).contains(filter)
-                || label.contains(filter)
-                || row.trigger().name().toLowerCase(Locale.ROOT).contains(filter);
-    }
-
-    private static Comparator<BackupRow> comparator(BackupSort sort) {
-        Comparator<BackupRow> tieBreaker = Comparator.comparing(BackupRow::backupId);
-        return switch (sort) {
-            case NEWEST -> Comparator.comparing(BackupRow::createdAt).reversed().thenComparing(tieBreaker);
-            case OLDEST -> Comparator.comparing(BackupRow::createdAt).thenComparing(tieBreaker);
-            case LABEL -> Comparator.comparing(
-                            (BackupRow row) -> row.label().orElse(""),
-                            String.CASE_INSENSITIVE_ORDER)
-                    .thenComparing(BackupRow::createdAt, Comparator.reverseOrder())
-                    .thenComparing(tieBreaker);
-            case SIZE_DESCENDING -> Comparator.comparingLong(BackupRow::logicalSizeBytes)
-                    .reversed()
-                    .thenComparing(BackupRow::createdAt, Comparator.reverseOrder())
-                    .thenComparing(tieBreaker);
-            case CHANGED_FILES_DESCENDING -> Comparator.comparingLong(BackupRow::changedFileCount)
-                    .reversed()
-                    .thenComparing(BackupRow::createdAt, Comparator.reverseOrder())
-                    .thenComparing(tieBreaker);
-        };
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupBrowserQuery.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupBrowserQuery.java
deleted file mode 100644
index 781234e..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupBrowserQuery.java
+++ /dev/null
@@ -1,21 +0,0 @@
-package dev.ishaanko.worldarchive.ui.model;
-
-import java.util.Locale;
-import java.util.Objects;
-
-/** Filter, sort, and zero-based page request for the backup browser. */
-public record BackupBrowserQuery(String filter, BackupSort sort, int pageIndex, int pageSize) {
-    public static final int MAXIMUM_PAGE_SIZE = 100;
-
-    public BackupBrowserQuery {
-        filter = Objects.requireNonNull(filter, "filter").strip().toLowerCase(Locale.ROOT);
-        Objects.requireNonNull(sort, "sort");
-        if (pageIndex < 0) {
-            throw new IllegalArgumentException("pageIndex must not be negative");
-        }
-        if (pageSize < 1 || pageSize > MAXIMUM_PAGE_SIZE) {
-            throw new IllegalArgumentException("pageSize must be between 1 and " + MAXIMUM_PAGE_SIZE);
-        }
-    }
-
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupDestinationView.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupDestinationView.java
deleted file mode 100644
index 17ef22b..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupDestinationView.java
+++ /dev/null
@@ -1,66 +0,0 @@
-package dev.ishaanko.worldarchive.ui.model;
-
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationStatus;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
-import dev.ishaanko.worldarchive.model.SyncStatus;
-import dev.ishaanko.worldarchive.model.VerificationStatus;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Presentation data for one independent destination. */
-public record BackupDestinationView(
-        DestinationType destination,
-        DestinationAvailability availability,
-        SyncStatus syncStatus,
-        VerificationStatus verificationStatus,
-        Optional<String> message) {
-    public BackupDestinationView {
-        Objects.requireNonNull(destination, "destination");
-        Objects.requireNonNull(availability, "availability");
-        Objects.requireNonNull(syncStatus, "syncStatus");
-        Objects.requireNonNull(verificationStatus, "verificationStatus");
-        message = Objects.requireNonNull(message, "message")
-                .map(SensitiveDataRedactor::redact);
-    }
-
-    public static BackupDestinationView from(
-            DestinationType destination,
-            Optional<DestinationResult> result) {
-        Objects.requireNonNull(destination, "destination");
-        Objects.requireNonNull(result, "result");
-        if (result.isEmpty()) {
-            return new BackupDestinationView(
-                    destination,
-                    DestinationAvailability.NOT_CREATED,
-                    SyncStatus.NOT_CONFIGURED,
-                    VerificationStatus.UNAVAILABLE,
-                    Optional.empty());
-        }
-        DestinationResult value = result.orElseThrow();
-        if (value.destination() != destination) {
-            throw new IllegalArgumentException("Destination result does not match requested destination");
-        }
-        return new BackupDestinationView(
-                destination,
-                availability(value.status()),
-                value.syncStatus(),
-                value.verificationStatus(),
-                value.message());
-    }
-
-    public boolean durable() {
-        return availability == DestinationAvailability.AVAILABLE
-                || availability == DestinationAvailability.PENDING_SYNC;
-    }
-
-    private static DestinationAvailability availability(DestinationStatus status) {
-        return switch (status) {
-            case SUCCESS -> DestinationAvailability.AVAILABLE;
-            case PENDING_SYNC -> DestinationAvailability.PENDING_SYNC;
-            case FAILED -> DestinationAvailability.FAILED;
-            case SKIPPED -> DestinationAvailability.SKIPPED;
-        };
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupFilter.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupFilter.java
new file mode 100644
index 0000000..1e57ebf
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupFilter.java
@@ -0,0 +1,45 @@
+package dev.ishaanko.worldarchive.ui.model;
+
+import java.util.Comparator;
+import java.util.List;
+import java.util.Locale;
+
+/** The browser's filter box and sort order: which backups match the typed text, and in what order. */
+public final class BackupFilter {
+    private BackupFilter() {
+    }
+
+    /**
+     * The rows that match {@code filter}, sorted. A row matches when its label contains the text,
+     * its trigger reads like it (for example {@code world exit}), or its backup ID starts with it.
+     * Case and surrounding spaces are ignored, and a blank filter matches every row.
+     */
+    public static List<BackupRow> apply(List<BackupRow> rows, String filter, BackupSort sort) {
+        String text = filter.strip().toLowerCase(Locale.ROOT);
+        return rows.stream()
+                .filter(row -> text.isEmpty() || matches(row, text))
+                .sorted(comparator(sort))
+                .toList();
+    }
+
+    private static boolean matches(BackupRow row, String text) {
+        return row.label().orElse("").toLowerCase(Locale.ROOT).contains(text)
+                || row.trigger().name().replace('_', ' ').toLowerCase(Locale.ROOT).contains(text)
+                || row.backupId().toString().startsWith(text);
+    }
+
+    private static Comparator<BackupRow> comparator(BackupSort sort) {
+        Comparator<BackupRow> newestFirst = Comparator.comparing(BackupRow::createdAt, Comparator.reverseOrder());
+        Comparator<BackupRow> order = switch (sort) {
+            case NEWEST -> newestFirst;
+            case OLDEST -> Comparator.comparing(BackupRow::createdAt);
+            case LABEL -> Comparator.comparing((BackupRow row) -> row.label().orElse(""), String.CASE_INSENSITIVE_ORDER)
+                    .thenComparing(newestFirst);
+            case SIZE_DESCENDING -> Comparator.comparingLong(BackupRow::logicalSizeBytes).reversed()
+                    .thenComparing(newestFirst);
+            case CHANGED_FILES_DESCENDING -> Comparator.comparingLong(BackupRow::changedFileCount).reversed()
+                    .thenComparing(newestFirst);
+        };
+        return order.thenComparing(BackupRow::backupId);
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupOutcomeSummary.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupOutcomeSummary.java
index a2dc294..231b566 100644
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupOutcomeSummary.java
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupOutcomeSummary.java
@@ -1,81 +1,117 @@
 package dev.ishaanko.worldarchive.ui.model;
 
-import dev.ishaanko.worldarchive.core.BackupOperation;
-import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupOperation;
 import dev.ishaanko.worldarchive.model.BackupResult;
 import dev.ishaanko.worldarchive.model.BackupStatus;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationStatus;
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.SafeText;
 import dev.ishaanko.worldarchive.model.SyncStatus;
 import dev.ishaanko.worldarchive.model.VerificationStatus;
 import java.util.List;
 import java.util.Objects;
-
-/** Aggregate presentation summary that preserves partial destination failures. */
+import java.util.function.Function;
+
+/**
+ * What a create, sync or verify of one backup did, for the operation screen: the overall status,
+ * a headline, and one line per copy that the operation touched. Restores and deletes have their
+ * own summaries: the restore screen names the new world, and {@link DeleteBatchSummary} counts
+ * deleted backups.
+ */
 public record BackupOutcomeSummary(
-        BackupOperation operation,
-        BackupId backupId,
         BackupStatus status,
         String headline,
-        List<DestinationOutcomeView> destinations) {
+        List<String> lines) {
+    /** Keeps one long destination message from pushing the other lines off the screen. */
+    private static final int MAXIMUM_DETAIL_LENGTH = 160;
+
     public BackupOutcomeSummary {
-        Objects.requireNonNull(operation, "operation");
-        Objects.requireNonNull(backupId, "backupId");
         Objects.requireNonNull(status, "status");
         Objects.requireNonNull(headline, "headline");
-        destinations = List.copyOf(destinations);
+        lines = List.copyOf(lines);
     }
 
-    public static BackupOutcomeSummary from(BackupResult result) {
-        return from(BackupOperation.CREATE, result);
+    /**
+     * Summarizes the result of a create, sync or verify.
+     *
+     * @throws IllegalArgumentException for a restore or a delete
+     */
+    public static BackupOutcomeSummary from(BackupOperation operation, BackupResult result) {
+        return switch (operation) {
+            case CREATE -> creation(result);
+            case SYNC -> synchronization(result);
+            case VERIFY -> verification(result);
+            case RESTORE, DELETE -> throw new IllegalArgumentException(operation + " has its own summary");
+        };
     }
 
-    public static BackupOutcomeSummary from(
-            BackupOperation operation,
-            BackupResult result) {
-        Objects.requireNonNull(operation, "operation");
-        Objects.requireNonNull(result, "result");
-        List<DestinationResult> applicable = applicableDestinations(
-                operation,
-                result.destinations());
-        List<DestinationOutcomeView> destinations = applicable.stream()
-                .map(BackupOutcomeSummary::destination)
-                .toList();
-        BackupStatus status = operationStatus(operation, result.status(), applicable);
-        return new BackupOutcomeSummary(
-                operation,
-                result.backupId(),
-                status,
-                headline(operation, status),
-                destinations);
+    private static BackupOutcomeSummary creation(BackupResult result) {
+        String headline = switch (result.status()) {
+            case SUCCESS -> "Backup completed";
+            case PARTIAL_SUCCESS -> "Backup completed with destination issues";
+            case FAILED -> "Backup failed";
+            case SKIPPED -> "Backup skipped";
+        };
+        return new BackupOutcomeSummary(result.status(), headline,
+                lines(result.destinations(), destination -> creationPhrase(destination.status())));
     }
 
-    public boolean partialFailure() {
-        return status == BackupStatus.PARTIAL_SUCCESS;
+    private static BackupOutcomeSummary synchronization(BackupResult result) {
+        List<DestinationResult> git = result.destinations().stream()
+                .filter(destination -> destination.destination() == DestinationType.GIT)
+                .filter(DestinationResult::isDurable)
+                .toList();
+        BackupStatus status = synchronizationStatus(git);
+        String headline = switch (status) {
+            case SUCCESS -> "Backup synchronized";
+            case PARTIAL_SUCCESS -> "Backup synchronization pending";
+            case FAILED -> "Backup synchronization failed";
+            case SKIPPED -> "Backup synchronization skipped";
+        };
+        return new BackupOutcomeSummary(status, headline,
+                lines(git, destination -> synchronizationPhrase(destination.syncStatus())));
     }
 
-    /** Returns an operation-aware status phrase for one destination line. */
-    public String destinationStatus(DestinationOutcomeView destination) {
-        Objects.requireNonNull(destination, "destination");
-        return switch (operation) {
-            case DELETE -> deletionStatus(destination.status());
-            case SYNC -> synchronizationStatus(destination.syncStatus());
-            case VERIFY -> verificationStatus(destination.verificationStatus());
-            default -> creationStatus(destination.status());
+    private static BackupOutcomeSummary verification(BackupResult result) {
+        List<DestinationResult> copies = result.destinations().stream()
+                .filter(DestinationResult::isDurable)
+                .toList();
+        BackupStatus status = verificationStatus(copies);
+        String headline = switch (status) {
+            case SUCCESS -> "Backup verified";
+            case PARTIAL_SUCCESS -> "Backup verification incomplete";
+            case FAILED -> "Backup verification failed";
+            case SKIPPED -> "Backup verification skipped";
         };
+        return new BackupOutcomeSummary(status, headline,
+                lines(copies, destination -> verificationPhrase(destination.verificationStatus())));
+    }
+
+    /** One line per destination, such as {@code GIT: sync failed · The remote refused}. */
+    private static List<String> lines(
+            List<DestinationResult> destinations, Function<DestinationResult, String> phrase) {
+        return destinations.stream()
+                .map(destination -> destination.destination() + ": " + phrase.apply(destination) + detail(destination))
+                .toList();
+    }
+
+    private static String detail(DestinationResult destination) {
+        return destination.message()
+                .map(message -> BackupText.SEPARATOR + SafeText.clean(message, MAXIMUM_DETAIL_LENGTH))
+                .orElse("");
     }
 
-    private static String deletionStatus(DestinationStatus status) {
+    private static String creationPhrase(DestinationStatus status) {
         return switch (status) {
-            case SUCCESS -> "deleted";
-            case PENDING_SYNC -> "deletion pending";
-            case FAILED -> "not deleted";
-            case SKIPPED -> "not present";
+            case SUCCESS -> "success";
+            case PENDING_SYNC -> "pending sync";
+            case FAILED -> "failed";
+            case SKIPPED -> "skipped";
         };
     }
 
-    private static String synchronizationStatus(SyncStatus status) {
+    private static String synchronizationPhrase(SyncStatus status) {
         return switch (status) {
             case SYNCED -> "synced";
             case NOT_CONFIGURED -> "not configured";
@@ -85,7 +121,7 @@ private static String synchronizationStatus(SyncStatus status) {
         };
     }
 
-    private static String verificationStatus(VerificationStatus status) {
+    private static String verificationPhrase(VerificationStatus status) {
         return switch (status) {
             case VERIFIED -> "verified";
             case FAILED -> "verification failed";
@@ -94,64 +130,11 @@ private static String verificationStatus(VerificationStatus status) {
         };
     }
 
-    private static String creationStatus(DestinationStatus status) {
-        return switch (status) {
-            case SUCCESS -> "success";
-            case PENDING_SYNC -> "pending sync";
-            case FAILED -> "failed";
-            case SKIPPED -> "skipped";
-        };
-    }
-
-    private static DestinationOutcomeView destination(DestinationResult result) {
-        return new DestinationOutcomeView(
-                result.destination(),
-                result.status(),
-                result.verificationStatus(),
-                result.syncStatus(),
-                result.message());
-    }
-
-    private static List<DestinationResult> applicableDestinations(
-            BackupOperation operation,
-            List<DestinationResult> destinations) {
-        if (operation == BackupOperation.SYNC) {
-            return destinations.stream()
-                    .filter(destination -> destination.destination() == DestinationType.GIT)
-                    .filter(BackupOutcomeSummary::durable)
-                    .toList();
-        }
-        if (operation == BackupOperation.VERIFY) {
-            return destinations.stream()
-                    .filter(BackupOutcomeSummary::durable)
-                    .toList();
-        }
-        return List.copyOf(destinations);
-    }
-
-    private static boolean durable(DestinationResult destination) {
-        return destination.artifactId().isPresent()
-                && (destination.status() == DestinationStatus.SUCCESS
-                        || destination.status() == DestinationStatus.PENDING_SYNC);
-    }
-
-    private static BackupStatus operationStatus(
-            BackupOperation operation,
-            BackupStatus backupStatus,
-            List<DestinationResult> destinations) {
-        return switch (operation) {
-            case SYNC -> synchronizationStatus(destinations);
-            case VERIFY -> verificationStatus(destinations);
-            default -> backupStatus;
-        };
-    }
-
-    private static BackupStatus synchronizationStatus(List<DestinationResult> destinations) {
-        if (destinations.isEmpty()) {
+    private static BackupStatus synchronizationStatus(List<DestinationResult> git) {
+        if (git.isEmpty()) {
             return BackupStatus.SKIPPED;
         }
-        SyncStatus sync = destinations.getFirst().syncStatus();
-        return switch (sync) {
+        return switch (git.getFirst().syncStatus()) {
             case SYNCED -> BackupStatus.SUCCESS;
             case NOT_SYNCED, PENDING -> BackupStatus.PARTIAL_SUCCESS;
             case FAILED -> BackupStatus.FAILED;
@@ -159,65 +142,15 @@ private static BackupStatus synchronizationStatus(List<DestinationResult> destin
         };
     }
 
-    private static BackupStatus verificationStatus(List<DestinationResult> destinations) {
-        if (destinations.isEmpty()) {
+    private static BackupStatus verificationStatus(List<DestinationResult> copies) {
+        if (copies.isEmpty()) {
             return BackupStatus.SKIPPED;
         }
-        if (destinations.stream()
-                .anyMatch(destination ->
-                        destination.verificationStatus() == VerificationStatus.FAILED)) {
+        if (copies.stream().anyMatch(copy -> copy.verificationStatus() == VerificationStatus.FAILED)) {
             return BackupStatus.FAILED;
         }
-        if (destinations.stream()
-                .allMatch(destination ->
-                        destination.verificationStatus() == VerificationStatus.VERIFIED)) {
-            return BackupStatus.SUCCESS;
-        }
-        return BackupStatus.PARTIAL_SUCCESS;
-    }
-
-    private static String headline(BackupOperation operation, BackupStatus status) {
-        return switch (operation) {
-            case DELETE -> deletionHeadline(status);
-            case SYNC -> synchronizationHeadline(status);
-            case VERIFY -> verificationHeadline(status);
-            default -> creationHeadline(status);
-        };
-    }
-
-    private static String deletionHeadline(BackupStatus status) {
-        return switch (status) {
-            case SUCCESS -> "Backup deleted";
-            case PARTIAL_SUCCESS -> "Backup deleted from some destinations";
-            case FAILED -> "Backup could not be deleted";
-            case SKIPPED -> "Backup removed";
-        };
-    }
-
-    private static String synchronizationHeadline(BackupStatus status) {
-        return switch (status) {
-            case SUCCESS -> "Backup synchronized";
-            case PARTIAL_SUCCESS -> "Backup synchronization pending";
-            case FAILED -> "Backup synchronization failed";
-            case SKIPPED -> "Backup synchronization skipped";
-        };
-    }
-
-    private static String verificationHeadline(BackupStatus status) {
-        return switch (status) {
-            case SUCCESS -> "Backup verified";
-            case PARTIAL_SUCCESS -> "Backup verification incomplete";
-            case FAILED -> "Backup verification failed";
-            case SKIPPED -> "Backup verification skipped";
-        };
-    }
-
-    private static String creationHeadline(BackupStatus status) {
-        return switch (status) {
-            case SUCCESS -> "Backup completed";
-            case PARTIAL_SUCCESS -> "Backup completed with destination issues";
-            case FAILED -> "Backup failed";
-            case SKIPPED -> "Backup skipped";
-        };
+        return copies.stream().allMatch(copy -> copy.verificationStatus() == VerificationStatus.VERIFIED)
+                ? BackupStatus.SUCCESS
+                : BackupStatus.PARTIAL_SUCCESS;
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupRow.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupRow.java
index 3a6b469..e8b76f3 100644
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupRow.java
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupRow.java
@@ -1,129 +1,96 @@
 package dev.ishaanko.worldarchive.ui.model;
 
 import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupManifest;
 import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.BackupStatus;
 import dev.ishaanko.worldarchive.model.BackupTrigger;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
 import dev.ishaanko.worldarchive.model.GameVersionStamp;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
 import dev.ishaanko.worldarchive.model.SyncStatus;
-import dev.ishaanko.worldarchive.model.VerificationStatus;
-import dev.ishaanko.worldarchive.model.WorldId;
 import java.time.Instant;
 import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
+import java.util.stream.Stream;
 
-/** Deterministic row data for the backup browser. */
+/**
+ * One backup as the browser shows it. The browser builds its rows once per catalog load, off the
+ * render thread, and every browser rule reads rows instead of catalog records.
+ */
 public record BackupRow(
         BackupId backupId,
-        WorldId worldId,
-        String worldName,
         Instant createdAt,
         Optional<String> label,
         BackupTrigger trigger,
-        BackupStatus status,
-        BackupDestinationView git,
-        BackupDestinationView zip,
+        Copy git,
+        Copy zip,
         long logicalSizeBytes,
         long changedFileCount,
         Optional<GameVersionStamp> gameVersion) {
     public BackupRow {
         Objects.requireNonNull(backupId, "backupId");
-        Objects.requireNonNull(worldId, "worldId");
-        worldName = SensitiveDataRedactor.redact(Objects.requireNonNull(worldName, "worldName"));
         Objects.requireNonNull(createdAt, "createdAt");
-        label = Objects.requireNonNull(label, "label").map(SensitiveDataRedactor::redact);
+        label = Objects.requireNonNull(label, "label");
         Objects.requireNonNull(trigger, "trigger");
-        Objects.requireNonNull(status, "status");
         Objects.requireNonNull(git, "git");
         Objects.requireNonNull(zip, "zip");
-        if (git.destination() != DestinationType.GIT || zip.destination() != DestinationType.ZIP) {
-            throw new IllegalArgumentException("Destination views must use their matching destination types");
-        }
         if (logicalSizeBytes < 0 || changedFileCount < 0) {
             throw new IllegalArgumentException("Backup counts must not be negative");
         }
-        Objects.requireNonNull(gameVersion, "gameVersion");
-    }
-
-    public BackupRow(
-            BackupId backupId,
-            WorldId worldId,
-            String worldName,
-            Instant createdAt,
-            Optional<String> label,
-            BackupTrigger trigger,
-            BackupStatus status,
-            BackupDestinationView git,
-            BackupDestinationView zip,
-            long logicalSizeBytes,
-            long changedFileCount) {
-        this(
-                backupId,
-                worldId,
-                worldName,
-                createdAt,
-                label,
-                trigger,
-                status,
-                git,
-                zip,
-                logicalSizeBytes,
-                changedFileCount,
-                Optional.empty());
+        gameVersion = Objects.requireNonNull(gameVersion, "gameVersion");
     }
 
     public static BackupRow from(BackupRecord record) {
-        Objects.requireNonNull(record, "record");
+        BackupManifest manifest = record.manifest();
         List<DestinationResult> destinations = record.result().destinations();
         return new BackupRow(
-                record.manifest().backupId(),
-                record.manifest().worldId(),
-                record.manifest().worldName(),
-                record.manifest().createdAt(),
-                record.manifest().label(),
-                record.manifest().trigger(),
-                record.result().status(),
-                destination(destinations, DestinationType.GIT),
-                destination(destinations, DestinationType.ZIP),
-                record.manifest().sourceByteCount(),
-                record.manifest().changedFileCount(),
-                record.manifest().gameVersion());
+                manifest.backupId(),
+                manifest.createdAt(),
+                manifest.label(),
+                manifest.trigger(),
+                Copy.of(destinations, DestinationType.GIT),
+                Copy.of(destinations, DestinationType.ZIP),
+                manifest.sourceByteCount(),
+                manifest.changedFileCount(),
+                manifest.gameVersion());
     }
 
+    /** True when Git or ZIP holds a copy that can be restored. */
     public boolean hasDurableCopy() {
         return git.durable() || zip.durable();
     }
 
-    public SyncStatus remoteSyncStatus() {
-        return git.syncStatus();
+    /** True when the Git copy is also on the world's remote, so a delete removes it there too. */
+    public boolean onRemote() {
+        return git.durable() && git.syncStatus() == SyncStatus.SYNCED;
+    }
+
+    /** The copies the browser shows for this backup; a delete request names them, so it deletes only these. */
+    public List<DestinationResult> copies() {
+        return Stream.of(git, zip).flatMap(copy -> copy.result().stream()).toList();
     }
 
-    public VerificationStatus verificationStatus() {
-        List<BackupDestinationView> durable = List.of(git, zip).stream()
-                .filter(BackupDestinationView::durable)
-                .toList();
-        if (durable.isEmpty()) {
-            return VerificationStatus.UNAVAILABLE;
+    /** One destination's copy as the catalog records it; empty when that destination wrote none. */
+    public record Copy(Optional<DestinationResult> result) {
+        public Copy {
+            Objects.requireNonNull(result, "result");
         }
-        if (durable.stream().anyMatch(view -> view.verificationStatus() == VerificationStatus.FAILED)) {
-            return VerificationStatus.FAILED;
+
+        private static Copy of(List<DestinationResult> destinations, DestinationType type) {
+            return new Copy(destinations.stream()
+                    .filter(destination -> destination.destination() == type)
+                    .findFirst());
         }
-        if (durable.stream().allMatch(view -> view.verificationStatus() == VerificationStatus.VERIFIED)) {
-            return VerificationStatus.VERIFIED;
+
+        /** True when this destination holds the backup. */
+        public boolean durable() {
+            return result.filter(DestinationResult::isDurable).isPresent();
         }
-        return VerificationStatus.NOT_VERIFIED;
-    }
 
-    private static BackupDestinationView destination(
-            List<DestinationResult> destinations,
-            DestinationType type) {
-        Optional<DestinationResult> result = destinations.stream()
-                .filter(candidate -> candidate.destination() == type)
-                .findFirst();
-        return BackupDestinationView.from(type, result);
+        /** The state of the remote copy; NOT_CONFIGURED when this destination wrote nothing. */
+        public SyncStatus syncStatus() {
+            return result.map(DestinationResult::syncStatus).orElse(SyncStatus.NOT_CONFIGURED);
+        }
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupSelection.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupSelection.java
new file mode 100644
index 0000000..bc5e056
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupSelection.java
@@ -0,0 +1,96 @@
+package dev.ishaanko.worldarchive.ui.model;
+
+import dev.ishaanko.worldarchive.model.BackupId;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Objects;
+import java.util.Set;
+
+/**
+ * The backups selected in the browser. A plain click selects one backup, a toggle click adds or
+ * removes one, and an extend click adds every backup from the last clicked one to the clicked
+ * one on the same page. The selection survives paging and filtering. Select all replaces it with
+ * every backup that matches the filter, and Clear empties it. The browser uses one instance on the
+ * render thread.
+ */
+public final class BackupSelection {
+    private final Set<BackupId> selected = new LinkedHashSet<>();
+
+    /** The last backup clicked without extending; an extend click starts from here. */
+    private BackupId anchor;
+
+    /** How a click on a row changes the selection. */
+    public enum Click {
+        /** A plain click: select only the clicked backup. */
+        SELECT,
+        /** Ctrl or Cmd click: add or remove the clicked backup. */
+        TOGGLE,
+        /** Shift click: add the range from the last clicked backup. */
+        EXTEND
+    }
+
+    /**
+     * Applies a click on {@code clicked}. {@code page} is the order of the rows on the current
+     * page; an extend click whose start is not on that page adds only the clicked backup.
+     */
+    public void click(BackupId clicked, Click click, List<BackupId> page) {
+        Objects.requireNonNull(clicked, "clicked");
+        if (click == Click.EXTEND && anchor != null) {
+            selected.addAll(range(page, anchor, clicked));
+            return;
+        }
+        if (click == Click.TOGGLE) {
+            if (!selected.remove(clicked)) {
+                selected.add(clicked);
+            }
+        } else {
+            selected.clear();
+            selected.add(clicked);
+        }
+        anchor = clicked;
+    }
+
+    /** True when {@code matching} is not empty and every backup in it is selected. */
+    public boolean coversAll(List<BackupId> matching) {
+        return !matching.isEmpty() && selected.containsAll(matching);
+    }
+
+    /** Clear when every matching backup is selected; otherwise select exactly the matching backups. */
+    public void selectAllOrClear(List<BackupId> matching) {
+        boolean clear = coversAll(matching);
+        selected.clear();
+        if (!clear) {
+            selected.addAll(matching);
+        }
+    }
+
+    /** Drops every selected backup that a reload no longer lists. */
+    public void retain(Set<BackupId> listed) {
+        selected.retainAll(listed);
+        if (anchor != null && !listed.contains(anchor)) {
+            anchor = null;
+        }
+    }
+
+    public boolean contains(BackupId backupId) {
+        return selected.contains(backupId);
+    }
+
+    public int size() {
+        return selected.size();
+    }
+
+    /** The selected rows among {@code rows}, in the order of {@code rows}. */
+    public List<BackupRow> rows(List<BackupRow> rows) {
+        return rows.stream().filter(row -> selected.contains(row.backupId())).toList();
+    }
+
+    private static List<BackupId> range(List<BackupId> page, BackupId from, BackupId to) {
+        int start = page.indexOf(from);
+        int end = page.indexOf(to);
+        if (start < 0 || end < 0) {
+            return List.of(to);
+        }
+        return page.subList(Math.min(start, end), Math.max(start, end) + 1);
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupText.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupText.java
new file mode 100644
index 0000000..54cfbde
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupText.java
@@ -0,0 +1,55 @@
+package dev.ishaanko.worldarchive.ui.model;
+
+import java.time.Instant;
+import java.time.ZoneId;
+import java.time.format.DateTimeFormatter;
+import java.time.format.FormatStyle;
+import java.util.Locale;
+import java.util.Optional;
+
+/**
+ * Names a backup and formats sizes the same way on every screen, so the player can match a row
+ * in a prompt or a result to the row in the browser.
+ */
+public final class BackupText {
+    /** Joins the parts of one line of backup text. */
+    public static final String SEPARATOR = " · ";
+
+    private static final DateTimeFormatter DATE_TIME = DateTimeFormatter
+            .ofLocalizedDateTime(FormatStyle.SHORT)
+            .withLocale(Locale.getDefault())
+            .withZone(ZoneId.systemDefault());
+
+    private static final String[] UNITS = {"KiB", "MiB", "GiB", "TiB"};
+
+    private BackupText() {
+    }
+
+    /** The short local date and time of an instant. */
+    public static String dateTime(Instant instant) {
+        return DATE_TIME.format(instant);
+    }
+
+    /** The date and time a backup was made, followed by its label when it has one. */
+    public static String name(Instant createdAt, Optional<String> label) {
+        return dateTime(createdAt) + label.map(value -> SEPARATOR + value).orElse("");
+    }
+
+    public static String name(BackupRow row) {
+        return name(row.createdAt(), row.label());
+    }
+
+    /** A byte count in binary units with one decimal, such as {@code 1.5 GiB}. */
+    public static String bytes(long bytes) {
+        if (bytes < 1_024) {
+            return bytes + " B";
+        }
+        double value = bytes / 1_024.0;
+        int unit = 0;
+        while (value >= 1_024 && unit < UNITS.length - 1) {
+            value /= 1_024;
+            unit++;
+        }
+        return String.format(Locale.ROOT, "%.1f %s", value, UNITS[unit]);
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupWorldContext.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupWorldContext.java
new file mode 100644
index 0000000..a7e1892
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupWorldContext.java
@@ -0,0 +1,34 @@
+package dev.ishaanko.worldarchive.ui.model;
+
+import dev.ishaanko.worldarchive.model.SafeText;
+import dev.ishaanko.worldarchive.model.WorldId;
+import java.nio.file.Path;
+import java.util.Objects;
+
+/**
+ * A world whose backups the screens show. {@code worldDirectory} is the world's real folder, with
+ * any link above or at it resolved: the settings and the capture key the world by it.
+ * {@code worldsDirectory} is the saves folder a restore creates the new world in, and
+ * {@code storageName} the world's folder name as the game lists it; a world reached through a
+ * link keeps the name of the link.
+ */
+public record BackupWorldContext(
+        WorldId worldId,
+        Path worldDirectory,
+        Path worldsDirectory,
+        String storageName,
+        String displayName) {
+    public BackupWorldContext {
+        Objects.requireNonNull(worldId, "worldId");
+        worldDirectory = Objects.requireNonNull(worldDirectory, "worldDirectory").toAbsolutePath().normalize();
+        worldsDirectory = Objects.requireNonNull(worldsDirectory, "worldsDirectory").toAbsolutePath().normalize();
+        SafeText.require(storageName, "storageName", BackupWorldSelection.MAXIMUM_NAME_LENGTH);
+        SafeText.require(displayName, "displayName", BackupWorldSelection.MAXIMUM_NAME_LENGTH);
+    }
+
+    /** True when {@code selection} names this world the way the game lists it. */
+    public boolean matches(BackupWorldSelection selection) {
+        Objects.requireNonNull(selection, "selection");
+        return worldsDirectory.equals(selection.worldsDirectory()) && storageName.equals(selection.storageName());
+    }
+}
diff --git a/src/client/java/dev/ishaanko/worldarchive/ui/BackupWorldEntry.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupWorldEntry.java
similarity index 71%
rename from src/client/java/dev/ishaanko/worldarchive/ui/BackupWorldEntry.java
rename to src/main/java/dev/ishaanko/worldarchive/ui/model/BackupWorldEntry.java
index 423430c..6d4988a 100644
--- a/src/client/java/dev/ishaanko/worldarchive/ui/BackupWorldEntry.java
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupWorldEntry.java
@@ -1,8 +1,8 @@
-package dev.ishaanko.worldarchive.ui;
+package dev.ishaanko.worldarchive.ui.model;
 
 import java.util.Objects;
 
-/** One live or catalog-only world shown by the recovery-aware world chooser. */
+/** One world in the World Backups list: a world in the saves folder, or one whose folder is gone. */
 public record BackupWorldEntry(
         BackupWorldContext context,
         boolean recoveryOnly,
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupWorldSelection.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupWorldSelection.java
new file mode 100644
index 0000000..862c843
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/BackupWorldSelection.java
@@ -0,0 +1,33 @@
+package dev.ishaanko.worldarchive.ui.model;
+
+import dev.ishaanko.worldarchive.model.SafeText;
+import java.nio.file.Path;
+import java.util.Objects;
+
+/**
+ * A world as the game lists it, before WorldArchive knows its identity: its folder in the saves
+ * folder, the saves folder, the folder name, and the name the player gave the world. The paths are
+ * the ones the game uses; links in them are not resolved.
+ */
+public record BackupWorldSelection(
+        Path worldDirectory,
+        Path worldsDirectory,
+        String storageName,
+        String displayName) {
+    /** The longest folder or world name, in UTF-16 units. */
+    public static final int MAXIMUM_NAME_LENGTH = 255;
+
+    public BackupWorldSelection {
+        worldDirectory = Objects.requireNonNull(worldDirectory, "worldDirectory").toAbsolutePath().normalize();
+        worldsDirectory = Objects.requireNonNull(worldsDirectory, "worldsDirectory").toAbsolutePath().normalize();
+        SafeText.require(storageName, "storageName", MAXIMUM_NAME_LENGTH);
+        SafeText.require(displayName, "displayName", MAXIMUM_NAME_LENGTH);
+        if (!worldsDirectory.equals(worldDirectory.getParent())) {
+            throw new IllegalArgumentException("The selected world must be a direct child of the worlds directory");
+        }
+        Path fileName = worldDirectory.getFileName();
+        if (fileName == null || !storageName.equals(fileName.toString())) {
+            throw new IllegalArgumentException("The storage name does not match the selected world directory");
+        }
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/CleanupSelection.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/CleanupSelection.java
new file mode 100644
index 0000000..f51f90e
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/CleanupSelection.java
@@ -0,0 +1,75 @@
+package dev.ishaanko.worldarchive.ui.model;
+
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.storage.management.CleanupItem;
+import dev.ishaanko.worldarchive.storage.management.CleanupPlan;
+import java.util.HashSet;
+import java.util.Objects;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+/**
+ * The backups a player keeps selected on the cleanup preview; every item starts selected.
+ * Protected backups give up their local Git copies as one group, because the space only comes back
+ * once none of them keeps the shared history, so toggling one of them toggles the group. Cleanup
+ * refuses a selection that splits the group.
+ */
+public final class CleanupSelection {
+    private final CleanupPlan plan;
+
+    private final Set<BackupId> protectedGitGroup;
+
+    private final Set<BackupId> selected = new HashSet<>();
+
+    /** Whether the selection brings storage under the limit. */
+    public enum Coverage {
+        REACHES_TARGET,
+        /** Selecting more backups would reach the limit. */
+        SELECT_MORE,
+        /** Even every item would not reach the limit; the rest is protected. */
+        REST_PROTECTED
+    }
+
+    public CleanupSelection(CleanupPlan plan) {
+        this.plan = Objects.requireNonNull(plan, "plan");
+        protectedGitGroup = plan.items().stream()
+                .filter(CleanupItem::removeGit)
+                .map(CleanupItem::backupId)
+                .filter(plan.protectedBackups()::contains)
+                .collect(Collectors.toUnmodifiableSet());
+        plan.items().forEach(item -> selected.add(item.backupId()));
+    }
+
+    /** Selects or clears one item, or the whole protected Git group when the item is in it. */
+    public void toggle(BackupId backupId) {
+        Set<BackupId> affected = protectedGitGroup.contains(backupId) ? protectedGitGroup : Set.of(backupId);
+        if (selected.contains(backupId)) {
+            selected.removeAll(affected);
+        } else {
+            selected.addAll(affected);
+        }
+    }
+
+    public boolean contains(BackupId backupId) {
+        return selected.contains(backupId);
+    }
+
+    public Set<BackupId> selected() {
+        return Set.copyOf(selected);
+    }
+
+    /** The space the selected items free, as the preview estimated it. */
+    public long freedBytes() {
+        return plan.items().stream()
+                .filter(item -> selected.contains(item.backupId()))
+                .mapToLong(CleanupItem::estimatedReclaimableBytes)
+                .sum();
+    }
+
+    public Coverage coverage() {
+        if (Math.max(0, plan.currentBytes() - freedBytes()) <= plan.targetBytes()) {
+            return Coverage.REACHES_TARGET;
+        }
+        return plan.targetReachable() ? Coverage.SELECT_MORE : Coverage.REST_PROTECTED;
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/ConfirmationKind.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/ConfirmationKind.java
deleted file mode 100644
index d846e3a..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/ConfirmationKind.java
+++ /dev/null
@@ -1,7 +0,0 @@
-package dev.ishaanko.worldarchive.ui.model;
-
-/** Supported confirmation prompts. */
-public enum ConfirmationKind {
-    DELETE,
-    RESTORE
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/ConfirmationState.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/ConfirmationState.java
deleted file mode 100644
index 2370619..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/ConfirmationState.java
+++ /dev/null
@@ -1,48 +0,0 @@
-package dev.ishaanko.worldarchive.ui.model;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Immutable pending confirmation state. */
-public record ConfirmationState(
-        ConfirmationKind kind,
-        BackupId backupId,
-        String title,
-        String prompt,
-        Optional<RestoreChoice> restoreChoice,
-        boolean destructive) {
-    public ConfirmationState {
-        Objects.requireNonNull(kind, "kind");
-        Objects.requireNonNull(backupId, "backupId");
-        Objects.requireNonNull(title, "title");
-        Objects.requireNonNull(prompt, "prompt");
-        restoreChoice = Objects.requireNonNull(restoreChoice, "restoreChoice");
-        if ((kind == ConfirmationKind.RESTORE) != restoreChoice.isPresent()) {
-            throw new IllegalArgumentException("Only restore confirmations carry a restore choice");
-        }
-    }
-
-    public static ConfirmationState delete(BackupRow row) {
-        Objects.requireNonNull(row, "row");
-        return new ConfirmationState(
-                ConfirmationKind.DELETE,
-                row.backupId(),
-                "Delete backup?",
-                "Delete backup " + row.backupId() + " from every available destination?",
-                Optional.empty(),
-                true);
-    }
-
-    public static ConfirmationState restore(BackupRow row, RestoreChoice choice) {
-        Objects.requireNonNull(row, "row");
-        Objects.requireNonNull(choice, "choice");
-        return new ConfirmationState(
-                ConfirmationKind.RESTORE,
-                row.backupId(),
-                "Restore backup?",
-                "Restore backup " + row.backupId() + " as a new world copy?",
-                Optional.of(choice),
-                false);
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/DeleteBatchSummary.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/DeleteBatchSummary.java
index e920180..936b635 100644
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/DeleteBatchSummary.java
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/DeleteBatchSummary.java
@@ -1,71 +1,90 @@
 package dev.ishaanko.worldarchive.ui.model;
 
-import dev.ishaanko.worldarchive.core.BackupOperation;
+import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupResult;
 import dev.ishaanko.worldarchive.model.BackupStatus;
+import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationStatus;
+import dev.ishaanko.worldarchive.model.SafeText;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Map;
 import java.util.Objects;
+import java.util.function.Function;
+import java.util.stream.Collectors;
 
-/** Presentation summary for a multi-backup delete: counts plus one line per problem. */
+/**
+ * What a delete of one or more backups did: how many are gone, one line for each copy that is
+ * still there, and one for each note of a deleted copy, such as a copy on a remote that is no
+ * longer in the settings. Lines name the backup the way the browser does. A backup counts as
+ * deleted only when no copy of it is left, because until then it stays listed.
+ */
 public record DeleteBatchSummary(
         BackupStatus status,
         String headline,
         List<String> details) {
     private static final int MAXIMUM_DETAIL_LINES = 6;
 
+    private static final int MAXIMUM_REASON_LENGTH = 160;
+
     public DeleteBatchSummary {
         Objects.requireNonNull(status, "status");
         Objects.requireNonNull(headline, "headline");
         details = List.copyOf(details);
     }
 
-    public static DeleteBatchSummary from(List<BackupResult> results) {
-        Objects.requireNonNull(results, "results");
-        int removed = 0;
-        List<String> problems = new ArrayList<>();
+    /** Summarizes {@code results}; {@code rows} are the browser rows that were confirmed. */
+    public static DeleteBatchSummary from(List<BackupResult> results, List<BackupRow> rows) {
+        Map<BackupId, BackupRow> confirmed = rows.stream()
+                .collect(Collectors.toMap(BackupRow::backupId, Function.identity(), (first, second) -> first));
+        int deleted = 0;
+        List<String> lines = new ArrayList<>();
         for (BackupResult result : results) {
-            BackupOutcomeSummary summary = BackupOutcomeSummary.from(BackupOperation.DELETE, result);
-            if (summary.status() == BackupStatus.SUCCESS || summary.status() == BackupStatus.SKIPPED) {
-                removed++;
-                continue;
-            }
-            if (summary.status() == BackupStatus.PARTIAL_SUCCESS) {
-                removed++;
-            }
-            for (DestinationOutcomeView destination : summary.destinations()) {
-                if (destination.status() == DestinationStatus.FAILED) {
-                    problems.add(shortId(result) + " · " + destination.destination() + ": "
-                            + destination.detail().orElse("not deleted"));
-                } else if (destination.status() == DestinationStatus.PENDING_SYNC) {
-                    problems.add(shortId(result) + " · " + destination.destination() + ": "
-                            + destination.detail().orElse("deletion pending"));
+            String name = confirmed.containsKey(result.backupId())
+                    ? BackupText.name(confirmed.get(result.backupId()))
+                    : result.backupId().toString();
+            boolean gone = true;
+            for (DestinationResult destination : result.destinations()) {
+                boolean kept = leftBehind(destination);
+                gone &= !kept;
+                if (kept || destination.message().isPresent()) {
+                    lines.add(name + BackupText.SEPARATOR + line(destination));
                 }
             }
+            if (gone) {
+                deleted++;
+            }
+        }
+        List<String> details = new ArrayList<>(lines.subList(0, Math.min(lines.size(), MAXIMUM_DETAIL_LINES)));
+        if (lines.size() > MAXIMUM_DETAIL_LINES) {
+            details.add("…and " + (lines.size() - MAXIMUM_DETAIL_LINES) + " more");
         }
         int total = results.size();
-        BackupStatus status;
-        String headline;
-        if (problems.isEmpty()) {
-            status = BackupStatus.SUCCESS;
-            headline = "Deleted " + total + " backups";
-        } else if (removed == 0) {
-            status = BackupStatus.FAILED;
-            headline = "No backups were deleted";
-        } else {
-            status = BackupStatus.PARTIAL_SUCCESS;
-            headline = "Deleted " + removed + " of " + total + " backups";
+        if (deleted == total) {
+            return new DeleteBatchSummary(
+                    BackupStatus.SUCCESS,
+                    total == 1 ? "Deleted 1 backup" : "Deleted " + total + " backups",
+                    details);
         }
-        List<String> details = new ArrayList<>(problems.subList(
-                0, Math.min(problems.size(), MAXIMUM_DETAIL_LINES)));
-        if (problems.size() > MAXIMUM_DETAIL_LINES) {
-            details.add("…and " + (problems.size() - MAXIMUM_DETAIL_LINES) + " more problems");
+        if (deleted == 0) {
+            return new DeleteBatchSummary(BackupStatus.FAILED, "No backups were deleted", details);
         }
-        return new DeleteBatchSummary(status, headline, details);
+        return new DeleteBatchSummary(
+                BackupStatus.PARTIAL_SUCCESS,
+                "Deleted " + deleted + " of " + total + " backups",
+                details);
+    }
+
+    /** True when the delete kept this copy: it failed, or its remote deletion still waits. */
+    private static boolean leftBehind(DestinationResult destination) {
+        return destination.status() == DestinationStatus.FAILED
+                || destination.status() == DestinationStatus.PENDING_SYNC;
     }
 
-    private static String shortId(BackupResult result) {
-        return result.backupId().toString().substring(0, 8);
+    private static String line(DestinationResult destination) {
+        String reason = destination.message()
+                .map(message -> SafeText.clean(message, MAXIMUM_REASON_LENGTH))
+                .orElse(destination.status() == DestinationStatus.PENDING_SYNC ? "deletion pending" : "not deleted");
+        return destination.destination() + ": " + reason;
     }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/DeletePrompt.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/DeletePrompt.java
new file mode 100644
index 0000000..b15b7ff
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/DeletePrompt.java
@@ -0,0 +1,37 @@
+package dev.ishaanko.worldarchive.ui.model;
+
+import java.util.List;
+
+/**
+ * What a delete confirmation tells the player before anything is deleted: the first backups by
+ * name, how many more there are, how many also have a copy on the Git remote (Delete removes that
+ * copy too), and how many have a label (a label protects a backup from cleanup, not from Delete).
+ */
+public record DeletePrompt(List<BackupRow> shown, int more, int onRemote, int labeled) {
+    /** The rows a prompt lists by name; the rest are counted. */
+    public static final int MAXIMUM_SHOWN = 5;
+
+    public DeletePrompt {
+        shown = List.copyOf(shown);
+        if (more < 0 || onRemote < 0 || labeled < 0) {
+            throw new IllegalArgumentException("Prompt counts must not be negative");
+        }
+    }
+
+    public static DeletePrompt of(List<BackupRow> rows) {
+        if (rows.isEmpty()) {
+            throw new IllegalArgumentException("A delete prompt needs at least one backup");
+        }
+        int shown = Math.min(rows.size(), MAXIMUM_SHOWN);
+        return new DeletePrompt(
+                rows.subList(0, shown),
+                rows.size() - shown,
+                (int) rows.stream().filter(BackupRow::onRemote).count(),
+                (int) rows.stream().filter(row -> row.label().isPresent()).count());
+    }
+
+    /** How many backups the prompt deletes. */
+    public int count() {
+        return shown.size() + more;
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/DestinationAvailability.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/DestinationAvailability.java
deleted file mode 100644
index ad65b3f..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/DestinationAvailability.java
+++ /dev/null
@@ -1,10 +0,0 @@
-package dev.ishaanko.worldarchive.ui.model;
-
-/** User-visible availability of one destination copy. */
-public enum DestinationAvailability {
-    NOT_CREATED,
-    AVAILABLE,
-    PENDING_SYNC,
-    FAILED,
-    SKIPPED
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/DestinationOutcomeView.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/DestinationOutcomeView.java
deleted file mode 100644
index 0305b23..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/DestinationOutcomeView.java
+++ /dev/null
@@ -1,36 +0,0 @@
-package dev.ishaanko.worldarchive.ui.model;
-
-import dev.ishaanko.worldarchive.model.DestinationStatus;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
-import dev.ishaanko.worldarchive.model.SyncStatus;
-import dev.ishaanko.worldarchive.model.VerificationStatus;
-import java.util.Objects;
-import java.util.Optional;
-
-/** Safe concise outcome line for one destination. */
-public record DestinationOutcomeView(
-        DestinationType destination,
-        DestinationStatus status,
-        VerificationStatus verificationStatus,
-        SyncStatus syncStatus,
-        Optional<String> detail) {
-    private static final int MAXIMUM_DETAIL_LENGTH = 160;
-
-    public DestinationOutcomeView {
-        Objects.requireNonNull(destination, "destination");
-        Objects.requireNonNull(status, "status");
-        Objects.requireNonNull(verificationStatus, "verificationStatus");
-        Objects.requireNonNull(syncStatus, "syncStatus");
-        detail = Objects.requireNonNull(detail, "detail")
-                .map(DestinationOutcomeView::concise);
-    }
-
-    private static String concise(String value) {
-        String safe = SensitiveDataRedactor.redact(value).strip();
-        if (safe.length() <= MAXIMUM_DETAIL_LENGTH) {
-            return safe;
-        }
-        return safe.substring(0, MAXIMUM_DETAIL_LENGTH - 1) + "…";
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/FolderSelectionResult.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/FolderSelectionResult.java
new file mode 100644
index 0000000..48c5d64
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/FolderSelectionResult.java
@@ -0,0 +1,25 @@
+package dev.ishaanko.worldarchive.ui.model;
+
+import java.nio.file.Path;
+import java.util.Objects;
+
+/** The outcome of a platform folder picker. */
+public sealed interface FolderSelectionResult {
+    /** The user selected a directory. */
+    record Selected(Path path) implements FolderSelectionResult {
+        public Selected {
+            path = Objects.requireNonNull(path, "path").toAbsolutePath().normalize();
+        }
+    }
+
+    /** The user intentionally dismissed the picker. */
+    record Cancelled() implements FolderSelectionResult {
+    }
+
+    /** The picker failed or is not available, and the current setting is unchanged. */
+    record Failed(String message) implements FolderSelectionResult {
+        public Failed {
+            Objects.requireNonNull(message, "message");
+        }
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/GameVersionNotice.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/GameVersionNotice.java
index dc2e980..03591d3 100644
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/GameVersionNotice.java
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/GameVersionNotice.java
@@ -27,7 +27,7 @@ public static GameVersionNotice of(
         GameVersionStamp stamp = backup.get();
         if (running.isEmpty()) {
             return new GameVersionNotice(
-                    GameVersionNoticeLevel.MATCHED,
+                    GameVersionNoticeLevel.UNKNOWN,
                     "Made with Minecraft " + stamp.displayName() + ".");
         }
         GameVersionStamp current = running.get();
@@ -49,8 +49,4 @@ public static GameVersionNotice of(
                         + ", which is newer than " + current.displayName()
                         + ". The restored copy may not open in this version.");
     }
-
-    public boolean isWarning() {
-        return level == GameVersionNoticeLevel.DOWNGRADE;
-    }
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/GameVersionNoticeLevel.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/GameVersionNoticeLevel.java
index b973e4b..b472f23 100644
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/GameVersionNoticeLevel.java
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/GameVersionNoticeLevel.java
@@ -1,12 +1,15 @@
 package dev.ishaanko.worldarchive.ui.model;
 
-/** How strongly a version notice should be shown. */
+/** How the restore screen colors a version notice. */
 public enum GameVersionNoticeLevel {
+    /** The backup's or the running game's version is unknown, so the two cannot be compared. */
     UNKNOWN,
 
     MATCHED,
 
+    /** Minecraft upgrades the restored copy when it opens. */
     UPGRADE,
 
+    /** The backup is newer than the running game; the copy may not open. */
     DOWNGRADE
 }
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/Paging.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/Paging.java
new file mode 100644
index 0000000..09a2ac9
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/Paging.java
@@ -0,0 +1,36 @@
+package dev.ishaanko.worldarchive.ui.model;
+
+import java.util.List;
+
+/**
+ * One page of a list that a screen shows {@code pageSize} items at a time. Every paged screen
+ * builds one per layout pass with {@link #of}, which keeps the page index inside the list.
+ */
+public record Paging(int pageIndex, int pageCount, int pageSize) {
+    public Paging {
+        if (pageSize < 1 || pageCount < 1 || pageIndex < 0 || pageIndex >= pageCount) {
+            throw new IllegalArgumentException("Invalid page dimensions");
+        }
+    }
+
+    /** The requested page of {@code itemCount} items, moved to the last page when it is past the end. */
+    public static Paging of(int itemCount, int pageSize, int requestedPage) {
+        int size = Math.max(1, pageSize);
+        int count = Math.max(1, Math.ceilDiv(itemCount, size));
+        return new Paging(Math.clamp(requestedPage, 0, count - 1), count, size);
+    }
+
+    public boolean hasPrevious() {
+        return pageIndex > 0;
+    }
+
+    public boolean hasNext() {
+        return pageIndex + 1 < pageCount;
+    }
+
+    /** The items on this page. */
+    public <T> List<T> slice(List<T> items) {
+        int first = Math.min(items.size(), pageIndex * pageSize);
+        return items.subList(first, Math.min(items.size(), first + pageSize));
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/ProgressState.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/ProgressState.java
deleted file mode 100644
index d4247dd..0000000
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/ProgressState.java
+++ /dev/null
@@ -1,40 +0,0 @@
-package dev.ishaanko.worldarchive.ui.model;
-
-import dev.ishaanko.worldarchive.core.BackupOperation;
-import dev.ishaanko.worldarchive.core.OperationPhase;
-import dev.ishaanko.worldarchive.core.OperationProgress;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
-import java.util.Objects;
-import java.util.OptionalDouble;
-
-/** Credential-safe progress state with a renderer-neutral optional fraction. */
-public record ProgressState(
-        BackupOperation operation,
-        OperationPhase phase,
-        String message,
-        OptionalDouble fraction,
-        boolean terminal,
-        boolean successful) {
-    public ProgressState {
-        Objects.requireNonNull(operation, "operation");
-        Objects.requireNonNull(phase, "phase");
-        message = SensitiveDataRedactor.redact(Objects.requireNonNull(message, "message"));
-        Objects.requireNonNull(fraction, "fraction");
-        if (successful && phase != OperationPhase.COMPLETE) {
-            throw new IllegalArgumentException("Only complete progress can be successful");
-        }
-    }
-
-    public static ProgressState from(OperationProgress progress) {
-        Objects.requireNonNull(progress, "progress");
-        boolean terminal = progress.phase() == OperationPhase.COMPLETE
-                || progress.phase() == OperationPhase.FAILED;
-        return new ProgressState(
-                progress.operation(),
-                progress.phase(),
-                progress.message(),
-                progress.fraction(),
-                terminal,
-                progress.phase() == OperationPhase.COMPLETE);
-    }
-}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/RestoreName.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/RestoreName.java
new file mode 100644
index 0000000..8b0d755
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/RestoreName.java
@@ -0,0 +1,93 @@
+package dev.ishaanko.worldarchive.ui.model;
+
+import dev.ishaanko.worldarchive.core.RestoreBackupRequest;
+import dev.ishaanko.worldarchive.support.PortablePath;
+import java.util.Optional;
+
+/**
+ * The folder name of a restored world copy: the name the Restore screen suggests, and the checks
+ * a typed name must pass before the restore starts. The checks keep the name a single folder that
+ * Windows, macOS and Linux can create, and never the folder of the world the backup came from.
+ * If a valid name is already taken, the restore picks the next free one.
+ */
+public final class RestoreName {
+    private static final String UNSAFE_CHARACTERS = "<>:\"/\\|?*";
+
+    private static final String SUFFIX = " - Restored";
+
+    private static final String COPY_SUFFIX = " Copy";
+
+    private RestoreName() {
+    }
+
+    /** Why a typed name cannot be used. */
+    public enum Problem {
+        BLANK,
+        TOO_LONG,
+        ENDS_WITH_DOT_OR_SPACE,
+        UNSAFE_CHARACTER,
+        RESERVED_BY_WINDOWS,
+        SAME_AS_ORIGINAL
+    }
+
+    /**
+     * The suggested name: the world's display name followed by {@code - Restored}, with unsafe
+     * characters replaced and cut to fit, and never the folder name of the original world.
+     */
+    public static String suggest(String displayName, String originalFolder) {
+        String name = trimFolderName(replaceUnsafe(displayName + SUFFIX));
+        if (name.isBlank()) {
+            name = "Restored World";
+        }
+        if (name.length() > RestoreBackupRequest.MAXIMUM_NAME_LENGTH) {
+            name = trimFolderName(name.substring(0, RestoreBackupRequest.MAXIMUM_NAME_LENGTH));
+        }
+        if (name.equalsIgnoreCase(originalFolder)) {
+            int keep = Math.min(name.length(), RestoreBackupRequest.MAXIMUM_NAME_LENGTH - COPY_SUFFIX.length());
+            name = name.substring(0, keep) + COPY_SUFFIX;
+        }
+        return name;
+    }
+
+    /** The first problem with {@code name}, or empty when a restore can use it. */
+    public static Optional<Problem> check(String name, String originalFolder) {
+        if (name.isBlank()) {
+            return Optional.of(Problem.BLANK);
+        }
+        if (name.length() > RestoreBackupRequest.MAXIMUM_NAME_LENGTH) {
+            return Optional.of(Problem.TOO_LONG);
+        }
+        if (name.endsWith(".") || name.endsWith(" ")) {
+            return Optional.of(Problem.ENDS_WITH_DOT_OR_SPACE);
+        }
+        if (name.chars().anyMatch(character -> UNSAFE_CHARACTERS.indexOf(character) >= 0
+                || Character.isISOControl(character))) {
+            return Optional.of(Problem.UNSAFE_CHARACTER);
+        }
+        if (PortablePath.isWindowsDeviceName(name)) {
+            return Optional.of(Problem.RESERVED_BY_WINDOWS);
+        }
+        if (name.equalsIgnoreCase(originalFolder)) {
+            return Optional.of(Problem.SAME_AS_ORIGINAL);
+        }
+        return Optional.empty();
+    }
+
+    private static String replaceUnsafe(String name) {
+        StringBuilder safe = new StringBuilder(name.length());
+        name.chars().forEach(character -> safe.append(
+                UNSAFE_CHARACTERS.indexOf(character) >= 0 || Character.isISOControl(character)
+                        ? '_'
+                        : (char) character));
+        return safe.toString();
+    }
+
+    /** Drops leading spaces and trailing dots and spaces, which Windows removes from folder names. */
+    private static String trimFolderName(String name) {
+        int end = name.length();
+        while (end > 0 && (name.charAt(end - 1) == '.' || Character.isWhitespace(name.charAt(end - 1)))) {
+            end--;
+        }
+        return name.substring(0, end).stripLeading();
+    }
+}
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/ScreenGeometry.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/ScreenGeometry.java
index 7bb5bf8..0e9b5be 100644
--- a/src/main/java/dev/ishaanko/worldarchive/ui/model/ScreenGeometry.java
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/ScreenGeometry.java
@@ -17,11 +17,6 @@ public static int centerX(int screenWidth, int contentWidth) {
         return (screenWidth - contentWidth) / 2;
     }
 
-    /** Row anchored to the bottom of the screen, never rising above {@code minY}. */
-    public static int anchorBottom(int minY, int screenHeight, int offset) {
-        return Math.max(minY, screenHeight - offset);
-    }
-
     /** Row anchored to the screen's vertical middle, never rising above {@code minY}. */
     public static int anchorMiddle(int minY, int screenHeight, int offset) {
         return Math.max(minY, screenHeight / 2 + offset);
diff --git a/src/main/java/dev/ishaanko/worldarchive/ui/model/StoragePolicyInput.java b/src/main/java/dev/ishaanko/worldarchive/ui/model/StoragePolicyInput.java
new file mode 100644
index 0000000..389514e
--- /dev/null
+++ b/src/main/java/dev/ishaanko/worldarchive/ui/model/StoragePolicyInput.java
@@ -0,0 +1,48 @@
+package dev.ishaanko.worldarchive.ui.model;
+
+import dev.ishaanko.worldarchive.config.StoragePolicy;
+import java.math.BigDecimal;
+import java.math.RoundingMode;
+import java.util.Optional;
+
+/**
+ * Reads the Storage screen's text fields into a storage policy, and writes a policy's limit back
+ * as text. The limit is in GiB and accepts a dot or a comma as the decimal mark; a blank limit
+ * means no limit. The keep counts are whole numbers.
+ */
+public final class StoragePolicyInput {
+    private static final BigDecimal GIBIBYTE = BigDecimal.valueOf(1_073_741_824L);
+
+    private StoragePolicyInput() {
+    }
+
+    /** The policy the fields describe, or empty when a field is not a number the policy allows. */
+    public static Optional<StoragePolicy> parse(String limit, String daily, String weekly, String monthly) {
+        try {
+            String gibibytes = limit.strip().replace(',', '.');
+            long budgetBytes = gibibytes.isEmpty()
+                    ? 0
+                    : new BigDecimal(gibibytes).multiply(GIBIBYTE).setScale(0, RoundingMode.HALF_UP).longValueExact();
+            return Optional.of(new StoragePolicy(
+                    budgetBytes,
+                    Integer.parseInt(daily.strip()),
+                    Integer.parseInt(weekly.strip()),
+                    Integer.parseInt(monthly.strip())));
+        } catch (ArithmeticException | IllegalArgumentException exception) {
+            // NumberFormatException is an IllegalArgumentException; StoragePolicy throws one for
+            // a value out of range.
+            return Optional.empty();
+        }
+    }
+
+    /** The policy's limit as the limit field shows it: GiB with up to two decimals, or blank. */
+    public static String limitText(StoragePolicy policy) {
+        if (!policy.budgetEnabled()) {
+            return "";
+        }
+        return BigDecimal.valueOf(policy.budgetBytes())
+                .divide(GIBIBYTE, 2, RoundingMode.HALF_UP)
+                .stripTrailingZeros()
+                .toPlainString();
+    }
+}
diff --git a/src/main/resources/assets/worldarchive/lang/en_us.json b/src/main/resources/assets/worldarchive/lang/en_us.json
index 7585476..7bd9d36 100644
--- a/src/main/resources/assets/worldarchive/lang/en_us.json
+++ b/src/main/resources/assets/worldarchive/lang/en_us.json
@@ -1,5 +1,38 @@
 {
     "modmenu.descriptionTranslation.worldarchive": "Creates dependable local backups of your single-player worlds.",
+    "screen.worldarchive.browser.opening_folder": "Opening the backup folder...",
+    "screen.worldarchive.cleanup.choose": "Choose which backups to delete from this computer. Copies on your Git remote are kept and stay listed; use Delete to remove one from the remote.",
+    "screen.worldarchive.delete.labeled": "%s of them have a label. A label does not protect a backup from Delete.",
+    "screen.worldarchive.delete.more": "...and %s more",
+    "screen.worldarchive.delete.prompt_many": "Delete these %s backups from every destination? You cannot undo this.",
+    "screen.worldarchive.delete.prompt_one": "Delete this backup from every destination? You cannot undo this.",
+    "screen.worldarchive.delete.remote_many": "%s of them have a copy on your Git remote. Those copies are deleted too.",
+    "screen.worldarchive.delete.remote_one": "Its copy on your Git remote is deleted too.",
+    "screen.worldarchive.delete.title_many": "Delete %s backups?",
+    "screen.worldarchive.delete.title_one": "Delete backup?",
+    "screen.worldarchive.import.read_failed": "Those backups could not be read, so nothing was changed: %s",
+    "screen.worldarchive.import.stopped": "Import stopped: %s. Some selected backups may already be imported. Go Back and check before you try again.",
+    "screen.worldarchive.operation.stopped": "The operation stopped before it finished",
+    "screen.worldarchive.operation.sync_cancelled": "Sync cancelled",
+    "screen.worldarchive.operation.sync_cancelled_detail": "The backup on this computer did not change. Choose Sync to try again.",
+    "screen.worldarchive.operation.sync_cancelling": "Cancelling sync...",
+    "screen.worldarchive.operation.verify_cancelled": "Verification cancelled",
+    "screen.worldarchive.operation.verify_cancelled_detail": "Nothing was changed.",
+    "screen.worldarchive.operation.verify_cancelling": "Cancelling verification...",
+    "screen.worldarchive.page.next": "Next",
+    "screen.worldarchive.page.previous": "Previous",
+    "screen.worldarchive.restore.leaves_world": "This leaves the world you are playing.",
+    "screen.worldarchive.restore.name_too_long": "The name is too long",
+    "screen.worldarchive.row.copies_git": "Git",
+    "screen.worldarchive.row.copies_git_and_zip": "Git and ZIP",
+    "screen.worldarchive.row.copies_none": "No copy",
+    "screen.worldarchive.row.copies_zip": "ZIP",
+    "screen.worldarchive.row.remote_failed": "Remote sync failed",
+    "screen.worldarchive.row.remote_not_synced": "Remote not synced",
+    "screen.worldarchive.row.remote_pending": "Remote sync pending",
+    "screen.worldarchive.row.remote_synced": "Remote synced",
+    "screen.worldarchive.storage.not_counted": "copies on your Git remote or in linked folders are not counted",
+    "screen.worldarchive.storage.save_first": "Save the policy first; cleanup uses the saved limit",
     "screen.worldarchive.backups_button": "World Backups",
     "screen.worldarchive.backup_toast.cancel": "Cancel",
     "screen.worldarchive.operation.cancel": "Cancel",
@@ -19,19 +52,27 @@
     "screen.worldarchive.settings.health_failed": "Destination health checks failed",
     "screen.worldarchive.settings.lfs_hint": "Comma-separated patterns",
     "screen.worldarchive.settings.lfs_patterns": "LFS patterns",
-    "screen.worldarchive.settings.load_failed": "Settings could not be loaded; using defaults",
     "screen.worldarchive.settings.loading": "Loading settings...",
     "screen.worldarchive.settings.manual": "Manual",
     "screen.worldarchive.settings.minutes_hint": "Minutes",
     "screen.worldarchive.settings.more": "More...",
-    "screen.worldarchive.settings.no_worlds": "World controls appear here after you open a world once with backups enabled.",
+    "screen.worldarchive.settings.no_worlds": "No worlds were found in the saves folder.",
+    "screen.worldarchive.settings.notice.copy": "%s is a copy of %s, so it now has its own backup history",
+    "screen.worldarchive.settings.notice.replaced": "%s now has a different WorldArchive identity, so its old world settings were not carried over",
+    "screen.worldarchive.settings.notice.shared": "%s carry the same WorldArchive identity. Open the world that should keep its backup history first",
+    "screen.worldarchive.settings.notice.unreadable": "%s is left out: its WorldArchive identity could not be read (%s)",
     "screen.worldarchive.settings.page": "Page %s of %s",
     "screen.worldarchive.settings.path_hint": "Full folder path on this computer",
     "screen.worldarchive.settings.remote_name": "Remote name",
     "screen.worldarchive.settings.remote_name_hint": "Usually origin",
     "screen.worldarchive.settings.remote_name_tooltip": "The Git remote name (usually origin). Set each world's repository URL on the Worlds tab.",
     "screen.worldarchive.settings.repository": "Local repository root",
+    "screen.worldarchive.settings.reset": "Reset settings",
+    "screen.worldarchive.settings.reset_done": "Settings were reset. The old file was kept as %s",
+    "screen.worldarchive.settings.reset_failed": "Settings could not be reset: %s",
+    "screen.worldarchive.settings.reset_not_needed": "The settings file can be read again, so nothing was reset.",
     "screen.worldarchive.settings.save": "Save",
+    "screen.worldarchive.settings.save_failed": "Settings could not be saved: %s",
     "screen.worldarchive.settings.saving": "Saving settings...",
     "screen.worldarchive.settings.schedule_interval": "Every (minutes)",
     "screen.worldarchive.settings.schedule_interval_tooltip": "Minutes between automatic backups (applies to Git and ZIP)",
@@ -41,12 +82,16 @@
     "screen.worldarchive.settings.tab.zip": "ZIP",
     "screen.worldarchive.settings.timing": "Timing...",
     "screen.worldarchive.settings.title": "WorldArchive Settings",
+    "screen.worldarchive.settings.unreadable": "Settings could not be read: %s",
+    "screen.worldarchive.settings.unreadable_help": "Backups are paused, and nothing is saved over %s until it can be read. Fix the file and open this screen again, or choose Reset settings: the old file is kept, and the settings start over from the defaults.",
+    "screen.worldarchive.settings.unreadable_newer": "Settings could not be read: a newer WorldArchive saved them. Update WorldArchive, or reset the settings.",
+    "screen.worldarchive.settings.unreadable_older": "Settings could not be read: they are from WorldArchive 0.1.0, which this version no longer reads. Reset the settings, then use Import with the old Git repository to bring back its backups.",
     "screen.worldarchive.settings.validating": "Validating settings...",
     "screen.worldarchive.settings.validation_failed": "Settings validation failed; review the destination paths",
     "screen.worldarchive.settings.world_count": "%s configured world(s)",
     "screen.worldarchive.settings.world_enabled": "Back up this world",
     "screen.worldarchive.settings.world_remote_hint": "Optional URL for this world",
-    "screen.worldarchive.settings.world_remote_steps": "Paste this world's GitHub repository URL here. Each new backup uploads automatically. If an upload fails, the mod tries again with the next backup.",
+    "screen.worldarchive.settings.world_remote_steps": "Paste the address of this world's Git repository. Each new backup uploads to it. If an upload fails, choose Sync on that backup to try again.",
     "screen.worldarchive.settings.world_remote_url": "Git remote",
     "screen.worldarchive.settings.world_zip_default": "Use a separate ZIP folder",
     "screen.worldarchive.settings.world_zip_destination": "ZIP folder",
@@ -57,5 +102,35 @@
     "screen.worldarchive.worlds.settings": "Settings",
     "screen.worldarchive.worlds.title": "World Backups",
     "screen.worldarchive.settings.zip_enabled": "Enable ZIP backups",
-    "screen.worldarchive.settings.zip_folder_title": "Select WorldArchive ZIP folder"
+    "screen.worldarchive.settings.zip_folder_title": "Select WorldArchive ZIP folder",
+    "screen.worldarchive.browser.create_world_off": "Backups are off for this world. Turn them on in Settings, on the Worlds tab.",
+    "screen.worldarchive.browser.create_no_destination": "No destination takes manual backups. Turn one on in Settings.",
+    "screen.worldarchive.browser.create_git_missing": "Only Git takes manual backups, and Git or Git LFS is missing. Install both, or turn on ZIP backups.",
+    "screen.worldarchive.browser.create_storage_problem": "A backup folder is inside a world, so backups are paused. Choose another folder in Settings.",
+    "screen.worldarchive.backup_toast.cancelling": "Cancelling backup...",
+    "screen.worldarchive.cleanup.freed": "Freed %s. Backups now use %s.",
+    "screen.worldarchive.cleanup.kept": "%s backups were not deleted:",
+    "screen.worldarchive.operation.restore_cancelling": "Cancelling restore...",
+    "screen.worldarchive.operation.restore_cancelled": "Restore cancelled",
+    "screen.worldarchive.operation.restore_cancelled_detail": "The partial world copy was removed. No world was changed.",
+    "screen.worldarchive.runtime.settings_unreadable": "WorldArchive settings could not be read (%s), so backups are paused. Open Settings to fix or reset them.",
+    "screen.worldarchive.runtime.loading": "WorldArchive is still loading. Try again in a moment.",
+    "screen.worldarchive.runtime.world_unavailable": "The world folder is not available for a new backup. Open the world list again.",
+    "screen.worldarchive.runtime.busy": "A backup of this world is already running. Try again when it finishes.",
+    "screen.worldarchive.runtime.world_loading": "This world is still loading. Try again in a moment.",
+    "screen.worldarchive.runtime.world_not_saved": "The settings could not record this world's folder. Open WorldArchive settings to check them.",
+    "screen.worldarchive.notice.chat": "WorldArchive: %s",
+    "screen.worldarchive.notice.exit_started": "Creating backup... Keep Minecraft open until it finishes.",
+    "screen.worldarchive.notice.exit_done": "Backup finished. You can safely quit Minecraft.",
+    "screen.worldarchive.notice.exit_warnings": "Backup made, but a destination had a problem. Open Backups to see which.",
+    "screen.worldarchive.notice.exit_failed": "Backup failed. Your world was saved. Open Backups to see why.",
+    "screen.worldarchive.notice.exit_skipped": "Backup skipped. Your world was saved.",
+    "screen.worldarchive.notice.exit_cancelled": "Backup cancelled. Your world was saved.",
+    "screen.worldarchive.notice.exit_not_made": "Backup not made: %s",
+    "screen.worldarchive.notice.save_missing": "The game closed before it saved the world, so no backup was made.",
+    "screen.worldarchive.notice.exit_interrupted": "Minecraft closed before the world-exit backup finished, so that backup was not made.",
+    "screen.worldarchive.notice.work_interrupted": "Minecraft closed before WorldArchive finished its work. Check your backups.",
+    "screen.worldarchive.notice.scheduled_warnings": "Scheduled backup made, but a destination had a problem",
+    "screen.worldarchive.notice.scheduled_failed": "Scheduled backup failed. Open Backups to see why.",
+    "screen.worldarchive.notice.scheduled_not_made": "Scheduled backup not made: %s"
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/WorldArchiveMetadataTest.java b/src/test/java/dev/ishaanko/worldarchive/WorldArchiveMetadataTest.java
deleted file mode 100644
index 508a824..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/WorldArchiveMetadataTest.java
+++ /dev/null
@@ -1,12 +0,0 @@
-package dev.ishaanko.worldarchive;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-
-import org.junit.jupiter.api.Test;
-
-final class WorldArchiveMetadataTest {
-    @Test
-    void exposesStableModIdentity() {
-        assertEquals("WorldArchive", WorldArchiveMetadata.MOD_NAME);
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/catalog/FileBackupCatalogTest.java b/src/test/java/dev/ishaanko/worldarchive/catalog/FileBackupCatalogTest.java
index 76c4f2a..00233d4 100644
--- a/src/test/java/dev/ishaanko/worldarchive/catalog/FileBackupCatalogTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/catalog/FileBackupCatalogTest.java
@@ -1,19 +1,20 @@
 package dev.ishaanko.worldarchive.catalog;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
+import dev.ishaanko.worldarchive.model.ArtifactOwnership;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupManifest;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.BackupStatus;
 import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.ArtifactOwnership;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
 import dev.ishaanko.worldarchive.model.GameVersionStamp;
+import dev.ishaanko.worldarchive.model.GoldenFixtures;
 import dev.ishaanko.worldarchive.model.ImportSourceId;
 import dev.ishaanko.worldarchive.model.SyncStatus;
 import dev.ishaanko.worldarchive.model.VerificationStatus;
@@ -25,37 +26,139 @@
 import java.time.Instant;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Map;
 import java.util.Optional;
-import java.util.concurrent.ExecutionException;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
+import java.util.stream.Stream;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
 final class FileBackupCatalogTest {
     private static final String SOURCE_HASH = "a".repeat(64);
 
+    /** A catalog written by WorldArchive 0.3.9; the bytes must never change. */
+    private static final String GOLDEN_CATALOG = """
+            {
+              "schemaVersion": 3,
+              "records": [
+                {
+                  "manifest": {
+                    "formatVersion": 1,
+                    "backupId": "0f6d3c2a-8b1e-4c5d-9a7f-112233445566",
+                    "worldId": "7a1b2c3d-4e5f-4a6b-8c7d-8e9fa0b1c2d3",
+                    "worldName": "Golden Wörld 世界",
+                    "label": "Before the <dragon> & \\"end\\"",
+                    "createdAt": "2026-09-01T12:34:56.789Z",
+                    "trigger": "MANUAL",
+                    "sourceFileCount": 3,
+                    "sourceByteCount": 266240,
+                    "changedFileCount": 2,
+                    "contentSha256": "3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
+                    "inventorySha256": "a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0",
+                    "gameVersion": {
+                      "name": "26.3",
+                      "dataVersion": 4556
+                    }
+                  },
+                  "result": {
+                    "backupId": "0f6d3c2a-8b1e-4c5d-9a7f-112233445566",
+                    "worldId": "7a1b2c3d-4e5f-4a6b-8c7d-8e9fa0b1c2d3",
+                    "status": "SUCCESS",
+                    "completedAt": "2026-09-01T12:35:10Z",
+                    "destinations": [
+                      {
+                        "destination": "GIT",
+                        "status": "SUCCESS",
+                        "artifactId": "refs/heads/backups/0f6d3c2a-8b1e-4c5d-9a7f-112233445566",
+                        "verificationStatus": "VERIFIED",
+                        "syncStatus": "SYNCED",
+                        "ownership": "MANAGED"
+                      },
+                      {
+                        "destination": "ZIP",
+                        "status": "SUCCESS",
+                        "artifactId": "2026-09-01_12-34-56Z - Golden - Manual - 0f6d3c2a-8b1e-4c5d-9a7f-112233445566.zip",
+                        "verificationStatus": "VERIFIED",
+                        "syncStatus": "NOT_CONFIGURED",
+                        "ownership": "IMPORTED_MANAGED",
+                        "importSourceId": "5b4a3928-1706-4f5e-8d4c-3b2a19087f6e"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "manifest": {
+                    "formatVersion": 1,
+                    "backupId": "1e2d3c4b-5a69-4788-97a6-b5c4d3e2f100",
+                    "worldId": "7a1b2c3d-4e5f-4a6b-8c7d-8e9fa0b1c2d3",
+                    "worldName": "Plain",
+                    "createdAt": "2026-09-01T12:00:00Z",
+                    "trigger": "WORLD_EXIT",
+                    "sourceFileCount": 0,
+                    "sourceByteCount": 0,
+                    "changedFileCount": 0,
+                    "contentSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+                    "inventorySha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+                  },
+                  "result": {
+                    "backupId": "1e2d3c4b-5a69-4788-97a6-b5c4d3e2f100",
+                    "worldId": "7a1b2c3d-4e5f-4a6b-8c7d-8e9fa0b1c2d3",
+                    "status": "PARTIAL_SUCCESS",
+                    "completedAt": "2026-09-01T12:00:05Z",
+                    "destinations": [
+                      {
+                        "destination": "GIT",
+                        "status": "PENDING_SYNC",
+                        "artifactId": "refs/heads/backups/1e2d3c4b-5a69-4788-97a6-b5c4d3e2f100",
+                        "message": "Remote is unreachable; the push will be retried",
+                        "verificationStatus": "NOT_VERIFIED",
+                        "syncStatus": "PENDING",
+                        "ownership": "MANAGED"
+                      },
+                      {
+                        "destination": "ZIP",
+                        "status": "FAILED",
+                        "message": "ZIP folder is not writable",
+                        "verificationStatus": "NOT_VERIFIED",
+                        "syncStatus": "FAILED",
+                        "ownership": "MANAGED"
+                      }
+                    ]
+                  }
+                }
+              ]
+            }
+            """;
+
     @TempDir
     Path temporaryDirectory;
 
     @Test
-    void roundTripsRecordsNewestFirstAndFiltersByWorld() throws IOException {
+    void recordsRoundTripNewestFirstWithTheirVersionOwnershipAndUpdates() throws IOException {
         FileBackupCatalog catalog = new FileBackupCatalog(temporaryDirectory.resolve("catalog.json"));
         WorldId firstWorld = WorldId.create();
-        WorldId secondWorld = WorldId.create();
         BackupRecord oldest = record(firstWorld, "2026-07-17T10:00:00Z");
-        BackupRecord newest = record(firstWorld, "2026-07-17T12:00:00Z");
-        BackupRecord otherWorld = record(secondWorld, "2026-07-17T11:00:00Z");
-
+        BackupRecord newest = withGameVersion(
+                record(firstWorld, "2026-07-17T12:00:00Z"), new GameVersionStamp("26.2", 4_820));
+        BackupRecord otherWorld = imported(record(WorldId.create(), "2026-07-17T11:00:00Z"));
         catalog.add(oldest);
         catalog.add(newest);
         catalog.add(otherWorld);
 
-        assertEquals(List.of(newest, otherWorld, oldest), catalog.listAll());
-        assertEquals(List.of(newest, oldest), catalog.list(firstWorld));
-        assertEquals(newest, catalog.find(newest.manifest().backupId()).orElseThrow());
-        assertEquals(catalog.listAll(), new FileBackupCatalog(catalog.file()).listAll());
+        BackupRecord verified = catalog.update(oldest.manifest().backupId(), current -> withDestinations(current,
+                List.of(current.result().destinations().getFirst().withVerification(VerificationStatus.VERIFIED))))
+                .orElseThrow();
+
+        FileBackupCatalog reloaded = new FileBackupCatalog(temporaryDirectory.resolve("catalog.json"));
+        assertEquals(List.of(newest, otherWorld, verified), reloaded.listAll());
+        assertEquals(List.of(newest, verified), reloaded.list(firstWorld));
+        assertEquals(Optional.of(new GameVersionStamp("26.2", 4_820)),
+                reloaded.find(newest.manifest().backupId()).orElseThrow().manifest().gameVersion());
+        assertEquals(ArtifactOwnership.IMPORTED_MANAGED, reloaded.find(otherWorld.manifest().backupId()).orElseThrow()
+                .result().destinations().getFirst().ownership());
+        assertEquals(Optional.empty(), reloaded.update(BackupId.create(), current -> current));
     }
 
     @Test
@@ -69,13 +172,12 @@ void concurrentWritersDoNotLoseRecords() throws Exception {
                 int offset = index;
                 futures.add(executor.submit(() -> {
                     new FileBackupCatalog(file).add(record(
-                            worldId,
-                            Instant.parse("2026-07-17T10:00:00Z").plusSeconds(offset).toString()));
+                            worldId, Instant.parse("2026-07-17T10:00:00Z").plusSeconds(offset).toString()));
                     return null;
                 }));
             }
             for (Future<Void> future : futures) {
-                get(future);
+                future.get();
             }
         } finally {
             executor.shutdownNow();
@@ -85,288 +187,241 @@ void concurrentWritersDoNotLoseRecords() throws Exception {
     }
 
     @Test
-    void orphanedPartialWriteDoesNotReplacePublishedCatalog() throws IOException {
-        Path file = temporaryDirectory.resolve("catalog.json");
-        FileBackupCatalog catalog = new FileBackupCatalog(file);
-        BackupRecord record = record(WorldId.create(), "2026-07-17T10:00:00Z");
-        catalog.add(record);
-        Files.writeString(
-                temporaryDirectory.resolve(".catalog.json.interrupted.tmp"),
-                "{\"schemaVersion\":999}",
-                StandardCharsets.UTF_8);
-
-        assertEquals(List.of(record), catalog.listAll());
-    }
+    void readsTheCatalogsOfEveryReleasedVersion() throws IOException {
+        Path withoutGameVersion = temporaryDirectory.resolve("catalog-0.3.json");
+        Files.writeString(withoutGameVersion,
+                legacyCatalog(3, "\"syncStatus\": \"NOT_CONFIGURED\", \"ownership\": \"MANAGED\""));
+        Path beforeImports = temporaryDirectory.resolve("catalog-0.1.json");
+        Files.writeString(beforeImports, legacyCatalog(2, "\"syncStatus\": \"NOT_CONFIGURED\""));
 
-    @Test
-    void readsCatalogsWrittenBeforeGameVersionTracking() throws IOException {
-        Path file = temporaryDirectory.resolve("catalog.json");
-        Files.writeString(file, legacyCatalog(), StandardCharsets.UTF_8);
-
-        BackupRecord record = new FileBackupCatalog(file).listAll().getFirst();
+        BackupRecord record = new FileBackupCatalog(withoutGameVersion).listAll().getFirst();
+        BackupRecord oldest = new FileBackupCatalog(beforeImports).listAll().getFirst();
 
         assertEquals("Legacy World", record.manifest().worldName());
         assertEquals(Optional.empty(), record.manifest().gameVersion());
+        assertEquals(ArtifactOwnership.MANAGED, oldest.result().destinations().getFirst().ownership());
     }
 
     @Test
-    void roundTripsAStampedGameVersion() throws IOException {
-        FileBackupCatalog catalog = new FileBackupCatalog(temporaryDirectory.resolve("catalog.json"));
-        GameVersionStamp stamp = new GameVersionStamp("26.2", 4_820);
-        BackupRecord original = record(WorldId.create(), "2026-07-17T10:00:00Z");
-        BackupManifest stamped = BackupManifest.create(
-                original.manifest().backupId(),
-                original.manifest().worldId(),
-                original.manifest().worldName(),
-                original.manifest().label(),
-                original.manifest().createdAt(),
-                original.manifest().trigger(),
-                original.manifest().sourceFileCount(),
-                original.manifest().sourceByteCount(),
-                original.manifest().changedFileCount(),
-                original.manifest().contentSha256(),
-                original.manifest().inventorySha256(),
-                Optional.of(stamp));
-        catalog.add(new BackupRecord(stamped, original.result()));
-
-        BackupRecord reloaded = new FileBackupCatalog(catalog.file()).listAll().getFirst();
-
-        assertEquals(Optional.of(stamp), reloaded.manifest().gameVersion());
+    void aDamagedCatalogIsMovedAsideAndTheCatalogStartsOver() throws IOException {
+        Path file = temporaryDirectory.resolve("catalog.json");
+        Files.writeString(file, "{\"schemaVersion\": 3, \"records\": [ {\"manifest\": ", StandardCharsets.UTF_8);
+        FileBackupCatalog catalog = new FileBackupCatalog(file);
+
+        assertEquals(List.of(), catalog.listAll());
+        BackupRecord added = record(WorldId.create(), "2026-07-17T10:00:00Z");
+        catalog.add(added);
+
+        assertEquals(List.of(added), new FileBackupCatalog(file).listAll());
+        try (Stream<Path> files = Files.list(temporaryDirectory)) {
+            Path aside = files.filter(path -> path.getFileName().toString().startsWith("catalog.json.corrupt-"))
+                    .findFirst()
+                    .orElseThrow();
+            assertEquals("{\"schemaVersion\": 3, \"records\": [ {\"manifest\": ", Files.readString(aside));
+        }
     }
 
+    /** A file cut short in its second record, as a failing disk leaves it, keeps the record before the cut. */
     @Test
-    void futureOrCorruptCatalogFailsSafely() throws IOException {
+    void aCatalogCutShortKeepsTheRecordsBeforeTheCut() throws IOException {
         Path file = temporaryDirectory.resolve("catalog.json");
-        Files.writeString(file, "{\"schemaVersion\":999,\"records\":[]}", StandardCharsets.UTF_8);
-        assertThrows(IOException.class, () -> new FileBackupCatalog(file).listAll());
-        Files.writeString(file, "not-json", StandardCharsets.UTF_8);
-        assertThrows(IOException.class, () -> new FileBackupCatalog(file).listAll());
+        FileBackupCatalog catalog = new FileBackupCatalog(file);
+        WorldId worldId = WorldId.create();
+        BackupRecord newer = record(worldId, "2026-07-17T11:00:00Z");
+        catalog.add(newer);
+        catalog.add(record(worldId, "2026-07-17T10:00:00Z"));
+        String text = Files.readString(file, StandardCharsets.UTF_8);
+        int secondRecord = text.indexOf("\"manifest\"", text.indexOf("\"manifest\"") + 1);
+        Files.writeString(file, text.substring(0, secondRecord + 20), StandardCharsets.UTF_8);
+
+        FileBackupCatalog reopened = new FileBackupCatalog(file);
+
+        assertEquals(List.of(newer), reopened.listAll());
+        assertTrue(reopened.lostRecords());
+        assertEquals(List.of(newer), new FileBackupCatalog(file).listAll());
     }
 
     @Test
-    void duplicateConflictIsRejectedAndRemovalIsExplicit() throws IOException {
-        FileBackupCatalog catalog = new FileBackupCatalog(temporaryDirectory.resolve("catalog.json"));
-        BackupRecord original = record(WorldId.create(), "2026-07-17T10:00:00Z");
-        catalog.add(original);
-        catalog.add(original);
+    void aCatalogFromANewerVersionIsRefusedAndKeptAsItIs() throws IOException {
+        Path file = temporaryDirectory.resolve("catalog.json");
+        String future = "{\"schemaVersion\":999,\"records\":[]}";
+        Files.writeString(file, future, StandardCharsets.UTF_8);
+        FileBackupCatalog catalog = new FileBackupCatalog(file);
+
+        IOException refused = assertThrows(IOException.class, catalog::listAll);
+        assertThrows(IOException.class, () -> catalog.add(record(WorldId.create(), "2026-07-17T10:00:00Z")));
 
-        BackupManifest changedManifest = new BackupManifest(
-                original.manifest().formatVersion(),
-                original.manifest().backupId(),
-                original.manifest().worldId(),
-                "Changed name",
-                original.manifest().createdAt(),
-                original.manifest().trigger(),
-                original.manifest().sourceFileCount(),
-                original.manifest().sourceByteCount(),
-                original.manifest().sourceSha256());
-        BackupRecord conflict = new BackupRecord(changedManifest, original.result());
-        assertThrows(IOException.class, () -> catalog.add(conflict));
-        assertEquals(1, catalog.listAll().size());
-
-        assertTrue(catalog.remove(original.manifest().backupId()));
-        assertFalse(catalog.remove(original.manifest().backupId()));
-        assertTrue(catalog.listAll().isEmpty());
+        assertTrue(refused.getMessage().contains("newer version"), refused.getMessage());
+        assertEquals(future, Files.readString(file));
     }
 
     @Test
-    void atomicallyUpdatesVerificationAndSyncState() throws IOException {
+    void addAcceptsTheSameRecordAgainAndRefusesADifferentOne() throws IOException {
         FileBackupCatalog catalog = new FileBackupCatalog(temporaryDirectory.resolve("catalog.json"));
         BackupRecord original = record(WorldId.create(), "2026-07-17T10:00:00Z");
         catalog.add(original);
+        catalog.add(original);
+
+        BackupRecord renamed = new BackupRecord(manifest(
+                original.manifest().worldId(), original.manifest().backupId(), "Changed name",
+                original.manifest().createdAt()), original.result());
 
-        BackupRecord updated = catalog.update(original.manifest().backupId(), current -> {
-            DestinationResult destination = current.result().destinations().getFirst()
-                    .withVerification(VerificationStatus.VERIFIED)
-                    .withSync(SyncStatus.SYNCED);
-            BackupResult result = new BackupResult(
-                    current.result().backupId(),
-                    current.result().worldId(),
-                    current.result().status(),
-                    List.of(destination),
-                    current.result().completedAt());
-            return new BackupRecord(current.manifest(), result);
-        }).orElseThrow();
-
-        assertEquals(VerificationStatus.VERIFIED,
-                updated.result().destinations().getFirst().verificationStatus());
-        assertEquals(SyncStatus.SYNCED, catalog.find(original.manifest().backupId())
-                .orElseThrow()
-                .result()
-                .destinations()
-                .getFirst()
-                .syncStatus());
+        assertThrows(IOException.class, () -> catalog.add(renamed));
+        assertEquals(List.of(original), catalog.listAll());
     }
 
     @Test
-    void mergesIdenticalArtifactsWithoutOverwritingConflicts() throws IOException {
+    void mergesOnlyAddWhatTheCatalogLacks() throws IOException {
         FileBackupCatalog catalog = new FileBackupCatalog(temporaryDirectory.resolve("merge.json"));
-        BackupRecord original = record(WorldId.create(), "2026-07-17T10:00:00Z");
-        catalog.add(original);
-        DestinationResult git = DestinationResult.success(
-                DestinationType.GIT,
-                "refs/heads/worldarchive/" + original.manifest().worldId()
-                        + "/" + original.manifest().backupId());
-        BackupRecord discovered = new BackupRecord(
-                original.manifest(),
-                BackupResult.aggregate(
-                        original.manifest().backupId(),
-                        original.manifest().worldId(),
-                        List.of(git),
-                        original.result().completedAt()));
-
-        assertEquals(CatalogMergeStatus.MERGED, catalog.merge(discovered).status());
-        assertEquals(2, catalog.find(original.manifest().backupId()).orElseThrow()
-                .result().destinations().size());
-        DestinationResult observedAgain = git.withVerification(VerificationStatus.VERIFIED);
-        BackupRecord healthOnlyDifference = new BackupRecord(
-                original.manifest(),
-                BackupResult.aggregate(
-                        original.manifest().backupId(),
-                        original.manifest().worldId(),
-                        List.of(observedAgain),
-                        original.result().completedAt()));
-        assertEquals(CatalogMergeStatus.UNCHANGED, catalog.merge(healthOnlyDifference).status());
-
-        BackupRecord conflict = new BackupRecord(
-                original.manifest(),
-                BackupResult.aggregate(
-                        original.manifest().backupId(),
-                        original.manifest().worldId(),
-                        List.of(DestinationResult.success(DestinationType.GIT, "another-ref")),
-                        original.result().completedAt()));
-        assertEquals(CatalogMergeStatus.CONFLICT, catalog.merge(conflict).status());
-        assertEquals(git.artifactId(), catalog.find(original.manifest().backupId()).orElseThrow()
-                .result().destinations().stream()
-                .filter(destination -> destination.destination() == DestinationType.GIT)
-                .findFirst().orElseThrow().artifactId());
+        BackupRecord listed = record(WorldId.create(), "2026-07-17T10:00:00Z");
+        BackupRecord conflicting = record(WorldId.create(), "2026-07-17T10:05:00Z");
+        catalog.add(listed);
+        catalog.add(conflicting);
+        BackupRecord unlisted = record(WorldId.create(), "2026-07-17T10:10:00Z");
+        DestinationResult git = DestinationResult.success(DestinationType.GIT, "refs/heads/worldarchive/a/b");
+
+        Map<BackupId, CatalogMergeResult> results = catalog.mergeAll(List.of(
+                withDestinations(listed, List.of(git)),
+                withDestinations(conflicting, List.of(DestinationResult.success(DestinationType.ZIP, "other.zip"))),
+                unlisted));
+        Map<BackupId, CatalogMergeResult> again = catalog.mergeAll(List.of(
+                withDestinations(listed, List.of(git.withVerification(VerificationStatus.VERIFIED)))));
+
+        assertEquals(CatalogMergeStatus.MERGED, results.get(listed.manifest().backupId()).status());
+        assertEquals(CatalogMergeStatus.CONFLICT, results.get(conflicting.manifest().backupId()).status());
+        assertEquals(CatalogMergeStatus.ADDED, results.get(unlisted.manifest().backupId()).status());
+        assertEquals(CatalogMergeStatus.UNCHANGED, again.get(listed.manifest().backupId()).status());
+        assertEquals(2, catalog.find(listed.manifest().backupId()).orElseThrow().result().destinations().size());
+        assertEquals(conflicting, catalog.find(conflicting.manifest().backupId()).orElseThrow());
     }
 
     @Test
-    void persistsExternalArtifactProvenanceInSchemaThree() throws IOException {
-        Path file = temporaryDirectory.resolve("external.json");
-        FileBackupCatalog catalog = new FileBackupCatalog(file);
-        BackupRecord base = record(WorldId.create(), "2026-07-17T10:00:00Z");
-        ImportSourceId sourceId = ImportSourceId.derived("linked folder");
-        DestinationResult external = DestinationResult.externalSuccess(
-                DestinationType.ZIP,
-                base.manifest().worldId() + "/archive.zip",
-                sourceId,
-                VerificationStatus.VERIFIED,
-                SyncStatus.NOT_CONFIGURED);
-        BackupRecord linked = new BackupRecord(
-                base.manifest(),
-                BackupResult.aggregate(
-                        base.manifest().backupId(),
-                        base.manifest().worldId(),
-                        List.of(external),
-                        base.result().completedAt()));
-
-        catalog.add(linked);
-
-        DestinationResult restored = new FileBackupCatalog(file).listAll().getFirst()
-                .result().destinations().getFirst();
-        assertEquals(ArtifactOwnership.EXTERNAL, restored.ownership());
-        assertEquals(sourceId, restored.importSourceId().orElseThrow());
-        assertTrue(Files.readString(file).contains("\"schemaVersion\": 3"));
+    void oneBatchChangeAddsChangesAndRemovesRecords() throws IOException {
+        FileBackupCatalog catalog = new FileBackupCatalog(temporaryDirectory.resolve("batch.json"));
+        BackupRecord removed = record(WorldId.create(), "2026-07-17T10:00:00Z");
+        BackupRecord changed = record(WorldId.create(), "2026-07-17T11:00:00Z");
+        BackupRecord added = record(WorldId.create(), "2026-07-17T12:00:00Z");
+        catalog.add(removed);
+        catalog.add(changed);
+        BackupRecord verified = withDestinations(changed,
+                List.of(changed.result().destinations().getFirst().withVerification(VerificationStatus.VERIFIED)));
+
+        Map<BackupId, Optional<BackupRecord>> after = catalog.updateAll(Map.of(
+                removed.manifest().backupId(), current -> Optional.empty(),
+                changed.manifest().backupId(), current -> current.map(ignored -> verified),
+                added.manifest().backupId(), current -> Optional.of(added)));
+
+        assertEquals(Map.of(
+                removed.manifest().backupId(), Optional.empty(),
+                changed.manifest().backupId(), Optional.of(verified),
+                added.manifest().backupId(), Optional.of(added)), after);
+        assertEquals(List.of(added, verified),
+                new FileBackupCatalog(temporaryDirectory.resolve("batch.json")).listAll());
+        assertThrows(IOException.class, () -> catalog.updateAll(Map.of(
+                added.manifest().backupId(), current -> Optional.of(verified))));
     }
 
     @Test
-    void neverPersistsRawDestinationSecrets() throws IOException {
-        Path file = temporaryDirectory.resolve("catalog.json");
-        FileBackupCatalog catalog = new FileBackupCatalog(file);
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        Instant createdAt = Instant.parse("2026-07-17T10:00:00Z");
-        String token = "ghp_abcdefghijklmnopqrstuvwxyz";
-        String encodedToken = "ghp%255Fabcdefghijklmnopqrstuvwxyz";
-        String password = "catalog-password";
-        String malformedAdjacent = encodedToken + " malformed %ZZ";
-        BackupManifest manifest = BackupManifest.create(
-                backupId,
-                worldId,
-                "World",
-                createdAt,
-                BackupTrigger.MANUAL,
-                1,
-                16,
-                SOURCE_HASH);
-        BackupResult result = BackupResult.aggregate(
-                backupId,
-                worldId,
-                List.of(DestinationResult.failed(
-                        DestinationType.GIT,
-                        "password=" + password + " prefix_x_" + token + "_suffix " + malformedAdjacent)),
-                createdAt.plusSeconds(1));
-
-        catalog.add(new BackupRecord(manifest, result));
-
-        String persisted = Files.readString(file, StandardCharsets.UTF_8);
-        assertFalse(persisted.contains(token));
-        assertFalse(persisted.contains(encodedToken));
-        assertFalse(persisted.contains(malformedAdjacent));
-        assertFalse(persisted.contains(password));
-        assertTrue(persisted.contains("[REDACTED]"));
-        assertFalse(catalog.listAll().getFirst().result().destinations().getFirst()
-                .message().orElseThrow().contains(token));
+    void keepsTheCatalogFileFormatByteForByte() throws IOException {
+        FileBackupCatalog catalog = new FileBackupCatalog(temporaryDirectory.resolve("catalog.json"));
+        List<BackupRecord> records = goldenRecords();
+
+        for (BackupRecord record : records) {
+            catalog.add(record);
+        }
+
+        assertEquals(GOLDEN_CATALOG,
+                Files.readString(temporaryDirectory.resolve("catalog.json"), StandardCharsets.UTF_8));
+        assertEquals(records, catalog.listAll());
     }
 
     @Test
-    void neverPersistsFullyEncodedDeeplyNestedToken() throws IOException {
-        Path file = temporaryDirectory.resolve("nested-secret-catalog.json");
-        FileBackupCatalog catalog = new FileBackupCatalog(file);
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        Instant createdAt = Instant.parse("2026-07-17T10:00:00Z");
-        String nestedToken = nestedPercentEncoding("ghp_abcdefghijklmnopqrstuvwxyz", 32);
-        BackupManifest manifest = BackupManifest.create(
-                backupId,
-                worldId,
-                "World",
-                createdAt,
-                BackupTrigger.MANUAL,
-                1,
-                16,
-                SOURCE_HASH);
-        BackupResult result = BackupResult.aggregate(
-                backupId,
-                worldId,
-                List.of(DestinationResult.failed(DestinationType.GIT, nestedToken)),
-                createdAt.plusSeconds(1));
+    void derivesTheBackupStatusInsteadOfTrustingTheStoredOne() throws IOException {
+        Path file = temporaryDirectory.resolve("catalog.json");
+        Files.writeString(file, GOLDEN_CATALOG.replace(
+                "\"status\": \"PARTIAL_SUCCESS\"", "\"status\": \"SOME_FUTURE_STATUS\""));
+
+        BackupRecord plain = new FileBackupCatalog(file).listAll().getLast();
 
-        catalog.add(new BackupRecord(manifest, result));
+        assertEquals(BackupStatus.PARTIAL_SUCCESS, plain.result().status());
+    }
 
-        String persisted = Files.readString(file, StandardCharsets.UTF_8);
-        assertFalse(persisted.contains(nestedToken));
-        assertTrue(persisted.contains("[REDACTED]"));
-        assertEquals("[REDACTED]", catalog.listAll().getFirst().result()
-                .destinations().getFirst().message().orElseThrow());
+    /** One labeled backup with a Git and an imported ZIP copy; one plain backup, pending sync. */
+    private static List<BackupRecord> goldenRecords() {
+        BackupManifest labeled = GoldenFixtures.labeledManifest();
+        BackupManifest plain = GoldenFixtures.plainManifest();
+        return List.of(
+                new BackupRecord(labeled, new BackupResult(
+                        labeled.backupId(),
+                        labeled.worldId(),
+                        List.of(
+                                DestinationResult.success(
+                                                DestinationType.GIT,
+                                                "refs/heads/backups/0f6d3c2a-8b1e-4c5d-9a7f-112233445566")
+                                        .withVerification(VerificationStatus.VERIFIED)
+                                        .withSync(SyncStatus.SYNCED),
+                                DestinationResult.importedSuccess(
+                                        DestinationType.ZIP,
+                                        "2026-09-01_12-34-56Z - Golden - Manual - "
+                                                + "0f6d3c2a-8b1e-4c5d-9a7f-112233445566.zip",
+                                        ImportSourceId.parse("5b4a3928-1706-4f5e-8d4c-3b2a19087f6e"),
+                                        VerificationStatus.VERIFIED,
+                                        SyncStatus.NOT_CONFIGURED)),
+                        Instant.parse("2026-09-01T12:35:10Z"))),
+                new BackupRecord(plain, new BackupResult(
+                        plain.backupId(),
+                        plain.worldId(),
+                        List.of(
+                                DestinationResult.pendingSync(
+                                        DestinationType.GIT,
+                                        "refs/heads/backups/1e2d3c4b-5a69-4788-97a6-b5c4d3e2f100",
+                                        "Remote is unreachable; the push will be retried"),
+                                DestinationResult.failed(DestinationType.ZIP, "ZIP folder is not writable")),
+                        Instant.parse("2026-09-01T12:00:05Z"))));
     }
 
     private static BackupRecord record(WorldId worldId, String timestamp) {
         Instant createdAt = Instant.parse(timestamp);
-        BackupId backupId = BackupId.create();
-        BackupManifest manifest = BackupManifest.create(
-                backupId,
-                worldId,
-                "World 世界",
-                createdAt,
-                BackupTrigger.MANUAL,
-                12,
-                4_096,
-                SOURCE_HASH);
-        BackupResult result = BackupResult.aggregate(
-                backupId,
+        BackupManifest manifest = manifest(worldId, BackupId.create(), "World 世界", createdAt);
+        return new BackupRecord(manifest, new BackupResult(
+                manifest.backupId(),
                 worldId,
-                List.of(DestinationResult.success(DestinationType.ZIP, "archive.zip")),
-                createdAt.plusSeconds(1));
-        return new BackupRecord(manifest, result);
+                List.of(DestinationResult.success(DestinationType.ZIP, worldId + "/archive.zip")),
+                createdAt.plusSeconds(1)));
+    }
+
+    private static BackupManifest manifest(WorldId worldId, BackupId backupId, String name, Instant createdAt) {
+        return new BackupManifest(BackupManifest.CURRENT_FORMAT_VERSION, backupId, worldId, name, Optional.empty(),
+                createdAt, BackupTrigger.MANUAL, 12, 4_096, 12, SOURCE_HASH, SOURCE_HASH, Optional.empty());
+    }
+
+    private static BackupRecord withDestinations(BackupRecord record, List<DestinationResult> destinations) {
+        return new BackupRecord(record.manifest(), new BackupResult(record.manifest().backupId(),
+                record.manifest().worldId(), destinations, record.result().completedAt()));
+    }
+
+    private static BackupRecord withGameVersion(BackupRecord record, GameVersionStamp stamp) {
+        BackupManifest manifest = record.manifest();
+        return new BackupRecord(new BackupManifest(manifest.formatVersion(), manifest.backupId(), manifest.worldId(),
+                manifest.worldName(), manifest.label(), manifest.createdAt(), manifest.trigger(),
+                manifest.sourceFileCount(), manifest.sourceByteCount(), manifest.changedFileCount(),
+                manifest.contentSha256(), manifest.inventorySha256(), Optional.of(stamp)), record.result());
+    }
+
+    private static BackupRecord imported(BackupRecord record) {
+        return withDestinations(record, List.of(DestinationResult.importedSuccess(
+                DestinationType.GIT,
+                "refs/heads/worldarchive/" + record.manifest().worldId() + "/" + record.manifest().backupId(),
+                ImportSourceId.derived("a repository"),
+                VerificationStatus.VERIFIED,
+                SyncStatus.SYNCED)));
     }
 
-    private static String legacyCatalog() {
-        return ("""
+    /** A catalog as an older release wrote it, whose one destination ends with the given fields. */
+    private static String legacyCatalog(int schemaVersion, String lastFields) {
+        return """
                 {
-                    "schemaVersion": 3,
+                    "schemaVersion": %2$d,
                     "records": [
                         {
                             "manifest": {
@@ -393,30 +448,13 @@ private static String legacyCatalog() {
                                         "status": "SUCCESS",
                                         "artifactId": "archive.zip",
                                         "verificationStatus": "NOT_VERIFIED",
-                                        "syncStatus": "NOT_CONFIGURED",
-                                        "ownership": "MANAGED"
+                                        %3$s
                                     }
                                 ]
                             }
                         }
                     ]
                 }
-                """).formatted(SOURCE_HASH);
-    }
-
-    private static <T> T get(Future<T> future) throws InterruptedException, ExecutionException {
-        return future.get();
-    }
-
-    private static String nestedPercentEncoding(String value, int depth) {
-        StringBuilder encoded = new StringBuilder(value.length() * 3);
-        for (int index = 0; index < value.length(); index++) {
-            encoded.append('%').append(String.format("%02X", (int) value.charAt(index)));
-        }
-        String nested = encoded.toString();
-        for (int round = 1; round < depth; round++) {
-            nested = nested.replace("%", "%25");
-        }
-        return nested;
+                """.formatted(SOURCE_HASH, schemaVersion, lastFields);
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/catalog/FileBackupDeletionRegistryTest.java b/src/test/java/dev/ishaanko/worldarchive/catalog/FileBackupDeletionRegistryTest.java
index 3fbfafe..9360a45 100644
--- a/src/test/java/dev/ishaanko/worldarchive/catalog/FileBackupDeletionRegistryTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/catalog/FileBackupDeletionRegistryTest.java
@@ -1,10 +1,15 @@
 package dev.ishaanko.worldarchive.catalog;
 
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import dev.ishaanko.worldarchive.model.BackupId;
+import java.io.IOException;
+import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.List;
+import java.util.Set;
+import java.util.stream.Stream;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
@@ -13,16 +18,33 @@ final class FileBackupDeletionRegistryTest {
     Path temporaryDirectory;
 
     @Test
-    void deletionIntentSurvivesReloadAndCanBeExplicitlyRestored() throws Exception {
+    void marksSurviveAReloadAndGoWhenUnmarkedOrNoFileIsLeft() throws Exception {
         Path file = temporaryDirectory.resolve("deleted.txt");
-        BackupId deleted = BackupId.create();
-        FileBackupDeletionRegistry registry = new FileBackupDeletionRegistry(file);
-
-        registry.record(deleted);
+        BackupId first = BackupId.create();
+        BackupId second = BackupId.create();
+        BackupId third = BackupId.create();
+        new FileBackupDeletionRegistry(file).mark(List.of(first, second, third));
 
         FileBackupDeletionRegistry reloaded = new FileBackupDeletionRegistry(file);
-        assertTrue(reloaded.contains(deleted));
-        reloaded.restore(deleted);
-        assertFalse(new FileBackupDeletionRegistry(file).contains(deleted));
+        reloaded.unmark(List.of(first));
+        reloaded.unmarkAllExcept(Set.of(second));
+
+        assertEquals(Set.of(second), new FileBackupDeletionRegistry(file).marked());
+    }
+
+    @Test
+    void aDamagedListIsMovedAsideAndOneFromANewerVersionIsRefused() throws Exception {
+        Path damaged = temporaryDirectory.resolve("deleted.txt");
+        Files.writeString(damaged, "worldarchive-deleted-backups-v1\nnot-a-backup-id\n");
+        Path future = temporaryDirectory.resolve("future.txt");
+        Files.writeString(future, "worldarchive-deleted-backups-v2\n");
+
+        assertEquals(Set.of(), new FileBackupDeletionRegistry(damaged).marked());
+        assertThrows(IOException.class, () -> new FileBackupDeletionRegistry(future).marked());
+
+        try (Stream<Path> files = Files.list(temporaryDirectory)) {
+            assertEquals(1, files.filter(path -> path.getFileName().toString().startsWith("deleted.txt.corrupt-")).count());
+        }
+        assertEquals("worldarchive-deleted-backups-v2\n", Files.readString(future));
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/config/PathSafetyTest.java b/src/test/java/dev/ishaanko/worldarchive/config/PathSafetyTest.java
index 42199d4..61c59f0 100644
--- a/src/test/java/dev/ishaanko/worldarchive/config/PathSafetyTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/config/PathSafetyTest.java
@@ -3,14 +3,15 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
-import dev.ishaanko.worldarchive.model.DestinationHealth;
-import dev.ishaanko.worldarchive.model.DestinationType;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.List;
 import java.util.Optional;
+import org.junit.jupiter.api.Assumptions;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.condition.EnabledOnOs;
+import org.junit.jupiter.api.condition.OS;
 import org.junit.jupiter.api.io.TempDir;
 
 final class PathSafetyTest {
@@ -21,11 +22,24 @@ final class PathSafetyTest {
     void rejectsExistingAndMissingDestinationsInsideWorld() throws IOException {
         Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
         Path existing = Files.createDirectory(world.resolve("backups"));
+        List<Path> worlds = PathSafety.canonicalizeAll(List.of(world));
+
+        assertThrows(IOException.class, () -> PathSafety.requireOutsideWorlds(existing, worlds));
+        assertThrows(IOException.class, () -> PathSafety.requireOutsideWorlds(world.resolve("missing/nested"), worlds));
+    }
+
+    @Test
+    void rejectsADestinationThatReachesAWorldThroughALink() throws IOException {
+        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
+        Path link = temporaryDirectory.resolve("world-link");
+        try {
+            Files.createSymbolicLink(link, world);
+        } catch (IOException | UnsupportedOperationException exception) {
+            Assumptions.abort("Symbolic links are not available: " + exception.getMessage());
+        }
 
-        assertThrows(IOException.class, () -> PathSafety.requireOutsideWorlds(existing, List.of(world)));
         assertThrows(IOException.class, () -> PathSafety.requireOutsideWorlds(
-                world.resolve("missing/nested"),
-                List.of(world)));
+                link.resolve("backups"), PathSafety.canonicalizeAll(List.of(world))));
     }
 
     @Test
@@ -33,40 +47,33 @@ void allowsCanonicalSiblingDestination() throws IOException {
         Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
         Path sibling = temporaryDirectory.resolve("backups/new");
 
-        assertEquals(PathSafety.canonicalize(sibling), PathSafety.requireOutsideWorlds(sibling, List.of(world)));
+        assertEquals(
+                PathSafety.canonicalize(sibling),
+                PathSafety.requireOutsideWorlds(sibling, PathSafety.canonicalizeAll(List.of(world))));
     }
 
     @Test
     void validatesEveryConfiguredDestination() throws IOException {
         Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
         Path sibling = Files.createDirectory(temporaryDirectory.resolve("zips"));
-        WorldArchiveConfig unsafe = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                TriggerConfig.defaults(),
-                new GitDestinationConfig(true, Optional.of(world.resolve("git")), "origin", Optional.empty()),
-                new ZipDestinationConfig(true, Optional.of(sibling)));
+        WorldArchiveConfig unsafe = WorldArchiveConfig.defaults()
+                .withGit(GitDestinationConfig.defaults().withRepository(Optional.of(world.resolve("git"))))
+                .withZip(ZipDestinationConfig.defaults().withDestination(Optional.of(sibling)));
 
         assertThrows(IOException.class, () -> unsafe.validateDestinations(List.of(world)));
     }
 
+    /** A folder on a drive that is not connected must not stop the settings from loading. */
     @Test
-    void validatesHiddenLegacyGitRepositoryAgainstWorlds() throws IOException {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("legacy-world"));
-        WorldArchiveConfig unsafe = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                TriggerConfig.defaults(),
-                new GitDestinationConfig(
-                        true,
-                        Optional.of(temporaryDirectory.resolve("git-root")),
-                        "origin",
-                        Optional.empty(),
-                        DestinationTriggerConfig.defaults(),
-                        GitDestinationConfig.DEFAULT_LFS_PATTERNS,
-                        DestinationHealth.notChecked(DestinationType.GIT),
-                        Optional.of(world.resolve("legacy.git")),
-                        Optional.empty()),
-                ZipDestinationConfig.defaults());
+    @EnabledOnOs(OS.WINDOWS)
+    void aFolderOnAMissingDriveStaysAsWritten() throws IOException {
+        Optional<Character> missingDrive = "ZYXWVUTSRQPONMLKJIHGFED".chars()
+                .mapToObj(letter -> (char) letter)
+                .filter(letter -> !Files.exists(Path.of(letter + ":\\")))
+                .findFirst();
+        Assumptions.assumeTrue(missingDrive.isPresent(), "every drive letter is in use");
+        Path offline = Path.of(missingDrive.get() + ":\\WorldBackups");
 
-        assertThrows(IOException.class, () -> unsafe.validateDestinations(List.of(world)));
+        assertEquals(offline, PathSafety.canonicalize(offline));
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/config/RemoteUrlPolicyTest.java b/src/test/java/dev/ishaanko/worldarchive/config/RemoteUrlPolicyTest.java
index 5bb56f1..f46f9b1 100644
--- a/src/test/java/dev/ishaanko/worldarchive/config/RemoteUrlPolicyTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/config/RemoteUrlPolicyTest.java
@@ -1,12 +1,10 @@
 package dev.ishaanko.worldarchive.config;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.nio.file.Path;
-import java.util.UUID;
+import java.util.List;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
@@ -15,52 +13,41 @@ final class RemoteUrlPolicyTest {
     Path temporaryDirectory;
 
     @Test
-    void acceptsOnlyWhitelistedCredentialFreeForms() {
-        assertEquals(
+    void acceptsTheRemotesPlayersUse() {
+        List<String> remotes = List.of(
                 "https://example.invalid/team/backups.git",
-                RemoteUrlPolicy.validate("https://example.invalid/team/backups.git"));
-        assertEquals(
-                "git@example.invalid:team/backups.git",
-                RemoteUrlPolicy.validate("git@example.invalid:team/backups.git"));
-        String local = temporaryDirectory.resolve("remote.git").toString();
-        assertEquals(local, RemoteUrlPolicy.validate(local));
-        String shortName = temporaryDirectory.resolve("RUNNER~1/remote.git").toString();
-        assertEquals(shortName, RemoteUrlPolicy.validate(shortName));
+                "git@github.com:bob/Desk-and-chair-collection-2024.git",
+                "ssh://git@gitea.example.com:2222/bob/world.git",
+                "ssh://git@github.com/bob/world.git",
+                "gitea:bob/world.git",
+                "file:///srv/git/world.git",
+                temporaryDirectory.resolve("100% Backups/world.git").toString(),
+                temporaryDirectory.resolve("Basic Training Backups/world.git").toString(),
+                temporaryDirectory.resolve("Bob's Laptop & Co (2)/RUNNER~1/remote.git").toString());
+        for (String remote : remotes) {
+            assertEquals(remote, RemoteUrlPolicy.validateConfiguredPlain(remote));
+        }
     }
 
     @Test
-    void acceptsLocalPathsWithPunctuationAndRejectsUnsafeCharacters() {
-        String punctuated = temporaryDirectory.resolve("Bob's Laptop & Co (2)/remote.git").toString();
-
-        assertEquals(punctuated, RemoteUrlPolicy.validate(punctuated));
-        assertThrows(IllegalArgumentException.class, () -> RemoteUrlPolicy.validate(
-                temporaryDirectory.resolve("bad<name>.git").toString()));
-    }
-
-    @Test
-    void acceptsAndResolvesExactlyOneWorldIdPlaceholder() {
-        String template = "https://example.invalid/team/world-{worldId}.git";
-        UUID worldId = UUID.fromString("12345678-1234-1234-1234-123456789abc");
-
-        assertEquals(template, RemoteUrlPolicy.validate(template));
-        assertTrue(RemoteUrlPolicy.isWorldIdTemplate(template));
-        assertFalse(RemoteUrlPolicy.isWorldIdTemplate(
-                "https://example.invalid/team/shared.git"));
-        assertEquals(
-                "https://example.invalid/team/world-12345678-1234-1234-1234-123456789abc.git",
-                RemoteUrlPolicy.resolveWorldId(template, worldId));
-    }
-
-    @Test
-    void keepsPlainLegacyUrlsButRejectsAmbiguousTemplates() {
-        String plain = "https://example.invalid/team/legacy.git";
-
-        assertEquals(plain, RemoteUrlPolicy.validatePlain(plain));
-        assertThrows(IllegalArgumentException.class, () -> RemoteUrlPolicy.validate(
-                "https://example.invalid/{worldId}/{worldId}.git"));
-        assertThrows(IllegalArgumentException.class, () -> RemoteUrlPolicy.validatePlain(
-                "https://example.invalid/team/{worldId}.git"));
-        assertThrows(IllegalArgumentException.class, () -> RemoteUrlPolicy.resolveWorldId(plain, UUID.randomUUID()));
+    void rejectsCredentialsTokensAndUnapprovedForms() {
+        List<String> rejected = List.of(
+                "../relative.git",
+                "https://user:password@example.invalid/team/repository.git",
+                "https://token@example.invalid/team/repository.git",
+                "ssh://git:password@example.invalid/team/repository.git",
+                "https://example.invalid/team/repository.git?token=value",
+                "https://example.invalid/team/repository.git#main",
+                "https://example.invalid/ghp_abcdefghijklmnopqrstuvwxyz/repository.git",
+                "https://example.invalid/x_ghp_abcdefghijklmnopqrstuvwxyz/repository.git",
+                "https://example.invalid/ghp%5Fabcdefghijklmnopqrstuvwxyz/repository.git",
+                "https://example.invalid/ghp%255Fabcdefghijklmnopqrstuvwxyz/repository.git",
+                "git@example.invalid:glpat-abcdefghijklmnopqrstuvwxyz.git",
+                "git://example.invalid/team/archive.git",
+                temporaryDirectory.resolve("bad<name>.git").toString());
+        for (String remote : rejected) {
+            assertThrows(IllegalArgumentException.class, () -> RemoteUrlPolicy.validateConfiguredPlain(remote), remote);
+        }
     }
 
     @Test
@@ -68,28 +55,5 @@ void permitsTheReadOnlyGitProtocolOnlyForImports() {
         String importUrl = "git://example.invalid/team/archive.git";
 
         assertEquals(importUrl, RemoteUrlPolicy.validatePlain(importUrl));
-        assertThrows(
-                IllegalArgumentException.class,
-                () -> RemoteUrlPolicy.validate(importUrl));
-        assertThrows(
-                IllegalArgumentException.class,
-                () -> RemoteUrlPolicy.validateConfiguredPlain(importUrl));
-    }
-
-    @Test
-    void rejectsCredentialsTokensAndUnapprovedForms() {
-        assertThrows(IllegalArgumentException.class, () -> RemoteUrlPolicy.validate("../relative.git"));
-        assertThrows(IllegalArgumentException.class, () -> RemoteUrlPolicy.validate(
-                "https://user:password@example.invalid/team/repository.git"));
-        assertThrows(IllegalArgumentException.class, () -> RemoteUrlPolicy.validate(
-                "https://example.invalid/team/repository.git?token=value"));
-        assertThrows(IllegalArgumentException.class, () -> RemoteUrlPolicy.validate(
-                "https://example.invalid/ghp_abcdefghijklmnopqrstuvwxyz/repository.git"));
-        assertThrows(IllegalArgumentException.class, () -> RemoteUrlPolicy.validate(
-                "https://example.invalid/ghp%5Fabcdefghijklmnopqrstuvwxyz/repository.git"));
-        assertThrows(IllegalArgumentException.class, () -> RemoteUrlPolicy.validate(
-                "https://example.invalid/x_ghp_abcdefghijklmnopqrstuvwxyz/repository.git"));
-        assertThrows(IllegalArgumentException.class, () -> RemoteUrlPolicy.validate(
-                "https://example.invalid/ghp%255Fabcdefghijklmnopqrstuvwxyz/repository.git"));
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/config/WorldArchiveConfigStoreTest.java b/src/test/java/dev/ishaanko/worldarchive/config/WorldArchiveConfigStoreTest.java
index 283037a..249966c 100644
--- a/src/test/java/dev/ishaanko/worldarchive/config/WorldArchiveConfigStoreTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/config/WorldArchiveConfigStoreTest.java
@@ -2,570 +2,247 @@
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import com.google.gson.JsonObject;
 import com.google.gson.JsonParser;
+import dev.ishaanko.worldarchive.model.WorldId;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.time.Instant;
-import java.util.Arrays;
+import java.util.ArrayList;
+import java.util.List;
 import java.util.Optional;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
-import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
 final class WorldArchiveConfigStoreTest {
+    private static final String WORLD_ID = "12345678-1234-1234-1234-123456789abc";
+
     @TempDir
     Path temporaryDirectory;
 
     @Test
-    void defaultsMatchProductBehavior() throws IOException {
-        WorldArchiveConfig config = new WorldArchiveConfigStore(temporaryDirectory.resolve("missing.json"))
-                .load(java.util.List.of());
-
-        assertTrue(config.triggers().manualEnabled());
-        assertTrue(config.triggers().worldExitEnabled());
-        assertFalse(config.triggers().scheduledEnabled());
-        assertEquals(30, config.triggers().scheduleIntervalMinutes());
-        assertTrue(config.git().enabled());
-        assertTrue(config.zip().enabled());
-        assertEquals(
-                dev.ishaanko.worldarchive.model.DestinationHealthStatus.UNCONFIGURED,
-                config.git().health().status());
-        assertEquals(
-                dev.ishaanko.worldarchive.model.DestinationHealthStatus.UNCONFIGURED,
-                config.zip().health().status());
-    }
-
-    @Test
-    void roundTripsUtf8ConfigurationAtomically() throws IOException {
+    void roundTripsEverySettingAndStaysReadableByOlderVersions() throws IOException {
         Path gitRepository = Files.createDirectory(temporaryDirectory.resolve("git-世界"));
         Path zipDestination = Files.createDirectory(temporaryDirectory.resolve("zip-é"));
-        Path legacyGitRepository = Files.createDirectory(temporaryDirectory.resolve("legacy-git"));
         Path world = Files.createDirectory(temporaryDirectory.resolve("forever-world"));
         Path worldZip = Files.createDirectory(temporaryDirectory.resolve("forever-world-zips"));
-        Path file = temporaryDirectory.resolve("worldarchive.json");
-        WorldArchiveConfigStore store = new WorldArchiveConfigStore(file);
+        WorldArchiveConfigStore store = store();
         WorldArchiveConfig expected = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
                 new TriggerConfig(true, false, true, 45),
-                new GitDestinationConfig(
-                        true,
-                        Optional.of(gitRepository),
-                        "backup-origin",
-                        Optional.empty(),
-                        DestinationTriggerConfig.defaults(),
-                        GitDestinationConfig.DEFAULT_LFS_PATTERNS,
-                        dev.ishaanko.worldarchive.model.DestinationHealth.notChecked(
-                                dev.ishaanko.worldarchive.model.DestinationType.GIT),
-                        Optional.of(legacyGitRepository),
-                        Optional.of("ssh://example.invalid/legacy-backups.git")),
-                new ZipDestinationConfig(true, Optional.of(zipDestination)),
-                java.util.List.of(new WorldConfig(
-                        dev.ishaanko.worldarchive.model.WorldId.create(),
-                        true,
+                new GitDestinationConfig(true, Optional.of(gitRepository), "backup-origin",
+                        new DestinationTriggerConfig(true, false, false), List.of("*.mca", "*.nbt")),
+                new ZipDestinationConfig(false, Optional.of(zipDestination), new DestinationTriggerConfig(false, true, false)),
+                List.of(new WorldConfig(
+                        WorldId.create(),
+                        false,
                         world,
-                        Optional.of("ssh://example.invalid/forever-world.git"),
+                        Optional.of("ssh://git@example.invalid:2222/forever-world.git"),
                         Optional.of(worldZip),
                         new StoragePolicy(16L * 1_024 * 1_024 * 1_024, 5, 3, 9))));
 
-        store.save(expected, java.util.List.of(world));
-        WorldArchiveConfig canonicalExpected = expected.validateDestinations(java.util.List.of(world));
-        assertEquals(canonicalExpected, store.load(java.util.List.of(world)));
-        assertEquals(canonicalExpected, store.load(java.util.List.of(world)));
-        String serialized = Files.readString(file, StandardCharsets.UTF_8);
-        assertTrue(serialized.contains("git-世界"));
-        assertTrue(serialized.contains("\"repositoryRoot\""));
-        assertFalse(serialized.contains("\"remoteUrlTemplate\""));
-        assertTrue(serialized.contains("\"remoteUrl\": \"ssh://example.invalid/forever-world.git\""));
-        assertTrue(serialized.contains("\"zipDestination\": \""));
-        assertTrue(serialized.contains("\"legacySharedRepository\""));
-        assertTrue(serialized.contains("\"legacyRemoteUrl\""));
-        assertTrue(serialized.contains("\"storage\""));
-        assertFalse(serialized.contains("\"repository\":"));
-        assertFalse(serialized.toLowerCase().contains("password"));
-    }
+        WorldArchiveConfig saved = store.update(ignored -> expected, List.of(world));
 
-    @Test
-    void schemaFourRejectsPlainRemoteUrlTemplate() throws IOException {
-        Path file = temporaryDirectory.resolve("plain-current-remote.json");
-        WorldArchiveConfigStore store = new WorldArchiveConfigStore(file);
-        WorldArchiveConfig defaults = WorldArchiveConfig.defaults();
-        Path world = Files.createDirectory(temporaryDirectory.resolve("schema-four-world"));
-        WorldArchiveConfig current = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                defaults.triggers(),
-                defaults.git(),
-                defaults.zip(),
-                java.util.List.of(new WorldConfig(
-                        dev.ishaanko.worldarchive.model.WorldId.create(),
-                        true,
-                        world)));
-        store.save(current, java.util.List.of(world));
-        String invalid = Files.readString(file, StandardCharsets.UTF_8)
-                .replace(
-                        "\"schemaVersion\": " + WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                        "\"schemaVersion\": 4")
-                .replace(
-                        "\"remoteName\": \"origin\",",
-                        "\"remoteName\": \"origin\",\n      \"remoteUrlTemplate\": \"https://example.invalid/shared.git\",");
-        Files.writeString(file, invalid, StandardCharsets.UTF_8);
-
-        ConfigurationException exception = assertThrows(
-                ConfigurationException.class,
-                () -> store.load(java.util.List.of()));
-
-        assertTrue(exception.getMessage().contains("{worldId}"));
+        assertEquals(expected.canonicalize(), saved);
+        assertEquals(saved, store().load());
+        JsonObject destinations = written().getAsJsonObject("destinations");
+        // WorldArchive 0.3.9 refuses a destination without "health", and replaces unreadable settings.
+        assertTrue(destinations.getAsJsonObject("git").has("health"));
+        assertTrue(destinations.getAsJsonObject("zip").has("health"));
     }
 
     @Test
-    void migratesSchemaFourKeepingEachWorldZipFolder() throws IOException {
-        Path file = temporaryDirectory.resolve("schema-four-zip.json");
-        Path world = Files.createDirectory(temporaryDirectory.resolve("zip-override-world"));
-        Path override = Files.createDirectory(temporaryDirectory.resolve("world-zips"));
-        WorldArchiveConfig defaults = WorldArchiveConfig.defaults();
-        WorldArchiveConfig current = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                defaults.triggers(),
-                defaults.git(),
-                defaults.zip(),
-                java.util.List.of(new WorldConfig(
-                        dev.ishaanko.worldarchive.model.WorldId.create(),
-                        true,
-                        world,
-                        Optional.empty(),
-                        Optional.of(override),
-                        StoragePolicy.defaults())));
-        WorldArchiveConfigStore store = new WorldArchiveConfigStore(file);
-        store.save(current, java.util.List.of(world));
-        Files.writeString(file, Files.readString(file, StandardCharsets.UTF_8).replace(
-                "\"schemaVersion\": " + WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                "\"schemaVersion\": 4"), StandardCharsets.UTF_8);
-
-        WorldArchiveConfig migrated = store.load(java.util.List.of(world));
-
-        assertEquals(override.toRealPath(), migrated.worlds().getFirst().zipDestination().orElseThrow());
-    }
-
-    @Test
-    void migratesSchemaFourTemplateToEachExistingWorld() throws IOException {
-        Path file = temporaryDirectory.resolve("schema-four-template.json");
-        Path world = Files.createDirectory(temporaryDirectory.resolve("migrated-world"));
-        dev.ishaanko.worldarchive.model.WorldId worldId =
-                dev.ishaanko.worldarchive.model.WorldId.create();
-        WorldArchiveConfig defaults = WorldArchiveConfig.defaults();
-        WorldArchiveConfig current = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                defaults.triggers(),
-                defaults.git(),
-                defaults.zip(),
-                java.util.List.of(new WorldConfig(worldId, true, world)));
-        WorldArchiveConfigStore store = new WorldArchiveConfigStore(file);
-        store.save(current, java.util.List.of(world));
-        String schemaFour = Files.readString(file, StandardCharsets.UTF_8)
-                .replace(
-                        "\"schemaVersion\": " + WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                        "\"schemaVersion\": 4")
-                .replace(
-                        "\"remoteName\": \"origin\",",
-                        "\"remoteName\": \"origin\",\n"
-                                + "      \"remoteUrlTemplate\": "
-                                + "\"https://example.invalid/world-{worldId}.git\",");
-        Files.writeString(file, schemaFour, StandardCharsets.UTF_8);
-
-        WorldArchiveConfig migrated = store.load(java.util.List.of(world));
-
-        assertTrue(migrated.git().remoteUrl().isEmpty());
-        assertEquals(
-                "https://example.invalid/world-" + worldId + ".git",
-                migrated.worlds().getFirst().remoteUrl().orElseThrow());
-        String persisted = Files.readString(file, StandardCharsets.UTF_8);
-        assertTrue(persisted.contains(
-                "\"schemaVersion\": " + WorldArchiveConfig.CURRENT_SCHEMA_VERSION));
-        assertFalse(persisted.contains("remoteUrlTemplate"));
+    void defaultFoldersAreFilledInButNeverStored() throws IOException {
+        WorldArchiveConfig loaded = store().load();
+        Path storageRoot = temporaryDirectory.toRealPath().resolve("worldarchive");
+        assertEquals(Optional.of(storageRoot.resolve("git")), loaded.git().repository());
+        assertEquals(Optional.of(storageRoot.resolve("archives")), loaded.zip().destination());
+
+        store().update(config -> new WorldArchiveConfig(
+                new TriggerConfig(true, true, true, 60), config.git(), config.zip(), config.worlds()), List.of());
+
+        JsonObject destinations = written().getAsJsonObject("destinations");
+        assertFalse(destinations.getAsJsonObject("git").has("repositoryRoot"));
+        assertFalse(destinations.getAsJsonObject("zip").has("destination"));
+        Path copiedGame = Files.createDirectory(temporaryDirectory.resolve("copied-instance"));
+        Path copiedConfig = Files.createDirectory(copiedGame.resolve("config")).resolve("worldarchive.json");
+        Files.copy(configFile(), copiedConfig);
+        WorldArchiveConfig copied = new WorldArchiveConfigStore(
+                copiedConfig, new DefaultDestinations(copiedGame.resolve("worldarchive"))).load();
+        assertEquals(Optional.of(copiedGame.toRealPath().resolve("worldarchive/git")), copied.git().repository());
     }
 
+    /**
+     * The default folders are links to a USB drive that is not connected. The settings still load
+     * and an unreadable file can still be reset; only a backup to such a folder fails, on its own.
+     */
     @Test
-    void migratesSchemaSixWorldsToDefaultStoragePolicy() throws IOException {
-        Path file = temporaryDirectory.resolve("schema-six.json");
-        Path world = Files.createDirectory(temporaryDirectory.resolve("schema-six-world"));
-        WorldArchiveConfig current = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                TriggerConfig.defaults(),
-                GitDestinationConfig.defaults(),
-                ZipDestinationConfig.defaults(),
-                java.util.List.of(new WorldConfig(
-                        dev.ishaanko.worldarchive.model.WorldId.create(),
-                        true,
-                        world)));
-        WorldArchiveConfigStore store = new WorldArchiveConfigStore(file);
-        store.save(current, java.util.List.of(world));
-        JsonObject schemaSix = JsonParser.parseString(
-                        Files.readString(file, StandardCharsets.UTF_8))
-                .getAsJsonObject();
-        schemaSix.addProperty("schemaVersion", 6);
-        schemaSix.getAsJsonArray("worlds")
-                .get(0)
-                .getAsJsonObject()
-                .remove("storage");
-        Files.writeString(file, schemaSix + System.lineSeparator(), StandardCharsets.UTF_8);
-
-        WorldArchiveConfig migrated = store.load(java.util.List.of(world));
-
-        assertEquals(
-                StoragePolicy.defaults(),
-                migrated.worlds().getFirst().storagePolicy());
-        JsonObject persisted = JsonParser.parseString(
-                        Files.readString(file, StandardCharsets.UTF_8))
-                .getAsJsonObject();
-        assertEquals(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                persisted.get("schemaVersion").getAsInt());
-        assertTrue(persisted.getAsJsonArray("worlds")
-                .get(0)
-                .getAsJsonObject()
-                .has("storage"));
+    void defaultFoldersLinkedToAnOfflineDriveLeaveTheSettingsReadable() throws IOException {
+        Path drive = Files.createDirectories(temporaryDirectory.resolve("usb-drive"));
+        Path storage = Files.createDirectories(temporaryDirectory.resolve("worldarchive"));
+        link(storage.resolve("git"), Files.createDirectories(drive.resolve("git")));
+        link(storage.resolve("archives"), Files.createDirectories(drive.resolve("archives")));
+        store().load();
+        Files.move(drive, temporaryDirectory.resolve("unplugged"));
+
+        WorldArchiveConfig loaded = store().load();
+        Files.writeString(configFile(), "{\"schemaVersion\": 7,", StandardCharsets.UTF_8);
+        Optional<WorldArchiveConfigStore.Reset> reset = store().reset(config -> config, List.of(), Instant.EPOCH);
+
+        assertEquals(Optional.of(storage.resolve("git")), loaded.git().repository());
+        assertTrue(reset.isPresent());
+        assertEquals(loaded.zip().destination(), store().load().zip().destination());
     }
 
     @Test
-    void rejectsMissingOrInvalidCurrentStoragePolicy() throws IOException {
-        Path file = temporaryDirectory.resolve("invalid-storage.json");
-        Path world = Files.createDirectory(temporaryDirectory.resolve("invalid-storage-world"));
-        WorldArchiveConfig current = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                TriggerConfig.defaults(),
-                GitDestinationConfig.defaults(),
-                ZipDestinationConfig.defaults(),
-                java.util.List.of(new WorldConfig(
-                        dev.ishaanko.worldarchive.model.WorldId.create(),
-                        true,
-                        world)));
-        WorldArchiveConfigStore store = new WorldArchiveConfigStore(file);
-        store.save(current, java.util.List.of(world));
-        JsonObject encoded = JsonParser.parseString(
-                        Files.readString(file, StandardCharsets.UTF_8))
-                .getAsJsonObject();
-        JsonObject encodedWorld = encoded.getAsJsonArray("worlds")
-                .get(0)
-                .getAsJsonObject();
-        JsonObject storage = encodedWorld.remove("storage").getAsJsonObject();
-        Files.writeString(file, encoded + System.lineSeparator(), StandardCharsets.UTF_8);
-        assertThrows(
-                ConfigurationException.class,
-                () -> store.load(java.util.List.of(world)));
-
-        storage.addProperty("budgetBytes", -1);
-        encodedWorld.add("storage", storage);
-        Files.writeString(file, encoded + System.lineSeparator(), StandardCharsets.UTF_8);
-        assertThrows(
-                ConfigurationException.class,
-                () -> store.load(java.util.List.of(world)));
-    }
-
-    @Test
-    void refusesMalformedAndFutureConfiguration() throws IOException {
-        Path file = temporaryDirectory.resolve("worldarchive.json");
-        WorldArchiveConfigStore store = new WorldArchiveConfigStore(file);
-
-        Files.writeString(file, "{not-json", StandardCharsets.UTF_8);
-        assertThrows(ConfigurationException.class, () -> store.load(java.util.List.of()));
-
-        Files.writeString(file, "{}", StandardCharsets.UTF_8);
-        assertThrows(ConfigurationException.class, () -> store.load(java.util.List.of()));
-
-        Files.writeString(file, "{\"schemaVersion\":999}", StandardCharsets.UTF_8);
-        UnsupportedSchemaVersionException exception = assertThrows(
-                UnsupportedSchemaVersionException.class,
-                () -> store.load(java.util.List.of()));
-        assertEquals(999, exception.schemaVersion());
-
-        Files.writeString(file, "{\"schemaVersion\":1.5}", StandardCharsets.UTF_8);
-        assertThrows(ConfigurationException.class, () -> store.load(java.util.List.of()));
-    }
-
-    @Test
-    void migratesLegacyConfigurationAndPersistsCurrentSchema() throws IOException {
-        Path zipDestination = Files.createDirectory(temporaryDirectory.resolve("legacy-zips"));
-        Path file = temporaryDirectory.resolve("worldarchive.json");
-        String legacy = """
-                {
-                  "manualBackups": false,
-                  "exitBackups": true,
-                  "scheduleEnabled": true,
-                  "scheduleMinutes": 60,
-                  "gitEnabled": false,
-                  "zipEnabled": true,
-                  "zipDestination": "%s"
-                }
-                """.formatted(jsonPath(zipDestination));
-        Files.writeString(file, legacy, StandardCharsets.UTF_8);
-
-        WorldArchiveConfig migrated = new WorldArchiveConfigStore(file).load(java.util.List.of());
-
-        assertEquals(WorldArchiveConfig.CURRENT_SCHEMA_VERSION, migrated.schemaVersion());
-        assertFalse(migrated.triggers().manualEnabled());
-        assertEquals(60, migrated.triggers().scheduleIntervalMinutes());
-        assertFalse(migrated.git().enabled());
-        assertEquals(zipDestination.toRealPath(), migrated.zip().destination().orElseThrow());
-        assertTrue(Files.readString(file, StandardCharsets.UTF_8).contains(
-                "\"schemaVersion\": " + WorldArchiveConfig.CURRENT_SCHEMA_VERSION));
-    }
-
-    @Test
-    void migratesSchemaThreeGitStorageWithoutMovingOrDeletingIt() throws IOException {
-        Path legacyGit = Files.createDirectory(temporaryDirectory.resolve("legacy-shared.git"));
-        Path zip = Files.createDirectory(temporaryDirectory.resolve("schema-three-zips"));
-        Path file = temporaryDirectory.resolve("schema-three.json");
-        Files.writeString(file, """
+    void upgradesAVersion031FileAndKeepsTheOriginal() throws IOException {
+        Path gameFolder = temporaryDirectory.toRealPath();
+        Path world = Files.createDirectories(gameFolder.resolve("saves/World"));
+        String original = """
                 {
-                  "schemaVersion": 3,
-                  "triggers": {
-                    "manualEnabled": true,
-                    "worldExitEnabled": true,
-                    "scheduledEnabled": false,
-                    "scheduleIntervalMinutes": 30
-                  },
+                  "schemaVersion": 6,
+                  "triggers": {"manualEnabled": true, "worldExitEnabled": true, "scheduledEnabled": false,
+                    "scheduleIntervalMinutes": 30},
                   "destinations": {
                     "git": {
                       "enabled": true,
-                      "repository": "%s",
+                      "repositoryRoot": "%s",
                       "remoteName": "origin",
-                      "remoteUrl": "https://example.invalid/legacy.git",
-                      "triggers": {
-                        "manualEnabled": true,
-                        "worldExitEnabled": true,
-                        "scheduledEnabled": false
-                      },
-                      "lfsPatterns": ["*.mca"],
-                      "health": {
-                        "status": "HEALTHY",
-                        "message": "legacy repository was ready",
-                        "checkedAt": "2026-07-17T12:00:00Z"
-                      }
+                      "triggers": {"manualEnabled": true, "worldExitEnabled": true, "scheduledEnabled": true},
+                      "lfsPatterns": ["*.mca", "*.mcr", "*.dat", "*.dat_old", "*.nbt", "*.zip"],
+                      "health": {"status": "HEALTHY", "message": "Git git version 2.45.1 | LFS git-lfs/3.5.1",
+                        "checkedAt": "2026-08-01T10:00:00Z"}
                     },
                     "zip": {
                       "enabled": true,
                       "destination": "%s",
-                      "triggers": {
-                        "manualEnabled": true,
-                        "worldExitEnabled": true,
-                        "scheduledEnabled": false
-                      },
-                      "health": {
-                        "status": "HEALTHY",
-                        "message": "ZIP folder is ready",
-                        "checkedAt": "2026-07-17T12:00:00Z"
-                      }
+                      "triggers": {"manualEnabled": true, "worldExitEnabled": true, "scheduledEnabled": true},
+                      "health": {"status": "HEALTHY", "message": "ZIP archive folder is ready",
+                        "checkedAt": "2026-08-01T10:00:00Z"}
                     }
                   },
-                  "worlds": []
+                  "worlds": [
+                    {"worldId": "%s", "enabled": true, "path": "%s", "remoteUrl": "git@github.com:player/world.git"}
+                  ]
                 }
-                """.formatted(jsonPath(legacyGit), jsonPath(zip)), StandardCharsets.UTF_8);
-
-        WorldArchiveConfig migrated = new WorldArchiveConfigStore(file).load(java.util.List.of());
-
-        assertEquals(WorldArchiveConfig.CURRENT_SCHEMA_VERSION, migrated.schemaVersion());
-        assertTrue(migrated.git().repository().isEmpty());
-        assertTrue(migrated.git().remoteUrl().isEmpty());
-        assertEquals(legacyGit.toRealPath(), migrated.git().legacyRepository().orElseThrow());
-        assertEquals(
-                "https://example.invalid/legacy.git",
-                migrated.git().legacyRemoteUrl().orElseThrow());
-        assertEquals(
-                dev.ishaanko.worldarchive.model.DestinationHealth.notChecked(
-                        dev.ishaanko.worldarchive.model.DestinationType.GIT),
-                migrated.git().health());
-        assertTrue(Files.isDirectory(legacyGit));
-        String persisted = Files.readString(file, StandardCharsets.UTF_8);
-        assertTrue(persisted.contains(
-                "\"schemaVersion\": " + WorldArchiveConfig.CURRENT_SCHEMA_VERSION));
-        assertTrue(persisted.contains("\"legacySharedRepository\""));
-        assertFalse(persisted.contains("\"repository\":"));
+                """.formatted(
+                        json(gameFolder.resolve("worldarchive/git")),
+                        json(gameFolder.resolve("worldarchive/archives")),
+                        WORLD_ID,
+                        json(world));
+        Files.createDirectories(configFile().getParent());
+        Files.writeString(configFile(), original, StandardCharsets.UTF_8);
+
+        WorldArchiveConfig upgraded = store().load();
+
+        WorldConfig upgradedWorld = upgraded.worlds().getFirst();
+        assertEquals(StoragePolicy.defaults(), upgradedWorld.storagePolicy());
+        assertEquals(Optional.of("git@github.com:player/world.git"), upgradedWorld.remoteUrl());
+        assertEquals(original, Files.readString(backup(6), StandardCharsets.UTF_8));
+        JsonObject written = written();
+        assertEquals(WorldArchiveConfig.CURRENT_SCHEMA_VERSION, written.get("schemaVersion").getAsInt());
+        assertFalse(written.getAsJsonObject("destinations").getAsJsonObject("git").has("repositoryRoot"));
+        assertEquals(upgraded, store().load());
     }
 
     @Test
-    void ignoresOrphanedPartialWriteAndKeepsLastPublishedValue() throws IOException {
-        Path file = temporaryDirectory.resolve("worldarchive.json");
-        WorldArchiveConfigStore store = new WorldArchiveConfigStore(file);
-        store.save(WorldArchiveConfig.defaults(), java.util.List.of());
-        Files.writeString(
-                temporaryDirectory.resolve(".worldarchive.json.interrupted.tmp"),
-                "{\"schemaVersion\":999}",
-                StandardCharsets.UTF_8);
-
-        assertEquals(WorldArchiveConfig.defaults(), store.load(java.util.List.of()));
-    }
-
-    @Test
-    void rejectsCredentialBearingConfiguration() throws IOException {
-        assertThrows(IllegalArgumentException.class, () -> new GitDestinationConfig(
-                true,
-                Optional.empty(),
-                "origin",
-                Optional.of("https://user:password@example.invalid/repository.git")));
-
-        Path file = temporaryDirectory.resolve("worldarchive.json");
-        Files.writeString(
-                file,
-                "{\"schemaVersion\":1,\"accessToken\":\"never\"}",
-                StandardCharsets.UTF_8);
-        assertThrows(
-                ConfigurationException.class,
-                () -> new WorldArchiveConfigStore(file).load(java.util.List.of()));
-
-        Files.writeString(
-                file,
-                "{\"schemaVersion\":2,\"extensions\":[{\"accessToken\":\"never\"}]}",
-                StandardCharsets.UTF_8);
-        assertThrows(
-                ConfigurationException.class,
-                () -> new WorldArchiveConfigStore(file).load(java.util.List.of()));
-    }
-
-    @Test
-    void saveRejectsDestinationInsideKnownWorld() throws IOException {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
-        WorldArchiveConfig config = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                TriggerConfig.defaults(),
-                new GitDestinationConfig(
-                        true,
-                        Optional.of(world.resolve("repository")),
-                        "origin",
-                        Optional.empty()),
-                ZipDestinationConfig.defaults());
-
-        WorldArchiveConfigStore store = new WorldArchiveConfigStore(temporaryDirectory.resolve("worldarchive.json"));
-        assertThrows(IOException.class, () -> store.save(config, java.util.List.of(world)));
-        assertFalse(Files.exists(store.file()));
-    }
-
-    @Test
-    void noUnsafeSaveOverloadExists() {
-        assertFalse(Arrays.stream(WorldArchiveConfigStore.class.getMethods())
-                .anyMatch(method -> method.getName().equals("save") && method.getParameterCount() == 1));
-    }
-
-    @Test
-    void roundTripsPerDestinationAndPerWorldSettings() throws IOException {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("configured-world"));
-        Path git = Files.createDirectory(temporaryDirectory.resolve("configured-git"));
-        Path zip = Files.createDirectory(temporaryDirectory.resolve("configured-zip"));
-        WorldArchiveConfig expected = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                TriggerConfig.defaults(),
-                new GitDestinationConfig(
-                        true,
-                        Optional.of(git),
-                        "origin",
-                        Optional.empty(),
-                        new DestinationTriggerConfig(true, false, false),
-                        java.util.List.of("*.mca", "*.nbt"),
-                        new dev.ishaanko.worldarchive.model.DestinationHealth(
-                                dev.ishaanko.worldarchive.model.DestinationType.GIT,
-                                dev.ishaanko.worldarchive.model.DestinationHealthStatus.HEALTHY,
-                                "Git and LFS are ready",
-                                Instant.parse("2026-07-17T12:00:00Z"))),
-                new ZipDestinationConfig(
-                        true,
-                        Optional.of(zip),
-                        new DestinationTriggerConfig(false, true, false),
-                        new dev.ishaanko.worldarchive.model.DestinationHealth(
-                                dev.ishaanko.worldarchive.model.DestinationType.ZIP,
-                                dev.ishaanko.worldarchive.model.DestinationHealthStatus.DEGRADED,
-                                "Desktop sync is paused",
-                                Instant.parse("2026-07-17T12:01:00Z"))),
-                java.util.List.of(new WorldConfig(
-                        dev.ishaanko.worldarchive.model.WorldId.create(),
-                        false,
-                        world)));
-        WorldArchiveConfigStore store = new WorldArchiveConfigStore(temporaryDirectory.resolve("settings.json"));
-
-        store.save(expected, java.util.List.of(world));
-
-        assertEquals(
-                expected.validateDestinations(java.util.List.of(world)),
-                store.load(java.util.List.of(world)));
-    }
-
-    @Test
-    void migratesSchemaTwoWithDefaultHealthForBothDestinations() throws IOException {
-        Path file = temporaryDirectory.resolve("schema-two.json");
-        Files.writeString(file, """
+    void upgradesAVersion013RemoteTemplateToEachWorld() throws IOException {
+        Path world = Files.createDirectories(temporaryDirectory.resolve("saves/World"));
+        Files.createDirectories(configFile().getParent());
+        Files.writeString(configFile(), """
                 {
-                  "schemaVersion": 2,
-                  "triggers": {
-                    "manualEnabled": true,
-                    "worldExitEnabled": true,
-                    "scheduledEnabled": false,
-                    "scheduleIntervalMinutes": 30
-                  },
+                  "schemaVersion": 4,
+                  "triggers": {"manualEnabled": true, "worldExitEnabled": true, "scheduledEnabled": false,
+                    "scheduleIntervalMinutes": 30},
                   "destinations": {
                     "git": {
                       "enabled": true,
                       "remoteName": "origin",
-                      "triggers": {
-                        "manualEnabled": true,
-                        "worldExitEnabled": true,
-                        "scheduledEnabled": true
-                      },
-                      "lfsPatterns": ["*.mca"]
+                      "remoteUrlTemplate": "https://example.invalid/world-{worldId}.git",
+                      "triggers": {"manualEnabled": true, "worldExitEnabled": true, "scheduledEnabled": true},
+                      "lfsPatterns": ["*.mca"],
+                      "health": {"status": "UNCONFIGURED", "message": "Not checked", "checkedAt": "1970-01-01T00:00:00Z"}
                     },
                     "zip": {
                       "enabled": true,
-                      "triggers": {
-                        "manualEnabled": true,
-                        "worldExitEnabled": true,
-                        "scheduledEnabled": true
-                      }
+                      "triggers": {"manualEnabled": true, "worldExitEnabled": true, "scheduledEnabled": true},
+                      "health": {"status": "UNCONFIGURED", "message": "Not checked", "checkedAt": "1970-01-01T00:00:00Z"}
                     }
                   },
-                  "worlds": []
+                  "worlds": [{"worldId": "%s", "enabled": true, "path": "%s"}]
                 }
-                """, StandardCharsets.UTF_8);
+                """.formatted(WORLD_ID, json(world)), StandardCharsets.UTF_8);
 
