@@ -37,5 +37,6 @@ elif [ -n "${GITHUB_BEFORE:-}" ] &&
   git fetch --depth=1 origin "$GITHUB_BEFORE"
   echo "ref=$GITHUB_BEFORE" >> "$GITHUB_OUTPUT"
 else
+  git fetch --depth=2 origin "$GITHUB_SHA"
   echo 'ref=HEAD~1' >> "$GITHUB_OUTPUT"
 fi
@@ -124,6 +124,30 @@ describe('Project document editor attribution over real Redis', () => {
     }
   )
 
+  check('retirement fences a seed that has not reached Redis yet', async () => {
+    const name = `project-file-doc:${generateId()}/${generateId()}`
+    const retiredId = generateId()
+    const replacementId = generateId()
+    const retired = new Y.Doc()
+    const replacement = new Y.Doc()
+    rooms.push({ name, doc: retired })
+    retired.getMap(FILE_DOC_SEED.configMap).set(FILE_DOC_SEED.flag, true)
+    retired.getMap(FILE_DOC_SEED.configMap).set(FILE_DOC_SEED.docIdKey, retiredId)
+    replacement.getMap(FILE_DOC_SEED.configMap).set(FILE_DOC_SEED.flag, true)
+    replacement.getMap(FILE_DOC_SEED.configMap).set(FILE_DOC_SEED.docIdKey, replacementId)
+    try {
+      expect(await store.retireDocumentGeneration(name, retiredId, replacementId)).toEqual({
+        status: 'applied',
+        docId: retiredId,
+      })
+      expect(await store.seedIfEmpty(name, Y.encodeStateAsUpdate(retired), 1, true)).toBe(false)
+      expect(await store.seedIfEmpty(name, Y.encodeStateAsUpdate(replacement), 1, true)).toBe(true)
+      expect(await store.getDocumentGeneration(name)).toBe(replacementId)
+    } finally {
+      replacement.destroy()
+    }
+  })
+
   check(
     'retiring a generation fences old seeds and delayed retirement preserves the replacement',
     async () => {
 
@@ -67,7 +67,7 @@ const SEED_IF_EMPTY_SCRIPT =
 
 /** Preserve a replacement identity even before its seed exists, fencing late seeds for the retired one. */
 const RETIRE_DOCUMENT_SCRIPT =
-  "local generation = redis.call('get', KEYS[2]); if generation ~= ARGV[1] then return false end; redis.call('set', KEYS[2], ARGV[2], 'EX', ARGV[3]); redis.call('del', KEYS[1], KEYS[4], KEYS[5]); redis.call('expire', KEYS[3], ARGV[3]); redis.call('expire', KEYS[6], ARGV[3]); return generation"
+  "local generation = redis.call('get', KEYS[2]); if generation and generation ~= ARGV[1] then return false end; redis.call('set', KEYS[2], ARGV[2], 'EX', ARGV[3]); redis.call('del', KEYS[1], KEYS[4], KEYS[5]); redis.call('expire', KEYS[3], ARGV[3]); redis.call('expire', KEYS[6], ARGV[3]); return generation or ARGV[1]"
 
 /** Orders a durable replacement with seeds and merges, and fences publishers in the same transaction. */
 const INVALIDATE_DOCUMENT_SCRIPT =
@@ -818,7 +818,8 @@ export class FileDocStore {
     if (!retiredDocId || !replacementDocId || retiredDocId === replacementDocId)
       throw new Error('Document retirement requires distinct identities')
     if (!this.enabled) {
-      if ((await this.getDocumentGeneration(name)) !== retiredDocId) return { status: 'stale' }
+      const generation = await this.getDocumentGeneration(name)
+      if (generation && generation !== retiredDocId) return { status: 'stale' }
       const previous = this.localInvalidations.get(name)
       this.localInvalidations.set(name, {
         version: previous?.version ?? 0,
 
@@ -11,6 +11,7 @@ import { ProjectConflictError } from '@/lib/projects/errors'
 import { purgeProjectFilesInTx } from '@/lib/projects/files/purge'
 import { lockProjectBackfillWrites, lockProjects } from '@/lib/projects/membership'
 import {
+  assertProjectCreatorSuccessor,
   findProjectSuccessor,
   handoffProjectCreatorReferencesTx,
   listSharedResourceProjectIdsForUser,
@@ -115,6 +116,7 @@ export async function getProjectAccountDeletionBlockers(
   )
   const doomed = new Set(doomedWorkspaceIds)
   const blockers: string[] = []
+  const creatorProjects = new Set(await listSharedResourceProjectIdsForUser(db, userId))
   for (const record of records) {
     const decision = await planProjectDeletion(
       db,
@@ -124,7 +126,25 @@ export async function getProjectAccountDeletionBlockers(
       doomed,
       false
     )
-    if ('blocker' in decision) blockers.push(decision.blocker)
+    if ('blocker' in decision) {
+      blockers.push(decision.blocker)
+      continue
+    }
+    if ('remove' in decision || !creatorProjects.has(record.id)) continue
+    try {
+      await assertProjectCreatorSuccessor(
+        db,
+        { ...record, ownerId: decision.ownerId ?? record.ownerId },
+        userId,
+        (environments.get(record.id) ?? [])
+          .filter((row) => !doomed.has(row.id))
+          .map((row) => row.id),
+        false
+      )
+    } catch (error) {
+      if (!(error instanceof ProjectConflictError)) throw error
+      blockers.push(error.message)
+    }
   }
   return blockers
 }
 
