diff --git a/apps/docs/content/docs/platform/enterprise/forks.mdx b/apps/docs/content/docs/platform/enterprise/forks.mdx
index 94334615944..c33c941c936 100644
--- a/apps/docs/content/docs/platform/enterprise/forks.mdx
+++ b/apps/docs/content/docs/platform/enterprise/forks.mdx
@@ -29,7 +29,7 @@ On Sim Cloud, your organization may also need the feature turned on for your acc
 
 ### 1. Open Forks
 
-Go to **Settings → Organization → Workspace forks** in the workspace you want to fork from (or manage).
+Go to **Settings → Workspace → Workspace forks** in the workspace you want to fork from (or manage).
 
 <Image src="/static/enterprise/forks-list.png" alt="Workspace Forks settings page showing Parent and Forks sections with Docs, See activity, and Create fork actions" width={900} height={369} />
 
@@ -62,7 +62,7 @@ Click **Fork**. The child workspace is created immediately. Deployed workflows l
 
 ### 3. Open the parent edge (from the child)
 
-Open the **child** workspace → **Settings → Organization → Workspace forks**. On the **Parent** row, open the menu and choose **Edit mappings**.
+Open the **child** workspace → **Settings → Workspace → Workspace forks**. On the **Parent** row, open the menu and choose **Edit mappings**.
 
 Child rows (when you are on the parent) only offer **Open workspace** and **Disconnect** — mapping and sync are owned by the child configuring how it relates to its parent.
 
@@ -136,14 +136,14 @@ Above the list, **Sync new workflows by default** decides where a **newly create
 
 | Setting | A new workflow… |
 |---------|-----------------|
-| **On** (default) | joins fork sync — it arrives checked and syncs as soon as you deploy it |
-| **Off** | starts outside fork sync — it arrives unchecked and only syncs after you check it |
+| **Sync** (default) | joins fork sync — it arrives checked and syncs as soon as you deploy it |
+| **Don't sync** | starts outside fork sync — it arrives unchecked and only syncs after you check it |
 
 Three things to know:
 
-- **It applies to the whole fork lineage.** The toggle writes every workspace in the lineage — the root, every ancestor, every descendant — so a parent and its forks can never disagree about what "new" means. Any workspace admin in the lineage can change it, and each member gets its own audit entry naming the workspace the change came from. A new fork inherits the value at creation.
+- **It applies to the whole fork lineage.** The toggle writes every workspace in the lineage — the root, every ancestor, every descendant — so a parent and its forks can never disagree about what "new" means. Any workspace admin in the lineage can change it, and each workspace whose value changes gets its own audit entry naming the workspace the change came from. A new fork inherits the value at creation.
 - **It is forward-only.** Flipping it never moves an existing workflow in or out of sync. The checkbox list above stays the record of what syncs.
-- **"New" means genuinely new.** Creating, duplicating, or importing a workflow takes this setting, as does the blank starter workflow a fork gets when there is nothing to copy. A workflow that arrives as a **copy** — from a fork, or from a push or pull — inherits its source's own checkbox instead, so a workflow you deliberately synced never lands unsynced in the child.
+- **"New" means genuinely new.** Creating, duplicating, or importing a workflow takes this setting, as does the blank starter workflow a fork gets when there is nothing to copy. A workflow that arrives as a **copy** — from a fork, or from a push or pull — ignores this setting. Only synced workflows are copied, and they always arrive synced, so a workflow you deliberately synced never lands unsynced on the other side.
 
 **Example:** a template workspace turns this off so every scratch workflow the team creates stays local, then checks only the handful meant to reach the forks.
 
@@ -399,7 +399,7 @@ Schedules, webhooks, and triggers are not live in the child until you **deploy**
   { question: "Why is Sync greyed out?", answer: "Usually a blocking reference, an unmapped credential or secret, or a required dependent field (label, channel, document, …) still empty. Open Blocking sync and the mapping sections — each row explains what to fix. Sync also stays disabled while details are loading or if loading failed (reload the page)." },
   { question: "Is sync a merge?", answer: "No. Deploy is like a commit; sync is a force push or force pull of deployed workflows onto the target. Use Rollback only for the last sync into a workspace, and remember copied resources may remain." },
   { question: "Who can disconnect a fork I cannot open?", answer: "Any admin on your side of the edge. Disconnect does not require access to the other workspace — so you are not stuck if the other side lost membership." },
-  { question: "I deployed a new workflow and sync ignored it. Why?", answer: "Sync new workflows by default is off for this fork lineage, so the workflow was created outside fork sync. Open Settings → Organization → Workspace forks and check it under Synced workflows. Turning the toggle back on only affects workflows created after that — it never moves an existing one." },
+  { question: "I deployed a new workflow and sync ignored it. Why?", answer: "Sync new workflows by default is off for this fork lineage, so the workflow was created outside fork sync. Open Settings → Workspace → Workspace forks and check it under Synced workflows. Turning the toggle back on only affects workflows created after that — it never moves an existing one." },
   { question: "Does turning Sync new workflows by default off stop my current syncs?", answer: "No. It is forward-only and never rewrites an existing workflow's checkbox, so everything already synced keeps syncing. It also applies to every workspace in the fork lineage, not just the one you changed it from." }
 ]} />
 
@@ -413,4 +413,4 @@ Self-hosted deployments turn Forks on with an environment variable instead of th
 |----------|-------------|
 | `FORKING_ENABLED`, `NEXT_PUBLIC_FORKING_ENABLED` | Enables workspace forking when billing is not used as the entitlement gate |
 
-Once enabled, use the same **Settings → Organization → Workspace forks** UI as Sim Cloud. Only workspace admins can manage forks.
+Once enabled, use the same **Settings → Workspace → Workspace forks** UI as Sim Cloud. Only workspace admins can manage forks.
diff --git a/apps/sim/app/api/superuser/import-workflow/route.ts b/apps/sim/app/api/superuser/import-workflow/route.ts
index f84d160f6e5..cc59d7627bf 100644
--- a/apps/sim/app/api/superuser/import-workflow/route.ts
+++ b/apps/sim/app/api/superuser/import-workflow/route.ts
@@ -12,13 +12,13 @@ import { loadCopilotChatMessages } from '@/lib/mothership/chat/lifecycle'
 import { appendCopilotChatMessages } from '@/lib/mothership/chat/messages-store'
 import { verifyEffectiveSuperUser } from '@/lib/permissions/super-user'
 import { parseWorkflowJson } from '@/lib/workflows/operations/import-export'
+import { buildNewWorkflowRow } from '@/lib/workflows/persistence/new-workflow-row'
 import {
   loadWorkflowFromNormalizedTables,
   saveWorkflowToNormalizedTables,
 } from '@/lib/workflows/persistence/utils'
 import { sanitizeForExport } from '@/lib/workflows/sanitization/json-sanitizer'
 import { deduplicateWorkflowName } from '@/lib/workflows/utils'
-import { resolveForkSyncExclusionForNewWorkflow } from '@/ee/workspace-forking/lib/sync-default'
 
 const logger = createLogger('SuperUserImportWorkflow')
 
@@ -130,30 +130,23 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     // Create new workflow record
     const newWorkflowId = generateId()
-    const now = new Date()
     const dedupedName = await deduplicateWorkflowName(
       `[Debug Import] ${sourceWorkflow.name}`,
       targetWorkspaceId,
       null
     )
 
-    await db.insert(workflow).values({
-      id: newWorkflowId,
-      userId: session.user.id,
-      workspaceId: targetWorkspaceId,
-      folderId: null,
-      name: dedupedName,
-      description: sourceWorkflow.description,
-      lastSynced: now,
-      createdAt: now,
-      updatedAt: now,
-      isDeployed: false, // Never copy deployment status
-      runCount: 0,
-      variables: sourceWorkflow.variables || {},
-      // An imported workflow is a NEW workflow in the target workspace, so it takes that
-      // workspace's fork-sync policy rather than the column default.
-      forkSyncExcluded: await resolveForkSyncExclusionForNewWorkflow(db, targetWorkspaceId),
-    })
+    await db.insert(workflow).values(
+      await buildNewWorkflowRow(db, {
+        id: newWorkflowId,
+        userId: session.user.id,
+        workspaceId: targetWorkspaceId,
+        folderId: null,
+        name: dedupedName,
+        description: sourceWorkflow.description,
+        variables: sourceWorkflow.variables || {},
+      })
+    )
 
     // Save using existing persistence logic
     const saveResult = await saveWorkflowToNormalizedTables(newWorkflowId, importedData, {
diff --git a/apps/sim/app/api/v1/admin/workflows/import/route.ts b/apps/sim/app/api/v1/admin/workflows/import/route.ts
index 5e0b85791bc..0c7f0f3c405 100644
--- a/apps/sim/app/api/v1/admin/workflows/import/route.ts
+++ b/apps/sim/app/api/v1/admin/workflows/import/route.ts
@@ -30,6 +30,7 @@ import { adminV1ImportWorkflowContract } from '@/lib/api/contracts/v1/admin'
 import { parseRequest } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { parseWorkflowJson } from '@/lib/workflows/operations/import-export'
+import { buildNewWorkflowRow } from '@/lib/workflows/persistence/new-workflow-row'
 import { prepareWorkflowStateForPersistence } from '@/lib/workflows/persistence/prepare-state'
 import { saveWorkflowToNormalizedTables } from '@/lib/workflows/persistence/utils'
 import { deduplicateWorkflowName } from '@/lib/workflows/utils'
@@ -41,7 +42,6 @@ import {
   notFoundResponse,
 } from '@/app/api/v1/admin/responses'
 import { extractWorkflowMetadata, type WorkflowImportRequest } from '@/app/api/v1/admin/types'
-import { resolveForkSyncExclusionForNewWorkflow } from '@/ee/workspace-forking/lib/sync-default'
 
 const logger = createLogger('AdminWorkflowImportAPI')
 
@@ -113,27 +113,18 @@ export const POST = withRouteHandler(
       )
 
       const workflowId = generateId()
-      const now = new Date()
       const dedupedName = await deduplicateWorkflowName(workflowName, workspaceId, folderId || null)
 
-      await db.insert(workflow).values({
-        id: workflowId,
-        userId: workspaceData.ownerId,
-        workspaceId,
-        folderId: folderId || null,
-        name: dedupedName,
-        description: workflowDescription,
-        lastSynced: now,
-        createdAt: now,
-        updatedAt: now,
-        isDeployed: false,
-        runCount: 0,
-        variables: {},
-        // An imported workflow is a NEW workflow in this workspace, so it takes the
-        // workspace's fork-sync policy. Without this it lands on the column default and
-        // silently joins fork sync in a workspace that opted out.
-        forkSyncExcluded: await resolveForkSyncExclusionForNewWorkflow(db, workspaceId),
-      })
+      await db.insert(workflow).values(
+        await buildNewWorkflowRow(db, {
+          id: workflowId,
+          userId: workspaceData.ownerId,
+          workspaceId,
+          folderId: folderId || null,
+          name: dedupedName,
+          description: workflowDescription,
+        })
+      )
 
       /**
        * Same normalization the editor and the v1 import API run, via the one
diff --git a/apps/sim/app/api/v1/admin/workspaces/[id]/import/route.ts b/apps/sim/app/api/v1/admin/workspaces/[id]/import/route.ts
index 12b26db0c28..f19a1c072a7 100644
--- a/apps/sim/app/api/v1/admin/workspaces/[id]/import/route.ts
+++ b/apps/sim/app/api/v1/admin/workspaces/[id]/import/route.ts
@@ -45,6 +45,7 @@ import {
   extractWorkflowsFromZip,
   parseWorkflowJson,
 } from '@/lib/workflows/operations/import-export'
+import { buildNewWorkflowRow } from '@/lib/workflows/persistence/new-workflow-row'
 import { prepareWorkflowStateForPersistence } from '@/lib/workflows/persistence/prepare-state'
 import { saveWorkflowToNormalizedTables } from '@/lib/workflows/persistence/utils'
 import { deduplicateWorkflowName } from '@/lib/workflows/utils'
@@ -62,7 +63,6 @@ import type {
   WorkspaceImportRequest,
   WorkspaceImportResponse,
 } from '@/app/api/v1/admin/types'
-import { resolveForkSyncExclusionForNewWorkflow } from '@/ee/workspace-forking/lib/sync-default'
 
 const logger = createLogger('AdminWorkspaceImportAPI')
 
@@ -348,27 +348,18 @@ async function importSingleWorkflow(
     }
 
     const workflowId = generateId()
-    const now = new Date()
     const dedupedName = await deduplicateWorkflowName(workflowName, workspaceId, targetFolderId)
 
-    await db.insert(workflow).values({
-      id: workflowId,
-      userId: ownerId,
-      workspaceId,
-      folderId: targetFolderId,
-      name: dedupedName,
-      description: workflowData.metadata?.description || 'Imported via Admin API',
-      lastSynced: now,
-      createdAt: now,
-      updatedAt: now,
-      isDeployed: false,
-      runCount: 0,
-      variables: {},
-      // An imported workflow is a NEW workflow in this workspace, so it takes the
-      // workspace's fork-sync policy. Without this it lands on the column default and
-      // silently joins fork sync in a workspace that opted out.
-      forkSyncExcluded: await resolveForkSyncExclusionForNewWorkflow(db, workspaceId),
-    })
+    await db.insert(workflow).values(
+      await buildNewWorkflowRow(db, {
+        id: workflowId,
+        userId: ownerId,
+        workspaceId,
+        folderId: targetFolderId,
+        name: dedupedName,
+        description: workflowData.metadata?.description || 'Imported via Admin API',
+      })
+    )
 
     /**
      * Same normalization the editor, the v1 import API and the single-workflow
diff --git a/apps/sim/app/api/workspaces/[id]/fork/sync-default/route.ts b/apps/sim/app/api/workspaces/[id]/fork/sync-default/route.ts
index 1f9cdaf9d27..d33985f4cb2 100644
--- a/apps/sim/app/api/workspaces/[id]/fork/sync-default/route.ts
+++ b/apps/sim/app/api/workspaces/[id]/fork/sync-default/route.ts
@@ -13,10 +13,8 @@ export const PUT = defineInternalJsonRoute({
   auth: internalSessionAuth,
   operation: forkOperations.syncDefault,
   /**
-   * Rated, unlike its sibling fork routes. This is the one that writes workspaces the
-   * caller may not administer, under the feature's coarsest advisory lock, so an admin of
-   * any single lineage member could otherwise loop it and starve fork creation across the
-   * whole lineage.
+   * Rate-limited, unlike sibling fork routes: it writes the whole lineage under the coarsest
+   * fork lock, so looping it could starve fork creation lineage-wide.
    */
   rateLimit: internalRateLimits.user({ bucketName: 'workspace-fork-sync-default' }),
   errorPolicy: internalForkErrorPolicy,
diff --git a/apps/sim/ee/workspace-forking/application/lineage-details.ts b/apps/sim/ee/workspace-forking/application/lineage-details.ts
index a2143b28b91..0b640febdc0 100644
--- a/apps/sim/ee/workspace-forking/application/lineage-details.ts
+++ b/apps/sim/ee/workspace-forking/application/lineage-details.ts
@@ -1,10 +1,10 @@
 import { db } from '@sim/db'
 import { workspace } from '@sim/db/schema'
 import { eq } from 'drizzle-orm'
+import { readForkSyncNewWorkflowsExcluded } from '@/lib/workflows/persistence/new-workflow-row'
 import { getEffectiveWorkspacePermission } from '@/lib/workspaces/permissions/utils'
 import { getForkChildren, getForkParent } from '@/ee/workspace-forking/lib/lineage/lineage'
 import { getUndoableRunForTarget } from '@/ee/workspace-forking/lib/promote/promote-run-store'
-import { resolveForkSyncExclusionForNewWorkflow } from '@/ee/workspace-forking/lib/sync-default'
 