-        WorldArchiveConfig migrated = new WorldArchiveConfigStore(file).load(java.util.List.of());
+        WorldArchiveConfig upgraded = store().load();
 
-        assertEquals(WorldArchiveConfig.CURRENT_SCHEMA_VERSION, migrated.schemaVersion());
-        assertEquals(
-                dev.ishaanko.worldarchive.model.DestinationHealth.notChecked(
-                        dev.ishaanko.worldarchive.model.DestinationType.GIT),
-                migrated.git().health());
         assertEquals(
-                dev.ishaanko.worldarchive.model.DestinationHealth.notChecked(
-                        dev.ishaanko.worldarchive.model.DestinationType.ZIP),
-                migrated.zip().health());
-        assertTrue(Files.readString(file, StandardCharsets.UTF_8).contains("\"health\""));
+                Optional.of("https://example.invalid/world-" + WORLD_ID + ".git"),
+                upgraded.worlds().getFirst().remoteUrl());
+        assertTrue(Files.isRegularFile(backup(4)));
+    }
+
+    @Test
+    void refusesFilesItCannotReadAndLeavesThemAsTheyAre() throws IOException {
+        Files.createDirectories(configFile().getParent());
+        List<String> unreadable = List.of(
+                "{not-json",
+                "{}",
+                "{\"schemaVersion\":1.5}",
+                "{\"schemaVersion\":7,\"triggers\":{},\"destinations\":{},\"worlds\":[]}",
+                "{\"schemaVersion\":7,\"accessToken\":\"never\"}",
+                validFileWithoutStoragePolicy(),
+                validFileWithoutStoragePolicy().replace("\"worlds\"", "\"unused\""));
+        for (String text : unreadable) {
+            Files.writeString(configFile(), text, StandardCharsets.UTF_8);
+
+            assertThrows(UnreadableConfigurationException.class, () -> store().load(), text);
+            assertThrows(UnreadableConfigurationException.class, () -> store().update(config -> config, List.of()), text);
+            assertEquals(text, Files.readString(configFile(), StandardCharsets.UTF_8));
+        }
+    }
+
+    @Test
+    void refusesNewerAndPreReleaseSchemasWithoutChangingThem() throws IOException {
+        Files.createDirectories(configFile().getParent());
+        for (int schemaVersion : new int[] {3, 99}) {
+            String text = "{\"schemaVersion\": " + schemaVersion + "}";
+            Files.writeString(configFile(), text, StandardCharsets.UTF_8);
+
+            UnreadableConfigurationException failure = assertThrows(UnreadableConfigurationException.class,
+                    () -> store().load());
+
+            UnsupportedSchemaVersionException schema = assertInstanceOf(
+                    UnsupportedSchemaVersionException.class, failure.getCause());
+            assertEquals(schemaVersion > WorldArchiveConfig.CURRENT_SCHEMA_VERSION, schema.newer());
+            assertEquals(text, Files.readString(configFile(), StandardCharsets.UTF_8));
+            assertFalse(Files.exists(backup(schemaVersion)));
+        }
     }
 
     @Test
-    void concurrentStoreInstancesPublishOnlyCompleteJson() throws Exception {
-        Path file = temporaryDirectory.resolve("concurrent.json");
-        WorldArchiveConfigStore firstStore = new WorldArchiveConfigStore(file);
-        WorldArchiveConfigStore secondStore = new WorldArchiveConfigStore(file);
-        WorldArchiveConfig first = WorldArchiveConfig.defaults();
-        WorldArchiveConfig second = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                new TriggerConfig(false, true, false, 30),
-                GitDestinationConfig.defaults(),
-                ZipDestinationConfig.defaults());
+    void concurrentStoresPublishOnlyCompleteFilesAndKeepEachChange() throws Exception {
         ExecutorService executor = Executors.newFixedThreadPool(8);
         try {
-            java.util.List<Future<?>> writes = new java.util.ArrayList<>();
-            for (int index = 0; index < 32; index++) {
-                WorldArchiveConfig value = index % 2 == 0 ? first : second;
-                WorldArchiveConfigStore target = index % 2 == 0 ? firstStore : secondStore;
-                writes.add(executor.submit(() -> {
-                    target.save(value, java.util.List.of());
-                    return null;
-                }));
+            List<Future<?>> writes = new ArrayList<>();
+            for (int index = 1; index <= 32; index++) {
+                int minutes = index;
+                writes.add(executor.submit(() -> store().update(
+                        config -> new WorldArchiveConfig(
+                                new TriggerConfig(true, true, true,
+                                        Math.max(config.triggers().scheduleIntervalMinutes(), minutes)),
+                                config.git(),
+                                config.zip(),
+                                config.worlds()),
+                        List.of())));
             }
             for (Future<?> write : writes) {
                 write.get();
@@ -574,26 +251,49 @@ void concurrentStoreInstancesPublishOnlyCompleteJson() throws Exception {
             executor.shutdownNow();
         }
 
-        WorldArchiveConfig loaded = firstStore.load(java.util.List.of());
-        assertTrue(loaded.equals(first) || loaded.equals(second));
+        assertEquals(32, store().load().triggers().scheduleIntervalMinutes());
     }
 
-    @Test
-    void rejectsSymbolicLinkLockFile() throws IOException {
-        Path file = temporaryDirectory.resolve("locked.json");
-        WorldArchiveConfigStore store = new WorldArchiveConfigStore(file);
-        Path target = Files.createFile(temporaryDirectory.resolve("lock-target"));
-        Path lock = file.resolveSibling(file.getFileName() + ".lock");
+    private static void link(Path link, Path target) throws IOException {
         try {
-            Files.createSymbolicLink(lock, target);
+            Files.createSymbolicLink(link, target);
         } catch (UnsupportedOperationException | IOException exception) {
-            Assumptions.assumeTrue(false, "Symbolic links unavailable: " + exception.getMessage());
+            Assumptions.abort("Symbolic links are unavailable: " + exception.getMessage());
         }
+    }
+
+    private WorldArchiveConfigStore store() {
+        return new WorldArchiveConfigStore(configFile(), new DefaultDestinations(temporaryDirectory.resolve("worldarchive")));
+    }
+
+    private Path configFile() {
+        return temporaryDirectory.resolve("config/worldarchive.json");
+    }
+
+    private Path backup(int schemaVersion) {
+        return configFile().resolveSibling("worldarchive.json.schema" + schemaVersion + ".bak");
+    }
+
+    private JsonObject written() throws IOException {
+        return JsonParser.parseString(Files.readString(configFile(), StandardCharsets.UTF_8)).getAsJsonObject();
+    }
 
-        assertThrows(ConfigurationException.class, () -> store.load(java.util.List.of()));
+    private String validFileWithoutStoragePolicy() {
+        return """
+                {"schemaVersion": 7,
+                 "triggers": {"manualEnabled": true, "worldExitEnabled": true, "scheduledEnabled": false,
+                   "scheduleIntervalMinutes": 30},
+                 "destinations": {
+                   "git": {"enabled": true, "remoteName": "origin",
+                     "triggers": {"manualEnabled": true, "worldExitEnabled": true, "scheduledEnabled": true},
+                     "lfsPatterns": ["*.mca"]},
+                   "zip": {"enabled": true,
+                     "triggers": {"manualEnabled": true, "worldExitEnabled": true, "scheduledEnabled": true}}},
+                 "worlds": [{"worldId": "%s", "enabled": true, "path": "%s"}]}
+                """.formatted(WORLD_ID, json(temporaryDirectory.resolve("saves/World")));
     }
 
-    private static String jsonPath(Path path) {
+    private static String json(Path path) {
         return path.toString().replace("\\", "\\\\").replace("\"", "\\\"");
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/config/WorldIdentityStoreTest.java b/src/test/java/dev/ishaanko/worldarchive/config/WorldIdentityStoreTest.java
index 6eec136..4d060c8 100644
--- a/src/test/java/dev/ishaanko/worldarchive/config/WorldIdentityStoreTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/config/WorldIdentityStoreTest.java
@@ -20,7 +20,6 @@
 import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
 import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.Assumptions;
 import org.junit.jupiter.api.io.TempDir;
 
 final class WorldIdentityStoreTest {
@@ -114,23 +113,6 @@ void futureIdentitySchemaFailsWithoutReplacement() throws IOException {
         assertEquals(future, Files.readString(identity, StandardCharsets.UTF_8));
     }
 
-    @Test
-    void rejectsSymbolicIdentityAndLockFiles() throws IOException {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("linked-world"));
-        Path metadata = Files.createDirectory(world.resolve(".worldarchive"));
-        Path target = Files.createFile(temporaryDirectory.resolve("identity-target"));
-        Path identity = metadata.resolve("world.json");
-        try {
-            Files.createSymbolicLink(identity, target);
-        } catch (UnsupportedOperationException | IOException exception) {
-            Assumptions.assumeTrue(false, "Symbolic links unavailable: " + exception.getMessage());
-        }
-        assertThrows(IOException.class, () -> new WorldIdentityStore().loadOrCreateIdentity(world));
-        Files.delete(identity);
-        Files.createSymbolicLink(metadata.resolve("world.json.lock"), target);
-        assertThrows(IOException.class, () -> new WorldIdentityStore().loadOrCreateIdentity(world));
-    }
-
     private static WorldId get(Future<WorldId> future) throws InterruptedException, ExecutionException {
         return future.get();
     }
diff --git a/src/test/java/dev/ishaanko/worldarchive/core/AtomicFilesTest.java b/src/test/java/dev/ishaanko/worldarchive/core/AtomicFilesTest.java
deleted file mode 100644
index 06eec0a..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/core/AtomicFilesTest.java
+++ /dev/null
@@ -1,78 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import org.junit.jupiter.api.Assumptions;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-final class AtomicFilesTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void rejectsMalformedUtf8() throws IOException {
-        Path source = Files.write(
-                temporaryDirectory.resolve("invalid.json"),
-                new byte[] {(byte) 0xc3, 0x28});
-
-        IOException failure = assertThrows(
-                IOException.class,
-                () -> AtomicFiles.readUtf8(source));
-
-        assertTrue(failure.getMessage().contains("not valid UTF-8"));
-    }
-
-    @Test
-    void rejectsSymbolicLinkSourceWhenSupported() throws IOException {
-        Path target = Files.writeString(
-                temporaryDirectory.resolve("target.json"),
-                "{}");
-        Path link = temporaryDirectory.resolve("linked.json");
-        try {
-            Files.createSymbolicLink(link, target.getFileName());
-        } catch (IOException | UnsupportedOperationException | SecurityException exception) {
-            Assumptions.assumeTrue(
-                    false,
-                    "Symbolic links are unavailable: " + exception.getMessage());
-        }
-
-        assertThrows(IOException.class, () -> AtomicFiles.readUtf8(link));
-    }
-
-    @Test
-    void enforcesSmallReadAndWriteLimitsWithoutLargeAllocations()
-            throws IOException {
-        Path source = Files.writeString(
-                temporaryDirectory.resolve("source.json"),
-                "123456789");
-        Path existing = Files.writeString(
-                temporaryDirectory.resolve("existing.json"),
-                "stable");
-        Path missingParent = temporaryDirectory
-                .resolve("missing")
-                .resolve("target.json");
-
-        assertThrows(
-                IOException.class,
-                () -> AtomicFiles.readUtf8(source, 8));
-        assertThrows(
-                IOException.class,
-                () -> AtomicFiles.writeUtf8(existing, "123456789", 8));
-        assertThrows(
-                IOException.class,
-                () -> AtomicFiles.writeUtf8(missingParent, "123456789", 8));
-
-        assertEquals("stable", Files.readString(existing));
-        assertFalse(Files.exists(missingParent.getParent()));
-
-        AtomicFiles.writeUtf8(existing, "12345678", 8);
-        assertEquals("12345678", AtomicFiles.readUtf8(existing, 8));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/core/CaptureHolder.java b/src/test/java/dev/ishaanko/worldarchive/core/CaptureHolder.java
new file mode 100644
index 0000000..69f877e
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/core/CaptureHolder.java
@@ -0,0 +1,35 @@
+package dev.ishaanko.worldarchive.core;
+
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.CaptureProgressListener;
+import dev.ishaanko.worldarchive.model.WorldId;
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.Optional;
+
+/**
+ * A second game instance for the capture workspace tests. It runs in a child JVM, captures a
+ * world, prints the capture folder, and keeps the capture open until the test kills it.
+ */
+public final class CaptureHolder {
+    private CaptureHolder() {
+    }
+
+    /** Arguments: the capture root and the world folder. */
+    public static void main(String[] arguments) throws Exception {
+        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(
+                Path.of(arguments[0]), Optional.empty(), SourceCaptureObserver.NONE);
+        CreateBackupRequest request = new CreateBackupRequest(
+                WorldId.create(), Path.of(arguments[1]), "Held", Optional.empty(), BackupTrigger.MANUAL);
+        CapturedBackup held = factory.capture(request, CaptureKind.CLOSED_WORLD, BackupId.create(), Instant.now(),
+                Optional.empty(), CaptureProgressListener.NO_OP);
+        // The instance's own housekeeping and a second capture run while the first one is open.
+        factory.removeAbandonedCaptures();
+        factory.capture(request, CaptureKind.CLOSED_WORLD, BackupId.create(), Instant.now(), Optional.empty(),
+                CaptureProgressListener.NO_OP).close();
+        System.out.println(held.capture().worldDirectory());
+        System.out.flush();
+        Thread.sleep(Long.MAX_VALUE);
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/core/CaptureWorkspaceTest.java b/src/test/java/dev/ishaanko/worldarchive/core/CaptureWorkspaceTest.java
index b761fa5..9f57850 100644
--- a/src/test/java/dev/ishaanko/worldarchive/core/CaptureWorkspaceTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/core/CaptureWorkspaceTest.java
@@ -1,35 +1,114 @@
 package dev.ishaanko.worldarchive.core;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
+import java.io.BufferedReader;
 import java.io.IOException;
+import java.io.InputStreamReader;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.util.UUID;
+import java.util.Optional;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
+/**
+ * Two game instances can share one storage folder. Each test runs the other instance in a child
+ * JVM, because file locks belong to a process and one JVM cannot model two.
+ */
 final class CaptureWorkspaceTest {
     @TempDir
     Path temporaryDirectory;
 
+    private Path captures;
+
+    private Path world;
+
+    private Process otherInstance;
+
+    @BeforeEach
+    void createWorld() throws IOException {
+        captures = temporaryDirectory.resolve("capture-temp");
+        world = Files.createDirectory(temporaryDirectory.resolve("world"));
+        Files.writeString(world.resolve("level.dat"), "level", StandardCharsets.UTF_8);
+        Files.write(Files.createDirectory(world.resolve("region")).resolve("r.0.0.mca"), new byte[4_096]);
+    }
+
+    @AfterEach
+    void stopOtherInstance() throws InterruptedException {
+        if (otherInstance != null) {
+            otherInstance.destroyForcibly().waitFor();
+        }
+    }
+
+    @Test
+    void anActiveCaptureOfAnotherInstanceIsKeptAndRemovedAfterThatInstanceCrashes() throws Exception {
+        Path held = startOtherInstance();
+
+        removeAbandonedCaptures();
+
+        assertEquals("level", Files.readString(held.resolve("level.dat")));
+        otherInstance.destroyForcibly().waitFor();
+        removeAbandonedCaptures();
+        assertFalse(Files.exists(held));
+    }
+
     @Test
-    void startupRemovesAMarkerWhoseCaptureDirectoryIsGone() throws IOException {
-        Path captures = Files.createDirectory(temporaryDirectory.resolve("captures"));
-        UUID captureId = UUID.randomUUID();
-        Path orphan = captures.resolve(".capture-" + captureId + ".worldarchive-owner");
-        Files.writeString(
-                orphan,
-                "worldarchive-private-capture-v1:" + captureId + "\n",
-                StandardCharsets.UTF_8);
-        Path foreign = captures.resolve(".capture-" + UUID.randomUUID() + ".worldarchive-owner");
-        Files.writeString(foreign, "not a worldarchive marker\n", StandardCharsets.UTF_8);
-
-        new CaptureWorkspace(captures);
-
-        assertFalse(Files.exists(orphan));
-        assertTrue(Files.exists(foreign));
+    void foldersThatWorldArchiveDidNotCreateAreKept() throws Exception {
+        Path foreign = Files.createDirectories(captures.resolve("stale-capture"));
+        Files.writeString(foreign.resolve("level.dat"), "keep", StandardCharsets.UTF_8);
+        Path note = Files.writeString(captures.resolve("notes.txt"), "keep", StandardCharsets.UTF_8);
+
+        removeAbandonedCaptures();
+
+        assertEquals("keep", Files.readString(foreign.resolve("level.dat")));
+        assertTrue(Files.exists(note));
+    }
+
+    @Test
+    void readOnlyCapturesLeftByWorldArchive04AreRemoved() throws Exception {
+        String id = "10000000-0000-0000-0000-000000000001";
+        Path legacy = Files.createDirectories(captures.resolve(".capture-" + id).resolve("region"));
+        Path copied = Files.write(legacy.resolve("r.0.0.mca"), new byte[16]);
+        Path marker = Files.writeString(captures.resolve(".capture-" + id + ".worldarchive-owner"), "owner");
+        assertTrue(copied.toFile().setReadOnly());
+        assertTrue(legacy.toFile().setReadOnly());
+
+        removeAbandonedCaptures();
+
+        assertFalse(Files.exists(captures.resolve(".capture-" + id)));
+        assertFalse(Files.exists(marker));
+    }
+
+    /** Starts the other instance and returns the capture folder it holds open. */
+    private Path startOtherInstance() throws IOException {
+        Path java = Path.of(System.getProperty("java.home"), "bin", "java");
+        otherInstance = new ProcessBuilder(
+                java.toString(),
+                "-cp",
+                System.getProperty("java.class.path"),
+                CaptureHolder.class.getName(),
+                captures.toString(),
+                world.toString())
+                .redirectError(ProcessBuilder.Redirect.INHERIT)
+                .start();
+        BufferedReader output = new BufferedReader(
+                new InputStreamReader(otherInstance.getInputStream(), StandardCharsets.UTF_8));
+        String line = output.readLine();
+        assertNotNull(line, "the other instance exited before it held a capture");
+        Path held = Path.of(line);
+        assertTrue(Files.isDirectory(held));
+        assertTrue(otherInstance.isAlive());
+        return held;
+    }
+
+    private void removeAbandonedCaptures() throws IOException {
+        new FileSystemBackupCaptureFactory(captures, Optional.empty(), SourceCaptureObserver.NONE)
+                .removeAbandonedCaptures();
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/core/ConfiguredBackupDestinationSelectorTest.java b/src/test/java/dev/ishaanko/worldarchive/core/ConfiguredBackupDestinationSelectorTest.java
index 1dc3113..d976cee 100644
--- a/src/test/java/dev/ishaanko/worldarchive/core/ConfiguredBackupDestinationSelectorTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/core/ConfiguredBackupDestinationSelectorTest.java
@@ -8,12 +8,11 @@
 import dev.ishaanko.worldarchive.model.BackupTrigger;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.ProgressListener;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.nio.file.Path;
 import java.util.List;
 import java.util.Optional;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.CompletionStage;
 import java.util.concurrent.atomic.AtomicReference;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
@@ -42,11 +41,10 @@ void appliesCurrentGlobalWorldAndDestinationGates() {
                 selector.select(request(worldId, world, BackupTrigger.SCHEDULED)));
 
         configuration.set(new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
                 defaults.triggers(),
                 defaults.git(),
                 defaults.zip(),
-                List.of(new WorldConfig(worldId, false, world))));
+                List.of(WorldConfig.defaults(worldId, world).withEnabled(false))));
         assertEquals(
                 List.of(),
                 selector.select(request(worldId, world, BackupTrigger.MANUAL)));
@@ -58,11 +56,10 @@ void rejectsAConfiguredWorldIdentityFromAnotherFolder() {
         WorldId worldId = WorldId.create();
         Path configuredPath = temporaryDirectory.resolve("original-world");
         WorldArchiveConfig config = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
                 defaults.triggers(),
                 defaults.git(),
                 defaults.zip(),
-                List.of(new WorldConfig(worldId, true, configuredPath)));
+                List.of(WorldConfig.defaults(worldId, configuredPath)));
         ConfiguredBackupDestinationSelector selector = new ConfiguredBackupDestinationSelector(
                 () -> config,
                 List.of(backend(DestinationType.GIT), backend(DestinationType.ZIP)));
@@ -98,12 +95,10 @@ public DestinationType destinationType() {
             }
 
             @Override
-            public CompletionStage<DestinationResult> createBackup(
+            public DestinationResult createBackup(
                     BackupCapture capture,
                     ProgressListener progressListener) {
-                return CompletableFuture.completedFuture(DestinationResult.success(
-                        destination,
-                        destination.name().toLowerCase()));
+                return DestinationResult.success(destination, destination.name().toLowerCase());
             }
         };
     }
diff --git a/src/test/java/dev/ishaanko/worldarchive/core/CoordinatorFakes.java b/src/test/java/dev/ishaanko/worldarchive/core/CoordinatorFakes.java
deleted file mode 100644
index e9885ca..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/core/CoordinatorFakes.java
+++ /dev/null
@@ -1,261 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import dev.ishaanko.worldarchive.catalog.BackupCatalog;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.DestinationHealth;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.security.MessageDigest;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.CompletionStage;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicInteger;
-import java.util.function.BiFunction;
-import java.util.function.Function;
-import java.util.function.UnaryOperator;
-
-/** In-memory fakes shared by the coordinator tests. */
-final class CoordinatorFakes {
-    private CoordinatorFakes() {
-    }
-
-    static final class FakeCaptureFactory implements BackupCaptureFactory {
-        final Path root;
-
-        final AtomicInteger calls = new AtomicInteger();
-
-        final WorldInventory inventory;
-
-        volatile java.util.function.Consumer<CreateBackupRequest> observer = ignored -> {
-        };
-
-        FakeCaptureFactory(Path root) throws Exception {
-            this.root = root;
-            byte[] contents = "contents".getBytes(StandardCharsets.UTF_8);
-            this.inventory = WorldInventory.create(List.of(new WorldInventory.Entry(
-                    "level.dat",
-                    contents.length,
-                    java.util.HexFormat.of().formatHex(
-                            MessageDigest.getInstance("SHA-256").digest(contents)))));
-        }
-
-        @Override
-        public CapturedBackup capture(
-                CreateBackupRequest request,
-                BackupId backupId,
-                Instant createdAt,
-                Optional<WorldInventory> previousInventory,
-                CaptureProgressListener progressListener) throws IOException {
-            observer.accept(request);
-            Files.createDirectories(root);
-            Path staging = Files.createDirectory(root.resolve("capture-" + calls.incrementAndGet()));
-            long changed = previousInventory.map(inventory::changedFilesSince).orElse(inventory.fileCount());
-            BackupManifest manifest = BackupManifest.create(
-                    backupId,
-                    request.worldId(),
-                    request.worldName(),
-                    request.label(),
-                    createdAt,
-                    request.trigger(),
-                    inventory.fileCount(),
-                    inventory.byteCount(),
-                    changed,
-                    inventory.contentSha256(),
-                    inventory.inventorySha256());
-            return new CapturedBackup(
-                    new BackupCapture(staging, manifest),
-                    inventory,
-                    () -> Files.deleteIfExists(staging));
-        }
-    }
-
-    static final class FakeBackend implements BackupBackend {
-        final DestinationType destination;
-
-        final BiFunction<BackupCapture, ProgressListener, CompletionStage<DestinationResult>> result;
-
-        final AtomicInteger calls = new AtomicInteger();
-
-        FakeBackend(
-                DestinationType destination,
-                Function<BackupCapture, CompletionStage<DestinationResult>> result) {
-            this(destination, (capture, ignored) -> result.apply(capture));
-        }
-
-        FakeBackend(
-                DestinationType destination,
-                BiFunction<BackupCapture, ProgressListener, CompletionStage<DestinationResult>> result) {
-            this.destination = destination;
-            this.result = result;
-        }
-
-        static FakeBackend success(DestinationType destination) {
-            return new FakeBackend(destination, ignored -> CompletableFuture.completedFuture(
-                    DestinationResult.success(destination, destination.name().toLowerCase())));
-        }
-
-        @Override
-        public DestinationType destinationType() {
-            return destination;
-        }
-
-        @Override
-        public CompletionStage<DestinationResult> createBackup(
-                BackupCapture capture,
-                ProgressListener progressListener) {
-            calls.incrementAndGet();
-            return result.apply(capture, progressListener);
-        }
-    }
-
-    static final class InMemoryInventoryStore implements WorldInventoryStore {
-        final Map<WorldId, WorldInventory> values = new ConcurrentHashMap<>();
-
-        IOException loadFailure;
-
-        @Override
-        public Optional<WorldInventory> load(WorldId worldId) throws IOException {
-            if (loadFailure != null) {
-                throw loadFailure;
-            }
-            return Optional.ofNullable(values.get(worldId));
-        }
-
-        @Override
-        public void save(WorldId worldId, WorldInventory inventory) {
-            values.put(worldId, inventory);
-        }
-    }
-
-    static class InMemoryCatalog implements BackupCatalog {
-        protected final List<BackupRecord> records = java.util.Collections.synchronizedList(new ArrayList<>());
-
-        @Override
-        public void add(BackupRecord record) throws IOException {
-            records.add(record);
-        }
-
-        @Override
-        public Optional<BackupRecord> find(BackupId backupId) {
-            return records.stream()
-                    .filter(record -> record.manifest().backupId().equals(backupId))
-                    .findFirst();
-        }
-
-        @Override
-        public List<BackupRecord> listAll() {
-            return List.copyOf(records);
-        }
-
-        @Override
-        public List<BackupRecord> list(WorldId worldId) {
-            return records.stream()
-                    .filter(record -> record.manifest().worldId().equals(worldId))
-                    .toList();
-        }
-
-        @Override
-        public Optional<BackupRecord> update(
-                BackupId backupId,
-                UnaryOperator<BackupRecord> update) {
-            throw new UnsupportedOperationException();
-        }
-
-        @Override
-        public boolean remove(BackupId backupId) {
-            return records.removeIf(record -> record.manifest().backupId().equals(backupId));
-        }
-    }
-
-    static final class BlockingCatalog extends InMemoryCatalog {
-        final CountDownLatch entered = new CountDownLatch(1);
-
-        final CountDownLatch release = new CountDownLatch(1);
-
-        @Override
-        public void add(BackupRecord record) throws IOException {
-            entered.countDown();
-            try {
-                if (!release.await(5, TimeUnit.SECONDS)) {
-                    throw new IOException("Timed out waiting to publish test catalog record");
-                }
-            } catch (InterruptedException exception) {
-                Thread.currentThread().interrupt();
-                throw new IOException("Interrupted while publishing test catalog record", exception);
-            }
-            super.add(record);
-        }
-    }
-
-    static final class UnusedMaintenanceService implements BackupMaintenanceService {
-        @Override
-        public CompletionStage<List<BackupRecord>> listBackups(Optional<WorldId> worldId) {
-            return CompletableFuture.failedFuture(new UnsupportedOperationException());
-        }
-
-        @Override
-        public CompletionStage<Optional<BackupRecord>> findBackup(BackupId backupId) {
-            return CompletableFuture.failedFuture(new UnsupportedOperationException());
-        }
-
-        @Override
-        public CompletionStage<RestoreBackupResult> restoreBackup(
-                RestoreBackupRequest request,
-                ProgressListener progressListener) {
-            return CompletableFuture.failedFuture(new UnsupportedOperationException());
-        }
-
-        @Override
-        public CompletionStage<DeletePreparation> prepareDelete(BackupId backupId) {
-            return CompletableFuture.failedFuture(new UnsupportedOperationException());
-        }
-
-        @Override
-        public CompletionStage<BackupResult> deleteBackup(
-                DeleteBackupRequest request,
-                ProgressListener progressListener) {
-            return CompletableFuture.failedFuture(new UnsupportedOperationException());
-        }
-
-        @Override
-        public CompletionStage<List<BackupResult>> deleteBackups(
-                List<DeleteBackupRequest> requests,
-                ProgressListener progressListener) {
-            return CompletableFuture.failedFuture(new UnsupportedOperationException());
-        }
-
-        @Override
-        public CompletionStage<BackupResult> verifyBackup(
-                BackupId backupId,
-                ProgressListener progressListener) {
-            return CompletableFuture.failedFuture(new UnsupportedOperationException());
-        }
-
-        @Override
-        public CompletionStage<BackupResult> syncBackup(
-                BackupId backupId,
-                ProgressListener progressListener) {
-            return CompletableFuture.failedFuture(new UnsupportedOperationException());
-        }
-
-        @Override
-        public CompletionStage<List<DestinationHealth>> health(Optional<WorldId> worldId) {
-            return CompletableFuture.failedFuture(new UnsupportedOperationException());
-        }
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/core/DestinationProgressAggregatorTest.java b/src/test/java/dev/ishaanko/worldarchive/core/DestinationProgressAggregatorTest.java
index 7f3719c..fa13d04 100644
--- a/src/test/java/dev/ishaanko/worldarchive/core/DestinationProgressAggregatorTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/core/DestinationProgressAggregatorTest.java
@@ -1,11 +1,14 @@
 package dev.ishaanko.worldarchive.core;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupOperation;
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.OperationId;
+import dev.ishaanko.worldarchive.model.OperationPhase;
+import dev.ishaanko.worldarchive.model.OperationProgress;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.util.List;
 import java.util.Optional;
@@ -78,15 +81,6 @@ void destinationWithoutAKnownTotalCountsAsNotStarted() {
                 progress(OperationPhase.COMPLETE, 0, 0, "Git snapshot complete")));
     }
 
-    @Test
-    void oneDestinationDoesNotAggregate() {
-        DestinationProgressAggregator aggregator = new DestinationProgressAggregator(
-                List.of(DestinationType.ZIP),
-                800);
-
-        assertFalse(aggregator.aggregates());
-    }
-
     private static OperationProgress progress(
             OperationPhase phase,
             long completed,
diff --git a/src/test/java/dev/ishaanko/worldarchive/core/FakeBackend.java b/src/test/java/dev/ishaanko/worldarchive/core/FakeBackend.java
new file mode 100644
index 0000000..81a7f03
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/core/FakeBackend.java
@@ -0,0 +1,61 @@
+package dev.ishaanko.worldarchive.core;
+
+import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.Future;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.function.Function;
+
+/** A destination for coordinator tests. Each write runs on its destination worker, like a real backend. */
+final class FakeBackend implements BackupBackend {
+    final AtomicInteger calls = new AtomicInteger();
+
+    private final DestinationType destination;
+
+    private final Write write;
+
+    private FakeBackend(DestinationType destination, Write write) {
+        this.destination = destination;
+        this.write = write;
+    }
+
+    static FakeBackend success(DestinationType destination) {
+        return writing(destination, (capture, listener) ->
+                DestinationResult.success(destination, destination.name().toLowerCase()));
+    }
+
+    static FakeBackend writing(DestinationType destination, Write write) {
+        return new FakeBackend(destination, write);
+    }
+
+    /** Each write waits for the future that {@code release} returns; a failed future means no trustworthy result. */
+    static FakeBackend awaiting(DestinationType destination, Function<BackupCapture, Future<DestinationResult>> release) {
+        return writing(destination, (capture, listener) -> {
+            try {
+                return release.apply(capture).get();
+            } catch (ExecutionException exception) {
+                throw new IllegalStateException("Fake destination failed without a result", exception.getCause());
+            }
+        });
+    }
+
+    @Override
+    public DestinationType destinationType() {
+        return destination;
+    }
+
+    @Override
+    public DestinationResult createBackup(BackupCapture capture, ProgressListener progressListener)
+            throws InterruptedException {
+        calls.incrementAndGet();
+        return write.run(capture, progressListener);
+    }
+
+    /** A blocking write on the destination worker. */
+    @FunctionalInterface
+    interface Write {
+        DestinationResult run(BackupCapture capture, ProgressListener listener) throws InterruptedException;
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/core/FileSystemBackupCaptureFactoryTest.java b/src/test/java/dev/ishaanko/worldarchive/core/FileSystemBackupCaptureFactoryTest.java
index 761f8ac..bcbbc52 100644
--- a/src/test/java/dev/ishaanko/worldarchive/core/FileSystemBackupCaptureFactoryTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/core/FileSystemBackupCaptureFactoryTest.java
@@ -1,35 +1,32 @@
 package dev.ishaanko.worldarchive.core;
 
-import static org.junit.jupiter.api.Assertions.assertArrayEquals;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.CaptureProgressListener;
 import dev.ishaanko.worldarchive.model.GameVersionStamp;
 import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupArtifact;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupStore;
+import dev.ishaanko.worldarchive.support.Digests;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
 import java.nio.file.attribute.FileTime;
-import java.security.MessageDigest;
+import java.time.Duration;
 import java.time.Instant;
-import java.util.HexFormat;
 import java.util.List;
+import java.util.Map;
 import java.util.Optional;
-import java.util.UUID;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.Future;
-import java.util.concurrent.TimeUnit;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicInteger;
+import java.util.stream.Stream;
 import org.junit.jupiter.api.Assumptions;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
@@ -41,564 +38,286 @@ final class FileSystemBackupCaptureFactoryTest {
     Path temporaryDirectory;
 
     @Test
-    void removesOnlyUnlockedOwnedCrashLeftoversAndKeepsMarkersOutsidePayload() throws Exception {
-        Path captures = Files.createDirectory(temporaryDirectory.resolve("captures-recovery"));
-        UUID staleId = UUID.fromString("10000000-0000-0000-0000-000000000001");
-        Path staleCapture = Files.createDirectory(captureRoot(captures, staleId));
-        Files.writeString(staleCapture.resolve("level.dat"), "stale", StandardCharsets.UTF_8);
-        Path staleMarker = writeOwnershipMarker(captures, staleId, staleId);
-
-        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(captures);
-
-        assertFalse(Files.exists(staleCapture));
-        assertFalse(Files.exists(staleMarker));
-
-        UUID nextId = UUID.fromString("10000000-0000-0000-0000-000000000002");
-        Path nextCapture = Files.createDirectory(captureRoot(captures, nextId));
-        Files.writeString(nextCapture.resolve("level.dat"), "next-stale", StandardCharsets.UTF_8);
-        Path nextMarker = writeOwnershipMarker(captures, nextId, nextId);
-
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world-recovery"));
-        Files.writeString(world.resolve("level.dat"), "current", StandardCharsets.UTF_8);
-        CapturedBackup captured = factory.capture(
-                request(world, BackupTrigger.MANUAL),
-                BackupId.create(),
-                CREATED_AT,
-                Optional.empty(),
-                CaptureProgressListener.NO_OP);
-        assertFalse(Files.exists(nextCapture));
-        assertFalse(Files.exists(nextMarker));
-        Path activeCapture = captured.capture().worldDirectory();
-        Path activeMarker = markerForCapture(activeCapture);
-        try {
-            assertTrue(Files.isRegularFile(activeMarker));
-            try (var payload = Files.list(activeCapture)) {
-                assertEquals(List.of(activeCapture.resolve("level.dat")), payload.toList());
-            }
-        } finally {
-            captured.close();
-        }
-        assertFalse(Files.exists(activeCapture));
-        assertFalse(Files.exists(activeMarker));
-    }
-
-    @Test
-    void stampsCapturesWithTheInjectedGameVersion() throws Exception {
-        Path captures = temporaryDirectory.resolve("captures-stamped");
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world-stamped"));
-        Files.writeString(world.resolve("level.dat"), "stamped", StandardCharsets.UTF_8);
-        GameVersionStamp stamp = new GameVersionStamp("26.2", 4_820);
-        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(
-                captures,
-                Optional.of(stamp));
-
-        try (CapturedBackup captured = factory.capture(
-                request(world, BackupTrigger.MANUAL),
-                BackupId.create(),
-                CREATED_AT,
-                Optional.empty(),
-                CaptureProgressListener.NO_OP)) {
-            assertEquals(Optional.of(stamp), captured.capture().manifest().gameVersion());
-        }
-    }
-
-    @Test
-    void capturesWithoutAGameVersionWhenNoneIsInjected() throws Exception {
-        Path captures = temporaryDirectory.resolve("captures-unstamped");
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world-unstamped"));
-        Files.writeString(world.resolve("level.dat"), "unstamped", StandardCharsets.UTF_8);
-        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(captures);
-
-        try (CapturedBackup captured = factory.capture(
-                request(world, BackupTrigger.MANUAL),
-                BackupId.create(),
-                CREATED_AT,
-                Optional.empty(),
-                CaptureProgressListener.NO_OP)) {
-            assertEquals(Optional.empty(), captured.capture().manifest().gameVersion());
-        }
-    }
-
-    @Test
-    void preservesAnActiveCaptureAcrossStartupAndNextCaptureCleanup() throws Exception {
-        Path captures = temporaryDirectory.resolve("captures-active");
-        Path firstWorld = Files.createDirectory(temporaryDirectory.resolve("world-active-first"));
-        Files.writeString(firstWorld.resolve("level.dat"), "first", StandardCharsets.UTF_8);
-        FileSystemBackupCaptureFactory firstFactory = new FileSystemBackupCaptureFactory(captures);
-        CapturedBackup first = firstFactory.capture(
-                request(firstWorld, BackupTrigger.MANUAL),
-                BackupId.create(),
-                CREATED_AT,
-                Optional.empty(),
-                CaptureProgressListener.NO_OP);
-        Path firstCapture = first.capture().worldDirectory();
-        Path firstMarker = markerForCapture(firstCapture);
-
-        FileSystemBackupCaptureFactory secondFactory = new FileSystemBackupCaptureFactory(captures);
-        assertTrue(Files.isDirectory(firstCapture));
-        assertTrue(Files.isRegularFile(firstMarker));
-
-        Path secondWorld = Files.createDirectory(temporaryDirectory.resolve("world-active-second"));
-        Files.writeString(secondWorld.resolve("level.dat"), "second", StandardCharsets.UTF_8);
-        CapturedBackup second = secondFactory.capture(
-                request(secondWorld, BackupTrigger.MANUAL),
-                BackupId.create(),
-                CREATED_AT,
-                Optional.empty(),
-                CaptureProgressListener.NO_OP);
-        try {
-            assertTrue(Files.isDirectory(firstCapture));
-            assertEquals("first", Files.readString(firstCapture.resolve("level.dat")));
-        } finally {
-            second.close();
-            first.close();
-        }
-        assertFalse(Files.exists(firstCapture));
-        assertFalse(Files.exists(firstMarker));
-    }
-
-    @Test
-    void preservesUnmarkedMismatchedNoncanonicalAndUnsafeCandidates() throws Exception {
-        Path captures = Files.createDirectory(temporaryDirectory.resolve("captures-conservative"));
-
-        UUID unmarkedId = UUID.fromString("20000000-0000-0000-0000-000000000001");
-        Path unmarked = Files.createDirectory(captureRoot(captures, unmarkedId));
-        Files.writeString(unmarked.resolve("keep.txt"), "unmarked", StandardCharsets.UTF_8);
-
-        UUID mismatchedId = UUID.fromString("20000000-0000-0000-0000-000000000002");
-        Path mismatched = Files.createDirectory(captureRoot(captures, mismatchedId));
-        UUID differentId = UUID.fromString("20000000-0000-0000-0000-000000000003");
-        Path mismatchedMarker = writeOwnershipMarker(captures, mismatchedId, differentId);
-
-        UUID unsafeTreeId = UUID.fromString("20000000-0000-0000-0000-000000000004");
-        Path unsafeTree = Files.writeString(
-                captureRoot(captures, unsafeTreeId),
-                "not-a-directory",
-                StandardCharsets.UTF_8);
-        Path unsafeTreeMarker = writeOwnershipMarker(captures, unsafeTreeId, unsafeTreeId);
-
-        UUID unsafeMarkerId = UUID.fromString("20000000-0000-0000-0000-000000000005");
-        Path unsafeMarkerCapture = Files.createDirectory(captureRoot(captures, unsafeMarkerId));
-        Path unsafeMarker = Files.createDirectory(markerForCapture(unsafeMarkerCapture));
-
-        UUID noncanonicalId = UUID.fromString("abcdef00-0000-0000-0000-000000000006");
-        Path noncanonical = Files.createDirectory(
-                captures.resolve(".capture-" + noncanonicalId.toString().toUpperCase(java.util.Locale.ROOT)));
-        Path noncanonicalMarker = markerForCapture(noncanonical);
-        Files.writeString(
-                noncanonicalMarker,
-                "worldarchive-private-capture-v1:" + noncanonicalId + '\n',
-                StandardCharsets.UTF_8);
-
-        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(captures);
-
-        assertTrue(Files.isDirectory(unmarked));
-        assertTrue(Files.isDirectory(mismatched));
-        assertTrue(Files.isRegularFile(mismatchedMarker));
-        assertTrue(Files.isRegularFile(unsafeTree));
-        assertTrue(Files.isRegularFile(unsafeTreeMarker));
-        assertTrue(Files.isDirectory(unsafeMarkerCapture));
-        assertTrue(Files.isDirectory(unsafeMarker));
-        assertTrue(Files.isDirectory(noncanonical));
-        assertTrue(Files.isRegularFile(noncanonicalMarker));
-
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world-conservative"));
-        Files.writeString(world.resolve("level.dat"), "new", StandardCharsets.UTF_8);
-        try (CapturedBackup ignored = factory.capture(
-                request(world, BackupTrigger.MANUAL),
-                BackupId.create(),
-                CREATED_AT,
-                Optional.empty(),
-                CaptureProgressListener.NO_OP)) {
-            assertTrue(Files.isDirectory(unmarked));
-            assertTrue(Files.isRegularFile(unsafeTree));
-        }
-    }
-
-    @Test
-    void createsOneImmutablePortableCaptureWithExactChangeAccounting() throws Exception {
+    void capturesThePortableWorldWithoutGitFoldersAndCountsChangedFiles() throws Exception {
         Path world = Files.createDirectory(temporaryDirectory.resolve("world space"));
         Files.writeString(world.resolve("level.dat"), "new-level", StandardCharsets.UTF_8);
-        Path region = Files.createDirectory(world.resolve("région"));
-        Files.write(region.resolve("r.0.0.mca"), new byte[] {1, 2, 3, 4});
+        Files.write(Files.createDirectory(world.resolve("région")).resolve("r.0.0.mca"), new byte[] {1, 2, 3, 4});
         Path internal = Files.createDirectory(world.resolve(".worldarchive"));
         Files.writeString(internal.resolve("world.json"), "identity", StandardCharsets.UTF_8);
         Files.writeString(world.resolve("session.lock"), "lock", StandardCharsets.UTF_8);
+        Path pack = Files.createDirectories(world.resolve("datapacks").resolve("pack"));
+        Files.writeString(pack.resolve("pack.mcmeta"), "{}", StandardCharsets.UTF_8);
+        Files.writeString(Files.createDirectory(pack.resolve(".git")).resolve("HEAD"), "ref: main\n");
+        Files.writeString(Files.createDirectories(world.resolve("datapacks").resolve("worktree")).resolve(".git"), "gitdir: x\n");
         WorldInventory previous = WorldInventory.create(List.of(
-                entry("deleted.dat", "gone".getBytes(StandardCharsets.UTF_8)),
-                entry("level.dat", "old-level".getBytes(StandardCharsets.UTF_8))));
-        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(
-                temporaryDirectory.resolve("captures"));
+                entry("deleted.dat", "gone"),
+                entry("level.dat", "old-level")));
 
-        CapturedBackup captured = factory.capture(
-                request(world, BackupTrigger.MANUAL),
-                BackupId.create(),
-                CREATED_AT,
-                Optional.of(previous),
-                CaptureProgressListener.NO_OP);
-        Path privateRoot = captured.capture().worldDirectory();
+        CapturedBackup captured = factory(SourceCaptureObserver.NONE).capture(request(world), CaptureKind.CLOSED_WORLD,
+                BackupId.create(), CREATED_AT, Optional.of(previous), CaptureProgressListener.NO_OP);
+        Path copy = captured.capture().worldDirectory();
         try {
-            assertFalse(privateRoot.startsWith(world));
-            assertEquals(2, captured.inventory().fileCount());
-            assertEquals(3, captured.capture().manifest().changedFileCount());
-            assertFalse(Files.exists(privateRoot.resolve(".worldarchive")));
-            assertFalse(Files.exists(privateRoot.resolve("session.lock")));
-            assertArrayEquals(
-                    new byte[] {1, 2, 3, 4},
-                    Files.readAllBytes(privateRoot.resolve("région").resolve("r.0.0.mca")));
-
+            assertEquals(
+                    List.of("datapacks/pack/pack.mcmeta", "level.dat", "région/r.0.0.mca"),
+                    captured.capture().inventory().files().stream().map(WorldInventory.Entry::path).toList());
+            assertEquals(4, captured.capture().manifest().changedFileCount());
+            assertEquals(List.of("datapacks/pack/pack.mcmeta", "datapacks/worktree", "level.dat", "région/r.0.0.mca"),
+                    relativeEntries(copy));
             Files.writeString(world.resolve("level.dat"), "mutated-live", StandardCharsets.UTF_8);
-            assertEquals("new-level", Files.readString(privateRoot.resolve("level.dat")));
+            assertEquals("new-level", Files.readString(copy.resolve("level.dat")));
         } finally {
             captured.close();
         }
-        assertFalse(Files.exists(privateRoot));
+        assertFalse(Files.exists(copy));
         assertEquals("identity", Files.readString(internal.resolve("world.json")));
     }
 
     @Test
-    void detectsPersistentSourceMutationAndDeletesPrivateStaging() throws Exception {
+    void aFileWrittenAfterItsCopyIsCopiedAgainAndTheOthersAreKept() throws Exception {
         Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
-        Files.writeString(world.resolve("level.dat"), "before", StandardCharsets.UTF_8);
-        Path captures = temporaryDirectory.resolve("captures");
-        AtomicInteger mutations = new AtomicInteger();
-        SourceCaptureObserver mutator = new SourceCaptureObserver() {
+        Files.writeString(world.resolve("a.dat"), "before", StandardCharsets.UTF_8);
+        Files.writeString(world.resolve("b.dat"), "stable", StandardCharsets.UTF_8);
+        Map<String, AtomicInteger> copies = new ConcurrentHashMap<>();
+        AtomicBoolean written = new AtomicBoolean();
+        SourceCaptureObserver writeOnce = new SourceCaptureObserver() {
             @Override
-            public void afterFileCopy(Path relativePath) throws IOException {
-                Files.writeString(
-                        world.resolve(relativePath),
-                        "after-" + mutations.incrementAndGet(),
-                        StandardCharsets.UTF_8);
+            public void beforeFileCopy(Path relativePath) {
+                copies.computeIfAbsent(relativePath.toString(), ignored -> new AtomicInteger()).incrementAndGet();
             }
-        };
-        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(captures, mutator);
-
-        assertThrows(IOException.class, () -> factory.capture(
-                request(world, BackupTrigger.MANUAL),
-                BackupId.create(),
-                CREATED_AT,
-                Optional.empty(),
-                CaptureProgressListener.NO_OP));
-
-        assertTrue(Files.isDirectory(captures));
-        try (var entries = Files.list(captures)) {
-            assertEquals(List.of(), entries.toList());
-        }
-    }
 
-    @Test
-    void oneTimeMidCaptureWriteIsRetriedAndCaptured() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world-retry"));
-        Files.writeString(world.resolve("a.dat"), "before", StandardCharsets.UTF_8);
-        Files.writeString(world.resolve("b.dat"), "stable", StandardCharsets.UTF_8);
-        AtomicBoolean mutated = new AtomicBoolean();
-        SourceCaptureObserver oneTimeMutator = new SourceCaptureObserver() {
             @Override
             public void afterFileCopy(Path relativePath) throws IOException {
-                if (relativePath.equals(Path.of("b.dat"))
-                        && mutated.compareAndSet(false, true)) {
+                if (relativePath.toString().equals("a.dat") && written.compareAndSet(false, true)) {
                     Files.writeString(world.resolve("a.dat"), "after!", StandardCharsets.UTF_8);
                 }
             }
         };
-        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(
-                temporaryDirectory.resolve("captures-retry"), oneTimeMutator);
-
-        try (CapturedBackup captured = factory.capture(
-                request(world, BackupTrigger.MANUAL),
-                BackupId.create(),
-                CREATED_AT,
-                Optional.empty(),
-                CaptureProgressListener.NO_OP)) {
-            assertEquals(2, captured.inventory().fileCount());
-            assertEquals(
-                    "after!",
-                    Files.readString(captured.capture().worldDirectory().resolve("a.dat")));
+
+        try (CapturedBackup captured = capture(factory(writeOnce), world)) {
+            assertEquals("after!", Files.readString(captured.capture().worldDirectory().resolve("a.dat")));
         }
+        assertEquals(2, copies.get("a.dat").get());
+        assertEquals(1, copies.get("b.dat").get());
     }
 
     @Test
-    void interruptionCleansCaptureBeforeAnyConsumerCanReceiveIt() throws Exception {
+    void aTemporaryFileReplacedDuringTheCaptureIsRetried() throws Exception {
         Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
-        Files.writeString(world.resolve("level.dat"), "contents", StandardCharsets.UTF_8);
-        Path captures = temporaryDirectory.resolve("captures");
-        CountDownLatch entered = new CountDownLatch(1);
-        CountDownLatch release = new CountDownLatch(1);
-        SourceCaptureObserver blocker = new SourceCaptureObserver() {
+        Files.writeString(world.resolve("level.dat"), "old level", StandardCharsets.UTF_8);
+        Path temporary = Files.writeString(world.resolve("level.dat_new"), "new level", StandardCharsets.UTF_8);
+        SourceCaptureObserver saveMidCapture = new SourceCaptureObserver() {
             @Override
-            public void beforeFileCopy(Path relativePath) throws InterruptedException {
-                entered.countDown();
-                release.await();
+            public void beforeFileCopy(Path relativePath) throws IOException {
+                if (relativePath.toString().equals("level.dat_new") && Files.exists(temporary)) {
+                    Files.move(temporary, world.resolve("level.dat"), StandardCopyOption.REPLACE_EXISTING);
+                }
             }
         };
-        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(captures, blocker);
-        ExecutorService executor = Executors.newSingleThreadExecutor();
-        try {
-            Future<CapturedBackup> capture = executor.submit(() -> factory.capture(
-                    request(world, BackupTrigger.MANUAL),
-                    BackupId.create(),
-                    CREATED_AT,
-                    Optional.empty(),
-                    CaptureProgressListener.NO_OP));
-            assertTrue(entered.await(5, TimeUnit.SECONDS));
-
-            capture.cancel(true);
-            release.countDown();
-            assertThrows(java.util.concurrent.CancellationException.class, capture::get);
-        } finally {
-            release.countDown();
-            executor.shutdown();
-            assertTrue(executor.awaitTermination(5, TimeUnit.SECONDS));
-        }
-        try (var entries = Files.list(captures)) {
-            assertEquals(List.of(), entries.toList());
-        }
-    }
-
-    @Test
-    void rejectsCaptureDirectoryInsideLiveWorld() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
-        Files.writeString(world.resolve("level.dat"), "contents", StandardCharsets.UTF_8);
-        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(
-                world.resolve("captures"));
-
-        assertThrows(IOException.class, () -> factory.capture(
-                request(world, BackupTrigger.MANUAL),
-                BackupId.create(),
-                CREATED_AT,
-                Optional.empty(),
-                CaptureProgressListener.NO_OP));
-    }
-
-    @Test
-    void canonicalReadOnlyCaptureIsAcceptedByZipDestination() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world-zip"));
-        Files.writeString(world.resolve("level.dat"), "contents", StandardCharsets.UTF_8);
-        Files.createDirectories(world.resolve("region"));
-        Files.write(world.resolve("region").resolve("r.0.0.mca"), new byte[] {4, 3, 2, 1});
-        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(
-                temporaryDirectory.resolve("captures-zip"));
-        CapturedBackup captured = factory.capture(
-                request(world, BackupTrigger.MANUAL),
-                BackupId.create(),
-                CREATED_AT,
-                Optional.empty(),
-                CaptureProgressListener.NO_OP);
-        try {
-            ZipBackupStore store = new ZipBackupStore(temporaryDirectory.resolve("archives"));
-            ZipBackupArtifact artifact = store.create(captured.capture());
 
-            assertTrue(store.verify(artifact.archivePath()).valid());
-            assertEquals(captured.capture().manifest(), artifact.manifest());
-        } finally {
-            captured.close();
+        try (CapturedBackup captured = capture(factory(saveMidCapture), world)) {
+            assertEquals(List.of("level.dat"), relativeEntries(captured.capture().worldDirectory()));
+            assertEquals("new level", Files.readString(captured.capture().worldDirectory().resolve("level.dat")));
         }
     }
 
     @Test
-    void ignoresDirectoryTimestampDriftWhileFileTreeRemainsStable() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world-directory-time"));
-        Files.writeString(world.resolve("level.dat"), "contents", StandardCharsets.UTF_8);
+    void metadataOnlyChangesDoNotFailTheCapture() throws Exception {
+        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
+        Files.writeString(world.resolve("a.dat"), "first contents", StandardCharsets.UTF_8);
+        Files.writeString(world.resolve("b.dat"), "second contents", StandardCharsets.UTF_8);
         Path region = Files.createDirectory(world.resolve("region"));
         Files.write(region.resolve("r.0.0.mca"), new byte[] {4, 3, 2, 1});
         FileTime changedTime = FileTime.from(Instant.parse("2026-07-17T12:01:00Z"));
-        SourceCaptureObserver timestampDrift = new SourceCaptureObserver() {
+        SourceCaptureObserver touchEverything = new SourceCaptureObserver() {
+            @Override
+            public void beforeFileCopy(Path relativePath) throws IOException {
+                Files.setLastModifiedTime(world.resolve(relativePath), changedTime);
+            }
+
             @Override
             public void afterFileCopy(Path relativePath) throws IOException {
                 Files.setLastModifiedTime(region, changedTime);
+                Files.setLastModifiedTime(world.resolve("a.dat"), FileTime.from(Instant.parse("2026-07-17T12:02:00Z")));
             }
         };
-        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(
-                temporaryDirectory.resolve("captures-directory-time"), timestampDrift);
 
-        CapturedBackup captured = factory.capture(
-                request(world, BackupTrigger.MANUAL),
-                BackupId.create(),
-                CREATED_AT,
-                Optional.empty(),
-                CaptureProgressListener.NO_OP);
-        try {
-            assertEquals(2, captured.inventory().fileCount());
-            assertArrayEquals(
-                    new byte[] {4, 3, 2, 1},
-                    Files.readAllBytes(captured.capture()
-                            .worldDirectory()
-                            .resolve("region")
-                            .resolve("r.0.0.mca")));
-        } finally {
-            captured.close();
+        try (CapturedBackup captured = capture(factory(touchEverything), world)) {
+            assertEquals(3, captured.capture().inventory().fileCount());
+            assertEquals("first contents", Files.readString(captured.capture().worldDirectory().resolve("a.dat")));
         }
     }
 
+    /** Each write keeps the size and moves the timestamp to a different old value, so only the stat shows it. */
     @Test
-    void acceptsFileTimestampDriftBeforeCopyWhenContentMatches() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world-file-time-before"));
-        byte[] contents = "stable contents".getBytes(StandardCharsets.UTF_8);
-        Path level = world.resolve("level.dat");
-        Files.write(level, contents);
-        FileTime changedTime = FileTime.from(Instant.parse("2026-07-17T12:02:00Z"));
-        SourceCaptureObserver timestampDrift = new SourceCaptureObserver() {
+    void rejectsSameSizeMutationDespiteFileTimestampDrift() throws Exception {
+        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
+        Path first = Files.writeString(world.resolve("a.dat"), "before", StandardCharsets.UTF_8);
+        Files.writeString(world.resolve("b.dat"), "second", StandardCharsets.UTF_8);
+        Instant past = Instant.parse("2026-07-17T12:04:00Z");
+        AtomicInteger writes = new AtomicInteger();
+        SourceCaptureObserver rewriteSameSize = new SourceCaptureObserver() {
             @Override
-            public void beforeFileCopy(Path relativePath) throws IOException {
-                Files.setLastModifiedTime(world.resolve(relativePath), changedTime);
+            public void afterFileCopy(Path relativePath) throws IOException {
+                if (relativePath.toString().equals("a.dat")) {
+                    int write = writes.incrementAndGet();
+                    Files.writeString(first, "chg--" + write, StandardCharsets.UTF_8);
+                    Files.setLastModifiedTime(first, FileTime.from(past.plusSeconds(write)));
+                }
             }
         };
-        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(
-                temporaryDirectory.resolve("captures-file-time-before"), timestampDrift);
-
-        try (CapturedBackup captured = factory.capture(
-                request(world, BackupTrigger.MANUAL),
-                BackupId.create(),
-                CREATED_AT,
-                Optional.empty(),
-                CaptureProgressListener.NO_OP)) {
-            assertEquals(1, captured.inventory().fileCount());
-            assertArrayEquals(
-                    contents,
-                    Files.readAllBytes(captured.capture().worldDirectory().resolve("level.dat")));
+
+        IOException failure = assertThrows(IOException.class, () -> capture(factory(rewriteSameSize), world));
+
+        assertInstanceOf(CaptureChangedException.class, failure);
+        assertEquals(List.of(), relativeEntries(temporaryDirectory.resolve("captures")).stream()
+                .filter(entry -> entry.endsWith(".dat"))
+                .toList());
+    }
+
+    /**
+     * The game writes a.dat again within one timestamp tick after its copy: same size, same time.
+     * One file dated an hour ahead must not stop the capture from reading a.dat again.
+     */
+    @Test
+    void aSameTickWriteIsCaughtEvenWhenAFileIsDatedInTheFuture() throws Exception {
+        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
+        Path a = Files.writeString(world.resolve("a.dat"), "before", StandardCharsets.UTF_8);
+        Files.writeString(world.resolve("b.dat"), "stable", StandardCharsets.UTF_8);
+        Path future = Files.writeString(world.resolve("datapacks.txt"), "made on a machine with a fast clock");
+        Files.setLastModifiedTime(future, FileTime.from(Instant.now().plus(Duration.ofHours(1))));
+
+        try (CapturedBackup captured = capture(factory(sameTickWrite(a)), world)) {
+            assertEquals("after!", Files.readString(captured.capture().worldDirectory().resolve("a.dat")));
         }
     }
 
+    /**
+     * In the open world the game can rewrite an old file within one timestamp tick, keeping its
+     * size and time. The capture reads every file again, so it copies that file again.
+     */
     @Test
-    void acceptsEarlierFileTimestampDriftDetectedByFinalScan() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world-file-time-final"));
-        byte[] firstContents = "first contents".getBytes(StandardCharsets.UTF_8);
-        Path first = world.resolve("a.dat");
-        Files.write(first, firstContents);
-        Files.writeString(world.resolve("b.dat"), "second contents", StandardCharsets.UTF_8);
-        FileTime changedTime = FileTime.from(Instant.parse("2026-07-17T12:03:00Z"));
-        SourceCaptureObserver timestampDrift = new SourceCaptureObserver() {
-            @Override
-            public void afterFileCopy(Path relativePath) throws IOException {
-                if (relativePath.equals(Path.of("b.dat"))) {
-                    Files.setLastModifiedTime(first, changedTime);
-                }
-            }
-        };
-        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(
-                temporaryDirectory.resolve("captures-file-time-final"), timestampDrift);
-
-        try (CapturedBackup captured = factory.capture(
-                request(world, BackupTrigger.MANUAL),
-                BackupId.create(),
-                CREATED_AT,
-                Optional.empty(),
-                CaptureProgressListener.NO_OP)) {
-            assertEquals(2, captured.inventory().fileCount());
-            assertArrayEquals(
-                    firstContents,
-                    Files.readAllBytes(captured.capture().worldDirectory().resolve("a.dat")));
+    void anOpenWorldCaptureCopiesAgainAnOldFileRewrittenWithTheSameSizeAndTime() throws Exception {
+        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
+        Path a = Files.writeString(world.resolve("a.dat"), "before", StandardCharsets.UTF_8);
+        Files.setLastModifiedTime(a, FileTime.from(Instant.now().minus(Duration.ofHours(1))));
+        Files.writeString(world.resolve("b.dat"), "stable", StandardCharsets.UTF_8);
+
+        try (CapturedBackup captured = capture(factory(sameTickWrite(a)), CaptureKind.OPEN_WORLD, world)) {
+            assertEquals("after!", Files.readString(captured.capture().worldDirectory().resolve("a.dat")));
         }
     }
 
     @Test
-    void rejectsSameSizeMutationDespiteFileTimestampDrift() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world-file-content-final"));
-        Path first = world.resolve("a.dat");
-        Files.writeString(first, "before", StandardCharsets.UTF_8);
-        Files.writeString(world.resolve("b.dat"), "second", StandardCharsets.UTF_8);
-        Path captures = temporaryDirectory.resolve("captures-file-content-final");
-        FileTime changedTime = FileTime.from(Instant.parse("2026-07-17T12:04:00Z"));
-        AtomicInteger mutations = new AtomicInteger();
-        SourceCaptureObserver mutator = new SourceCaptureObserver() {
-            @Override
-            public void afterFileCopy(Path relativePath) throws IOException {
-                if (relativePath.equals(Path.of("b.dat"))) {
-                    Files.writeString(
-                            first,
-                            "chg--" + mutations.incrementAndGet(),
-                            StandardCharsets.UTF_8);
-                    Files.setLastModifiedTime(first, changedTime);
-                }
-            }
-        };
-        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(captures, mutator);
+    void aNameThatAnotherSystemCannotRestoreFailsTheCaptureAndIsNamed() throws Exception {
+        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
+        Files.writeString(world.resolve("level.dat"), "level", StandardCharsets.UTF_8);
+        Files.writeString(Files.createDirectory(world.resolve("datapacks")).resolve("aux.json"), "{}");
 
-        assertThrows(IOException.class, () -> factory.capture(
-                request(world, BackupTrigger.MANUAL),
-                BackupId.create(),
-                CREATED_AT,
-                Optional.empty(),
-                CaptureProgressListener.NO_OP));
+        IOException failure = assertThrows(IOException.class, () -> capture(factory(SourceCaptureObserver.NONE), world));
+
+        assertTrue(failure.getMessage().contains("\"datapacks/aux.json\""), failure.getMessage());
+        assertTrue(failure.getMessage().contains("Rename or remove it"), failure.getMessage());
+    }
 
-        try (var entries = Files.list(captures)) {
-            assertEquals(List.of(), entries.toList());
+    @Test
+    void aLinkInsideTheWorldFailsTheCaptureAndIsNamed() throws Exception {
+        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
+        Path outside = Files.writeString(temporaryDirectory.resolve("outside.dat"), "not the world's");
+        try {
+            Files.createSymbolicLink(world.resolve("linked.dat"), outside);
+        } catch (IOException | UnsupportedOperationException exception) {
+            Assumptions.abort("Symbolic links are unavailable: " + exception.getMessage());
         }
+
+        IOException failure = assertThrows(IOException.class, () -> capture(factory(SourceCaptureObserver.NONE), world));
+
+        assertTrue(failure.getMessage().contains("\"linked.dat\" is a link"), failure.getMessage());
     }
 
     @Test
-    void rejectsSameSizeMutationWhenFileTimestampIsRestored() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world-file-content-hidden"));
-        Path first = world.resolve("a.dat");
-        Files.writeString(first, "before", StandardCharsets.UTF_8);
-        Files.writeString(world.resolve("b.dat"), "second", StandardCharsets.UTF_8);
-        FileTime originalTime = Files.getLastModifiedTime(first);
-        Files.writeString(first, "after!", StandardCharsets.UTF_8);
-        Files.setLastModifiedTime(first, originalTime);
-        Assumptions.assumeTrue(
-                Files.getLastModifiedTime(first).equals(originalTime),
-                "The file system cannot restore the source timestamp");
-        Files.writeString(first, "before", StandardCharsets.UTF_8);
-        Files.setLastModifiedTime(first, originalTime);
-
-        Path captures = temporaryDirectory.resolve("captures-file-content-hidden");
-        AtomicInteger mutations = new AtomicInteger();
-        SourceCaptureObserver mutator = new SourceCaptureObserver() {
+    void rejectsACaptureFolderInsideTheWorld() throws Exception {
+        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
+        Files.writeString(world.resolve("level.dat"), "contents", StandardCharsets.UTF_8);
+        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(
+                world.resolve("captures"), Optional.empty(), SourceCaptureObserver.NONE);
+
+        assertThrows(IOException.class, () -> capture(factory, world));
+        assertFalse(Files.exists(world.resolve("captures")));
+    }
+
+    @Test
+    void stampsCapturesWithTheInjectedGameVersionOnly() throws Exception {
+        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
+        Files.writeString(world.resolve("level.dat"), "stamped", StandardCharsets.UTF_8);
+        GameVersionStamp stamp = new GameVersionStamp("26.2", 4_820);
+        FileSystemBackupCaptureFactory stamped = new FileSystemBackupCaptureFactory(
+                temporaryDirectory.resolve("captures"), Optional.of(stamp), SourceCaptureObserver.NONE);
+
+        try (CapturedBackup withVersion = capture(stamped, world);
+                CapturedBackup withoutVersion = capture(factory(SourceCaptureObserver.NONE), world)) {
+            assertEquals(Optional.of(stamp), withVersion.capture().manifest().gameVersion());
+            assertEquals(Optional.empty(), withoutVersion.capture().manifest().gameVersion());
+        }
+    }
+
+    /** Rewrites the file once, right after its first copy, and puts its old modification time back. */
+    private static SourceCaptureObserver sameTickWrite(Path file) {
+        AtomicBoolean written = new AtomicBoolean();
+        return new SourceCaptureObserver() {
             @Override
             public void afterFileCopy(Path relativePath) throws IOException {
-                if (relativePath.equals(Path.of("b.dat"))) {
-                    Files.writeString(
-                            first,
-                            "chg--" + mutations.incrementAndGet(),
-                            StandardCharsets.UTF_8);
-                    Files.setLastModifiedTime(first, originalTime);
+                if (relativePath.equals(file.getFileName()) && written.compareAndSet(false, true)) {
+                    FileTime tick = Files.getLastModifiedTime(file);
+                    Files.writeString(file, "after!", StandardCharsets.UTF_8);
+                    Files.setLastModifiedTime(file, tick);
                 }
             }
         };
-        FileSystemBackupCaptureFactory factory = new FileSystemBackupCaptureFactory(captures, mutator);
+    }
 
-        assertThrows(IOException.class, () -> factory.capture(
-                request(world, BackupTrigger.MANUAL),
-                BackupId.create(),
-                CREATED_AT,
-                Optional.empty(),
-                CaptureProgressListener.NO_OP));
+    private FileSystemBackupCaptureFactory factory(SourceCaptureObserver observer) {
+        return new FileSystemBackupCaptureFactory(temporaryDirectory.resolve("captures"), Optional.empty(), observer);
+    }
 
-        try (var entries = Files.list(captures)) {
-            assertEquals(List.of(), entries.toList());
-        }
+    private static CapturedBackup capture(FileSystemBackupCaptureFactory factory, Path world)
+            throws IOException, InterruptedException {
+        return capture(factory, CaptureKind.CLOSED_WORLD, world);
     }
 
-    private static CreateBackupRequest request(Path world, BackupTrigger trigger) {
-        return new CreateBackupRequest(
-                WorldId.create(),
-                world,
-                "Test World",
-                trigger);
+    private static CapturedBackup capture(FileSystemBackupCaptureFactory factory, CaptureKind kind, Path world)
+            throws IOException, InterruptedException {
+        return factory.capture(request(world), kind, BackupId.create(), CREATED_AT, Optional.empty(),
+                CaptureProgressListener.NO_OP);
     }
 
-    private static Path captureRoot(Path captures, UUID captureId) {
-        return captures.resolve(".capture-" + captureId);
+    private static CreateBackupRequest request(Path world) {
+        return new CreateBackupRequest(WorldId.create(), world, "Test World", Optional.empty(), BackupTrigger.MANUAL);
     }
 
-    private static Path markerForCapture(Path captureRoot) {
-        return captureRoot.resolveSibling(captureRoot.getFileName() + ".worldarchive-owner");
+    /** Files and empty folders below {@code root}, as sorted portable paths. */
+    private static List<String> relativeEntries(Path root) throws IOException {
+        if (!Files.exists(root)) {
+            return List.of();
+        }
+        try (Stream<Path> entries = Files.walk(root)) {
+            return entries.filter(entry -> !entry.equals(root))
+                    .filter(entry -> Files.isRegularFile(entry) || isEmptyFolder(entry))
+                    .map(entry -> root.relativize(entry).toString().replace('\\', '/'))
+                    .sorted()
+                    .toList();
+        }
     }
 
-    private static Path writeOwnershipMarker(Path captures, UUID fileId, UUID contentsId)
-            throws IOException {
-        Path marker = markerForCapture(captureRoot(captures, fileId));
-        Files.writeString(
-                marker,
-                "worldarchive-private-capture-v1:" + contentsId + '\n',
-                StandardCharsets.UTF_8);
-        return marker;
+    private static boolean isEmptyFolder(Path entry) {
+        try (Stream<Path> children = Files.list(entry)) {
+            return children.findAny().isEmpty();
+        } catch (IOException exception) {
+            return false;
+        }
     }
 
-    private static WorldInventory.Entry entry(String path, byte[] contents) throws Exception {
-        return new WorldInventory.Entry(
-                path,
-                contents.length,
-                HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(contents)));
+    private static WorldInventory.Entry entry(String path, String contents) {
+        byte[] bytes = contents.getBytes(StandardCharsets.UTF_8);
+        return new WorldInventory.Entry(path, bytes.length, Digests.hex(Digests.sha256().digest(bytes)));
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/core/FileSystemSafetyTest.java b/src/test/java/dev/ishaanko/worldarchive/core/FileSystemSafetyTest.java
deleted file mode 100644
index 712579f..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/core/FileSystemSafetyTest.java
+++ /dev/null
@@ -1,55 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.nio.file.attribute.BasicFileAttributes;
-import org.junit.jupiter.api.Assumptions;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-final class FileSystemSafetyTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void classifiesOrdinaryDirectoriesAndFiles() throws IOException {
-        Path directory = Files.createDirectory(temporaryDirectory.resolve("directory"));
-        Path file = Files.writeString(temporaryDirectory.resolve("file.dat"), "data");
-        BasicFileAttributes directoryAttributes = attributes(directory);
-        BasicFileAttributes fileAttributes = attributes(file);
-
-        assertTrue(FileSystemSafety.isOrdinaryDirectory(directory, directoryAttributes));
-        assertFalse(FileSystemSafety.isOrdinaryRegularFile(directory, directoryAttributes));
-        assertTrue(FileSystemSafety.isOrdinaryRegularFile(file, fileAttributes));
-        assertFalse(FileSystemSafety.isOrdinaryDirectory(file, fileAttributes));
-    }
-
-    @Test
-    void rejectsSymbolicLinks() throws IOException {
-        Path target = Files.writeString(temporaryDirectory.resolve("target.dat"), "data");
-        Path link = temporaryDirectory.resolve("link.dat");
-        try {
-            Files.createSymbolicLink(link, target.getFileName());
-        } catch (IOException | UnsupportedOperationException | SecurityException exception) {
-            Assumptions.assumeTrue(
-                    false,
-                    "Symbolic links are unavailable: " + exception.getMessage());
-        }
-
-        BasicFileAttributes attributes = attributes(link);
-        assertFalse(FileSystemSafety.isOrdinaryDirectory(link, attributes));
-        assertFalse(FileSystemSafety.isOrdinaryRegularFile(link, attributes));
-    }
-
-    private static BasicFileAttributes attributes(Path path) throws IOException {
-        return Files.readAttributes(
-                path,
-                BasicFileAttributes.class,
-                LinkOption.NOFOLLOW_LINKS);
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/core/FileWorldInventoryStoreTest.java b/src/test/java/dev/ishaanko/worldarchive/core/FileWorldInventoryStoreTest.java
deleted file mode 100644
index 9755ac5..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/core/FileWorldInventoryStoreTest.java
+++ /dev/null
@@ -1,65 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.security.MessageDigest;
-import java.util.HexFormat;
-import java.util.List;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-final class FileWorldInventoryStoreTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void atomicallyRoundTripsInventoryOutsideWorld() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
-        Path state = temporaryDirectory.resolve("state");
-        WorldId worldId = WorldId.create();
-        WorldInventory inventory = WorldInventory.create(List.of(
-                entry("level.dat", "contents")));
-
-        FileWorldInventoryStore store = new FileWorldInventoryStore(state);
-        store.save(worldId, inventory);
-
-        assertEquals(inventory, store.load(worldId).orElseThrow());
-        try (var entries = Files.list(world)) {
-            assertEquals(List.of(), entries.toList());
-        }
-        assertEquals(state.toAbsolutePath().normalize(), store.directory());
-    }
-
-    @Test
-    void rejectsIdentityMismatchAndMalformedState() throws Exception {
-        Path state = Files.createDirectory(temporaryDirectory.resolve("state"));
-        WorldId requested = WorldId.create();
-        WorldId other = WorldId.create();
-        Files.writeString(
-                state.resolve(requested + ".json"),
-                """
-                {"schemaVersion":1,"worldId":"%s","files":[]}
-                """.formatted(other),
-                StandardCharsets.UTF_8);
-
-        FileWorldInventoryStore store = new FileWorldInventoryStore(state);
-        assertThrows(IOException.class, () -> store.load(requested));
-
-        Files.writeString(state.resolve(requested + ".json"), "not-json", StandardCharsets.UTF_8);
-        assertThrows(IOException.class, () -> store.load(requested));
-    }
-
-    private static WorldInventory.Entry entry(String path, String contents) throws Exception {
-        byte[] bytes = contents.getBytes(StandardCharsets.UTF_8);
-        return new WorldInventory.Entry(
-                path,
-                bytes.length,
-                HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(bytes)));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/core/NoCatchUpScheduleTest.java b/src/test/java/dev/ishaanko/worldarchive/core/NoCatchUpScheduleTest.java
deleted file mode 100644
index 24107e2..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/core/NoCatchUpScheduleTest.java
+++ /dev/null
@@ -1,35 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.time.Duration;
-import java.time.Instant;
-import org.junit.jupiter.api.Test;
-
-final class NoCatchUpScheduleTest {
-    private static final Instant START = Instant.parse("2026-07-17T12:00:00Z");
-
-    @Test
-    void schedulesFromObservationTimeWithoutCatchUpBursts() {
-        NoCatchUpSchedule schedule = new NoCatchUpSchedule(Duration.ofMinutes(30), START);
-
-        assertTrue(schedule.poll(START.plusSeconds(1_799)).isEmpty());
-        assertEquals(START.plusSeconds(1_800), schedule.poll(START.plus(Duration.ofDays(2))).orElseThrow());
-        assertEquals(
-                START.plus(Duration.ofDays(2)).plus(Duration.ofMinutes(30)),
-                schedule.nextRunAt());
-        assertTrue(schedule.poll(START.plus(Duration.ofDays(2)).plusSeconds(1)).isEmpty());
-    }
-
-    @Test
-    void resetStartsFreshInterval() {
-        NoCatchUpSchedule schedule = NoCatchUpSchedule.minutes(30, START);
-        Instant reopened = START.plus(Duration.ofDays(3));
-
-        schedule.reset(reopened);
-
-        assertEquals(reopened.plus(Duration.ofMinutes(30)), schedule.nextRunAt());
-        assertTrue(schedule.poll(reopened).isEmpty());
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/core/OperationProgressTest.java b/src/test/java/dev/ishaanko/worldarchive/core/OperationProgressTest.java
deleted file mode 100644
index 6503c81..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/core/OperationProgressTest.java
+++ /dev/null
@@ -1,45 +0,0 @@
-package dev.ishaanko.worldarchive.core;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.util.Optional;
-import org.junit.jupiter.api.Test;
-
-final class OperationProgressTest {
-    @Test
-    void reportsKnownAndUnknownFractions() {
-        OperationProgress known = new OperationProgress(
-                OperationId.create(),
-                WorldId.create(),
-                Optional.empty(),
-                BackupOperation.CREATE,
-                OperationPhase.WRITING,
-                25,
-                100,
-                "Writing");
-        OperationProgress unknown = new OperationProgress(
-                OperationId.create(),
-                WorldId.create(),
-                Optional.empty(),
-                BackupOperation.CREATE,
-                OperationPhase.READING,
-                25,
-                0,
-                "Scanning");
-
-        assertEquals(0.25, known.fraction().orElseThrow());
-        assertTrue(unknown.fraction().isEmpty());
-        assertThrows(IllegalArgumentException.class, () -> new OperationProgress(
-                OperationId.create(),
-                WorldId.create(),
-                Optional.empty(),
-                BackupOperation.CREATE,
-                OperationPhase.WRITING,
-                101,
-                100,
-                "Invalid"));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/core/SerializedBackupCoordinatorTest.java b/src/test/java/dev/ishaanko/worldarchive/core/SerializedBackupCoordinatorTest.java
index 3acd65d..6c237ff 100644
--- a/src/test/java/dev/ishaanko/worldarchive/core/SerializedBackupCoordinatorTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/core/SerializedBackupCoordinatorTest.java
@@ -2,25 +2,23 @@
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
-import dev.ishaanko.worldarchive.catalog.BackupCatalog;
-import dev.ishaanko.worldarchive.core.CoordinatorFakes.BlockingCatalog;
-import dev.ishaanko.worldarchive.core.CoordinatorFakes.FakeBackend;
-import dev.ishaanko.worldarchive.core.CoordinatorFakes.FakeCaptureFactory;
-import dev.ishaanko.worldarchive.core.CoordinatorFakes.InMemoryCatalog;
-import dev.ishaanko.worldarchive.core.CoordinatorFakes.InMemoryInventoryStore;
-import dev.ishaanko.worldarchive.core.CoordinatorFakes.UnusedMaintenanceService;
+import dev.ishaanko.worldarchive.catalog.FileBackupCatalog;
 import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.BackupOperation;
 import dev.ishaanko.worldarchive.model.BackupResult;
 import dev.ishaanko.worldarchive.model.BackupStatus;
 import dev.ishaanko.worldarchive.model.BackupTrigger;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationStatus;
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.OperationId;
+import dev.ishaanko.worldarchive.model.OperationPhase;
+import dev.ishaanko.worldarchive.model.OperationProgress;
+import dev.ishaanko.worldarchive.model.ProgressListener;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
@@ -30,785 +28,509 @@
 import java.time.Instant;
 import java.time.ZoneOffset;
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CompletionStage;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.CopyOnWriteArrayList;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
-import java.util.concurrent.Future;
 import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicInteger;
-import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.BooleanSupplier;
+import java.util.stream.Stream;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
+/** The coordinator on a real catalog, inventory store and capture of a world folder; only destinations are fakes. */
 final class SerializedBackupCoordinatorTest {
     private static final Instant NOW = Instant.parse("2026-07-17T12:00:00Z");
 
     @TempDir
     Path temporaryDirectory;
 
-    private ExecutorService coordinatorExecutor;
+    private final ExecutorService executor = Executors.newThreadPerTaskExecutor(Thread.ofVirtual().factory());
+
+    private final WorldId worldId = WorldId.create();
+
+    private FileBackupCatalog catalog;
+
+    private FileWorldInventoryStore inventories;
+
+    private Path world;
 
     @BeforeEach
-    void setUp() {
-        coordinatorExecutor = Executors.newFixedThreadPool(4);
+    void createWorld() throws IOException {
+        catalog = new FileBackupCatalog(temporaryDirectory.resolve("catalog.json"));
+        inventories = new FileWorldInventoryStore(temporaryDirectory.resolve("inventories"));
+        world = createWorld("world");
     }
 
     @AfterEach
-    void tearDown() throws Exception {
-        coordinatorExecutor.shutdownNow();
-        assertTrue(coordinatorExecutor.awaitTermination(5, TimeUnit.SECONDS));
+    void stopWorkers() throws InterruptedException {
+        executor.shutdownNow();
+        assertTrue(executor.awaitTermination(5, TimeUnit.SECONDS));
     }
 
     @Test
-    void gateUsesCallerControlledThreadAndExitsBeforeDestinationBegins() throws Exception {
-        InMemoryCatalog catalog = new InMemoryCatalog();
-        InMemoryInventoryStore inventories = new InMemoryInventoryStore();
-        FakeCaptureFactory captures = new FakeCaptureFactory(temporaryDirectory.resolve("captures"));
-        AtomicReference<String> captureThread = new AtomicReference<>();
-        captures.observer = ignored -> captureThread.set(Thread.currentThread().getName());
-        AtomicBoolean gateExited = new AtomicBoolean();
-        ExecutorService gateExecutor = Executors.newSingleThreadExecutor(runnable ->
-                new Thread(runnable, "server-capture-thread"));
-        BackupCaptureGate gate = task -> {
-            try {
-                CapturedBackup result = gateExecutor.submit(task::capture).get();
-                gateExited.set(true);
-                return result;
-            } catch (ExecutionException exception) {
-                if (exception.getCause() instanceof IOException ioException) {
-                    throw ioException;
-                }
-                if (exception.getCause() instanceof InterruptedException interruptedException) {
-                    throw interruptedException;
-                }
-                throw new IOException("Capture gate failed", exception.getCause());
-            }
-        };
-        AtomicBoolean backendAfterGate = new AtomicBoolean();
-        FakeBackend backend = new FakeBackend(DestinationType.ZIP, capture -> {
-            backendAfterGate.set(gateExited.get());
-            return CompletableFuture.completedFuture(DestinationResult.success(
-                    DestinationType.ZIP,
-                    "archive"));
+    void writesEveryDestinationFromOneCaptureAndRecordsTheBackupOnce() throws Exception {
+        List<Path> captures = new CopyOnWriteArrayList<>();
+        FakeBackend git = FakeBackend.writing(DestinationType.GIT, (capture, listener) -> {
+            captures.add(capture.worldDirectory());
+            return DestinationResult.success(DestinationType.GIT, "ref");
         });
-        SerializedBackupCoordinator coordinator = coordinator(
-                catalog,
-                inventories,
-                captures,
-                List.of(backend),
-                gate,
-                new LockingWorldOperationGate());
-        try {
-            BackupResult result = coordinator.createBackup(
-                            request(WorldId.create(), "world-a", BackupTrigger.MANUAL, Optional.empty()),
-                            ProgressListener.NO_OP)
-                    .toCompletableFuture()
-                    .get(5, TimeUnit.SECONDS);
-
-            assertEquals(BackupStatus.SUCCESS, result.status());
-            assertEquals("server-capture-thread", captureThread.get());
-            assertTrue(backendAfterGate.get());
-        } finally {
-            gateExecutor.shutdownNow();
-            assertTrue(gateExecutor.awaitTermination(5, TimeUnit.SECONDS));
-        }
-    }
-
-    @Test
-    void preparedCaptureIsSynchronousAndQueuesOnlyDestinationWork() throws Exception {
-        InMemoryCatalog catalog = new InMemoryCatalog();
-        InMemoryInventoryStore inventories = new InMemoryInventoryStore();
-        FakeCaptureFactory captures = new FakeCaptureFactory(temporaryDirectory.resolve("captures"));
-        AtomicReference<Thread> captureThread = new AtomicReference<>();
-        captures.observer = ignored -> captureThread.set(Thread.currentThread());
-        FakeBackend backend = FakeBackend.success(DestinationType.ZIP);
-        BackupCaptureGate forbiddenGate = task -> {
-            throw new AssertionError("Prepared captures must not re-enter the async capture gate");
-        };
-        LockingWorldOperationGate operationGate = new LockingWorldOperationGate();
-        SerializedBackupCoordinator coordinator = coordinator(
-                catalog,
-                inventories,
-                captures,
-                List.of(backend),
-                forbiddenGate,
-                operationGate);
-        CreateBackupRequest request = request(
-                WorldId.create(), "world-a", BackupTrigger.WORLD_EXIT, Optional.empty());
-
-        PreparedBackup prepared = coordinator.prepareCapture(request, CaptureProgressListener.NO_OP);
-        assertSame(Thread.currentThread(), captureThread.get());
-        assertEquals(0, backend.calls.get());
-
-        BackupResult result = coordinator.createPreparedBackup(prepared, ProgressListener.NO_OP)
-                .toCompletableFuture()
-                .get(5, TimeUnit.SECONDS);
-        assertEquals(BackupStatus.SUCCESS, result.status());
-        assertEquals(1, backend.calls.get());
-        try (WorldOperationGate.Permit ignored = operationGate.enter(request.worldId())) {
-            assertTrue(true);
-        }
+        FakeBackend zip = FakeBackend.writing(DestinationType.ZIP, (capture, listener) -> {
+            captures.add(capture.worldDirectory());
+            throw new IllegalStateException("untrustworthy failure");
+        });
+        SerializedBackupCoordinator coordinator = coordinator(git, zip);
+
+        BackupResult first = await(coordinator.createBackup(request(BackupTrigger.MANUAL), ProgressListener.NO_OP));
+        BackupResult second = await(coordinator.createBackup(request(BackupTrigger.MANUAL), ProgressListener.NO_OP));
+
+        assertEquals(BackupStatus.PARTIAL_SUCCESS, first.status());
+        assertEquals(DestinationStatus.FAILED, destination(first, DestinationType.ZIP).status());
+        assertEquals(2, catalog.list(worldId).size());
+        assertEquals(2, changedFiles(first));
+        assertEquals(0, changedFiles(second));
+        assertEquals(captures.get(0), captures.get(1));
+        assertEquals(List.of(), worldCopies());
     }
 
     @Test
-    void preparedCaptureReleaseObserversRunOnceForCloseAndClaim() throws Exception {
-        SerializedBackupCoordinator coordinator = coordinator(
-                new InMemoryCatalog(),
-                new InMemoryInventoryStore(),
-                new FakeCaptureFactory(temporaryDirectory.resolve("captures")),
-                List.of(FakeBackend.success(DestinationType.ZIP)),
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate());
-        CreateBackupRequest request = request(
-                WorldId.create(), "world-a", BackupTrigger.MANUAL, Optional.empty());
-        AtomicInteger closedReleases = new AtomicInteger();
-        PreparedBackup closed = coordinator.prepareCapture(
-                request,
-                CaptureProgressListener.NO_OP);
-        closed.addReleaseObserver(closedReleases::incrementAndGet);
-
-        closed.close();
-        closed.close();
-        assertEquals(1, closedReleases.get());
-        AtomicInteger lateReleases = new AtomicInteger();
-        closed.addReleaseObserver(lateReleases::incrementAndGet);
-        assertEquals(1, lateReleases.get());
-
-        AtomicInteger claimedReleases = new AtomicInteger();
-        PreparedBackup claimed = coordinator.prepareCapture(
-                request,
-                CaptureProgressListener.NO_OP);
-        claimed.addReleaseObserver(claimedReleases::incrementAndGet);
-        coordinator.createPreparedBackup(claimed, ProgressListener.NO_OP)
-                .toCompletableFuture()
-                .get(5, TimeUnit.SECONDS);
-        assertEquals(1, claimedReleases.get());
-    }
+    void aDamagedInventoryFileCountsEveryFileAsChangedAndIsReplaced() throws Exception {
+        Path inventory = temporaryDirectory.resolve("inventories").resolve(worldId + ".json");
+        Files.createDirectories(inventory.getParent());
+        Files.writeString(inventory, "not json", StandardCharsets.UTF_8);
+        SerializedBackupCoordinator coordinator = coordinator(FakeBackend.success(DestinationType.ZIP));
 
-    @Test
-    void preparedCaptureReleaseObserverCannotBlockOwnershipTransfer() throws Exception {
-        Path captures = temporaryDirectory.resolve("captures-release-observer");
-        FakeBackend backend = FakeBackend.success(DestinationType.ZIP);
-        SerializedBackupCoordinator coordinator = coordinator(
-                new InMemoryCatalog(),
-                new InMemoryInventoryStore(),
-                new FakeCaptureFactory(captures),
-                List.of(backend),
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate());
-        PreparedBackup prepared = coordinator.prepareCapture(
-                request(
-                        WorldId.create(),
-                        "world-release-observer",
-                        BackupTrigger.MANUAL,
-                        Optional.empty()),
-                CaptureProgressListener.NO_OP);
-        prepared.addReleaseObserver(() -> {
-            throw new IllegalStateException("observer failure");
-        });
-
-        BackupResult result = coordinator.createPreparedBackup(prepared, ProgressListener.NO_OP)
-                .toCompletableFuture()
-                .get(5, TimeUnit.SECONDS);
+        BackupResult manual = await(coordinator.createBackup(request(BackupTrigger.MANUAL), ProgressListener.NO_OP));
+        PreparedBackup exitCapture = coordinator.prepareCapture(
+                request(BackupTrigger.WORLD_EXIT), CaptureKind.CLOSED_WORLD, ProgressListener.NO_OP);
+        BackupResult exit = await(coordinator.createPreparedBackup(exitCapture, ProgressListener.NO_OP));
 
-        assertEquals(BackupStatus.SUCCESS, result.status());
-        assertEquals(1, backend.calls.get());
-        try (var entries = Files.list(captures)) {
-            assertEquals(List.of(), entries.toList());
-        }
+        assertEquals(BackupStatus.SUCCESS, manual.status());
+        assertEquals(BackupStatus.SUCCESS, exit.status());
+        assertEquals(2, changedFiles(manual));
+        assertEquals(0, changedFiles(exit));
     }
 
     @Test
-    void preparedCaptureClosesResourcesWhenAReleaseObserverThrowsAnError() throws Exception {
-        Path captures = temporaryDirectory.resolve("captures-release-error");
-        SerializedBackupCoordinator coordinator = coordinator(
-                new InMemoryCatalog(),
-                new InMemoryInventoryStore(),
-                new FakeCaptureFactory(captures),
-                List.of(FakeBackend.success(DestinationType.ZIP)),
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate());
-        PreparedBackup prepared = coordinator.prepareCapture(
-                request(
-                        WorldId.create(),
-                        "world-release-error",
-                        BackupTrigger.MANUAL,
-                        Optional.empty()),
-                CaptureProgressListener.NO_OP);
-        prepared.addReleaseObserver(() -> {
-            throw new AssertionError("observer error");
-        });
+    void aPreparedCaptureIsCompleteWhenItReturnsAndOnlyItsDestinationWorkIsQueued() throws Exception {
+        FakeBackend zip = FakeBackend.success(DestinationType.ZIP);
+        SerializedBackupCoordinator coordinator = coordinator(zip);
 
-        assertThrows(
-                AssertionError.class,
-                () -> coordinator.createPreparedBackup(prepared, ProgressListener.NO_OP));
+        PreparedBackup prepared = coordinator.prepareCapture(
+                request(BackupTrigger.WORLD_EXIT), CaptureKind.CLOSED_WORLD, ProgressListener.NO_OP);
+        assertEquals(2, worldCopies().size());
+        assertEquals(0, zip.calls.get());
+        assertTrue(coordinator.isBusy(worldId));
+        BackupResult result = await(coordinator.createPreparedBackup(prepared, ProgressListener.NO_OP));
+        PreparedBackup abandoned = coordinator.prepareCapture(
+                request(BackupTrigger.WORLD_EXIT), CaptureKind.CLOSED_WORLD, ProgressListener.NO_OP);
+        abandoned.close();
 
-        try (var entries = Files.list(captures)) {
-            assertEquals(List.of(), entries.toList());
-        }
+        assertEquals(BackupStatus.SUCCESS, result.status());
+        assertEquals(1, zip.calls.get());
+        assertFalse(coordinator.isBusy(worldId));
+        assertEquals(List.of(), worldCopies());
+        assertEquals(BackupStatus.SUCCESS, await(coordinator.createBackup(
+                request(BackupTrigger.MANUAL), ProgressListener.NO_OP)).status());
     }
 
     @Test
-    void coalescesCompatibleCreatesSerializesOneWorldAndRunsOtherWorld() throws Exception {
-        InMemoryCatalog catalog = new InMemoryCatalog();
-        InMemoryInventoryStore inventories = new InMemoryInventoryStore();
-        FakeCaptureFactory captures = new FakeCaptureFactory(temporaryDirectory.resolve("captures"));
+    void backupsOfOneWorldWriteInOrderWhileAnotherWorldProceeds() throws Exception {
+        WorldId otherWorldId = WorldId.create();
+        Path otherWorld = createWorld("other-world");
         Map<String, CompletableFuture<DestinationResult>> releases = new ConcurrentHashMap<>();
-        FakeBackend backend = new FakeBackend(DestinationType.ZIP, capture -> {
-            String key = key(capture.manifest());
-            CompletableFuture<DestinationResult> release = new CompletableFuture<>();
-            releases.put(key, release);
-            return release;
-        });
-        SerializedBackupCoordinator coordinator = coordinator(
-                catalog,
-                inventories,
-                captures,
-                List.of(backend),
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate());
-        WorldId worldA = WorldId.create();
-        WorldId worldB = WorldId.create();
-        CreateBackupRequest firstRequest = request(
-                worldA, "world-a", BackupTrigger.MANUAL, Optional.empty());
-        CompletionStage<BackupResult> first = coordinator.createBackup(
-                firstRequest, ProgressListener.NO_OP);
-        CompletionStage<BackupResult> coalesced = coordinator.createBackup(
-                firstRequest, ProgressListener.NO_OP);
-        CompletionStage<BackupResult> queued = coordinator.createBackup(
-                request(worldA, "world-a", BackupTrigger.MANUAL, Optional.of("later")),
-                ProgressListener.NO_OP);
-        CompletionStage<BackupResult> otherWorld = coordinator.createBackup(
-                request(worldB, "world-b", BackupTrigger.MANUAL, Optional.empty()),
-                ProgressListener.NO_OP);
-
-        assertSame(first, coalesced);
-        await(() -> releases.containsKey(worldA + ":none")
-                && releases.containsKey(worldB + ":none"));
-        assertFalse(releases.containsKey(worldA + ":later"));
-
-        releases.get(worldB + ":none").complete(DestinationResult.success(DestinationType.ZIP, "b"));
-        releases.get(worldA + ":none").complete(DestinationResult.success(DestinationType.ZIP, "a"));
-        assertEquals(BackupStatus.SUCCESS, otherWorld.toCompletableFuture().get(5, TimeUnit.SECONDS).status());
-        assertEquals(BackupStatus.SUCCESS, first.toCompletableFuture().get(5, TimeUnit.SECONDS).status());
-        await(() -> releases.containsKey(worldA + ":later"));
-        releases.get(worldA + ":later").complete(DestinationResult.success(DestinationType.ZIP, "later"));
-        assertEquals(BackupStatus.SUCCESS, queued.toCompletableFuture().get(5, TimeUnit.SECONDS).status());
-        assertEquals(3, captures.calls.get());
+        FakeBackend zip = FakeBackend.awaiting(DestinationType.ZIP, capture -> releases.computeIfAbsent(
+                capture.manifest().label().orElseThrow(), ignored -> new CompletableFuture<>()));
+        SerializedBackupCoordinator coordinator = coordinator(zip);
+        List<OperationProgress> secondProgress = Collections.synchronizedList(new ArrayList<>());
+
+        CompletableFuture<BackupResult> first = start(coordinator, request(worldId, world, "first"), ProgressListener.NO_OP);
+        awaitCondition(() -> releases.containsKey("first"));
+        CompletableFuture<BackupResult> second = start(coordinator, request(worldId, world, "second"), secondProgress::add);
+        CompletableFuture<BackupResult> other = start(
+                coordinator, request(otherWorldId, otherWorld, "other"), ProgressListener.NO_OP);
+        awaitCondition(() -> releases.containsKey("other")
+                && secondProgress.stream().anyMatch(progress -> progress.phase() == OperationPhase.QUEUED));
+        releases.get("other").complete(DestinationResult.success(DestinationType.ZIP, "other"));
+
+        assertEquals(BackupStatus.SUCCESS, other.get(5, TimeUnit.SECONDS).status());
+        assertFalse(releases.containsKey("second"));
+        releases.get("first").complete(DestinationResult.success(DestinationType.ZIP, "first"));
+        assertEquals(BackupStatus.SUCCESS, first.get(5, TimeUnit.SECONDS).status());
+        awaitCondition(() -> releases.containsKey("second"));
+        releases.get("second").complete(DestinationResult.success(DestinationType.ZIP, "second"));
+        assertEquals(BackupStatus.SUCCESS, second.get(5, TimeUnit.SECONDS).status());
     }
 
     @Test
-    void mergesPartialResultsAndPersistsCatalogAndInventoryOnce() throws Exception {
-        InMemoryCatalog catalog = new InMemoryCatalog();
-        InMemoryInventoryStore inventories = new InMemoryInventoryStore();
-        FakeCaptureFactory captures = new FakeCaptureFactory(temporaryDirectory.resolve("captures"));
-        List<Path> observedRoots = new java.util.concurrent.CopyOnWriteArrayList<>();
-        FakeBackend git = new FakeBackend(DestinationType.GIT, capture -> {
-            observedRoots.add(capture.worldDirectory());
-            return CompletableFuture.completedFuture(DestinationResult.success(DestinationType.GIT, "ref"));
-        });
-        FakeBackend zip = new FakeBackend(DestinationType.ZIP, capture -> {
-            observedRoots.add(capture.worldDirectory());
-            return CompletableFuture.failedFuture(new IOException("untrustworthy failure"));
-        });
-        SerializedBackupCoordinator coordinator = coordinator(
-                catalog,
-                inventories,
-                captures,
-                List.of(git, zip),
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate());
-        WorldId worldId = WorldId.create();
-
-        BackupResult result = coordinator.createBackup(
-                        request(worldId, "world-a", BackupTrigger.MANUAL, Optional.empty()),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture()
-                .get(5, TimeUnit.SECONDS);
-
-        assertEquals(BackupStatus.PARTIAL_SUCCESS, result.status());
-        assertEquals(1, catalog.records.size());
-        assertTrue(inventories.values.containsKey(worldId));
-        assertEquals(2, observedRoots.size());
-        assertEquals(1, observedRoots.stream().distinct().count());
-        assertFalse(Files.exists(observedRoots.getFirst()));
-    }
+    void destinationsWaitWhileMaintenanceHoldsTheWorld() throws Exception {
+        LockingWorldOperationGate shared = new LockingWorldOperationGate();
+        WorldOperationGate.Permit maintenance = shared.enter(worldId);
+        CountDownLatch waitingForWorld = new CountDownLatch(1);
+        WorldOperationGate operationGate = id -> {
+            waitingForWorld.countDown();
+            return shared.enter(id);
+        };
+        FakeBackend zip = FakeBackend.success(DestinationType.ZIP);
+        SerializedBackupCoordinator coordinator = coordinator(SourceCaptureObserver.NONE, operationGate, zip);
 
-    @Test
-    void scheduledCreateSkipsKnownUnchangedWorldWithoutPublishing() throws Exception {
-        InMemoryCatalog catalog = new InMemoryCatalog();
-        InMemoryInventoryStore inventories = new InMemoryInventoryStore();
-        FakeCaptureFactory captures = new FakeCaptureFactory(temporaryDirectory.resolve("captures"));
-        WorldId worldId = WorldId.create();
-        inventories.values.put(worldId, captures.inventory);
-        FakeBackend backend = FakeBackend.success(DestinationType.ZIP);
-        SerializedBackupCoordinator coordinator = coordinator(
-                catalog,
-                inventories,
-                captures,
-                List.of(backend),
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate());
-
-        BackupResult result = coordinator.createBackup(
-                        request(worldId, "world-a", BackupTrigger.SCHEDULED, Optional.empty()),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture()
-                .get(5, TimeUnit.SECONDS);
-
-        assertEquals(BackupStatus.SKIPPED, result.status());
-        assertEquals(List.of(DestinationStatus.SKIPPED), result.destinations().stream()
-                .map(DestinationResult::status)
-                .toList());
-        assertEquals(0, backend.calls.get());
-        assertEquals(List.of(), catalog.records);
+        CompletableFuture<BackupResult> backup = start(coordinator, request(BackupTrigger.MANUAL), ProgressListener.NO_OP);
+        assertTrue(waitingForWorld.await(5, TimeUnit.SECONDS));
+        assertEquals(0, zip.calls.get());
+        maintenance.close();
+
+        assertEquals(BackupStatus.SUCCESS, backup.get(5, TimeUnit.SECONDS).status());
     }
 
     @Test
-    void corruptInventoryDoesNotBlockManualOrPreparedExitBackups() throws Exception {
-        InMemoryCatalog catalog = new InMemoryCatalog();
-        InMemoryInventoryStore inventories = new InMemoryInventoryStore();
-        inventories.loadFailure = new IOException("simulated corrupt inventory");
-        FakeBackend backend = FakeBackend.success(DestinationType.ZIP);
-        SerializedBackupCoordinator coordinator = coordinator(
-                catalog,
-                inventories,
-                new FakeCaptureFactory(temporaryDirectory.resolve("corrupt-inventory-captures")),
-                List.of(backend),
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate());
-        WorldId worldId = WorldId.create();
-
-        BackupResult manual = coordinator.createBackup(
-                        request(worldId, "world-corrupt-inventory", BackupTrigger.MANUAL, Optional.empty()),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture()
-                .get(5, TimeUnit.SECONDS);
-        PreparedBackup preparedExit = coordinator.prepareCapture(
-                request(worldId, "world-corrupt-inventory", BackupTrigger.WORLD_EXIT, Optional.empty()),
-                CaptureProgressListener.NO_OP);
-        BackupResult exit = coordinator.createPreparedBackup(preparedExit, ProgressListener.NO_OP)
-                .toCompletableFuture()
-                .get(5, TimeUnit.SECONDS);
+    void aPreparedCaptureDoesNotWaitForAnotherBackupsDestinationsAndQueuesBehindThem() throws Exception {
+        Map<BackupTrigger, CompletableFuture<DestinationResult>> releases = new ConcurrentHashMap<>();
+        FakeBackend zip = FakeBackend.awaiting(DestinationType.ZIP, capture -> releases.computeIfAbsent(
+                capture.manifest().trigger(), ignored -> new CompletableFuture<>()));
+        SerializedBackupCoordinator coordinator = coordinator(zip);
+        CompletableFuture<BackupResult> manual = start(coordinator, request(BackupTrigger.MANUAL), ProgressListener.NO_OP);
+        awaitCondition(() -> releases.containsKey(BackupTrigger.MANUAL));
+        List<OperationProgress> exitProgress = Collections.synchronizedList(new ArrayList<>());
 
-        assertEquals(BackupStatus.SUCCESS, manual.status());
-        assertEquals(BackupStatus.SUCCESS, exit.status());
-        assertEquals(2, backend.calls.get());
-        assertEquals(2, catalog.records.size());
-        assertTrue(inventories.values.containsKey(worldId));
+        PreparedBackup prepared = coordinator.prepareCapture(
+                request(BackupTrigger.WORLD_EXIT), CaptureKind.CLOSED_WORLD, ProgressListener.NO_OP);
+        CompletableFuture<BackupResult> exit = coordinator.createPreparedBackup(prepared, exitProgress::add)
+                .toCompletableFuture();
+
+        assertEquals(OperationPhase.QUEUED, exitProgress.getLast().phase());
+        assertFalse(releases.containsKey(BackupTrigger.WORLD_EXIT));
+        releases.get(BackupTrigger.MANUAL).complete(DestinationResult.success(DestinationType.ZIP, "manual"));
+        assertEquals(BackupStatus.SUCCESS, manual.get(5, TimeUnit.SECONDS).status());
+        awaitCondition(() -> releases.containsKey(BackupTrigger.WORLD_EXIT));
+        releases.get(BackupTrigger.WORLD_EXIT).complete(DestinationResult.success(DestinationType.ZIP, "exit"));
+        assertEquals(BackupStatus.SUCCESS, exit.get(5, TimeUnit.SECONDS).status());
     }
 
     @Test
-    void cancellationInterruptsCaptureAndPublishesNothing() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world-cancel"));
-        Files.writeString(world.resolve("level.dat"), "contents", StandardCharsets.UTF_8);
-        Path capturesRoot = temporaryDirectory.resolve("captures-real");
-        CountDownLatch entered = new CountDownLatch(1);
-        CountDownLatch release = new CountDownLatch(1);
-        FileSystemBackupCaptureFactory captures = new FileSystemBackupCaptureFactory(
-                capturesRoot,
-                new SourceCaptureObserver() {
-                    @Override
-                    public void beforeFileCopy(Path relativePath) throws InterruptedException {
-                        entered.countDown();
-                        release.await();
-                    }
-                });
-        InMemoryCatalog catalog = new InMemoryCatalog();
-        InMemoryInventoryStore inventories = new InMemoryInventoryStore();
-        FakeBackend backend = FakeBackend.success(DestinationType.ZIP);
-        SerializedBackupCoordinator coordinator = coordinator(
-                catalog,
-                inventories,
-                captures,
-                List.of(backend),
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate());
-        WorldId worldId = WorldId.create();
-        CompletionStage<BackupResult> operation = coordinator.createBackup(
-                new CreateBackupRequest(
-                        worldId, world, "Cancel World", BackupTrigger.MANUAL),
-                ProgressListener.NO_OP);
-        assertTrue(entered.await(5, TimeUnit.SECONDS));
-
-        assertTrue(operation.toCompletableFuture().cancel(true));
-        release.countDown();
-        await(() -> !coordinator.isBusy(worldId));
-        await(() -> {
-            if (!Files.isDirectory(capturesRoot)) {
-                return false;
-            }
-            try (var entries = Files.list(capturesRoot)) {
-                return entries.findAny().isEmpty();
-            } catch (IOException exception) {
-                return false;
+    void cancellingWhileCapturingPublishesNothingAndDeletesTheCapture() throws Exception {
+        CountDownLatch copying = new CountDownLatch(1);
+        SourceCaptureObserver blockCopies = new SourceCaptureObserver() {
+            @Override
+            public void beforeFileCopy(Path relativePath) throws InterruptedException {
+                copying.countDown();
+                new CountDownLatch(1).await();
             }
-        });
-        assertEquals(0, backend.calls.get());
-        assertEquals(List.of(), catalog.records);
-        assertEquals(Map.of(), inventories.values);
+        };
+        FakeBackend zip = FakeBackend.success(DestinationType.ZIP);
+        SerializedBackupCoordinator coordinator = coordinator(blockCopies, new LockingWorldOperationGate(), zip);
+        CompletableFuture<BackupResult> backup = start(coordinator, request(BackupTrigger.MANUAL), ProgressListener.NO_OP);
+        assertTrue(copying.await(5, TimeUnit.SECONDS));
+
+        assertTrue(backup.cancel(true));
+
+        awaitCondition(() -> !coordinator.isBusy(worldId));
+        assertTrue(backup.isCancelled());
+        assertEquals(0, zip.calls.get());
+        assertEquals(List.of(), catalog.list(worldId));
+        assertEquals(Optional.empty(), inventories.load(worldId));
+        assertEquals(List.of(), worldCopies());
     }
 
     @Test
-    void sourceMutationFailsBeforeAnyDestinationOrCatalogPublication() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world-mutation"));
-        Files.writeString(world.resolve("level.dat"), "before", StandardCharsets.UTF_8);
-        java.util.concurrent.atomic.AtomicInteger mutations =
-                new java.util.concurrent.atomic.AtomicInteger();
-        FileSystemBackupCaptureFactory captures = new FileSystemBackupCaptureFactory(
-                temporaryDirectory.resolve("captures-mutation"),
-                new SourceCaptureObserver() {
-                    @Override
-                    public void afterFileCopy(Path relativePath) throws IOException {
-                        Files.writeString(
-                                world.resolve(relativePath),
-                                "after-" + mutations.incrementAndGet(),
-                                StandardCharsets.UTF_8);
-                    }
-                });
-        InMemoryCatalog catalog = new InMemoryCatalog();
-        InMemoryInventoryStore inventories = new InMemoryInventoryStore();
-        FakeBackend backend = FakeBackend.success(DestinationType.ZIP);
-        SerializedBackupCoordinator coordinator = coordinator(
-                catalog,
-                inventories,
-                captures,
-                List.of(backend),
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate());
-
-        ExecutionException failure = assertThrows(ExecutionException.class, () -> coordinator.createBackup(
-                        new CreateBackupRequest(
-                                WorldId.create(), world, "Mutation World", BackupTrigger.MANUAL),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture()
-                .get(5, TimeUnit.SECONDS));
-
-        assertTrue(failure.getCause() instanceof IOException);
-        assertEquals(0, backend.calls.get());
-        assertEquals(List.of(), catalog.records);
-        assertEquals(Map.of(), inventories.values);
+    void cancellingAPreparedBackupQueuedBehindAnotherDeletesItsCapture() throws Exception {
+        CompletableFuture<DestinationResult> firstWrite = new CompletableFuture<>();
+        AtomicInteger writes = new AtomicInteger();
+        FakeBackend zip = FakeBackend.awaiting(DestinationType.ZIP, capture -> writes.incrementAndGet() == 1
+                ? firstWrite
+                : CompletableFuture.completedFuture(DestinationResult.success(DestinationType.ZIP, "later")));
+        SerializedBackupCoordinator coordinator = coordinator(zip);
+        CompletableFuture<BackupResult> first = start(coordinator, request(BackupTrigger.MANUAL), ProgressListener.NO_OP);
+        awaitCondition(() -> writes.get() == 1);
+        PreparedBackup prepared = coordinator.prepareCapture(
+                request(BackupTrigger.WORLD_EXIT), CaptureKind.CLOSED_WORLD, ProgressListener.NO_OP);
+        CompletableFuture<BackupResult> queued = coordinator.createPreparedBackup(prepared, ProgressListener.NO_OP)
+                .toCompletableFuture();
+
+        assertTrue(queued.cancel(true));
+        firstWrite.complete(DestinationResult.success(DestinationType.ZIP, "first"));
+
+        assertEquals(BackupStatus.SUCCESS, first.get(5, TimeUnit.SECONDS).status());
+        assertTrue(queued.isCancelled());
+        assertEquals(BackupStatus.SUCCESS, await(coordinator.createBackup(
+                request(BackupTrigger.MANUAL), ProgressListener.NO_OP)).status());
+        assertEquals(2, writes.get());
+        assertEquals(2, catalog.list(worldId).size());
+        assertEquals(List.of(), worldCopies());
     }
 
     @Test
-    void cancellationIsRejectedAfterDestinationPublicationBegins() throws Exception {
-        BlockingCatalog catalog = new BlockingCatalog();
-        FakeBackend backend = FakeBackend.success(DestinationType.ZIP);
-        SerializedBackupCoordinator coordinator = coordinator(
-                catalog,
-                new InMemoryInventoryStore(),
-                new FakeCaptureFactory(temporaryDirectory.resolve("captures-commit")),
-                List.of(backend),
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate());
-        CompletionStage<BackupResult> operation = coordinator.createBackup(
-                request(WorldId.create(), "world-commit", BackupTrigger.MANUAL, Optional.empty()),
-                ProgressListener.NO_OP);
-        assertTrue(catalog.entered.await(5, TimeUnit.SECONDS));
-
-        assertFalse(operation.toCompletableFuture().cancel(true));
-        catalog.release.countDown();
-
-        assertEquals(
-                BackupStatus.SUCCESS,
-                operation.toCompletableFuture().get(5, TimeUnit.SECONDS).status());
-        assertEquals(1, catalog.records.size());
-    }
+    void cancellingWhileWritingRecordsTheDestinationsThatFinished() throws Exception {
+        FakeBackend zip = FakeBackend.success(DestinationType.ZIP);
+        FakeBackend git = FakeBackend.awaiting(DestinationType.GIT, capture -> new CompletableFuture<>());
+        SerializedBackupCoordinator coordinator = coordinator(zip, git);
+        CompletableFuture<BackupResult> backup = start(coordinator, request(BackupTrigger.MANUAL), ProgressListener.NO_OP);
+        awaitCondition(() -> git.calls.get() == 1 && zip.calls.get() == 1);
 
-    @Test
-    void cancellationDuringDestinationWritesStopsThemAndRecordsNothing() throws Exception {
-        CompletableFuture<DestinationResult> writing = new CompletableFuture<>();
-        FakeBackend backend = new FakeBackend(DestinationType.ZIP, ignored -> writing);
-        InMemoryCatalog catalog = new InMemoryCatalog();
-        InMemoryInventoryStore inventories = new InMemoryInventoryStore();
-        SerializedBackupCoordinator coordinator = coordinator(
-                catalog,
-                inventories,
-                new FakeCaptureFactory(temporaryDirectory.resolve("captures-writing")),
-                List.of(backend),
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate());
-        WorldId worldId = WorldId.create();
-        CompletionStage<BackupResult> operation = coordinator.createBackup(
-                request(worldId, "world-writing", BackupTrigger.MANUAL, Optional.empty()),
-                ProgressListener.NO_OP);
-        await(() -> backend.calls.get() == 1);
-
-        assertTrue(operation.toCompletableFuture().cancel(true));
-
-        assertTrue(writing.isCancelled());
-        await(() -> !coordinator.isBusy(worldId));
-        assertThrows(
-                java.util.concurrent.CancellationException.class,
-                () -> operation.toCompletableFuture().join());
-        assertEquals(List.of(), catalog.records);
-        assertEquals(Map.of(), inventories.values);
-    }
+        assertTrue(backup.cancel(true));
+        awaitCondition(() -> !coordinator.isBusy(worldId));
 
-    @Test
-    void cancellationKeepsAndRecordsDestinationsThatAlreadyFinished() throws Exception {
-        CompletableFuture<DestinationResult> gitWriting = new CompletableFuture<>();
-        FakeBackend zip = FakeBackend.success(DestinationType.ZIP);
-        FakeBackend git = new FakeBackend(DestinationType.GIT, ignored -> gitWriting);
-        InMemoryCatalog catalog = new InMemoryCatalog();
-        SerializedBackupCoordinator coordinator = coordinator(
-                catalog,
-                new InMemoryInventoryStore(),
-                new FakeCaptureFactory(temporaryDirectory.resolve("captures-partial")),
-                List.of(zip, git),
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate());
-        WorldId worldId = WorldId.create();
-        CompletionStage<BackupResult> operation = coordinator.createBackup(
-                request(worldId, "world-partial", BackupTrigger.MANUAL, Optional.empty()),
-                ProgressListener.NO_OP);
-        await(() -> git.calls.get() == 1);
-
-        assertTrue(operation.toCompletableFuture().cancel(true));
-        await(() -> !coordinator.isBusy(worldId));
-
-        assertTrue(operation.toCompletableFuture().isCancelled());
-        assertEquals(1, catalog.records.size());
-        BackupResult recorded = catalog.records.getFirst().result();
+        assertTrue(backup.isCancelled());
+        assertEquals(1, catalog.list(worldId).size());
+        BackupResult recorded = catalog.list(worldId).getFirst().result();
         assertEquals(BackupStatus.PARTIAL_SUCCESS, recorded.status());
-        assertEquals(
-                DestinationStatus.SUCCESS,
-                destination(recorded, DestinationType.ZIP).status());
+        assertEquals(DestinationStatus.SUCCESS, destination(recorded, DestinationType.ZIP).status());
         assertEquals(
                 "Cancelled before this destination finished",
                 destination(recorded, DestinationType.GIT).message().orElseThrow());
+        assertTrue(inventories.load(worldId).isPresent());
     }
 
+    /**
+     * A cancel completes the backup's stage at once, while a destination may still be stopping.
+     * whenIdle waits for it, so the runtime keeps the backup folders in place until then.
+     */
     @Test
-    void cancellationKeepsAGitSnapshotWhoseSyncWasInterrupted() throws Exception {
+    void whenIdleWaitsForADestinationThatIsStillStoppingAfterACancel() throws Exception {
+        CountDownLatch interrupted = new CountDownLatch(1);
+        CountDownLatch stopped = new CountDownLatch(1);
+        FakeBackend git = FakeBackend.writing(DestinationType.GIT, (capture, listener) -> {
+            try {
+                Thread.sleep(Long.MAX_VALUE);
+            } catch (InterruptedException stop) {
+                interrupted.countDown();
+                stopped.await();
+            }
+            return DestinationResult.failed(DestinationType.GIT, "Stopped");
+        });
+        SerializedBackupCoordinator coordinator = coordinator(git);
+        CompletableFuture<BackupResult> backup = start(coordinator, request(BackupTrigger.MANUAL), ProgressListener.NO_OP);
+        awaitCondition(() -> git.calls.get() == 1);
+
+        assertTrue(backup.cancel(true));
+        assertTrue(interrupted.await(5, TimeUnit.SECONDS));
+        CompletableFuture<Void> idle = coordinator.whenIdle(worldId).toCompletableFuture();
+
+        assertTrue(backup.isCancelled());
+        assertFalse(idle.isDone());
+        stopped.countDown();
+        idle.get(5, TimeUnit.SECONDS);
+        assertFalse(coordinator.isBusy(worldId));
+    }
+
+    @Test
+    void cancellingKeepsAGitSnapshotWhoseSyncWasInterrupted() throws Exception {
         CountDownLatch pushing = new CountDownLatch(1);
-        FakeBackend git = new FakeBackend(DestinationType.GIT, ignored -> AsyncTasks.supplyInterruptible(
-                coordinatorExecutor,
-                () -> {
-                    pushing.countDown();
-                    try {
-                        Thread.sleep(Long.MAX_VALUE);
-                    } catch (InterruptedException exception) {
-                        // The local snapshot exists; only the remote push was cut short.
-                        return DestinationResult.pendingSync(
-                                DestinationType.GIT, "snapshot", "Remote synchronization was cancelled");
-                    }
-                    return DestinationResult.success(DestinationType.GIT, "snapshot");
-                }));
-        InMemoryCatalog catalog = new InMemoryCatalog();
-        SerializedBackupCoordinator coordinator = coordinator(
-                catalog,
-                new InMemoryInventoryStore(),
-                new FakeCaptureFactory(temporaryDirectory.resolve("captures-pending-sync")),
-                List.of(git),
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate());
-        WorldId worldId = WorldId.create();
-        CompletionStage<BackupResult> operation = coordinator.createBackup(
-                request(worldId, "world-pending-sync", BackupTrigger.MANUAL, Optional.empty()),
-                ProgressListener.NO_OP);
+        FakeBackend git = FakeBackend.writing(DestinationType.GIT, (capture, listener) -> {
+            pushing.countDown();
+            try {
+                Thread.sleep(Long.MAX_VALUE);
+            } catch (InterruptedException exception) {
+                // Like the Git backend: the local snapshot exists, only the push was cut short, and
+                // the interrupt stays set, so the catalog write must not run on this thread.
+                Thread.currentThread().interrupt();
+                return DestinationResult.pendingSync(
+                        DestinationType.GIT, "snapshot", "Remote synchronization was cancelled");
+            }
+            return DestinationResult.success(DestinationType.GIT, "snapshot");
+        });
+        SerializedBackupCoordinator coordinator = coordinator(git);
+        CompletableFuture<BackupResult> backup = start(coordinator, request(BackupTrigger.MANUAL), ProgressListener.NO_OP);
         assertTrue(pushing.await(5, TimeUnit.SECONDS));
 
-        assertTrue(operation.toCompletableFuture().cancel(true));
-        await(() -> !coordinator.isBusy(worldId));
+        assertTrue(backup.cancel(true));
+        awaitCondition(() -> !coordinator.isBusy(worldId));
 
-        assertEquals(1, catalog.records.size());
+        assertEquals(1, catalog.list(worldId).size());
         assertEquals(
                 DestinationStatus.PENDING_SYNC,
-                destination(catalog.records.getFirst().result(), DestinationType.GIT).status());
+                destination(catalog.list(worldId).getFirst().result(), DestinationType.GIT).status());
     }
 
     @Test
-    void sharedWorldGateBlocksCreateUntilExternalMaintenancePermitCloses() throws Exception {
-        LockingWorldOperationGate operationGate = new LockingWorldOperationGate();
-        WorldId worldId = WorldId.create();
-        WorldOperationGate.Permit maintenance = operationGate.enter(worldId);
-        FakeBackend backend = FakeBackend.success(DestinationType.ZIP);
-        SerializedBackupCoordinator coordinator = coordinator(
-                new InMemoryCatalog(),
-                new InMemoryInventoryStore(),
-                new FakeCaptureFactory(temporaryDirectory.resolve("captures")),
-                List.of(backend),
-                BackupCaptureGate.DIRECT,
-                operationGate);
-
-        CompletionStage<BackupResult> operation = coordinator.createBackup(
-                request(worldId, "world-a", BackupTrigger.MANUAL, Optional.empty()),
-                ProgressListener.NO_OP);
-        await(() -> coordinator.isBusy(worldId));
-        assertEquals(0, backend.calls.get());
+    void cancellingWhileRecordingIsRefusedAndTheBackupCompletes() throws Exception {
+        CountDownLatch recording = new CountDownLatch(1);
+        CountDownLatch release = new CountDownLatch(1);
+        ProgressListener holdWhileRecording = progress -> {
+            if (progress.phase() == OperationPhase.PUBLISHING) {
+                recording.countDown();
+                try {
+                    release.await(5, TimeUnit.SECONDS);
+                } catch (InterruptedException exception) {
+                    Thread.currentThread().interrupt();
+                }
+            }
+        };
+        SerializedBackupCoordinator coordinator = coordinator(FakeBackend.success(DestinationType.ZIP));
+        CompletableFuture<BackupResult> backup = start(coordinator, request(BackupTrigger.MANUAL), holdWhileRecording);
+        assertTrue(recording.await(5, TimeUnit.SECONDS));
 
-        maintenance.close();
-        assertEquals(
-                BackupStatus.SUCCESS,
-                operation.toCompletableFuture().get(5, TimeUnit.SECONDS).status());
+        assertFalse(backup.cancel(true));
+        release.countDown();
+
+        assertEquals(BackupStatus.SUCCESS, backup.get(5, TimeUnit.SECONDS).status());
+        assertEquals(1, catalog.list(worldId).size());
     }
 
     @Test
-    void preparedCaptureDoesNotWaitForActiveDestinationAndQueuesBehindIt() throws Exception {
-        WorldId worldId = WorldId.create();
-        Map<BackupTrigger, CompletableFuture<DestinationResult>> releases = new ConcurrentHashMap<>();
-        FakeBackend backend = new FakeBackend(DestinationType.ZIP, capture -> {
-            CompletableFuture<DestinationResult> result = new CompletableFuture<>();
-            releases.put(capture.manifest().trigger(), result);
-            return result;
-        });
+    void aWorldThatKeepsChangingFailsWithCaptureChangedAndPublishesNothing() throws Exception {
+        AtomicInteger writes = new AtomicInteger();
+        SourceCaptureObserver rewriteAfterEachCopy = new SourceCaptureObserver() {
+            @Override
+            public void afterFileCopy(Path relativePath) throws IOException {
+                if (relativePath.toString().equals("level.dat")) {
+                    Files.writeString(world.resolve("level.dat"), "changed-" + writes.incrementAndGet());
+                }
+            }
+        };
+        FakeBackend zip = FakeBackend.success(DestinationType.ZIP);
         SerializedBackupCoordinator coordinator = coordinator(
-                new InMemoryCatalog(),
-                new InMemoryInventoryStore(),
-                new FakeCaptureFactory(temporaryDirectory.resolve("captures")),
-                List.of(backend),
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate());
-        ExecutorService serverExecutor = Executors.newSingleThreadExecutor();
-        try {
-            CompletionStage<BackupResult> normal = coordinator.createBackup(
-                    request(worldId, "world-a", BackupTrigger.MANUAL, Optional.empty()),
-                    ProgressListener.NO_OP);
-            await(() -> releases.containsKey(BackupTrigger.MANUAL));
-
-            Future<PreparedBackup> preparation = serverExecutor.submit(() -> coordinator.prepareCapture(
-                    request(worldId, "world-a", BackupTrigger.WORLD_EXIT, Optional.empty()),
-                    CaptureProgressListener.NO_OP));
-            PreparedBackup prepared = preparation.get(5, TimeUnit.SECONDS);
-            assertEquals(OperationPhase.PREPARING,
-                    coordinator.currentOperation(worldId).orElseThrow().phase());
-
-            CompletionStage<BackupResult> exit = coordinator.createPreparedBackup(
-                    prepared,
-                    ProgressListener.NO_OP);
-            assertFalse(releases.containsKey(BackupTrigger.WORLD_EXIT));
-
-            releases.get(BackupTrigger.MANUAL).complete(DestinationResult.success(
-                    DestinationType.ZIP,
-                    "manual"));
-            assertEquals(BackupStatus.SUCCESS, normal.toCompletableFuture().get(5, TimeUnit.SECONDS).status());
-
-            await(() -> releases.containsKey(BackupTrigger.WORLD_EXIT));
-            releases.get(BackupTrigger.WORLD_EXIT).complete(DestinationResult.success(
-                    DestinationType.ZIP,
-                    "exit"));
-            assertEquals(BackupStatus.SUCCESS, exit.toCompletableFuture().get(5, TimeUnit.SECONDS).status());
-        } finally {
-            serverExecutor.shutdownNow();
-            assertTrue(serverExecutor.awaitTermination(5, TimeUnit.SECONDS));
-        }
+                rewriteAfterEachCopy, new LockingWorldOperationGate(), zip);
+
+        ExecutionException failure = assertThrows(ExecutionException.class, () -> await(
+                coordinator.createBackup(request(BackupTrigger.MANUAL), ProgressListener.NO_OP)));
+
+        assertInstanceOf(CaptureChangedException.class, failure.getCause());
+        assertEquals(0, zip.calls.get());
+        assertEquals(List.of(), catalog.list(worldId));
+        assertEquals(Optional.empty(), inventories.load(worldId));
+        assertEquals(List.of(), worldCopies());
     }
 
     @Test
     void combinesTheProgressOfBothDestinationsIntoOneStream() throws Exception {
         Map<DestinationType, ProgressListener> listeners = new ConcurrentHashMap<>();
         Map<DestinationType, CompletableFuture<DestinationResult>> releases = new ConcurrentHashMap<>();
-        List<OperationProgress> reported = java.util.Collections.synchronizedList(new ArrayList<>());
+        List<OperationProgress> reported = Collections.synchronizedList(new ArrayList<>());
         SerializedBackupCoordinator coordinator = coordinator(
-                new InMemoryCatalog(),
-                new InMemoryInventoryStore(),
-                new FakeCaptureFactory(temporaryDirectory.resolve("captures-combined")),
-                List.of(
-                        pendingBackend(DestinationType.GIT, listeners, releases),
-                        pendingBackend(DestinationType.ZIP, listeners, releases)),
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate());
-
-        CompletionStage<BackupResult> operation = coordinator.createBackup(
-                request(WorldId.create(), "world-combined", BackupTrigger.MANUAL, Optional.empty()),
-                reported::add);
-        await(() -> listeners.size() == 2);
-        listeners.get(DestinationType.ZIP).onProgress(backendProgress(
-                OperationPhase.WRITING, 900, 1_000, "Writing ZIP backup"));
-        listeners.get(DestinationType.GIT).onProgress(backendProgress(
-                OperationPhase.READING, 3, 6, "Synchronizing Git snapshot"));
-        listeners.get(DestinationType.ZIP).onProgress(backendProgress(
-                OperationPhase.COMPLETE, 1_000, 1_000, "ZIP backup complete"));
+                pendingBackend(DestinationType.GIT, listeners, releases),
+                pendingBackend(DestinationType.ZIP, listeners, releases));
+
+        CompletableFuture<BackupResult> backup = start(coordinator, request(BackupTrigger.MANUAL), reported::add);
+        awaitCondition(() -> listeners.size() == 2);
+        listeners.get(DestinationType.ZIP).onProgress(backendProgress(OperationPhase.WRITING, 900, 1_000, "Writing ZIP"));
+        listeners.get(DestinationType.GIT).onProgress(backendProgress(OperationPhase.READING, 3, 6, "Pushing"));
+        listeners.get(DestinationType.ZIP).onProgress(backendProgress(OperationPhase.COMPLETE, 1_000, 1_000, "ZIP done"));
 
         List<OperationProgress> writing = List.copyOf(reported).stream()
                 .dropWhile(progress -> progress.phase() != OperationPhase.WRITING)
                 .toList();
+        assertEquals(List.of(OperationPhase.WRITING), writing.stream().map(OperationProgress::phase).distinct().toList());
         assertEquals(
-                List.of(OperationPhase.WRITING),
-                writing.stream().map(OperationProgress::phase).distinct().toList());
-        assertEquals(
-                List.of("Writing backup destinations"),
+                List.of(DestinationProgressAggregator.WRITING_MESSAGE),
                 writing.stream().map(OperationProgress::message).distinct().toList());
-        assertEquals(4, writing.size());
-        assertTrue(
-                writing.getLast().completedUnits() > 0,
-                "The combined progress must advance while the destinations write");
-        assertMonotonic(writing);
-
+        assertTrue(writing.getLast().completedUnits() > 0, "The combined progress must advance");
+        for (int index = 1; index < writing.size(); index++) {
+            assertTrue(writing.get(index).completedUnits() >= writing.get(index - 1).completedUnits());
+        }
         releases.get(DestinationType.ZIP).complete(DestinationResult.success(DestinationType.ZIP, "zip"));
         releases.get(DestinationType.GIT).complete(DestinationResult.success(DestinationType.GIT, "ref"));
-        assertEquals(
-                BackupStatus.SUCCESS,
-                operation.toCompletableFuture().get(5, TimeUnit.SECONDS).status());
+        assertEquals(BackupStatus.SUCCESS, backup.get(5, TimeUnit.SECONDS).status());
     }
 
     @Test
-    void oneDestinationKeepsItsOwnProgressAndRedactsTheMessage() throws Exception {
+    void oneDestinationKeepsItsOwnProgressUntilTheBackupIsRecorded() throws Exception {
         Map<DestinationType, ProgressListener> listeners = new ConcurrentHashMap<>();
         Map<DestinationType, CompletableFuture<DestinationResult>> releases = new ConcurrentHashMap<>();
-        List<OperationProgress> reported = java.util.Collections.synchronizedList(new ArrayList<>());
-        SerializedBackupCoordinator coordinator = coordinator(
-                new InMemoryCatalog(),
-                new InMemoryInventoryStore(),
-                new FakeCaptureFactory(temporaryDirectory.resolve("captures-single")),
-                List.of(pendingBackend(DestinationType.GIT, listeners, releases)),
-                BackupCaptureGate.DIRECT,
-                new LockingWorldOperationGate());
-
-        CompletionStage<BackupResult> operation = coordinator.createBackup(
-                request(WorldId.create(), "world-single", BackupTrigger.MANUAL, Optional.empty()),
-                reported::add);
-        await(() -> listeners.size() == 1);
-        listeners.get(DestinationType.GIT).onProgress(backendProgress(
-                OperationPhase.VERIFYING,
-                3,
-                6,
-                "Pushing to https://user:secret@example.com/world.git"));
+        List<OperationProgress> reported = Collections.synchronizedList(new ArrayList<>());
+        SerializedBackupCoordinator coordinator = coordinator(pendingBackend(DestinationType.GIT, listeners, releases));
 
+        CompletableFuture<BackupResult> backup = start(coordinator, request(BackupTrigger.MANUAL), reported::add);
+        awaitCondition(() -> listeners.size() == 1);
+        ProgressListener git = listeners.get(DestinationType.GIT);
+        git.onProgress(backendProgress(OperationPhase.VERIFYING, 3, 6, "Pushing to https://user:secret@example.com/world.git"));
         OperationProgress forwarded = reported.getLast();
+        git.onProgress(backendProgress(OperationPhase.COMPLETE, 6, 6, "Git snapshot complete"));
+        OperationProgress destinationDone = reported.getLast();
+        releases.get(DestinationType.GIT).complete(DestinationResult.success(DestinationType.GIT, "ref"));
+
+        assertEquals(BackupStatus.SUCCESS, backup.get(5, TimeUnit.SECONDS).status());
         assertEquals(OperationPhase.VERIFYING, forwarded.phase());
         assertEquals(3, forwarded.completedUnits());
-        assertEquals(6, forwarded.totalUnits());
-        assertEquals(
-                "Pushing to https://[REDACTED]@example.com/world.git",
-                forwarded.message());
+        assertEquals("Pushing to https://[REDACTED]@example.com/world.git", forwarded.message());
+        assertEquals(OperationPhase.WRITING, destinationDone.phase());
+        assertEquals(OperationPhase.COMPLETE, reported.getLast().phase());
+    }
 
-        releases.get(DestinationType.GIT).complete(DestinationResult.success(DestinationType.GIT, "ref"));
-        assertEquals(
-                BackupStatus.SUCCESS,
-                operation.toCompletableFuture().get(5, TimeUnit.SECONDS).status());
+    private SerializedBackupCoordinator coordinator(BackupBackend... backends) {
+        return coordinator(SourceCaptureObserver.NONE, new LockingWorldOperationGate(), backends);
+    }
+
+    private SerializedBackupCoordinator coordinator(
+            SourceCaptureObserver observer,
+            WorldOperationGate operationGate,
+            BackupBackend... backends) {
+        return new SerializedBackupCoordinator(
+                catalog,
+                new FileSystemBackupCaptureFactory(temporaryDirectory.resolve("capture-temp"), Optional.empty(), observer),
+                inventories,
+                request -> List.of(backends),
+                new LockingWorldOperationGate(),
+                operationGate,
+                executor,
+                Clock.fixed(NOW, ZoneOffset.UTC));
     }
 
-    /** Backend that publishes its progress listener and waits for the test to release its result. */
+    /** Publishes its progress listener and waits for the test to release its result. */
     private static FakeBackend pendingBackend(
             DestinationType destination,
             Map<DestinationType, ProgressListener> listeners,
             Map<DestinationType, CompletableFuture<DestinationResult>> releases) {
-        return new FakeBackend(destination, (capture, listener) -> {
+        return FakeBackend.writing(destination, (capture, listener) -> {
             CompletableFuture<DestinationResult> release = new CompletableFuture<>();
             releases.put(destination, release);
             listeners.put(destination, listener);
-            return release;
+            try {
+                return release.get();
+            } catch (ExecutionException exception) {
+                throw new IllegalStateException(exception);
+            }
         });
     }
 
-    private static OperationProgress backendProgress(
-            OperationPhase phase,
-            long completed,
-            long total,
-            String message) {
+    private Path createWorld(String name) throws IOException {
+        Path folder = Files.createDirectory(temporaryDirectory.resolve(name));
+        Files.writeString(folder.resolve("level.dat"), "level", StandardCharsets.UTF_8);
+        Files.write(Files.createDirectory(folder.resolve("region")).resolve("r.0.0.mca"), new byte[1_024]);
+        return folder;
+    }
+
+    private CreateBackupRequest request(BackupTrigger trigger) {
+        return new CreateBackupRequest(worldId, world, "World", Optional.empty(), trigger);
+    }
+
+    private static CreateBackupRequest request(WorldId id, Path folder, String label) {
+        return new CreateBackupRequest(id, folder, "World", Optional.of(label), BackupTrigger.MANUAL);
+    }
+
+    private static CompletableFuture<BackupResult> start(
+            SerializedBackupCoordinator coordinator,
+            CreateBackupRequest request,
+            ProgressListener listener) {
+        return coordinator.createBackup(request, listener).toCompletableFuture();
+    }
+
+    private long changedFiles(BackupResult result) throws IOException {
+        return catalog.find(result.backupId()).orElseThrow().manifest().changedFileCount();
+    }
+
+    /** Every copied world file still under the capture folder. */
+    private List<Path> worldCopies() throws IOException {
+        Path captures = temporaryDirectory.resolve("capture-temp");
+        if (!Files.exists(captures)) {
+            return List.of();
+        }
+        try (Stream<Path> files = Files.walk(captures)) {
+            return files.filter(file -> file.endsWith("level.dat") || file.toString().endsWith(".mca")).toList();
+        }
+    }
+
+    private static OperationProgress backendProgress(OperationPhase phase, long completed, long total, String message) {
         return new OperationProgress(
                 OperationId.create(),
                 WorldId.create(),
@@ -820,49 +542,6 @@ private static OperationProgress backendProgress(
                 message);
     }
 
-    private static void assertMonotonic(List<OperationProgress> reported) {
-        long previous = 0;
-        for (OperationProgress progress : reported) {
-            assertTrue(
-                    progress.completedUnits() >= previous,
-                    "Combined progress moved backward to " + progress.completedUnits());
-            previous = progress.completedUnits();
-        }
-    }
-
-    private SerializedBackupCoordinator coordinator(
-            BackupCatalog catalog,
-            WorldInventoryStore inventories,
-            BackupCaptureFactory captures,
-            List<BackupBackend> backends,
-            BackupCaptureGate gate,
-            WorldOperationGate operationGate) {
-        return new SerializedBackupCoordinator(
-                catalog,
-                captures,
-                inventories,
-                BackupDestinationSelector.fixed(backends),
-                new UnusedMaintenanceService(),
-                gate,
-                operationGate,
-                coordinatorExecutor,
-                Clock.fixed(NOW, ZoneOffset.UTC));
-    }
-
-    private CreateBackupRequest request(
-            WorldId worldId,
-            String directoryName,
-            BackupTrigger trigger,
-            Optional<String> label) throws IOException {
-        Path world = temporaryDirectory.resolve(directoryName);
-        Files.createDirectories(world);
-        return new CreateBackupRequest(worldId, world, directoryName, label, trigger);
-    }
-
-    private static String key(BackupManifest manifest) {
-        return manifest.worldId() + ":" + manifest.label().orElse("none");
-    }
-
     private static DestinationResult destination(BackupResult result, DestinationType type) {
         return result.destinations().stream()
                 .filter(destination -> destination.destination() == type)
@@ -870,7 +549,11 @@ private static DestinationResult destination(BackupResult result, DestinationTyp
                 .orElseThrow();
     }
 
-    private static void await(BooleanSupplier condition) throws Exception {
+    private static <T> T await(CompletionStage<T> stage) throws Exception {
+        return stage.toCompletableFuture().get(5, TimeUnit.SECONDS);
+    }
+
+    private static void awaitCondition(BooleanSupplier condition) throws InterruptedException {
         long deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(5);
         while (!condition.getAsBoolean()) {
             if (System.nanoTime() >= deadline) {
diff --git a/src/test/java/dev/ishaanko/worldarchive/core/TestCaptures.java b/src/test/java/dev/ishaanko/worldarchive/core/TestCaptures.java
new file mode 100644
index 0000000..8349d81
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/core/TestCaptures.java
@@ -0,0 +1,36 @@
+package dev.ishaanko.worldarchive.core;
+
+import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.support.Digests;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.stream.Stream;
+
+/** Builds destination input from a plain test folder, hashing its files the way a capture does. */
+public final class TestCaptures {
+    private TestCaptures() {
+    }
+
+    /** A capture of the folder whose inventory lists every file a capture would keep. */
+    public static BackupCapture of(Path world, BackupManifest manifest) throws IOException {
+        return new BackupCapture(world, manifest, inventoryOf(world));
+    }
+
+    /** Every regular file except {@code session.lock} and the {@code .worldarchive} folder. */
+    public static WorldInventory inventoryOf(Path world) throws IOException {
+        List<WorldInventory.Entry> entries = new ArrayList<>();
+        try (Stream<Path> paths = Files.walk(world)) {
+            for (Path file : paths.filter(path -> Files.isRegularFile(path, LinkOption.NOFOLLOW_LINKS)).toList()) {
+                String relative = world.relativize(file).toString().replace('\\', '/');
+                if (!relative.equals("session.lock") && !relative.startsWith(".worldarchive/")) {
+                    entries.add(new WorldInventory.Entry(relative, Files.size(file), Digests.sha256(file)));
+                }
+            }
+        }
+        return WorldInventory.create(entries);
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/core/WorldInventoryTest.java b/src/test/java/dev/ishaanko/worldarchive/core/WorldInventoryTest.java
index f911f12..aef4777 100644
--- a/src/test/java/dev/ishaanko/worldarchive/core/WorldInventoryTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/core/WorldInventoryTest.java
@@ -3,32 +3,25 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
-import java.nio.ByteBuffer;
-import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
-import java.util.HexFormat;
+import dev.ishaanko.worldarchive.model.GoldenFixtures;
 import java.util.List;
 import org.junit.jupiter.api.Test;
 
 final class WorldInventoryTest {
-    private static final String A_SHA = sha256("alpha");
+    private static final String A_SHA = "a1".repeat(32);
 
-    private static final String B_SHA = sha256("bravo");
+    private static final String B_SHA = "b2".repeat(32);
 
     @Test
-    void usesCanonicalStorageDigestFramingAndSortsPaths() throws Exception {
-        WorldInventory inventory = WorldInventory.create(List.of(
-                new WorldInventory.Entry("region/r.0.0.mca", 5, B_SHA),
-                new WorldInventory.Entry("level.dat", 5, A_SHA)));
-
-        List<WorldInventory.Entry> sorted = List.of(
-                new WorldInventory.Entry("level.dat", 5, A_SHA),
-                new WorldInventory.Entry("region/r.0.0.mca", 5, B_SHA));
-        assertEquals(sorted, inventory.files());
-        assertEquals(2, inventory.fileCount());
-        assertEquals(10, inventory.byteCount());
-        assertEquals(contentDigest(sorted), inventory.contentSha256());
-        assertEquals(inventoryDigest(sorted), inventory.inventorySha256());
+    void digestsKeepTheFramingThatStoredManifestsHold() {
+        WorldInventory inventory = WorldInventory.create(GoldenFixtures.INVENTORY.stream()
+                .map(file -> new WorldInventory.Entry(file.path(), file.size(), file.sha256()))
+                .toList());
+
+        assertEquals(GoldenFixtures.INVENTORY_CONTENT_SHA256, inventory.contentSha256());
+        assertEquals(GoldenFixtures.INVENTORY_SHA256, inventory.inventorySha256());
+        assertEquals(4, inventory.fileCount());
+        assertEquals(266_251, inventory.byteCount());
     }
 
     @Test
@@ -45,42 +38,14 @@ void countsAddedModifiedAndDeletedFiles() {
         assertEquals(3, current.changedFilesSince(previous));
     }
 
