@@ -47,6 +47,10 @@ type Batcher struct {
 	OnLost  func()
 	OnError func(error)      // a refusal (see RefusalOf) the person should hear of, once per episode
 	Now     func() time.Time // default time.Now; tests inject a fake clock
+	// BeforeResolve settles finished calls before displacement chooses the head
+	// to keep. A failed save must leave resolution pending rather than branch
+	// an older head and announce that all work was kept.
+	BeforeResolve func(context.Context) error
 	// OnRenewalChange wakes local readers when renewal health or ownership changes.
 	OnRenewalChange func()
 	// Liveness, when set, is a watch socket that can vouch for the lease, so
@@ -561,6 +565,11 @@ func (b *Batcher) lost(ctx context.Context, seen Driving) {
 // resolve turns the orphaned turns into a branch, or, when there are none,
 // just tells the caller the chat is now a viewer. The caller holds flushMu.
 func (b *Batcher) resolve(ctx context.Context) error {
+	if b.BeforeResolve != nil {
+		if err := b.BeforeResolve(ctx); err != nil {
+			return err
+		}
+	}
 	head, n := b.newest()
 	by := b.holder(ctx)
 	if local, ok := b.Publisher.Engine.(interface {
 
@@ -0,0 +1,41 @@
+package cellsync
+
+import (
+	"context"
+	"errors"
+	"testing"
+)
+
+func TestSavePausesDisplacementSettlesBeforeChoosingItsHead(t *testing.T) {
+	r := newRig(t)
+	b := r.batcher()
+	r.publishFirst(map[string]string{"a": "shared"})
+	r.takeOver()
+	var kept string
+	b.BeforeResolve = func(context.Context) error {
+		kept = r.seal(map[string]string{"a": "finished but held"})
+		note(b, kept)
+		return nil
+	}
+	b.Displaced(t.Context())
+	id := r.branch.Resolve(cellID)
+	if kept == "" || id == cellID || r.head(id).Head != kept || r.head(id).OrphanTurns != 1 {
+		t.Fatalf("displacement chose the head before settling: kept=%q branch=%q", kept, id)
+	}
+}
+
+func TestSavePausesDisplacementDoesNotAcknowledgeAFailedSettle(t *testing.T) {
+	r := newRig(t)
+	b := r.batcher()
+	r.publishFirst(map[string]string{"a": "shared"})
+	note(b, r.seal(map[string]string{"a": "older pending head"}))
+	r.takeOver()
+	fault := errors.New("latest calls could not be saved")
+	b.BeforeResolve = func(context.Context) error { return fault }
+	announced := false
+	b.OnSuperseded = func(Superseded) { announced = true }
+	b.Displaced(t.Context())
+	if !errors.Is(b.lastFlushErr, fault) || announced || r.branch.Resolve(cellID) != cellID || b.Pending() != 1 {
+		t.Fatalf("failed settle acknowledged older work: err=%v announced=%v pending=%d", b.lastFlushErr, announced, b.Pending())
+	}
+}
@@ -8,10 +8,11 @@ import (
 	"github.com/Agent-Field/codeaf/internal/directory"
 )
 
-// ConfirmWork checks only this chat's directory record. Unlike CheckLease it
-// never waits for a capture before reading ownership. The caller bounds ctx
-// and decides how to degrade a failed read. True confirms the current fence;
-// false means either a viewer or a drive that cannot confirm ownership yet.
+// ConfirmWork checks only this chat's directory record without waiting for
+// capture before reading ownership. Reacquisition captures closed steps before
+// comparing heads. The caller bounds ctx and decides how to degrade a failed
+// read. True confirms the current fence; false means either a viewer or a drive
+// that cannot confirm ownership yet.
 func (d *Drive) ConfirmWork(ctx context.Context) (bool, error) {
 	held := d.sendLeaseSnapshot()
 	if d.batcher == nil {
@@ -40,6 +41,9 @@ func (d *Drive) ConfirmWork(ctx context.Context) (bool, error) {
 	if lease.Expires <= v.Now {
 		d.availableAfter(held, lease)
 		// Never resume an older tree over work saved by another computer.
+		if err := cellstore.Captured(ctx, d.cell); err != nil {
+			return false, err
+		}
 		head, err := cellstore.Head(d.cell)
 		if err != nil || head == nil || head.Turn.ID != v.Cell.Head {
 			return false, err
 