 /**
  * Annotates a lineage node with whether the viewer holds any access to it (explicit
@@ -40,7 +40,7 @@ export const getWorkspaceForkLineageDetails = defineForkUseCase({
       getForkChildren(workspaceId),
       getUndoableRunForTarget(db, workspaceId),
       // Lineage-uniform, so this workspace's own value is the lineage's value.
-      resolveForkSyncExclusionForNewWorkflow(db, workspaceId),
+      readForkSyncNewWorkflowsExcluded(db, workspaceId),
     ])
 
     const [parent, children] = await Promise.all([
diff --git a/apps/sim/ee/workspace-forking/application/operations.ts b/apps/sim/ee/workspace-forking/application/operations.ts
index 27759c9e9b5..e744d99f92f 100644
--- a/apps/sim/ee/workspace-forking/application/operations.ts
+++ b/apps/sim/ee/workspace-forking/application/operations.ts
@@ -99,12 +99,8 @@ export const forkOperations = {
     oauthScope: 'api:write',
   }),
   /**
-   * Admin on the CALLING workspace is sufficient, and the write then fans out to every
-   * ancestor and descendant, because the default is meaningless unless it is uniform
-   * across a lineage. Flipping it to "sync new workflows" restores the historical
-   * behaviour rather than granting anything new, and it never moves an existing workflow
-   * in or out of sync - so each member records its own audit entry rather than the write
-   * being restricted to one workspace.
+   * Admin on the calling workspace is sufficient; the write fans out to the whole lineage
+   * because the default must be uniform, and it never moves an existing workflow.
    *
    * permission-group-exempt: the new-workflow fork-sync default is workspace configuration governed by the admin role.
    */
diff --git a/apps/sim/ee/workspace-forking/application/recovery-and-mappings.ts b/apps/sim/ee/workspace-forking/application/recovery-and-mappings.ts
index eb519e299bc..f679f2686e2 100644
--- a/apps/sim/ee/workspace-forking/application/recovery-and-mappings.ts
+++ b/apps/sim/ee/workspace-forking/application/recovery-and-mappings.ts
@@ -52,10 +52,8 @@ export const updateWorkspaceForkMappings = defineForkUseCase<
       input.direction === 'push' ? input.otherWorkspaceId : input.workspaceId
     return db.transaction(async (tx) => {
       await setForkLockTimeout(tx)
-      // Rank 4 - see the rank table on `acquireForkLineageLock`. Unlike promote and
-      // rollback this takes no rank-3 target lock: it rewrites only this edge's mapping
-      // rows, never the target's workflows, so nothing contends with a sync into the
-      // target. Skipping a higher rank is not an ordering violation.
+      // Rank 4 - see the rank table on `acquireForkLineageLock`. No target lock: this
+      // rewrites only the edge's mapping rows.
       await acquireForkEdgeLock(tx, edge.childWorkspaceId)
       const [currentEdge] = await tx
         .select({ parentId: workspace.forkedFromWorkspaceId })
diff --git a/apps/sim/ee/workspace-forking/application/revision.ts b/apps/sim/ee/workspace-forking/application/revision.ts
index 4ca0fb3b96d..1bfb81aaf92 100644
--- a/apps/sim/ee/workspace-forking/application/revision.ts
+++ b/apps/sim/ee/workspace-forking/application/revision.ts
@@ -143,11 +143,8 @@ export async function loadForkPreviewRevision(
 /**
  * Locks normalized graph rows as well as workflow metadata, including realtime-only writes.
  *
- * Rank 5 - the heaviest acquirer in the fork module, and the one the rank table on
- * `acquireForkLineageLock` exists for. It takes `FOR UPDATE` on the `workspace` rows, so
- * any caller that also needs the rank-2 lineage lock must take that one FIRST; doing it
- * the other way round deadlocks against `unlinkForkEdge`, which holds the lineage key and
- * then updates the same `workspace` row.
+ * Rank 5 - see the rank table on `acquireForkLineageLock`. Takes `FOR UPDATE` on `workspace`
+ * rows, so a caller needing the rank-2 lineage lock must take it first.
  */
 export async function lockForkRevision(tx: DbTransaction, scope: ForkRevisionScope): Promise<void> {
   const workspaceIds = [
@@ -207,21 +204,11 @@ export async function assertForkSourceVersions(
   sourceWorkspaceId: string,
   expected: ReadonlyMap<string, { id: string; digest: string }>
 ): Promise<void> {
-  // Verify exactly the workflows that were ADMITTED, rather than re-deriving the source
-  // predicate here. Re-deriving it duplicated `listDeployedWorkflows`'s filter, so the day
-  // a caller admitted a different set - "Copy unsynced workflows" admits sync-excluded
-  // workflows - this query returned fewer rows and every such fork failed on a phantom
-  // size mismatch. Keying off `expected` cannot drift from the admitted set by construction.
-  if (expected.size === 0) return
-  const admittedIds = sql.join(
-    [...expected.keys()].map((id) => sql`${id}`),
-    sql`, `
-  )
   const rows = await tx.execute<{ workflowId: string; id: string; digest: string }>(sql`
     SELECT w.id AS "workflowId", d.id, md5(d.state::text) AS digest FROM ${workflow} w
     JOIN ${workflowDeploymentVersion} d ON d.workflow_id = w.id AND d.is_active = true
     WHERE w.workspace_id = ${sourceWorkspaceId} AND w.is_deployed = true
-      AND w.archived_at IS NULL AND w.id IN (${admittedIds})
+      AND w.archived_at IS NULL AND w.fork_sync_excluded = false
   `)
   if (
     rows.length !== expected.size ||
diff --git a/apps/sim/ee/workspace-forking/application/sync-default.test.ts b/apps/sim/ee/workspace-forking/application/sync-default.test.ts
index 953001acd26..5eb0b50df73 100644
--- a/apps/sim/ee/workspace-forking/application/sync-default.test.ts
+++ b/apps/sim/ee/workspace-forking/application/sync-default.test.ts
@@ -1,9 +1,10 @@
 /**
  * @vitest-environment node
  */
+import { workspace } from '@sim/db/schema'
 import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
 import { auditMock, auditMockFns } from '@sim/testing/mocks/audit.mock'
-import { dbChainMockFns, resetDbChainMock } from '@sim/testing/mocks/database.mock'
+import { dbChainMockFns, queueTableRows, resetDbChainMock } from '@sim/testing/mocks/database.mock'
 import { permissionsMock, permissionsMockFns } from '@sim/testing/mocks/permissions.mock'
 import { posthogServerMock } from '@sim/testing/mocks/posthog-server.mock'
 import {
@@ -12,12 +13,14 @@ import {
 } from '@sim/testing/mocks/workspace-authorization.mock'
 import { workspaceForkingAuthzMock } from '@sim/testing/mocks/workspace-forking-authz.mock'
 import { workspaceForkingLineageMock } from '@sim/testing/mocks/workspace-forking-lineage.mock'
+import {
+  workspaceForkingLineageRootMock,
+  workspaceForkingLineageRootMockFns,
+} from '@sim/testing/mocks/workspace-forking-lineage-root.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const hoisted = vi.hoisted(() => ({
-  resolveRootId: vi.fn(),
-  resolveLineage: vi.fn(),
-}))
+const { mockResolveForkLineageRootId, mockResolveForkLineageWorkspaceIds } =
+  workspaceForkingLineageRootMockFns
 
 vi.mock('@sim/audit', () => auditMock)
 vi.mock('@/lib/core/application/workspace-authorization', () => workspaceAuthorizationMock)
@@ -25,10 +28,7 @@ vi.mock('@/lib/workspaces/permissions/utils', () => permissionsMock)
 vi.mock('@/lib/posthog/server', () => posthogServerMock)
 vi.mock('@/ee/workspace-forking/lib/lineage/authz', () => workspaceForkingAuthzMock)
 vi.mock('@/ee/workspace-forking/lib/lineage/lineage', () => workspaceForkingLineageMock)
-vi.mock('@/ee/workspace-forking/lib/sync-default', () => ({
-  resolveForkLineageRootId: hoisted.resolveRootId,
-  resolveForkLineageWorkspaceIds: hoisted.resolveLineage,
-}))
+vi.mock('@/ee/workspace-forking/lib/lineage/lineage-root', () => workspaceForkingLineageRootMock)
 
 import { setForkSyncDefault } from '@/ee/workspace-forking/application/sync-default'
 
@@ -37,7 +37,6 @@ const LINEAGE = ['root-ws', 'fork-a', 'fork-b', 'grandchild']
 
 beforeEach(() => {
   resetDbChainMock()
-  vi.clearAllMocks()
   permissionsMockFns.mockGetWorkspaceWithOwner.mockResolvedValue({
     id: 'fork-a',
     name: 'Fork A',
@@ -45,11 +44,13 @@ beforeEach(() => {
     allowPersonalApiKeys: true,
   })
   workspaceAuthorizationMockFns.mockAuthorizeWorkspaceOperation.mockResolvedValue(undefined)
-  hoisted.resolveRootId.mockResolvedValue('root-ws')
-  hoisted.resolveLineage.mockResolvedValue(LINEAGE)
-  // The use case's `UPDATE ... RETURNING` over the global @sim/db mock: the rows it returns
-  // are the lineage members whose value actually changed, each with the name the audit
-  // entry is filed under.
+  mockResolveForkLineageRootId.mockResolvedValue('root-ws')
+  mockResolveForkLineageWorkspaceIds.mockResolvedValue(LINEAGE)
+  // The live-member row lock, then the `UPDATE ... RETURNING` of the members that changed.
+  queueTableRows(
+    workspace,
+    LINEAGE.map((id) => ({ id }))
+  )
   dbChainMockFns.returning.mockResolvedValue(LINEAGE.map((id) => ({ id, name: `Name of ${id}` })))
 })
 
@@ -60,18 +61,11 @@ const run = (excludeNewWorkflows: boolean) =>
   })
 
 describe('setForkSyncDefault', () => {
-  it('writes every lineage member when issued from a mid-lineage fork', async () => {
-    await expect(run(true)).resolves.toMatchObject({
-      excludeNewWorkflows: true,
-      changedWorkspaces: LINEAGE.map((id) => ({ id, name: `Name of ${id}` })),
-    })
-  })
-
   /**
    * One entry per member, because the default genuinely changed for all of them. A single
    * entry on the calling workspace would leave the other members' admins with no record.
    */
-  it('records one entry per CHANGED member, naming where the change was issued from', async () => {
+  it("files one audit entry per updated member, in that member's own workspace and name", async () => {
     await run(true)
     const audited = auditMockFns.mockRecordAudit.mock.calls.map(([entry]) => entry)
     expect(audited).toHaveLength(LINEAGE.length)
@@ -82,9 +76,7 @@ describe('setForkSyncDefault', () => {
       // defaults it to the caller's workspace, so every entry would pile into one log and
       // the other members' admins would see nothing.
       expect(entry.workspaceId).toBe(entry.resourceId)
-      // The member's OWN name, not a raw id and not the caller's name. A lineage-wide
-      // change that named only the calling workspace left every other member's audit
-      // entry reading as an opaque identifier.
+      // The member's OWN name, not a raw id and not the caller's name.
       expect(entry.resourceName).toBe(`Name of ${entry.resourceId}`)
       expect(entry.metadata).toMatchObject({
         forkSyncNewWorkflowsExcluded: true,
@@ -94,44 +86,9 @@ describe('setForkSyncDefault', () => {
     }
   })
 
-  /**
-   * `projectAudit` maps over `changedWorkspaces` and `afterSuccess` returns early when it
-   * is empty, so an empty result IS "no audit, no analytics". Asserting the result rather
-   * than the mocks' call counts keeps this pinned to the value the fan-out reads.
-   */
-  it('reports no changed members when the value already matched everywhere', async () => {
-    dbChainMockFns.returning.mockResolvedValue([])
-    await expect(run(true)).resolves.toMatchObject({ changedWorkspaces: [] })
-  })
-
-  /**
-   * The update only touches members whose value differs, so auditing the whole lineage
-   * would file a change record against a workspace that already held the requested value.
-   */
-  it('records nothing for a member that already held the requested value', async () => {
-    dbChainMockFns.returning.mockResolvedValue([{ id: 'fork-b', name: 'Fork B' }])
-    await expect(run(true)).resolves.toMatchObject({
-      changedWorkspaces: [{ id: 'fork-b', name: 'Fork B' }],
-    })
-    const audited = auditMockFns.mockRecordAudit.mock.calls.map(([entry]) => entry)
-    expect(audited.map((entry) => entry.resourceId)).toEqual(['fork-b'])
-  })
-
-  /**
-   * The fan-out reaches workspaces the caller may not administer, so the admission check
-   * is the only thing standing between a non-admin and a lineage-wide write. Assert it
-   * rejects rather than trusting that the wrapper was wired up.
-   */
-  it('rejects a caller who fails workspace admission', async () => {
-    workspaceAuthorizationMockFns.mockAuthorizeWorkspaceOperation.mockRejectedValue(
-      new Error('forbidden')
-    )
-    await expect(run(true)).rejects.toThrow('forbidden')
-  })
-
-  it('carries the chosen value through, so turning the default back on is symmetric', async () => {
-    await expect(run(false)).resolves.toMatchObject({ excludeNewWorkflows: false })
-    const [entry] = auditMockFns.mockRecordAudit.mock.calls[0]
-    expect(entry.metadata).toMatchObject({ forkSyncNewWorkflowsExcluded: false })
+  /** An unlink that moved the caller out of the locked root's lineage must not be written. */
+  it('refuses when the locked root no longer reaches the calling workspace', async () => {
+    mockResolveForkLineageWorkspaceIds.mockResolvedValue(['root-ws', 'fork-b'])
+    await expect(run(true)).rejects.toMatchObject({ statusCode: 409 })
   })
 })
diff --git a/apps/sim/ee/workspace-forking/application/sync-default.ts b/apps/sim/ee/workspace-forking/application/sync-default.ts
index 1b8ea739670..8c5592aa3ca 100644
--- a/apps/sim/ee/workspace-forking/application/sync-default.ts
+++ b/apps/sim/ee/workspace-forking/application/sync-default.ts
@@ -1,8 +1,7 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import { db } from '@sim/db'
 import { workspace } from '@sim/db/schema'
-import { compareStrings } from '@sim/utils/string'
-import { and, inArray, isNull, ne, sql } from 'drizzle-orm'
+import { and, asc, inArray, isNull, ne } from 'drizzle-orm'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { defineForkUseCase } from '@/ee/workspace-forking/application/authorized-fork-use-case'
 import { forkOperations } from '@/ee/workspace-forking/application/operations'
@@ -14,7 +13,7 @@ import {
 import {
   resolveForkLineageRootId,
   resolveForkLineageWorkspaceIds,
-} from '@/ee/workspace-forking/lib/sync-default'
+} from '@/ee/workspace-forking/lib/lineage/lineage-root'
 