+    /** Git and ZIP will read their inventories through this type, so it must refuse collisions. */
     @Test
-    void rejectsNonportableAndCollidingPaths() {
-        assertThrows(IllegalArgumentException.class, () -> new WorldInventory.Entry(
-                "../level.dat", 1, A_SHA));
+    void refusesPathsThatCollideOnWindowsOrMacOs() {
         assertThrows(IllegalArgumentException.class, () -> WorldInventory.create(List.of(
                 new WorldInventory.Entry("Data/file.dat", 1, A_SHA),
                 new WorldInventory.Entry("data/FILE.dat", 1, A_SHA))));
-    }
-
-    private static String contentDigest(List<WorldInventory.Entry> files) throws Exception {
-        MessageDigest digest = MessageDigest.getInstance("SHA-256");
-        for (WorldInventory.Entry file : files) {
-            digest.update(ByteBuffer.allocate(Long.BYTES).putLong(file.size()).array());
-            digest.update(HexFormat.of().parseHex(file.sha256()));
-        }
-        return HexFormat.of().formatHex(digest.digest());
-    }
-
-    private static String inventoryDigest(List<WorldInventory.Entry> files) throws Exception {
-        MessageDigest digest = MessageDigest.getInstance("SHA-256");
-        for (WorldInventory.Entry file : files) {
-            byte[] path = file.path().getBytes(StandardCharsets.UTF_8);
-            digest.update(ByteBuffer.allocate(Long.BYTES).putLong(path.length).array());
-            digest.update(path);
-            digest.update(ByteBuffer.allocate(Long.BYTES).putLong(file.size()).array());
-            digest.update(HexFormat.of().parseHex(file.sha256()));
-        }
-        return HexFormat.of().formatHex(digest.digest());
-    }
-
-    private static String sha256(String value) {
-        try {
-            return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256")
-                    .digest(value.getBytes(StandardCharsets.UTF_8)));
-        } catch (Exception exception) {
-            throw new AssertionError(exception);
-        }
+        assertThrows(IllegalArgumentException.class, () -> WorldInventory.create(List.of(
+                new WorldInventory.Entry("region", 1, A_SHA),
+                new WorldInventory.Entry("Region/r.0.0.mca", 1, A_SHA))));
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/e2e/BackupRestoreEndToEndTest.java b/src/test/java/dev/ishaanko/worldarchive/e2e/BackupRestoreEndToEndTest.java
new file mode 100644
index 0000000..cec4065
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/e2e/BackupRestoreEndToEndTest.java
@@ -0,0 +1,320 @@
+package dev.ishaanko.worldarchive.e2e;
+
+import static dev.ishaanko.worldarchive.e2e.Engine.await;
+import static dev.ishaanko.worldarchive.e2e.TestWorld.assertSameFiles;
+import static dev.ishaanko.worldarchive.e2e.TestWorld.bytes;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.core.RestoreBackupRequest;
+import dev.ishaanko.worldarchive.core.RestoreBackupResult;
+import dev.ishaanko.worldarchive.core.SourceCaptureObserver;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupRecord;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.BackupStatus;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.OperationPhase;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import java.io.IOException;
+import java.io.RandomAccessFile;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.CancellationException;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.EnumSource;
+
+class BackupRestoreEndToEndTest {
+    @TempDir
+    Path root;
+
+    private Engine engine;
+
+    @AfterEach
+    void closeEngine() throws Exception {
+        if (engine != null) {
+            engine.close();
+        }
+    }
+
+    /** Legal but unusual names, some of which look like Git's own fast-import commands, round-trip byte for byte. */
+    @ParameterizedTest
+    @EnumSource(DestinationType.class)
+    void unusualNamesRestoreByteForByte(DestinationType destination) throws Exception {
+        engine = start(Engine.onlyDestination(destination));
+        TestWorld world = TestWorld.create(engine, "Odd");
+        for (String name : List.of(" leading space.json", "a  b/c  d.txt", "-dash.json", "#hash.json",
+                "semi;colon'quote.json", "percent%20.json", "emoji \uD83C\uDFAE/\u0444\u0430\u0439\u043B.json",
+                "M 100644 inline x.json", "data/very.many.dots.dat", "unicode/\u00E9t\u00E9   sep.json")) {
+            world.write(name, ("contents of " + name).getBytes(StandardCharsets.UTF_8));
+        }
+        Map<String, byte[]> files = world.files();
+
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+
+        assertEquals(BackupStatus.SUCCESS, result.status(), result.destinations().toString());
+        assertSameFiles(files, await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(result.backupId(), engine.saves, "Odd restored"), ProgressListener.NO_OP))
+                .restoredWorldDirectory());
+    }
+
+    @Test
+    void manualBackupRestoresIntoANewWorldAndLeavesTheSourceAlone() throws Exception {
+        engine = start(Engine.defaultConfig());
+        TestWorld world = TestWorld.create(engine, "Survival");
+        Map<String, byte[]> backedUp = world.files();
+
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+
+        assertEquals(BackupStatus.SUCCESS, result.status());
+        assertEquals(
+                List.of(DestinationType.GIT, DestinationType.ZIP),
+                result.destinations().stream().map(DestinationResult::destination).sorted().toList());
+        world.write("level.dat", bytes(4_096, 99));
+        world.delete("playerdata/3f1a2b.dat");
+        world.write("region/r.1.0.mca", bytes(1_024, 98));
+        Map<String, byte[]> sourceAfterEdits = world.files();
+
+        RestoreBackupResult restored = restore(result.backupId(), "Survival restored");
+
+        assertEquals(engine.saves, restored.restoredWorldDirectory().getParent());
+        assertNotEquals(world.path(), restored.restoredWorldDirectory());
+        assertSameFiles(backedUp, restored.restoredWorldDirectory());
+        assertSameFiles(sourceAfterEdits, world.path());
+        assertNotEquals(world.id(), restored.restoredWorldId());
+        assertEquals(
+                restored.restoredWorldId(),
+                engine.identities.loadExisting(restored.restoredWorldDirectory()).orElseThrow().worldId());
+    }
+
+    @Test
+    void restoreFallsBackToGitWhenTheZipArchiveIsGone() throws Exception {
+        engine = start(Engine.defaultConfig());
+        TestWorld world = TestWorld.create(engine, "Archipelago");
+        Map<String, byte[]> backedUp = world.files();
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+        try (Stream<Path> files = Files.walk(engine.zipFolder(world.id()))) {
+            for (Path file : files.filter(Files::isRegularFile).toList()) {
+                Files.delete(file);
+            }
+        }
+
+        RestoreBackupResult restored = restore(result.backupId(), "Archipelago from Git");
+
+        assertSameFiles(backedUp, restored.restoredWorldDirectory());
+    }
+
+    @Test
+    void everyGitSnapshotRestoresItsOwnVersion() throws Exception {
+        engine = start(Engine.onlyDestination(DestinationType.GIT));
+        TestWorld world = TestWorld.create(engine, "Incremental");
+        Map<String, byte[]> first = world.files();
+        BackupId firstId = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        engine.clock.advance(Duration.ofMinutes(5));
+        world.write("region/r.0.0.mca", bytes(256 * 1_024, 7));
+        Map<String, byte[]> second = world.files();
+        BackupId secondId = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+
+        List<BackupRecord> records = engine.records(world.id()).stream()
+                .sorted(Comparator.comparing(record -> record.manifest().createdAt()))
+                .toList();
+        assertEquals(List.of(firstId, secondId), records.stream().map(record -> record.manifest().backupId()).toList());
+        assertEquals(first.size(), records.get(0).manifest().changedFileCount());
+        assertEquals(1, records.get(1).manifest().changedFileCount());
+        assertSameFiles(first, restore(firstId, "Incremental v1").restoredWorldDirectory());
+        assertSameFiles(second, restore(secondId, "Incremental v2").restoredWorldDirectory());
+    }
+
+    @Test
+    void backupsStayListedAndRestorableAfterARestart() throws Exception {
+        engine = start(Engine.defaultConfig());
+        TestWorld world = TestWorld.create(engine, "Persistent");
+        Map<String, byte[]> backedUp = world.files();
+        BackupId backupId = engine.backupNow(world, BackupTrigger.WORLD_EXIT).backupId();
+        engine.close();
+
+        engine = start(Engine.defaultConfig());
+
+        assertEquals(List.of(backupId), engine.records(world.id()).stream()
+                .map(record -> record.manifest().backupId())
+                .toList());
+        assertSameFiles(backedUp, restore(backupId, "Persistent restored").restoredWorldDirectory());
+        assertTrue(Files.isDirectory(world.path()));
+    }
+
+    @Test
+    void aLabelIsKeptExactlyAsTypedInEveryCopy() throws Exception {
+        engine = start(Engine.defaultConfig());
+        TestWorld world = TestWorld.create(engine, "Training");
+        // The diagnostics redactor used to store this label as "Basic [REDACTED] Base".
+        Optional<String> label = Optional.of("Basic Training Base");
+
+        BackupId backupId = await(engine.backup(world, BackupTrigger.MANUAL, label)).backupId();
+        Optional<String> recorded = engine.records(world.id()).getFirst().manifest().label();
+        Files.delete(engine.catalogFile());
+        await(engine.imports.rebuildLocal());
+
+        BackupRecord rebuilt = engine.records(world.id()).getFirst();
+        assertEquals(label, recorded);
+        assertEquals(backupId, rebuilt.manifest().backupId());
+        assertEquals(label, rebuilt.manifest().label());
+        assertEquals(2, rebuilt.result().destinations().size());
+    }
+
+    @Test
+    void aDamagedZipIsSkippedAndTheBackupRestoresFromGit() throws Exception {
+        engine = start(Engine.defaultConfig());
+        TestWorld world = TestWorld.create(engine, "Coral");
+        Map<String, byte[]> backedUp = world.files();
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+        flipOneByte(onlyArchive(world));
+
+        RestoreBackupResult restored = restore(result.backupId(), "Coral from Git");
+
+        assertSameFiles(backedUp, restored.restoredWorldDirectory());
+        assertSameFiles(backedUp, world.path());
+        assertNotEquals(world.id(), restored.restoredWorldId());
+        assertEquals(List.of("Coral", "Coral from Git"), savesFolders());
+    }
+
+    @Test
+    void whenNoCopyCanRestoreTheErrorGivesEachReasonAndNothingIsLeftInSaves() throws Exception {
+        engine = start(Engine.defaultConfig());
+        TestWorld world = TestWorld.create(engine, "Lost");
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+        flipOneByte(onlyArchive(world));
+        deleteTree(engine.git.repositoryFor(world.id()));
+
+        ExecutionException failure = assertThrows(ExecutionException.class, () -> restore(result.backupId(), "Lost"));
+
+        String message = failure.getCause().getMessage();
+        assertTrue(message.contains("ZIP: ") && message.contains("Git: "), message);
+        assertEquals(List.of("Lost"), savesFolders());
+    }
+
+    @Test
+    void cancellingARestoreWhileItWritesLeavesNothingInSaves() throws Exception {
+        engine = start(Engine.onlyDestination(DestinationType.ZIP));
+        TestWorld world = TestWorld.create(engine, "Undone");
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+        CompletableFuture<CompletableFuture<RestoreBackupResult>> restore = new CompletableFuture<>();
+        ProgressListener cancelWhileWriting = progress -> {
+            if (progress.phase() == OperationPhase.WRITING) {
+                restore.join().cancel(true);
+            }
+        };
+
+        restore.complete(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(result.backupId(), engine.saves, "Undone restored"), cancelWhileWriting)
+                .toCompletableFuture());
+
+        assertThrows(CancellationException.class, () -> Engine.await(restore.join()));
+        assertEquals(List.of("Undone"), savesFolders());
+    }
+
+    @Test
+    void aRestoreCannotBeCancelledOnceItsWorldIsPublished() throws Exception {
+        engine = start(Engine.onlyDestination(DestinationType.ZIP));
+        TestWorld world = TestWorld.create(engine, "Kept");
+        Map<String, byte[]> backedUp = world.files();
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+        CompletableFuture<CompletableFuture<RestoreBackupResult>> restore = new CompletableFuture<>();
+        AtomicBoolean refused = new AtomicBoolean();
+        ProgressListener cancelOncePublished = progress -> {
+            if (progress.phase() == OperationPhase.COMPLETE) {
+                refused.set(!restore.join().cancel(true));
+            }
+        };
+
+        restore.complete(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(result.backupId(), engine.saves, "Kept restored"), cancelOncePublished)
+                .toCompletableFuture());
+
+        RestoreBackupResult restored = Engine.await(restore.join());
+        assertTrue(refused.get());
+        assertSameFiles(backedUp, restored.restoredWorldDirectory());
+    }
+
+    @Test
+    void aSavesFolderReachedThroughALinkReceivesTheRestoredWorldWhereItReallyIs() throws Exception {
+        Assumptions.assumeFalse(System.getProperty("os.name").startsWith("Windows"), "links need extra rights on Windows");
+        Path realSaves = Files.createDirectories(root.resolve("shared-saves"));
+        Files.createSymbolicLink(root.resolve("saves"), realSaves);
+        engine = start(Engine.onlyDestination(DestinationType.ZIP));
+        TestWorld world = TestWorld.create(engine, "Shared");
+        Map<String, byte[]> backedUp = world.files();
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+
+        RestoreBackupResult restored = restore(result.backupId(), "Shared restored");
+
+        assertEquals(realSaves.toRealPath().resolve("Shared restored"), restored.restoredWorldDirectory());
+        assertSameFiles(backedUp, engine.saves.resolve("Shared restored"));
+    }
+
+    private Path onlyArchive(TestWorld world) throws IOException {
+        try (Stream<Path> files = Files.walk(engine.zipFolder(world.id()))) {
+            List<Path> archives = files.filter(file -> file.toString().endsWith(".zip")).toList();
+            assertEquals(1, archives.size(), archives.toString());
+            return archives.getFirst();
+        }
+    }
+
+    private static void flipOneByte(Path archive) throws IOException {
+        try (RandomAccessFile file = new RandomAccessFile(archive.toFile(), "rw")) {
+            long middle = file.length() / 2;
+            file.seek(middle);
+            int value = file.read();
+            file.seek(middle);
+            file.write(value ^ 0xFF);
+        }
+    }
+
+    /** The names in saves, sorted; a staging folder left behind would show up here too. */
+    private List<String> savesFolders() throws IOException {
+        try (Stream<Path> folders = Files.list(engine.saves)) {
+            return folders.map(folder -> folder.getFileName().toString()).sorted().toList();
+        }
+    }
+
+    private static void deleteTree(Path folder) throws IOException {
+        try (Stream<Path> paths = Files.walk(folder)) {
+            for (Path path : paths.sorted(Comparator.reverseOrder()).toList()) {
+                Files.delete(path);
+            }
+        }
+    }
+
+    private Engine start(WorldArchiveConfig config) {
+        return new Engine(
+                root,
+                new Engine.TestClock(Instant.parse("2026-09-01T12:00:00Z")),
+                config,
+                SourceCaptureObserver.NONE);
+    }
+
+    private RestoreBackupResult restore(BackupId backupId, String name) throws Exception {
+        return await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(backupId, engine.saves, name),
+                ProgressListener.NO_OP));
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/e2e/CleanupEndToEndTest.java b/src/test/java/dev/ishaanko/worldarchive/e2e/CleanupEndToEndTest.java
new file mode 100644
index 0000000..44f6060
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/e2e/CleanupEndToEndTest.java
@@ -0,0 +1,344 @@
+package dev.ishaanko.worldarchive.e2e;
+
+import static dev.ishaanko.worldarchive.e2e.Engine.await;
+import static dev.ishaanko.worldarchive.e2e.TestWorld.assertSameFiles;
+import static dev.ishaanko.worldarchive.e2e.TestWorld.bytes;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.config.StoragePolicy;
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.core.RestoreBackupRequest;
+import dev.ishaanko.worldarchive.core.SourceCaptureObserver;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupRecord;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.VerificationStatus;
+import dev.ishaanko.worldarchive.storage.management.CleanupItem;
+import dev.ishaanko.worldarchive.storage.management.CleanupPlan;
+import dev.ishaanko.worldarchive.storage.management.CleanupRequest;
+import dev.ishaanko.worldarchive.storage.management.CleanupResult;
+import java.nio.file.FileSystems;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.attribute.PosixFilePermission;
+import java.nio.file.attribute.PosixFilePermissions;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import java.util.concurrent.ExecutionException;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class CleanupEndToEndTest {
+    /** Over budget from the first backup, and only the newest day is kept by the calendar. */
+    private static final StoragePolicy TIGHT = new StoragePolicy(1_024, 1, 0, 0);
+
+    @TempDir
+    Path root;
+
+    private Engine engine;
+
+    @AfterEach
+    void closeEngine() throws Exception {
+        if (engine != null) {
+            engine.close();
+        }
+    }
+
+    @Test
+    void cleanupKeepsLabeledBackupsAndDeletesOnlyWhatWasSelected() throws Exception {
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Crowded");
+        engine = start(Engine.defaultConfig(Engine.world(world.id(), world.path(), Optional.empty(), TIGHT)));
+        Map<String, byte[]> labeledFiles = world.files();
+        List<BackupId> days = backupOnFourDays(world, Optional.of("Base"));
+        BackupId labeled = days.get(0);
+
+        CleanupPlan plan = await(engine.cleanup.prepareCleanup(world.id()));
+
+        Map<BackupId, CleanupItem> items = plan.items().stream()
+                .collect(Collectors.toMap(CleanupItem::backupId, Function.identity()));
+        assertTrue(plan.protectedBackups().containsAll(List.of(labeled, days.get(3))));
+        for (BackupId unprotected : List.of(days.get(1), days.get(2))) {
+            assertTrue(items.get(unprotected).removeZip() && items.get(unprotected).removeGit());
+        }
+        for (BackupId kept : plan.protectedBackups()) {
+            assertTrue(!items.containsKey(kept) || !items.get(kept).removeZip(), kept.toString());
+        }
+        CleanupResult result = await(engine.cleanup.applyCleanup(
+                new CleanupRequest(plan.confirmationToken(), Set.of(days.get(1)))));
+
+        assertTrue(result.failures().isEmpty(), result.failures().toString());
+        assertEquals(Set.of(labeled, days.get(2), days.get(3)), backupIds(world));
+        assertSameFiles(labeledFiles, await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(labeled, engine.saves, "Crowded base"),
+                ProgressListener.NO_OP)).restoredWorldDirectory());
+    }
+
+    /**
+     * Verify found the ZIP of a labeled backup damaged, so its Git copy is the last intact one: no
+     * item of the plan deletes it, and after the whole plan the backup still restores.
+     */
+    @Test
+    void theGitCopyOfALabeledBackupWhoseZipIsDamagedIsNeverOffered() throws Exception {
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Labeled");
+        engine = start(Engine.defaultConfig(Engine.world(world.id(), world.path(), Optional.empty(), TIGHT)));
+        Map<String, byte[]> labeledFiles = world.files();
+        BackupId labeled = backupOnFourDays(world, Optional.of("Base")).getFirst();
+        Path archive = archiveOf(world, labeled);
+        byte[] damaged = Files.readAllBytes(archive);
+        damaged[damaged.length / 2] ^= 0x10;
+        Files.write(archive, damaged);
+        BackupResult verified = await(engine.recovery.verifyBackup(labeled, ProgressListener.NO_OP));
+        assertEquals(VerificationStatus.FAILED, verified.destinations().stream()
+                .filter(copy -> copy.destination() == DestinationType.ZIP)
+                .findFirst().orElseThrow().verificationStatus(), verified.destinations().toString());
+
+        CleanupPlan plan = await(engine.cleanup.prepareCleanup(world.id()));
+        assertTrue(plan.items().stream().noneMatch(item -> item.backupId().equals(labeled) && item.removeGit()),
+                plan.items().toString());
+        await(engine.cleanup.applyCleanup(new CleanupRequest(plan.confirmationToken(),
+                Set.copyOf(plan.items().stream().map(CleanupItem::backupId).toList()))));
+
+        assertSameFiles(labeledFiles, await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(labeled, engine.saves, "Labeled base"),
+                ProgressListener.NO_OP)).restoredWorldDirectory());
+    }
+
+    @Test
+    void cleanupLeavesTheRemoteCopyAndKeepsTheBackupListed() throws Exception {
+        Path remote = root.resolve("remote.git");
+        Files.createDirectories(remote);
+        new ProcessBuilder("git", "init", "--bare", "--quiet", remote.toString()).start().waitFor();
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Mirrored");
+        engine = start(Engine.defaultConfig(
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), TIGHT)));
+        Map<String, byte[]> oldest = world.files();
+        List<BackupId> days = backupOnFourDays(world, Optional.empty());
+
+        CleanupPlan plan = await(engine.cleanup.prepareCleanup(world.id()));
+        assertTrue(plan.items().stream().anyMatch(item -> item.backupId().equals(days.get(0))));
+        CleanupResult result = await(engine.cleanup.applyCleanup(
+                new CleanupRequest(plan.confirmationToken(), Set.of(days.get(0)))));
+
+        assertTrue(result.failures().isEmpty(), result.failures().toString());
+        BackupRecord remoteOnly = engine.catalog.find(days.get(0)).orElseThrow();
+        assertEquals(
+                List.of(DestinationType.GIT),
+                remoteOnly.result().destinations().stream().map(destination -> destination.destination()).toList());
+        assertSameFiles(oldest, await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(days.get(0), engine.saves, "Mirrored first"),
+                ProgressListener.NO_OP)).restoredWorldDirectory());
+    }
+
+    @Test
+    void aRemoteThatCannotBeReachedKeepsEveryCopyOfTheBackupsThatRelyOnIt() throws Exception {
+        Path remote = root.resolve("remote.git");
+        Files.createDirectories(remote);
+        new ProcessBuilder("git", "init", "--bare", "--quiet", remote.toString()).start().waitFor();
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Offline");
+        engine = start(Engine.defaultConfig(
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), TIGHT)));
+        List<BackupId> days = backupOnFourDays(world, Optional.empty());
+        CleanupPlan plan = await(engine.cleanup.prepareCleanup(world.id()));
+        BackupRecord oldest = engine.catalog.find(days.getFirst()).orElseThrow();
+        Files.move(remote, root.resolve("unplugged.git"));
+
+        CleanupResult result = await(engine.cleanup.applyCleanup(
+                new CleanupRequest(plan.confirmationToken(), Set.of(days.getFirst()))));
+
+        String reason = result.failures().getOrDefault(days.getFirst(), "");
+        assertTrue(reason.contains("could not be reached"), result.failures().toString());
+        assertEquals(oldest, engine.catalog.find(days.getFirst()).orElseThrow());
+        assertEquals(4, zipArchives(world));
+    }
+
+    @Test
+    void aSelectionThatSplitsTheProtectedGitCopiesDeletesNothing() throws Exception {
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Grouped");
+        engine = start(Engine.defaultConfig(Engine.world(world.id(), world.path(), Optional.empty(), TIGHT)));
+        backupOnFourDays(world, Optional.of("Base"));
+        CleanupPlan plan = await(engine.cleanup.prepareCleanup(world.id()));
+        List<BackupId> protectedGit = plan.items().stream()
+                .filter(item -> item.removeGit() && plan.protectedBackups().contains(item.backupId()))
+                .map(CleanupItem::backupId)
+                .toList();
+        assertTrue(protectedGit.size() > 1, plan.items().toString());
+        List<BackupRecord> before = engine.records(world.id());
+
+        ExecutionException refused = assertThrows(ExecutionException.class, () -> await(engine.cleanup.applyCleanup(
+                new CleanupRequest(plan.confirmationToken(), Set.of(protectedGit.getFirst())))));
+
+        assertTrue(refused.getCause().getMessage().contains("every protected backup"), refused.toString());
+        assertEquals(before, engine.records(world.id()));
+        assertEquals(4, await(engine.git.listSnapshots(Optional.of(world.id()))).size());
+        assertEquals(4, zipArchives(world));
+    }
+
+    @Test
+    void aPreviewThatWentStaleDeletesNothing() throws Exception {
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Stale");
+        engine = start(Engine.defaultConfig(Engine.world(world.id(), world.path(), Optional.empty(), TIGHT)));
+        List<BackupId> days = backupOnFourDays(world, Optional.empty());
+        CleanupPlan plan = await(engine.cleanup.prepareCleanup(world.id()));
+        assertFalse(plan.items().isEmpty());
+        engine.clock.advance(Duration.ofMinutes(1));
+        world.write("level.dat", bytes(4_096, 77));
+        BackupId newest = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+
+        assertThrows(ExecutionException.class, () -> await(engine.cleanup.applyCleanup(new CleanupRequest(
+                plan.confirmationToken(),
+                Set.copyOf(plan.items().stream().map(CleanupItem::backupId).toList())))));
+
+        List<BackupId> expected = new ArrayList<>(days);
+        expected.add(newest);
+        assertEquals(Set.copyOf(expected), backupIds(world));
+    }
+
+    @Test
+    void cleanupNeverLeavesARecordWhoseCopiesAreAllGone() throws Exception {
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Phantom");
+        engine = start(Engine.defaultConfig(Engine.world(world.id(), world.path(), Optional.empty(), TIGHT)));
+        List<BackupId> days = backupOnFourDays(world, Optional.empty());
+        BackupId oldest = days.getFirst();
+        try (Stream<Path> files = Files.walk(engine.zipFolder(world.id()))) {
+            for (Path file : files.filter(path -> path.getFileName().toString().contains(oldest.toString())).toList()) {
+                Files.delete(file);
+            }
+        }
+
+        CleanupPlan plan = await(engine.cleanup.prepareCleanup(world.id()));
+        CleanupItem item = plan.items().stream()
+                .filter(candidate -> candidate.backupId().equals(oldest))
+                .findFirst()
+                .orElseThrow();
+        assertTrue(item.removesRestorePoint(), "the preview must not promise another copy");
+        CleanupResult result = await(engine.cleanup.applyCleanup(
+                new CleanupRequest(plan.confirmationToken(), Set.of(oldest))));
+
+        assertTrue(result.failures().isEmpty(), result.failures().toString());
+        assertTrue(engine.catalog.find(oldest).isEmpty(), "a backup with no copy left must leave the catalog");
+    }
+
+    @Test
+    void aZipArchiveThatCannotBeDeletedKeepsItsBackupListedAndTheRestIsCleaned() throws Exception {
+        Assumptions.assumeTrue(FileSystems.getDefault().supportedFileAttributeViews().contains("posix"));
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Sticky");
+        engine = start(Engine.defaultConfig(Engine.world(world.id(), world.path(), Optional.empty(), TIGHT)));
+        Map<String, byte[]> first = world.files();
+        List<BackupId> days = backupOnFourDays(world, Optional.empty());
+        CleanupPlan plan = await(engine.cleanup.prepareCleanup(world.id()));
+        Set<BackupId> selected = Set.copyOf(plan.items().stream().map(CleanupItem::backupId).toList());
+        Path folder = engine.zipFolder(world.id()).resolve(world.id().toString());
+        Set<PosixFilePermission> writable = Files.getPosixFilePermissions(folder);
+        CleanupResult result;
+        Files.setPosixFilePermissions(folder, PosixFilePermissions.fromString("r-xr-xr-x"));
+        try {
+            Assumptions.assumeFalse(Files.isWritable(folder), "permissions do not apply to this user");
+            result = await(engine.cleanup.applyCleanup(new CleanupRequest(plan.confirmationToken(), selected)));
+        } finally {
+            Files.setPosixFilePermissions(folder, writable);
+        }
+
+        assertEquals(Set.copyOf(plan.items().stream().filter(CleanupItem::removeZip).map(CleanupItem::backupId).toList()),
+                result.failures().keySet());
+        for (BackupId backupId : selected) {
+            assertEquals(List.of(DestinationType.ZIP), engine.catalog.find(backupId).orElseThrow()
+                    .result().destinations().stream().map(destination -> destination.destination()).toList());
+        }
+        assertEquals(Set.copyOf(days), backupIds(world));
+        assertSameFiles(first, await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(days.getFirst(), engine.saves, "Sticky first"),
+                ProgressListener.NO_OP)).restoredWorldDirectory());
+    }
+
+    /**
+     * The remote keeps the oldest backup listed, so cleanup marks nothing deleted. Its ZIP archive
+     * cannot be deleted, and the deleted-backup list cannot be changed either: the archive is
+     * listed again all the same.
+     */
+    @Test
+    void aZipArchiveThatCannotBeDeletedIsListedAgainWhenTheDeletedBackupListCannotBeChanged() throws Exception {
+        Assumptions.assumeTrue(FileSystems.getDefault().supportedFileAttributeViews().contains("posix"));
+        Path remote = root.resolve("remote.git");
+        Files.createDirectories(remote);
+        new ProcessBuilder("git", "init", "--bare", "--quiet", remote.toString()).start().waitFor();
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Stubborn");
+        engine = start(Engine.defaultConfig(
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), TIGHT)));
+        BackupId oldest = backupOnFourDays(world, Optional.empty()).getFirst();
+        CleanupPlan plan = await(engine.cleanup.prepareCleanup(world.id()));
+        Files.createDirectories(engine.catalogFile().resolveSibling("deleted-backups.txt.lock"));
+        Path folder = engine.zipFolder(world.id()).resolve(world.id().toString());
+        Set<PosixFilePermission> writable = Files.getPosixFilePermissions(folder);
+        CleanupResult result;
+        Files.setPosixFilePermissions(folder, PosixFilePermissions.fromString("r-xr-xr-x"));
+        try {
+            Assumptions.assumeFalse(Files.isWritable(folder), "permissions do not apply to this user");
+            result = await(engine.cleanup.applyCleanup(new CleanupRequest(plan.confirmationToken(), Set.of(oldest))));
+        } finally {
+            Files.setPosixFilePermissions(folder, writable);
+        }
+
+        assertEquals(Set.of(oldest), result.failures().keySet());
+        assertEquals(Set.of(DestinationType.GIT, DestinationType.ZIP), engine.catalog.find(oldest).orElseThrow()
+                .result().destinations().stream().map(destination -> destination.destination()).collect(Collectors.toSet()));
+    }
+
+    /** Backs up on four consecutive days, changing the world each day, and verifies the newest. */
+    private List<BackupId> backupOnFourDays(TestWorld world, Optional<String> firstLabel) throws Exception {
+        List<BackupId> backups = new ArrayList<>();
+        for (int day = 0; day < 4; day++) {
+            if (day > 0) {
+                engine.clock.advance(Duration.ofDays(1));
+                world.write("level.dat", bytes(4_096, 100 + day));
+            }
+            Optional<String> label = day == 0 ? firstLabel : Optional.empty();
+            backups.add(await(engine.backup(world, BackupTrigger.MANUAL, label)).backupId());
+        }
+        await(engine.recovery.verifyBackup(backups.getLast(), ProgressListener.NO_OP));
+        return backups;
+    }
+
+    private Path archiveOf(TestWorld world, BackupId backupId) throws Exception {
+        try (Stream<Path> files = Files.walk(engine.zipFolder(world.id()))) {
+            return files.filter(path -> path.getFileName().toString().endsWith(backupId + ".zip"))
+                    .findFirst()
+                    .orElseThrow();
+        }
+    }
+
+    private long zipArchives(TestWorld world) throws Exception {
+        try (Stream<Path> files = Files.walk(engine.zipFolder(world.id()))) {
+            return files.filter(path -> path.getFileName().toString().endsWith(".zip")).count();
+        }
+    }
+
+    private Set<BackupId> backupIds(TestWorld world) throws Exception {
+        return Set.copyOf(engine.records(world.id()).stream()
+                .map(record -> record.manifest().backupId())
+                .toList());
+    }
+
+    private Engine start(WorldArchiveConfig config) {
+        return new Engine(
+                root,
+                new Engine.TestClock(Instant.parse("2026-09-01T12:00:00Z")),
+                config,
+                SourceCaptureObserver.NONE);
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/e2e/ConcurrencyEndToEndTest.java b/src/test/java/dev/ishaanko/worldarchive/e2e/ConcurrencyEndToEndTest.java
new file mode 100644
index 0000000..142154e
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/e2e/ConcurrencyEndToEndTest.java
@@ -0,0 +1,144 @@
+package dev.ishaanko.worldarchive.e2e;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.core.CaptureKind;
+import dev.ishaanko.worldarchive.core.CreateBackupRequest;
+import dev.ishaanko.worldarchive.core.PreparedBackup;
+import dev.ishaanko.worldarchive.core.SourceCaptureObserver;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.BackupStatus;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Optional;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class ConcurrencyEndToEndTest {
+    @TempDir
+    Path root;
+
+    private final CountDownLatch capturing = new CountDownLatch(1);
+
+    private final CountDownLatch release = new CountDownLatch(1);
+
+    private final AtomicInteger levelCopies = new AtomicInteger();
+
+    private Engine engine;
+
+    @AfterEach
+    void closeEngine() throws Exception {
+        release.countDown();
+        if (engine != null) {
+            engine.close();
+        }
+    }
+
+    @Test
+    void oneWorldsBackupDoesNotWaitForAnotherWorld() throws Exception {
+        engine = start(holdFirstCapture());
+        TestWorld slow = TestWorld.create(engine, "Slow");
+        TestWorld fast = TestWorld.create(engine, "Fast");
+
+        CompletableFuture<BackupResult> held = backup(slow);
+        assertTrue(capturing.await(Engine.TIMEOUT.toSeconds(), TimeUnit.SECONDS));
+        BackupResult finished = backup(fast).get(Engine.TIMEOUT.toSeconds(), TimeUnit.SECONDS);
+
+        assertEquals(BackupStatus.SUCCESS, finished.status());
+        assertFalse(held.isDone());
+        release.countDown();
+        assertEquals(BackupStatus.SUCCESS, held.get(Engine.TIMEOUT.toSeconds(), TimeUnit.SECONDS).status());
+    }
+
+    /** The player quits while a scheduled capture still copies: the exit capture waits for it instead of failing. */
+    @Test
+    void aSecondCaptureOfTheSameWorldWaitsForTheFirstAndBothSucceed() throws Exception {
+        engine = start(holdFirstCapture());
+        TestWorld world = TestWorld.create(engine, "Quitting");
+        CountDownLatch exitStarted = new CountDownLatch(1);
+
+        CompletableFuture<PreparedBackup> scheduled = prepare(world, BackupTrigger.SCHEDULED, ProgressListener.NO_OP);
+        assertTrue(capturing.await(Engine.TIMEOUT.toSeconds(), TimeUnit.SECONDS));
+        CompletableFuture<PreparedBackup> exit = prepare(world, BackupTrigger.WORLD_EXIT, progress -> exitStarted.countDown());
+        assertTrue(exitStarted.await(Engine.TIMEOUT.toSeconds(), TimeUnit.SECONDS));
+
+        assertFalse(exit.isDone());
+        release.countDown();
+        BackupResult first = Engine.await(engine.coordinator.createPreparedBackup(
+                scheduled.get(Engine.TIMEOUT.toSeconds(), TimeUnit.SECONDS), ProgressListener.NO_OP));
+        BackupResult second = Engine.await(engine.coordinator.createPreparedBackup(
+                exit.get(Engine.TIMEOUT.toSeconds(), TimeUnit.SECONDS), ProgressListener.NO_OP));
+        assertEquals(BackupStatus.SUCCESS, first.status());
+        assertEquals(BackupStatus.SUCCESS, second.status());
+        assertEquals(2, engine.records(world.id()).size());
+    }
+
+    @Test
+    void cancellingABackupThatWaitsForTheWorldNeverCapturesItAndTheNextBackupRuns() throws Exception {
+        engine = start(holdFirstCapture());
+        TestWorld world = TestWorld.create(engine, "Queued");
+        CompletableFuture<BackupResult> first = backup(world);
+        assertTrue(capturing.await(Engine.TIMEOUT.toSeconds(), TimeUnit.SECONDS));
+        CompletableFuture<BackupResult> waiting = backup(world);
+
+        assertTrue(waiting.cancel(true));
+        release.countDown();
+
+        assertEquals(BackupStatus.SUCCESS, first.get(Engine.TIMEOUT.toSeconds(), TimeUnit.SECONDS).status());
+        assertTrue(waiting.isCancelled());
+        engine.clock.advance(Duration.ofMinutes(1));
+        assertEquals(BackupStatus.SUCCESS, engine.backupNow(world, BackupTrigger.MANUAL).status());
+        assertEquals(2, levelCopies.get());
+        assertEquals(2, engine.records(world.id()).size());
+    }
+
+    /** Holds the first copy of level.dat until the test releases it, and counts every copy of it. */
+    private SourceCaptureObserver holdFirstCapture() {
+        return new SourceCaptureObserver() {
+            @Override
+            public void beforeFileCopy(Path relativePath) throws InterruptedException {
+                if (relativePath.toString().equals("level.dat") && levelCopies.incrementAndGet() == 1) {
+                    capturing.countDown();
+                    release.await();
+                }
+            }
+        };
+    }
+
+    private CompletableFuture<BackupResult> backup(TestWorld world) {
+        return engine.backup(world, BackupTrigger.MANUAL, Optional.empty()).toCompletableFuture();
+    }
+
+    /** Captures on a thread of its own, as the game does: the open world for a schedule, the closed one at exit. */
+    private CompletableFuture<PreparedBackup> prepare(TestWorld world, BackupTrigger trigger, ProgressListener listener) {
+        CreateBackupRequest request = new CreateBackupRequest(world.id(), world.path(), world.name(), Optional.empty(), trigger);
+        return CompletableFuture.supplyAsync(() -> {
+            try {
+                CaptureKind kind = trigger == BackupTrigger.WORLD_EXIT
+                        ? CaptureKind.CLOSED_WORLD
+                        : CaptureKind.OPEN_WORLD;
+                return engine.coordinator.prepareCapture(request, kind, listener);
+            } catch (Exception exception) {
+                throw new IllegalStateException(exception);
+            }
+        }, runnable -> Thread.ofVirtual().start(runnable));
+    }
+
+    private Engine start(SourceCaptureObserver observer) {
+        return new Engine(
+                root,
+                new Engine.TestClock(Instant.parse("2026-09-01T12:00:00Z")),
+                Engine.defaultConfig(),
+                observer);
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/e2e/DeleteEndToEndTest.java b/src/test/java/dev/ishaanko/worldarchive/e2e/DeleteEndToEndTest.java
new file mode 100644
index 0000000..8eb01eb
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/e2e/DeleteEndToEndTest.java
@@ -0,0 +1,627 @@
+package dev.ishaanko.worldarchive.e2e;
+
+import static dev.ishaanko.worldarchive.e2e.Engine.await;
+import static dev.ishaanko.worldarchive.e2e.TestWorld.bytes;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.config.StoragePolicy;
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.core.DeleteBackupRequest;
+import dev.ishaanko.worldarchive.core.RestoreBackupRequest;
+import dev.ishaanko.worldarchive.core.SourceCaptureObserver;
+import dev.ishaanko.worldarchive.importing.ImportSummary;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupRecord;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.BackupStatus;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.DestinationStatus;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.OperationPhase;
+import dev.ishaanko.worldarchive.model.OperationProgress;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.SyncStatus;
+import dev.ishaanko.worldarchive.ui.model.BackupRow;
+import dev.ishaanko.worldarchive.ui.model.DeleteBatchSummary;
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.FileSystems;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.attribute.PosixFilePermission;
+import java.nio.file.attribute.PosixFilePermissions;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import java.util.concurrent.TimeUnit;
+import java.util.function.Predicate;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class DeleteEndToEndTest {
+    @TempDir
+    Path root;
+
+    private Engine engine;
+
+    @AfterEach
+    void closeEngine() throws Exception {
+        if (engine != null) {
+            engine.close();
+        }
+    }
+
+    @Test
+    void deleteRemovesTheLocalCopiesAndTheRemoteCopy() throws Exception {
+        Path remote = bareRepository("remote.git");
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Synced");
+        engine = start(Engine.defaultConfig(
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), StoragePolicy.defaults())));
+        BackupResult created = engine.backupNow(world, BackupTrigger.MANUAL);
+        assertEquals(BackupStatus.SUCCESS, created.status());
+        assertEquals(SyncStatus.SYNCED, destination(created, DestinationType.GIT).syncStatus());
+        List<String> remoteRefs = refs(remote);
+        assertFalse(remoteRefs.isEmpty());
+
+        BackupResult deleted = delete(created.backupId());
+
+        assertEquals(BackupStatus.SUCCESS, deleted.status());
+        assertTrue(engine.records(world.id()).isEmpty());
+        assertTrue(archives(engine.zipFolder(world.id())).isEmpty());
+        assertTrue(snapshotRefs(remote, created.backupId()).isEmpty(), refs(remote).toString());
+    }
+
+    @Test
+    void aRemoteThatRefusesTheDeleteFailsTheDeleteAndKeepsTheBackupListed() throws Exception {
+        Path remote = bareRepository("refusing.git");
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Refused");
+        engine = start(Engine.defaultConfig(
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), StoragePolicy.defaults())));
+        BackupResult created = engine.backupNow(world, BackupTrigger.MANUAL);
+        git(remote, "config", "receive.denyDeletes", "true");
+        List<String> exposed = snapshotRefs(remote, created.backupId()).stream()
+                .filter(ref -> !ref.equals("refs/heads/main"))
+                .toList();
+        assertFalse(exposed.isEmpty());
+
+        BackupResult deleted = delete(created.backupId());
+
+        assertNotEquals(BackupStatus.SUCCESS, deleted.status());
+        assertEquals(DestinationStatus.FAILED, destination(deleted, DestinationType.GIT).status());
+        assertTrue(refs(remote).containsAll(exposed), refs(remote).toString());
+        List<BackupRecord> records = engine.records(world.id());
+        assertEquals(1, records.size());
+        assertTrue(records.getFirst().result().destinations().stream()
+                .anyMatch(result -> result.destination() == DestinationType.GIT));
+        // The player reads that the delete failed.
+        DeleteBatchSummary batch = DeleteBatchSummary.from(List.of(deleted), List.of(BackupRow.from(records.getFirst())));
+        assertEquals(BackupStatus.FAILED, batch.status());
+        assertEquals("No backups were deleted", batch.headline());
+    }
+
+    @Test
+    void aRefusedDeleteLeavesEveryRemoteRefWhereItWas() throws Exception {
+        Path remote = bareRepository("untouched.git");
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Untouched");
+        engine = start(Engine.defaultConfig(
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), StoragePolicy.defaults())));
+        BackupId older = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        engine.clock.advance(Duration.ofMinutes(1));
+        world.write("level.dat", bytes(4_096, 41));
+        BackupId newest = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        git(remote, "config", "receive.denyDeletes", "true");
+        String before = git(remote, "for-each-ref", "--format=%(refname) %(objectname)");
+
+        BackupResult deleted = delete(newest);
+
+        assertEquals(DestinationStatus.FAILED, destination(deleted, DestinationType.GIT).status());
+        assertEquals(before, git(remote, "for-each-ref", "--format=%(refname) %(objectname)"));
+        assertEquals(2, engine.records(world.id()).size());
+        assertFalse(snapshotRefs(remote, older).isEmpty());
+    }
+
+    /**
+     * A delete names the copies the player saw listed. A backup whose copies changed since then is
+     * left alone; a fresh confirmation deletes it, and only it, once.
+     */
+    @Test
+    void aConfirmationForABackupThatChangedDeletesNothing() throws Exception {
+        engine = start(Engine.defaultConfig());
+        TestWorld world = TestWorld.create(engine, "Confirmed");
+        List<BackupId> backups = backups(world, 2);
+        BackupId first = backups.getFirst();
+        BackupRecord listed = engine.catalog.find(first).orElseThrow();
+        // The list the player confirmed from showed only the ZIP copy; the catalog now also lists Git.
+        DeleteBackupRequest stale = new DeleteBackupRequest(
+                world.id(), first, List.of(destination(listed.result(), DestinationType.ZIP)));
+
+        BackupResult refused = await(engine.recovery.deleteBackups(List.of(stale), ProgressListener.NO_OP)).getFirst();
+
+        assertEquals(BackupStatus.FAILED, refused.status());
+        String reason = destination(refused, DestinationType.ZIP).message().orElseThrow();
+        assertTrue(reason.contains("changed after you confirmed"), reason);
+        assertEquals(listed, engine.catalog.find(first).orElseThrow());
+        assertEquals(4, archives(engine.zipFolder(world.id())).size());
+
+        DeleteBackupRequest confirmed = engine.confirmedDelete(first);
+        assertEquals(BackupStatus.SUCCESS, await(engine.recovery.deleteBackups(
+                List.of(confirmed), ProgressListener.NO_OP)).getFirst().status());
+        BackupResult again = await(engine.recovery.deleteBackups(List.of(confirmed), ProgressListener.NO_OP)).getFirst();
+
+        assertEquals(BackupStatus.FAILED, again.status());
+        assertEquals(List.of(backups.getLast()), backupIds(engine.records(world.id())));
+        assertEquals(1, await(engine.git.listSnapshots(Optional.of(world.id()))).size());
+    }
+
+    /**
+     * The player confirmed the delete while the backup waited for its upload, so the prompt named
+     * no copy on the remote. The upload then finished: the delete stops and removes nothing there.
+     */
+    @Test
+    void aConfirmationMadeBeforeASyncDoesNotDeleteTheRemoteCopy() throws Exception {
+        Path remote = bareRepository("pending.git");
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Pending");
+        engine = start(Engine.onlyDestination(DestinationType.GIT,
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), StoragePolicy.defaults())));
+        Path away = Files.move(remote, root.resolve("remote-away.git"));
+        BackupId backupId = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        assertEquals(SyncStatus.PENDING, destination(engine.catalog.find(backupId).orElseThrow().result(),
+                DestinationType.GIT).syncStatus());
+        DeleteBackupRequest confirmed = request(backupId);
+        Files.move(away, remote);
+        BackupResult synced = await(engine.recovery.syncBackup(backupId, ProgressListener.NO_OP));
+        assertEquals(SyncStatus.SYNCED, destination(synced, DestinationType.GIT).syncStatus(), synced.toString());
+
+        BackupResult refused = await(engine.recovery.deleteBackups(List.of(confirmed), ProgressListener.NO_OP)).getFirst();
+
+        assertEquals(BackupStatus.FAILED, refused.status(), refused.toString());
+        String reason = destination(refused, DestinationType.GIT).message().orElseThrow();
+        assertTrue(reason.contains("changed after you confirmed"), reason);
+        assertFalse(snapshotRefs(remote, backupId).isEmpty(), "the remote copy the player never saw is kept");
+        assertTrue(engine.catalog.find(backupId).isPresent());
+    }
+
+    @Test
+    void batchDeleteRemovesExactlyTheChosenBackupsAcrossWorlds() throws Exception {
+        engine = start(Engine.defaultConfig());
+        TestWorld north = TestWorld.create(engine, "North");
+        TestWorld south = TestWorld.create(engine, "South");
+        BackupId northOld = engine.backupNow(north, BackupTrigger.MANUAL).backupId();
+        BackupId southOld = engine.backupNow(south, BackupTrigger.MANUAL).backupId();
+        engine.clock.advance(Duration.ofMinutes(1));
+        north.write("level.dat", bytes(4_096, 31));
+        south.write("level.dat", bytes(4_096, 32));
+        BackupId northNew = engine.backupNow(north, BackupTrigger.MANUAL).backupId();
+        BackupId southNew = engine.backupNow(south, BackupTrigger.MANUAL).backupId();
+
+        List<DeleteBackupRequest> requests = List.of(
+                request(northOld), request(northNew), request(southOld));
+        List<BackupResult> results = await(engine.recovery.deleteBackups(requests, ProgressListener.NO_OP));
+
+        assertEquals(
+                List.of(northOld, northNew, southOld),
+                results.stream().map(BackupResult::backupId).toList());
+        assertTrue(results.stream().allMatch(result -> result.status() == BackupStatus.SUCCESS));
+        assertTrue(engine.records(north.id()).isEmpty());
+        assertEquals(List.of(southNew), engine.records(south.id()).stream()
+                .map(record -> record.manifest().backupId())
+                .toList());
+        List<Path> remaining = archives(engine.zipFolder(north.id()));
+        assertEquals(2, remaining.size(), remaining.toString());
+        assertTrue(remaining.stream().allMatch(file -> file.getFileName().toString().contains(southNew.toString())));
+    }
+
+    @Test
+    void aBackupThatCouldNotReachTheRemoteIsPendingUntilSynced() throws Exception {
+        Path remote = root.resolve("later.git");
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Offline");
+        engine = start(Engine.defaultConfig(
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), StoragePolicy.defaults())));
+
+        BackupResult created = engine.backupNow(world, BackupTrigger.MANUAL);
+        assertEquals(BackupStatus.PARTIAL_SUCCESS, created.status());
+        assertEquals(DestinationStatus.PENDING_SYNC, destination(created, DestinationType.GIT).status());
+
+        bareRepository("later.git");
+        BackupResult synced = await(engine.recovery.syncBackup(created.backupId(), ProgressListener.NO_OP));
+
+        assertEquals(SyncStatus.SYNCED, destination(synced, DestinationType.GIT).syncStatus());
+        assertFalse(snapshotRefs(remote, created.backupId()).isEmpty());
+        assertEquals(BackupStatus.SUCCESS, engine.records(world.id()).getFirst().result().status());
+    }
+
+    @Test
+    void aBatchDeleteWhileTheRemoteIsUnreachableKeepsEveryGitCopyAndARetryFinishes() throws Exception {
+        Path remote = bareRepository("travelling.git");
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Travelling");
+        engine = start(Engine.defaultConfig(
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), StoragePolicy.defaults())));
+        List<BackupId> backups = backups(world, 3);
+        Path unplugged = Files.move(remote, root.resolve("unplugged.git"));
+
+        List<BackupResult> refused = await(engine.recovery.deleteBackups(requests(backups), ProgressListener.NO_OP));
+
+        for (BackupResult result : refused) {
+            assertEquals(BackupStatus.PARTIAL_SUCCESS, result.status());
+            assertEquals(DestinationStatus.SUCCESS, destination(result, DestinationType.ZIP).status());
+            String reason = destination(result, DestinationType.GIT).message().orElseThrow();
+            assertTrue(reason.contains("could not be reached"), reason);
+        }
+        assertEquals(3, await(engine.git.listSnapshots(Optional.of(world.id()))).size());
+        assertTrue(engine.records(world.id()).stream().allMatch(record -> record.result().destinations().stream()
+                .map(DestinationResult::destination).toList().equals(List.of(DestinationType.GIT))));
+        assertTrue(archives(engine.zipFolder(world.id())).isEmpty());
+        Files.move(unplugged, remote);
+
+        List<BackupResult> retried = await(engine.recovery.deleteBackups(requests(backups), ProgressListener.NO_OP));
+
+        assertTrue(retried.stream().allMatch(result -> result.status() == BackupStatus.SUCCESS), retried.toString());
+        assertTrue(engine.records(world.id()).isEmpty());
+        for (BackupId backupId : backups) {
+            assertTrue(snapshotRefs(remote, backupId).isEmpty(), refs(remote).toString());
+        }
+    }
+
+    @Test
+    void aBatchDeleteReportsEachBackupHonestlyWhenOneWorldsZipFolderIsReadOnly() throws Exception {
+        Assumptions.assumeTrue(FileSystems.getDefault().supportedFileAttributeViews().contains("posix"));
+        engine = start(Engine.onlyDestination(DestinationType.ZIP));
+        TestWorld north = TestWorld.create(engine, "North");
+        TestWorld south = TestWorld.create(engine, "South");
+        Map<String, byte[]> southFiles = south.files();
+        BackupId northOld = engine.backupNow(north, BackupTrigger.MANUAL).backupId();
+        BackupId southOnly = engine.backupNow(south, BackupTrigger.MANUAL).backupId();
+        engine.clock.advance(Duration.ofMinutes(1));
+        north.write("level.dat", bytes(4_096, 33));
+        BackupId northNew = engine.backupNow(north, BackupTrigger.MANUAL).backupId();
+        Path southFolder = engine.zipFolder(south.id()).resolve(south.id().toString());
+        Set<PosixFilePermission> writable = Files.getPosixFilePermissions(southFolder);
+        List<BackupResult> results;
+        Files.setPosixFilePermissions(southFolder, PosixFilePermissions.fromString("r-xr-xr-x"));
+        try {
+            Assumptions.assumeFalse(Files.isWritable(southFolder), "permissions do not apply to this user");
+            results = await(engine.recovery.deleteBackups(
+                    requests(List.of(northOld, southOnly, northNew)), ProgressListener.NO_OP));
+        } finally {
+            Files.setPosixFilePermissions(southFolder, writable);
+        }
+
+        assertEquals(List.of(BackupStatus.SUCCESS, BackupStatus.FAILED, BackupStatus.SUCCESS),
+                results.stream().map(BackupResult::status).toList());
+        String reason = destination(results.get(1), DestinationType.ZIP).message().orElseThrow();
+        assertTrue(reason.contains("could not be deleted"), reason);
+        assertTrue(engine.records(north.id()).isEmpty());
+        assertEquals(List.of(southOnly), backupIds(engine.records(south.id())));
+        TestWorld.assertSameFiles(southFiles, await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(southOnly, engine.saves, "South kept"), ProgressListener.NO_OP))
+                .restoredWorldDirectory());
+    }
+
+    @Test
+    void aWorldWhoseBackupListCannotBeSavedFailsOnlyItsOwnBackupsAndTheBatchGoesOn() throws Exception {
+        Assumptions.assumeTrue(FileSystems.getDefault().supportedFileAttributeViews().contains("posix"));
+        engine = start(Engine.onlyDestination(DestinationType.ZIP));
+        TestWorld north = TestWorld.create(engine, "North");
+        TestWorld south = TestWorld.create(engine, "South");
+        Map<String, byte[]> southFiles = south.files();
+        BackupId northBackup = engine.backupNow(north, BackupTrigger.MANUAL).backupId();
+        BackupId southBackup = engine.backupNow(south, BackupTrigger.MANUAL).backupId();
+        Set<PosixFilePermission> writable = Files.getPosixFilePermissions(engine.storage);
+        List<BackupResult> results;
+        try {
+            results = await(engine.recovery.deleteBackups(requests(List.of(northBackup, southBackup)), readOnlyWhen(
+                    engine.storage,
+                    progress -> progress.worldId().equals(south.id()) && progress.phase() == OperationPhase.PREPARING)));
+            Assumptions.assumeFalse(Files.isWritable(engine.storage), "permissions do not apply to this user");
+        } finally {
+            Files.setPosixFilePermissions(engine.storage, writable);
+        }
+
+        assertEquals(List.of(BackupStatus.SUCCESS, BackupStatus.FAILED),
+                results.stream().map(BackupResult::status).toList());
+        String reason = destination(results.get(1), DestinationType.ZIP).message().orElseThrow();
+        assertTrue(reason.startsWith("Nothing of this backup was deleted"), reason);
+        assertTrue(engine.records(north.id()).isEmpty());
+        assertEquals(List.of(southBackup), backupIds(engine.records(south.id())));
+        TestWorld.assertSameFiles(southFiles, await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(southBackup, engine.saves, "South kept"), ProgressListener.NO_OP))
+                .restoredWorldDirectory());
+    }
+
+    @Test
+    void copiesDeletedWhileTheBackupListCannotBeSavedAreReportedAndTheNextDeleteFinishes() throws Exception {
+        Assumptions.assumeTrue(FileSystems.getDefault().supportedFileAttributeViews().contains("posix"));
+        engine = start(Engine.onlyDestination(DestinationType.ZIP));
+        TestWorld world = TestWorld.create(engine, "World");
+        BackupId backupId = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        Set<PosixFilePermission> writable = Files.getPosixFilePermissions(engine.storage);
+        BackupResult result;
+        try {
+            result = engine.delete(backupId,
+                    readOnlyWhen(engine.storage, progress -> progress.phase() == OperationPhase.WRITING));
+            Assumptions.assumeFalse(Files.isWritable(engine.storage), "permissions do not apply to this user");
+        } finally {
+            Files.setPosixFilePermissions(engine.storage, writable);
+        }
+
+        assertEquals(BackupStatus.FAILED, result.status());
+        String reason = destination(result, DestinationType.ZIP).message().orElseThrow();
+        assertTrue(reason.startsWith("Deleted, but the backup list could not be saved"), reason);
+        assertEquals(List.of(backupId), backupIds(engine.records(world.id())));
+        assertTrue(archives(engine.zipFolder(world.id())).isEmpty());
+        assertEquals(BackupStatus.SUCCESS, delete(backupId).status());
+        assertTrue(engine.records(world.id()).isEmpty());
+    }
+
+    @Test
+    void aDeletedBackupStaysGoneAfterARestartEvenWhenACrashLeftItsArchiveBehind() throws Exception {
+        engine = start(Engine.defaultConfig());
+        TestWorld world = TestWorld.create(engine, "Gone");
+        List<BackupId> backups = backups(world, 2);
+        Path archive = archives(engine.zipFolder(world.id())).stream()
+                .filter(file -> file.toString().endsWith(backups.getFirst() + ".zip"))
+                .findFirst()
+                .orElseThrow();
+        byte[] leftover = Files.readAllBytes(archive);
+        assertEquals(BackupStatus.SUCCESS, delete(backups.getFirst()).status());
+        Files.write(archive, leftover);
+        engine.close();
+
+        engine = start(Engine.defaultConfig());
+        ImportSummary rebuilt = await(engine.imports.rebuildLocal());
+
+        assertEquals(0, rebuilt.added());
+        assertEquals(List.of(backups.getLast()), backupIds(engine.records(world.id())));
+        assertEquals(List.of(backups.getLast()), await(engine.git.listSnapshots(Optional.of(world.id()))).stream()
+                .map(snapshot -> snapshot.backupId())
+                .toList());
+    }
+
+    /** The drive that holds the chosen Git folder is unplugged: the delete fails, touches no copy, and creates nothing. */
+    @Test
+    void deletingWhileTheGitFolderIsUnpluggedFailsAndCreatesNothing() throws Exception {
+        Path drive = Files.createDirectories(root.resolve("usb"));
+        Path gitFolder = Files.createDirectories(drive.resolve("Git backups"));
+        WorldArchiveConfig gitOnly = Engine.onlyDestination(DestinationType.GIT);
+        engine = start(gitOnly.withGit(gitOnly.git().withRepository(Optional.of(gitFolder))));
+        TestWorld world = TestWorld.create(engine, "Travelling");
+        BackupId backupId = backups(world, 1).getFirst();
+        Path unplugged = Files.move(drive, root.resolve("unplugged-drive"));
+
+        BackupResult refused = delete(backupId);
+
+        assertEquals(BackupStatus.FAILED, refused.status(), refused.toString());
+        String reason = destination(refused, DestinationType.GIT).message().orElseThrow();
+        assertTrue(reason.contains("cannot be reached"), reason);
+        assertFalse(Files.exists(drive), "nothing was created where the drive was");
+        Files.move(unplugged, drive);
+        assertEquals(1, await(engine.git.listSnapshots(Optional.of(world.id()))).size());
+        assertEquals(BackupStatus.SUCCESS, delete(backupId).status());
+    }
+
+    /**
+     * The player removed a world's repository from WorldArchive's default Git folder by hand. Its
+     * backups can still be deleted: nothing is left here, and the copy on the remote goes too.
+     */
+    @Test
+    void aRepositoryRemovedByHandFromTheDefaultFolderIsStillDeletedEverywhere() throws Exception {
+        Path remote = bareRepository("kept-remote.git");
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Tidied");
+        engine = start(Engine.onlyDestination(DestinationType.GIT,
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), StoragePolicy.defaults())));
+        BackupId backupId = backups(world, 1).getFirst();
+        assertFalse(snapshotRefs(remote, backupId).isEmpty());
+        deleteTree(engine.git.repositoryFor(world.id()));
+
+        BackupResult deleted = delete(backupId);
+
+        assertEquals(BackupStatus.SUCCESS, deleted.status(), deleted.toString());
+        assertEquals(List.of(), backupIds(engine.records(world.id())));
+        assertEquals(List.of(), snapshotRefs(remote, backupId));
+    }
+
+    /** The player removed a world's folder from WorldArchive's default ZIP folder by hand: its backups leave the list. */
+    @Test
+    void aZipFolderRemovedByHandFromTheDefaultFolderLetsItsBackupsBeDeleted() throws Exception {
+        engine = start(Engine.onlyDestination(DestinationType.ZIP));
+        TestWorld world = TestWorld.create(engine, "Tidied");
+        BackupId backupId = backups(world, 1).getFirst();
+        Path worldFolder = engine.zipFolder(world.id()).resolve(world.id().toString());
+        assertTrue(Files.isDirectory(worldFolder));
+        deleteTree(worldFolder);
+
+        BackupResult deleted = delete(backupId);
+
+        assertEquals(BackupStatus.SUCCESS, deleted.status(), deleted.toString());
+        assertEquals(List.of(), backupIds(engine.records(world.id())));
+        assertFalse(Files.exists(worldFolder), "nothing was created in place of the removed folder");
+    }
+
+    /**
+     * A crash left the archive of a deleted backup on a USB drive, and the drive was away when the
+     * game started again. That rebuild could not see the drive, so the backup stays deleted once
+     * the drive is back.
+     */
+    @Test
+    void aDeletedBackupsArchiveOnADriveThatWasAwayAtARestartIsNotListedAgain() throws Exception {
+        Path drive = Files.createDirectories(root.resolve("usb"));
+        Path zips = Files.createDirectories(drive.resolve("Backups"));
+        WorldArchiveConfig zipOnly = Engine.onlyDestination(DestinationType.ZIP);
+        WorldArchiveConfig config = zipOnly.withZip(zipOnly.zip().withDestination(Optional.of(zips)));
+        engine = start(config);
+        TestWorld world = TestWorld.create(engine, "Travelling");
+        BackupId backupId = backups(world, 1).getFirst();
+        Path archive = archives(zips).stream().filter(file -> file.toString().endsWith(".zip")).findFirst().orElseThrow();
+        byte[] leftover = Files.readAllBytes(archive);
+        assertEquals(BackupStatus.SUCCESS, delete(backupId).status());
+        Files.write(archive, leftover);
+        engine.close();
+        Path unplugged = Files.move(drive, root.resolve("unplugged"));
+        engine = start(config);
+        await(engine.imports.rebuildLocal());
+        engine.close();
+        Files.move(unplugged, drive);
+
+        engine = start(config);
+        await(engine.imports.rebuildLocal());
+
+        assertEquals(List.of(), backupIds(engine.records(world.id())));
+    }
+
+    @Test
+    void aSyncedBackupWhoseOnlyCopyIsOnARemoteThatLeftTheSettingsStaysListed() throws Exception {
+        Path remote = bareRepository("former.git");
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Moved");
+        engine = start(Engine.onlyDestination(DestinationType.GIT,
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), StoragePolicy.defaults())));
+        List<BackupId> backups = backups(world, 2);
+        BackupId withLocalCopy = backups.getFirst();
+        BackupId remoteOnly = backups.getLast();
+        assertTrue(await(engine.git.deleteLocalSnapshot(world.id(), remoteOnly)), "cleanup left only the remote copy");
+        engine.close();
+        engine = start(Engine.onlyDestination(DestinationType.GIT,
+                Engine.world(world.id(), world.path(), Optional.empty(), StoragePolicy.defaults())));
+
+        List<BackupResult> results = await(engine.recovery.deleteBackups(
+                requests(List.of(withLocalCopy, remoteOnly)), ProgressListener.NO_OP));
+
+        DestinationResult deletedHere = destination(results.getFirst(), DestinationType.GIT);
+        assertEquals(DestinationStatus.SUCCESS, deletedHere.status());
+        assertTrue(deletedHere.message().orElseThrow().contains("was not deleted there"), deletedHere.toString());
+        DestinationResult kept = destination(results.getLast(), DestinationType.GIT);
+        assertEquals(DestinationStatus.FAILED, kept.status());
+        assertTrue(kept.message().orElseThrow().contains("Add the remote again"), kept.toString());
+        assertEquals(List.of(remoteOnly), backupIds(engine.records(world.id())));
+        assertFalse(snapshotRefs(remote, withLocalCopy).isEmpty());
+        assertFalse(snapshotRefs(remote, remoteOnly).isEmpty());
+    }
+
+    /** Backs up the world the given number of times, a minute apart, changing it each time. */
+    private List<BackupId> backups(TestWorld world, int count) throws Exception {
+        List<BackupId> backups = new ArrayList<>();
+        for (int index = 0; index < count; index++) {
+            engine.clock.advance(Duration.ofMinutes(1));
+            world.write("level.dat", bytes(4_096, 500 + index));
+            BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+            assertEquals(BackupStatus.SUCCESS, result.status(), result.destinations().toString());
+            backups.add(result.backupId());
+        }
+        return backups;
+    }
+
+    private List<DeleteBackupRequest> requests(List<BackupId> backups) throws Exception {
+        List<DeleteBackupRequest> requests = new ArrayList<>();
+        for (BackupId backupId : backups) {
+            requests.add(request(backupId));
+        }
+        return requests;
+    }
+
+    private static List<BackupId> backupIds(List<BackupRecord> records) {
+        return records.stream().map(record -> record.manifest().backupId()).toList();
+    }
+
+    private Engine start(WorldArchiveConfig config) {
+        return new Engine(
+                root,
+                new Engine.TestClock(Instant.parse("2026-09-01T12:00:00Z")),
+                config,
+                SourceCaptureObserver.NONE);
+    }
+
+    private BackupResult delete(BackupId backupId) throws Exception {
+        return engine.delete(backupId, ProgressListener.NO_OP);
+    }
+
+    private DeleteBackupRequest request(BackupId backupId) throws Exception {
+        return engine.confirmedDelete(backupId);
+    }
+
+    /** A progress listener that makes the folder read-only when a matching step is reported. */
+    private static ProgressListener readOnlyWhen(Path folder, Predicate<OperationProgress> step) {
+        return progress -> {
+            if (step.test(progress)) {
+                try {
+                    Files.setPosixFilePermissions(folder, PosixFilePermissions.fromString("r-xr-xr-x"));
+                } catch (IOException exception) {
+                    throw new UncheckedIOException(exception);
+                }
+            }
+        };
+    }
+
+    private static DestinationResult destination(BackupResult result, DestinationType type) {
+        return result.destinations().stream()
+                .filter(destination -> destination.destination() == type)
+                .findFirst()
+                .orElseThrow();
+    }
+
+    private Path bareRepository(String name) throws Exception {
+        Path repository = root.resolve(name);
+        Files.createDirectories(repository);
+        git(repository, "init", "--bare", "--quiet");
+        return repository;
+    }
+
+    /** Remote refs whose snapshot commit message names this backup. */
+    private static List<String> snapshotRefs(Path repository, BackupId backupId) throws Exception {
+        return refs(repository).stream()
+                .filter(ref -> {
+                    try {
+                        return git(repository, "log", "-1", "--format=%B", ref).contains(backupId.toString());
+                    } catch (Exception exception) {
+                        throw new IllegalStateException(exception);
+                    }
+                })
+                .toList();
+    }
+
+    private static List<String> refs(Path repository) throws Exception {
+        return git(repository, "for-each-ref", "--format=%(refname)").lines()
+                .filter(line -> !line.isBlank())
+                .toList();
+    }
+
+    private static String git(Path repository, String... arguments) throws Exception {
+        List<String> command = new ArrayList<>(List.of("git", "--git-dir", repository.toString()));
+        command.addAll(List.of(arguments));
+        Process process = new ProcessBuilder(command).redirectErrorStream(true).start();
+        String output = new String(process.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
+        if (!process.waitFor(30, TimeUnit.SECONDS) || process.exitValue() != 0) {
+            throw new IllegalStateException("git " + String.join(" ", arguments) + " failed: " + output);
+        }
+        return output;
+    }
+
+    /** ZIP archives and checksum files under a ZIP folder; lock files are not backup copies. */
+    private static List<Path> archives(Path folder) throws IOException {
+        if (!Files.exists(folder)) {
+            return List.of();
+        }
+        try (Stream<Path> files = Files.walk(folder)) {
+            return files.filter(file -> file.toString().endsWith(".zip") || file.toString().endsWith(".sha256"))
+                    .toList();
+        }
+    }
+
+    private static void deleteTree(Path folder) throws IOException {
+        try (Stream<Path> paths = Files.walk(folder)) {
+            for (Path path : paths.sorted(java.util.Comparator.reverseOrder()).toList()) {
+                Files.delete(path);
+            }
+        }
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/e2e/Engine.java b/src/test/java/dev/ishaanko/worldarchive/e2e/Engine.java
new file mode 100644
index 0000000..2aa3cec
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/e2e/Engine.java
@@ -0,0 +1,226 @@
+package dev.ishaanko.worldarchive.e2e;
+
+import dev.ishaanko.worldarchive.catalog.FileBackupCatalog;
+import dev.ishaanko.worldarchive.config.DestinationTriggerConfig;
+import dev.ishaanko.worldarchive.config.GitDestinationConfig;
+import dev.ishaanko.worldarchive.config.StoragePolicy;
+import dev.ishaanko.worldarchive.config.TriggerConfig;
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.config.WorldConfig;
+import dev.ishaanko.worldarchive.config.WorldIdentityStore;
+import dev.ishaanko.worldarchive.config.ZipDestinationConfig;
+import dev.ishaanko.worldarchive.core.CreateBackupRequest;
+import dev.ishaanko.worldarchive.core.DeleteBackupRequest;
+import dev.ishaanko.worldarchive.core.FileSystemBackupCaptureFactory;
+import dev.ishaanko.worldarchive.core.SerializedBackupCoordinator;
+import dev.ishaanko.worldarchive.core.SourceCaptureObserver;
+import dev.ishaanko.worldarchive.importing.FileBackupImportService;
+import dev.ishaanko.worldarchive.importing.ImportPreview;
+import dev.ishaanko.worldarchive.importing.ImportSummary;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupRecord;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.recovery.BackupRecoveryService;
+import dev.ishaanko.worldarchive.recovery.RestoredWorldMetadataFinalizer;
+import dev.ishaanko.worldarchive.runtime.RuntimeState;
+import dev.ishaanko.worldarchive.runtime.RuntimeStoragePaths;
+import dev.ishaanko.worldarchive.runtime.ServiceGraph;
+import dev.ishaanko.worldarchive.storage.git.WorldGitSnapshotStore;
+import dev.ishaanko.worldarchive.storage.management.ManagedStorageService;
+import java.io.IOException;
+import java.nio.file.Path;
+import java.time.Clock;
+import java.time.Duration;
+import java.time.Instant;
+import java.time.ZoneId;
+import java.time.ZoneOffset;
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.concurrent.CompletionStage;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
+import java.util.stream.Collectors;
+
+/**
+ * The real backup engine (capture, Git and ZIP destinations, catalog, recovery, import, and
+ * cleanup), built through the production {@link ServiceGraph} and rooted in one temporary folder.
+ * Closing and rebuilding an engine on the same folder models a game restart; a test that models
+ * the start's catalog rebuild calls it itself.
+ */
+final class Engine implements AutoCloseable {
+    static final Duration TIMEOUT = Duration.ofSeconds(60);
+
+    final Path saves;
+
+    final Path storage;
+
+    final TestClock clock;
+
+    final ServiceGraph graph;
+
+    final WorldIdentityStore identities;
+
+    final FileBackupCatalog catalog;
+
+    final WorldGitSnapshotStore git;
+
+    final RuntimeStoragePaths paths;
+
+    final SerializedBackupCoordinator coordinator;
+
+    final BackupRecoveryService recovery;
+
+    final FileBackupImportService imports;
+
+    final ManagedStorageService cleanup;
+
+    private final ExecutorService executor = Executors.newThreadPerTaskExecutor(
+            Thread.ofVirtual().name("e2e-worker-", 0).factory());
+
+    Engine(Path root, TestClock clock, WorldArchiveConfig config, SourceCaptureObserver observer) {
+        this.saves = root.resolve("saves");
+        this.storage = root.resolve("worldarchive");
+        this.clock = Objects.requireNonNull(clock, "clock");
+        this.graph = new ServiceGraph(
+                storage,
+                new FileSystemBackupCaptureFactory(storage.resolve("capture-temp"), Optional.empty(), observer),
+                RestoredWorldMetadataFinalizer.NO_OP,
+                executor,
+                clock);
+        RuntimeState state = graph.install(config).orElseThrow();
+        try {
+            await(graph.checkGitTools(state));
+        } catch (Exception exception) {
+            throw new IllegalStateException("Git could not be checked", exception);
+        }
+        this.identities = graph.identities();
+        this.catalog = graph.catalog();
+        this.git = state.git();
+        this.paths = state.storagePaths();
+        this.coordinator = state.coordinator();
+        this.recovery = state.recovery();
+        this.imports = state.imports();
+        this.cleanup = state.storage();
+    }
+
+    /** Both destinations on, every trigger allowed, no per-world overrides. */
+    static WorldArchiveConfig defaultConfig(WorldConfig... worlds) {
+        return new WorldArchiveConfig(
+                new TriggerConfig(true, true, true, TriggerConfig.DEFAULT_SCHEDULE_INTERVAL_MINUTES),
+                GitDestinationConfig.defaults(),
+                ZipDestinationConfig.defaults(),
+                List.of(worlds));
+    }
+
+    /** A config with only one destination enabled. */
+    static WorldArchiveConfig onlyDestination(DestinationType destination, WorldConfig... worlds) {
+        WorldArchiveConfig defaults = defaultConfig(worlds);
+        GitDestinationConfig git = defaults.git();
+        return new WorldArchiveConfig(
+                defaults.triggers(),
+                new GitDestinationConfig(
+                        destination == DestinationType.GIT,
+                        git.repository(),
+                        git.remoteName(),
+                        DestinationTriggerConfig.defaults(),
+                        git.lfsPatterns()),
+                new ZipDestinationConfig(
+                        destination == DestinationType.ZIP,
+                        Optional.empty(),
+                        DestinationTriggerConfig.defaults()),
+                defaults.worlds());
+    }
+
+    static WorldConfig world(WorldId worldId, Path path, Optional<String> remote, StoragePolicy policy) {
+        return new WorldConfig(worldId, true, path, remote, Optional.empty(), policy);
+    }
+
+    CompletionStage<BackupResult> backup(TestWorld world, BackupTrigger trigger, Optional<String> label) {
+        return coordinator.createBackup(
+                new CreateBackupRequest(world.id(), world.path(), world.name(), label, trigger),
+                ProgressListener.NO_OP);
+    }
+
+    BackupResult backupNow(TestWorld world, BackupTrigger trigger) throws Exception {
+        return await(backup(world, trigger, Optional.empty()));
+    }
+
+    List<BackupRecord> records(WorldId worldId) throws IOException {
+        return catalog.list(worldId);
+    }
+
+    /** The delete a player confirms after seeing the backup as the catalog lists it now. */
+    DeleteBackupRequest confirmedDelete(BackupId backupId) throws IOException {
+        BackupRecord record = catalog.find(backupId).orElseThrow();
+        return new DeleteBackupRequest(record.manifest().worldId(), backupId, record.result().destinations());
+    }
+
+    /** Deletes one backup the way the browser does, with the copies it lists now. */
+    BackupResult delete(BackupId backupId, ProgressListener listener) throws Exception {
+        return await(recovery.deleteBackups(List.of(confirmedDelete(backupId)), listener)).getFirst();
+    }
+
+    /** The backup list file, which tests damage or delete. */
+    Path catalogFile() {
+        return storage.resolve("catalog.json");
+    }
+
+    /** The folder that holds the world's ZIP folder, as the settings name it. */
+    Path zipFolder(WorldId worldId) {
+        return paths.zipDirectory(worldId);
+    }
+
+    /** Imports every backup the preview lists, as a player does who keeps the whole selection. */
+    ImportSummary importAll(ImportPreview preview) throws Exception {
+        return await(imports.execute(preview.token(), preview.items().stream()
+                .map(item -> item.manifest().backupId())
+                .collect(Collectors.toUnmodifiableSet())));
+    }
+
+    static <T> T await(CompletionStage<T> stage) throws Exception {
+        return stage.toCompletableFuture().get(TIMEOUT.toSeconds(), TimeUnit.SECONDS);
+    }
+
+    @Override
+    public void close() throws Exception {
+        graph.close();
+        executor.shutdownNow();
+        if (!executor.awaitTermination(TIMEOUT.toSeconds(), TimeUnit.SECONDS)) {
+            throw new IllegalStateException("Engine workers did not stop");
+        }
+    }
+
+    /** A clock the test moves forward by hand, so backups land on chosen days. */
+    static final class TestClock extends Clock {
+        private volatile Instant now;
+
+        TestClock(Instant start) {
+            this.now = Objects.requireNonNull(start, "start");
+        }
+
+        void advance(Duration duration) {
+            now = now.plus(duration);
+        }
+
+        @Override
+        public ZoneId getZone() {
+            return ZoneOffset.UTC;
+        }
+
+        @Override
+        public Clock withZone(ZoneId zone) {
+            throw new UnsupportedOperationException();
+        }
+
+        @Override
+        public Instant instant() {
+            return now;
+        }
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/e2e/FailureEndToEndTest.java b/src/test/java/dev/ishaanko/worldarchive/e2e/FailureEndToEndTest.java
new file mode 100644
index 0000000..872375d
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/e2e/FailureEndToEndTest.java
@@ -0,0 +1,439 @@
+package dev.ishaanko.worldarchive.e2e;
+
+import static dev.ishaanko.worldarchive.e2e.Engine.await;
+import static dev.ishaanko.worldarchive.e2e.TestWorld.assertSameFiles;
+import static dev.ishaanko.worldarchive.e2e.TestWorld.bytes;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.config.DestinationTriggerConfig;
+import dev.ishaanko.worldarchive.config.GitDestinationConfig;
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.config.ZipDestinationConfig;
+import dev.ishaanko.worldarchive.core.RestoreBackupRequest;
+import dev.ishaanko.worldarchive.core.SourceCaptureObserver;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.BackupStatus;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.DestinationStatus;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.VerificationStatus;
+import java.io.IOException;
+import java.io.RandomAccessFile;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Arrays;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.CancellationException;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class FailureEndToEndTest {
+    @TempDir
+    Path root;
+
+    private Engine engine;
+
+    @AfterEach
+    void closeEngine() throws Exception {
+        if (engine != null) {
+            engine.close();
+        }
+    }
+
+    @Test
+    void aFailingZipFolderStillKeepsTheGitCopy() throws Exception {
+        Path notAFolder = Files.writeString(root.resolve("zip-folder-is-a-file"), "x");
+        engine = start(withFolders(Optional.empty(), Optional.of(notAFolder)), SourceCaptureObserver.NONE);
+        TestWorld world = TestWorld.create(engine, "Half");
+        Map<String, byte[]> backedUp = world.files();
+
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+
+        assertEquals(BackupStatus.PARTIAL_SUCCESS, result.status());
+        assertEquals(DestinationStatus.SUCCESS, destination(result, DestinationType.GIT).status());
+        assertEquals(DestinationStatus.FAILED, destination(result, DestinationType.ZIP).status());
+        assertEquals(1, engine.records(world.id()).size());
+        assertSameFiles(backedUp, await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(result.backupId(), engine.saves, "Half restored"),
+                ProgressListener.NO_OP)).restoredWorldDirectory());
+    }
+
+    /** The world list was loaded, then the world folder was deleted: the backup fails and names the folder. */
+    @Test
+    void aWorldDeletedBeforeItsBackupFailsWithoutARecordOrCopies() throws Exception {
+        engine = start(Engine.defaultConfig(), SourceCaptureObserver.NONE);
+        TestWorld world = TestWorld.create(engine, "Deleted");
+        try (Stream<Path> files = Files.walk(world.path())) {
+            for (Path file : files.sorted(Comparator.reverseOrder()).toList()) {
+                Files.delete(file);
+            }
+        }
+
+        ExecutionException failure = assertThrows(ExecutionException.class, () -> engine.backupNow(world, BackupTrigger.MANUAL));
+
+        assertTrue(failure.getCause().getMessage().contains(world.path().toString()), failure.getCause().getMessage());
+        assertTrue(engine.records(world.id()).isEmpty());
+        assertNoWorldCopies(engine.storage.resolve("capture-temp"));
+    }
+
+    @Test
+    void aBackupWithNoWorkingDestinationRecordsNothingAndLeavesNoCopies() throws Exception {
+        Path notAFolder = Files.writeString(root.resolve("not-a-folder"), "x");
+        engine = start(withFolders(Optional.of(notAFolder), Optional.of(notAFolder)), SourceCaptureObserver.NONE);
+        TestWorld world = TestWorld.create(engine, "Nowhere");
+
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+
+        assertEquals(BackupStatus.FAILED, result.status());
+        assertTrue(engine.records(world.id()).isEmpty());
+        assertNoWorldCopies(engine.storage.resolve("capture-temp"));
+    }
+
+    /**
+     * The drive of the folders the player chose is away, but its mount point is there. The backup
+     * fails, and neither folder is created on the computer's own disk in the drive's place.
+     */
+    @Test
+    void backupsToChosenFoldersThatAreMissingFailAndCreateNothing() throws Exception {
+        Path mountPoint = Files.createDirectories(root.resolve("usb"));
+        engine = start(withFolders(Optional.of(mountPoint.resolve("Git")), Optional.of(mountPoint.resolve("Zips"))),
+                SourceCaptureObserver.NONE);
+        TestWorld world = TestWorld.create(engine, "Away");
+
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+
+        assertEquals(BackupStatus.FAILED, result.status(), result.destinations().toString());
+        for (DestinationType type : DestinationType.values()) {
+            String reason = destination(result, type).message().orElseThrow();
+            assertTrue(reason.contains("cannot be reached"), reason);
+        }
+        try (Stream<Path> created = Files.list(mountPoint)) {
+            assertEquals(List.of(), created.toList());
+        }
+    }
+
+    @Test
+    void cancellingDuringCaptureLeavesNoBackupBehind() throws Exception {
+        CountDownLatch copying = new CountDownLatch(1);
+        CountDownLatch never = new CountDownLatch(1);
+        AtomicInteger copies = new AtomicInteger();
+        SourceCaptureObserver blockOnSecondFile = new SourceCaptureObserver() {
+            @Override
+            public void beforeFileCopy(Path relativePath) throws InterruptedException {
+                if (copies.incrementAndGet() == 2) {
+                    copying.countDown();
+                    never.await();
+                }
+            }
+        };
+        engine = start(Engine.defaultConfig(), blockOnSecondFile);
+        TestWorld world = TestWorld.create(engine, "Cancelled");
+
+        CompletableFuture<BackupResult> backup = engine.backup(
+                world, BackupTrigger.MANUAL, Optional.empty()).toCompletableFuture();
+        assertTrue(copying.await(Engine.TIMEOUT.toSeconds(), TimeUnit.SECONDS));
+        assertTrue(backup.cancel(true));
+
+        awaitIdle(world);
+        assertThrows(CancellationException.class, backup::join);
+        assertTrue(engine.records(world.id()).isEmpty());
+        assertNoWorldCopies(engine.storage);
+    }
+
+    @Test
+    void aWorldThatChangesDuringCaptureIsCapturedConsistently() throws Exception {
+        AtomicBoolean changed = new AtomicBoolean();
+        TestWorld[] target = new TestWorld[1];
+        SourceCaptureObserver writeBehindTheCopy = new SourceCaptureObserver() {
+            @Override
+            public void afterFileCopy(Path relativePath) throws IOException {
+                if (relativePath.toString().equals("empty.txt") && changed.compareAndSet(false, true)) {
+                    target[0].write("empty.txt", bytes(512, 11));
+                }
+            }
+        };
+        engine = start(Engine.defaultConfig(), writeBehindTheCopy);
+        target[0] = TestWorld.create(engine, "Busy");
+
+        BackupResult result = engine.backupNow(target[0], BackupTrigger.MANUAL);
+
+        assertTrue(changed.get());
+        assertEquals(BackupStatus.SUCCESS, result.status());
+        assertSameFiles(target[0].files(), await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(result.backupId(), engine.saves, "Busy restored"),
+                ProgressListener.NO_OP)).restoredWorldDirectory());
+    }
+
+    @Test
+    void aSaveThatReplacesLevelDatDuringTheCaptureIsRetriedAndCaptured() throws Exception {
+        TestWorld[] target = new TestWorld[1];
+        AtomicBoolean saved = new AtomicBoolean();
+        SourceCaptureObserver saveDuringCapture = new SourceCaptureObserver() {
+            @Override
+            public void beforeFileCopy(Path relativePath) throws IOException {
+                // The game writes level.dat_new, then moves it over level.dat; the listed temporary file vanishes.
+                if (relativePath.toString().equals("level.dat_new") && saved.compareAndSet(false, true)) {
+                    Files.move(
+                            target[0].path().resolve("level.dat_new"),
+                            target[0].path().resolve("level.dat"),
+                            java.nio.file.StandardCopyOption.REPLACE_EXISTING);
+                }
+            }
+        };
+        engine = start(Engine.defaultConfig(), saveDuringCapture);
+        target[0] = TestWorld.create(engine, "Saving");
+        target[0].write("level.dat_new", bytes(4_096, 21));
+        Map<String, byte[]> expected = new java.util.TreeMap<>(target[0].files());
+        expected.put("level.dat", expected.remove("level.dat_new"));
+
+        BackupResult result = engine.backupNow(target[0], BackupTrigger.MANUAL);
+
+        assertTrue(saved.get());
+        assertEquals(BackupStatus.SUCCESS, result.status(), result.destinations().toString());
+        assertSameFiles(expected, await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(result.backupId(), engine.saves, "Saving restored"),
+                ProgressListener.NO_OP)).restoredWorldDirectory());
+    }
+
+    @Test
+    void aBackupThatCannotBeListedSaysSoAndIsListedAfterTheRestartRebuild() throws Exception {
+        engine = start(Engine.defaultConfig(), SourceCaptureObserver.NONE);
+        TestWorld world = TestWorld.create(engine, "Unlisted");
+        Map<String, byte[]> backedUp = world.files();
+        Files.createDirectories(engine.catalogFile());
+
+        ExecutionException failure = assertThrows(
+                ExecutionException.class, () -> engine.backupNow(world, BackupTrigger.MANUAL));
+        Files.delete(engine.catalogFile());
+        await(engine.imports.rebuildLocal());
+
+        assertTrue(failure.getCause().getMessage().contains("could not add it to its backup list"),
+                failure.getCause().getMessage());
+        assertEquals(1, engine.records(world.id()).size());
+        assertSameFiles(backedUp, await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(engine.records(world.id()).getFirst().manifest().backupId(),
+                        engine.saves, "Unlisted restored"),
+                ProgressListener.NO_OP)).restoredWorldDirectory());
+    }
+
+    @Test
+    void aDamagedZipFailsVerificationAndIsNeverRestored() throws Exception {
+        engine = start(Engine.onlyDestination(DestinationType.ZIP), SourceCaptureObserver.NONE);
+        TestWorld world = TestWorld.create(engine, "Damaged");
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+        Path archive = onlyFile(engine.zipFolder(world.id()), ".zip");
+        try (RandomAccessFile file = new RandomAccessFile(archive.toFile(), "rw")) {
+            long middle = file.length() / 2;
+            file.seek(middle);
+            int value = file.read();
+            file.seek(middle);
+            file.write(value ^ 0xFF);
+        }
+
+        BackupResult verified = await(engine.recovery.verifyBackup(result.backupId(), ProgressListener.NO_OP));
+        ExecutionException restore = assertThrows(ExecutionException.class, () -> await(
+                engine.recovery.restoreBackup(
+                        new RestoreBackupRequest(result.backupId(), engine.saves, "Damaged restored"),
+                        ProgressListener.NO_OP)));
+
+        assertEquals(VerificationStatus.FAILED, destination(verified, DestinationType.ZIP).verificationStatus());
+        assertInstanceOf(RuntimeException.class, restore.getCause());
+        try (Stream<Path> saves = Files.list(engine.saves)) {
+            assertEquals(List.of(world.path()), saves.toList());
+        }
+    }
+
+    @Test
+    void filesLeftByACrashAreNotListedAndDoNotBlockTheNextBackup() throws Exception {
+        engine = start(Engine.onlyDestination(DestinationType.ZIP), SourceCaptureObserver.NONE);
+        TestWorld world = TestWorld.create(engine, "Crashed");
+        engine.backupNow(world, BackupTrigger.MANUAL);
+        Path archive = onlyFile(engine.zipFolder(world.id()), ".zip");
+        Path folder = archive.getParent();
+        byte[] complete = Files.readAllBytes(archive);
+        Files.write(folder.resolve("half-written.zip.partial"), Arrays.copyOf(complete, complete.length / 2));
+        Files.createDirectories(engine.storage.resolve("capture-temp").resolve("stale-capture"));
+        engine.close();
+        Files.delete(engine.storage.resolve("catalog.json"));
+        engine = start(Engine.onlyDestination(DestinationType.ZIP), SourceCaptureObserver.NONE);
+
+        engine.clock.advance(Duration.ofMinutes(1));
+        world.write("level.dat", bytes(4_096, 12));
+        BackupResult next = engine.backupNow(world, BackupTrigger.MANUAL);
+        await(engine.imports.rebuildLocal());
+
+        assertEquals(BackupStatus.SUCCESS, next.status());
+        assertEquals(2, engine.records(world.id()).size());
+    }
+
+    @Test
+    void cancellingDuringAStalledPushKeepsTheCopiesThatFinished() throws Exception {
+        Path remote = root.resolve("stalled.git");
+        Files.createDirectories(remote);
+        new ProcessBuilder("git", "init", "--bare", "--quiet", remote.toString()).start().waitFor();
+        Path pushing = root.resolve("push-started");
+        Path hook = remote.resolve("hooks").resolve("pre-receive");
+        Files.writeString(hook, "#!/bin/sh\ntouch '" + pushing + "'\nsleep 60\n");
+        hook.toFile().setExecutable(true);
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Stalled");
+        engine = start(Engine.defaultConfig(Engine.world(
+                world.id(), world.path(), Optional.of(remote.toString()),
+                dev.ishaanko.worldarchive.config.StoragePolicy.defaults())), SourceCaptureObserver.NONE);
+
+        CompletableFuture<BackupResult> backup = engine.backup(
+                world, BackupTrigger.MANUAL, Optional.empty()).toCompletableFuture();
+        long deadline = System.nanoTime() + Engine.TIMEOUT.toNanos();
+        while (!Files.exists(pushing) && System.nanoTime() < deadline) {
+            Thread.sleep(20);
+        }
+        assertTrue(Files.exists(pushing), "the push never reached the remote");
+        assertTrue(backup.cancel(true));
+        awaitIdle(world);
+
+        List<dev.ishaanko.worldarchive.model.BackupRecord> records = engine.records(world.id());
+        assertEquals(1, records.size());
+        assertEquals(DestinationStatus.SUCCESS, destination(records.getFirst().result(), DestinationType.ZIP).status());
+        assertEquals(
+                DestinationStatus.PENDING_SYNC,
+                destination(records.getFirst().result(), DestinationType.GIT).status());
+    }
+
+    @Test
+    void aStaleLooseObjectInTheRepositoryDoesNotBlockTheNextBackup() throws Exception {
+        engine = start(Engine.onlyDestination(DestinationType.GIT), SourceCaptureObserver.NONE);
+        TestWorld world = TestWorld.create(engine, "PowerLoss");
+        engine.backupNow(world, BackupTrigger.MANUAL);
+        Path objects;
+        try (Stream<Path> found = Files.walk(engine.storage)) {
+            objects = found.filter(path -> path.getFileName().toString().equals("objects")
+                            && Files.exists(path.resolveSibling("HEAD")))
+                    .findFirst()
+                    .orElseThrow();
+        }
+        Path emptyObject = objects.resolve("ab").resolve("cdef0123456789abcdef0123456789abcdef01");
+        Files.createDirectories(emptyObject.getParent());
+        Files.write(emptyObject, new byte[0]);
+        engine.clock.advance(Duration.ofMinutes(1));
+        world.write("level.dat", bytes(4_096, 13));
+
+        BackupResult next = engine.backupNow(world, BackupTrigger.MANUAL);
+
+        assertEquals(BackupStatus.SUCCESS, next.status(), next.destinations().toString());
+    }
+
+    @Test
+    void aNestedGitRepositoryInAWorldDoesNotBreakBackups() throws Exception {
+        engine = start(Engine.defaultConfig(), SourceCaptureObserver.NONE);
+        TestWorld world = TestWorld.create(engine, "Datapack Dev");
+        world.write("datapacks/mypack/pack.mcmeta", "{\"pack\":{}}".getBytes(java.nio.charset.StandardCharsets.UTF_8));
+        world.write("datapacks/mypack/.git/HEAD", "ref: refs/heads/main\n".getBytes(java.nio.charset.StandardCharsets.UTF_8));
+        Map<String, byte[]> expected = new java.util.TreeMap<>(world.files());
+        expected.remove("datapacks/mypack/.git/HEAD");
+
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+
+        assertEquals(BackupStatus.SUCCESS, result.status(), result.destinations().toString());
+        assertSameFiles(expected, await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(result.backupId(), engine.saves, "Datapack Dev restored"),
+                ProgressListener.NO_OP)).restoredWorldDirectory());
+    }
+
+    @Test
+    void partialFilesLeftByACrashAreSweptByTheNextBackup() throws Exception {
+        engine = start(Engine.onlyDestination(DestinationType.ZIP), SourceCaptureObserver.NONE);
+        TestWorld world = TestWorld.create(engine, "Swept");
+        engine.backupNow(world, BackupTrigger.MANUAL);
+        Path folder = onlyFile(engine.zipFolder(world.id()), ".zip").getParent();
+        Path leftover = folder.resolve("2026-09-01_11-00-00Z - Swept - Manual - "
+                + dev.ishaanko.worldarchive.model.BackupId.create() + ".zip.partial");
+        Files.write(leftover, bytes(1_024, 14));
+        engine.clock.advance(Duration.ofMinutes(1));
+        world.write("level.dat", bytes(4_096, 15));
+
+        engine.backupNow(world, BackupTrigger.MANUAL);
+
+        assertFalse(Files.exists(leftover));
+    }
+
+    private void awaitIdle(TestWorld world) throws InterruptedException {
+        long deadline = System.nanoTime() + Engine.TIMEOUT.toNanos();
+        while (engine.coordinator.isBusy(world.id())) {
+            if (System.nanoTime() > deadline) {
+                throw new AssertionError("Backup did not stop after cancellation");
+            }
+            Thread.sleep(10);
+        }
+    }
+
+    private Engine start(WorldArchiveConfig config, SourceCaptureObserver observer) {
+        return new Engine(root, new Engine.TestClock(Instant.parse("2026-09-01T12:00:00Z")), config, observer);
+    }
+
+    private static WorldArchiveConfig withFolders(Optional<Path> gitRepository, Optional<Path> zipFolder) {
+        WorldArchiveConfig defaults = Engine.defaultConfig();
+        GitDestinationConfig git = defaults.git();
+        return new WorldArchiveConfig(
+                defaults.triggers(),
+                new GitDestinationConfig(
+                        true,
+                        gitRepository,
+                        git.remoteName(),
+                        DestinationTriggerConfig.defaults(),
+                        git.lfsPatterns()),
+                new ZipDestinationConfig(
+                        true,
+                        zipFolder,
+                        DestinationTriggerConfig.defaults()),
+                List.of());
+    }
+
+    private static DestinationResult destination(BackupResult result, DestinationType type) {
+        return result.destinations().stream()
+                .filter(destination -> destination.destination() == type)
+                .findFirst()
+                .orElseThrow();
+    }
+
+    private static Path onlyFile(Path folder, String suffix) throws IOException {
+        try (Stream<Path> files = Files.walk(folder)) {
+            List<Path> matches = files.filter(file -> file.toString().endsWith(suffix)).toList();
+            assertEquals(1, matches.size(), matches.toString());
+            return matches.getFirst();
+        }
+    }
+
+    /** No private world copy (staging folders, archives, partial files) remains under the folder. */
+    private static void assertNoWorldCopies(Path folder) throws IOException {
+        if (!Files.exists(folder)) {
+            return;
+        }
+        try (Stream<Path> files = Files.walk(folder)) {
+            List<Path> copies = files
+                    .filter(file -> {
+                        String name = file.getFileName().toString();
+                        return name.equals("level.dat") || name.endsWith(".mca") || name.contains(".zip");
+                    })
+                    .toList();
+            assertFalse(copies.stream().findAny().isPresent(), copies.toString());
+        }
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/e2e/GitStorageEndToEndTest.java b/src/test/java/dev/ishaanko/worldarchive/e2e/GitStorageEndToEndTest.java
new file mode 100644
index 0000000..9013837
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/e2e/GitStorageEndToEndTest.java
@@ -0,0 +1,515 @@
+package dev.ishaanko.worldarchive.e2e;
+
+import static dev.ishaanko.worldarchive.e2e.Engine.await;
+import static dev.ishaanko.worldarchive.e2e.TestWorld.assertSameFiles;
+import static dev.ishaanko.worldarchive.e2e.TestWorld.bytes;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.config.StoragePolicy;
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.core.DeleteBackupRequest;
+import dev.ishaanko.worldarchive.core.RestoreBackupRequest;
+import dev.ishaanko.worldarchive.core.SourceCaptureObserver;
+import dev.ishaanko.worldarchive.importing.ImportDisposition;
+import dev.ishaanko.worldarchive.importing.ImportPreview;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.BackupStatus;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.DestinationStatus;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.SyncStatus;
+import dev.ishaanko.worldarchive.model.VerificationStatus;
+import dev.ishaanko.worldarchive.storage.git.GitSnapshot;
+import dev.ishaanko.worldarchive.support.Digests;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.nio.file.attribute.FileTime;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.TimeUnit;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+/** Git storage through the real engine: odd world content, deletes, broken remotes, repairs and imports. */
+class GitStorageEndToEndTest {
+    private static final String NO_COMMIT = "0000000000000000000000000000000000000000";
+
+    @TempDir
+    Path root;
+
+    private Engine engine;
+
+    @AfterEach
+    void closeEngine() throws Exception {
+        if (engine != null) {
+            engine.close();
+        }
+    }
+
+    @Test
+    void aWorldWithTrickyFilesRestoresByteForByte() throws Exception {
+        engine = start(root, Engine.onlyDestination(DestinationType.GIT));
+        TestWorld world = TestWorld.create(engine, "Tricky");
+        world.write(".gitignore", "*.dat\nregion/\n*.txt\n".getBytes(StandardCharsets.UTF_8));
+        world.write(".gitattributes", "*.txt ident eol=crlf\n*.json filter=lfs\n* text\n".getBytes(StandardCharsets.UTF_8));
+        world.write("notes.txt", "$Id: kept exactly$\nline one\nline two\n".getBytes(StandardCharsets.UTF_8));
+        world.write("data/large.json", bytes(5 * 1_024 * 1_024, 51));
+        world.write("nested/session.lock", "a nested lock is world data".getBytes(StandardCharsets.UTF_8));
+        world.write("names/Cafe\u0301.txt", "a decomposed name".getBytes(StandardCharsets.UTF_8));
+        world.write("names/pointer-like.txt",
+                "version https://git-lfs.github.com/spec/v1 is only text here\n".getBytes(StandardCharsets.UTF_8));
+        Map<String, byte[]> files = world.files();
+
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+
+        assertEquals(BackupStatus.SUCCESS, result.status(), result.destinations().toString());
+        assertSameFiles(files, restore(result.backupId(), "Tricky restored"));
+        assertSameFiles(files, world.path());
+    }
+
+    /**
+     * A file outside the LFS patterns can hold the text of an LFS pointer, as in a datapack cloned
+     * without Git LFS. Such files back up and restore byte for byte, as does one under a pattern.
+     */
+    @Test
+    void filesThatHoldLfsPointerTextBackUpAndRestore() throws Exception {
+        engine = start(root, Engine.onlyDestination(DestinationType.GIT));
+        TestWorld world = TestWorld.create(engine, "Pointers");
+        String pointer = "version https://git-lfs.github.com/spec/v1\n"
+                + "oid sha256:4d7a214614ab2935c943f9e0ff69d22eadbb8f32b1258daaa5e2ca24d17e2393\n"
+                + "size 12345\n";
+        world.write("datapacks/pack/pack.png", pointer.getBytes(StandardCharsets.UTF_8));
+        world.write("datapacks/pack/README.md",
+                pointer.replace("oid", "ext-0-foo sha256:ffff\noid").getBytes(StandardCharsets.UTF_8));
+        world.write("data/pointer-like.dat", pointer.getBytes(StandardCharsets.UTF_8));
+        Map<String, byte[]> files = world.files();
+
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+
+        assertEquals(BackupStatus.SUCCESS, result.status(), result.destinations().toString());
+        assertSameFiles(files, restore(result.backupId(), "Pointers restored"));
+    }
+
+    @Test
+    void deletedBackupsLeaveTheRemoteAndThisComputerAndStayGoneAfterARestart() throws Exception {
+        Path remote = bareRepository("remote.git");
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Pruned");
+        WorldArchiveConfig config = gitOnly(world, remote);
+        engine = start(root, config);
+        List<BackupId> backups = backupOnThreeMinutes(world);
+        assertTrue(await(engine.git.deleteLocalSnapshot(world.id(), backups.get(0))), "cleanup kept only the remote copy");
+
+        List<BackupResult> deleted = await(engine.recovery.deleteBackups(
+                List.of(request(backups.get(0)), request(backups.get(1))), ProgressListener.NO_OP));
+
+        assertTrue(deleted.stream().allMatch(result -> result.status() == BackupStatus.SUCCESS), deleted.toString());
+        assertEquals(List.of(branch(remote, backups.get(2))), branches(remote));
+        assertEquals(commit(backups.get(2), world), git(remote, "rev-parse", "refs/heads/main").strip());
+        assertEquals(4, lfsObjects(world), "only the kept backup's LFS objects remain");
+        engine.close();
+        engine = start(root, config);
+        await(engine.imports.rebuildLocal());
+        assertEquals(List.of(backups.get(2)), engine.records(world.id()).stream()
+                .map(record -> record.manifest().backupId())
+                .toList());
+    }
+
+    @Test
+    void locksLeftByAStoppedGitDoNotBlockTheNextBackupOrDelete() throws Exception {
+        Path remote = bareRepository("locked.git");
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Locked");
+        WorldArchiveConfig config = gitOnly(world, remote);
+        engine = start(root, config);
+        BackupId first = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        engine.close();
+        Path repository = engine.git.repositoryFor(world.id());
+        List<Path> locks = List.of(
+                repository.resolve("config.lock"),
+                repository.resolve("packed-refs.lock"),
+                repository.resolve(GitSnapshot.refName(world.id(), first) + ".lock"));
+        for (Path lock : locks) {
+            Files.write(lock, new byte[0]);
+            Files.setLastModifiedTime(lock, FileTime.from(Instant.now().minus(Duration.ofMinutes(10))));
+        }
+        engine = start(root, config);
+        engine.clock.advance(Duration.ofMinutes(1));
+        world.write("level.dat", bytes(4_096, 71));
+
+        BackupResult next = engine.backupNow(world, BackupTrigger.MANUAL);
+        BackupResult deleted = delete(first);
+
+        assertEquals(SyncStatus.SYNCED, destination(next).syncStatus(), next.destinations().toString());
+        assertEquals(BackupStatus.SUCCESS, deleted.status(), deleted.destinations().toString());
+        assertTrue(locks.stream().noneMatch(Files::exists));
+    }
+
+    @Test
+    void anEmptyRepositoryFolderMadeBeforeTheFirstBackupIsSetUpByIt() throws Exception {
+        engine = start(root, Engine.onlyDestination(DestinationType.GIT));
+        TestWorld world = TestWorld.create(engine, "Opened");
+        Map<String, byte[]> files = world.files();
+        // WorldArchive 0.3.9 made this folder when the player opened the backup folder first.
+        Files.createDirectories(engine.git.repositoryFor(world.id()));
+
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+
+        assertEquals(BackupStatus.SUCCESS, result.status(), result.destinations().toString());
+        assertSameFiles(files, restore(result.backupId(), "Opened restored"));
+    }
+
+    /** A sync tool removed the empty refs folder after Git packed the refs: the next backup keeps every snapshot. */
+    @Test
+    void aRepositoryWhoseRefsFolderWasRemovedKeepsItsSnapshots() throws Exception {
+        engine = start(root, Engine.onlyDestination(DestinationType.GIT));
+        TestWorld world = TestWorld.create(engine, "Packed");
+        Map<String, byte[]> files = world.files();
+        BackupId first = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        Path repository = engine.git.repositoryFor(world.id());
+        git(repository, "pack-refs", "--all");
+        deleteTree(repository.resolve("refs"));
+        engine.clock.advance(Duration.ofMinutes(1));
+        world.write("level.dat", bytes(4_096, 9));
+
+        BackupResult second = engine.backupNow(world, BackupTrigger.MANUAL);
+
+        assertEquals(BackupStatus.SUCCESS, second.status(), second.destinations().toString());
+        assertEquals(2, await(engine.git.listSnapshots(Optional.of(world.id()))).size());
+        assertSameFiles(files, restore(first, "Packed first"));
+    }
+
+    @Test
+    void aProtectedMainNeverFailsAnUploadAndOnlyBlocksDeletingTheBackupItShows() throws Exception {
+        Path remote = bareRepository("protected.git");
+        Path hook = remote.resolve("hooks").resolve("pre-receive");
+        Files.writeString(hook, """
+                #!/bin/sh
+                while read old new ref; do
+                  if [ "$ref" = "refs/heads/main" ] && [ "$old" != "%s" ]; then
+                    echo "main is protected" >&2
+                    exit 1
+                  fi
+                done
+                """.formatted(NO_COMMIT));
+        assertTrue(hook.toFile().setExecutable(true));
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Protected");
+        engine = start(root, gitOnly(world, remote));
+        BackupId shown = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        engine.clock.advance(Duration.ofMinutes(1));
+        world.write("level.dat", bytes(4_096, 72));
+
+        BackupResult newer = engine.backupNow(world, BackupTrigger.MANUAL);
+        String before = git(remote, "for-each-ref", "--format=%(refname) %(objectname)");
+        BackupResult refused = delete(shown);
+        String afterRefusal = git(remote, "for-each-ref", "--format=%(refname) %(objectname)");
+        BackupResult allowed = delete(newer.backupId());
+
+        assertEquals(SyncStatus.SYNCED, destination(newer).syncStatus(), newer.destinations().toString());
+        assertEquals(commit(shown, world), git(remote, "rev-parse", "refs/heads/main").strip());
+        assertEquals(DestinationStatus.FAILED, destination(refused).status());
+        assertEquals(before, afterRefusal);
+        assertEquals(BackupStatus.SUCCESS, allowed.status(), allowed.destinations().toString());
+        assertEquals(List.of(branch(remote, shown)), branches(remote));
+    }
+
+    @Test
+    void deletingWhileTheRemoteIsUnreachableRemovesNothingAndWorksLater() throws Exception {
+        Path remote = bareRepository("travelling.git");
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Offline");
+        engine = start(root, gitOnly(world, remote));
+        BackupId backupId = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        Path away = Files.move(remote, root.resolve("unplugged.git"));
+
+        BackupResult refused = delete(backupId);
+
+        assertEquals(DestinationStatus.FAILED, destination(refused).status());
+        assertTrue(destination(refused).message().orElseThrow().contains("could not be reached"),
+                destination(refused).message().orElseThrow());
+        assertEquals(1, engine.records(world.id()).size());
+        assertEquals(1, await(engine.git.listSnapshots(Optional.of(world.id()))).size());
+        Files.move(away, remote);
+        assertEquals(BackupStatus.SUCCESS, delete(backupId).status());
+        assertTrue(branches(remote).isEmpty());
+    }
+
+    @Test
+    void aLostLfsObjectOrRepositoryIsRestoredFromTheRemoteAndRepairedHere() throws Exception {
+        Path remote = bareRepository("rescue.git");
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Rescued");
+        engine = start(root, gitOnly(world, remote));
+        Map<String, byte[]> files = world.files();
+        BackupId backupId = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        Path repository = engine.git.repositoryFor(world.id());
+        Path region = lfsObject(repository, files.get("region/r.0.0.mca"));
+        Files.delete(region);
+
+        assertSameFiles(files, restore(backupId, "Rescued once"));
+        BackupResult verified = await(engine.recovery.verifyBackup(backupId, ProgressListener.NO_OP));
+        assertEquals(VerificationStatus.VERIFIED, destination(verified).verificationStatus());
+        assertTrue(Files.isRegularFile(region), "the object is back on this computer");
+
+        deleteTree(repository);
+        assertSameFiles(files, restore(backupId, "Rescued twice"));
+        assertEquals(1, await(engine.git.listSnapshots(Optional.of(world.id()))).size());
+    }
+
+    /**
+     * An LFS object rotted in place: same size, other bytes. Verify finds it and sets it aside, so
+     * the next backup of the unchanged file writes the object again from the capture.
+     */
+    @Test
+    void aBackupAfterVerifyFoundADamagedLfsObjectStoresTheFileIntactAgain() throws Exception {
+        engine = start(root, Engine.onlyDestination(DestinationType.GIT));
+        TestWorld world = TestWorld.create(engine, "Rot");
+        BackupId first = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        rot(lfsObject(engine.git.repositoryFor(world.id()), world.files().get("region/r.0.0.mca")));
+        assertEquals(VerificationStatus.FAILED, destination(await(engine.recovery.verifyBackup(
+                first, ProgressListener.NO_OP))).verificationStatus());
+        engine.clock.advance(Duration.ofMinutes(5));
+        world.write("level.dat", bytes(4_096, 77));
+
+        BackupResult second = engine.backupNow(world, BackupTrigger.MANUAL);
+
+        assertEquals(BackupStatus.SUCCESS, second.status(), second.destinations().toString());
+        BackupResult verified = await(engine.recovery.verifyBackup(second.backupId(), ProgressListener.NO_OP));
+        assertEquals(VerificationStatus.VERIFIED, destination(verified).verificationStatus(), verified.toString());
+    }
+
+    /** With a remote, an LFS object that rotted in place is downloaded again, and the restore goes on. */
+    @Test
+    void aRestoreWithARemoteReplacesAnLfsObjectThatRottedInPlace() throws Exception {
+        Path remote = bareRepository("rot.git");
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Rot");
+        engine = start(root, gitOnly(world, remote));
+        Map<String, byte[]> files = world.files();
+        BackupResult backup = engine.backupNow(world, BackupTrigger.MANUAL);
+        assertEquals(SyncStatus.SYNCED, destination(backup).syncStatus(), backup.toString());
+        Path object = lfsObject(engine.git.repositoryFor(world.id()), files.get("region/r.0.0.mca"));
+        rot(object);
+
+        assertSameFiles(files, restore(backup.backupId(), "Rot restored"));
+        assertArrayEquals(files.get("region/r.0.0.mca"), Files.readAllBytes(object), "the object is repaired here");
+    }
+
+    @Test
+    void aDamagedGitCopyWithoutARemoteIsNeverRestored() throws Exception {
+        engine = start(root, Engine.onlyDestination(DestinationType.GIT));
+        TestWorld world = TestWorld.create(engine, "Damaged");
+        BackupId backupId = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        Files.delete(lfsObject(engine.git.repositoryFor(world.id()), world.files().get("region/r.0.0.mca")));
+
+        assertThrows(ExecutionException.class, () -> restore(backupId, "Damaged restored"));
+
+        try (Stream<Path> saves = Files.list(engine.saves)) {
+            assertEquals(List.of(world.path()), saves.toList());
+        }
+    }
+
+    @Test
+    void hooksInsideTheRepositoryNeverRun() throws Exception {
+        Path remote = bareRepository("hooked.git");
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Hooked");
+        engine = start(root, gitOnly(world, remote));
+        BackupId first = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        Path marker = root.resolve("a hook ran");
+        for (String name : List.of("pre-push", "reference-transaction", "post-checkout", "pre-auto-gc")) {
+            Path hook = engine.git.repositoryFor(world.id()).resolve("hooks").resolve(name);
+            Files.createDirectories(hook.getParent());
+            Files.writeString(hook, "#!/bin/sh\ntouch '" + marker + "'\nexit 1\n");
+            assertTrue(hook.toFile().setExecutable(true));
+        }
+        engine.clock.advance(Duration.ofMinutes(1));
+        world.write("level.dat", bytes(4_096, 73));
+
+        BackupResult second = engine.backupNow(world, BackupTrigger.MANUAL);
+        BackupResult deleted = delete(first);
+
+        assertEquals(SyncStatus.SYNCED, destination(second).syncStatus(), second.destinations().toString());
+        assertEquals(BackupStatus.SUCCESS, deleted.status(), deleted.destinations().toString());
+        assertFalse(Files.exists(marker));
+    }
+
+    @Test
+    void aGameFolderReachedThroughALinkBacksUpAndRestores() throws Exception {
+        Assumptions.assumeFalse(System.getProperty("os.name").startsWith("Windows"), "links need extra rights on Windows");
+        Path linked = Files.createSymbolicLink(root.resolve("linked-game"), Files.createDirectories(root.resolve("real-game")));
+        engine = start(linked, Engine.onlyDestination(DestinationType.GIT));
+        TestWorld world = TestWorld.create(engine, "Linked");
+        Map<String, byte[]> files = world.files();
+
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+
+        assertEquals(BackupStatus.SUCCESS, result.status(), result.destinations().toString());
+        assertSameFiles(files, restore(result.backupId(), "Linked restored"));
+    }
+
+    @Test
+    void anImportSkipsBackupsWhoseIdentityTwoCommitsClaimAndKeepsTheRest() throws Exception {
+        Path remote = bareRepository("shared.git");
+        Path laptop = root.resolve("laptop");
+        TestWorld world = TestWorld.create(laptop.resolve("saves"), "Shared");
+        engine = start(laptop, gitOnly(world, remote));
+        List<BackupId> backups = backupOnThreeMinutes(world);
+        engine.close();
+        String claimed = git(remote, "rev-parse", branch(remote, backups.get(0))).strip();
+        String rival = commitTree(remote, claimed);
+        git(remote, "update-ref", "refs/heads/backups/rival/" + backups.get(0), rival);
+
+        engine = start(root.resolve("desktop"), Engine.onlyDestination(DestinationType.GIT));
+        ImportPreview preview = await(engine.imports.previewGit(remote.toString()));
+        engine.importAll(preview);
+
+        assertNotEquals(claimed, rival);
+        assertEquals(List.of(ImportDisposition.ADD, ImportDisposition.ADD), preview.items().stream()
+                .map(item -> item.disposition()).toList());
+        assertTrue(preview.issues().stream().anyMatch(issue -> issue.contains(backups.get(0).toString())), preview.issues().toString());
+        assertTrue(engine.catalog.find(backups.get(0)).isEmpty());
+        assertTrue(engine.catalog.find(backups.get(1)).isPresent());
+        assertTrue(engine.catalog.find(backups.get(2)).isPresent());
+    }
+
+    private List<BackupId> backupOnThreeMinutes(TestWorld world) throws Exception {
+        List<BackupId> backups = new ArrayList<>();
+        for (int minute = 0; minute < 3; minute++) {
+            if (minute > 0) {
+                engine.clock.advance(Duration.ofMinutes(1));
+                world.write("level.dat", bytes(4_096, 60 + minute));
+            }
+            BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+            assertEquals(SyncStatus.SYNCED, destination(result).syncStatus(), result.destinations().toString());
+            backups.add(result.backupId());
+        }
+        return backups;
+    }
+
+    private static WorldArchiveConfig gitOnly(TestWorld world, Path remote) {
+        return Engine.onlyDestination(DestinationType.GIT,
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), StoragePolicy.defaults()));
+    }
+
+    private static Engine start(Path home, WorldArchiveConfig config) {
+        return new Engine(home, new Engine.TestClock(Instant.parse("2026-09-01T12:00:00Z")), config, SourceCaptureObserver.NONE);
+    }
+
+    private Path restore(BackupId backupId, String name) throws Exception {
+        return await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(backupId, engine.saves, name), ProgressListener.NO_OP)).restoredWorldDirectory();
+    }
+
+    private BackupResult delete(BackupId backupId) throws Exception {
+        return engine.delete(backupId, ProgressListener.NO_OP);
+    }
+
+    private DeleteBackupRequest request(BackupId backupId) throws Exception {
+        return engine.confirmedDelete(backupId);
+    }
+
+    private static DestinationResult destination(BackupResult result) {
+        return result.destinations().stream()
+                .filter(destination -> destination.destination() == DestinationType.GIT)
+                .findFirst()
+                .orElseThrow();
+    }
+
+    private String commit(BackupId backupId, TestWorld world) throws Exception {
+        return git(engine.git.repositoryFor(world.id()), "rev-parse", GitSnapshot.refName(world.id(), backupId)).strip();
+    }
+
+    private long lfsObjects(TestWorld world) throws IOException {
+        try (Stream<Path> files = Files.walk(engine.git.repositoryFor(world.id()).resolve("lfs").resolve("objects"))) {
+            return files.filter(Files::isRegularFile).count();
+        }
+    }
+
+    private static Path lfsObject(Path repository, byte[] contents) {
+        String sha256 = Digests.hex(Digests.sha256().digest(contents));
+        return repository.resolve("lfs").resolve("objects")
+                .resolve(sha256.substring(0, 2)).resolve(sha256.substring(2, 4)).resolve(sha256);
+    }
+
+    /**
+     * Flips one byte in the middle of the object, which keeps its size, as when a disk sector goes
+     * bad. The bytes go to a new file that replaces the object: Git LFS hard-links objects into a
+     * remote on the same drive, and a remote elsewhere keeps its own intact copy.
+     */
+    private static void rot(Path object) throws IOException {
+        byte[] rotten = Files.readAllBytes(object);
+        rotten[rotten.length / 2] ^= 0x40;
+        Path replacement = Files.write(object.resolveSibling("rotten"), rotten);
+        Files.move(replacement, object, StandardCopyOption.REPLACE_EXISTING);
+    }
+
+    /** The same snapshot committed by someone else: same tree, message and time, another commit. */
+    private static String commitTree(Path repository, String commit) throws Exception {
+        String tree = git(repository, "rev-parse", commit + "^{tree}").strip();
+        String time = "@" + git(repository, "log", "-1", "--format=%ct", commit).strip() + " +0000";
+        ProcessBuilder builder = new ProcessBuilder("git", "--git-dir", repository.toString(), "commit-tree", tree)
+                .redirectErrorStream(true);
+        builder.environment().putAll(Map.of(
+                "GIT_AUTHOR_NAME", "Someone Else", "GIT_AUTHOR_EMAIL", "someone@example.invalid",
+                "GIT_COMMITTER_NAME", "Someone Else", "GIT_COMMITTER_EMAIL", "someone@example.invalid",
+                "GIT_AUTHOR_DATE", time, "GIT_COMMITTER_DATE", time));
+        Process process = builder.start();
+        try (var input = process.getOutputStream()) {
+            input.write(git(repository, "log", "-1", "--format=%B", commit).getBytes(StandardCharsets.UTF_8));
+        }
+        String output = new String(process.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
+        assertTrue(process.waitFor(30, TimeUnit.SECONDS));
+        assertEquals(0, process.exitValue(), output);
+        return output.strip();
+    }
+
+    private static String branch(Path remote, BackupId backupId) throws Exception {
+        return branches(remote).stream().filter(ref -> ref.endsWith(backupId.toString())).findFirst().orElseThrow();
+    }
+
+    private static List<String> branches(Path remote) throws Exception {
+        return git(remote, "for-each-ref", "--format=%(refname)", "refs/heads/backups/").lines()
+                .filter(line -> !line.isBlank())
+                .toList();
+    }
+
+    private Path bareRepository(String name) throws Exception {
+        Path repository = Files.createDirectories(root.resolve(name));
+        git(repository, "init", "--bare", "--quiet");
+        return repository;
+    }
+
+    private static String git(Path repository, String... arguments) throws Exception {
+        List<String> command = new ArrayList<>(List.of("git", "--git-dir", repository.toString()));
+        command.addAll(List.of(arguments));
+        Process process = new ProcessBuilder(command).redirectErrorStream(true).start();
+        String output = new String(process.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
+        if (!process.waitFor(30, TimeUnit.SECONDS) || process.exitValue() != 0) {
+            throw new IllegalStateException("git " + String.join(" ", arguments) + " failed: " + output);
+        }
+        return output;
+    }
+
+    private static void deleteTree(Path folder) throws IOException {
+        try (Stream<Path> paths = Files.walk(folder)) {
+            for (Path path : paths.sorted(Comparator.reverseOrder()).toList()) {
+                Files.delete(path);
+            }
+        }
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/e2e/ImportEndToEndTest.java b/src/test/java/dev/ishaanko/worldarchive/e2e/ImportEndToEndTest.java
new file mode 100644
index 0000000..e071f29
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/e2e/ImportEndToEndTest.java
@@ -0,0 +1,162 @@
+package dev.ishaanko.worldarchive.e2e;
+
+import static dev.ishaanko.worldarchive.e2e.Engine.await;
+import static dev.ishaanko.worldarchive.e2e.TestWorld.assertSameFiles;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.config.StoragePolicy;
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.core.RestoreBackupRequest;
+import dev.ishaanko.worldarchive.core.SourceCaptureObserver;
+import dev.ishaanko.worldarchive.importing.ImportDisposition;
+import dev.ishaanko.worldarchive.importing.ImportPreview;
+import dev.ishaanko.worldarchive.importing.ImportSummary;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupRecord;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.BackupStatus;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class ImportEndToEndTest {
+    @TempDir
+    Path root;
+
+    private Engine engine;
+
+    @AfterEach
+    void closeEngine() throws Exception {
+        if (engine != null) {
+            engine.close();
+        }
+    }
+
+    @Test
+    void aLostCatalogIsRebuiltFromTheBackupsOnDisk() throws Exception {
+        Path home = root.resolve("home");
+        engine = start(home, Engine.defaultConfig());
+        TestWorld world = TestWorld.create(engine, "Reinstalled");
+        Map<String, byte[]> backedUp = world.files();
+        BackupId backupId = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        engine.close();
+        Files.delete(engine.storage.resolve("catalog.json"));
+
+        engine = start(home, Engine.defaultConfig());
+        ImportSummary summary = await(engine.imports.rebuildLocal());
+
+        assertEquals(1, summary.added(), summary.message());
+        BackupRecord record = engine.catalog.find(backupId).orElseThrow();
+        assertEquals(
+                Set.of(DestinationType.GIT, DestinationType.ZIP),
+                Set.copyOf(record.result().destinations().stream().map(result -> result.destination()).toList()));
+        assertSameFiles(backedUp, await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(backupId, engine.saves, "Reinstalled restored"),
+                ProgressListener.NO_OP)).restoredWorldDirectory());
+    }
+
+    @Test
+    void backupsPushedFromAnotherComputerCanBeImportedAndRestored() throws Exception {
+        Path remote = root.resolve("shared.git");
+        Files.createDirectories(remote);
+        new ProcessBuilder("git", "init", "--bare", "--quiet", remote.toString()).start().waitFor();
+        Path laptop = root.resolve("laptop");
+        TestWorld world = TestWorld.create(laptop.resolve("saves"), "Travelling");
+        engine = start(laptop, Engine.defaultConfig(
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), StoragePolicy.defaults())));
+        Map<String, byte[]> backedUp = world.files();
+        BackupId backupId = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        engine.close();
+
+        engine = start(root.resolve("desktop"), Engine.defaultConfig());
+        ImportPreview preview = await(engine.imports.previewGit(remote.toString()));
+        assertEquals(
+                List.of(ImportDisposition.ADD),
+                preview.items().stream().map(item -> item.disposition()).toList(),
+                preview.issues().toString());
+        ImportSummary summary = engine.importAll(preview);
+
+        assertEquals(1, summary.added(), summary.message());
+        assertTrue(engine.catalog.find(backupId).isPresent());
+        assertSameFiles(backedUp, await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(backupId, engine.saves, "Travelling restored"),
+                ProgressListener.NO_OP)).restoredWorldDirectory());
+    }
+
+    @Test
+    void deletingAnImportedBackupAlsoRemovesItFromTheConnectedRemote() throws Exception {
+        Path remote = root.resolve("github.git");
+        Files.createDirectories(remote);
+        new ProcessBuilder("git", "init", "--bare", "--quiet", remote.toString()).start().waitFor();
+        Path laptop = root.resolve("laptop");
+        TestWorld world = TestWorld.create(laptop.resolve("saves"), "Kept");
+        WorldArchiveConfig connected = Engine.defaultConfig(
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), StoragePolicy.defaults()));
+        engine = start(laptop, connected);
+        BackupId backupId = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        engine.close();
+        Files.walk(laptop.resolve("worldarchive"))
+                .sorted(java.util.Comparator.reverseOrder())
+                .forEach(path -> path.toFile().delete());
+
+        engine = start(laptop, connected);
+        ImportPreview preview = await(engine.imports.previewGit(remote.toString()));
+        engine.importAll(preview);
+        BackupResult deleted = engine.delete(backupId, ProgressListener.NO_OP);
+
+        assertEquals(BackupStatus.SUCCESS, deleted.status());
+        String remoteRefs = new String(new ProcessBuilder(
+                "git", "--git-dir", remote.toString(), "for-each-ref", "--format=%(refname)")
+                .start().getInputStream().readAllBytes(), java.nio.charset.StandardCharsets.UTF_8);
+        assertTrue(remoteRefs.lines().noneMatch(ref -> ref.contains(backupId.toString())), remoteRefs);
+    }
+
+    @Test
+    void aRemoteWithManyBranchesStillImports() throws Exception {
+        Path remote = root.resolve("busy.git");
+        Files.createDirectories(remote);
+        new ProcessBuilder("git", "init", "--bare", "--quiet", remote.toString()).start().waitFor();
+        Path laptop = root.resolve("laptop");
+        TestWorld world = TestWorld.create(laptop.resolve("saves"), "Long Lived");
+        engine = start(laptop, Engine.defaultConfig(
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), StoragePolicy.defaults())));
+        BackupId backupId = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        engine.close();
+        String main = new String(new ProcessBuilder("git", "--git-dir", remote.toString(), "rev-parse", "main")
+                .start().getInputStream().readAllBytes(), java.nio.charset.StandardCharsets.UTF_8).strip();
+        StringBuilder refs = new StringBuilder();
+        for (int index = 0; index < 300; index++) {
+            refs.append("create refs/heads/topic/").append(index).append(' ').append(main).append('\n');
+        }
+        Process updateRef = new ProcessBuilder("git", "--git-dir", remote.toString(), "update-ref", "--stdin").start();
+        updateRef.getOutputStream().write(refs.toString().getBytes(java.nio.charset.StandardCharsets.UTF_8));
+        updateRef.getOutputStream().close();
+        assertEquals(0, updateRef.waitFor());
+
+        engine = start(root.resolve("desktop"), Engine.defaultConfig());
+        ImportPreview preview = await(engine.imports.previewGit(remote.toString()));
+        ImportSummary summary = engine.importAll(preview);
+
+        assertEquals(1, summary.added(), summary.message() + " " + preview.issues());
+        assertTrue(engine.catalog.find(backupId).isPresent());
+    }
+
+    private static Engine start(Path home, WorldArchiveConfig config) {
+        return new Engine(
+                home,
+                new Engine.TestClock(Instant.parse("2026-09-01T12:00:00Z")),
+                config,
+                SourceCaptureObserver.NONE);
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/e2e/LiveWorldBackupsTest.java b/src/test/java/dev/ishaanko/worldarchive/e2e/LiveWorldBackupsTest.java
new file mode 100644
index 0000000..109d406
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/e2e/LiveWorldBackupsTest.java
@@ -0,0 +1,498 @@
+package dev.ishaanko.worldarchive.e2e;
+
+import static dev.ishaanko.worldarchive.e2e.Engine.await;
+import static dev.ishaanko.worldarchive.e2e.TestWorld.bytes;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.config.StoragePolicy;
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.config.WorldConfig;
+import dev.ishaanko.worldarchive.core.CreateBackupRequest;
+import dev.ishaanko.worldarchive.core.RestoreBackupRequest;
+import dev.ishaanko.worldarchive.core.SourceCaptureObserver;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupRecord;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.BackupStatus;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.OperationProgress;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.runtime.BackgroundReports;
+import dev.ishaanko.worldarchive.runtime.LiveServer;
+import dev.ishaanko.worldarchive.runtime.LiveWorldBackups;
+import dev.ishaanko.worldarchive.runtime.Notice;
+import dev.ishaanko.worldarchive.runtime.WorldIdentityResolver;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Optional;
+import java.util.Queue;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ConcurrentLinkedQueue;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+/**
+ * The open world's backups, driven by a fake integrated server against the real engine: the save
+ * that comes first, the world-exit backup, cancel, a server that vanished, and the schedule.
+ */
+class LiveWorldBackupsTest {
+    private static final Duration SCHEDULE = Duration.ofMinutes(30);
+
+    @TempDir
+    Path root;
+
+    private final AtomicLong nanos = new AtomicLong();
+
+    private final Reports reports = new Reports();
+
+    private final CountDownLatch copying = new CountDownLatch(1);
+
+    private final CountDownLatch release = new CountDownLatch(1);
+
+    private Engine engine;
+
+    private WorldIdentityResolver resolver;
+
+    private LiveWorldBackups live;
+
+    @AfterEach
+    void close() throws Exception {
+        release.countDown();
+        if (live != null) {
+            live.close();
+        }
+        if (engine != null) {
+            engine.close();
+        }
+    }
+
+    /** The player turned autosave off with /save-off: a backup pauses it too, and leaves it off. */
+    @Test
+    void aBackupOfTheOpenWorldSavesItFirstAndLeavesAutosaveAsThePlayerHadIt() throws Exception {
+        start(Engine.defaultConfig(), SourceCaptureObserver.NONE);
+        FakeServer server = new FakeServer(TestWorld.create(engine, "Open"));
+        server.autoSave = false;
+        BackupWorldContext world = open(server);
+
+        CompletableFuture<BackupResult> backup = backUp(world);
+        server.runTasks();
+        BackupResult result = await(backup);
+        awaitIdle();
+        server.runTasks();
+
+        assertEquals(BackupStatus.SUCCESS, result.status());
+        assertEquals(1, server.saves);
+        assertEquals(List.of(false, false), server.autoSaveChanges);
+        TestWorld.assertSameFiles(server.world.files(), restore(result.backupId()));
+    }
+
+    /**
+     * A second backup is requested just as the first one hands autosave back to the server. It is
+     * refused until autosave is back, so it never takes the paused autosave for the player's own.
+     */
+    @Test
+    void aBackupRequestedWhileAutosaveComesBackLeavesAutosaveAsThePlayerHadIt() throws Exception {
+        start(Engine.defaultConfig(), SourceCaptureObserver.NONE);
+        FakeServer server = new FakeServer(TestWorld.create(engine, "Race"));
+        BackupWorldContext world = open(server);
+        CompletableFuture<BackupResult> first = backUp(world);
+        AtomicReference<CompletableFuture<BackupResult>> second = new AtomicReference<>();
+        // The first task a worker hands to the server gives autosave back; the request lands right before it.
+        server.beforeNextWorkerTask = () -> second.set(backUp(world));
+
+        server.runTasks();
+        assertEquals(BackupStatus.SUCCESS, await(first).status());
+        server.runTasks();
+        CompletableFuture<BackupResult> third = backUp(world);
+        server.runTasks();
+        assertEquals(BackupStatus.SUCCESS, await(third).status());
+        awaitIdle();
+        server.runTasks();
+
+        assertEquals(List.of(false, true, false, true), server.autoSaveChanges);
+        ExecutionException refused = assertThrows(ExecutionException.class, () -> await(second.get()));
+        assertTrue(refused.getCause().getMessage().contains("still copying"), refused.getCause().getMessage());
+    }
+
+    @Test
+    void theWorldExitBackupCopiesTheWorldAfterItsFinalSave() throws Exception {
+        start(Engine.defaultConfig(), SourceCaptureObserver.NONE);
+        FakeServer server = new FakeServer(TestWorld.create(engine, "Leaving"));
+        open(server);
+
+        stop(server, true);
+
+        assertEquals("screen.worldarchive.notice.exit_done", reports.exitOutcome.get(30, TimeUnit.SECONDS).key());
+        awaitIdle();
+        BackupRecord exit = onlyRecord(server.world.id());
+        assertEquals(BackupTrigger.WORLD_EXIT, exit.manifest().trigger());
+        TestWorld.assertSameFiles(server.world.files(), restore(exit.manifest().backupId()));
+    }
+
+    @Test
+    void aStopWithoutTheFinalSaveMakesNoBackupAndSaysTheWorldWasNotSaved() throws Exception {
+        start(Engine.defaultConfig(), SourceCaptureObserver.NONE);
+        FakeServer server = new FakeServer(TestWorld.create(engine, "Crashed"));
+        open(server);
+
+        stop(server, false);
+
+        assertEquals("screen.worldarchive.notice.save_missing", reports.notMade.get(30, TimeUnit.SECONDS).key());
+        assertTrue(engine.records(server.world.id()).isEmpty());
+        assertEquals(0, reports.started.size());
+    }
+
+    /** Quitting while a manual backup copies the world: the exit backup waits for that copy and records the final save. */
+    @Test
+    void quittingWhileABackupCopiesTheWorldStillBacksUpItsFinalState() throws Exception {
+        start(Engine.defaultConfig(), holdFirstCapture());
+        FakeServer server = new FakeServer(TestWorld.create(engine, "Quitting"));
+        BackupWorldContext world = open(server);
+        CompletableFuture<BackupResult> manual = backUp(world);
+        server.runTasks();
+        assertTrue(copying.await(30, TimeUnit.SECONDS));
+
+        stop(server, true);
+        release.countDown();
+
+        assertEquals(BackupStatus.SUCCESS, await(manual).status());
+        assertEquals("screen.worldarchive.notice.exit_done", reports.exitOutcome.get(30, TimeUnit.SECONDS).key());
+        awaitIdle();
+        BackupRecord exit = engine.records(server.world.id()).stream()
+                .filter(record -> record.manifest().trigger() == BackupTrigger.WORLD_EXIT)
+                .findFirst()
+                .orElseThrow();
+        TestWorld.assertSameFiles(server.world.files(), restore(exit.manifest().backupId()));
+    }
+
+    /**
+     * The settings bind the world's identity to its old folder. The destination selector refuses
+     * the world, which once threw out of the stopping event and skipped the game's final save.
+     */
+    @Test
+    void aWorldTheSettingsPlaceElsewhereClosesNormallyAndItsExitBackupSaysWhy() throws Exception {
+        TestWorld moved = TestWorld.create(root.resolve("saves"), "Moved");
+        start(Engine.defaultConfig(new WorldConfig(
+                        moved.id(), true, root.resolve("saves/Old Name"), Optional.empty(), Optional.empty(),
+                        StoragePolicy.defaults())),
+                SourceCaptureObserver.NONE);
+        FakeServer server = new FakeServer(moved);
+        open(server);
+
+        stop(server, true);
+
+        Notice notMade = reports.notMade.get(30, TimeUnit.SECONDS);
+        assertEquals("screen.worldarchive.notice.exit_not_made", notMade.key());
+        assertTrue(notMade.arguments().getFirst().contains("another folder"), notMade.arguments().toString());
+        assertTrue(engine.records(moved.id()).isEmpty());
+    }
+
+    /** A server that stopped without reporting it leaves its save behind; the next world must not inherit it. */
+    @Test
+    void theNextWorldBacksUpAfterAServerThatNeverReportedItsStop() throws Exception {
+        start(Engine.defaultConfig(), SourceCaptureObserver.NONE);
+        FakeServer vanished = new FakeServer(TestWorld.create(engine, "Vanished"));
+        CompletableFuture<BackupResult> stuck = backUp(open(vanished));
+
+        FakeServer next = new FakeServer(TestWorld.create(engine, "Next"));
+        BackupWorldContext world = open(next);
+
+        assertThrows(ExecutionException.class, () -> await(stuck));
+        CompletableFuture<BackupResult> backup = backUp(world);
+        next.runTasks();
+        assertEquals(BackupStatus.SUCCESS, await(backup).status());
+        awaitIdle();
+    }
+
+    @Test
+    void aCancelDuringTheCopyLeavesNoBackupAndHandsBackTheWorld() throws Exception {
+        start(Engine.defaultConfig(), holdFirstCapture());
+        FakeServer server = new FakeServer(TestWorld.create(engine, "Cancelled"));
+        CompletableFuture<BackupResult> backup = backUp(open(server));
+        server.runTasks();
+        assertTrue(copying.await(30, TimeUnit.SECONDS));
+
+        assertTrue(backup.cancel(true));
+
+        assertTrue(backup.isCancelled());
+        awaitIdle();
+        server.runTasks();
+        assertEquals(List.of(false, true), server.autoSaveChanges);
+        assertTrue(engine.records(server.world.id()).isEmpty());
+        assertNoWorldCopies(engine.storage.resolve("capture-temp"));
+    }
+
+    /**
+     * A paused game does not tick, so nothing changed: the schedule skips it without saving or a
+     * word. Once the server ticked, the next run backs up, although only the save rewrote level.dat.
+     */
+    @Test
+    void theScheduleSkipsAGameThatDidNotTickSinceTheLastBackup() throws Exception {
+        start(Engine.defaultConfig(), SourceCaptureObserver.NONE);
+        FakeServer server = new FakeServer(TestWorld.create(engine, "Paused"));
+        open(server);
+
+        runSchedule(server);
+        assertEquals(1, engine.records(server.world.id()).size());
+        runSchedule(server);
+        assertEquals(1, server.saves);
+        server.ticks += 20;
+        runSchedule(server);
+
+        assertEquals(2, engine.records(server.world.id()).size());
+        assertEquals(2, server.saves);
+        assertEquals(List.of(), reports.warnings);
+        assertTrue(server.autoSave);
+    }
+
+    @Test
+    void theScheduleSkipsAWorldThePlayerTurnedOffWithoutAWarning() throws Exception {
+        TestWorld off = TestWorld.create(root.resolve("saves"), "Off");
+        start(Engine.defaultConfig(new WorldConfig(
+                        off.id(), false, off.path(), Optional.empty(), Optional.empty(), StoragePolicy.defaults())),
+                SourceCaptureObserver.NONE);
+        FakeServer server = new FakeServer(off);
+        open(server);
+
+        server.ticks += 20;
+        runSchedule(server);
+
+        assertEquals(0, server.saves);
+        assertEquals(List.of(), reports.warnings);
+        assertTrue(engine.records(off.id()).isEmpty());
+    }
+
+    private void start(WorldArchiveConfig config, SourceCaptureObserver observer) {
+        engine = new Engine(root, new Engine.TestClock(Instant.parse("2026-09-01T12:00:00Z")), config, observer);
+        resolver = new WorldIdentityResolver(engine.saves, engine.identities, new WorldIdentityResolver.Listener() {
+            @Override
+            public void found(WorldId worldId, Path worldDirectory) {
+            }
+
+            @Override
+            public void copyFound(Path copy) {
+            }
+        });
+        resolver.configure(engine.graph.current().orElseThrow().config());
+        live = new LiveWorldBackups(engine.graph, resolver, reports, nanos::get);
+    }
+
+    /** Starts the server's world and waits until WorldArchive knows its identity. */
+    private BackupWorldContext open(FakeServer server) throws InterruptedException {
+        live.started(server);
+        long deadline = System.nanoTime() + Engine.TIMEOUT.toNanos();
+        while (live.liveWorld().isEmpty()) {
+            assertTrue(System.nanoTime() < deadline, "the open world was never resolved");
+            live.tick();
+            Thread.sleep(5);
+        }
+        return live.liveWorld().orElseThrow();
+    }
+
+    /** Stops the server the way the game does: stopping, the final save when it happens, stopped. */
+    private void stop(FakeServer server, boolean finalSave) throws IOException {
+        live.stopping(server);
+        if (finalSave) {
+            server.world.write("level.dat", bytes(4_096, 999));
+            live.saved(server, true, false);
+        }
+        live.stopped(server);
+    }
+
+    private CompletableFuture<BackupResult> backUp(BackupWorldContext world) {
+        CreateBackupRequest request = new CreateBackupRequest(
+                world.worldId(), world.worldDirectory(), world.displayName(), Optional.empty(), BackupTrigger.MANUAL);
+        return live.backUpOpenWorld(
+                engine.graph.current().orElseThrow(), request, ProgressListener.NO_OP, engine.graph.gate().enterWork());
+    }
+
+    /** Lets one schedule interval pass, runs what the tick started on the server thread, and waits for it. */
+    private void runSchedule(FakeServer server) throws InterruptedException {
+        live.tick();
+        nanos.addAndGet(SCHEDULE.toNanos());
+        live.tick();
+        server.runTasks();
+        awaitIdle();
+        server.runTasks();
+    }
+
+    private void awaitIdle() throws InterruptedException {
+        assertTrue(engine.graph.gate().awaitIdle(Engine.TIMEOUT), "backup work did not finish");
+    }
+
+    private BackupRecord onlyRecord(WorldId worldId) throws IOException {
+        List<BackupRecord> records = engine.records(worldId);
+        assertEquals(1, records.size(), records.toString());
+        return records.getFirst();
+    }
+
+    private Path restore(BackupId backupId) throws Exception {
+        return await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(backupId, engine.saves, "Restored"), ProgressListener.NO_OP))
+                .restoredWorldDirectory();
+    }
+
+    /** Blocks the first world copy until the test releases it. */
+    private SourceCaptureObserver holdFirstCapture() {
+        AtomicBoolean first = new AtomicBoolean(true);
+        return new SourceCaptureObserver() {
+            @Override
+            public void beforeFileCopy(Path relativePath) throws InterruptedException {
+                if (first.compareAndSet(true, false)) {
+                    copying.countDown();
+                    release.await();
+                }
+            }
+        };
+    }
+
+    private static void assertNoWorldCopies(Path folder) throws IOException {
+        if (!Files.exists(folder)) {
+            return;
+        }
+        try (Stream<Path> files = Files.walk(folder)) {
+            List<Path> copies = files.filter(file -> file.getFileName().toString().equals("level.dat")).toList();
+            assertFalse(copies.stream().findAny().isPresent(), copies.toString());
+        }
+    }
+
+    /**
+     * An integrated server that runs its tasks when the test says so, on the test's thread. Each
+     * save rewrites level.dat, as the game's saves do.
+     */
+    private static final class FakeServer implements LiveServer {
+        private final TestWorld world;
+
+        private final Thread serverThread = Thread.currentThread();
+
+        private final Queue<Runnable> tasks = new ConcurrentLinkedQueue<>();
+
+        private final List<Boolean> autoSaveChanges = new ArrayList<>();
+
+        private volatile boolean autoSave = true;
+
+        private volatile int ticks;
+
+        /** Runs once, from the next task that a thread other than the server's hands to the server. */
+        private volatile Runnable beforeNextWorkerTask;
+
+        private int saves;
+
+        private FakeServer(TestWorld world) {
+            this.world = world;
+        }
+
+        private void runTasks() {
+            for (Runnable task = tasks.poll(); task != null; task = tasks.poll()) {
+                task.run();
+            }
+        }
+
+        @Override
+        public Path worldDirectory() {
+            return world.path();
+        }
+
+        @Override
+        public String levelName() {
+            return world.name();
+        }
+
+        @Override
+        public void execute(Runnable task) {
+            Runnable hook = beforeNextWorkerTask;
+            if (hook != null && Thread.currentThread() != serverThread) {
+                beforeNextWorkerTask = null;
+                hook.run();
+            }
+            tasks.add(task);
+        }
+
+        @Override
+        public boolean isServerThread() {
+            return Thread.currentThread() == serverThread;
+        }
+
+        @Override
+        public void saveAll() {
+            saves++;
+            try {
+                world.write("level.dat", bytes(4_096, 100 + saves));
+            } catch (IOException exception) {
+                throw new UncheckedIOException(exception);
+            }
+        }
+
+        @Override
+        public boolean isAutoSave() {
+            return autoSave;
+        }
+
+        @Override
+        public void setAutoSave(boolean enabled) {
+            autoSave = enabled;
+            autoSaveChanges.add(enabled);
+        }
+
+        @Override
+        public int tickCount() {
+            return ticks;
+        }
+    }
+
+    /** What the player would see: the outcome of the world-exit backup, a missing one, and scheduled warnings. */
+    private static final class Reports implements BackgroundReports {
+        private final List<Runnable> started = new CopyOnWriteArrayList<>();
+
+        private final CompletableFuture<Notice> exitOutcome = new CompletableFuture<>();
+
+        private final CompletableFuture<Notice> notMade = new CompletableFuture<>();
+
+        private final List<Notice> warnings = new CopyOnWriteArrayList<>();
+
+        @Override
+        public ExitReport exitStarted(Runnable cancel) {
+            started.add(cancel);
+            return new ExitReport() {
+                @Override
+                public void onProgress(OperationProgress progress) {
+                }
+
+                @Override
+                public void finished(Notice notice) {
+                    exitOutcome.complete(notice);
+                }
+            };
+        }
+
+        @Override
+        public void exitNotMade(Notice notice) {
+            notMade.complete(notice);
+        }
+
+        @Override
+        public void scheduledWarning(Notice notice) {
+            warnings.add(notice);
+        }
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/e2e/RebuildEndToEndTest.java b/src/test/java/dev/ishaanko/worldarchive/e2e/RebuildEndToEndTest.java
new file mode 100644
index 0000000..65cf2f7
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/e2e/RebuildEndToEndTest.java
@@ -0,0 +1,209 @@
+package dev.ishaanko.worldarchive.e2e;
+
+import static dev.ishaanko.worldarchive.e2e.Engine.await;
+import static dev.ishaanko.worldarchive.e2e.TestWorld.bytes;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+import dev.ishaanko.worldarchive.config.StoragePolicy;
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.core.SourceCaptureObserver;
+import dev.ishaanko.worldarchive.importing.ImportSummary;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.BackupStatus;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.SyncStatus;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Optional;
+import java.util.Set;
+import java.util.concurrent.CompletableFuture;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+/** The rebuild of the backup list at every start: a damaged list, a broken repository, and a backup running meanwhile. */
+class RebuildEndToEndTest {
+    @TempDir
+    Path root;
+
+    private Engine engine;
+
+    @AfterEach
+    void closeEngine() throws Exception {
+        if (engine != null) {
+            engine.close();
+        }
+    }
+
+    @Test
+    void aDamagedBackupListIsSetAsideAndTheBackupsAreListedAgain() throws Exception {
+        engine = start(Engine.defaultConfig());
+        TestWorld world = TestWorld.create(engine, "Damaged List");
+        BackupId labeled = await(engine.backup(world, BackupTrigger.MANUAL, Optional.of("Castle"))).backupId();
+        engine.clock.advance(Duration.ofMinutes(1));
+        world.write("level.dat", bytes(4_096, 81));
+        BackupId plain = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        engine.close();
+        Files.writeString(engine.catalogFile(), "not-json");
+
+        engine = start(Engine.defaultConfig());
+        ImportSummary summary = await(engine.imports.rebuildLocal());
+
+        assertEquals(2, summary.added(), summary.message());
+        assertEquals(Optional.of("Castle"), engine.catalog.find(labeled).orElseThrow().manifest().label());
+        assertEquals(Set.of(DestinationType.GIT, DestinationType.ZIP), copies(plain));
+        try (Stream<Path> files = Files.list(engine.storage)) {
+            Path aside = files.filter(file -> file.getFileName().toString().startsWith("catalog.json.corrupt-"))
+                    .findFirst()
+                    .orElseThrow();
+            assertEquals("not-json", Files.readString(aside));
+        }
+    }
+
+    /**
+     * One record of the backup list is damaged. The records that still read stay listed, among
+     * them a backup whose only copy is on the remote, and the rebuild asks the remote which of the
+     * copies it finds here are there, so the rebuilt record stays synced.
+     */
+    @Test
+    void aBackupListDamagedInOneRecordKeepsTheOthersAndTheSyncState() throws Exception {
+        Path remote = Files.createDirectories(root.resolve("remote.git"));
+        new ProcessBuilder("git", "init", "--bare", "--quiet", remote.toString()).start().waitFor();
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Mirrored");
+        WorldArchiveConfig config = Engine.onlyDestination(DestinationType.GIT,
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), StoragePolicy.defaults()));
+        engine = start(config);
+        BackupId remoteOnly = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        engine.clock.advance(Duration.ofMinutes(1));
+        world.write("level.dat", bytes(4_096, 82));
+        BackupId synced = engine.backupNow(world, BackupTrigger.MANUAL).backupId();
+        assertTrue(await(engine.git.deleteLocalSnapshot(world.id(), remoteOnly)), "cleanup kept only the remote copy");
+        engine.close();
+        damage(engine.catalogFile(), synced);
+
+        engine = start(config);
+        await(engine.imports.rebuildLocal());
+
+        assertEquals(SyncStatus.SYNCED, gitCopy(synced).syncStatus());
+        assertEquals(SyncStatus.SYNCED, gitCopy(remoteOnly).syncStatus());
+    }
+
+    @Test
+    void aBrokenRepositoryHidesNoOtherBackup() throws Exception {
+        engine = start(Engine.defaultConfig());
+        TestWorld broken = TestWorld.create(engine, "Broken");
+        TestWorld healthy = TestWorld.create(engine, "Healthy");
+        BackupId brokenBackup = engine.backupNow(broken, BackupTrigger.MANUAL).backupId();
+        BackupId healthyBackup = engine.backupNow(healthy, BackupTrigger.MANUAL).backupId();
+        engine.close();
+        Files.delete(engine.catalogFile());
+        Files.writeString(engine.git.repositoryFor(broken.id()).resolve("HEAD"), "not a ref\n");
+
+        engine = start(Engine.defaultConfig());
+        ImportSummary summary = await(engine.imports.rebuildLocal());
+
+        assertEquals(2, summary.added(), summary.message());
+        assertTrue(summary.issues() > 0, summary.message());
+        assertEquals(Set.of(DestinationType.ZIP), copies(brokenBackup));
+        assertEquals(Set.of(DestinationType.GIT, DestinationType.ZIP), copies(healthyBackup));
+    }
+
+    /** The rebuild waits for the world, so the backup records its own result, sync status included. */
+    @Test
+    void aBackupThatFinishesDuringTheRebuildKeepsItsOwnRecord() throws Exception {
+        Path remote = Files.createDirectories(root.resolve("slow.git"));
+        new ProcessBuilder("git", "init", "--bare", "--quiet", remote.toString()).start().waitFor();
+        Path pushing = root.resolve("push-started");
+        Path release = root.resolve("push-released");
+        Path hook = remote.resolve("hooks").resolve("pre-receive");
+        Files.writeString(hook, "#!/bin/sh\ntouch '" + pushing + "'\nwhile [ ! -e '" + release + "' ]; do sleep 0.05; done\n");
+        assertTrue(hook.toFile().setExecutable(true));
+        TestWorld world = TestWorld.create(root.resolve("saves"), "Busy");
+        engine = start(Engine.defaultConfig(
+                Engine.world(world.id(), world.path(), Optional.of(remote.toString()), StoragePolicy.defaults())));
+
+        CompletableFuture<BackupResult> backup = engine.backup(world, BackupTrigger.MANUAL, Optional.empty())
+                .toCompletableFuture();
+        awaitFile(pushing);
+        awaitArchive(world);
+        CompletableFuture<ImportSummary> rebuild = engine.imports.rebuildLocal().toCompletableFuture();
+        Thread.sleep(300);
+        assertFalse(rebuild.isDone(), "the rebuild waits while the world's backup is still being written");
+        Files.createFile(release);
+
+        BackupResult created = await(backup);
+        ImportSummary summary = await(rebuild);
+        assertEquals(BackupStatus.SUCCESS, created.status(), created.destinations().toString());
+        assertEquals(0, summary.added(), summary.message());
+        DestinationResult git = engine.catalog.find(created.backupId()).orElseThrow().result().destinations().stream()
+                .filter(destination -> destination.destination() == DestinationType.GIT)
+                .findFirst()
+                .orElseThrow();
+        assertEquals(SyncStatus.SYNCED, git.syncStatus());
+    }
+
+    /** Gives the record of the backup a sync status that no version of WorldArchive writes. */
+    private static void damage(Path catalog, BackupId backupId) throws Exception {
+        JsonObject list = JsonParser.parseString(Files.readString(catalog)).getAsJsonObject();
+        for (JsonElement record : list.getAsJsonArray("records")) {
+            JsonObject result = record.getAsJsonObject().getAsJsonObject("result");
+            if (result.get("backupId").getAsString().equals(backupId.toString())) {
+                result.getAsJsonArray("destinations").get(0).getAsJsonObject().addProperty("syncStatus", "HALF");
+            }
+        }
+        Files.writeString(catalog, list.toString());
+    }
+
+    private DestinationResult gitCopy(BackupId backupId) throws Exception {
+        return engine.catalog.find(backupId).orElseThrow().result().destinations().stream()
+                .filter(destination -> destination.destination() == DestinationType.GIT)
+                .findFirst()
+                .orElseThrow();
+    }
+
+    private Set<DestinationType> copies(BackupId backupId) throws Exception {
+        return engine.catalog.find(backupId).orElseThrow().result().destinations().stream()
+                .map(DestinationResult::destination)
+                .collect(Collectors.toSet());
+    }
+
+    private static void awaitFile(Path file) throws InterruptedException {
+        long deadline = System.nanoTime() + Engine.TIMEOUT.toNanos();
+        while (!Files.exists(file)) {
+            assertTrue(System.nanoTime() < deadline, file + " never appeared");
+            Thread.sleep(20);
+        }
+    }
+
+    private void awaitArchive(TestWorld world) throws Exception {
+        long deadline = System.nanoTime() + Engine.TIMEOUT.toNanos();
+        Path folder = engine.zipFolder(world.id()).resolve(world.id().toString());
+        while (!Files.isDirectory(folder) || !hasArchive(folder)) {
+            assertTrue(System.nanoTime() < deadline, "the ZIP backup never appeared");
+            Thread.sleep(20);
+        }
+    }
+
+    private static boolean hasArchive(Path folder) throws Exception {
+        try (Stream<Path> files = Files.list(folder)) {
+            return files.anyMatch(file -> file.getFileName().toString().endsWith(".zip"));
+        }
+    }
+
+    private Engine start(WorldArchiveConfig config) {
+        return new Engine(root, new Engine.TestClock(Instant.parse("2026-09-01T12:00:00Z")), config,
+                SourceCaptureObserver.NONE);
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/e2e/TestWorld.java b/src/test/java/dev/ishaanko/worldarchive/e2e/TestWorld.java
new file mode 100644
index 0000000..8e5e9f9
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/e2e/TestWorld.java
@@ -0,0 +1,77 @@
+package dev.ishaanko.worldarchive.e2e;
+
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import dev.ishaanko.worldarchive.config.WorldIdentityStore;
+import dev.ishaanko.worldarchive.model.WorldId;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Map;
+import java.util.Random;
+import java.util.TreeMap;
+import java.util.stream.Stream;
+
+/** A small but realistic world folder under the engine's saves folder. */
+record TestWorld(WorldId id, Path path, String name) {
+    static TestWorld create(Engine engine, String name) throws IOException {
+        return create(engine.saves, name);
+    }
+
+    /** Creates region, player, and data-pack files, an empty file, and a session lock. */
+    static TestWorld create(Path saves, String name) throws IOException {
+        Path path = saves.resolve(name);
+        Files.createDirectories(path);
+        TestWorld world = new TestWorld(new WorldIdentityStore().loadOrCreate(path), path, name);
+        world.write("level.dat", bytes(4_096, 1));
+        world.write("region/r.0.0.mca", bytes(256 * 1_024, 2));
+        world.write("region/r.0.-1.mca", bytes(128 * 1_024, 3));
+        world.write("playerdata/3f1a2b.dat", bytes(2_048, 4));
+        world.write("datapacks/Ünïcødé pack/pack.mcmeta", "{\"pack\":{}}".getBytes(StandardCharsets.UTF_8));
+        world.write("empty.txt", new byte[0]);
+        world.write("session.lock", "locked by the game".getBytes(StandardCharsets.UTF_8));
+        return world;
+    }
+
+    void write(String relative, byte[] contents) throws IOException {
+        Path file = path.resolve(relative);
+        Files.createDirectories(file.getParent());
+        Files.write(file, contents);
+    }
+
+    void delete(String relative) throws IOException {
+        Files.delete(path.resolve(relative));
+    }
+
+    /** Every backed-up file by portable path; the session lock and WorldArchive metadata are excluded. */
+    Map<String, byte[]> files() throws IOException {
+        return filesOf(path);
+    }
+
+    static Map<String, byte[]> filesOf(Path root) throws IOException {
+        Map<String, byte[]> files = new TreeMap<>();
+        try (Stream<Path> paths = Files.walk(root)) {
+            for (Path file : paths.filter(Files::isRegularFile).toList()) {
+                String relative = root.relativize(file).toString().replace('\\', '/');
+                if (!relative.equals("session.lock") && !relative.startsWith(".worldarchive/")) {
+                    files.put(relative, Files.readAllBytes(file));
+                }
+            }
+        }
+        return files;
+    }
+
+    static void assertSameFiles(Map<String, byte[]> expected, Path actualRoot) throws IOException {
+        Map<String, byte[]> actual = filesOf(actualRoot);
+        assertEquals(expected.keySet(), actual.keySet());
+        expected.forEach((file, contents) -> assertArrayEquals(contents, actual.get(file), file));
+    }
+
+    static byte[] bytes(int length, long seed) {
+        byte[] value = new byte[length];
+        new Random(seed).nextBytes(value);
+        return value;
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/e2e/ZipEndToEndTest.java b/src/test/java/dev/ishaanko/worldarchive/e2e/ZipEndToEndTest.java
new file mode 100644
index 0000000..e029287
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/e2e/ZipEndToEndTest.java
@@ -0,0 +1,187 @@
+package dev.ishaanko.worldarchive.e2e;
+
+import static dev.ishaanko.worldarchive.e2e.Engine.await;
+import static dev.ishaanko.worldarchive.e2e.TestWorld.assertSameFiles;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.core.CreateBackupRequest;
+import dev.ishaanko.worldarchive.core.RestoreBackupRequest;
+import dev.ishaanko.worldarchive.core.SourceCaptureObserver;
+import dev.ishaanko.worldarchive.model.BackupOperation;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.BackupStatus;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.DestinationStatus;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.OperationPhase;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.VerificationStatus;
+import dev.ishaanko.worldarchive.ui.model.BackupOutcomeSummary;
+import java.io.IOException;
+import java.nio.file.FileSystems;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.attribute.PosixFilePermission;
+import java.nio.file.attribute.PosixFilePermissions;
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import java.util.concurrent.CancellationException;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+/** ZIP backups through the real engine: deletes that fail, cancels, lost checksum files, and missing folders. */
+class ZipEndToEndTest {
+    @TempDir
+    Path root;
+
+    private Engine engine;
+
+    @AfterEach
+    void closeEngine() throws Exception {
+        if (engine != null) {
+            engine.close();
+        }
+    }
+
+    @Test
+    void aReadOnlyZipFolderFailsTheDeleteAndKeepsTheBackup() throws Exception {
+        Assumptions.assumeTrue(FileSystems.getDefault().supportedFileAttributeViews().contains("posix"));
+        engine = start(Engine.onlyDestination(DestinationType.ZIP));
+        TestWorld world = TestWorld.create(engine, "Locked");
+        Map<String, byte[]> backedUp = world.files();
+        BackupResult backup = engine.backupNow(world, BackupTrigger.MANUAL);
+        Path folder = onlyArchive(world).getParent();
+        Set<PosixFilePermission> writable = Files.getPosixFilePermissions(folder);
+        Files.setPosixFilePermissions(folder, PosixFilePermissions.fromString("r-xr-xr-x"));
+        BackupResult deleted;
+        try {
+            Assumptions.assumeFalse(Files.isWritable(folder), "permissions do not apply to this user");
+            deleted = engine.delete(backup.backupId(), ProgressListener.NO_OP);
+        } finally {
+            Files.setPosixFilePermissions(folder, writable);
+        }
+
+        assertEquals(DestinationStatus.FAILED, destination(deleted).status());
+        assertEquals(1, engine.records(world.id()).size());
+        assertSameFiles(backedUp, restore(backup, "Locked restored"));
+    }
+
+    @Test
+    void cancellingWhileTheZipIsWrittenLeavesNothingBehind() throws Exception {
+        engine = start(Engine.onlyDestination(DestinationType.ZIP));
+        TestWorld world = TestWorld.create(engine, "Cancelled");
+        CountDownLatch started = new CountDownLatch(1);
+        CompletableFuture<CompletableFuture<BackupResult>> backup = new CompletableFuture<>();
+        AtomicBoolean cancelled = new AtomicBoolean();
+        ProgressListener cancelWhileWriting = progress -> {
+            if (progress.phase() == OperationPhase.WRITING
+                    && progress.completedUnits() > 0
+                    && cancelled.compareAndSet(false, true)) {
+                backup.join().cancel(true);
+                started.countDown();
+            }
+        };
+
+        backup.complete(engine.coordinator.createBackup(
+                new CreateBackupRequest(world.id(), world.path(), world.name(), Optional.empty(), BackupTrigger.MANUAL),
+                cancelWhileWriting).toCompletableFuture());
+
+        assertTrue(started.await(Engine.TIMEOUT.toSeconds(), TimeUnit.SECONDS));
+        awaitIdle(world);
+        assertThrows(CancellationException.class, () -> backup.join().join());
+        assertEquals(List.of(), engine.records(world.id()));
+        assertEquals(List.of(), filesUnder(engine.zipFolder(world.id())));
+    }
+
+    @Test
+    void aZipBackupThatLostItsChecksumFileStillVerifiesAndRestores() throws Exception {
+        engine = start(Engine.onlyDestination(DestinationType.ZIP));
+        TestWorld world = TestWorld.create(engine, "Bare");
+        Map<String, byte[]> backedUp = world.files();
+        BackupResult backup = engine.backupNow(world, BackupTrigger.MANUAL);
+        Path archive = onlyArchive(world);
+        Files.delete(archive.resolveSibling(archive.getFileName() + ".sha256"));
+
+        BackupResult verified = await(engine.recovery.verifyBackup(backup.backupId(), ProgressListener.NO_OP));
+
+        assertEquals(VerificationStatus.VERIFIED, destination(verified).verificationStatus());
+        List<String> shown = BackupOutcomeSummary.from(BackupOperation.VERIFY, verified).lines();
+        assertTrue(shown.getFirst().contains("checksum file (.sha256)"), "Verify tells the player: " + shown);
+        assertSameFiles(backedUp, restore(backup, "Bare restored"));
+    }
+
+    @Test
+    void aZipFolderThatCannotBeReachedIsNamedInTheFailure() throws Exception {
+        Path blocked = Files.writeString(root.resolve("unplugged"), "a file where a drive would be");
+        Path folder = blocked.resolve("Backups");
+        WorldArchiveConfig zipOnly = Engine.onlyDestination(DestinationType.ZIP);
+        engine = start(zipOnly.withZip(zipOnly.zip().withDestination(Optional.of(folder))));
+        TestWorld world = TestWorld.create(engine, "Unplugged");
+
+        BackupResult result = engine.backupNow(world, BackupTrigger.MANUAL);
+
+        assertEquals(BackupStatus.FAILED, result.status());
+        String message = destination(result).message().orElseThrow();
+        assertTrue(message.contains(folder.toString()) && message.contains("cannot be created or reached"), message);
+    }
+
+    private Engine start(WorldArchiveConfig config) {
+        return new Engine(root, new Engine.TestClock(Instant.parse("2026-09-01T12:00:00Z")), config,
+                SourceCaptureObserver.NONE);
+    }
+
+    private Path restore(BackupResult backup, String name) throws Exception {
+        return await(engine.recovery.restoreBackup(
+                new RestoreBackupRequest(backup.backupId(), engine.saves, name),
+                ProgressListener.NO_OP)).restoredWorldDirectory();
+    }
+
+    private Path onlyArchive(TestWorld world) throws IOException {
+        List<Path> archives = filesUnder(engine.zipFolder(world.id())).stream()
+                .filter(file -> file.getFileName().toString().endsWith(".zip"))
+                .toList();
+        assertEquals(1, archives.size(), archives.toString());
+        return archives.getFirst();
+    }
+
+    private void awaitIdle(TestWorld world) throws InterruptedException {
+        long deadline = System.nanoTime() + Engine.TIMEOUT.toNanos();
+        while (engine.coordinator.isBusy(world.id())) {
+            assertTrue(System.nanoTime() < deadline, "the backup did not stop after the cancel");
+            Thread.sleep(10);
+        }
+    }
+
+    private static DestinationResult destination(BackupResult result) {
+        return result.destinations().stream()
+                .filter(destination -> destination.destination() == DestinationType.ZIP)
+                .findFirst()
+                .orElseThrow();
+    }
+
+    /** Every file under the folder except the lock file each world folder keeps. */
+    private static List<Path> filesUnder(Path folder) throws IOException {
+        if (!Files.exists(folder)) {
+            return List.of();
+        }
+        try (Stream<Path> files = Files.walk(folder)) {
+            return files.filter(Files::isRegularFile)
+                    .filter(file -> !file.getFileName().toString().equals(".worldarchive.lock"))
+                    .toList();
+        }
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/importing/FileBackupImportServicePreviewTest.java b/src/test/java/dev/ishaanko/worldarchive/importing/FileBackupImportServicePreviewTest.java
deleted file mode 100644
index b889709..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/importing/FileBackupImportServicePreviewTest.java
+++ /dev/null
@@ -1,105 +0,0 @@
-package dev.ishaanko.worldarchive.importing;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.catalog.FileBackupCatalog;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupStore;
-import java.io.IOException;
-import java.nio.file.Path;
-import java.time.Instant;
-import java.util.List;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-class FileBackupImportServicePreviewTest {
-    private static final Instant CREATED_AT = Instant.parse("2026-07-22T12:00:00Z");
-
-    @TempDir
-    private Path temporaryDirectory;
-
-    @Test
-    void storedPreviewConsidersEveryDiscoveredDestination() throws IOException {
-        BackupManifest manifest = manifest();
-        DestinationResult git = DestinationResult.success(DestinationType.GIT, "git-ref");
-        DestinationResult zip = DestinationResult.success(DestinationType.ZIP, "backup.zip");
-        BackupRecord current = record(manifest, git);
-        BackupRecord discovered = record(manifest, git, zip);
-        FileBackupCatalog catalog = new FileBackupCatalog(temporaryDirectory.resolve("catalog.json"));
-        catalog.add(current);
-
-        assertEquals(
-                ImportDisposition.MERGE,
-                FileBackupImportService.disposition(catalog.previewMerge(discovered)));
-    }
-
-    @Test
-    void storedPreviewReportsConflictInAnyDiscoveredDestination() throws IOException {
-        BackupManifest manifest = manifest();
-        DestinationResult git = DestinationResult.success(DestinationType.GIT, "git-ref");
-        BackupRecord current = record(
-                manifest,
-                git,
-                DestinationResult.success(DestinationType.ZIP, "original.zip"));
-        BackupRecord discovered = record(
-                manifest,
-                git,
-                DestinationResult.success(DestinationType.ZIP, "different.zip"));
-        FileBackupCatalog catalog = new FileBackupCatalog(temporaryDirectory.resolve("catalog.json"));
-        catalog.add(current);
-
-        assertEquals(
-                ImportDisposition.CONFLICT,
-                FileBackupImportService.disposition(catalog.previewMerge(discovered)));
-    }
-
-    @Test
-    void copyPreviewUsesTheCanonicalManagedArchiveName() {
-        BackupManifest manifest = manifest();
-
-        assertEquals(
-                manifest.worldId() + "/" + ZipBackupStore.archiveFilename(manifest),
-                FileBackupImportService.zipPreviewArtifactId(manifest));
-    }
-
-    @Test
-    void readOnlyGitImportRemoteIsNotOfferedAsAConnection() {
-        assertFalse(FileBackupImportService.connectableRemote(
-                "git://example.invalid/team/archive.git"));
-        assertTrue(FileBackupImportService.connectableRemote(
-                "https://example.invalid/team/archive.git"));
-    }
-
-    private static BackupManifest manifest() {
-        return BackupManifest.create(
-                BackupId.create(),
-                WorldId.create(),
-                "Preview World",
-                CREATED_AT,
-                BackupTrigger.MANUAL,
-                1,
-                12,
-                "a".repeat(64));
-    }
-
-    private static BackupRecord record(
-            BackupManifest manifest,
-            DestinationResult... destinations) {
-        return new BackupRecord(
-                manifest,
-                BackupResult.aggregate(
-                        manifest.backupId(),
-                        manifest.worldId(),
-                        List.of(destinations),
-                        CREATED_AT.plusSeconds(1)));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/importing/FileBackupImportServiceRetentionTest.java b/src/test/java/dev/ishaanko/worldarchive/importing/FileBackupImportServiceRetentionTest.java
deleted file mode 100644
index 1454bd5..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/importing/FileBackupImportServiceRetentionTest.java
+++ /dev/null
@@ -1,216 +0,0 @@
-package dev.ishaanko.worldarchive.importing;
-
-import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertInstanceOf;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-
-import dev.ishaanko.worldarchive.catalog.BackupDeletionRegistry;
-import dev.ishaanko.worldarchive.catalog.FileBackupCatalog;
-import dev.ishaanko.worldarchive.config.GitDestinationConfig;
-import dev.ishaanko.worldarchive.storage.git.GitBackendSettings;
-import dev.ishaanko.worldarchive.storage.git.WorldGitSnapshotStore;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupStore;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.time.Clock;
-import java.time.Duration;
-import java.time.Instant;
-import java.time.ZoneId;
-import java.time.ZoneOffset;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Optional;
-import java.util.Set;
-import java.util.concurrent.CompletionException;
-import java.util.concurrent.Executor;
-import java.util.concurrent.RejectedExecutionException;
-import java.util.concurrent.atomic.AtomicBoolean;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-final class FileBackupImportServiceRetentionTest {
-    private static final Instant NOW = Instant.parse("2026-07-31T12:00:00Z");
-
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void expiredPreviewCannotExecute() throws Exception {
-        MutableClock clock = new MutableClock(NOW);
-        Path source = Files.createDirectories(
-                temporaryDirectory.resolve("expired-source"));
-
-        try (Fixture fixture = fixture(clock)) {
-            ImportPreview preview = fixture.imports()
-                    .previewZip(source)
-                    .toCompletableFuture()
-                    .join();
-            clock.advance(FileBackupImportService.PREVIEW_LIFETIME);
-
-            assertMissing(fixture.imports(), preview);
-        }
-    }
-
-    @Test
-    void previewCountEvictsTheOldestUnusedPlan() throws Exception {
-        MutableClock clock = new MutableClock(NOW);
-        Path source = Files.createDirectories(
-                temporaryDirectory.resolve("bounded-source"));
-        List<ImportPreview> previews = new ArrayList<>();
-
-        try (Fixture fixture = fixture(clock)) {
-            for (int index = 0;
-                    index <= FileBackupImportService.MAXIMUM_PREPARED_PREVIEWS;
-                    index++) {
-                previews.add(fixture.imports()
-                        .previewZip(source)
-                        .toCompletableFuture()
-                        .join());
-                clock.advance(Duration.ofNanos(1));
-            }
-
-            assertMissing(fixture.imports(), previews.getFirst());
-            ImportSummary latest = fixture.imports()
-                    .execute(previews.getLast().token())
-                    .toCompletableFuture()
-                    .join();
-            assertEquals(0, latest.discovered());
-        }
-    }
-
-    @Test
-    void rejectedExecutionReturnsAFailedStageAndConsumesThePreview() throws Exception {
-        MutableClock clock = new MutableClock(NOW);
-        Path source = Files.createDirectories(
-                temporaryDirectory.resolve("rejected-source"));
-        AtomicBoolean reject = new AtomicBoolean();
-        Executor executor = command -> {
-            if (reject.get()) {
-                throw new RejectedExecutionException("simulated rejection");
-            }
-            command.run();
-        };
-
-        try (Fixture fixture = fixture(clock, executor)) {
-            ImportPreview preview = fixture.imports()
-                    .previewZip(source)
-                    .toCompletableFuture()
-                    .join();
-            reject.set(true);
-
-            CompletionException failure = assertThrows(
-                    CompletionException.class,
-                    () -> fixture.imports()
-                            .execute(preview.token())
-                            .toCompletableFuture()
-                            .join());
-
-            assertInstanceOf(RejectedExecutionException.class, failure.getCause());
-            reject.set(false);
-            assertMissing(fixture.imports(), preview);
-        }
-    }
-
-    @Test
-    void rejectedPreviewReturnsAFailedStage() throws Exception {
-        MutableClock clock = new MutableClock(NOW);
-        Path source = Files.createDirectories(
-                temporaryDirectory.resolve("rejected-preview-source"));
-        Executor executor = command -> {
-            throw new RejectedExecutionException("simulated rejection");
-        };
-
-        try (Fixture fixture = fixture(clock, executor)) {
-            var preview = assertDoesNotThrow(
-                    () -> fixture.imports().previewZip(source));
-            CompletionException failure = assertThrows(
-                    CompletionException.class,
-                    () -> preview.toCompletableFuture().join());
-
-            assertInstanceOf(RejectedExecutionException.class, failure.getCause());
-        }
-    }
-
-    private Fixture fixture(Clock clock) {
-        return fixture(clock, Runnable::run);
-    }
-
-    private Fixture fixture(Clock clock, Executor executor) {
-        WorldGitSnapshotStore git = new WorldGitSnapshotStore(
-                new GitBackendSettings(
-                        true,
-                        temporaryDirectory.resolve("git"),
-                        "git",
-                        "origin",
-                        Optional.empty(),
-                        GitDestinationConfig.DEFAULT_LFS_PATTERNS,
-                        GitBackendSettings.DEFAULT_COMMAND_TIMEOUT,
-                        GitBackendSettings.DEFAULT_MAXIMUM_OUTPUT_BYTES));
-        FileBackupImportService imports = new FileBackupImportService(
-                new FileBackupCatalog(
-                        temporaryDirectory.resolve("catalog.json")),
-                new FileImportSourceRegistry(
-                        temporaryDirectory.resolve("sources.json")),
-                BackupDeletionRegistry.NONE,
-                git,
-                new ZipBackupStore(
-                        temporaryDirectory.resolve("managed-zip")),
-                Set::of,
-                executor,
-                clock);
-        return new Fixture(imports, git);
-    }
-
-    private static void assertMissing(
-            FileBackupImportService imports,
-            ImportPreview preview) {
-        CompletionException failure = assertThrows(
-                CompletionException.class,
-                () -> imports.execute(preview.token())
-                        .toCompletableFuture()
-                        .join());
-        assertInstanceOf(IllegalArgumentException.class, failure.getCause());
-    }
-
-    private record Fixture(
-            FileBackupImportService imports,
-            WorldGitSnapshotStore git) implements AutoCloseable {
-        @Override
-        public void close() {
-            imports.close();
-            git.close();
-        }
-    }
-
-    private static final class MutableClock extends Clock {
-        private Instant current;
-
-        private MutableClock(Instant current) {
-            this.current = current;
-        }
-
-        void advance(Duration duration) {
-            current = current.plus(duration);
-        }
-
-        @Override
-        public ZoneId getZone() {
-            return ZoneOffset.UTC;
-        }
-
-        @Override
-        public Clock withZone(ZoneId zone) {
-            if (!ZoneOffset.UTC.equals(zone)) {
-                throw new UnsupportedOperationException(
-                        "Test clock only supports UTC");
-            }
-            return this;
-        }
-
-        @Override
-        public Instant instant() {
-            return current;
-        }
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/importing/FileBackupImportServiceTest.java b/src/test/java/dev/ishaanko/worldarchive/importing/FileBackupImportServiceTest.java
new file mode 100644
index 0000000..2eee33a
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/importing/FileBackupImportServiceTest.java
@@ -0,0 +1,266 @@
+package dev.ishaanko.worldarchive.importing;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.catalog.FileBackupCatalog;
+import dev.ishaanko.worldarchive.catalog.FileBackupDeletionRegistry;
+import dev.ishaanko.worldarchive.config.FolderOrigin;
+import dev.ishaanko.worldarchive.core.LockingWorldOperationGate;
+import dev.ishaanko.worldarchive.core.TestCaptures;
+import dev.ishaanko.worldarchive.core.WorldInventory;
+import dev.ishaanko.worldarchive.model.ArtifactOwnership;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.VerificationStatus;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.storage.git.GitBackendSettings;
+import dev.ishaanko.worldarchive.storage.git.SystemGitCommandRunner;
+import dev.ishaanko.worldarchive.storage.git.WorldGitSnapshotStore;
+import dev.ishaanko.worldarchive.storage.zip.ZipBackupArtifact;
+import dev.ishaanko.worldarchive.storage.zip.ZipBackupStore;
+import dev.ishaanko.worldarchive.storage.zip.ZipBackupStoreResolver;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardOpenOption;
+import java.time.Clock;
+import java.time.Duration;
+import java.time.Instant;
+import java.time.ZoneId;
+import java.time.ZoneOffset;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import java.util.concurrent.CompletionException;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.stream.Collectors;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+/** ZIP imports and the search for stored backups, on real archives, catalogs and registries. */
+final class FileBackupImportServiceTest {
+    private static final Instant NOW = Instant.parse("2026-07-31T12:00:00Z");
+
+    @TempDir
+    Path temporaryDirectory;
+
+    private final ExecutorService executor = Executors.newVirtualThreadPerTaskExecutor();
+
+    private final MutableClock clock = new MutableClock(NOW);
+
+    @AfterEach
+    void stopExecutor() {
+        executor.shutdownNow();
+    }
+
+    @Test
+    void importsOnlyTheBackupsSelectedFromThePreview() throws Exception {
+        ZipBackupStore source = new ZipBackupStore(temporaryDirectory.resolve("source"), FolderOrigin.DEFAULT);
+        ZipBackupArtifact first = sourceBackup(source, "first");
+        ZipBackupArtifact second = sourceBackup(source, "second");
+        Imports imports = imports("selection");
+
+        ImportPreview preview = imports.service().previewZip(source.root()).toCompletableFuture().join();
+        ImportSummary summary = imports.service().execute(preview.token(), Set.of(first.manifest().backupId()))
+                .toCompletableFuture().join();
+
+        assertEquals(1, summary.added());
+        assertTrue(imports.catalog().find(first.manifest().backupId()).isPresent());
+        assertTrue(imports.catalog().find(second.manifest().backupId()).isEmpty());
+    }
+
+    @Test
+    void aDiscardedOrExpiredPreviewCannotRun() throws Exception {
+        ZipBackupStore source = new ZipBackupStore(temporaryDirectory.resolve("source"), FolderOrigin.DEFAULT);
+        sourceBackup(source, "only");
+        Imports imports = imports("expiry");
+        ImportPreview discarded = imports.service().previewZip(source.root()).toCompletableFuture().join();
+        ImportPreview expired = imports.service().previewZip(source.root()).toCompletableFuture().join();
+
+        imports.service().discard(discarded.token()).toCompletableFuture().join();
+        clock.advance(FileBackupImportService.PREVIEW_LIFETIME);
+
+        for (ImportPreview preview : List.of(discarded, expired)) {
+            assertThrows(CompletionException.class,
+                    () -> importAll(imports, preview));
+        }
+        assertTrue(imports.catalog().listAll().isEmpty());
+    }
+
+    @Test
+    void anArchiveThatChangedAfterThePreviewIsAnIssueAndTheOthersStillImport() throws Exception {
+        ZipBackupStore source = new ZipBackupStore(temporaryDirectory.resolve("source"), FolderOrigin.DEFAULT);
+        ZipBackupArtifact changed = sourceBackup(source, "changed");
+        ZipBackupArtifact intact = sourceBackup(source, "intact");
+        Imports imports = imports("changed");
+        ImportPreview preview = imports.service().previewZip(source.root()).toCompletableFuture().join();
+        Files.write(changed.archivePath(), new byte[] {1}, StandardOpenOption.APPEND);
+
+        ImportSummary summary = importAll(imports, preview);
+
+        assertEquals(1, summary.added());
+        assertEquals(1, summary.issues());
+        assertTrue(imports.catalog().find(changed.manifest().backupId()).isEmpty());
+        assertTrue(imports.catalog().find(intact.manifest().backupId()).isPresent());
+        assertTrue(Files.isRegularFile(changed.archivePath()));
+    }
+
+    @Test
+    void importingTheSameArchiveTwiceChangesNothingAndNeverTouchesTheSource() throws Exception {
+        ZipBackupStore source = new ZipBackupStore(temporaryDirectory.resolve("source"), FolderOrigin.DEFAULT);
+        ZipBackupArtifact archive = sourceBackup(source, "idempotent");
+        Imports imports = imports("idempotent");
+
+        ImportPreview preview = imports.service().previewZip(source.root()).toCompletableFuture().join();
+        assertEquals(ImportDisposition.ADD, preview.items().getFirst().disposition());
+        assertEquals(1, importAll(imports, preview).added());
+        ImportPreview repeated = imports.service().previewZip(source.root()).toCompletableFuture().join();
+
+        assertEquals(ImportDisposition.UNCHANGED, repeated.items().getFirst().disposition());
+        assertEquals(1, importAll(imports, repeated).unchanged());
+        assertEquals(ArtifactOwnership.MANAGED, imports.catalog().find(archive.manifest().backupId()).orElseThrow()
+                .result().destinations().getFirst().ownership());
+        assertTrue(Files.isRegularFile(archive.archivePath()));
+        assertEquals(1, imports.managed().listArchives().size());
+    }
+
+    @Test
+    void storedBackupsAreFoundOfflineAndOnlyTheSelectedOnesAreListed() throws Exception {
+        ZipBackupStore source = new ZipBackupStore(temporaryDirectory.resolve("source"), FolderOrigin.DEFAULT);
+        ZipBackupArtifact first = sourceBackup(source, "first");
+        ZipBackupArtifact second = sourceBackup(source, "second");
+        Imports imports = imports("stored");
+        ImportPreview copy = imports.service().previewZip(source.root()).toCompletableFuture().join();
+        importAll(imports, copy);
+        Imports afterLostCatalog = imports("stored", "rebuilt-catalog.json");
+
+        ImportPreview found = afterLostCatalog.service().previewLocal().toCompletableFuture().join();
+        afterLostCatalog.service().execute(found.token(), Set.of(first.manifest().backupId()))
+                .toCompletableFuture().join();
+        ImportSummary rebuilt = afterLostCatalog.service().rebuildLocal().toCompletableFuture().join();
+
+        assertEquals(2, found.items().size());
+        assertEquals(1, rebuilt.added());
+        assertEquals(1, rebuilt.unchanged());
+        DestinationResult listed = afterLostCatalog.catalog().find(second.manifest().backupId()).orElseThrow()
+                .result().destinations().getFirst();
+        assertEquals(second.manifest(), afterLostCatalog.catalog().find(second.manifest().backupId())
+                .orElseThrow().manifest());
+        assertEquals(VerificationStatus.NOT_VERIFIED, listed.verificationStatus());
+    }
+
+    @Test
+    void onlyARemoteThatCanBePushedToIsOfferedAsTheWorldsRemote() {
+        assertFalse(FileBackupImportService.connectableRemote("git://example.invalid/team/archive.git"));
+        assertTrue(FileBackupImportService.connectableRemote("https://example.invalid/team/archive.git"));
+    }
+
+    /** An import service on real stores under one folder; each name gets its own storage. */
+    private Imports imports(String name) {
+        return imports(name, "catalog.json");
+    }
+
+    private Imports imports(String name, String catalogName) {
+        Path storage = temporaryDirectory.resolve(name);
+        FileBackupCatalog catalog = new FileBackupCatalog(storage.resolve(catalogName));
+        ZipBackupStore managed = new ZipBackupStore(storage.resolve("archives"), FolderOrigin.DEFAULT);
+        WorldGitSnapshotStore git = new WorldGitSnapshotStore(
+                new GitBackendSettings(true, storage.resolve("git"), FolderOrigin.DEFAULT, "git", "origin",
+                        Optional.empty(), GitBackendSettings.DEFAULT_LFS_PATTERNS,
+                        GitBackendSettings.DEFAULT_COMMAND_TIMEOUT, GitBackendSettings.DEFAULT_MAXIMUM_OUTPUT_BYTES),
+                Map.of(),
+                new SystemGitCommandRunner(),
+                executor);
+        ZipBackupStoreResolver stores = new ZipBackupStoreResolver() {
+            @Override
+            public ZipBackupStore store(WorldId worldId) {
+                return managed;
+            }
+
+            @Override
+            public ZipBackupStore defaultStore() {
+                return managed;
+            }
+        };
+        FileBackupImportService service = new FileBackupImportService(
+                catalog,
+                new FileImportSourceRegistry(storage.resolve("import-sources.json")),
+                new FileBackupDeletionRegistry(storage.resolve("deleted-backups.txt")),
+                git,
+                stores,
+                Set::of,
+                new LockingWorldOperationGate(),
+                executor,
+                clock);
+        return new Imports(service, catalog, managed);
+    }
+
+    private ZipBackupArtifact sourceBackup(ZipBackupStore store, String name) throws Exception {
+        Path world = Files.createDirectories(temporaryDirectory.resolve("worlds").resolve(name));
+        Files.writeString(world.resolve("level.dat"), "recoverable-world-data-" + name);
+        WorldInventory inventory = TestCaptures.inventoryOf(world);
+        BackupManifest manifest = new BackupManifest(
+                BackupManifest.CURRENT_FORMAT_VERSION,
+                BackupId.create(),
+                WorldId.create(),
+                "Recovered World",
+                Optional.of("Import"),
+                NOW.minus(Duration.ofDays(1)),
+                BackupTrigger.MANUAL,
+                inventory.fileCount(),
+                inventory.byteCount(),
+                inventory.fileCount(),
+                inventory.contentSha256(),
+                inventory.inventorySha256(),
+                Optional.empty());
+        return store.create(TestCaptures.of(world, manifest), bytes -> {
+        });
+    }
+
+    /** Imports every backup the preview lists, as a player does who keeps the whole selection. */
+    private static ImportSummary importAll(Imports imports, ImportPreview preview) {
+        return imports.service().execute(preview.token(), preview.items().stream()
+                        .map(item -> item.manifest().backupId())
+                        .collect(Collectors.toUnmodifiableSet()))
+                .toCompletableFuture()
+                .join();
+    }
+
+    private record Imports(FileBackupImportService service, FileBackupCatalog catalog, ZipBackupStore managed) {
+    }
+
+    /** A clock the test moves by hand, so a preview can expire. */
+    private static final class MutableClock extends Clock {
+        private volatile Instant current;
+
+        private MutableClock(Instant current) {
+            this.current = current;
+        }
+
+        void advance(Duration duration) {
+            current = current.plus(duration);
+        }
+
+        @Override
+        public ZoneId getZone() {
+            return ZoneOffset.UTC;
+        }
+
+        @Override
+        public Clock withZone(ZoneId zone) {
+            throw new UnsupportedOperationException();
+        }
+
+        @Override
+        public Instant instant() {
+            return current;
+        }
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/importing/FileImportSourceRegistryTest.java b/src/test/java/dev/ishaanko/worldarchive/importing/FileImportSourceRegistryTest.java
index d181e2d..ebc3e1f 100644
--- a/src/test/java/dev/ishaanko/worldarchive/importing/FileImportSourceRegistryTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/importing/FileImportSourceRegistryTest.java
@@ -6,7 +6,9 @@
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.ImportSourceId;
 import dev.ishaanko.worldarchive.model.WorldId;
+import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.List;
 import java.util.Map;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
@@ -16,55 +18,51 @@ final class FileImportSourceRegistryTest {
     Path temporaryDirectory;
 
