diff --git a/Cargo.lock b/Cargo.lock
index 5e055de1c8..4f97dbb617 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8747,18 +8747,6 @@ dependencies = [
  "syn 2.0.106",
 ]
 
-[[package]]
-name = "reflink-copy"
-version = "0.1.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9dd7ab4af0363d5ccfd2838d782a28196cf32a5cc2e4fe3c5dc83f2be588b8b"
-dependencies = [
- "cfg-if",
- "libc",
- "rustix 1.1.2",
- "windows",
-]
-
 [[package]]
 name = "regex"
 version = "1.12.2"
@@ -11550,7 +11538,6 @@ dependencies = [
  "quartz_nbt",
  "quick-xml 0.38.3",
  "rand 0.8.5",
- "reflink-copy",
  "regex",
  "reqwest 0.12.24",
  "rgb",
diff --git a/Cargo.toml b/Cargo.toml
index a1a4a5b2a5..435c6a8019 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -162,7 +162,6 @@ rand = "=0.8.5"  # Locked on 0.8 until argon2 and p256 update to 0.9
 rand_chacha = "=0.3.1"  # Locked on 0.3 until we can update rand to 0.9
 rdkafka = { version = "0.36.2", features = ["cmake-build"] }
 redis = "1.4.1"
-reflink-copy = "0.1.30"
 regex = "1.12.2"
 reqwest = { version = "0.12.24", default-features = false }
 rgb = "0.8.52"
diff --git a/apps/app-frontend/src/locales/en-US/index.json b/apps/app-frontend/src/locales/en-US/index.json
index e81abe70f9..09f98ec77f 100644
--- a/apps/app-frontend/src/locales/en-US/index.json
+++ b/apps/app-frontend/src/locales/en-US/index.json
@@ -3714,7 +3714,7 @@
     "message": "Adding files ({completed}/{total})"
   },
   "instance.files.managed-content-read-only": {
-    "message": "Managed content is read-only here. Add, disable, update, or remove it from the Content tab."
+    "message": "Manage your installed content via the Content tab"
   },
   "instance.files.save-as": {
     "message": "Save as..."
diff --git a/apps/app-frontend/src/pages/instance/files/index.vue b/apps/app-frontend/src/pages/instance/files/index.vue
index 6cde0e2535..be579b8273 100644
--- a/apps/app-frontend/src/pages/instance/files/index.vue
+++ b/apps/app-frontend/src/pages/instance/files/index.vue
@@ -31,8 +31,7 @@ const debug = useDebugLogger('Files')
 const messages = defineMessages({
 	readOnly: {
 		id: 'instance.files.managed-content-read-only',
-		defaultMessage:
-			'Managed content is read-only here. Add, disable, update, or remove it from the Content tab.',
+		defaultMessage: 'Manage your installed content via the Content tab',
 	},
 	saveAs: {
 		id: 'instance.files.save-as',
@@ -337,9 +336,6 @@ provideFileManager({
 <template>
 	<ReadyTransition :pending="firstPaintPending">
 		<div>
-			<p v-if="isReadOnly(currentPath)" class="m-0 mb-4 text-sm text-secondary">
-				{{ formatMessage(messages.readOnly) }}
-			</p>
 			<FilePageLayout :show-refresh-button="true" />
 		</div>
 	</ReadyTransition>
diff --git a/packages/app-lib/Cargo.toml b/packages/app-lib/Cargo.toml
index 15a1dc9920..9bb14ce8a4 100644
--- a/packages/app-lib/Cargo.toml
+++ b/packages/app-lib/Cargo.toml
@@ -67,7 +67,6 @@ postcard-bindgen = { workspace = true, features = ["generating", "std"], optiona
 quartz_nbt = { workspace = true, features = ["serde"] }
 quick-xml = { workspace = true, features = ["async-tokio"] }
 rand = { workspace = true }
-reflink-copy = { workspace = true }
 regex = { workspace = true }
 reqwest = { workspace = true, features = [
   "brotli",
diff --git a/packages/app-lib/src/launcher/download.rs b/packages/app-lib/src/launcher/download.rs
index 0b8d32907b..6200b86df2 100644
--- a/packages/app-lib/src/launcher/download.rs
+++ b/packages/app-lib/src/launcher/download.rs
@@ -219,6 +219,50 @@ fn should_download(path_exists: bool, force: bool) -> bool {
     !path_exists || force
 }
 