 export interface SetForkSyncDefaultInput {
   workspaceId: string
@@ -50,98 +49,68 @@ export const setForkSyncDefault = defineForkUseCase<
 >({
   operation: forkOperations.syncDefault,
   async execute({ input }) {
+    // The root is the lock key, so it is resolved before the lock; membership is expanded under it.
+    const rootId = await resolveForkLineageRootId(db, input.workspaceId)
     return db.transaction(async (tx) => {
       await setForkLockTimeout(tx)
-      const rootId = await resolveForkLineageRootId(tx, input.workspaceId)
-      // Rank 2, and the only fork lock this transaction takes before its rank-6 row
-      // locks - see the rank table on `acquireForkLineageLock`.
+      // Rank 2 - see the rank table on `acquireForkLineageLock`.
       await acquireForkLineageLock(tx, rootId)
-      // Re-resolve under the lock and refuse if the root moved. An unlink committing
-      // between the read and the lock would leave us holding the OLD lineage's key while
-      // writing the new one's members, so a second write rooted at the new lineage could
-      // run concurrently over the same rows. Mirrors the organization re-check `createFork`
-      // performs under its own lock.
-      if ((await resolveForkLineageRootId(tx, input.workspaceId)) !== rootId) {
+      // Expanded under the lock, so a fork created a moment ago is included and one being
+      // created now waits on the same key. A root that no longer reaches the caller means an
+      // unlink moved it before we locked, and this key no longer covers its lineage.
+      const lineageWorkspaceIds = await resolveForkLineageWorkspaceIds(tx, rootId)
+      if (!lineageWorkspaceIds.includes(input.workspaceId)) {
         throw new ForkError(
           'The fork lineage changed while this request was being applied. Try again.',
           409
         )
       }
-      // Resolve the membership AFTER the lock: a fork created a moment ago must be
-      // included, and one being created right now is blocked on the same key.
-      const lineageWorkspaceIds = await resolveForkLineageWorkspaceIds(tx, input.workspaceId)
-      if (lineageWorkspaceIds.length === 0) {
+      // Rank 6: lock the live members whose value differs, in id order, since a multi-row
+      // UPDATE locks in plan order and could deadlock against other multi-workspace writers.
+      // NO KEY UPDATE keeps FK inserts into these workspaces (KEY SHARE) from queueing behind
+      // the write. Nothing else writes this column under the lineage lock, so the filter holds.
+      const toChange = await tx
+        .select({ id: workspace.id })
+        .from(workspace)
+        .where(
+          and(
+            inArray(workspace.id, lineageWorkspaceIds),
+            isNull(workspace.archivedAt),
+            ne(workspace.forkSyncNewWorkflowsExcluded, input.excludeNewWorkflows)
+          )
+        )
+        .orderBy(asc(workspace.id))
+        .for('no key update')
+      if (toChange.length === 0) {
         return { excludeNewWorkflows: input.excludeNewWorkflows, changedWorkspaces: [] }
       }
-      // Rank 6: take the member row locks in sorted id order BEFORE the update. A bare
-      // multi-row `UPDATE ... WHERE id IN (...)` acquires its row locks in whatever order
-      // the plan produces, so it is unordered against any other multi-workspace writer
-      // that takes no lineage lock - `lockWorkspaceRowsForPayerChanges` on the
-      // organization-attach path is one today. `revision.ts` locks this same table with an
-      // explicit `ORDER BY id FOR UPDATE` for exactly this reason; Drizzle's
-      // `.update().where(inArray(...))` cannot express ORDER BY, so this is the same
-      // lock-then-update shape.
-      const memberIds = sql.join(
-        [...lineageWorkspaceIds].sort(compareStrings).map((id) => sql`${id}`),
-        sql`, `
-      )
-      await tx.execute(
-        sql`SELECT id FROM ${workspace} WHERE id IN (${memberIds}) ORDER BY id FOR UPDATE`
-      )
       const changed = await tx
         .update(workspace)
         .set({ forkSyncNewWorkflowsExcluded: input.excludeNewWorkflows, updatedAt: new Date() })
         .where(
-          and(
-            inArray(workspace.id, lineageWorkspaceIds),
-            // Re-assert liveness at write time: `resolveForkLineageWorkspaceIds` filtered
-            // archived members when it read, but a workspace can be archived between that
-            // read and this update, and a policy write must never touch one.
-            isNull(workspace.archivedAt),
-            ne(workspace.forkSyncNewWorkflowsExcluded, input.excludeNewWorkflows)
+          inArray(
+            workspace.id,
+            toChange.map((member) => member.id)
           )
         )
-        // Return the NAME too, so the audit fan-out can identify each member the way a
-        // reader knows it. Projecting a bare id as `resourceName` made every entry but the
-        // caller's read as a raw identifier in the audit log.
         .returning({ id: workspace.id, name: workspace.name })
-      return {
-        excludeNewWorkflows: input.excludeNewWorkflows,
-        // The members whose value ACTUALLY changed, not every member considered. Auditing
-        // the whole lineage would file a change record against a workspace that already
-        // held the requested value, making its history claim something that did not happen.
-        changedWorkspaces: changed,
-      }
+      return { excludeNewWorkflows: input.excludeNewWorkflows, changedWorkspaces: changed }
     })
   },
-  /**
-   * One entry per workspace whose value actually changed. Every such member gets its own
-   * record, because the default genuinely moved for each of them and a single entry on the
-   * calling workspace would leave the others' admins with no trace. A member that already
-   * held the requested value gets nothing - it did not change.
-   */
+  /** One entry per member whose value changed, so every affected workspace's admins see it. */
   projectAudit: ({ input, context, result }) =>
     result.changedWorkspaces.map((member) => ({
       action: AuditAction.WORKSPACE_FORK_SYNC_DEFAULT_CHANGED,
-      // File each entry in the workspace it describes, not the caller's. The audit
-      // wrapper defaults `workspaceId` to the initiating workspace, which would land
-      // every entry in one log and leave the other members' admins with no record of
-      // their own workspace changing - the exact gap this per-member fan-out exists
-      // to close.
+      // The audit wrapper defaults `workspaceId` to the caller; file each entry in its own workspace.
       workspaceId: member.id,
       resourceType: AuditResourceType.WORKSPACE,
       resourceId: member.id,
-      // The member's own name, read back from the UPDATE. Falling back to the id for
-      // every member but the caller made a lineage-wide change read as one named
-      // workspace and N opaque identifiers.
       resourceName: member.name,
       description: input.excludeNewWorkflows
         ? 'New workflows no longer sync to forks by default'
         : 'New workflows sync to forks by default',
       metadata: {
         forkSyncNewWorkflowsExcluded: input.excludeNewWorkflows,
-        // Which workspace in the lineage the admin changed it from, so a member's own
-        // log explains why its behaviour moved without an action taken on it.
         originWorkspaceId: context.workspace.id,
         originWorkspaceName: context.workspace.name,
         workspacesChanged: result.changedWorkspaces.length,
diff --git a/apps/sim/ee/workspace-forking/components/fork-sync-default-toggle/fork-sync-default-toggle.tsx b/apps/sim/ee/workspace-forking/components/fork-sync-default-toggle/fork-sync-default-toggle.tsx
index 7e3fa15cf97..f2f86ca30b9 100644
--- a/apps/sim/ee/workspace-forking/components/fork-sync-default-toggle/fork-sync-default-toggle.tsx
+++ b/apps/sim/ee/workspace-forking/components/fork-sync-default-toggle/fork-sync-default-toggle.tsx
@@ -14,48 +14,25 @@ interface ForkSyncDefaultToggleProps {
   workspaceId: string
   /** The lineage's stored policy: true means new workflows start outside fork sync. */
   excludeNewWorkflows: boolean
-  /**
-   * True while the value on screen is not this workspace's own. Covers the first load AND
-   * the placeholder window after a workspace switch: `useForkLineage` sets
-   * `placeholderData: keepPreviousData`, so it serves the PREVIOUS workspace's policy with
-   * `isLoading: false`. Rendering then would show one workspace's value under another's
-   * name, and a click would write that stale value to the newly selected lineage.
-   */
-  loading: boolean
 }
 
 /**
  * Whether a newly created workflow in this lineage joins fork sync automatically.
  *
- * Positive polarity, matching the checkbox list below it - on means new workflows sync,
- * which is the historical default. The stored column is the negative
- * `forkSyncNewWorkflowsExcluded`, so this component owns that inversion.
- *
- * The description is not decoration: this writes to every workspace in the lineage, and
- * without it the control reads as a local preference. That is the "prevents a
- * misunderstanding" case `sim-ui-copy.md` reserves supporting copy for.
- *
- * Forward-only - no existing workflow's checkbox moves, so flipping it can never silently
- * pull a workflow into or out of sync.
+ * Positive polarity, matching the checkbox list below it; this component owns the inversion
+ * from the stored `forkSyncNewWorkflowsExcluded`. The write reaches every workspace in the
+ * lineage and is forward-only: no existing workflow moves.
  */
 export function ForkSyncDefaultToggle({
   workspaceId,
   excludeNewWorkflows,
-  loading,
 }: ForkSyncDefaultToggleProps) {
   const updateDefault = useUpdateForkSyncDefault()
 
-  // Render nothing until the lineage resolves, matching the workflow list below. A
-  // placeholder would have to guess a value, and guessing `false` selects "Sync" - the
-  // opposite of the truth for an opt-in lineage, which then visibly snaps once the real
-  // value lands. Disabled-but-wrong is worse than absent for a cross-workspace policy.
-  if (loading) return null
-
   return (
     <div className='flex items-center justify-between'>
       <div className='flex flex-col gap-1'>
-        {/* No `htmlFor`: `ChipSwitch` is a radio group and takes no id, so the group
-            carries its own `aria-label`. Matches `inbox-enable-toggle.tsx`. */}
+        {/* No `htmlFor`: `ChipSwitch` is a radio group that takes no id; it carries its own `aria-label`. */}
         <Label>Sync new workflows by default</Label>
         <p className='text-[var(--text-muted)] text-caption'>
           Applies to every workspace in this fork lineage.
diff --git a/apps/sim/ee/workspace-forking/components/fork-synced-workflows/fork-synced-workflows.test.ts b/apps/sim/ee/workspace-forking/components/fork-synced-workflows/fork-synced-workflows.test.ts
deleted file mode 100644
index 6e75b29b2c1..00000000000
--- a/apps/sim/ee/workspace-forking/components/fork-synced-workflows/fork-synced-workflows.test.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { buildForkSyncWorkflowTree } from '@/ee/workspace-forking/components/fork-synced-workflows/fork-synced-workflows'
-
-const wf = (over: Record<string, unknown>) => ({
-  id: 'w',
-  name: 'W',
-  isDeployed: true,
-  archivedAt: null,
-  folderId: null,
-  forkSyncExcluded: false,
-  ...over,
-})
-
-describe('buildForkSyncWorkflowTree', () => {
-  it('lists only deployed, non-archived workflows — the only ones that sync', () => {
-    const tree = buildForkSyncWorkflowTree(
-      [
-        wf({ id: 'live', name: 'Live' }),
-        wf({ id: 'draft', name: 'Draft', isDeployed: false }),
-        wf({ id: 'gone', name: 'Gone', archivedAt: new Date() }),
-      ] as never,
-      []
-    )
-    expect(tree.rootWorkflows.map((w) => w.id)).toEqual(['live'])
-  })
-
-  it('falls a workflow whose folder was deleted back to root so it stays selectable', () => {
-    const tree = buildForkSyncWorkflowTree([wf({ id: 'orphan', folderId: 'missing' })] as never, [])
-    expect(tree.rootWorkflows.map((w) => w.id)).toEqual(['orphan'])
-  })
-
-  it('prunes folders with no deployed workflows anywhere beneath them', () => {
-    const folders = [
-      { id: 'f-empty', name: 'Empty', parentId: null, sortOrder: 0 },
-      { id: 'f-full', name: 'Full', parentId: null, sortOrder: 1 },
-    ]
-    const tree = buildForkSyncWorkflowTree(
-      [wf({ id: 'a', folderId: 'f-full' })] as never,
-      folders as never
-    )
-    expect(tree.folders.map((f) => f.id)).toEqual(['f-full'])
-  })
-
-  /**
-   * The folder-level select-all writes this list verbatim, so a subtree that misses a
-   * nested workflow silently leaves it out of a "sync all in this folder" click.
-   */
-  it('collects nested descendants into the parent folder select-all list', () => {
-    const folders = [
-      { id: 'parent', name: 'Parent', parentId: null, sortOrder: 0 },
-      { id: 'child', name: 'Child', parentId: 'parent', sortOrder: 0 },
-    ]
-    const tree = buildForkSyncWorkflowTree(
-      [wf({ id: 'top', folderId: 'parent' }), wf({ id: 'nested', folderId: 'child' })] as never,
-      folders as never
-    )
-    expect([...tree.folders[0].descendantWorkflowIds].sort()).toEqual(['nested', 'top'])
-  })
-})
diff --git a/apps/sim/ee/workspace-forking/components/fork-synced-workflows/fork-synced-workflows.tsx b/apps/sim/ee/workspace-forking/components/fork-synced-workflows/fork-synced-workflows.tsx
index b6014a11c5b..f7a03674c28 100644
--- a/apps/sim/ee/workspace-forking/components/fork-synced-workflows/fork-synced-workflows.tsx
+++ b/apps/sim/ee/workspace-forking/components/fork-synced-workflows/fork-synced-workflows.tsx
@@ -1,7 +1,8 @@
 'use client'
 
 import { useId, useMemo, useState } from 'react'
-import { Checkbox, ChevronDown, cn, OverflowText, toast } from '@sim/emcn'
+import { Checkbox, cn, OverflowText, toast } from '@sim/emcn'
+import { ChevronDown } from '@sim/emcn/icons'
 import { getErrorMessage } from '@sim/utils/errors'
 import { SettingsEmptyState } from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
 import { useUpdateForkSyncedWorkflows } from '@/ee/workspace-forking/hooks/workspace-fork'
@@ -36,7 +37,7 @@ interface SyncTreeFolder {
  * a workflow whose folder was deleted falls into the root bucket so it stays selectable.
  * Folders sort like the sidebar (sortOrder, then name); workflows keep the list order.
  */
-export function buildForkSyncWorkflowTree(
+function buildForkSyncWorkflowTree(
   workflows: WorkflowMetadata[],
   folders: WorkflowFolder[]
 ): { folders: SyncTreeFolder[]; rootWorkflows: SyncWorkflowItem[] } {
@@ -136,12 +137,8 @@ export function ForkSyncedWorkflows({ workspaceId }: ForkSyncedWorkflowsProps) {
     )
   }
 
-  // `useWorkflows` and `useFolders` both set `placeholderData: keepPreviousData`, so during
-  // a workspace switch they serve the PREVIOUS workspace's rows with `isLoading: false`.
-  // Gating on loading alone rendered workspace A's workflows under workspace B's id, and a
-  // click then posted A's workflow ids against B. `sim-react-performance.md`: "Never carry
-  // placeholder data between protected resource keys ... an explicit loading state is
-  // truthful." Matches `custom-tools.tsx` and `integration-skills-section.tsx`.
+  // Both queries keep the previous workspace's rows as placeholder data on a switch;
+  // rendering them would post workspace A's workflow ids against workspace B.
   const isLoading =
     workflowsQuery.isPending ||
     workflowsQuery.isPlaceholderData ||
@@ -149,6 +146,14 @@ export function ForkSyncedWorkflows({ workspaceId }: ForkSyncedWorkflowsProps) {
     foldersQuery.isPlaceholderData
   if (isLoading) return null
 
+  if (workflowsQuery.isError || foldersQuery.isError) {
+    return (
+      <SettingsEmptyState variant='inline'>
+        {getErrorMessage(workflowsQuery.error ?? foldersQuery.error, 'Failed to load workflows')}
+      </SettingsEmptyState>
+    )
+  }
+
   if (tree.folders.length === 0 && tree.rootWorkflows.length === 0) {
     return (
       <SettingsEmptyState variant='inline'>
@@ -196,11 +201,15 @@ function SyncFolderRow({ folder, level, syncedIds, onToggle, disabled }: SyncFol
   const total = folder.descendantWorkflowIds.length
   const selectedCount = folder.descendantWorkflowIds.filter((id) => syncedIds.has(id)).length
   const headerState = selectedCount === 0 ? false : selectedCount === total ? true : 'indeterminate'
+  const countLabel = selectedCount > 0 ? `${selectedCount}/${total}` : String(total)
 