     @Test
-    void roundTripsAndUnlinksExternalArtifactsWithoutTouchingTheirFolder() throws Exception {
-        // ZIP_LINK sources are no longer created (zip link-in-place import was
-        // removed), but a registry written by an older release may still contain
-        // one; the registry must keep decoding and unlinking it correctly.
-        Path linkedFolder = temporaryDirectory.resolve("linked").toAbsolutePath().normalize();
-        java.nio.file.Files.createDirectories(linkedFolder);
-        BackupId backupId = BackupId.create();
+    void aRepositoryCollectsItsImportedBackupsAndGoesWhenTheLastIsUnlinked() throws Exception {
+        Path file = temporaryDirectory.resolve("sources.json");
+        ImportSourceId sourceId = ImportSourceId.derived("https://example.invalid/world.git");
         WorldId worldId = WorldId.create();
-        ImportSourceId sourceId = ImportSourceId.derived("ZIP_LINK\0" + linkedFolder);
-        ImportSource source = new ImportSource(
-                sourceId,
-                ImportSourceMode.ZIP_LINK,
-                linkedFolder.toString(),
-                Map.of(
-                        backupId,
-                        new ImportArtifactBinding(
-                                worldId,
-                                backupId,
-                                "nested/archive.zip",
-                                "a".repeat(64))));
-        FileImportSourceRegistry registry = new FileImportSourceRegistry(
-                temporaryDirectory.resolve("sources.json"));
+        BackupId first = BackupId.create();
+        BackupId second = BackupId.create();
+        FileImportSourceRegistry registry = new FileImportSourceRegistry(file);
 
-        registry.put(source);
+        String location = "https://example.invalid/world.git";
+        registry.put(ImportSource.git(sourceId, location, Map.of(first, binding(worldId, first))));
+        registry.put(ImportSource.git(sourceId, location, Map.of(second, binding(worldId, second))));
 
-        assertEquals(source, registry.find(sourceId).orElseThrow());
-        assertEquals(source, new FileImportSourceRegistry(
-                temporaryDirectory.resolve("sources.json")).list().getFirst());
-        registry.unlink(sourceId, backupId);
-        assertTrue(registry.find(sourceId).isEmpty());
-        assertTrue(java.nio.file.Files.isDirectory(linkedFolder));
+        ImportSource merged = new FileImportSourceRegistry(file).find(sourceId).orElseThrow();
+        assertEquals(ImportSourceMode.GIT_FULL_DOWNLOAD, merged.mode());
+        assertEquals(Map.of(first, binding(worldId, first), second, binding(worldId, second)), merged.artifacts());
+        registry.unlink(Map.of(first, sourceId));
+        assertEquals(List.of(second), List.copyOf(registry.find(sourceId).orElseThrow().artifacts().keySet()));
+        registry.unlink(Map.of(second, sourceId));
+        assertTrue(registry.list().isEmpty());
     }
 
     @Test
-    void stableSourceIdentityIsIdempotent() {
-        assertEquals(
-                ImportSourceId.derived("same source"),
-                ImportSourceId.derived("same source"));
-    }
+    void aLinkedFolderFromAnOlderReleaseStillDecodesAsItWasWritten() throws Exception {
+        Path file = temporaryDirectory.resolve("sources.json");
+        Files.writeString(file, """
+                {
+                  "schemaVersion": 1,
+                  "sources": [
+                    {
+                      "id": "5b4a3928-1706-4f5e-8d4c-3b2a19087f6e",
+                      "mode": "ZIP_LINK",
+                      "location": "C:\\\\Users\\\\bob\\\\zips",
+                      "artifacts": []
+                    }
+                  ]
+                }
+                """);
 
-    @Test
-    void keepsALegacyLinkedFolderFromStoredDataAsWritten() {
-        // A registry synced from another platform may hold a path this platform cannot
-        // parse; the retired ZIP_LINK mode is never resolved, so the text is kept as it is.
-        ImportSource legacy = new ImportSource(
-                ImportSourceId.create(),
-                ImportSourceMode.ZIP_LINK,
-                "C:\\Users\\bob\\zips",
-                Map.of());
+        ImportSource legacy = new FileImportSourceRegistry(file).list().getFirst();
+
+        assertEquals(ImportSourceMode.ZIP_LINK, legacy.mode());
         assertEquals("C:\\Users\\bob\\zips", legacy.location());
     }
+
+    private static ImportArtifactBinding binding(WorldId worldId, BackupId backupId) {
+        return new ImportArtifactBinding(worldId, backupId, "refs/heads/backups/" + backupId, "a".repeat(40));
+    }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/model/BackupManifestTest.java b/src/test/java/dev/ishaanko/worldarchive/model/BackupManifestTest.java
deleted file mode 100644
index b98140e..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/model/BackupManifestTest.java
+++ /dev/null
@@ -1,89 +0,0 @@
-package dev.ishaanko.worldarchive.model;
-
-import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-
-import java.time.Instant;
-import java.util.Optional;
-import org.junit.jupiter.api.Test;
-
-final class BackupManifestTest {
-    private static final String SHA256 = "0".repeat(64);
-
-    @Test
-    void requiresAPortableFourDigitUtcYear() {
-        assertDoesNotThrow(() -> manifest(
-                Instant.parse("9999-12-31T23:59:59Z")));
-        assertThrows(
-                IllegalArgumentException.class,
-                () -> manifest(Instant.MAX));
-        assertThrows(
-                IllegalArgumentException.class,
-                () -> manifest(Instant.parse("-0001-01-01T00:00:00Z")));
-    }
-
-    @Test
-    void rejectsMalformedUnicodeText() {
-        assertThrows(
-                IllegalArgumentException.class,
-                () -> BackupManifest.create(
-                        BackupId.create(),
-                        WorldId.create(),
-                        "World\uD800",
-                        Optional.empty(),
-                        Instant.parse("2026-07-31T12:00:00Z"),
-                        BackupTrigger.MANUAL,
-                        0,
-                        0,
-                        0,
-                        SHA256,
-                        SHA256));
-    }
-
-    @Test
-    void recordsNoGameVersionForManifestsBuiltWithoutOne() {
-        assertEquals(Optional.empty(), manifest(Instant.parse("2026-07-31T12:00:00Z")).gameVersion());
-    }
-
-    @Test
-    void keepsTheGameVersionItWasStampedWith() {
-        BackupManifest manifest = BackupManifest.create(
-                BackupId.create(),
-                WorldId.create(),
-                "World",
-                Optional.empty(),
-                Instant.parse("2026-07-31T12:00:00Z"),
-                BackupTrigger.MANUAL,
-                0,
-                0,
-                0,
-                SHA256,
-                SHA256,
-                Optional.of(new GameVersionStamp("26.2", 4_820)));
-
-        assertEquals(Optional.of(new GameVersionStamp("26.2", 4_820)), manifest.gameVersion());
-    }
-
-    @Test
-    void rejectsAnUnusableGameVersionStamp() {
-        assertThrows(IllegalArgumentException.class, () -> new GameVersionStamp("26.2", 0));
-        assertThrows(IllegalArgumentException.class, () -> new GameVersionStamp(" ", 1));
-        assertThrows(IllegalArgumentException.class, () -> new GameVersionStamp("26.2\n", 1));
-    }
-
-    private static BackupManifest manifest(Instant createdAt) {
-        return BackupManifest.create(
-                BackupId.create(),
-                WorldId.create(),
-                "World",
-                Optional.empty(),
-                createdAt,
-                BackupTrigger.MANUAL,
-                0,
-                0,
-                0,
-                SHA256,
-                SHA256);
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/model/BackupResultTest.java b/src/test/java/dev/ishaanko/worldarchive/model/BackupResultTest.java
index 162a4a1..6770503 100644
--- a/src/test/java/dev/ishaanko/worldarchive/model/BackupResultTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/model/BackupResultTest.java
@@ -1,61 +1,29 @@
 package dev.ishaanko.worldarchive.model;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import java.time.Instant;
-import java.util.ArrayList;
 import java.util.List;
 import org.junit.jupiter.api.Test;
 
 final class BackupResultTest {
     @Test
-    void preservesPartialDestinationSuccess() {
-        BackupId backupId = BackupId.create();
-        WorldId worldId = WorldId.create();
-        DestinationResult git = DestinationResult.success(DestinationType.GIT, "refs/worldarchive/world/backup");
-        DestinationResult zip = DestinationResult.failed(DestinationType.ZIP, "Destination is unavailable");
+    void derivesTheOverallStatusFromTheDestinations() {
+        DestinationResult git = DestinationResult.success(DestinationType.GIT, "ref");
 
-        BackupResult result = BackupResult.aggregate(
-                backupId,
-                worldId,
-                List.of(git, zip),
-                Instant.parse("2026-07-17T12:00:00Z"));
-
-        assertEquals(BackupStatus.PARTIAL_SUCCESS, result.status());
-        assertEquals(List.of(git, zip), result.destinations());
-    }
-
-    @Test
-    void computesAllTerminalAggregateStates() {
-        assertEquals(BackupStatus.SUCCESS, BackupResult.aggregateStatus(List.of(
-                DestinationResult.success(DestinationType.GIT, "ref"),
-                DestinationResult.skipped(DestinationType.ZIP, "unchanged"))));
-        assertEquals(BackupStatus.FAILED, BackupResult.aggregateStatus(List.of(
-                DestinationResult.failed(DestinationType.GIT, "missing Git LFS"))));
-        assertEquals(BackupStatus.SKIPPED, BackupResult.aggregateStatus(List.of()));
-        assertEquals(BackupStatus.PARTIAL_SUCCESS, BackupResult.aggregateStatus(List.of(
-                DestinationResult.pendingSync(DestinationType.GIT, "ref", "Remote unavailable"))));
+        assertEquals(BackupStatus.SUCCESS, status(git, DestinationResult.skipped(DestinationType.ZIP, "off")));
+        assertEquals(BackupStatus.PARTIAL_SUCCESS, status(git, DestinationResult.failed(DestinationType.ZIP, "full")));
+        assertEquals(BackupStatus.PARTIAL_SUCCESS, status(
+                DestinationResult.pendingSync(DestinationType.GIT, "ref", "Remote unavailable")));
+        assertEquals(BackupStatus.FAILED, status(DestinationResult.failed(DestinationType.GIT, "no Git LFS")));
+        assertEquals(BackupStatus.SKIPPED, status());
     }
 
-    @Test
-    void destinationResultsAreDefensivelyCopiedAndUnique() {
-        List<DestinationResult> mutable = new ArrayList<>();
-        mutable.add(DestinationResult.success(DestinationType.GIT, "ref"));
-        BackupResult result = BackupResult.aggregate(
-                BackupId.create(),
-                WorldId.create(),
-                mutable,
-                Instant.now());
-        mutable.clear();
-        assertEquals(1, result.destinations().size());
-        assertThrows(UnsupportedOperationException.class, () -> result.destinations().clear());
-        assertThrows(IllegalArgumentException.class, () -> BackupResult.aggregate(
+    private static BackupStatus status(DestinationResult... destinations) {
+        return new BackupResult(
                 BackupId.create(),
                 WorldId.create(),
-                List.of(
-                        DestinationResult.success(DestinationType.GIT, "one"),
-                        DestinationResult.success(DestinationType.GIT, "two")),
-                Instant.now()));
+                List.of(destinations),
+                Instant.parse("2026-07-17T12:00:00Z")).status();
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/model/GoldenFixtures.java b/src/test/java/dev/ishaanko/worldarchive/model/GoldenFixtures.java
new file mode 100644
index 0000000..84e36bc
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/model/GoldenFixtures.java
@@ -0,0 +1,107 @@
+package dev.ishaanko.worldarchive.model;
+
+import java.time.Instant;
+import java.util.List;
+import java.util.Optional;
+
+/**
+ * Fixed backup metadata and the exact bytes and digests that WorldArchive 0.3.9 writes for it.
+ * Stored backups depend on these formats: if a golden value changes, old backups stop verifying.
+ * The expected values were produced by the encoders as they were before the shared helpers.
+ */
+public final class GoldenFixtures {
+    /** The manifest fields exactly as the ZIP manifest, the Git manifest and the catalog write them. */
+    public static final String LABELED_MANIFEST_JSON = """
+            {
+              "formatVersion": 1,
+              "backupId": "0f6d3c2a-8b1e-4c5d-9a7f-112233445566",
+              "worldId": "7a1b2c3d-4e5f-4a6b-8c7d-8e9fa0b1c2d3",
+              "worldName": "Golden Wörld 世界",
+              "label": "Before the <dragon> & \\"end\\"",
+              "createdAt": "2026-09-01T12:34:56.789Z",
+              "trigger": "MANUAL",
+              "sourceFileCount": 3,
+              "sourceByteCount": 266240,
+              "changedFileCount": 2,
+              "contentSha256": "3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
+              "inventorySha256": "a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0",
+              "gameVersion": {
+                "name": "26.3",
+                "dataVersion": 4556
+              }
+            }
+            """;
+
+    public static final String PLAIN_MANIFEST_JSON = """
+            {
+              "formatVersion": 1,
+              "backupId": "1e2d3c4b-5a69-4788-97a6-b5c4d3e2f100",
+              "worldId": "7a1b2c3d-4e5f-4a6b-8c7d-8e9fa0b1c2d3",
+              "worldName": "Plain",
+              "createdAt": "2026-09-01T12:00:00Z",
+              "trigger": "WORLD_EXIT",
+              "sourceFileCount": 0,
+              "sourceByteCount": 0,
+              "changedFileCount": 0,
+              "contentSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+              "inventorySha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+            }
+            """;
+
+    /** Four files in no particular order; the digests below cover them sorted by path. */
+    public static final List<InventoryFile> INVENTORY = List.of(
+            new InventoryFile("region/r.0.0.mca", 262_144, "fedcba9876543210".repeat(4)),
+            new InventoryFile("datapacks/Ünïcødé pack/pack.mcmeta", 11, "4f".repeat(32)),
+            new InventoryFile("level.dat", 4_096, "0123456789abcdef".repeat(4)),
+            new InventoryFile(
+                    "empty.txt", 0, "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"));
+
+    public static final String INVENTORY_CONTENT_SHA256 =
+            "736219723b042194ed020abfc4b6066d2a05f0fbc06bb9f2fd130dc62ef4afe4";
+
+    public static final String INVENTORY_SHA256 =
+            "406824d45dac822e60e953296ae4f7b82f108d41003ce8566e9090639b2a5545";
+
+    private GoldenFixtures() {
+    }
+
+    /** A manifest with a label and a game version, and text that JSON must not escape as HTML. */
+    public static BackupManifest labeledManifest() {
+        return new BackupManifest(
+                BackupManifest.CURRENT_FORMAT_VERSION,
+                BackupId.parse("0f6d3c2a-8b1e-4c5d-9a7f-112233445566"),
+                WorldId.parse("7a1b2c3d-4e5f-4a6b-8c7d-8e9fa0b1c2d3"),
+                "Golden Wörld 世界",
+                Optional.of("Before the <dragon> & \"end\""),
+                Instant.parse("2026-09-01T12:34:56.789Z"),
+                BackupTrigger.MANUAL,
+                3,
+                266_240,
+                2,
+                "3f".repeat(32),
+                "a0".repeat(32),
+                Optional.of(new GameVersionStamp("26.3", 4_556)));
+    }
+
+    /** A manifest without a label or a game version. */
+    public static BackupManifest plainManifest() {
+        return new BackupManifest(
+                BackupManifest.CURRENT_FORMAT_VERSION,
+                BackupId.parse("1e2d3c4b-5a69-4788-97a6-b5c4d3e2f100"),
+                WorldId.parse("7a1b2c3d-4e5f-4a6b-8c7d-8e9fa0b1c2d3"),
+                "Plain",
+                Optional.empty(),
+                Instant.parse("2026-09-01T12:00:00Z"),
+                BackupTrigger.WORLD_EXIT,
+                0,
+                0,
+                0,
+                "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+                "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+                Optional.empty());
+    }
+
+    /** One inventory row, independent of each destination's own entry type. */
+    public record InventoryFile(String path, long size, String sha256) {
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/model/IdentifierTest.java b/src/test/java/dev/ishaanko/worldarchive/model/IdentifierTest.java
index dd40275..6e6e014 100644
--- a/src/test/java/dev/ishaanko/worldarchive/model/IdentifierTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/model/IdentifierTest.java
@@ -1,32 +1,12 @@
 package dev.ishaanko.worldarchive.model;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
-import java.util.HashSet;
-import java.util.Set;
 import java.util.UUID;
 import org.junit.jupiter.api.Test;
 
 final class IdentifierTest {
-    @Test
-    void generatedIdentifiersAreUniqueAndRoundTrip() {
-        Set<WorldId> worlds = new HashSet<>();
-        Set<BackupId> backups = new HashSet<>();
-        for (int index = 0; index < 10_000; index++) {
-            WorldId worldId = WorldId.create();
-            BackupId backupId = BackupId.create();
-            worlds.add(worldId);
-            backups.add(backupId);
-            assertEquals(worldId, WorldId.parse(worldId.toString()));
-            assertEquals(backupId, BackupId.parse(backupId.toString()));
-        }
-        assertEquals(10_000, worlds.size());
-        assertEquals(10_000, backups.size());
-        assertNotEquals(WorldId.create().toString(), BackupId.create().toString());
-    }
-
     @Test
     void nilIdentifiersAreRejected() {
         UUID nil = new UUID(0, 0);
diff --git a/src/test/java/dev/ishaanko/worldarchive/model/SafeTextTest.java b/src/test/java/dev/ishaanko/worldarchive/model/SafeTextTest.java
new file mode 100644
index 0000000..b8ba354
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/model/SafeTextTest.java
@@ -0,0 +1,35 @@
+package dev.ishaanko.worldarchive.model;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import java.io.IOException;
+import java.util.concurrent.CompletionException;
+import java.util.concurrent.ExecutionException;
+import org.junit.jupiter.api.Test;
+
+final class SafeTextTest {
+    @Test
+    void makesAMessageSafeToShowOnOneLine() {
+        assertEquals(
+                "Push failed: token=[REDACTED] rejected",
+                SafeText.of("  Push failed:\r\n token=abc123\u202e rejected\n", "Push failed", 200));
+        assertEquals("🌍🌍🌍🌍…", SafeText.of("🌍".repeat(10), "fallback", 5));
+        assertEquals("fallback", SafeText.of(" \n\t ", "fallback", 5));
+        assertEquals("fallback", SafeText.of(null, "fallback", 5));
+    }
+
+    @Test
+    void usesTheMessageOfTheRealCause() {
+        Throwable wrapped = new CompletionException(new ExecutionException(new IOException("No space left")));
+
+        assertEquals("No space left", SafeText.from(wrapped, "Backup failed", 100));
+        assertEquals("Backup failed", SafeText.from(new CompletionException(new IOException()), "Backup failed", 100));
+    }
+
+    @Test
+    void aFailureMessageWithLineBreaksBecomesAResultInsteadOfAnError() {
+        DestinationResult failed = DestinationResult.failed(DestinationType.ZIP, "Could not write\nD:\\Backups");
+
+        assertEquals("Could not write D:\\Backups", failed.message().orElseThrow());
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/model/SensitiveDataRedactorTest.java b/src/test/java/dev/ishaanko/worldarchive/model/SensitiveDataRedactorTest.java
index 79c729e..e426666 100644
--- a/src/test/java/dev/ishaanko/worldarchive/model/SensitiveDataRedactorTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/model/SensitiveDataRedactorTest.java
@@ -2,16 +2,13 @@
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
-import java.time.Instant;
-import java.util.Optional;
 import org.junit.jupiter.api.Test;
 
 final class SensitiveDataRedactorTest {
     @Test
-    void destinationDiagnosticsAreRedactedAtConstruction() {
+    void failureMessagesAreRedactedWhereTheyAreMade() {
         String secret = "ghp_abcdefghijklmnopqrstuvwxyz";
         DestinationResult result = DestinationResult.failed(
                 DestinationType.GIT,
@@ -21,9 +18,6 @@ void destinationDiagnosticsAreRedactedAtConstruction() {
         assertTrue(message.contains(SensitiveDataRedactor.REDACTED));
         assertFalse(message.contains("user:password"));
         assertFalse(message.contains(secret));
-        assertThrows(IllegalArgumentException.class, () -> DestinationResult.success(
-                DestinationType.GIT,
-                "https://user:password@example.invalid/artifact"));
 
         String adjacent = "prefix_x_ghp_abcdefghijklmnopqrstuvwxyz_suffix";
         DestinationResult adjacentResult = DestinationResult.failed(DestinationType.GIT, adjacent);
@@ -46,31 +40,8 @@ void destinationDiagnosticsAreRedactedAtConstruction() {
     }
 
     @Test
-    void healthAndLabelsCannotExposeKnownTokens() {
-        String token = "glpat-abcdefghijklmnopqrstuvwxyz";
-        DestinationHealth health = new DestinationHealth(
-                DestinationType.GIT,
-                DestinationHealthStatus.AUTHENTICATION_REQUIRED,
-                "Bearer " + token,
-                Instant.parse("2026-07-17T12:00:00Z"));
-        BackupManifest manifest = BackupManifest.create(
-                BackupId.create(),
-                WorldId.create(),
-                "World",
-                Optional.of("token=" + token),
-                Instant.parse("2026-07-17T12:00:00Z"),
-                BackupTrigger.MANUAL,
-                8,
-                1_024,
-                3,
-                "a".repeat(64),
-                "b".repeat(64));
-
-        assertEquals("Bearer [REDACTED]", health.message());
-        assertFalse(manifest.label().orElseThrow().contains(token));
-        assertEquals(3, manifest.changedFileCount());
-        assertEquals("a".repeat(64), manifest.contentSha256());
-        assertEquals("b".repeat(64), manifest.inventorySha256());
+    void bearerTokensAreRedacted() {
+        assertEquals("Bearer [REDACTED]", SensitiveDataRedactor.redact("Bearer glpat-abcdefghijklmnopqrstuvwxyz"));
     }
 
     @Test
diff --git a/src/test/java/dev/ishaanko/worldarchive/recovery/BackupRecoveryServiceBatchDeleteTest.java b/src/test/java/dev/ishaanko/worldarchive/recovery/BackupRecoveryServiceBatchDeleteTest.java
deleted file mode 100644
index 46cc87c..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/recovery/BackupRecoveryServiceBatchDeleteTest.java
+++ /dev/null
@@ -1,76 +0,0 @@
-package dev.ishaanko.worldarchive.recovery;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.catalog.BackupDeletionRegistry;
-import dev.ishaanko.worldarchive.config.WorldIdentityStore;
-import dev.ishaanko.worldarchive.core.DeleteBackupRequest;
-import dev.ishaanko.worldarchive.core.DeletePreparation;
-import dev.ishaanko.worldarchive.core.LockingWorldOperationGate;
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.core.WorldOperationGate;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.BackupStatus;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.nio.file.Files;
-import java.time.Clock;
-import java.util.List;
-import java.util.Map;
-import java.util.concurrent.CompletionException;
-import java.util.concurrent.atomic.AtomicBoolean;
-import org.junit.jupiter.api.Test;
-
-/** Batch deletion across several worlds, where one world's lane can refuse to open. */
-class BackupRecoveryServiceBatchDeleteTest extends BackupRecoveryServiceTestSupport {
-    @Test
-    void deleteBackupsHandsBackTokensOfAWorldThatNeverStarted() {
-        WorldId firstWorld = WorldId.create();
-        WorldId secondWorld = WorldId.create();
-        Fixture first = fixture(firstWorld, DestinationType.ZIP);
-        Fixture second = fixture(secondWorld, DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, firstWorld);
-        InMemoryCatalog catalog = new InMemoryCatalog(first.record(), second.record());
-        LockingWorldOperationGate lanes = new LockingWorldOperationGate();
-        AtomicBoolean refuseOnce = new AtomicBoolean(true);
-        WorldOperationGate gate = worldId -> {
-            if (worldId.equals(secondWorld) && refuseOnce.getAndSet(false)) {
-                throw new IllegalStateException("second world lane is unavailable");
-            }
-            return lanes.enter(worldId);
-        };
-        BackupRecoveryService service = new BackupRecoveryService(
-                catalog,
-                Map.of(DestinationType.ZIP, zip),
-                BackupDeletionRegistry.NONE,
-                new WorldIdentityStore(),
-                RestoredWorldMetadataFinalizer.NO_OP,
-                Runnable::run,
-                Clock.systemUTC(),
-                BackupRecoveryService.DEFAULT_CONFIRMATION_LIFETIME,
-                gate,
-                Files::move);
-        DeleteBackupRequest firstRequest = prepared(service, first);
-        DeleteBackupRequest secondRequest = prepared(service, second);
-
-        assertThrows(CompletionException.class, () -> service.deleteBackups(
-                        List.of(firstRequest, secondRequest), ProgressListener.NO_OP)
-                .toCompletableFuture().join());
-        assertEquals(1, catalog.records.size());
-
-        // The second world never started, so its confirmation is still valid.
-        List<BackupResult> retried = service.deleteBackups(
-                        List.of(secondRequest), ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-        assertEquals(BackupStatus.SUCCESS, retried.getFirst().status());
-        assertTrue(catalog.records.isEmpty());
-    }
-
-    private static DeleteBackupRequest prepared(BackupRecoveryService service, Fixture fixture) {
-        DeletePreparation preparation = service.prepareDelete(fixture.backupId())
-                .toCompletableFuture().join();
-        return new DeleteBackupRequest(fixture.backupId(), preparation.confirmationToken());
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/recovery/BackupRecoveryServiceMaintenanceTest.java b/src/test/java/dev/ishaanko/worldarchive/recovery/BackupRecoveryServiceMaintenanceTest.java
deleted file mode 100644
index 26b4c32..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/recovery/BackupRecoveryServiceMaintenanceTest.java
+++ /dev/null
@@ -1,960 +0,0 @@
-package dev.ishaanko.worldarchive.recovery;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertSame;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.catalog.BackupDeletionRegistry;
-import dev.ishaanko.worldarchive.catalog.FileBackupDeletionRegistry;
-import dev.ishaanko.worldarchive.core.DeleteBackupRequest;
-import dev.ishaanko.worldarchive.core.DeletePreparation;
-import dev.ishaanko.worldarchive.core.CaptureProgressListener;
-import dev.ishaanko.worldarchive.core.CapturedBackup;
-import dev.ishaanko.worldarchive.core.CreateBackupRequest;
-import dev.ishaanko.worldarchive.core.FileSystemBackupCaptureFactory;
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.BackupStatus;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.ArtifactOwnership;
-import dev.ishaanko.worldarchive.model.DestinationHealth;
-import dev.ishaanko.worldarchive.model.DestinationHealthStatus;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationStatus;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.ImportSourceId;
-import dev.ishaanko.worldarchive.model.SyncStatus;
-import dev.ishaanko.worldarchive.model.VerificationStatus;
-import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupArtifact;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupStore;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.time.Clock;
-import java.time.Duration;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.CancellationException;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.Future;
-import java.util.concurrent.TimeUnit;
-import org.junit.jupiter.api.Test;
-
-class BackupRecoveryServiceMaintenanceTest extends BackupRecoveryServiceTestSupport {
-    @Test
-    void deletionIntentMustPersistBeforeDestinationMutation() {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        InMemoryCatalog catalog = new InMemoryCatalog(fixture.record());
-        BackupDeletionRegistry unavailable = new BackupDeletionRegistry() {
-            @Override
-            public boolean contains(BackupId backupId) {
-                return false;
-            }
-
-            @Override
-            public void record(BackupId backupId) throws IOException {
-                throw new IOException("Deletion registry unavailable");
-            }
-
-            @Override
-            public void restore(BackupId backupId) {
-            }
-        };
-        BackupRecoveryService service = new BackupRecoveryService(
-                catalog,
-                Map.of(DestinationType.ZIP, zip),
-                unavailable,
-                new dev.ishaanko.worldarchive.config.WorldIdentityStore(),
-                RestoredWorldMetadataFinalizer.NO_OP,
-                Runnable::run,
-                new MutableClock(CREATED_AT.plusSeconds(2)),
-                BackupRecoveryService.DEFAULT_CONFIRMATION_LIFETIME,
-                new dev.ishaanko.worldarchive.core.LockingWorldOperationGate(),
-                Files::move);
-        DeletePreparation preparation = service.prepareDelete(fixture.backupId())
-                .toCompletableFuture().join();
-
-        assertThrows(java.util.concurrent.CompletionException.class, () -> service.deleteBackup(
-                        new DeleteBackupRequest(
-                                fixture.backupId(), preparation.confirmationToken()),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join());
-
-        assertEquals(0, zip.deleteCalls.get());
-        assertTrue(catalog.findUnchecked(fixture.backupId()).isPresent());
-    }
-
-    @Test
-    void failedDeletionRollsBackItsIntentMarker() throws Exception {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        zip.deleteResult = false;
-        InMemoryCatalog catalog = new InMemoryCatalog(fixture.record());
-        FileBackupDeletionRegistry deletions = new FileBackupDeletionRegistry(
-                temporaryDirectory.resolve("failed-delete-intent.txt"));
-        BackupRecoveryService service = new BackupRecoveryService(
-                catalog,
-                Map.of(DestinationType.ZIP, zip),
-                deletions,
-                new dev.ishaanko.worldarchive.config.WorldIdentityStore(),
-                RestoredWorldMetadataFinalizer.NO_OP,
-                Runnable::run,
-                new MutableClock(CREATED_AT.plusSeconds(2)),
-                BackupRecoveryService.DEFAULT_CONFIRMATION_LIFETIME,
-                new dev.ishaanko.worldarchive.core.LockingWorldOperationGate(),
-                Files::move);
-        DeletePreparation preparation = service.prepareDelete(fixture.backupId())
-                .toCompletableFuture().join();
-
-        service.deleteBackup(
-                new DeleteBackupRequest(fixture.backupId(), preparation.confirmationToken()),
-                ProgressListener.NO_OP).toCompletableFuture().join();
-
-        assertFalse(deletions.contains(fixture.backupId()));
-        assertTrue(catalog.findUnchecked(fixture.backupId()).isPresent());
-    }
-
-    @Test
-    void deleteConfirmationExpiresAndCannotBeReplayed() {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        InMemoryCatalog catalog = new InMemoryCatalog(fixture.record());
-        MutableClock clock = new MutableClock(CREATED_AT.plusSeconds(2));
-        BackupRecoveryService service = service(
-                catalog,
-                Map.of(DestinationType.ZIP, zip),
-                clock,
-                RestoredWorldMetadataFinalizer.NO_OP,
-                Runnable::run,
-                Duration.ofSeconds(10));
-
-        DeletePreparation expired = service.prepareDelete(fixture.backupId())
-                .toCompletableFuture().join();
-        clock.advance(Duration.ofSeconds(10));
-        assertRecoveryFailure(() -> service.deleteBackup(
-                        new DeleteBackupRequest(fixture.backupId(), expired.confirmationToken()),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join());
-        assertEquals(0, zip.deleteCalls.get());
-
-        DeletePreparation valid = service.prepareDelete(fixture.backupId())
-                .toCompletableFuture().join();
-        BackupResult deleted = service.deleteBackup(
-                        new DeleteBackupRequest(fixture.backupId(), valid.confirmationToken()),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-        assertEquals(BackupStatus.SUCCESS, deleted.status());
-        assertTrue(catalog.findUnchecked(fixture.backupId()).isEmpty());
-        assertRecoveryFailure(() -> service.deleteBackup(
-                        new DeleteBackupRequest(fixture.backupId(), valid.confirmationToken()),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join());
-        assertEquals(1, zip.deleteCalls.get());
-    }
-
-    @Test
-    void deleteConfirmationRejectsADestinationAddedAfterPreview() {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination git = new FakeDestination(DestinationType.GIT, fixture.worldId());
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        InMemoryCatalog catalog = new InMemoryCatalog(fixture.record());
-        BackupRecoveryService service = service(
-                catalog,
-                destinationMap(git, zip),
-                new MutableClock(CREATED_AT.plusSeconds(2)));
-        DeletePreparation preparation = service.prepareDelete(fixture.backupId())
-                .toCompletableFuture()
-                .join();
-        DestinationResult added = DestinationResult.success(
-                DestinationType.GIT,
-                "refs/heads/backups/added-" + fixture.backupId());
-        BackupResult changedResult = BackupResult.aggregate(
-                fixture.backupId(),
-                fixture.worldId(),
-                List.of(fixture.destination(DestinationType.ZIP), added),
-                fixture.record().result().completedAt());
-        catalog.records.put(
-                fixture.backupId(),
-                new BackupRecord(fixture.record().manifest(), changedResult));
-
-        assertRecoveryFailure(() -> service.deleteBackup(
-                        new DeleteBackupRequest(
-                                fixture.backupId(), preparation.confirmationToken()),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture()
-                .join());
-
-        assertEquals(0, git.deleteCalls.get());
-        assertEquals(0, zip.deleteCalls.get());
-    }
-
-    @Test
-    void deleteConfirmationRejectsAReplacementManifest() {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        InMemoryCatalog catalog = new InMemoryCatalog(fixture.record());
-        BackupRecoveryService service = service(
-                catalog,
-                Map.of(DestinationType.ZIP, zip),
-                new MutableClock(CREATED_AT.plusSeconds(2)));
-        DeletePreparation preparation = service.prepareDelete(fixture.backupId())
-                .toCompletableFuture()
-                .join();
-        BackupManifest old = fixture.record().manifest();
-        BackupManifest replacement = BackupManifest.create(
-                old.backupId(),
-                old.worldId(),
-                "Replacement World",
-                old.label(),
-                old.createdAt(),
-                old.trigger(),
-                old.sourceFileCount(),
-                old.sourceByteCount(),
-                old.changedFileCount(),
-                old.contentSha256(),
-                old.inventorySha256());
-        catalog.records.put(
-                fixture.backupId(),
-                new BackupRecord(replacement, fixture.record().result()));
-
-        assertRecoveryFailure(() -> service.deleteBackup(
-                        new DeleteBackupRequest(
-                                fixture.backupId(), preparation.confirmationToken()),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture()
-                .join());
-
-        assertEquals(0, zip.deleteCalls.get());
-    }
-
-    @Test
-    void deleteConfirmationRejectsAChangedArtifactOwner() {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        InMemoryCatalog catalog = new InMemoryCatalog(fixture.record());
-        BackupRecoveryService service = service(
-                catalog,
-                Map.of(DestinationType.ZIP, zip),
-                new MutableClock(CREATED_AT.plusSeconds(2)));
-        DeletePreparation preparation = service.prepareDelete(fixture.backupId())
-                .toCompletableFuture()
-                .join();
-        DestinationResult original = fixture.destination(DestinationType.ZIP);
-        DestinationResult replacement = DestinationResult.importedSuccess(
-                DestinationType.ZIP,
-                original.artifactId().orElseThrow(),
-                ImportSourceId.create(),
-                VerificationStatus.VERIFIED,
-                SyncStatus.NOT_CONFIGURED);
-        BackupResult changedResult = BackupResult.aggregate(
-                fixture.backupId(),
-                fixture.worldId(),
-                List.of(replacement),
-                fixture.record().result().completedAt());
-        catalog.records.put(
-                fixture.backupId(),
-                new BackupRecord(fixture.record().manifest(), changedResult));
-
-        assertRecoveryFailure(() -> service.deleteBackup(
-                        new DeleteBackupRequest(
-                                fixture.backupId(), preparation.confirmationToken()),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture()
-                .join());
-
-        assertEquals(0, zip.deleteCalls.get());
-    }
-
-    @Test
-    void deletionRemovesCatalogRecordWithNoDurableDestinations() {
-        Fixture fixture = fixture();
-        InMemoryCatalog catalog = new InMemoryCatalog(fixture.record());
-        BackupRecoveryService service = service(
-                catalog, Map.of(), new MutableClock(CREATED_AT.plusSeconds(2)));
-        DeletePreparation preparation = service.prepareDelete(fixture.backupId())
-                .toCompletableFuture().join();
-
-        BackupResult result = service.deleteBackup(
-                        new DeleteBackupRequest(
-                                fixture.backupId(), preparation.confirmationToken()),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-
-        assertEquals(BackupStatus.SKIPPED, result.status());
-        assertTrue(catalog.findUnchecked(fixture.backupId()).isEmpty());
-    }
-
-    @Test
-    void alreadyAbsentExactZipArtifactRepairsCatalogAsSuccessfulDeletion() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("absent-zip-world"));
-        Files.writeString(world.resolve("level.dat"), "zip contents");
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        ZipBackupStore store = new ZipBackupStore(temporaryDirectory.resolve("absent-zip-store"));
-        ZipBackupArtifact artifact;
-        try (CapturedBackup captured = new FileSystemBackupCaptureFactory(
-                        temporaryDirectory.resolve("absent-zip-captures"))
-                .capture(
-                        new CreateBackupRequest(
-                                worldId,
-                                world,
-                                "Absent ZIP",
-                                BackupTrigger.MANUAL),
-                        backupId,
-                        CREATED_AT,
-                        Optional.empty(),
-                        CaptureProgressListener.NO_OP)) {
-            artifact = store.create(captured.capture());
-        }
-        DestinationResult destination = DestinationResult.success(
-                DestinationType.ZIP, artifact.artifactId());
-        BackupRecord record = new BackupRecord(
-                artifact.manifest(),
-                BackupResult.aggregate(
-                        backupId,
-                        worldId,
-                        List.of(destination),
-                        CREATED_AT.plusSeconds(1)));
-        InMemoryCatalog catalog = new InMemoryCatalog(record);
-        assertTrue(store.delete(artifact.archivePath()));
-        BackupRecoveryService service = service(
-                catalog,
-                Map.of(DestinationType.ZIP, new ZipRecoveryDestination(store, Clock.systemUTC())),
-                new MutableClock(CREATED_AT.plusSeconds(2)));
-        DeletePreparation preparation = service.prepareDelete(backupId)
-                .toCompletableFuture().join();
-
-        BackupResult result = service.deleteBackup(
-                        new DeleteBackupRequest(backupId, preparation.confirmationToken()),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-
-        assertEquals(BackupStatus.SUCCESS, result.status());
-        assertTrue(catalog.findUnchecked(backupId).isEmpty());
-    }
-
-    @Test
-    void missingCatalogZipLocationDeletesCanonicalManagedArchive() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("canonical-zip-world"));
-        Files.writeString(world.resolve("level.dat"), "zip contents");
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        ZipBackupStore store = new ZipBackupStore(
-                temporaryDirectory.resolve("canonical-zip-store"));
-        ZipBackupArtifact artifact;
-        try (CapturedBackup captured = new FileSystemBackupCaptureFactory(
-                        temporaryDirectory.resolve("canonical-zip-captures"))
-                .capture(
-                        new CreateBackupRequest(
-                                worldId,
-                                world,
-                                "Canonical ZIP",
-                                BackupTrigger.MANUAL),
-                        backupId,
-                        CREATED_AT,
-                        Optional.empty(),
-                        CaptureProgressListener.NO_OP)) {
-            artifact = store.create(captured.capture());
-        }
-        String missingArtifactId =
-                worldId + "/20260717T200000000Z_" + backupId + ".zip";
-        DestinationResult destination = DestinationResult.success(
-                DestinationType.ZIP, missingArtifactId);
-        BackupRecord record = new BackupRecord(
-                artifact.manifest(),
-                BackupResult.aggregate(
-                        backupId,
-                        worldId,
-                        List.of(destination),
-                        CREATED_AT.plusSeconds(1)));
-        InMemoryCatalog catalog = new InMemoryCatalog(record);
-        BackupRecoveryService service = service(
-                catalog,
-                Map.of(DestinationType.ZIP, new ZipRecoveryDestination(
-                        store, Clock.systemUTC())),
-                new MutableClock(CREATED_AT.plusSeconds(2)));
-        DeletePreparation preparation = service.prepareDelete(backupId)
-                .toCompletableFuture()
-                .join();
-
-        BackupResult result = service.deleteBackup(
-                        new DeleteBackupRequest(
-                                backupId, preparation.confirmationToken()),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture()
-                .join();
-
-        assertEquals(BackupStatus.SUCCESS, result.status());
-        assertFalse(Files.exists(artifact.archivePath()));
-        assertFalse(Files.exists(artifact.checksumPath()));
-        assertTrue(catalog.findUnchecked(backupId).isEmpty());
-    }
-
-    @Test
-    void partialDeletionRemovesOnlySuccessfulDestinationFromCatalog() {
-        Fixture fixture = fixture(DestinationType.GIT, DestinationType.ZIP);
-        FakeDestination git = new FakeDestination(DestinationType.GIT, fixture.worldId());
-        git.deleteResult = false;
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        InMemoryCatalog catalog = new InMemoryCatalog(fixture.record());
-        BackupRecoveryService service = service(
-                catalog, destinationMap(git, zip), new MutableClock(CREATED_AT.plusSeconds(2)));
-        DeletePreparation preparation = service.prepareDelete(fixture.backupId())
-                .toCompletableFuture().join();
-
-        BackupResult result = service.deleteBackup(
-                        new DeleteBackupRequest(fixture.backupId(), preparation.confirmationToken()),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-
-        assertEquals(BackupStatus.PARTIAL_SUCCESS, result.status());
-        assertEquals(1, git.deleteCalls.get());
-        assertEquals(1, zip.deleteCalls.get());
-        BackupRecord retained = catalog.findUnchecked(fixture.backupId()).orElseThrow();
-        assertEquals(List.of(DestinationType.GIT), retained.result().destinations().stream()
-                .map(DestinationResult::destination).toList());
-    }
-
-    @Test
-    void cancellationAfterFirstDeletionPublishesCatalogBeforeStopping() throws Exception {
-        Fixture fixture = fixture(DestinationType.GIT, DestinationType.ZIP);
-        FakeDestination git = new FakeDestination(DestinationType.GIT, fixture.worldId());
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        InMemoryCatalog catalog = new InMemoryCatalog(fixture.record());
-        BlockingStep catalogCommit = new BlockingStep();
-        catalog.afterUpdate = catalogCommit::blockUnchecked;
-        try (ExecutorService executor = Executors.newThreadPerTaskExecutor(
-                Thread.ofVirtual().factory())) {
-            BackupRecoveryService service = service(
-                    catalog,
-                    destinationMap(git, zip),
-                    new MutableClock(CREATED_AT.plusSeconds(2)),
-                    RestoredWorldMetadataFinalizer.NO_OP,
-                    executor);
-            DeletePreparation preparation = service.prepareDelete(fixture.backupId())
-                    .toCompletableFuture().join();
-
-            var future = service.deleteBackup(
-                            new DeleteBackupRequest(
-                                    fixture.backupId(), preparation.confirmationToken()),
-                            ProgressListener.NO_OP)
-                    .toCompletableFuture();
-            catalogCommit.awaitEntered();
-            assertEquals(List.of(DestinationType.ZIP), catalog.findUnchecked(fixture.backupId())
-                    .orElseThrow().result().destinations().stream()
-                    .map(DestinationResult::destination)
-                    .toList());
-            try {
-                assertTrue(future.cancel(true));
-            } finally {
-                catalogCommit.release();
-            }
-            assertThrows(CancellationException.class, future::join);
-        }
-
-        assertFalse(catalogCommit.interrupted());
-        assertEquals(1, git.deleteCalls.get());
-        assertEquals(0, zip.deleteCalls.get());
-        assertEquals(List.of(DestinationType.ZIP), catalog.findUnchecked(fixture.backupId())
-                .orElseThrow().result().destinations().stream()
-                .map(DestinationResult::destination)
-                .toList());
-    }
-
-    @Test
-    void cancellingDeletionDefersInterruptUntilArtifactAndCatalogAreConsistent() throws Exception {
-        Fixture fixture = fixture(DestinationType.GIT);
-        FakeDestination git = new FakeDestination(DestinationType.GIT, fixture.worldId());
-        BlockingStep deletion = new BlockingStep();
-        git.deletionBlock = deletion;
-        InMemoryCatalog catalog = new InMemoryCatalog(fixture.record());
-        try (ExecutorService executor = Executors.newThreadPerTaskExecutor(
-                Thread.ofVirtual().factory())) {
-            BackupRecoveryService service = service(
-                    catalog,
-                    Map.of(DestinationType.GIT, git),
-                    new MutableClock(CREATED_AT.plusSeconds(2)),
-                    RestoredWorldMetadataFinalizer.NO_OP,
-                    executor);
-            DeletePreparation preparation = service.prepareDelete(fixture.backupId())
-                    .toCompletableFuture().join();
-
-            var future = service.deleteBackup(
-                            new DeleteBackupRequest(
-                                    fixture.backupId(), preparation.confirmationToken()),
-                            ProgressListener.NO_OP)
-                    .toCompletableFuture();
-            deletion.awaitEntered();
-            try {
-                assertTrue(future.cancel(true));
-            } finally {
-                deletion.release();
-            }
-            assertThrows(CancellationException.class, future::join);
-        }
-
-        assertFalse(deletion.interrupted());
-        assertEquals(1, git.deleteCalls.get());
-        assertTrue(catalog.findUnchecked(fixture.backupId()).isEmpty());
-    }
-
-    @Test
-    void cancellingVerificationInterruptsCurrentDestinationAndLeavesCatalogUnchanged()
-            throws Exception {
-        Fixture fixture = fixture(DestinationType.GIT, DestinationType.ZIP);
-        FakeDestination git = new FakeDestination(DestinationType.GIT, fixture.worldId());
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        BlockingStep verification = new BlockingStep();
-        git.verificationBlock = verification;
-        InMemoryCatalog catalog = new InMemoryCatalog(fixture.record());
-        try (ExecutorService executor = Executors.newThreadPerTaskExecutor(
-                Thread.ofVirtual().factory())) {
-            BackupRecoveryService service = service(
-                    catalog,
-                    destinationMap(git, zip),
-                    new MutableClock(CREATED_AT.plusSeconds(2)),
-                    RestoredWorldMetadataFinalizer.NO_OP,
-                    executor);
-
-            var future = service.verifyBackup(fixture.backupId(), ProgressListener.NO_OP)
-                    .toCompletableFuture();
-            verification.awaitEntered();
-            try {
-                assertTrue(future.cancel(true));
-            } finally {
-                verification.release();
-            }
-            assertThrows(CancellationException.class, future::join);
-        }
-
-        assertTrue(verification.interrupted());
-        assertEquals(1, git.verifyCalls.get());
-        assertEquals(0, zip.verifyCalls.get());
-        assertEquals(fixture.record(), catalog.findUnchecked(fixture.backupId()).orElseThrow());
-    }
-
-    @Test
-    void cancellingSyncInterruptsRemoteWorkAndRetainsRetryableCatalogState() throws Exception {
-        Fixture fixture = fixture(DestinationType.GIT);
-        FakeDestination git = new FakeDestination(DestinationType.GIT, fixture.worldId());
-        BlockingStep synchronization = new BlockingStep();
-        git.syncBlock = synchronization;
-        InMemoryCatalog catalog = new InMemoryCatalog(fixture.record());
-        try (ExecutorService executor = Executors.newThreadPerTaskExecutor(
-                Thread.ofVirtual().factory())) {
-            BackupRecoveryService service = service(
-                    catalog,
-                    Map.of(DestinationType.GIT, git),
-                    new MutableClock(CREATED_AT.plusSeconds(2)),
-                    RestoredWorldMetadataFinalizer.NO_OP,
-                    executor);
-
-            var future = service.syncBackup(fixture.backupId(), ProgressListener.NO_OP)
-                    .toCompletableFuture();
-            synchronization.awaitEntered();
-            try {
-                assertTrue(future.cancel(true));
-            } finally {
-                synchronization.release();
-            }
-            assertThrows(CancellationException.class, future::join);
-        }
-
-        assertTrue(synchronization.interrupted());
-        assertEquals(1, git.syncCalls.get());
-        assertEquals(fixture.record(), catalog.findUnchecked(fixture.backupId()).orElseThrow());
-    }
-
-    @Test
-    void delayedCancellationInterruptCannotEnterAfterMandatoryCommitStarts() throws Exception {
-        Fixture fixture = fixture(DestinationType.GIT);
-        FakeDestination git = new FakeDestination(DestinationType.GIT, fixture.worldId());
-        BlockingStep synchronization = new BlockingStep();
-        git.syncBlock = synchronization;
-        git.syncResult = DestinationResult.pendingSync(
-                DestinationType.GIT,
-                fixture.destination(DestinationType.GIT).artifactId().orElseThrow(),
-                "retry remote");
-        InMemoryCatalog catalog = new InMemoryCatalog(fixture.record());
-        BlockingStep catalogCommit = new BlockingStep();
-        catalog.beforeUpdate = catalogCommit::blockUnchecked;
-        try (DelayedInterruptExecutor serviceExecutor = new DelayedInterruptExecutor();
-                ExecutorService cancellationExecutor = Executors.newSingleThreadExecutor()) {
-            BackupRecoveryService service = service(
-                    catalog,
-                    Map.of(DestinationType.GIT, git),
-                    new MutableClock(CREATED_AT.plusSeconds(2)),
-                    RestoredWorldMetadataFinalizer.NO_OP,
-                    serviceExecutor);
-            var future = service.syncBackup(fixture.backupId(), ProgressListener.NO_OP)
-                    .toCompletableFuture();
-            synchronization.awaitEntered();
-
-            Future<Boolean> cancellation = cancellationExecutor.submit(() -> future.cancel(true));
-            serviceExecutor.awaitInterruptEntered();
-            synchronization.release();
-            assertFalse(catalogCommit.enteredWithin(250, TimeUnit.MILLISECONDS));
-            serviceExecutor.releaseInterrupt();
-            assertTrue(cancellation.get(5, TimeUnit.SECONDS));
-            catalogCommit.awaitEntered();
-            catalogCommit.release();
-            serviceExecutor.awaitFinished();
-
-            assertThrows(CancellationException.class, future::join);
-        }
-
-        assertFalse(catalogCommit.interrupted());
-        DestinationResult persisted = destination(
-                catalog.findUnchecked(fixture.backupId()).orElseThrow().result(),
-                DestinationType.GIT);
-        assertEquals(DestinationStatus.PENDING_SYNC, persisted.status());
-    }
-
-    @Test
-    void verificationAndSyncAtomicallyUpdateDestinationStateInCatalog() {
-        Fixture fixture = fixture(DestinationType.GIT, DestinationType.ZIP);
-        FakeDestination git = new FakeDestination(DestinationType.GIT, fixture.worldId());
-        git.verification = VerificationOutcome.failed("Git object missing");
-        git.syncResult = DestinationResult.pendingSync(
-                DestinationType.GIT,
-                fixture.destination(DestinationType.GIT).artifactId().orElseThrow(),
-                "Remote unavailable");
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        InMemoryCatalog catalog = new InMemoryCatalog(fixture.record());
-        BackupRecoveryService service = service(
-                catalog, destinationMap(git, zip), new MutableClock(CREATED_AT.plusSeconds(2)));
-
-        BackupResult verified = service.verifyBackup(
-                        fixture.backupId(), ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-        assertEquals(VerificationStatus.FAILED, destination(verified, DestinationType.GIT)
-                .verificationStatus());
-        assertEquals(VerificationStatus.VERIFIED, destination(verified, DestinationType.ZIP)
-                .verificationStatus());
-
-        BackupResult synced = service.syncBackup(
-                        fixture.backupId(), ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-        DestinationResult syncedGit = destination(synced, DestinationType.GIT);
-        assertEquals(DestinationStatus.PENDING_SYNC, syncedGit.status());
-        assertEquals(SyncStatus.PENDING, syncedGit.syncStatus());
-        assertEquals(VerificationStatus.FAILED, syncedGit.verificationStatus());
-        BackupRecord persisted = catalog.findUnchecked(fixture.backupId()).orElseThrow();
-        assertEquals(syncedGit, destination(persisted.result(), DestinationType.GIT));
-        assertEquals(VerificationStatus.VERIFIED, destination(
-                persisted.result(), DestinationType.ZIP).verificationStatus());
-    }
-
-    @Test
-    void syncKeepsImportedGitOwnershipAndSourceIdentity() {
-        Fixture fixture = fixture(DestinationType.GIT);
-        ImportSourceId sourceId = ImportSourceId.create();
-        for (ArtifactOwnership ownership : List.of(
-                ArtifactOwnership.EXTERNAL,
-                ArtifactOwnership.IMPORTED_MANAGED)) {
-            DestinationResult imported = ownership == ArtifactOwnership.EXTERNAL
-                    ? DestinationResult.externalSuccess(
-                            DestinationType.GIT,
-                            fixture.destination(DestinationType.GIT)
-                                    .artifactId()
-                                    .orElseThrow(),
-                            sourceId,
-                            VerificationStatus.VERIFIED,
-                            SyncStatus.SYNCED)
-                    : DestinationResult.importedSuccess(
-                            DestinationType.GIT,
-                            fixture.destination(DestinationType.GIT)
-                                    .artifactId()
-                                    .orElseThrow(),
-                            sourceId,
-                            VerificationStatus.VERIFIED,
-                            SyncStatus.SYNCED);
-            BackupRecord importedRecord = new BackupRecord(
-                    fixture.record().manifest(),
-                    BackupResult.aggregate(
-                            fixture.backupId(),
-                            fixture.worldId(),
-                            List.of(imported),
-                            CREATED_AT.plusSeconds(1)));
-            InMemoryCatalog catalog = new InMemoryCatalog(importedRecord);
-            FakeDestination git = new FakeDestination(
-                    DestinationType.GIT, fixture.worldId());
-            BackupRecoveryService service = service(
-                    catalog,
-                    Map.of(DestinationType.GIT, git),
-                    new MutableClock(CREATED_AT.plusSeconds(2)));
-
-            BackupResult synchronizedResult = service.syncBackup(
-                            fixture.backupId(), ProgressListener.NO_OP)
-                    .toCompletableFuture()
-                    .join();
-
-            assertEquals(
-                    imported,
-                    destination(synchronizedResult, DestinationType.GIT));
-            assertEquals(
-                    imported,
-                    destination(
-                            catalog.findUnchecked(fixture.backupId())
-                                    .orElseThrow()
-                                    .result(),
-                            DestinationType.GIT));
-        }
-    }
-
-    @Test
-    void syncReturnsImmediatelyWhenTheSnapshotIsAlreadySynced() {
-        Fixture fixture = fixture(DestinationType.GIT);
-        BackupRecord synced = gitRecord(fixture, SyncStatus.SYNCED);
-        InMemoryCatalog catalog = new InMemoryCatalog(synced);
-        FakeDestination git = new FakeDestination(DestinationType.GIT, fixture.worldId());
-        BackupRecoveryService service = service(
-                catalog,
-                Map.of(DestinationType.GIT, git),
-                new MutableClock(CREATED_AT.plusSeconds(2)));
-
-        BackupResult result = service.syncBackup(fixture.backupId(), ProgressListener.NO_OP)
-                .toCompletableFuture()
-                .join();
-
-        assertEquals(synced.result(), result);
-        assertEquals(0, git.syncCalls.get());
-        assertSame(synced, catalog.findUnchecked(fixture.backupId()).orElseThrow());
-    }
-
-    @Test
-    void syncStillRunsWhenTheSnapshotIsSuccessfulButNotSynced() {
-        Fixture fixture = fixture(DestinationType.GIT);
-        BackupRecord pending = gitRecord(fixture, SyncStatus.PENDING);
-        InMemoryCatalog catalog = new InMemoryCatalog(pending);
-        FakeDestination git = new FakeDestination(DestinationType.GIT, fixture.worldId());
-        git.syncResult = destination(pending.result(), DestinationType.GIT)
-                .withSync(SyncStatus.SYNCED);
-        BackupRecoveryService service = service(
-                catalog,
-                Map.of(DestinationType.GIT, git),
-                new MutableClock(CREATED_AT.plusSeconds(2)));
-
-        BackupResult result = service.syncBackup(fixture.backupId(), ProgressListener.NO_OP)
-                .toCompletableFuture()
-                .join();
-
-        assertEquals(1, git.syncCalls.get());
-        assertEquals(SyncStatus.SYNCED, destination(result, DestinationType.GIT).syncStatus());
-        assertEquals(
-                SyncStatus.SYNCED,
-                destination(
-                        catalog.findUnchecked(fixture.backupId()).orElseThrow().result(),
-                        DestinationType.GIT).syncStatus());
-    }
-
-    @Test
-    void healthMergesConfiguredAndMissingDestinationsDeterministically() {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        BackupRecoveryService service = service(
-                new InMemoryCatalog(fixture.record()),
-                Map.of(DestinationType.ZIP, zip),
-                new MutableClock(CREATED_AT.plusSeconds(2)));
-
-        List<DestinationHealth> health = service.health(Optional.of(fixture.worldId()))
-                .toCompletableFuture().join();
-
-        assertEquals(List.of(DestinationType.GIT, DestinationType.ZIP), health.stream()
-                .map(DestinationHealth::destination).toList());
-        assertEquals(DestinationHealthStatus.UNCONFIGURED, health.get(0).status());
-        assertEquals(DestinationHealthStatus.HEALTHY, health.get(1).status());
-    }
-
-    /** Builds a record whose single successful Git destination carries the given sync state. */
-    private static BackupRecord gitRecord(Fixture fixture, SyncStatus sync) {
-        return new BackupRecord(
-                fixture.record().manifest(),
-                BackupResult.aggregate(
-                        fixture.backupId(),
-                        fixture.worldId(),
-                        List.of(fixture.destination(DestinationType.GIT).withSync(sync)),
-                        fixture.record().result().completedAt()));
-    }
-
-    @Test
-    void deleteBackupsRemovesEveryConfirmedBackupInRequestOrder() {
-        WorldId worldId = WorldId.create();
-        Fixture first = fixture(worldId, DestinationType.ZIP);
-        Fixture second = fixture(worldId, DestinationType.GIT, DestinationType.ZIP);
-        FakeDestination git = new FakeDestination(DestinationType.GIT, worldId);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, worldId);
-        InMemoryCatalog catalog = new InMemoryCatalog(first.record(), second.record());
-        BackupRecoveryService service = service(
-                catalog, destinationMap(git, zip), Clock.systemUTC());
-
-        List<BackupResult> results = service.deleteBackups(
-                        List.of(prepared(service, second), prepared(service, first)),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-
-        assertEquals(List.of(second.backupId(), first.backupId()),
-                results.stream().map(BackupResult::backupId).toList());
-        assertTrue(results.stream().allMatch(result -> result.status() == BackupStatus.SUCCESS));
-        assertTrue(catalog.records.isEmpty());
-        assertEquals(1, git.deleteCalls.get());
-        assertEquals(2, zip.deleteCalls.get());
-    }
-
-    @Test
-    void deleteBackupsDeletesNothingWhenOneConfirmationIsInvalid() {
-        WorldId worldId = WorldId.create();
-        Fixture first = fixture(worldId, DestinationType.ZIP);
-        Fixture second = fixture(worldId, DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, worldId);
-        InMemoryCatalog catalog = new InMemoryCatalog(first.record(), second.record());
-        BackupRecoveryService service = service(
-                catalog, Map.of(DestinationType.ZIP, zip), Clock.systemUTC());
-        DeleteBackupRequest valid = prepared(service, first);
-        DeleteBackupRequest forged = new DeleteBackupRequest(
-                second.backupId(), dev.ishaanko.worldarchive.core.OperationId.create());
-
-        assertRecoveryFailure(() -> service.deleteBackups(
-                        List.of(valid, forged), ProgressListener.NO_OP)
-                .toCompletableFuture().join());
-
-        assertEquals(0, zip.deleteCalls.get());
-        assertEquals(2, catalog.records.size());
-
-        // The rejected batch handed the valid token back, so it still works on its own.
-        List<BackupResult> retried = service.deleteBackups(List.of(valid), ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-        assertEquals(BackupStatus.SUCCESS, retried.getFirst().status());
-        assertEquals(1, zip.deleteCalls.get());
-    }
-
-    @Test
-    void deleteBackupsHandsBackATokenPairedWithTheWrongBackup() {
-        WorldId worldId = WorldId.create();
-        Fixture first = fixture(worldId, DestinationType.ZIP);
-        Fixture second = fixture(worldId, DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, worldId);
-        InMemoryCatalog catalog = new InMemoryCatalog(first.record(), second.record());
-        BackupRecoveryService service = service(
-                catalog, Map.of(DestinationType.ZIP, zip), Clock.systemUTC());
-        DeleteBackupRequest valid = prepared(service, first);
-        DeleteBackupRequest mismatched = new DeleteBackupRequest(
-                second.backupId(), prepared(service, second).confirmationToken());
-        DeleteBackupRequest wrongBackup = new DeleteBackupRequest(
-                first.backupId(), mismatched.confirmationToken());
-
-        assertRecoveryFailure(() -> service.deleteBackups(
-                        List.of(valid, wrongBackup), ProgressListener.NO_OP)
-                .toCompletableFuture().join());
-        assertEquals(0, zip.deleteCalls.get());
-
-        List<BackupResult> retried = service.deleteBackups(
-                        List.of(valid, mismatched), ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-        assertTrue(retried.stream().allMatch(result -> result.status() == BackupStatus.SUCCESS));
-        assertTrue(catalog.records.isEmpty());
-    }
-
-    @Test
-    void deleteBackupsReportsOneFailedBackupWithoutStoppingTheOthers() {
-        WorldId worldId = WorldId.create();
-        Fixture kept = fixture(worldId, DestinationType.ZIP);
-        Fixture vanished = fixture(worldId, DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, worldId);
-        InMemoryCatalog catalog = new InMemoryCatalog(kept.record(), vanished.record());
-        BackupRecoveryService service = service(
-                catalog, Map.of(DestinationType.ZIP, zip), Clock.systemUTC());
-        DeleteBackupRequest keptRequest = prepared(service, kept);
-        DeleteBackupRequest vanishedRequest = prepared(service, vanished);
-        catalog.records.remove(vanished.backupId());
-
-        List<BackupResult> results = service.deleteBackups(
-                        List.of(keptRequest, vanishedRequest), ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-
-        assertEquals(BackupStatus.SUCCESS, results.get(0).status());
-        assertEquals(BackupStatus.FAILED, results.get(1).status());
-        assertEquals(vanished.backupId(), results.get(1).backupId());
-        assertTrue(results.get(1).destinations().getFirst().message().orElseThrow()
-                .contains("not found"));
-        assertTrue(catalog.records.isEmpty());
-        assertEquals(1, zip.deleteCalls.get());
-    }
-
-    @Test
-    void deleteBackupsRunsSameWorldDeletionsConcurrently() throws Exception {
-        WorldId worldId = WorldId.create();
-        Fixture first = fixture(worldId, DestinationType.ZIP);
-        Fixture second = fixture(worldId, DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, worldId);
-        zip.deletionBlock = new BlockingStep();
-        InMemoryCatalog catalog = new InMemoryCatalog(first.record(), second.record());
-        try (ExecutorService executor = Executors.newVirtualThreadPerTaskExecutor()) {
-            BackupRecoveryService service = service(
-                    catalog,
-                    Map.of(DestinationType.ZIP, zip),
-                    Clock.systemUTC(),
-                    RestoredWorldMetadataFinalizer.NO_OP,
-                    executor);
-            List<DeleteBackupRequest> requests = List.of(
-                    prepared(service, first), prepared(service, second));
-
-            Future<List<BackupResult>> deletion = service.deleteBackups(
-                    requests, ProgressListener.NO_OP).toCompletableFuture();
-            zip.deletionBlock.awaitEntered();
-            long deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(5);
-            while (zip.deleteCalls.get() < 2 && System.nanoTime() < deadline) {
-                Thread.sleep(5);
-            }
-            assertEquals(2, zip.deleteCalls.get(), "second deletion waited for the first");
-            zip.deletionBlock.release();
-
-            List<BackupResult> results = deletion.get(5, TimeUnit.SECONDS);
-            assertTrue(results.stream().allMatch(result -> result.status() == BackupStatus.SUCCESS));
-            assertTrue(catalog.records.isEmpty());
-        }
-    }
-
-    @Test
-    void deleteBackupsCompletesOnASingleThreadExecutor() throws Exception {
-        WorldId worldId = WorldId.create();
-        Fixture first = fixture(worldId, DestinationType.ZIP);
-        Fixture second = fixture(worldId, DestinationType.ZIP);
-        Fixture third = fixture(worldId, DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, worldId);
-        InMemoryCatalog catalog = new InMemoryCatalog(
-                first.record(), second.record(), third.record());
-        try (ExecutorService executor = Executors.newSingleThreadExecutor()) {
-            BackupRecoveryService service = service(
-                    catalog,
-                    Map.of(DestinationType.ZIP, zip),
-                    Clock.systemUTC(),
-                    RestoredWorldMetadataFinalizer.NO_OP,
-                    executor);
-            List<DeleteBackupRequest> requests = List.of(
-                    prepared(service, first), prepared(service, second), prepared(service, third));
-
-            List<BackupResult> results = service.deleteBackups(requests, ProgressListener.NO_OP)
-                    .toCompletableFuture().get(5, TimeUnit.SECONDS);
-
-            assertEquals(3, results.size());
-            assertTrue(results.stream().allMatch(result -> result.status() == BackupStatus.SUCCESS));
-            assertTrue(catalog.records.isEmpty());
-        }
-    }
-
-    private static DeleteBackupRequest prepared(BackupRecoveryService service, Fixture fixture) {
-        DeletePreparation preparation = service.prepareDelete(fixture.backupId())
-                .toCompletableFuture().join();
-        return new DeleteBackupRequest(fixture.backupId(), preparation.confirmationToken());
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/recovery/BackupRecoveryServiceTest.java b/src/test/java/dev/ishaanko/worldarchive/recovery/BackupRecoveryServiceTest.java
deleted file mode 100644
index d0a5985..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/recovery/BackupRecoveryServiceTest.java
+++ /dev/null
@@ -1,660 +0,0 @@
-package dev.ishaanko.worldarchive.recovery;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertInstanceOf;
-import static org.junit.jupiter.api.Assertions.assertNotEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.config.WorldIdentityStore;
-import dev.ishaanko.worldarchive.core.CaptureProgressListener;
-import dev.ishaanko.worldarchive.core.CapturedBackup;
-import dev.ishaanko.worldarchive.core.CreateBackupRequest;
-import dev.ishaanko.worldarchive.core.FileSystemBackupCaptureFactory;
-import dev.ishaanko.worldarchive.core.LockingWorldOperationGate;
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.core.RestoreBackupRequest;
-import dev.ishaanko.worldarchive.core.RestoreBackupResult;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.WorldIdentity;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupArtifact;
-import dev.ishaanko.worldarchive.storage.zip.ZipBackupStore;
-import dev.ishaanko.worldarchive.storage.git.GitSnapshot;
-import dev.ishaanko.worldarchive.storage.git.GitVerification;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.AtomicMoveNotSupportedException;
-import java.nio.file.CopyOption;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.StandardCopyOption;
-import java.time.Clock;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.CancellationException;
-import java.util.concurrent.CompletionException;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.concurrent.atomic.AtomicReference;
-import org.junit.jupiter.api.Assumptions;
-import org.junit.jupiter.api.Test;
-
-class BackupRecoveryServiceTest extends BackupRecoveryServiceTestSupport {
-
-    @Test
-    void listsAndFindsRecordsFromCatalog() {
-        Fixture first = fixture(DestinationType.ZIP);
-        Fixture second = fixture(DestinationType.GIT);
-        InMemoryCatalog catalog = new InMemoryCatalog(first.record(), second.record());
-        BackupRecoveryService service = service(catalog, Map.of(), Clock.systemUTC());
-
-        assertEquals(List.of(first.record()), service.listBackups(Optional.of(first.worldId()))
-                .toCompletableFuture().join());
-        assertEquals(2, service.listBackups(Optional.empty()).toCompletableFuture().join().size());
-        assertEquals(first.record(), service.findBackup(first.backupId())
-                .toCompletableFuture().join().orElseThrow());
-        assertTrue(service.findBackup(BackupId.create()).toCompletableFuture().join().isEmpty());
-    }
-
-    @Test
-    void restorePrefersZipThenFallsBackToGitAndCreatesFreshIdentity() throws IOException {
-        Fixture fixture = fixture(DestinationType.GIT, DestinationType.ZIP);
-        List<DestinationType> calls = java.util.Collections.synchronizedList(new ArrayList<>());
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        zip.materializeFailure = new IOException("simulated ZIP failure");
-        zip.calls = calls;
-        FakeDestination git = new FakeDestination(DestinationType.GIT, fixture.worldId());
-        git.calls = calls;
-        InMemoryCatalog catalog = new InMemoryCatalog(fixture.record());
-        BackupRecoveryService service = service(
-                catalog, destinationMap(git, zip), Clock.systemUTC());
-
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("worlds"));
-        RestoreBackupResult result = service.restoreBackup(
-                        new RestoreBackupRequest(fixture.backupId(), worlds, "Recovered World"),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-
-        assertEquals(List.of(DestinationType.ZIP, DestinationType.GIT), calls);
-        assertEquals("payload-GIT", Files.readString(
-                result.restoredWorldDirectory().resolve("payload.txt"), StandardCharsets.UTF_8));
-        WorldIdentity identity = new WorldIdentityStore().loadOrCreateIdentity(
-                result.restoredWorldDirectory());
-        assertEquals(result.restoredWorldId(), identity.worldId());
-        assertNotEquals(fixture.worldId(), identity.worldId());
-        assertEquals(fixture.backupId(), identity.sourceBackupId().orElseThrow());
-    }
-
-    @Test
-    void restoreStopsAfterTheFirstVerifiedSourceSucceeds() throws IOException {
-        Fixture fixture = fixture(DestinationType.GIT, DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        FakeDestination git = new FakeDestination(DestinationType.GIT, fixture.worldId());
-        BackupRecoveryService service = service(
-                new InMemoryCatalog(fixture.record()),
-                destinationMap(git, zip),
-                Clock.systemUTC());
-        Path worlds = Files.createDirectory(
-                temporaryDirectory.resolve("single-source-worlds"));
-
-        RestoreBackupResult result = service.restoreBackup(
-                        new RestoreBackupRequest(
-                                fixture.backupId(), worlds, "First Source"),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture()
-                .join();
-
-        assertEquals("payload-ZIP", Files.readString(
-                result.restoredWorldDirectory().resolve("payload.txt")));
-        assertEquals(1, zip.verifyCalls.get());
-        assertEquals(1, zip.materializeCalls.get());
-        assertEquals(0, git.verifyCalls.get());
-        assertEquals(0, git.materializeCalls.get());
-    }
-
-    @Test
-    void restoreRejectsUnexpectedInternalIdentityMetadataAndUsesFallback() throws IOException {
-        Fixture fixture = fixture(DestinationType.GIT, DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        zip.writeUnexpectedInternalMetadata = true;
-        FakeDestination git = new FakeDestination(DestinationType.GIT, fixture.worldId());
-        BackupRecoveryService service = service(
-                new InMemoryCatalog(fixture.record()),
-                destinationMap(git, zip),
-                Clock.systemUTC());
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("identity-worlds"));
-
-        RestoreBackupResult result = service.restoreBackup(
-                        new RestoreBackupRequest(fixture.backupId(), worlds, "Identity Check"),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-
-        assertEquals(1, zip.materializeCalls.get());
-        assertEquals(1, git.materializeCalls.get());
-        assertEquals("payload-GIT", Files.readString(
-                result.restoredWorldDirectory().resolve("payload.txt"), StandardCharsets.UTF_8));
-    }
-
-    @Test
-    void realZipArtifactRestoresWithoutCopiedInternalIdentity() throws Exception {
-        Path liveWorld = Files.createDirectories(temporaryDirectory.resolve("live-world"));
-        Files.writeString(liveWorld.resolve("level.dat"), "real world bytes", StandardCharsets.UTF_8);
-        WorldIdentity sourceIdentity = new WorldIdentityStore().loadOrCreateIdentity(liveWorld);
-        BackupId backupId = BackupId.create();
-        FileSystemBackupCaptureFactory captureFactory = new FileSystemBackupCaptureFactory(
-                temporaryDirectory.resolve("captures"));
-        ZipBackupStore store = new ZipBackupStore(temporaryDirectory.resolve("real-archives"));
-        ZipBackupArtifact artifact;
-        try (CapturedBackup captured = captureFactory.capture(
-                new CreateBackupRequest(
-                        sourceIdentity.worldId(),
-                        liveWorld,
-                        "Real ZIP World",
-                        Optional.empty(),
-                        BackupTrigger.MANUAL),
-                backupId,
-                CREATED_AT,
-                Optional.empty(),
-                CaptureProgressListener.NO_OP)) {
-            artifact = store.create(captured.capture());
-        }
-        DestinationResult destination = DestinationResult.success(
-                DestinationType.ZIP, artifact.artifactId());
-        BackupRecord record = new BackupRecord(
-                artifact.manifest(),
-                BackupResult.aggregate(
-                        backupId,
-                        sourceIdentity.worldId(),
-                        List.of(destination),
-                        CREATED_AT.plusSeconds(1)));
-        BackupRecoveryService service = service(
-                new InMemoryCatalog(record),
-                Map.of(
-                        DestinationType.ZIP,
-                        new ZipRecoveryDestination(store, Clock.systemUTC())),
-                Clock.systemUTC());
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("real-restore-worlds"));
-
-        RestoreBackupResult restored = service.restoreBackup(
-                        new RestoreBackupRequest(backupId, worlds, "Real ZIP Restored"),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-
-        assertEquals("real world bytes", Files.readString(
-                restored.restoredWorldDirectory().resolve("level.dat"), StandardCharsets.UTF_8));
-        WorldIdentity restoredIdentity = new WorldIdentityStore().loadOrCreateIdentity(
-                restored.restoredWorldDirectory());
-        assertNotEquals(sourceIdentity.worldId(), restoredIdentity.worldId());
-        assertEquals(backupId, restoredIdentity.sourceBackupId().orElseThrow());
-    }
-
-    @Test
-    void legacyLinkedZipDestinationDegradesLikeAMissingArtifactInsteadOfCrashing()
-            throws IOException {
-        // Zip link-in-place import was removed. A record persisted by an older
-        // release can still carry an EXTERNAL-owned ZIP destination; recovery must
-        // treat it exactly like a managed archive whose file is missing, not throw.
-        Fixture fixture = fixture(DestinationType.ZIP);
-        DestinationResult legacyLinked = DestinationResult.externalSuccess(
-                DestinationType.ZIP,
-                fixture.destination(DestinationType.ZIP).artifactId().orElseThrow(),
-                dev.ishaanko.worldarchive.model.ImportSourceId.derived("legacy linked folder"),
-                dev.ishaanko.worldarchive.model.VerificationStatus.VERIFIED,
-                dev.ishaanko.worldarchive.model.SyncStatus.NOT_CONFIGURED);
-        BackupRecord legacyRecord = new BackupRecord(
-                fixture.record().manifest(),
-                BackupResult.aggregate(
-                        fixture.backupId(),
-                        fixture.worldId(),
-                        List.of(legacyLinked),
-                        CREATED_AT.plusSeconds(1)));
-        ZipRecoveryDestination adapter = new ZipRecoveryDestination(
-                new ZipBackupStore(temporaryDirectory.resolve("legacy-linked-store")),
-                Clock.systemUTC());
-
-        VerificationOutcome outcome = adapter.verify(legacyRecord, legacyLinked);
-
-        assertFalse(outcome.valid());
-        assertEquals(
-                "The selected ZIP archive is missing or is not a regular file.",
-                outcome.message());
-
-        BackupRecoveryService service = service(
-                new InMemoryCatalog(legacyRecord),
-                Map.of(DestinationType.ZIP, adapter),
-                Clock.systemUTC());
-        Path worlds = Files.createDirectory(
-                temporaryDirectory.resolve("legacy-linked-worlds"));
-
-        CompletionException failure = assertThrows(
-                CompletionException.class,
-                () -> service.restoreBackup(
-                                new RestoreBackupRequest(
-                                        fixture.backupId(), worlds, "Legacy Linked"),
-                                ProgressListener.NO_OP)
-                        .toCompletableFuture().join());
-        assertInstanceOf(BackupRecoveryException.class, failure.getCause());
-        assertEquals(
-                "No valid destination can restore this backup", failure.getCause().getMessage());
-    }
-
-    @Test
-    void gitVerificationRejectsManifestThatDiffersFromCatalog() {
-        Fixture fixture = fixture(DestinationType.GIT);
-        BackupManifest original = fixture.record().manifest();
-        BackupManifest tampered = BackupManifest.create(
-                original.backupId(),
-                original.worldId(),
-                "Tampered World Name",
-                original.label(),
-                original.createdAt(),
-                original.trigger(),
-                original.sourceFileCount(),
-                original.sourceByteCount(),
-                original.changedFileCount(),
-                original.contentSha256(),
-                original.inventorySha256());
-        GitSnapshot snapshot = new GitSnapshot(
-                fixture.worldId(),
-                fixture.backupId(),
-                fixture.destination(DestinationType.GIT).artifactId().orElseThrow(),
-                "1".repeat(40),
-                original.createdAt());
-        GitVerification verification = new GitVerification(
-                snapshot, Optional.of(tampered), true, "objects verified");
-
-        VerificationOutcome outcome = GitRecoveryDestination.verificationOutcome(
-                fixture.record(), fixture.destination(DestinationType.GIT), verification);
-
-        assertFalse(outcome.valid());
-        assertTrue(outcome.message().contains("exactly match"));
-    }
-
-    @Test
-    void restoreSanitizesWindowsNamesBeforeResolvingAndKeepsExactDisplayName()
-            throws IOException {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        List<String> displayNames = new ArrayList<>();
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("safe-worlds"));
-        Files.createDirectory(worlds.resolve("_CON"));
-        BackupRecoveryService service = service(
-                new InMemoryCatalog(fixture.record()),
-                Map.of(DestinationType.ZIP, zip),
-                new MutableClock(CREATED_AT.plusSeconds(2)),
-                (directory, displayName) -> displayNames.add(displayName));
-
-        RestoreBackupResult result = service.restoreBackup(
-                        new RestoreBackupRequest(fixture.backupId(), worlds, "CON. "),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-
-        assertEquals("_CON (2)", result.restoredWorldDirectory().getFileName().toString());
-        assertEquals(worlds.toRealPath(), result.restoredWorldDirectory().getParent());
-        assertEquals(List.of("CON. "), displayNames);
-        assertThrows(IllegalArgumentException.class, () -> new RestoreBackupRequest(
-                fixture.backupId(), worlds, "../escape"));
-    }
-
-    @Test
-    void restoresForSameWorldAreSerializedAndPublishedWithUniqueNames() throws Exception {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        zip.pauseMaterialization = true;
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("concurrent-worlds"));
-        try (ExecutorService executor = Executors.newThreadPerTaskExecutor(
-                Thread.ofVirtual().factory())) {
-            BackupRecoveryService service = service(
-                    new InMemoryCatalog(fixture.record()),
-                    Map.of(DestinationType.ZIP, zip),
-                    new MutableClock(CREATED_AT.plusSeconds(2)),
-                    RestoredWorldMetadataFinalizer.NO_OP,
-                    executor);
-            RestoreBackupRequest request = new RestoreBackupRequest(
-                    fixture.backupId(), worlds, "Concurrent Copy");
-
-            var first = service.restoreBackup(request, ProgressListener.NO_OP);
-            var second = service.restoreBackup(request, ProgressListener.NO_OP);
-            RestoreBackupResult firstResult = first.toCompletableFuture().join();
-            RestoreBackupResult secondResult = second.toCompletableFuture().join();
-
-            assertNotEquals(firstResult.restoredWorldDirectory(), secondResult.restoredWorldDirectory());
-            assertEquals(1, zip.maximumActiveMaterializations.get());
-            assertEquals(2, zip.materializeCalls.get());
-        }
-    }
-
-    @Test
-    void cancellingRestoreInterruptsMaterializationAndRemovesPrivateStaging() throws Exception {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        BlockingStep materialization = new BlockingStep();
-        zip.materializationBlock = materialization;
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("cancelled-restore-worlds"));
-        try (ExecutorService executor = Executors.newThreadPerTaskExecutor(
-                Thread.ofVirtual().factory())) {
-            BackupRecoveryService service = service(
-                    new InMemoryCatalog(fixture.record()),
-                    Map.of(DestinationType.ZIP, zip),
-                    new MutableClock(CREATED_AT.plusSeconds(2)),
-                    RestoredWorldMetadataFinalizer.NO_OP,
-                    executor);
-
-            var future = service.restoreBackup(
-                            new RestoreBackupRequest(
-                                    fixture.backupId(), worlds, "Cancelled Copy"),
-                            ProgressListener.NO_OP)
-                    .toCompletableFuture();
-            materialization.awaitEntered();
-            try {
-                assertTrue(future.cancel(true));
-            } finally {
-                materialization.release();
-            }
-            assertThrows(CancellationException.class, future::join);
-        }
-
-        assertTrue(materialization.interrupted());
-        try (var children = Files.list(worlds)) {
-            assertEquals(0, children.count());
-        }
-    }
-
-    @Test
-    void cancellingRestoreDrainsNestedGitMaterializationBeforeStagingCleanup() throws Exception {
-        Fixture fixture = fixture(DestinationType.GIT);
-        FakeDestination git = new FakeDestination(DestinationType.GIT, fixture.worldId());
-        BlockingStep nestedWork = new BlockingStep();
-        DrainAwareFuture<Path> nestedResult = new DrainAwareFuture<>();
-        AtomicBoolean nestedFinished = new AtomicBoolean();
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("nested-cancel-worlds"));
-        try (ExecutorService nestedExecutor = Executors.newSingleThreadExecutor();
-                ExecutorService serviceExecutor = Executors.newThreadPerTaskExecutor(
-                        Thread.ofVirtual().factory())) {
-            git.nestedMaterialization = emptyTarget -> {
-                nestedExecutor.execute(() -> {
-                    nestedWork.blockUnchecked();
-                    try {
-                        Files.createDirectories(emptyTarget);
-                        Files.writeString(emptyTarget.resolve("nested.txt"), "finished");
-                        nestedFinished.set(true);
-                        nestedResult.complete(emptyTarget);
-                    } catch (IOException exception) {
-                        nestedResult.completeExceptionally(exception);
-                    }
-                });
-                return nestedResult;
-            };
-            BackupRecoveryService service = service(
-                    new InMemoryCatalog(fixture.record()),
-                    Map.of(DestinationType.GIT, git),
-                    new MutableClock(CREATED_AT.plusSeconds(2)),
-                    RestoredWorldMetadataFinalizer.NO_OP,
-                    serviceExecutor);
-
-            var future = service.restoreBackup(
-                            new RestoreBackupRequest(
-                                    fixture.backupId(), worlds, "Nested Cancel Copy"),
-                            ProgressListener.NO_OP)
-                    .toCompletableFuture();
-            nestedWork.awaitEntered();
-            try {
-                assertTrue(future.cancel(true));
-                nestedResult.awaitDrainStarted();
-            } finally {
-                nestedWork.release();
-            }
-            assertThrows(CancellationException.class, future::join);
-        }
-
-        assertTrue(nestedFinished.get());
-        try (var children = Files.list(worlds)) {
-            assertEquals(0, children.count());
-        }
-    }
-
-    @Test
-    void restoreCancellationIsRejectedAfterAtomicPublicationBegins() throws Exception {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        BlockingStep publication = new BlockingStep();
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("committed-restore-worlds"));
-        try (ExecutorService executor = Executors.newThreadPerTaskExecutor(
-                Thread.ofVirtual().factory())) {
-            BackupRecoveryService service = new BackupRecoveryService(
-                    new InMemoryCatalog(fixture.record()),
-                    Map.of(DestinationType.ZIP, zip),
-                    dev.ishaanko.worldarchive.catalog.BackupDeletionRegistry.NONE,
-                    new WorldIdentityStore(),
-                    RestoredWorldMetadataFinalizer.NO_OP,
-                    executor,
-                    new MutableClock(CREATED_AT.plusSeconds(2)),
-                    BackupRecoveryService.DEFAULT_CONFIRMATION_LIFETIME,
-                    new LockingWorldOperationGate(),
-                    (source, target, options) -> {
-                        publication.blockForIo();
-                        return Files.move(source, target, options);
-                    });
-
-            var future = service.restoreBackup(
-                            new RestoreBackupRequest(
-                                    fixture.backupId(), worlds, "Committed Copy"),
-                            ProgressListener.NO_OP)
-                    .toCompletableFuture();
-            publication.awaitEntered();
-            try {
-                assertFalse(future.cancel(true));
-            } finally {
-                publication.release();
-            }
-            RestoreBackupResult result = future.join();
-            assertTrue(Files.isDirectory(result.restoredWorldDirectory()));
-        }
-        assertFalse(publication.interrupted());
-    }
-
-    @Test
-    void postMaterializationFailureRollsBackAllPrivateAndPublishedTargets() throws IOException {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("rollback-worlds"));
-        BackupRecoveryService service = service(
-                new InMemoryCatalog(fixture.record()),
-                Map.of(DestinationType.ZIP, zip),
-                new MutableClock(CREATED_AT.plusSeconds(2)),
-                (directory, displayName) -> {
-                    throw new IOException("metadata finalizer failed");
-                });
-
-        CompletionException failure = assertThrows(CompletionException.class, () -> service
-                .restoreBackup(
-                        new RestoreBackupRequest(fixture.backupId(), worlds, "Rollback Copy"),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join());
-
-        assertInstanceOf(BackupRecoveryException.class, failure.getCause());
-        try (var children = Files.list(worlds)) {
-            assertEquals(0, children.count());
-        }
-    }
-
-    @Test
-    void restorePublicationRequiresAnAtomicMove() throws IOException {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("atomic-worlds"));
-        AtomicReference<List<CopyOption>> requestedOptions = new AtomicReference<>();
-        BackupRecoveryService service = service(
-                new InMemoryCatalog(fixture.record()),
-                Map.of(DestinationType.ZIP, zip),
-                new MutableClock(CREATED_AT.plusSeconds(2)),
-                (source, target, options) -> {
-                    requestedOptions.set(List.of(options));
-                    return Files.move(source, target, options);
-                });
-
-        RestoreBackupResult result = service.restoreBackup(
-                        new RestoreBackupRequest(fixture.backupId(), worlds, "Atomic Copy"),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-
-        assertEquals(List.of(StandardCopyOption.ATOMIC_MOVE), requestedOptions.get());
-        assertTrue(Files.isDirectory(result.restoredWorldDirectory()));
-    }
-
-    @Test
-    void unsupportedAtomicPublicationLeavesNoVisibleRestore() throws IOException {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("unsupported-atomic-worlds"));
-        BackupRecoveryService service = service(
-                new InMemoryCatalog(fixture.record()),
-                Map.of(DestinationType.ZIP, zip),
-                new MutableClock(CREATED_AT.plusSeconds(2)),
-                (source, target, options) -> {
-                    throw new AtomicMoveNotSupportedException(
-                            source.toString(), target.toString(), "simulated unsupported move");
-                });
-
-        assertRecoveryFailure(() -> service.restoreBackup(
-                        new RestoreBackupRequest(fixture.backupId(), worlds, "No Partial Copy"),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join());
-        try (var children = Files.list(worlds)) {
-            assertEquals(0, children.count());
-        }
-    }
-
-    @Test
-    void moveThenThrowIsReconciledByExactStagingIdentity() throws IOException {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("ambiguous-atomic-worlds"));
-        BackupRecoveryService service = service(
-                new InMemoryCatalog(fixture.record()),
-                Map.of(DestinationType.ZIP, zip),
-                new MutableClock(CREATED_AT.plusSeconds(2)),
-                (source, target, options) -> {
-                    Files.move(source, target, options);
-                    throw new IOException("simulated error after atomic publication");
-                });
-
-        RestoreBackupResult result = service.restoreBackup(
-                        new RestoreBackupRequest(
-                                fixture.backupId(), worlds, "Ambiguous Copy"),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join();
-
-        assertTrue(Files.isDirectory(result.restoredWorldDirectory()));
-        assertEquals("payload-ZIP", Files.readString(
-                result.restoredWorldDirectory().resolve("payload.txt")));
-        try (var children = Files.list(worlds)) {
-            List<Path> published = children.toList();
-            assertEquals(1, published.size());
-            assertTrue(Files.isSameFile(result.restoredWorldDirectory(), published.getFirst()));
-        }
-    }
-
-    @Test
-    void validationFailurePreservesUnrelatedReplacementTarget() throws IOException {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("replaced-target-worlds"));
-        Path displacedRestore = temporaryDirectory.resolve("displaced-restore");
-        AtomicReference<Path> replacement = new AtomicReference<>();
-        BackupRecoveryService service = service(
-                new InMemoryCatalog(fixture.record()),
-                Map.of(DestinationType.ZIP, zip),
-                new MutableClock(CREATED_AT.plusSeconds(2)),
-                (source, target, options) -> {
-                    Files.move(source, target, options);
-                    Files.move(target, displacedRestore);
-                    Files.createDirectory(target);
-                    Files.writeString(target.resolve("unrelated.txt"), "preserve me");
-                    replacement.set(target);
-                    return target;
-                });
-
-        assertRecoveryFailure(() -> service.restoreBackup(
-                        new RestoreBackupRequest(
-                                fixture.backupId(), worlds, "Replaced Target Copy"),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join());
-
-        Path unrelated = replacement.get();
-        assertTrue(Files.isDirectory(unrelated));
-        assertEquals("preserve me", Files.readString(unrelated.resolve("unrelated.txt")));
-        assertTrue(Files.isDirectory(displacedRestore));
-    }
-
-    @Test
-    void materializationReplacementIsNeverDeletedDuringCleanup() throws IOException {
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        zip.replaceStagingBeforeReturn = true;
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("replaced-staging-worlds"));
-        BackupRecoveryService service = service(
-                new InMemoryCatalog(fixture.record()),
-                Map.of(DestinationType.ZIP, zip),
-                new MutableClock(CREATED_AT.plusSeconds(2)));
-
-        assertRecoveryFailure(() -> service.restoreBackup(
-                        new RestoreBackupRequest(
-                                fixture.backupId(), worlds, "Replaced Staging Copy"),
-                        ProgressListener.NO_OP)
-                .toCompletableFuture().join());
-
-        try (var children = Files.list(worlds)) {
-            Path replacement = children.findFirst().orElseThrow();
-            assertEquals("preserve me", Files.readString(replacement.resolve("unrelated.txt")));
-        }
-    }
-
-    @Test
-    void windowsJunctionWorldsRootIsRejectedWithoutTouchingItsTarget() throws Exception {
-        Assumptions.assumeTrue(System.getProperty("os.name", "").startsWith("Windows"));
-        Fixture fixture = fixture(DestinationType.ZIP);
-        FakeDestination zip = new FakeDestination(DestinationType.ZIP, fixture.worldId());
-        Path outside = Files.createDirectory(temporaryDirectory.resolve("junction-outside"));
-        Path junction = temporaryDirectory.resolve("junction-worlds");
-        Process create = new ProcessBuilder(
-                        "cmd.exe", "/d", "/c", "mklink", "/J",
-                        junction.toString(), outside.toString())
-                .redirectOutput(ProcessBuilder.Redirect.DISCARD)
-                .redirectError(ProcessBuilder.Redirect.DISCARD)
-                .start();
-        boolean created = create.waitFor(10, TimeUnit.SECONDS)
-                && create.exitValue() == 0
-                && Files.exists(junction, java.nio.file.LinkOption.NOFOLLOW_LINKS);
-        Assumptions.assumeTrue(created, "Windows junction creation is unavailable");
-        try {
-            BackupRecoveryService service = service(
-                    new InMemoryCatalog(fixture.record()),
-                    Map.of(DestinationType.ZIP, zip),
-                    new MutableClock(CREATED_AT.plusSeconds(2)));
-
-            assertRecoveryFailure(() -> service.restoreBackup(
-                            new RestoreBackupRequest(
-                                    fixture.backupId(), junction, "Junction Copy"),
-                            ProgressListener.NO_OP)
-                    .toCompletableFuture().join());
-            try (var children = Files.list(outside)) {
-                assertEquals(0, children.count());
-            }
-        } finally {
-            Files.deleteIfExists(junction);
-        }
-    }
-
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/recovery/BackupRecoveryServiceTestSupport.java b/src/test/java/dev/ishaanko/worldarchive/recovery/BackupRecoveryServiceTestSupport.java
deleted file mode 100644
index 68753b3..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/recovery/BackupRecoveryServiceTestSupport.java
+++ /dev/null
@@ -1,560 +0,0 @@
-package dev.ishaanko.worldarchive.recovery;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertInstanceOf;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.catalog.BackupCatalog;
-import dev.ishaanko.worldarchive.config.WorldIdentityStore;
-import dev.ishaanko.worldarchive.core.LockingWorldOperationGate;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.DestinationHealth;
-import dev.ishaanko.worldarchive.model.DestinationHealthStatus;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.time.Clock;
-import java.time.Duration;
-import java.time.Instant;
-import java.time.ZoneId;
-import java.time.ZoneOffset;
-import java.util.ArrayList;
-import java.util.EnumMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.CompletionException;
-import java.util.concurrent.CompletionStage;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentMap;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.Executor;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.concurrent.atomic.AtomicInteger;
-import java.util.concurrent.atomic.AtomicReference;
-import java.util.function.Function;
-import java.util.function.UnaryOperator;
-import org.junit.jupiter.api.io.TempDir;
-
-abstract class BackupRecoveryServiceTestSupport {
-    static final Instant CREATED_AT = Instant.parse("2026-07-17T20:00:00Z");
-
-    @TempDir
-    Path temporaryDirectory;
-
-    BackupRecoveryService service(
-            InMemoryCatalog catalog,
-            Map<DestinationType, RecoveryDestination> destinations,
-            Clock clock) {
-        return service(
-                catalog,
-                destinations,
-                clock,
-                RestoredWorldMetadataFinalizer.NO_OP,
-                Runnable::run);
-    }
-
-    BackupRecoveryService service(
-            InMemoryCatalog catalog,
-            Map<DestinationType, RecoveryDestination> destinations,
-            Clock clock,
-            RestoredWorldMetadataFinalizer finalizer) {
-        return service(catalog, destinations, clock, finalizer, Runnable::run);
-    }
-
-    BackupRecoveryService service(
-            InMemoryCatalog catalog,
-            Map<DestinationType, RecoveryDestination> destinations,
-            Clock clock,
-            BackupRecoveryService.DirectoryMove directoryMove) {
-        return new BackupRecoveryService(
-                catalog,
-                destinations,
-                dev.ishaanko.worldarchive.catalog.BackupDeletionRegistry.NONE,
-                new WorldIdentityStore(),
-                RestoredWorldMetadataFinalizer.NO_OP,
-                Runnable::run,
-                clock,
-                BackupRecoveryService.DEFAULT_CONFIRMATION_LIFETIME,
-                new LockingWorldOperationGate(),
-                directoryMove);
-    }
-
-    BackupRecoveryService service(
-            InMemoryCatalog catalog,
-            Map<DestinationType, RecoveryDestination> destinations,
-            Clock clock,
-            RestoredWorldMetadataFinalizer finalizer,
-            java.util.concurrent.Executor executor) {
-        return service(
-                catalog,
-                destinations,
-                clock,
-                finalizer,
-                executor,
-                BackupRecoveryService.DEFAULT_CONFIRMATION_LIFETIME);
-    }
-
-    BackupRecoveryService service(
-            InMemoryCatalog catalog,
-            Map<DestinationType, RecoveryDestination> destinations,
-            Clock clock,
-            RestoredWorldMetadataFinalizer finalizer,
-            java.util.concurrent.Executor executor,
-            Duration confirmationLifetime) {
-        return new BackupRecoveryService(
-                catalog,
-                destinations,
-                new WorldIdentityStore(),
-                finalizer,
-                executor,
-                clock,
-                confirmationLifetime,
-                new LockingWorldOperationGate());
-    }
-
-    static EnumMap<DestinationType, RecoveryDestination> destinationMap(
-            FakeDestination git,
-            FakeDestination zip) {
-        EnumMap<DestinationType, RecoveryDestination> destinations =
-                new EnumMap<>(DestinationType.class);
-        destinations.put(git.destinationType(), git);
-        destinations.put(zip.destinationType(), zip);
-        return destinations;
-    }
-
-    static DestinationResult destination(BackupResult result, DestinationType type) {
-        return result.destinations().stream()
-                .filter(destination -> destination.destination() == type)
-                .findFirst()
-                .orElseThrow();
-    }
-
-    static void assertRecoveryFailure(Runnable operation) {
-        CompletionException failure = assertThrows(CompletionException.class, operation::run);
-        assertInstanceOf(BackupRecoveryException.class, failure.getCause());
-    }
-
-    static Fixture fixture(DestinationType... destinationTypes) {
-        return fixture(WorldId.create(), destinationTypes);
-    }
-
-    static Fixture fixture(WorldId worldId, DestinationType... destinationTypes) {
-        BackupId backupId = BackupId.create();
-        BackupManifest manifest = BackupManifest.create(
-                backupId,
-                worldId,
-                "Test World",
-                Optional.of("manual"),
-                CREATED_AT,
-                BackupTrigger.MANUAL,
-                2,
-                24,
-                2,
-                "a".repeat(64),
-                "b".repeat(64));
-        List<DestinationResult> destinations = new ArrayList<>();
-        for (DestinationType type : destinationTypes) {
-            String artifact = type == DestinationType.GIT
-                    ? "refs/heads/worldarchive/" + worldId + "/" + backupId
-                    : worldId + "/20260717T200000Z_" + backupId + ".zip";
-            destinations.add(DestinationResult.success(type, artifact));
-        }
-        BackupResult result = BackupResult.aggregate(
-                backupId, worldId, destinations, CREATED_AT.plusSeconds(1));
-        return new Fixture(worldId, backupId, new BackupRecord(manifest, result));
-    }
-
-    record Fixture(WorldId worldId, BackupId backupId, BackupRecord record) {
-        DestinationResult destination(DestinationType type) {
-            return BackupRecoveryServiceTestSupport.destination(record.result(), type);
-        }
-    }
-
-    static final class FakeDestination implements RecoveryDestination {
-        final DestinationType type;
-
-        final WorldId materializedWorldId;
-
-        final AtomicInteger activeMaterializations = new AtomicInteger();
-
-        final AtomicInteger maximumActiveMaterializations = new AtomicInteger();
-
-        final AtomicInteger materializeCalls = new AtomicInteger();
-
-        final AtomicInteger deleteCalls = new AtomicInteger();
-
-        final AtomicInteger verifyCalls = new AtomicInteger();
-
-        final AtomicInteger syncCalls = new AtomicInteger();
-
-        VerificationOutcome verification = VerificationOutcome.verified("verified");
-
-        IOException materializeFailure;
-
-        boolean deleteResult = true;
-
-        boolean pauseMaterialization;
-
-        boolean writeUnexpectedInternalMetadata;
-
-        boolean replaceStagingBeforeReturn;
-
-        BlockingStep verificationBlock;
-
-        BlockingStep materializationBlock;
-
-        BlockingStep deletionBlock;
-
-        BlockingStep syncBlock;
-
-        Function<Path, CompletionStage<Path>> nestedMaterialization;
-
-        DestinationResult syncResult;
-
-        List<DestinationType> calls = new ArrayList<>();
-
-        FakeDestination(DestinationType type, WorldId materializedWorldId) {
-            this.type = type;
-            this.materializedWorldId = materializedWorldId;
-        }
-
-        @Override
-        public DestinationType destinationType() {
-            return type;
-        }
-
-        @Override
-        public VerificationOutcome verify(
-                BackupRecord record,
-                DestinationResult destination) throws Exception {
-            verifyCalls.incrementAndGet();
-            if (verificationBlock != null) {
-                verificationBlock.block();
-            }
-            return verification;
-        }
-
-        @Override
-        public Materialization materialize(
-                BackupRecord record,
-                DestinationResult destination,
-                Path emptyTarget) throws Exception {
-            calls.add(type);
-            materializeCalls.incrementAndGet();
-            int active = activeMaterializations.incrementAndGet();
-            maximumActiveMaterializations.accumulateAndGet(active, Math::max);
-            try {
-                if (nestedMaterialization != null) {
-                    GitRecoveryDestination.awaitDrained(
-                            nestedMaterialization.apply(emptyTarget));
-                    return Materialization.preserved(emptyTarget);
-                }
-                if (materializationBlock != null) {
-                    materializationBlock.block();
-                }
-                if (materializeFailure != null) {
-                    throw materializeFailure;
-                }
-                if (replaceStagingBeforeReturn) {
-                    Files.delete(emptyTarget);
-                    Files.createDirectory(emptyTarget);
-                    Files.writeString(emptyTarget.resolve("unrelated.txt"), "preserve me");
-                    return Materialization.preserved(emptyTarget);
-                }
-                if (pauseMaterialization) {
-                    Thread.sleep(Duration.ofMillis(30));
-                }
-                if (writeUnexpectedInternalMetadata) {
-                    Path metadata = Files.createDirectories(emptyTarget.resolve(".worldarchive"));
-                    Files.writeString(
-                            metadata.resolve("world.json"),
-                            "{\"schemaVersion\":1,\"worldId\":\"" + materializedWorldId
-                                    + "\"}\n",
-                            StandardCharsets.UTF_8);
-                }
-                Files.writeString(
-                        emptyTarget.resolve("payload.txt"),
-                        "payload-" + type,
-                        StandardCharsets.UTF_8);
-                return Materialization.preserved(emptyTarget);
-            } finally {
-                activeMaterializations.decrementAndGet();
-            }
-        }
-
-        @Override
-        public boolean delete(
-                BackupRecord record,
-                DestinationResult destination) throws Exception {
-            deleteCalls.incrementAndGet();
-            if (deletionBlock != null) {
-                deletionBlock.block();
-            }
-            return deleteResult;
-        }
-
-        @Override
-        public DestinationResult sync(
-                BackupRecord record,
-                DestinationResult destination) throws Exception {
-            syncCalls.incrementAndGet();
-            if (syncBlock != null) {
-                syncBlock.block();
-            }
-            return syncResult == null ? destination : syncResult;
-        }
-
-        @Override
-        public DestinationHealth health(Optional<WorldId> worldId) {
-            return new DestinationHealth(
-                    type,
-                    DestinationHealthStatus.HEALTHY,
-                    type + " healthy",
-                    CREATED_AT.plusSeconds(2));
-        }
-    }
-
-    static final class InMemoryCatalog implements BackupCatalog {
-        final ConcurrentMap<BackupId, BackupRecord> records = new ConcurrentHashMap<>();
-
-        Runnable beforeUpdate;
-
-        Runnable afterUpdate;
-
-        InMemoryCatalog(BackupRecord... records) {
-            for (BackupRecord record : records) {
-                this.records.put(record.manifest().backupId(), record);
-            }
-        }
-
-        @Override
-        public void add(BackupRecord record) throws IOException {
-            BackupRecord old = records.putIfAbsent(record.manifest().backupId(), record);
-            if (old != null && !old.equals(record)) {
-                throw new IOException("conflicting record");
-            }
-        }
-
-        @Override
-        public Optional<BackupRecord> find(BackupId backupId) {
-            return Optional.ofNullable(records.get(backupId));
-        }
-
-        Optional<BackupRecord> findUnchecked(BackupId backupId) {
-            return find(backupId);
-        }
-
-        @Override
-        public List<BackupRecord> listAll() {
-            return List.copyOf(records.values());
-        }
-
-        @Override
-        public List<BackupRecord> list(WorldId worldId) {
-            return records.values().stream()
-                    .filter(record -> record.manifest().worldId().equals(worldId))
-                    .toList();
-        }
-
-        @Override
-        public synchronized Optional<BackupRecord> update(
-                BackupId backupId,
-                UnaryOperator<BackupRecord> update) {
-            BackupRecord existing = records.get(backupId);
-            if (existing == null) {
-                return Optional.empty();
-            }
-            if (beforeUpdate != null) {
-                beforeUpdate.run();
-            }
-            BackupRecord replacement = update.apply(existing);
-            records.put(backupId, replacement);
-            if (afterUpdate != null) {
-                afterUpdate.run();
-            }
-            return Optional.of(replacement);
-        }
-
-        @Override
-        public boolean remove(BackupId backupId) {
-            return records.remove(backupId) != null;
-        }
-    }
-
-    static final class BlockingStep {
-        final CountDownLatch entered = new CountDownLatch(1);
-
-        final CountDownLatch released = new CountDownLatch(1);
-
-        final AtomicBoolean interrupted = new AtomicBoolean();
-
-        void awaitEntered() throws InterruptedException {
-            assertTrue(entered.await(5, TimeUnit.SECONDS), "Blocking test step was not reached");
-        }
-
-        void release() {
-            released.countDown();
-        }
-
-        boolean interrupted() {
-            return interrupted.get();
-        }
-
-        boolean enteredWithin(long timeout, TimeUnit unit) throws InterruptedException {
-            return entered.await(timeout, unit);
-        }
-
-        void block() throws InterruptedException {
-            entered.countDown();
-            try {
-                if (!released.await(5, TimeUnit.SECONDS)) {
-                    throw new AssertionError("Blocking test step was not released");
-                }
-            } catch (InterruptedException exception) {
-                interrupted.set(true);
-                throw exception;
-            }
-        }
-
-        void blockForIo() throws IOException {
-            try {
-                block();
-            } catch (InterruptedException exception) {
-                Thread.currentThread().interrupt();
-                throw new IOException("Blocking I/O test step was interrupted", exception);
-            }
-        }
-
-        void blockUnchecked() {
-            try {
-                block();
-            } catch (InterruptedException exception) {
-                Thread.currentThread().interrupt();
-                throw new AssertionError("Catalog publication was interrupted", exception);
-            }
-        }
-    }
-
-    static final class DelayedInterruptExecutor implements Executor, AutoCloseable {
-        final CountDownLatch interruptEntered = new CountDownLatch(1);
-
-        final CountDownLatch releaseInterrupt = new CountDownLatch(1);
-
-        final CountDownLatch finished = new CountDownLatch(1);
-
-        final AtomicReference<Thread> worker = new AtomicReference<>();
-
-        @Override
-        public void execute(Runnable command) {
-            Thread thread = new Thread(() -> {
-                try {
-                    command.run();
-                } finally {
-                    finished.countDown();
-                }
-            }, "delayed-recovery-interrupt") {
-                @Override
-                public void interrupt() {
-                    interruptEntered.countDown();
-                    boolean interrupted = false;
-                    while (true) {
-                        try {
-                            releaseInterrupt.await();
-                            break;
-                        } catch (InterruptedException exception) {
-                            interrupted = true;
-                        }
-                    }
-                    super.interrupt();
-                    if (interrupted) {
-                        Thread.currentThread().interrupt();
-                    }
-                }
-            };
-            if (!worker.compareAndSet(null, thread)) {
-                throw new IllegalStateException("Delayed executor supports one task");
-            }
-            thread.start();
-        }
-
-        void awaitInterruptEntered() throws InterruptedException {
-            assertTrue(interruptEntered.await(5, TimeUnit.SECONDS));
-        }
-
-        void releaseInterrupt() {
-            releaseInterrupt.countDown();
-        }
-
-        void awaitFinished() throws InterruptedException {
-            assertTrue(finished.await(5, TimeUnit.SECONDS));
-        }
-
-        @Override
-        public void close() throws InterruptedException {
-            releaseInterrupt();
-            Thread thread = worker.get();
-            if (thread != null) {
-                thread.join(TimeUnit.SECONDS.toMillis(5));
-                assertFalse(thread.isAlive(), "Delayed executor worker did not finish");
-            }
-        }
-    }
-
-    static final class DrainAwareFuture<T> extends CompletableFuture<T> {
-        final CountDownLatch drainStarted = new CountDownLatch(1);
-
-        @Override
-        public T join() {
-            drainStarted.countDown();
-            return super.join();
-        }
-
-        void awaitDrainStarted() throws InterruptedException {
-            assertTrue(
-                    drainStarted.await(5, TimeUnit.SECONDS),
-                    "Interrupted materialization was not drained before cleanup");
-        }
-    }
-
-    static final class MutableClock extends Clock {
-        Instant instant;
-
-        MutableClock(Instant instant) {
-            this.instant = instant;
-        }
-
-        void advance(Duration duration) {
-            instant = instant.plus(duration);
-        }
-
-        @Override
-        public ZoneId getZone() {
-            return ZoneOffset.UTC;
-        }
-
-        @Override
-        public Clock withZone(ZoneId zone) {
-            if (!ZoneOffset.UTC.equals(zone)) {
-                throw new UnsupportedOperationException("Test clock only supports UTC");
-            }
-            return this;
-        }
-
-        @Override
-        public Instant instant() {
-            return instant;
-        }
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/recovery/CancellableTaskTest.java b/src/test/java/dev/ishaanko/worldarchive/recovery/CancellableTaskTest.java
new file mode 100644
index 0000000..e4b30a0
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/recovery/CancellableTaskTest.java
@@ -0,0 +1,89 @@
+package dev.ishaanko.worldarchive.recovery;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.util.concurrent.CancellationException;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicInteger;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+
+/** The cancellation contract of recovery operations: storage work that started always finishes first. */
+final class CancellableTaskTest {
+    private final ExecutorService executor = Executors.newVirtualThreadPerTaskExecutor();
+
+    @AfterEach
+    void stopExecutor() {
+        executor.shutdownNow();
+    }
+
+    @Test
+    void aCancelDuringACommitWaitsForItAndStopsAtTheNextCheckpoint() throws Exception {
+        CountDownLatch committing = new CountDownLatch(1);
+        CountDownLatch release = new CountDownLatch(1);
+        AtomicBoolean commitInterrupted = new AtomicBoolean();
+        AtomicInteger stepsAfterCommit = new AtomicInteger();
+        CancellableTask<String> task = new CancellableTask<>(self -> {
+            self.commitIfActive(() -> {
+                committing.countDown();
+                release.await();
+                commitInterrupted.set(Thread.currentThread().isInterrupted());
+                return null;
+            });
+            self.checkpoint();
+            stepsAfterCommit.incrementAndGet();
+            return "finished";
+        });
+        executor.execute(task);
+        assertTrue(committing.await(5, TimeUnit.SECONDS));
+
+        assertTrue(task.cancel(true));
+        assertFalse(task.isDone(), "the task completes only once the commit and the worker are done");
+        release.countDown();
+
+        assertThrows(CancellationException.class, () -> task.get(5, TimeUnit.SECONDS));
+        assertFalse(commitInterrupted.get());
+        assertEquals(0, stepsAfterCommit.get());
+        assertTrue(task.isCancelled());
+    }
+
+    @Test
+    void aTaskCancelledBeforeItStartsNeverRuns() {
+        AtomicBoolean ran = new AtomicBoolean();
+        CancellableTask<String> task = new CancellableTask<>(self -> {
+            ran.set(true);
+            return "ran";
+        });
+
+        assertTrue(task.cancel(true));
+        task.run();
+
+        assertTrue(task.isCancelled());
+        assertFalse(ran.get());
+    }
+
+    @Test
+    void afterThePointOfNoReturnCancelHasNoEffect() throws Exception {
+        CountDownLatch publishing = new CountDownLatch(1);
+        CountDownLatch release = new CountDownLatch(1);
+        CancellableTask<String> task = new CancellableTask<>(self -> self.pointOfNoReturn(() -> {
+            publishing.countDown();
+            release.await();
+            return "published";
+        }));
+        executor.execute(task);
+        assertTrue(publishing.await(5, TimeUnit.SECONDS));
+
+        assertFalse(task.cancel(true));
+        release.countDown();
+
+        assertEquals("published", task.get(5, TimeUnit.SECONDS));
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/recovery/GitRecoveryDestinationCancellationTest.java b/src/test/java/dev/ishaanko/worldarchive/recovery/GitRecoveryDestinationCancellationTest.java
deleted file mode 100644
index 5e07a58..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/recovery/GitRecoveryDestinationCancellationTest.java
+++ /dev/null
@@ -1,89 +0,0 @@
-package dev.ishaanko.worldarchive.recovery;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.SyncStatus;
-import dev.ishaanko.worldarchive.storage.git.GitSnapshotStore;
-import java.lang.reflect.Proxy;
-import java.util.Map;
-import java.util.concurrent.CancellationException;
-import java.util.concurrent.CompletionStage;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.TimeUnit;
-import org.junit.jupiter.api.Test;
-
-final class GitRecoveryDestinationCancellationTest
-        extends BackupRecoveryServiceTestSupport {
-    @Test
-    void cancellingSyncDrainsRemoteGitBeforeCatalogPublication() throws Exception {
-        Fixture fixture = fixture(DestinationType.GIT);
-        DrainAwareFuture<DestinationResult> remote = new DrainAwareFuture<>();
-        CountDownLatch syncRequested = new CountDownLatch(1);
-        CountDownLatch catalogUpdated = new CountDownLatch(1);
-        GitSnapshotStore backend = syncOnlyBackend(syncRequested, remote);
-        InMemoryCatalog catalog = new InMemoryCatalog(fixture.record());
-        catalog.afterUpdate = catalogUpdated::countDown;
-        MutableClock clock = new MutableClock(CREATED_AT.plusSeconds(2));
-
-        try (ExecutorService executor = Executors.newThreadPerTaskExecutor(
-                Thread.ofVirtual().factory())) {
-            BackupRecoveryService service = service(
-                    catalog,
-                    Map.of(
-                            DestinationType.GIT,
-                            new GitRecoveryDestination(backend, clock)),
-                    clock,
-                    RestoredWorldMetadataFinalizer.NO_OP,
-                    executor);
-            var future = service.syncBackup(
-                            fixture.backupId(),
-                            ProgressListener.NO_OP)
-                    .toCompletableFuture();
-            assertTrue(syncRequested.await(5, TimeUnit.SECONDS));
-
-            assertTrue(future.cancel(true));
-            remote.awaitDrainStarted();
-            assertFalse(catalogUpdated.await(250, TimeUnit.MILLISECONDS));
-
-            remote.complete(fixture.destination(DestinationType.GIT)
-                    .withSync(SyncStatus.SYNCED));
-            assertTrue(catalogUpdated.await(5, TimeUnit.SECONDS));
-            assertThrows(CancellationException.class, future::join);
-        }
-
-        BackupRecord persisted = catalog.findUnchecked(
-                        fixture.backupId())
-                .orElseThrow();
-        assertEquals(
-                SyncStatus.SYNCED,
-                destination(persisted.result(), DestinationType.GIT)
-                        .syncStatus());
-    }
-
-    private static GitSnapshotStore syncOnlyBackend(
-            CountDownLatch syncRequested,
-            CompletionStage<DestinationResult> remote) {
-        return (GitSnapshotStore) Proxy.newProxyInstance(
-                GitSnapshotStore.class.getClassLoader(),
-                new Class<?>[] {GitSnapshotStore.class},
-                (ignored, method, arguments) -> switch (method.getName()) {
-                    case "destinationType" -> DestinationType.GIT;
-                    case "syncSnapshot" -> {
-                        syncRequested.countDown();
-                        yield remote;
-                    }
-                    case "close" -> null;
-                    default -> throw new AssertionError(
-                            "Unexpected Git operation: " + method.getName());
-                });
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/recovery/RestoreWorkspaceTest.java b/src/test/java/dev/ishaanko/worldarchive/recovery/RestoreWorkspaceTest.java
index d1c5d47..1c088a8 100644
--- a/src/test/java/dev/ishaanko/worldarchive/recovery/RestoreWorkspaceTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/recovery/RestoreWorkspaceTest.java
@@ -1,32 +1,52 @@
 package dev.ishaanko.worldarchive.recovery;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
-import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.time.Clock;
+import java.util.Map;
+import java.util.stream.Stream;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
+/** The folder a restored world gets: a name that works everywhere, and never an existing folder. */
 final class RestoreWorkspaceTest {
     @TempDir
     Path temporaryDirectory;
 