@@ -1,5 +1,5 @@
 import { mkdtempSync } from 'node:fs'
-import { chmod, mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { db } from '@sim/db'
@@ -39,6 +39,7 @@ import { processOutboxEventById } from '@/lib/core/outbox/service'
 import { prepareProjectsForAccountDeletion } from '@/lib/projects/account-deletion'
 import { createProjectFileUploadSession } from '@/lib/projects/files/application/uploads'
 import { workspaceFileStorageCleanupOutboxHandlers } from '@/lib/uploads/contexts/workspace/workspace-file-storage-cleanup-outbox'
+import * as storageService from '@/lib/uploads/core/storage-service'
 import { UPLOAD_URL_TTL_MS } from '@/lib/uploads/upload-session/provider'
 import { PROJECT_FILE_UPLOAD_BINDING_KEY } from '@/lib/uploads/upload-session/types'
 import { deleteUserAccount } from '@/lib/users/account-deletion'
@@ -673,7 +674,15 @@ describe('Private Project teardown and durable object cleanup', () => {
         await mkdir(prefix, { recursive: true })
         await writeFile(join(prefix, 'late.bin'), 'late')
       }
-      await chmod(obstructed, 0o000)
+      const deleteStoredFile = storageService.deleteFile
+      const deletion = vi.spyOn(storageService, 'deleteFile').mockImplementation((params) => {
+        if (params.key.startsWith(`project/${orphanIds[0]}/`)) {
+          return Promise.reject(
+            Object.assign(new Error('Fixture prefix deletion failed'), { code: 'EACCES' })
+          )
+        }
+        return deleteStoredFile(params)
+      })
       const { projectFilePrefixCleanupOutboxHandlers } = await import(
         '@/lib/projects/files/prefix-cleanup'
       )
@@ -718,7 +727,7 @@ describe('Private Project teardown and durable object cleanup', () => {
           })
         expect(await readFile(join(storageRoot, live.keys[0]), 'utf8')).toBe('new')
       } finally {
-        await chmod(obstructed, 0o755)
+        deletion.mockRestore()
       }
       expect(await readFile(join(obstructed, 'late.bin'), 'utf8')).toBe('late')
       await db
 
@@ -86,25 +86,23 @@ export async function listSharedResourceProjectIdsForUser(executor: DbOrTx, user
 }
 
 /** Validates the canonical Project owner rather than borrowing an environment's payer. */
-export async function handoffProjectCreatorReferencesTx(
-  tx: DbTransaction,
+export async function assertProjectCreatorSuccessor(
+  executor: DbOrTx,
   record: typeof project.$inferSelect,
   departingUserId: string,
-  environmentIds: string[]
+  environmentIds: string[],
+  hold: boolean
 ) {
   const successorId = record.ownerId
   if (successorId === departingUserId)
     throw new ProjectConflictError(
       'Project resources need a successor before this account can leave'
     )
-  const [successor] = await tx
-    .select({ id: user.id })
-    .from(user)
-    .where(eq(user.id, successorId))
-    .for('key share')
+  const successorQuery = executor.select({ id: user.id }).from(user).where(eq(user.id, successorId))
+  const [successor] = await (hold ? successorQuery.for('key share') : successorQuery)
   if (!successor) throw new ProjectConflictError('Project successor changed; retry the operation')
-  const [admin] = record.organizationId
-    ? await tx
+  const adminQuery = record.organizationId
+    ? executor
         .select({ id: member.id })
         .from(member)
         .where(
@@ -114,11 +112,11 @@ export async function handoffProjectCreatorReferencesTx(
             inArray(member.role, ORG_ADMIN_ROLES)
           )
         )
-        .for('share')
-    : []
+    : null
+  const [admin] = adminQuery ? await (hold ? adminQuery.for('share') : adminQuery) : []
   if (!admin) {
-    const grants = environmentIds.length
-      ? await tx
+    const grantQuery = environmentIds.length
+      ? executor
           .select({ id: permissions.entityId })
           .from(permissions)
           .where(
@@ -129,13 +127,24 @@ export async function handoffProjectCreatorReferencesTx(
               inArray(permissions.entityId, environmentIds)
             )
           )
-          .for('share')
-      : []
+      : null
+    const grants = grantQuery ? await (hold ? grantQuery.for('share') : grantQuery) : []
     if (!environmentIds.length || grants.length !== environmentIds.length)
       throw new ProjectConflictError(
         'Project successor must administer every surviving environment'
       )
   }
+}
+
+/** Transfers creator references only after the canonical successor is held and validated. */
+export async function handoffProjectCreatorReferencesTx(
+  tx: DbTransaction,
+  record: typeof project.$inferSelect,
+  departingUserId: string,
+  environmentIds: string[]
+) {
+  await assertProjectCreatorSuccessor(tx, record, departingUserId, environmentIds, true)
+  const successorId = record.ownerId
   await handoffFileCreatorsInTx(
     tx,
     and(eq(workspaceFiles.projectId, record.id), eq(workspaceFiles.userId, departingUserId)),
 