   return (
     <div className='flex flex-col gap-0.5'>
       <div
-        className='flex min-w-0 items-center gap-2 py-0.5 text-[var(--text-body)] text-sm'
+        className={cn(
+          'flex min-w-0 items-center gap-2 py-0.5 text-[var(--text-body)] text-sm',
+          disabled && 'opacity-60'
+        )}
         style={{ paddingLeft: `${level * INDENT_PER_LEVEL}px` }}
       >
         <Checkbox
@@ -212,16 +221,12 @@ function SyncFolderRow({ folder, level, syncedIds, onToggle, disabled }: SyncFol
         />
         <button
           type='button'
+          aria-expanded={expanded}
           className='flex min-w-0 items-center gap-1.5 text-left hover:text-[var(--text-primary)]'
           onClick={() => setExpanded((value) => !value)}
         >
-          <OverflowText
-            label={`${folder.name} (${selectedCount > 0 ? `${selectedCount}/${total}` : total})`}
-          >
-            {folder.name}{' '}
-            <span className='text-[var(--text-muted)]'>
-              ({selectedCount > 0 ? `${selectedCount}/${total}` : total})
-            </span>
+          <OverflowText label={`${folder.name} (${countLabel})`}>
+            {folder.name} <span className='text-[var(--text-muted)]'>({countLabel})</span>
           </OverflowText>
           <ChevronDown
             className={cn(
diff --git a/apps/sim/ee/workspace-forking/components/forks.tsx b/apps/sim/ee/workspace-forking/components/forks.tsx
index a71d345bc5a..b25486dde76 100644
--- a/apps/sim/ee/workspace-forking/components/forks.tsx
+++ b/apps/sim/ee/workspace-forking/components/forks.tsx
@@ -549,11 +549,14 @@ export function Forks() {
               </SettingsSection>
               <SettingsSection label='Synced workflows'>
                 <div className='flex flex-col gap-4'>
-                  <ForkSyncDefaultToggle
-                    workspaceId={workspaceId}
-                    excludeNewWorkflows={lineage.data?.forkSyncNewWorkflowsExcluded ?? false}
-                    loading={lineage.isLoading || lineage.isPlaceholderData}
-                  />
+                  {/* Only this workspace's own value: a placeholder from the previous workspace
+                      would show, and on click write, another lineage's policy. */}
+                  {lineage.data && !lineage.isPlaceholderData ? (
+                    <ForkSyncDefaultToggle
+                      workspaceId={workspaceId}
+                      excludeNewWorkflows={lineage.data.forkSyncNewWorkflowsExcluded}
+                    />
+                  ) : null}
                   <ForkSyncedWorkflows workspaceId={workspaceId} />
                 </div>
               </SettingsSection>
diff --git a/apps/sim/ee/workspace-forking/hooks/workspace-fork.ts b/apps/sim/ee/workspace-forking/hooks/workspace-fork.ts
index 40017c8c5d3..21e5acda94b 100644
--- a/apps/sim/ee/workspace-forking/hooks/workspace-fork.ts
+++ b/apps/sim/ee/workspace-forking/hooks/workspace-fork.ts
@@ -290,12 +290,11 @@ export function useUpdateForkSyncDefault() {
         queryClient.setQueryData(forkKeys.lineage(vars.workspaceId), context.snapshot)
       }
     },
-    onSettled: (_data, _error, vars) => {
-      // Every lineage member's value moved, so refresh all cached lineages rather than
-      // just this workspace's. The fork modal's preflight counts are unaffected (the
-      // policy governs future workflows only), but its copy set is read per-open anyway.
+    onSettled: () => {
+      // Every lineage member's value moved, so refresh all cached lineages, not just this one,
+      // and every sync preview: each one fingerprints the workspace rows this just rewrote.
       queryClient.invalidateQueries({ queryKey: forkKeys.lineages() })
-      queryClient.invalidateQueries({ queryKey: forkKeys.resources(vars.workspaceId) })
+      queryClient.invalidateQueries({ queryKey: forkKeys.diffs() })
     },
   })
 }
diff --git a/apps/sim/ee/workspace-forking/lib/copy/copy-workflows.test.ts b/apps/sim/ee/workspace-forking/lib/copy/copy-workflows.test.ts
index 997a3eeb5f4..00052299e3e 100644
--- a/apps/sim/ee/workspace-forking/lib/copy/copy-workflows.test.ts
+++ b/apps/sim/ee/workspace-forking/lib/copy/copy-workflows.test.ts
@@ -653,57 +653,3 @@ describe('copyWorkflowStateIntoTarget custom-block remap', () => {
     expect(subBlocks.text?.value).toBe('true')
   })
 })
-
-describe('copyWorkflowStateIntoTarget fork-sync inheritance', () => {
-  const sourceState = {
-    blocks: {},
-    edges: [],
-    loops: {},
-    parallels: {},
-    variables: {},
-  } as never
-
-  /** `create` mode inserts the target row; capture exactly what it writes. */
-  function stubCreateTx(captured: Record<string, unknown>[]) {
-    return {
-      insert: () => ({
-        values: (row: Record<string, unknown>) => {
-          captured.push(row)
-          return Promise.resolve()
-        },
-      }),
-    } as unknown as DbOrTx
-  }
-
-  const createParams = (forkSyncExcluded: boolean) => ({
-    targetWorkflowId: 'wf-new',
-    targetWorkspaceId: 'ws-target',
-    userId: 'target-user',
-    mode: 'create' as const,
-    now: new Date('2026-07-01'),
-    sourceState,
-    sourceMeta: {
-      name: 'Prod',
-      description: null,
-      folderId: null,
-      sortOrder: 0,
-      forkSyncExcluded,
-    },
-    workflowIdMap: new Map(),
-    folderIdMap: new Map(),
-    nameRegistry: buildWorkflowNameRegistry([]),
-    resolveBlockId: (_targetWorkflowId: string, sourceBlockId: string) => `tgt-${sourceBlockId}`,
-  })
-
-  /**
-   * The regression the whole opt-in feature hinges on. A copy is not a new workflow, so it
-   * must never take the TARGET workspace's new-workflow default. In an opt-out lineage that
-   * default is "excluded", so taking it here would land a deliberately synced workflow's
-   * copy already excluded, and sync would never update it again.
-   */
-  it('writes a synced copy rather than taking the target workspace default', async () => {
-    const rows: Record<string, unknown>[] = []
-    await copyWorkflowStateIntoTarget({ ...createParams(false), tx: stubCreateTx(rows) } as never)
-    expect(rows[0].forkSyncExcluded).toBe(false)
-  })
-})
diff --git a/apps/sim/ee/workspace-forking/lib/copy/copy-workflows.ts b/apps/sim/ee/workspace-forking/lib/copy/copy-workflows.ts
index 26747e82e85..847f2ec2984 100644
--- a/apps/sim/ee/workspace-forking/lib/copy/copy-workflows.ts
+++ b/apps/sim/ee/workspace-forking/lib/copy/copy-workflows.ts
@@ -211,8 +211,7 @@ export async function resolveForkFolderMapping({
      * makes it atomic differs by caller: `promoteFork` holds `fork-target` and `fork-edge`,
      * which serializes it against every other promote into the same target. `createFork`
      * holds neither - it does not need to, because the target workspace is being created in
-     * this same transaction and nothing else can reach it yet. (An earlier revision of this
-     * comment asserted the `fork-target` lock for both, which was true of only one.)
+     * this same transaction and nothing else can reach it yet.
      *
      * It does NOT take the folder mutation lock in either case: that helper resets the
      * transaction's `lock_timeout`, which the fork sets deliberately, so an ordinary
@@ -419,18 +418,6 @@ export interface CopyWorkflowStateParams {
      * the child starts undeployed and private (going public is an explicit act there).
      */
     isPublicApi?: boolean
-    /**
-     * The source's own fork-sync participation, inherited verbatim by the copy. A copied
-     * workflow is the same logical workflow in another workspace, so it must NOT take the
-     * target workspace's new-workflow default: in an opt-in workspace that would land an
-     * explicitly-selected source's copy already excluded, and sync would never update it
-     * again.
-     *
-     * Required, not optional: a caller that forgot it would silently ATTACH the copy to
-     * sync via the column default, with no UI or audit signal. The type system carries
-     * that, not a comment.
-     */
-    forkSyncExcluded: boolean
   }
   /** source workflow id -> target workflow id, for `workflow-selector` references */
   workflowIdMap: Map<string, string>
@@ -739,7 +726,9 @@ export async function copyWorkflowStateIntoTarget(
       // Deployment visibility follows the source on sync (a public source stays public in
       // the target); fork-create omits the field, so the child starts private.
       ...(sourceMeta.isPublicApi !== undefined ? { isPublicApi: sourceMeta.isPublicApi } : {}),
-      forkSyncExcluded: sourceMeta.forkSyncExcluded,
+      // A copy never takes the target's new-workflow default: `listDeployedWorkflows` admits
+      // only synced sources, so the copy is synced too.
+      forkSyncExcluded: false,
     })
   } else {
     await tx
diff --git a/apps/sim/ee/workspace-forking/lib/create-fork.test.ts b/apps/sim/ee/workspace-forking/lib/create-fork.test.ts
index 7f69ba1f00b..648815617f7 100644
--- a/apps/sim/ee/workspace-forking/lib/create-fork.test.ts
+++ b/apps/sim/ee/workspace-forking/lib/create-fork.test.ts
@@ -5,6 +5,7 @@ import {
   workspaceForkingLineageMock,
   workspaceForkingLineageMockFns,
 } from '@sim/testing/mocks/workspace-forking-lineage.mock'
+import { workspaceForkingLineageRootMock } from '@sim/testing/mocks/workspace-forking-lineage-root.mock'
 import {
   workspaceForkingMappingStoreMock,
   workspaceForkingMappingStoreMockFns,
@@ -22,7 +23,6 @@ const {
   mockFinishBackgroundWork,
   mockScheduleForkContentCopy,
   mockCollectReferencedFileFolderPaths,
-  mockResolveForkSyncExclusionForNewWorkflow,
   mockLockForkRevision,
 } = vi.hoisted(() => ({
   mockSumForkCopyBytes: vi.fn(),
@@ -34,8 +34,6 @@ const {
   mockFinishBackgroundWork: vi.fn(),
   mockScheduleForkContentCopy: vi.fn(),
   mockCollectReferencedFileFolderPaths: vi.fn(() => new Set<string>()),
-  // Historical opt-out default unless a test opts the lineage in.
-  mockResolveForkSyncExclusionForNewWorkflow: vi.fn(async () => false),
   mockLockForkRevision: vi.fn(async () => {}),
 }))
 
@@ -90,11 +88,7 @@ vi.mock('@/lib/workspaces/operations/receipts', () => ({
   insertWorkspaceOperationReceipt: vi.fn(async () => {}),
   lockWorkspaceOperationRequest: vi.fn(async () => {}),
 }))
-vi.mock('@/ee/workspace-forking/lib/sync-default', () => ({
-  // The lineage root is resolved before the fork tx; a standalone source is its own root.
-  resolveForkLineageRootId: vi.fn(async (_executor: unknown, workspaceId: string) => workspaceId),
-  resolveForkSyncExclusionForNewWorkflow: mockResolveForkSyncExclusionForNewWorkflow,
-}))
+vi.mock('@/ee/workspace-forking/lib/lineage/lineage-root', () => workspaceForkingLineageRootMock)
 vi.mock('@/ee/workspace-forking/lib/mapping/block-map-store', () => ({
   reconcileForkBlockPairs: vi.fn(),
   toForkBlockPairs: vi.fn(() => []),
@@ -239,7 +233,8 @@ describe('createFork storage headroom gate', () => {
    * would disagree with its parent from the moment it exists.
    */
   it('gives the child the source workspace personal API-key and fork-sync policies', async () => {
-    mockResolveForkSyncExclusionForNewWorkflow.mockResolvedValue(true)
+    resetDbChainMock()
+    queueTableRows(workspace, [{ organizationId: null, forkSyncNewWorkflowsExcluded: true }])
 
     const result = await createFork(forkParams())
 
diff --git a/apps/sim/ee/workspace-forking/lib/create-fork.ts b/apps/sim/ee/workspace-forking/lib/create-fork.ts
index f117239aa2e..8b8a06bbb77 100644
--- a/apps/sim/ee/workspace-forking/lib/create-fork.ts
+++ b/apps/sim/ee/workspace-forking/lib/create-fork.ts
@@ -8,6 +8,7 @@ import { and, eq } from 'drizzle-orm'
 import type { Workspace } from '@/lib/api/contracts/workspaces'
 import { enqueueOutboxEvent } from '@/lib/core/outbox/service'
 import { buildDefaultWorkflowArtifacts } from '@/lib/workflows/defaults'
+import { buildNewWorkflowRow } from '@/lib/workflows/persistence/new-workflow-row'
 import { saveWorkflowToNormalizedTables } from '@/lib/workflows/persistence/utils'
 import {
   collectReferencedDocumentIds,
@@ -63,6 +64,7 @@ import {
   acquireForkLineageLock,
   setForkLockTimeout,
 } from '@/ee/workspace-forking/lib/lineage/lineage'
+import { resolveForkLineageRootId } from '@/ee/workspace-forking/lib/lineage/lineage-root'
 import {
   type ForkBlockPair,
   reconcileForkBlockPairs,
@@ -75,10 +77,6 @@ import {
 } from '@/ee/workspace-forking/lib/mapping/mapping-store'
 import { deriveForkBlockId } from '@/ee/workspace-forking/lib/remap/block-identity'
 import { createForkBootstrapTransform } from '@/ee/workspace-forking/lib/remap/fork-bootstrap'
-import {
-  resolveForkLineageRootId,
-  resolveForkSyncExclusionForNewWorkflow,
-} from '@/ee/workspace-forking/lib/sync-default'
 
 const logger = createLogger('WorkspaceForkCreate')
 
@@ -174,9 +172,7 @@ export async function createFork(params: CreateForkParams): Promise<CreateForkRe
     bytes: copyBytes,
   })
 
-  // Resolved out here for the same reason as the deployed-state reads below: the lineage
-  // walk is several round trips, and issuing them from inside the fork tx would hold that
-  // connection while checking out more.
+  // The root is the lineage lock key, so it is resolved first and re-checked under the lock.
   const lineageRootId = await resolveForkLineageRootId(db, source.id)
 
   // Read the source's deployed workflows + states BEFORE the transaction so these
@@ -221,28 +217,14 @@ export async function createFork(params: CreateForkParams): Promise<CreateForkRe
         admission.requestId,
         admission.requestHash
       )
-      // Returned BEFORE the lineage lock: replaying a completed fork copies nothing, so
-      // making it queue behind an in-flight fork of the same lineage would let an
-      // idempotent retry fail on the lock timeout instead of serving its receipt. The
-      // request key is per-request and nothing takes lineage-then-request, so returning
-      // from here holds no lock out of rank order.
+      // Replay before the lineage lock, so an idempotent retry never waits on it.
       if (receipt?.forkResult) return { replay: receipt }
     }
-    // Rank 2, and it MUST precede `lockForkRevision` (rank 5) below: that helper takes
-    // `FOR UPDATE` on the source `workspace` row, which `unlinkForkEdge` updates while
-    // holding this same lineage key. Acquiring it after would close the cycle
-    // (fork: workspace row -> lineage; unlink: lineage -> workspace row) and deadlock.
-    // See the rank table on `acquireForkLineageLock`.
-    //
-    // It is also what makes the child's inherited new-workflow fork-sync default correct:
-    // `setForkSyncDefault` fans that value out across the lineage under this same key, so
-    // a fork created mid-change cannot inherit a stale default.
-    await acquireForkLineageLock(tx, lineageRootId)
-    // The root was resolved before this transaction, so an unlink committing in between
-    // would leave us holding the OLD lineage's key while inserting into the new one - a
-    // concurrent policy write rooted at the new lineage could then miss this child
-    // entirely. Re-check under the lock and refuse if it moved, exactly as
-    // `setForkSyncDefault` does. The caller retries against the new lineage.
+    // Rank 2, before `lockForkRevision` (rank 5) - see the rank table on
+    // `acquireForkLineageLock`. Shared: other forks of this lineage proceed, while
+    // `setForkSyncDefault` and unlink wait, so the child cannot inherit a stale default.
+    await acquireForkLineageLock(tx, lineageRootId, { shared: true })
+    // The root was resolved before this transaction; refuse if an unlink moved it since.
     if ((await resolveForkLineageRootId(tx, source.id)) !== lineageRootId) {
       throw new ForkError(
         'The source workspace changed fork lineage while this fork was being created. Try again.',
@@ -264,7 +246,10 @@ export async function createFork(params: CreateForkParams): Promise<CreateForkRe
      * organization.
      */
     const [currentSource] = await tx
-      .select({ organizationId: workspace.organizationId })
+      .select({
+        organizationId: workspace.organizationId,
+        forkSyncNewWorkflowsExcluded: workspace.forkSyncNewWorkflowsExcluded,
+      })
       .from(workspace)
       .where(eq(workspace.id, source.id))
       /**
@@ -311,12 +296,6 @@ export async function createFork(params: CreateForkParams): Promise<CreateForkRe
 
     const now = new Date()
 
-    // The new-workflow fork-sync policy is uniform across a lineage, so the child
-    // inherits the source's value at creation (like `allowPersonalApiKeys` below).
-    // Read here rather than off `source` so the widely-consumed `WorkspaceWithOwner`
-    // does not have to carry a field only fork code reads.
-    const forkSyncNewWorkflowsExcluded = await resolveForkSyncExclusionForNewWorkflow(tx, source.id)
-
     await tx.insert(workspace).values({
       id: childWorkspaceId,
       name: childName,
@@ -325,7 +304,8 @@ export async function createFork(params: CreateForkParams): Promise<CreateForkRe
       workspaceMode: policy.workspaceMode,
       billedAccountUserId: policy.billedAccountUserId,
       allowPersonalApiKeys: source.allowPersonalApiKeys,
-      forkSyncNewWorkflowsExcluded,
+      // Lineage-uniform, so the child inherits the value read under the source row lock.
+      forkSyncNewWorkflowsExcluded: currentSource.forkSyncNewWorkflowsExcluded,
       forkedFromWorkspaceId: source.id,
       createdAt: now,
       updatedAt: now,
@@ -472,11 +452,6 @@ export async function createFork(params: CreateForkParams): Promise<CreateForkRe
           description: wf.description,
           folderId: wf.folderId,
           sortOrder: wf.sortOrder,
-          // A copy, not a new workflow, so it must not take the child's new-workflow
-          // default. `listDeployedWorkflows` admits only synced sources, so a copy is
-          // synced too - stated here rather than read back from a projection the source
-          // query has already pinned to false.
-          forkSyncExcluded: false,
         },
         workflowIdMap,
         folderIdMap,
@@ -527,22 +502,17 @@ export async function createFork(params: CreateForkParams): Promise<CreateForkRe
     // starter "New workspace" creates. Any copied resources still land alongside it.
     if (workflowsCopied === 0) {
       const defaultWorkflowId = generateId()
-      await tx.insert(workflow).values({
-        id: defaultWorkflowId,
-        userId,
-        workspaceId: childWorkspaceId,
-        folderId: null,
-        name: 'default-agent',
-        description: 'Your first workflow - start building here!',
-        lastSynced: now,
-        createdAt: now,
-        updatedAt: now,
-        isDeployed: false,
-        runCount: 0,
-        variables: {},
-        // A genuinely new workflow, not a copy, so it takes the child's inherited policy.
-        forkSyncExcluded: forkSyncNewWorkflowsExcluded,
-      })
+      await tx.insert(workflow).values(
+        await buildNewWorkflowRow(tx, {
+          id: defaultWorkflowId,
+          userId,
+          workspaceId: childWorkspaceId,
+          folderId: null,
+          name: 'default-agent',
+          description: 'Your first workflow - start building here!',
+          now,
+        })
+      )
       const { workflowState } = buildDefaultWorkflowArtifacts()
       await saveWorkflowToNormalizedTables(
         defaultWorkflowId,
diff --git a/apps/sim/ee/workspace-forking/lib/lineage/fork-lock-order.integration.ts b/apps/sim/ee/workspace-forking/lib/lineage/fork-lock-order.integration.ts
index 46900248924..d35ea595c0f 100644
--- a/apps/sim/ee/workspace-forking/lib/lineage/fork-lock-order.integration.ts
+++ b/apps/sim/ee/workspace-forking/lib/lineage/fork-lock-order.integration.ts
@@ -3,11 +3,10 @@
  *
  * Proves the fork module's lock ORDER is acyclic, against real Postgres deadlock detection.
  *
- * The cycle this guards: `createFork` used to take `lockForkRevision` (which holds
- * `FOR UPDATE` on the source `workspace` row) BEFORE `acquireForkLineageLock`, while
- * `unlinkForkEdge` takes the lineage lock and then UPDATEs that same row. Two reviewers
- * reported it independently and no unit test could see it - only two real sessions racing
- * on a real server can.
+ * The cycle this guards: taking `lockForkRevision` (which holds `FOR UPDATE` on the source
+ * `workspace` row) BEFORE the shared lineage lock in `createFork`, while `unlinkForkEdge`
+ * takes the lineage lock exclusively and then UPDATEs that same row. Only two real sessions
+ * racing on a real server can observe it.
  *
  * Both sessions drive the PRODUCTION lock helpers (`setForkLockTimeout`,
  * `acquireForkLineageLock`, `lockForkRevision`) rather than copies of their SQL, so a
@@ -18,15 +17,14 @@
  *
  * The suite runs BOTH orders and asserts they differ: the pre-fix order must deadlock, the
  * shipped order must not. Asserting only "no deadlock" would pass even if the locks never
- * contended at all, which is exactly the class of vacuous check that let this bug through
- * the earlier review rounds.
+ * contended at all.
  */
 
 import * as schema from '@sim/db/schema'
 import { workspace } from '@sim/db/schema'
 import { readTestDatabaseUrl } from '@sim/db/testing/test-infrastructure'
 import { createDeferred } from '@sim/testing/helpers/deferred'
-import { getErrorMessage } from '@sim/utils/errors'
+import { getErrorMessage, getPostgresCancellationReason } from '@sim/utils/errors'
 import { sleep } from '@sim/utils/helpers'
 import { generateShortId } from '@sim/utils/id'
 import { eq, sql } from 'drizzle-orm'
@@ -44,19 +42,9 @@ const databaseUrl = readTestDatabaseUrl()
 
 const SOURCE_WORKSPACE_ID = 'root-ws'
 