     @Test
-    void creationFailureRemovesTheNewStagingDirectory() throws Exception {
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("worlds"));
-        RestoreWorkspace workspace = RestoreWorkspace.open(worlds, Files::move);
-
-        assertThrows(
-                IOException.class,
-                () -> workspace.createStaging(staging -> {
-                    Files.writeString(staging.resolve("partial.txt"), "partial");
-                    throw new IOException("simulated staging initialization failure");
-                }));
-
-        try (var children = Files.list(worlds)) {
-            assertEquals(0, children.count());
+    void aRequestedNameBecomesAFolderNameThatWorksOnEverySystem() {
+        Map<String, String> names = Map.of(
+                "My World", "My World",
+                "CON. ", "_CON",
+                "lpt1.backup", "_lpt1.backup",
+                "a/b\\c:d*e?f\"g<h>i|j", "a_b_c_d_e_f_g_h_i_j",
+                "trailing dots... ", "trailing dots",
+                "..", "Restored World",
+                "Ｆｕｌｌｗｉｄｔｈ", "Fullwidth",
+                "x".repeat(120), "x".repeat(96));
+
+        names.forEach((requested, folder) ->
+                assertEquals(folder, RestoreWorkspace.safeDirectoryName(requested), requested));
+    }
+
+    @Test
+    void aTakenNameGetsTheNextFreeNumberAndNoStagingFolderStays() throws Exception {
+        Path saves = Files.createDirectories(temporaryDirectory.resolve("saves"));
+        Files.createDirectory(saves.resolve("_CON"));
+        Files.createDirectory(saves.resolve("_CON (2)"));
+        RestoreWorkspace workspace = RestoreWorkspace.open(saves, Clock.systemUTC());
+        Path staging = workspace.createStaging();
+        Files.writeString(staging.resolve("level.dat"), "restored");
+
+        Path published = workspace.publish(staging, "CON. ", new CancellableTask<>(task -> null));
+
+        assertEquals(saves.toRealPath().resolve("_CON (3)"), published);
+        assertEquals("restored", Files.readString(published.resolve("level.dat")));
+        try (Stream<Path> children = Files.list(saves)) {
+            assertTrue(children.noneMatch(child -> child.getFileName().toString().startsWith(".worldarchive-restore-")));
         }
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/runtime/BackgroundBackupWarningsTest.java b/src/test/java/dev/ishaanko/worldarchive/runtime/BackgroundBackupWarningsTest.java
deleted file mode 100644
index 2c8ed85..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/runtime/BackgroundBackupWarningsTest.java
+++ /dev/null
@@ -1,121 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.time.Instant;
-import java.util.List;
-import org.junit.jupiter.api.Test;
-
-final class BackgroundBackupWarningsTest {
-    @Test
-    void scheduledPartialAndFailedResultsProduceCredentialSafeWarnings() {
-        BackupResult partial = result(List.of(
-                DestinationResult.success(DestinationType.ZIP, "archive"),
-                DestinationResult.failed(DestinationType.GIT, "https://user:secret@example.invalid")));
-        BackupResult failed = result(List.of(
-                DestinationResult.failed(DestinationType.GIT, "secret failure")));
-
-        assertEquals(
-                "Scheduled backup completed with warnings",
-                BackgroundBackupWarnings.scheduled(partial, null).orElseThrow());
-        assertEquals(
-                "Scheduled backup failed",
-                BackgroundBackupWarnings.scheduled(failed, null).orElseThrow());
-        assertEquals(
-                "World-exit backup completed with warnings",
-                BackgroundBackupWarnings.worldExit(partial, null).orElseThrow());
-        assertEquals(
-                "World-exit backup failed",
-                BackgroundBackupWarnings.worldExit(failed, null).orElseThrow());
-    }
-
-    @Test
-    void successfulAndSkippedBackgroundResultsDoNotWarn() {
-        BackupResult success = result(List.of(
-                DestinationResult.success(DestinationType.ZIP, "archive")));
-        BackupResult skipped = result(List.of());
-
-        assertTrue(BackgroundBackupWarnings.scheduled(success, null).isEmpty());
-        assertTrue(BackgroundBackupWarnings.scheduled(skipped, null).isEmpty());
-        assertTrue(BackgroundBackupWarnings.worldExit(success, null).isEmpty());
-        assertTrue(BackgroundBackupWarnings.worldExit(skipped, null).isEmpty());
-    }
-
-    @Test
-    void worldExitNoticeConfirmsSaveAndReportsBackupOutcome() {
-        BackupResult success = result(List.of(
-                DestinationResult.success(DestinationType.ZIP, "archive")));
-        BackupResult partial = result(List.of(
-                DestinationResult.success(DestinationType.ZIP, "archive"),
-                DestinationResult.failed(DestinationType.GIT, "sync failed")));
-        BackupResult failed = result(List.of(
-                DestinationResult.failed(DestinationType.GIT, "write failed")));
-        BackupResult skipped = result(List.of());
-
-        assertEquals(
-                "Creating backup... Keep Minecraft open until it finishes.",
-                BackgroundBackupWarnings.worldExitStartedMessage());
-        assertNotice(
-                "Backup finished. You can safely quit Minecraft.",
-                BackgroundBackupWarnings.NoticeSeverity.SUCCESS,
-                BackgroundBackupWarnings.worldExitNotice(success, null));
-        assertNotice(
-                "Backup created with warnings",
-                BackgroundBackupWarnings.NoticeSeverity.WARNING,
-                BackgroundBackupWarnings.worldExitNotice(partial, null));
-        assertNotice(
-                "Backup failed; world was saved",
-                BackgroundBackupWarnings.NoticeSeverity.ERROR,
-                BackgroundBackupWarnings.worldExitNotice(failed, null));
-        assertNotice(
-                "Backup skipped; world was saved",
-                BackgroundBackupWarnings.NoticeSeverity.WARNING,
-                BackgroundBackupWarnings.worldExitNotice(skipped, null));
-        assertNotice(
-                "World save or backup did not complete",
-                BackgroundBackupWarnings.NoticeSeverity.ERROR,
-                BackgroundBackupWarnings.worldExitNotice(
-                        null,
-                        new IllegalStateException("save failed")));
-    }
-
-    @Test
-    void cancelledBackupIsReportedWithoutAWarning() {
-        Throwable cancelled = new java.util.concurrent.CancellationException("Backup was cancelled");
-
-        assertTrue(BackgroundBackupWarnings.worldExit(null, cancelled).isEmpty());
-        assertTrue(BackgroundBackupWarnings.scheduled(null, cancelled).isEmpty());
-        assertNotice(
-                "Backup cancelled; world was saved",
-                BackgroundBackupWarnings.NoticeSeverity.WARNING,
-                BackgroundBackupWarnings.worldExitNotice(null, cancelled));
-        assertNotice(
-                "Backup cancelled; world was saved",
-                BackgroundBackupWarnings.NoticeSeverity.WARNING,
-                BackgroundBackupWarnings.worldExitNotice(
-                        null,
-                        new java.util.concurrent.CompletionException(cancelled)));
-    }
-
-    private static void assertNotice(
-            String message,
-            BackgroundBackupWarnings.NoticeSeverity severity,
-            BackgroundBackupWarnings.ExitNotice actual) {
-        assertEquals(message, actual.message());
-        assertEquals(severity, actual.severity());
-    }
-
-    private static BackupResult result(List<DestinationResult> destinations) {
-        return BackupResult.aggregate(
-                BackupId.create(),
-                WorldId.create(),
-                destinations,
-                Instant.parse("2026-07-17T12:00:00Z"));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/runtime/BackgroundNoticesTest.java b/src/test/java/dev/ishaanko/worldarchive/runtime/BackgroundNoticesTest.java
new file mode 100644
index 0000000..9005cd0
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/runtime/BackgroundNoticesTest.java
@@ -0,0 +1,61 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.WorldId;
+import java.time.Instant;
+import java.util.List;
+import java.util.Optional;
+import java.util.concurrent.CancellationException;
+import java.util.concurrent.CompletionException;
+import org.junit.jupiter.api.Test;
+
+final class BackgroundNoticesTest {
+    private static final BackupResult SUCCESS = result(DestinationResult.success(DestinationType.ZIP, "archive"));
+
+    private static final BackupResult PARTIAL = result(
+            DestinationResult.success(DestinationType.ZIP, "archive"),
+            DestinationResult.failed(DestinationType.GIT, "The remote refused the push"));
+
+    private static final BackupResult FAILED = result(DestinationResult.failed(DestinationType.GIT, "Disk full"));
+
+    private static final BackupResult SKIPPED = result();
+
+    @Test
+    void eachOutcomeHasOneSeverityAndOneText() {
+        assertNotice(Notice.Severity.SUCCESS, "exit_done", BackgroundNotices.exitOutcome(SUCCESS, null));
+        assertNotice(Notice.Severity.WARNING, "exit_warnings", BackgroundNotices.exitOutcome(PARTIAL, null));
+        assertNotice(Notice.Severity.ERROR, "exit_failed", BackgroundNotices.exitOutcome(FAILED, null));
+        assertNotice(Notice.Severity.WARNING, "exit_skipped", BackgroundNotices.exitOutcome(SKIPPED, null));
+        Notice notMade = BackgroundNotices.exitOutcome(null, new CompletionException(new IllegalStateException("No space")));
+        assertNotice(Notice.Severity.ERROR, "exit_not_made", notMade);
+        assertEquals(List.of("No space"), notMade.arguments());
+
+        assertEquals(Optional.empty(), BackgroundNotices.scheduledOutcome(SUCCESS, null));
+        assertEquals(Optional.empty(), BackgroundNotices.scheduledOutcome(SKIPPED, null));
+        assertNotice(Notice.Severity.WARNING, "scheduled_warnings", BackgroundNotices.scheduledOutcome(PARTIAL, null).orElseThrow());
+        assertNotice(Notice.Severity.WARNING, "scheduled_failed", BackgroundNotices.scheduledOutcome(FAILED, null).orElseThrow());
+    }
+
+    @Test
+    void aCancelIsThePlayersChoiceAndNeverAWarning() {
+        CompletionException cancelled = new CompletionException(new CancellationException("Backup was cancelled"));
+
+        assertTrue(BackgroundNotices.scheduledOutcome(null, cancelled).isEmpty());
+        assertNotice(Notice.Severity.WARNING, "exit_cancelled", BackgroundNotices.exitOutcome(null, cancelled));
+    }
+
+    private static void assertNotice(Notice.Severity severity, String key, Notice notice) {
+        assertEquals(severity, notice.severity());
+        assertEquals("screen.worldarchive.notice." + key, notice.key());
+    }
+
+    private static BackupResult result(DestinationResult... destinations) {
+        return new BackupResult(BackupId.create(), WorldId.create(), List.of(destinations), Instant.EPOCH);
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/runtime/ConfigurationGateTest.java b/src/test/java/dev/ishaanko/worldarchive/runtime/ConfigurationGateTest.java
new file mode 100644
index 0000000..f1fb033
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/runtime/ConfigurationGateTest.java
@@ -0,0 +1,51 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTimeoutPreemptively;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.time.Duration;
+import java.util.concurrent.atomic.AtomicInteger;
+import org.junit.jupiter.api.Test;
+
+final class ConfigurationGateTest {
+    /** Neither side waits: the render and server threads call the gate, and a wait there freezes the game. */
+    @Test
+    void workAndAFolderChangeRefuseEachOtherAtOnce() {
+        ConfigurationGate gate = new ConfigurationGate(() -> { });
+
+        assertTimeoutPreemptively(Duration.ofSeconds(5), () -> {
+            ConfigurationGate.Permit backup = gate.enterWork();
+            assertThrows(IllegalStateException.class, gate::enterFolderChange);
+            backup.close();
+
+            ConfigurationGate.Permit change = gate.enterFolderChange();
+            assertThrows(IllegalStateException.class, gate::enterWork);
+            // The first catalog scan of the new folders belongs to the change itself.
+            ConfigurationGate.Permit scan = gate.enterSettingsWork();
+            change.close();
+            assertThrows(IllegalStateException.class, gate::enterFolderChange);
+            scan.close();
+            gate.enterFolderChange().close();
+        });
+    }
+
+    @Test
+    void theLastPermitRunsTheIdleCallbackAndEndsTheQuitWait() throws InterruptedException {
+        AtomicInteger idle = new AtomicInteger();
+        ConfigurationGate gate = new ConfigurationGate(idle::incrementAndGet);
+        ConfigurationGate.Permit first = gate.enterWork();
+        ConfigurationGate.Permit second = gate.enterWork();
+
+        first.close();
+        first.close();
+        assertEquals(0, idle.get());
+        assertFalse(gate.awaitIdle(Duration.ofMillis(50)));
+        Thread.startVirtualThread(second::close);
+
+        assertTrue(gate.awaitIdle(Duration.ofSeconds(5)));
+        assertEquals(1, idle.get());
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/runtime/LiveBackupSaveGateTest.java b/src/test/java/dev/ishaanko/worldarchive/runtime/LiveBackupSaveGateTest.java
deleted file mode 100644
index a5699ce..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/runtime/LiveBackupSaveGateTest.java
+++ /dev/null
@@ -1,132 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertSame;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import org.junit.jupiter.api.Test;
-
-final class LiveBackupSaveGateTest {
-    @Test
-    void requestedSaveConsumesOnlyOwnedArmedFlushAndForceEvent() {
-        LiveBackupSaveGate<Object, Object> gate = new LiveBackupSaveGate<>();
-        Object server = new Object();
-        Object otherServer = new Object();
-        Object requested = new Object();
-
-        assertTrue(gate.queueRequested(server, requested));
-        assertTrue(gate.observeRequestedSave(server, true, true).isEmpty());
-        assertTrue(gate.armRequested(server, requested));
-        assertTrue(gate.observeRequestedSave(otherServer, true, true).isEmpty());
-        assertTrue(gate.observeRequestedSave(server, false, true).isEmpty());
-        assertTrue(gate.observeRequestedSave(server, true, false).isEmpty());
-        assertSame(requested, gate.observeRequestedSave(server, true, true).orElseThrow());
-        assertFalse(gate.hasPending());
-    }
-
-    @Test
-    void exitSaveWaitsForServerStopAndDispatchesExactlyOnce() {
-        LiveBackupSaveGate<Object, Object> gate = new LiveBackupSaveGate<>();
-        Object server = new Object();
-        Object exit = new Object();
-
-        LiveBackupSaveGate.ExitInstall<Object> installed = gate.installExit(server, exit);
-        assertTrue(installed.installed());
-        assertTrue(installed.displaced().isEmpty());
-        assertFalse(gate.installExit(server, new Object()).installed());
-        assertTrue(gate.observeExitSave(server, true, false));
-        assertTrue(gate.observeExitSave(server, true, false));
-        assertTrue(gate.hasPending());
-
-        LiveBackupSaveGate.StopResult<Object> stopped = gate.stop(server);
-        assertEquals(LiveBackupSaveGate.StopKind.EXIT_READY, stopped.kind());
-        assertSame(exit, stopped.value().orElseThrow());
-        assertEquals(LiveBackupSaveGate.StopKind.NONE, gate.stop(server).kind());
-        assertFalse(gate.hasPending());
-    }
-
-    @Test
-    void exitWithoutFinalSaveFailsClosedAtServerStop() {
-        LiveBackupSaveGate<Object, Object> gate = new LiveBackupSaveGate<>();
-        Object server = new Object();
-        Object exit = new Object();
-
-        assertTrue(gate.installExit(server, exit).installed());
-        LiveBackupSaveGate.StopResult<Object> stopped = gate.stop(server);
-
-        assertEquals(LiveBackupSaveGate.StopKind.EXIT_MISSING_SAVE, stopped.kind());
-        assertSame(exit, stopped.value().orElseThrow());
-        assertFalse(gate.hasPending());
-    }
-
-    @Test
-    void mismatchedFinalSavesRemainMissingAndFailClosed() {
-        for (SaveEvent event : new SaveEvent[] {
-            new SaveEvent(false, false),
-            new SaveEvent(true, true)
-        }) {
-            LiveBackupSaveGate<Object, Object> gate = new LiveBackupSaveGate<>();
-            Object server = new Object();
-            Object exit = new Object();
-
-            assertTrue(gate.installExit(server, exit).installed());
-            assertFalse(gate.observeExitSave(
-                    server, event.flush(), event.force()));
-            LiveBackupSaveGate.StopResult<Object> stopped = gate.stop(server);
-            assertEquals(LiveBackupSaveGate.StopKind.EXIT_MISSING_SAVE, stopped.kind());
-            assertSame(exit, stopped.value().orElseThrow());
-        }
-    }
-
-    @Test
-    void newServerCallbacksCannotStealOrClearOldExit() {
-        LiveBackupSaveGate<Object, Object> gate = new LiveBackupSaveGate<>();
-        Object oldServer = new Object();
-        Object newServer = new Object();
-        Object oldExit = new Object();
-
-        assertTrue(gate.installExit(oldServer, oldExit).installed());
-        assertFalse(gate.installExit(newServer, new Object()).installed());
-        assertFalse(gate.observeExitSave(newServer, true, false));
-        assertEquals(LiveBackupSaveGate.StopKind.NONE, gate.stop(newServer).kind());
-        assertTrue(gate.ownedBy(oldServer));
-
-        assertTrue(gate.observeExitSave(oldServer, true, false));
-        LiveBackupSaveGate.StopResult<Object> stopped = gate.stop(oldServer);
-        assertEquals(LiveBackupSaveGate.StopKind.EXIT_READY, stopped.kind());
-        assertSame(oldExit, stopped.value().orElseThrow());
-    }
-
-    @Test
-    void sameServerExitReplacesRequestedSave() {
-        for (String trigger : new String[] {"manual", "scheduled"}) {
-            LiveBackupSaveGate<Object, String> gate = new LiveBackupSaveGate<>();
-            Object server = new Object();
-
-            assertTrue(gate.queueRequested(server, trigger));
-            LiveBackupSaveGate.ExitInstall<String> installed = gate.installExit(server, "exit");
-            assertTrue(installed.installed());
-            assertSame(trigger, installed.displaced().orElseThrow());
-            assertFalse(gate.armRequested(server, trigger));
-            assertTrue(gate.observeExitSave(server, true, false));
-            assertSame("exit", gate.stop(server).value().orElseThrow());
-        }
-    }
-
-    @Test
-    void requestedSaveIsReportedAbandonedAtOwnedServerStop() {
-        LiveBackupSaveGate<Object, Object> gate = new LiveBackupSaveGate<>();
-        Object server = new Object();
-        Object requested = new Object();
-
-        assertTrue(gate.queueRequested(server, requested));
-        LiveBackupSaveGate.StopResult<Object> stopped = gate.stop(server);
-
-        assertEquals(LiveBackupSaveGate.StopKind.REQUEST_ABANDONED, stopped.kind());
-        assertSame(requested, stopped.value().orElseThrow());
-    }
-
-    private record SaveEvent(boolean flush, boolean force) {
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/runtime/RestoredWorldTransitionTest.java b/src/test/java/dev/ishaanko/worldarchive/runtime/RestoredWorldTransitionTest.java
deleted file mode 100644
index aaa3028..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/runtime/RestoredWorldTransitionTest.java
+++ /dev/null
@@ -1,56 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-
-import java.util.ArrayList;
-import java.util.List;
-import org.junit.jupiter.api.Test;
-
-final class RestoredWorldTransitionTest {
-    @Test
-    void disconnectsActiveWorldBeforeContinuing() {
-        List<String> events = new ArrayList<>();
-
-        RestoredWorldTransition.afterLeavingActiveWorld(
-                () -> {
-                    events.add("active");
-                    return true;
-                },
-                () -> events.add("disconnect"),
-                leftActiveWorld -> events.add("continue:" + leftActiveWorld));
-
-        assertEquals(List.of("active", "disconnect", "continue:true"), events);
-    }
-
-    @Test
-    void continuesWithoutDisconnectWhenNoWorldIsActive() {
-        List<String> events = new ArrayList<>();
-
-        RestoredWorldTransition.afterLeavingActiveWorld(
-                () -> false,
-                () -> events.add("disconnect"),
-                leftActiveWorld -> events.add("continue:" + leftActiveWorld));
-
-        assertEquals(List.of("continue:false"), events);
-    }
-
-    @Test
-    void doesNotContinueWhenDisconnectFails() {
-        List<String> events = new ArrayList<>();
-        IllegalStateException failure = new IllegalStateException("disconnect failed");
-
-        IllegalStateException thrown = assertThrows(
-                IllegalStateException.class,
-                () -> RestoredWorldTransition.afterLeavingActiveWorld(
-                        () -> true,
-                        () -> {
-                            events.add("disconnect");
-                            throw failure;
-                        },
-                        ignored -> events.add("continue")));
-
-        assertEquals(failure, thrown);
-        assertEquals(List.of("disconnect"), events);
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/runtime/RetryGateTest.java b/src/test/java/dev/ishaanko/worldarchive/runtime/RetryGateTest.java
deleted file mode 100644
index 17f58d7..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/runtime/RetryGateTest.java
+++ /dev/null
@@ -1,45 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertSame;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.time.Duration;
-import org.junit.jupiter.api.Test;
-
-final class RetryGateTest {
-    @Test
-    void retriesAfterDelayWithoutOverlappingAttempts() {
-        RetryGate<Object> gate = new RetryGate<>(Duration.ofSeconds(1));
-        Object owner = new Object();
-
-        RetryGate.Attempt<Object> first = gate.tryStart(owner, 10L).orElseThrow();
-
-        assertSame(owner, first.owner());
-        assertTrue(gate.tryStart(owner, 20L).isEmpty());
-        assertTrue(gate.complete(first));
-        assertTrue(gate.tryStart(owner, 999_999_999L).isEmpty());
-        assertTrue(gate.tryStart(owner, 1_000_000_010L).isPresent());
-    }
-
-    @Test
-    void resetRejectsAStaleCompletionWithoutClearingTheNewAttempt() {
-        RetryGate<Object> gate = new RetryGate<>(Duration.ZERO);
-        RetryGate.Attempt<Object> stale = gate.tryStart(new Object(), 1L).orElseThrow();
-        gate.reset();
-        RetryGate.Attempt<Object> current = gate.tryStart(new Object(), 1L).orElseThrow();
-
-        assertFalse(gate.complete(stale));
-        assertTrue(gate.tryStart(new Object(), 1L).isEmpty());
-        assertTrue(gate.complete(current));
-    }
-
-    @Test
-    void resetAllowsAnAttemptWhenNanoTimeIsNegative() {
-        RetryGate<Object> gate = new RetryGate<>(Duration.ofSeconds(1));
-
-        gate.reset();
-
-        assertTrue(gate.tryStart(new Object(), Long.MIN_VALUE).isPresent());
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeActionContextRegistryTest.java b/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeActionContextRegistryTest.java
deleted file mode 100644
index dc9a406..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeActionContextRegistryTest.java
+++ /dev/null
@@ -1,50 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.ui.BackupWorldContext;
-import java.nio.file.Path;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-final class RuntimeActionContextRegistryTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void actionOnlyContextNeverOffersSourceWorldActions() {
-        RuntimeActionContextRegistry registry = new RuntimeActionContextRegistry();
-        Path worlds = temporaryDirectory.resolve("saves");
-        BackupWorldContext missing = context(
-                WorldId.create(),
-                worlds,
-                "missing-world");
-        BackupWorldContext available = context(
-                WorldId.create(),
-                worlds,
-                "available-world");
-
-        registry.markActionOnly(missing);
-
-        assertFalse(registry.sourceActionsAllowed(missing));
-        assertTrue(registry.sourceActionsAllowed(available));
-
-        registry.allowSourceActions(missing);
-
-        assertTrue(registry.sourceActionsAllowed(missing));
-    }
-
-    private static BackupWorldContext context(
-            WorldId worldId,
-            Path worlds,
-            String storageName) {
-        return new BackupWorldContext(
-                worldId,
-                worlds.resolve(storageName),
-                worlds,
-                storageName,
-                "World");
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupWorldsTest.java b/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupWorldsTest.java
deleted file mode 100644
index afe6e05..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeBackupWorldsTest.java
+++ /dev/null
@@ -1,15 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import org.junit.jupiter.api.Test;
-
-final class RuntimeBackupWorldsTest {
-    @Test
-    void hidesOnlyMissingWorldsWithoutBackups() {
-        assertTrue(RuntimeBackupWorlds.shouldInclude(true, 0));
-        assertTrue(RuntimeBackupWorlds.shouldInclude(false, 1));
-        assertFalse(RuntimeBackupWorlds.shouldInclude(false, 0));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeConfigurationGateTest.java b/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeConfigurationGateTest.java
deleted file mode 100644
index 38655a8..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeConfigurationGateTest.java
+++ /dev/null
@@ -1,160 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTimeoutPreemptively;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.time.Duration;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicInteger;
-import java.util.concurrent.atomic.AtomicReference;
-import org.junit.jupiter.api.Test;
-
-final class RuntimeConfigurationGateTest {
-    @Test
-    void idleCallbackRunsOnlyAfterTheLastRetainedOperationFinishes() {
-        AtomicInteger callbacks = new AtomicInteger();
-        RuntimeConfigurationGate gate = new RuntimeConfigurationGate(callbacks::incrementAndGet);
-        RuntimeConfigurationGate.Permit first = gate.retainStateWork();
-        RuntimeConfigurationGate.Permit second = gate.retainStateWork();
-
-        first.close();
-        assertEquals(0, callbacks.get());
-        second.close();
-        assertEquals(1, callbacks.get());
-    }
-
-    @Test
-    void rejectsPathTransactionWhileBackupPublicationIsActive() {
-        RuntimeConfigurationGate gate = new RuntimeConfigurationGate();
-        RuntimeConfigurationGate.Permit backup = gate.enterBackup();
-
-        assertThrows(
-                IllegalStateException.class,
-                gate::tryEnterConfigurationChange);
-
-        backup.close();
-        RuntimeConfigurationGate.Permit configuration = assertDoesNotThrow(
-                gate::tryEnterConfigurationChange);
-        configuration.close();
-    }
-
-    @Test
-    void permitsMayCloseOnAnAsyncCompletionThread() throws InterruptedException {
-        RuntimeConfigurationGate gate = new RuntimeConfigurationGate();
-        RuntimeConfigurationGate.Permit backup = gate.enterBackup();
-
-        Thread.startVirtualThread(backup::close).join();
-
-        RuntimeConfigurationGate.Permit configuration = assertDoesNotThrow(
-                gate::tryEnterConfigurationChange);
-        configuration.close();
-    }
-
-    @Test
-    void atomicallyTransitionsCompletedBackupIntoConfigurationTransaction() {
-        RuntimeConfigurationGate gate = new RuntimeConfigurationGate();
-        RuntimeConfigurationGate.Permit backup = gate.enterBackup();
-
-        RuntimeConfigurationGate.Permit configuration =
-                gate.transitionBackupToConfigurationChange(backup);
-        assertThrows(IllegalStateException.class, gate::tryEnterConfigurationChange);
-
-        configuration.close();
-        assertDoesNotThrow(gate::enterBackup).close();
-    }
-
-    @Test
-    void concurrentCompletedBackupsDrainAndRegisterSequentially() throws InterruptedException {
-        RuntimeConfigurationGate gate = new RuntimeConfigurationGate();
-        RuntimeConfigurationGate.Permit firstBackup = gate.enterBackup();
-        RuntimeConfigurationGate.Permit secondBackup = gate.enterBackup();
-        CountDownLatch firstConfigurationAcquired = new CountDownLatch(1);
-        CountDownLatch releaseFirstConfiguration = new CountDownLatch(1);
-        AtomicInteger acquisitionOrder = new AtomicInteger();
-        AtomicReference<Throwable> failure = new AtomicReference<>();
-
-        Thread first = transitionThread(
-                gate,
-                firstBackup,
-                acquisitionOrder,
-                firstConfigurationAcquired,
-                releaseFirstConfiguration,
-                failure);
-        Thread second = transitionThread(
-                gate,
-                secondBackup,
-                acquisitionOrder,
-                firstConfigurationAcquired,
-                releaseFirstConfiguration,
-                failure);
-
-        first.start();
-        second.start();
-        assertTimeoutPreemptively(
-                Duration.ofSeconds(2),
-                () -> assertTrue(firstConfigurationAcquired.await(2, TimeUnit.SECONDS)));
-        releaseFirstConfiguration.countDown();
-        first.join(Duration.ofSeconds(2));
-        second.join(Duration.ofSeconds(2));
-
-        assertFalse(first.isAlive());
-        assertFalse(second.isAlive());
-        assertEquals(2, acquisitionOrder.get());
-        assertNull(failure.get());
-        assertDoesNotThrow(gate::enterBackup).close();
-    }
-
-    @Test
-    void blockingConfigurationEntryWaitsForActiveBackup() throws InterruptedException {
-        RuntimeConfigurationGate gate = new RuntimeConfigurationGate();
-        RuntimeConfigurationGate.Permit backup = gate.enterBackup();
-        CountDownLatch configurationAcquired = new CountDownLatch(1);
-        CountDownLatch releaseConfiguration = new CountDownLatch(1);
-        AtomicReference<Throwable> failure = new AtomicReference<>();
-        Thread configuration = Thread.ofVirtual().unstarted(() -> {
-            try (RuntimeConfigurationGate.Permit ignored = gate.enterConfigurationChange()) {
-                configurationAcquired.countDown();
-                releaseConfiguration.await();
-            } catch (Throwable throwable) {
-                failure.set(throwable);
-            }
-        });
-
-        configuration.start();
-        assertFalse(configurationAcquired.await(100, TimeUnit.MILLISECONDS));
-        backup.close();
-        assertTrue(configurationAcquired.await(2, TimeUnit.SECONDS));
-        releaseConfiguration.countDown();
-        configuration.join(Duration.ofSeconds(2));
-
-        assertFalse(configuration.isAlive());
-        assertNull(failure.get());
-        assertDoesNotThrow(gate::enterBackup).close();
-    }
-
-    private static Thread transitionThread(
-            RuntimeConfigurationGate gate,
-            RuntimeConfigurationGate.Permit backup,
-            AtomicInteger acquisitionOrder,
-            CountDownLatch firstConfigurationAcquired,
-            CountDownLatch releaseFirstConfiguration,
-            AtomicReference<Throwable> failure) {
-        return Thread.ofVirtual().unstarted(() -> {
-            try (RuntimeConfigurationGate.Permit configuration =
-                    gate.transitionBackupToConfigurationChange(backup)) {
-                if (acquisitionOrder.incrementAndGet() == 1) {
-                    firstConfigurationAcquired.countDown();
-                    releaseFirstConfiguration.await();
-                }
-            } catch (Throwable throwable) {
-                failure.compareAndSet(null, throwable);
-            }
-        });
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationPathGuardTest.java b/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationPathGuardTest.java
index 8d1b4ea..353fb39 100644
--- a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationPathGuardTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationPathGuardTest.java
@@ -3,61 +3,69 @@
 import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.BackupRecord;
+import dev.ishaanko.worldarchive.model.BackupResult;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.WorldId;
 import java.nio.file.Path;
+import java.time.Instant;
 import java.util.List;
+import java.util.Map;
+import java.util.Optional;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
 final class RuntimeDestinationPathGuardTest {
+    private final WorldId north = WorldId.create();
+
+    private final WorldId south = WorldId.create();
+
     @TempDir
-    Path temporaryDirectory;
+    Path folder;
 
     @Test
-    void rejectsGitRootChangeForSuccessOrPendingSyncArtifacts() {
-        RuntimeStoragePaths current = paths("old.git", "archives");
-        RuntimeStoragePaths replacement = paths("new.git", "archives");
-
-        assertThrows(
-                IllegalArgumentException.class,
-                () -> RuntimeDestinationPathGuard.requireAllowed(
-                        current,
-                        replacement,
-                        List.of(DestinationResult.success(DestinationType.GIT, "git-ref"))));
-        assertThrows(
-                IllegalArgumentException.class,
-                () -> RuntimeDestinationPathGuard.requireAllowed(
-                        current,
-                        replacement,
-                        List.of(DestinationResult.pendingSync(
-                                DestinationType.GIT,
-                                "git-ref",
-                                "Remote synchronization is pending"))));
+    void theGitFolderStaysWhileItHoldsAListedCopy() {
+        RuntimeStoragePaths current = paths("old.git", "archives", Map.of());
+        RuntimeStoragePaths moved = paths("new.git", "archives", Map.of());
+
+        assertThrows(IllegalArgumentException.class, () -> RuntimeDestinationPathGuard.requireAllowed(
+                current, moved, List.of(record(north, DestinationResult.success(DestinationType.GIT, "ref")))));
+        assertThrows(IllegalArgumentException.class, () -> RuntimeDestinationPathGuard.requireAllowed(
+                current, moved, List.of(record(north, DestinationResult.pendingSync(
+                        DestinationType.GIT, "ref", "The upload waits for the remote")))));
+        assertDoesNotThrow(() -> RuntimeDestinationPathGuard.requireAllowed(
+                current, moved, List.of(record(north, DestinationResult.failed(DestinationType.GIT, "No Git")))));
     }
 
+    /** A world with its own ZIP folder keeps its backups there, so only that folder is held in place for it. */
     @Test
-    void rejectsZipRootChangeOnlyWhenDurableZipArtifactsDependOnIt() {
-        RuntimeStoragePaths current = paths("repo.git", "old-archives");
-        RuntimeStoragePaths replacement = paths("repo.git", "new-archives");
-
-        assertThrows(
-                IllegalArgumentException.class,
-                () -> RuntimeDestinationPathGuard.requireAllowed(
-                        current,
-                        replacement,
-                        List.of(DestinationResult.success(DestinationType.ZIP, "world/archive.zip"))));
+    void eachZipFolderStaysWhileItHoldsAListedCopyOfItsWorlds() {
+        RuntimeStoragePaths current = paths("repo.git", "shared", Map.of(south, folder.resolve("south")));
+        List<BackupRecord> records = List.of(
+                record(north, DestinationResult.success(DestinationType.ZIP, north + "/north.zip")),
+                record(south, DestinationResult.success(DestinationType.ZIP, south + "/south.zip")));
+
+        assertThrows(IllegalArgumentException.class, () -> RuntimeDestinationPathGuard.requireAllowed(
+                current, paths("repo.git", "shared", Map.of(south, folder.resolve("elsewhere"))), records));
+        assertThrows(IllegalArgumentException.class, () -> RuntimeDestinationPathGuard.requireAllowed(
+                current, paths("repo.git", "moved", Map.of(south, folder.resolve("south"))), records));
         assertDoesNotThrow(() -> RuntimeDestinationPathGuard.requireAllowed(
-                current,
-                replacement,
-                List.of(
-                        DestinationResult.success(DestinationType.GIT, "git-ref"),
-                        DestinationResult.failed(DestinationType.ZIP, "Archive creation failed"))));
+                current, paths("repo.git", "moved", Map.of(south, folder.resolve("south"))), records.subList(1, 2)));
+    }
+
+    private RuntimeStoragePaths paths(String git, String zip, Map<WorldId, Path> worldZip) {
+        return new RuntimeStoragePaths(folder.resolve(git), folder.resolve(zip), worldZip);
     }
 
-    private RuntimeStoragePaths paths(String git, String zip) {
-        return new RuntimeStoragePaths(
-                temporaryDirectory.resolve(git),
-                temporaryDirectory.resolve(zip));
+    private static BackupRecord record(WorldId worldId, DestinationResult destination) {
+        Instant createdAt = Instant.parse("2026-09-01T12:00:00Z");
+        String digest = "0".repeat(64);
+        BackupManifest manifest = new BackupManifest(BackupManifest.CURRENT_FORMAT_VERSION, BackupId.create(), worldId,
+                "World", Optional.empty(), createdAt, BackupTrigger.MANUAL, 1, 1, 1, digest, digest, Optional.empty());
+        return new BackupRecord(manifest, new BackupResult(manifest.backupId(), worldId, List.of(destination), createdAt));
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationSelectorTest.java b/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationSelectorTest.java
index b0e158c..c15b494 100644
--- a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationSelectorTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeDestinationSelectorTest.java
@@ -9,16 +9,14 @@
 import dev.ishaanko.worldarchive.core.BackupCapture;
 import dev.ishaanko.worldarchive.core.ConfiguredBackupDestinationSelector;
 import dev.ishaanko.worldarchive.core.CreateBackupRequest;
-import dev.ishaanko.worldarchive.core.ProgressListener;
 import dev.ishaanko.worldarchive.model.BackupTrigger;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.ProgressListener;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.nio.file.Path;
 import java.util.List;
 import java.util.Optional;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.CompletionStage;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
@@ -44,22 +42,22 @@ void keepsZipAvailableWhileGitToolsAreMissingOrStillBeingChecked() {
         assertEquals(List.of(DestinationType.ZIP), types(selector.select(request)));
         assertTrue(selector.warning().isEmpty());
 
-        selector.gitToolsAvailable(false);
+        selector.gitTools(RuntimeDestinationSelector.GitTools.MISSING);
         assertEquals(List.of(DestinationType.ZIP), types(selector.select(request)));
         assertTrue(selector.hasConfiguredDestination(request));
         assertTrue(selector.warning().isPresent());
 
-        selector.gitToolsAvailable(true);
+        selector.gitTools(RuntimeDestinationSelector.GitTools.AVAILABLE);
         assertEquals(
                 List.of(DestinationType.GIT, DestinationType.ZIP),
                 types(selector.select(request)));
         assertTrue(selector.warning().isEmpty());
 
-        selector.gitToolsAvailable(false);
+        selector.gitTools(RuntimeDestinationSelector.GitTools.CHECK_FAILED);
         assertEquals(List.of(DestinationType.ZIP), types(selector.select(request)));
         assertTrue(selector.warning().isPresent());
 
-        selector.gitDisabled();
+        selector.gitTools(RuntimeDestinationSelector.GitTools.TURNED_OFF);
         assertEquals(List.of(DestinationType.ZIP), types(selector.select(request)));
         assertFalse(selector.warning().isPresent());
     }
@@ -76,12 +74,10 @@ public DestinationType destinationType() {
             }
 
             @Override
-            public CompletionStage<DestinationResult> createBackup(
+            public DestinationResult createBackup(
                     BackupCapture capture,
                     ProgressListener progressListener) {
-                return CompletableFuture.completedFuture(DestinationResult.success(
-                        destination,
-                        destination.name().toLowerCase()));
+                return DestinationResult.success(destination, destination.name().toLowerCase());
             }
         };
     }
diff --git a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeNoticeStoreTest.java b/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeNoticeStoreTest.java
index 17d099f..8ced9a6 100644
--- a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeNoticeStoreTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeNoticeStoreTest.java
@@ -1,39 +1,45 @@
 package dev.ishaanko.worldarchive.runtime;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import java.io.IOException;
 import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
 final class RuntimeNoticeStoreTest {
     @TempDir
-    Path temporaryDirectory;
+    Path folder;
 
+    /** A notice kept at quit is shown at the next start, and forgotten only once the display took it. */
     @Test
-    void warningSurvivesStoreReopenUntilCleared() throws IOException {
-        Path file = temporaryDirectory.resolve("runtime/last-warning.txt");
-        RuntimeNoticeStore store = new RuntimeNoticeStore(file);
-
-        store.save("World-exit backup failed");
-
-        assertEquals(
-                "World-exit backup failed",
-                new RuntimeNoticeStore(file).load().orElseThrow());
-        store.clear();
-        assertTrue(store.load().isEmpty());
+    void aKeptNoticeIsShownOnceAfterARestartAndSurvivesADisplayThatFails() throws IOException {
+        Path file = folder.resolve("worldarchive/last-background-warning.txt");
+        new RuntimeNoticeStore(file).keep(BackgroundNotices.exitNotMade("The drive is full"));
+        RuntimeNoticeStore afterRestart = new RuntimeNoticeStore(file);
+
+        assertThrows(IllegalStateException.class, () -> afterRestart.showKept(notice -> {
+            throw new IllegalStateException("The toast could not be shown");
+        }));
+        List<Notice> shown = new ArrayList<>();
+        afterRestart.showKept(shown::add);
+        afterRestart.showKept(shown::add);
+
+        assertEquals(List.of(BackgroundNotices.exitNotMade("The drive is full")), shown);
     }
 
     @Test
-    void laterOutcomesCannotEraseOrReplaceAnUnacknowledgedWarning() throws IOException {
-        RuntimeNoticeStore store = new RuntimeNoticeStore(
-                temporaryDirectory.resolve("runtime/retained-warning.txt"));
+    void aNoticeThatWasNotShownYetIsNotReplaced() throws IOException {
+        RuntimeNoticeStore store = new RuntimeNoticeStore(folder.resolve("notice.txt"));
 
-        store.retain("World-exit backup failed");
-        store.retain("World-exit backup completed with warnings");
+        store.keep(BackgroundNotices.exitInterrupted());
+        store.keep(BackgroundNotices.workInterrupted());
 
-        assertEquals("World-exit backup failed", store.load().orElseThrow());
+        List<Notice> shown = new ArrayList<>();
+        store.showKept(shown::add);
+        assertEquals(List.of(BackgroundNotices.exitInterrupted()), shown);
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeStateRegistryTest.java b/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeStateRegistryTest.java
deleted file mode 100644
index 534733a..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeStateRegistryTest.java
+++ /dev/null
@@ -1,68 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertSame;
-
-import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
-import dev.ishaanko.worldarchive.config.GitDestinationConfig;
-import dev.ishaanko.worldarchive.config.ZipDestinationConfig;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.Optional;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-final class RuntimeStateRegistryTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void installingReloadedConfigRoutesNextWorkToItsExactDestinationPaths() {
-        RuntimeStateRegistry<RuntimeStoragePaths> registry = new RuntimeStateRegistry<>();
-        Path oldGit = temporaryDirectory.resolve("old.git");
-        Path oldZip = temporaryDirectory.resolve("old-archives");
-        RuntimeStoragePaths original = RuntimeStoragePaths.from(
-                config(oldGit, oldZip),
-                temporaryDirectory.resolve("defaults"));
-        registry.install(original);
-        RuntimeStoragePaths inFlight = registry.currentOrNull();
-
-        Path newGit = temporaryDirectory.resolve("new.git");
-        Path newZip = temporaryDirectory.resolve("new-archives");
-        RuntimeStoragePaths reloaded = RuntimeStoragePaths.from(
-                config(newGit, newZip),
-                temporaryDirectory.resolve("defaults"));
-        registry.install(reloaded);
-
-        assertSame(reloaded, registry.currentOrNull());
-        assertEquals(newGit.toAbsolutePath(), registry.currentOrNull().gitRepository());
-        assertEquals(newZip.toAbsolutePath(), registry.currentOrNull().zipDirectory());
-        assertSame(original, inFlight);
-        assertEquals(oldGit.toAbsolutePath(), inFlight.gitRepository());
-        assertEquals(oldZip.toAbsolutePath(), inFlight.zipDirectory());
-        assertEquals(List.of(original, reloaded), registry.retained());
-        assertEquals(List.of(original), registry.removeRetired());
-        assertEquals(List.of(reloaded), registry.retained());
-    }
-
-    private static WorldArchiveConfig config(Path gitRepository, Path zipDirectory) {
-        WorldArchiveConfig defaults = WorldArchiveConfig.defaults();
-        return new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                defaults.triggers(),
-                new GitDestinationConfig(
-                        true,
-                        Optional.of(gitRepository),
-                        defaults.git().remoteName(),
-                        defaults.git().remoteUrl(),
-                        defaults.git().triggers(),
-                        defaults.git().lfsPatterns(),
-                        defaults.git().health()),
-                new ZipDestinationConfig(
-                        true,
-                        Optional.of(zipDirectory),
-                        defaults.zip().triggers(),
-                        defaults.zip().health()),
-                defaults.worlds());
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeStorageSafetyTest.java b/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeStorageSafetyTest.java
deleted file mode 100644
index 5adc1a0..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeStorageSafetyTest.java
+++ /dev/null
@@ -1,35 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
-import dev.ishaanko.worldarchive.config.ZipDestinationConfig;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.Optional;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-final class RuntimeStorageSafetyTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void overlapLocksStorageUntilConfigurationIsSafeAgain() {
-        Path world = temporaryDirectory.resolve("new-world");
-        WorldArchiveConfig defaults = WorldArchiveConfig.defaults();
-        WorldArchiveConfig unsafe = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                defaults.triggers(),
-                defaults.git(),
-                new ZipDestinationConfig(false, Optional.of(world.resolve("archives"))),
-                defaults.worlds());
-        RuntimeStorageSafety safety = new RuntimeStorageSafety();
-
-        safety.refresh(unsafe, List.of(world));
-        assertTrue(safety.warning().isPresent());
-
-        safety.refresh(defaults, List.of(world));
-        assertTrue(safety.warning().isEmpty());
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeWorldPathRegistryTest.java b/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeWorldPathRegistryTest.java
deleted file mode 100644
index 219959e..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/runtime/RuntimeWorldPathRegistryTest.java
+++ /dev/null
@@ -1,91 +0,0 @@
-package dev.ishaanko.worldarchive.runtime;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
-import dev.ishaanko.worldarchive.config.ZipDestinationConfig;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.nio.file.Path;
-import java.util.Optional;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-final class RuntimeWorldPathRegistryTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void rejectsEitherIdentityAtTwoPathsOrTwoIdentitiesAtOnePath() {
-        RuntimeWorldPathRegistry registry = new RuntimeWorldPathRegistry();
-        WorldId first = WorldId.create();
-        WorldId second = WorldId.create();
-        Path firstPath = temporaryDirectory.resolve("first-world");
-        Path secondPath = temporaryDirectory.resolve("second-world");
-
-        assertTrue(registry.register(first, firstPath));
-        assertFalse(registry.register(first, secondPath));
-        assertFalse(registry.register(second, firstPath));
-        assertTrue(registry.register(second, secondPath));
-        assertEquals(
-                java.util.Set.of(
-                        firstPath.toAbsolutePath().normalize(),
-                        secondPath.toAbsolutePath().normalize()),
-                java.util.Set.copyOf(registry.snapshotPaths()));
-    }
-
-    @Test
-    void configuredPathOwnerIsAuthoritative() {
-        RuntimeWorldPathRegistry registry = new RuntimeWorldPathRegistry();
-        WorldId configured = WorldId.create();
-        WorldId conflicting = WorldId.create();
-        Path path = temporaryDirectory.resolve("world");
-
-        registry.configure(configured, path);
-
-        assertTrue(registry.matches(configured, path));
-        assertFalse(registry.matches(conflicting, path));
-        assertFalse(registry.register(conflicting, path));
-    }
-
-    @Test
-    void releaseFreesBothClaimsForNewOwners() {
-        RuntimeWorldPathRegistry registry = new RuntimeWorldPathRegistry();
-        WorldId original = WorldId.create();
-        WorldId restored = WorldId.create();
-        Path path = temporaryDirectory.resolve("world");
-
-        assertTrue(registry.register(original, path));
-        assertEquals(path.toAbsolutePath().normalize(),
-                registry.claimedPath(original).orElseThrow());
-        assertEquals(original, registry.claimedWorld(path).orElseThrow());
-        assertFalse(registry.register(restored, path));
-
-        registry.release(original, path);
-
-        assertTrue(registry.claimedPath(original).isEmpty());
-        assertTrue(registry.claimedWorld(path).isEmpty());
-        assertTrue(registry.register(restored, path));
-    }
-
-    @Test
-    void runtimePathSnapshotRejectsDestinationInsideNewWorld() {
-        RuntimeWorldPathRegistry registry = new RuntimeWorldPathRegistry();
-        Path newWorld = temporaryDirectory.resolve("new-world");
-        assertTrue(registry.register(WorldId.create(), newWorld));
-        WorldArchiveConfig defaults = WorldArchiveConfig.defaults();
-        WorldArchiveConfig unsafe = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                defaults.triggers(),
-                defaults.git(),
-                new ZipDestinationConfig(false, Optional.of(newWorld.resolve("archives"))),
-                defaults.worlds());
-
-        assertThrows(
-                IOException.class,
-                () -> unsafe.validateDestinations(registry.snapshotPaths()));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/runtime/WorldIdentityResolverTest.java b/src/test/java/dev/ishaanko/worldarchive/runtime/WorldIdentityResolverTest.java
new file mode 100644
index 0000000..aff302f
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/runtime/WorldIdentityResolverTest.java
@@ -0,0 +1,209 @@
+package dev.ishaanko.worldarchive.runtime;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.config.WorldConfig;
+import dev.ishaanko.worldarchive.config.WorldIdentityStore;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldContext;
+import dev.ishaanko.worldarchive.ui.model.BackupWorldSelection;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Optional;
+import java.util.concurrent.CopyOnWriteArrayList;
+import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+/** How a world folder the game lists or opens gets its identity, with real folders and links. */
+final class WorldIdentityResolverTest {
+    private final WorldIdentityStore identities = new WorldIdentityStore();
+
+    private final List<Path> found = new CopyOnWriteArrayList<>();
+
+    private final List<Path> copies = new CopyOnWriteArrayList<>();
+
+    @TempDir
+    Path root;
+
+    /** A game folder moved to another drive and linked back: its worlds are keyed by their real folder. */
+    @Test
+    void aWorldBehindALinkedSavesFolderIsKeyedByItsRealFolder() throws IOException {
+        Path realSaves = Files.createDirectories(root.resolve("other drive/saves"));
+        Path saves = link(root.resolve("game/saves"), realSaves);
+        Path realWorld = world(realSaves.resolve("World"));
+        WorldIdentityResolver resolver = resolver(saves);
+
+        BackupWorldContext resolved = resolved(resolver, selection(saves, "World"));
+
+        assertEquals(realWorld.toRealPath(), resolved.worldDirectory());
+        assertTrue(resolved.matches(selection(saves, "World")));
+        assertTrue(resolver.isRegistered(resolved.worldId(), realWorld.toRealPath()));
+        assertEquals(List.of(realWorld.toRealPath()), found);
+    }
+
+    @Test
+    void aWorldFolderThatIsALinkIsKeyedByItsRealFolderAndKeepsItsListedName() throws IOException {
+        Path saves = Files.createDirectories(root.resolve("game/saves"));
+        Path realWorld = world(root.resolve("elsewhere/My World"));
+        link(saves.resolve("Linked"), realWorld);
+        WorldIdentityResolver resolver = resolver(saves);
+
+        BackupWorldContext resolved = resolved(resolver, selection(saves, "Linked"));
+
+        assertEquals(realWorld.toRealPath(), resolved.worldDirectory());
+        assertEquals("Linked", resolved.storageName());
+        assertEquals(saves, resolved.worldsDirectory());
+    }
+
+    /** A folder copied in a file manager carries the original's identity; it must never share its backups. */
+    @Test
+    void aCopyIsRefusedWhileTheOriginalIsThereAndResolvesOnceItHasItsOwnIdentity() throws IOException {
+        Path saves = Files.createDirectories(root.resolve("saves"));
+        Path original = world(saves.resolve("World"));
+        WorldId originalId = identities.loadOrCreate(original);
+        Path copy = copyWorld(original, saves.resolve("World - Copy"));
+        WorldIdentityResolver resolver = resolver(saves);
+        resolver.configure(settings(WorldConfig.defaults(originalId, original.toRealPath())));
+
+        assertInstanceOf(WorldIdentityResolver.Resolution.Refused.class, resolver.resolve(selection(saves, "World - Copy")));
+        assertEquals(List.of(copy.toRealPath()), copies);
+
+        identities.giveCopyItsOwnIdentity(copy, originalId);
+        BackupWorldContext resolved = resolved(resolver, selection(saves, "World - Copy"));
+
+        assertNotEquals(originalId, resolved.worldId());
+        assertTrue(resolver.isRegistered(originalId, original.toRealPath()));
+    }
+
+    /** The settings still name the old folder of a renamed world; that folder is gone, so the world moves. */
+    @Test
+    void aRenamedWorldKeepsItsIdentityInItsNewFolder() throws IOException {
+        Path saves = Files.createDirectories(root.resolve("saves"));
+        Path renamed = world(saves.resolve("New Name"));
+        WorldId worldId = identities.loadOrCreate(renamed);
+        WorldIdentityResolver resolver = resolver(saves);
+        resolver.configure(settings(WorldConfig.defaults(worldId, saves.resolve("Old Name"))));
+
+        BackupWorldContext resolved = resolved(resolver, selection(saves, "New Name"));
+
+        assertEquals(worldId, resolved.worldId());
+        assertTrue(resolver.isRegistered(worldId, renamed.toRealPath()));
+        assertFalse(resolver.isRegistered(worldId, saves.resolve("Old Name")));
+        assertEquals(List.of(renamed.toRealPath()), found);
+    }
+
+    /** A restore that reuses the name of a deleted world gets that folder; the old identity's claim is stale. */
+    @Test
+    void aWorldRestoredIntoAnOldFolderTakesItOver() throws IOException {
+        Path saves = Files.createDirectories(root.resolve("saves"));
+        Path folder = world(saves.resolve("World"));
+        WorldId restored = identities.loadOrCreate(folder);
+        WorldId deleted = WorldId.create();
+        WorldIdentityResolver resolver = resolver(saves);
+        resolver.configure(settings(WorldConfig.defaults(deleted, folder.toRealPath())));
+
+        assertTrue(resolver.register(restored, folder));
+
+        assertTrue(resolver.isRegistered(restored, folder.toRealPath()));
+        assertFalse(resolver.isRegistered(deleted, folder.toRealPath()));
+    }
+
+    /** The settings always win: a claim they contradict goes when they load. */
+    @Test
+    void theSettingsWinOverAnEarlierClaim() throws IOException {
+        Path saves = Files.createDirectories(root.resolve("saves"));
+        Path folder = world(saves.resolve("World"));
+        WorldIdentityResolver resolver = resolver(saves);
+        BackupWorldContext resolved = resolved(resolver, selection(saves, "World"));
+        WorldId configured = WorldId.create();
+
+        resolver.configure(settings(WorldConfig.defaults(configured, folder.toRealPath())));
+
+        assertTrue(resolver.isRegistered(configured, folder.toRealPath()));
+        assertFalse(resolver.isRegistered(resolved.worldId(), folder.toRealPath()));
+    }
+
+    @Test
+    void anUnreadableIdentityFailsSoTheOpenWorldIsTriedAgainLater() throws IOException {
+        Path saves = Files.createDirectories(root.resolve("saves"));
+        Path folder = world(saves.resolve("World"));
+        identities.loadOrCreate(folder);
+        Files.writeString(folder.resolve(".worldarchive/world.json"), "not json");
+
+        assertThrows(IOException.class, () -> resolver(saves).resolve(selection(saves, "World")));
+    }
+
+    /** A world found later inside a backup folder pauses backups, although the settings passed their own check. */
+    @Test
+    void aBackupFolderInsideAWorldFoundLaterPausesBackups() throws IOException {
+        Path saves = Files.createDirectories(root.resolve("saves"));
+        world(saves.resolve("World"));
+        WorldIdentityResolver resolver = resolver(saves);
+        WorldArchiveConfig defaults = WorldArchiveConfig.defaults();
+        resolver.configure(defaults.withZip(defaults.zip().withDestination(Optional.of(saves.resolve("World/backups")))));
+        assertTrue(resolver.storageIssue().isEmpty());
+
+        resolved(resolver, selection(saves, "World"));
+
+        assertTrue(resolver.storageIssue().orElseThrow().startsWith("Backups are paused"));
+    }
+
+    private WorldIdentityResolver resolver(Path saves) {
+        return new WorldIdentityResolver(saves, identities, new WorldIdentityResolver.Listener() {
+            @Override
+            public void found(WorldId worldId, Path worldDirectory) {
+                found.add(worldDirectory);
+            }
+
+            @Override
+            public void copyFound(Path copy) {
+                copies.add(copy);
+            }
+        });
+    }
+
+    private static BackupWorldContext resolved(WorldIdentityResolver resolver, BackupWorldSelection selection)
+            throws IOException {
+        return assertInstanceOf(WorldIdentityResolver.Resolution.Resolved.class, resolver.resolve(selection)).world();
+    }
+
+    private static BackupWorldSelection selection(Path saves, String folder) {
+        return new BackupWorldSelection(saves.resolve(folder), saves, folder, folder);
+    }
+
+    private static WorldArchiveConfig settings(WorldConfig world) {
+        return WorldArchiveConfig.defaults().withWorlds(List.of(world));
+    }
+
+    private static Path world(Path folder) throws IOException {
+        Files.createDirectories(folder);
+        Files.write(folder.resolve("level.dat"), new byte[] {1, 2, 3});
+        return folder;
+    }
+
+    private static Path copyWorld(Path original, Path copy) throws IOException {
+        world(copy);
+        Files.createDirectories(copy.resolve(".worldarchive"));
+        Files.copy(original.resolve(".worldarchive/world.json"), copy.resolve(".worldarchive/world.json"));
+        return copy;
+    }
+
+    private static Path link(Path link, Path target) throws IOException {
+        Files.createDirectories(link.getParent());
+        try {
+            return Files.createSymbolicLink(link, target);
+        } catch (UnsupportedOperationException | IOException unsupported) {
+            Assumptions.abort("This file system cannot create symbolic links");
+            throw unsupported;
+        }
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/settings/FolderSelectionControllerTest.java b/src/test/java/dev/ishaanko/worldarchive/settings/FolderSelectionControllerTest.java
deleted file mode 100644
index 4a3c699..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/settings/FolderSelectionControllerTest.java
+++ /dev/null
@@ -1,72 +0,0 @@
-package dev.ishaanko.worldarchive.settings;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
-import java.nio.file.Path;
-import org.junit.jupiter.api.Test;
-
-class FolderSelectionControllerTest {
-    @Test
-    void cancellationLeavesTypedValueUntouched() {
-        FolderSelectionController controller = new FolderSelectionController();
-        FolderSelectionController.Request request = controller.begin("C:\\Backups");
-
-        FolderSelectionController.Application application = controller.apply(
-                request,
-                new FolderSelectionResult.Cancelled(),
-                "C:\\Backups");
-
-        assertTrue(application.applied());
-        assertEquals("C:\\Backups", application.value());
-        assertTrue(application.message().isEmpty());
-    }
-
-    @Test
-    void manualEditMakesPendingSelectionStale() {
-        FolderSelectionController controller = new FolderSelectionController();
-        FolderSelectionController.Request request = controller.begin("");
-        controller.noteManualEdit();
-
-        FolderSelectionController.Application application = controller.apply(
-                request,
-                new FolderSelectionResult.Selected(Path.of("C:\\OldSelection")),
-                "C:\\NewTypedValue");
-
-        assertFalse(application.applied());
-        assertEquals("C:\\NewTypedValue", application.value());
-    }
-
-    @Test
-    void failurePreservesValueAndReturnsFallbackMessage() {
-        FolderSelectionController controller = new FolderSelectionController();
-        FolderSelectionController.Request request = controller.begin("");
-
-        FolderSelectionController.Application application = controller.apply(
-                request,
-                new FolderSelectionResult.Unavailable("Type an absolute path instead"),
-                "typed");
-
-        assertTrue(application.applied());
-        assertEquals("typed", application.value());
-        assertEquals("Type an absolute path instead", application.message().orElseThrow());
-    }
-
-    @Test
-    void pickerFailureRedactsCredentialsBeforeReachingTheController() {
-        FolderSelectionController controller = new FolderSelectionController();
-        FolderSelectionController.Request request = controller.begin("");
-
-        FolderSelectionController.Application application = controller.apply(
-                request,
-                new FolderSelectionResult.Failed(
-                        "Could not open https://user:password@example.com/folder"),
-                "typed");
-
-        assertEquals(
-                "Could not open https://" + SensitiveDataRedactor.REDACTED + "@example.com/folder",
-                application.message().orElseThrow());
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/settings/NewWorldDiscoveryTest.java b/src/test/java/dev/ishaanko/worldarchive/settings/NewWorldDiscoveryTest.java
deleted file mode 100644
index 9f1aede..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/settings/NewWorldDiscoveryTest.java
+++ /dev/null
@@ -1,28 +0,0 @@
-package dev.ishaanko.worldarchive.settings;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.List;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-final class NewWorldDiscoveryTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void newWorldBecomesDiscoverableAfterLevelDataIsPublished() throws IOException {
-        Path saves = Files.createDirectory(temporaryDirectory.resolve("saves"));
-        Path world = Files.createDirectory(saves.resolve("new-world"));
-
-        assertTrue(WorldFolderDiscovery.discover(saves).isEmpty());
-
-        Files.writeString(world.resolve("level.dat"), "level data");
-
-        assertEquals(List.of(world.toRealPath()), WorldFolderDiscovery.discover(saves));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/settings/SettingsDraftTest.java b/src/test/java/dev/ishaanko/worldarchive/settings/SettingsDraftTest.java
index 864d10b..f75b085 100644
--- a/src/test/java/dev/ishaanko/worldarchive/settings/SettingsDraftTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/settings/SettingsDraftTest.java
@@ -4,23 +4,20 @@
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
-import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
-import dev.ishaanko.worldarchive.config.GitDestinationConfig;
+import dev.ishaanko.worldarchive.config.DefaultDestinations;
+import dev.ishaanko.worldarchive.config.StoragePolicy;
 import dev.ishaanko.worldarchive.config.TriggerConfig;
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
 import dev.ishaanko.worldarchive.config.WorldConfig;
-import dev.ishaanko.worldarchive.config.ZipDestinationConfig;
-import dev.ishaanko.worldarchive.model.DestinationHealth;
-import dev.ishaanko.worldarchive.model.DestinationHealthStatus;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
 import dev.ishaanko.worldarchive.model.DestinationType;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.time.Instant;
 import java.util.List;
-import java.util.Map;
 import java.util.Optional;
-import java.util.UUID;
+import java.util.Set;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
@@ -33,91 +30,65 @@ void untouchedDefaultsAndPausedDestinationsRemainValid() {
         WorldArchiveConfig resolvedDefaults = resolvedDefaults();
         SettingsDraft draft = SettingsDraft.from(resolvedDefaults);
         assertTrue(draft.validate(List.of()).isValid());
-        assertTrue(draft.gitManualEnabled());
-        assertTrue(draft.gitWorldExitEnabled());
-        assertFalse(draft.gitScheduledEnabled());
-        assertTrue(draft.zipManualEnabled());
-        assertTrue(draft.zipWorldExitEnabled());
-        assertFalse(draft.zipScheduledEnabled());
+        assertTrue(draft.trigger(DestinationType.GIT, BackupTrigger.MANUAL));
+        assertTrue(draft.trigger(DestinationType.ZIP, BackupTrigger.WORLD_EXIT));
+        assertFalse(draft.trigger(DestinationType.ZIP, BackupTrigger.SCHEDULED));
         assertEquals("30", draft.scheduleInterval());
 
         draft.setGitEnabled(false);
         draft.setZipEnabled(false);
 
-        SettingsValidation validation = draft.validate(List.of());
-        assertTrue(validation.isValid());
-        assertFalse(validation.config().orElseThrow().git().enabled());
-        assertFalse(validation.config().orElseThrow().zip().enabled());
-        assertEquals(
-                resolvedDefaults.git().repository(),
-                validation.config().orElseThrow().git().repository());
-        assertEquals(
-                resolvedDefaults.zip().destination(),
-                validation.config().orElseThrow().zip().destination());
+        WorldArchiveConfig config = draft.validate(List.of()).config().orElseThrow();
+        assertFalse(config.git().enabled());
+        assertFalse(config.zip().enabled());
+        assertEquals(resolvedDefaults.git().repository(), config.git().repository());
+        assertEquals(resolvedDefaults.zip().destination(), config.zip().destination());
     }
 
     @Test
-    void foldsLegacyGlobalGatesIntoVisibleChoicesAndDerivesPersistedGlobals() {
+    void foldsGlobalGatesIntoEachDestinationAndDerivesTheGlobals() {
         WorldArchiveConfig defaults = resolvedDefaults();
-        WorldArchiveConfig legacyGates = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                new TriggerConfig(false, true, false, 45),
-                defaults.git(),
-                defaults.zip(),
-                defaults.worlds());
-        SettingsDraft draft = SettingsDraft.from(legacyGates);
-
-        assertFalse(draft.gitManualEnabled());
-        assertTrue(draft.gitWorldExitEnabled());
-        assertFalse(draft.gitScheduledEnabled());
-        assertFalse(draft.zipManualEnabled());
-        assertTrue(draft.zipWorldExitEnabled());
-        assertFalse(draft.zipScheduledEnabled());
-
-        draft.setScheduleInterval("45");
-        draft.setGitManualEnabled(false);
-        draft.setGitWorldExitEnabled(true);
-        draft.setGitScheduledEnabled(false);
-        draft.setZipManualEnabled(true);
-        draft.setZipWorldExitEnabled(false);
-        draft.setZipScheduledEnabled(true);
+        SettingsDraft draft = SettingsDraft.from(new WorldArchiveConfig(
+                new TriggerConfig(false, true, false, 45), defaults.git(), defaults.zip(), defaults.worlds()));
+
+        assertFalse(draft.trigger(DestinationType.GIT, BackupTrigger.MANUAL));
+        assertTrue(draft.trigger(DestinationType.GIT, BackupTrigger.WORLD_EXIT));
+        assertFalse(draft.trigger(DestinationType.ZIP, BackupTrigger.MANUAL));
 
+        draft.setTrigger(DestinationType.ZIP, BackupTrigger.MANUAL, true);
+        draft.setTrigger(DestinationType.ZIP, BackupTrigger.WORLD_EXIT, false);
+        draft.setTrigger(DestinationType.ZIP, BackupTrigger.SCHEDULED, true);
         WorldArchiveConfig config = draft.validate(List.of()).config().orElseThrow();
 
-        assertTrue(config.triggers().manualEnabled());
-        assertTrue(config.triggers().worldExitEnabled());
-        assertTrue(config.triggers().scheduledEnabled());
-        assertEquals(45, config.triggers().scheduleIntervalMinutes());
+        assertEquals(new TriggerConfig(true, true, true, 45), config.triggers());
         assertFalse(config.git().triggers().manualEnabled());
         assertTrue(config.git().triggers().worldExitEnabled());
-        assertFalse(config.git().triggers().scheduledEnabled());
         assertTrue(config.zip().triggers().manualEnabled());
         assertFalse(config.zip().triggers().worldExitEnabled());
         assertTrue(config.zip().triggers().scheduledEnabled());
     }
 
     @Test
-    void rejectsDestinationNestedInsideKnownWorld() throws IOException {
+    void rejectsADestinationInsideAWorldEvenWhileItIsOff() throws IOException {
         Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
-        Path nested = world.resolve("backups");
         SettingsDraft draft = SettingsDraft.from(resolvedDefaults());
-        draft.setZipDestination(nested.toString());
+        draft.setZipEnabled(false);
+        draft.setZipDestination(world.resolve("backups").toString());
 
         SettingsValidation validation = draft.validate(List.of(world));
 
         assertFalse(validation.isValid());
-        assertTrue(validation.issue(SettingsField.ZIP_DESTINATION).orElseThrow()
-                .contains("must not be inside"));
+        assertTrue(validation.issue(SettingsField.ZIP_DESTINATION).orElseThrow().contains("must not be inside"));
     }
 
     @Test
-    void acceptsOrdinaryExternalAndDesktopSyncedFolders() throws IOException {
+    void acceptsExternalFoldersAWorldRemoteAndAFolderThatIsNotThereYet() throws IOException {
         Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
-        Path syncedFolder = Files.createDirectory(temporaryDirectory.resolve("OneDrive"));
+        Path external = Files.createDirectory(temporaryDirectory.resolve("OneDrive"));
         SettingsDraft draft = draftWithWorld(world);
         WorldId worldId = draft.base().worlds().getFirst().worldId();
-        draft.setGitRepository(syncedFolder.resolve("git-store").toString());
-        draft.setZipDestination(syncedFolder.resolve("archives").toString());
+        draft.setGitRepository(external.resolve("git-store").toString());
+        draft.setZipDestination(temporaryDirectory.resolve("unplugged-drive/archives").toString());
         draft.setGitRemoteName("backup-origin");
         draft.setWorldRemoteUrl(worldId, "https://example.com/user/forever-world.git");
         draft.setGitLfsPatterns("*.mca, *.dat, *.nbt");
@@ -125,11 +96,13 @@ void acceptsOrdinaryExternalAndDesktopSyncedFolders() throws IOException {
         SettingsValidation validation = draft.validate(List.of(world));
 
         assertTrue(validation.isValid(), () -> validation.issues().toString());
-        assertEquals(3, validation.config().orElseThrow().git().lfsPatterns().size());
+        WorldArchiveConfig config = validation.config().orElseThrow();
+        assertEquals(List.of("*.mca", "*.dat", "*.nbt"), config.git().lfsPatterns());
+        assertEquals(Optional.of("https://example.com/user/forever-world.git"), config.worlds().getFirst().remoteUrl());
     }
 
     @Test
-    void rejectsCredentialBearingRemoteAndInvalidSchedule() {
+    void rejectsACredentialInARemoteAndAnInvalidSchedule() {
         SettingsDraft draft = draftWithWorld(temporaryDirectory.resolve("credential-world"));
         WorldId worldId = draft.base().worlds().getFirst().worldId();
         draft.setWorldRemoteUrl(worldId, "https://user:password@example.com/worlds.git");
@@ -138,211 +111,95 @@ void rejectsCredentialBearingRemoteAndInvalidSchedule() {
         SettingsValidation validation = draft.validate(List.of());
 
         assertFalse(validation.isValid());
-        assertTrue(validation.issue(SettingsField.WORLD_REMOTE_URL).isPresent());
+        assertTrue(validation.issue(worldId, SettingsField.WORLD_REMOTE_URL).isPresent());
         assertTrue(validation.issue(SettingsField.SCHEDULE_INTERVAL).isPresent());
     }
 
     @Test
-    void acceptsPlainRemoteForOneWorld() {
-        SettingsDraft draft = draftWithWorld(temporaryDirectory.resolve("plain-remote-world"));
-        WorldId worldId = draft.base().worlds().getFirst().worldId();
-        draft.setWorldRemoteUrl(worldId, "https://example.com/user/forever-world.git");
+    void eachWorldKeepsItsOwnProblems() {
+        WorldId first = WorldId.create();
+        WorldId second = WorldId.create();
+        SettingsDraft draft = SettingsDraft.from(resolvedDefaults().withWorlds(List.of(
+                WorldConfig.defaults(first, temporaryDirectory.resolve("first")),
+                WorldConfig.defaults(second, temporaryDirectory.resolve("second")))));
+        draft.setWorldRemoteUrl(first, "https://example.com/first.git?token=1");
+        draft.setWorldZipOverride(second, true);
+        draft.setWorldZipDestination(second, "relative/zips");
 
         SettingsValidation validation = draft.validate(List.of());
 
-        assertTrue(validation.isValid(), () -> validation.issues().toString());
-        assertEquals(
-                "https://example.com/user/forever-world.git",
-                validation.config().orElseThrow().worlds().getFirst().remoteUrl().orElseThrow());
+        assertTrue(validation.issue(first, SettingsField.WORLD_REMOTE_URL).isPresent());
+        assertTrue(validation.issue(first, SettingsField.WORLD_ZIP_DESTINATION).isEmpty());
+        assertTrue(validation.issue(second, SettingsField.WORLD_ZIP_DESTINATION).isPresent());
+        assertTrue(validation.issue(second, SettingsField.WORLD_REMOTE_URL).isEmpty());
+        assertEquals(Set.of(first, second), validation.invalidWorlds());
     }
 
     @Test
-    void rejectsRegularFileAsDestination() throws IOException {
+    void rejectsARegularFileAsADestination() throws IOException {
         Path file = Files.writeString(temporaryDirectory.resolve("not-a-folder"), "data");
         SettingsDraft draft = SettingsDraft.from(resolvedDefaults());
         draft.setZipDestination(file.toString());
 
         SettingsValidation validation = draft.validate(List.of());
 
-        assertFalse(validation.isValid());
         assertTrue(validation.issue(SettingsField.ZIP_DESTINATION).orElseThrow().contains("not a folder"));
     }
 
     @Test
-    void disabledDestinationStillRejectsAndDoesNotHideRecursivePath() throws IOException {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("paused-world"));
-        SettingsDraft draft = SettingsDraft.from(resolvedDefaults());
-        draft.setZipEnabled(false);
-        draft.setZipDestination(world.resolve("archives").toString());
-
-        SettingsValidation validation = draft.validate(List.of(world));
-
-        assertFalse(validation.isValid());
-        assertTrue(validation.issue(SettingsField.ZIP_DESTINATION).orElseThrow()
-                .contains("must not be inside"));
-    }
-
-    @Test
-    void destinationChangesInvalidateOnlyTheirPersistedHealth() {
-        SettingsDefaults defaults = new SettingsDefaults(temporaryDirectory.resolve("worldarchive"));
-        WorldArchiveConfig base = defaults.resolve(WorldArchiveConfig.defaults());
-        Instant checkedAt = Instant.parse("2026-07-17T12:00:00Z");
-        DestinationHealth healthyGit = new DestinationHealth(
-                DestinationType.GIT,
-                DestinationHealthStatus.HEALTHY,
-                "Git and LFS are ready",
-                checkedAt);
-        DestinationHealth healthyZip = new DestinationHealth(
-                DestinationType.ZIP,
-                DestinationHealthStatus.HEALTHY,
-                "ZIP folder is ready",
-                checkedAt);
-        Path worldPath = temporaryDirectory.resolve("health-world");
-        WorldId worldId = WorldId.create();
-        WorldArchiveConfig checked = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                base.triggers(),
-                new GitDestinationConfig(
-                        true,
-                        base.git().repository(),
-                        base.git().remoteName(),
-                        Optional.empty(),
-                        base.git().triggers(),
-                        base.git().lfsPatterns(),
-                        healthyGit),
-                new ZipDestinationConfig(
-                        true,
-                        base.zip().destination(),
-                        base.zip().triggers(),
-                        healthyZip),
-                List.of(new WorldConfig(worldId, true, worldPath)));
-        SettingsDraft draft = SettingsDraft.from(checked);
-
-        draft.setWorldRemoteUrl(worldId, "https://example.com/health-world.git");
-
-        assertEquals(DestinationHealthStatus.UNCONFIGURED, draft.gitHealth().status());
-        assertEquals(DestinationHealthStatus.HEALTHY, draft.zipHealth().status());
-
-        draft.setZipDestination(temporaryDirectory.resolve("other-archives").toString());
-
-        assertEquals(DestinationHealthStatus.UNCONFIGURED, draft.zipHealth().status());
-    }
-
-    @Test
-    void validationIssuesRedactCredentialBearingDiagnostics() {
-        SettingsValidation validation = new SettingsValidation(
-                Optional.empty(),
-                Map.of(SettingsField.DESTINATIONS, "Authorization: Bearer abcdefghijklmnop"));
-
-        assertEquals(
-                "Authorization: Bearer [REDACTED]",
-                validation.firstIssue().orElseThrow());
-    }
-
-    @Test
-    void retainsWorldIdentityWhileChangingEnablementAndResettingDefaults() throws IOException {
+    void defaultsKeepWhereBackupsAreAndSwitchEveryWorldBackOn() throws IOException {
         Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
-        WorldId worldId = new WorldId(UUID.randomUUID());
-        WorldArchiveConfig productDefaults = resolvedDefaults();
-        WorldArchiveConfig config = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                productDefaults.triggers(),
-                productDefaults.git(),
-                productDefaults.zip(),
-                List.of(new WorldConfig(worldId, true, world)));
-        SettingsDraft draft = SettingsDraft.from(config);
-        draft.setWorldEnabled(worldId, false);
-
-        assertFalse(draft.validate(List.of(world)).config().orElseThrow().worlds().getFirst().enabled());
-
-        SettingsDraft defaults = SettingsDraft.defaultsKeepingWorlds(config);
-        assertTrue(defaults.validate(List.of(world)).config().orElseThrow().worlds().getFirst().enabled());
-        assertEquals(worldId, defaults.base().worlds().getFirst().worldId());
-    }
-
-    @Test
-    void validatesAndPreservesPerWorldZipOverride() throws IOException {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("override-world"));
-        Path override = Files.createDirectory(temporaryDirectory.resolve("override-zips"));
+        Path customZips = Files.createDirectory(temporaryDirectory.resolve("custom-zips"));
+        Path worldZips = Files.createDirectory(temporaryDirectory.resolve("world-zips"));
         WorldId worldId = WorldId.create();
         WorldArchiveConfig defaults = resolvedDefaults();
-        SettingsDraft draft = SettingsDraft.from(new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                defaults.triggers(),
+        WorldArchiveConfig saved = new WorldArchiveConfig(
+                new TriggerConfig(true, false, true, 90),
                 defaults.git(),
-                defaults.zip(),
-                List.of(new WorldConfig(worldId, true, world))));
-
-        draft.setWorldZipDestination(worldId, override.toString());
-
-        WorldConfig validated = draft.validate(List.of(world))
-                .config().orElseThrow().worlds().getFirst();
-        assertEquals(override.toRealPath(), validated.zipDestination().orElseThrow());
-        assertEquals(
-                validated.zipDestination(),
-                SettingsDraft.defaultsKeepingWorlds(
-                                draft.validate(List.of(world)).config().orElseThrow())
-                        .base().worlds().getFirst().zipDestination());
+                defaults.zip().withDestination(Optional.of(customZips)),
+                List.of(new WorldConfig(worldId, false, world, Optional.of("https://example.com/w.git"),
+                        Optional.of(worldZips), StoragePolicy.defaults())));
+
+        WorldArchiveConfig reset = SettingsDraft.from(saved).withDefaults()
+                .validate(List.of(world)).config().orElseThrow();
+
+        assertEquals(TriggerConfig.defaults(), reset.triggers());
+        assertEquals(Optional.of(customZips.toRealPath()), reset.zip().destination());
+        WorldConfig resetWorld = reset.worlds().getFirst();
+        assertTrue(resetWorld.enabled());
+        assertEquals(Optional.of("https://example.com/w.git"), resetWorld.remoteUrl());
+        assertEquals(Optional.of(worldZips.toRealPath()), resetWorld.zipDestination());
     }
 
     @Test
-    void preservesHiddenLegacyGitStorageAcrossValidationAndDefaults() throws IOException {
-        Path legacyRepository = Files.createDirectory(temporaryDirectory.resolve("legacy-shared.git"));
-        WorldArchiveConfig resolved = resolvedDefaults();
-        GitDestinationConfig git = resolved.git();
-        WorldArchiveConfig migrated = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                resolved.triggers(),
-                new GitDestinationConfig(
-                        git.enabled(),
-                        git.repository(),
-                        git.remoteName(),
-                        git.remoteUrl(),
-                        git.triggers(),
-                        git.lfsPatterns(),
-                        git.health(),
-                        Optional.of(legacyRepository),
-                        Optional.of("https://example.invalid/legacy.git")),
-                resolved.zip(),
-                resolved.worlds());
-
-        WorldArchiveConfig validated = SettingsDraft.from(migrated)
-                .validate(List.of())
-                .config()
-                .orElseThrow();
-        SettingsDraft reset = SettingsDraft.defaultsKeepingWorlds(
-                migrated,
-                new SettingsDefaults(temporaryDirectory.resolve("new-defaults")));
-
-        assertEquals(legacyRepository.toRealPath(), validated.git().legacyRepository().orElseThrow());
-        assertEquals(
-                migrated.git().legacyRemoteUrl(),
-                validated.git().legacyRemoteUrl());
-        assertEquals(
-                migrated.git().legacyRepository(),
-                reset.base().git().legacyRepository());
-        assertEquals(
-                migrated.git().legacyRemoteUrl(),
-                reset.base().git().legacyRemoteUrl());
+    void theZipBoxRemembersTheWorldFolderWhenItIsUnticked() {
+        WorldId worldId = WorldId.create();
+        SettingsDraft draft = SettingsDraft.from(resolvedDefaults().withWorlds(List.of(
+                WorldConfig.defaults(worldId, temporaryDirectory.resolve("world")))));
+        String worldFolder = temporaryDirectory.resolve("world-zips").toString();
+
+        draft.setWorldZipOverride(worldId, true);
+        assertEquals(draft.zipDestination(), draft.worldZipDestination(worldId));
+        draft.setWorldZipDestination(worldId, worldFolder);
+        draft.setWorldZipOverride(worldId, false);
+        assertEquals("", draft.worldZipDestination(worldId));
+        assertTrue(draft.validate(List.of()).config().orElseThrow().worlds().getFirst().zipDestination().isEmpty());
+        draft.setWorldZipOverride(worldId, true);
+
+        assertEquals(worldFolder, draft.worldZipDestination(worldId));
     }
 
     private WorldArchiveConfig resolvedDefaults() {
         try {
-            return new SettingsDefaults(temporaryDirectory.resolve("worldarchive"))
+            return new DefaultDestinations(temporaryDirectory.resolve("worldarchive"))
                     .resolve(WorldArchiveConfig.defaults())
-                    .validateDestinations(List.of());
+                    .canonicalize();
         } catch (IOException exception) {
             throw new AssertionError(exception);
         }
     }
 
     private SettingsDraft draftWithWorld(Path world) {
-        WorldArchiveConfig defaults = resolvedDefaults();
-        return SettingsDraft.from(new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                defaults.triggers(),
-                defaults.git(),
-                defaults.zip(),
-                List.of(new WorldConfig(WorldId.create(), true, world))));
+        return SettingsDraft.from(resolvedDefaults().withWorlds(List.of(WorldConfig.defaults(WorldId.create(), world))));
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/settings/SettingsHealthProbeTest.java b/src/test/java/dev/ishaanko/worldarchive/settings/SettingsHealthProbeTest.java
new file mode 100644
index 0000000..46bac3a
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/settings/SettingsHealthProbeTest.java
@@ -0,0 +1,62 @@
+package dev.ishaanko.worldarchive.settings;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import dev.ishaanko.worldarchive.storage.git.GitCommandResult;
+import dev.ishaanko.worldarchive.storage.git.GitCommandRunner;
+import java.nio.file.Path;
+import java.util.Optional;
+import java.util.concurrent.atomic.AtomicInteger;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class SettingsHealthProbeTest {
+    @TempDir
+    Path temporaryDirectory;
+
+    @Test
+    void missingLfsDoesNotHideAHealthyGitOrFolderAndToolsAreStartedOnce() throws Exception {
+        AtomicInteger started = new AtomicInteger();
+        GitCommandRunner runner = command -> {
+            started.incrementAndGet();
+            return command.arguments().contains("lfs")
+                    ? result(1, "Git LFS is not installed")
+                    : result(0, "git version 2.50.1");
+        };
+        SettingsHealthProbe probe = new SettingsHealthProbe(temporaryDirectory, runner);
+        SettingsProbeRequest request = new SettingsProbeRequest(
+                true,
+                Optional.of(temporaryDirectory.resolve("repository.git")),
+                true,
+                Optional.of(temporaryDirectory.resolve("archives")));
+
+        SettingsHealthSnapshot health = probe.probe(request);
+        probe.probe(request);
+
+        assertEquals(SettingsHealthStatus.HEALTHY, health.gitTool().status());
+        assertEquals(SettingsHealthStatus.TOOL_MISSING, health.lfsTool().status());
+        assertEquals(SettingsHealthStatus.HEALTHY, health.repository().status());
+        assertEquals(SettingsHealthStatus.HEALTHY, health.zipFolder().status());
+        assertEquals(2, started.get());
+    }
+
+    @Test
+    void disabledDestinationsDoNotStartGitProcesses() throws Exception {
+        AtomicInteger started = new AtomicInteger();
+        GitCommandRunner runner = command -> {
+            started.incrementAndGet();
+            return result(0, "unexpected");
+        };
+
+        SettingsHealthSnapshot health = new SettingsHealthProbe(temporaryDirectory, runner)
+                .probe(new SettingsProbeRequest(false, Optional.empty(), false, Optional.empty()));
+
+        assertEquals(0, started.get());
+        assertEquals(SettingsHealthStatus.DISABLED, health.gitTool().status());
+        assertEquals(SettingsHealthStatus.DISABLED, health.zipFolder().status());
+    }
+
+    private static GitCommandResult result(int exitCode, String output) {
+        return new GitCommandResult(exitCode, output, "", false, false);
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/settings/SettingsHealthSnapshotTest.java b/src/test/java/dev/ishaanko/worldarchive/settings/SettingsHealthSnapshotTest.java
index 66adf13..f3c61d6 100644
--- a/src/test/java/dev/ishaanko/worldarchive/settings/SettingsHealthSnapshotTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/settings/SettingsHealthSnapshotTest.java
@@ -2,96 +2,35 @@
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 
-import dev.ishaanko.worldarchive.model.DestinationHealthStatus;
 import java.nio.file.Path;
-import java.time.Instant;
+import java.util.List;
 import java.util.Optional;
 import org.junit.jupiter.api.Test;
 
 class SettingsHealthSnapshotTest {
+    /** Before a probe finishes and after it fails, only the parts that are on and configured change state. */
     @Test
-    void uncheckedSnapshotDistinguishesMissingPathsFromPendingChecks() {
-        SettingsHealthSnapshot missing = SettingsHealthSnapshot.unchecked(new SettingsProbeRequest(
-                true,
-                "git",
-                Optional.empty(),
-                false,
-                true,
-                Optional.empty()));
-
-        assertEquals(SettingsHealthStatus.UNCHECKED, missing.gitTool().status());
-        assertEquals(SettingsHealthStatus.UNCONFIGURED, missing.repository().status());
-        assertEquals(SettingsHealthStatus.UNCONFIGURED, missing.remote().status());
-        assertEquals(SettingsHealthStatus.UNCONFIGURED, missing.zipDirectory().status());
-        assertEquals(
-                DestinationHealthStatus.UNCONFIGURED,
-                missing.gitDestinationHealth(Instant.EPOCH).status());
-
-        SettingsHealthSnapshot configured = SettingsHealthSnapshot.unchecked(new SettingsProbeRequest(
-                true,
-                "git",
-                Optional.of(Path.of("configured-git")),
-                true,
-                true,
-                Optional.of(Path.of("configured-zip"))));
-
-        assertEquals(SettingsHealthStatus.UNCHECKED, configured.repository().status());
-        assertEquals(SettingsHealthStatus.UNCHECKED, configured.remote().status());
-        assertEquals(SettingsHealthStatus.UNCHECKED, configured.zipDirectory().status());
-    }
-
-    @Test
-    void disabledDestinationsAreReportedIndependently() {
-        SettingsHealthSnapshot snapshot = SettingsHealthSnapshot.unchecked(new SettingsProbeRequest(
-                false,
-                "git",
-                Optional.empty(),
-                false,
-                true,
-                Optional.of(Path.of("archives"))));
-
-        assertEquals(
-                DestinationHealthStatus.DISABLED,
-                snapshot.gitDestinationHealth(Instant.EPOCH).status());
-        assertEquals(
-                DestinationHealthStatus.UNCONFIGURED,
-                snapshot.zipDestinationHealth(Instant.EPOCH).status());
+    void placeholdersKeepDisabledAndUnconfiguredParts() {
+        SettingsProbeRequest gitWithoutFolder = new SettingsProbeRequest(
+                true, Optional.empty(), false, Optional.of(Path.of("archives")));
+        SettingsProbeRequest bothConfigured = new SettingsProbeRequest(
+                true, Optional.of(Path.of("git")), true, Optional.of(Path.of("archives")));
+        for (SettingsHealthStatus pending : List.of(SettingsHealthStatus.UNCHECKED, SettingsHealthStatus.UNAVAILABLE)) {
+            SettingsHealthSnapshot partial = placeholder(pending, gitWithoutFolder);
+            assertEquals(pending, partial.gitTool().status());
+            assertEquals(pending, partial.lfsTool().status());
+            assertEquals(SettingsHealthStatus.UNCONFIGURED, partial.repository().status());
+            assertEquals(SettingsHealthStatus.DISABLED, partial.zipFolder().status());
+
+            SettingsHealthSnapshot complete = placeholder(pending, bothConfigured);
+            assertEquals(pending, complete.repository().status());
+            assertEquals(pending, complete.zipFolder().status());
+        }
     }
 
-    @Test
-    void failedProbePreservesDisabledAndUnconfiguredComponents() {
-        SettingsHealthSnapshot snapshot = SettingsHealthSnapshot.unavailable(
-                new SettingsProbeRequest(
-                        true,
-                        "git",
-                        Optional.empty(),
-                        false,
-                        false,
-                        Optional.of(Path.of("archives"))),
-                "probe failed");
-
-        assertEquals(SettingsHealthStatus.UNAVAILABLE, snapshot.gitTool().status());
-        assertEquals(SettingsHealthStatus.UNCONFIGURED, snapshot.repository().status());
-        assertEquals(SettingsHealthStatus.UNCONFIGURED, snapshot.remote().status());
-        assertEquals(SettingsHealthStatus.DISABLED, snapshot.zipDirectory().status());
-    }
-
-    @Test
-    void displaySummariesStayConciseWhileFullDiagnosticsRemainAvailable() {
-        SettingsHealthSnapshot snapshot = new SettingsHealthSnapshot(
-                new SettingsHealthItem(SettingsHealthStatus.HEALTHY, "git version 2.55.0.windows.3"),
-                new SettingsHealthItem(SettingsHealthStatus.TOOL_MISSING, "Git LFS is not installed"),
-                new SettingsHealthItem(SettingsHealthStatus.HEALTHY, "repository is ready"),
-                new SettingsHealthItem(SettingsHealthStatus.UNCONFIGURED, "not configured"),
-                new SettingsHealthItem(SettingsHealthStatus.HEALTHY, "archive folder is ready"));
-
-        assertEquals(
-                "Git Ready | LFS Missing | Repository Ready | Remote Not Configured",
-                snapshot.gitDisplaySummary());
-        assertEquals("ZIP Folder Ready", snapshot.zipDisplaySummary());
-        assertEquals(
-                "Git git version 2.55.0.windows.3 | LFS Git LFS is not installed"
-                        + " | repository repository is ready | remote not configured",
-                snapshot.gitSummary());
+    private static SettingsHealthSnapshot placeholder(SettingsHealthStatus pending, SettingsProbeRequest request) {
+        return pending == SettingsHealthStatus.UNCHECKED
+                ? SettingsHealthSnapshot.unchecked(request)
+                : SettingsHealthSnapshot.unavailable(request, "probe failed");
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/settings/SettingsLayoutTest.java b/src/test/java/dev/ishaanko/worldarchive/settings/SettingsLayoutTest.java
deleted file mode 100644
index 4fe7622..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/settings/SettingsLayoutTest.java
+++ /dev/null
@@ -1,154 +0,0 @@
-package dev.ishaanko.worldarchive.settings;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import org.junit.jupiter.api.Test;
-
-class SettingsLayoutTest {
-    @Test
-    void compactLayoutSplitsGitFieldsAndKeepsContentAboveTheFooter() {
-        SettingsLayout layout = SettingsLayout.forHeight(180);
-
-        assertTrue(layout.compact());
-        assertEquals(3, layout.gitSectionCount());
-        assertEquals(2, layout.zipSectionCount());
-        assertEquals(2, layout.worldPageSize());
-        assertEquals(130, layout.statusY());
-        assertEquals(152, layout.buttonsY());
-    }
-
-    @Test
-    void fullLayoutFitsTheCompleteGitPageAtTheThreshold() {
-        SettingsLayout layout = SettingsLayout.forHeight(
-                SettingsLayout.COMPACT_HEIGHT_THRESHOLD);
-
-        assertFalse(layout.compact());
-        assertEquals(1, layout.gitSectionCount());
-        assertEquals(1, layout.zipSectionCount());
-        assertThrows(IllegalArgumentException.class, () -> layout.gitRowY(1, 0));
-    }
-
-    // Row positions below are derived from the pre-refactor
-    // WorldArchiveSettingsScreen#addFullGitPage/addCompact*Page/addFullZipPage/addCompact*Page
-    // hard-coded y-values, at a compact height (180, below COMPACT_HEIGHT_THRESHOLD=240) and a
-    // full height (240, at the threshold). pagedHeaderY() (54) is the checkbox/nav-button row
-    // shared by every paged section, independent of layout height.
-
-    @Test
-    void pagedHeaderRowIsFixedRegardlessOfHeight() {
-        assertEquals(54, SettingsLayout.forHeight(180).pagedHeaderY());
-        assertEquals(54, SettingsLayout.forHeight(400).pagedHeaderY());
-    }
-
-    @Test
-    void fullGitRowsMatchThePreRefactorAddFullGitPageLayout() {
-        SettingsLayout layout = SettingsLayout.forHeight(SettingsLayout.COMPACT_HEIGHT_THRESHOLD);
-
-        assertEquals(5, layout.gitSectionRowCount(0));
-        assertEquals(54, layout.gitRowY(0, 0)); // git_enabled checkbox
-        assertEquals(76, layout.gitRowY(0, 1)); // repository row
-        assertEquals(98, layout.gitRowY(0, 2)); // remote name row
-        assertEquals(120, layout.gitRowY(0, 3)); // patterns row
-        assertEquals(143, layout.gitRowY(0, 4)); // trigger row (23px gap, not 22)
-        assertThrows(IllegalArgumentException.class, () -> layout.gitRowY(0, 5));
-    }
-
-    @Test
-    void compactGitRowsMatchThePreRefactorAddCompactGitSectionPages() {
-        SettingsLayout layout = SettingsLayout.forHeight(180);
-
-        // Section 0 (location): only the repository row, at the shared compact first row.
-        assertEquals(1, layout.gitSectionRowCount(0));
-        assertEquals(77, layout.gitRowY(0, 0));
-
-        // Section 1 (remote): remote name then patterns, 22px apart.
-        assertEquals(2, layout.gitSectionRowCount(1));
-        assertEquals(77, layout.gitRowY(1, 0));
-        assertEquals(99, layout.gitRowY(1, 1));
-
-        // Section 2 (timing): only the trigger row.
-        assertEquals(1, layout.gitSectionRowCount(2));
-        assertEquals(77, layout.gitRowY(2, 0));
-    }
-
-    @Test
-    void fullZipRowsMatchThePreRefactorAddFullZipPageLayout() {
-        SettingsLayout layout = SettingsLayout.forHeight(SettingsLayout.COMPACT_HEIGHT_THRESHOLD);
-
-        assertEquals(3, layout.zipSectionRowCount(0));
-        assertEquals(53, layout.zipRowY(0, 0)); // zip_enabled checkbox (53, not 54 - preserved)
-        assertEquals(76, layout.zipRowY(0, 1)); // destination row
-        assertEquals(102, layout.zipRowY(0, 2)); // trigger row
-        assertThrows(IllegalArgumentException.class, () -> layout.zipRowY(0, 3));
-    }
-
-    @Test
-    void compactZipRowsMatchThePreRefactorAddCompactZipSectionPages() {
-        SettingsLayout layout = SettingsLayout.forHeight(180);
-
-        // Section 0 (location): only the destination row.
-        assertEquals(1, layout.zipSectionRowCount(0));
-        assertEquals(77, layout.zipRowY(0, 0));
-
-        // Section 1 (timing): only the trigger row.
-        assertEquals(1, layout.zipSectionRowCount(1));
-        assertEquals(77, layout.zipRowY(1, 0));
-
-        assertThrows(IllegalArgumentException.class, () -> layout.zipRowY(2, 0));
-    }
-
-    // A tall but narrow screen (content width below FULL_CONTENT_WIDTH) still renders the paged
-    // git/zip pages, exactly as the pre-refactor screen did: its addGitPage/addZipPage chose the
-    // full page only when the screen was both tall AND at least 300 content units wide. The row
-    // geometry must therefore follow the paged grid (header 54, rows from 77) and expose all
-    // three git / two zip sections, not the full-page grid.
-    @Test
-    void tallButNarrowScreensUseThePagedGitAndZipGrids() {
-        SettingsLayout layout = SettingsLayout.forScreen(
-                SettingsLayout.COMPACT_HEIGHT_THRESHOLD, SettingsLayout.FULL_CONTENT_WIDTH - 1);
-
-        assertFalse(layout.compact());
-        assertTrue(layout.paged());
-        assertEquals(3, layout.gitSectionCount());
-        assertEquals(2, layout.zipSectionCount());
-        assertEquals(54, layout.pagedHeaderY());
-
-        assertEquals(1, layout.gitSectionRowCount(0));
-        assertEquals(77, layout.gitRowY(0, 0));
-        assertEquals(2, layout.gitSectionRowCount(1));
-        assertEquals(77, layout.gitRowY(1, 0));
-        assertEquals(99, layout.gitRowY(1, 1));
-        assertEquals(1, layout.gitSectionRowCount(2));
-        assertEquals(77, layout.gitRowY(2, 0));
-
-        assertEquals(1, layout.zipSectionRowCount(0));
-        assertEquals(77, layout.zipRowY(0, 0));
-        assertEquals(1, layout.zipSectionRowCount(1));
-        assertEquals(77, layout.zipRowY(1, 0));
-    }
-
-    @Test
-    void tallAndWideScreensUseTheFullGitAndZipGrids() {
-        SettingsLayout layout = SettingsLayout.forScreen(
-                SettingsLayout.COMPACT_HEIGHT_THRESHOLD, SettingsLayout.FULL_CONTENT_WIDTH);
-
-        assertFalse(layout.paged());
-        assertEquals(1, layout.gitSectionCount());
-        assertEquals(1, layout.zipSectionCount());
-        assertEquals(54, layout.gitRowY(0, 0));
-        assertEquals(53, layout.zipRowY(0, 0));
-    }
-
-    @Test
-    void shortScreensStayPagedRegardlessOfWidth() {
-        SettingsLayout layout = SettingsLayout.forScreen(180, 1000);
-
-        assertTrue(layout.compact());
-        assertTrue(layout.paged());
-        assertEquals(3, layout.gitSectionCount());
-        assertEquals(77, layout.gitRowY(2, 0));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/settings/SettingsScreenStateTest.java b/src/test/java/dev/ishaanko/worldarchive/settings/SettingsScreenStateTest.java
deleted file mode 100644
index 4ca270b..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/settings/SettingsScreenStateTest.java
+++ /dev/null
@@ -1,43 +0,0 @@
-package dev.ishaanko.worldarchive.settings;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import org.junit.jupiter.api.Test;
-
-class SettingsScreenStateTest {
-    @Test
-    void rejectsStaleCallbacksAcrossOperationsAndScreenLifecycles() {
-        SettingsScreenState state = new SettingsScreenState();
-        SettingsScreenState.LifecycleToken beforeInitialization = state.lifecycleToken();
-
-        assertTrue(state.acceptsBeforeInitialization(beforeInitialization));
-        assertFalse(state.acceptsActive(beforeInitialization));
-
-        state.activate();
-        SettingsScreenState.RevisionToken firstValidation = state.nextValidation();
-        SettingsScreenState.RevisionToken currentValidation = state.nextValidation();
-        SettingsScreenState.RevisionToken health = state.nextHealthProbe();
-
-        assertFalse(state.acceptsValidation(firstValidation));
-        assertTrue(state.acceptsValidation(currentValidation));
-        assertTrue(state.acceptsHealthProbe(health));
-        assertTrue(state.beginSave().isPresent());
-        assertTrue(state.beginSave().isEmpty());
-
-        state.deactivate();
-
-        assertFalse(state.acceptsActive(beforeInitialization));
-        assertFalse(state.acceptsValidation(currentValidation));
-        assertFalse(state.acceptsHealthProbe(health));
-        assertFalse(state.saving());
-
-        state.activate();
-        SettingsScreenState.LifecycleToken reopened = state.lifecycleToken();
-        assertTrue(state.acceptsActive(reopened));
-
-        state.close();
-        assertFalse(state.acceptsBeforeInitialization(reopened));
-        assertFalse(state.acceptsActive(reopened));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/settings/SettingsServiceTest.java b/src/test/java/dev/ishaanko/worldarchive/settings/SettingsServiceTest.java
new file mode 100644
index 0000000..27072ed
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/settings/SettingsServiceTest.java
@@ -0,0 +1,279 @@
+package dev.ishaanko.worldarchive.settings;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.config.DefaultDestinations;
+import dev.ishaanko.worldarchive.config.TriggerConfig;
+import dev.ishaanko.worldarchive.config.UnreadableConfigurationException;
+import dev.ishaanko.worldarchive.config.UnsupportedSchemaVersionException;
+import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
+import dev.ishaanko.worldarchive.config.WorldArchiveConfigStore;
+import dev.ishaanko.worldarchive.config.WorldConfig;
+import dev.ishaanko.worldarchive.config.WorldIdentityStore;
+import dev.ishaanko.worldarchive.model.WorldId;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Clock;
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.CompletionException;
+import java.util.concurrent.CompletionStage;
+import java.util.function.UnaryOperator;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+/** The settings service on real folders, a real settings file and real world identity files. */
+class SettingsServiceTest {
+    private static final Clock CLOCK = Clock.fixed(Instant.parse("2026-09-22T15:45:00Z"), ZoneOffset.UTC);
+
+    private static final String REMOTE = "https://example.com/player/world.git";
+
+    private final WorldIdentityStore identities = new WorldIdentityStore();
+
+    @TempDir
+    Path temporaryDirectory;
+
+    @Test
+    void unreadableSettingsAreNeverOverwrittenUntilReset() throws IOException {
+        Path game = Files.createDirectory(temporaryDirectory.resolve("minecraft"));
+        Path world = world(Files.createDirectory(game.resolve("saves")), "World");
+        Path configFile = Files.createDirectory(game.resolve("config")).resolve("worldarchive.json");
+        String newerSettings = "{\"schemaVersion\": 99, \"destinations\": {\"zip\": {\"destination\": \"E:\\\\Backups\"}}}\n";
+        Files.writeString(configFile, newerSettings, StandardCharsets.UTF_8);
+        SettingsService settings = service(game);
+
+        UnreadableConfigurationException failure = failure(UnreadableConfigurationException.class, settings.load());
+        assertTrue(assertInstanceOf(UnsupportedSchemaVersionException.class, failure.getCause()).newer());
+        failure(UnreadableConfigurationException.class, settings.registerWorld(identities.loadOrCreate(world), world));
+        failure(UnreadableConfigurationException.class, settings.update(config -> new WorldArchiveConfig(
+                new TriggerConfig(false, true, false, 45), config.git(), config.zip(), config.worlds())));
+        failure(UnreadableConfigurationException.class, settings.saveSettings(UnaryOperator.identity()));
+        assertEquals(newerSettings, Files.readString(configFile, StandardCharsets.UTF_8));
+
+        Path keptCopy = await(settings.reset()).orElseThrow();
+
+        assertEquals(configFile.resolveSibling("worldarchive.json.unreadable-20260922T154500Z"), keptCopy);
+        assertEquals(newerSettings, Files.readString(keptCopy, StandardCharsets.UTF_8));
+        assertTrue(settings.unreadable().isEmpty());
+        assertEquals(List.of(world.toRealPath()), paths(await(service(game).load())));
+    }
+
+    /** Another game window fixed the settings file after this one found it unreadable: Reset keeps the file. */
+    @Test
+    void resetKeepsASettingsFileThatReadsAgain() throws IOException {
+        Path game = Files.createDirectory(temporaryDirectory.resolve("minecraft"));
+        world(Files.createDirectory(game.resolve("saves")), "World");
+        Path configFile = Files.createDirectory(game.resolve("config")).resolve("worldarchive.json");
+        Files.writeString(configFile, "{\"schemaVersion\": 7,", StandardCharsets.UTF_8);
+        SettingsService settings = service(game);
+        failure(UnreadableConfigurationException.class, settings.load());
+        Files.delete(configFile);
+        await(service(game).update(config -> new WorldArchiveConfig(
+                new TriggerConfig(true, true, true, 45), config.git(), config.zip(), config.worlds())));
+
+        Optional<Path> keptCopy = await(settings.reset());
+
+        assertEquals(Optional.empty(), keptCopy);
+        assertTrue(settings.unreadable().isEmpty());
+        assertEquals(45, settings.current().triggers().scheduleIntervalMinutes());
+        assertEquals(45, await(service(game).load()).triggers().scheduleIntervalMinutes());
+        try (Stream<Path> files = Files.list(configFile.getParent())) {
+            assertTrue(files.noneMatch(file -> file.getFileName().toString().contains(".unreadable-")));
+        }
+    }
+
+    @Test
+    void aFixedFileIsReadAgainAndReachesListeners() throws IOException {
+        Path game = Files.createDirectory(temporaryDirectory.resolve("minecraft"));
+        Path world = world(Files.createDirectory(game.resolve("saves")), "World");
+        Path configFile = Files.createDirectory(game.resolve("config")).resolve("worldarchive.json");
+        Files.writeString(configFile, "{\"schemaVersion\": 7,", StandardCharsets.UTF_8);
+        SettingsService settings = service(game);
+        List<WorldArchiveConfig> published = new ArrayList<>();
+        settings.addConfigurationListener(published::add);
+        failure(UnreadableConfigurationException.class, settings.load());
+
+        Files.delete(configFile);
+        WorldArchiveConfig loaded = await(settings.load());
+
+        assertTrue(settings.unreadable().isEmpty());
+        assertEquals(List.of(world.toRealPath()), paths(loaded));
+        assertEquals(List.of(loaded), published);
+    }
+
+    @Test
+    void copiedWorldKeepsSettingsOnTheOriginalFolder() throws IOException {
+        Path game = Files.createDirectory(temporaryDirectory.resolve("minecraft"));
+        Path saves = Files.createDirectory(game.resolve("saves"));
+        Path original = world(saves, "World");
+        WorldId worldId = identities.loadOrCreate(original);
+        SettingsService before = service(game);
+        await(before.load());
+        await(before.update(config -> config.withWorld(worldId, world -> world.withRemoteUrl(Optional.of(REMOTE)))));
+        Path copy = world(saves, "A copy of World");
+        Files.createDirectory(copy.resolve(".worldarchive"));
+        Files.copy(original.resolve(".worldarchive/world.json"), copy.resolve(".worldarchive/world.json"));
+
+        SettingsService restarted = service(game);
+        WorldArchiveConfig loaded = await(restarted.load());
+
+        WorldConfig kept = loaded.world(worldId).orElseThrow();
+        assertEquals(original.toRealPath(), kept.path());
+        assertEquals(Optional.of(REMOTE), kept.remoteUrl());
+        WorldId copyId = identities.loadOrCreate(copy);
+        assertNotEquals(worldId, copyId);
+        assertEquals(Optional.empty(), loaded.world(copyId).orElseThrow().remoteUrl());
+        assertEquals(
+                List.of(new WorldNotice.CopyGotOwnIdentity(copy.toRealPath(), original.toRealPath())),
+                restarted.notices());
+    }
+
+    @Test
+    void staleWriterDoesNotEraseAnotherWritersChange() throws IOException {
+        Path game = Files.createDirectory(temporaryDirectory.resolve("minecraft"));
+        Path saves = Files.createDirectory(game.resolve("saves"));
+        WorldId firstId = identities.loadOrCreate(world(saves, "First"));
+        SettingsService windowA = service(game);
+        SettingsService windowB = service(game);
+        await(windowA.load());
+        await(windowB.load());
+        SettingsDraft screenInA = SettingsDraft.from(windowA.current());
+
+        await(windowB.update(config -> config.withWorld(firstId, world -> world.withRemoteUrl(Optional.of(REMOTE)))));
+        Path second = world(saves, "Second");
+        WorldId secondId = identities.loadOrCreate(second);
+        await(windowA.registerWorld(secondId, second.toRealPath()));
+        screenInA.setScheduleInterval("45");
+        await(windowA.saveSettings(screenInA.changes(screenInA.validate(List.of()).config().orElseThrow())));
+
+        WorldArchiveConfig onDisk = await(service(game).load());
+        assertEquals(Optional.of(REMOTE), onDisk.world(firstId).orElseThrow().remoteUrl());
+        assertTrue(onDisk.world(secondId).isPresent());
+        assertEquals(45, onDisk.triggers().scheduleIntervalMinutes());
+    }
+
+    @Test
+    void worldsNamedLikeCredentialsCanBeSaved() throws IOException {
+        Path game = Files.createDirectory(temporaryDirectory.resolve("Basic Survival Pack"));
+        Path saves = Files.createDirectory(game.resolve("saves"));
+        Path basic = world(saves, "Basic Survival");
+        Path secret = world(saves, "Secret=Base");
+
+        WorldArchiveConfig loaded = await(service(game).load());
+
+        assertEquals(List.of(basic.toRealPath(), secret.toRealPath()), paths(loaded));
+        assertEquals(loaded, await(service(game).load()));
+    }
+
+    @Test
+    void destinationInsideAWorldCreatedAfterLoadingIsRefusedAndNothingChanges() throws IOException {
+        Path game = Files.createDirectory(temporaryDirectory.resolve("minecraft"));
+        Path saves = Files.createDirectory(game.resolve("saves"));
+        world(saves, "Old World");
+        SettingsService settings = service(game);
+        await(settings.load());
+        Path configFile = game.resolve("config/worldarchive.json");
+        String saved = Files.readString(configFile, StandardCharsets.UTF_8);
+        Path newWorld = world(saves, "New World");
+        SettingsDraft screen = SettingsDraft.from(settings.current());
+        screen.setZipDestination(newWorld.resolve("backups").toString());
+        WorldArchiveConfig edited = screen.validate(List.of()).config().orElseThrow();
+
+        IOException refused = failure(IOException.class, settings.saveSettings(screen.changes(edited)));
+
+        assertTrue(refused.getMessage().contains("must not be inside a source world"), refused.getMessage());
+        assertEquals(saved, Files.readString(configFile, StandardCharsets.UTF_8));
+        assertFalse(Files.exists(newWorld.resolve("backups")));
+    }
+
+    /** Backups never create a folder the player chose, so the save that names a new one creates it. */
+    @Test
+    void savingANewZipFolderCreatesIt() throws IOException {
+        Path game = Files.createDirectory(temporaryDirectory.resolve("minecraft"));
+        world(Files.createDirectory(game.resolve("saves")), "World");
+        SettingsService settings = service(game);
+        await(settings.load());
+        Path chosen = temporaryDirectory.resolve("usb/Backups");
+        SettingsDraft screen = SettingsDraft.from(settings.current());
+        screen.setZipDestination(chosen.toString());
+
+        await(settings.saveSettings(screen.changes(screen.validate(List.of()).config().orElseThrow())));
+
+        assertTrue(Files.isDirectory(chosen));
+    }
+
+    /**
+     * A restore writes the world into a staging folder in the saves folder. A scan while it runs,
+     * as a settings save starts, neither gives that folder an identity nor lists it as a world.
+     */
+    @Test
+    void aRestoreStagingFolderIsNeitherGivenAnIdentityNorListedAsAWorld() throws IOException {
+        Path game = Files.createDirectory(temporaryDirectory.resolve("minecraft"));
+        Path staging = Files.createDirectories(game.resolve("saves/.worldarchive-restore-123456"));
+        Files.writeString(staging.resolve("level.dat"), "level data being restored", StandardCharsets.UTF_8);
+
+        WorldArchiveConfig loaded = await(service(game).load());
+
+        assertEquals(List.of(), paths(loaded));
+        assertFalse(Files.exists(staging.resolve(".worldarchive")));
+    }
+
+    @Test
+    void importedRemoteFillsOnlyAWorldWithoutOne() throws IOException {
+        Path game = Files.createDirectory(temporaryDirectory.resolve("minecraft"));
+        Path saves = Files.createDirectory(game.resolve("saves"));
+        WorldId connected = identities.loadOrCreate(world(saves, "Connected"));
+        WorldId unconnected = identities.loadOrCreate(world(saves, "Unconnected"));
+        SettingsService settings = service(game);
+        await(settings.load());
+        await(settings.update(config -> config.withWorld(connected, world -> world.withRemoteUrl(Optional.of(REMOTE)))));
+        String usbCopy = temporaryDirectory.resolve("usb/world.git").toString();
+
+        WorldArchiveConfig saved = await(settings.connectWorldRemotes(Map.of(connected, usbCopy, unconnected, usbCopy)));
+
+        assertEquals(Optional.of(REMOTE), saved.world(connected).orElseThrow().remoteUrl());
+        assertEquals(Optional.of(usbCopy), saved.world(unconnected).orElseThrow().remoteUrl());
+    }
+
+    private SettingsService service(Path game) {
+        return new SettingsService(
+                new WorldArchiveConfigStore(
+                        game.resolve("config/worldarchive.json"),
+                        new DefaultDestinations(game.resolve("worldarchive"))),
+                game.resolve("saves"),
+                identities,
+                Runnable::run,
+                CLOCK);
+    }
+
+    private static Path world(Path saves, String name) throws IOException {
+        Path world = Files.createDirectory(saves.resolve(name));
+        Files.writeString(world.resolve("level.dat"), "level data", StandardCharsets.UTF_8);
+        return world;
+    }
+
+    private static List<Path> paths(WorldArchiveConfig config) {
+        return config.worlds().stream().map(WorldConfig::path).toList();
+    }
+
+    private static <T> T await(CompletionStage<T> stage) {
+        return stage.toCompletableFuture().join();
+    }
+
+    private static <E extends Throwable> E failure(Class<E> type, CompletionStage<?> stage) {
+        CompletionException failure = assertThrows(CompletionException.class, () -> await(stage));
+        return assertInstanceOf(type, failure.getCause());
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/settings/SystemSettingsHealthProbeTest.java b/src/test/java/dev/ishaanko/worldarchive/settings/SystemSettingsHealthProbeTest.java
deleted file mode 100644
index b1d3899..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/settings/SystemSettingsHealthProbeTest.java
+++ /dev/null
@@ -1,92 +0,0 @@
-package dev.ishaanko.worldarchive.settings;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-
-import dev.ishaanko.worldarchive.storage.git.GitCommandResult;
-import dev.ishaanko.worldarchive.storage.git.GitCommandRunner;
-import java.nio.file.Path;
-import java.util.Optional;
-import java.util.concurrent.atomic.AtomicInteger;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-class SystemSettingsHealthProbeTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void reportsToolsAndDestinationFoldersIndependently() throws Exception {
-        GitCommandRunner runner = command -> command.arguments().contains("lfs")
-                ? result(0, "git-lfs/3.7.0")
-                : result(0, "git version 2.50.1");
-        SystemSettingsHealthProbe probe = new SystemSettingsHealthProbe(
-                temporaryDirectory,
-                runner);
-        SettingsProbeRequest request = new SettingsProbeRequest(
-                true,
-                "git",
-                Optional.of(temporaryDirectory.resolve("repository.git")),
-                true,
-                true,
-                Optional.of(temporaryDirectory.resolve("archives")));
-
-        SettingsHealthSnapshot health = probe.probe(request);
-
-        assertEquals(SettingsHealthStatus.HEALTHY, health.gitTool().status());
-        assertEquals(SettingsHealthStatus.HEALTHY, health.lfsTool().status());
-        assertEquals(SettingsHealthStatus.HEALTHY, health.repository().status());
-        assertEquals(SettingsHealthStatus.HEALTHY, health.remote().status());
-        assertEquals(SettingsHealthStatus.HEALTHY, health.zipDirectory().status());
-    }
-
-    @Test
-    void missingLfsDoesNotHideAHealthyGitExecutableOrZipFolder() throws Exception {
-        GitCommandRunner runner = command -> command.arguments().contains("lfs")
-                ? result(1, "Git LFS is not installed")
-                : result(0, "git version 2.50.1");
-        SettingsHealthSnapshot health = new SystemSettingsHealthProbe(
-                        temporaryDirectory,
-                        runner)
-                .probe(new SettingsProbeRequest(
-                        true,
-                        "git",
-                        Optional.of(temporaryDirectory.resolve("repository.git")),
-                        false,
-                        true,
-                        Optional.of(temporaryDirectory.resolve("archives"))));
-
-        assertEquals(SettingsHealthStatus.HEALTHY, health.gitTool().status());
-        assertEquals(SettingsHealthStatus.TOOL_MISSING, health.lfsTool().status());
-        assertEquals(SettingsHealthStatus.HEALTHY, health.repository().status());
-        assertEquals(SettingsHealthStatus.UNCONFIGURED, health.remote().status());
-        assertEquals(SettingsHealthStatus.HEALTHY, health.zipDirectory().status());
-    }
-
-    @Test
-    void disabledDestinationsDoNotStartGitProcesses() throws Exception {
-        AtomicInteger invocations = new AtomicInteger();
-        GitCommandRunner runner = command -> {
-            invocations.incrementAndGet();
-            return result(0, "unexpected");
-        };
-
-        SettingsHealthSnapshot health = new SystemSettingsHealthProbe(
-                        temporaryDirectory,
-                        runner)
-                .probe(new SettingsProbeRequest(
-                        false,
-                        "git",
-                        Optional.empty(),
-                        false,
-                        false,
-                        Optional.empty()));
-
-        assertEquals(0, invocations.get());
-        assertEquals(SettingsHealthStatus.DISABLED, health.gitTool().status());
-        assertEquals(SettingsHealthStatus.DISABLED, health.zipDirectory().status());
-    }
-
-    private static GitCommandResult result(int exitCode, String output) {
-        return new GitCommandResult(exitCode, output, "", false, false);
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/settings/WorldArchiveSettingsRepositoryTest.java b/src/test/java/dev/ishaanko/worldarchive/settings/WorldArchiveSettingsRepositoryTest.java
deleted file mode 100644
index 83007cd..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/settings/WorldArchiveSettingsRepositoryTest.java
+++ /dev/null
@@ -1,184 +0,0 @@
-package dev.ishaanko.worldarchive.settings;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
-import dev.ishaanko.worldarchive.config.WorldArchiveConfigStore;
-import dev.ishaanko.worldarchive.config.WorldConfig;
-import dev.ishaanko.worldarchive.config.ZipDestinationConfig;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.Optional;
-import java.util.concurrent.atomic.AtomicReference;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-class WorldArchiveSettingsRepositoryTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void savesAtomicallyThroughSharedKnownWorldValidation() throws IOException {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
-        SettingsDefaults settingsDefaults = new SettingsDefaults(temporaryDirectory.resolve("storage"));
-        WorldArchiveSettingsRepository repository = new WorldArchiveSettingsRepository(
-                new WorldArchiveConfigStore(temporaryDirectory.resolve("config/worldarchive.json")),
-                () -> List.of(world),
-                settingsDefaults);
-        WorldArchiveConfig defaults = WorldArchiveConfig.defaults();
-        WorldArchiveConfig recursive = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                defaults.triggers(),
-                defaults.git(),
-                new ZipDestinationConfig(true, Optional.of(world.resolve("backups"))),
-                defaults.worlds());
-
-        assertThrows(IOException.class, () -> repository.save(recursive));
-        assertEquals(settingsDefaults.resolve(WorldArchiveConfig.defaults()), repository.current());
-    }
-
-    @Test
-    void roundTripsAValidPausedConfigurationWithOperationalDefaults() throws IOException {
-        WorldArchiveConfig defaults = WorldArchiveConfig.defaults();
-        WorldArchiveConfig paused = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                defaults.triggers(),
-                new dev.ishaanko.worldarchive.config.GitDestinationConfig(
-                        false,
-                        Optional.empty(),
-                        "origin",
-                        Optional.empty()),
-                new ZipDestinationConfig(false, Optional.empty()),
-                List.of());
-        Path configFile = temporaryDirectory.resolve("config/worldarchive.json");
-        WorldArchiveSettingsRepository repository = new WorldArchiveSettingsRepository(
-                new WorldArchiveConfigStore(configFile),
-                List::of);
-
-        repository.save(paused);
-
-        WorldArchiveSettingsRepository reloaded = new WorldArchiveSettingsRepository(
-                new WorldArchiveConfigStore(configFile),
-                List::of);
-        WorldArchiveConfig expected = SettingsDefaults.fromConfigFile(configFile)
-                .resolve(paused)
-                .validateDestinations(List.of());
-        assertEquals(expected, reloaded.load());
-    }
-
-    @Test
-    void resolvesAndPersistsProductDestinationPathsOnFirstLoad() throws IOException {
-        Path gameDirectory = Files.createDirectory(temporaryDirectory.resolve("minecraft"));
-        Path configFile = gameDirectory.resolve("config/worldarchive.json");
-        WorldArchiveSettingsRepository repository = new WorldArchiveSettingsRepository(
-                new WorldArchiveConfigStore(configFile),
-                List::of);
-
-        WorldArchiveConfig loaded = repository.load();
-
-        assertEquals(
-                gameDirectory.toRealPath().resolve("worldarchive/git"),
-                loaded.git().repository().orElseThrow());
-        assertEquals(
-                gameDirectory.toRealPath().resolve("worldarchive/archives"),
-                loaded.zip().destination().orElseThrow());
-        assertTrue(Files.isRegularFile(configFile));
-        assertEquals(loaded, new WorldArchiveConfigStore(configFile).load(List.of()));
-    }
-
-    @Test
-    void disabledConfiguredDestinationIsStillCheckedAgainstWorlds() throws IOException {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("disabled-world"));
-        SettingsDefaults settingsDefaults = new SettingsDefaults(temporaryDirectory.resolve("storage"));
-        WorldArchiveSettingsRepository repository = new WorldArchiveSettingsRepository(
-                new WorldArchiveConfigStore(temporaryDirectory.resolve("config/disabled.json")),
-                () -> List.of(world),
-                settingsDefaults);
-        WorldArchiveConfig defaults = settingsDefaults.resolve(WorldArchiveConfig.defaults());
-        WorldArchiveConfig unsafe = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                defaults.triggers(),
-                defaults.git(),
-                new ZipDestinationConfig(false, Optional.of(world.resolve("archives"))),
-                defaults.worlds());
-
-        assertThrows(IOException.class, () -> repository.save(unsafe));
-    }
-
-    @Test
-    void newlyKnownRuntimeWorldRejectsUnsafeSaveWithoutChangingStoredConfig() throws IOException {
-        AtomicReference<List<Path>> knownWorlds = new AtomicReference<>(List.of());
-        Path configFile = temporaryDirectory.resolve("config/runtime-world.json");
-        SettingsDefaults defaults = new SettingsDefaults(temporaryDirectory.resolve("storage"));
-        WorldArchiveSettingsRepository repository = new WorldArchiveSettingsRepository(
-                new WorldArchiveConfigStore(configFile),
-                knownWorlds::get,
-                defaults);
-        WorldArchiveConfig safe = defaults.resolve(WorldArchiveConfig.defaults())
-                .validateDestinations(List.of());
-        repository.save(safe);
-        Path runtimeWorld = Files.createDirectory(temporaryDirectory.resolve("runtime-world"));
-        knownWorlds.set(List.of(runtimeWorld));
-        WorldArchiveConfig unsafe = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                safe.triggers(),
-                safe.git(),
-                new ZipDestinationConfig(false, Optional.of(runtimeWorld.resolve("archives"))),
-                safe.worlds());
-
-        assertThrows(IOException.class, () -> repository.save(unsafe));
-        assertEquals(safe, repository.current());
-        assertEquals(safe, new WorldArchiveConfigStore(configFile).load(knownWorlds.get()));
-    }
-
-    @Test
-    void runtimeWorldRegistrationIsImmediatelyKnownAndDurablyUpserted() throws IOException {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("registered-world"));
-        WorldId worldId = WorldId.create();
-        List<Path> known = ClientSettingsAccess.mergedWorldPaths(List.of(), List.of(world));
-        WorldArchiveConfig updated = ClientSettingsAccess.upsertWorld(
-                WorldArchiveConfig.defaults(), worldId, world);
-        Path configFile = temporaryDirectory.resolve("config/registered-world.json");
-        WorldArchiveSettingsRepository repository = new WorldArchiveSettingsRepository(
-                new WorldArchiveConfigStore(configFile),
-                () -> known);
-
-        repository.save(updated);
-
-        WorldArchiveConfig durable = new WorldArchiveSettingsRepository(
-                new WorldArchiveConfigStore(configFile),
-                () -> known).load();
-        assertTrue(known.contains(world.toAbsolutePath().normalize()));
-        assertTrue(durable.worlds().contains(new WorldConfig(worldId, true, world.toRealPath())));
-    }
-
-    @Test
-    void saveRefreshFindsUnselectedNewWorldBeforeDestinationValidation() throws IOException {
-        Path saves = Files.createDirectory(temporaryDirectory.resolve("saves"));
-        Path newWorld = Files.createDirectory(saves.resolve("new-world"));
-        Files.writeString(newWorld.resolve("level.dat"), "world data");
-        AtomicReference<List<Path>> known = new AtomicReference<>(List.of());
-        WorldArchiveConfig defaults = WorldArchiveConfig.defaults();
-        WorldArchiveConfig unsafe = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                defaults.triggers(),
-                defaults.git(),
-                new ZipDestinationConfig(false, Optional.of(newWorld.resolve("archives"))),
-                defaults.worlds());
-        WorldArchiveConfig refreshed = ClientSettingsAccess.refreshWorlds(
-                unsafe, saves, known::set);
-        WorldArchiveSettingsRepository repository = new WorldArchiveSettingsRepository(
-                new WorldArchiveConfigStore(
-                        temporaryDirectory.resolve("config/refreshed-world.json")),
-                known::get);
-
-        assertThrows(IOException.class, () -> repository.save(refreshed));
-        assertEquals(List.of(newWorld.toRealPath()), known.get());
-        assertEquals(1, refreshed.worlds().size());
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/settings/WorldConfigReconcilerTest.java b/src/test/java/dev/ishaanko/worldarchive/settings/WorldConfigReconcilerTest.java
index 3ac51d6..9805045 100644
--- a/src/test/java/dev/ishaanko/worldarchive/settings/WorldConfigReconcilerTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/settings/WorldConfigReconcilerTest.java
@@ -1,12 +1,10 @@
 package dev.ishaanko.worldarchive.settings;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import dev.ishaanko.worldarchive.config.StoragePolicy;
 import dev.ishaanko.worldarchive.config.WorldConfig;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.nio.file.Path;
 import java.util.List;
@@ -14,80 +12,62 @@
 import org.junit.jupiter.api.Test;
 
 class WorldConfigReconcilerTest {
-    @Test
-    void preservesEnablementWhenStableWorldMoves() {
-        WorldId worldId = WorldId.create();
-        WorldConfig existing = new WorldConfig(
-                worldId,
-                false,
-                Path.of("old-save"),
-                Optional.of("https://example.invalid/forever-world.git"));
-        Path moved = Path.of("moved-save");
-
-        WorldReconciliation reconciliation = WorldConfigReconciler.reconcile(
-                List.of(existing),
-                List.of(DiscoveredWorld.success(moved, worldId)));
-
-        assertTrue(reconciliation.errors().isEmpty());
-        assertEquals(1, reconciliation.worlds().size());
-        assertEquals(moved.toAbsolutePath().normalize(), reconciliation.worlds().getFirst().path());
-        assertFalse(reconciliation.worlds().getFirst().enabled());
-        assertEquals(existing.remoteUrl(), reconciliation.worlds().getFirst().remoteUrl());
-    }
+    private static final Path SAVES = Path.of("saves").toAbsolutePath();
 
     @Test
-    void rejectsTwoIdentitiesDiscoveredAtTheSamePath() {
-        Path path = Path.of("same-save");
+    void aMovedWorldKeepsItsSettings() {
+        WorldId worldId = WorldId.create();
+        WorldConfig stored = WorldConfig.defaults(worldId, SAVES.resolve("old-name"))
+                .withEnabled(false)
+                .withRemoteUrl(Optional.of("https://example.invalid/forever-world.git"));
+        Path moved = SAVES.resolve("new-name");
 
         WorldReconciliation reconciliation = WorldConfigReconciler.reconcile(
-                List.of(),
-                List.of(
-                        DiscoveredWorld.success(path, WorldId.create()),
-                        DiscoveredWorld.success(path, WorldId.create())));
+                List.of(stored),
+                List.of(new DiscoveredWorld(moved, worldId)));
 
-        assertEquals(1, reconciliation.worlds().size());
-        assertEquals(1, reconciliation.errors().size());
-        assertTrue(reconciliation.errors().getFirst().contains("same save folder"));
+        assertEquals(List.of(stored.withPath(moved)), reconciliation.worlds());
+        assertTrue(reconciliation.notices().isEmpty());
     }
 
     @Test
-    void doesNotCopySettingsToAReplacementIdentityAtTheSamePath() {
-        Path path = Path.of("replaced-save");
-        StoragePolicy customPolicy = new StoragePolicy(16_000, 2, 3, 4);
-        WorldConfig existing = new WorldConfig(
+    void aReplacedFolderDoesNotInheritTheOldSettings() {
+        Path path = SAVES.resolve("replaced");
+        WorldConfig stored = new WorldConfig(
                 WorldId.create(),
                 false,
                 path,
                 Optional.of("https://example.invalid/old-world.git"),
                 Optional.of(Path.of("old-zip-destination")),
-                customPolicy);
+                new StoragePolicy(16_000, 2, 3, 4));
         WorldId replacementId = WorldId.create();
 
         WorldReconciliation reconciliation = WorldConfigReconciler.reconcile(
-                List.of(existing),
-                List.of(DiscoveredWorld.success(path, replacementId)));
+                List.of(stored),
+                List.of(new DiscoveredWorld(path, replacementId)));
 
-        assertEquals(1, reconciliation.errors().size());
-        WorldConfig replacement = reconciliation.worlds().getFirst();
-        assertEquals(replacementId, replacement.worldId());
-        assertTrue(replacement.enabled());
-        assertEquals(Optional.empty(), replacement.remoteUrl());
-        assertEquals(Optional.empty(), replacement.zipDestination());
-        assertEquals(StoragePolicy.defaults(), replacement.storagePolicy());
+        assertEquals(List.of(WorldConfig.defaults(replacementId, path)), reconciliation.worlds());
+        assertEquals(List.of(new WorldNotice.IdentityReplaced(path)), reconciliation.notices());
     }
 
     @Test
-    void discoveryFailuresAreRedactedBeforeReconciliation() {
-        DiscoveredWorld failure = DiscoveredWorld.failure(
-                Path.of("failed-save"),
-                "Could not read https://user:password@example.com/world.json");
-
-        WorldReconciliation reconciliation = WorldConfigReconciler.reconcile(
-                List.of(),
-                List.of(failure));
+    void aCopiedFolderNeverTakesTheOriginalsSettings() {
+        WorldId worldId = WorldId.create();
+        Path original = SAVES.resolve("World");
+        Path copy = SAVES.resolve("A copy of World");
+        WorldConfig stored = WorldConfig.defaults(worldId, original)
+                .withRemoteUrl(Optional.of("https://example.invalid/w.git"));
+        List<DiscoveredWorld> found = List.of(new DiscoveredWorld(copy, worldId), new DiscoveredWorld(original, worldId));
 
         assertEquals(
-                "Could not read https://" + SensitiveDataRedactor.REDACTED + "@example.com/world.json",
-                reconciliation.errors().getFirst());
+                List.of(new WorldConfigReconciler.Copy(copy, worldId, original)),
+                WorldConfigReconciler.copies(List.of(stored), found));
+        WorldReconciliation reconciliation = WorldConfigReconciler.reconcile(List.of(stored), found);
+        assertEquals(List.of(stored), reconciliation.worlds());
+
+        WorldReconciliation unknownOriginal = WorldConfigReconciler.reconcile(List.of(), found);
+        assertTrue(WorldConfigReconciler.copies(List.of(), found).isEmpty());
+        assertTrue(unknownOriginal.worlds().isEmpty());
+        assertEquals(List.of(new WorldNotice.SharedIdentity(List.of(copy, original))), unknownOriginal.notices());
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/settings/WorldFolderDiscoveryTest.java b/src/test/java/dev/ishaanko/worldarchive/settings/WorldFolderDiscoveryTest.java
index 591303a..d9a792b 100644
--- a/src/test/java/dev/ishaanko/worldarchive/settings/WorldFolderDiscoveryTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/settings/WorldFolderDiscoveryTest.java
@@ -4,11 +4,11 @@
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
-import dev.ishaanko.worldarchive.config.WorldIdentityStore;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.List;
+import org.junit.jupiter.api.Assumptions;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
@@ -17,46 +17,34 @@ class WorldFolderDiscoveryTest {
     Path temporaryDirectory;
 
     @Test
-    void ignoresAndDoesNotModifyNonWorldFolders() throws IOException {
+    void findsOnlyFoldersWithLevelDataAndChangesNothing() throws IOException {
         Path saves = Files.createDirectory(temporaryDirectory.resolve("saves"));
-        Path world = Files.createDirectory(saves.resolve("actual-world"));
-        Files.writeString(world.resolve("level.dat"), "level data");
+        Path world = world(saves, "actual-world");
         Path unrelated = Files.createDirectory(saves.resolve("screenshots"));
         Files.writeString(unrelated.resolve("notes.txt"), "not a world");
-        Path fake = Files.createDirectory(saves.resolve("fake-world"));
-        Files.createDirectory(fake.resolve("level.dat"));
+        Files.createDirectories(saves.resolve("fake-world/level.dat"));
+        Path created = Files.createDirectory(saves.resolve("being-created"));
 
-        List<Path> discovered = WorldFolderDiscovery.discover(saves);
-        WorldIdentityStore identities = new WorldIdentityStore();
-        discovered.forEach(path -> {
-            try {
-                identities.loadOrCreate(path);
-            } catch (IOException exception) {
-                throw new AssertionError(exception);
-            }
-        });
+        assertEquals(List.of(world.toRealPath()), WorldFolderDiscovery.discover(saves));
+        assertFalse(Files.exists(world.resolve(".worldarchive")));
 
-        assertEquals(List.of(world.toRealPath()), discovered);
-        assertTrue(Files.isRegularFile(world.resolve(".worldarchive/world.json")));
-        assertFalse(Files.exists(unrelated.resolve(".worldarchive")));
-        assertFalse(Files.exists(fake.resolve(".worldarchive")));
+        Files.writeString(created.resolve("level.dat"), "level data");
+        assertEquals(List.of(world.toRealPath(), created.toRealPath()), WorldFolderDiscovery.discover(saves));
     }
 
     @Test
-    void ignoresLinkedWorldDirectoriesWithoutTouchingTheirTargets() throws IOException {
-        Path saves = Files.createDirectory(temporaryDirectory.resolve("linked-saves"));
-        Path outsideWorld = Files.createDirectory(temporaryDirectory.resolve("outside-world"));
-        Files.writeString(outsideWorld.resolve("level.dat"), "level data");
-        try {
-            Files.createSymbolicLink(saves.resolve("linked-world"), outsideWorld);
-        } catch (IOException | UnsupportedOperationException | SecurityException exception) {
-            return;
-        }
+    void findsLinkedSavesAndLinkedWorldsByTheirRealPathOnce() throws IOException {
+        Path sharedSaves = Files.createDirectory(temporaryDirectory.resolve("shared-saves"));
+        Path shared = world(sharedSaves, "shared-world");
+        Path otherDrive = world(Files.createDirectory(temporaryDirectory.resolve("other-drive")), "moved-world");
+        Path instance = Files.createDirectory(temporaryDirectory.resolve("instance"));
+        Path saves = link(instance.resolve("saves"), sharedSaves);
+        link(sharedSaves.resolve("moved-world"), otherDrive);
+        link(sharedSaves.resolve("shared-world-alias"), shared);
 
-        List<Path> discovered = WorldFolderDiscovery.discover(saves);
-
-        assertTrue(discovered.isEmpty());
-        assertFalse(Files.exists(outsideWorld.resolve(".worldarchive")));
+        assertEquals(
+                List.of(otherDrive.toRealPath(), shared.toRealPath()).stream().sorted().toList(),
+                WorldFolderDiscovery.discover(saves));
     }
 