@@ -285,6 +285,9 @@ func (s *Sync) publishLocalChat(ctx context.Context, root, id string) (copyAttem
 	if err != nil {
 		return copyAttempt{}, err
 	}
+	if err := cellstore.Await(ctx, c); err != nil {
+		return copyAttempt{}, err
+	}
 	head, err := cellstore.Head(c)
 	if err != nil {
 		return copyAttempt{}, err
 
@@ -382,12 +382,15 @@ func (s *Sync) batcher(eng cellstore.Engine, c cell.Cell, drv cellsync.Driving,
 			Dir: s.Dir, Publisher: pub, Map: branches,
 			NewID: func() (string, error) { return cell.NewID(time.Now()) },
 		},
-		Driving:         &drv,
-		Interval:        s.Interval,
-		Info:            d.info,
-		OnFlush:         d.flushed(),
-		OnSuperseded:    d.becomeViewer,
-		OnLost:          d.loseHold,
+		Driving:      &drv,
+		Interval:     s.Interval,
+		Info:         d.info,
+		OnFlush:      d.flushed(),
+		OnSuperseded: d.becomeViewer,
+		OnLost:       d.loseHold,
+		BeforeResolve: func(ctx context.Context) error {
+			return cellstore.Captured(ctx, c)
+		},
 		OnError:         d.refusal,
 		Sleep:           d.opt.Sleep,
 		Liveness:        s.Liveness(),
@@ -593,7 +596,7 @@ func (d *Drive) HoldsLease(ctx context.Context) bool {
 // heartbeat or directory change has reached this process since the move.
 func (d *Drive) CheckLease(ctx context.Context) error {
 	held := d.sendLeaseSnapshot()
-	if err := cellstore.Captured(ctx, d.cell); err != nil {
+	if err := cellstore.WaitCapture(ctx, d.cell); err != nil {
 		return err
 	}
 	if d.batcher == nil {
@@ -624,7 +627,7 @@ func (d *Drive) CheckLease(ctx context.Context) error {
 
 // retireForAnotherHolder retires this writer's hold when CheckLease finds
 // another computer holding the chat. It retires the hold at once so no new
-// seal starts, waits for any seal already past Gate, and lets the batcher keep
+// tool starts, waits for any seal already past Gate, and lets the batcher keep
 // unsent turns as a branch before the window names the new holder (#2091).
 // The send receipt goes before the
 // batcher marks itself stale, because that mark already wakes renewal readers
@@ -742,7 +745,13 @@ func (s stamping) Seal(ctx context.Context, c cell.Cell, info cellstore.TurnInfo
 	d := s.drive
 	d.sealMu.Lock()
 	defer d.sealMu.Unlock()
-	if d.Gate() != nil {
+	d.mu.Lock()
+	stopped := d.stopped
+	d.mu.Unlock()
+	// Finished calls still belong to this computer's work after its hold is
+	// lost. Seal them locally so displacement can keep them in the branch;
+	// the gate continues to refuse new tools and bookkeeping-only saves.
+	if stopped || d.Gate() != nil && len(info.Calls) == 0 {
 		return cellstore.Sealed{}, cellstore.ErrReadOnly
 	}
 	if d.sync.isRemoved() {
 