-/**
- * Drizzle wraps a driver error as `Failed query: ...` and hangs the real one off `cause`,
- * so the Postgres condition we are asserting on ("deadlock detected") is never in the top
- * message. Flatten the chain so the assertion reads the server's own words.
- */
+/** The server's cancellation reason (`deadlock`, `lock_timeout`, ...) or the raw message. */
 function describeFailure(error: unknown): string {
-  const parts: string[] = []
-  let current: unknown = error
-  for (let depth = 0; current instanceof Error && depth < 5; depth++) {
-    parts.push(current.message)
-    current = (current as { cause?: unknown }).cause
-  }
-  return parts.length > 0 ? parts.join(' | ') : getErrorMessage(error)
+  return getPostgresCancellationReason(error) ?? getErrorMessage(error)
 }
 
 interface CheckResult {
@@ -163,20 +151,21 @@ describe('fork lock ordering in PostgreSQL', () => {
     const unlinkMayFinish = createDeferred<void>()
     let failure: string | null = null
 
-    // The two locks `createFork` takes, as production takes them: rank 2 then rank 5.
-    const takeLineageLock = (tx: DbTransaction) => acquireForkLineageLock(tx, SOURCE_WORKSPACE_ID)
+    // The two locks `createFork` takes, as production takes them: rank 2 (shared) then rank 5.
+    const takeForkLineageLock = (tx: DbTransaction) =>
+      acquireForkLineageLock(tx, SOURCE_WORKSPACE_ID, { shared: true })
     const takeRevisionLock = (tx: DbTransaction) =>
       lockForkRevision(tx, { sourceWorkspaceId: SOURCE_WORKSPACE_ID })
 
     const forkSession = forkDb
       .transaction(async (tx) => {
         await setForkLockTimeout(tx)
-        await (forkTakesLineageFirst ? takeLineageLock(tx) : takeRevisionLock(tx))
+        await (forkTakesLineageFirst ? takeForkLineageLock(tx) : takeRevisionLock(tx))
         forkHoldsFirstLock.resolve()
         // Only reach for the second lock once the unlink is demonstrably blocked, so the
         // pre-fix cycle is closed rather than merely likely.
         await unlinkMayFinish.promise
-        await (forkTakesLineageFirst ? takeRevisionLock(tx) : takeLineageLock(tx))
+        await (forkTakesLineageFirst ? takeRevisionLock(tx) : takeForkLineageLock(tx))
       })
       .catch((error: unknown) => {
         failure ??= describeFailure(error)
@@ -194,8 +183,8 @@ describe('fork lock ordering in PostgreSQL', () => {
             // on exactly this session rather than on whatever else the database is doing.
             const [self] = await tx.execute<{ pid: number }>(sql`SELECT pg_backend_pid() AS pid`)
             unlinkBackendPid.resolve(Number(self?.pid))
-            // `unlinkForkEdge` takes the lineage lock, then writes the workspace row.
-            await takeLineageLock(tx)
+            // `unlinkForkEdge` takes the lineage lock exclusively, then writes the workspace row.
+            await acquireForkLineageLock(tx, SOURCE_WORKSPACE_ID)
             await tx
               .update(workspace)
               .set({ updatedAt: new Date() })
@@ -254,31 +243,7 @@ describe('fork lock ordering in PostgreSQL', () => {
   it('deadlocks when fork takes the revision lock first (the reported pre-fix order)', async () => {
     await check('pre-fix-order-deadlocks', async () => {
       const failure = await raceForkAgainstUnlink(false)
-      expect(failure).toMatch(/deadlock detected|canceling statement due to lock timeout/i)
-    })
-  })
-
-  /**
-   * Guards the fixture itself. The race above only proves the two sessions conflict; this
-   * pins WHY - `lockForkRevision` really does hold the `workspace` row, which is the edge
-   * of the cycle. A fixture that drifted (a renamed table, a helper that stopped locking)
-   * would otherwise still deadlock for some unrelated reason and look healthy.
-   */
-  it('holds the workspace row through the production revision lock', async () => {
-    await check('revision-lock-covers-workspace-row', async () => {
-      const { executor: probe } = connect()
-      const locked = await probe.transaction(async (tx) => {
-        await setForkLockTimeout(tx)
-        await lockForkRevision(tx, { sourceWorkspaceId: SOURCE_WORKSPACE_ID })
-        const rows = await tx.execute<{ count: number }>(sql`
-          SELECT count(*)::int AS count FROM pg_locks l
-          JOIN pg_class c ON c.oid = l.relation
-          JOIN pg_namespace n ON n.oid = c.relnamespace
-          WHERE l.pid = pg_backend_pid() AND c.relname = 'workspace'
-            AND n.nspname = ${testSchema}`)
-        return Number(rows[0]?.count ?? 0)
-      })
-      expect(locked).toBeGreaterThan(0)
+      expect(failure).toBe('deadlock')
     })
   })
 })
diff --git a/apps/sim/ee/workspace-forking/lib/lineage/lineage-root.test.ts b/apps/sim/ee/workspace-forking/lib/lineage/lineage-root.test.ts
new file mode 100644
index 00000000000..463aec0b88c
--- /dev/null
+++ b/apps/sim/ee/workspace-forking/lib/lineage/lineage-root.test.ts
@@ -0,0 +1,65 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import {
+  collectForkLineageWorkspaceIds,
+  type ForkLineageReader,
+  MAX_FORK_LINEAGE_WORKSPACES,
+  walkToForkLineageRoot,
+} from '@/ee/workspace-forking/lib/lineage/lineage-root'
+
+/** An in-memory lineage: workspace id -> the workspace it was forked from (null = a root). */
+function reader(parents: Record<string, string | null>): ForkLineageReader {
+  return {
+    getParentId: async (workspaceId) => parents[workspaceId] ?? null,
+    getChildIds: async (parentIds) =>
+      Object.entries(parents)
+        .filter(([, parentId]) => parentId !== null && parentIds.includes(parentId))
+        .map(([id]) => id),
+  }
+}
+
+describe('walkToForkLineageRoot', () => {
+  /**
+   * Absorbing a cycle would return a caller-dependent root (`a`->`b`, `b`->`a`), so two
+   * callers would lock different keys for one lineage and lose mutual exclusion.
+   */
+  it('refuses a corrupted parent cycle rather than picking a caller-dependent root', async () => {
+    const parents = { a: 'b', b: 'a' }
+    await expect(walkToForkLineageRoot(reader(parents), 'a')).rejects.toThrow(/cycle/)
+    await expect(walkToForkLineageRoot(reader(parents), 'b')).rejects.toThrow(/cycle/)
+  })
+})
+
+describe('collectForkLineageWorkspaceIds', () => {
+  /**
+   * Resolving root then members must give every member the same set, or two callers would
+   * write different workspaces under the same lineage key.
+   */
+  it('returns the same full lineage from every member', async () => {
+    const parents = { root: null, forkA: 'root', forkB: 'root', grandchild: 'forkA' }
+    const r = reader(parents)
+    for (const from of Object.keys(parents)) {
+      const rootId = await walkToForkLineageRoot(r, from)
+      expect([...(await collectForkLineageWorkspaceIds(r, rootId))].sort()).toEqual([
+        'forkA',
+        'forkB',
+        'grandchild',
+        'root',
+      ])
+    }
+  })
+
+  it('admits exactly the cap and refuses one member past it', async () => {
+    const parents: Record<string, string | null> = { root: null }
+    for (let i = 0; i < MAX_FORK_LINEAGE_WORKSPACES - 1; i++) parents[`fork-${i}`] = 'root'
+    await expect(collectForkLineageWorkspaceIds(reader(parents), 'root')).resolves.toHaveLength(
+      MAX_FORK_LINEAGE_WORKSPACES
+    )
+    parents.overflow = 'root'
+    await expect(collectForkLineageWorkspaceIds(reader(parents), 'root')).rejects.toThrow(
+      `exceeds ${MAX_FORK_LINEAGE_WORKSPACES} workspaces`
+    )
+  })
+})
diff --git a/apps/sim/ee/workspace-forking/lib/sync-default.ts b/apps/sim/ee/workspace-forking/lib/lineage/lineage-root.ts
similarity index 50%
rename from apps/sim/ee/workspace-forking/lib/sync-default.ts
rename to apps/sim/ee/workspace-forking/lib/lineage/lineage-root.ts
index c7c903b934a..58b0756faea 100644
--- a/apps/sim/ee/workspace-forking/lib/sync-default.ts
+++ b/apps/sim/ee/workspace-forking/lib/lineage/lineage-root.ts
@@ -1,20 +1,17 @@
 import { workspace } from '@sim/db/schema'
-import { and, eq, inArray, isNull } from 'drizzle-orm'
+import { eq, inArray } from 'drizzle-orm'
 import type { DbOrTx } from '@/lib/db/types'
 import { ForkError } from '@/ee/workspace-forking/lib/lineage/authz'
 
 /**
- * Hard ceiling on how many workspaces one lineage traversal will visit. A fork lineage is a
- * template workspace plus its forks - tens at most in real use, so this is far above any
- * plausible shape while bounding a pathological or corrupted parent chain to a fixed number
- * of queries. Mirrors the bounded-load discipline of `MAX_FORK_DEPLOYED_WORKFLOWS` in
- * `copy/deploy-bridge.ts`.
+ * Hard ceiling on workspaces one lineage traversal visits: far above real lineages (tens at
+ * most), while bounding a corrupted parent chain to a fixed number of queries.
  */
 export const MAX_FORK_LINEAGE_WORKSPACES = 500
 
 /**
- * The two reads a lineage traversal needs, injected so the walk itself is pure and testable
- * without a database. Both must return only LIVE (non-archived) workspaces.
+ * The reads a lineage traversal needs, injected so the walk itself is pure and testable
+ * without a database. Both include archived workspaces; writers filter liveness themselves.
  */
 export interface ForkLineageReader {
   /**
@@ -32,20 +29,12 @@ export interface ForkLineageReader {
    * Archival is a soft delete that leaves children's `forkedFromWorkspaceId` intact, so
    * filtering archived members here would stop the walk at one and split a lineage into
    * disjoint sets per caller: for `R -> M(archived) -> L -> C`, `R` would see only itself
-   * while `L` and `C` each saw a different pair. {@link ForkLineageReader.liveAmong} is
-   * what keeps archived members out of the writable set.
+   * while `L` and `C` each saw a different pair.
    */
   getChildIds(parentIds: string[]): Promise<string[]>
-  /**
-   * Which of `workspaceIds` are live. Archived members are traversed for topology but
-   * never written. Batched deliberately: this runs inside the lineage-locked transaction,
-   * where a per-member round trip would hold the lock for up to
-   * {@link MAX_FORK_LINEAGE_WORKSPACES} queries.
-   */
-  liveAmong(workspaceIds: string[]): Promise<string[]>
 }
 
-export function createForkLineageReader(executor: DbOrTx): ForkLineageReader {
+function createForkLineageReader(executor: DbOrTx): ForkLineageReader {
   return {
     async getParentId(workspaceId) {
       const [row] = await executor
@@ -55,19 +44,13 @@ export function createForkLineageReader(executor: DbOrTx): ForkLineageReader {
         .limit(1)
       return row?.parentId ?? null
     },
-    async liveAmong(workspaceIds) {
-      if (workspaceIds.length === 0) return []
-      const rows = await executor
-        .select({ id: workspace.id })
-        .from(workspace)
-        .where(and(inArray(workspace.id, workspaceIds), isNull(workspace.archivedAt)))
-      return rows.map((row) => row.id)
-    },
     async getChildIds(parentIds) {
       const rows = await executor
         .select({ id: workspace.id })
         .from(workspace)
         .where(inArray(workspace.forkedFromWorkspaceId, parentIds))
+        // One past the cap, so an oversized lineage is refused without loading all of it.
+        .limit(MAX_FORK_LINEAGE_WORKSPACES + 1)
       return rows.map((row) => row.id)
     },
   }
@@ -106,25 +89,17 @@ export async function walkToForkLineageRoot(
 }
 
 /**
- * Every live workspace in a fork lineage, resolved from ANY member: walk up to the root,
- * then expand descendants one level at a time.
+ * Every workspace in the fork lineage rooted at `rootId`, archived ones included, expanding
+ * descendants one level at a time.
  *
  * Batched breadth-first rather than a recursive CTE - lineages are shallow, so this costs a
- * handful of queries and stays unit-testable. The visited set dedupes, so a corrupted parent
- * cycle terminates instead of looping, and the member cap bounds the worst case.
- *
- * Includes `workspaceId` itself when it is live, so a caller writing the returned set never
- * silently skips the workspace it was asked about. An archived caller is walked for topology
- * but excluded from the result like any other archived member.
+ * handful of queries and stays unit-testable. The visited set dedupes descendants and the
+ * member cap bounds the worst case.
  */
 export async function collectForkLineageWorkspaceIds(
   reader: ForkLineageReader,
-  workspaceId: string
+  rootId: string
 ): Promise<string[]> {
-  const rootId = await walkToForkLineageRoot(reader, workspaceId)
-  // Seed with the root ALONE. Seeding the calling workspace too would mark it visited
-  // before the walk reaches it, so it would be skipped as a frontier node and its own
-  // descendants never expanded - `workspaceId` is added at the end instead.
   const members = new Set<string>([rootId])
   let frontier = [rootId]
   while (frontier.length > 0) {
@@ -139,12 +114,7 @@ export async function collectForkLineageWorkspaceIds(
     }
     frontier = next
   }
-  members.add(workspaceId)
-  // Archived members are part of the topology - they must be walked so the root is the same
-  // from every member - but they are never written. Returning them would let a policy write
-  // touch workspaces the lineage UI reports as gone.
-  const live = new Set(await reader.liveAmong([...members]))
-  return [...members].filter((id) => live.has(id))
+  return [...members]
 }
 