     @Test
@@ -68,4 +56,18 @@ void temporaryReplayWorldIsNotAChildOfTheMinecraftSavesFolder() {
         assertTrue(WorldFolderDiscovery.isDirectChild(saves, saves.resolve("world")));
         assertFalse(WorldFolderDiscovery.isDirectChild(saves, replay));
     }
+
+    private static Path world(Path saves, String name) throws IOException {
+        Path world = Files.createDirectory(saves.resolve(name));
+        Files.writeString(world.resolve("level.dat"), "level data");
+        return world;
+    }
+
+    private static Path link(Path link, Path target) {
+        try {
+            return Files.createSymbolicLink(link, target);
+        } catch (IOException | UnsupportedOperationException exception) {
+            return Assumptions.abort("Symbolic links are not available: " + exception.getMessage());
+        }
+    }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitBackupBackendIntegrationTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitBackupBackendIntegrationTest.java
deleted file mode 100644
index 6f1aee0..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitBackupBackendIntegrationTest.java
+++ /dev/null
@@ -1,640 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import static org.junit.jupiter.api.Assertions.assertArrayEquals;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationStatus;
-import dev.ishaanko.worldarchive.model.SyncStatus;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.time.Duration;
-import java.time.Instant;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.CompletionException;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicInteger;
-import java.util.stream.Stream;
-import org.junit.jupiter.api.Assumptions;
-import org.junit.jupiter.api.Test;
-
-class GitBackupBackendIntegrationTest extends GitBackupBackendIntegrationTestSupport {
-
-    @Test
-    void createsChangesDeletesListsVerifiesAndRestoresIndependentRefs() throws Exception {
-        Path world = temporaryDirectory.resolve("World ü with spaces");
-        Files.createDirectories(world.resolve("region"));
-        Files.createDirectories(world.resolve("data Ω"));
-        byte[] firstRegion = bytes(16_384, 17);
-        Files.write(world.resolve("region/r.0.0.mca"), firstRegion);
-        Files.writeString(world.resolve("level.dat"), "first level", StandardCharsets.UTF_8);
-        Files.writeString(world.resolve("data Ω/你好.txt"), "snowman ☃", StandardCharsets.UTF_8);
-        Files.writeString(world.resolve("session.lock"), "not captured", StandardCharsets.UTF_8);
-        Files.createDirectories(world.resolve(".worldarchive"));
-        Files.writeString(world.resolve(".worldarchive/world.json"), "not captured", StandardCharsets.UTF_8);
-        Map<String, byte[]> firstExpected = worldFiles(world);
-        WorldId worldId = WorldId.create();
-        BackupId firstId = BackupId.create();
-
-        try (GitBackupBackend backend = new GitBackupBackend(settings)) {
-            BackupCapture firstCapture = capture(
-                    world, worldId, firstId, Instant.now().minusSeconds(5));
-            DestinationResult first = await(backend.createBackup(
-                    firstCapture,
-                    ProgressListener.NO_OP));
-            assertEquals(DestinationStatus.SUCCESS, first.status(), first.message().orElse(""));
-
-            Files.writeString(world.resolve("level.dat"), "second level", StandardCharsets.UTF_8);
-            Files.delete(world.resolve("data Ω/你好.txt"));
-            Files.writeString(world.resolve("created-新.txt"), "new", StandardCharsets.UTF_8);
-            byte[] secondRegion = bytes(20_000, 29);
-            Files.write(world.resolve("region/r.0.0.mca"), secondRegion);
-            Map<String, byte[]> secondExpected = worldFiles(world);
-            BackupId secondId = BackupId.create();
-            BackupCapture secondCapture = capture(world, worldId, secondId, Instant.now());
-
-            DestinationResult second = await(backend.createBackup(
-                    secondCapture,
-                    ProgressListener.NO_OP));
-            assertEquals(DestinationStatus.SUCCESS, second.status(), second.message().orElse(""));
-
-            List<GitSnapshot> snapshots = await(backend.listSnapshots(Optional.of(worldId)));
-            assertEquals(2, snapshots.size());
-            assertEquals(2, snapshots.stream().map(GitSnapshot::commitId).distinct().count());
-            assertTrue(snapshots.stream().allMatch(
-                    snapshot -> snapshot.refName().startsWith("refs/heads/worldarchive/")));
-            GitVerification firstVerification = await(backend.verifySnapshot(worldId, firstId));
-            GitVerification secondVerification = await(backend.verifySnapshot(worldId, secondId));
-            assertTrue(firstVerification.valid());
-            assertTrue(secondVerification.valid());
-            assertEquals(firstCapture.manifest(), firstVerification.manifest().orElseThrow());
-            assertEquals(secondCapture.manifest(), secondVerification.manifest().orElseThrow());
-
-            Path firstRestore = temporaryDirectory.resolve("restore first Ω");
-            await(backend.restoreSnapshot(worldId, firstId, firstRestore));
-            assertWorldEquals(firstExpected, firstRestore);
-            assertFalse(Files.exists(firstRestore.resolve(".git")));
-            assertFalse(Files.exists(firstRestore.resolve(GitBackupBackend.MANIFEST_PATH)));
-
-            Path secondRestore = temporaryDirectory.resolve("restore second");
-            await(backend.restoreSnapshot(worldId, secondId, secondRestore));
-            assertWorldEquals(secondExpected, secondRestore);
-
-            assertTrue(await(backend.deleteSnapshot(worldId, firstId)));
-            assertFalse(await(backend.deleteSnapshot(worldId, firstId)));
-            assertEquals(List.of(secondId), await(backend.listSnapshots(Optional.of(worldId))).stream()
-                    .map(GitSnapshot::backupId)
-                    .toList());
-            Path remainingRestore = temporaryDirectory.resolve("remaining");
-            await(backend.restoreSnapshot(worldId, secondId, remainingRestore));
-            assertWorldEquals(secondExpected, remainingRestore);
-        }
-    }
-
-    @Test
-    void missingLfsObjectFailsVerification() throws Exception {
-        Path world = temporaryDirectory.resolve("lfs-world");
-        Files.createDirectories(world.resolve("region"));
-        Files.write(world.resolve("region/r.1.2.mca"), bytes(8_192, 7));
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-
-        try (GitBackupBackend backend = new GitBackupBackend(settings)) {
-            assertEquals(DestinationStatus.SUCCESS, await(backend.createBackup(
-                    capture(world, worldId, backupId, Instant.now()),
-                    ProgressListener.NO_OP)).status());
-            GitSnapshot snapshot = await(backend.listSnapshots(Optional.of(worldId))).getFirst();
-            String pointer = nativeGit(
-                    "--git-dir=" + settings.repository(),
-                    "show",
-                    snapshot.refName() + ":region/r.1.2.mca");
-            assertTrue(pointer.startsWith("version https://git-lfs.github.com/spec/v1"));
-            String oid = pointer.lines()
-                    .filter(line -> line.startsWith("oid sha256:"))
-                    .findFirst()
-                    .orElseThrow()
-                    .substring("oid sha256:".length());
-            Path object = settings.repository().resolve("lfs/objects")
-                    .resolve(oid.substring(0, 2))
-                    .resolve(oid.substring(2, 4))
-                    .resolve(oid);
-            Path parked = object.resolveSibling(oid + ".parked");
-            Files.move(object, parked);
-            try {
-                assertFalse(await(backend.verifySnapshot(worldId, backupId)).valid());
-            } finally {
-                Files.move(parked, object);
-            }
-        }
-    }
-
-    @Test
-    void remoteFailureLeavesLocalRefPendingSync() throws Exception {
-        Path world = temporaryDirectory.resolve("remote-world");
-        Files.createDirectories(world);
-        Files.writeString(world.resolve("level.dat"), "durable locally", StandardCharsets.UTF_8);
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        GitBackendSettings remoteSettings = settings(Optional.of(
-                temporaryDirectory.resolve("missing remote.git").toUri().toString()));
-
-        try (GitBackupBackend backend = new GitBackupBackend(remoteSettings)) {
-            DestinationResult result = await(backend.createBackup(
-                    capture(world, worldId, backupId, Instant.now()),
-                    ProgressListener.NO_OP));
-
-            assertEquals(DestinationStatus.PENDING_SYNC, result.status());
-            assertEquals(backupId, await(backend.listSnapshots(Optional.of(worldId))).getFirst().backupId());
-            Path restore = temporaryDirectory.resolve("pending-restore");
-            await(backend.restoreSnapshot(worldId, backupId, restore));
-            assertEquals("durable locally", Files.readString(restore.resolve("level.dat")));
-        }
-    }
-
-    @Test
-    void remoteAuthenticationFailureIsPendingAndCredentialSafe() throws Exception {
-        Path remote = temporaryDirectory.resolve("auth-failure-remote.git");
-        nativeGit("init", "--bare", remote.toString());
-        Path world = Files.createDirectories(temporaryDirectory.resolve("auth-failure-world"));
-        Files.writeString(world.resolve("notes.txt"), "local remains durable", StandardCharsets.UTF_8);
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        GitBackendSettings remoteSettings = settings(Optional.of(remote.toUri().toString()));
-        SystemGitCommandRunner systemRunner = new SystemGitCommandRunner();
-        GitCommandRunner authenticationFailure = command -> {
-            if (command.arguments().contains("push")) {
-                throw new IOException(
-                        "authentication failed password=visible-secret token=ghp_1234567890abcdef");
-            }
-            return systemRunner.run(command);
-        };
-        ExecutorService executor = Executors.newSingleThreadExecutor();
-        try (GitBackupBackend backend = new GitBackupBackend(
-                remoteSettings,
-                authenticationFailure,
-                executor)) {
-            DestinationResult result = await(backend.createBackup(
-                    capture(world, worldId, backupId, Instant.now()),
-                    ProgressListener.NO_OP));
-
-            assertEquals(DestinationStatus.PENDING_SYNC, result.status());
-            String message = result.message().orElseThrow();
-            assertTrue(message.toLowerCase(java.util.Locale.ROOT).contains("authentication"));
-            assertFalse(message.contains("visible-secret"));
-            assertFalse(message.contains("ghp_1234567890abcdef"));
-            assertEquals(backupId, await(backend.listSnapshots(Optional.of(worldId)))
-                    .getFirst().backupId());
-            assertTrue(remoteRef(remote, GitSnapshot.refName(worldId, backupId)).isEmpty());
-        } finally {
-            executor.shutdownNow();
-        }
-    }
-
-    @Test
-    void remoteWithoutLfsLeavesVerifiedLocalSnapshotPendingSync() throws Exception {
-        Path remote = temporaryDirectory.resolve("no-lfs-remote.git");
-        nativeGit("init", "--bare", remote.toString());
-        Path world = Files.createDirectories(temporaryDirectory.resolve("no-lfs-world"));
-        Files.createDirectories(world.resolve("region"));
-        Files.write(world.resolve("region/r.0.0.mca"), bytes(8_192, 41));
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        GitBackendSettings remoteSettings = settings(Optional.of(remote.toUri().toString()));
-        SystemGitCommandRunner systemRunner = new SystemGitCommandRunner();
-        GitCommandRunner remoteWithoutLfs = command -> {
-            if (command.arguments().contains("lfs") && command.arguments().contains("push")) {
-                throw new IOException("remote does not support Git LFS uploads");
-            }
-            return systemRunner.run(command);
-        };
-        ExecutorService executor = Executors.newSingleThreadExecutor();
-        try (GitBackupBackend backend = new GitBackupBackend(
-                remoteSettings,
-                remoteWithoutLfs,
-                executor)) {
-            DestinationResult result = await(backend.createBackup(
-                    capture(world, worldId, backupId, Instant.now()),
-                    ProgressListener.NO_OP));
-
-            assertEquals(DestinationStatus.PENDING_SYNC, result.status());
-            assertTrue(result.message().orElseThrow().contains("does not support Git LFS"));
-            assertTrue(await(backend.verifySnapshot(worldId, backupId)).valid());
-            assertTrue(remoteRef(remote, GitSnapshot.refName(worldId, backupId)).isEmpty());
-        } finally {
-            executor.shutdownNow();
-        }
-    }
-
-    @Test
-    void successfulRemotePushUsesTheHeadsNamespace() throws Exception {
-        Path remote = temporaryDirectory.resolve("remote repository.git");
-        nativeGit("init", "--bare", remote.toString());
-        Path world = temporaryDirectory.resolve("remote-success-world");
-        Files.createDirectories(world);
-        Files.writeString(world.resolve("notes.txt"), "remote snapshot", StandardCharsets.UTF_8);
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        GitBackendSettings remoteSettings = settings(Optional.of(remote.toUri().toString()));
-
-        try (GitBackupBackend backend = new GitBackupBackend(remoteSettings)) {
-            DestinationResult result = await(backend.createBackup(
-                    capture(world, worldId, backupId, Instant.now()),
-                    ProgressListener.NO_OP));
-
-            assertEquals(DestinationStatus.SUCCESS, result.status(), result.message().orElse(""));
-            assertEquals(SyncStatus.SYNCED, result.syncStatus());
-            String expectedRef = GitSnapshot.refName(worldId, backupId);
-            assertEquals(expectedRef, result.artifactId().orElseThrow());
-            GitSnapshot snapshot = await(backend.listSnapshots(Optional.of(worldId))).getFirst();
-            String remoteCommit = nativeGit(
-                    "--git-dir=" + remote,
-                    "rev-parse",
-                    "--verify",
-                    GitRemoteSnapshotRef.current(snapshot)).trim();
-            assertEquals(snapshot.commitId(), remoteCommit);
-        }
-    }
-
-    @Test
-    void migratesLegacyUuidBranchToReadableDatedBranch() throws Exception {
-        Path remote = temporaryDirectory.resolve("legacy-branch-remote.git");
-        nativeGit("init", "--bare", remote.toString());
-        Path world = temporaryDirectory.resolve("legacy-branch-world");
-        Files.createDirectories(world);
-        Files.writeString(world.resolve("notes.txt"), "readable branch", StandardCharsets.UTF_8);
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        GitBackendSettings localSettings = settings(Optional.empty());
-        GitSnapshot snapshot;
-
-        try (GitBackupBackend local = new GitBackupBackend(localSettings)) {
-            assertEquals(DestinationStatus.SUCCESS, await(local.createBackup(
-                    capture(world, worldId, backupId, Instant.parse("2026-07-21T22:33:23Z")),
-                    ProgressListener.NO_OP)).status());
-            snapshot = await(local.listSnapshots(Optional.of(worldId))).getFirst();
-        }
-        nativeGit(
-                "--git-dir=" + localSettings.repository(),
-                "push",
-                remote.toUri().toString(),
-                snapshot.refName() + ":" + snapshot.refName());
-
-        try (GitBackupBackend synced = new GitBackupBackend(settings(
-                Optional.of(remote.toUri().toString())))) {
-            assertEquals(
-                    DestinationStatus.SUCCESS,
-                    await(synced.syncSnapshot(worldId, backupId)).status());
-        }
-
-        assertTrue(remoteRef(remote, snapshot.refName()).isEmpty());
-        assertEquals(
-                snapshot.commitId(),
-                remoteRef(remote, GitRemoteSnapshotRef.current(snapshot)).orElseThrow());
-    }
-
-    @Test
-    void deletesRemoteRefBeforeLocalRefAndRetriesAfterLocalFailure() throws Exception {
-        Path remote = temporaryDirectory.resolve("remote-delete.git");
-        nativeGit("init", "--bare", remote.toString());
-        Path world = temporaryDirectory.resolve("remote-delete-world");
-        Files.createDirectories(world);
-        Files.writeString(world.resolve("level.dat"), "remote deletion", StandardCharsets.UTF_8);
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        String snapshotRef = GitSnapshot.refName(worldId, backupId);
-        GitBackendSettings remoteSettings = settings(Optional.of(remote.toUri().toString()));
-        SystemGitCommandRunner systemRunner = new SystemGitCommandRunner();
-        AtomicInteger localDeleteAttempts = new AtomicInteger();
-        GitCommandRunner failFirstLocalDelete = command -> {
-            if (command.arguments().contains("update-ref")
-                    && command.arguments().contains("-d")
-                    && command.arguments().contains(snapshotRef)) {
-                int attempt = localDeleteAttempts.getAndIncrement();
-                if (attempt == 0) {
-                    throw new IOException("simulated local ref deletion failure");
-                }
-                if (attempt == 1) {
-                    systemRunner.run(command);
-                    throw new GitCommandTimeoutException(Duration.ofMillis(1));
-                }
-            }
-            return systemRunner.run(command);
-        };
-        ExecutorService executor = Executors.newSingleThreadExecutor();
-        try (GitBackupBackend backend = new GitBackupBackend(
-                remoteSettings,
-                failFirstLocalDelete,
-                executor)) {
-            DestinationResult result = await(backend.createBackup(
-                    capture(world, worldId, backupId, Instant.now()),
-                    ProgressListener.NO_OP));
-            assertEquals(DestinationStatus.SUCCESS, result.status(), result.message().orElse(""));
-
-            assertThrows(IOException.class, () -> await(backend.deleteSnapshot(worldId, backupId)));
-            assertTrue(remoteRef(remote, snapshotRef).isEmpty());
-            assertEquals(
-                    backupId,
-                    await(backend.listSnapshots(Optional.of(worldId))).getFirst().backupId());
-
-            assertTrue(await(backend.deleteSnapshot(worldId, backupId)));
-            assertTrue(remoteRef(remote, snapshotRef).isEmpty());
-            assertTrue(await(backend.listSnapshots(Optional.of(worldId))).isEmpty());
-            assertFalse(await(backend.deleteSnapshot(worldId, backupId)));
-            assertEquals(2, localDeleteAttempts.get());
-        } finally {
-            executor.shutdownNow();
-        }
-    }
-
-    @Test
-    void deletesRemoteSnapshotWhenItsLocalRefWasEvicted() throws Exception {
-        Path remote = temporaryDirectory.resolve("remote-only-delete.git");
-        nativeGit("init", "--bare", remote.toString());
-        Path world = temporaryDirectory.resolve("remote-only-delete-world");
-        Files.createDirectories(world);
-        Files.writeString(world.resolve("level.dat"), "remote-only deletion");
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        String snapshotRef = GitSnapshot.refName(worldId, backupId);
-        GitBackendSettings remoteSettings = settings(Optional.of(remote.toUri().toString()));
-
-        try (GitBackupBackend backend = new GitBackupBackend(remoteSettings)) {
-            DestinationResult result = await(backend.createBackup(
-                    capture(world, worldId, backupId, Instant.now()),
-                    ProgressListener.NO_OP));
-            assertEquals(DestinationStatus.SUCCESS, result.status(), result.message().orElse(""));
-            GitSnapshot snapshot = await(backend.listSnapshots(Optional.of(worldId))).getFirst();
-            String remoteSnapshotRef = GitRemoteSnapshotRef.current(snapshot);
-            nativeGit(
-                    "--git-dir=" + remoteSettings.repository(),
-                    "update-ref",
-                    "-d",
-                    snapshotRef);
-
-            assertTrue(await(backend.deleteSnapshot(worldId, backupId)));
-            assertTrue(remoteRef(remote, remoteSnapshotRef).isEmpty());
-        }
-    }
-
-    @Test
-    void rejectsPreparedManifestThatDoesNotMatchCapturedWorld() throws Exception {
-        Path world = temporaryDirectory.resolve("manifest-mismatch-world");
-        Files.createDirectories(world);
-        Files.writeString(world.resolve("level.dat"), "not represented by the manifest");
-        WorldId worldId = WorldId.create();
-
-        try (GitBackupBackend backend = new GitBackupBackend(settings)) {
-            DestinationResult result = await(backend.createBackup(
-                    captureWithoutScanning(world, worldId, BackupId.create(), Instant.now()),
-                    ProgressListener.NO_OP));
-
-            assertEquals(DestinationStatus.FAILED, result.status());
-            assertTrue(await(backend.listSnapshots(Optional.of(worldId))).isEmpty());
-        }
-    }
-
-    @Test
-    void capturesNestedSessionLockButExcludesTheLiveWorldLock() throws Exception {
-        Path world = temporaryDirectory.resolve("nested-lock-world");
-        Files.createDirectories(world.resolve("nested"));
-        Files.writeString(world.resolve("session.lock"), "live lock");
-        Files.writeString(world.resolve("nested/session.lock"), "world data");
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-
-        try (GitBackupBackend backend = new GitBackupBackend(settings)) {
-            DestinationResult result = await(backend.createBackup(
-                    capture(world, worldId, backupId, Instant.now()),
-                    ProgressListener.NO_OP));
-            assertEquals(DestinationStatus.SUCCESS, result.status(), result.message().orElse(""));
-
-            Path restored = temporaryDirectory.resolve("nested-lock-restore");
-            await(backend.restoreSnapshot(worldId, backupId, restored));
-            assertFalse(Files.exists(restored.resolve("session.lock")));
-            assertEquals("world data", Files.readString(restored.resolve("nested/session.lock")));
-        }
-    }
-
-    @Test
-    void verifiesLargeFilesThatAreNotManagedByLfs() throws Exception {
-        Path world = temporaryDirectory.resolve("large-ordinary-world");
-        Files.createDirectories(world);
-        byte[] original = bytes(5 * 1_024 * 1_024 + 17, 53);
-        Files.write(world.resolve("large.bin"), original);
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-
-        try (GitBackupBackend backend = new GitBackupBackend(settings)) {
-            DestinationResult result = await(backend.createBackup(
-                    capture(world, worldId, backupId, Instant.now()),
-                    ProgressListener.NO_OP));
-            assertEquals(DestinationStatus.SUCCESS, result.status(), result.message().orElse(""));
-            assertTrue(await(backend.verifySnapshot(worldId, backupId)).valid());
-
-            Path restored = temporaryDirectory.resolve("large-ordinary-restore");
-            await(backend.restoreSnapshot(worldId, backupId, restored));
-            assertArrayEquals(original, Files.readAllBytes(restored.resolve("large.bin")));
-        }
-    }
-
-    @Test
-    void refusesRestoreIntoNonEmptyDirectory() throws Exception {
-        Path world = temporaryDirectory.resolve("world");
-        Files.createDirectories(world);
-        Files.writeString(world.resolve("level.dat"), "level");
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-
-        try (GitBackupBackend backend = new GitBackupBackend(settings)) {
-            await(backend.createBackup(capture(world, worldId, backupId, Instant.now()), ProgressListener.NO_OP));
-            Path staging = temporaryDirectory.resolve("occupied");
-            Files.createDirectories(staging);
-            Files.writeString(staging.resolve("keep.txt"), "keep");
-
-            CompletionException exception = assertThrows(
-                    CompletionException.class,
-                    () -> backend.restoreSnapshot(worldId, backupId, staging).toCompletableFuture().join());
-            assertTrue(exception.getCause() instanceof GitStorageException);
-            assertEquals("keep", Files.readString(staging.resolve("keep.txt")));
-        }
-    }
-
-    @Test
-    void refusesRestoreThroughAWindowsJunction() throws Exception {
-        Assumptions.assumeTrue(System.getProperty("os.name").startsWith("Windows"));
-        Path world = temporaryDirectory.resolve("restore-junction-world");
-        Files.createDirectories(world);
-        Files.writeString(world.resolve("level.dat"), "level");
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        Path outside = temporaryDirectory.resolve("restore-junction-outside");
-        Path junction = temporaryDirectory.resolve("restore-junction-target");
-        Files.createDirectories(outside);
-
-        try (GitBackupBackend backend = new GitBackupBackend(settings)) {
-            assertEquals(DestinationStatus.SUCCESS, await(backend.createBackup(
-                    capture(world, worldId, backupId, Instant.now()),
-                    ProgressListener.NO_OP)).status());
-            Process createJunction = new ProcessBuilder(
-                            "cmd.exe",
-                            "/d",
-                            "/c",
-                            "mklink",
-                            "/J",
-                            junction.toString(),
-                            outside.toString())
-                    .redirectErrorStream(true)
-                    .start();
-            String commandOutput = new String(createJunction.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
-            assertTrue(createJunction.waitFor(10, TimeUnit.SECONDS));
-            assertEquals(0, createJunction.exitValue(), commandOutput);
-            try {
-                assertThrows(GitStorageException.class, () -> await(backend.restoreSnapshot(
-                        worldId,
-                        backupId,
-                        junction)));
-                try (Stream<Path> children = Files.list(outside)) {
-                    assertTrue(children.findAny().isEmpty());
-                }
-            } finally {
-                Files.deleteIfExists(junction);
-            }
-        }
-    }
-
-    @Test
-    void restoresOldLfsPointersAfterConfiguredPatternsChange() throws Exception {
-        Path world = temporaryDirectory.resolve("pattern-world");
-        Files.createDirectories(world);
-        byte[] original = bytes(12_345, 41);
-        Files.write(world.resolve("region.legacy"), original);
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        GitBackendSettings oldPatterns = settings(List.of("*.legacy"), Optional.empty());
-
-        try (GitBackupBackend backend = new GitBackupBackend(oldPatterns)) {
-            assertEquals(DestinationStatus.SUCCESS, await(backend.createBackup(
-                    capture(world, worldId, backupId, Instant.now()),
-                    ProgressListener.NO_OP)).status());
-        }
-        String pointer = nativeGit(
-                "--git-dir=" + settings.repository(),
-                "show",
-                GitSnapshot.refName(worldId, backupId) + ":region.legacy");
-        assertTrue(pointer.startsWith("version https://git-lfs.github.com/spec/v1"));
-
-        GitBackendSettings newPatterns = settings(List.of("*.nbt"), Optional.empty());
-        try (GitBackupBackend backend = new GitBackupBackend(newPatterns)) {
-            assertTrue(await(backend.verifySnapshot(worldId, backupId)).valid());
-            Path restored = temporaryDirectory.resolve("pattern-restore");
-            await(backend.restoreSnapshot(worldId, backupId, restored));
-            assertArrayEquals(original, Files.readAllBytes(restored.resolve("region.legacy")));
-        }
-        String attributes = Files.readString(settings.repository().resolve("info/attributes"));
-        assertTrue(attributes.contains("*.legacy filter=lfs"));
-        assertTrue(attributes.contains("*.nbt filter=lfs"));
-    }
-
-    @Test
-    void refRepointingFailsIdentityVerificationAndRestore() throws Exception {
-        Path world = temporaryDirectory.resolve("identity-world");
-        Files.createDirectories(world);
-        Files.writeString(world.resolve("level.dat"), "first");
-        WorldId worldId = WorldId.create();
-        BackupId firstId = BackupId.create();
-        BackupId secondId = BackupId.create();
-
-        try (GitBackupBackend backend = new GitBackupBackend(settings)) {
-            await(backend.createBackup(capture(world, worldId, firstId, Instant.now().minusSeconds(2)),
-                    ProgressListener.NO_OP));
-            Files.writeString(world.resolve("level.dat"), "second");
-            await(backend.createBackup(capture(world, worldId, secondId, Instant.now()),
-                    ProgressListener.NO_OP));
-            GitSnapshot second = await(backend.listSnapshots(Optional.of(worldId))).stream()
-                    .filter(snapshot -> snapshot.backupId().equals(secondId))
-                    .findFirst()
-                    .orElseThrow();
-            nativeGit(
-                    "--git-dir=" + settings.repository(),
-                    "update-ref",
-                    GitSnapshot.refName(worldId, firstId),
-                    second.commitId());
-
-            assertFalse(await(backend.verifySnapshot(worldId, firstId)).valid());
-            assertTrue(await(backend.verifySnapshot(worldId, secondId)).valid());
-            assertThrows(GitStorageException.class, () -> await(backend.restoreSnapshot(
-                    worldId,
-                    firstId,
-                    temporaryDirectory.resolve("repointed-restore"))));
-        }
-    }
-
-    @Test
-    void rejectsLinkedSourceBeforeGitAdd() throws Exception {
-        Path world = temporaryDirectory.resolve("linked-world");
-        Path outside = temporaryDirectory.resolve("outside-secret.txt");
-        Files.createDirectories(world);
-        Files.writeString(outside, "must not be captured");
-        Path link = world.resolve("linked-secret.txt");
-        try {
-            Files.createSymbolicLink(link, outside);
-        } catch (IOException | UnsupportedOperationException exception) {
-            Assumptions.abort("Symbolic links are unavailable: " + exception.getMessage());
-        }
-
-        try (GitBackupBackend backend = new GitBackupBackend(settings)) {
-            DestinationResult result = await(backend.createBackup(
-                    captureWithoutScanning(world, WorldId.create(), BackupId.create(), Instant.now()),
-                    ProgressListener.NO_OP));
-            assertEquals(DestinationStatus.FAILED, result.status());
-            assertTrue(await(backend.listSnapshots(Optional.empty())).isEmpty());
-        }
-    }
-
-    @Test
-    void rejectsWindowsJunctionBeforeGitAdd() throws Exception {
-        Assumptions.assumeTrue(System.getProperty("os.name").startsWith("Windows"));
-        Path world = temporaryDirectory.resolve("junction-world");
-        Path outside = temporaryDirectory.resolve("junction-outside");
-        Path junction = world.resolve("linked-directory");
-        Files.createDirectories(world);
-        Files.createDirectories(outside);
-        Files.writeString(outside.resolve("secret.txt"), "must not be captured");
-        Process createJunction = new ProcessBuilder(
-                        "cmd.exe",
-                        "/d",
-                        "/c",
-                        "mklink",
-                        "/J",
-                        junction.toString(),
-                        outside.toString())
-                .redirectErrorStream(true)
-                .start();
-        String commandOutput = new String(createJunction.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
-        assertTrue(createJunction.waitFor(10, TimeUnit.SECONDS));
-        assertEquals(0, createJunction.exitValue(), commandOutput);
-        try (GitBackupBackend backend = new GitBackupBackend(settings)) {
-            DestinationResult result = await(backend.createBackup(
-                    captureWithoutScanning(world, WorldId.create(), BackupId.create(), Instant.now()),
-                    ProgressListener.NO_OP));
-            assertEquals(DestinationStatus.FAILED, result.status());
-            assertTrue(await(backend.listSnapshots(Optional.empty())).isEmpty());
-        } finally {
-            Files.deleteIfExists(junction);
-        }
-    }
-
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitBackupBackendIntegrationTestSupport.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitBackupBackendIntegrationTestSupport.java
deleted file mode 100644
index 4ab70ef..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitBackupBackendIntegrationTestSupport.java
+++ /dev/null
@@ -1,257 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import static org.junit.jupiter.api.Assertions.assertArrayEquals;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.AccessDeniedException;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.nio.file.attribute.DosFileAttributeView;
-import java.time.Duration;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.Comparator;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.TimeUnit;
-import java.util.stream.Stream;
-import org.junit.jupiter.api.Assumptions;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.io.TempDir;
-
-abstract class GitBackupBackendIntegrationTestSupport {
-    static final Duration TEST_TIMEOUT = Duration.ofSeconds(30);
-
-    static final Duration WINDOWS_DELETE_RETRY_TIMEOUT = Duration.ofSeconds(2);
-
-    @TempDir
-    Path temporaryDirectory;
-
-    GitBackendSettings settings;
-
-    @BeforeEach
-    void requireNativeGitAndLfs() throws Exception {
-        settings = settings(Optional.empty());
-        GitToolHealth health = new GitToolProbe(settings, new SystemGitCommandRunner()).probe();
-        Assumptions.assumeTrue(health.available(), health.summary());
-    }
-
-    GitBackendSettings settings(Optional<String> remoteUrl) {
-        return settings(GitBackendSettings.DEFAULT_LFS_PATTERNS, remoteUrl);
-    }
-
-    GitBackendSettings settings(List<String> lfsPatterns, Optional<String> remoteUrl) {
-        return new GitBackendSettings(
-                true,
-                temporaryDirectory.resolve("synced folder Ω").resolve("worldarchive.git"),
-                "git",
-                "origin",
-                remoteUrl,
-                lfsPatterns,
-                TEST_TIMEOUT,
-                4 * 1_024 * 1_024);
-    }
-
-    static BackupCapture capture(Path world, WorldId worldId, BackupId backupId, Instant timestamp)
-            throws IOException, GitStorageException {
-        List<GitInventoryEntry> entries = new ArrayList<>();
-        try (Stream<Path> paths = Files.walk(world)) {
-            for (Path path : paths.filter(Files::isRegularFile).toList()) {
-                String relative = relative(world, path);
-                if (relative.equals("session.lock") || relative.startsWith(".worldarchive/")) {
-                    continue;
-                }
-                byte[] contents = Files.readAllBytes(path);
-                entries.add(new GitInventoryEntry(
-                        relative,
-                        contents.length,
-                        java.util.HexFormat.of().formatHex(GitInventory.sha256().digest(contents))));
-            }
-        }
-        GitInventory inventory = GitInventory.create(entries);
-        BackupManifest manifest = BackupManifest.create(
-                backupId,
-                worldId,
-                "Integration 世界",
-                Optional.empty(),
-                timestamp,
-                BackupTrigger.MANUAL,
-                inventory.fileCount(),
-                inventory.byteCount(),
-                inventory.fileCount(),
-                inventory.contentSha256(),
-                inventory.inventorySha256());
-        return new BackupCapture(world, manifest);
-    }
-
-    static BackupCapture captureWithoutScanning(
-            Path world,
-            WorldId worldId,
-            BackupId backupId,
-            Instant timestamp) {
-        return new BackupCapture(world, BackupManifest.create(
-                backupId,
-                worldId,
-                "Unsafe source test",
-                timestamp,
-                BackupTrigger.MANUAL,
-                0,
-                0,
-                "0".repeat(64)));
-    }
-
-    static Map<String, byte[]> worldFiles(Path world) throws IOException {
-        Map<String, byte[]> files = new HashMap<>();
-        try (Stream<Path> paths = Files.walk(world)) {
-            for (Path path : paths.filter(Files::isRegularFile).toList()) {
-                String relative = relative(world, path);
-                if (!relative.equals("session.lock") && !relative.startsWith(".worldarchive/")) {
-                    files.put(relative, Files.readAllBytes(path));
-                }
-            }
-        }
-        return files;
-    }
-
-    static void assertWorldEquals(Map<String, byte[]> expected, Path actualRoot) throws IOException {
-        Map<String, byte[]> actual = worldFiles(actualRoot);
-        assertEquals(expected.keySet(), actual.keySet());
-        for (Map.Entry<String, byte[]> entry : expected.entrySet()) {
-            assertArrayEquals(entry.getValue(), actual.get(entry.getKey()), entry.getKey());
-        }
-    }
-
-    static String relative(Path root, Path path) {
-        return root.relativize(path).toString().replace('\\', '/');
-    }
-
-    static byte[] bytes(int length, int seed) {
-        byte[] value = new byte[length];
-        for (int index = 0; index < value.length; index++) {
-            value[index] = (byte) (index * 31 + seed);
-        }
-        return value;
-    }
-
-    Map<String, String> worldTreeObjects(String refName) throws Exception {
-        Map<String, String> objects = new HashMap<>();
-        String tree = nativeGit(
-                "--git-dir=" + settings.repository(),
-                "ls-tree",
-                "-r",
-                refName);
-        for (String line : tree.lines().toList()) {
-            int tab = line.indexOf('\t');
-            String[] metadata = line.substring(0, tab).split(" ");
-            String path = line.substring(tab + 1);
-            if (!path.equals(GitBackupBackend.MANIFEST_PATH)) {
-                objects.put(path, metadata[2]);
-            }
-        }
-        return Map.copyOf(objects);
-    }
-
-    long lfsObjectCount() throws IOException {
-        Path objects = settings.repository().resolve("lfs/objects");
-        if (!Files.isDirectory(objects)) {
-            return 0;
-        }
-        try (Stream<Path> paths = Files.walk(objects)) {
-            return paths.filter(Files::isRegularFile).count();
-        }
-    }
-
-    static void deleteTree(Path root) throws IOException, InterruptedException {
-        if (!Files.exists(root)) {
-            return;
-        }
-        try (Stream<Path> paths = Files.walk(root)) {
-            for (Path path : paths.sorted(Comparator.reverseOrder()).toList()) {
-                deleteWithSharingRetry(path);
-            }
-        }
-    }
-
-    static void deleteWithSharingRetry(Path path) throws IOException, InterruptedException {
-        long deadline = System.nanoTime() + WINDOWS_DELETE_RETRY_TIMEOUT.toNanos();
-        while (true) {
-            try {
-                Files.deleteIfExists(path);
-                return;
-            } catch (AccessDeniedException exception) {
-                if (!System.getProperty("os.name").startsWith("Windows")) {
-                    throw exception;
-                }
-                try {
-                    if (clearDosReadOnly(path)) {
-                        continue;
-                    }
-                } catch (AccessDeniedException ignored) {
-                    // A sharing violation can temporarily prevent reading the DOS attributes too.
-                }
-                if (!Files.exists(path, LinkOption.NOFOLLOW_LINKS)
-                        || System.nanoTime() >= deadline) {
-                    throw exception;
-                }
-                TimeUnit.MILLISECONDS.sleep(10L);
-            }
-        }
-    }
-
-    static boolean clearDosReadOnly(Path path) throws IOException {
-        DosFileAttributeView attributes = Files.getFileAttributeView(
-                path,
-                DosFileAttributeView.class,
-                LinkOption.NOFOLLOW_LINKS);
-        if (attributes == null || !attributes.readAttributes().isReadOnly()) {
-            return false;
-        }
-        attributes.setReadOnly(false);
-        return true;
-    }
-
-    String nativeGit(String... arguments) throws Exception {
-        List<String> command = new ArrayList<>();
-        command.add("git");
-        command.addAll(List.of(arguments));
-        Process process = new ProcessBuilder(command)
-                .directory(temporaryDirectory.toFile())
-                .redirectErrorStream(true)
-                .start();
-        String output = new String(process.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
-        assertTrue(process.waitFor(30, TimeUnit.SECONDS));
-        assertEquals(0, process.exitValue(), output);
-        return output;
-    }
-
-    Optional<String> remoteRef(Path remote, String refName) throws Exception {
-        String output = nativeGit(
-                "--git-dir=" + remote,
-                "for-each-ref",
-                "--format=%(objectname)",
-                refName).trim();
-        return output.isEmpty() ? Optional.empty() : Optional.of(output);
-    }
-
-    static <T> T await(java.util.concurrent.CompletionStage<T> stage) throws Exception {
-        try {
-            return stage.toCompletableFuture().get(60, TimeUnit.SECONDS);
-        } catch (java.util.concurrent.ExecutionException exception) {
-            if (exception.getCause() instanceof Exception cause) {
-                throw cause;
-            }
-            throw exception;
-        }
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitBackupBackendRemoteIntegrationTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitBackupBackendRemoteIntegrationTest.java
deleted file mode 100644
index 9369c02..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitBackupBackendRemoteIntegrationTest.java
+++ /dev/null
@@ -1,558 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNotEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.catalog.FileBackupCatalog;
-import dev.ishaanko.worldarchive.config.WorldIdentityStore;
-import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.core.LockingWorldOperationGate;
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.core.RestoreBackupRequest;
-import dev.ishaanko.worldarchive.core.RestoreBackupResult;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationStatus;
-import dev.ishaanko.worldarchive.model.SyncStatus;
-import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.model.WorldIdentity;
-import dev.ishaanko.worldarchive.recovery.BackupRecoveryException;
-import dev.ishaanko.worldarchive.recovery.BackupRecoveryService;
-import dev.ishaanko.worldarchive.recovery.RestoredWorldMetadataFinalizer;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.time.Duration;
-import java.time.Instant;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.CancellationException;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicInteger;
-import java.util.stream.Stream;
-import org.junit.jupiter.api.Test;
-
-class GitBackupBackendRemoteIntegrationTest extends GitBackupBackendIntegrationTestSupport {
-    @Test
-    void concurrentWorldsPublishIndependentRefs() throws Exception {
-        Path firstWorld = temporaryDirectory.resolve("concurrent-one");
-        Path secondWorld = temporaryDirectory.resolve("concurrent-two");
-        Files.createDirectories(firstWorld);
-        Files.createDirectories(secondWorld);
-        Files.writeString(firstWorld.resolve("level.dat"), "one");
-        Files.writeString(secondWorld.resolve("level.dat"), "two");
-        WorldId firstWorldId = WorldId.create();
-        WorldId secondWorldId = WorldId.create();
-        BackupId firstBackupId = BackupId.create();
-        BackupId secondBackupId = BackupId.create();
-
-        try (GitBackupBackend firstBackend = new GitBackupBackend(settings);
-                GitBackupBackend secondBackend = new GitBackupBackend(settings)) {
-            CompletableFuture<DestinationResult> first = firstBackend.createBackup(
-                    capture(firstWorld, firstWorldId, firstBackupId, Instant.now()),
-                    ProgressListener.NO_OP).toCompletableFuture();
-            CompletableFuture<DestinationResult> second = secondBackend.createBackup(
-                    capture(secondWorld, secondWorldId, secondBackupId, Instant.now()),
-                    ProgressListener.NO_OP).toCompletableFuture();
-            CompletableFuture.allOf(first, second).get(60, TimeUnit.SECONDS);
-
-            assertEquals(DestinationStatus.SUCCESS, first.get().status());
-            assertEquals(DestinationStatus.SUCCESS, second.get().status());
-            assertEquals(2, await(firstBackend.listSnapshots(Optional.empty())).size());
-            assertTrue(await(firstBackend.verifySnapshot(firstWorldId, firstBackupId)).valid());
-            assertTrue(await(firstBackend.verifySnapshot(secondWorldId, secondBackupId)).valid());
-        }
-    }
-
-    @Test
-    void timeoutAfterRefPublicationReturnsPendingSync() throws Exception {
-        Path world = temporaryDirectory.resolve("interrupted-remote");
-        Files.createDirectories(world);
-        Files.writeString(world.resolve("level.dat"), "locally durable");
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        GitBackendSettings remoteSettings = settings(
-                GitBackendSettings.DEFAULT_LFS_PATTERNS,
-                Optional.of(temporaryDirectory.resolve("remote.git").toUri().toString()));
-        SystemGitCommandRunner systemRunner = new SystemGitCommandRunner();
-        GitCommandRunner timedOutPush = command -> {
-            if (command.arguments().contains("push")) {
-                throw new GitCommandTimeoutException(Duration.ofMillis(1));
-            }
-            return systemRunner.run(command);
-        };
-        ExecutorService executor = Executors.newSingleThreadExecutor();
-        try (GitBackupBackend backend = new GitBackupBackend(remoteSettings, timedOutPush, executor)) {
-            DestinationResult result = await(backend.createBackup(
-                    capture(world, worldId, backupId, Instant.now()),
-                    ProgressListener.NO_OP));
-
-            assertEquals(DestinationStatus.PENDING_SYNC, result.status());
-            assertEquals(GitSnapshot.refName(worldId, backupId), result.artifactId().orElseThrow());
-            assertEquals(backupId, await(backend.listSnapshots(Optional.of(worldId))).getFirst().backupId());
-        } finally {
-            executor.shutdownNow();
-        }
-    }
-
-    @Test
-    void unchangedCaptureReusesEveryWorldBlobAndLfsObject() throws Exception {
-        Path world = temporaryDirectory.resolve("unchanged-world");
-        Files.createDirectories(world.resolve("region"));
-        Files.writeString(world.resolve("level.dat"), "unchanged level", StandardCharsets.UTF_8);
-        Files.write(world.resolve("region/r.2.3.mca"), bytes(32_768, 67));
-        WorldId worldId = WorldId.create();
-        BackupId firstId = BackupId.create();
-        BackupId secondId = BackupId.create();
-
-        try (GitBackupBackend backend = new GitBackupBackend(settings)) {
-            assertEquals(DestinationStatus.SUCCESS, await(backend.createBackup(
-                    capture(world, worldId, firstId, Instant.now().minusSeconds(1)),
-                    ProgressListener.NO_OP)).status());
-            Map<String, String> firstObjects = worldTreeObjects(GitSnapshot.refName(worldId, firstId));
-            long firstLfsObjects = lfsObjectCount();
-
-            assertEquals(DestinationStatus.SUCCESS, await(backend.createBackup(
-                    capture(world, worldId, secondId, Instant.now()),
-                    ProgressListener.NO_OP)).status());
-
-            assertEquals(firstObjects, worldTreeObjects(GitSnapshot.refName(worldId, secondId)));
-            assertEquals(firstLfsObjects, lfsObjectCount());
-            assertEquals(2, await(backend.listSnapshots(Optional.of(worldId))).size());
-        }
-    }
-
-    @Test
-    void syncKeepsRemoteMainOnTheNewestBackup() throws Exception {
-        Path remote = temporaryDirectory.resolve("default-branch.git");
-        nativeGit("init", "--bare", remote.toString());
-        Path world = temporaryDirectory.resolve("default-branch-world");
-        Files.createDirectories(world);
-        Files.writeString(world.resolve("level.dat"), "first", StandardCharsets.UTF_8);
-        WorldId worldId = WorldId.create();
-        BackupId firstId = BackupId.create();
-        BackupId secondId = BackupId.create();
-        GitBackendSettings remoteSettings = settings(Optional.of(remote.toUri().toString()));
-
-        try (GitBackupBackend backend = new GitBackupBackend(remoteSettings)) {
-            assertEquals(DestinationStatus.SUCCESS, await(backend.createBackup(
-                    capture(world, worldId, firstId, Instant.now().minusSeconds(1)),
-                    ProgressListener.NO_OP)).status());
-            String firstCommit = nativeGit(
-                    "--git-dir=" + remoteSettings.repository(),
-                    "rev-parse",
-                    GitSnapshot.refName(worldId, firstId)).trim();
-            assertEquals(Optional.of(firstCommit), remoteRef(remote, "refs/heads/main"));
-
-            // A diverged default branch left behind by another machine must still move.
-            String emptyTree = nativeGit(
-                    "--git-dir=" + remote, "hash-object", "-t", "tree", "-w", "/dev/null").trim();
-            String unrelated = nativeGit(
-                    "-c", "user.name=test", "-c", "user.email=test@test.invalid",
-                    "--git-dir=" + remote, "commit-tree", emptyTree, "-m", "diverged").trim();
-            nativeGit("--git-dir=" + remote, "update-ref", "refs/heads/main", unrelated);
-
-            Files.writeString(world.resolve("level.dat"), "second", StandardCharsets.UTF_8);
-            assertEquals(DestinationStatus.SUCCESS, await(backend.createBackup(
-                    capture(world, worldId, secondId, Instant.now()),
-                    ProgressListener.NO_OP)).status());
-            String secondCommit = nativeGit(
-                    "--git-dir=" + remoteSettings.repository(),
-                    "rev-parse",
-                    GitSnapshot.refName(worldId, secondId)).trim();
-            assertEquals(Optional.of(secondCommit), remoteRef(remote, "refs/heads/main"));
-
-            // Deleting the newest backup must stop its content being reachable from
-            // main; the last deletion parks main on an empty placeholder commit
-            // because remotes refuse to delete their HEAD branch.
-            assertTrue(await(backend.deleteSnapshot(worldId, secondId)));
-            assertEquals(Optional.of(firstCommit), remoteRef(remote, "refs/heads/main"));
-            assertTrue(await(backend.deleteSnapshot(worldId, firstId)));
-            String placeholder = remoteRef(remote, "refs/heads/main").orElseThrow();
-            assertNotEquals(firstCommit, placeholder);
-            assertNotEquals(secondCommit, placeholder);
-            assertTrue(nativeGit(
-                    "--git-dir=" + remoteSettings.repository(),
-                    "ls-tree",
-                    placeholder).isBlank());
-        }
-    }
-
-    @Test
-    void protectedDefaultBranchDoesNotFailTheSync() throws Exception {
-        Path remote = temporaryDirectory.resolve("protected-main.git");
-        nativeGit("init", "--bare", remote.toString());
-        Path hook = remote.resolve("hooks").resolve("pre-receive");
-        Files.writeString(hook, """
-                #!/bin/sh
-                while read old new ref; do
-                  if [ "$ref" = "refs/heads/main" ]; then
-                    echo "main is protected" >&2
-                    exit 1
-                  fi
-                done
-                exit 0
-                """);
-        assertTrue(hook.toFile().setExecutable(true));
-        Path world = temporaryDirectory.resolve("protected-main-world");
-        Files.createDirectories(world);
-        Files.writeString(world.resolve("level.dat"), "protected", StandardCharsets.UTF_8);
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        GitBackendSettings remoteSettings = settings(Optional.of(remote.toUri().toString()));
-
-        try (GitBackupBackend backend = new GitBackupBackend(remoteSettings)) {
-            DestinationResult result = await(backend.createBackup(
-                    capture(world, worldId, backupId, Instant.now()),
-                    ProgressListener.NO_OP));
-
-            assertEquals(DestinationStatus.SUCCESS, result.status(), result.message().orElse(""));
-            assertEquals(SyncStatus.SYNCED, result.syncStatus());
-            GitSnapshot snapshot = await(backend.listSnapshots(Optional.of(worldId))).getFirst();
-            assertFalse(remoteRef(remote, GitRemoteSnapshotRef.current(snapshot)).isEmpty());
-            assertEquals(Optional.empty(), remoteRef(remote, "refs/heads/main"));
-        }
-    }
-
-    @Test
-    void restoresExactBytesFromRemoteWhenLocalRepositoryIsAbsent() throws Exception {
-        Path remote = temporaryDirectory.resolve("remote-only.git");
-        nativeGit("init", "--bare", remote.toString());
-        Path world = temporaryDirectory.resolve("remote-only-world");
-        Files.createDirectories(world.resolve("region"));
-        Files.writeString(world.resolve("level.dat"), "remote recovery", StandardCharsets.UTF_8);
-        Files.write(world.resolve("region/r.4.5.mca"), bytes(24_321, 73));
-        Map<String, byte[]> expected = worldFiles(world);
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        GitBackendSettings remoteSettings = settings(Optional.of(remote.toUri().toString()));
-        BackupManifest manifest;
-        DestinationResult destination;
-
-        try (GitBackupBackend backend = new GitBackupBackend(remoteSettings)) {
-            BackupCapture capture = capture(world, worldId, backupId, Instant.now());
-            manifest = capture.manifest();
-            destination = await(backend.createBackup(capture, ProgressListener.NO_OP));
-            assertEquals(
-                    DestinationStatus.SUCCESS,
-                    destination.status(),
-                    destination.message().orElse(""));
-            assertEquals(SyncStatus.SYNCED, destination.syncStatus());
-        }
-        FileBackupCatalog catalog = new FileBackupCatalog(
-                temporaryDirectory.resolve("remote-only-catalog.json"));
-        catalog.add(new BackupRecord(
-                manifest,
-                BackupResult.aggregate(
-                        backupId,
-                        worldId,
-                        List.of(destination),
-                        manifest.createdAt().plusSeconds(1))));
-        deleteTree(remoteSettings.repository());
-
-        try (GitBackupBackend recovered = new GitBackupBackend(remoteSettings)) {
-            BackupRecoveryService service = new BackupRecoveryService(
-                    catalog,
-                    Optional.of(recovered),
-                    Optional.empty(),
-                    new WorldIdentityStore(),
-                    RestoredWorldMetadataFinalizer.NO_OP,
-                    Runnable::run,
-                    new LockingWorldOperationGate());
-            Path worlds = Files.createDirectory(temporaryDirectory.resolve("remote-only-worlds"));
-            RestoreBackupResult restored = await(service.restoreBackup(
-                    new RestoreBackupRequest(backupId, worlds, "Remote Restored"),
-                    ProgressListener.NO_OP));
-
-            assertWorldEquals(expected, restored.restoredWorldDirectory());
-            WorldIdentity restoredIdentity = new WorldIdentityStore().loadOrCreateIdentity(
-                    restored.restoredWorldDirectory());
-            assertNotEquals(worldId, restoredIdentity.worldId());
-            assertEquals(backupId, restoredIdentity.sourceBackupId().orElseThrow());
-            assertEquals(backupId, await(recovered.listSnapshots(Optional.of(worldId))).getFirst().backupId());
-            assertTrue(nativeGit(
-                    "--git-dir=" + remoteSettings.repository(),
-                    "for-each-ref",
-                    "--format=%(refname)",
-                    "refs/worldarchive/fetch/").isBlank());
-        }
-    }
-
-    @Test
-    void remoteCatalogMismatchDoesNotInstallCanonicalLocalRef() throws Exception {
-        Path remote = temporaryDirectory.resolve("catalog-mismatch.git");
-        nativeGit("init", "--bare", remote.toString());
-        Path world = Files.createDirectory(temporaryDirectory.resolve("catalog-mismatch-world"));
-        Files.writeString(world.resolve("level.dat"), "remote manifest");
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        GitBackendSettings remoteSettings = settings(Optional.of(remote.toUri().toString()));
-        BackupManifest captured;
-        DestinationResult destination;
-
-        try (GitBackupBackend backend = new GitBackupBackend(remoteSettings)) {
-            BackupCapture capture = capture(world, worldId, backupId, Instant.now());
-            captured = capture.manifest();
-            destination = await(backend.createBackup(capture, ProgressListener.NO_OP));
-            assertEquals(DestinationStatus.SUCCESS, destination.status());
-        }
-        BackupManifest divergentCatalogManifest = new BackupManifest(
-                captured.formatVersion(),
-                captured.backupId(),
-                captured.worldId(),
-                captured.worldName(),
-                Optional.of("divergent catalog label"),
-                captured.createdAt(),
-                captured.trigger(),
-                captured.sourceFileCount(),
-                captured.sourceByteCount(),
-                captured.changedFileCount(),
-                captured.contentSha256(),
-                captured.inventorySha256());
-        FileBackupCatalog catalog = new FileBackupCatalog(
-                temporaryDirectory.resolve("catalog-mismatch.json"));
-        catalog.add(new BackupRecord(
-                divergentCatalogManifest,
-                BackupResult.aggregate(
-                        backupId,
-                        worldId,
-                        List.of(destination),
-                        captured.createdAt().plusSeconds(1))));
-        deleteTree(remoteSettings.repository());
-
-        try (GitBackupBackend recovered = new GitBackupBackend(remoteSettings)) {
-            BackupRecoveryService service = new BackupRecoveryService(
-                    catalog,
-                    Optional.of(recovered),
-                    Optional.empty(),
-                    new WorldIdentityStore(),
-                    RestoredWorldMetadataFinalizer.NO_OP,
-                    Runnable::run,
-                    new LockingWorldOperationGate());
-            Path worlds = Files.createDirectory(temporaryDirectory.resolve("catalog-mismatch-worlds"));
-
-            assertThrows(
-                    BackupRecoveryException.class,
-                    () -> await(service.restoreBackup(
-                            new RestoreBackupRequest(backupId, worlds, "Must Fail"),
-                            ProgressListener.NO_OP)));
-            assertTrue(nativeGit(
-                    "--git-dir=" + remoteSettings.repository(),
-                    "for-each-ref",
-                    "--format=%(refname)",
-                    GitSnapshot.refName(worldId, backupId)).isBlank());
-            assertTrue(nativeGit(
-                    "--git-dir=" + remoteSettings.repository(),
-                    "for-each-ref",
-                    "--format=%(refname)",
-                    "refs/worldarchive/fetch/").isBlank());
-        }
-    }
-
-    @Test
-    void cancelledRecoveryCleansAtomicallyReplacedGitStaging() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("cancelled-recovery-world"));
-        Files.writeString(world.resolve("level.dat"), "cancel after Git publication");
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        BackupManifest manifest;
-        DestinationResult destination;
-        try (GitBackupBackend backend = new GitBackupBackend(settings)) {
-            BackupCapture capture = capture(world, worldId, backupId, Instant.now());
-            manifest = capture.manifest();
-            destination = await(backend.createBackup(capture, ProgressListener.NO_OP));
-        }
-        FileBackupCatalog catalog = new FileBackupCatalog(
-                temporaryDirectory.resolve("cancelled-recovery-catalog.json"));
-        catalog.add(new BackupRecord(
-                manifest,
-                BackupResult.aggregate(
-                        backupId,
-                        worldId,
-                        List.of(destination),
-                        manifest.createdAt().plusSeconds(1))));
-
-        CountDownLatch checkoutEntered = new CountDownLatch(1);
-        CountDownLatch releaseCheckout = new CountDownLatch(1);
-        SystemGitCommandRunner systemRunner = new SystemGitCommandRunner();
-        GitCommandRunner blockingCheckout = command -> {
-            if (command.arguments().contains("checkout-index")) {
-                checkoutEntered.countDown();
-                releaseCheckout.await();
-            }
-            return systemRunner.run(command);
-        };
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("cancelled-recovery-worlds"));
-        try (ExecutorService backendExecutor = Executors.newSingleThreadExecutor();
-                ExecutorService serviceExecutor = Executors.newSingleThreadExecutor();
-                GitBackupBackend recovered = new GitBackupBackend(
-                        settings, blockingCheckout, backendExecutor)) {
-            BackupRecoveryService service = new BackupRecoveryService(
-                    catalog,
-                    Optional.of(recovered),
-                    Optional.empty(),
-                    new WorldIdentityStore(),
-                    RestoredWorldMetadataFinalizer.NO_OP,
-                    serviceExecutor,
-                    new LockingWorldOperationGate());
-            CompletableFuture<RestoreBackupResult> future = service.restoreBackup(
-                            new RestoreBackupRequest(backupId, worlds, "Cancelled Restore"),
-                            ProgressListener.NO_OP)
-                    .toCompletableFuture();
-            try {
-                assertTrue(checkoutEntered.await(30, TimeUnit.SECONDS));
-                assertTrue(future.cancel(true));
-            } finally {
-                releaseCheckout.countDown();
-            }
-            assertThrows(CancellationException.class, future::join);
-        }
-
-        try (Stream<Path> children = Files.list(worlds)) {
-            assertEquals(List.of(), children.toList());
-        }
-    }
-
-    @Test
-    void failedGitMaterializationPreservesRecoveryStagingIdentityForCleanup() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("failed-recovery-world"));
-        Files.writeString(world.resolve("level.dat"), "fail Git checkout");
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        BackupManifest manifest;
-        DestinationResult destination;
-        try (GitBackupBackend backend = new GitBackupBackend(settings)) {
-            BackupCapture capture = capture(world, worldId, backupId, Instant.now());
-            manifest = capture.manifest();
-            destination = await(backend.createBackup(capture, ProgressListener.NO_OP));
-        }
-        FileBackupCatalog catalog = new FileBackupCatalog(
-                temporaryDirectory.resolve("failed-recovery-catalog.json"));
-        catalog.add(new BackupRecord(
-                manifest,
-                BackupResult.aggregate(
-                        backupId,
-                        worldId,
-                        List.of(destination),
-                        manifest.createdAt().plusSeconds(1))));
-
-        SystemGitCommandRunner systemRunner = new SystemGitCommandRunner();
-        GitCommandRunner failedCheckout = command -> {
-            if (command.arguments().contains("checkout-index")) {
-                throw new IOException("simulated Git checkout failure");
-            }
-            return systemRunner.run(command);
-        };
-        Path worlds = Files.createDirectory(temporaryDirectory.resolve("failed-recovery-worlds"));
-        try (ExecutorService backendExecutor = Executors.newSingleThreadExecutor();
-                GitBackupBackend recovered = new GitBackupBackend(
-                        settings, failedCheckout, backendExecutor)) {
-            BackupRecoveryService service = new BackupRecoveryService(
-                    catalog,
-                    Optional.of(recovered),
-                    Optional.empty(),
-                    new WorldIdentityStore(),
-                    RestoredWorldMetadataFinalizer.NO_OP,
-                    Runnable::run,
-                    new LockingWorldOperationGate());
-
-            assertThrows(
-                    BackupRecoveryException.class,
-                    () -> await(service.restoreBackup(
-                            new RestoreBackupRequest(backupId, worlds, "Failed Restore"),
-                            ProgressListener.NO_OP)));
-        }
-
-        try (Stream<Path> children = Files.list(worlds)) {
-            assertEquals(List.of(), children.toList());
-        }
-    }
-
-    @Test
-    void ambiguousSnapshotPublicationIsRolledBackAfterTimeout() throws Exception {
-        Path world = temporaryDirectory.resolve("ambiguous-publication-world");
-        Files.createDirectories(world);
-        Files.writeString(world.resolve("level.dat"), "must not remain published");
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        String snapshotRef = GitSnapshot.refName(worldId, backupId);
-        SystemGitCommandRunner systemRunner = new SystemGitCommandRunner();
-        AtomicInteger refUpdates = new AtomicInteger();
-        GitCommandRunner ambiguousRunner = command -> {
-            if (command.arguments().contains("update-ref")
-                    && command.arguments().contains(snapshotRef)) {
-                if (refUpdates.incrementAndGet() == 1) {
-                    systemRunner.run(command);
-                    throw new GitCommandTimeoutException(Duration.ofMillis(1));
-                }
-            }
-            return systemRunner.run(command);
-        };
-        ExecutorService executor = Executors.newSingleThreadExecutor();
-        try (GitBackupBackend backend = new GitBackupBackend(settings, ambiguousRunner, executor)) {
-            DestinationResult result = await(backend.createBackup(
-                    capture(world, worldId, backupId, Instant.now()),
-                    ProgressListener.NO_OP));
-
-            assertEquals(DestinationStatus.FAILED, result.status());
-            assertTrue(await(backend.listSnapshots(Optional.of(worldId))).isEmpty());
-            assertEquals(2, refUpdates.get());
-        } finally {
-            executor.shutdownNow();
-        }
-    }
-
-    @Test
-    void deletionCannotInterleaveBetweenLocalPublicationAndRemotePush() throws Exception {
-        Path remote = temporaryDirectory.resolve("serialized-remote.git");
-        nativeGit("init", "--bare", remote.toString());
-        Path world = temporaryDirectory.resolve("serialized-create-world");
-        Files.createDirectories(world);
-        Files.writeString(world.resolve("level.dat"), "serialized");
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        GitBackendSettings remoteSettings = settings(Optional.of(remote.toUri().toString()));
-        CountDownLatch pushEntered = new CountDownLatch(1);
-        CountDownLatch releasePush = new CountDownLatch(1);
-        SystemGitCommandRunner systemRunner = new SystemGitCommandRunner();
-        GitCommandRunner blockingPush = command -> {
-            if (command.arguments().contains("lfs") && command.arguments().contains("push")) {
-                pushEntered.countDown();
-                if (!releasePush.await(10, TimeUnit.SECONDS)) {
-                    throw new IOException("Test did not release Git LFS push");
-                }
-            }
-            return systemRunner.run(command);
-        };
-        ExecutorService executor = Executors.newSingleThreadExecutor();
-        try (GitBackupBackend creator = new GitBackupBackend(remoteSettings, blockingPush, executor);
-                GitBackupBackend deleter = new GitBackupBackend(remoteSettings)) {
-            CompletableFuture<DestinationResult> create = creator.createBackup(
-                    capture(world, worldId, backupId, Instant.now()),
-                    ProgressListener.NO_OP).toCompletableFuture();
-            assertTrue(pushEntered.await(30, TimeUnit.SECONDS));
-            CompletableFuture<Boolean> delete = deleter.deleteSnapshot(worldId, backupId).toCompletableFuture();
-            assertThrows(java.util.concurrent.TimeoutException.class, () -> delete.get(250, TimeUnit.MILLISECONDS));
-            releasePush.countDown();
-
-            assertEquals(DestinationStatus.SUCCESS, create.get(30, TimeUnit.SECONDS).status());
-            assertTrue(delete.get(30, TimeUnit.SECONDS));
-        } finally {
-            releasePush.countDown();
-            executor.shutdownNow();
-        }
-    }
-
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitBackupBackendToolAvailabilityTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitBackupBackendToolAvailabilityTest.java
deleted file mode 100644
index c609387..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitBackupBackendToolAvailabilityTest.java
+++ /dev/null
@@ -1,84 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationStatus;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.nio.file.Files;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.time.Duration;
-import java.time.Instant;
-import java.util.Optional;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicInteger;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-class GitBackupBackendToolAvailabilityTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void enabledDestinationFailsWhenToolsDisappearAfterInitialProbe() throws Exception {
-        AtomicInteger probes = new AtomicInteger();
-        GitCommandRunner disappearingTools = command -> {
-            int probe = probes.getAndIncrement();
-            if (probe < 2) {
-                String version = command.arguments().contains("lfs")
-                        ? "git-lfs/3.7.1"
-                        : "git version 2.50.1";
-                return new GitCommandResult(0, version, "", false, false);
-            }
-            return new GitCommandResult(1, "", "tool unavailable", false, false);
-        };
-        Path repository = temporaryDirectory.resolve("missing-tools.git");
-        GitBackendSettings settings = new GitBackendSettings(
-                true,
-                repository,
-                "git",
-                "origin",
-                Optional.empty(),
-                GitBackendSettings.DEFAULT_LFS_PATTERNS,
-                Duration.ofSeconds(5),
-                1_024 * 1_024);
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
-        BackupManifest manifest = BackupManifest.create(
-                BackupId.create(),
-                WorldId.create(),
-                "Tool Loss World",
-                Instant.parse("2026-07-18T08:00:00Z"),
-                BackupTrigger.MANUAL,
-                0L,
-                0L,
-                "00".repeat(32));
-
-        try (ExecutorService executor = Executors.newSingleThreadExecutor();
-                GitBackupBackend backend = new GitBackupBackend(
-                        settings, disappearingTools, executor)) {
-            assertTrue(backend.probeTools().toCompletableFuture().get(
-                    10, TimeUnit.SECONDS).available());
-
-            DestinationResult result = backend.createBackup(
-                            new BackupCapture(world, manifest),
-                            ProgressListener.NO_OP)
-                    .toCompletableFuture()
-                    .get(10, TimeUnit.SECONDS);
-
-            assertEquals(DestinationStatus.FAILED, result.status());
-            assertEquals("Git and Git LFS are unavailable", result.message().orElseThrow());
-            assertFalse(Files.exists(repository, LinkOption.NOFOLLOW_LINKS));
-            assertEquals(4, probes.get());
-        }
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitDisplayRedactionTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitDisplayRedactionTest.java
deleted file mode 100644
index 6e61d35..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitDisplayRedactionTest.java
+++ /dev/null
@@ -1,37 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.time.Instant;
-import java.util.Optional;
-import org.junit.jupiter.api.Test;
-
-class GitDisplayRedactionTest {
-    @Test
-    void verificationAndHealthObjectsRedactMissedProcessSecrets() {
-        String secret = "Authorization: Bearer ABCDEFGHIJKLMNOP";
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        GitSnapshot snapshot = new GitSnapshot(
-                worldId,
-                backupId,
-                GitSnapshot.refName(worldId, backupId),
-                "a".repeat(40),
-                Instant.EPOCH);
-
-        GitVerification verification = new GitVerification(snapshot, false, secret);
-        GitToolHealth health = new GitToolHealth(
-                false,
-                false,
-                Optional.empty(),
-                Optional.empty(),
-                Optional.of(secret),
-                Optional.of("api_key=visible"));
-
-        assertFalse(verification.message().contains("ABCDEFGHIJKLMNOP"));
-        assertFalse(health.gitFailure().orElseThrow().contains("ABCDEFGHIJKLMNOP"));
-        assertFalse(health.lfsFailure().orElseThrow().contains("visible"));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitHistoryImporterTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitHistoryImporterTest.java
deleted file mode 100644
index 2e6e1b6..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitHistoryImporterTest.java
+++ /dev/null
@@ -1,53 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.LinkedHashMap;
-import java.util.Map;
-import java.util.Set;
-import org.junit.jupiter.api.Test;
-
-final class GitHistoryImporterTest {
-    @Test
-    void conflictingIdentityRemainsRejectedAfterAdditionalCommits() {
-        BackupId backupId = BackupId.create();
-        Map<BackupId, GitImportCandidate> candidates = new LinkedHashMap<>();
-        Set<BackupId> rejected = new HashSet<>();
-        ArrayList<GitImportIssue> issues = new ArrayList<>();
-
-        GitHistoryImporter.mergeCandidate(
-                candidates, rejected, issues, candidate(backupId, "1".repeat(40), "first"));
-        GitHistoryImporter.mergeCandidate(
-                candidates, rejected, issues, candidate(backupId, "2".repeat(40), "second"));
-        GitHistoryImporter.mergeCandidate(
-                candidates, rejected, issues, candidate(backupId, "3".repeat(40), "third"));
-
-        assertFalse(candidates.containsKey(backupId));
-        assertEquals(Set.of(backupId), rejected);
-        assertEquals(1, issues.size());
-    }
-
-    private static GitImportCandidate candidate(
-            BackupId backupId,
-            String commit,
-            String name) {
-        BackupManifest manifest = BackupManifest.create(
-                backupId,
-                WorldId.create(),
-                name,
-                Instant.parse("2026-07-22T00:00:00Z"),
-                BackupTrigger.MANUAL,
-                0,
-                0,
-                "0".repeat(64));
-        return new GitImportCandidate(manifest, "refs/heads/main", commit);
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitHubImportSmokeTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitHubImportSmokeTest.java
deleted file mode 100644
index f0ca9cd..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitHubImportSmokeTest.java
+++ /dev/null
@@ -1,275 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.DestinationStatus;
-import dev.ishaanko.worldarchive.model.SyncStatus;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.time.Duration;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.CompletionStage;
-import java.util.concurrent.ExecutionException;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.TimeUnit;
-import java.util.stream.Stream;
-import org.junit.jupiter.api.Assumptions;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-/** Opt-in end-to-end import smoke test against isolated GitHub fixture repositories. */
-final class GitHubImportSmokeTest {
-    private static final String FULL_REMOTE = "WORLDARCHIVE_GITHUB_SMOKE_FULL";
-
-    private static final String REMOTE_BACKED = "WORLDARCHIVE_GITHUB_SMOKE_REMOTE";
-
-    private static final Duration NETWORK_TIMEOUT = Duration.ofMinutes(3);
-
-    @TempDir
-    Path temporaryDirectory;
-
-    private String fullRemote;
-
-    private String remoteBacked;
-
-    @BeforeEach
-    void requireExplicitFixtureRemotesAndNativeTools() throws Exception {
-        fullRemote = System.getenv(FULL_REMOTE);
-        remoteBacked = System.getenv(REMOTE_BACKED);
-        Assumptions.assumeTrue(
-                fullRemote != null && !fullRemote.isBlank()
-                        && remoteBacked != null && !remoteBacked.isBlank(),
-                "Set both GitHub smoke fixture environment variables");
-        GitToolHealth health = new GitToolProbe(
-                settings(temporaryDirectory.resolve("probe"), Optional.empty()),
-                new SystemGitCommandRunner()).probe();
-        Assumptions.assumeTrue(health.available(), health.summary());
-    }
-
-    @Test
-    void importsFullAndRemoteBackedGitHubHistoriesWithoutMutatingSources() throws Exception {
-        Fixture fullFixture = publishFixture("full-source", fullRemote);
-        try (WorldGitSnapshotStore imported = store("full-import")) {
-            try (GitPreparedImport prepared = await(imported.prepareImport(fullRemote))) {
-                assertEquals(2, prepared.candidates().size());
-                assertTrue(prepared.issues().isEmpty());
-                assertTrue(await(imported.installImport(prepared, true)).values().stream()
-                        .allMatch(status -> status == GitImportInstallStatus.ADDED));
-                assertTrue(await(imported.installImport(prepared, true)).values().stream()
-                        .allMatch(status -> status == GitImportInstallStatus.UNCHANGED));
-            }
-            assertTrue(await(imported.verifySnapshot(
-                    fullFixture.worldId(), fullFixture.firstBackup())).valid());
-            assertTrue(await(imported.verifySnapshot(
-                    fullFixture.worldId(), fullFixture.secondBackup())).valid());
-
-            Path repository = imported.repositoryFor(fullFixture.worldId());
-            nativeGit(
-                    "--git-dir=" + repository,
-                    "update-ref",
-                    "-d",
-                    GitSnapshot.refName(fullFixture.worldId(), fullFixture.firstBackup()));
-            assertEquals(0, await(imported.rebuildSnapshotRefs()));
-            assertFalse(await(imported.listSnapshots(Optional.of(
-                            fullFixture.worldId()))).stream()
-                    .anyMatch(snapshot ->
-                            snapshot.backupId().equals(fullFixture.firstBackup())));
-
-            Path restored = temporaryDirectory.resolve("full-restored");
-            await(imported.restoreSnapshot(
-                    fullFixture.worldId(),
-                    fullFixture.secondBackup(),
-                    fullFixture.secondManifest(),
-                    restored));
-            assertEquals("second", Files.readString(restored.resolve("level.dat")));
-            assertEquals(
-                    "lfs-second",
-                    Files.readString(restored.resolve("region").resolve("r.0.0.mca")));
-        }
-
-        Fixture remoteFixture = publishFixture("remote-source", remoteBacked);
-        try (WorldGitSnapshotStore imported = store("remote-import");
-                GitPreparedImport prepared = await(imported.prepareImport(remoteBacked))) {
-            assertEquals(2, prepared.candidates().size());
-            Map<BackupId, GitImportInstallStatus> statuses =
-                    await(imported.installImport(prepared, false));
-            assertTrue(statuses.values().stream()
-                    .allMatch(status -> status == GitImportInstallStatus.ADDED));
-            assertFalse(await(imported.verifySnapshot(
-                    remoteFixture.worldId(), remoteFixture.secondBackup())).valid());
-
-            GitImportCandidate newest = prepared.candidates().stream()
-                    .filter(candidate -> candidate.manifest().backupId()
-                            .equals(remoteFixture.secondBackup()))
-                    .findFirst()
-                    .orElseThrow();
-            assertTrue(await(imported.hydrateExternalSnapshot(
-                    remoteFixture.worldId(),
-                    remoteFixture.secondBackup(),
-                    newest.manifest(),
-                    newest.commitId(),
-                    remoteBacked)).valid());
-
-            Path restored = temporaryDirectory.resolve("remote-restored");
-            await(imported.restoreSnapshot(
-                    remoteFixture.worldId(),
-                    remoteFixture.secondBackup(),
-                    remoteFixture.secondManifest(),
-                    restored));
-            assertEquals("second", Files.readString(restored.resolve("level.dat")));
-            assertTrue(await(imported.deleteLocalSnapshot(
-                    remoteFixture.worldId(), remoteFixture.secondBackup())));
-            assertFalse(await(imported.listSnapshots(Optional.of(remoteFixture.worldId()))).stream()
-                    .anyMatch(snapshot -> snapshot.backupId().equals(remoteFixture.secondBackup())));
-        }
-
-        assertFalse(nativeGit(
-                "ls-remote",
-                fullRemote,
-                GitRemoteSnapshotRef.current(
-                        fullFixture.firstBackup(),
-                        fullFixture.firstManifest().createdAt())).isBlank());
-        assertFalse(nativeGit(
-                "ls-remote",
-                remoteBacked,
-                GitRemoteSnapshotRef.current(
-                        remoteFixture.secondBackup(),
-                        remoteFixture.secondManifest().createdAt())).isBlank());
-    }
-
-    private Fixture publishFixture(String name, String remote) throws Exception {
-        WorldId worldId = WorldId.create();
-        BackupId firstBackup = BackupId.create();
-        BackupId secondBackup = BackupId.create();
-        Path world = Files.createDirectories(temporaryDirectory.resolve(name).resolve("world"));
-        Path region = Files.createDirectories(world.resolve("region")).resolve("r.0.0.mca");
-        Files.writeString(world.resolve("level.dat"), "first");
-        Files.writeString(region, "lfs-first");
-        BackupCapture first = capture(
-                world, worldId, firstBackup, Instant.parse("2026-07-21T22:00:00Z"));
-        BackupCapture second;
-        ExecutorService executor = Executors.newThreadPerTaskExecutor(
-                Thread.ofVirtual().name("worldarchive-github-smoke-", 0).factory());
-        try (WorldGitSnapshotStore producer = new WorldGitSnapshotStore(
-                settings(
-                        temporaryDirectory.resolve(name).resolve("repositories"),
-                        Optional.empty()),
-                Optional.empty(),
-                Map.of(worldId, remote),
-                new SystemGitCommandRunner(),
-                executor)) {
-            var firstResult = await(producer.createBackup(first, ProgressListener.NO_OP));
-            assertEquals(DestinationStatus.SUCCESS, firstResult.status());
-            assertEquals(SyncStatus.SYNCED, firstResult.syncStatus());
-
-            Files.writeString(world.resolve("level.dat"), "second");
-            Files.writeString(region, "lfs-second");
-            second = capture(
-                    world, worldId, secondBackup, Instant.parse("2026-07-21T22:01:00Z"));
-            var secondResult = await(producer.createBackup(second, ProgressListener.NO_OP));
-            assertEquals(DestinationStatus.SUCCESS, secondResult.status());
-            assertEquals(SyncStatus.SYNCED, secondResult.syncStatus());
-        } finally {
-            executor.shutdownNow();
-        }
-        return new Fixture(
-                worldId, firstBackup, secondBackup, first.manifest(), second.manifest());
-    }
-
-    private WorldGitSnapshotStore store(String name) {
-        return new WorldGitSnapshotStore(settings(
-                temporaryDirectory.resolve(name), Optional.empty()));
-    }
-
-    private GitBackendSettings settings(Path repository, Optional<String> remote) {
-        return new GitBackendSettings(
-                true,
-                repository,
-                "git",
-                "origin",
-                remote,
-                GitBackendSettings.DEFAULT_LFS_PATTERNS,
-                NETWORK_TIMEOUT,
-                GitBackendSettings.DEFAULT_MAXIMUM_OUTPUT_BYTES);
-    }
-
-    private static BackupCapture capture(
-            Path world,
-            WorldId worldId,
-            BackupId backupId,
-            Instant timestamp) throws Exception {
-        List<GitInventoryEntry> entries = new ArrayList<>();
-        try (Stream<Path> paths = Files.walk(world)) {
-            for (Path path : paths.filter(Files::isRegularFile).toList()) {
-                byte[] contents = Files.readAllBytes(path);
-                entries.add(new GitInventoryEntry(
-                        world.relativize(path).toString().replace('\\', '/'),
-                        contents.length,
-                        java.util.HexFormat.of().formatHex(
-                                GitInventory.sha256().digest(contents))));
-            }
-        }
-        GitInventory inventory = GitInventory.create(entries);
-        BackupManifest manifest = BackupManifest.create(
-                backupId,
-                worldId,
-                "GitHub recovery fixture",
-                Optional.of("v0.3.0 smoke"),
-                timestamp,
-                BackupTrigger.MANUAL,
-                inventory.fileCount(),
-                inventory.byteCount(),
-                inventory.fileCount(),
-                inventory.contentSha256(),
-                inventory.inventorySha256());
-        return new BackupCapture(world, manifest);
-    }
-
-    private String nativeGit(String... arguments) throws Exception {
-        List<String> command = new ArrayList<>();
-        command.add("git");
-        command.addAll(List.of(arguments));
-        Process process = new ProcessBuilder(command)
-                .directory(temporaryDirectory.toFile())
-                .redirectErrorStream(true)
-                .start();
-        String output = new String(process.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
-        assertTrue(process.waitFor(3, TimeUnit.MINUTES));
-        assertEquals(0, process.exitValue(), output);
-        return output;
-    }
-
-    private static <T> T await(CompletionStage<T> stage) throws Exception {
-        try {
-            return stage.toCompletableFuture().get(3, TimeUnit.MINUTES);
-        } catch (ExecutionException exception) {
-            if (exception.getCause() instanceof Exception cause) {
-                throw cause;
-            }
-            throw exception;
-        }
-    }
-
-    private record Fixture(
-            WorldId worldId,
-            BackupId firstBackup,
-            BackupId secondBackup,
-            BackupManifest firstManifest,
-            BackupManifest secondManifest) {
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitRemoteSnapshotRefTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitRemoteSnapshotRefTest.java
index 0f0fc74..f5c59ce 100644
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitRemoteSnapshotRefTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitRemoteSnapshotRefTest.java
@@ -7,6 +7,7 @@
 import java.time.Instant;
 import org.junit.jupiter.api.Test;
 
+/** Remote backup branch names never change, because remote backups depend on them. */
 class GitRemoteSnapshotRefTest {
     @Test
     void leadsWithReadableUtcDateAndOmitsWorldUuid() {
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitRepositoryPathGuardTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitRepositoryPathGuardTest.java
deleted file mode 100644
index 8af4925..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitRepositoryPathGuardTest.java
+++ /dev/null
@@ -1,31 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import org.junit.jupiter.api.Assumptions;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-class GitRepositoryPathGuardTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void refusesToFollowASymlinkedLockFile() throws Exception {
-        Path outside = temporaryDirectory.resolve("outside.txt");
-        Path lock = temporaryDirectory.resolve("repository.worldarchive.lock");
-        Files.writeString(outside, "unchanged");
-        try {
-            Files.createSymbolicLink(lock, outside);
-        } catch (IOException | UnsupportedOperationException exception) {
-            Assumptions.abort("Symbolic links are unavailable: " + exception.getMessage());
-        }
-
-        assertThrows(GitStorageException.class, () -> GitRepositoryPathGuard.openLockFile(lock));
-        assertEquals("unchanged", Files.readString(outside));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitRestorePublicationTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitRestorePublicationTest.java
deleted file mode 100644
index 0352180..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitRestorePublicationTest.java
+++ /dev/null
@@ -1,212 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.core.DirectoryIdentityMarker;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.attribute.BasicFileAttributes;
-import java.nio.file.attribute.FileTime;
-import java.util.stream.Stream;
-import org.junit.jupiter.api.Assumptions;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-class GitRestorePublicationTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void failedRestoreRollsBackPrivateStagingWithoutPublishing() throws Exception {
-        Path target = temporaryDirectory.resolve("failed-restore");
-
-        try (GitRestorePublication publication = GitRestorePublication.create(target)) {
-            Files.writeString(publication.staging().resolve("partial.dat"), "partial");
-        }
-
-        assertFalse(Files.exists(target));
-        assertFalse(hasPrivateRestoreDirectory());
-    }
-
-    @Test
-    void failedRestorePreservesAnOriginallyEmptyTarget() throws Exception {
-        Path target = temporaryDirectory.resolve("existing-empty");
-        Files.createDirectory(target);
-        BasicFileAttributes attributes = Files.readAttributes(
-                target, BasicFileAttributes.class);
-        if (attributes.fileKey() == null) {
-            Assumptions.assumeTrue(DirectoryIdentityMarker.create(target).isPresent());
-        }
-
-        try (GitRestorePublication publication = GitRestorePublication.create(target)) {
-            Files.writeString(publication.staging().resolve("partial.dat"), "partial");
-        }
-
-        assertTrue(Files.isDirectory(target));
-        try (Stream<Path> children = Files.list(target)) {
-            assertTrue(children.findAny().isEmpty());
-        }
-        assertFalse(hasPrivateRestoreDirectory());
-    }
-
-    @Test
-    void publishesCompletePrivateTreeInOneMove() throws Exception {
-        Path target = temporaryDirectory.resolve("published");
-
-        try (GitRestorePublication publication = GitRestorePublication.create(target)) {
-            Files.createDirectories(publication.staging().resolve("region"));
-            Files.writeString(publication.staging().resolve("region/r.0.0.mca"), "complete");
-            publication.publish();
-        }
-
-        assertEquals("complete", Files.readString(target.resolve("region/r.0.0.mca")));
-        assertFalse(hasPrivateRestoreDirectory());
-    }
-
-    @Test
-    void targetLinkInsertedDuringRestoreCannotRedirectPublication() throws Exception {
-        Path target = temporaryDirectory.resolve("racing-target");
-        Path outside = temporaryDirectory.resolve("outside");
-        Files.createDirectory(outside);
-
-        try (GitRestorePublication publication = GitRestorePublication.create(target)) {
-            Files.writeString(publication.staging().resolve("level.dat"), "private");
-            try {
-                Files.createSymbolicLink(target, outside);
-            } catch (IOException | UnsupportedOperationException exception) {
-                Assumptions.abort("Symbolic links are unavailable: " + exception.getMessage());
-            }
-            assertThrows(GitStorageException.class, publication::publish);
-        }
-
-        try (Stream<Path> children = Files.list(outside)) {
-            assertTrue(children.findAny().isEmpty());
-        }
-    }
-
-    @Test
-    void nullFileKeyUsesDirectoryMarkerIdentity() throws Exception {
-        Path directory = Files.createDirectory(temporaryDirectory.resolve("marked-identity"));
-        FileTime creationTime = FileTime.fromMillis(1_234L);
-        GitRestorePublication.DirectoryIdentity identity =
-                GitRestorePublication.DirectoryIdentity.capture(
-                        directory,
-                        directoryAttributes(null, creationTime),
-                        false,
-                        true,
-                        "identity unavailable");
-        Assumptions.assumeTrue(identity.marker().isPresent());
-
-        assertDoesNotThrow(() -> identity.requireMatches(
-                directory,
-                directoryAttributes(null, creationTime),
-                "identity changed"));
-        Files.delete(directory);
-        Files.createDirectory(directory);
-        assertThrows(GitStorageException.class, () -> identity.requireMatches(
-                directory,
-                directoryAttributes(null, creationTime),
-                "identity changed"));
-        assertThrows(GitStorageException.class, () ->
-                GitRestorePublication.DirectoryIdentity.capture(
-                        directory,
-                        directoryAttributes(null, creationTime),
-                        false,
-                        false,
-                        "identity unavailable"));
-        assertThrows(GitStorageException.class, () ->
-                GitRestorePublication.DirectoryIdentity.capture(
-                        directory,
-                        directoryAttributes(null, creationTime),
-                        true,
-                        true,
-                        "identity unavailable"));
-    }
-
-    @Test
-    void fileKeyUsesSupplementalDirectoryMarkerWhenAvailable() throws Exception {
-        Path directory = Files.createDirectory(temporaryDirectory.resolve("keyed-identity"));
-        FileTime creationTime = FileTime.fromMillis(1_234L);
-        Object reusedFileKey = "reused-file-key";
-        GitRestorePublication.DirectoryIdentity identity =
-                GitRestorePublication.DirectoryIdentity.capture(
-                        directory,
-                        directoryAttributes(reusedFileKey, creationTime),
-                        false,
-                        true,
-                        "identity unavailable");
-        Assumptions.assumeTrue(identity.marker().isPresent());
-
-        assertDoesNotThrow(() -> identity.requireMatches(
-                directory,
-                directoryAttributes(reusedFileKey, creationTime),
-                "identity changed"));
-        Files.delete(directory);
-        Files.createDirectory(directory);
-        assertThrows(GitStorageException.class, () -> identity.requireMatches(
-                directory,
-                directoryAttributes(reusedFileKey, creationTime),
-                "identity changed"));
-    }
-
-    private boolean hasPrivateRestoreDirectory() throws IOException {
-        try (Stream<Path> children = Files.list(temporaryDirectory)) {
-            return children.anyMatch(path -> path.getFileName().toString()
-                    .startsWith(".worldarchive-restore-"));
-        }
-    }
-
-    private static BasicFileAttributes directoryAttributes(Object fileKey, FileTime creationTime) {
-        return new BasicFileAttributes() {
-            @Override
-            public FileTime lastModifiedTime() {
-                return creationTime;
-            }
-
-            @Override
-            public FileTime lastAccessTime() {
-                return creationTime;
-            }
-
-            @Override
-            public FileTime creationTime() {
-                return creationTime;
-            }
-
-            @Override
-            public boolean isRegularFile() {
-                return false;
-            }
-
-            @Override
-            public boolean isDirectory() {
-                return true;
-            }
-
-            @Override
-            public boolean isSymbolicLink() {
-                return false;
-            }
-
-            @Override
-            public boolean isOther() {
-                return false;
-            }
-
-            @Override
-            public long size() {
-                return 0L;
-            }
-
-            @Override
-            public Object fileKey() {
-                return fileKey;
-            }
-        };
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotManifestCodecTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotManifestCodecTest.java
index 1497742..dcde562 100644
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotManifestCodecTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitSnapshotManifestCodecTest.java
@@ -5,14 +5,18 @@
 import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
+import com.google.gson.GsonBuilder;
+import com.google.gson.JsonArray;
 import com.google.gson.JsonObject;
 import com.google.gson.JsonParser;
-import dev.ishaanko.worldarchive.core.Digests;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.BackupManifestJson;
 import dev.ishaanko.worldarchive.model.BackupTrigger;
 import dev.ishaanko.worldarchive.model.GameVersionStamp;
+import dev.ishaanko.worldarchive.model.GoldenFixtures;
 import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.support.Digests;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.time.Instant;
@@ -20,9 +24,58 @@
 import java.util.Optional;
 import org.junit.jupiter.api.Test;
 
+/** The manifest in every snapshot keeps its exact bytes and rejects versions it does not know. */
 class GitSnapshotManifestCodecTest {
     private static final String DIGEST = "cd".repeat(32);
 
+    private static final String LABELED_SNAPSHOT_JSON = """
+            {
+              "storageFormatVersion": 1,
+              "formatVersion": 1,
+              "backupId": "0f6d3c2a-8b1e-4c5d-9a7f-112233445566",
+              "worldId": "7a1b2c3d-4e5f-4a6b-8c7d-8e9fa0b1c2d3",
+              "worldName": "Golden Wörld 世界",
+              "label": "Before the <dragon> & \\"end\\"",
+              "createdAt": "2026-09-01T12:34:56.789Z",
+              "trigger": "MANUAL",
+              "sourceFileCount": 3,
+              "sourceByteCount": 266240,
+              "changedFileCount": 2,
+              "contentSha256": "3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
+              "inventorySha256": "a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0",
+              "gameVersion": {
+                "name": "26.3",
+                "dataVersion": 4556
+              },
+              "sourceIdentity": "c1f161dcc2c7ee8e0970731fe99169335e5b3a1beac65bc7a93909f8907b4005",
+              "lfsPatterns": [
+                "*.mca",
+                "*.dat"
+              ]
+            }
+            """;
+
+    private static final String PLAIN_SNAPSHOT_JSON = """
+            {
+              "storageFormatVersion": 1,
+              "formatVersion": 1,
+              "backupId": "1e2d3c4b-5a69-4788-97a6-b5c4d3e2f100",
+              "worldId": "7a1b2c3d-4e5f-4a6b-8c7d-8e9fa0b1c2d3",
+              "worldName": "Plain",
+              "createdAt": "2026-09-01T12:00:00Z",
+              "trigger": "WORLD_EXIT",
+              "sourceFileCount": 0,
+              "sourceByteCount": 0,
+              "changedFileCount": 0,
+              "contentSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+              "inventorySha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+              "sourceIdentity": "46834a3e593e735a57267595d8e4988ac53e6fad4195ebe0b8f93b66ae92575a",
+              "lfsPatterns": [
+                "*.mca"
+              ]
+            }
+            """;
+
     @Test
     void rejectsUnsupportedStorageFormatVersion() {
         assertThrows(
@@ -63,27 +116,17 @@ void keepsTheLegacySourceIdentityForManifestsWithoutAGameVersion() {
     }
 
     @Test
-    void validatesSnapshotsWrittenBeforeGameVersionTracking() throws IOException {
-        byte[] encoded = GitSnapshotManifestCodec.encode(
+    void roundTripsManifestsWithAndWithoutAGameVersion() throws IOException {
+        byte[] unstamped = GitSnapshotManifestCodec.encode(
                 GitSnapshotManifest.create(manifest(Optional.empty()), List.of("*.mca")));
-        JsonObject root = JsonParser.parseString(new String(encoded, StandardCharsets.UTF_8))
-                .getAsJsonObject();
-
-        assertFalse(root.has("gameVersion"));
-
-        GitSnapshotManifest decoded = GitSnapshotManifestCodec.decode(encoded);
-
-        assertEquals(Optional.empty(), decoded.manifest().gameVersion());
-    }
-
-    @Test
-    void roundTripsAStampedGameVersion() throws IOException {
         GameVersionStamp stamp = new GameVersionStamp("26.2", 4_820);
-        GitSnapshotManifest decoded = GitSnapshotManifestCodec.decode(
-                GitSnapshotManifestCodec.encode(
-                        GitSnapshotManifest.create(manifest(Optional.of(stamp)), List.of("*.mca"))));
+        byte[] stamped = GitSnapshotManifestCodec.encode(
+                GitSnapshotManifest.create(manifest(Optional.of(stamp)), List.of("*.mca")));
 
-        assertEquals(Optional.of(stamp), decoded.manifest().gameVersion());
+        assertFalse(JsonParser.parseString(new String(unstamped, StandardCharsets.UTF_8))
+                .getAsJsonObject().has("gameVersion"));
+        assertEquals(Optional.empty(), GitSnapshotManifestCodec.decode(unstamped).manifest().gameVersion());
+        assertEquals(Optional.of(stamp), GitSnapshotManifestCodec.decode(stamped).manifest().gameVersion());
     }
 
     @Test
@@ -94,6 +137,30 @@ void bindsTheGameVersionIntoTheSourceIdentity() {
         assertNotEquals(GitSnapshotManifest.computeSourceIdentity(manifest(Optional.empty())), stamped);
     }
 
+    @Test
+    void encodesManifestsExactlyAsStoredSnapshotsHoldThem() {
+        GitSnapshotManifest labeled = GitSnapshotManifest.create(
+                GoldenFixtures.labeledManifest(), List.of("*.mca", "*.dat"));
+        GitSnapshotManifest plain = GitSnapshotManifest.create(GoldenFixtures.plainManifest(), List.of("*.mca"));
+
+        assertEquals(LABELED_SNAPSHOT_JSON, new String(GitSnapshotManifestCodec.encode(labeled), StandardCharsets.UTF_8));
+        assertEquals(PLAIN_SNAPSHOT_JSON, new String(GitSnapshotManifestCodec.encode(plain), StandardCharsets.UTF_8));
+        assertEquals(LABELED_SNAPSHOT_JSON, withSharedManifestFields(labeled));
+        assertEquals(PLAIN_SNAPSHOT_JSON, withSharedManifestFields(plain));
+    }
+
+    /** The Git layout written with the shared manifest fields, to prove they are byte-identical. */
+    private static String withSharedManifestFields(GitSnapshotManifest snapshot) {
+        JsonObject root = new JsonObject();
+        root.addProperty("storageFormatVersion", snapshot.storageFormatVersion());
+        BackupManifestJson.write(snapshot.manifest(), root);
+        root.addProperty("sourceIdentity", snapshot.sourceIdentity());
+        JsonArray patterns = new JsonArray();
+        snapshot.lfsPatterns().forEach(patterns::add);
+        root.add("lfsPatterns", patterns);
+        return new GsonBuilder().setPrettyPrinting().disableHtmlEscaping().create().toJson(root) + "\n";
+    }
+
     private static BackupManifest manifest(Optional<GameVersionStamp> gameVersion) {
         return BackupManifest.create(
                 BackupId.parse("33333333-3333-3333-3333-333333333333"),
@@ -115,11 +182,15 @@ private static byte[] withVersion(String field, int version) {
                 BackupId.parse("33333333-3333-3333-3333-333333333333"),
                 WorldId.parse("44444444-4444-4444-4444-444444444444"),
                 "Versioned World",
+                Optional.empty(),
                 Instant.parse("2026-07-17T20:00:00Z"),
                 BackupTrigger.MANUAL,
                 1L,
                 4L,
-                DIGEST);
+                1L,
+                DIGEST,
+                DIGEST,
+                Optional.empty());
         JsonObject encoded = JsonParser.parseString(new String(
                         GitSnapshotManifestCodec.encode(
                                 GitSnapshotManifest.create(manifest, List.of("*.mca"))),
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitSourceCaptureTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitSourceCaptureTest.java
deleted file mode 100644
index 5a43d76..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitSourceCaptureTest.java
+++ /dev/null
@@ -1,65 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.attribute.FileTime;
-import java.time.Instant;
-import java.util.HexFormat;
-import java.util.List;
-import java.util.Optional;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-class GitSourceCaptureTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void ignoresDirectoryTimestampDriftWhileFilesRemainStable() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world-directory-time"));
-        Path region = Files.createDirectory(world.resolve("region"));
-        byte[] contents = "contents".getBytes(StandardCharsets.UTF_8);
-        Path regionFile = region.resolve("r.0.0.mca");
-        Files.write(regionFile, contents);
-
-        GitInventory inventory = GitInventory.create(List.of(new GitInventoryEntry(
-                "region/r.0.0.mca",
-                contents.length,
-                HexFormat.of().formatHex(GitInventory.sha256().digest(contents)))));
-        BackupManifest manifest = BackupManifest.create(
-                BackupId.create(),
-                WorldId.create(),
-                "Directory timestamp test",
-                Optional.empty(),
-                Instant.parse("2026-07-17T12:00:00Z"),
-                BackupTrigger.MANUAL,
-                inventory.fileCount(),
-                inventory.byteCount(),
-                inventory.fileCount(),
-                inventory.contentSha256(),
-                inventory.inventorySha256());
-
-        try (GitSourceCapture capture = GitSourceCapture.create(
-                world,
-                manifest,
-                new GitSourceCapture.CaptureHook() {
-                    @Override
-                    public void afterFileCopy(Path relative) throws java.io.IOException {
-                        if (relative.equals(Path.of("region", "r.0.0.mca"))) {
-                            Files.setLastModifiedTime(
-                                    region,
-                                    FileTime.from(Instant.parse("2026-07-17T12:01:00Z")));
-                        }
-                    }
-                })) {
-            assertEquals(inventory, capture.inventory());
-        }
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitToolProbeTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitToolProbeTest.java
index 26d6e91..dfdc594 100644
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitToolProbeTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitToolProbeTest.java
@@ -1,42 +1,66 @@
 package dev.ishaanko.worldarchive.storage.git;
 
+import dev.ishaanko.worldarchive.config.FolderOrigin;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
+import java.io.IOException;
 import java.nio.file.Path;
 import java.time.Duration;
 import java.util.Optional;
+import java.util.concurrent.atomic.AtomicInteger;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
+/** The tool check reports Git and Git LFS separately and refuses a Git that is too old. */
 final class GitToolProbeTest {
     @TempDir
     Path temporaryDirectory;
 
     @Test
     void reportsAnOldOrUnreadableGitAsUnavailable() throws Exception {
-        GitToolHealth old = probe("git version 2.20.1.windows.1");
-        GitToolHealth current = probe("git version 2.53.0");
-        GitToolHealth unparsed = probe("git version test");
+        GitToolHealth old = probe(versions("git version 2.20.1.windows.1"));
+        GitToolHealth current = probe(versions("git version 2.53.0"));
+        GitToolHealth unparsed = probe(versions("git version test"));
 
         assertFalse(old.gitAvailable());
         assertTrue(old.gitFailure().orElseThrow().contains("found 2.20"));
         assertTrue(old.lfsAvailable());
-        assertTrue(current.gitAvailable());
+        assertTrue(current.available());
         assertFalse(unparsed.gitAvailable());
         assertTrue(unparsed.gitFailure().orElseThrow().contains("git version test"));
     }
 
-    private GitToolHealth probe(String gitVersion) throws InterruptedException {
-        GitCommandRunner runner = command -> new GitCommandResult(
-                0,
-                command.arguments().contains("lfs") ? "git-lfs/3.7.1" : gitVersion,
-                "",
-                false,
-                false);
+    @Test
+    void checksGitAndLfsIndependently() throws Exception {
+        GitToolHealth lfsMissing = probe(command -> command.arguments().contains("lfs")
+                ? new GitCommandResult(1, "", "git: 'lfs' is not a git command", false, false)
+                : new GitCommandResult(0, "git version 2.53.0", "", false, false));
+        AtomicInteger starts = new AtomicInteger();
+        GitToolHealth gitMissing = probe(command -> {
+            starts.incrementAndGet();
+            throw new IOException("Git could not be started");
+        });
+
+        assertTrue(lfsMissing.gitAvailable());
+        assertFalse(lfsMissing.lfsAvailable());
+        assertTrue(lfsMissing.lfsFailure().orElseThrow().contains("not a git command"));
+        assertFalse(gitMissing.gitAvailable());
+        assertFalse(gitMissing.lfsAvailable());
+        assertEquals(2, starts.get(), "LFS is still checked when Git itself cannot start");
+    }
+
+    private static GitCommandRunner versions(String gitVersion) {
+        return command -> new GitCommandResult(
+                0, command.arguments().contains("lfs") ? "git-lfs/3.7.1" : gitVersion, "", false, false);
+    }
+
+    private GitToolHealth probe(GitCommandRunner runner) throws InterruptedException {
         GitBackendSettings settings = new GitBackendSettings(
                 true,
                 temporaryDirectory.resolve("repository.git"),
+                FolderOrigin.DEFAULT,
                 "git",
                 "origin",
                 Optional.empty(),
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitTreeValidatorTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitTreeValidatorTest.java
index 9e1ee63..f2d62f2 100644
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/GitTreeValidatorTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/git/GitTreeValidatorTest.java
@@ -1,52 +1,47 @@
 package dev.ishaanko.worldarchive.storage.git;
 
-import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
+import java.io.ByteArrayInputStream;
+import java.nio.charset.StandardCharsets;
+import java.util.List;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 
+/** A snapshot tree may hold only ordinary files with paths every system can restore. */
 class GitTreeValidatorTest {
     private static final String OBJECT = "0123456789012345678901234567890123456789";
 
     @Test
-    void acceptsOnlyRegularWorldFiles() {
-        String tree = "100644 blob " + OBJECT + "\tlevel.dat\0"
-                + "100755 blob " + OBJECT + "\tdatapacks/tool.sh\0";
+    void acceptsOrdinaryWorldFilesAndTheManifest() throws Exception {
+        List<GitTreeEntry> entries = read("100644 blob " + OBJECT + "\tlevel.dat\0"
+                + "100755 blob " + OBJECT + "\tdatapacks/Ünïcødé pack/tool.sh\0"
+                + "100644 blob " + OBJECT + "\t" + GitTreeValidator.MANIFEST_PATH + "\0");
 
-        assertDoesNotThrow(() -> GitTreeValidator.parse(tree));
+        assertEquals(List.of("level.dat", "datapacks/Ünïcødé pack/tool.sh", GitTreeValidator.MANIFEST_PATH),
+                entries.stream().map(GitTreeEntry::path).toList());
     }
 
-    @Test
-    void rejectsSymbolicLinksAndGitlinks() {
-        assertThrows(GitStorageException.class, () -> GitTreeValidator.parse(
-                "120000 blob " + OBJECT + "\tlinked-world\0"));
-        assertThrows(GitStorageException.class, () -> GitTreeValidator.parse(
-                "160000 commit " + OBJECT + "\tnested-repository\0"));
+    @ParameterizedTest
+    @ValueSource(strings = {
+        "120000 blob " + OBJECT + "\tlinked-world\0",
+        "160000 commit " + OBJECT + "\tnested-repository\0",
+        "100644 blob " + OBJECT + "\tdata/.GIT/config\0",
+        "100644 blob " + OBJECT + "\tCON/world.dat\0",
+        "100644 blob " + OBJECT + "\t.worldarchive.restore.lock\0",
+        "100644 blob " + OBJECT + "\t.WORLDARCHIVE-MANIFEST.JSON\0",
+        "100644 blob " + OBJECT + "\t.WORLDARCHIVE/world.json\0",
+        "100644 blob " + OBJECT + "\tData/first.dat\0100644 blob " + OBJECT + "\tdata/FIRST.dat\0",
+        "100644 blob " + OBJECT + "\tregion\0100644 blob " + OBJECT + "\tRegion/r.0.0.mca\0",
+        "100644 blob " + OBJECT + "\ttruncated"
+    })
+    void rejectsEntriesThatCannotBeRestoredAsOrdinaryFiles(String listing) {
+        assertThrows(GitStorageException.class, () -> read(listing));
     }
 
-    @Test
-    void rejectsEmbeddedGitMetadata() {
-        assertThrows(GitStorageException.class, () -> GitTreeValidator.parse(
-                "100644 blob " + OBJECT + "\tdata/.GIT/config\0"));
-    }
-
-    @Test
-    void rejectsNonPortableAndInternalRestorePaths() {
-        assertThrows(GitStorageException.class, () -> GitTreeValidator.parse(
-                "100644 blob " + OBJECT + "\tCON/world.dat\0"));
-        assertThrows(GitStorageException.class, () -> GitTreeValidator.parse(
-                "100644 blob " + OBJECT + "\t.worldarchive.restore.lock\0"));
-        assertThrows(GitStorageException.class, () -> GitTreeValidator.parse(
-                "100644 blob " + OBJECT + "\t.WORLDARCHIVE-MANIFEST.JSON\0"));
-        assertThrows(GitStorageException.class, () -> GitTreeValidator.parse(
-                "100644 blob " + OBJECT + "\t.WORLDARCHIVE/world.json\0"));
-    }
-
-    @Test
-    void rejectsPathsThatCollideOnCaseInsensitiveFilesystems() {
-        String tree = "100644 blob " + OBJECT + "\tData/first.dat\0"
-                + "100644 blob " + OBJECT + "\tdata/FIRST.dat\0";
-
-        assertThrows(GitStorageException.class, () -> GitTreeValidator.parse(tree));
+    private static List<GitTreeEntry> read(String listing) throws Exception {
+        return GitTreeValidator.read(new ByteArrayInputStream(listing.getBytes(StandardCharsets.UTF_8)));
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/KnownGitToolDirectoriesTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/KnownGitToolDirectoriesTest.java
index 8e54fce..8d0cb0f 100644
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/KnownGitToolDirectoriesTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/git/KnownGitToolDirectoriesTest.java
@@ -1,148 +1,22 @@
 package dev.ishaanko.worldarchive.storage.git;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
 
-import java.nio.file.Files;
+import java.io.File;
 import java.nio.file.Path;
-import java.util.Arrays;
-import java.util.HashMap;
 import java.util.List;
-import java.util.Map;
 import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
 
+/** Package-manager folders extend the child PATH without repeating a folder. */
 class KnownGitToolDirectoriesTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void macCandidatesCoverCommonPackageManagers() {
-        Path home = Path.of("/Users/alice");
-
-        List<Path> candidates = KnownGitToolDirectories.candidateDirectories(
-                "Mac OS X", Map.of(), home);
-
-        assertTrue(candidates.contains(Path.of("/opt/homebrew/bin")));
-        assertTrue(candidates.contains(Path.of("/usr/local/bin")));
-        assertTrue(candidates.contains(Path.of("/opt/local/bin")));
-        assertTrue(candidates.contains(Path.of("/Library/Developer/CommandLineTools/usr/bin")));
-        assertTrue(candidates.contains(home.resolve(".nix-profile/bin")));
-        assertTrue(candidates.contains(home.resolve(".local/bin")));
-    }
-
-    @Test
-    void linuxCandidatesCoverCommonPackageManagers() {
-        Path home = Path.of("/home/alice");
-
-        List<Path> candidates = KnownGitToolDirectories.candidateDirectories(
-                "Linux", Map.of(), home);
-
-        assertTrue(candidates.contains(Path.of("/usr/bin")));
-        assertTrue(candidates.contains(Path.of("/snap/bin")));
-        assertTrue(candidates.contains(Path.of("/home/linuxbrew/.linuxbrew/bin")));
-        assertTrue(candidates.contains(Path.of("/nix/var/nix/profiles/default/bin")));
-        assertTrue(candidates.contains(home.resolve(".local/bin")));
-    }
-
-    @Test
-    void windowsCandidatesUseEnvironmentRootsWithFallbacks() {
-        Path home = Path.of("C:\\Users\\alice");
-        Map<String, String> environment = Map.of(
-                "ProgramFiles", "D:\\Programs",
-                "LOCALAPPDATA", "C:\\Users\\alice\\AppData\\Local",
-                "ChocolateyInstall", "D:\\choco");
-
-        List<Path> candidates = KnownGitToolDirectories.candidateDirectories(
-                "Windows 11", environment, home);
-
-        assertTrue(candidates.contains(Path.of("D:\\Programs\\Git\\cmd")));
-        assertTrue(candidates.contains(Path.of("D:\\Programs\\Git\\mingw64\\bin")));
-        assertTrue(candidates.contains(Path.of("D:\\Programs\\Git LFS")));
-        assertTrue(candidates.contains(Path.of("C:\\Program Files\\Git\\cmd")));
-        assertTrue(candidates.contains(Path.of("C:\\Program Files (x86)\\Git\\cmd")));
-        assertTrue(candidates.contains(Path.of("C:\\Users\\alice\\AppData\\Local\\Programs\\Git\\cmd")));
-        assertTrue(candidates.contains(Path.of("D:\\choco\\bin")));
-        assertTrue(candidates.contains(home.resolve("scoop").resolve("shims")));
-        assertTrue(candidates.contains(Path.of("C:\\ProgramData\\scoop\\shims")));
-    }
-
-    @Test
-    void appendsOnlyExistingDirectoriesAfterTheCurrentPath() throws Exception {
-        Path localBin = Files.createDirectories(temporaryDirectory.resolve(".local").resolve("bin"));
-        Map<String, String> environment = new HashMap<>();
-        environment.put("PATH", "/usr/bin");
-
-        KnownGitToolDirectories.augment(
-                environment,
-                "Linux",
-                temporaryDirectory,
-                path -> path.equals(localBin));
-
-        List<String> entries = Arrays.asList(environment.get("PATH").split(":"));
-        assertEquals("/usr/bin", entries.get(0));
-        assertTrue(entries.contains(localBin.toString()));
-        assertEquals(2, entries.size());
-    }
-
-    @Test
-    void neverDuplicatesEntriesAlreadyOnThePath() {
-        Map<String, String> environment = new HashMap<>();
-        environment.put("PATH", "/opt/homebrew/bin:/usr/bin/");
-
-        KnownGitToolDirectories.augment(
-                environment,
-                "Mac OS X",
-                Path.of("/Users/alice"),
-                path -> path.equals(Path.of("/opt/homebrew/bin"))
-                        || path.equals(Path.of("/usr/bin")));
-
-        List<String> entries = Arrays.asList(environment.get("PATH").split(":"));
-        assertEquals(List.of("/opt/homebrew/bin", "/usr/bin/"), entries);
-    }
-
-    @Test
-    void windowsPathComparisonIsCaseInsensitiveAndKeepsTheExistingKey() {
-        Map<String, String> environment = new HashMap<>();
-        environment.put("Path", "c:\\program files\\git\\cmd");
-        environment.put("ProgramFiles", "C:\\Program Files");
-
-        KnownGitToolDirectories.augment(
-                environment,
-                "Windows 11",
-                Path.of("C:\\Users\\alice"),
-                path -> path.equals(Path.of("C:\\Program Files\\Git\\cmd"))
-                        || path.equals(Path.of("C:\\Program Files\\Git LFS")));
-
-        assertFalse(environment.containsKey("PATH"));
-        List<String> entries = Arrays.asList(environment.get("Path").split(";"));
-        assertEquals(2, entries.size());
-        assertEquals("c:\\program files\\git\\cmd", entries.get(0));
-        assertEquals(Path.of("C:\\Program Files\\Git LFS").toString(), entries.get(1));
-    }
-
-    @Test
-    void createsThePathVariableWhenTheEnvironmentHasNone() {
-        Map<String, String> environment = new HashMap<>();
-
-        KnownGitToolDirectories.augment(
-                environment,
-                "Linux",
-                Path.of("/home/alice"),
-                path -> path.equals(Path.of("/usr/bin")));
-
-        assertEquals("/usr/bin", environment.get("PATH"));
-    }
-
     @Test
-    void ignoresUnparsableWindowsEnvironmentValues() {
-        Map<String, String> environment = new HashMap<>();
-        environment.put("ProgramFiles", "C:\\Program Files\u0000broken");
+    void appendsPackageManagerFoldersAfterThePathWithoutRepeatingAny() {
+        String separator = File.pathSeparator;
+        String path = String.join(separator, "/usr/bin", "/opt/homebrew/bin", "", "/bin");
 
-        List<Path> candidates = KnownGitToolDirectories.candidateDirectories(
-                "Windows 11", environment, Path.of("C:\\Users\\alice"));
+        String extended = KnownGitToolDirectories.appendFolders(
+                path, List.of(Path.of("/opt/homebrew/bin"), Path.of("/opt/local/bin")));
 
-        assertTrue(candidates.contains(Path.of("C:\\Program Files\\Git\\cmd")));
+        assertEquals(String.join(separator, "/usr/bin", "/opt/homebrew/bin", "/bin", "/opt/local/bin"), extended);
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/NativeProcessFixture.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/NativeProcessFixture.java
index 4208aa9..902668d 100644
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/NativeProcessFixture.java
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/git/NativeProcessFixture.java
@@ -4,7 +4,7 @@
 import java.nio.file.Path;
 import java.util.List;
 
-/** Separate JVM fixture for process timeout and bounded-output tests. */
+/** A separate JVM that the runner tests start in place of Git. */
 public final class NativeProcessFixture {
     private NativeProcessFixture() {
     }
@@ -14,11 +14,32 @@ public static void main(String[] arguments) throws Exception {
             case "output" -> System.out.print(arguments[1].repeat(Integer.parseInt(arguments[2])));
             case "environment" -> System.out.print(System.getenv(arguments[1]));
             case "sleep" -> Thread.sleep(Long.parseLong(arguments[1]));
+            case "ticks" -> ticks(Integer.parseInt(arguments[1]), Long.parseLong(arguments[2]));
+            case "fail" -> fail(arguments[1], arguments[2]);
             case "spawn-inherited" -> spawnInherited(arguments);
             default -> throw new IllegalArgumentException("Unknown fixture operation");
         }
     }
 
+    /** Prints one dot per interval, like Git's progress output during a long transfer. */
+    private static void ticks(int count, long intervalMillis) throws InterruptedException {
+        for (int tick = 0; tick < count; tick++) {
+            System.err.print('.');
+            System.err.flush();
+            Thread.sleep(intervalMillis);
+        }
+    }
+
+    /** Writes some output, then an error, and exits the way Git does after a fatal error. */
+    private static void fail(String output, String error) {
+        System.out.print(output);
+        System.out.flush();
+        System.err.print(error);
+        System.err.flush();
+        System.exit(128);
+    }
+
+    /** Starts a sleeping child that shares this process's output, then sleeps itself. */
     private static void spawnInherited(String[] arguments) throws Exception {
         Path java = Path.of(System.getProperty("java.home"), "bin", isWindows() ? "java.exe" : "java");
         Process child = new ProcessBuilder(List.of(
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/SystemCredentialHelpersTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/SystemCredentialHelpersTest.java
deleted file mode 100644
index 812c88f..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/SystemCredentialHelpersTest.java
+++ /dev/null
@@ -1,33 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-
-import java.util.List;
-import org.junit.jupiter.api.Test;
-
-class SystemCredentialHelpersTest {
-    @Test
-    void parsesConfiguredHelpersLineByLine() {
-        assertEquals(
-                List.of("osxkeychain", "!custom-helper"),
-                SystemCredentialHelpers.parse(0, "osxkeychain\n!custom-helper\n"));
-        assertEquals(
-                List.of("manager"),
-                SystemCredentialHelpers.parse(0, "manager\r\n"));
-    }
-
-    @Test
-    void missingConfigurationYieldsNoHelpers() {
-        assertEquals(List.of(), SystemCredentialHelpers.parse(1, ""));
-        assertEquals(List.of(), SystemCredentialHelpers.parse(0, " \n\n"));
-        assertEquals(List.of(), SystemCredentialHelpers.parse(128, "osxkeychain"));
-    }
-
-    @Test
-    void platformDefaultsCoverStockGitInstallations() {
-        assertEquals(List.of("osxkeychain"), SystemCredentialHelpers.platformDefault("Mac OS X"));
-        assertEquals(List.of("osxkeychain"), SystemCredentialHelpers.platformDefault("Darwin"));
-        assertEquals(List.of("manager"), SystemCredentialHelpers.platformDefault("Windows 11"));
-        assertEquals(List.of(), SystemCredentialHelpers.platformDefault("Linux"));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/SystemGitCommandRunnerTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/SystemGitCommandRunnerTest.java
index 80efc39..48052a8 100644
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/SystemGitCommandRunnerTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/git/SystemGitCommandRunnerTest.java
@@ -2,436 +2,148 @@
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.io.IOException;
-import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.time.Duration;
 import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.HexFormat;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
-import java.util.Set;
-import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.atomic.AtomicReference;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
+/** How the runner starts, feeds, limits, reads and stops real processes. */
 class SystemGitCommandRunnerTest {
-    @Test
-    void removesUnsafeInheritedGitEnvironment() {
-        Map<String, String> environment = new HashMap<>();
-        environment.put("PATH", "/safe/path");
-        environment.put("GIT_DIR", "/redirected/repository");
-        environment.put("GIT_WORK_TREE", "/redirected/tree");
-        environment.put("GIT_SSH_COMMAND", "unsafe-command");
-        environment.put("GIT_CONFIG_COUNT", "1");
-        environment.put("GIT_CONFIG_KEY_0", "core.sshCommand");
-        environment.put("GIT_CONFIG_VALUE_0", "unsafe-command");
-        environment.put("GIT_CONFIG_PARAMETERS", "core.sshCommand=unsafe-command");
-        environment.put("GIT_PROXY_COMMAND", "unsafe-command");
-        environment.put("GIT_TRACE", "/untrusted/trace");
-        environment.put("git_unknown_future_setting", "unsafe");
-
-        SystemGitCommandRunner.removeUnsafeGitEnvironment(environment);
-
-        assertEquals("/safe/path", environment.get("PATH"));
-        assertFalse(environment.containsKey("GIT_DIR"));
-        assertFalse(environment.containsKey("GIT_WORK_TREE"));
-        assertFalse(environment.containsKey("GIT_SSH_COMMAND"));
-        assertFalse(environment.containsKey("GIT_CONFIG_COUNT"));
-        assertFalse(environment.containsKey("GIT_CONFIG_KEY_0"));
-        assertFalse(environment.containsKey("GIT_CONFIG_VALUE_0"));
-        assertFalse(environment.containsKey("GIT_CONFIG_PARAMETERS"));
-        assertFalse(environment.containsKey("GIT_PROXY_COMMAND"));
-        assertFalse(environment.containsKey("GIT_TRACE"));
-        assertFalse(environment.containsKey("git_unknown_future_setting"));
-        assertEquals("1", environment.get("GIT_CONFIG_NOSYSTEM"));
-        assertEquals("1", environment.get("GIT_ATTR_NOSYSTEM"));
-    }
-
     @TempDir
     Path temporaryDirectory;
 
-    @Test
-    void boundsAndRedactsProcessOutput() throws Exception {
-        String secret = "https://alice:hunter2@example.invalid/repository?token=visible";
-        GitCommand command = command(List.of("output", secret, "200"), Duration.ofSeconds(10), 1_024, Set.of(secret));
-
-        GitCommandResult result = new SystemGitCommandRunner().run(command);
-
-        assertTrue(result.successful());
-        assertTrue(result.standardOutputTruncated());
-        assertTrue(result.standardOutput().length() <= 1_024);
-        assertFalse(result.standardOutput().contains("hunter2"));
-        assertFalse(result.standardOutput().contains("visible"));
-        byte[] completeOutput = secret.repeat(200).getBytes(StandardCharsets.UTF_8);
-        assertEquals(completeOutput.length, result.standardOutputBytes());
-        assertEquals(
-                HexFormat.of().formatHex(GitInventory.sha256().digest(completeOutput)),
-                result.standardOutputSha256());
-    }
-
-    @Test
-    void standardOutputKeepsParsedDataThatOnlyLooksLikeASecret() {
-        String manifest = "{ \"worldName\": \"Secret: Base\", \"contentSha256\": \"ab\" }";
-
-        assertEquals(manifest, SystemGitCommandRunner.redactSecrets(manifest, Set.of()));
-        assertEquals("[REDACTED] data", SystemGitCommandRunner.redactSecrets("hunter2 data", Set.of("hunter2")));
-        assertFalse(SystemGitCommandRunner.redact(manifest, Set.of()).contains("Base"));
-    }
-
-    @Test
-    void redactsAuthorizationHeadersKnownTokensJwtAndNamedCredentials() {
-        String github = "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ123456";
-        String jwt = "eyJabcdefghijk.abcdefghijklmnop.abcdefghijklmnop";
-        String output = "Authorization: Bearer ABCDEFGHIJKLMNOP "
-                + github + " " + jwt + " api_key=visible credential=visible refresh_token=visible";
-
-        String redacted = SystemGitCommandRunner.redact(output, Set.of());
-
-        assertFalse(redacted.contains("ABCDEFGHIJKLMNOP"));
-        assertFalse(redacted.contains(github));
-        assertFalse(redacted.contains(jwt));
-        assertFalse(redacted.contains("=visible"));
-    }
+    private final SystemGitCommandRunner runner = new SystemGitCommandRunner();
 
     @Test
-    void terminatesAProcessAtItsDeadline() {
-        GitCommand command = command(List.of("sleep", "10000"), Duration.ofMillis(100), 1_024, Set.of());
-
-        assertThrows(GitCommandTimeoutException.class, () -> new SystemGitCommandRunner().run(command));
-    }
-
-    @Test
-    void timeoutIncludesBlockedStandardInputWrite() {
-        GitCommand base = command(List.of("sleep", "10000"), Duration.ofMillis(100), 1_024, Set.of());
-        GitCommand command = new GitCommand(
-                base.arguments(),
-                base.workingDirectory(),
-                base.environment(),
-                new byte[2_000_000],
-                base.secrets(),
-                base.timeout(),
-                base.maximumOutputBytes());
+    void aSilentCommandStopsAtItsIdleLimitWhileOneThatReportsProgressRuns() throws Exception {
+        Duration idle = Duration.ofMillis(600);
+        GitCommand silent = command(List.of("sleep", "20000"), Optional.of(idle), GitCommand.Input.NONE);
+        GitCommand notReading = command(List.of("sleep", "20000"), Optional.of(idle), GitCommand.Input.of(new byte[4_000_000]));
+        GitCommand reporting = command(List.of("ticks", "8", "250"), Optional.of(idle), GitCommand.Input.NONE);
         long started = System.nanoTime();
 
-        assertThrows(GitCommandTimeoutException.class, () -> new SystemGitCommandRunner().run(command));
-
-        assertTrue(Duration.ofNanos(System.nanoTime() - started).compareTo(Duration.ofSeconds(3)) < 0);
+        assertThrows(GitCommandTimeoutException.class, () -> runner.run(silent));
+        assertThrows(GitCommandTimeoutException.class, () -> runner.run(notReading));
+        assertTrue(Duration.ofNanos(System.nanoTime() - started).compareTo(Duration.ofSeconds(8)) < 0);
+        assertTrue(runner.run(reporting).successful(), "two seconds of progress outlast a 0.6 second idle limit");
     }
 
     @Test
-    void mandatoryNonInteractiveEnvironmentCannotBeOverridden() throws Exception {
-        GitCommand base = command(
-                List.of("environment", "GIT_TERMINAL_PROMPT"),
-                Duration.ofSeconds(10),
-                1_024,
-                Set.of());
-        GitCommand command = new GitCommand(
-                base.arguments(),
-                base.workingDirectory(),
-                Map.of("GIT_TERMINAL_PROMPT", "1"),
-                base.standardInput(),
-                base.secrets(),
-                base.timeout(),
-                base.maximumOutputBytes());
-
-        GitCommandResult result = new SystemGitCommandRunner().run(command);
-
-        assertTrue(result.successful());
-        assertEquals("0", result.standardOutput());
-    }
-
-    @Test
-    void keepsRequiredCommandScopedGitEnvironment() throws Exception {
-        Path index = temporaryDirectory.resolve("index");
-        Map<String, String> environment = Map.of(
-                "GIT_INDEX_FILE", index.toString(),
-                "GIT_LFS_SKIP_SMUDGE", "1");
-
-        assertEquals(
-                index.toString(),
-                runEnvironmentCommand("GIT_INDEX_FILE", environment));
-        assertEquals(
-                "1",
-                runEnvironmentCommand("GIT_LFS_SKIP_SMUDGE", environment));
-    }
-
-    @Test
-    void rejectsCommandScopedGitInjectionAndKeepsConfigIsolation() throws Exception {
-        Map<String, String> environment = Map.of(
-                "GIT_ATTR_NOSYSTEM", "0",
-                "GIT_CONFIG_GLOBAL", "/unsafe/global-config",
-                "GIT_CONFIG_NOSYSTEM", "0",
-                "GIT_CONFIG_PARAMETERS", "core.sshCommand=unsafe-command",
-                "GIT_PROXY_COMMAND", "unsafe-command");
-
-        assertEquals(
-                "1",
-                runEnvironmentCommand("GIT_ATTR_NOSYSTEM", environment));
-        assertEquals(
-                "null",
-                runEnvironmentCommand("GIT_CONFIG_GLOBAL", environment));
-        assertEquals(
-                "1",
-                runEnvironmentCommand("GIT_CONFIG_NOSYSTEM", environment));
-        assertEquals(
-                "null",
-                runEnvironmentCommand("GIT_CONFIG_PARAMETERS", environment));
-        assertEquals(
-                "null",
-                runEnvironmentCommand("GIT_PROXY_COMMAND", environment));
-    }
-
-    @Test
-    void injectsSystemCredentialHelpersForNetworkCommands() throws Exception {
-        GitCommand command = command(
-                List.of("environment", "GIT_CONFIG_VALUE_0", "push"),
-                Duration.ofSeconds(10),
-                1_024,
-                Set.of());
-        SystemGitCommandRunner runner = new SystemGitCommandRunner(
-                (executable, environment) -> List.of("osxkeychain"));
-
-        GitCommandResult result = runner.run(command);
-
-        assertTrue(result.successful());
-        assertEquals("osxkeychain", result.standardOutput());
-    }
-
-    @Test
-    void countsEveryInjectedCredentialHelper() throws Exception {
-        GitCommand command = command(
-                List.of("environment", "GIT_CONFIG_COUNT", "fetch"),
-                Duration.ofSeconds(10),
-                1_024,
-                Set.of());
-        SystemGitCommandRunner runner = new SystemGitCommandRunner(
-                (executable, environment) -> List.of("osxkeychain", "!custom-helper"));
-
-        GitCommandResult result = runner.run(command);
-
-        assertTrue(result.successful());
-        assertEquals("2", result.standardOutput());
-    }
-
-    @Test
-    void localCommandsNeverResolveCredentialHelpers() throws Exception {
-        AtomicInteger resolutions = new AtomicInteger();
-        SystemGitCommandRunner runner = new SystemGitCommandRunner((executable, environment) -> {
-            resolutions.incrementAndGet();
-            return List.of("osxkeychain");
-        });
-        GitCommand command = command(
-                List.of("environment", "GIT_CONFIG_COUNT"),
-                Duration.ofSeconds(10),
-                1_024,
-                Set.of());
-
-        GitCommandResult result = runner.run(command);
-
-        assertTrue(result.successful());
-        assertEquals("null", result.standardOutput());
-        assertEquals(0, resolutions.get());
-    }
-
-    @Test
-    void networkCommandsWithoutHelpersStayUnconfigured() throws Exception {
+    void interruptionStopsTheCommandAndTheProcessesItStarted() throws Exception {
+        Path childPid = temporaryDirectory.resolve("child.pid");
         GitCommand command = command(
-                List.of("environment", "GIT_CONFIG_COUNT", "push"),
-                Duration.ofSeconds(10),
-                1_024,
-                Set.of());
-        SystemGitCommandRunner runner = new SystemGitCommandRunner(
-                (executable, environment) -> List.of());
-
-        GitCommandResult result = runner.run(command);
-
-        assertTrue(result.successful());
-        assertEquals("null", result.standardOutput());
-    }
-
-    @Test
-    void interruptionCancelsTheNativeProcess() throws Exception {
-        GitCommand command = command(List.of("sleep", "10000"), Duration.ofSeconds(30), 1_024, Set.of());
+                List.of("spawn-inherited", childPid.toString(), "20000", "20000"), Optional.empty(), GitCommand.Input.NONE);
         AtomicReference<Throwable> failure = new AtomicReference<>();
         Thread worker = Thread.ofPlatform().start(() -> {
             try {
-                new SystemGitCommandRunner().run(command);
+                runner.run(command);
             } catch (Throwable throwable) {
                 failure.set(throwable);
             }
         });
+        waitFor(childPid);
 
-        Thread.sleep(200L);
         worker.interrupt();
-        worker.join(5_000L);
+        worker.join(5_000);
 
         assertFalse(worker.isAlive());
-        assertTrue(failure.get() instanceof InterruptedException);
+        assertInstanceOf(InterruptedException.class, failure.get());
+        assertEventuallyDead(Long.parseLong(Files.readString(childPid)));
     }
 
     @Test
-    void timeoutKillsAChildHoldingInheritedOutputOpen() throws Exception {
-        Path childPid = temporaryDirectory.resolve("child.pid");
+    void aProcessThatKeepsTheOutputOpenNeverHoldsBackAFinishedCommand() throws Exception {
+        Path childPid = temporaryDirectory.resolve("orphan.pid");
         GitCommand command = command(
-                List.of("spawn-inherited", childPid.toString(), "10000", "100"),
-                Duration.ofSeconds(2),
-                1_024,
-                Set.of());
+                List.of("spawn-inherited", childPid.toString(), "20000", "10"), Optional.empty(), GitCommand.Input.NONE);
         long started = System.nanoTime();
-
-        assertThrows(GitCommandTimeoutException.class, () -> new SystemGitCommandRunner().run(command));
-
-        assertTrue(Duration.ofNanos(System.nanoTime() - started).compareTo(Duration.ofSeconds(5)) < 0);
-        long pid = Long.parseLong(Files.readString(childPid));
-        for (int attempt = 0; attempt < 20
-                && ProcessHandle.of(pid).map(ProcessHandle::isAlive).orElse(false); attempt++) {
-            Thread.sleep(25L);
-        }
-        assertFalse(ProcessHandle.of(pid).map(ProcessHandle::isAlive).orElse(false));
-    }
-
-    @Test
-    void timeoutTracksAChildWhoseParentExitsQuickly() throws Exception {
-        Path childPid = temporaryDirectory.resolve("quick-child.pid");
-        GitCommand command = command(
-                List.of("spawn-inherited", childPid.toString(), "10000", "10"),
-                Duration.ofSeconds(2),
-                1_024,
-                Set.of());
-
-        assertThrows(GitCommandTimeoutException.class, () -> new SystemGitCommandRunner().run(command));
-
-        long pid = Long.parseLong(Files.readString(childPid));
-        for (int attempt = 0; attempt < 20
-                && ProcessHandle.of(pid).map(ProcessHandle::isAlive).orElse(false); attempt++) {
-            Thread.sleep(25L);
+        try {
+            assertTrue(runner.run(command).successful());
+            assertTrue(Duration.ofNanos(System.nanoTime() - started).compareTo(Duration.ofSeconds(10)) < 0);
+        } finally {
+            ProcessHandle.of(Long.parseLong(Files.readString(childPid))).ifPresent(ProcessHandle::destroyForcibly);
         }
-        assertFalse(ProcessHandle.of(pid).map(ProcessHandle::isAlive).orElse(false));
     }
 
     @Test
-    void settingsRejectCredentialBearingRemotes() {
-        assertThrows(IllegalArgumentException.class, () -> new GitBackendSettings(
-                true,
-                temporaryDirectory.resolve("repository.git"),
-                "git",
-                "origin",
-                Optional.of("https://alice:secret@example.invalid/repository.git"),
-                GitBackendSettings.DEFAULT_LFS_PATTERNS,
-                Duration.ofSeconds(5),
-                4_096));
-        assertThrows(IllegalArgumentException.class, () -> new GitBackendSettings(
-                true,
-                temporaryDirectory.resolve("repository.git"),
-                "git",
-                "origin",
-                Optional.of("https://example.invalid/repository.git%3Ftoken%3Dsecret"),
-                GitBackendSettings.DEFAULT_LFS_PATTERNS,
-                Duration.ofSeconds(5),
-                4_096));
+    void commandsNeverPromptAndSetOnlyWorldArchivesOwnGitVariables() throws Exception {
+        assertEquals("0", environment("GIT_TERMINAL_PROMPT", Map.of()));
+        assertEquals("Never", environment("GCM_INTERACTIVE", Map.of()));
+        assertEquals("1", environment("GIT_LFS_FORCE_PROGRESS", Map.of("GIT_LFS_FORCE_PROGRESS", "1")));
+        assertThrows(IllegalArgumentException.class, () -> environment("GIT_DIR", Map.of("GIT_DIR", "/elsewhere")));
+        assertThrows(IllegalArgumentException.class,
+                () -> environment("GIT_TERMINAL_PROMPT", Map.of("GIT_TERMINAL_PROMPT", "1")));
     }
 
     @Test
-    void probesGitAndLfsIndependently() throws Exception {
-        List<List<String>> invocations = new ArrayList<>();
-        AtomicInteger call = new AtomicInteger();
-        GitCommandRunner fakeRunner = command -> {
-            invocations.add(command.arguments());
-            if (call.getAndIncrement() == 0) {
-                return new GitCommandResult(0, "git version 2.50.1", "", false, false);
-            }
-            return new GitCommandResult(1, "", "git: lfs unavailable", false, false);
-        };
-        GitBackendSettings settings = settings("git");
+    void outputPastTheLimitIsCutAndFlagged() throws Exception {
+        GitCommand command = new GitCommand(fixture(List.of("output", "abc", "2000")), temporaryDirectory, Map.of(),
+                GitCommand.Input.NONE, Optional.empty(), 1_024);
 
-        GitToolHealth health = new GitToolProbe(settings, fakeRunner).probe();
+        GitCommandResult result = runner.run(command);
 
-        assertTrue(health.gitAvailable());
-        assertFalse(health.lfsAvailable());
-        assertFalse(health.available());
-        assertEquals(2, invocations.size());
-        assertEquals(List.of("git", "--version"), invocations.get(0));
-        assertEquals(List.of("git", "lfs", "version"), invocations.get(1));
+        assertTrue(result.successful());
+        assertTrue(result.standardOutputTruncated());
+        assertEquals(1_024, result.standardOutput().length());
     }
 
     @Test
-    void stillProbesLfsWhenGitExecutableCannotStart() throws Exception {
-        AtomicInteger invocations = new AtomicInteger();
-        GitCommandRunner fakeRunner = command -> {
-            invocations.incrementAndGet();
-            throw new IOException("missing");
-        };
-
-        GitToolHealth health = new GitToolProbe(settings("missing-git"), fakeRunner).probe();
+    void whenGitFailsWhileItsOutputIsReadGitsOwnErrorIsReported() {
+        GitCommand command = command(
+                List.of("fail", "partial", "fatal: loose object 1234 is corrupt"), Optional.empty(), GitCommand.Input.NONE);
 
-        assertFalse(health.available());
-        assertEquals(2, invocations.get());
-    }
+        GitStorageException failure = assertThrows(GitStorageException.class, () -> runner.stream(command, output -> {
+            output.readAllBytes();
+            throw new GitStorageException("Git returned incomplete object data");
+        }));
 
-    private GitCommand command(
-            List<String> fixtureArguments,
-            Duration timeout,
-            int outputLimit,
-            Set<String> secrets) {
-        Path java = Path.of(System.getProperty("java.home"), "bin", isWindows() ? "java.exe" : "java");
-        List<String> arguments = new ArrayList<>();
-        arguments.add(java.toString());
-        arguments.add("-cp");
-        arguments.add(System.getProperty("java.class.path"));
-        arguments.add(NativeProcessFixture.class.getName());
-        arguments.addAll(fixtureArguments);
-        return new GitCommand(
-                arguments,
-                temporaryDirectory,
-                Map.of(),
-                new byte[0],
-                secrets,
-                timeout,
-                outputLimit);
+        assertTrue(failure.getMessage().contains("loose object 1234 is corrupt"), failure.getMessage());
     }
 
-    private String runEnvironmentCommand(
-            String name,
-            Map<String, String> environment) throws Exception {
-        GitCommand base = command(
-                List.of("environment", name),
-                Duration.ofSeconds(10),
-                1_024,
-                Set.of());
-        GitCommand command = new GitCommand(
-                base.arguments(),
-                base.workingDirectory(),
-                environment,
-                base.standardInput(),
-                base.secrets(),
-                base.timeout(),
-                base.maximumOutputBytes());
-        GitCommandResult result = new SystemGitCommandRunner().run(command);
+    private String environment(String name, Map<String, String> environment) throws IOException, InterruptedException {
+        GitCommand command = new GitCommand(fixture(List.of("environment", name)), temporaryDirectory, environment,
+                GitCommand.Input.NONE, Optional.empty(), 1_024);
+        GitCommandResult result = runner.run(command);
         assertTrue(result.successful());
         return result.standardOutput();
     }
 
-    private GitBackendSettings settings(String executable) {
-        return new GitBackendSettings(
-                true,
-                temporaryDirectory.resolve("repository.git"),
-                executable,
-                "origin",
-                Optional.empty(),
-                GitBackendSettings.DEFAULT_LFS_PATTERNS,
-                Duration.ofSeconds(5),
-                4_096);
+    private GitCommand command(List<String> fixtureArguments, Optional<Duration> idleLimit, GitCommand.Input input) {
+        return new GitCommand(fixture(fixtureArguments), temporaryDirectory, Map.of(), input, idleLimit, 4_096);
+    }
+
+    private static List<String> fixture(List<String> fixtureArguments) {
+        String program = System.getProperty("os.name").startsWith("Windows") ? "java.exe" : "java";
+        List<String> arguments = new ArrayList<>(List.of(
+                Path.of(System.getProperty("java.home"), "bin", program).toString(),
+                "-cp",
+                System.getProperty("java.class.path"),
+                NativeProcessFixture.class.getName()));
+        arguments.addAll(fixtureArguments);
+        return arguments;
+    }
+
+    private static void waitFor(Path file) throws Exception {
+        for (int attempt = 0; attempt < 200 && (!Files.exists(file) || Files.size(file) == 0); attempt++) {
+            Thread.sleep(25);
+        }
     }
 
-    private static boolean isWindows() {
-        return System.getProperty("os.name").startsWith("Windows");
+    private static void assertEventuallyDead(long pid) throws InterruptedException {
+        for (int attempt = 0; attempt < 80 && ProcessHandle.of(pid).map(ProcessHandle::isAlive).orElse(false); attempt++) {
+            Thread.sleep(25);
+        }
+        assertFalse(ProcessHandle.of(pid).map(ProcessHandle::isAlive).orElse(false));
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/WorldGitSnapshotStoreIntegrationTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/WorldGitSnapshotStoreIntegrationTest.java
deleted file mode 100644
index b9a5a7d..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/git/WorldGitSnapshotStoreIntegrationTest.java
+++ /dev/null
@@ -1,837 +0,0 @@
-package dev.ishaanko.worldarchive.storage.git;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertInstanceOf;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.core.AsyncTasks;
-import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationStatus;
-import dev.ishaanko.worldarchive.model.SyncStatus;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.time.Duration;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.CompletionStage;
-import java.util.concurrent.ExecutionException;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.function.Function;
-import java.util.stream.Collectors;
-import java.util.stream.Stream;
-import org.junit.jupiter.api.Assumptions;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-class WorldGitSnapshotStoreIntegrationTest {
-    private static final Duration TEST_TIMEOUT = Duration.ofSeconds(30);
-
-    @TempDir
-    Path temporaryDirectory;
-
-    @BeforeEach
-    void requireNativeGitAndLfs() throws Exception {
-        GitBackendSettings probeSettings = settings(
-                temporaryDirectory.resolve("probe-root"),
-                Optional.empty());
-        GitToolHealth health = new GitToolProbe(probeSettings, new SystemGitCommandRunner()).probe();
-        Assumptions.assumeTrue(health.available(), health.summary());
-    }
-
-    @Test
-    void createBackupReturnsAnInterruptibleWriteSoCancellationKeepsItsOutcome() throws Exception {
-        WorldId worldId = WorldId.create();
-        Path world = world("interruptible-world", "contents");
-        try (WorldGitSnapshotStore store = new WorldGitSnapshotStore(
-                settings(temporaryDirectory.resolve("repositories-interruptible"), Optional.empty()))) {
-            CompletionStage<DestinationResult> write = store.createBackup(
-                    capture(world, worldId, BackupId.create(), Instant.now()),
-                    ProgressListener.NO_OP);
-
-            // The coordinator stops a cancelled write through this future type; a composed
-            // stage would be cancelled outright and lose a snapshot published before the push.
-            assertInstanceOf(AsyncTasks.InterruptibleFuture.class, write);
-            assertEquals(DestinationStatus.SUCCESS, await(write).status());
-        }
-    }
-
-    @Test
-    void snapshotsFilesThatAGitignoreInsideTheWorldWouldExclude() throws Exception {
-        Path repositoryRoot = temporaryDirectory.resolve("repositories");
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        Path world = world("ignored-world", "level");
-        Path datapack = Files.createDirectories(world.resolve("datapacks/pack"));
-        Files.writeString(world.resolve(".gitignore"), "level.dat\n", StandardCharsets.UTF_8);
-        Files.writeString(datapack.resolve(".gitignore"), "*.txt\n", StandardCharsets.UTF_8);
-        Files.writeString(datapack.resolve("notes.txt"), "kept", StandardCharsets.UTF_8);
-
-        try (WorldGitSnapshotStore store = new WorldGitSnapshotStore(
-                settings(repositoryRoot, Optional.empty()))) {
-            assertEquals(DestinationStatus.SUCCESS, await(store.createBackup(
-                    capture(world, worldId, backupId, Instant.now()),
-                    ProgressListener.NO_OP)).status());
-            List<String> tree = nativeGit(
-                    "--git-dir=" + store.repositoryFor(worldId),
-                    "ls-tree",
-                    "-r",
-                    "--name-only",
-                    GitSnapshot.refName(worldId, backupId)).lines().toList();
-            assertTrue(tree.contains("level.dat"));
-            assertTrue(tree.contains("datapacks/pack/notes.txt"));
-            assertTrue(tree.contains(".gitignore"));
-        }
-    }
-
-    @Test
-    void isolatesWorldRepositoriesAndCreatesParentlessSnapshots() throws Exception {
-        Path repositoryRoot = temporaryDirectory.resolve("repositories");
-        WorldId firstWorldId = WorldId.create();
-        WorldId secondWorldId = WorldId.create();
-        Path firstWorld = world("first-world", "first");
-        Path secondWorld = world("second-world", "other");
-        BackupId firstBackupId = BackupId.create();
-        BackupId secondBackupId = BackupId.create();
-        BackupId otherBackupId = BackupId.create();
-        Path firstRepository = repositoryRoot.resolve(firstWorldId + ".git");
-        Files.createDirectories(repositoryRoot);
-        nativeGit(
-                "init",
-                "--bare",
-                "--initial-branch=old-isolated-head",
-                firstRepository.toString());
-
-        try (WorldGitSnapshotStore store = new WorldGitSnapshotStore(
-                settings(repositoryRoot, Optional.empty()))) {
-            assertEquals(DestinationStatus.SUCCESS, await(store.createBackup(
-                    capture(firstWorld, firstWorldId, firstBackupId, Instant.now().minusSeconds(2)),
-                    ProgressListener.NO_OP)).status());
-            Files.writeString(firstWorld.resolve("level.dat"), "second");
-            assertEquals(DestinationStatus.SUCCESS, await(store.createBackup(
-                    capture(firstWorld, firstWorldId, secondBackupId, Instant.now().minusSeconds(1)),
-                    ProgressListener.NO_OP)).status());
-            assertEquals(DestinationStatus.SUCCESS, await(store.createBackup(
-                    capture(secondWorld, secondWorldId, otherBackupId, Instant.now()),
-                    ProgressListener.NO_OP)).status());
-
-            assertEquals(firstRepository, store.repositoryFor(firstWorldId));
-            Path secondRepository = store.repositoryFor(secondWorldId);
-            assertTrue(Files.isDirectory(firstRepository));
-            assertTrue(Files.isDirectory(secondRepository));
-            assertEquals("true", nativeGit(
-                    "--git-dir=" + firstRepository,
-                    "rev-parse",
-                    "--is-bare-repository").trim());
-            assertEquals("true", nativeGit(
-                    "--git-dir=" + secondRepository,
-                    "rev-parse",
-                    "--is-bare-repository").trim());
-            assertEquals("refs/heads/main", nativeGit(
-                    "--git-dir=" + firstRepository,
-                    "symbolic-ref",
-                    "HEAD").trim());
-            assertEquals("refs/heads/main", nativeGit(
-                    "--git-dir=" + secondRepository,
-                    "symbolic-ref",
-                    "HEAD").trim());
-
-            Map<BackupId, GitSnapshot> firstSnapshots = await(store.listSnapshots(
-                            Optional.of(firstWorldId))).stream()
-                    .collect(Collectors.toMap(GitSnapshot::backupId, Function.identity()));
-            assertEquals(SetView.of(firstBackupId, secondBackupId), SetView.of(firstSnapshots.keySet()));
-            assertEquals(List.of(otherBackupId), await(store.listSnapshots(
-                            Optional.of(secondWorldId))).stream()
-                    .map(GitSnapshot::backupId)
-                    .toList());
-
-            String firstCommit = firstSnapshots.get(firstBackupId).commitId();
-            String secondCommit = firstSnapshots.get(secondBackupId).commitId();
-            assertEquals(firstCommit, nativeGit(
-                    "--git-dir=" + firstRepository,
-                    "rev-list",
-                    "--parents",
-                    "--max-count=1",
-                    firstCommit).trim());
-            assertEquals(secondCommit, nativeGit(
-                    "--git-dir=" + firstRepository,
-                    "rev-list",
-                    "--parents",
-                    "--max-count=1",
-                    secondCommit).trim());
-            assertTrue(remoteRef(firstRepository, "refs/heads/main").isEmpty());
-            assertTrue(nativeGit(
-                    "--git-dir=" + firstRepository,
-                    "for-each-ref",
-                    "--format=%(refname)",
-                    GitSnapshot.refName(secondWorldId, otherBackupId)).isBlank());
-            assertTrue(await(store.verifySnapshot(firstWorldId, secondBackupId)).valid());
-            assertTrue(await(store.verifySnapshot(secondWorldId, otherBackupId)).valid());
-        }
-    }
-
-    @Test
-    void deletedNewSnapshotCannotBeRebuiltOrReachedFromNewerSnapshot() throws Exception {
-        Path repositoryRoot = temporaryDirectory.resolve("deletion-repositories");
-        WorldId worldId = WorldId.create();
-        BackupId firstBackupId = BackupId.create();
-        BackupId secondBackupId = BackupId.create();
-        Path world = world("deletion-world", "first");
-
-        try (WorldGitSnapshotStore store = new WorldGitSnapshotStore(
-                settings(repositoryRoot, Optional.empty()))) {
-            assertEquals(DestinationStatus.SUCCESS, await(store.createBackup(
-                    capture(world, worldId, firstBackupId, Instant.now().minusSeconds(2)),
-                    ProgressListener.NO_OP)).status());
-            Files.writeString(world.resolve("level.dat"), "second");
-            assertEquals(DestinationStatus.SUCCESS, await(store.createBackup(
-                    capture(world, worldId, secondBackupId, Instant.now()),
-                    ProgressListener.NO_OP)).status());
-
-            Map<BackupId, GitSnapshot> snapshots = await(store.listSnapshots(
-                            Optional.of(worldId))).stream()
-                    .collect(Collectors.toMap(GitSnapshot::backupId, Function.identity()));
-            String firstCommit = snapshots.get(firstBackupId).commitId();
-            String secondCommit = snapshots.get(secondBackupId).commitId();
-            assertEquals(List.of(secondCommit), nativeGit(
-                            "--git-dir=" + store.repositoryFor(worldId),
-                            "rev-list",
-                            secondCommit)
-                    .lines()
-                    .filter(line -> !line.isBlank())
-                    .toList());
-
-            assertTrue(await(store.deleteSnapshot(worldId, firstBackupId)));
-            assertEquals(0, await(store.rebuildSnapshotRefs()));
-            assertFalse(await(store.listSnapshots(Optional.of(worldId))).stream()
-                    .anyMatch(snapshot -> snapshot.backupId().equals(firstBackupId)));
-            assertFalse(nativeGit(
-                            "--git-dir=" + store.repositoryFor(worldId),
-                            "rev-list",
-                            secondCommit)
-                    .lines()
-                    .anyMatch(firstCommit::equals));
-        }
-    }
-
-    @Test
-    void expandsWorldTemplateIntoDistinctLocalRemotes() throws Exception {
-        Path repositoryRoot = temporaryDirectory.resolve("templated-repositories");
-        WorldId firstWorldId = WorldId.create();
-        WorldId secondWorldId = WorldId.create();
-        BackupId firstBackupId = BackupId.create();
-        BackupId secondBackupId = BackupId.create();
-        Path remoteTemplate = temporaryDirectory.resolve("remote-{worldId}.git");
-        Path firstRemote = Path.of(GitBackendSettings.resolveWorldRemote(
-                remoteTemplate.toString(), firstWorldId));
-        Path secondRemote = Path.of(GitBackendSettings.resolveWorldRemote(
-                remoteTemplate.toString(), secondWorldId));
-        nativeGit("init", "--bare", firstRemote.toString());
-        nativeGit("init", "--bare", secondRemote.toString());
-
-        try (WorldGitSnapshotStore store = new WorldGitSnapshotStore(settings(
-                repositoryRoot,
-                Optional.of(remoteTemplate.toString())))) {
-            assertEquals(DestinationStatus.SUCCESS, await(store.createBackup(
-                    capture(world("remote-one", "one"), firstWorldId, firstBackupId, Instant.now()),
-                    ProgressListener.NO_OP)).status());
-            assertEquals(DestinationStatus.SUCCESS, await(store.createBackup(
-                    capture(world("remote-two", "two"), secondWorldId, secondBackupId, Instant.now()),
-                    ProgressListener.NO_OP)).status());
-
-            GitSnapshot firstSnapshot = await(store.listSnapshots(
-                    Optional.of(firstWorldId))).getFirst();
-            GitSnapshot secondSnapshot = await(store.listSnapshots(
-                    Optional.of(secondWorldId))).getFirst();
-            assertFalse(remoteRef(firstRemote, GitRemoteSnapshotRef.current(firstSnapshot)).isEmpty());
-            assertTrue(remoteRef(firstRemote, GitRemoteSnapshotRef.current(secondSnapshot)).isEmpty());
-            assertFalse(remoteRef(secondRemote, GitRemoteSnapshotRef.current(secondSnapshot)).isEmpty());
-            assertTrue(remoteRef(secondRemote, GitRemoteSnapshotRef.current(firstSnapshot)).isEmpty());
-            assertEquals(
-                    remoteRef(firstRemote, GitRemoteSnapshotRef.current(firstSnapshot)),
-                    remoteRef(firstRemote, "refs/heads/main"));
-            assertEquals(
-                    remoteRef(secondRemote, GitRemoteSnapshotRef.current(secondSnapshot)),
-                    remoteRef(secondRemote, "refs/heads/main"));
-        }
-    }
-
-    @Test
-    void synchronizesEveryNewWorldCommitImmediately() throws Exception {
-        Path repositoryRoot = temporaryDirectory.resolve("automatic-sync-repositories");
-        Path remote = temporaryDirectory.resolve("automatic-sync-remote.git");
-        nativeGit("init", "--bare", remote.toString());
-        WorldId worldId = WorldId.create();
-        Path world = world("automatic-sync-world", "first");
-        ExecutorService executor = Executors.newSingleThreadExecutor();
-
-        try (WorldGitSnapshotStore store = new WorldGitSnapshotStore(
-                settings(repositoryRoot, Optional.empty()),
-                Optional.empty(),
-                Map.of(worldId, remote.toUri().toString()),
-                new SystemGitCommandRunner(),
-                executor)) {
-            var first = await(store.createBackup(
-                    capture(world, worldId, BackupId.create(), Instant.now().minusSeconds(2)),
-                    ProgressListener.NO_OP));
-            assertEquals(DestinationStatus.SUCCESS, first.status());
-            assertEquals(SyncStatus.SYNCED, first.syncStatus());
-            GitSnapshot firstSnapshot = await(store.listSnapshots(
-                    Optional.of(worldId))).getFirst();
-            String firstRemoteCommit = remoteRef(
-                    remote, GitRemoteSnapshotRef.current(firstSnapshot)).orElseThrow();
-
-            Files.writeString(world.resolve("level.dat"), "second", StandardCharsets.UTF_8);
-            var second = await(store.createBackup(
-                    capture(world, worldId, BackupId.create(), Instant.now()),
-                    ProgressListener.NO_OP));
-            assertEquals(DestinationStatus.SUCCESS, second.status());
-            assertEquals(SyncStatus.SYNCED, second.syncStatus());
-            GitSnapshot secondSnapshot = await(store.listSnapshots(Optional.of(worldId))).stream()
-                    .filter(snapshot -> !snapshot.backupId().equals(firstSnapshot.backupId()))
-                    .findFirst()
-                    .orElseThrow();
-            String secondRemoteCommit = remoteRef(
-                    remote, GitRemoteSnapshotRef.current(secondSnapshot)).orElseThrow();
-
-            assertFalse(firstRemoteCommit.equals(secondRemoteCommit));
-            assertEquals(
-                    firstRemoteCommit,
-                    remoteRef(remote, GitRemoteSnapshotRef.current(firstSnapshot)).orElseThrow());
-            assertEquals(
-                    Optional.of(secondRemoteCommit),
-                    remoteRef(remote, "refs/heads/main"));
-            assertTrue(remoteRef(store.repositoryFor(worldId), "refs/heads/main").isEmpty());
-        } finally {
-            executor.shutdownNow();
-        }
-    }
-
-    @Test
-    void readsRestoresSyncsAndDeletesExistingSharedRepositoryAsLegacy() throws Exception {
-        Path legacyRepository = temporaryDirectory.resolve("legacy.git");
-        nativeGit(
-                "init",
-                "--bare",
-                "--initial-branch=legacy-shared",
-                legacyRepository.toString());
-        GitBackendSettings legacySettings = settings(legacyRepository, Optional.empty());
-        WorldId worldId = WorldId.create();
-        Path source = world("legacy-world", "legacy contents");
-        BackupId legacyBackupId = BackupId.create();
-        BackupCapture legacyCapture = capture(
-                source,
-                worldId,
-                legacyBackupId,
-                Instant.now().minusSeconds(1));
-        try (GitBackupBackend legacy = new GitBackupBackend(legacySettings)) {
-            assertEquals(DestinationStatus.SUCCESS, await(legacy.createBackup(
-                    legacyCapture,
-                    ProgressListener.NO_OP)).status());
-        }
-        assertEquals("refs/heads/legacy-shared", nativeGit(
-                "--git-dir=" + legacyRepository,
-                "symbolic-ref",
-                "HEAD").trim());
-
-        try (WorldGitSnapshotStore store = new WorldGitSnapshotStore(legacySettings)) {
-            assertEquals(
-                    legacyRepository.resolveSibling("legacy.git.worlds"),
-                    store.repositoryRoot());
-            assertTrue(await(store.verifySnapshot(worldId, legacyBackupId)).valid());
-            assertEquals(DestinationStatus.SUCCESS, await(store.syncSnapshot(
-                    worldId,
-                    legacyBackupId)).status());
-            Path restored = temporaryDirectory.resolve("legacy-restored");
-            await(store.restoreSnapshot(
-                    worldId,
-                    legacyBackupId,
-                    legacyCapture.manifest(),
-                    restored));
-            assertEquals("legacy contents", Files.readString(restored.resolve("level.dat")));
-
-            BackupId isolatedBackupId = BackupId.create();
-            Files.writeString(source.resolve("level.dat"), "new isolated contents");
-            assertEquals(DestinationStatus.SUCCESS, await(store.createBackup(
-                    capture(source, worldId, isolatedBackupId, Instant.now()),
-                    ProgressListener.NO_OP)).status());
-            assertTrue(Files.isDirectory(store.repositoryFor(worldId)));
-            assertFalse(remoteRef(
-                    legacyRepository,
-                    GitSnapshot.refName(worldId, legacyBackupId)).isEmpty());
-            assertTrue(remoteRef(
-                    legacyRepository,
-                    GitSnapshot.refName(worldId, isolatedBackupId)).isEmpty());
-            assertFalse(remoteRef(
-                    store.repositoryFor(worldId),
-                    GitSnapshot.refName(worldId, isolatedBackupId)).isEmpty());
-            assertEquals("refs/heads/legacy-shared", nativeGit(
-                    "--git-dir=" + legacyRepository,
-                    "symbolic-ref",
-                    "HEAD").trim());
-
-            assertTrue(await(store.deleteSnapshot(worldId, legacyBackupId)));
-            assertTrue(remoteRef(
-                    legacyRepository,
-                    GitSnapshot.refName(worldId, legacyBackupId)).isEmpty());
-        }
-    }
-
-    @Test
-    void usesExplicitMigratedLegacySettingsAlongsideCurrentRoot() throws Exception {
-        Path currentRoot = temporaryDirectory.resolve("current-repositories");
-        Path legacyRepository = temporaryDirectory.resolve("migrated-legacy.git");
-        Path legacyRemote = temporaryDirectory.resolve("migrated-legacy-remote.git");
-        nativeGit("init", "--bare", legacyRemote.toString());
-        GitBackendSettings legacySettings = settings(
-                legacyRepository,
-                Optional.of(legacyRemote.toString()));
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        BackupCapture legacyCapture = capture(
-                world("explicit-legacy-world", "migrated contents"),
-                worldId,
-                backupId,
-                Instant.now());
-        try (GitBackupBackend legacy = new GitBackupBackend(legacySettings)) {
-            assertEquals(DestinationStatus.SUCCESS, await(legacy.createBackup(
-                    legacyCapture,
-                    ProgressListener.NO_OP)).status());
-        }
-
-        try (ExecutorService executor = Executors.newVirtualThreadPerTaskExecutor();
-                WorldGitSnapshotStore store = new WorldGitSnapshotStore(
-                        settings(currentRoot, Optional.empty()),
-                        Optional.of(legacySettings),
-                        new SystemGitCommandRunner(),
-                        executor)) {
-            assertEquals(currentRoot.toAbsolutePath().normalize(), store.repositoryRoot());
-            assertTrue(store.remoteConfigured(worldId));
-            assertTrue(await(store.verifySnapshot(worldId, backupId)).valid());
-            assertEquals(
-                    DestinationStatus.SUCCESS,
-                    await(store.syncSnapshot(worldId, backupId)).status());
-            assertFalse(remoteRef(
-                    legacyRemote,
-                    GitRemoteSnapshotRef.current(
-                            backupId,
-                            legacyCapture.manifest().createdAt())).isEmpty());
-            assertFalse(Files.exists(store.repositoryFor(worldId)));
-        }
-    }
-
-    @Test
-    void restoresRemoteOnlySnapshotFromOnlyConfiguredLegacyRemote() throws Exception {
-        Path currentRoot = temporaryDirectory.resolve("remote-only-current-repositories");
-        Path legacyRemote = temporaryDirectory.resolve("remote-only-legacy-remote.git");
-        Path producerRepository = temporaryDirectory.resolve("remote-only-producer.git");
-        Path recoveryRepository = temporaryDirectory.resolve("remote-only-recovery.git");
-        nativeGit("init", "--bare", legacyRemote.toString());
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        BackupCapture capture = capture(
-                world("remote-only-legacy-world", "remote legacy contents"),
-                worldId,
-                backupId,
-                Instant.now());
-        try (GitBackupBackend producer = new GitBackupBackend(settings(
-                producerRepository,
-                Optional.of(legacyRemote.toString())))) {
-            assertEquals(DestinationStatus.SUCCESS, await(producer.createBackup(
-                    capture,
-                    ProgressListener.NO_OP)).status());
-        }
-
-        GitBackendSettings recoverySettings = settings(
-                recoveryRepository,
-                Optional.of(legacyRemote.toString()));
-        try (ExecutorService executor = Executors.newVirtualThreadPerTaskExecutor();
-                WorldGitSnapshotStore store = new WorldGitSnapshotStore(
-                        settings(currentRoot, Optional.empty()),
-                        Optional.of(recoverySettings),
-                        new SystemGitCommandRunner(),
-                        executor)) {
-            assertFalse(Files.exists(recoveryRepository));
-            assertFalse(Files.exists(store.repositoryFor(worldId)));
-
-            Path restored = temporaryDirectory.resolve("remote-only-restored");
-            await(store.restoreSnapshot(
-                    worldId,
-                    backupId,
-                    capture.manifest(),
-                    restored));
-
-            assertEquals("remote legacy contents", Files.readString(restored.resolve("level.dat")));
-            assertTrue(Files.isDirectory(recoveryRepository));
-            assertFalse(Files.exists(store.repositoryFor(worldId)));
-        }
-    }
-
-    @Test
-    void failsClosedWhenSnapshotExistsInChildAndLegacyRepositories() throws Exception {
-        Path legacyRepository = temporaryDirectory.resolve("ambiguous-legacy.git");
-        GitBackendSettings legacySettings = settings(legacyRepository, Optional.empty());
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        Path source = world("ambiguous-world", "same snapshot");
-        BackupCapture capture = capture(source, worldId, backupId, Instant.now());
-        try (GitBackupBackend legacy = new GitBackupBackend(legacySettings)) {
-            await(legacy.createBackup(capture, ProgressListener.NO_OP));
-        }
-
-        try (WorldGitSnapshotStore store = new WorldGitSnapshotStore(legacySettings);
-                GitBackupBackend child = new GitBackupBackend(legacySettings.forWorld(
-                        store.repositoryFor(worldId),
-                        worldId,
-                        Optional.empty()))) {
-            await(child.createBackup(capture, ProgressListener.NO_OP));
-
-            ExecutionException failure = assertThrows(
-                    ExecutionException.class,
-                    () -> store.listSnapshots(Optional.of(worldId))
-                            .toCompletableFuture()
-                            .get(30, TimeUnit.SECONDS));
-            assertTrue(rootCause(failure) instanceof GitStorageException);
-        }
-    }
-
-    @Test
-    void importsFullAndRemoteBackedParentlessSnapshots() throws Exception {
-        WorldId worldId = WorldId.create();
-        BackupId firstBackup = BackupId.create();
-        BackupId secondBackup = BackupId.create();
-        Path world = world("import-source-world", "first");
-        Path region = world.resolve("region").resolve("r.0.0.mca");
-        Files.createDirectories(region.getParent());
-        Files.writeString(region, "lfs-content");
-        Path producerRoot = temporaryDirectory.resolve("import-producer");
-        try (WorldGitSnapshotStore producer = new WorldGitSnapshotStore(
-                settings(producerRoot, Optional.empty()))) {
-            assertEquals(DestinationStatus.SUCCESS, await(producer.createBackup(
-                    capture(world, worldId, firstBackup, Instant.now().minusSeconds(2)),
-                    ProgressListener.NO_OP)).status());
-            Files.writeString(world.resolve("level.dat"), "second");
-            assertEquals(DestinationStatus.SUCCESS, await(producer.createBackup(
-                    capture(world, worldId, secondBackup, Instant.now().minusSeconds(1)),
-                    ProgressListener.NO_OP)).status());
-
-            Path sourceRepository = producer.repositoryFor(worldId);
-            try (WorldGitSnapshotStore full = new WorldGitSnapshotStore(settings(
-                            temporaryDirectory.resolve("import-full"), Optional.empty()));
-                    WorldGitSnapshotStore remoteBacked = new WorldGitSnapshotStore(settings(
-                            temporaryDirectory.resolve("import-remote"), Optional.empty()));
-                    WorldGitSnapshotStore selective = new WorldGitSnapshotStore(settings(
-                            temporaryDirectory.resolve("import-selective"), Optional.empty()));
-                    GitPreparedImport prepared = await(full.prepareImport(sourceRepository.toString()))) {
-                assertEquals(2, prepared.candidates().size());
-                assertTrue(prepared.issues().isEmpty());
-                GitImportCandidate candidate = prepared.candidates().stream()
-                        .filter(value -> value.manifest().backupId().equals(secondBackup))
-                        .findFirst()
-                        .orElseThrow();
-                assertEquals(2, await(full.installImport(prepared, true)).size());
-                assertTrue(await(full.verifySnapshot(worldId, firstBackup)).valid());
-                assertTrue(await(full.verifySnapshot(worldId, secondBackup)).valid());
-
-                nativeGit(
-                        "--git-dir=" + full.repositoryFor(worldId),
-                        "update-ref",
-                        "-d",
-                        GitSnapshot.refName(worldId, firstBackup));
-                assertEquals(0, await(full.rebuildSnapshotRefs()));
-                assertEquals(
-                        List.of(secondBackup),
-                        await(full.listSnapshots(Optional.of(worldId))).stream()
-                                .map(GitSnapshot::backupId)
-                                .toList());
-
-                assertEquals(2, await(remoteBacked.installImport(prepared, false)).size());
-                assertFalse(await(remoteBacked.verifySnapshot(worldId, secondBackup)).valid());
-                assertTrue(await(remoteBacked.hydrateExternalSnapshot(
-                        worldId,
-                        secondBackup,
-                        candidate.manifest(),
-                        candidate.commitId(),
-                        sourceRepository.toString())).valid());
-                assertTrue(await(remoteBacked.deleteLocalSnapshot(worldId, secondBackup)));
-                assertFalse(await(remoteBacked.listSnapshots(Optional.of(worldId))).stream()
-                        .anyMatch(snapshot -> snapshot.backupId().equals(secondBackup)));
-
-                assertEquals(1, await(selective.installImport(
-                        prepared, List.of(candidate), true)).size());
-                assertEquals(0, await(selective.rebuildSnapshotRefs()));
-                assertEquals(
-                        List.of(secondBackup),
-                        await(selective.listSnapshots(Optional.of(worldId))).stream()
-                                .map(GitSnapshot::backupId)
-                                .toList());
-                assertTrue(Files.isDirectory(sourceRepository));
-            }
-        }
-    }
-
-    @Test
-    void fullImportKeepsLegacyAncestryAvailableForRefRebuild() throws Exception {
-        WorldId worldId = WorldId.create();
-        BackupId firstBackup = BackupId.create();
-        BackupId secondBackup = BackupId.create();
-        Path world = world("legacy-import-source-world", "first");
-        Path producerRoot = temporaryDirectory.resolve("legacy-import-producer");
-
-        try (WorldGitSnapshotStore producer = new WorldGitSnapshotStore(
-                settings(producerRoot, Optional.empty()))) {
-            assertEquals(DestinationStatus.SUCCESS, await(producer.createBackup(
-                    capture(world, worldId, firstBackup, Instant.now().minusSeconds(2)),
-                    ProgressListener.NO_OP)).status());
-            Files.writeString(world.resolve("level.dat"), "second");
-            assertEquals(DestinationStatus.SUCCESS, await(producer.createBackup(
-                    capture(world, worldId, secondBackup, Instant.now()),
-                    ProgressListener.NO_OP)).status());
-
-            Map<BackupId, GitSnapshot> snapshots = await(producer.listSnapshots(
-                            Optional.of(worldId))).stream()
-                    .collect(Collectors.toMap(GitSnapshot::backupId, Function.identity()));
-            Path sourceRepository = producer.repositoryFor(worldId);
-            createLegacyHistory(
-                    sourceRepository,
-                    snapshots.get(firstBackup),
-                    snapshots.get(secondBackup));
-
-            try (WorldGitSnapshotStore imported = new WorldGitSnapshotStore(settings(
-                            temporaryDirectory.resolve("legacy-import-full"),
-                            Optional.empty()));
-                    GitPreparedImport prepared = await(imported.prepareImport(
-                            sourceRepository.toString()))) {
-                assertEquals(2, prepared.candidates().size());
-                assertEquals(2, await(imported.installImport(prepared, true)).size());
-
-                nativeGit(
-                        "--git-dir=" + imported.repositoryFor(worldId),
-                        "update-ref",
-                        "-d",
-                        GitSnapshot.refName(worldId, firstBackup));
-                assertEquals(1, await(imported.rebuildSnapshotRefs()));
-                assertEquals(2, await(imported.listSnapshots(
-                        Optional.of(worldId))).size());
-            }
-        }
-    }
-
-    @Test
-    void rejectsTooManyAdvertisedHeadsBeforeFetch() throws Exception {
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        Path producerRoot = temporaryDirectory.resolve("large-ref-import-producer");
-        Path sourceRepository;
-        String commit;
-        try (WorldGitSnapshotStore producer = new WorldGitSnapshotStore(
-                settings(producerRoot, Optional.empty()))) {
-            assertEquals(DestinationStatus.SUCCESS, await(producer.createBackup(
-                    capture(
-                            world("large-ref-import-world", "contents"),
-                            worldId,
-                            backupId,
-                            Instant.now()),
-                    ProgressListener.NO_OP)).status());
-            sourceRepository = producer.repositoryFor(worldId);
-            commit = await(producer.listSnapshots(Optional.of(worldId)))
-                    .getFirst()
-                    .commitId();
-        }
-        Path extraHeads = Files.createDirectories(
-                sourceRepository.resolve("refs/heads/excess"));
-        for (int index = 0; index < 256; index++) {
-            Files.writeString(extraHeads.resolve(Integer.toString(index)), commit + "\n");
-        }
-
-        AtomicBoolean fetchStarted = new AtomicBoolean();
-        SystemGitCommandRunner delegate = new SystemGitCommandRunner();
-        GitCommandRunner recordingRunner = command -> {
-            if (command.arguments().contains("fetch")) {
-                fetchStarted.set(true);
-            }
-            return delegate.run(command);
-        };
-        try (ExecutorService executor = Executors.newVirtualThreadPerTaskExecutor();
-                WorldGitSnapshotStore imported = new WorldGitSnapshotStore(
-                        settings(
-                                temporaryDirectory.resolve("large-ref-import-target"),
-                                Optional.empty()),
-                        Optional.empty(),
-                        recordingRunner,
-                        executor)) {
-            GitStorageException failure = assertThrows(
-                    GitStorageException.class,
-                    () -> await(imported.prepareImport(sourceRepository.toString())));
-            assertEquals("Git import contains too many branches", failure.getMessage());
-            assertFalse(fetchStarted.get());
-        }
-    }
-
-    private Path world(String name, String contents) throws IOException {
-        Path world = Files.createDirectory(temporaryDirectory.resolve(name));
-        Files.writeString(world.resolve("level.dat"), contents, StandardCharsets.UTF_8);
-        return world;
-    }
-
-    private GitBackendSettings settings(Path repository, Optional<String> remoteUrl) {
-        return new GitBackendSettings(
-                true,
-                repository,
-                "git",
-                "origin",
-                remoteUrl,
-                GitBackendSettings.DEFAULT_LFS_PATTERNS,
-                TEST_TIMEOUT,
-                4 * 1_024 * 1_024);
-    }
-
-    private static BackupCapture capture(
-            Path world,
-            WorldId worldId,
-            BackupId backupId,
-            Instant timestamp) throws Exception {
-        List<GitInventoryEntry> entries = new ArrayList<>();
-        try (Stream<Path> paths = Files.walk(world)) {
-            for (Path path : paths.filter(Files::isRegularFile).toList()) {
-                byte[] contents = Files.readAllBytes(path);
-                entries.add(new GitInventoryEntry(
-                        world.relativize(path).toString().replace('\\', '/'),
-                        contents.length,
-                        java.util.HexFormat.of().formatHex(GitInventory.sha256().digest(contents))));
-            }
-        }
-        GitInventory inventory = GitInventory.create(entries);
-        BackupManifest manifest = BackupManifest.create(
-                backupId,
-                worldId,
-                "Integration World",
-                Optional.empty(),
-                timestamp,
-                BackupTrigger.MANUAL,
-                inventory.fileCount(),
-                inventory.byteCount(),
-                inventory.fileCount(),
-                inventory.contentSha256(),
-                inventory.inventorySha256());
-        return new BackupCapture(world, manifest);
-    }
-
-    private Optional<String> remoteRef(Path repository, String refName) throws Exception {
-        String output = nativeGit(
-                "--git-dir=" + repository,
-                "for-each-ref",
-                "--format=%(objectname)",
-                refName).trim();
-        return output.isEmpty() ? Optional.empty() : Optional.of(output);
-    }
-
-    private void createLegacyHistory(
-            Path repository,
-            GitSnapshot parent,
-            GitSnapshot child) throws Exception {
-        String tree = GitCommands.objectId(nativeGit(
-                "--git-dir=" + repository,
-                "rev-parse",
-                child.commitId() + "^{tree}"));
-        GitSnapshotManifest manifest = GitSnapshotManifestCodec.decode(nativeGit(
-                        "--git-dir=" + repository,
-                        "show",
-                        child.commitId() + ":" + GitBackupBackend.MANIFEST_PATH)
-                .getBytes(StandardCharsets.UTF_8));
-        Map<String, String> environment = Map.of(
-                "GIT_AUTHOR_NAME", "WorldArchive",
-                "GIT_AUTHOR_EMAIL", "worldarchive@localhost",
-                "GIT_COMMITTER_NAME", "WorldArchive",
-                "GIT_COMMITTER_EMAIL", "worldarchive@localhost",
-                "GIT_AUTHOR_DATE", child.committedAt().toString(),
-                "GIT_COMMITTER_DATE", child.committedAt().toString());
-        GitCommands commands = new GitCommands(
-                settings(repository, Optional.empty()),
-                new SystemGitCommandRunner());
-        String linkedCommit = GitCommands.objectId(commands.checked(
-                        List.of(
-                                "--git-dir=" + repository,
-                                "commit-tree",
-                                tree,
-                                "-p",
-                                parent.commitId()),
-                        repository,
-                        environment,
-                        GitCommand.utf8Input(GitSnapshotVerifier.commitMessage(manifest)))
-                .standardOutput());
-        nativeGit(
-                "--git-dir=" + repository,
-                "update-ref",
-                child.refName(),
-                linkedCommit,
-                child.commitId());
-        nativeGit(
-                "--git-dir=" + repository,
-                "update-ref",
-                "refs/heads/main",
-                linkedCommit);
-    }
-
-    private String nativeGit(String... arguments) throws Exception {
-        List<String> command = new ArrayList<>();
-        command.add("git");
-        command.addAll(List.of(arguments));
-        Process process = new ProcessBuilder(command)
-                .directory(temporaryDirectory.toFile())
-                .redirectErrorStream(true)
-                .start();
-        String output = new String(process.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
-        assertTrue(process.waitFor(30, TimeUnit.SECONDS));
-        assertEquals(0, process.exitValue(), output);
-        return output;
-    }
-
-    private static Throwable rootCause(Throwable throwable) {
-        Throwable current = throwable;
-        while (current.getCause() != null) {
-            current = current.getCause();
-        }
-        return current;
-    }
-
-    private static <T> T await(CompletionStage<T> stage) throws Exception {
-        try {
-            return stage.toCompletableFuture().get(60, TimeUnit.SECONDS);
-        } catch (ExecutionException exception) {
-            if (exception.getCause() instanceof Exception cause) {
-                throw cause;
-            }
-            throw exception;
-        }
-    }
-
-    private record SetView(List<String> values) {
-        private static SetView of(BackupId... backupIds) {
-            return of(List.of(backupIds));
-        }
-
-        private static SetView of(Iterable<BackupId> backupIds) {
-            List<String> values = new ArrayList<>();
-            backupIds.forEach(backupId -> values.add(backupId.toString()));
-            values.sort(String::compareTo);
-            return new SetView(List.copyOf(values));
-        }
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/git/WorldGitSnapshotStoreTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/git/WorldGitSnapshotStoreTest.java
new file mode 100644
index 0000000..0651f7e
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/git/WorldGitSnapshotStoreTest.java
@@ -0,0 +1,574 @@
+package dev.ishaanko.worldarchive.storage.git;
+
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.config.FolderOrigin;
+import dev.ishaanko.worldarchive.core.BackupCapture;
+import dev.ishaanko.worldarchive.core.TestCaptures;
+import dev.ishaanko.worldarchive.core.WorldInventory;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.DestinationStatus;
+import dev.ishaanko.worldarchive.model.ProgressListener;
+import dev.ishaanko.worldarchive.model.SyncStatus;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.support.Digests;
+import java.io.IOException;
+import java.io.RandomAccessFile;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.LinkOption;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Random;
+import java.util.Set;
+import java.util.concurrent.CompletionStage;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Assumptions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+/** Git storage behavior that the end-to-end suite cannot reach through the engine. */
+class WorldGitSnapshotStoreTest {
+    private static final Instant START = Instant.parse("2026-09-01T12:00:00Z");
+
+    @TempDir
+    Path temporaryDirectory;
+
+    private final ExecutorService executor = Executors.newVirtualThreadPerTaskExecutor();
+
+
+    @BeforeEach
+    void requireGitAndLfs() throws Exception {
+        GitToolHealth tools = new GitToolProbe(settings("storage", GitBackendSettings.DEFAULT_LFS_PATTERNS),
+                new SystemGitCommandRunner()).probe();
+        Assumptions.assumeTrue(tools.available(), tools.summary());
+    }
+
+    @AfterEach
+    void stopExecutor() {
+        executor.shutdownNow();
+    }
+
+    @Test
+    void gitThatCannotStartFailsTheBackupAndCreatesNothing() throws Exception {
+        GitBackendSettings missing = new GitBackendSettings(true, temporaryDirectory.resolve("missing"),
+                FolderOrigin.DEFAULT, "worldarchive-missing-git", "origin", Optional.empty(),
+                GitBackendSettings.DEFAULT_LFS_PATTERNS, Duration.ofSeconds(10), 1_024 * 1_024);
+        WorldGitSnapshotStore store =
+                new WorldGitSnapshotStore(missing, Map.of(), new SystemGitCommandRunner(), executor);
+
+        DestinationResult result = store.createBackup(capture(world("Missing"), WorldId.create(), START), ProgressListener.NO_OP);
+
+        assertEquals(DestinationStatus.FAILED, result.status());
+        assertTrue(result.message().orElseThrow().contains("Install Git"), result.message().orElseThrow());
+        assertFalse(Files.exists(temporaryDirectory.resolve("missing")));
+    }
+
+    @Test
+    void aNestedGitRepositoryFailsWithAMessageNamingItsFolder() throws Exception {
+        Path world = world("Datapacks");
+        write(world.resolve("datapacks/mypack/.git/HEAD"), "ref: refs/heads/main\n".getBytes(StandardCharsets.UTF_8));
+
+        DestinationResult result = store(Map.of()).createBackup(capture(world, WorldId.create(), START), ProgressListener.NO_OP);
+
+        assertEquals(DestinationStatus.FAILED, result.status());
+        assertTrue(result.message().orElseThrow().contains("datapacks/mypack"), result.message().orElseThrow());
+        assertTrue(result.message().orElseThrow().contains("Remove its .git folder"));
+    }
+
+    @Test
+    void aWorldThatChangedAfterItsCaptureIsNeverPublished() throws Exception {
+        Path world = world("Changed");
+        WorldId worldId = WorldId.create();
+        WorldGitSnapshotStore store = store(Map.of());
+        BackupCapture capture = capture(world, worldId, START);
+        write(world.resolve("level.dat"), bytes(4_096, 99));
+
+        DestinationResult result = store.createBackup(capture, ProgressListener.NO_OP);
+
+        assertEquals(DestinationStatus.FAILED, result.status());
+        assertTrue(result.message().orElseThrow().contains("level.dat"), result.message().orElseThrow());
+        assertTrue(await(store.listSnapshots(Optional.of(worldId))).isEmpty());
+    }
+
+    @Test
+    void aLinkInTheCaptureFolderNeverBecomesPartOfASnapshot() throws Exception {
+        Assumptions.assumeFalse(isWindows(), "creating a symbolic link needs extra rights on Windows");
+        Path world = world("Linked");
+        WorldId worldId = WorldId.create();
+        BackupCapture capture = capture(world, worldId, START);
+        Files.createSymbolicLink(world.resolve("linked.dat"), world.resolve("level.dat"));
+        WorldGitSnapshotStore store = store(Map.of());
+
+        assertEquals(DestinationStatus.SUCCESS, store.createBackup(capture, ProgressListener.NO_OP).status());
+
+        Path staging = Files.createDirectories(temporaryDirectory.resolve("linked-restore"));
+        await(store.restoreSnapshot(worldId, capture.manifest().backupId(), capture.manifest(), staging));
+        assertEquals(capture.inventory(), TestCaptures.inventoryOf(staging));
+        assertFalse(Files.exists(staging.resolve("linked.dat"), LinkOption.NOFOLLOW_LINKS));
+    }
+
+    @Test
+    void anUnchangedWorldReusesEveryObjectAndEachWorldKeepsItsOwnRepository() throws Exception {
+        Path world = world("Unchanged");
+        WorldId worldId = WorldId.create();
+        WorldId otherWorldId = WorldId.create();
+        WorldGitSnapshotStore store = store(Map.of());
+        BackupId first = backup(store, world, worldId, START);
+        long objects = lfsObjects(store, worldId);
+
+        BackupId second = backup(store, world, worldId, START.plusSeconds(60));
+        backup(store, world("Other"), otherWorldId, START.plusSeconds(120));
+
+        assertEquals(objects, lfsObjects(store, worldId));
+        assertEquals(worldFiles(store, worldId, first), worldFiles(store, worldId, second));
+        assertNotEquals(store.repositoryFor(worldId), store.repositoryFor(otherWorldId));
+        assertEquals(2, await(store.listSnapshots(Optional.of(worldId))).size());
+        assertEquals(1, await(store.listSnapshots(Optional.of(otherWorldId))).size());
+        assertEquals(3, await(store.listSnapshots(Optional.empty())).size());
+    }
+
+    @Test
+    void verifyCatchesADamagedOrMissingLfsObjectAndARepointedRef() throws Exception {
+        Path world = world("Verified");
+        WorldId worldId = WorldId.create();
+        WorldGitSnapshotStore store = store(Map.of());
+        BackupId first = backup(store, world, worldId, START);
+        write(world.resolve("level.dat"), bytes(4_096, 7));
+        BackupId second = backup(store, world, worldId, START.plusSeconds(60));
+        Path repository = store.repositoryFor(worldId);
+        String firstCommit = commit(store, worldId, first);
+        git(repository, "update-ref", GitSnapshot.refName(worldId, first), commit(store, worldId, second));
+        assertFalse(await(store.verifyCurrentSnapshot(worldId, first)).valid(), "a ref that shows another backup");
+        git(repository, "update-ref", GitSnapshot.refName(worldId, first), firstCommit);
+        assertTrue(await(store.verifyCurrentSnapshot(worldId, first)).valid());
+
+        flipOneByte(lfsObject(repository, Files.readAllBytes(world.resolve("level.dat"))));
+        Files.delete(lfsObject(repository, bytes(4_096, 1)));
+
+        GitVerification damaged = await(store.verifyCurrentSnapshot(worldId, second));
+        assertFalse(damaged.valid());
+        assertTrue(damaged.message().contains("missing or damaged"), damaged.message());
+        assertFalse(await(store.verifyCurrentSnapshot(worldId, first)).valid());
+    }
+
+    @Test
+    void aSnapshotWrittenWithOtherLfsPatternsStillRestores() throws Exception {
+        Path world = world("Patterns");
+        WorldId worldId = WorldId.create();
+        WorldGitSnapshotStore before = store("storage", List.of("*.mca", "*.dat"), Map.of());
+        BackupCapture older = capture(world, worldId, START);
+        assertEquals(DestinationStatus.SUCCESS, before.createBackup(older, ProgressListener.NO_OP).status());
+        WorldGitSnapshotStore after = store("storage", List.of("*.mca"), Map.of());
+        BackupCapture newer = capture(world, worldId, START.plusSeconds(60));
+
+        assertEquals(DestinationStatus.SUCCESS, after.createBackup(newer, ProgressListener.NO_OP).status());
+
+        assertRestores(after, older, world);
+        assertRestores(after, newer, world);
+        assertArrayEquals(Files.readAllBytes(world.resolve("level.dat")), git(after.repositoryFor(worldId), "cat-file",
+                "blob", GitSnapshot.refName(worldId, newer.manifest().backupId()) + ":level.dat")
+                .getBytes(StandardCharsets.ISO_8859_1));
+    }
+
+    @Test
+    void aRestoreNeedsAnEmptyFolder() throws Exception {
+        Path world = world("Occupied");
+        WorldId worldId = WorldId.create();
+        WorldGitSnapshotStore store = store(Map.of());
+        BackupCapture capture = capture(world, worldId, START);
+        store.createBackup(capture, ProgressListener.NO_OP);
+        Path staging = Files.createDirectories(temporaryDirectory.resolve("occupied"));
+        write(staging.resolve("keep.txt"), "players' file".getBytes(StandardCharsets.UTF_8));
+
+        ExecutionException failure = assertThrows(ExecutionException.class, () -> await(
+                store.restoreSnapshot(worldId, capture.manifest().backupId(), capture.manifest(), staging)));
+
+        assertInstanceOf(GitStorageException.class, failure.getCause());
+        assertEquals(List.of(staging.resolve("keep.txt")), list(staging));
+    }
+
+    @Test
+    void anUploadThatStallsIsPendingAndALaterSyncFinishesIt() throws Exception {
+        Path remote = bareRepository("stalling.git");
+        Path hook = remote.resolve("hooks/pre-receive");
+        Files.writeString(hook, "#!/bin/sh\nsleep 30\n");
+        assertTrue(hook.toFile().setExecutable(true));
+        WorldId worldId = WorldId.create();
+        GitBackendSettings impatient = new GitBackendSettings(true, temporaryDirectory.resolve("impatient"),
+                FolderOrigin.DEFAULT, "git", "origin", Optional.empty(), GitBackendSettings.DEFAULT_LFS_PATTERNS,
+                Duration.ofSeconds(2), 1_024 * 1_024);
+        WorldGitSnapshotStore store = new WorldGitSnapshotStore(
+                impatient, Map.of(worldId, remote.toString()), new SystemGitCommandRunner(), executor);
+        BackupCapture capture = capture(world("Stalled"), worldId, START);
+
+        DestinationResult pending = store.createBackup(capture, ProgressListener.NO_OP);
+        Files.delete(hook);
+        DestinationResult synced = await(store.syncSnapshot(worldId, capture.manifest().backupId()));
+
+        assertEquals(DestinationStatus.PENDING_SYNC, pending.status(), pending.message().orElse(""));
+        assertTrue(pending.message().orElseThrow().contains("no progress"), pending.message().orElseThrow());
+        assertEquals(SyncStatus.SYNCED, synced.syncStatus());
+        assertEquals(Set.of(capture.manifest().backupId()), await(store.remoteSnapshotCommits(worldId)).keySet());
+    }
+
+    @Test
+    void syncingAnOlderBackupLeavesMainOnTheNewest() throws Exception {
+        Path remote = temporaryDirectory.resolve("later.git");
+        WorldId worldId = WorldId.create();
+        Path world = world("Main");
+        WorldGitSnapshotStore store = store(Map.of(worldId, remote.toString()));
+        BackupCapture older = capture(world, worldId, START);
+        assertEquals(DestinationStatus.PENDING_SYNC, store.createBackup(older, ProgressListener.NO_OP).status());
+        bareRepository("later.git");
+        write(world.resolve("level.dat"), bytes(4_096, 12));
+        BackupId newer = backup(store, world, worldId, START.plusSeconds(60));
+        String newerCommit = commit(store, worldId, newer);
+        assertEquals(newerCommit, git(remote, "rev-parse", "refs/heads/main").trim());
+
+        assertEquals(SyncStatus.SYNCED, await(store.syncSnapshot(worldId, older.manifest().backupId())).syncStatus());
+
+        assertEquals(newerCommit, git(remote, "rev-parse", "refs/heads/main").trim());
+        assertEquals(2, await(store.remoteSnapshotCommits(worldId)).size());
+    }
+
+    @Test
+    void deleteReportsWhatItFoundAndRemovesBackupsFromTheRemoteInOneOperation() throws Exception {
+        Path remote = bareRepository("remote.git");
+        WorldId local = WorldId.create();
+        WorldId synced = WorldId.create();
+        WorldGitSnapshotStore store = store(Map.of(synced, remote.toString()));
+        Path world = world("Synced");
+        BackupId first = backup(store, world, synced, START);
+        write(world.resolve("level.dat"), bytes(4_096, 13));
+        BackupId second = backup(store, world, synced, START.plusSeconds(60));
+        BackupId unknown = BackupId.create();
+        assertEquals(Map.of(first, commit(store, synced, first), second, commit(store, synced, second)),
+                await(store.remoteSnapshotCommits(synced)));
+
+        backup(store, world("Local"), local, START);
+        assertEquals(GitDeletion.Outcome.REMOTE_NOT_CONFIGURED,
+                await(store.deleteSnapshots(local, Set.of(unknown))).get(unknown).outcome());
+        WorldId withoutRepository = WorldId.create();
+        assertEquals(GitDeletion.Outcome.REMOTE_NOT_CONFIGURED,
+                await(store.deleteSnapshots(withoutRepository, Set.of(unknown))).get(unknown).outcome());
+        assertFalse(Files.exists(store.repositoryFor(withoutRepository)), "a delete creates no repository");
+        assertEquals(GitDeletion.Outcome.NOT_FOUND, await(store.deleteSnapshots(synced, Set.of(unknown))).get(unknown).outcome());
+        Map<BackupId, GitDeletion> deleted = await(store.deleteSnapshots(synced, Set.of(first, second)));
+
+        assertEquals(GitDeletion.Outcome.DELETED, deleted.get(first).outcome());
+        assertEquals(GitDeletion.Outcome.DELETED, deleted.get(second).outcome());
+        assertTrue(await(store.remoteSnapshotCommits(synced)).isEmpty());
+        assertTrue(await(store.listSnapshots(Optional.of(synced))).isEmpty());
+        assertEquals("", git(remote, "ls-tree", "refs/heads/main").trim(), "main shows an empty placeholder");
+        assertEquals(0, lfsObjects(store, synced), "the deleted backups' space is freed");
+    }
+
+    @Test
+    void aRemoteCopyThatDiffersIsNeitherDeletedNorRestoredOrKept() throws Exception {
+        Path remote = bareRepository("diverged.git");
+        WorldId worldId = WorldId.create();
+        WorldGitSnapshotStore store = store(Map.of(worldId, remote.toString()));
+        Path world = world("Diverged");
+        BackupCapture first = capture(world, worldId, START);
+        store.createBackup(first, ProgressListener.NO_OP);
+        write(world.resolve("level.dat"), bytes(4_096, 14));
+        BackupId second = backup(store, world, worldId, START.plusSeconds(60));
+        BackupId firstId = first.manifest().backupId();
+        String firstBranch = remoteBranch(remote, firstId);
+        git(remote, "update-ref", firstBranch, commit(store, worldId, second));
+
+        GitDeletion refused = await(store.deleteSnapshots(worldId, Set.of(firstId))).get(firstId);
+        assertTrue(await(store.deleteLocalSnapshot(worldId, firstId)));
+        Path staging = Files.createDirectories(temporaryDirectory.resolve("diverged-restore"));
+
+        assertEquals(GitDeletion.Outcome.FAILED, refused.outcome());
+        assertTrue(refused.message().contains("differs"), refused.message());
+        assertThrows(ExecutionException.class, () -> await(store.restoreSnapshot(worldId, firstId, first.manifest(), staging)));
+        assertEquals(List.of(second), await(store.listSnapshots(Optional.of(worldId))).stream()
+                .map(GitSnapshot::backupId).toList());
+    }
+
+    @Test
+    void anImportedBackupWithoutItsLfsObjectsFailsAloneAndHydrationDownloadsMissingObjects() throws Exception {
+        Path remote = bareRepository("source.git");
+        WorldId worldId = WorldId.create();
+        WorldGitSnapshotStore source = store("source", GitBackendSettings.DEFAULT_LFS_PATTERNS, Map.of(worldId, remote.toString()));
+        Path world = world("Imported");
+        BackupId broken = backup(source, world, worldId, START);
+        Files.delete(lfsObject(remote, Files.readAllBytes(world.resolve("level.dat"))));
+        write(world.resolve("level.dat"), bytes(4_096, 15));
+        BackupId intact = backup(source, world, worldId, START.plusSeconds(60));
+
+        WorldGitSnapshotStore target = store("target", GitBackendSettings.DEFAULT_LFS_PATTERNS, Map.of());
+        try (GitPreparedImport preview = await(target.prepareImport(remote.toString()))) {
+            assertEquals(Map.of(broken, GitImportInstallStatus.FAILED, intact, GitImportInstallStatus.ADDED),
+                    await(target.installImport(preview, preview.candidates())));
+        }
+        BackupManifest manifest = await(target.readManifests(worldId, await(target.listSnapshots(Optional.of(worldId)))))
+                .get(intact);
+        try (Stream<Path> objects = Files.walk(target.repositoryFor(worldId).resolve("lfs/objects"))) {
+            for (Path object : objects.filter(Files::isRegularFile).toList()) {
+                Files.delete(object);
+            }
+        }
+        GitVerification hydrated = await(target.hydrateExternalSnapshot(
+                worldId, intact, manifest, commit(target, worldId, intact), remote.toString()));
+        assertTrue(hydrated.valid(), hydrated.message());
+    }
+
+    @Test
+    void aRefUpdateThatFailsAfterItAppliedStillPublishesTheSnapshot() throws Exception {
+        GitCommandRunner lostAnswer = refUpdate(true, "fatal: the connection was lost");
+        GitCommandRunner neverApplied = refUpdate(false, "fatal: unable to lock the ref");
+        WorldId published = WorldId.create();
+        WorldId refused = WorldId.create();
+
+        DestinationResult applied = new WorldGitSnapshotStore(
+                        settings("lost", GitBackendSettings.DEFAULT_LFS_PATTERNS), Map.of(), lostAnswer, executor)
+                .createBackup(capture(world("Lost"), published, START), ProgressListener.NO_OP);
+        DestinationResult failed = new WorldGitSnapshotStore(
+                        settings("never", GitBackendSettings.DEFAULT_LFS_PATTERNS), Map.of(), neverApplied, executor)
+                .createBackup(capture(world("Never"), refused, START), ProgressListener.NO_OP);
+
+        assertEquals(DestinationStatus.SUCCESS, applied.status(), applied.message().orElse(""));
+        assertEquals(DestinationStatus.FAILED, failed.status());
+        assertTrue(failed.message().orElseThrow().contains("unable to lock"), failed.message().orElseThrow());
+    }
+
+    /** A cancel that arrives right after Git published the snapshot reports it as kept here, waiting for its upload. */
+    @Test
+    void aCancelRightAfterPublishStillReportsThePublishedSnapshot() throws Exception {
+        Path remote = bareRepository("cancel.git");
+        WorldId worldId = WorldId.create();
+        AtomicBoolean cancelled = new AtomicBoolean();
+        SystemGitCommandRunner system = new SystemGitCommandRunner();
+        GitCommandRunner cancelAfterPublish = new GitCommandRunner() {
+            @Override
+            public GitCommandResult run(GitCommand command) throws IOException, InterruptedException {
+                GitCommandResult result = system.run(command);
+                if (command.arguments().contains("update-ref") && command.arguments().contains("--stdin")
+                        && cancelled.compareAndSet(false, true)) {
+                    Thread.currentThread().interrupt();
+                }
+                return result;
+            }
+
+            @Override
+            public GitCommandResult stream(GitCommand command, OutputReader reader)
+                    throws IOException, InterruptedException, GitStorageException {
+                return system.stream(command, reader);
+            }
+        };
+        WorldGitSnapshotStore store = new WorldGitSnapshotStore(
+                settings("cancel", GitBackendSettings.DEFAULT_LFS_PATTERNS),
+                Map.of(worldId, remote.toString()),
+                cancelAfterPublish,
+                executor);
+
+        DestinationResult result = store.createBackup(capture(world("Cancel"), worldId, START), ProgressListener.NO_OP);
+        Thread.interrupted();
+
+        assertTrue(cancelled.get());
+        assertEquals(1, await(store.listSnapshots(Optional.of(worldId))).size());
+        assertEquals(DestinationStatus.PENDING_SYNC, result.status(), result.toString());
+    }
+
+    /**
+     * Git LFS writes what it downloads without flushing it. Every object a download added, or
+     * wrote again with another size, is flushed afterwards; objects that were there before are not.
+     */
+    @Test
+    void theLfsObjectsADownloadWroteAreFlushed() throws Exception {
+        GitBackendSettings settings = settings("flush", GitBackendSettings.DEFAULT_LFS_PATTERNS)
+                .withRepository(temporaryDirectory.resolve("flush/world.git"), Optional.empty());
+        GitLfsObjects lfs = new GitLfsObjects(new GitRepository(settings, new SystemGitCommandRunner()));
+        lfsObject(lfs, bytes(1_024, 3));
+        Path resized = lfsObject(lfs, bytes(2_048, 4));
+        Map<Path, Long> before = lfs.sizes();
+        Path added = lfsObject(lfs, bytes(512, 5));
+        Files.write(resized, bytes(1_000, 6));
+
+        assertEquals(Set.of(added, resized), lfs.flushAddedSince(before));
+    }
+
+    /** The system runner, except that every ref transaction reports a failure, after running or instead of it. */
+    private static GitCommandRunner refUpdate(boolean runIt, String error) {
+        SystemGitCommandRunner system = new SystemGitCommandRunner();
+        return new GitCommandRunner() {
+            @Override
+            public GitCommandResult run(GitCommand command) throws IOException, InterruptedException {
+                if (!command.arguments().contains("update-ref") || !command.arguments().contains("--stdin")) {
+                    return system.run(command);
+                }
+                if (runIt) {
+                    system.run(command);
+                }
+                return new GitCommandResult(128, "", error, false, false);
+            }
+
+            @Override
+            public GitCommandResult stream(GitCommand command, OutputReader reader)
+                    throws IOException, InterruptedException, GitStorageException {
+                return system.stream(command, reader);
+            }
+        };
+    }
+
+    private void assertRestores(WorldGitSnapshotStore store, BackupCapture capture, Path world) throws Exception {
+        Path staging = Files.createDirectories(temporaryDirectory.resolve("restore-" + capture.manifest().backupId()));
+        await(store.restoreSnapshot(capture.manifest().worldId(), capture.manifest().backupId(), capture.manifest(), staging));
+        assertEquals(TestCaptures.inventoryOf(world), TestCaptures.inventoryOf(staging));
+    }
+
+    private BackupId backup(WorldGitSnapshotStore store, Path world, WorldId worldId, Instant time) throws Exception {
+        BackupCapture capture = capture(world, worldId, time);
+        DestinationResult result = store.createBackup(capture, ProgressListener.NO_OP);
+        assertTrue(result.status() == DestinationStatus.SUCCESS, result.message().orElse(""));
+        return capture.manifest().backupId();
+    }
+
+    private static BackupCapture capture(Path world, WorldId worldId, Instant time) throws IOException {
+        WorldInventory inventory = TestCaptures.inventoryOf(world);
+        BackupManifest manifest = BackupManifest.create(BackupId.create(), worldId, world.getFileName().toString(),
+                Optional.empty(), time, BackupTrigger.MANUAL, inventory.fileCount(), inventory.byteCount(),
+                inventory.fileCount(), inventory.contentSha256(), inventory.inventorySha256(), Optional.empty());
+        return new BackupCapture(world, manifest, inventory);
+    }
+
+    /** A small world: LFS region and player files, a plain JSON file, and an empty file. */
+    private Path world(String name) throws IOException {
+        Path world = temporaryDirectory.resolve("worlds").resolve(name);
+        write(world.resolve("level.dat"), bytes(4_096, 1));
+        write(world.resolve("region/r.0.0.mca"), bytes(64 * 1_024, 2));
+        write(world.resolve("data/raids.json"), "{\"raids\":[]}".getBytes(StandardCharsets.UTF_8));
+        write(world.resolve("empty.txt"), new byte[0]);
+        return world;
+    }
+
+    private WorldGitSnapshotStore store(Map<WorldId, String> remotes) {
+        return store("storage", GitBackendSettings.DEFAULT_LFS_PATTERNS, remotes);
+    }
+
+    private WorldGitSnapshotStore store(String folder, List<String> lfsPatterns, Map<WorldId, String> remotes) {
+        return new WorldGitSnapshotStore(
+                settings(folder, lfsPatterns), remotes, new SystemGitCommandRunner(), executor);
+    }
+
+    private GitBackendSettings settings(String folder, List<String> lfsPatterns) {
+        return new GitBackendSettings(true, temporaryDirectory.resolve(folder).resolve("git Ω"), FolderOrigin.DEFAULT,
+                "git", "origin", Optional.empty(), lfsPatterns, Duration.ofSeconds(30), 4 * 1_024 * 1_024);
+    }
+
+    private String commit(WorldGitSnapshotStore store, WorldId worldId, BackupId backupId) throws Exception {
+        return git(store.repositoryFor(worldId), "rev-parse", GitSnapshot.refName(worldId, backupId)).trim();
+    }
+
+    /** The snapshot's files and their blobs, without its own manifest. */
+    private List<String> worldFiles(WorldGitSnapshotStore store, WorldId worldId, BackupId backupId) throws Exception {
+        return git(store.repositoryFor(worldId), "ls-tree", "-r", GitSnapshot.refName(worldId, backupId)).lines()
+                .filter(line -> !line.endsWith(GitTreeValidator.MANIFEST_PATH))
+                .toList();
+    }
+
+    private String remoteBranch(Path remote, BackupId backupId) throws Exception {
+        return git(remote, "for-each-ref", "--format=%(refname)", "refs/heads/backups/").lines()
+                .filter(line -> line.endsWith(backupId.toString()))
+                .findFirst()
+                .orElseThrow();
+    }
+
+    private long lfsObjects(WorldGitSnapshotStore store, WorldId worldId) throws IOException {
+        Path objects = store.repositoryFor(worldId).resolve("lfs/objects");
+        if (!Files.isDirectory(objects)) {
+            return 0;
+        }
+        try (Stream<Path> files = Files.walk(objects)) {
+            return files.filter(Files::isRegularFile).count();
+        }
+    }
+
+    /** Stores the bytes as the LFS object named by their SHA-256. */
+    private static Path lfsObject(GitLfsObjects lfs, byte[] contents) throws IOException {
+        Path object = lfs.path(Digests.hex(Digests.sha256().digest(contents)));
+        Files.createDirectories(object.getParent());
+        return Files.write(object, contents);
+    }
+
+    private static Path lfsObject(Path repository, byte[] contents) {
+        String sha256 = Digests.hex(Digests.sha256().digest(contents));
+        return repository.resolve("lfs/objects").resolve(sha256.substring(0, 2)).resolve(sha256.substring(2, 4)).resolve(sha256);
+    }
+
+    private Path bareRepository(String name) throws Exception {
+        Path repository = temporaryDirectory.resolve(name);
+        Files.createDirectories(repository);
+        git(repository, "init", "--bare", "--quiet");
+        return repository;
+    }
+
+    private String git(Path repository, String... arguments) throws Exception {
+        List<String> command = new ArrayList<>(List.of("git", "--git-dir=" + repository));
+        command.addAll(List.of(arguments));
+        Process process = new ProcessBuilder(command).directory(temporaryDirectory.toFile()).start();
+        byte[] output = process.getInputStream().readAllBytes();
+        String error = new String(process.getErrorStream().readAllBytes(), StandardCharsets.UTF_8);
+        assertTrue(process.waitFor(30, TimeUnit.SECONDS));
+        assertEquals(0, process.exitValue(), error);
+        return new String(output, StandardCharsets.ISO_8859_1);
+    }
+
+    private static void write(Path file, byte[] contents) throws IOException {
+        Files.createDirectories(file.getParent());
+        Files.write(file, contents);
+    }
+
+    private static void flipOneByte(Path file) throws IOException {
+        try (RandomAccessFile access = new RandomAccessFile(file.toFile(), "rw")) {
+            int value = access.read();
+            access.seek(0);
+            access.write(value ^ 0xFF);
+        }
+    }
+
+    private static List<Path> list(Path folder) throws IOException {
+        try (Stream<Path> children = Files.list(folder)) {
+            return children.toList();
+        }
+    }
+
+    private static byte[] bytes(int length, long seed) {
+        byte[] value = new byte[length];
+        new Random(seed).nextBytes(value);
+        return value;
+    }
+
+    private static boolean isWindows() {
+        return System.getProperty("os.name").startsWith("Windows");
+    }
+
+    private static <T> T await(CompletionStage<T> stage) throws Exception {
+        return stage.toCompletableFuture().get(60, TimeUnit.SECONDS);
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/management/CleanupIntegrationTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/management/CleanupIntegrationTest.java
index 3eac364..3eec862 100644
--- a/src/test/java/dev/ishaanko/worldarchive/storage/management/CleanupIntegrationTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/management/CleanupIntegrationTest.java
@@ -6,6 +6,7 @@
 