@@ -165,6 +165,9 @@ it('partial departure retains Project attribution; successor handoff and prior-d
       context: 'project',
       folderId: projectFolderId,
     })
+    await expect(db.delete(user).where(eq(user.id, creatorId))).rejects.toMatchObject({
+      cause: { code: '23514', constraint_name: 'project_resource_creator_handoff' },
+    })
     await db.transaction((tx) =>
       changeProjectStoragePayersInTx(tx, [
         {
 
@@ -891,7 +891,6 @@ export async function createOwnedWorkspaceFile<T>(params: {
   const name = params.fileName(fileId)
   const buffer = Buffer.from(params.content, 'utf-8')
   const storageKey = generateWorkspaceFileKey(params.workspaceId, name)
-  const storageBillingContext = await resolveStorageBillingContext(params.workspaceId)
   const uploadResult = await uploadFile({
     file: buffer,
     fileName: storageKey,
@@ -909,7 +908,11 @@ export async function createOwnedWorkspaceFile<T>(params: {
     persistMetadata: false,
   })
   try {
-    const { owner, updatedUsage } = await db.transaction(async (tx) => {
+    const { owner, updatedUsage, billing } = await db.transaction(async (tx) => {
+      const accounting = await prepareFileAccountingInTx(tx, {
+        entityType: 'workspace',
+        entityId: params.workspaceId,
+      })
       const inserted = await insertWorkspaceFileMetadataInTx(tx, {
         id: fileId,
         key: uploadResult.key,
@@ -922,14 +925,14 @@ export async function createOwnedWorkspaceFile<T>(params: {
         context: params.context,
       })
       if (!inserted) throw new Error(`Owned ${params.context} file ${fileId} was not inserted`)
-      const updatedUsage = await incrementStorageUsageForBillingContextInTx(
-        tx,
-        storageBillingContext,
-        buffer.length
-      )
-      return { owner: await params.insertOwner(tx, fileId), updatedUsage }
+      const updatedUsage = await accounting.mutation.applyDelta(buffer.length)
+      return {
+        owner: await params.insertOwner(tx, fileId),
+        updatedUsage,
+        billing: accounting.billing,
+      }
     })
-    void maybeNotifyStorageLimitForBillingContext(storageBillingContext, updatedUsage)
+    void maybeNotifyStorageLimitForBillingContext(billing, updatedUsage)
     return { fileId, owner }
   } catch (error) {
     await cleanupWorkspaceStorageObject(
 
@@ -0,0 +1,20 @@
+import { describe, expect, it } from 'vitest'
+import { fileDocumentInputIdentity } from '@/lib/uploads/documents/input-identity'
+
+describe('compiled document input identity', () => {
+  it('is independent of dependency query order and still changes with a revision', () => {
+    const owner = { entityType: 'project', entityId: 'project-1' } as const
+    const files = ['b', 'a'].map((id) => ({
+      id,
+      key: `project/project-1/${id}`,
+      contentUpdatedAt: new Date(1),
+      sizeBytes: 1,
+    }))
+    const identity = fileDocumentInputIdentity(owner, files)
+    expect(fileDocumentInputIdentity(owner, files.toReversed())).toBe(identity)
+    expect(
+      fileDocumentInputIdentity(owner, [{ ...files[0], contentUpdatedAt: new Date(2) }, files[1]])
+    ).not.toBe(identity)
+    expect(files.map((file) => file.id)).toEqual(['b', 'a'])
+  })
+})
@@ -1,21 +1,24 @@
 import type { WorkspaceFileRow } from '@sim/db/schema'
+import { compareStrings } from '@sim/utils/string'
 import type { EditableFileOwner } from '@/lib/workspace-files/ownership'
 
 /** Binds a rendered cache entry to every authorized input revision, in canonical file order. */
 export function fileDocumentInputIdentity(
   owner: EditableFileOwner,
-  files: readonly WorkspaceFileRow[]
+  files: readonly Pick<WorkspaceFileRow, 'id' | 'key' | 'contentUpdatedAt' | 'sizeBytes'>[]
 ) {
   return files.length > 0
     ? JSON.stringify({
         version: 1,
-        inputs: files.map((file) => ({
-          fileId: file.id,
-          key: file.key,
-          context: owner.entityType,
-          contentVersion: file.contentUpdatedAt.toISOString(),
-          size: file.sizeBytes,
-        })),
+        inputs: files
+          .toSorted((left, right) => compareStrings(left.id, right.id))
+          .map((file) => ({
+            fileId: file.id,
+            key: file.key,
+            context: owner.entityType,
+            contentVersion: file.contentUpdatedAt.toISOString(),
+            size: file.sizeBytes,
+          })),
       })
     : undefined
 }