 /** {@link walkToForkLineageRoot} against the database. */
@@ -155,33 +125,7 @@ export function resolveForkLineageRootId(executor: DbOrTx, workspaceId: string):
 /** {@link collectForkLineageWorkspaceIds} against the database. */
 export function resolveForkLineageWorkspaceIds(
   executor: DbOrTx,
-  workspaceId: string
+  rootId: string
 ): Promise<string[]> {
-  return collectForkLineageWorkspaceIds(createForkLineageReader(executor), workspaceId)
-}
-
-/**
- * Whether a workflow created right now in this workspace should start OUTSIDE fork sync,
- * read from the workspace's `forkSyncNewWorkflowsExcluded` policy.
- *
- * Returns `false` for a personal, workspace-less workflow: it participates in no fork edge
- * at all, so the flag must never be what keeps it out. Also `false` for a workspace that
- * cannot be read (archived or deleted mid-flight), which is the historical opt-out behaviour
- * and the safe direction - a workflow that should have been excluded is visible in the Forks
- * page's checkbox list and can be cleared, while one wrongly excluded silently stops syncing.
- */
-export async function resolveForkSyncExclusionForNewWorkflow(
-  executor: DbOrTx,
-  workspaceId: string | null | undefined
-): Promise<boolean> {
-  if (!workspaceId) return false
-  const [row] = await executor
-    .select({ excluded: workspace.forkSyncNewWorkflowsExcluded })
-    .from(workspace)
-    // Archived workspaces fall through to the documented `false` default rather than
-    // returning their stored policy: an archive racing a workflow insert must not mark the
-    // new workflow excluded on the strength of a workspace that is already gone.
-    .where(and(eq(workspace.id, workspaceId), isNull(workspace.archivedAt)))
-    .limit(1)
-  return row?.excluded ?? false
+  return collectForkLineageWorkspaceIds(createForkLineageReader(executor), rootId)
 }
diff --git a/apps/sim/ee/workspace-forking/lib/lineage/lineage.ts b/apps/sim/ee/workspace-forking/lib/lineage/lineage.ts
index 7cc85525ca1..41fbeffc408 100644
--- a/apps/sim/ee/workspace-forking/lib/lineage/lineage.ts
+++ b/apps/sim/ee/workspace-forking/lib/lineage/lineage.ts
@@ -1,7 +1,7 @@
 import { db } from '@sim/db'
 import { workspace } from '@sim/db/schema'
 import { and, desc, eq, isNull, sql } from 'drizzle-orm'
-import { acquireAdvisoryXactLock } from '@/lib/db/advisory-locks'
+import { acquireAdvisoryXactLock, acquireAdvisoryXactLocks } from '@/lib/db/advisory-locks'
 import type { DbOrTx, DbTransaction } from '@/lib/db/types'
 
 export interface ForkLineageNode {
@@ -121,10 +121,12 @@ export async function acquireForkEdgeLock(
  * Serialize writes that must see one consistent view of a whole fork lineage, keyed by
  * the lineage ROOT so every member contends on the same key.
  *
- * Two writers need it: setting the new-workflow fork-sync default (which fans out to
- * every member) and fork creation (which inherits the source's value). Without it a fork
- * created while the default was being changed could inherit a stale value, and the
- * "every member agrees" invariant would be merely likely rather than guaranteed.
+ * Exclusive for the writers that change what the lineage agrees on: setting the new-workflow
+ * fork-sync default (which fans out to every member) and unlink (which moves a subtree to a
+ * new root). Shared for fork creation, which only inherits the source's value: forks of one
+ * lineage do not conflict with each other, so they run concurrently, while a default change
+ * or unlink still waits for them and they for it. Without it a fork created while the
+ * default was being changed could inherit a stale value.
  *
  * ## Lock order for the whole fork module
  *
@@ -133,30 +135,29 @@ export async function acquireForkEdgeLock(
  *
  * | Rank | Lock | Where |
  * | --- | --- | --- |
- * | 1 | `lockWorkspaceOperationRequest` (per-request idempotency key) | `lib/workspaces/operation-receipts` |
+ * | 1 | `lockWorkspaceOperationRequest` (per-request idempotency key) | `lib/workspaces/operations/receipts` |
  * | 2 | {@link acquireForkLineageLock} (coarsest fork lock) | here |
  * | 3 | {@link acquireForkTargetLock} | here |
  * | 4 | {@link acquireForkEdgeLock} | here |
  * | 5 | `lockForkRevision` (a `resource_folders:*` advisory lock per workspace, then `FOR UPDATE` on `workspace`, `workflow`, `workflow_blocks`, `workflow_edges`, `workflow_subflows` and `FOR SHARE` on the active `workflow_deployment_version` rows) | `application/revision.ts` |
  * | 6 | remaining row locks, taken in sorted id order | various |
  *
- * Rank 5 is the trap this table exists for. Ranking only the three advisory locks here
- * said nothing about `lockForkRevision`, and `createFork` took it BEFORE this lock - so
- * it held `FOR UPDATE` on the source `workspace` row while waiting on `fork-lineage`,
- * while `unlinkForkEdge` held `fork-lineage` and waited to UPDATE that same row. A
- * genuine cycle, reported independently by two reviewers.
+ * Rank 5 is the easy one to get wrong: it takes `FOR UPDATE` on `workspace`, which
+ * `unlinkForkEdge` and `setForkSyncDefault` write while holding rank 2, so taking rank 5
+ * before rank 2 deadlocks.
  *
- * Do NOT assume a uniform 10s bound from {@link setForkLockTimeout} across a whole
- * transaction: `lockForkRevision` reaches `acquireFolderMutationLock`
- * (`lib/folders/locks.ts`), which re-sets `lock_timeout` to 5s mid-transaction, and the
- * MCP server lock re-sets it to 3s. Pre-existing and wider than forks; recorded here so
- * the contract does not assert something false.
+ * {@link setForkLockTimeout}'s 10s is not a whole-transaction bound: `lockForkRevision`
+ * reaches `acquireFolderMutationLock`, which re-sets `lock_timeout` to 5s, and the MCP
+ * server lock re-sets it to 3s.
  */
 export async function acquireForkLineageLock(
   tx: DbTransaction,
-  rootWorkspaceId: string
+  rootWorkspaceId: string,
+  { shared = false }: { shared?: boolean } = {}
 ): Promise<void> {
-  await acquireAdvisoryXactLock(tx, 'fork_lineage', `fork-lineage:${rootWorkspaceId}`)
+  await acquireAdvisoryXactLocks(tx, 'fork_lineage', [
+    { key: `fork-lineage:${rootWorkspaceId}`, shared },
+  ])
 }
 
 /**
diff --git a/apps/sim/ee/workspace-forking/lib/lineage/unlink.test.ts b/apps/sim/ee/workspace-forking/lib/lineage/unlink.test.ts
index 867c2e9214f..d2eb41a82c9 100644
--- a/apps/sim/ee/workspace-forking/lib/lineage/unlink.test.ts
+++ b/apps/sim/ee/workspace-forking/lib/lineage/unlink.test.ts
@@ -3,13 +3,19 @@ import {
   workspaceForkingLineageMock,
   workspaceForkingLineageMockFns,
 } from '@sim/testing/mocks/workspace-forking-lineage.mock'
+import {
+  workspaceForkingLineageRootMock,
+  workspaceForkingLineageRootMockFns,
+} from '@sim/testing/mocks/workspace-forking-lineage-root.mock'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@/ee/workspace-forking/lib/lineage/lineage', () => workspaceForkingLineageMock)
+vi.mock('@/ee/workspace-forking/lib/lineage/lineage-root', () => workspaceForkingLineageRootMock)
 
 import { unlinkForkEdge } from '@/ee/workspace-forking/lib/lineage/unlink'
 
 const { mockSetForkLockTimeout, mockAcquireForkEdgeLock } = workspaceForkingLineageMockFns
+const { mockResolveForkLineageRootId } = workspaceForkingLineageRootMockFns
 
 const EDGE = { childWorkspaceId: 'child-ws', parentWorkspaceId: 'parent-ws' }
 
@@ -18,6 +24,7 @@ afterAll(resetDbChainMock)
 describe('unlinkForkEdge', () => {
   beforeEach(() => {
     resetDbChainMock()
+    mockResolveForkLineageRootId.mockResolvedValue('root-ws')
   })
 
   it('nulls the child pointer and purges all four edge tables under the edge lock', async () => {
@@ -34,4 +41,19 @@ describe('unlinkForkEdge', () => {
     )
     expect(dbChainMockFns.delete).toHaveBeenCalledTimes(4)
   })
+
+  /** A root moved by a concurrent unlink higher up means the lock taken no longer covers it. */
+  it('refuses when the lineage root moved before the lock was taken', async () => {
+    mockResolveForkLineageRootId.mockResolvedValueOnce('root-ws').mockResolvedValueOnce('parent-ws')
+
+    await expect(unlinkForkEdge(EDGE, 'req-1')).rejects.toMatchObject({ statusCode: 409 })
+  })
+
+  /** The child being its own root means this very edge is already gone: an idempotent no-op. */
+  it('treats an edge dissolved concurrently as already unlinked', async () => {
+    mockResolveForkLineageRootId.mockResolvedValueOnce('root-ws').mockResolvedValueOnce('child-ws')
+    dbChainMockFns.returning.mockResolvedValueOnce([])
+
+    await expect(unlinkForkEdge(EDGE, 'req-1')).resolves.toEqual({ unlinked: false })
+  })
 })
diff --git a/apps/sim/ee/workspace-forking/lib/lineage/unlink.ts b/apps/sim/ee/workspace-forking/lib/lineage/unlink.ts
index 4e193b9eda2..6540a3c4a96 100644
--- a/apps/sim/ee/workspace-forking/lib/lineage/unlink.ts
+++ b/apps/sim/ee/workspace-forking/lib/lineage/unlink.ts
@@ -8,13 +8,14 @@ import {
 } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, eq } from 'drizzle-orm'
+import { ForkError } from '@/ee/workspace-forking/lib/lineage/authz'
 import {
   acquireForkEdgeLock,
   acquireForkLineageLock,
   type ForkEdge,
   setForkLockTimeout,
 } from '@/ee/workspace-forking/lib/lineage/lineage'
-import { resolveForkLineageRootId } from '@/ee/workspace-forking/lib/sync-default'
+import { resolveForkLineageRootId } from '@/ee/workspace-forking/lib/lineage/lineage-root'
 
 const logger = createLogger('ForkUnlink')
 
@@ -43,18 +44,22 @@ export async function unlinkForkEdge(
 ): Promise<UnlinkForkResult> {
   const { childWorkspaceId, parentWorkspaceId } = edge
 
-  // Resolved before the transaction: the walk is several round trips, and issuing them
-  // from inside the tx would hold this connection while checking out more.
+  // The root is the lock key, so it is resolved before the transaction and re-checked under the lock.
   const lineageRootId = await resolveForkLineageRootId(db, childWorkspaceId)
 
   const unlinked = await db.transaction(async (tx) => {
     await setForkLockTimeout(tx)
-    // Severing this edge changes which lineage the child belongs to, and therefore which
-    // key `setForkSyncDefault` and `createFork` lock on. Taking the lineage lock first
-    // (the documented ordering) keeps an unlink from splitting a lineage underneath a
-    // policy write that already enumerated its members.
-    // Ranks 2 then 4 - see the rank table on `acquireForkLineageLock`.
+    // Severing the edge changes the child's lineage root; ranks 2 then 4 - see the rank
+    // table on `acquireForkLineageLock`.
     await acquireForkLineageLock(tx, lineageRootId)
+    // Refuse if a concurrent unlink higher up moved the root before we locked it: holding a
+    // stale key would not serialize against writers of the child's current lineage. A root
+    // equal to the child means this very edge is already gone, which the update below
+    // treats as an idempotent success.
+    const currentRootId = await resolveForkLineageRootId(tx, childWorkspaceId)
+    if (currentRootId !== lineageRootId && currentRootId !== childWorkspaceId) {
+      throw new ForkError('The fork lineage changed while disconnecting. Try again.', 409)
+    }
     await acquireForkEdgeLock(tx, childWorkspaceId)
 
     const updated = await tx
diff --git a/apps/sim/ee/workspace-forking/lib/promote/promote-plan.ts b/apps/sim/ee/workspace-forking/lib/promote/promote-plan.ts
index ec56622d718..b2237c1057f 100644
--- a/apps/sim/ee/workspace-forking/lib/promote/promote-plan.ts
+++ b/apps/sim/ee/workspace-forking/lib/promote/promote-plan.ts
@@ -42,14 +42,6 @@ export interface ForkPromotePlanItem {
     sortOrder: number
     /** Source's public-API flag, carried onto the written target (see copyWorkflowStateIntoTarget). */
     isPublicApi: boolean
-    /**
-     * The sync participation a promote-created target is written with. Always false:
-     * `listDeployedWorkflows` admits only synced sources, so a promoted workflow is one.
-     * Stated explicitly so a created target can never take the TARGET workspace's
-     * new-workflow default, which in an opt-out lineage would land a deliberately synced
-     * workflow unsynced on the other side.
-     */
-    forkSyncExcluded: boolean
   }
 }
 