 import dev.ishaanko.worldarchive.catalog.FileBackupCatalog;
 import dev.ishaanko.worldarchive.catalog.FileBackupDeletionRegistry;
+import dev.ishaanko.worldarchive.config.FolderOrigin;
 import dev.ishaanko.worldarchive.config.GitDestinationConfig;
 import dev.ishaanko.worldarchive.config.StoragePolicy;
 import dev.ishaanko.worldarchive.config.TriggerConfig;
@@ -13,7 +14,8 @@
 import dev.ishaanko.worldarchive.config.WorldConfig;
 import dev.ishaanko.worldarchive.config.ZipDestinationConfig;
 import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.core.ProgressListener;
+import dev.ishaanko.worldarchive.core.LockingWorldOperationGate;
+import dev.ishaanko.worldarchive.core.TestCaptures;
 import dev.ishaanko.worldarchive.core.WorldInventory;
 import dev.ishaanko.worldarchive.importing.FileBackupImportService;
 import dev.ishaanko.worldarchive.importing.FileImportSourceRegistry;
@@ -24,6 +26,7 @@
 import dev.ishaanko.worldarchive.model.BackupTrigger;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.ProgressListener;
 import dev.ishaanko.worldarchive.model.SyncStatus;
 import dev.ishaanko.worldarchive.model.VerificationStatus;
 import dev.ishaanko.worldarchive.model.WorldId;
@@ -94,25 +97,24 @@ void setUp() throws Exception {
                 new GitBackendSettings(
                         true,
                         temporaryDirectory.resolve("git"),
+                        FolderOrigin.DEFAULT,
                         "git",
                         "origin",
                         Optional.empty(),
                         GitDestinationConfig.DEFAULT_LFS_PATTERNS,
                         GitBackendSettings.DEFAULT_COMMAND_TIMEOUT,
                         GitBackendSettings.DEFAULT_MAXIMUM_OUTPUT_BYTES),
-                Optional.empty(),
                 Map.of(worldId, remote.toUri().toString()),
                 new SystemGitCommandRunner(),
                 executor);
         Assumptions.assumeTrue(await(git.probeTools()).available(), "git and git-lfs required");
-        zipStore = new ZipBackupStore(temporaryDirectory.resolve("archives"));
+        zipStore = new ZipBackupStore(temporaryDirectory.resolve("archives"), FolderOrigin.DEFAULT);
         catalog = new FileBackupCatalog(temporaryDirectory.resolve("catalog.json"));
         deletions = new FileBackupDeletionRegistry(temporaryDirectory.resolve("deleted.txt"));
     }
 
     @AfterEach
     void tearDown() {
-        git.close();
         executor.shutdownNow();
     }
 
@@ -145,9 +147,9 @@ void unprotectedBackupsLoseLocalCopiesAndStayListedOnTheRemote() throws Exceptio
             BackupRecord record = catalog.find(removed).orElseThrow();
             assertEquals(List.of(DestinationType.GIT), record.result().destinations().stream()
                     .map(DestinationResult::destination).toList());
-            assertFalse(deletions.contains(removed));
+            assertFalse(deletions.marked().contains(removed));
         }
-        assertEquals(Set.of(newest), await(git.listCurrentSnapshots(worldId)).stream()
+        assertEquals(Set.of(newest), await(git.listSnapshots(Optional.of(worldId))).stream()
                 .map(snapshot -> snapshot.backupId()).collect(Collectors.toSet()));
         assertEquals(1, zipStore.listArchives().size());
         assertEquals(2, lfsObjectCount(), "only the newest snapshot's objects remain");
@@ -156,7 +158,7 @@ void unprotectedBackupsLoseLocalCopiesAndStayListedOnTheRemote() throws Exceptio
 
         imports().rebuildLocal().toCompletableFuture().get(30, TimeUnit.SECONDS);
         assertEquals(3, catalog.list(worldId).size());
-        assertEquals(1, await(git.listCurrentSnapshots(worldId)).size());
+        assertEquals(1, await(git.listSnapshots(Optional.of(worldId))).size());
     }
 
     @Test
@@ -167,7 +169,7 @@ void backupWithNoCopyLeftAnywhereLeavesTheCatalog() throws Exception {
                 remoteRef(newest));
         catalog.update(newest, record -> new BackupRecord(
                 record.manifest(),
-                BackupResult.aggregate(
+                new BackupResult(
                         newest,
                         worldId,
                         record.result().destinations().stream()
@@ -191,7 +193,7 @@ void backupWithNoCopyLeftAnywhereLeavesTheCatalog() throws Exception {
         assertEquals(Map.of(), result.failures());
 
         assertFalse(catalog.find(newest).isPresent());
-        assertTrue(deletions.contains(newest));
+        assertTrue(deletions.marked().contains(newest));
         BackupRecord kept = catalog.find(older).orElseThrow();
         assertEquals(
                 List.of(DestinationType.GIT, DestinationType.ZIP),
@@ -199,10 +201,53 @@ void backupWithNoCopyLeftAnywhereLeavesTheCatalog() throws Exception {
                         .map(DestinationResult::destination).toList(),
                 "the synchronized remote copy stays in the catalog");
         assertEquals(Set.of(older), remoteBackupIds());
-        assertTrue(await(git.listCurrentSnapshots(worldId)).isEmpty());
+        assertTrue(await(git.listSnapshots(Optional.of(worldId))).isEmpty());
         assertEquals(0, lfsObjectCount());
     }
 
+    @Test
+    void aLocalSnapshotThatNoListedBackupOwnsKeepsEveryProtectedLocalGitCopy() throws Exception {
+        BackupId older = backup(2, true);
+        BackupId newest = backup(1, true);
+        BackupId failedGit = backup(3, true);
+        catalog.update(failedGit, record -> new BackupRecord(record.manifest(), new BackupResult(failedGit, worldId,
+                List.of(DestinationResult.failed(DestinationType.GIT, "Git failed after the snapshot was published"),
+                        record.result().destinations().get(1)),
+                record.result().completedAt())));
+        snapshotOnly(4);
+
+        CleanupPlan plan = await(service(KEEP_ONLY_SAFETY_FLOOR).prepareCleanup(worldId));
+
+        Map<BackupId, CleanupItem> items = plan.items().stream()
+                .collect(Collectors.toMap(CleanupItem::backupId, item -> item));
+        assertFalse(items.containsKey(newest), "the protected newest backup keeps its local Git copy");
+        assertTrue(items.get(older).removeGit() && items.get(older).removeZip());
+        assertTrue(!items.get(failedGit).removeGit() && items.get(failedGit).removeZip());
+        assertFalse(plan.targetReachable());
+    }
+
+    @Test
+    void aRemoteThatLostTheSnapshotKeepsItsLastLocalGitCopy() throws Exception {
+        BackupId safety = backup(3, true);
+        BackupId protectedGitOnly = backup(1, false);
+        BackupId unprotectedGitOnly = backup(2, false);
+        nativeGit("--git-dir=" + remote, "update-ref", "-d", remoteRef(protectedGitOnly));
+        ManagedStorageService service = service(new StoragePolicy(1, 1, 0, 0));
+
+        CleanupPlan plan = await(service.prepareCleanup(worldId));
+        nativeGit("--git-dir=" + remote, "update-ref", "-d", remoteRef(unprotectedGitOnly));
+        CleanupResult result = await(service.applyCleanup(new CleanupRequest(plan.confirmationToken(),
+                plan.items().stream().map(CleanupItem::backupId).collect(Collectors.toSet()))));
+
+        assertTrue(plan.items().stream().noneMatch(item -> item.backupId().equals(protectedGitOnly)),
+                "the preview checks the remote before offering a protected backup's last local copy");
+        assertTrue(result.failures().get(unprotectedGitOnly).contains("no longer has this backup"),
+                result.failures().toString());
+        assertEquals(Set.of(safety, protectedGitOnly, unprotectedGitOnly), await(git.listSnapshots(Optional.of(worldId)))
+                .stream().map(snapshot -> snapshot.backupId()).collect(Collectors.toSet()));
+        assertTrue(catalog.find(unprotectedGitOnly).isPresent());
+    }
+
     private BackupId backup(int daysAgo, boolean withZip) throws Exception {
         BackupId backupId = BackupId.create();
         Path source = Files.createDirectories(temporaryDirectory.resolve("world-" + backupId));
@@ -224,23 +269,31 @@ private BackupId backup(int daysAgo, boolean withZip) throws Exception {
                 inventory.byteCount(),
                 inventory.fileCount(),
                 inventory.contentSha256(),
-                inventory.inventorySha256());
-        BackupCapture capture = new BackupCapture(source, manifest);
-        DestinationResult gitResult = await(git.createBackup(capture, ProgressListener.NO_OP));
+                inventory.inventorySha256(),
+                Optional.empty());
+        BackupCapture capture = TestCaptures.of(source, manifest);
+        DestinationResult gitResult = git.createBackup(capture, ProgressListener.NO_OP);
         assertEquals(SyncStatus.SYNCED, gitResult.syncStatus());
         List<DestinationResult> destinations = new ArrayList<>();
         destinations.add(gitResult);
         if (withZip) {
-            ZipBackupArtifact artifact = zipStore.create(capture);
+            ZipBackupArtifact artifact = zipStore.create(capture, bytes -> {
+            });
             destinations.add(DestinationResult.success(DestinationType.ZIP, artifact.artifactId())
                     .withVerification(VerificationStatus.VERIFIED));
         }
         catalog.add(new BackupRecord(
                 manifest,
-                BackupResult.aggregate(backupId, worldId, destinations, NOW)));
+                new BackupResult(backupId, worldId, destinations, NOW)));
         return backupId;
     }
 
+    /** A Git snapshot of the world that the catalog does not list. */
+    private void snapshotOnly(int daysAgo) throws Exception {
+        BackupId backupId = backup(daysAgo, false);
+        catalog.updateAll(Map.of(backupId, current -> Optional.empty()));
+    }
+
     private ManagedStorageService service(StoragePolicy policy) {
         WorldConfig world = new WorldConfig(
                 worldId,
@@ -250,7 +303,6 @@ private ManagedStorageService service(StoragePolicy policy) {
                 Optional.empty(),
                 policy);
         WorldArchiveConfig config = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
                 TriggerConfig.defaults(),
                 GitDestinationConfig.defaults(),
                 ZipDestinationConfig.defaults(),
@@ -260,11 +312,9 @@ private ManagedStorageService service(StoragePolicy policy) {
                 catalog,
                 deletions,
                 git,
-                zipStore,
+                ignored -> zipStore,
                 new FileStorageHistoryStore(temporaryDirectory.resolve("history")),
-                new FileStorageReviewStore(temporaryDirectory.resolve("reviews")),
-                ignored -> () -> {
-                },
+                new LockingWorldOperationGate(),
                 executor,
                 Clock.fixed(NOW, ZoneOffset.UTC),
                 ZoneOffset.UTC);
@@ -290,7 +340,9 @@ public ZipBackupStore defaultStore() {
                 git,
                 stores,
                 () -> Set.of(worldId),
-                executor);
+                new LockingWorldOperationGate(),
+                executor,
+                Clock.fixed(NOW, ZoneOffset.UTC));
     }
 
     private String remoteRef(BackupId backupId) throws Exception {
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/management/ManagedStorageServiceTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/management/ManagedStorageServiceTest.java
index 2802b44..87e09b6 100644
--- a/src/test/java/dev/ishaanko/worldarchive/storage/management/ManagedStorageServiceTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/management/ManagedStorageServiceTest.java
@@ -3,22 +3,22 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertInstanceOf;
-import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import dev.ishaanko.worldarchive.catalog.BackupCatalog;
-import dev.ishaanko.worldarchive.catalog.BackupDeletionRegistry;
+import dev.ishaanko.worldarchive.catalog.FileBackupCatalog;
 import dev.ishaanko.worldarchive.catalog.FileBackupDeletionRegistry;
+import dev.ishaanko.worldarchive.config.FolderOrigin;
 import dev.ishaanko.worldarchive.config.GitDestinationConfig;
 import dev.ishaanko.worldarchive.config.StoragePolicy;
 import dev.ishaanko.worldarchive.config.TriggerConfig;
 import dev.ishaanko.worldarchive.config.WorldArchiveConfig;
 import dev.ishaanko.worldarchive.config.WorldConfig;
 import dev.ishaanko.worldarchive.config.ZipDestinationConfig;
-import dev.ishaanko.worldarchive.core.BackupCapture;
+import dev.ishaanko.worldarchive.core.LockingWorldOperationGate;
+import dev.ishaanko.worldarchive.core.TestCaptures;
 import dev.ishaanko.worldarchive.core.WorldInventory;
-import dev.ishaanko.worldarchive.core.WorldOperationGate;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupManifest;
 import dev.ishaanko.worldarchive.model.BackupRecord;
@@ -26,29 +26,22 @@
 import dev.ishaanko.worldarchive.model.BackupTrigger;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.SensitiveDataRedactor;
-import dev.ishaanko.worldarchive.model.SyncStatus;
 import dev.ishaanko.worldarchive.model.VerificationStatus;
 import dev.ishaanko.worldarchive.model.WorldId;
 import dev.ishaanko.worldarchive.storage.git.GitBackendSettings;
-import dev.ishaanko.worldarchive.storage.git.GitCommandResult;
-import dev.ishaanko.worldarchive.storage.git.GitCommandRunner;
-import dev.ishaanko.worldarchive.storage.git.GitSnapshot;
+import dev.ishaanko.worldarchive.storage.git.SystemGitCommandRunner;
 import dev.ishaanko.worldarchive.storage.git.WorldGitSnapshotStore;
 import dev.ishaanko.worldarchive.storage.zip.ZipBackupArtifact;
 import dev.ishaanko.worldarchive.storage.zip.ZipBackupStore;
+import dev.ishaanko.worldarchive.storage.zip.ZipBackupStoreResolver;
 import java.io.IOException;
-import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.security.MessageDigest;
-import java.security.NoSuchAlgorithmException;
 import java.time.Clock;
 import java.time.Duration;
 import java.time.Instant;
 import java.time.ZoneId;
 import java.time.ZoneOffset;
-import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
@@ -59,578 +52,258 @@
 import java.util.concurrent.Executors;
 import java.util.concurrent.TimeUnit;
 import java.util.function.UnaryOperator;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
+/** Storage measurement, previews and cleanup failures on real ZIP archives and catalogs. */
 final class ManagedStorageServiceTest {
     private static final Instant NOW = Instant.parse("2026-07-31T12:00:00Z");
 
-    private static final StoragePolicy CLEANUP_POLICY =
-            new StoragePolicy(1, 0, 0, 0);
-
-    private static final String SECRET = "top-secret-value";
-
-    private static final GitCommandRunner EMPTY_GIT = command ->
-            new GitCommandResult(0, "", "", false, false);
+    /** One byte of budget: cleanup goes as far as the keep settings allow. */
+    private static final StoragePolicy OVER_BUDGET = new StoragePolicy(1, 0, 0, 0);
 
     @TempDir
     Path temporaryDirectory;
 
-    @Test
-    void overviewSurvivesStorageHistoryAppendFailure() throws Exception {
-        WorldId worldId = WorldId.create();
-        Path blockedHistory = temporaryDirectory.resolve("blocked-history");
-        Files.writeString(blockedHistory, "not a directory", StandardCharsets.UTF_8);
-        ZipBackupStore zipStore = new ZipBackupStore(
-                temporaryDirectory.resolve("archives"));
-
-        try (Fixture fixture = fixture(
-                worldId,
-                StoragePolicy.defaults(),
-                new InMemoryCatalog(),
-                zipStore,
-                blockedHistory,
-                Clock.fixed(NOW, ZoneOffset.UTC),
-                EMPTY_GIT)) {
-            StorageOverview overview = await(fixture.service().overview(worldId));
-
-            assertEquals(0, overview.totalBytes());
-            assertEquals(StorageForecast.State.DISABLED, overview.forecast().state());
-        }
-    }
+    private final ExecutorService executor = Executors.newVirtualThreadPerTaskExecutor();
 
-    @Test
-    void cleanupPreservesZipWhenCatalogRemovalFails()
-            throws Exception {
-        WorldId worldId = WorldId.create();
-        ZipBackupStore zipStore = new ZipBackupStore(
-                temporaryDirectory.resolve("archives"));
-        CreatedBackup old = createBackup(
-                zipStore,
-                worldId,
-                NOW.minus(Duration.ofDays(2)),
-                "old world");
-        CreatedBackup safety = createBackup(
-                zipStore,
-                worldId,
-                NOW.minus(Duration.ofDays(1)),
-                "safe world");
-        InMemoryCatalog catalog = new InMemoryCatalog(old.record(), safety.record());
-        catalog.failRemoval(old.backupId());
-        FileBackupDeletionRegistry deletions = new FileBackupDeletionRegistry(
-                temporaryDirectory.resolve("deleted-backups.txt"));
-        Path blockedHistory = temporaryDirectory.resolve("blocked-history");
-        Files.writeString(blockedHistory, "not a directory", StandardCharsets.UTF_8);
-
-        try (Fixture fixture = fixture(
-                worldId,
-                CLEANUP_POLICY,
-                catalog,
-                deletions,
-                zipStore,
-                blockedHistory,
-                Clock.fixed(NOW, ZoneOffset.UTC),
-                EMPTY_GIT)) {
-            CleanupPlan plan = await(fixture.service().prepareCleanup(worldId));
-            CleanupResult result = await(fixture.service().applyCleanup(
-                    new CleanupRequest(
-                            plan.confirmationToken(),
-                            Set.of(old.backupId()))));
-
-            String failure = result.failures().get(old.backupId());
-            assertTrue(failure.contains(SensitiveDataRedactor.REDACTED));
-            assertFalse(failure.contains(SECRET));
-            assertTrue(Files.exists(old.artifact().archivePath()));
-            assertTrue(Files.exists(safety.artifact().archivePath()));
-            assertTrue(catalog.find(old.backupId()).isPresent());
-            assertFalse(deletions.contains(old.backupId()));
-        }
-    }
+    private final WorldId worldId = WorldId.create();
 
-    @Test
-    void newPreviewInvalidatesThePreviousPreviewForTheSameWorld()
-            throws Exception {
-        WorldId worldId = WorldId.create();
-        ZipBackupStore zipStore = new ZipBackupStore(
-                temporaryDirectory.resolve("archives"));
-        CreatedBackup old = createBackup(
-                zipStore,
-                worldId,
-                NOW.minus(Duration.ofDays(2)),
-                "old world");
-        CreatedBackup safety = createBackup(
-                zipStore,
-                worldId,
-                NOW.minus(Duration.ofDays(1)),
-                "safe world");
-        InMemoryCatalog catalog = new InMemoryCatalog(old.record(), safety.record());
-
-        try (Fixture fixture = fixture(
-                worldId,
-                CLEANUP_POLICY,
-                catalog,
-                zipStore,
-                temporaryDirectory.resolve("history"),
-                Clock.fixed(NOW, ZoneOffset.UTC),
-                EMPTY_GIT)) {
-            CleanupPlan first = await(fixture.service().prepareCleanup(worldId));
-            CleanupPlan second = await(fixture.service().prepareCleanup(worldId));
-
-            assertNotEquals(first.confirmationToken(), second.confirmationToken());
-            IOException failure = awaitIoFailure(fixture.service().applyCleanup(
-                    new CleanupRequest(
-                            first.confirmationToken(),
-                            Set.of(old.backupId()))));
-            assertTrue(failure.getMessage().contains("invalid"));
-            assertTrue(Files.exists(old.artifact().archivePath()));
-
-            CleanupResult result = await(fixture.service().applyCleanup(
-                    new CleanupRequest(
-                            second.confirmationToken(),
-                            Set.of(old.backupId()))));
-            assertTrue(result.failures().isEmpty());
-            assertFalse(Files.exists(old.artifact().archivePath()));
-        }
+    private final MutableClock clock = new MutableClock(NOW);
+
+    @AfterEach
+    void stopExecutor() {
+        executor.shutdownNow();
     }
 
     @Test
-    void expiredPreviewIsRejectedBeforeCleanupStarts() throws Exception {
-        WorldId worldId = WorldId.create();
-        ZipBackupStore zipStore = new ZipBackupStore(
-                temporaryDirectory.resolve("archives"));
-        CreatedBackup old = createBackup(
-                zipStore,
-                worldId,
-                NOW.minus(Duration.ofDays(2)),
-                "old world");
-        CreatedBackup safety = createBackup(
-                zipStore,
-                worldId,
-                NOW.minus(Duration.ofDays(1)),
-                "safe world");
-        MutableClock clock = new MutableClock(NOW, ZoneOffset.UTC);
-
-        try (Fixture fixture = fixture(
-                worldId,
-                CLEANUP_POLICY,
-                new InMemoryCatalog(old.record(), safety.record()),
-                zipStore,
-                temporaryDirectory.resolve("history"),
-                clock,
-                EMPTY_GIT)) {
-            CleanupPlan plan = await(fixture.service().prepareCleanup(worldId));
-            clock.advance(Duration.ofMinutes(16));
-
-            IOException failure = awaitIoFailure(fixture.service().applyCleanup(
-                    new CleanupRequest(
-                            plan.confirmationToken(),
-                            Set.of(old.backupId()))));
-
-            assertTrue(failure.getMessage().contains("expired"));
-            assertTrue(Files.exists(old.artifact().archivePath()));
-        }
+    void nothingIsDeletedWhenTheBackupListCannotBeSaved() throws Exception {
+        ZipBackupStore zips = new ZipBackupStore(temporaryDirectory.resolve("archives"), FolderOrigin.DEFAULT);
+        CatalogThatCannotSave catalog = new CatalogThatCannotSave(temporaryDirectory.resolve("catalog.json"));
+        ZipBackupArtifact old = backup(zips, catalog, NOW.minus(Duration.ofDays(2)));
+        ZipBackupArtifact newest = backup(zips, catalog, NOW.minus(Duration.ofDays(1)));
+        FileBackupDeletionRegistry deletions = new FileBackupDeletionRegistry(temporaryDirectory.resolve("deleted.txt"));
+        ManagedStorageService service = service(OVER_BUDGET, catalog, deletions, zips);
+        CleanupPlan plan = await(service.prepareCleanup(worldId));
+        catalog.failSaving = true;
+
+        ExecutionException failure = assertThrows(ExecutionException.class, () -> await(service.applyCleanup(
+                new CleanupRequest(plan.confirmationToken(), Set.of(old.manifest().backupId())))));
+
+        assertInstanceOf(IOException.class, failure.getCause());
+        assertTrue(Files.exists(old.archivePath()) && Files.exists(newest.archivePath()));
+        assertEquals(2, catalog.list(worldId).size());
+        assertEquals(Set.of(), deletions.marked());
     }
 
     @Test
-    void overviewCountsCompleteZipArchiveWithoutCatalogRecord()
-            throws Exception {
-        WorldId worldId = WorldId.create();
-        ZipBackupStore zipStore = new ZipBackupStore(
-                temporaryDirectory.resolve("archives"));
-        CreatedBackup orphan = createBackup(
-                zipStore,
-                worldId,
-                NOW.minus(Duration.ofDays(1)),
-                "orphan world");
-        long expectedBytes = Math.addExact(
-                Files.size(orphan.artifact().archivePath()),
-                Files.size(orphan.artifact().checksumPath()));
-
-        try (Fixture fixture = fixture(
-                worldId,
-                StoragePolicy.defaults(),
-                new InMemoryCatalog(),
-                zipStore,
-                temporaryDirectory.resolve("history"),
-                Clock.fixed(NOW, ZoneOffset.UTC),
-                EMPTY_GIT)) {
-            StorageOverview overview = await(fixture.service().overview(worldId));
-
-            assertEquals(expectedBytes, overview.zipBytes());
-            assertEquals(expectedBytes, overview.totalBytes());
+    void onlyTheNewestPreviewOfAWorldCanBeAppliedAndOnlyBeforeItExpires() throws Exception {
+        ZipBackupStore zips = new ZipBackupStore(temporaryDirectory.resolve("archives"), FolderOrigin.DEFAULT);
+        FileBackupCatalog catalog = new FileBackupCatalog(temporaryDirectory.resolve("catalog.json"));
+        ZipBackupArtifact old = backup(zips, catalog, NOW.minus(Duration.ofDays(2)));
+        backup(zips, catalog, NOW.minus(Duration.ofDays(1)));
+        ManagedStorageService service = service(OVER_BUDGET, catalog, deletions(), zips);
+        CleanupPlan replaced = await(service.prepareCleanup(worldId));
+        CleanupPlan expired = await(service.prepareCleanup(worldId));
+        clock.advance(Duration.ofMinutes(16));
+
+        for (CleanupPlan stale : List.of(replaced, expired)) {
+            ExecutionException refused = assertThrows(ExecutionException.class, () -> await(service.applyCleanup(
+                    new CleanupRequest(stale.confirmationToken(), Set.of(old.manifest().backupId())))));
+            assertTrue(refused.getCause().getMessage().contains("invalid, expired"), refused.getCause().getMessage());
         }
+        assertTrue(Files.exists(old.archivePath()));
+        CleanupPlan current = await(service.prepareCleanup(worldId));
+        CleanupResult result = await(service.applyCleanup(
+                new CleanupRequest(current.confirmationToken(), Set.of(old.manifest().backupId()))));
+
+        assertEquals(Map.of(), result.failures());
+        assertFalse(Files.exists(old.archivePath()));
+        assertTrue(catalog.find(old.manifest().backupId()).isEmpty());
     }
 
     @Test
-    void orphanGitRefDisablesWholeGitHistoryCleanup() throws Exception {
-        WorldId worldId = WorldId.create();
-        BackupId orphanId = BackupId.create();
-        ZipBackupStore zipStore = new ZipBackupStore(
-                temporaryDirectory.resolve("archives"));
-        CreatedBackup safety = createBackup(
-                zipStore,
-                worldId,
-                NOW.minus(Duration.ofDays(1)),
-                "safe world");
-        String listing = GitSnapshot.refName(worldId, orphanId)
-                + "\t" + "a".repeat(40)
-                + "\t" + NOW.getEpochSecond()
-                + System.lineSeparator();
-        GitCommandRunner orphanGit = command -> {
-            if (command.arguments().contains("rev-parse")) {
-                return new GitCommandResult(0, "true\n", "", false, false);
-            }
-            if (command.arguments().contains("for-each-ref")) {
-                return new GitCommandResult(0, listing, "", false, false);
-            }
-            return new GitCommandResult(0, "", "", false, false);
-        };
-
-        try (Fixture fixture = fixture(
-                worldId,
-                CLEANUP_POLICY,
-                new InMemoryCatalog(safety.record()),
-                zipStore,
-                temporaryDirectory.resolve("history"),
-                Clock.fixed(NOW, ZoneOffset.UTC),
-                orphanGit)) {
-            Path repository = Files.createDirectories(
-                    fixture.git().repositoryFor(worldId));
-            Files.write(repository.resolve("objects.bin"), new byte[4_096]);
-
-            CleanupPlan plan = await(fixture.service().prepareCleanup(worldId));
-
-            assertTrue(plan.items().isEmpty());
-            assertFalse(plan.targetReachable());
-        }
+    void theOverviewCountsArchivesThatTheCatalogDoesNotList() throws Exception {
+        ZipBackupStore zips = new ZipBackupStore(temporaryDirectory.resolve("archives"), FolderOrigin.DEFAULT);
+        FileBackupCatalog unlisted = new FileBackupCatalog(temporaryDirectory.resolve("other-catalog.json"));
+        ZipBackupArtifact orphan = backup(zips, unlisted, NOW.minus(Duration.ofDays(1)));
+        FileBackupCatalog catalog = new FileBackupCatalog(temporaryDirectory.resolve("catalog.json"));
+
+        StorageOverview overview = await(service(StoragePolicy.defaults(), catalog, deletions(), zips).overview(worldId));
+
+        long expected = Files.size(orphan.archivePath())
+                + Files.size(orphan.archivePath().resolveSibling(orphan.archivePath().getFileName() + ".sha256"));
+        assertEquals(expected, overview.zipBytes());
+        assertEquals(expected, overview.totalBytes());
     }
 
     @Test
-    void staleSynchronizedStatusCannotAuthorizeLastLocalGitCopyRemoval()
-            throws Exception {
-        WorldId worldId = WorldId.create();
-        BackupId gitBackupId = BackupId.create();
-        ZipBackupStore zipStore = new ZipBackupStore(
-                temporaryDirectory.resolve("archives"));
-        CreatedBackup safety = createBackup(
-                zipStore,
-                worldId,
-                NOW.minus(Duration.ofDays(1)),
-                "safe world");
-        BackupRecord gitRecord = gitRecord(
-                worldId,
-                gitBackupId,
-                NOW.minus(Duration.ofDays(2)));
-        String listing = GitSnapshot.refName(worldId, gitBackupId)
-                + "\t" + "a".repeat(40)
-                + "\t" + gitRecord.manifest().createdAt().getEpochSecond()
-                + System.lineSeparator();
-        GitCommandRunner localGit = command -> {
-            if (command.arguments().contains("rev-parse")) {
-                return new GitCommandResult(0, "true\n", "", false, false);
-            }
-            if (command.arguments().contains("for-each-ref")) {
-                return new GitCommandResult(0, listing, "", false, false);
-            }
-            return new GitCommandResult(0, "", "", false, false);
-        };
-
-        try (Fixture fixture = fixture(
-                worldId,
-                new StoragePolicy(1, 2, 0, 0),
-                new InMemoryCatalog(safety.record(), gitRecord),
-                zipStore,
-                temporaryDirectory.resolve("history"),
-                Clock.fixed(NOW, ZoneOffset.UTC),
-                localGit)) {
-            Path repository = Files.createDirectories(
-                    fixture.git().repositoryFor(worldId));
-            Files.write(repository.resolve("objects.bin"), new byte[4_096]);
-
-            CleanupPlan plan = await(fixture.service().prepareCleanup(worldId));
-
-            assertTrue(plan.items().stream()
-                    .noneMatch(CleanupItem::removeGit));
-            assertTrue(Files.exists(repository.resolve("objects.bin")));
-        }
+    void theReviewNoticeNeedsABudgetAndCostsNoDiskAccessWithoutOne() throws Exception {
+        ZipBackupStore zips = new ZipBackupStore(temporaryDirectory.resolve("archives"), FolderOrigin.DEFAULT);
+        CatalogThatCannotSave catalog = new CatalogThatCannotSave(temporaryDirectory.resolve("catalog.json"));
+        backup(zips, catalog, NOW.minus(Duration.ofDays(1)));
+        catalog.failReading = true;
+
+        assertFalse(await(service(StoragePolicy.defaults(), catalog, deletions(), zips).claimReviewNotice(worldId)));
+
+        catalog.failReading = false;
+        assertTrue(await(service(OVER_BUDGET, catalog, deletions(), zips).claimReviewNotice(worldId)));
     }
 
-    private Fixture fixture(
-            WorldId worldId,
-            StoragePolicy policy,
-            BackupCatalog catalog,
-            ZipBackupStore zipStore,
-            Path historyDirectory,
-            Clock clock,
-            GitCommandRunner gitRunner) {
-        return fixture(
-                worldId,
-                policy,
-                catalog,
-                BackupDeletionRegistry.NONE,
-                zipStore,
-                historyDirectory,
-                clock,
-                gitRunner);
+    @Test
+    void theForecastHistoryKeepsOneSamplePerLocalDay() throws Exception {
+        FileStorageHistoryStore history = new FileStorageHistoryStore(temporaryDirectory.resolve("history"));
+        ZoneId newYork = ZoneId.of("America/New_York");
+        Instant eveningBefore = Instant.parse("2026-07-31T01:00:00Z");
+        Instant morning = Instant.parse("2026-07-31T13:00:00Z");
+        Instant evening = Instant.parse("2026-08-01T02:00:00Z");
+
+        history.record(worldId, new StorageSample(eveningBefore, 10), newYork);
+        history.record(worldId, new StorageSample(morning, 20), newYork);
+        history.record(worldId, new StorageSample(evening, 30), newYork);
+
+        assertEquals(List.of(new StorageSample(eveningBefore, 10), new StorageSample(evening, 30)),
+                history.load(worldId));
     }
 
-    private Fixture fixture(
-            WorldId worldId,
+    private ManagedStorageService service(
             StoragePolicy policy,
             BackupCatalog catalog,
-            BackupDeletionRegistry deletions,
-            ZipBackupStore zipStore,
-            Path historyDirectory,
-            Clock clock,
-            GitCommandRunner gitRunner) {
-        ExecutorService gitExecutor = Executors.newSingleThreadExecutor();
-        WorldGitSnapshotStore git = new WorldGitSnapshotStore(
-                new GitBackendSettings(
-                        true,
-                        temporaryDirectory.resolve("git"),
-                        "git",
-                        "origin",
-                        Optional.empty(),
-                        GitDestinationConfig.DEFAULT_LFS_PATTERNS,
-                        GitBackendSettings.DEFAULT_COMMAND_TIMEOUT,
-                        GitBackendSettings.DEFAULT_MAXIMUM_OUTPUT_BYTES),
-                Optional.empty(),
-                gitRunner,
-                gitExecutor);
+            FileBackupDeletionRegistry deletions,
+            ZipBackupStore zips) {
         WorldConfig world = new WorldConfig(
-                worldId,
-                true,
-                temporaryDirectory.resolve("configured-world"),
-                Optional.empty(),
-                Optional.empty(),
-                policy);
-        WorldArchiveConfig configuration = new WorldArchiveConfig(
-                WorldArchiveConfig.CURRENT_SCHEMA_VERSION,
-                TriggerConfig.defaults(),
-                GitDestinationConfig.defaults(),
-                ZipDestinationConfig.defaults(),
-                List.of(world));
-        ManagedStorageService service = new ManagedStorageService(
-                () -> configuration,
+                worldId, true, temporaryDirectory.resolve("world"), Optional.empty(), Optional.empty(), policy);
+        WorldArchiveConfig config = new WorldArchiveConfig(
+                TriggerConfig.defaults(), GitDestinationConfig.defaults(), ZipDestinationConfig.defaults(), List.of(world));
+        WorldGitSnapshotStore git = new WorldGitSnapshotStore(
+                new GitBackendSettings(true, temporaryDirectory.resolve("git"), FolderOrigin.DEFAULT, "git", "origin",
+                        Optional.empty(), GitDestinationConfig.DEFAULT_LFS_PATTERNS,
+                        GitBackendSettings.DEFAULT_COMMAND_TIMEOUT, GitBackendSettings.DEFAULT_MAXIMUM_OUTPUT_BYTES),
+                Map.of(),
+                new SystemGitCommandRunner(),
+                executor);
+        ZipBackupStoreResolver stores = ignored -> zips;
+        return new ManagedStorageService(
+                () -> config,
                 catalog,
                 deletions,
                 git,
-                zipStore,
-                new FileStorageHistoryStore(historyDirectory),
-                new FileStorageReviewStore(temporaryDirectory.resolve("reviews")),
-                noOpGate(),
-                Runnable::run,
+                stores,
+                new FileStorageHistoryStore(temporaryDirectory.resolve("history")),
+                new LockingWorldOperationGate(),
+                executor,
                 clock,
                 ZoneOffset.UTC);
-        return new Fixture(service, git, gitExecutor);
     }
 
-    private CreatedBackup createBackup(
-            ZipBackupStore store,
-            WorldId worldId,
-            Instant createdAt,
-            String contents) throws Exception {
-        BackupId backupId = BackupId.create();
-        Path source = Files.createDirectories(
-                temporaryDirectory.resolve("source-" + backupId));
-        byte[] bytes = contents.getBytes(StandardCharsets.UTF_8);
-        Files.write(source.resolve("level.dat"), bytes);
-        WorldInventory inventory = WorldInventory.create(List.of(
-                new WorldInventory.Entry("level.dat", bytes.length, sha256(bytes))));
-        BackupManifest manifest = BackupManifest.create(
-                backupId,
-                worldId,
-                "Storage Test World",
-                Optional.empty(),
-                createdAt,
-                BackupTrigger.SCHEDULED,
-                inventory.fileCount(),
-                inventory.byteCount(),
-                inventory.fileCount(),
-                inventory.contentSha256(),
-                inventory.inventorySha256());
-        ZipBackupArtifact artifact = store.create(
-                new BackupCapture(source, manifest));
-        DestinationResult destination = DestinationResult.success(
-                        DestinationType.ZIP,
-                        artifact.artifactId())
-                .withVerification(VerificationStatus.VERIFIED);
-        BackupRecord record = new BackupRecord(
-                manifest,
-                BackupResult.aggregate(
-                        backupId,
-                        worldId,
-                        List.of(destination),
-                        createdAt.plusSeconds(1)));
-        return new CreatedBackup(record, artifact);
+    private FileBackupDeletionRegistry deletions() {
+        return new FileBackupDeletionRegistry(temporaryDirectory.resolve("deleted.txt"));
     }
 
-    private static BackupRecord gitRecord(
-            WorldId worldId,
-            BackupId backupId,
-            Instant createdAt) {
-        BackupManifest manifest = BackupManifest.create(
-                backupId,
-                worldId,
-                "Git Storage Test World",
-                Optional.empty(),
-                createdAt,
-                BackupTrigger.SCHEDULED,
-                1,
-                10,
-                1,
-                "c".repeat(64),
-                "d".repeat(64));
-        DestinationResult destination = DestinationResult.success(
-                        DestinationType.GIT,
-                        GitSnapshot.refName(worldId, backupId))
-                .withSync(SyncStatus.SYNCED);
-        return new BackupRecord(
-                manifest,
-                BackupResult.aggregate(
-                        backupId,
-                        worldId,
-                        List.of(destination),
-                        createdAt.plusSeconds(1)));
+    /** A verified ZIP backup of the world, listed in the catalog. */
+    private ZipBackupArtifact backup(ZipBackupStore zips, BackupCatalog catalog, Instant createdAt) throws Exception {
+        BackupId backupId = BackupId.create();
+        Path source = Files.createDirectories(temporaryDirectory.resolve("source-" + backupId));
+        Files.writeString(source.resolve("level.dat"), "world at " + createdAt);
+        WorldInventory inventory = TestCaptures.inventoryOf(source);
+        BackupManifest manifest = new BackupManifest(BackupManifest.CURRENT_FORMAT_VERSION, backupId, worldId,
+                "Storage Test World", Optional.empty(), createdAt, BackupTrigger.SCHEDULED, inventory.fileCount(),
+                inventory.byteCount(), inventory.fileCount(), inventory.contentSha256(), inventory.inventorySha256(),
+                Optional.empty());
+        ZipBackupArtifact artifact = zips.create(TestCaptures.of(source, manifest), bytes -> {
+        });
+        catalog.add(new BackupRecord(manifest, new BackupResult(backupId, worldId, List.of(
+                DestinationResult.success(DestinationType.ZIP, artifact.artifactId())
+                        .withVerification(VerificationStatus.VERIFIED)), createdAt.plusSeconds(1))));
+        return artifact;
     }
 
-    private static WorldOperationGate noOpGate() {
-        return worldId -> () -> {
-        };
+    private static <T> T await(CompletionStage<T> stage) throws Exception {
+        return stage.toCompletableFuture().get(30, TimeUnit.SECONDS);
     }
 
-    private static String sha256(byte[] bytes) {
-        try {
-            return java.util.HexFormat.of().formatHex(
-                    MessageDigest.getInstance("SHA-256").digest(bytes));
-        } catch (NoSuchAlgorithmException exception) {
-            throw new IllegalStateException(
-                    "The Java runtime does not provide SHA-256",
-                    exception);
-        }
-    }
+    /** The real catalog, which a test can make fail to save or to read, as a full or failing disk does. */
+    private static final class CatalogThatCannotSave implements BackupCatalog {
+        private final FileBackupCatalog catalog;
 
-    private static <T> T await(CompletionStage<T> stage) throws Exception {
-        return stage.toCompletableFuture().get(10, TimeUnit.SECONDS);
-    }
+        private volatile boolean failSaving;
 
-    private static IOException awaitIoFailure(CompletionStage<?> stage) {
-        ExecutionException failure = assertThrows(
-                ExecutionException.class,
-                () -> stage.toCompletableFuture().get(10, TimeUnit.SECONDS));
-        return assertInstanceOf(IOException.class, failure.getCause());
-    }
+        private volatile boolean failReading;
 
-    private record CreatedBackup(
-            BackupRecord record,
-            ZipBackupArtifact artifact) {
-        BackupId backupId() {
-            return record.manifest().backupId();
+        private CatalogThatCannotSave(Path file) {
+            this.catalog = new FileBackupCatalog(file);
         }
-    }
 
-    private record Fixture(
-            ManagedStorageService service,
-            WorldGitSnapshotStore git,
-            ExecutorService gitExecutor) implements AutoCloseable {
         @Override
-        public void close() {
-            git.close();
-            gitExecutor.shutdownNow();
+        public void add(BackupRecord record) throws IOException {
+            catalog.add(record);
         }
-    }
 
-    private static final class MutableClock extends Clock {
-        private Instant current;
-
-        private final ZoneId zone;
-
-        private MutableClock(Instant current, ZoneId zone) {
-            this.current = current;
-            this.zone = zone;
-        }
-
-        void advance(Duration duration) {
-            current = current.plus(duration);
+        @Override
+        public Optional<BackupRecord> find(BackupId backupId) throws IOException {
+            requireReadable();
+            return catalog.find(backupId);
         }
 
         @Override
-        public ZoneId getZone() {
-            return zone;
+        public List<BackupRecord> listAll() throws IOException {
+            requireReadable();
+            return catalog.listAll();
         }
 
         @Override
-        public Clock withZone(ZoneId requestedZone) {
-            return new MutableClock(current, requestedZone);
+        public List<BackupRecord> list(WorldId worldId) throws IOException {
+            requireReadable();
+            return catalog.list(worldId);
         }
 
         @Override
-        public Instant instant() {
-            return current;
+        public boolean lostRecords() {
+            return catalog.lostRecords();
         }
-    }
-
-    private static final class InMemoryCatalog implements BackupCatalog {
-        private final Map<BackupId, BackupRecord> records = new LinkedHashMap<>();
 
-        private BackupId failingRemoval;
-
-        private InMemoryCatalog(BackupRecord... records) {
-            for (BackupRecord record : records) {
-                this.records.put(record.manifest().backupId(), record);
+        @Override
+        public Map<BackupId, Optional<BackupRecord>> updateAll(
+                Map<BackupId, UnaryOperator<Optional<BackupRecord>>> changes) throws IOException {
+            if (failSaving) {
+                throw new IOException("The drive is full");
             }
+            return catalog.updateAll(changes);
         }
 
-        void failRemoval(BackupId backupId) {
-            failingRemoval = backupId;
-        }
-
-        @Override
-        public synchronized void add(BackupRecord record) throws IOException {
-            BackupRecord previous = records.putIfAbsent(
-                    record.manifest().backupId(),
-                    record);
-            if (previous != null && !previous.equals(record)) {
-                throw new IOException("Catalog record conflict");
+        private void requireReadable() throws IOException {
+            if (failReading) {
+                throw new IOException("The catalog was read");
             }
         }
+    }
 
-        @Override
-        public synchronized Optional<BackupRecord> find(BackupId backupId) {
-            return Optional.ofNullable(records.get(backupId));
+    /** A clock the test moves by hand. */
+    private static final class MutableClock extends Clock {
+        private volatile Instant current;
+
+        private MutableClock(Instant current) {
+            this.current = current;
         }
 
-        @Override
-        public synchronized List<BackupRecord> listAll() {
-            return List.copyOf(records.values());
+        void advance(Duration duration) {
+            current = current.plus(duration);
         }
 
         @Override
-        public synchronized List<BackupRecord> list(WorldId worldId) {
-            return records.values().stream()
-                    .filter(record -> record.manifest().worldId().equals(worldId))
-                    .toList();
+        public ZoneId getZone() {
+            return ZoneOffset.UTC;
         }
 
         @Override
-        public synchronized Optional<BackupRecord> update(
-                BackupId backupId,
-                UnaryOperator<BackupRecord> update) {
-            BackupRecord current = records.get(backupId);
-            if (current == null) {
-                return Optional.empty();
-            }
-            BackupRecord replacement = update.apply(current);
-            records.put(backupId, replacement);
-            return Optional.of(replacement);
+        public Clock withZone(ZoneId zone) {
+            throw new UnsupportedOperationException();
         }
 
         @Override
-        public synchronized boolean remove(BackupId backupId) throws IOException {
-            if (backupId.equals(failingRemoval)) {
-                throw new IOException("token=" + SECRET);
-            }
-            return records.remove(backupId) != null;
+        public Instant instant() {
+            return current;
         }
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/management/ManagedStorageSupportTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/management/ManagedStorageSupportTest.java
deleted file mode 100644
index 99dc83a..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/management/ManagedStorageSupportTest.java
+++ /dev/null
@@ -1,52 +0,0 @@
-package dev.ishaanko.worldarchive.storage.management;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.time.Instant;
-import java.util.List;
-import java.util.Optional;
-import org.junit.jupiter.api.Test;
-
-final class ManagedStorageSupportTest {
-    private static final WorldId WORLD_ID = WorldId.create();
-
-    @Test
-    void onlyADestinationWithAnArtifactCountsAsManaged() {
-        BackupRecord failed = record(DestinationResult.failed(DestinationType.ZIP, "disk full"));
-        BackupRecord written = record(DestinationResult.success(DestinationType.ZIP, WORLD_ID + "/archive.zip"));
-
-        assertFalse(ManagedStorageSupport.managedDestination(failed, DestinationType.ZIP));
-        assertTrue(ManagedStorageSupport.managedDestination(written, DestinationType.ZIP));
-        assertFalse(ManagedStorageSupport.ownGitSnapshot(
-                record(DestinationResult.failed(DestinationType.GIT, "git missing"))));
-    }
-
-    private static BackupRecord record(DestinationResult destination) {
-        BackupId backupId = BackupId.create();
-        Instant created = Instant.parse("2026-09-15T10:00:00Z");
-        BackupManifest manifest = BackupManifest.create(
-                backupId,
-                WORLD_ID,
-                "Support Test World",
-                Optional.empty(),
-                created,
-                BackupTrigger.MANUAL,
-                1,
-                100,
-                0,
-                "a".repeat(64),
-                "b".repeat(64));
-        return new BackupRecord(
-                manifest,
-                BackupResult.aggregate(backupId, WORLD_ID, List.of(destination), created.plusSeconds(1)));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/management/RetentionPlannerTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/management/RetentionPlannerTest.java
index 25894a7..4a4ef0d 100644
--- a/src/test/java/dev/ishaanko/worldarchive/storage/management/RetentionPlannerTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/management/RetentionPlannerTest.java
@@ -13,7 +13,11 @@
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.nio.charset.StandardCharsets;
 import java.time.Instant;
+import java.time.LocalDate;
+import java.time.ZoneId;
 import java.time.ZoneOffset;
+import java.util.ArrayList;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Optional;
 import java.util.Set;
@@ -60,7 +64,7 @@ void protectsLabelsSafetyFloorAndTheBestDailyRepresentative() {
                 List.of(automatic, manualLight, manualHeavy, labeled, safety),
                 new StoragePolicy(1_000, 1, 0, 0),
                 ZoneOffset.UTC,
-                Optional.of(safety.manifest().backupId()));
+                safety.manifest().backupId());
 
         assertTrue(protectedIds.contains(manualHeavy.manifest().backupId()));
         assertTrue(protectedIds.contains(labeled.manifest().backupId()));
@@ -82,7 +86,7 @@ void usesSeparateRecentDailyWeeklyAndMonthlyWindows() {
                 List.of(dayZero, dayOne, weekOne, weekTwo, monthOne, removable),
                 new StoragePolicy(1_000, 2, 2, 1),
                 ZoneOffset.UTC,
-                Optional.empty());
+                dayZero.manifest().backupId());
 
         assertEquals(
                 Set.of(
@@ -95,6 +99,35 @@ void usesSeparateRecentDailyWeeklyAndMonthlyWindows() {
         assertFalse(protectedIds.contains(removable.manifest().backupId()));
     }
 
+    /**
+     * Days are the player's local days, also across a daylight saving change: a backup made late
+     * in the evening belongs to that evening's day, not to the next UTC day.
+     */
+    @Test
+    void keepsTheSevenMostRecentLocalDaysAcrossADaylightSavingChange() {
+        ZoneId newYork = ZoneId.of("America/New_York");
+        List<BackupRecord> records = new ArrayList<>();
+        Set<BackupId> expected = new HashSet<>();
+        LocalDate lastDay = LocalDate.of(2026, 11, 4);
+        for (LocalDate day = LocalDate.of(2026, 10, 25); !day.isAfter(lastDay); day = day.plusDays(1)) {
+            BackupRecord morning = record("morning " + day, day.atTime(8, 0).atZone(newYork).toInstant().toString(),
+                    BackupTrigger.SCHEDULED, 5, Optional.empty());
+            BackupRecord evening = record("evening " + day, day.atTime(22, 30).atZone(newYork).toInstant().toString(),
+                    BackupTrigger.SCHEDULED, 1, Optional.empty());
+            records.add(morning);
+            records.add(evening);
+            if (day.isAfter(lastDay.minusDays(7))) {
+                expected.add(morning.manifest().backupId());
+            }
+        }
+        BackupId newestMorning = records.get(records.size() - 2).manifest().backupId();
+
+        Set<BackupId> protectedIds = RetentionPlanner.protectedBackups(
+                records, new StoragePolicy(1_000, 7, 0, 0), newYork, newestMorning);
+
+        assertEquals(expected, protectedIds);
+    }
+
     @Test
     void cleanupStartsWithAutomaticLightAndOldBackups() {
         BackupRecord oldAutomatic = record(
@@ -160,10 +193,11 @@ private static BackupRecord record(
                 100,
                 changedFileCount,
                 "a".repeat(64),
-                "b".repeat(64));
+                "b".repeat(64),
+                Optional.empty());
         return new BackupRecord(
                 manifest,
-                BackupResult.aggregate(
+                new BackupResult(
                         backupId,
                         WORLD_ID,
                         List.of(),
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/management/StorageForecastCalculatorTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/management/StorageForecastCalculatorTest.java
index e4aa5cd..49c5cce 100644
--- a/src/test/java/dev/ishaanko/worldarchive/storage/management/StorageForecastCalculatorTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/management/StorageForecastCalculatorTest.java
@@ -58,7 +58,6 @@ void usesTheMedianGrowthRateForTheEstimate() {
 
         assertEquals(StorageForecast.State.ESTIMATED, forecast.state());
         assertEquals(5, forecast.daysRemaining().orElseThrow());
-        assertEquals(60, forecast.bytesPerDay(), 0.001);
     }
 
     @Test
@@ -73,7 +72,7 @@ void reportsStableStorageWhenTheMedianDoesNotGrow() {
                         sample(NOW, 400)));
 
         assertEquals(StorageForecast.State.STABLE, forecast.state());
-        assertEquals(0, forecast.bytesPerDay());
+        assertTrue(forecast.daysRemaining().isEmpty());
     }
 
     @Test
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/zip/FileBackupImportServiceIntegrationTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/zip/FileBackupImportServiceIntegrationTest.java
deleted file mode 100644
index 4561bef..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/zip/FileBackupImportServiceIntegrationTest.java
+++ /dev/null
@@ -1,327 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import dev.ishaanko.worldarchive.core.Digests;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.catalog.FileBackupCatalog;
-import dev.ishaanko.worldarchive.catalog.FileBackupDeletionRegistry;
-import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.importing.FileBackupImportService;
-import dev.ishaanko.worldarchive.importing.FileImportSourceRegistry;
-import dev.ishaanko.worldarchive.importing.ImportDisposition;
-import dev.ishaanko.worldarchive.importing.ImportPreview;
-import dev.ishaanko.worldarchive.importing.ImportSummary;
-import dev.ishaanko.worldarchive.model.ArtifactOwnership;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.WorldId;
-import dev.ishaanko.worldarchive.storage.git.GitBackendSettings;
-import dev.ishaanko.worldarchive.storage.git.WorldGitSnapshotStore;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.StandardOpenOption;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Optional;
-import java.util.Set;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-final class FileBackupImportServiceIntegrationTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void importsOnlyBackupsSelectedFromPreview() throws Exception {
-        ZipBackupStore sourceStore = new ZipBackupStore(temporaryDirectory.resolve("selection-source"));
-        ZipBackupArtifact first = sourceBackup(sourceStore, "selection-first");
-        ZipBackupArtifact second = sourceBackup(sourceStore, "selection-second");
-        FileBackupCatalog catalog = new FileBackupCatalog(
-                temporaryDirectory.resolve("selection-catalog.json"));
-        FileImportSourceRegistry registry = new FileImportSourceRegistry(
-                temporaryDirectory.resolve("selection-sources.json"));
-        ZipBackupStore managed = new ZipBackupStore(temporaryDirectory.resolve("selection-managed"));
-        try (WorldGitSnapshotStore git = gitStore("selection-git");
-                FileBackupImportService imports = imports(catalog, registry, git, managed)) {
-            ImportPreview preview = imports.previewZip(sourceStore.root())
-                    .toCompletableFuture().join();
-
-            ImportSummary summary = imports.execute(
-                    preview.token(), Set.of(first.manifest().backupId()))
-                    .toCompletableFuture().join();
-
-            assertEquals(1, summary.added());
-            assertTrue(catalog.find(first.manifest().backupId()).isPresent());
-            assertTrue(catalog.find(second.manifest().backupId()).isEmpty());
-        }
-    }
-
-    @Test
-    void discardedPreviewCannotExecuteOrChangeTheCatalog() throws Exception {
-        ZipBackupArtifact source = sourceBackup("discard-source");
-        FileBackupCatalog catalog = new FileBackupCatalog(
-                temporaryDirectory.resolve("discard-catalog.json"));
-        FileImportSourceRegistry sources = new FileImportSourceRegistry(
-                temporaryDirectory.resolve("discard-sources.json"));
-        ZipBackupStore managed = new ZipBackupStore(
-                temporaryDirectory.resolve("discard-managed"));
-        try (WorldGitSnapshotStore git = gitStore("discard-git");
-                FileBackupImportService imports = imports(catalog, sources, git, managed)) {
-            ImportPreview preview = imports.previewZip(
-                    source.archivePath().getParent().getParent())
-                    .toCompletableFuture().join();
-
-            imports.discard(preview.token()).toCompletableFuture().join();
-
-            assertThrows(
-                    java.util.concurrent.CompletionException.class,
-                    () -> imports.execute(preview.token()).toCompletableFuture().join());
-            assertTrue(catalog.listAll().isEmpty());
-        }
-    }
-
-    @Test
-    void storedBackupSearchAlsoImportsOnlyTheSelectedBackups() throws Exception {
-        ZipBackupStore sourceStore = new ZipBackupStore(temporaryDirectory.resolve("stored-source"));
-        ZipBackupArtifact first = sourceBackup(sourceStore, "stored-first");
-        ZipBackupArtifact second = sourceBackup(sourceStore, "stored-second");
-        ZipBackupStore managed = new ZipBackupStore(temporaryDirectory.resolve("stored-managed"));
-        FileImportSourceRegistry sources = new FileImportSourceRegistry(
-                temporaryDirectory.resolve("stored-sources.json"));
-        try (WorldGitSnapshotStore git = gitStore("stored-git");
-                FileBackupImportService initial = imports(
-                        new FileBackupCatalog(temporaryDirectory.resolve("stored-initial.json")),
-                        sources,
-                        git,
-                        managed)) {
-            ImportPreview copy = initial.previewZip(sourceStore.root())
-                    .toCompletableFuture().join();
-            initial.execute(copy.token()).toCompletableFuture().join();
-
-            FileBackupCatalog rebuilt = new FileBackupCatalog(
-                    temporaryDirectory.resolve("stored-rebuilt.json"));
-            try (FileBackupImportService search = imports(rebuilt, sources, git, managed)) {
-                ImportPreview found = search.previewLocal().toCompletableFuture().join();
-                assertEquals(2, found.items().size());
-
-                search.execute(found.token(), Set.of(first.manifest().backupId()))
-                        .toCompletableFuture().join();
-
-                assertTrue(rebuilt.find(first.manifest().backupId()).isPresent());
-                assertTrue(rebuilt.find(second.manifest().backupId()).isEmpty());
-            }
-        }
-    }
-
-    @Test
-    void deletionMarkerSuppressesAStillDiscoverableManagedBackup() throws Exception {
-        ZipBackupArtifact source = sourceBackup("deleted-source");
-        FileBackupCatalog catalog = new FileBackupCatalog(
-                temporaryDirectory.resolve("deleted-catalog.json"));
-        FileImportSourceRegistry sources = new FileImportSourceRegistry(
-                temporaryDirectory.resolve("deleted-sources.json"));
-        FileBackupDeletionRegistry deletions = new FileBackupDeletionRegistry(
-                temporaryDirectory.resolve("deleted-backups.txt"));
-        ZipBackupStore managed = new ZipBackupStore(temporaryDirectory.resolve("deleted-managed"));
-        try (WorldGitSnapshotStore git = gitStore("deleted-git");
-                FileBackupImportService imports = imports(
-                        catalog, sources, deletions, git, managed)) {
-            ImportPreview preview = imports.previewZip(
-                    source.archivePath().getParent().getParent())
-                    .toCompletableFuture().join();
-            imports.execute(preview.token()).toCompletableFuture().join();
-
-            deletions.record(source.manifest().backupId());
-            assertTrue(catalog.remove(source.manifest().backupId()));
-            assertFalse(managed.listCompleteArchives().isEmpty());
-
-            assertTrue(catalog.listAll().isEmpty());
-            assertEquals(0, imports.rebuildLocal().toCompletableFuture().join().added());
-            assertTrue(catalog.listAll().isEmpty());
-        }
-    }
-
-    @Test
-    void zipChangedAfterPreviewIsRejectedBeforeAnyImportMutation() throws Exception {
-        ZipBackupStore sourceStore = new ZipBackupStore(
-                temporaryDirectory.resolve("changed-source"));
-        ZipBackupArtifact first = sourceBackup(sourceStore, "changed-first");
-        ZipBackupArtifact second = sourceBackup(sourceStore, "changed-second");
-        FileBackupCatalog catalog = new FileBackupCatalog(
-                temporaryDirectory.resolve("changed-catalog.json"));
-        FileImportSourceRegistry sources = new FileImportSourceRegistry(
-                temporaryDirectory.resolve("changed-sources.json"));
-        ZipBackupStore managed = new ZipBackupStore(
-                temporaryDirectory.resolve("changed-managed"));
-        try (WorldGitSnapshotStore git = gitStore("changed-git");
-                FileBackupImportService imports = imports(catalog, sources, git, managed)) {
-            ImportPreview preview = imports.previewZip(sourceStore.root())
-                    .toCompletableFuture().join();
-            // Corrupting whichever archive the import visits last proves the pinned
-            // contents of every candidate are rechecked before the first copy runs.
-            BackupId lastVisited = preview.items().getLast().manifest().backupId();
-            ZipBackupArtifact changed =
-                    lastVisited.equals(first.manifest().backupId()) ? first : second;
-            Files.write(changed.archivePath(), new byte[] {1}, StandardOpenOption.APPEND);
-
-            assertThrows(
-                    java.util.concurrent.CompletionException.class,
-                    () -> imports.execute(preview.token()).toCompletableFuture().join());
-            assertTrue(catalog.listAll().isEmpty());
-            assertTrue(managed.listCompleteArchives().isEmpty());
-            assertTrue(Files.isRegularFile(first.archivePath()));
-            assertTrue(Files.isRegularFile(second.archivePath()));
-        }
-    }
-
-    @Test
-    void repeatedCopyImportIsIdempotentAndNeverTouchesTheSourceArchive() throws Exception {
-        ZipBackupArtifact source = sourceBackup("idempotent-source");
-        Path sourceRoot = source.archivePath().getParent().getParent();
-        FileBackupCatalog catalog = new FileBackupCatalog(
-                temporaryDirectory.resolve("idempotent-catalog.json"));
-        FileImportSourceRegistry registry = new FileImportSourceRegistry(
-                temporaryDirectory.resolve("idempotent-sources.json"));
-        ZipBackupStore managed = new ZipBackupStore(
-                temporaryDirectory.resolve("idempotent-managed"));
-        try (WorldGitSnapshotStore git = gitStore("idempotent-git");
-                FileBackupImportService imports = imports(catalog, registry, git, managed)) {
-            ImportPreview preview = imports.previewZip(sourceRoot).toCompletableFuture().join();
-            assertEquals(ImportDisposition.ADD, preview.items().getFirst().disposition());
-            assertEquals(1, imports.execute(preview.token()).toCompletableFuture().join().added());
-            assertEquals(
-                    ArtifactOwnership.MANAGED,
-                    catalog.find(source.manifest().backupId())
-                            .orElseThrow().result().destinations().getFirst().ownership());
-
-            ImportPreview repeated = imports.previewZip(sourceRoot).toCompletableFuture().join();
-            assertEquals(ImportDisposition.UNCHANGED, repeated.items().getFirst().disposition());
-            assertEquals(
-                    1,
-                    imports.execute(repeated.token()).toCompletableFuture().join().unchanged());
-            assertTrue(Files.isRegularFile(source.archivePath()));
-            assertEquals(1, managed.listCompleteArchives().size());
-        }
-    }
-
-    @Test
-    void copiedZipImportCanRebuildAnEmptyCatalogOffline() throws Exception {
-        ZipBackupArtifact source = sourceBackup("copy-source");
-        FileBackupCatalog catalog = new FileBackupCatalog(temporaryDirectory.resolve("copy-catalog.json"));
-        FileImportSourceRegistry registry = new FileImportSourceRegistry(
-                temporaryDirectory.resolve("copy-sources.json"));
-        ZipBackupStore managed = new ZipBackupStore(temporaryDirectory.resolve("copy-managed"));
-        try (WorldGitSnapshotStore git = gitStore("copy-git");
-                FileBackupImportService imports = imports(catalog, registry, git, managed)) {
-            ImportPreview preview = imports.previewZip(
-                    source.archivePath().getParent().getParent())
-                    .toCompletableFuture().join();
-            assertEquals(1, imports.execute(preview.token()).toCompletableFuture().join().added());
-            assertTrue(Files.isRegularFile(source.archivePath()));
-            assertFalse(managed.listCompleteArchives().isEmpty());
-
-            FileBackupCatalog rebuiltCatalog = new FileBackupCatalog(
-                    temporaryDirectory.resolve("rebuilt-catalog.json"));
-            try (FileBackupImportService rebuild = imports(
-                    rebuiltCatalog, registry, git, managed)) {
-                ImportSummary summary = rebuild.rebuildLocal().toCompletableFuture().join();
-                assertEquals(1, summary.added());
-                assertEquals(source.manifest(), rebuiltCatalog.find(
-                        source.manifest().backupId()).orElseThrow().manifest());
-            }
-        }
-    }
-
-    private FileBackupImportService imports(
-            FileBackupCatalog catalog,
-            FileImportSourceRegistry registry,
-            WorldGitSnapshotStore git,
-            ZipBackupStore managed) {
-        return new FileBackupImportService(
-                catalog, registry, git, resolver(managed), java.util.Set::of, Runnable::run);
-    }
-
-    private FileBackupImportService imports(
-            FileBackupCatalog catalog,
-            FileImportSourceRegistry registry,
-            FileBackupDeletionRegistry deletions,
-            WorldGitSnapshotStore git,
-            ZipBackupStore managed) {
-        return new FileBackupImportService(
-                catalog,
-                registry,
-                deletions,
-                git,
-                resolver(managed),
-                java.util.Set::of,
-                Runnable::run);
-    }
-
-    private WorldGitSnapshotStore gitStore(String name) {
-        return new WorldGitSnapshotStore(new GitBackendSettings(
-                true,
-                temporaryDirectory.resolve(name),
-                "git",
-                "origin",
-                Optional.empty(),
-                GitBackendSettings.DEFAULT_LFS_PATTERNS,
-                GitBackendSettings.DEFAULT_COMMAND_TIMEOUT,
-                GitBackendSettings.DEFAULT_MAXIMUM_OUTPUT_BYTES));
-    }
-
-    private static ZipBackupStoreResolver resolver(ZipBackupStore store) {
-        return new ZipBackupStoreResolver() {
-            @Override
-            public ZipBackupStore store(WorldId worldId) {
-                return store;
-            }
-
-            @Override
-            public ZipBackupStore defaultStore() {
-                return store;
-            }
-        };
-    }
-
-    private ZipBackupArtifact sourceBackup(String name) throws Exception {
-        Path world = Files.createDirectories(temporaryDirectory.resolve(name).resolve("world"));
-        Files.writeString(world.resolve("level.dat"), "recoverable-world-data");
-        BackupManifest manifest = manifest(world);
-        return new ZipBackupStore(temporaryDirectory.resolve(name).resolve("archives"))
-                .create(new BackupCapture(world, manifest));
-    }
-
-    private ZipBackupArtifact sourceBackup(ZipBackupStore store, String name) throws Exception {
-        Path world = Files.createDirectories(temporaryDirectory.resolve(name).resolve("world"));
-        Files.writeString(world.resolve("level.dat"), "recoverable-world-data-" + name);
-        return store.create(new BackupCapture(world, manifest(world)));
-    }
-
-    private static BackupManifest manifest(Path world) throws Exception {
-        List<ZipInventoryEntry> files = new ArrayList<>();
-        for (ZipSourceScanner.SourceEntry entry : ZipSourceScanner.snapshot(world).entries()) {
-            if (!entry.directory()) {
-                files.add(new ZipInventoryEntry(
-                        entry.relativePath(), entry.size(), Digests.sha256(entry.path())));
-            }
-        }
-        ZipInventory inventory = ZipInventory.create(files);
-        return BackupManifest.create(
-                BackupId.create(),
-                WorldId.create(),
-                "Recovered World",
-                Optional.of("Import integration"),
-                Instant.parse("2026-07-21T21:00:00Z"),
-                BackupTrigger.MANUAL,
-                inventory.fileCount(),
-                inventory.byteCount(),
-                inventory.fileCount(),
-                ZipDigests.contentSha256(inventory.files()),
-                inventory.inventorySha256());
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveExtractorTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveExtractorTest.java
deleted file mode 100644
index 9246145..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveExtractorTest.java
+++ /dev/null
@@ -1,36 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.List;
-import org.junit.jupiter.api.Assumptions;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-final class ZipArchiveExtractorTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void insufficientFreeSpaceFailsBeforeArchiveAccess() throws Exception {
-        Path staging = Files.createDirectory(temporaryDirectory.resolve("staging"));
-        long usableSpace = Files.getFileStore(staging).getUsableSpace();
-        Assumptions.assumeTrue(usableSpace < Long.MAX_VALUE);
-        ZipInventory inventory = ZipInventory.create(List.of(new ZipInventoryEntry(
-                "too-large.dat", Long.MAX_VALUE, "0".repeat(64))));
-
-        ZipBackupException failure = assertThrows(
-                ZipBackupException.class,
-                () -> ZipArchiveExtractor.extract(
-                        temporaryDirectory.resolve("missing.zip"),
-                        ZipArchiveExtractor.openEmpty(staging),
-                        inventory,
-                        new ZipStoreHooks() {
-                        }));
-
-        assertTrue(failure.getMessage().contains("insufficient free space"));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveFormatTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveFormatTest.java
new file mode 100644
index 0000000..fd63f2d
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipArchiveFormatTest.java
@@ -0,0 +1,45 @@
+package dev.ishaanko.worldarchive.storage.zip;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import com.google.gson.JsonObject;
+import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.BackupManifestJson;
+import dev.ishaanko.worldarchive.model.GoldenFixtures;
+import java.nio.charset.StandardCharsets;
+import java.util.List;
+import org.junit.jupiter.api.Test;
+
+class ZipArchiveFormatTest {
+    private static final Gson PRETTY = new GsonBuilder().setPrettyPrinting().disableHtmlEscaping().create();
+
+    @Test
+    void encodesManifestsExactlyAsStoredArchivesHoldThem() throws Exception {
+        for (BackupManifest manifest : List.of(GoldenFixtures.labeledManifest(), GoldenFixtures.plainManifest())) {
+            String expected = manifest.label().isPresent()
+                    ? GoldenFixtures.LABELED_MANIFEST_JSON
+                    : GoldenFixtures.PLAIN_MANIFEST_JSON;
+            JsonObject shared = new JsonObject();
+            BackupManifestJson.write(manifest, shared);
+
+            assertEquals(expected, new String(ZipArchiveFormat.encodeManifest(manifest), StandardCharsets.UTF_8));
+            assertEquals(expected, PRETTY.toJson(shared) + "\n");
+            assertEquals(manifest, ZipArchiveFormat.decodeManifest(ZipArchiveFormat.encodeManifest(manifest)));
+        }
+    }
+
+    @Test
+    void aManifestFromANewerWorldArchiveAsksForAnUpdate() {
+        String newer = GoldenFixtures.PLAIN_MANIFEST_JSON.replace(
+                "\"formatVersion\": 1", "\"formatVersion\": " + (BackupManifest.CURRENT_FORMAT_VERSION + 1));
+
+        ZipArchiveDamagedException failure = assertThrows(ZipArchiveDamagedException.class,
+                () -> ZipArchiveFormat.decodeManifest(newer.getBytes(StandardCharsets.UTF_8)));
+
+        assertTrue(failure.getMessage().contains("Update WorldArchive"), failure.getMessage());
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupBackendTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupBackendTest.java
index ba18b39..6816a14 100644
--- a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupBackendTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupBackendTest.java
@@ -1,30 +1,28 @@
 package dev.ishaanko.worldarchive.storage.zip;
 
-import dev.ishaanko.worldarchive.core.Digests;
-import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static dev.ishaanko.worldarchive.storage.zip.ZipTestFixtures.CREATED_AT;
+import static dev.ishaanko.worldarchive.storage.zip.ZipTestFixtures.bytes;
+import static dev.ishaanko.worldarchive.storage.zip.ZipTestFixtures.capture;
+import static dev.ishaanko.worldarchive.storage.zip.ZipTestFixtures.files;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertInstanceOf;
-import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
+import dev.ishaanko.worldarchive.config.FolderOrigin;
 import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.core.TestCaptures;
+import dev.ishaanko.worldarchive.core.WorldInventory;
+import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationStatus;
+import dev.ishaanko.worldarchive.model.OperationPhase;
+import dev.ishaanko.worldarchive.model.OperationProgress;
+import dev.ishaanko.worldarchive.model.VerificationStatus;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.time.Instant;
 import java.util.List;
-import java.util.Optional;
-import java.util.concurrent.CompletionException;
+import java.util.Map;
 import java.util.concurrent.CopyOnWriteArrayList;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.RejectedExecutionException;
-import java.util.concurrent.TimeUnit;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
@@ -33,130 +31,76 @@ class ZipBackupBackendTest {
     Path temporaryDirectory;
 
     @Test
-    void backendRunsOnItsExecutorAndObserverFailuresCannotCauseFalseFailure() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
-        byte[] contents = "world data".getBytes(java.nio.charset.StandardCharsets.UTF_8);
-        Files.write(world.resolve("level.dat"), contents);
-        BackupManifest manifest = manifest(contents);
-        List<String> callbackThreads = new CopyOnWriteArrayList<>();
-        try (ExecutorService executor = Executors.newSingleThreadExecutor(runnable -> {
-            Thread thread = new Thread(runnable, "zip-backup-worker");
-            thread.setDaemon(true);
-            return thread;
-        })) {
-            ZipBackupBackend backend = new ZipBackupBackend(
-                    temporaryDirectory.resolve("archives"), executor);
-            var result = backend.createBackup(new BackupCapture(world, manifest), progress -> {
-                callbackThreads.add(Thread.currentThread().getName());
-                throw new IllegalStateException("observer failed");
-            }).toCompletableFuture().get(10, TimeUnit.SECONDS);
-
-            assertEquals(DestinationStatus.SUCCESS, result.status());
-            assertTrue(result.artifactId().isPresent());
-            assertFalse(callbackThreads.isEmpty());
-            assertTrue(callbackThreads.stream().allMatch(name -> name.equals("zip-backup-worker")));
-        }
+    void aFailingProgressListenerCannotFailTheBackup() throws Exception {
+        Path world = ZipTestFixtures.world(temporaryDirectory.resolve("world"), files("level.dat", "world data"));
+        List<OperationPhase> reported = new CopyOnWriteArrayList<>();
+        ZipBackupBackend backend = new ZipBackupBackend(worldId -> store("archives"));
+
+        DestinationResult result = backend.createBackup(capture(world, WorldId.create(), CREATED_AT), progress -> {
+            reported.add(progress.phase());
+            throw new IllegalStateException("listener failed");
+        });
+
+        assertEquals(DestinationStatus.SUCCESS, result.status());
+        assertEquals(VerificationStatus.VERIFIED, result.verificationStatus());
+        assertTrue(result.artifactId().isPresent());
+        assertEquals(OperationPhase.COMPLETE, reported.getLast());
     }
 
     @Test
-    void recoverableStoreFailureCompletesWithDestinationFailure() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
-        Files.writeString(world.resolve("level.dat"), "unexpected file");
-        BackupManifest staleManifest = emptyManifest();
-        try (ExecutorService executor = Executors.newSingleThreadExecutor()) {
-            ZipBackupBackend backend = new ZipBackupBackend(
-                    temporaryDirectory.resolve("archives"), executor);
-
-            var result = backend.createBackup(
-                    new BackupCapture(world, staleManifest), progress -> {
-                    }).toCompletableFuture().get(10, TimeUnit.SECONDS);
-
-            assertEquals(DestinationStatus.FAILED, result.status());
-            assertEquals("World contents no longer match the prepared backup manifest",
-                    result.message().orElseThrow());
-            assertTrue(result.artifactId().isEmpty());
+    void writingProgressIsReportedOncePerPercent() throws Exception {
+        Path world = ZipTestFixtures.world(
+                temporaryDirectory.resolve("world"), Map.of("region/r.0.0.mca", bytes(8 * 1_024 * 1_024, 1)));
+        List<OperationProgress> writing = new CopyOnWriteArrayList<>();
+        ZipBackupBackend backend = new ZipBackupBackend(worldId -> store("archives"));
+
+        backend.createBackup(capture(world, WorldId.create(), CREATED_AT), progress -> {
+            if (progress.phase() == OperationPhase.WRITING) {
+                writing.add(progress);
+            }
+        });
+
+        assertTrue(writing.size() > 10 && writing.size() <= 101, "events: " + writing.size());
+        assertEquals(writing.getLast().totalUnits(), writing.getLast().completedUnits());
+        for (int index = 1; index < writing.size(); index++) {
+            assertTrue(writing.get(index).completedUnits() > writing.get(index - 1).completedUnits());
         }
     }
 
     @Test
-    void resolverRoutesEachWorldToItsConfiguredZipRoot() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("routed-world"));
-        byte[] contents = "routed world data".getBytes(java.nio.charset.StandardCharsets.UTF_8);
-        Files.write(world.resolve("level.dat"), contents);
-        WorldId worldId = WorldId.create();
-        Path defaultRoot = temporaryDirectory.resolve("default-archives");
-        Path overrideRoot = temporaryDirectory.resolve("override-archives");
-        ZipBackupStoreResolver stores = candidate -> new ZipBackupStore(
-                candidate.equals(worldId) ? overrideRoot : defaultRoot);
-        try (ExecutorService executor = Executors.newSingleThreadExecutor()) {
-            ZipBackupBackend backend = new ZipBackupBackend(stores, executor);
-
-            var result = backend.createBackup(
-                    new BackupCapture(world, manifest(contents, worldId)),
-                    ignored -> {}).toCompletableFuture().get(10, TimeUnit.SECONDS);
-
-            assertEquals(DestinationStatus.SUCCESS, result.status());
-            assertTrue(Files.isDirectory(overrideRoot.resolve(worldId.toString())));
-            assertFalse(Files.exists(defaultRoot));
-        }
+    void aCaptureThatDoesNotMatchItsManifestFailsWithAPlainMessage() throws Exception {
+        Path world = ZipTestFixtures.world(temporaryDirectory.resolve("world"), files("level.dat", "unexpected file"));
+        BackupCapture capture = capture(world, WorldId.create(), CREATED_AT);
+        BackupCapture stale = new BackupCapture(world, capture.manifest(), WorldInventory.create(List.of()));
+        ZipBackupBackend backend = new ZipBackupBackend(worldId -> store("archives"));
+
+        DestinationResult result = backend.createBackup(stale, progress -> {
+        });
+
+        assertEquals(DestinationStatus.FAILED, result.status());
+        assertEquals(
+                "The prepared copy of the world does not match its backup manifest. Try the backup again.",
+                result.message().orElseThrow());
+        assertFalse(Files.exists(temporaryDirectory.resolve("archives")));
     }
 
     @Test
-    void rejectedExecutionReturnsAFailedStage() {
+    void eachWorldIsWrittenToItsOwnZipFolder() throws Exception {
+        Path world = ZipTestFixtures.world(temporaryDirectory.resolve("world"), files("level.dat", "routed"));
+        WorldId routed = WorldId.create();
         ZipBackupBackend backend = new ZipBackupBackend(
-                temporaryDirectory.resolve("archives"),
-                command -> {
-                    throw new RejectedExecutionException("simulated rejection");
-                });
-
-        var result = assertDoesNotThrow(() -> backend.createBackup(
-                new BackupCapture(temporaryDirectory, emptyManifest()),
-                ignored -> {
-                }));
-        CompletionException failure = assertThrows(
-                CompletionException.class,
-                () -> result.toCompletableFuture().join());
-
-        assertInstanceOf(RejectedExecutionException.class, failure.getCause());
-    }
-
-    private static BackupManifest manifest(byte[] contents) {
-        return manifest(contents, WorldId.create());
-    }
+                worldId -> store(worldId.equals(routed) ? "override-archives" : "default-archives"));
 
-    private static BackupManifest manifest(byte[] contents, WorldId worldId) {
-        ZipInventory inventory = ZipInventory.create(List.of(new ZipInventoryEntry(
-                "level.dat", contents.length, sha256(contents))));
-        return BackupManifest.create(
-                BackupId.create(),
-                worldId,
-                "Test World",
-                Optional.empty(),
-                Instant.parse("2026-07-17T20:15:30.123Z"),
-                BackupTrigger.MANUAL,
-                inventory.fileCount(),
-                inventory.byteCount(),
-                inventory.fileCount(),
-                ZipDigests.contentSha256(inventory.files()),
-                inventory.inventorySha256());
-    }
+        DestinationResult result = backend.createBackup(
+                TestCaptures.of(world, capture(world, routed, CREATED_AT).manifest()), progress -> {
+                });
 
-    private static BackupManifest emptyManifest() {
-        ZipInventory inventory = ZipInventory.create(List.of());
-        return BackupManifest.create(
-                BackupId.create(),
-                WorldId.create(),
-                "Test World",
-                Instant.parse("2026-07-17T20:15:30.123Z"),
-                BackupTrigger.MANUAL,
-                0,
-                0,
-                ZipDigests.contentSha256(inventory.files()));
+        assertEquals(DestinationStatus.SUCCESS, result.status());
+        assertTrue(Files.isDirectory(temporaryDirectory.resolve("override-archives").resolve(routed.toString())));
+        assertFalse(Files.exists(temporaryDirectory.resolve("default-archives")));
     }
 
-    private static String sha256(byte[] contents) {
-        var digest = Digests.sha256();
-        digest.update(contents);
-        return Digests.hex(digest.digest());
+    private ZipBackupStore store(String name) {
+        return new ZipBackupStore(temporaryDirectory.resolve(name), FolderOrigin.DEFAULT);
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupCancellationTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupCancellationTest.java
deleted file mode 100644
index b0091b1..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupCancellationTest.java
+++ /dev/null
@@ -1,111 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.catalog.FileBackupCatalog;
-import dev.ishaanko.worldarchive.core.BackupDestinationSelector;
-import dev.ishaanko.worldarchive.core.BackupMaintenanceService;
-import dev.ishaanko.worldarchive.core.CreateBackupRequest;
-import dev.ishaanko.worldarchive.core.FileSystemBackupCaptureFactory;
-import dev.ishaanko.worldarchive.core.FileWorldInventoryStore;
-import dev.ishaanko.worldarchive.core.ProgressListener;
-import dev.ishaanko.worldarchive.core.SerializedBackupCoordinator;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.io.InterruptedIOException;
-import java.lang.reflect.Proxy;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.time.Clock;
-import java.util.List;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.CompletionStage;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.TimeUnit;
-import java.util.stream.Stream;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-/** A backup cancelled while the ZIP is written leaves no capture, archive, or catalog entry. */
-final class ZipBackupCancellationTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void cancelDuringArchiveWriteLeavesNoFilesBehind() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world"));
-        Files.writeString(world.resolve("level.dat"), "level");
-        Files.writeString(
-                Files.createDirectory(world.resolve("region")).resolve("r.0.0.mca"), "chunks");
-        Path captures = temporaryDirectory.resolve("captures");
-        Path archives = temporaryDirectory.resolve("archives");
-        CountDownLatch writing = new CountDownLatch(1);
-        CountDownLatch release = new CountDownLatch(1);
-        ZipStoreHooks pauseWrite = new ZipStoreHooks() {
-            @Override
-            public void archiveCompleted(Path partialArchive) throws IOException {
-                writing.countDown();
-                try {
-                    release.await();
-                } catch (InterruptedException exception) {
-                    Thread.currentThread().interrupt();
-                    throw new InterruptedIOException("ZIP write was interrupted");
-                }
-            }
-        };
-        FileBackupCatalog catalog = new FileBackupCatalog(temporaryDirectory.resolve("catalog.json"));
-        try (ExecutorService executor = Executors.newCachedThreadPool()) {
-            SerializedBackupCoordinator coordinator = new SerializedBackupCoordinator(
-                    catalog,
-                    new FileSystemBackupCaptureFactory(captures),
-                    new FileWorldInventoryStore(temporaryDirectory.resolve("inventories")),
-                    BackupDestinationSelector.fixed(List.of(new ZipBackupBackend(
-                            new ZipBackupStore(archives, pauseWrite), executor))),
-                    unusedMaintenance(),
-                    executor,
-                    Clock.systemUTC());
-            WorldId worldId = WorldId.create();
-            CompletionStage<BackupResult> operation = coordinator.createBackup(
-                    new CreateBackupRequest(worldId, world, "Cancelled", BackupTrigger.MANUAL),
-                    ProgressListener.NO_OP);
-            assertTrue(writing.await(10, TimeUnit.SECONDS));
-
-            assertTrue(operation.toCompletableFuture().cancel(true));
-            long deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(10);
-            while (coordinator.isBusy(worldId)) {
-                assertTrue(System.nanoTime() < deadline, "Cancelled backup did not settle");
-                Thread.sleep(10);
-            }
-        }
-
-        assertEquals(List.of(), regularFiles(captures));
-        assertEquals(List.of(), regularFiles(archives));
-        assertEquals(List.of(), catalog.listAll());
-    }
-
-    /** Every file under the root except the store's permanent per-folder operation lock. */
-    private static List<Path> regularFiles(Path root) throws IOException {
-        if (!Files.isDirectory(root)) {
-            return List.of();
-        }
-        try (Stream<Path> files = Files.walk(root)) {
-            return files.filter(Files::isRegularFile)
-                    .filter(file -> !file.getFileName().toString()
-                            .equals(ZipBackupStore.OPERATION_LOCK_NAME))
-                    .toList();
-        }
-    }
-
-    private static BackupMaintenanceService unusedMaintenance() {
-        return (BackupMaintenanceService) Proxy.newProxyInstance(
-                BackupMaintenanceService.class.getClassLoader(),
-                new Class<?>[] {BackupMaintenanceService.class},
-                (proxy, method, args) -> CompletableFuture.failedFuture(
-                        new UnsupportedOperationException(method.getName())));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupStoreAuditTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupStoreAuditTest.java
deleted file mode 100644
index 9587004..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupStoreAuditTest.java
+++ /dev/null
@@ -1,699 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import dev.ishaanko.worldarchive.core.Digests;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.io.InterruptedIOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.FileSystemException;
-import java.nio.file.LinkOption;
-import java.nio.file.Path;
-import java.nio.file.StandardCopyOption;
-import java.nio.file.StandardOpenOption;
-import java.time.Instant;
-import java.util.List;
-import java.util.Optional;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.function.Consumer;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipOutputStream;
-import org.junit.jupiter.api.Assumptions;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-class ZipBackupStoreAuditTest {
-    private static final Instant CREATED_AT = Instant.parse("2026-07-17T21:15:30.123Z");
-
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void completedArchiveMustPassPerFileInspectionBeforePublication() throws Exception {
-        Fixture fixture = fixture("inspection");
-        byte[] expected = Files.readAllBytes(fixture.world().resolve("level.dat"));
-        ZipInventory inventory = ZipInventory.create(List.of(new ZipInventoryEntry(
-                "level.dat", expected.length, sha256(expected))));
-        ZipStoreHooks hooks = new ZipStoreHooks() {
-            @Override
-            public void archiveCompleted(Path partialArchive) throws IOException {
-                rewriteArchive(partialArchive, zip -> {
-                    writeEntry(zip, ZipArchiveFormat.MANIFEST_ENTRY,
-                            ZipMetadataCodec.encodeManifest(fixture.manifest()));
-                    writeEntry(zip, ZipArchiveFormat.WORLD_PREFIX, new byte[0]);
-                    writeEntry(zip, ZipArchiveFormat.WORLD_PREFIX + "level.dat",
-                            "tampered".getBytes(StandardCharsets.UTF_8));
-                    writeEntry(zip, ZipArchiveFormat.INVENTORY_ENTRY,
-                            ZipMetadataCodec.encodeInventory(inventory));
-                });
-            }
-        };
-        ZipBackupStore store = new ZipBackupStore(fixture.root(), hooks);
-
-        assertThrows(ZipBackupException.class,
-                () -> store.create(new BackupCapture(fixture.world(), fixture.manifest())));
-
-        assertTrue(store.listCompleteArchives().isEmpty());
-        assertFalse(hasFileWithSuffix(fixture.root(), ".partial"));
-        assertFalse(hasFileWithSuffix(fixture.root(), ".zip"));
-    }
-
-    @Test
-    void publishedArchiveMutationCannotReturnSuccess() throws Exception {
-        Fixture fixture = fixture("publish-interference");
-        ZipStoreHooks hooks = new ZipStoreHooks() {
-            @Override
-            public void archivePublished(Path archive) throws IOException {
-                Files.write(archive, new byte[] {42}, StandardOpenOption.APPEND);
-            }
-        };
-        ZipBackupStore store = new ZipBackupStore(fixture.root(), hooks);
-
-        assertThrows(ZipBackupException.class,
-                () -> store.create(new BackupCapture(fixture.world(), fixture.manifest())));
-
-        assertTrue(store.listCompleteArchives().isEmpty());
-        assertFalse(hasFileWithSuffix(fixture.root(), ".zip"));
-        assertFalse(hasFileWithSuffix(fixture.root(), ".sha256"));
-    }
-
-    @Test
-    void postInspectionMutationIsDetectedBeforePublication() throws Exception {
-        Fixture fixture = fixture("inspection-race");
-        ZipStoreHooks hooks = new ZipStoreHooks() {
-            @Override
-            public void archiveInspected(Path partialArchive) throws IOException {
-                Files.write(partialArchive, new byte[] {7}, StandardOpenOption.APPEND);
-            }
-        };
-        ZipBackupStore store = new ZipBackupStore(fixture.root(), hooks);
-
-        assertThrows(ZipBackupException.class,
-                () -> store.create(new BackupCapture(fixture.world(), fixture.manifest())));
-
-        assertTrue(store.listCompleteArchives().isEmpty());
-        assertFalse(hasFileWithSuffix(fixture.root(), ".zip"));
-        assertFalse(hasFileWithSuffix(fixture.root(), ".partial"));
-    }
-
-    @Test
-    void managedWorldReplacementCannotPublishOrStrandAPartialArchive() throws Exception {
-        Fixture fixture = fixture("directory-replacement");
-        Path displacedDirectory = fixture.root().resolve(
-                fixture.manifest().worldId() + ".displaced");
-        ZipStoreHooks hooks = new ZipStoreHooks() {
-            @Override
-            public void archiveCompleted(Path partialArchive) throws IOException {
-                Path worldDirectory = partialArchive.getParent();
-                Files.move(worldDirectory, displacedDirectory);
-                Files.createDirectory(worldDirectory);
-            }
-        };
-        ZipBackupStore store = new ZipBackupStore(fixture.root(), hooks);
-
-        assertThrows(IOException.class,
-                () -> store.create(new BackupCapture(fixture.world(), fixture.manifest())));
-
-        assertTrue(store.listCompleteArchives().isEmpty());
-        assertFalse(hasFileWithSuffix(fixture.root(), ".partial"));
-        assertFalse(hasFileWithSuffix(fixture.root(), ".zip"));
-    }
-
-    @Test
-    void interruptedCreationLeavesNoPublishedOrPartialArtifact() throws Exception {
-        Fixture fixture = fixture("interrupted");
-        ZipStoreHooks hooks = new ZipStoreHooks() {
-            @Override
-            public void archiveCompleted(Path partialArchive) throws IOException {
-                throw new InterruptedIOException("simulated interruption");
-            }
-        };
-        ZipBackupStore store = new ZipBackupStore(fixture.root(), hooks);
-
-        assertThrows(InterruptedIOException.class,
-                () -> store.create(new BackupCapture(fixture.world(), fixture.manifest())));
-
-        assertTrue(store.listCompleteArchives().isEmpty());
-        assertFalse(hasFileWithSuffix(fixture.root(), ".partial"));
-    }
-
-    @Test
-    void simulatedDiskFullFailureCannotPublishOrReportAnArtifact() throws Exception {
-        Fixture fixture = fixture("disk-full");
-        ZipStoreHooks hooks = new ZipStoreHooks() {
-            @Override
-            public void archiveCompleted(Path partialArchive) throws IOException {
-                throw new FileSystemException(
-                        partialArchive.toString(), null, "simulated disk full");
-            }
-        };
-        ZipBackupStore store = new ZipBackupStore(fixture.root(), hooks);
-
-        assertThrows(FileSystemException.class,
-                () -> store.create(new BackupCapture(fixture.world(), fixture.manifest())));
-
-        assertTrue(store.listCompleteArchives().isEmpty());
-        assertFalse(hasFileWithSuffix(fixture.root(), ".partial"));
-        assertFalse(hasFileWithSuffix(fixture.root(), ".zip"));
-    }
-
-    @Test
-    void checksumIsPublishedBeforeTheCompletedArchive() throws Exception {
-        Fixture fixture = fixture("publication-order");
-        AtomicBoolean checksumObservedFirst = new AtomicBoolean();
-        AtomicBoolean checksumPresentWithArchive = new AtomicBoolean();
-        ZipStoreHooks hooks = new ZipStoreHooks() {
-            @Override
-            public void checksumPublished(Path archive, Path checksum) {
-                checksumObservedFirst.set(!Files.exists(archive) && Files.isRegularFile(checksum));
-            }
-
-            @Override
-            public void archivePublished(Path archive) {
-                checksumPresentWithArchive.set(Files.isRegularFile(
-                        Path.of(archive + ".sha256")));
-            }
-        };
-
-        ZipBackupArtifact artifact = new ZipBackupStore(fixture.root(), hooks).create(
-                new BackupCapture(fixture.world(), fixture.manifest()));
-
-        assertTrue(checksumObservedFirst.get());
-        assertTrue(checksumPresentWithArchive.get());
-        assertTrue(Files.isRegularFile(artifact.archivePath()));
-        assertTrue(Files.isRegularFile(artifact.checksumPath()));
-    }
-
-    @Test
-    void stalePartialsAreRemovedBeforeARetry() throws Exception {
-        Fixture fixture = fixture("stale-partial");
-        Path directory = Files.createDirectories(
-                fixture.root().resolve(fixture.manifest().worldId().toString()));
-        String filename = ZipBackupStore.archiveFilename(fixture.manifest());
-        Files.writeString(directory.resolve(filename + ".partial"), "incomplete archive");
-        Files.writeString(
-                directory.resolve(filename + ".sha256.partial"), "incomplete checksum");
-
-        ZipBackupArtifact artifact = new ZipBackupStore(fixture.root()).create(
-                new BackupCapture(fixture.world(), fixture.manifest()));
-
-        assertTrue(Files.isRegularFile(artifact.archivePath()));
-        assertTrue(Files.isRegularFile(artifact.checksumPath()));
-        assertFalse(hasFileWithSuffix(fixture.root(), ".partial"));
-    }
-
-    @Test
-    void orphanedArchiveRecoversItsChecksumIdempotently() throws Exception {
-        Fixture fixture = fixture("orphan-recovery");
-        ZipBackupStore store = new ZipBackupStore(fixture.root());
-        BackupCapture capture = new BackupCapture(fixture.world(), fixture.manifest());
-        ZipBackupArtifact first = store.create(capture);
-        Object archiveKey = Files.readAttributes(
-                first.archivePath(),
-                java.nio.file.attribute.BasicFileAttributes.class,
-                LinkOption.NOFOLLOW_LINKS).fileKey();
-        Files.delete(first.checksumPath());
-
-        ZipBackupArtifact recovered = store.create(capture);
-
-        assertEquals(first, recovered);
-        assertEquals(archiveKey, Files.readAttributes(
-                recovered.archivePath(),
-                java.nio.file.attribute.BasicFileAttributes.class,
-                LinkOption.NOFOLLOW_LINKS).fileKey());
-        assertTrue(store.verify(recovered.archivePath()).valid());
-    }
-
-    @Test
-    void restoreFailureRollsBackExtractedEntries() throws Exception {
-        Fixture fixture = fixture("restore-rollback");
-        ZipBackupArtifact artifact = new ZipBackupStore(fixture.root()).create(
-                new BackupCapture(fixture.world(), fixture.manifest()));
-        ZipStoreHooks hooks = new ZipStoreHooks() {
-            @Override
-            public void restoreEntryExtracted(Path target) throws IOException {
-                throw new IOException("simulated restore interruption");
-            }
-        };
-        Path staging = Files.createDirectory(temporaryDirectory.resolve("rollback-staging"));
-
-        assertThrows(IOException.class,
-                () -> new ZipBackupStore(fixture.root(), hooks).materialize(
-                        artifact.archivePath(), staging));
-
-        try (var entries = Files.list(staging)) {
-            assertTrue(entries.findAny().isEmpty());
-        }
-    }
-
-    @Test
-    void sourceTreeChangeDuringStreamingCannotPublish() throws Exception {
-        Fixture fixture = fixture("source-tree-change");
-        AtomicBoolean changed = new AtomicBoolean();
-        ZipBackupStore store = new ZipBackupStore(fixture.root());
-
-        assertThrows(ZipBackupException.class, () -> store.create(
-                new BackupCapture(fixture.world(), fixture.manifest()), completed -> {
-                    if (changed.compareAndSet(false, true)) {
-                        try {
-                            Files.writeString(fixture.world().resolve("late-file.dat"), "late");
-                        } catch (IOException exception) {
-                            throw new UncheckedTestIOException(exception);
-                        }
-                    }
-                }));
-
-        assertTrue(store.listCompleteArchives().isEmpty());
-        assertFalse(hasFileWithSuffix(fixture.root(), ".partial"));
-        assertFalse(hasFileWithSuffix(fixture.root(), ".zip"));
-    }
-
-    @Test
-    void restoreDetectsOriginalReplacementAndExtractsNothing() throws Exception {
-        Fixture fixture = fixture("restore-replacement");
-        ZipBackupArtifact artifact = new ZipBackupStore(fixture.root()).create(
-                new BackupCapture(fixture.world(), fixture.manifest()));
-        ZipStoreHooks hooks = new ZipStoreHooks() {
-            @Override
-            public void restoreCopyCompleted(Path archive, Path privateCopy) throws IOException {
-                Path replacement = archive.resolveSibling("replacement.tmp");
-                Files.copy(archive, replacement, StandardCopyOption.REPLACE_EXISTING);
-                Files.write(replacement, new byte[] {13}, StandardOpenOption.APPEND);
-                Files.move(replacement, archive, StandardCopyOption.REPLACE_EXISTING);
-            }
-        };
-        ZipBackupStore store = new ZipBackupStore(fixture.root(), hooks);
-        Path staging = Files.createDirectory(temporaryDirectory.resolve("restore-staging"));
-
-        assertThrows(ZipBackupException.class,
-                () -> store.materialize(artifact.archivePath(), staging));
-
-        try (var entries = Files.list(staging)) {
-            assertTrue(entries.findAny().isEmpty());
-        }
-        try (var entries = Files.list(staging.getParent())) {
-            assertFalse(entries.anyMatch(path -> path.getFileName().toString()
-                    .startsWith(".worldarchive-restore-")));
-        }
-    }
-
-    @Test
-    void archiveDeleteFailureLeavesCompletePairDiscoverable() throws Exception {
-        Fixture fixture = fixture("delete-archive-failure");
-        ZipBackupArtifact artifact = new ZipBackupStore(fixture.root()).create(
-                new BackupCapture(fixture.world(), fixture.manifest()));
-        ZipStoreHooks hooks = new ZipStoreHooks() {
-            @Override
-            public void beforeArchiveDelete(Path archive) throws IOException {
-                throw new IOException("simulated archive delete failure");
-            }
-        };
-        ZipBackupStore store = new ZipBackupStore(fixture.root(), hooks);
-
-        assertThrows(IOException.class, () -> store.delete(artifact));
-
-        assertTrue(Files.exists(artifact.archivePath()));
-        assertTrue(Files.exists(artifact.checksumPath()));
-        assertTrue(store.listCompleteArchives().stream().anyMatch(candidate -> candidate.equals(artifact)));
-    }
-
-    @Test
-    void checksumDeleteFailureCannotHideAnArchiveSurvivor() throws Exception {
-        Fixture fixture = fixture("delete-checksum-failure");
-        ZipBackupArtifact artifact = new ZipBackupStore(fixture.root()).create(
-                new BackupCapture(fixture.world(), fixture.manifest()));
-        ZipStoreHooks hooks = new ZipStoreHooks() {
-            @Override
-            public void beforeChecksumDelete(Path checksum) throws IOException {
-                throw new IOException("simulated checksum delete failure");
-            }
-        };
-        ZipBackupStore store = new ZipBackupStore(fixture.root(), hooks);
-
-        assertThrows(IOException.class, () -> store.delete(artifact));
-
-        assertFalse(Files.exists(artifact.archivePath()));
-        assertTrue(Files.exists(artifact.checksumPath()));
-        assertTrue(store.listCompleteArchives().isEmpty());
-    }
-
-    @Test
-    void managedLinkAncestorIsRejectedAcrossReadRestoreAndDelete() throws Exception {
-        Fixture fixture = fixture("managed-link");
-        ZipBackupArtifact artifact = new ZipBackupStore(fixture.root()).create(
-                new BackupCapture(fixture.world(), fixture.manifest()));
-        Path linkedRoot = temporaryDirectory.resolve("linked-archive-root");
-        boolean linked = createDirectoryAlias(linkedRoot, fixture.root());
-        Assumptions.assumeTrue(linked, "Directory links and junctions are unavailable");
-        try {
-            Path linkedArchive = linkedRoot.resolve(fixture.root().relativize(artifact.archivePath()));
-            ZipBackupStore linkedStore = new ZipBackupStore(linkedRoot);
-            Path staging = Files.createDirectory(temporaryDirectory.resolve("linked-staging"));
-
-            assertFalse(linkedStore.verify(linkedArchive).valid());
-            assertThrows(ZipBackupException.class,
-                    () -> linkedStore.materialize(linkedArchive, staging));
-            assertThrows(ZipBackupException.class, () -> linkedStore.delete(linkedArchive));
-            assertThrows(ZipBackupException.class, linkedStore::listCompleteArchives);
-            assertTrue(Files.exists(artifact.archivePath()));
-            assertTrue(Files.exists(artifact.checksumPath()));
-        } finally {
-            Files.deleteIfExists(linkedRoot);
-        }
-    }
-
-    @Test
-    void nonexistentDestinationThroughLinkAncestorIsRejectedBeforeCreation() throws Exception {
-        Fixture fixture = fixture("nonexistent-link");
-        Path realParent = Files.createDirectory(temporaryDirectory.resolve("real-parent"));
-        Path linkedParent = temporaryDirectory.resolve("linked-parent");
-        boolean linked = createDirectoryAlias(linkedParent, realParent);
-        Assumptions.assumeTrue(linked, "Directory links and junctions are unavailable");
-        try {
-            Path destination = linkedParent.resolve("future").resolve("archives");
-            ZipBackupStore store = new ZipBackupStore(destination);
-
-            assertThrows(ZipBackupException.class,
-                    () -> store.create(new BackupCapture(fixture.world(), fixture.manifest())));
-
-            assertFalse(Files.exists(realParent.resolve("future")));
-        } finally {
-            Files.deleteIfExists(linkedParent);
-        }
-    }
-
-    @Test
-    void sourceDirectoryReparsePointIsRejected() throws Exception {
-        Fixture fixture = fixture("source-reparse");
-        Path external = Files.createDirectory(temporaryDirectory.resolve("source-reparse-external"));
-        Files.writeString(external.resolve("outside.txt"), "outside");
-        Path linkedSource = fixture.world().resolve("linked-source");
-        boolean linked = createDirectoryAlias(linkedSource, external);
-        Assumptions.assumeTrue(linked, "Directory links and junctions are unavailable");
-        try {
-            assertThrows(ZipBackupException.class,
-                    () -> new ZipBackupStore(fixture.root()).create(
-                            new BackupCapture(fixture.world(), fixture.manifest())));
-            assertFalse(Files.exists(fixture.root()));
-        } finally {
-            Files.deleteIfExists(linkedSource);
-        }
-    }
-
-    @Test
-    void jdkZip64EntryCountArchiveVerifies() throws Exception {
-        Path root = temporaryDirectory.resolve("zip64-root");
-        ZipInventory inventory = ZipInventory.create(List.of());
-        BackupManifest manifest = BackupManifest.create(
-                BackupId.create(),
-                WorldId.create(),
-                "ZIP64 World",
-                CREATED_AT,
-                BackupTrigger.MANUAL,
-                0,
-                0,
-                ZipDigests.contentSha256(inventory.files()));
-        Path archive = writeManagedPair(root, manifest, zip -> {
-            writeEntry(zip, ZipArchiveFormat.MANIFEST_ENTRY, ZipMetadataCodec.encodeManifest(manifest));
-            for (int index = 0; index < 65_536; index++) {
-                writeEntry(zip, "world/d" + index + "/", new byte[0]);
-            }
-            writeEntry(zip, ZipArchiveFormat.INVENTORY_ENTRY,
-                    ZipMetadataCodec.encodeInventory(inventory));
-        });
-
-        ZipVerification verification = new ZipBackupStore(root).verify(archive);
-
-        assertTrue(verification.valid(), () -> String.join("; ", verification.problems()));
-    }
-
-    @Test
-    void manifestDigestsAreBoundToTheEmbeddedInventory() throws Exception {
-        Path root = temporaryDirectory.resolve("manifest-digest-root");
-        byte[] contents = "expected".getBytes(StandardCharsets.UTF_8);
-        ZipInventory inventory = ZipInventory.create(List.of(new ZipInventoryEntry(
-                "level.dat", contents.length, sha256(contents))));
-        BackupManifest manifest = BackupManifest.create(
-                BackupId.create(),
-                WorldId.create(),
-                "Digest World",
-                Optional.empty(),
-                CREATED_AT,
-                BackupTrigger.MANUAL,
-                1,
-                contents.length,
-                1,
-                "0".repeat(64),
-                inventory.inventorySha256());
-        Path archive = writeManagedPair(root, manifest, zip -> {
-            writeEntry(zip, ZipArchiveFormat.MANIFEST_ENTRY,
-                    ZipMetadataCodec.encodeManifest(manifest));
-            writeEntry(zip, ZipArchiveFormat.WORLD_PREFIX, new byte[0]);
-            writeEntry(zip, ZipArchiveFormat.WORLD_PREFIX + "level.dat", contents);
-            writeEntry(zip, ZipArchiveFormat.INVENTORY_ENTRY,
-                    ZipMetadataCodec.encodeInventory(inventory));
-        });
-
-        ZipVerification verification = new ZipBackupStore(root).verify(archive);
-
-        assertFalse(verification.valid());
-        assertTrue(verification.problems().contains(
-                "Archive manifest digests do not match the ZIP inventory."));
-    }
-
-    @Test
-    void unixSymlinkEntryIsRejectedBeforeRestore() throws Exception {
-        Path root = temporaryDirectory.resolve("archive-symlink-root");
-        byte[] contents = "target".getBytes(StandardCharsets.UTF_8);
-        ZipInventory inventory = ZipInventory.create(List.of(new ZipInventoryEntry(
-                "link.dat", contents.length, sha256(contents))));
-        BackupManifest manifest = BackupManifest.create(
-                BackupId.create(),
-                WorldId.create(),
-                "Symlink World",
-                Optional.empty(),
-                CREATED_AT,
-                BackupTrigger.MANUAL,
-                1,
-                contents.length,
-                1,
-                ZipDigests.contentSha256(inventory.files()),
-                inventory.inventorySha256());
-        Path archive = writeManagedPair(root, manifest, zip -> {
-            writeEntry(zip, ZipArchiveFormat.MANIFEST_ENTRY,
-                    ZipMetadataCodec.encodeManifest(manifest));
-            writeEntry(zip, ZipArchiveFormat.WORLD_PREFIX, new byte[0]);
-            writeEntry(zip, ZipArchiveFormat.WORLD_PREFIX + "link.dat", contents);
-            writeEntry(zip, ZipArchiveFormat.INVENTORY_ENTRY,
-                    ZipMetadataCodec.encodeInventory(inventory));
-        });
-        markCentralEntryAsUnixSymlink(
-                archive, ZipArchiveFormat.WORLD_PREFIX + "link.dat");
-        rewriteChecksum(archive);
-        ZipBackupStore store = new ZipBackupStore(root);
-        Path staging = Files.createDirectory(temporaryDirectory.resolve("symlink-staging"));
-
-        ZipVerification verification = store.verify(archive);
-
-        assertFalse(verification.valid());
-        assertTrue(verification.problems().contains(
-                "Archive contains a symbolic-link or special entry."));
-        assertThrows(ZipBackupException.class, () -> store.materialize(archive, staging));
-        try (var entries = Files.list(staging)) {
-            assertTrue(entries.findAny().isEmpty());
-        }
-    }
-
-    private Fixture fixture(String name) throws IOException {
-        Path world = Files.createDirectory(temporaryDirectory.resolve(name + "-world"));
-        byte[] contents = "expected".getBytes(StandardCharsets.UTF_8);
-        Files.write(world.resolve("level.dat"), contents);
-        ZipInventory inventory = ZipInventory.create(List.of(new ZipInventoryEntry(
-                "level.dat", contents.length, sha256(contents))));
-        BackupManifest manifest = BackupManifest.create(
-                BackupId.create(),
-                WorldId.create(),
-                "Test World",
-                Optional.empty(),
-                CREATED_AT,
-                BackupTrigger.MANUAL,
-                1,
-                contents.length,
-                1,
-                ZipDigests.contentSha256(inventory.files()),
-                inventory.inventorySha256());
-        return new Fixture(world, temporaryDirectory.resolve(name + "-archives"), manifest);
-    }
-
-    private static boolean createDirectoryAlias(Path link, Path target) throws Exception {
-        try {
-            Files.createSymbolicLink(link, target, new java.nio.file.attribute.FileAttribute<?>[0]);
-            return true;
-        } catch (IOException | UnsupportedOperationException | SecurityException exception) {
-            if (!System.getProperty("os.name", "").startsWith("Windows")) {
-                return false;
-            }
-        }
-        Process process = new ProcessBuilder(
-                "cmd.exe", "/d", "/c", "mklink", "/J", link.toString(), target.toString())
-                .redirectOutput(ProcessBuilder.Redirect.DISCARD)
-                .redirectError(ProcessBuilder.Redirect.DISCARD)
-                .start();
-        if (!process.waitFor(10, TimeUnit.SECONDS)) {
-            process.destroyForcibly();
-            return false;
-        }
-        return process.exitValue() == 0 && Files.exists(link, LinkOption.NOFOLLOW_LINKS);
-    }
-
-    private static boolean hasFileWithSuffix(Path root, String suffix) throws IOException {
-        if (!Files.exists(root)) {
-            return false;
-        }
-        try (var paths = Files.walk(root)) {
-            return paths.anyMatch(path -> Files.isRegularFile(path, LinkOption.NOFOLLOW_LINKS)
-                    && path.getFileName().toString().endsWith(suffix));
-        }
-    }
-
-    private static void rewriteArchive(Path archive, Consumer<ZipOutputStream> contents)
-            throws IOException {
-        try (ZipOutputStream zip = new ZipOutputStream(
-                Files.newOutputStream(
-                        archive,
-                        StandardOpenOption.CREATE,
-                        StandardOpenOption.TRUNCATE_EXISTING,
-                        StandardOpenOption.WRITE),
-                StandardCharsets.UTF_8)) {
-            try {
-                contents.accept(zip);
-            } catch (UncheckedTestIOException exception) {
-                throw exception.cause();
-            }
-        }
-    }
-
-    private static void markCentralEntryAsUnixSymlink(Path archive, String entryName)
-            throws IOException {
-        byte[] bytes = Files.readAllBytes(archive);
-        byte[] expectedName = entryName.getBytes(StandardCharsets.UTF_8);
-        for (int offset = 0; offset <= bytes.length - 46; offset++) {
-            if (littleEndianInt(bytes, offset) != 0x0201_4b50) {
-                continue;
-            }
-            int nameLength = littleEndianShort(bytes, offset + 28);
-            int nameOffset = offset + 46;
-            if (nameLength != expectedName.length || nameOffset + nameLength > bytes.length) {
-                continue;
-            }
-            boolean matches = true;
-            for (int index = 0; index < nameLength; index++) {
-                if (bytes[nameOffset + index] != expectedName[index]) {
-                    matches = false;
-                    break;
-                }
-            }
-            if (!matches) {
-                continue;
-            }
-            bytes[offset + 4] = 20;
-            bytes[offset + 5] = 3;
-            writeLittleEndianInt(bytes, offset + 38, 0120777 << 16);
-            Files.write(archive, bytes);
-            return;
-        }
-        throw new IOException("Test ZIP central entry was not found");
-    }
-
-    private static void rewriteChecksum(Path archive) throws IOException {
-        String checksum = Digests.sha256(archive);
-        Files.writeString(
-                Path.of(archive + ".sha256"),
-                checksum + "  " + archive.getFileName() + "\n",
-                StandardCharsets.UTF_8);
-    }
-
-    private static int littleEndianShort(byte[] bytes, int offset) {
-        return Byte.toUnsignedInt(bytes[offset])
-                | Byte.toUnsignedInt(bytes[offset + 1]) << 8;
-    }
-
-    private static int littleEndianInt(byte[] bytes, int offset) {
-        return littleEndianShort(bytes, offset)
-                | littleEndianShort(bytes, offset + 2) << 16;
-    }
-
-    private static void writeLittleEndianInt(byte[] bytes, int offset, int value) {
-        bytes[offset] = (byte) value;
-        bytes[offset + 1] = (byte) (value >>> 8);
-        bytes[offset + 2] = (byte) (value >>> 16);
-        bytes[offset + 3] = (byte) (value >>> 24);
-    }
-
-    private static Path writeManagedPair(
-            Path root,
-            BackupManifest manifest,
-            Consumer<ZipOutputStream> contents) throws IOException {
-        Path directory = Files.createDirectories(root.resolve(manifest.worldId().toString()));
-        Path archive = directory.resolve(managedFilename(manifest));
-        rewriteArchive(archive, contents);
-        String checksum = Digests.sha256(archive);
-        Files.writeString(
-                Path.of(archive + ".sha256"),
-                checksum + "  " + archive.getFileName() + "\n",
-                StandardCharsets.UTF_8);
-        return archive;
-    }
-
-    private static void writeEntry(ZipOutputStream zip, String name, byte[] contents) {
-        try {
-            ZipEntry entry = new ZipEntry(name);
-            zip.putNextEntry(entry);
-            zip.write(contents);
-            zip.closeEntry();
-        } catch (IOException exception) {
-            throw new UncheckedTestIOException(exception);
-        }
-    }
-
-    private static String managedFilename(BackupManifest manifest) {
-        String timestamp = manifest.createdAt().toString()
-                .replace("-", "")
-                .replace(":", "")
-                .replace(".", "");
-        timestamp = timestamp.substring(0, 15) + timestamp.substring(15, 18) + "Z";
-        return timestamp + "_" + manifest.backupId() + ".zip";
-    }
-
-    private static String sha256(byte[] bytes) {
-        var digest = Digests.sha256();
-        digest.update(bytes);
-        return Digests.hex(digest.digest());
-    }
-
-    private record Fixture(Path world, Path root, BackupManifest manifest) {
-    }
-
-    private static final class UncheckedTestIOException extends RuntimeException {
-        private final IOException cause;
-
-        UncheckedTestIOException(IOException cause) {
-            super(cause);
-            this.cause = cause;
-        }
-
-        IOException cause() {
-            return cause;
-        }
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupStoreTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupStoreTest.java
index 77baafc..58d3e74 100644
--- a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupStoreTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipBackupStoreTest.java
@@ -1,55 +1,62 @@
 package dev.ishaanko.worldarchive.storage.zip;
 
-import dev.ishaanko.worldarchive.core.Digests;
+import static dev.ishaanko.worldarchive.storage.zip.ZipTestFixtures.CREATED_AT;
+import static dev.ishaanko.worldarchive.storage.zip.ZipTestFixtures.NO_PROGRESS;
+import static dev.ishaanko.worldarchive.storage.zip.ZipTestFixtures.bytes;
+import static dev.ishaanko.worldarchive.storage.zip.ZipTestFixtures.capture;
+import static dev.ishaanko.worldarchive.storage.zip.ZipTestFixtures.checksumOf;
+import static dev.ishaanko.worldarchive.storage.zip.ZipTestFixtures.files;
 import static org.junit.jupiter.api.Assertions.assertArrayEquals;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
-import dev.ishaanko.worldarchive.core.BackupCapture;
+import dev.ishaanko.worldarchive.config.FolderOrigin;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupManifest;
 import dev.ishaanko.worldarchive.model.BackupTrigger;
 import dev.ishaanko.worldarchive.model.WorldId;
 import java.io.IOException;
+import java.io.RandomAccessFile;
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.FileSystems;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.nio.file.StandardOpenOption;
+import java.nio.file.attribute.PosixFilePermissions;
 import java.time.Instant;
 import java.util.List;
+import java.util.Locale;
+import java.util.Map;
 import java.util.Optional;
-import java.util.function.Consumer;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipOutputStream;
+import java.util.TreeMap;
+import java.util.stream.Stream;
+import java.util.zip.ZipFile;
 import org.junit.jupiter.api.Assumptions;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
 class ZipBackupStoreTest {
-    private static final Instant CREATED_AT = Instant.parse("2026-07-17T20:15:30.123Z");
+    private final WorldId worldId = WorldId.create();
 
     @TempDir
     Path temporaryDirectory;
 
     @Test
     void archiveFilenameIsReadableAndKeepsItsManagedIdentity() throws Exception {
-        Path world = Files.createDirectories(temporaryDirectory.resolve("world"));
-        Files.writeString(world.resolve("level.dat"), "world data", StandardCharsets.UTF_8);
-        BackupManifest manifest = manifestFor(world, CREATED_AT);
+        Path world = ZipTestFixtures.world(temporaryDirectory.resolve("world"), files("level.dat", "world data"));
 
-        ZipBackupArtifact artifact = new ZipBackupStore(temporaryDirectory.resolve("archives"))
-                .create(new BackupCapture(world, manifest));
+        ZipBackupArtifact artifact = store().create(capture(world, WorldId.create(), CREATED_AT), NO_PROGRESS);
 
         assertEquals(
-                "2026-07-17_20-15-30Z - Test World - Snapshot 世界 - "
-                        + manifest.backupId() + ".zip",
+                "2026-09-01_12-00-00Z - Test World - Snapshot 世界 - " + artifact.manifest().backupId() + ".zip",
                 artifact.archivePath().getFileName().toString());
     }
 
     @Test
-    void archiveFilenameFitsPortableComponentByteLimits() throws Exception {
+    void archiveFilenameFitsPortableComponentByteLimits() {
         BackupManifest manifest = BackupManifest.create(
                 BackupId.create(),
                 WorldId.create(),
@@ -61,7 +68,8 @@ void archiveFilenameFitsPortableComponentByteLimits() throws Exception {
                 0,
                 0,
                 "0".repeat(64),
-                "0".repeat(64));
+                "0".repeat(64),
+                Optional.empty());
 
         String filename = ZipBackupStore.archiveFilename(manifest);
 
@@ -70,395 +78,283 @@ void archiveFilenameFitsPortableComponentByteLimits() throws Exception {
     }
 
     @Test
-    void roundTripPreservesBytesUnicodeAndEmptyDirectories() throws Exception {
-        Path world = Files.createDirectories(temporaryDirectory.resolve("world"));
-        byte[] level = new byte[Digests.COPY_BUFFER_BYTES * 2 + 37];
-        for (int index = 0; index < level.length; index++) {
-            level[index] = (byte) (index * 31);
-        }
-        Files.write(world.resolve("level.dat"), level);
-        Path unicodeFile = world.resolve("région-世界").resolve("данные.txt");
-        Files.createDirectories(unicodeFile.getParent());
-        Files.writeString(unicodeFile, "héllo 世界\n", StandardCharsets.UTF_8);
+    void roundTripKeepsBytesUnicodeCompressibleFilesAndEmptyFolders() throws Exception {
+        Map<String, byte[]> worldFiles = new TreeMap<>();
+        worldFiles.put("level.dat", bytes(ZipArchiveReader.BUFFER_BYTES * 2 + 37, 1));
+        worldFiles.put("région-世界/данные.txt", "héllo 世界\n".getBytes(StandardCharsets.UTF_8));
+        worldFiles.put("region/r.0.0.mca", new byte[4 * 1_024 * 1_024]);
+        worldFiles.put("data/session.lock", "only the one next to level.dat is left out".getBytes(StandardCharsets.UTF_8));
+        worldFiles.put("empty.txt", new byte[0]);
+        Path world = ZipTestFixtures.world(temporaryDirectory.resolve("world"), worldFiles);
         Files.createDirectories(world.resolve("empty").resolve("nested"));
-        Files.createDirectories(world.resolve(".worldarchive"));
-        Files.writeString(world.resolve(".worldarchive").resolve("internal.txt"), "excluded");
-        Files.writeString(world.resolve("session.lock"), "excluded");
-        Path nestedSessionLock = world.resolve("data").resolve("session.lock");
-        Files.createDirectories(nestedSessionLock.getParent());
-        Files.writeString(nestedSessionLock, "retained");
-
-        BackupManifest manifest = manifestFor(world, CREATED_AT);
-        ZipBackupStore store = new ZipBackupStore(temporaryDirectory.resolve("archives"));
-        ZipBackupArtifact artifact = store.create(new BackupCapture(world, manifest));
-
-        assertTrue(Files.isRegularFile(artifact.archivePath()));
-        assertTrue(Files.isRegularFile(artifact.checksumPath()));
-        assertFalse(Files.exists(Path.of(artifact.archivePath() + ".partial")));
-        assertFalse(Files.exists(Path.of(artifact.checksumPath() + ".partial")));
-        assertEquals(manifest.sourceSha256(), artifact.manifest().sourceSha256());
-        assertEquals(manifest, artifact.manifest());
-        assertEquals(List.of(artifact), store.listCompleteArchives());
+        ZipBackupStore store = store();
 
-        ZipVerification verification = store.verify(artifact.archivePath());
-        assertTrue(verification.valid(), () -> String.join("; ", verification.problems()));
-        assertEquals(3, verification.verifiedFileCount());
-        assertEquals(level.length
-                        + "héllo 世界\n".getBytes(StandardCharsets.UTF_8).length
-                        + "retained".getBytes(StandardCharsets.UTF_8).length,
-                verification.verifiedByteCount());
+        ZipBackupArtifact artifact = store.create(capture(world, WorldId.create(), CREATED_AT), NO_PROGRESS);
 
+        assertEquals(List.of(artifact), store.listArchives());
+        assertEquals(List.of(artifact.archivePath().getFileName(), checksumOf(artifact).getFileName()),
+                fileNames(artifact.archivePath().getParent()));
+        ZipVerification verification = store.verify(artifact.archivePath());
+        assertEquals(List.of(), verification.problems());
+        assertEquals(List.of(), verification.warnings());
+        assertEquals(Optional.of(artifact.manifest()), verification.manifest());
         Path staging = Files.createDirectory(temporaryDirectory.resolve("staging"));
-        store.materialize(artifact.archivePath(), staging);
-        assertArrayEquals(level, Files.readAllBytes(staging.resolve("level.dat")));
-        assertEquals("héllo 世界\n", Files.readString(
-                staging.resolve("région-世界").resolve("данные.txt"), StandardCharsets.UTF_8));
+        assertEquals(artifact.manifest(), store.materialize(artifact.archivePath(), staging));
+        assertSameFiles(worldFiles, staging);
         assertTrue(Files.isDirectory(staging.resolve("empty").resolve("nested")));
-        assertFalse(Files.exists(staging.resolve(".worldarchive")));
-        assertFalse(Files.exists(staging.resolve("session.lock")));
-        assertEquals("retained", Files.readString(staging.resolve("data").resolve("session.lock")));
+        assertEquals(
+                List.of(new ZipArchiveSize(
+                        artifact.manifest().backupId(),
+                        artifact.archivePath(),
+                        Files.size(artifact.archivePath()) + Files.size(checksumOf(artifact)))),
+                store.listSizes(artifact.manifest().worldId()));
     }
 
     @Test
-    void highlyCompressibleManagedArchiveStillRoundTrips() throws Exception {
-        Path world = Files.createDirectories(temporaryDirectory.resolve("compressed-world"));
-        byte[] contents = new byte[4 * 1_024 * 1_024];
-        Files.write(world.resolve("level.dat"), contents);
-        BackupManifest manifest = manifestFor(world, CREATED_AT);
-        ZipBackupStore store = new ZipBackupStore(
-                temporaryDirectory.resolve("compressed-archives"));
-
-        ZipBackupArtifact artifact = store.create(new BackupCapture(world, manifest));
-
-        assertTrue(contents.length > Files.size(artifact.archivePath()) * 100);
-        assertTrue(ZipLimits.maximumUncompressedBytes(Files.size(artifact.archivePath()))
-                >= contents.length);
-        assertTrue(store.verify(artifact.archivePath()).valid());
-        Path staging = Files.createDirectory(
-                temporaryDirectory.resolve("compressed-staging"));
-        store.materialize(artifact.archivePath(), staging);
-        assertArrayEquals(contents, Files.readAllBytes(staging.resolve("level.dat")));
+    void aBackupThatLostItsChecksumFileIsStillListedVerifiedAndRestored() throws Exception {
+        ZipBackupStore store = store();
+        ZipBackupArtifact kept = createSimple(store, "kept", CREATED_AT);
+        ZipBackupArtifact bare = createSimple(store, "bare", CREATED_AT.plusSeconds(1));
+        Files.delete(checksumOf(bare));
+        Files.writeString(bare.archivePath().resolveSibling(
+                "2026-09-01_10-00-00Z - Test World - Manual - " + BackupId.create() + ".zip"), "not a zip");
+
+        assertEquals(List.of(bare, kept), store.listArchives());
+        ZipVerification verification = store.verify(bare.archivePath());
+        assertTrue(verification.valid(), verification.problems().toString());
+        assertEquals(1, verification.warnings().size());
+        Path staging = Files.createDirectory(temporaryDirectory.resolve("staging"));
+        store.materialize(bare.archivePath(), staging);
+        assertEquals("bare", Files.readString(staging.resolve("level.dat")));
     }
 
     @Test
-    void archiveTamperingBreaksSidecarVerification() throws Exception {
-        CreatedBackup created = createSimpleBackup(CREATED_AT);
-        Files.write(created.artifact().archivePath(), new byte[] {42}, StandardOpenOption.APPEND);
-
-        ZipVerification verification = created.store().verify(created.artifact().archivePath());
-
-        assertFalse(verification.valid());
-        assertTrue(verification.problems().contains(
-                "The ZIP archive checksum does not match its sidecar."));
+    void anArchiveThatCannotBeReadDoesNotHideTheOthers() throws Exception {
+        Assumptions.assumeTrue(FileSystems.getDefault().supportedFileAttributeViews().contains("posix"));
+        ZipBackupStore store = store();
+        ZipBackupArtifact readable = createSimple(store, "readable", CREATED_AT);
+        ZipBackupArtifact locked = createSimple(store, "locked", CREATED_AT.plusSeconds(1));
+        Files.setPosixFilePermissions(locked.archivePath(), PosixFilePermissions.fromString("---------"));
+        Assumptions.assumeFalse(Files.isReadable(locked.archivePath()), "permissions do not apply to this user");
+
+        assertEquals(List.of(readable), store.listArchives());
+        assertThrows(IOException.class, () -> store.verify(locked.archivePath()));
     }
 