@@ -0,0 +1,76 @@
+package syncsetup
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/Agent-Field/codeaf/internal/cellstore"
+	"github.com/Agent-Field/codeaf/internal/directory"
+	"github.com/Agent-Field/codeaf/internal/executor"
+)
+
+type pauseStepSeat struct {
+	executor.Stance
+	rec *cellstore.Recorder
+}
+
+func (s pauseStepSeat) Settle(ctx context.Context) { s.rec.Settle(ctx) }
+
+func TestSavePausesOwnershipLossKeepsHeldCallsInTheBranch(t *testing.T) {
+	r := newDriveRig(t)
+	ctx := t.Context()
+	appendTo(t, transcriptOf(r.cell), `{"type":"message","role":"user","content":"start this chat"}`+"\n")
+	first, err := r.engine.Seal(ctx, r.cell, cellstore.TurnInfo{})
+	mustNil(t, err)
+	_, err = r.a.Dir.Create(ctx, r.cell.ID, directory.CellInit{Head: first.Turn.ID})
+	mustNil(t, err)
+	drive, err := r.a.Drive(ctx, r.engine, r.cell, DriveOptions{})
+	mustNil(t, err)
+	t.Cleanup(func() { mustNil(t, drive.Close(context.Background())) })
+	rec, err := cellstore.NewRecorder(executor.Local{}, drive.Store(r.engine), r.cell, r.engine.WALPath(r.cell), cellstore.Options{Async: true, Now: func() time.Time { return time.Unix(100, 0) }})
+	mustNil(t, err)
+	mustNil(t, rec.Around(ctx, executor.Call{Tool: "bash", Args: []byte("held call"), Deferred: true}, executor.EffectExternal, cellstore.AgentRun, func() ([]byte, bool) {
+		mustNil(t, os.WriteFile(filepath.Join(r.work, "held.txt"), []byte("held work"), 0600))
+		return []byte("held output"), false
+	}))
+	appendTo(t, transcriptOf(r.cell), `{"type":"message","role":"tool","content":"held output"}`+"\n")
+	executor.SettleStep(ctx, pauseStepSeat{rec: rec})
+	before, err := cellstore.Head(r.cell)
+	mustNil(t, err)
+	if before == nil || before.Turn.ID != first.Turn.ID {
+		t.Fatal("held call was captured before ownership loss")
+	}
+	view, err := r.b.Dir.Cell(ctx, r.cell.ID)
+	mustNil(t, err)
+	_, err = r.b.Dir.Acquire(ctx, r.cell.ID, directory.AcquireOpts{Force: true, Expect: &directory.LeaseExpectation{Device: view.Cell.Lease.Device, Fence: view.Cell.Lease.Fence}})
+	mustNil(t, err)
+	mustNil(t, drive.CheckLease(ctx))
+	branches, err := branchMapOf(r.homeA)
+	mustNil(t, err)
+	id := branches.Resolve(r.cell.ID)
+	if id == r.cell.ID {
+		t.Fatal("ownership loss did not preserve the held work as a branch")
+	}
+	kept, err := r.a.Dir.Cell(ctx, id)
+	mustNil(t, err)
+	head, err := cellstore.Head(r.cell)
+	mustNil(t, err)
+	if head == nil || kept.Cell.Head != head.Turn.ID || len(head.Receipt.Calls) != 1 || head.Receipt.Calls[0].Tool != "bash" || drive.Gate() == nil {
+		t.Fatalf("branch did not carry the held call or retire its writer: head=%+v branch=%+v", head, kept.Cell)
+	}
+	_, recovery, err := cellstore.OpenWAL(r.engine.WALPath(r.cell))
+	mustNil(t, err)
+	if len(recovery.Completed) != 0 {
+		t.Fatal("preserved call remained unsealed in the WAL")
+	}
+	mustNil(t, os.Remove(filepath.Join(r.work, "held.txt")))
+	mustNil(t, r.engine.Restore(ctx, r.cell, kept.Cell.Head, []string{"held.txt"}))
+	content, err := os.ReadFile(filepath.Join(r.work, "held.txt"))
+	mustNil(t, err)
+	if string(content) != "held work" {
+		t.Fatalf("kept head did not restore the held call's file: %q", content)
+	}
+}