@@ -221,7 +213,6 @@ export function buildForkPromotePlanItems(params: {
         folderId: source.folderId,
         sortOrder: source.sortOrder,
         isPublicApi: source.isPublicApi,
-        forkSyncExcluded: false,
       },
     })
   }
diff --git a/apps/sim/ee/workspace-forking/lib/promote/promote.ts b/apps/sim/ee/workspace-forking/lib/promote/promote.ts
index ffacacf5c1b..abba1cad4ab 100644
--- a/apps/sim/ee/workspace-forking/lib/promote/promote.ts
+++ b/apps/sim/ee/workspace-forking/lib/promote/promote.ts
@@ -619,9 +619,7 @@ export async function promoteFork(params: PromoteForkParams): Promise<PromoteFor
       // Target lock before edge lock (consistent ordering): the target lock serializes
       // every sync into this target so sibling forks can't interleave writes, and so
       // rollback's "newest sync" check stays race-free against a concurrent promote.
-      // Ranks 3 then 4, then `lockForkRevision` at 5 below - see the rank table on
-      // `acquireForkLineageLock`. Promote spans one edge, not a lineage, so it takes no
-      // rank-2 lineage lock; that is why it may start at 3.
+      // Ranks 3, 4, then 5 below - see the rank table on `acquireForkLineageLock`.
       await acquireForkTargetLock(tx, targetWorkspaceId)
       await acquireForkEdgeLock(tx, edge.childWorkspaceId)
       if (admission) {
diff --git a/apps/sim/ee/workspace-forking/lib/sync-default.test.ts b/apps/sim/ee/workspace-forking/lib/sync-default.test.ts
deleted file mode 100644
index 8ffdce9cf35..00000000000
--- a/apps/sim/ee/workspace-forking/lib/sync-default.test.ts
+++ /dev/null
@@ -1,177 +0,0 @@
-/**
- * @vitest-environment node
- */
-import { describe, expect, it } from 'vitest'
-import type { DbOrTx } from '@/lib/db/types'
-import {
-  collectForkLineageWorkspaceIds,
-  type ForkLineageReader,
-  MAX_FORK_LINEAGE_WORKSPACES,
-  resolveForkSyncExclusionForNewWorkflow,
-  walkToForkLineageRoot,
-} from '@/ee/workspace-forking/lib/sync-default'
-
-/** An in-memory lineage: workspace id -> the workspace it was forked from (null = a root). */
-function reader(
-  parents: Record<string, string | null>,
-  archived: readonly string[] = []
-): ForkLineageReader {
-  return {
-    getParentId: async (workspaceId) => parents[workspaceId] ?? null,
-    // Deliberately does NOT filter archived children: the real reader must not either, or
-    // an archived middle workspace blocks descent and splits the lineage. A fake that
-    // filtered here would reproduce that bug and let the test pass.
-    getChildIds: async (parentIds) =>
-      Object.entries(parents)
-        .filter(([, parentId]) => parentId !== null && parentIds.includes(parentId))
-        .map(([id]) => id),
-    liveAmong: async (ids) => ids.filter((id) => !archived.includes(id)),
-  }
-}
-
-describe('walkToForkLineageRoot', () => {
-  it('returns the workspace itself when it is not a fork', async () => {
-    await expect(walkToForkLineageRoot(reader({ root: null }), 'root')).resolves.toBe('root')
-  })
-
-  it('climbs through intermediate forks to the original workspace', async () => {
-    const parents = { root: null, mid: 'root', leaf: 'mid' }
-    await expect(walkToForkLineageRoot(reader(parents), 'leaf')).resolves.toBe('root')
-  })
-
-  /** `forkedFromWorkspaceId` is ON DELETE SET NULL, and unlink clears it. */
-  it('treats a severed chain as its own root rather than failing', async () => {
-    await expect(walkToForkLineageRoot(reader({ unlinked: null }), 'unlinked')).resolves.toBe(
-      'unlinked'
-    )
-  })
-
-  /**
-   * Absorbing a cycle would return a caller-dependent root (`a`->`b`, `b`->`a`), so two
-   * callers would lock different keys for one lineage and lose mutual exclusion.
-   */
-  it('refuses a corrupted parent cycle rather than picking a caller-dependent root', async () => {
-    const parents = { a: 'b', b: 'a' }
-    await expect(walkToForkLineageRoot(reader(parents), 'a')).rejects.toThrow(/cycle/)
-    await expect(walkToForkLineageRoot(reader(parents), 'b')).rejects.toThrow(/cycle/)
-  })
-
-  /** Archival preserves the parent link, so the root must not depend on who asks. */
-  it('resolves the same root from either side of an archived intermediate', async () => {
-    const parents = { root: null, mid: 'root', leaf: 'mid' }
-    const r = reader(parents, ['mid'])
-    await expect(walkToForkLineageRoot(r, 'leaf')).resolves.toBe('root')
-    await expect(walkToForkLineageRoot(r, 'root')).resolves.toBe('root')
-  })
-})
-
-describe('collectForkLineageWorkspaceIds', () => {
-  const family = { root: null, forkA: 'root', forkB: 'root', grandchild: 'forkA' }
-
-  it('reaches ancestors AND descendants when issued from a mid-lineage fork', async () => {
-    const members = await collectForkLineageWorkspaceIds(reader(family), 'forkA')
-    expect([...members].sort()).toEqual(['forkA', 'forkB', 'grandchild', 'root'])
-  })
-
-  it('returns the same set no matter which member it is issued from', async () => {
-    const fromRoot = await collectForkLineageWorkspaceIds(reader(family), 'root')
-    const fromLeaf = await collectForkLineageWorkspaceIds(reader(family), 'grandchild')
-    expect([...fromRoot].sort()).toEqual([...fromLeaf].sort())
-  })
-
-  it('always includes the calling workspace, even when it is standalone', async () => {
-    const members = await collectForkLineageWorkspaceIds(reader({ solo: null }), 'solo')
-    expect(members).toEqual(['solo'])
-  })
-
-  it('propagates the cycle refusal rather than writing a partial lineage', async () => {
-    await expect(collectForkLineageWorkspaceIds(reader({ a: 'b', b: 'a' }), 'a')).rejects.toThrow(
-      /cycle/
-    )
-  })
-
-  /**
-   * An archived member is walked for topology so the root agrees from every side, but it is
-   * never returned - a policy write must not touch a workspace the UI reports as gone.
-   */
-  it('traverses an archived member but excludes it from the writable set', async () => {
-    const parents = { root: null, mid: 'root', leaf: 'mid' }
-    const members = await collectForkLineageWorkspaceIds(reader(parents, ['mid']), 'leaf')
-    expect([...members].sort()).toEqual(['leaf', 'root'])
-  })
-
-  /**
-   * The regression that matters: archival is a soft delete, so a deleted template in the
-   * middle must not stop the walk. If it does, every member computes a DIFFERENT write set
-   * (`root -> [root]`, `leaf -> [leaf, root]`, `child -> [child, root]`) and the
-   * "every member agrees" invariant breaks with no error.
-   */
-  it('reaches descendants BEYOND an archived member, from every member', async () => {
-    const parents = { root: null, mid: 'root', leaf: 'mid', child: 'leaf' }
-    const r = reader(parents, ['mid'])
-    const expected = ['child', 'leaf', 'root']
-    for (const from of ['root', 'leaf', 'child']) {
-      expect([...(await collectForkLineageWorkspaceIds(r, from))].sort()).toEqual(expected)
-    }
-  })
-
-  it('refuses a lineage larger than the cap rather than loading it', async () => {
-    const parents: Record<string, string | null> = { root: null }
-    for (let i = 0; i < MAX_FORK_LINEAGE_WORKSPACES + 10; i++) parents[`fork-${i}`] = 'root'
-    await expect(collectForkLineageWorkspaceIds(reader(parents), 'root')).rejects.toThrow(
-      /exceeds 500 workspaces/
-    )
-  })
-})
-
-/** Stands in for the single-row policy lookup the resolver issues. */
-function policyExecutor(rows: Array<{ excluded: boolean }>): DbOrTx {
-  const chain = {
-    select: () => chain,
-    from: () => chain,
-    where: () => chain,
-    limit: async () => rows,
-  }
-  return chain as unknown as DbOrTx
-}
-
-describe('resolveForkSyncExclusionForNewWorkflow', () => {
-  /**
-   * A personal, workspace-less workflow participates in no fork edge, so the policy must
-   * never be what keeps it out - and the resolver must not issue a query for it either.
-   */
-  it.each([null, undefined, ''])('returns false for a workspace-less workflow (%p)', async (id) => {
-    let queried = false
-    const executor = {
-      select: () => {
-        queried = true
-        return executor
-      },
-    } as unknown as DbOrTx
-    await expect(resolveForkSyncExclusionForNewWorkflow(executor, id)).resolves.toBe(false)
-    expect(queried).toBe(false)
-  })
-
-  it('returns the stored policy when the workspace opts in', async () => {
-    await expect(
-      resolveForkSyncExclusionForNewWorkflow(policyExecutor([{ excluded: true }]), 'ws-1')
-    ).resolves.toBe(true)
-  })
-
-  it('returns false for the historical opt-out default', async () => {
-    await expect(
-      resolveForkSyncExclusionForNewWorkflow(policyExecutor([{ excluded: false }]), 'ws-1')
-    ).resolves.toBe(false)
-  })
-
-  /**
-   * Falling back to "included" is the safe direction: a workflow that should have been
-   * excluded is visible in the Forks checkbox list and can be cleared, whereas one wrongly
-   * excluded silently stops syncing.
-   */
-  it('falls back to included when the workspace row cannot be read', async () => {
-    await expect(
-      resolveForkSyncExclusionForNewWorkflow(policyExecutor([]), 'ws-deleted-mid-flight')
-    ).resolves.toBe(false)
-  })
-})
diff --git a/apps/sim/lib/workflows/orchestration/workflow-lifecycle.ts b/apps/sim/lib/workflows/orchestration/workflow-lifecycle.ts
index 25ef97be6bf..d2be643a92f 100644
--- a/apps/sim/lib/workflows/orchestration/workflow-lifecycle.ts
+++ b/apps/sim/lib/workflows/orchestration/workflow-lifecycle.ts
@@ -11,10 +11,10 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import type { DbOrTx } from '@/lib/db/types'
 import { buildDefaultWorkflowArtifacts } from '@/lib/workflows/defaults'
 import { archiveWorkflow, restoreWorkflow } from '@/lib/workflows/lifecycle'
+import { buildNewWorkflowRow } from '@/lib/workflows/persistence/new-workflow-row'
 import { saveWorkflowToNormalizedTables } from '@/lib/workflows/persistence/utils'
 import { nextWorkflowSortOrder } from '@/lib/workflows/sort-order'
 import { deduplicateWorkflowName } from '@/lib/workflows/utils'
-import { resolveForkSyncExclusionForNewWorkflow } from '@/ee/workspace-forking/lib/sync-default'
 
 const logger = createLogger('WorkflowLifecycle')
 
@@ -190,25 +190,15 @@ export async function createWorkflowInTransaction(tx: DbOrTx, params: PerformCre
   const name = params.deduplicate
     ? await deduplicateWorkflowName(params.name, params.workspaceId, folderId, tx)
     : params.name
-  const sortOrder =
-    params.sortOrder ?? (await nextWorkflowSortOrder(params.workspaceId, folderId, tx))
-  const now = new Date()
-  const row = {
+  const row = await buildNewWorkflowRow(tx, {
     id: params.id ?? generateId(),
     userId: params.userId,
     workspaceId: params.workspaceId,
     folderId,
     name,
     description: params.description ?? null,
-    sortOrder,
-    lastSynced: now,
-    createdAt: now,
-    updatedAt: now,
-    isDeployed: false,
-    runCount: 0,
-    variables: {},
-    forkSyncExcluded: await resolveForkSyncExclusionForNewWorkflow(tx, params.workspaceId),
-  }
+    sortOrder: params.sortOrder ?? (await nextWorkflowSortOrder(params.workspaceId, folderId, tx)),
+  })
   if (!params.deduplicate) {
     await tx.insert(workflow).values(row)
     return row
@@ -271,30 +261,19 @@ export async function performCreateWorkflowTransition(
 
     try {
       await db.transaction(async (tx) => {
-        // Read inside the insert transaction, not before it. The policy is forward-only and
-        // governs a default the owner can see and change in the Forks list, so this does not
-        // need the lineage lock that `setForkSyncDefault` takes - but snapshotting it before
-        // the transaction widened the window for no reason.
-        const forkSyncExcluded = await resolveForkSyncExclusionForNewWorkflow(
-          tx,
-          params.workspaceId
-        )
-        await tx.insert(workflow).values({
+        // Built per attempt inside the insert transaction, so the fork-sync policy is read
+        // with the write rather than carried across retries.
+        const row = await buildNewWorkflowRow(tx, {
           id: workflowId,
           userId: params.userId,
           workspaceId: params.workspaceId,
           folderId,
-          sortOrder,
           name,
-          description: params.description,
-          lastSynced: now,
-          createdAt: now,
-          updatedAt: now,
-          isDeployed: false,
-          runCount: 0,
-          variables: {},
-          forkSyncExcluded,
+          description: params.description ?? null,
+          sortOrder,
+          now,
         })
+        await tx.insert(workflow).values(row)
 
         await saveWorkflowToNormalizedTables(
           workflowId,
diff --git a/apps/sim/lib/workflows/persistence/duplicate.ts b/apps/sim/lib/workflows/persistence/duplicate.ts
index a39d4d285fb..94e90ed829e 100644
--- a/apps/sim/lib/workflows/persistence/duplicate.ts
+++ b/apps/sim/lib/workflows/persistence/duplicate.ts
@@ -20,6 +20,7 @@ import {
 import { and, eq } from 'drizzle-orm'
 import type { DbOrTx } from '@/lib/db/types'
 import { remapConditionEdgeHandle } from '@/lib/workflows/condition-ids'
+import { buildNewWorkflowRow } from '@/lib/workflows/persistence/new-workflow-row'
 import {
   remapConditionIdsInSubBlocks,
   remapVariableIdsInSubBlocks,
@@ -29,7 +30,6 @@ import {
 } from '@/lib/workflows/persistence/remap-internal-ids'
 import { nextWorkflowSortOrder } from '@/lib/workflows/sort-order'
 import { deduplicateWorkflowName } from '@/lib/workflows/utils'
-import { resolveForkSyncExclusionForNewWorkflow } from '@/ee/workspace-forking/lib/sync-default'
 import type { Variable } from '@/stores/variables/types'
 import type { LoopConfig, ParallelConfig } from '@/stores/workflows/workflow/types'
 
@@ -200,40 +200,30 @@ export async function duplicateWorkflow(
       tx
     )
 
-    await tx.insert(workflow).values({
-      id: newWorkflowId,
-      userId,
-      workspaceId: targetWorkspaceId,
-      folderId: targetFolderId,
-      sortOrder,
-      name: deduplicatedName,
-      description: description || source.description,
-      lastSynced: now,
-      createdAt: now,
-      updatedAt: now,
-      isDeployed: false,
-      runCount: 0,
-      locked: false,
-      // A duplicate is a NEW workflow, so it takes the target workspace's new-workflow
-      // fork-sync policy rather than inheriting the source's participation. Only a
-      // fork/promote copy - the same logical workflow in another workspace - inherits.
-      forkSyncExcluded: await resolveForkSyncExclusionForNewWorkflow(tx, targetWorkspaceId),
-      // Duplicate variables with new IDs and new workflowId
-      variables: (() => {
-        const sourceVars = (source.variables as Record<string, Variable>) || {}
-        const remapped: Record<string, Variable> = {}
-        for (const [oldVarId, variable] of Object.entries(sourceVars) as [string, Variable][]) {
-          const newVarId = generateId()
-          varIdMapping.set(oldVarId, newVarId)
-          remapped[newVarId] = {
-            ...variable,
-            id: newVarId,
-            workflowId: newWorkflowId,
-          }
-        }
-        return remapped
-      })(),
-    })
+    // Duplicate variables with new IDs and new workflowId
+    const variables: Record<string, Variable> = {}
+    const sourceVars = (source.variables as Record<string, Variable>) || {}
+    for (const [oldVarId, variable] of Object.entries(sourceVars) as [string, Variable][]) {
+      const newVarId = generateId()
+      varIdMapping.set(oldVarId, newVarId)
+      variables[newVarId] = { ...variable, id: newVarId, workflowId: newWorkflowId }
+    }
+
+    // A duplicate is a new workflow, so it takes the workspace's fork-sync policy rather
+    // than inheriting the source's participation, and starts unlocked like any new one.
+    await tx.insert(workflow).values(
+      await buildNewWorkflowRow(tx, {
+        id: newWorkflowId,
+        userId,
+        workspaceId: targetWorkspaceId,
+        folderId: targetFolderId,
+        sortOrder,
+        name: deduplicatedName,
+        description: description || source.description,
+        now,
+        variables,
+      })
+    )
 
     // Copy all blocks from source workflow with new IDs
     const sourceBlocks = await tx
diff --git a/apps/sim/lib/workflows/persistence/new-workflow-row.ts b/apps/sim/lib/workflows/persistence/new-workflow-row.ts
new file mode 100644
index 00000000000..e1e10809137
--- /dev/null
+++ b/apps/sim/lib/workflows/persistence/new-workflow-row.ts
@@ -0,0 +1,60 @@
+import { type workflow, workspace } from '@sim/db/schema'
+import { and, eq, isNull } from 'drizzle-orm'
+import type { DbOrTx } from '@/lib/db/types'
+
+interface NewWorkflowRowInput {
+  id: string
+  userId: string
+  workspaceId: string
+  folderId: string | null
+  name: string
+  description: string | null
+  sortOrder?: number
+  variables?: (typeof workflow.$inferInsert)['variables']
+  now?: Date
+}
+
+/**
+ * The workspace's `forkSyncNewWorkflowsExcluded` policy: whether a workflow created now
+ * starts outside fork sync.
+ *
+ * `false` for an archived or missing workspace: a wrongly-synced workflow is visible and
+ * fixable in the Forks list, while a wrongly-excluded one silently stops syncing.
+ */
+export async function readForkSyncNewWorkflowsExcluded(
+  executor: DbOrTx,
+  workspaceId: string
+): Promise<boolean> {
+  const [row] = await executor
+    .select({ excluded: workspace.forkSyncNewWorkflowsExcluded })
+    .from(workspace)
+    .where(and(eq(workspace.id, workspaceId), isNull(workspace.archivedAt)))
+    .limit(1)
+  return row?.excluded ?? false
+}
+
+/**
+ * The insert row for a genuinely new workflow - created, duplicated, imported, or seeded as
+ * a starter - so every such path takes the workspace's fork-sync policy rather than the
+ * column default. A fork or promote copy is not new and is written by
+ * `copyWorkflowStateIntoTarget` instead.
+ */
+export async function buildNewWorkflowRow(executor: DbOrTx, input: NewWorkflowRowInput) {
+  const now = input.now ?? new Date()
+  return {
+    id: input.id,
+    userId: input.userId,
+    workspaceId: input.workspaceId,
+    folderId: input.folderId,
+    name: input.name,
+    description: input.description,
+    sortOrder: input.sortOrder ?? 0,
+    lastSynced: now,
+    createdAt: now,
+    updatedAt: now,
+    isDeployed: false,
+    runCount: 0,
+    variables: input.variables ?? {},
+    forkSyncExcluded: await readForkSyncNewWorkflowsExcluded(executor, input.workspaceId),
+  } satisfies typeof workflow.$inferInsert
+}
diff --git a/apps/sim/lib/workflows/utils.ts b/apps/sim/lib/workflows/utils.ts
index 8e9f4754b5f..d7d070372ae 100644
--- a/apps/sim/lib/workflows/utils.ts
+++ b/apps/sim/lib/workflows/utils.ts
@@ -8,9 +8,6 @@ import { NextResponse } from 'next/server'
 import { getSession } from '@/lib/auth'
 import { materializeInlineExecutionValue } from '@/lib/execution/payloads/inline-materialization.server'
 import type { ExecutionMaterializationContext } from '@/lib/execution/payloads/materialization.server'
-import { buildDefaultWorkflowArtifacts } from '@/lib/workflows/defaults'
-import { saveWorkflowToNormalizedTables } from '@/lib/workflows/persistence/utils'
-import { nextWorkflowSortOrder } from '@/lib/workflows/sort-order'
 import { listAccessibleWorkspaceRowsForUser } from '@/lib/workspaces/utils'
 import type { ExecutionResult } from '@/executor/types'
 