+    /**
+     * A create removes what interrupted creates and imports left. A checksum file whose archive
+     * is missing stays: a sync tool may deliver the archive later, or the player moved it away
+     * for a moment.
+     */
     @Test
-    void perFileTamperingIsRejectedEvenWhenSidecarMatches() throws Exception {
-        Path root = temporaryDirectory.resolve("archives");
-        WorldId worldId = WorldId.create();
-        BackupId backupId = BackupId.create();
-        byte[] expected = "expected".getBytes(StandardCharsets.UTF_8);
-        byte[] changed = "tampered".getBytes(StandardCharsets.UTF_8);
-        ZipInventory inventory = ZipInventory.create(List.of(new ZipInventoryEntry(
-                "level.dat", expected.length, sha256(expected))));
-        BackupManifest manifest = BackupManifest.create(
-                backupId,
-                worldId,
-                "World",
-                Optional.empty(),
-                CREATED_AT,
-                BackupTrigger.MANUAL,
-                1,
-                expected.length,
-                1,
-                ZipDigests.contentSha256(inventory.files()),
-                inventory.inventorySha256());
-        Path archive = writeManagedPair(root, manifest, zip -> {
-            writeEntry(zip, ZipArchiveFormat.MANIFEST_ENTRY, ZipMetadataCodec.encodeManifest(manifest));
-            writeEntry(zip, ZipArchiveFormat.WORLD_PREFIX, new byte[0]);
-            writeEntry(zip, ZipArchiveFormat.WORLD_PREFIX + "level.dat", changed);
-            writeEntry(zip, ZipArchiveFormat.INVENTORY_ENTRY, ZipMetadataCodec.encodeInventory(inventory));
-        });
-
-        ZipVerification verification = new ZipBackupStore(root).verify(archive);
-
-        assertFalse(verification.valid());
-        assertTrue(verification.problems().contains(
-                "Archive entry checksum does not match its inventory."));
+    void aCreateRemovesLeftoversOfInterruptedOperationsAndNothingElse() throws Exception {
+        ZipBackupStore store = store();
+        ZipBackupArtifact existing = createSimple(store, "existing", CREATED_AT);
+        Path folder = existing.archivePath().getParent();
+        String other = "2026-09-01_11-00-00Z - Test World - Manual - " + BackupId.create() + ".zip";
+        String legacy = "20260717T201530123Z_" + BackupId.create() + ".zip";
+        List<Path> leftovers = List.of(
+                Files.writeString(folder.resolve(other + ".partial"), "half an archive"),
+                Files.writeString(folder.resolve(other + ".sha256.partial"), "half a checksum"),
+                Files.writeString(folder.resolve(legacy + ".importing"), "half an import"),
+                Files.writeString(folder.resolve(legacy + ".sha256.importing"), "half a checksum"),
+                Files.writeString(folder.resolve(".worldarchive.guard"), ""));
+        Path userFile = Files.writeString(folder.resolve("notes.zip.partial"), "not ours");
+        Path awayForAMoment = Files.writeString(folder.resolve(legacy + ".sha256"), "a checksum without its archive");
+
+        ZipBackupArtifact next = createSimple(store, "next", CREATED_AT.plusSeconds(60));
+
+        assertTrue(leftovers.stream().noneMatch(Files::exists), leftovers.toString());
+        assertTrue(Files.exists(userFile));
+        assertTrue(Files.exists(awayForAMoment));
+        assertTrue(store.verify(existing.archivePath()).valid());
+        assertEquals(List.of(next, existing), store.listArchives());
     }
 
     @Test
-    void traversalEntryIsRejectedAndNeverMaterialized() throws Exception {
-        Path root = temporaryDirectory.resolve("archives");
-        BackupManifest manifest = emptyManifest(CREATED_AT);
-        Path archive = writeManagedPair(root, manifest, zip -> {
-            writeEntry(zip, "../escape.txt", "escape".getBytes(StandardCharsets.UTF_8));
-            writeEntry(zip, ZipArchiveFormat.MANIFEST_ENTRY, ZipMetadataCodec.encodeManifest(manifest));
-            writeEntry(zip, ZipArchiveFormat.INVENTORY_ENTRY,
-                    ZipMetadataCodec.encodeInventory(ZipInventory.create(List.of())));
-        });
-        ZipBackupStore store = new ZipBackupStore(root);
-
-        ZipVerification verification = store.verify(archive);
-
-        assertFalse(verification.valid());
-        assertTrue(verification.problems().contains("Archive contains an unsafe entry path."));
-        Path staging = Files.createDirectory(temporaryDirectory.resolve("staging"));
-        assertThrows(ZipBackupException.class, () -> store.materialize(archive, staging));
-        assertFalse(Files.exists(temporaryDirectory.resolve("escape.txt")));
-    }
+    void deletionRemovesOnlyTheSelectedPair() throws Exception {
+        ZipBackupStore store = store();
+        ZipBackupArtifact first = createSimple(store, "first", CREATED_AT);
+        ZipBackupArtifact second = createSimple(store, "second", CREATED_AT.plusSeconds(1));
+        Path partial = Files.writeString(first.archivePath().resolveSibling("unrelated.zip.partial"), "partial");
 
-    @Test
-    void duplicateNormalizedPathsAreRejected() throws Exception {
-        Path root = temporaryDirectory.resolve("archives");
-        BackupManifest manifest = emptyManifest(CREATED_AT);
-        Path archive = writeManagedPair(root, manifest, zip -> {
-            writeEntry(zip, "world/Data/file.bin", new byte[] {1});
-            writeEntry(zip, "world/data/file.bin", new byte[] {2});
-            writeEntry(zip, ZipArchiveFormat.MANIFEST_ENTRY, ZipMetadataCodec.encodeManifest(manifest));
-            writeEntry(zip, ZipArchiveFormat.INVENTORY_ENTRY,
-                    ZipMetadataCodec.encodeInventory(ZipInventory.create(List.of())));
-        });
-
-        ZipVerification verification = new ZipBackupStore(root).verify(archive);
-
-        assertFalse(verification.valid());
-        assertTrue(verification.problems().contains(
-                "Archive contains duplicate normalized entry paths."));
+        assertTrue(store.delete(first.archivePath()));
+
+        assertFalse(Files.exists(first.archivePath()));
+        assertFalse(Files.exists(checksumOf(first)));
+        assertFalse(store.delete(first.archivePath()));
+        assertTrue(Files.exists(second.archivePath()));
+        assertTrue(Files.exists(checksumOf(second)));
+        assertTrue(Files.exists(partial));
+        assertThrows(ZipBackupException.class, () -> store.delete(temporaryDirectory.resolve("outside.zip")));
     }
 
+    /** A world's folder that is a link to another drive: a create writes through it, and list and delete follow it too. */
     @Test
-    void fileAndDescendantPathConflictIsRejected() throws Exception {
-        Path root = temporaryDirectory.resolve("archives");
-        BackupManifest manifest = emptyManifest(CREATED_AT);
-        Path archive = writeManagedPair(root, manifest, zip -> {
-            writeEntry(zip, "world/data", new byte[] {1});
-            writeEntry(zip, "world/data/child.bin", new byte[] {2});
-            writeEntry(zip, ZipArchiveFormat.MANIFEST_ENTRY,
-                    ZipMetadataCodec.encodeManifest(manifest));
-            writeEntry(zip, ZipArchiveFormat.INVENTORY_ENTRY,
-                    ZipMetadataCodec.encodeInventory(ZipInventory.create(List.of())));
-        });
-
-        ZipVerification verification = new ZipBackupStore(root).verify(archive);
-
-        assertFalse(verification.valid());
-        assertTrue(verification.problems().contains(
-                "Archive contains a file/directory path conflict."));
+    void aWorldFolderThatIsALinkIsListedAndItsArchiveDeleted() throws Exception {
+        Path elsewhere = Files.createDirectories(temporaryDirectory.resolve("other-drive/world-archives"));
+        try {
+            Files.createSymbolicLink(Files.createDirectories(temporaryDirectory.resolve("archives"))
+                    .resolve(worldId.toString()), elsewhere);
+        } catch (UnsupportedOperationException | IOException exception) {
+            Assumptions.abort("Symbolic links are unavailable: " + exception.getMessage());
+        }
+        ZipBackupStore store = store();
+        ZipBackupArtifact linked = createSimple(store, "linked", CREATED_AT);
+
+        assertEquals(List.of(linked), store.listArchives());
+        assertEquals(1, store.listSizes(worldId).size());
+        assertTrue(store.delete(linked.archivePath()));
+        assertEquals(List.of(), fileNames(elsewhere).stream().filter(name -> name.toString().endsWith(".zip")).toList());
     }
 
+    /** The drive is unmounted: its mount point, the chosen ZIP folder, is there, but the world's folder is not. */
     @Test
-    void unsafePortablePathsAreRejected() {
-        for (String path : List.of("../escape", "/absolute", "C:/drive", "a\\b", "a/./b", "a/../b")) {
-            assertThrows(IllegalArgumentException.class,
-                    () -> PortableZipPath.validate(path, false), path);
-        }
-        assertThrows(IllegalArgumentException.class,
-                () -> PortableZipPath.validate("world/nu\0l", false));
+    void deletingFromAChosenFolderWhoseWorldFolderIsGoneFailsAndCreatesNothing() throws Exception {
+        ZipBackupStore store = new ZipBackupStore(
+                Files.createDirectories(temporaryDirectory.resolve("usb")), FolderOrigin.CHOSEN);
+        ZipBackupArtifact away = createSimple(store, "away", CREATED_AT);
+        Path worldFolder = away.archivePath().getParent();
+        Files.move(worldFolder, temporaryDirectory.resolve("unmounted"));
+
+        ZipBackupException failure = assertThrows(ZipBackupException.class, () -> store.delete(away.archivePath()));
+
+        assertTrue(failure.getMessage().contains("cannot be reached"), failure.getMessage());
+        assertFalse(Files.exists(worldFolder));
     }
 
+    /** A world's folder removed by hand from the default ZIP folder holds nothing to delete, and nothing is created. */
     @Test
-    void partialAndUnpairedFilesAreNotCatalogEntries() throws Exception {
-        Path root = temporaryDirectory.resolve("archives");
-        BackupManifest manifest = emptyManifest(CREATED_AT);
-        Path worldDirectory = Files.createDirectories(root.resolve(manifest.worldId().toString()));
-        String filename = managedFilename(manifest);
-        Files.writeString(worldDirectory.resolve(filename + ".partial"), "partial");
-        Files.writeString(worldDirectory.resolve(filename), "orphan archive");
-        BackupManifest second = emptyManifest(CREATED_AT.plusSeconds(1));
-        String secondName = managedFilename(second);
-        Files.writeString(worldDirectory.resolve(secondName + ".sha256"), "0".repeat(64) + "  " + secondName + "\n");
-
-        assertTrue(new ZipBackupStore(root).listCompleteArchives().isEmpty());
+    void aWorldFolderRemovedByHandFromTheDefaultFolderCountsAsAlreadyDeleted() throws Exception {
+        ZipBackupStore store = store();
+        ZipBackupArtifact removed = createSimple(store, "removed", CREATED_AT);
+        Path worldFolder = removed.archivePath().getParent();
+        Files.move(worldFolder, temporaryDirectory.resolve("trash"));
+
+        assertFalse(store.delete(removed.archivePath()));
+        assertFalse(Files.exists(worldFolder));
     }
 
+    /** Only the checksum file was left under the listed name: the delete removes it and says the archive was gone. */
     @Test
-    void listArchivesReadsIdentityWithoutHashingTheArchive() throws Exception {
-        CreatedBackup created = createSimpleBackup(CREATED_AT);
-        ZipBackupStore store = created.store();
-        assertEquals(store.listCompleteArchives(), store.listArchives());
-
-        // Trailing bytes break the sidecar checksum but leave the leading manifest readable.
-        Files.write(
-                created.artifact().archivePath(),
-                new byte[] {1, 2, 3},
-                StandardOpenOption.APPEND);
-
-        assertTrue(store.listCompleteArchives().isEmpty());
-        assertEquals(List.of(created.artifact()), store.listArchives());
+    void aDeleteThatFindsOnlyTheChecksumFileSaysTheArchiveWasAlreadyGone() throws Exception {
+        ZipBackupStore store = store();
+        ZipBackupArtifact moved = createSimple(store, "moved", CREATED_AT);
+        Files.delete(moved.archivePath());
+
+        assertFalse(store.delete(moved.archivePath()));
+        assertFalse(Files.exists(checksumOf(moved)));
     }
 
+    /**
+     * An archive copied without its checksum file and cut at its central directory cannot be
+     * opened by other ZIP programs, so Verify and import refuse it; a restore still reads it.
+     */
     @Test
-    void listArchivesSkipsPairsWithoutAUsableChecksumSidecar() throws Exception {
-        CreatedBackup created = createSimpleBackup(CREATED_AT);
-        CreatedBackup unpaired = createSimpleBackup(CREATED_AT.plusSeconds(1));
-        CreatedBackup malformed = createSimpleBackup(CREATED_AT.plusSeconds(2));
-        Files.delete(unpaired.artifact().checksumPath());
-        Files.writeString(malformed.artifact().checksumPath(), "not a checksum line\n");
-
-        assertEquals(List.of(created.artifact()), created.store().listArchives());
+    void anArchiveCutAtItsCentralDirectoryWithoutItsChecksumFailsVerifyButStillRestores() throws Exception {
+        ZipBackupStore store = store();
+        ZipBackupArtifact cut = createSimple(store, "cut", CREATED_AT);
+        Files.delete(checksumOf(cut));
+        cutAtCentralDirectory(cut.archivePath());
+        assertThrows(IOException.class, () -> new ZipFile(cut.archivePath().toFile()).close());
+
+        ZipVerification verification = store.verify(cut.archivePath());
+        ZipImportScan scan = new ZipImportScanner().scan(store.root());
+
+        assertFalse(verification.valid(), verification.warnings().toString());
+        assertEquals(List.of(), scan.candidates());
+        Path staging = Files.createDirectory(temporaryDirectory.resolve("staging"));
+        assertEquals(cut.manifest(), store.materialize(cut.archivePath(), staging));
+        assertEquals("cut", Files.readString(staging.resolve("level.dat")));
     }
 
+    /** More entries than an end record can count: Verify reads the count of the ZIP64 end record. */
     @Test
-    void sourceSymlinkIsRejectedWhereSupported() throws Exception {
-        Path world = Files.createDirectories(temporaryDirectory.resolve("world"));
-        Path target = Files.writeString(world.resolve("target.txt"), "target");
-        BackupManifest manifest = manifestFor(world, CREATED_AT);
-        Path link = world.resolve("link.txt");
-        boolean linkCreated;
-        try {
-            Files.createSymbolicLink(link, target.getFileName());
-            linkCreated = true;
-        } catch (IOException | UnsupportedOperationException | SecurityException exception) {
-            linkCreated = false;
+    void anArchiveWithAZip64EndRecordVerifiesWithoutItsChecksum() throws Exception {
+        Map<String, byte[]> files = new TreeMap<>();
+        for (int index = 0; index < 70_000; index++) {
+            files.put(String.format(Locale.ROOT, "data/f%05d", index), new byte[0]);
         }
-        Assumptions.assumeTrue(linkCreated, "Symbolic links are unavailable in this environment");
+        BackupManifest manifest =
+                ZipTestFixtures.manifest(WorldId.create(), ZipTestFixtures.inventory(files), CREATED_AT);
+        Path archive = ZipTestFixtures.writeArchive(
+                temporaryDirectory.resolve("archives"), manifest, ZipTestFixtures.wellFormedEntries(manifest, files));
+        Files.delete(archive.resolveSibling(archive.getFileName() + ".sha256"));
+
+        ZipVerification verification = store().verify(archive);
 
-        assertThrows(ZipBackupException.class, () -> new ZipBackupStore(
-                temporaryDirectory.resolve("archives")).create(new BackupCapture(world, manifest)));
+        assertTrue(verification.valid(), verification.problems().toString());
     }
 
     @Test
-    void restoreRequiresAnExistingEmptyStagingDirectory() throws Exception {
-        CreatedBackup created = createSimpleBackup(CREATED_AT);
+    void restoreRequiresAnExistingEmptyFolder() throws Exception {
+        ZipBackupStore store = store();
+        ZipBackupArtifact artifact = createSimple(store, "world", CREATED_AT);
         Path nonempty = Files.createDirectory(temporaryDirectory.resolve("nonempty"));
         Files.writeString(nonempty.resolve("keep.txt"), "keep");
-        Path absent = temporaryDirectory.resolve("absent");
 
-        assertThrows(ZipBackupException.class,
-                () -> created.store().materialize(created.artifact().archivePath(), nonempty));
+        assertThrows(ZipBackupException.class, () -> store.materialize(artifact.archivePath(), nonempty));
         assertThrows(IOException.class,
-                () -> created.store().materialize(created.artifact().archivePath(), absent));
-        assertEquals("keep", Files.readString(nonempty.resolve("keep.txt")));
+                () -> store.materialize(artifact.archivePath(), temporaryDirectory.resolve("absent")));
+        assertEquals(List.of(Path.of("keep.txt")), fileNames(nonempty));
     }
 
     @Test
-    void deletionIsIsolatedToTheSelectedCompletePair() throws Exception {
-        Path world = Files.createDirectories(temporaryDirectory.resolve("world"));
-        Files.writeString(world.resolve("level.dat"), "data");
-        ZipBackupStore store = new ZipBackupStore(temporaryDirectory.resolve("archives"));
-        ZipBackupArtifact first = store.create(new BackupCapture(world, manifestFor(world, CREATED_AT)));
-        ZipBackupArtifact second = store.create(new BackupCapture(
-                world, manifestFor(world, CREATED_AT.plusSeconds(1))));
-        Path unrelatedPartial = Files.writeString(
-                first.archivePath().getParent().resolve("unrelated.zip.partial"), "partial");
-
-        assertTrue(store.delete(first));
-
-        assertFalse(Files.exists(first.archivePath()));
-        assertFalse(Files.exists(first.checksumPath()));
-        assertFalse(store.delete(first.archivePath()));
-        assertTrue(Files.exists(second.archivePath()));
-        assertTrue(Files.exists(second.checksumPath()));
-        assertTrue(Files.exists(unrelatedPartial));
-        assertThrows(ZipBackupException.class,
-                () -> store.delete(temporaryDirectory.resolve("outside.zip")));
-    }
-
-    private CreatedBackup createSimpleBackup(Instant createdAt) throws Exception {
-        Path world = Files.createDirectories(temporaryDirectory.resolve("world-" + createdAt.toEpochMilli()));
-        Files.writeString(world.resolve("level.dat"), "world data", StandardCharsets.UTF_8);
-        ZipBackupStore store = new ZipBackupStore(temporaryDirectory.resolve("archives"));
-        ZipBackupArtifact artifact = store.create(new BackupCapture(world, manifestFor(world, createdAt)));
-        return new CreatedBackup(store, artifact);
+    void restoreStopsBeforeWritingWhenTheDriveIsTooSmall() throws Exception {
+        Path staging = Files.createDirectory(temporaryDirectory.resolve("staging"));
+        long usable = Files.getFileStore(staging).getUsableSpace();
+        Assumptions.assumeTrue(usable > 0 && usable < Long.MAX_VALUE / 2);
+        Map<String, byte[]> files = files("level.dat", "tiny");
+        BackupManifest honest = ZipTestFixtures.manifest(WorldId.create(), ZipTestFixtures.inventory(files), CREATED_AT);
+        BackupManifest tooLarge = BackupManifest.create(
+                honest.backupId(), honest.worldId(), honest.worldName(), honest.label(), honest.createdAt(),
+                honest.trigger(), 1, usable * 2, 1, honest.contentSha256(), honest.inventorySha256(), Optional.empty());
+        Path archive = ZipTestFixtures.writeArchive(
+                temporaryDirectory.resolve("archives"), tooLarge, ZipTestFixtures.wellFormedEntries(tooLarge, files));
+
+        ZipBackupException failure = assertThrows(ZipBackupException.class,
+                () -> store().materialize(archive, staging));
+
+        assertTrue(failure.getMessage().contains("not enough free space"), failure.getMessage());
+        assertEquals(List.of(), fileNames(staging));
     }
 
-    private static BackupManifest manifestFor(Path world, Instant createdAt) throws IOException {
-        List<ZipInventoryEntry> files = new java.util.ArrayList<>();
-        for (ZipSourceScanner.SourceEntry entry : ZipSourceScanner.snapshot(world).entries()) {
-            if (!entry.directory()) {
-                files.add(new ZipInventoryEntry(
-                        entry.relativePath(), entry.size(), Digests.sha256(entry.path())));
-            }
+    /** Truncates the archive where its central directory starts, as a copy that stopped early would. */
+    private static void cutAtCentralDirectory(Path archive) throws IOException {
+        byte[] bytes = Files.readAllBytes(archive);
+        long offset = ByteBuffer.wrap(bytes, bytes.length - 6, 4).order(ByteOrder.LITTLE_ENDIAN).getInt() & 0xFFFFFFFFL;
+        try (RandomAccessFile file = new RandomAccessFile(archive.toFile(), "rw")) {
+            file.setLength(offset);
         }
-        ZipInventory inventory = ZipInventory.create(files);
-        return BackupManifest.create(
-                BackupId.create(),
-                WorldId.create(),
-                "Test World",
-                Optional.of("Snapshot 世界"),
-                createdAt,
-                BackupTrigger.MANUAL,
-                inventory.fileCount(),
-                inventory.byteCount(),
-                inventory.fileCount(),
-                ZipDigests.contentSha256(inventory.files()),
-                inventory.inventorySha256());
     }
 
-    private static BackupManifest emptyManifest(Instant createdAt) {
-        ZipInventory inventory = ZipInventory.create(List.of());
-        return BackupManifest.create(
-                BackupId.create(),
-                WorldId.create(),
-                "Test World",
-                createdAt,
-                BackupTrigger.MANUAL,
-                0,
-                0,
-                ZipDigests.contentSha256(inventory.files()));
+    private ZipBackupStore store() {
+        return new ZipBackupStore(temporaryDirectory.resolve("archives"), FolderOrigin.DEFAULT);
     }
 
-    private static Path writeManagedPair(
-            Path root,
-            BackupManifest manifest,
-            Consumer<ZipOutputStream> contents) throws IOException {
-        Path directory = Files.createDirectories(root.resolve(manifest.worldId().toString()));
-        Path archive = directory.resolve(managedFilename(manifest));
-        try (ZipOutputStream zip = new ZipOutputStream(Files.newOutputStream(archive), StandardCharsets.UTF_8)) {
-            try {
-                contents.accept(zip);
-            } catch (UncheckedTestIOException exception) {
-                throw exception.cause();
-            }
-        }
-        String checksum = Digests.sha256(archive);
-        Files.writeString(
-                Path.of(archive + ".sha256"),
-                checksum + "  " + archive.getFileName() + "\n",
-                StandardCharsets.UTF_8);
-        return archive;
+    /** A backup of a one-file world whose level.dat holds the name; every one is of the same world. */
+    private ZipBackupArtifact createSimple(ZipBackupStore store, String name, Instant createdAt) throws IOException {
+        Path world = ZipTestFixtures.world(temporaryDirectory.resolve("world-" + name), files("level.dat", name));
+        return store.create(capture(world, worldId, createdAt), NO_PROGRESS);
     }
 
-    private static void writeEntry(ZipOutputStream zip, String name, byte[] contents) {
-        try {
-            ZipEntry entry = new ZipEntry(name);
-            zip.putNextEntry(entry);
-            zip.write(contents);
-            zip.closeEntry();
-        } catch (IOException exception) {
-            throw new UncheckedTestIOException(exception);
+    private static List<Path> fileNames(Path folder) throws IOException {
+        try (Stream<Path> files = Files.list(folder)) {
+            return files.map(Path::getFileName)
+                    .filter(name -> !name.toString().equals(".worldarchive.lock"))
+                    .sorted()
+                    .toList();
         }
     }
 
-    private static String managedFilename(BackupManifest manifest) {
-        String timestamp = manifest.createdAt().toString()
-                .replace("-", "")
-                .replace(":", "")
-                .replace(".", "");
-        timestamp = timestamp.substring(0, 15) + timestamp.substring(15, 18) + "Z";
-        return timestamp + "_" + manifest.backupId() + ".zip";
-    }
-
-    private static String sha256(byte[] bytes) {
-        var digest = Digests.sha256();
-        digest.update(bytes);
-        return Digests.hex(digest.digest());
-    }
-
-    private record CreatedBackup(ZipBackupStore store, ZipBackupArtifact artifact) {
-    }
-
-    private static final class UncheckedTestIOException extends RuntimeException {
-        private final IOException cause;
-
-        UncheckedTestIOException(IOException cause) {
-            super(cause);
-            this.cause = cause;
-        }
-
-        IOException cause() {
-            return cause;
+    private static void assertSameFiles(Map<String, byte[]> expected, Path root) throws IOException {
+        Map<String, byte[]> actual = new TreeMap<>();
+        try (Stream<Path> files = Files.walk(root)) {
+            for (Path file : files.filter(Files::isRegularFile).toList()) {
+                actual.put(root.relativize(file).toString().replace('\\', '/'), Files.readAllBytes(file));
+            }
         }
+        assertEquals(expected.keySet(), actual.keySet());
+        expected.forEach((path, contents) -> assertArrayEquals(contents, actual.get(path), path));
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipDamagedArchiveTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipDamagedArchiveTest.java
new file mode 100644
index 0000000..99ab9dc
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipDamagedArchiveTest.java
@@ -0,0 +1,208 @@
+package dev.ishaanko.worldarchive.storage.zip;
+
+import static dev.ishaanko.worldarchive.storage.zip.ZipTestFixtures.CREATED_AT;
+import static dev.ishaanko.worldarchive.storage.zip.ZipTestFixtures.bytes;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+import dev.ishaanko.worldarchive.config.FolderOrigin;
+import dev.ishaanko.worldarchive.core.WorldInventory;
+import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.WorldId;
+import java.io.IOException;
+import java.io.RandomAccessFile;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardOpenOption;
+import java.util.Arrays;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.TreeMap;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.io.TempDir;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.EnumSource;
+
+/**
+ * Archives that were damaged after they were written, or made by hand to attack the reader.
+ * Each one must fail Verify, must fail a restore without writing outside the restore folder,
+ * and must not be offered by an import preview.
+ */
+class ZipDamagedArchiveTest {
+    private static final Map<String, byte[]> FILES = files();
+
+    @TempDir
+    Path temporaryDirectory;
+
+    @ParameterizedTest
+    @EnumSource(Damage.class)
+    void aDamagedArchiveIsNeverTakenForABackup(Damage damage) throws Exception {
+        Path root = temporaryDirectory.resolve("archives");
+        Path archive = damage.archive(root, temporaryDirectory.resolve("world"));
+        ZipBackupStore store = new ZipBackupStore(root, FolderOrigin.DEFAULT);
+        Path staging = Files.createDirectories(temporaryDirectory.resolve("saves").resolve("staging"));
+
+        ZipVerification verification = store.verify(archive);
+        assertThrows(ZipBackupException.class, () -> store.materialize(archive, staging));
+        ZipImportScan scan = new ZipImportScanner().scan(root);
+
+        assertFalse(verification.valid());
+        assertEquals(1, verification.problems().size());
+        assertEquals(List.of(), scan.candidates());
+        assertEquals(List.of(archive), scan.issues().stream().map(ZipImportIssue::path).toList());
+        assertEquals(List.of(), escaped());
+    }
+
+    /** Every file named like the escape entry, anywhere under the test folder. */
+    private List<Path> escaped() throws IOException {
+        try (Stream<Path> files = Files.walk(temporaryDirectory)) {
+            return files.filter(file -> file.getFileName().toString().equals("escape.txt")).toList();
+        }
+    }
+
+    private static Map<String, byte[]> files() {
+        Map<String, byte[]> files = new TreeMap<>();
+        files.put("level.dat", bytes(2_048, 1));
+        files.put("region/r.0.0.mca", bytes(64 * 1_024, 2));
+        return files;
+    }
+
+    private static BackupManifest manifest(WorldInventory inventory) {
+        return ZipTestFixtures.manifest(WorldId.create(), inventory, CREATED_AT);
+    }
+
+    /** One way an archive can be damaged or hostile. */
+    enum Damage {
+        FLIPPED_BYTE_IN_A_WORLD_FILE {
+            @Override
+            Path archive(Path root, Path world) throws IOException {
+                Path archive = written(root, world);
+                try (RandomAccessFile file = new RandomAccessFile(archive.toFile(), "rw")) {
+                    long middle = file.length() / 2;
+                    file.seek(middle);
+                    int value = file.read();
+                    file.seek(middle);
+                    file.write(value ^ 0xFF);
+                }
+                return archive;
+            }
+        },
+        CUT_SHORT {
+            @Override
+            Path archive(Path root, Path world) throws IOException {
+                Path archive = written(root, world);
+                byte[] complete = Files.readAllBytes(archive);
+                Files.write(archive, Arrays.copyOf(complete, complete.length / 2));
+                return archive;
+            }
+        },
+        BYTES_ADDED_AFTER_IT_WAS_MADE {
+            @Override
+            Path archive(Path root, Path world) throws IOException {
+                Path archive = written(root, world);
+                Files.write(archive, new byte[] {42}, StandardOpenOption.APPEND);
+                return archive;
+            }
+        },
+        ENTRY_OUTSIDE_THE_WORLD {
+            @Override
+            Path archive(Path root, Path world) throws IOException {
+                return crafted(root, "../escape.txt", "escape");
+            }
+        },
+        ENTRY_THAT_CLIMBS_OUT_OF_THE_WORLD {
+            @Override
+            Path archive(Path root, Path world) throws IOException {
+                return crafted(root, "world/../../escape.txt", "escape");
+            }
+        },
+        TWO_FILES_THAT_DIFFER_ONLY_IN_CASE {
+            @Override
+            Path archive(Path root, Path world) throws IOException {
+                return crafted(root, "world/LEVEL.DAT", "a second level.dat");
+            }
+        },
+        FOLDER_ENTRY_NAMED_LIKE_A_FILE {
+            @Override
+            Path archive(Path root, Path world) throws IOException {
+                return crafted(root, "world/level.dat/", "");
+            }
+        },
+        FOLDER_ENTRY_INSIDE_A_FILE {
+            @Override
+            Path archive(Path root, Path world) throws IOException {
+                return crafted(root, "world/level.dat/inner/", "");
+            }
+        },
+        FILE_THE_FILE_LIST_DOES_NOT_NAME {
+            @Override
+            Path archive(Path root, Path world) throws IOException {
+                return crafted(root, "world/extra.dat", "not in the file list");
+            }
+        },
+        FILE_WHOSE_BYTES_DIFFER_FROM_THE_FILE_LIST {
+            @Override
+            Path archive(Path root, Path world) throws IOException {
+                BackupManifest manifest = manifest(ZipTestFixtures.inventory(FILES));
+                Map<String, byte[]> entries = ZipTestFixtures.wellFormedEntries(manifest, FILES);
+                byte[] changed = FILES.get("level.dat").clone();
+                changed[0] ^= 1;
+                entries.put("world/level.dat", changed);
+                return ZipTestFixtures.writeArchive(root, manifest, entries);
+            }
+        },
+        MANIFEST_THAT_DOES_NOT_MATCH_THE_FILE_LIST {
+            @Override
+            Path archive(Path root, Path world) throws IOException {
+                Map<String, byte[]> other = new TreeMap<>(FILES);
+                other.put("level.dat", bytes(2_048, 99));
+                BackupManifest manifest = manifest(ZipTestFixtures.inventory(other));
+                Map<String, byte[]> entries = ZipTestFixtures.wellFormedEntries(manifest, FILES);
+                return ZipTestFixtures.writeArchive(root, manifest, entries);
+            }
+        },
+        MORE_DATA_THAN_THE_MANIFEST_LISTS {
+            @Override
+            Path archive(Path root, Path world) throws IOException {
+                Map<String, byte[]> small = Map.of("level.dat", new byte[] {1});
+                BackupManifest manifest = manifest(ZipTestFixtures.inventory(small));
+                Map<String, byte[]> entries = ZipTestFixtures.wellFormedEntries(manifest, small);
+                entries.put("world/level.dat", new byte[1_024 * 1_024]);
+                return ZipTestFixtures.writeArchive(root, manifest, entries);
+            }
+        },
+        NOT_A_WORLDARCHIVE_BACKUP {
+            @Override
+            Path archive(Path root, Path world) throws IOException {
+                BackupManifest manifest = manifest(ZipTestFixtures.inventory(FILES));
+                Map<String, byte[]> entries = new LinkedHashMap<>();
+                entries.put("readme.txt", "a modpack".getBytes(StandardCharsets.UTF_8));
+                return ZipTestFixtures.writeArchive(root, manifest, entries);
+            }
+        };
+
+        /** Builds the archive in the store root; the world folder is free for a real backup. */
+        abstract Path archive(Path root, Path world) throws IOException;
+
+        /** A backup that the store wrote itself. */
+        private static Path written(Path root, Path world) throws IOException {
+            ZipTestFixtures.world(world, FILES);
+            return new ZipBackupStore(root, FolderOrigin.DEFAULT)
+                    .create(ZipTestFixtures.capture(world, WorldId.create(), CREATED_AT), ZipTestFixtures.NO_PROGRESS)
+                    .archivePath();
+        }
+
+        /** A well-formed archive of the files with one more entry just before its file list. */
+        private static Path crafted(Path root, String name, String contents) throws IOException {
+            BackupManifest manifest = manifest(ZipTestFixtures.inventory(FILES));
+            Map<String, byte[]> entries = ZipTestFixtures.wellFormedEntries(manifest, FILES);
+            byte[] inventory = entries.remove(ZipArchiveFormat.INVENTORY_ENTRY);
+            entries.put(name, contents.getBytes(StandardCharsets.UTF_8));
+            entries.put(ZipArchiveFormat.INVENTORY_ENTRY, inventory);
+            return ZipTestFixtures.writeArchive(root, manifest, entries);
+        }
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipGoldenArchiveTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipGoldenArchiveTest.java
new file mode 100644
index 0000000..e292207
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipGoldenArchiveTest.java
@@ -0,0 +1,245 @@
+package dev.ishaanko.worldarchive.storage.zip;
+
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.config.FolderOrigin;
+import dev.ishaanko.worldarchive.core.BackupCapture;
+import dev.ishaanko.worldarchive.core.WorldInventory;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.GameVersionStamp;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.support.Digests;
+import java.io.IOException;
+import java.net.URISyntaxException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.MessageDigest;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Random;
+import java.util.TreeMap;
+import java.util.stream.Stream;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipInputStream;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+/**
+ * Archives written by the WorldArchive 0.3.9 ZIP writer, kept byte for byte under
+ * {@code src/test/resources/zip/golden}: one per file-name format (the readable name and the
+ * 0.1.0 {@code <timestamp>_<backup id>.zip} name), with and without a label and a game version.
+ * Players keep such archives for years, so every later reader must list, verify, restore and
+ * import them. Never regenerate these files; add new ones instead.
+ */
+final class ZipGoldenArchiveTest {
+    private static final WorldId FIRST_WORLD = WorldId.parse("5c1f0e7a-3b2d-4e6f-8a9b-0c1d2e3f4a5b");
+
+    private static final WorldId SECOND_WORLD = WorldId.parse("9d8c7b6a-5f4e-4d3c-8b2a-1f0e9d8c7b6a");
+
+    private static final List<Golden> GOLDENS = List.of(
+            new Golden(
+                    "2026-09-01_12-34-56Z - Golden World - Before the End - "
+                            + "0a1b2c3d-4e5f-4061-8273-8495a6b7c8d9.zip",
+                    manifest(FIRST_WORLD, "0a1b2c3d-4e5f-4061-8273-8495a6b7c8d9", Optional.of("Before the End"),
+                            "2026-09-01T12:34:56.789Z", BackupTrigger.MANUAL, 2,
+                            Optional.of(new GameVersionStamp("26.3", 4_556)), 1),
+                    1),
+            new Golden(
+                    "2026-09-01_13-00-00Z - Golden World - World Exit - "
+                            + "1b2c3d4e-5f60-4172-8384-95a6b7c8d9ea.zip",
+                    manifest(FIRST_WORLD, "1b2c3d4e-5f60-4172-8384-95a6b7c8d9ea", Optional.empty(),
+                            "2026-09-01T13:00:00Z", BackupTrigger.WORLD_EXIT, 1, Optional.empty(), 11),
+                    11),
+            new Golden(
+                    "20260717T201530123Z_2c3d4e5f-6071-4283-9495-a6b7c8d9eafb.zip",
+                    manifest(SECOND_WORLD, "2c3d4e5f-6071-4283-9495-a6b7c8d9eafb", Optional.of("Nightly"),
+                            "2026-07-17T20:15:30.123Z", BackupTrigger.SCHEDULED, 6, Optional.empty(), 21),
+                    21));
+
+    @TempDir
+    Path temporaryDirectory;
+
+    @Test
+    void everyGoldenArchiveIsListedVerifiedAndRestoredExactly() throws Exception {
+        Path root = copyGoldens(temporaryDirectory.resolve("archives"));
+        ZipBackupStore store = new ZipBackupStore(root, FolderOrigin.DEFAULT);
+
+        List<ZipBackupArtifact> listed = store.listArchives();
+
+        assertEquals(
+                GOLDENS.stream().map(Golden::manifest).sorted(newestFirst()).toList(),
+                listed.stream().map(ZipBackupArtifact::manifest).toList());
+        for (Golden golden : GOLDENS) {
+            Path archive = golden.path(root);
+            ZipVerification verification = store.verify(archive);
+            assertTrue(verification.valid(), golden.filename() + ": " + verification.problems());
+            assertEquals(List.of(), verification.warnings());
+            assertEquals(Optional.of(golden.manifest()), verification.manifest());
+
+            Path staging = Files.createDirectories(temporaryDirectory.resolve("restored-" + golden.levelSeed()));
+            assertEquals(golden.manifest(), store.materialize(archive, staging));
+
+            assertSameFiles(worldFiles(golden.levelSeed()), staging);
+            assertTrue(Files.isDirectory(staging.resolve("empty").resolve("nested")));
+        }
+        assertEquals(
+                List.of(GOLDENS.get(0).path(root), GOLDENS.get(1).path(root)),
+                store.listSizes(FIRST_WORLD).stream().map(ZipArchiveSize::archivePath).toList());
+    }
+
+    @Test
+    void newArchivesKeepTheLayoutOfTheGoldens() throws Exception {
+        Path root = copyGoldens(temporaryDirectory.resolve("archives"));
+        for (Golden golden : GOLDENS) {
+            Path world = temporaryDirectory.resolve("world-" + golden.levelSeed());
+            Map<String, byte[]> files = worldFiles(golden.levelSeed());
+            for (Map.Entry<String, byte[]> file : files.entrySet()) {
+                Files.createDirectories(world.resolve(file.getKey()).getParent());
+                Files.write(world.resolve(file.getKey()), file.getValue());
+            }
+            Files.createDirectories(world.resolve("empty").resolve("nested"));
+
+            ZipBackupArtifact created = new ZipBackupStore(
+                            temporaryDirectory.resolve("new-" + golden.levelSeed()), FolderOrigin.DEFAULT)
+                    .create(new BackupCapture(world, golden.manifest(), inventory(files)), ZipTestFixtures.NO_PROGRESS);
+
+            assertEquals(layout(golden.path(root)), layout(created.archivePath()));
+        }
+    }
+
+    @Test
+    void everyGoldenArchiveCanBeImportedIntoAnotherFolder() throws Exception {
+        Path source = copyGoldens(temporaryDirectory.resolve("source"));
+        ZipBackupStore managed = new ZipBackupStore(temporaryDirectory.resolve("managed"), FolderOrigin.DEFAULT);
+
+        ZipImportScan scan = new ZipImportScanner().scan(source);
+
+        assertEquals(List.of(), scan.issues());
+        assertEquals(GOLDENS.size(), scan.candidates().size());
+        for (ZipImportCandidate candidate : scan.candidates()) {
+            ZipBackupArtifact imported = managed.importCopy(candidate);
+            assertEquals(candidate.manifest(), imported.manifest());
+            assertTrue(managed.verify(imported.archivePath()).valid());
+        }
+    }
+
+    /**
+     * Copies the goldens into a fresh store root. The 0.1.0 archive gets the Windows line
+     * ending in its checksum file, as players on Windows have it.
+     */
+    private static Path copyGoldens(Path root) throws IOException, URISyntaxException {
+        Path goldens = Path.of(ZipGoldenArchiveTest.class.getResource("/zip/golden").toURI());
+        try (Stream<Path> files = Files.walk(goldens)) {
+            for (Path file : files.filter(Files::isRegularFile).toList()) {
+                Path target = root.resolve(goldens.relativize(file).toString());
+                Files.createDirectories(target.getParent());
+                Files.copy(file, target);
+            }
+        }
+        Path legacySidecar = GOLDENS.getLast().path(root).resolveSibling(GOLDENS.getLast().filename() + ".sha256");
+        Files.writeString(legacySidecar, Files.readString(legacySidecar).replace("\n", "\r\n"));
+        return root;
+    }
+
+    /** The files of each golden world; the level seed makes every archive different. */
+    private static Map<String, byte[]> worldFiles(long levelSeed) {
+        Map<String, byte[]> files = new TreeMap<>();
+        files.put("level.dat", bytes(2_048, levelSeed));
+        byte[] region = new byte[16_384];
+        System.arraycopy(bytes(8_192, 2), 0, region, 0, 8_192);
+        files.put("region/r.0.0.mca", region);
+        files.put("playerdata/3f1a2b.dat", bytes(1_024, 3));
+        files.put("datapacks/Ünïcødé pack/pack.mcmeta", "{\"pack\":{}}".getBytes(StandardCharsets.UTF_8));
+        files.put("data/session.lock", "kept".getBytes(StandardCharsets.UTF_8));
+        files.put("empty.txt", new byte[0]);
+        return files;
+    }
+
+    private static BackupManifest manifest(
+            WorldId worldId,
+            String backupId,
+            Optional<String> label,
+            String createdAt,
+            BackupTrigger trigger,
+            long changedFileCount,
+            Optional<GameVersionStamp> gameVersion,
+            long levelSeed) {
+        WorldInventory inventory = inventory(worldFiles(levelSeed));
+        return BackupManifest.create(
+                BackupId.parse(backupId),
+                worldId,
+                "Golden World",
+                label,
+                Instant.parse(createdAt),
+                trigger,
+                inventory.fileCount(),
+                inventory.byteCount(),
+                changedFileCount,
+                inventory.contentSha256(),
+                inventory.inventorySha256(),
+                gameVersion);
+    }
+
+    /** Every entry name in order, and the text of the manifest and the inventory. */
+    private static List<String> layout(Path archive) throws IOException {
+        List<String> layout = new ArrayList<>();
+        try (ZipInputStream zip = new ZipInputStream(Files.newInputStream(archive), StandardCharsets.UTF_8)) {
+            for (ZipEntry entry = zip.getNextEntry(); entry != null; entry = zip.getNextEntry()) {
+                layout.add(entry.getName());
+                if (entry.getName().startsWith("META-INF/")) {
+                    layout.add(new String(zip.readAllBytes(), StandardCharsets.UTF_8));
+                }
+            }
+        }
+        return layout;
+    }
+
+    private static WorldInventory inventory(Map<String, byte[]> files) {
+        List<WorldInventory.Entry> entries = new ArrayList<>();
+        files.forEach((path, contents) -> entries.add(new WorldInventory.Entry(path, contents.length, sha256(contents))));
+        return WorldInventory.create(entries);
+    }
+
+    private static void assertSameFiles(Map<String, byte[]> expected, Path root) throws IOException {
+        Map<String, byte[]> actual = new TreeMap<>();
+        try (Stream<Path> files = Files.walk(root)) {
+            for (Path file : files.filter(Files::isRegularFile).toList()) {
+                actual.put(root.relativize(file).toString().replace('\\', '/'), Files.readAllBytes(file));
+            }
+        }
+        assertEquals(expected.keySet(), actual.keySet());
+        expected.forEach((path, contents) -> assertArrayEquals(contents, actual.get(path), path));
+    }
+
+    private static Comparator<BackupManifest> newestFirst() {
+        return Comparator.comparing(BackupManifest::createdAt).reversed();
+    }
+
+    private static byte[] bytes(int length, long seed) {
+        byte[] value = new byte[length];
+        new Random(seed).nextBytes(value);
+        return value;
+    }
+
+    private static String sha256(byte[] contents) {
+        MessageDigest digest = Digests.sha256();
+        digest.update(contents);
+        return Digests.hex(digest.digest());
+    }
+
+    /** One golden archive: its file name, the manifest it holds, and the seed of its level.dat. */
+    private record Golden(String filename, BackupManifest manifest, long levelSeed) {
+        Path path(Path root) {
+            return root.resolve(manifest.worldId().toString()).resolve(filename);
+        }
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipImportTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipImportTest.java
index 1ec0522..1d5e662 100644
--- a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipImportTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipImportTest.java
@@ -1,29 +1,30 @@
 package dev.ishaanko.worldarchive.storage.zip;
 
-import dev.ishaanko.worldarchive.core.Digests;
+import static dev.ishaanko.worldarchive.storage.zip.ZipTestFixtures.CREATED_AT;
+import static dev.ishaanko.worldarchive.storage.zip.ZipTestFixtures.NO_PROGRESS;
+import static dev.ishaanko.worldarchive.storage.zip.ZipTestFixtures.capture;
+import static dev.ishaanko.worldarchive.storage.zip.ZipTestFixtures.files;
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
+import dev.ishaanko.worldarchive.config.FolderOrigin;
 import dev.ishaanko.worldarchive.core.BackupCapture;
-import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.core.TestCaptures;
+import dev.ishaanko.worldarchive.core.WorldInventory;
 import dev.ishaanko.worldarchive.model.BackupManifest;
 import dev.ishaanko.worldarchive.model.BackupTrigger;
 import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.time.Instant;
-import java.util.ArrayList;
+import java.nio.file.StandardOpenOption;
 import java.util.List;
 import java.util.Optional;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.Future;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.locks.ReentrantLock;
+import java.util.stream.Stream;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipOutputStream;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
@@ -32,196 +33,117 @@ final class ZipImportTest {
     Path temporaryDirectory;
 
     @Test
-    void scansAndCopiesOnlyPinnedWorldArchiveArchives() throws Exception {
-        Path world = Files.createDirectories(temporaryDirectory.resolve("world"));
-        Files.writeString(world.resolve("level.dat"), "world-data");
-        BackupManifest manifest = manifest(world);
-        Path sourceRoot = temporaryDirectory.resolve("source-archives");
-        new ZipBackupStore(sourceRoot).create(new BackupCapture(world, manifest));
-        Files.writeString(sourceRoot.resolve("not-a-backup.zip"), "not a zip");
+    void offersOnlyWorldArchiveBackupsAndImportsThemOnce() throws Exception {
+        Path source = temporaryDirectory.resolve("downloads");
+        ZipBackupArtifact backup = new ZipBackupStore(source, FolderOrigin.DEFAULT)
+                .create(worldCapture("world", "world-data"), NO_PROGRESS);
+        Files.writeString(source.resolve("not-a-zip.zip"), "not a zip");
+        try (ZipOutputStream modpack = new ZipOutputStream(Files.newOutputStream(source.resolve("modpack.zip")))) {
+            modpack.putNextEntry(new ZipEntry("mods/readme.txt"));
+            modpack.write("a modpack".getBytes(StandardCharsets.UTF_8));
+        }
+        ZipBackupStore managed = new ZipBackupStore(temporaryDirectory.resolve("managed"), FolderOrigin.DEFAULT);
 
-        ZipImportScan scan = new ZipImportScanner().scan(sourceRoot);
+        ZipImportScan scan = new ZipImportScanner().scan(source);
+        ZipBackupArtifact imported = managed.importCopy(scan.candidates().getFirst());
+        ZipBackupArtifact again = managed.importCopy(scan.candidates().getFirst());
 
         assertEquals(1, scan.candidates().size());
-        assertEquals(1, scan.issues().size());
-        ZipImportCandidate candidate = scan.candidates().getFirst();
-        ZipBackupStore managed = new ZipBackupStore(temporaryDirectory.resolve("managed"));
-        ZipBackupArtifact copied = managed.importCopy(candidate);
-        assertTrue(managed.verify(copied.archivePath()).valid());
-        assertEquals(manifest, copied.manifest());
+        assertEquals(2, scan.issues().size());
+        assertEquals(backup.manifest(), imported.manifest());
+        assertEquals(imported, again);
+        assertTrue(managed.verify(imported.archivePath()).valid());
+        assertArrayEquals(Files.readAllBytes(backup.archivePath()), Files.readAllBytes(imported.archivePath()));
+        assertTrue(Files.isRegularFile(backup.archivePath()));
     }
 
     @Test
-    void rejectsEveryArchiveWhenBackupIdentityIsDuplicated() throws Exception {
-        Path world = Files.createDirectories(temporaryDirectory.resolve("duplicate-world"));
-        Files.writeString(world.resolve("level.dat"), "world-data");
-        Path sourceRoot = temporaryDirectory.resolve("duplicate-archives");
-        ZipBackupArtifact source = new ZipBackupStore(sourceRoot)
-                .create(new BackupCapture(world, manifest(world)));
-        Files.copy(source.archivePath(), sourceRoot.resolve("duplicate.zip"));
-
-        ZipImportScan scan = new ZipImportScanner().scan(sourceRoot);
-
-        assertTrue(scan.candidates().isEmpty());
+    void identicalCopiesCountOnceAndDifferentFilesForOneBackupAreRefused() throws Exception {
+        Path source = temporaryDirectory.resolve("source");
+        ZipBackupArtifact copied =
+                new ZipBackupStore(source.resolve("archives"), FolderOrigin.DEFAULT)
+                        .create(worldCapture("copied", "a"), NO_PROGRESS);
+        Path copy = Files.createDirectories(source.resolve("archives - Copy").resolve("folder"));
+        Files.copy(copied.archivePath(), copy.resolve(copied.archivePath().getFileName()));
+        BackupCapture claimed = worldCapture("claimed", "b");
+        new ZipBackupStore(source.resolve("first"), FolderOrigin.DEFAULT).create(claimed, NO_PROGRESS);
+        Path other = ZipTestFixtures.world(temporaryDirectory.resolve("other"), files("level.dat", "different data"));
+        WorldInventory otherInventory = TestCaptures.inventoryOf(other);
+        BackupManifest sameBackupOtherData = BackupManifest.create(
+                claimed.manifest().backupId(), claimed.manifest().worldId(), "Test World", Optional.empty(),
+                CREATED_AT, BackupTrigger.MANUAL, otherInventory.fileCount(), otherInventory.byteCount(), 1,
+                otherInventory.contentSha256(), otherInventory.inventorySha256(), Optional.empty());
+        new ZipBackupStore(source.resolve("second"), FolderOrigin.DEFAULT)
+                .create(new BackupCapture(other, sameBackupOtherData, otherInventory), NO_PROGRESS);
+
+        ZipImportScan scan = new ZipImportScanner().scan(source);
+
+        assertEquals(List.of(copied.manifest()), scan.candidates().stream().map(ZipImportCandidate::manifest).toList());
         assertEquals(2, scan.issues().size());
-        assertTrue(scan.issues().stream().allMatch(issue ->
-                issue.message().contains("same backup identity")));
     }
 
     @Test
-    void rejectsAnOversizedChecksumSidecar() throws Exception {
-        Path world = Files.createDirectories(temporaryDirectory.resolve("sidecar-world"));
-        Files.writeString(world.resolve("level.dat"), "world-data");
-        Path sourceRoot = temporaryDirectory.resolve("sidecar-source");
-        ZipBackupArtifact source = new ZipBackupStore(sourceRoot)
-                .create(new BackupCapture(world, manifest(world)));
-        Files.writeString(
-                source.checksumPath(),
-                "0".repeat(ZipLimits.MAXIMUM_CHECKSUM_BYTES + 1));
-
-        ZipImportScan scan = new ZipImportScanner().scan(sourceRoot);
-
-        assertTrue(scan.candidates().isEmpty());
-        assertEquals(1, scan.issues().size());
-    }
+    void leftoversOfAnInterruptedImportDoNotBlockTheNextOne() throws Exception {
+        Path source = temporaryDirectory.resolve("source");
+        new ZipBackupStore(source, FolderOrigin.DEFAULT)
+                .create(worldCapture("world", "world-data"), NO_PROGRESS);
+        ZipImportCandidate candidate = new ZipImportScanner().scan(source).candidates().getFirst();
+        ZipBackupStore managed = new ZipBackupStore(temporaryDirectory.resolve("managed"), FolderOrigin.DEFAULT);
+        ManagedZipArchive target = ManagedZipArchive.of(managed.root(), candidate.manifest());
+        Files.createDirectories(target.folder());
+        Files.writeString(target.archive().resolveSibling(target.name() + ".importing"), "half a copy");
+        Files.writeString(target.checksum(), candidate.archiveSha256() + "  " + target.name() + "\r\n");
 
-    @Test
-    void boundedSidecarReaderRejectsMalformedUtf8() throws Exception {
-        Path sidecar = temporaryDirectory.resolve("malformed.sha256");
-        Files.write(sidecar, new byte[] {(byte) 0xff});
+        ZipBackupArtifact imported = managed.importCopy(candidate);
 
-        assertThrows(IOException.class, () -> ZipImportScanner.readSidecar(sidecar));
+        assertTrue(managed.verify(imported.archivePath()).valid());
+        assertEquals(List.of(target.name(), target.name() + ".sha256"), fileNames(target.folder()));
     }
 
     @Test
-    void boundedSidecarReaderPreservesNormalManagedText() throws Exception {
-        Path sidecar = temporaryDirectory.resolve("normal.sha256");
-        String expected = "0".repeat(64) + "  archive 世界.zip\n";
-        Files.writeString(sidecar, expected, StandardCharsets.UTF_8);
+    void aFileThatChangedAfterThePreviewIsNotImported() throws Exception {
+        Path source = temporaryDirectory.resolve("source");
+        ZipBackupArtifact backup = new ZipBackupStore(source, FolderOrigin.DEFAULT)
+                .create(worldCapture("world", "world-data"), NO_PROGRESS);
+        ZipImportCandidate candidate = new ZipImportScanner().scan(source).candidates().getFirst();
+        Files.write(backup.archivePath(), new byte[] {1}, StandardOpenOption.APPEND);
+        ZipBackupStore managed = new ZipBackupStore(temporaryDirectory.resolve("managed"), FolderOrigin.DEFAULT);
 
-        assertEquals(expected, ZipImportScanner.readSidecar(sidecar));
-    }
+        assertThrows(ZipBackupException.class, () -> managed.importCopy(candidate));
 
-    @Test
-    void importWaitsForCreateThroughTheSharedWorldLock() throws Exception {
-        Path world = Files.createDirectories(temporaryDirectory.resolve("locked-world"));
-        Files.writeString(world.resolve("level.dat"), "world-data");
-        BackupManifest manifest = manifest(world);
-        Path sourceRoot = temporaryDirectory.resolve("locked-source");
-        new ZipBackupStore(sourceRoot).create(new BackupCapture(world, manifest));
-        ZipImportCandidate candidate = new ZipImportScanner()
-                .scan(sourceRoot)
-                .candidates()
-                .getFirst();
-        Path managedRoot = temporaryDirectory.resolve("locked-managed");
-        Path managedWorld = managedRoot.resolve(manifest.worldId().toString());
-        CountDownLatch createEntered = new CountDownLatch(1);
-        CountDownLatch releaseCreate = new CountDownLatch(1);
-        ZipStoreHooks hooks = new ZipStoreHooks() {
-            @Override
-            public void archiveCompleted(Path partialArchive) throws IOException {
-                createEntered.countDown();
-                try {
-                    if (!releaseCreate.await(5, TimeUnit.SECONDS)) {
-                        throw new IOException("Timed out while the test held ZIP creation");
-                    }
-                } catch (InterruptedException exception) {
-                    Thread.currentThread().interrupt();
-                    throw new IOException("ZIP creation test wait was interrupted", exception);
-                }
-            }
-        };
-        ZipBackupStore creating = new ZipBackupStore(managedRoot, hooks);
-        ZipBackupStore importing = new ZipBackupStore(managedRoot);
-        ReentrantLock operationLock = ZipBackupStore.processLock(managedWorld);
-
-        try (ExecutorService executor = Executors.newVirtualThreadPerTaskExecutor()) {
-            Future<ZipBackupArtifact> created = executor.submit(
-                    () -> creating.create(new BackupCapture(world, manifest)));
-            assertTrue(createEntered.await(5, TimeUnit.SECONDS));
-            CountDownLatch importStarted = new CountDownLatch(1);
-            Future<ZipBackupArtifact> imported;
-            try {
-                imported = executor.submit(() -> {
-                    importStarted.countDown();
-                    return importing.importCopy(candidate);
-                });
-                assertTrue(importStarted.await(5, TimeUnit.SECONDS));
-                assertTrue(
-                        waitForQueuedThread(operationLock),
-                        "ZIP import did not wait for the active create operation");
-            } finally {
-                releaseCreate.countDown();
-            }
-
-            ZipBackupArtifact createdArtifact = created.get(10, TimeUnit.SECONDS);
-            ZipBackupArtifact importedArtifact = imported.get(10, TimeUnit.SECONDS);
-            assertEquals(createdArtifact, importedArtifact);
-            assertEquals(List.of(createdArtifact), importing.listCompleteArchives());
-        }
+        assertEquals(List.of(), fileNames(ManagedZipArchive.of(managed.root(), candidate.manifest()).folder()));
     }
 
     @Test
-    void resumesImportFromAMatchingChecksumOnlyDestination() throws Exception {
-        Path world = Files.createDirectories(temporaryDirectory.resolve("resumed-world"));
-        Files.writeString(world.resolve("level.dat"), "world-data");
-        BackupManifest manifest = manifest(world);
-        Path sourceRoot = temporaryDirectory.resolve("resumed-source");
-        new ZipBackupStore(sourceRoot).create(new BackupCapture(world, manifest));
-        ZipImportCandidate candidate = new ZipImportScanner()
-                .scan(sourceRoot)
-                .candidates()
-                .getFirst();
-        Path managedRoot = temporaryDirectory.resolve("resumed-managed");
-        Path managedWorld = Files.createDirectories(
-                managedRoot.resolve(manifest.worldId().toString()));
-        String archiveName = ZipBackupStore.archiveFilename(manifest);
-        Path checksum = managedWorld.resolve(archiveName + ".sha256");
-        String checksumText =
-                candidate.archiveSha256() + "  " + archiveName + System.lineSeparator();
-        Files.writeString(checksum, checksumText);
-        ZipBackupStore managed = new ZipBackupStore(managedRoot);
-
-        ZipBackupArtifact imported = managed.importCopy(candidate);
-
-        assertTrue(Files.isRegularFile(imported.archivePath()));
-        assertEquals(checksumText, Files.readString(checksum));
-        assertTrue(Files.isRegularFile(managedWorld.resolve(".worldarchive.lock")));
-        assertTrue(managed.verify(imported.archivePath()).valid());
-        assertEquals(List.of(imported), managed.listCompleteArchives());
+    void aDifferentFileAlreadyStoredForTheBackupIsNeverReplaced() throws Exception {
+        Path source = temporaryDirectory.resolve("source");
+        new ZipBackupStore(source, FolderOrigin.DEFAULT)
+                .create(worldCapture("world", "world-data"), NO_PROGRESS);
+        ZipImportCandidate candidate = new ZipImportScanner().scan(source).candidates().getFirst();
+        ZipBackupStore managed = new ZipBackupStore(temporaryDirectory.resolve("managed"), FolderOrigin.DEFAULT);
+        Path stored = ManagedZipArchive.of(managed.root(), candidate.manifest()).archive();
+        Files.createDirectories(stored.getParent());
+        Files.writeString(stored, "another file under the same name");
+
+        assertThrows(ZipBackupException.class, () -> managed.importCopy(candidate));
+
+        assertEquals("another file under the same name", Files.readString(stored));
     }
 
-    private static boolean waitForQueuedThread(ReentrantLock lock) throws InterruptedException {
-        long deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(5);
-        while (System.nanoTime() < deadline) {
-            if (lock.hasQueuedThreads()) {
-                return true;
-            }
-            Thread.sleep(10);
-        }
-        return lock.hasQueuedThreads();
+    private BackupCapture worldCapture(String name, String level) throws Exception {
+        Path world = ZipTestFixtures.world(temporaryDirectory.resolve("world-" + name), files("level.dat", level));
+        return capture(world, WorldId.create(), CREATED_AT);
     }
 
-    private static BackupManifest manifest(Path world) throws Exception {
-        List<ZipInventoryEntry> files = new ArrayList<>();
-        for (ZipSourceScanner.SourceEntry entry : ZipSourceScanner.snapshot(world).entries()) {
-            if (!entry.directory()) {
-                files.add(new ZipInventoryEntry(
-                        entry.relativePath(), entry.size(), Digests.sha256(entry.path())));
-            }
+    private static List<String> fileNames(Path folder) throws Exception {
+        if (!Files.isDirectory(folder)) {
+            return List.of();
+        }
+        try (Stream<Path> files = Files.list(folder)) {
+            return files.map(file -> file.getFileName().toString())
+                    .filter(name -> !name.equals(".worldarchive.lock"))
+                    .sorted()
+                    .toList();
         }
-        ZipInventory inventory = ZipInventory.create(files);
-        return BackupManifest.create(
-                BackupId.create(),
-                WorldId.create(),
-                "Imported World",
-                Optional.of("Recovery"),
-                Instant.parse("2026-07-21T20:00:00Z"),
-                BackupTrigger.MANUAL,
-                inventory.fileCount(),
-                inventory.byteCount(),
-                inventory.fileCount(),
-                ZipDigests.contentSha256(inventory.files()),
-                inventory.inventorySha256());
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipLimitsTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipLimitsTest.java
deleted file mode 100644
index ed9e2eb..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipLimitsTest.java
+++ /dev/null
@@ -1,21 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-
-import org.junit.jupiter.api.Test;
-
-final class ZipLimitsTest {
-    @Test
-    void boundsUncompressedDataByArchiveSizeAndAbsoluteLimit() {
-        assertEquals(
-                256L * 1_024 * 1_024,
-                ZipLimits.maximumUncompressedBytes(1));
-        assertEquals(
-                2L * 1_024 * 1_024 * 1_024 * 1_000,
-                ZipLimits.maximumUncompressedBytes(
-                        2L * 1_024 * 1_024 * 1_024));
-        assertEquals(
-                ZipLimits.MAXIMUM_UNCOMPRESSED_BYTES,
-                ZipLimits.maximumUncompressedBytes(Long.MAX_VALUE));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipMetadataCodecTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipMetadataCodecTest.java
deleted file mode 100644
index 62c24af..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipMetadataCodecTest.java
+++ /dev/null
@@ -1,93 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.GameVersionStamp;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.time.Instant;
-import java.util.Optional;
-import org.junit.jupiter.api.Test;
-
-class ZipMetadataCodecTest {
-    private static final String LEGACY_DIGEST = "ab".repeat(32);
-
-    @Test
-    void decodesLegacySingleDigestManifest() throws IOException {
-        BackupManifest manifest = ZipMetadataCodec.decodeManifest(
-                legacyManifest(BackupManifest.CURRENT_FORMAT_VERSION));
-
-        assertEquals("11111111-1111-1111-1111-111111111111", manifest.backupId().toString());
-        assertEquals("22222222-2222-2222-2222-222222222222", manifest.worldId().toString());
-        assertEquals("Legacy World", manifest.worldName());
-        assertEquals(Optional.empty(), manifest.label());
-        assertEquals(Instant.parse("2026-07-17T20:00:00Z"), manifest.createdAt());
-        assertEquals(BackupTrigger.MANUAL, manifest.trigger());
-        assertEquals(3L, manifest.sourceFileCount());
-        assertEquals(12L, manifest.sourceByteCount());
-        assertEquals(3L, manifest.changedFileCount());
-        assertEquals(LEGACY_DIGEST, manifest.contentSha256());
-        assertEquals(LEGACY_DIGEST, manifest.inventorySha256());
-    }
-
-    @Test
-    void rejectsUnsupportedManifestFormatVersion() {
-        assertThrows(
-                IOException.class,
-                () -> ZipMetadataCodec.decodeManifest(
-                        legacyManifest(BackupManifest.CURRENT_FORMAT_VERSION + 1)));
-    }
-
-    @Test
-    void decodesManifestsWrittenBeforeGameVersionTracking() throws IOException {
-        BackupManifest manifest = ZipMetadataCodec.decodeManifest(
-                legacyManifest(BackupManifest.CURRENT_FORMAT_VERSION));
-
-        assertEquals(Optional.empty(), manifest.gameVersion());
-    }
-
-    @Test
-    void roundTripsAStampedGameVersion() throws IOException {
-        GameVersionStamp stamp = new GameVersionStamp("26.2", 4_820);
-        BackupManifest stamped = BackupManifest.create(
-                BackupId.parse("11111111-1111-1111-1111-111111111111"),
-                WorldId.parse("22222222-2222-2222-2222-222222222222"),
-                "Stamped World",
-                Optional.empty(),
-                Instant.parse("2026-07-17T20:00:00Z"),
-                BackupTrigger.MANUAL,
-                3L,
-                12L,
-                3L,
-                LEGACY_DIGEST,
-                LEGACY_DIGEST,
-                Optional.of(stamp));
-
-        BackupManifest decoded = ZipMetadataCodec.decodeManifest(
-                ZipMetadataCodec.encodeManifest(stamped));
-
-        assertEquals(Optional.of(stamp), decoded.gameVersion());
-        assertEquals(stamped, decoded);
-    }
-
-    private static byte[] legacyManifest(int formatVersion) {
-        return ("""
-                {
-                    "formatVersion": %d,
-                    "backupId": "11111111-1111-1111-1111-111111111111",
-                    "worldId": "22222222-2222-2222-2222-222222222222",
-                    "worldName": "Legacy World",
-                    "createdAt": "2026-07-17T20:00:00Z",
-                    "trigger": "MANUAL",
-                    "sourceFileCount": 3,
-                    "sourceByteCount": 12,
-                    "sourceSha256": "%s"
-                }
-                """).formatted(formatVersion, LEGACY_DIGEST).getBytes(StandardCharsets.UTF_8);
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipSourceScannerTest.java b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipSourceScannerTest.java
deleted file mode 100644
index 572d552..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipSourceScannerTest.java
+++ /dev/null
@@ -1,46 +0,0 @@
-package dev.ishaanko.worldarchive.storage.zip;
-
-import static org.junit.jupiter.api.Assertions.assertThrows;
-
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.attribute.FileTime;
-import java.time.Instant;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-class ZipSourceScannerTest {
-    @TempDir
-    Path temporaryDirectory;
-
-    @Test
-    void ignoresDirectoryTimestampDriftWhileTreeRemainsStable() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world-directory-time"));
-        Path region = Files.createDirectory(world.resolve("region"));
-        Files.writeString(region.resolve("r.0.0.mca"), "contents", StandardCharsets.UTF_8);
-        ZipSourceScanner.SourceSnapshot snapshot = ZipSourceScanner.snapshot(world);
-
-        Files.setLastModifiedTime(
-                world,
-                FileTime.from(Instant.parse("2026-07-17T12:00:00Z")));
-        Files.setLastModifiedTime(
-                region,
-                FileTime.from(Instant.parse("2026-07-17T12:01:00Z")));
-
-        snapshot.requireUnchanged();
-    }
-
-    @Test
-    void stillDetectsEmptyDirectoryMembershipChanges() throws Exception {
-        Path world = Files.createDirectory(temporaryDirectory.resolve("world-membership"));
-        Files.writeString(world.resolve("level.dat"), "contents", StandardCharsets.UTF_8);
-        FileTime originalRootTime = Files.getLastModifiedTime(world);
-        ZipSourceScanner.SourceSnapshot snapshot = ZipSourceScanner.snapshot(world);
-
-        Files.createDirectory(world.resolve("late-empty-directory"));
-        Files.setLastModifiedTime(world, originalRootTime);
-
-        assertThrows(ZipBackupException.class, snapshot::requireUnchanged);
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipTestFixtures.java b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipTestFixtures.java
new file mode 100644
index 0000000..b3d4885
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/storage/zip/ZipTestFixtures.java
@@ -0,0 +1,136 @@
+package dev.ishaanko.worldarchive.storage.zip;
+
+import dev.ishaanko.worldarchive.core.BackupCapture;
+import dev.ishaanko.worldarchive.core.TestCaptures;
+import dev.ishaanko.worldarchive.core.WorldInventory;
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.support.Digests;
+import java.io.BufferedOutputStream;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Random;
+import java.util.function.LongConsumer;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipOutputStream;
+
+/** Worlds, captures and hand-made archives for the ZIP tests. */
+final class ZipTestFixtures {
+    static final Instant CREATED_AT = Instant.parse("2026-09-01T12:00:00Z");
+
+    /** The progress receiver of a create whose progress the test does not watch. */
+    static final LongConsumer NO_PROGRESS = bytes -> {
+    };
+
+    private ZipTestFixtures() {
+    }
+
+    /** Writes the files under a new world folder and returns the folder. */
+    static Path world(Path folder, Map<String, byte[]> files) throws IOException {
+        Files.createDirectories(folder);
+        for (Map.Entry<String, byte[]> file : files.entrySet()) {
+            Path target = folder.resolve(file.getKey());
+            Files.createDirectories(target.getParent());
+            Files.write(target, file.getValue());
+        }
+        return folder;
+    }
+
+    /** A capture of the folder as one backup of the world, made at the given time. */
+    static BackupCapture capture(Path world, WorldId worldId, Instant createdAt) throws IOException {
+        return TestCaptures.of(world, manifest(worldId, TestCaptures.inventoryOf(world), createdAt));
+    }
+
+    static BackupManifest manifest(WorldId worldId, WorldInventory inventory, Instant createdAt) {
+        return BackupManifest.create(
+                BackupId.create(),
+                worldId,
+                "Test World",
+                Optional.of("Snapshot 世界"),
+                createdAt,
+                BackupTrigger.MANUAL,
+                inventory.fileCount(),
+                inventory.byteCount(),
+                inventory.fileCount(),
+                inventory.contentSha256(),
+                inventory.inventorySha256(),
+                Optional.empty());
+    }
+
+    /** The checksum file next to a published archive. */
+    static Path checksumOf(ZipBackupArtifact artifact) {
+        return artifact.archivePath().resolveSibling(artifact.archivePath().getFileName() + ".sha256");
+    }
+
+    /** The inventory of files that are only in memory. */
+    static WorldInventory inventory(Map<String, byte[]> files) {
+        return WorldInventory.create(files.entrySet().stream()
+                .map(file -> new WorldInventory.Entry(file.getKey(), file.getValue().length, sha256(file.getValue())))
+                .toList());
+    }
+
+    static Map<String, byte[]> files(String... pathsAndContents) {
+        Map<String, byte[]> files = new LinkedHashMap<>();
+        for (int index = 0; index < pathsAndContents.length; index += 2) {
+            files.put(pathsAndContents[index], pathsAndContents[index + 1].getBytes(StandardCharsets.UTF_8));
+        }
+        return files;
+    }
+
+    static byte[] bytes(int length, long seed) {
+        byte[] value = new byte[length];
+        new Random(seed).nextBytes(value);
+        return value;
+    }
+
+    static String sha256(byte[] contents) {
+        var digest = Digests.sha256();
+        digest.update(contents);
+        return Digests.hex(digest.digest());
+    }
+
+    /**
+     * Writes a ZIP with exactly these entries, in this order, at the managed place of the
+     * manifest's backup in the root, with a matching checksum file. Names ending in a slash
+     * are folder entries.
+     */
+    static Path writeArchive(Path root, BackupManifest manifest, Map<String, byte[]> entries) throws IOException {
+        Path archive = ManagedZipArchive.of(root, manifest).archive();
+        Files.createDirectories(archive.getParent());
+        try (ZipOutputStream zip = new ZipOutputStream(
+                new BufferedOutputStream(Files.newOutputStream(archive)), StandardCharsets.UTF_8)) {
+            for (Map.Entry<String, byte[]> entry : entries.entrySet()) {
+                zip.putNextEntry(new ZipEntry(entry.getKey()));
+                zip.write(entry.getValue());
+            }
+        }
+        writeChecksum(archive);
+        return archive;
+    }
+
+    /** The entries of a well-formed archive of these files, in the order the writer uses. */
+    static Map<String, byte[]> wellFormedEntries(BackupManifest manifest, Map<String, byte[]> files) {
+        Map<String, byte[]> entries = new LinkedHashMap<>();
+        entries.put(ZipArchiveFormat.MANIFEST_ENTRY, ZipArchiveFormat.encodeManifest(manifest));
+        entries.put(ZipArchiveFormat.WORLD_PREFIX, new byte[0]);
+        files.forEach((path, contents) -> entries.put(ZipArchiveFormat.WORLD_PREFIX + path, contents));
+        entries.put(ZipArchiveFormat.INVENTORY_ENTRY, ZipArchiveFormat.encodeInventory(inventory(files)));
+        return entries;
+    }
+
+    /** Writes the checksum file of an archive as it is now. */
+    static void writeChecksum(Path archive) throws IOException {
+        Files.writeString(
+                archive.resolveSibling(archive.getFileName() + ".sha256"),
+                Digests.sha256(archive) + "  " + archive.getFileName() + "\n",
+                StandardCharsets.UTF_8);
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/core/AsyncTasksTest.java b/src/test/java/dev/ishaanko/worldarchive/support/AsyncTasksTest.java
similarity index 54%
rename from src/test/java/dev/ishaanko/worldarchive/core/AsyncTasksTest.java
rename to src/test/java/dev/ishaanko/worldarchive/support/AsyncTasksTest.java
index 93d63b4..bf0ea2b 100644
--- a/src/test/java/dev/ishaanko/worldarchive/core/AsyncTasksTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/support/AsyncTasksTest.java
@@ -1,65 +1,22 @@
-package dev.ishaanko.worldarchive.core;
+package dev.ishaanko.worldarchive.support;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertInstanceOf;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.CancellationException;
-import java.util.concurrent.CompletionException;
+import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
-import java.util.concurrent.RejectedExecutionException;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicBoolean;
 import org.junit.jupiter.api.Test;
 
 final class AsyncTasksTest {
-    @Test
-    void cancellationIsRecognizedDirectlyAndWhenWrapped() {
-        CancellationException cancelled = new CancellationException("cancelled");
-
-        assertTrue(AsyncTasks.isCancellation(cancelled));
-        assertTrue(AsyncTasks.isCancellation(new CompletionException(cancelled)));
-        assertFalse(AsyncTasks.isCancellation(new IllegalStateException("failed")));
-        assertFalse(AsyncTasks.isCancellation(null));
-    }
-
-    @Test
-    void supplyExecutorRejectionCompletesTheReturnedStage() {
-        CompletionException failure = assertThrows(
-                CompletionException.class,
-                () -> AsyncTasks.supply(
-                                command -> {
-                                    throw new RejectedExecutionException("rejected");
-                                },
-                                () -> "unused")
-                        .toCompletableFuture()
-                        .join());
-
-        assertInstanceOf(RejectedExecutionException.class, failure.getCause());
-    }
-
-    @Test
-    void runExecutorRejectionCompletesTheReturnedStage() {
-        CompletionException failure = assertThrows(
-                CompletionException.class,
-                () -> AsyncTasks.run(
-                                command -> {
-                                    throw new RejectedExecutionException("rejected");
-                                },
-                                () -> {
-                                })
-                        .toCompletableFuture()
-                        .join());
-
-        assertInstanceOf(RejectedExecutionException.class, failure.getCause());
-    }
-
     @Test
     void stopBeforeStartNeverRunsTheOperation() {
         AtomicBoolean ran = new AtomicBoolean();
@@ -104,4 +61,34 @@ void stopInterruptsTheWorkerAndKeepsItsOutcome() throws Exception {
             executor.shutdownNow();
         }
     }
+
+    @Test
+    void dependentsRunWithTheInterruptCleared() throws Exception {
+        ExecutorService executor = Executors.newSingleThreadExecutor();
+        try {
+            CountDownLatch started = new CountDownLatch(1);
+            AsyncTasks.InterruptibleFuture<String> future = AsyncTasks.supplyInterruptible(
+                    executor,
+                    () -> {
+                        started.countDown();
+                        try {
+                            Thread.sleep(Long.MAX_VALUE);
+                            return "finished";
+                        } catch (InterruptedException exception) {
+                            // A backend that keeps its outcome restores the flag, as a Git push does.
+                            Thread.currentThread().interrupt();
+                            return "kept after interrupt";
+                        }
+                    });
+            CompletableFuture<Boolean> dependentSawInterrupt = future.thenApply(
+                    ignored -> Thread.currentThread().isInterrupted());
+            assertTrue(started.await(5, TimeUnit.SECONDS));
+
+            future.stop(true);
+
+            assertFalse(dependentSawInterrupt.get(5, TimeUnit.SECONDS));
+        } finally {
+            executor.shutdownNow();
+        }
+    }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/support/AtomicFilesTest.java b/src/test/java/dev/ishaanko/worldarchive/support/AtomicFilesTest.java
new file mode 100644
index 0000000..803e69c
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/support/AtomicFilesTest.java
@@ -0,0 +1,64 @@
+package dev.ishaanko.worldarchive.support;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+final class AtomicFilesTest {
+    @TempDir
+    Path temporaryDirectory;
+
+    @Test
+    void rejectsMalformedUtf8() throws IOException {
+        Path source = Files.write(
+                temporaryDirectory.resolve("invalid.json"),
+                new byte[] {(byte) 0xc3, 0x28});
+
+        IOException failure = assertThrows(
+                IOException.class,
+                () -> AtomicFiles.readUtf8(source));
+
+        assertTrue(failure.getMessage().contains("not valid UTF-8"));
+    }
+
+    @Test
+    void aFailedReplaceKeepsTheOldFileAndLeavesNoTemporaryFile() throws IOException {
+        Path catalog = Files.writeString(temporaryDirectory.resolve("catalog.json"), "old");
+
+        // Channel writes fail on an interrupted thread, as they do when a backup is cancelled.
+        Thread.currentThread().interrupt();
+        try {
+            assertThrows(IOException.class, () -> AtomicFiles.writeUtf8(catalog, "new"));
+        } finally {
+            Thread.interrupted();
+        }
+
+        assertEquals("old", Files.readString(catalog));
+        assertEquals(List.of(catalog), filesIn(temporaryDirectory));
+    }
+
+    @Test
+    void aReplaceThatKeepsFailingGivesUpAndLeavesNoTemporaryFile() throws IOException {
+        Path occupied = Files.createDirectory(temporaryDirectory.resolve("catalog.json"));
+        Path kept = Files.writeString(occupied.resolve("kept.txt"), "kept");
+
+        assertThrows(IOException.class, () -> AtomicFiles.writeUtf8(occupied, "new"));
+
+        assertEquals("kept", Files.readString(kept));
+        assertEquals(List.of(occupied), filesIn(temporaryDirectory));
+    }
+
+    private static List<Path> filesIn(Path directory) throws IOException {
+        try (Stream<Path> entries = Files.list(directory)) {
+            return entries.toList();
+        }
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/support/PortablePathTest.java b/src/test/java/dev/ishaanko/worldarchive/support/PortablePathTest.java
new file mode 100644
index 0000000..babdfb8
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/support/PortablePathTest.java
@@ -0,0 +1,100 @@
+package dev.ishaanko.worldarchive.support;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Set;
+import org.junit.jupiter.api.Test;
+
+final class PortablePathTest {
+    private static final Set<String> GIT_INTERNAL_NAMES = Set.of(".worldarchive", ".worldarchive-manifest.json");
+
+    @Test
+    void acceptsPathsThatEverySystemCanRestore() {
+        List<String> accepted = List.of(
+                "level.dat",
+                "region/r.0.0.mca",
+                "datapacks/Ünïcødé pack/pack.mcmeta",
+                ".hidden",
+                "icon/level.dat",
+                "COM10.txt",
+                "clock.txt",
+                "clock$.dat",
+                "datapacks/p/.gitignore",
+                "é".repeat(127),
+                "a/".repeat(2_047) + "b");
+
+        for (String path : accepted) {
+            assertEquals(path, PortablePath.validate(path));
+        }
+        assertEquals("region/r.0.0.mca", PortablePath.fromRelativePath(Path.of("region", "r.0.0.mca")));
+    }
+
+    @Test
+    void rejectsEveryPathThatSomeSystemCannotRestoreAndNamesIt() {
+        List<String> rejected = List.of(
+                "/level.dat",
+                "C:level.dat",
+                "c:/level.dat",
+                "region\\r.0.0.mca",
+                "region/",
+                "region//r.0.0.mca",
+                "./level.dat",
+                "region/../level.dat",
+                "..",
+                "level.dat.",
+                "level.dat ",
+                "a<b", "a>b", "a:b", "a\"b", "a|b", "a?b", "a*b",
+                "a\u0000b", "a\nb", "a\u007fb", "a\u0085b",
+                "a\uFFFDb",
+                "CON", "prn.txt", "Aux.json", "nul", "com1", "COM9.dat", "lpt1", "LPT9.log",
+                "region/con/level.dat", "con.d/level.dat",
+                "x".repeat(256),
+                "é".repeat(128),
+                "a/".repeat(2_048) + "b");
+
+        for (String path : rejected) {
+            IllegalArgumentException failure = assertThrows(
+                    IllegalArgumentException.class, () -> PortablePath.validate(path), path);
+            assertTrue(failure.getMessage().contains(path), failure.getMessage());
+        }
+        assertThrows(IllegalArgumentException.class, () -> PortablePath.validate(""));
+    }
+
+    @Test
+    void directoryEntriesNeedOneTrailingSlash() {
+        assertEquals("region", PortablePath.validateDirectoryEntry("region/"));
+        assertEquals("datapacks/p", PortablePath.validateDirectoryEntry("datapacks/p/"));
+        for (String entry : List.of("region", "/", "region//", "con/")) {
+            assertThrows(IllegalArgumentException.class, () -> PortablePath.validateDirectoryEntry(entry), entry);
+        }
+    }
+
+    @Test
+    void gitSnapshotsAlsoRefuseGitFoldersAndInternalNames() {
+        for (String path : List.of(
+                "datapacks/p/.git/HEAD", ".GIT/config", ".worldarchive/world.json", ".WorldArchive-Manifest.json")) {
+            IllegalArgumentException failure = assertThrows(
+                    IllegalArgumentException.class, () -> PortablePath.requireGitSafe(path, GIT_INTERNAL_NAMES), path);
+            assertTrue(failure.getMessage().contains(path), failure.getMessage());
+        }
+        assertEquals("region/.worldarchive", PortablePath.requireGitSafe("region/.worldarchive", GIT_INTERNAL_NAMES));
+    }
+
+    @Test
+    void collisionKeysIgnoreCaseAndUnicodeNormalization() {
+        assertEquals(PortablePath.collisionKey("Region/R.0.0.mca"), PortablePath.collisionKey("region/r.0.0.mca"));
+        assertEquals(PortablePath.collisionKey("cafe\u0301"), PortablePath.collisionKey("caf\u00e9"));
+    }
+
+    @Test
+    void resolvesOnlyBelowTheRoot() {
+        Path root = Path.of("capture").toAbsolutePath();
+
+        assertEquals(root.resolve("region").resolve("r.0.0.mca"), PortablePath.resolveInside(root, "region/r.0.0.mca"));
+        assertThrows(IllegalArgumentException.class, () -> PortablePath.resolveInside(root, "../outside"));
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/ui/BackupClientScreenLogicTest.java b/src/test/java/dev/ishaanko/worldarchive/ui/BackupClientScreenLogicTest.java
deleted file mode 100644
index 29f078d..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/ui/BackupClientScreenLogicTest.java
+++ /dev/null
@@ -1,66 +0,0 @@
-package dev.ishaanko.worldarchive.ui;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import org.joml.Vector2ic;
-import org.junit.jupiter.api.Test;
-
-final class BackupClientScreenLogicTest {
-    @Test
-    void backupRowTooltipIsClampedInsideTheWindow() {
-        Vector2ic above = BackupRowButton.boundedTooltipPosition(
-                428,
-                256,
-                400,
-                240,
-                170,
-                120);
-        assertEquals(254, above.x());
-        assertEquals(108, above.y());
-
-        Vector2ic below = BackupRowButton.boundedTooltipPosition(
-                428,
-                256,
-                8,
-                8,
-                170,
-                120);
-        assertEquals(20, below.x());
-        assertEquals(20, below.y());
-
-        Vector2ic topRow = BackupRowButton.boundedTooltipPosition(
-                428,
-                256,
-                200,
-                70,
-                170,
-                120);
-        assertEquals(212, topRow.x());
-        assertEquals(82, topRow.y());
-        assertInside(topRow, 170, 120, 428, 256);
-    }
-
-    @Test
-    void retryAdviceRecognizesBothPrivateCaptureMutationMessages() {
-        assertTrue(BackupOperationScreen.captureChanged(
-                "World file changed while its private capture was being created: level.dat"));
-        assertTrue(BackupOperationScreen.captureChanged(
-                "World file changed size while it was being captured: region/r.0.0.mca"));
-        assertFalse(BackupOperationScreen.captureChanged(
-                "Remote repository changed while the Git snapshot was being synchronized"));
-    }
-
-    private static void assertInside(
-            Vector2ic position,
-            int width,
-            int height,
-            int screenWidth,
-            int screenHeight) {
-        assertTrue(position.x() >= 4);
-        assertTrue(position.y() >= 4);
-        assertTrue(position.x() + width <= screenWidth - 4);
-        assertTrue(position.y() + height <= screenHeight - 4);
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/ui/LangKeysTest.java b/src/test/java/dev/ishaanko/worldarchive/ui/LangKeysTest.java
new file mode 100644
index 0000000..3ca0df3
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/ui/LangKeysTest.java
@@ -0,0 +1,55 @@
+package dev.ishaanko.worldarchive.ui;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Set;
+import java.util.TreeSet;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.Test;
+
+/** A lang key that the code names but en_us.json lacks shows the raw key to players. */
+class LangKeysTest {
+    private static final Pattern KEY_IN_CODE = Pattern.compile("\"(screen\\.worldarchive\\.[a-z0-9_.]*[a-z0-9_])\"");
+
+    private static final Pattern KEY_IN_LANG_FILE = Pattern.compile("^\\s*\"([^\"]+)\"\\s*:", Pattern.MULTILINE);
+
+    @Test
+    void everyKeyTheCodeNamesHasEnglishText() throws IOException {
+        Set<String> english = matches(
+                KEY_IN_LANG_FILE,
+                Files.readString(Path.of("src/main/resources/assets/worldarchive/lang/en_us.json")));
+        Set<String> named = new TreeSet<>();
+        for (Path root : Set.of(Path.of("src/main/java"), Path.of("src/client/java"))) {
+            try (Stream<Path> files = Files.walk(root)) {
+                files.filter(file -> file.toString().endsWith(".java"))
+                        .forEach(file -> named.addAll(matches(KEY_IN_CODE, read(file))));
+            }
+        }
+
+        assertFalse(named.isEmpty());
+        named.removeAll(english);
+        assertEquals(Set.of(), named);
+    }
+
+    private static Set<String> matches(Pattern pattern, String text) {
+        Matcher matcher = pattern.matcher(text);
+        return matcher.results().map(result -> result.group(1)).collect(Collectors.toSet());
+    }
+
+    private static String read(Path file) {
+        try {
+            return Files.readString(file, StandardCharsets.UTF_8);
+        } catch (IOException exception) {
+            throw new UncheckedIOException(exception);
+        }
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/ui/model/BackupBrowserModelTest.java b/src/test/java/dev/ishaanko/worldarchive/ui/model/BackupBrowserModelTest.java
index de4f037..7e18ac0 100644
--- a/src/test/java/dev/ishaanko/worldarchive/ui/model/BackupBrowserModelTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/ui/model/BackupBrowserModelTest.java
@@ -8,7 +8,6 @@
 import dev.ishaanko.worldarchive.model.BackupManifest;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.BackupStatus;
 import dev.ishaanko.worldarchive.model.BackupTrigger;
 import dev.ishaanko.worldarchive.model.DestinationResult;
 import dev.ishaanko.worldarchive.model.DestinationType;
@@ -17,241 +16,156 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
-import java.util.Set;
-import java.util.UUID;
 import org.junit.jupiter.api.Test;
 
 class BackupBrowserModelTest {
-    private static final WorldId WORLD_ID = new WorldId(
-            UUID.fromString("bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"));
+    private static final WorldId WORLD_ID = WorldId.parse("bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb");
 
     @Test
-    void filtersSortsPaginatesAndKeepsOnlyVisibleSelection() {
-        BackupRecord oldest = record("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa1", "Zulu", 1, 10, 1);
-        BackupRecord middle = record("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa2", "alpha", 2, 30, 3);
-        BackupRecord newest = record("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa3", "Alpha", 3, 20, 2);
-
-        BackupBrowserPage first = BackupBrowserPage.create(
-                List.of(oldest, middle, newest),
-                new BackupBrowserQuery("alpha", BackupSort.NEWEST, 0, 1),
-                Set.of(newest.manifest().backupId()));
-
-        assertEquals(2, first.totalRows());
-        assertEquals(2, first.pageCount());
-        assertEquals(List.of(newest.manifest().backupId()), ids(first));
-        assertEquals(Set.of(newest.manifest().backupId()), first.selectedBackupIds());
-        assertEquals(
-                List.of(newest.manifest().backupId(), middle.manifest().backupId()),
-                first.matchingBackupIds());
-
-        BackupBrowserPage second = BackupBrowserPage.create(
-                List.of(oldest, middle, newest),
-                new BackupBrowserQuery("alpha", BackupSort.NEWEST, 1, 1),
-                Set.of(newest.manifest().backupId()));
-        assertEquals(List.of(middle.manifest().backupId()), ids(second));
-        assertTrue(second.selectedBackupIds().isEmpty());
-
-        BackupBrowserPage sizeOrder = BackupBrowserPage.create(
-                List.of(oldest, middle, newest),
-                new BackupBrowserQuery("", BackupSort.SIZE_DESCENDING, 0, 3),
-                Set.of());
-        assertEquals(
-                List.of(
-                        middle.manifest().backupId(),
-                        newest.manifest().backupId(),
-                        oldest.manifest().backupId()),
-                ids(sizeOrder));
-
-        BackupBrowserPage oldestFirst = BackupBrowserPage.create(
-                List.of(oldest, middle, newest),
-                new BackupBrowserQuery("", BackupSort.OLDEST, 0, 3),
-                Set.of());
-        assertEquals(
-                List.of(
-                        oldest.manifest().backupId(),
-                        middle.manifest().backupId(),
-                        newest.manifest().backupId()),
-                ids(oldestFirst));
+    void filtersSortsAndPages() {
+        BackupRow oldest = row("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa1", "Zulu", 1, 10, 1);
+        BackupRow middle = row("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa2", "alpha", 2, 30, 3);
+        BackupRow newest = row("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa3", "Alpha", 3, 20, 2);
+        List<BackupRow> rows = List.of(oldest, middle, newest);
+
+        List<BackupRow> alpha = BackupFilter.apply(rows, " ALPHA ", BackupSort.NEWEST);
+        assertEquals(List.of(newest, middle), alpha);
+        Paging second = Paging.of(alpha.size(), 1, 1);
+        assertEquals(List.of(middle), second.slice(alpha));
+        assertTrue(second.hasPrevious());
+        assertFalse(second.hasNext());
+
+        assertEquals(List.of(middle, newest, oldest), BackupFilter.apply(rows, "", BackupSort.SIZE_DESCENDING));
+        assertEquals(List.of(oldest, middle, newest), BackupFilter.apply(rows, "", BackupSort.OLDEST));
+        assertEquals(List.of(middle, newest, oldest), BackupFilter.apply(rows, "", BackupSort.CHANGED_FILES_DESCENDING));
+    }
 
-        BackupBrowserPage changedOrder = BackupBrowserPage.create(
-                List.of(oldest, middle, newest),
-                new BackupBrowserQuery("", BackupSort.CHANGED_FILES_DESCENDING, 0, 3),
-                Set.of());
-        assertEquals(
-                List.of(
-                        middle.manifest().backupId(),
-                        newest.manifest().backupId(),
-                        oldest.manifest().backupId()),
-                ids(changedOrder));
+    @Test
+    void theFilterMatchesLabelsTriggersAsShownAndIdPrefixesButNotTheWorldName() {
+        BackupRow labeled = row("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa1", "Base before the raid", 1, 10, 1);
+        BackupRow unlabeled = record(
+                "cccccccc-aaaa-aaaa-aaaa-aaaaaaaaaaa2", Optional.empty(), BackupTrigger.WORLD_EXIT, 2, 10, 1, zip());
+
+        assertEquals(List.of(labeled), BackupFilter.apply(List.of(labeled, unlabeled), "base", BackupSort.NEWEST));
+        assertEquals(List.of(unlabeled), BackupFilter.apply(List.of(labeled, unlabeled), "world exit", BackupSort.NEWEST));
+        assertEquals(List.of(unlabeled), BackupFilter.apply(List.of(labeled, unlabeled), "cccc", BackupSort.NEWEST));
     }
 
     @Test
-    void clampsPagesAndUsesStableLabelTies() {
-        BackupRecord first = record("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa1", "same", 1, 10, 1);
-        BackupRecord second = record("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa2", "SAME", 2, 10, 1);
-        BackupBrowserPage page = BackupBrowserPage.create(
-                List.of(first, second),
-                new BackupBrowserQuery("", BackupSort.LABEL, 99, 1),
-                Set.of());
+    void pagesAreClampedAndLabelTiesStayStable() {
+        BackupRow first = row("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa1", "same", 1, 10, 1);
+        BackupRow second = row("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa2", "SAME", 2, 10, 1);
+        List<BackupRow> sorted = BackupFilter.apply(List.of(first, second), "", BackupSort.LABEL);
+
+        Paging paging = Paging.of(sorted.size(), 1, 99);
 
-        assertEquals(1, page.pageIndex());
-        assertEquals(List.of(first.manifest().backupId()), ids(page));
+        assertEquals(1, paging.pageIndex());
+        assertEquals(List.of(first), paging.slice(sorted));
     }
 
     @Test
     void actionPolicyExplainsEveryDisabledAction() {
-        BackupRow selected = BackupRow.from(record(
-                "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa1", "label", 1, 10, 1));
-        BackupBrowserCapabilities capabilities = new BackupBrowserCapabilities(
-                false, true, true, false, true);
-        Map<BackupAction, BackupActionAvailability> states = BackupActionPolicy.evaluate(
-                capabilities, List.of(selected));
-
-        assertTrue(states.get(BackupAction.CREATE).enabled());
-        assertTrue(states.get(BackupAction.RESTORE).enabled());
-        assertTrue(states.get(BackupAction.DELETE).enabled());
-        assertTrue(states.get(BackupAction.VERIFY).enabled());
-        assertTrue(states.get(BackupAction.OPEN_FOLDER).enabled());
-        assertTrue(states.get(BackupAction.SETTINGS).enabled());
-        assertFalse(states.get(BackupAction.SYNC).enabled());
-        assertEquals(
-                ActionDisabledReason.REMOTE_NOT_CONFIGURED,
-                states.get(BackupAction.SYNC).reason());
-
-        Map<BackupAction, BackupActionAvailability> noSelection = BackupActionPolicy.evaluate(
-                capabilities, List.of());
+        BackupRow selected = row("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa1", "label", 1, 10, 1);
+        BackupBrowserCapabilities capabilities = capabilities(false, true, true, false, true);
+
+        Map<BackupAction, ActionDisabledReason> states = BackupActionPolicy.evaluate(capabilities, List.of(selected));
+        for (BackupAction action : List.of(
+                BackupAction.CREATE,
+                BackupAction.RESTORE,
+                BackupAction.DELETE,
+                BackupAction.VERIFY,
+                BackupAction.OPEN_FOLDER,
+                BackupAction.SETTINGS)) {
+            assertEquals(ActionDisabledReason.NONE, states.get(action), action.name());
+        }
+        assertEquals(ActionDisabledReason.REMOTE_NOT_CONFIGURED, states.get(BackupAction.SYNC));
         assertEquals(
                 ActionDisabledReason.NO_SELECTION,
-                noSelection.get(BackupAction.RESTORE).reason());
+                BackupActionPolicy.evaluate(capabilities, List.of()).get(BackupAction.RESTORE));
+        assertTrue(BackupActionPolicy.evaluate(capabilities.withOperationInProgress(), List.of(selected))
+                .values().stream()
+                .allMatch(reason -> reason == ActionDisabledReason.OPERATION_IN_PROGRESS));
 
-        Map<BackupAction, BackupActionAvailability> busy = BackupActionPolicy.evaluate(
-                new BackupBrowserCapabilities(true, true, true, true, true),
-                List.of(selected));
-        assertTrue(busy.values().stream().noneMatch(BackupActionAvailability::enabled));
-        assertTrue(busy.values().stream()
-                .allMatch(state -> state.reason() == ActionDisabledReason.OPERATION_IN_PROGRESS));
-
-        BackupRow failed = BackupRow.from(record(
+        BackupRow failedGitOnly = record(
                 "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa4",
-                "failed",
+                Optional.of("failed"),
+                BackupTrigger.MANUAL,
                 4,
                 10,
                 1,
-                DestinationResult.failed(DestinationType.GIT, "failed")));
-        Map<BackupAction, BackupActionAvailability> noDurableCopy = BackupActionPolicy.evaluate(
-                new BackupBrowserCapabilities(false, true, false, true, false),
-                List.of(failed));
-        assertEquals(
-                ActionDisabledReason.NO_DESTINATION_CONFIGURED,
-                noDurableCopy.get(BackupAction.CREATE).reason());
-
-        Map<BackupAction, BackupActionAvailability> sourceMissing = BackupActionPolicy.evaluate(
-                new BackupBrowserCapabilities(false, false, false, true, false),
-                List.of(failed));
+                DestinationResult.failed(DestinationType.GIT, "failed"));
+        Map<BackupAction, ActionDisabledReason> noCopy = BackupActionPolicy.evaluate(
+                capabilities(false, true, false, true, false), List.of(failedGitOnly));
+        assertEquals(ActionDisabledReason.CREATE_BLOCKED, noCopy.get(BackupAction.CREATE));
+        assertEquals(ActionDisabledReason.FOLDER_UNAVAILABLE, noCopy.get(BackupAction.OPEN_FOLDER));
+        assertEquals(ActionDisabledReason.NO_DURABLE_COPY, noCopy.get(BackupAction.RESTORE));
+        assertEquals(ActionDisabledReason.NO_DURABLE_COPY, noCopy.get(BackupAction.SYNC));
         assertEquals(
                 ActionDisabledReason.SOURCE_UNAVAILABLE,
-                sourceMissing.get(BackupAction.CREATE).reason());
-        assertEquals(
-                ActionDisabledReason.FOLDER_UNAVAILABLE,
-                noDurableCopy.get(BackupAction.OPEN_FOLDER).reason());
-        assertEquals(
-                ActionDisabledReason.NO_DURABLE_COPY,
-                noDurableCopy.get(BackupAction.RESTORE).reason());
-        assertEquals(
-                ActionDisabledReason.NO_DURABLE_COPY,
-                noDurableCopy.get(BackupAction.SYNC).reason());
+                BackupActionPolicy.evaluate(capabilities(false, false, false, true, false), List.of(failedGitOnly))
+                        .get(BackupAction.CREATE));
     }
 
     @Test
-    void multipleSelectionOnlyAllowsDelete() {
-        BackupRow first = BackupRow.from(record(
-                "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa1", "one", 1, 10, 1));
-        BackupRow second = BackupRow.from(record(
-                "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa2", "two", 2, 10, 1));
-        BackupBrowserCapabilities capabilities = new BackupBrowserCapabilities(
-                false, true, true, true, true);
+    void multipleSelectionOnlyAllowsDeleteAndOnlyWhenEveryBackupHasACopy() {
+        BackupRow first = row("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa1", "one", 1, 10, 1);
+        BackupRow second = row("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa2", "two", 2, 10, 1);
+        BackupBrowserCapabilities capabilities = capabilities(false, true, true, true, true);
 
-        Map<BackupAction, BackupActionAvailability> states = BackupActionPolicy.evaluate(
-                capabilities, List.of(first, second));
+        Map<BackupAction, ActionDisabledReason> states = BackupActionPolicy.evaluate(capabilities, List.of(first, second));
 
-        assertTrue(states.get(BackupAction.DELETE).enabled());
-        assertEquals(
-                ActionDisabledReason.MULTIPLE_SELECTED,
-                states.get(BackupAction.RESTORE).reason());
-        assertEquals(
-                ActionDisabledReason.MULTIPLE_SELECTED,
-                states.get(BackupAction.SYNC).reason());
-        assertEquals(
-                ActionDisabledReason.MULTIPLE_SELECTED,
-                states.get(BackupAction.VERIFY).reason());
+        assertEquals(ActionDisabledReason.NONE, states.get(BackupAction.DELETE));
+        assertEquals(ActionDisabledReason.MULTIPLE_SELECTED, states.get(BackupAction.RESTORE));
+        assertEquals(ActionDisabledReason.MULTIPLE_SELECTED, states.get(BackupAction.SYNC));
+        assertEquals(ActionDisabledReason.MULTIPLE_SELECTED, states.get(BackupAction.VERIFY));
 
-        BackupRow unavailable = BackupRow.from(record(
+        BackupRow gone = record(
                 "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa3",
-                "gone",
+                Optional.of("gone"),
+                BackupTrigger.MANUAL,
                 3,
                 10,
                 1,
-                DestinationResult.failed(DestinationType.GIT, "failed")));
-        Map<BackupAction, BackupActionAvailability> mixed = BackupActionPolicy.evaluate(
-                capabilities, List.of(first, unavailable));
+                DestinationResult.failed(DestinationType.GIT, "failed"));
         assertEquals(
                 ActionDisabledReason.NO_DURABLE_COPY,
-                mixed.get(BackupAction.DELETE).reason());
+                BackupActionPolicy.evaluate(capabilities, List.of(first, gone)).get(BackupAction.DELETE));
     }
 
-    @Test
-    void deleteBatchSummaryCountsRemovedBackupsAndListsProblems() {
-        BackupId removed = BackupId.parse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa1");
-        BackupId stuck = BackupId.parse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa2");
-        Instant completedAt = Instant.ofEpochSecond(10);
-        BackupResult success = BackupResult.aggregate(
-                removed,
-                WORLD_ID,
-                List.of(DestinationResult.success(DestinationType.ZIP, "zip")),
-                completedAt);
-        BackupResult failure = BackupResult.aggregate(
-                stuck,
-                WORLD_ID,
-                List.of(DestinationResult.failed(DestinationType.GIT, "remote refused")),
-                completedAt);
-
-        DeleteBatchSummary all = DeleteBatchSummary.from(List.of(success, success));
-        assertEquals(BackupStatus.SUCCESS, all.status());
-        assertEquals("Deleted 2 backups", all.headline());
-        assertTrue(all.details().isEmpty());
-
-        DeleteBatchSummary partial = DeleteBatchSummary.from(List.of(success, failure));
-        assertEquals(BackupStatus.PARTIAL_SUCCESS, partial.status());
-        assertEquals("Deleted 1 of 2 backups", partial.headline());
-        assertEquals(List.of("aaaaaaaa · GIT: remote refused"), partial.details());
-
-        DeleteBatchSummary none = DeleteBatchSummary.from(List.of(failure));
-        assertEquals(BackupStatus.FAILED, none.status());
-        assertEquals("No backups were deleted", none.headline());
+    private static BackupBrowserCapabilities capabilities(
+            boolean operationInProgress,
+            boolean sourceAvailable,
+            boolean createAllowed,
+            boolean gitRemoteConfigured,
+            boolean managedFolderAvailable) {
+        return new BackupBrowserCapabilities(
+                operationInProgress,
+                sourceAvailable,
+                createAllowed ? Optional.empty() : Optional.of(BackupBrowserCapabilities.CreateBlock.WORLD_OFF),
+                gitRemoteConfigured,
+                managedFolderAvailable,
+                Optional.empty());
     }
 
-    private static List<BackupId> ids(BackupBrowserPage page) {
-        return page.rows().stream().map(BackupRow::backupId).toList();
+    private static DestinationResult zip() {
+        return DestinationResult.success(DestinationType.ZIP, "archive.zip");
     }
 
-    private static BackupRecord record(
-            String backupId,
-            String label,
-            long epochSecond,
-            long bytes,
-            long changedFiles) {
+    private static BackupRow row(String backupId, String label, long epochSecond, long bytes, long changedFiles) {
         return record(
                 backupId,
-                label,
+                Optional.of(label),
+                BackupTrigger.MANUAL,
                 epochSecond,
                 bytes,
                 changedFiles,
                 DestinationResult.success(DestinationType.GIT, "artifact-" + backupId));
     }
 
-    private static BackupRecord record(
+    private static BackupRow record(
             String backupId,
-            String label,
+            Optional<String> label,
+            BackupTrigger trigger,
             long epochSecond,
             long bytes,
             long changedFiles,
@@ -261,20 +175,18 @@ private static BackupRecord record(
         BackupManifest manifest = BackupManifest.create(
                 id,
                 WORLD_ID,
-                "Fixture World",
-                Optional.of(label),
+                "My Base",
+                label,
                 createdAt,
-                BackupTrigger.MANUAL,
+                trigger,
                 4,
                 bytes,
                 changedFiles,
                 "a".repeat(64),
-                "b".repeat(64));
-        BackupResult result = BackupResult.aggregate(
-                id,
-                WORLD_ID,
-                List.of(destination),
-                createdAt.plusSeconds(1));
-        return new BackupRecord(manifest, result);
+                "b".repeat(64),
+                Optional.empty());
+        return BackupRow.from(new BackupRecord(
+                manifest,
+                new BackupResult(id, WORLD_ID, List.of(destination), createdAt.plusSeconds(1))));
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/ui/model/BackupFeedbackModelTest.java b/src/test/java/dev/ishaanko/worldarchive/ui/model/BackupFeedbackModelTest.java
index 7f69760..f5765bd 100644
--- a/src/test/java/dev/ishaanko/worldarchive/ui/model/BackupFeedbackModelTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/ui/model/BackupFeedbackModelTest.java
@@ -1,21 +1,16 @@
 package dev.ishaanko.worldarchive.ui.model;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
-import dev.ishaanko.worldarchive.core.BackupOperation;
-import dev.ishaanko.worldarchive.core.OperationId;
-import dev.ishaanko.worldarchive.core.OperationPhase;
-import dev.ishaanko.worldarchive.core.OperationProgress;
 import dev.ishaanko.worldarchive.model.BackupId;
 import dev.ishaanko.worldarchive.model.BackupManifest;
+import dev.ishaanko.worldarchive.model.BackupOperation;
 import dev.ishaanko.worldarchive.model.BackupRecord;
 import dev.ishaanko.worldarchive.model.BackupResult;
 import dev.ishaanko.worldarchive.model.BackupStatus;
 import dev.ishaanko.worldarchive.model.BackupTrigger;
 import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationStatus;
 import dev.ishaanko.worldarchive.model.DestinationType;
 import dev.ishaanko.worldarchive.model.SyncStatus;
 import dev.ishaanko.worldarchive.model.VerificationStatus;
@@ -23,244 +18,94 @@
 import java.time.Instant;
 import java.util.List;
 import java.util.Optional;
-import java.util.UUID;
 import org.junit.jupiter.api.Test;
 
 class BackupFeedbackModelTest {
-    @Test
-    void batchDeleteCountsAPendingRemoteDeletionAsAProblem() {
-        BackupId backupId = BackupId.create();
-        WorldId worldId = WorldId.create();
-        BackupResult pending = BackupResult.aggregate(
-                backupId,
-                worldId,
-                List.of(
-                        DestinationResult.success(DestinationType.ZIP, worldId + "/archive.zip"),
-                        DestinationResult.pendingSync(
-                                DestinationType.GIT, "refs/heads/x", "deletion pending on the remote")),
-                Instant.parse("2026-09-15T10:00:00Z"));
-
-        DeleteBatchSummary summary = DeleteBatchSummary.from(List.of(pending));
-
-        assertEquals(BackupStatus.PARTIAL_SUCCESS, summary.status());
-        assertEquals(1, summary.details().size());
-        assertTrue(summary.details().getFirst().contains("GIT"));
-    }
-
-    private static final BackupId BACKUP_ID = new BackupId(
-            UUID.fromString("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"));
-
-    private static final WorldId WORLD_ID = new WorldId(
-            UUID.fromString("bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"));
-
-    @Test
-    void retainsAndRedactsPartialDestinationFailures() {
-        BackupResult result = BackupResult.aggregate(
-                BACKUP_ID,
-                WORLD_ID,
-                List.of(
-                        DestinationResult.success(DestinationType.GIT, "git-object"),
-                        DestinationResult.failed(
-                                DestinationType.ZIP,
-                                "Upload failed token=secret-value")),
-                Instant.EPOCH.plusSeconds(2));
-
-        BackupOutcomeSummary summary = BackupOutcomeSummary.from(result);
-
-        assertEquals(BackupStatus.PARTIAL_SUCCESS, summary.status());
-        assertTrue(summary.partialFailure());
-        assertEquals("Backup completed with destination issues", summary.headline());
-        assertEquals(2, summary.destinations().size());
-        assertEquals(
-                "Upload failed token=[REDACTED]",
-                summary.destinations().get(1).detail().orElseThrow());
-    }
-
-    @Test
-    void deletionSummaryUsesDeletionSpecificLanguage() {
-        BackupResult deleted = BackupResult.aggregate(
-                BACKUP_ID,
-                WORLD_ID,
-                List.of(
-                        DestinationResult.success(DestinationType.GIT, "git-object"),
-                        DestinationResult.success(DestinationType.ZIP, "zip-object")),
-                Instant.EPOCH.plusSeconds(2));
-        BackupOutcomeSummary success = BackupOutcomeSummary.from(
-                BackupOperation.DELETE,
-                deleted);
-
-        assertEquals(BackupOperation.DELETE, success.operation());
-        assertEquals("Backup deleted", success.headline());
-        assertEquals("deleted", success.destinationStatus(success.destinations().get(0)));
-        assertEquals("deleted", success.destinationStatus(success.destinations().get(1)));
-
-        BackupResult partialDelete = BackupResult.aggregate(
-                BACKUP_ID,
-                WORLD_ID,
-                List.of(
-                        DestinationResult.success(DestinationType.GIT, "git-object"),
-                        DestinationResult.failed(DestinationType.ZIP, "Delete failed")),
-                Instant.EPOCH.plusSeconds(3));
-        BackupOutcomeSummary partial = BackupOutcomeSummary.from(
-                BackupOperation.DELETE,
-                partialDelete);
-
-        assertEquals("Backup deleted from some destinations", partial.headline());
-        assertEquals("not deleted", partial.destinationStatus(partial.destinations().get(1)));
+    private static final BackupId BACKUP_ID = BackupId.parse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa");
 
-        BackupOutcomeSummary empty = BackupOutcomeSummary.from(
-                BackupOperation.DELETE,
-                BackupResult.aggregate(BACKUP_ID, WORLD_ID, List.of(), Instant.EPOCH.plusSeconds(4)));
-        assertEquals("Backup removed", empty.headline());
-    }
+    private static final WorldId WORLD_ID = WorldId.parse("bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb");
 
     @Test
-    void synchronizationSummaryUsesRemoteSyncOutcome() {
-        DestinationResult git = new DestinationResult(
-                DestinationType.GIT,
-                DestinationStatus.SUCCESS,
-                Optional.of("git-object"),
-                Optional.empty(),
-                VerificationStatus.NOT_VERIFIED,
-                SyncStatus.SYNCED);
-        BackupResult result = BackupResult.aggregate(
-                BACKUP_ID,
-                WORLD_ID,
-                List.of(
-                        git,
-                        DestinationResult.success(DestinationType.ZIP, "zip-object")),
-                Instant.EPOCH.plusSeconds(2));
-
-        BackupOutcomeSummary synchronizedSummary = BackupOutcomeSummary.from(
-                BackupOperation.SYNC,
-                result);
-
-        assertEquals(BackupStatus.SUCCESS, synchronizedSummary.status());
-        assertEquals("Backup synchronized", synchronizedSummary.headline());
-        assertEquals(1, synchronizedSummary.destinations().size());
-        assertEquals(
-                "synced",
-                synchronizedSummary.destinationStatus(synchronizedSummary.destinations().getFirst()));
-
-        DestinationResult failedGit = new DestinationResult(
-                DestinationType.GIT,
-                DestinationStatus.PENDING_SYNC,
-                Optional.of("git-object"),
-                Optional.of("Remote rejected the update"),
-                VerificationStatus.NOT_VERIFIED,
-                SyncStatus.FAILED);
-        BackupOutcomeSummary failed = BackupOutcomeSummary.from(
-                BackupOperation.SYNC,
-                BackupResult.aggregate(
-                        BACKUP_ID,
-                        WORLD_ID,
-                        List.of(failedGit),
-                        Instant.EPOCH.plusSeconds(3)));
-
+    void synchronizationReportsTheGitCopyOnly() {
+        BackupOutcomeSummary synced = BackupOutcomeSummary.from(BackupOperation.SYNC, result(BACKUP_ID,
+                DestinationResult.success(DestinationType.GIT, "git-object").withSync(SyncStatus.SYNCED),
+                DestinationResult.success(DestinationType.ZIP, "zip-object")));
+        assertEquals(BackupStatus.SUCCESS, synced.status());
+        assertEquals("Backup synchronized", synced.headline());
+        assertEquals(List.of("GIT: synced"), synced.lines());
+
+        BackupOutcomeSummary failed = BackupOutcomeSummary.from(BackupOperation.SYNC, result(BACKUP_ID,
+                DestinationResult.pendingSync(DestinationType.GIT, "git-object", "Remote rejected the update")
+                        .withSync(SyncStatus.FAILED)));
         assertEquals(BackupStatus.FAILED, failed.status());
         assertEquals("Backup synchronization failed", failed.headline());
-        assertEquals("sync failed", failed.destinationStatus(failed.destinations().getFirst()));
+        assertEquals(List.of("GIT: sync failed · Remote rejected the update"), failed.lines());
     }
 
     @Test
-    void verificationSummaryUsesIntegrityOutcome() {
-        DestinationResult verifiedGit = new DestinationResult(
-                DestinationType.GIT,
-                DestinationStatus.SUCCESS,
-                Optional.of("git-object"),
-                Optional.empty(),
-                VerificationStatus.VERIFIED,
-                SyncStatus.NOT_CONFIGURED);
-        DestinationResult unavailableZip = new DestinationResult(
-                DestinationType.ZIP,
-                DestinationStatus.SUCCESS,
-                Optional.of("zip-object"),
-                Optional.empty(),
-                VerificationStatus.UNAVAILABLE,
-                SyncStatus.NOT_CONFIGURED);
-
-        BackupOutcomeSummary summary = BackupOutcomeSummary.from(
-                BackupOperation.VERIFY,
-                BackupResult.aggregate(
-                        BACKUP_ID,
-                        WORLD_ID,
-                        List.of(verifiedGit, unavailableZip),
-                        Instant.EPOCH.plusSeconds(2)));
+    void verificationIsIncompleteWhileACopyCouldNotBeChecked() {
+        BackupOutcomeSummary summary = BackupOutcomeSummary.from(BackupOperation.VERIFY, result(BACKUP_ID,
+                DestinationResult.success(DestinationType.GIT, "git-object")
+                        .withVerification(VerificationStatus.VERIFIED),
+                DestinationResult.success(DestinationType.ZIP, "zip-object")
+                        .withVerification(VerificationStatus.UNAVAILABLE)));
 
         assertEquals(BackupStatus.PARTIAL_SUCCESS, summary.status());
         assertEquals("Backup verification incomplete", summary.headline());
-        assertEquals("verified", summary.destinationStatus(summary.destinations().get(0)));
-        assertEquals(
-                "verification unavailable",
-                summary.destinationStatus(summary.destinations().get(1)));
+        assertEquals(List.of("GIT: verified", "ZIP: verification unavailable"), summary.lines());
     }
 
     @Test
-    void confirmationCarriesDeleteAndRestoreIntent() {
-        BackupRow row = BackupRow.from(record());
-
-        ConfirmationState delete = ConfirmationState.delete(row);
-        ConfirmationState restore = ConfirmationState.restore(row, RestoreChoice.PLAY);
-
-        assertEquals(ConfirmationKind.DELETE, delete.kind());
-        assertTrue(delete.destructive());
-        assertTrue(delete.restoreChoice().isEmpty());
-        assertEquals(ConfirmationKind.RESTORE, restore.kind());
-        assertFalse(restore.destructive());
-        assertEquals(Optional.of(RestoreChoice.PLAY), restore.restoreChoice());
+    void aBatchDeleteCountsOnlyBackupsWithNoCopyLeftAndNamesTheRest() {
+        BackupId removed = BackupId.parse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa1");
+        BackupId refused = BackupId.parse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa2");
+        BackupId pending = BackupId.parse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa3");
+        List<BackupRow> rows = List.of(row(removed, "Kept base"), row(refused, "Before the raid"), row(pending, "Farm"));
+        BackupResult success = result(removed, DestinationResult.success(DestinationType.ZIP, "zip"));
+        BackupResult partlyDeleted = result(refused,
+                DestinationResult.success(DestinationType.ZIP, "zip"),
+                DestinationResult.failed(DestinationType.GIT, "remote refused"));
+        BackupResult remoteWaits = result(pending,
+                DestinationResult.success(DestinationType.ZIP, "zip"),
+                DestinationResult.pendingSync(DestinationType.GIT, "refs/heads/x", "deletion pending on the remote"));
+
+        DeleteBatchSummary all = DeleteBatchSummary.from(List.of(success), rows);
+        assertEquals(BackupStatus.SUCCESS, all.status());
+        assertEquals("Deleted 1 backup", all.headline());
+        assertTrue(all.details().isEmpty());
+
+        DeleteBatchSummary partial = DeleteBatchSummary.from(List.of(success, partlyDeleted), rows);
+        assertEquals(BackupStatus.PARTIAL_SUCCESS, partial.status());
+        assertEquals("Deleted 1 of 2 backups", partial.headline());
+        assertEquals(List.of(BackupText.name(rows.get(1)) + " · GIT: remote refused"), partial.details());
+
+        DeleteBatchSummary none = DeleteBatchSummary.from(List.of(partlyDeleted, remoteWaits), rows);
+        assertEquals(BackupStatus.FAILED, none.status());
+        assertEquals("No backups were deleted", none.headline());
+        assertEquals(2, none.details().size());
+        assertTrue(none.details().get(1).startsWith(BackupText.name(rows.get(2))), none.details().toString());
     }
 
-    @Test
-    void progressIsCredentialSafeAndRendererNeutral() {
-        OperationProgress progress = new OperationProgress(
-                new OperationId(UUID.fromString("cccccccc-cccc-cccc-cccc-cccccccccccc")),
-                WORLD_ID,
-                Optional.of(BACKUP_ID),
-                BackupOperation.CREATE,
-                OperationPhase.WRITING,
-                1,
-                4,
-                "Pushing with token=secret-value");
-
-        ProgressState state = ProgressState.from(progress);
-
-        assertEquals(0.25, state.fraction().orElseThrow());
-        assertEquals("Pushing with token=[REDACTED]", state.message());
-        assertFalse(state.terminal());
-        assertFalse(state.successful());
-
-        OperationProgress completed = new OperationProgress(
-                progress.operationId(),
-                WORLD_ID,
-                Optional.of(BACKUP_ID),
-                BackupOperation.CREATE,
-                OperationPhase.COMPLETE,
-                4,
-                4,
-                "Complete");
-        assertTrue(ProgressState.from(completed).terminal());
-        assertTrue(ProgressState.from(completed).successful());
+    private static BackupResult result(BackupId backupId, DestinationResult... destinations) {
+        return new BackupResult(backupId, WORLD_ID, List.of(destinations), Instant.EPOCH.plusSeconds(2));
     }
 
-    private static BackupRecord record() {
-        Instant createdAt = Instant.EPOCH.plusSeconds(1);
+    private static BackupRow row(BackupId backupId, String label) {
         BackupManifest manifest = BackupManifest.create(
-                BACKUP_ID,
+                backupId,
                 WORLD_ID,
                 "Fixture World",
-                Optional.empty(),
-                createdAt,
+                Optional.of(label),
+                Instant.EPOCH.plusSeconds(1),
                 BackupTrigger.MANUAL,
                 1,
                 10,
                 1,
                 "a".repeat(64),
-                "b".repeat(64));
-        BackupResult result = BackupResult.aggregate(
-                BACKUP_ID,
-                WORLD_ID,
-                List.of(DestinationResult.success(DestinationType.ZIP, "archive.zip")),
-                createdAt.plusSeconds(1));
-        return new BackupRecord(manifest, result);
+                "b".repeat(64),
+                Optional.empty());
+        return BackupRow.from(new BackupRecord(
+                manifest,
+                result(backupId, DestinationResult.success(DestinationType.ZIP, "archive.zip"))));
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/ui/model/BackupRowTest.java b/src/test/java/dev/ishaanko/worldarchive/ui/model/BackupRowTest.java
deleted file mode 100644
index d0ba0fb..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/ui/model/BackupRowTest.java
+++ /dev/null
@@ -1,102 +0,0 @@
-package dev.ishaanko.worldarchive.ui.model;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import dev.ishaanko.worldarchive.model.BackupId;
-import dev.ishaanko.worldarchive.model.BackupManifest;
-import dev.ishaanko.worldarchive.model.BackupRecord;
-import dev.ishaanko.worldarchive.model.BackupResult;
-import dev.ishaanko.worldarchive.model.BackupTrigger;
-import dev.ishaanko.worldarchive.model.DestinationResult;
-import dev.ishaanko.worldarchive.model.DestinationType;
-import dev.ishaanko.worldarchive.model.SyncStatus;
-import dev.ishaanko.worldarchive.model.VerificationStatus;
-import dev.ishaanko.worldarchive.model.WorldId;
-import java.time.Instant;
-import java.util.List;
-import java.util.Optional;
-import java.util.UUID;
-import org.junit.jupiter.api.Test;
-
-class BackupRowTest {
-    private static final BackupId BACKUP_ID = new BackupId(
-            UUID.fromString("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"));
-
-    private static final WorldId WORLD_ID = new WorldId(
-            UUID.fromString("bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"));
-
-    private static final Instant CREATED_AT = Instant.parse("2026-07-17T12:34:56Z");
-
-    @Test
-    void exposesManifestAndIndependentDestinationData() {
-        DestinationResult git = DestinationResult.pendingSync(
-                        DestinationType.GIT, "git-object", "Remote unavailable")
-                .withVerification(VerificationStatus.VERIFIED);
-        DestinationResult zip = DestinationResult.success(DestinationType.ZIP, "archive.zip")
-                .withVerification(VerificationStatus.VERIFIED);
-
-        BackupRow row = BackupRow.from(record(List.of(git, zip)));
-
-        assertEquals(BACKUP_ID, row.backupId());
-        assertEquals(WORLD_ID, row.worldId());
-        assertEquals("Fixture World", row.worldName());
-        assertEquals(CREATED_AT, row.createdAt());
-        assertEquals(Optional.of("Before the dragon"), row.label());
-        assertEquals(BackupTrigger.MANUAL, row.trigger());
-        assertEquals(42_000, row.logicalSizeBytes());
-        assertEquals(7, row.changedFileCount());
-        assertEquals(DestinationAvailability.PENDING_SYNC, row.git().availability());
-        assertEquals(DestinationAvailability.AVAILABLE, row.zip().availability());
-        assertEquals(SyncStatus.PENDING, row.remoteSyncStatus());
-        assertEquals(VerificationStatus.VERIFIED, row.verificationStatus());
-        assertTrue(row.hasDurableCopy());
-    }
-
-    @Test
-    void representsMissingAndFailedCopiesWithoutInventingAvailability() {
-        DestinationResult git = DestinationResult.failed(
-                DestinationType.GIT, "Local Git write failed");
-        BackupRow row = BackupRow.from(record(List.of(git)));
-
-        assertEquals(DestinationAvailability.FAILED, row.git().availability());
-        assertEquals(DestinationAvailability.NOT_CREATED, row.zip().availability());
-        assertEquals(VerificationStatus.UNAVAILABLE, row.zip().verificationStatus());
-        assertEquals(VerificationStatus.UNAVAILABLE, row.verificationStatus());
-        assertFalse(row.hasDurableCopy());
-    }
-
-    @Test
-    void aggregateVerificationPrefersAnyDurableFailure() {
-        DestinationResult git = DestinationResult.success(DestinationType.GIT, "git-object")
-                .withVerification(VerificationStatus.VERIFIED);
-        DestinationResult zip = DestinationResult.success(DestinationType.ZIP, "archive.zip")
-                .withVerification(VerificationStatus.FAILED);
-
-        assertEquals(
-                VerificationStatus.FAILED,
-                BackupRow.from(record(List.of(git, zip))).verificationStatus());
-    }
-
-    private static BackupRecord record(List<DestinationResult> destinations) {
-        BackupManifest manifest = BackupManifest.create(
-                BACKUP_ID,
-                WORLD_ID,
-                "Fixture World",
-                Optional.of("Before the dragon"),
-                CREATED_AT,
-                BackupTrigger.MANUAL,
-                12,
-                42_000,
-                7,
-                "a".repeat(64),
-                "b".repeat(64));
-        BackupResult result = BackupResult.aggregate(
-                BACKUP_ID,
-                WORLD_ID,
-                destinations,
-                CREATED_AT.plusSeconds(1));
-        return new BackupRecord(manifest, result);
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/ui/model/BackupSelectionTest.java b/src/test/java/dev/ishaanko/worldarchive/ui/model/BackupSelectionTest.java
new file mode 100644
index 0000000..d7d5bba
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/ui/model/BackupSelectionTest.java
@@ -0,0 +1,83 @@
+package dev.ishaanko.worldarchive.ui.model;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.model.BackupId;
+import java.util.List;
+import java.util.Set;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.Test;
+
+class BackupSelectionTest {
+    private static final BackupId A = BackupId.parse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa1");
+
+    private static final BackupId B = BackupId.parse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa2");
+
+    private static final BackupId C = BackupId.parse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa3");
+
+    private static final BackupId D = BackupId.parse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa4");
+
+    private static final List<BackupId> PAGE = List.of(A, B, C, D);
+
+    @Test
+    void aPlainClickSelectsOneBackupAndAToggleClickAddsOrRemovesOne() {
+        BackupSelection selection = new BackupSelection();
+
+        selection.click(A, BackupSelection.Click.SELECT, PAGE);
+        selection.click(C, BackupSelection.Click.TOGGLE, PAGE);
+        assertEquals(Set.of(A, C), selected(selection));
+
+        selection.click(A, BackupSelection.Click.TOGGLE, PAGE);
+        assertEquals(Set.of(C), selected(selection));
+
+        selection.click(D, BackupSelection.Click.SELECT, PAGE);
+        assertEquals(Set.of(D), selected(selection));
+    }
+
+    @Test
+    void anExtendClickAddsTheRangeFromTheLastClickedBackupOnThePage() {
+        BackupSelection selection = new BackupSelection();
+        selection.click(D, BackupSelection.Click.SELECT, PAGE);
+        selection.click(B, BackupSelection.Click.EXTEND, PAGE);
+        assertEquals(Set.of(B, C, D), selected(selection));
+
+        selection.click(A, BackupSelection.Click.EXTEND, List.of(A, B));
+        assertEquals(Set.of(A, B, C, D), selected(selection), "a start on another page adds only the click");
+    }
+
+    @Test
+    void selectAllReplacesTheSelectionWithTheMatchingBackupsAndClearEmptiesIt() {
+        BackupSelection selection = new BackupSelection();
+        selection.click(D, BackupSelection.Click.SELECT, PAGE);
+
+        selection.selectAllOrClear(List.of(A, B));
+        assertEquals(Set.of(A, B), selected(selection));
+        assertTrue(selection.coversAll(List.of(A, B)));
+
+        selection.selectAllOrClear(List.of(A, B));
+        assertEquals(Set.of(), selected(selection));
+        assertFalse(selection.coversAll(List.of()));
+    }
+
+    @Test
+    void aReloadDropsBackupsThatAreGoneAndTheirRangeStart() {
+        BackupSelection selection = new BackupSelection();
+        selection.click(B, BackupSelection.Click.SELECT, PAGE);
+        selection.click(A, BackupSelection.Click.TOGGLE, PAGE);
+
+        selection.retain(Set.of(B, C, D));
+        assertEquals(Set.of(B), selected(selection));
+
+        selection.click(D, BackupSelection.Click.EXTEND, List.of(B, C, D));
+        assertEquals(Set.of(D), selected(selection), "without a start, an extend click selects one backup");
+    }
+
+    private static Set<BackupId> selected(BackupSelection selection) {
+        Set<BackupId> selected = Stream.of(A, B, C, D).filter(selection::contains).collect(Collectors.toSet());
+        assertEquals(selected.size(), selection.size());
+        return selected;
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/ui/model/CleanupSelectionTest.java b/src/test/java/dev/ishaanko/worldarchive/ui/model/CleanupSelectionTest.java
new file mode 100644
index 0000000..9ea95aa
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/ui/model/CleanupSelectionTest.java
@@ -0,0 +1,77 @@
+package dev.ishaanko.worldarchive.ui.model;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.OperationId;
+import dev.ishaanko.worldarchive.model.WorldId;
+import dev.ishaanko.worldarchive.storage.management.CleanupItem;
+import dev.ishaanko.worldarchive.storage.management.CleanupPlan;
+import java.time.Instant;
+import java.util.List;
+import java.util.Optional;
+import java.util.Set;
+import org.junit.jupiter.api.Test;
+
+class CleanupSelectionTest {
+    private static final BackupId SHARED_FIRST = BackupId.parse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa1");
+
+    private static final BackupId SHARED_SECOND = BackupId.parse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa2");
+
+    private static final BackupId ZIP_ONLY = BackupId.parse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa3");
+
+    private static final BackupId SAFETY_FLOOR = BackupId.parse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa4");
+
+    @Test
+    void protectedBackupsGiveUpTheirLocalGitCopiesTogether() {
+        CleanupSelection selection = new CleanupSelection(plan(60, true));
+        assertEquals(Set.of(SHARED_FIRST, SHARED_SECOND, ZIP_ONLY), selection.selected());
+
+        selection.toggle(SHARED_FIRST);
+        assertEquals(Set.of(ZIP_ONLY), selection.selected());
+
+        selection.toggle(ZIP_ONLY);
+        selection.toggle(SHARED_SECOND);
+        assertEquals(Set.of(SHARED_FIRST, SHARED_SECOND), selection.selected());
+    }
+
+    @Test
+    void theSummarySaysWhetherTheSelectionReachesTheLimit() {
+        CleanupSelection reachable = new CleanupSelection(plan(60, true));
+        assertEquals(75, reachable.freedBytes());
+        assertEquals(CleanupSelection.Coverage.REACHES_TARGET, reachable.coverage());
+
+        reachable.toggle(SHARED_FIRST);
+        assertEquals(CleanupSelection.Coverage.SELECT_MORE, reachable.coverage());
+
+        CleanupSelection protectedRest = new CleanupSelection(plan(10, false));
+        assertEquals(CleanupSelection.Coverage.REST_PROTECTED, protectedRest.coverage());
+    }
+
+    /** 100 bytes used; two protected backups share Git history, and one backup is a ZIP. */
+    private static CleanupPlan plan(long targetBytes, boolean targetReachable) {
+        return new CleanupPlan(
+                OperationId.create(),
+                WorldId.parse("bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"),
+                Instant.EPOCH.plusSeconds(900),
+                100,
+                targetBytes,
+                List.of(git(SHARED_FIRST, 30), git(SHARED_SECOND, 20), zip(ZIP_ONLY, 25)),
+                Set.of(SHARED_FIRST, SHARED_SECOND, SAFETY_FLOOR),
+                SAFETY_FLOOR,
+                targetReachable,
+                "fingerprint");
+    }
+
+    private static CleanupItem git(BackupId backupId, long bytes) {
+        return new CleanupItem(
+                backupId, Instant.EPOCH, Optional.empty(), 1,
+                Optional.of("refs/worldarchive/" + backupId), Optional.empty(), bytes, 0, false);
+    }
+
+    private static CleanupItem zip(BackupId backupId, long bytes) {
+        return new CleanupItem(
+                backupId, Instant.EPOCH, Optional.empty(), 1,
+                Optional.empty(), Optional.of(backupId + ".zip"), 0, bytes, true);
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/ui/model/DeletePromptTest.java b/src/test/java/dev/ishaanko/worldarchive/ui/model/DeletePromptTest.java
new file mode 100644
index 0000000..e9f6c36
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/ui/model/DeletePromptTest.java
@@ -0,0 +1,50 @@
+package dev.ishaanko.worldarchive.ui.model;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import dev.ishaanko.worldarchive.model.BackupId;
+import dev.ishaanko.worldarchive.model.BackupTrigger;
+import dev.ishaanko.worldarchive.model.DestinationResult;
+import dev.ishaanko.worldarchive.model.DestinationType;
+import dev.ishaanko.worldarchive.model.SyncStatus;
+import java.time.Instant;
+import java.util.List;
+import java.util.Optional;
+import java.util.stream.IntStream;
+import org.junit.jupiter.api.Test;
+
+class DeletePromptTest {
+    @Test
+    void thePromptNamesTheFirstBackupsAndCountsRemoteCopiesAndLabels() {
+        List<BackupRow> rows = IntStream.range(0, 7)
+                .mapToObj(index -> row(
+                        index,
+                        index < 2 ? SyncStatus.SYNCED : SyncStatus.PENDING,
+                        index % 2 == 0 ? Optional.of("Label " + index) : Optional.empty()))
+                .toList();
+
+        DeletePrompt prompt = DeletePrompt.of(rows);
+
+        assertEquals(rows.subList(0, DeletePrompt.MAXIMUM_SHOWN), prompt.shown());
+        assertEquals(2, prompt.more());
+        assertEquals(7, prompt.count());
+        assertEquals(2, prompt.onRemote(), "only copies the remote holds are named as deleted there");
+        assertEquals(4, prompt.labeled());
+    }
+
+    private static BackupRow row(int index, SyncStatus sync, Optional<String> label) {
+        BackupId backupId = BackupId.parse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa" + index);
+        DestinationResult git = DestinationResult.success(DestinationType.GIT, "refs/heads/backup-" + index)
+                .withSync(sync);
+        return new BackupRow(
+                backupId,
+                Instant.EPOCH.plusSeconds(index),
+                label,
+                BackupTrigger.MANUAL,
+                new BackupRow.Copy(Optional.of(git)),
+                new BackupRow.Copy(Optional.empty()),
+                10,
+                1,
+                Optional.empty());
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/ui/model/GameVersionNoticeTest.java b/src/test/java/dev/ishaanko/worldarchive/ui/model/GameVersionNoticeTest.java
index 546f76f..8f05a06 100644
--- a/src/test/java/dev/ishaanko/worldarchive/ui/model/GameVersionNoticeTest.java
+++ b/src/test/java/dev/ishaanko/worldarchive/ui/model/GameVersionNoticeTest.java
@@ -1,7 +1,6 @@
 package dev.ishaanko.worldarchive.ui.model;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import dev.ishaanko.worldarchive.model.GameVersionStamp;
@@ -17,7 +16,6 @@ void reportsAnUnknownVersionForBackupsTakenBeforeVersionTracking() {
 
         assertEquals(GameVersionNoticeLevel.UNKNOWN, notice.level());
         assertTrue(notice.message().contains("before version tracking"));
-        assertFalse(notice.isWarning());
     }
 
     @Test
@@ -26,7 +24,6 @@ void namesTheVersionWhenItMatchesTheRunningGame() {
 
         assertEquals(GameVersionNoticeLevel.MATCHED, notice.level());
         assertTrue(notice.message().contains("26.2"));
-        assertFalse(notice.isWarning());
     }
 
     @Test
@@ -37,7 +34,6 @@ void explainsThatOlderBackupsAreUpgradedOnOpen() {
 
         assertEquals(GameVersionNoticeLevel.UPGRADE, notice.level());
         assertTrue(notice.message().contains("upgrade"));
-        assertFalse(notice.isWarning());
     }
 
     @Test
@@ -48,14 +44,13 @@ void warnsThatNewerBackupsMayNotOpen() {
 
         assertEquals(GameVersionNoticeLevel.DOWNGRADE, notice.level());
         assertTrue(notice.message().contains("may not open"));
-        assertTrue(notice.isWarning());
     }
 
     @Test
     void namesTheBackupVersionWhenTheRunningVersionIsUnreadable() {
         GameVersionNotice notice = GameVersionNotice.of(Optional.of(RUNNING), Optional.empty());
 
-        assertEquals(GameVersionNoticeLevel.MATCHED, notice.level());
+        assertEquals(GameVersionNoticeLevel.UNKNOWN, notice.level());
         assertTrue(notice.message().contains("26.2"));
     }
 }
diff --git a/src/test/java/dev/ishaanko/worldarchive/ui/model/RestoreNameTest.java b/src/test/java/dev/ishaanko/worldarchive/ui/model/RestoreNameTest.java
new file mode 100644
index 0000000..fcf97fc
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/ui/model/RestoreNameTest.java
@@ -0,0 +1,40 @@
+package dev.ishaanko.worldarchive.ui.model;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.core.RestoreBackupRequest;
+import java.util.Optional;
+import org.junit.jupiter.api.Test;
+
+class RestoreNameTest {
+    @Test
+    void theSuggestedNameIsSafeAndNeverTheOriginalFolder() {
+        assertEquals("My World - Restored", RestoreName.suggest("My World", "My World"));
+        assertEquals("A_B_ C_ - Restored", RestoreName.suggest("A/B: C?", "folder"));
+        assertEquals("Base - Restored Copy", RestoreName.suggest("Base", "base - restored"));
+
+        String cut = RestoreName.suggest("x".repeat(250) + " ...", "folder");
+        assertEquals("x".repeat(250), cut, "a cut name loses the dots and spaces Windows would drop");
+        assertEquals(Optional.empty(), RestoreName.check(cut, "folder"));
+    }
+
+    @Test
+    void aTypedNameMustBeOneFolderThatEverySystemCanCreate() {
+        assertEquals(Optional.of(RestoreName.Problem.BLANK), RestoreName.check("  ", "World"));
+        assertEquals(Optional.of(RestoreName.Problem.ENDS_WITH_DOT_OR_SPACE), RestoreName.check("Copy.", "World"));
+        assertEquals(Optional.of(RestoreName.Problem.UNSAFE_CHARACTER), RestoreName.check("a/b", "World"));
+        assertEquals(Optional.of(RestoreName.Problem.RESERVED_BY_WINDOWS), RestoreName.check("con.txt", "World"));
+        assertEquals(Optional.of(RestoreName.Problem.RESERVED_BY_WINDOWS), RestoreName.check("LPT1", "World"));
+        assertEquals(
+                Optional.of(RestoreName.Problem.TOO_LONG),
+                RestoreName.check("x".repeat(RestoreBackupRequest.MAXIMUM_NAME_LENGTH + 1), "World"));
+        assertEquals(Optional.empty(), RestoreName.check("World copy", "World"));
+    }
+
+    @Test
+    void aRestoreNeverTakesTheOriginalWorldsFolderInAnyCase() {
+        assertEquals(Optional.of(RestoreName.Problem.SAME_AS_ORIGINAL), RestoreName.check("NEW WORLD", "New World"));
+        assertTrue(RestoreName.check("New World 2", "New World").isEmpty());
+    }
+}
diff --git a/src/test/java/dev/ishaanko/worldarchive/ui/model/ScreenGeometryTest.java b/src/test/java/dev/ishaanko/worldarchive/ui/model/ScreenGeometryTest.java
deleted file mode 100644
index 522a988..0000000
--- a/src/test/java/dev/ishaanko/worldarchive/ui/model/ScreenGeometryTest.java
+++ /dev/null
@@ -1,105 +0,0 @@
-package dev.ishaanko.worldarchive.ui.model;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-
-import org.junit.jupiter.api.Test;
-
-class ScreenGeometryTest {
-    @Test
-    void contentWidthClampsToMinimumOnNarrowScreens() {
-        assertEquals(180, ScreenGeometry.contentWidth(150, 180, 620, 20));
-    }
-
-    @Test
-    void contentWidthClampsToMaximumOnWideScreens() {
-        assertEquals(620, ScreenGeometry.contentWidth(4000, 180, 620, 20));
-    }
-
-    @Test
-    void contentWidthSubtractsMarginInTheUnclampedMiddle() {
-        assertEquals(380, ScreenGeometry.contentWidth(400, 180, 620, 20));
-    }
-
-    @Test
-    void contentWidthHandlesExactBoundaryValues() {
-        assertEquals(180, ScreenGeometry.contentWidth(200, 180, 620, 20));
-        assertEquals(620, ScreenGeometry.contentWidth(640, 180, 620, 20));
-    }
-
-    @Test
-    void contentWidthClampsToMinimumOneBelowTheCrossover() {
-        assertEquals(180, ScreenGeometry.contentWidth(199, 180, 620, 20));
-        assertEquals(181, ScreenGeometry.contentWidth(201, 180, 620, 20));
-    }
-
-    @Test
-    void contentWidthSubtractsTheMarginOnceNotTwice() {
-        assertEquals(276, ScreenGeometry.contentWidth(300, 180, 620, 24));
-    }
-
-    @Test
-    void contentWidthClampsToMinimumOnDegenerateScreens() {
-        assertEquals(240, ScreenGeometry.contentWidth(0, 240, 450, 24));
-    }
-
-    @Test
-    void centerXSplitsTheRemainingSpaceEvenly() {
-        assertEquals(10, ScreenGeometry.centerX(400, 380));
-        assertEquals(0, ScreenGeometry.centerX(400, 400));
-    }
-
-    @Test
-    void centerXTruncatesAnOddRemainderTowardTheLeft() {
-        assertEquals(10, ScreenGeometry.centerX(401, 380));
-        assertEquals(0, ScreenGeometry.centerX(181, 180));
-    }
-
-    @Test
-    void centerXReturnsZeroWhenContentIsWiderThanTheScreen() {
-        assertEquals(0, ScreenGeometry.centerX(180, 180));
-        assertEquals(-10, ScreenGeometry.centerX(160, 180));
-    }
-
-    @Test
-    void anchorBottomSwitchesAtTheExactCrossover() {
-        assertEquals(108, ScreenGeometry.anchorBottom(108, 172, 64));
-        assertEquals(109, ScreenGeometry.anchorBottom(108, 173, 64));
-    }
-
-    @Test
-    void anchorBottomStaysAboveMinimumOnShortScreens() {
-        assertEquals(108, ScreenGeometry.anchorBottom(108, 150, 64));
-    }
-
-    @Test
-    void anchorBottomTracksTheBottomOnTallScreens() {
-        assertEquals(436, ScreenGeometry.anchorBottom(108, 500, 64));
-    }
-
-    @Test
-    void anchorMiddleStaysAboveMinimumOnShortScreens() {
-        assertEquals(12, ScreenGeometry.anchorMiddle(12, 100, -72));
-    }
-
-    @Test
-    void anchorMiddleTracksTheMiddleOnTallScreens() {
-        assertEquals(428, ScreenGeometry.anchorMiddle(12, 1000, -72));
-    }
-
-    @Test
-    void anchorMiddleHalvesOddHeightsBeforeApplyingTheOffset() {
-        assertEquals(428, ScreenGeometry.anchorMiddle(12, 1001, -72));
-        assertEquals(429, ScreenGeometry.anchorMiddle(12, 1002, -72));
-    }
-
-    @Test
-    void anchorMiddleSwitchesAtTheExactCrossover() {
-        assertEquals(12, ScreenGeometry.anchorMiddle(12, 168, -72));
-        assertEquals(13, ScreenGeometry.anchorMiddle(12, 170, -72));
-    }
-
-    @Test
-    void anchorMiddleAcceptsPositiveOffsetsBelowTheMiddle() {
-        assertEquals(276, ScreenGeometry.anchorMiddle(12, 500, 26));
-    }
-}
diff --git a/src/test/java/dev/ishaanko/worldarchive/ui/model/StoragePolicyInputTest.java b/src/test/java/dev/ishaanko/worldarchive/ui/model/StoragePolicyInputTest.java
new file mode 100644
index 0000000..f54aa20
--- /dev/null
+++ b/src/test/java/dev/ishaanko/worldarchive/ui/model/StoragePolicyInputTest.java
@@ -0,0 +1,39 @@
+package dev.ishaanko.worldarchive.ui.model;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import dev.ishaanko.worldarchive.config.StoragePolicy;
+import java.util.Optional;
+import org.junit.jupiter.api.Test;
+
+class StoragePolicyInputTest {
+    private static final long ONE_AND_A_HALF_GIB = 1_610_612_736L;
+
+    @Test
+    void theLimitAcceptsADotOrACommaAndReadsBackAsTyped() {
+        StoragePolicy dot = StoragePolicyInput.parse("1.5", "7", "4", "12").orElseThrow();
+        StoragePolicy comma = StoragePolicyInput.parse(" 1,5 ", "7", "4", "12").orElseThrow();
+
+        assertEquals(new StoragePolicy(ONE_AND_A_HALF_GIB, 7, 4, 12), dot);
+        assertEquals(dot, comma);
+        assertEquals("1.5", StoragePolicyInput.limitText(dot));
+    }
+
+    @Test
+    void aBlankLimitMeansNoLimit() {
+        StoragePolicy policy = StoragePolicyInput.parse("", "7", "4", "12").orElseThrow();
+
+        assertEquals(0, policy.budgetBytes());
+        assertEquals("", StoragePolicyInput.limitText(policy));
+    }
+
+    @Test
+    void textThatIsNotAPolicyIsRejectedInsteadOfGuessed() {
+        assertEquals(Optional.empty(), StoragePolicyInput.parse("1.2.3", "7", "4", "12"));
+        assertEquals(Optional.empty(), StoragePolicyInput.parse("-1", "7", "4", "12"));
+        assertEquals(Optional.empty(), StoragePolicyInput.parse("99999", "7", "4", "12"));
+        assertEquals(Optional.empty(), StoragePolicyInput.parse("1", "seven", "4", "12"));
+        assertTrue(StoragePolicyInput.parse("1", "7", "-4", "12").isEmpty());
+    }
+}
diff --git a/src/test/resources/zip/golden/5c1f0e7a-3b2d-4e6f-8a9b-0c1d2e3f4a5b/2026-09-01_12-34-56Z - Golden World - Before the End - 0a1b2c3d-4e5f-4061-8273-8495a6b7c8d9.zip b/src/test/resources/zip/golden/5c1f0e7a-3b2d-4e6f-8a9b-0c1d2e3f4a5b/2026-09-01_12-34-56Z - Golden World - Before the End - 0a1b2c3d-4e5f-4061-8273-8495a6b7c8d9.zip
new file mode 100644
index 0000000..9d97e0f
Binary files /dev/null and b/src/test/resources/zip/golden/5c1f0e7a-3b2d-4e6f-8a9b-0c1d2e3f4a5b/2026-09-01_12-34-56Z - Golden World - Before the End - 0a1b2c3d-4e5f-4061-8273-8495a6b7c8d9.zip differ
diff --git a/src/test/resources/zip/golden/5c1f0e7a-3b2d-4e6f-8a9b-0c1d2e3f4a5b/2026-09-01_12-34-56Z - Golden World - Before the End - 0a1b2c3d-4e5f-4061-8273-8495a6b7c8d9.zip.sha256 b/src/test/resources/zip/golden/5c1f0e7a-3b2d-4e6f-8a9b-0c1d2e3f4a5b/2026-09-01_12-34-56Z - Golden World - Before the End - 0a1b2c3d-4e5f-4061-8273-8495a6b7c8d9.zip.sha256
new file mode 100644
index 0000000..fdf4d31
--- /dev/null
+++ b/src/test/resources/zip/golden/5c1f0e7a-3b2d-4e6f-8a9b-0c1d2e3f4a5b/2026-09-01_12-34-56Z - Golden World - Before the End - 0a1b2c3d-4e5f-4061-8273-8495a6b7c8d9.zip.sha256	
@@ -0,0 +1 @@
+8ce6159e74a93203d4c654162b72e7faa250543a2c7d3d373a35d4df04d3d713  2026-09-01_12-34-56Z - Golden World - Before the End - 0a1b2c3d-4e5f-4061-8273-8495a6b7c8d9.zip
diff --git a/src/test/resources/zip/golden/5c1f0e7a-3b2d-4e6f-8a9b-0c1d2e3f4a5b/2026-09-01_13-00-00Z - Golden World - World Exit - 1b2c3d4e-5f60-4172-8384-95a6b7c8d9ea.zip b/src/test/resources/zip/golden/5c1f0e7a-3b2d-4e6f-8a9b-0c1d2e3f4a5b/2026-09-01_13-00-00Z - Golden World - World Exit - 1b2c3d4e-5f60-4172-8384-95a6b7c8d9ea.zip
new file mode 100644
index 0000000..2e4b91a
Binary files /dev/null and b/src/test/resources/zip/golden/5c1f0e7a-3b2d-4e6f-8a9b-0c1d2e3f4a5b/2026-09-01_13-00-00Z - Golden World - World Exit - 1b2c3d4e-5f60-4172-8384-95a6b7c8d9ea.zip differ
diff --git a/src/test/resources/zip/golden/5c1f0e7a-3b2d-4e6f-8a9b-0c1d2e3f4a5b/2026-09-01_13-00-00Z - Golden World - World Exit - 1b2c3d4e-5f60-4172-8384-95a6b7c8d9ea.zip.sha256 b/src/test/resources/zip/golden/5c1f0e7a-3b2d-4e6f-8a9b-0c1d2e3f4a5b/2026-09-01_13-00-00Z - Golden World - World Exit - 1b2c3d4e-5f60-4172-8384-95a6b7c8d9ea.zip.sha256
new file mode 100644
index 0000000..1750a45
--- /dev/null
+++ b/src/test/resources/zip/golden/5c1f0e7a-3b2d-4e6f-8a9b-0c1d2e3f4a5b/2026-09-01_13-00-00Z - Golden World - World Exit - 1b2c3d4e-5f60-4172-8384-95a6b7c8d9ea.zip.sha256	
@@ -0,0 +1 @@
+c89756dec39f28e0a6f69151d8a3ff967527b5b97bcd6d1026f2f4ab22d18746  2026-09-01_13-00-00Z - Golden World - World Exit - 1b2c3d4e-5f60-4172-8384-95a6b7c8d9ea.zip
diff --git a/src/test/resources/zip/golden/9d8c7b6a-5f4e-4d3c-8b2a-1f0e9d8c7b6a/20260717T201530123Z_2c3d4e5f-6071-4283-9495-a6b7c8d9eafb.zip b/src/test/resources/zip/golden/9d8c7b6a-5f4e-4d3c-8b2a-1f0e9d8c7b6a/20260717T201530123Z_2c3d4e5f-6071-4283-9495-a6b7c8d9eafb.zip
new file mode 100644
index 0000000..d27ade9
Binary files /dev/null and b/src/test/resources/zip/golden/9d8c7b6a-5f4e-4d3c-8b2a-1f0e9d8c7b6a/20260717T201530123Z_2c3d4e5f-6071-4283-9495-a6b7c8d9eafb.zip differ
diff --git a/src/test/resources/zip/golden/9d8c7b6a-5f4e-4d3c-8b2a-1f0e9d8c7b6a/20260717T201530123Z_2c3d4e5f-6071-4283-9495-a6b7c8d9eafb.zip.sha256 b/src/test/resources/zip/golden/9d8c7b6a-5f4e-4d3c-8b2a-1f0e9d8c7b6a/20260717T201530123Z_2c3d4e5f-6071-4283-9495-a6b7c8d9eafb.zip.sha256
new file mode 100644
index 0000000..76d738d
--- /dev/null
+++ b/src/test/resources/zip/golden/9d8c7b6a-5f4e-4d3c-8b2a-1f0e9d8c7b6a/20260717T201530123Z_2c3d4e5f-6071-4283-9495-a6b7c8d9eafb.zip.sha256
@@ -0,0 +1 @@
+da40a8553525bf8b0184941c9b3c39470ae9106c66530a8f16f7d8cee97326d4  20260717T201530123Z_2c3d4e5f-6071-4283-9495-a6b7c8d9eafb.zip