@@ -434,70 +431,6 @@ export async function validateWorkflowPermissions(
 
 // ── Workflow CRUD ──
 
-export interface CreateWorkflowInput {
-  userId: string
-  workspaceId: string
-  name: string
-  description?: string | null
-  folderId?: string | null
-}
-
-export async function createWorkflowRecord(params: CreateWorkflowInput) {
-  const { userId, workspaceId, name, description = null, folderId = null } = params
-  const workflowId = generateId()
-  const now = new Date()
-
-  const duplicateConditions = [
-    eq(workflowTable.workspaceId, workspaceId),
-    isNull(workflowTable.archivedAt),
-    eq(workflowTable.name, name),
-    ...(folderId ? [eq(workflowTable.folderId, folderId)] : [isNull(workflowTable.folderId)]),
-  ]
-  const [duplicateWorkflow] = await db
-    .select({ id: workflowTable.id })
-    .from(workflowTable)
-    .where(and(...duplicateConditions))
-    .limit(1)
-  if (duplicateWorkflow) {
-    throw new Error(
-      `A workflow named "${name}" already exists in this folder. Use a different name.`
-    )
-  }
-
-  const sortOrder = await nextWorkflowSortOrder(workspaceId, folderId)
-
-  await db.insert(workflowTable).values({
-    id: workflowId,
-    userId,
-    workspaceId,
-    folderId,
-    sortOrder,
-    name,
-    description,
-    lastSynced: now,
-    createdAt: now,
-    updatedAt: now,
-    isDeployed: false,
-    runCount: 0,
-    variables: {},
-  })
-
-  const { workflowState } = buildDefaultWorkflowArtifacts()
-  const saveResult = await saveWorkflowToNormalizedTables(workflowId, workflowState, {
-    /**
-     * Actorless: `buildDefaultWorkflowArtifacts` produces the platform's starter
-     * graph, so there is no caller-chosen block type for a group to judge.
-     */
-    workspaceId: null,
-    subjectUserId: null,
-  })
-  if (!saveResult.success) {
-    throw new Error(saveResult.error || 'Failed to save workflow state')
-  }
-
-  return { workflowId, name, workspaceId, folderId, sortOrder, createdAt: now, updatedAt: now }
-}
-
 export async function updateWorkflowRecord(
   workflowId: string,
   updates: { name?: string; description?: string; folderId?: string | null }
diff --git a/apps/sim/lib/workspaces/__integration__/fork-sync.integration.ts b/apps/sim/lib/workspaces/__integration__/fork-sync.integration.ts
index 13118cd4e0b..bb0210d5139 100644
--- a/apps/sim/lib/workspaces/__integration__/fork-sync.integration.ts
+++ b/apps/sim/lib/workspaces/__integration__/fork-sync.integration.ts
@@ -21,6 +21,8 @@ import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-i
 import { processOutboxEventById } from '@/lib/core/outbox/service'
 import { createScopedCliTransport } from '@/lib/mothership/agent-cli/scoped-transport'
 import { workflowDeploymentOutboxHandlers } from '@/lib/workflows/deployment-outbox'
+import { performCreateWorkflowTransition } from '@/lib/workflows/orchestration/workflow-lifecycle'
+import { duplicateWorkflow } from '@/lib/workflows/persistence/duplicate'
 import { admitWorkflowState, saveAdmittedWorkflowState } from '@/lib/workflows/persistence/utils'
 import { getWorkspaceOperation } from '@/lib/workspaces/operations/application'
 import { workspaceOperationOutboxHandlers } from '@/lib/workspaces/operations/outbox'
@@ -32,6 +34,7 @@ import {
   syncWorkspace,
 } from '@/ee/workspace-forking/application/create-and-sync'
 import { assertForkSourceVersions } from '@/ee/workspace-forking/application/revision'
+import { setForkSyncDefault } from '@/ee/workspace-forking/application/sync-default'
 import { loadSourceDeployedStates } from '@/ee/workspace-forking/lib/copy/deploy-bridge'
 import type { WorkflowState } from '@/stores/workflows/workflow/types'
 
@@ -94,8 +97,8 @@ async function finishDeployments(report: WorkspaceOperationReport) {
   })
 }
 
-async function createChild() {
-  const input = { workspaceId: sourceWorkspaceId, name: `Edge ${generateId()}` }
+async function createChild(parentWorkspaceId = sourceWorkspaceId) {
+  const input = { workspaceId: parentWorkspaceId, name: `Edge ${generateId()}` }
   const preview = await previewWorkspaceFork.execute({ principal, input })
   const result = await forkWorkspace.execute({
     principal,
@@ -759,4 +762,89 @@ describe('authorized fork and sync against PostgreSQL', () => {
         .where(eq(workspaceOperationReceipt.requestId, refusedId))
     ).toHaveLength(0)
   })
+
+  /**
+   * The opt-in policy end to end: set from a fork, it reaches the parent and changes only
+   * what differs; a genuinely new workflow (created, duplicated, or a fork's starter) and a
+   * new fork take it; a forked copy stays synced; no existing workflow moves; and an archived
+   * member is walked through for the lineage root but never written.
+   */
+  it('gives new workflows the lineage fork-sync default while copies stay synced', async () => {
+    const childId = await createChild()
+    const excludedFor = async (workflowId: string) =>
+      (
+        await db
+          .select({ excluded: workflow.forkSyncExcluded })
+          .from(workflow)
+          .where(eq(workflow.id, workflowId))
+      )[0]?.excluded
+    const policyOf = async (workspaceId: string) =>
+      (
+        await db
+          .select({ excluded: workspace.forkSyncNewWorkflowsExcluded })
+          .from(workspace)
+          .where(eq(workspace.id, workspaceId))
+      )[0]?.excluded
+    const setDefault = (workspaceId: string, excludeNewWorkflows: boolean) =>
+      setForkSyncDefault.execute({ principal, input: { workspaceId, excludeNewWorkflows } })
+    try {
+      const first = await setDefault(childId, true)
+      expect(first.changedWorkspaces.map((member) => member.id)).toEqual(
+        expect.arrayContaining([sourceWorkspaceId, childId])
+      )
+      expect((await setDefault(childId, true)).changedWorkspaces).toEqual([])
+      expect(await policyOf(sourceWorkspaceId)).toBe(true)
+      expect(await excludedFor(sourceWorkflowId)).toBe(false)
+
+      const [copy] = await db
+        .select({ id: workflow.id, excluded: workflow.forkSyncExcluded })
+        .from(workflow)
+        .where(eq(workflow.workspaceId, childId))
+      expect(copy.excluded).toBe(false)
+
+      const created = await performCreateWorkflowTransition({
+        userId,
+        workspaceId: childId,
+        name: `New ${generateId()}`,
+      })
+      expect(await excludedFor(created.workflow!.id)).toBe(true)
+
+      // Duplicating a SYNCED workflow still yields a new, excluded one.
+      const duplicated = await duplicateWorkflow({
+        sourceWorkflowId: copy.id,
+        userId,
+        name: `Duplicate ${generateId()}`,
+        workspaceId: childId,
+      })
+      expect(await excludedFor(duplicated.id)).toBe(true)
+
+      const newForkId = await createChild()
+      expect(await policyOf(newForkId)).toBe(true)
+      expect(
+        await db
+          .select({ excluded: workflow.forkSyncExcluded })
+          .from(workflow)
+          .where(eq(workflow.workspaceId, newForkId))
+      ).toEqual([{ excluded: false }])
+
+      // The child has nothing deployed, so its fork gets a starter workflow, written in the
+      // same transaction that created the grandchild and its inherited policy.
+      const grandchildId = await createChild(childId)
+      expect(
+        await db
+          .select({ excluded: workflow.forkSyncExcluded })
+          .from(workflow)
+          .where(eq(workflow.workspaceId, grandchildId))
+      ).toEqual([{ excluded: true }])
+
+      await db.update(workspace).set({ archivedAt: new Date() }).where(eq(workspace.id, childId))
+      await setDefault(grandchildId, false)
+      expect(await policyOf(sourceWorkspaceId)).toBe(false)
+      expect(await policyOf(grandchildId)).toBe(false)
+      expect(await policyOf(childId)).toBe(true)
+    } finally {
+      await db.update(workspace).set({ archivedAt: null }).where(eq(workspace.id, childId))
+      await setDefault(sourceWorkspaceId, false)
+    }
+  })
 })
diff --git a/apps/sim/lib/workspaces/create.test.ts b/apps/sim/lib/workspaces/create.test.ts
index a27bbc392c1..fc42089f009 100644
--- a/apps/sim/lib/workspaces/create.test.ts
+++ b/apps/sim/lib/workspaces/create.test.ts
@@ -1,4 +1,9 @@
-import { dbChainMockFns, resetDbChainMock, workflowsPersistenceUtilsMock } from '@sim/testing'
+import {
+  dbChainMock,
+  dbChainMockFns,
+  resetDbChainMock,
+  workflowsPersistenceUtilsMock,
+} from '@sim/testing'
 import {
   workspacesPolicyMock,
   workspacesPolicyMockFns,
@@ -117,7 +122,7 @@ describe('createDefaultPersonalWorkspaceInTransaction', () => {
    */
   it('creates an ungoverned personal workspace and resolves no regime', async () => {
     mockLockWorkspaceCreationContext.mockResolvedValue({ billedAccountUserId: 'user-1' })
-    const tx = { insert: vi.fn(() => ({ values: vi.fn() })) } as unknown as DbOrTx
+    const tx = dbChainMock.db as unknown as DbOrTx
 
     await createDefaultPersonalWorkspaceInTransaction(tx, {
       userId: 'user-1',
diff --git a/apps/sim/lib/workspaces/create.ts b/apps/sim/lib/workspaces/create.ts
index adae897329a..8abfb8d2c99 100644
--- a/apps/sim/lib/workspaces/create.ts
+++ b/apps/sim/lib/workspaces/create.ts
@@ -6,6 +6,7 @@ import { generateId } from '@sim/utils/id'
 import { PlatformEvents } from '@/lib/core/telemetry'
 import type { DbTransaction } from '@/lib/db/types'
 import { buildDefaultWorkflowArtifacts } from '@/lib/workflows/defaults'
+import { buildNewWorkflowRow } from '@/lib/workflows/persistence/new-workflow-row'
 import { saveWorkflowToNormalizedTables } from '@/lib/workflows/persistence/utils'
 import {
   getWorkspaceInvitePolicy,
@@ -153,20 +154,17 @@ export async function createWorkspaceInTransaction(
   await tx.insert(permissions).values(permissionRows)
 
   if (defaultWorkflowArtifacts) {
-    await tx.insert(workflow).values({
-      id: workflowId,
-      userId,
-      workspaceId,
-      folderId: null,
-      name: 'default-agent',
-      description: 'Your first workflow - start building here!',
-      lastSynced: now,
-      createdAt: now,
-      updatedAt: now,
-      isDeployed: false,
-      runCount: 0,
-      variables: {},
-    })
+    await tx.insert(workflow).values(
+      await buildNewWorkflowRow(tx, {
+        id: workflowId,
+        userId,
+        workspaceId,
+        folderId: null,
+        name: 'default-agent',
+        description: 'Your first workflow - start building here!',
+        now,
+      })
+    )
     await saveWorkflowToNormalizedTables(
       workflowId,
       defaultWorkflowArtifacts.workflowState,
diff --git a/packages/db/schema.ts b/packages/db/schema.ts
index 24121b475e6..963adc6c79e 100644
--- a/packages/db/schema.ts
+++ b/packages/db/schema.ts
@@ -2004,20 +2004,12 @@ export const workspace = pgTable(
       { onDelete: 'set null' }
     ),
     /**
-     * Whether a newly created workflow in this workspace starts OUTSIDE fork sync.
+     * Whether a newly created workflow in this workspace starts outside fork sync.
+     * `false` (default): new workflows join sync once deployed. `true`: they land with
+     * `workflow.forkSyncExcluded` set and are opted in on the Forks page.
      *
-     * `false` (the default) preserves the historical opt-out behaviour: a workflow
-     * joins fork sync as soon as it is deployed. `true` makes participation opt-in -
-     * a new workflow lands with `workflow.forkSyncExcluded` set, and an admin selects
-     * it deliberately on the Forks settings page.
-     *
-     * Uniform across a fork lineage: settable from any member, and the write fans out
-     * to every ancestor and descendant so a parent and its forks can never disagree
-     * about what "new" means. Every member holds the same value so reads stay local.
-     * A fork inherits it at creation, like `allowPersonalApiKeys` above.
-     *
-     * Forward-only. Flipping it never rewrites an existing workflow's
-     * `forkSyncExcluded`; the Forks page's checkbox list stays the record of what syncs.
+     * Uniform across a fork lineage (written to every member, inherited by new forks) and
+     * forward-only: flipping it never rewrites an existing workflow's `forkSyncExcluded`.
      */
     forkSyncNewWorkflowsExcluded: boolean('fork_sync_new_workflows_excluded')
       .notNull()
diff --git a/packages/testing/src/mocks/index.ts b/packages/testing/src/mocks/index.ts
index 1f408765f71..ea63009b76c 100644
--- a/packages/testing/src/mocks/index.ts
+++ b/packages/testing/src/mocks/index.ts
@@ -1048,6 +1048,10 @@ export {
   workspaceForkingLineageMock,
   workspaceForkingLineageMockFns,
 } from './workspace-forking-lineage.mock'
+export {
+  workspaceForkingLineageRootMock,
+  workspaceForkingLineageRootMockFns,
+} from './workspace-forking-lineage-root.mock'
 export {
   workspaceForkingMappingStoreMock,
   workspaceForkingMappingStoreMockFns,
diff --git a/packages/testing/src/mocks/workflows-utils.mock.ts b/packages/testing/src/mocks/workflows-utils.mock.ts
index 328502836f1..fe8664804bd 100644
--- a/packages/testing/src/mocks/workflows-utils.mock.ts
+++ b/packages/testing/src/mocks/workflows-utils.mock.ts
@@ -20,7 +20,6 @@ export const workflowsUtilsMockFns = {
   mockWorkflowHasResponseBlock: vi.fn(),
   mockCreateHttpResponseFromBlock: vi.fn(),
   mockValidateWorkflowPermissions: vi.fn(),
-  mockCreateWorkflowRecord: vi.fn(),
   mockUpdateWorkflowRecord: vi.fn(),
   mockDeleteWorkflowRecord: vi.fn(),
   mockSetWorkflowVariables: vi.fn(),
@@ -53,7 +52,6 @@ export const workflowsUtilsMock = {
   workflowHasResponseBlock: workflowsUtilsMockFns.mockWorkflowHasResponseBlock,
   createHttpResponseFromBlock: workflowsUtilsMockFns.mockCreateHttpResponseFromBlock,
   validateWorkflowPermissions: workflowsUtilsMockFns.mockValidateWorkflowPermissions,
-  createWorkflowRecord: workflowsUtilsMockFns.mockCreateWorkflowRecord,
   updateWorkflowRecord: workflowsUtilsMockFns.mockUpdateWorkflowRecord,
   deleteWorkflowRecord: workflowsUtilsMockFns.mockDeleteWorkflowRecord,
   setWorkflowVariables: workflowsUtilsMockFns.mockSetWorkflowVariables,
diff --git a/packages/testing/src/mocks/workspace-forking-lineage-root.mock.ts b/packages/testing/src/mocks/workspace-forking-lineage-root.mock.ts
new file mode 100644
index 00000000000..ac7a908f01e
--- /dev/null
+++ b/packages/testing/src/mocks/workspace-forking-lineage-root.mock.ts
@@ -0,0 +1,37 @@
+import { vi } from 'vitest'
+
+/**
+ * Controllable mock functions for `@/ee/workspace-forking/lib/lineage/lineage-root`.
+ *
+ * Both default to a standalone lineage: `resolveForkLineageRootId` returns the workspace it
+ * was asked about, and `resolveForkLineageWorkspaceIds` returns the root alone. Override per
+ * test to model a moved root or a wider lineage.
+ *
+ * @example
+ * ```ts
+ * import { workspaceForkingLineageRootMockFns } from '@sim/testing/mocks/workspace-forking-lineage-root.mock'
+ *
+ * workspaceForkingLineageRootMockFns.mockResolveForkLineageRootId.mockResolvedValue('root-ws')
+ * ```
+ */
+export const workspaceForkingLineageRootMockFns = {
+  mockResolveForkLineageRootId: vi.fn(
+    async (_executor: unknown, workspaceId: string) => workspaceId
+  ),
+  mockResolveForkLineageWorkspaceIds: vi.fn(async (_executor: unknown, rootId: string) => [rootId]),
+}
+
+/**
+ * Static mock module for `@/ee/workspace-forking/lib/lineage/lineage-root`. Covers every runtime
+ * export production code imports.
+ *
+ * @example
+ * ```ts
+ * vi.mock('@/ee/workspace-forking/lib/lineage/lineage-root', () => workspaceForkingLineageRootMock)
+ * ```
+ */
+export const workspaceForkingLineageRootMock = {
+  resolveForkLineageRootId: workspaceForkingLineageRootMockFns.mockResolveForkLineageRootId,
+  resolveForkLineageWorkspaceIds:
+    workspaceForkingLineageRootMockFns.mockResolveForkLineageWorkspaceIds,
+}