+/// Installed instances can outlive files in the shared runtime cache. Include
+/// processor-generated libraries so recovery also reruns the loader installer.
+pub(super) fn missing_runtime_file(
+    st: &State,
+    version: &GameVersionInfo,
+    java_arch: &str,
+    minecraft_updated: bool,
+) -> crate::Result<Option<std::path::PathBuf>> {
+    let client_path = st
+        .directories
+        .version_dir(&version.id)
+        .join(format!("{}.jar", version.id));
+    if !client_path.try_exists()? {
+        return Ok(Some(client_path));
+    }
+
+    for library in &version.libraries {
+        if let Some(rules) = &library.rules
+            && !parse_rules(
+                rules,
+                java_arch,
+                &QuickPlayType::None,
+                minecraft_updated,
+            )
+        {
+            continue;
+        }
+        if !library.include_in_classpath
+            || library.natives_os_key_and_classifiers(java_arch).is_some()
+        {
+            continue;
+        }
+        let path = st
+            .directories
+            .libraries_dir()
+            .join(d::get_path_from_artifact(&library.name)?);
+        if !path.try_exists()? {
+            return Ok(Some(path));
+        }
+    }
+
+    Ok(None)
+}
+
 fn missing_client_bytes(
     st: &State,
     version: &GameVersionInfo,
diff --git a/packages/app-lib/src/launcher/mod.rs b/packages/app-lib/src/launcher/mod.rs
index 791069479d..73cc7b7bbc 100644
--- a/packages/app-lib/src/launcher/mod.rs
+++ b/packages/app-lib/src/launcher/mod.rs
@@ -846,7 +846,7 @@ pub async fn launch_minecraft(
     }
 
     let state = State::get().await?;
-    let _runtime_lease = state.content_store.runtime_cache_lock.read().await;
+    let mut runtime_lease = state.content_store.runtime_cache_lock.read().await;
 
     let instance_path = get_instance_full_path(&instance.path).await?;
 
@@ -971,6 +971,19 @@ pub async fn launch_minecraft(
         .as_error());
     }
 
+    if let Some(path) = download::missing_runtime_file(
+        &state,
+        &version_info,
+        &java_version.architecture,
+        minecraft_updated,
+    )? {
+        tracing::info!(instance_id = %instance.id, path = %path.display(), "Restoring missing Minecraft runtime files before launch");
+        drop(runtime_lease);
+        install_minecraft_with_reporter(context, false, None).await?;
+        runtime_lease = state.content_store.runtime_cache_lock.read().await;
+    }
+    let _runtime_lease = runtime_lease;
+
     let natives_dir = state.directories.version_natives_dir(&version_jar);
     if !natives_dir.exists() {
         io::create_dir_all(&natives_dir).await?;
diff --git a/packages/app-lib/src/state/content_store/adapters/filesystem.rs b/packages/app-lib/src/state/content_store/adapters/filesystem.rs
index 86a273853e..4253cd0cff 100644
--- a/packages/app-lib/src/state/content_store/adapters/filesystem.rs
+++ b/packages/app-lib/src/state/content_store/adapters/filesystem.rs
@@ -31,10 +31,16 @@ pub(crate) async fn writable_copy(
     source: &Path,
     destination: &Path,
 ) -> crate::Result<()> {
-    fs::copy(source, destination).await?;
+    let mut input = File::open(source).await?;
+    let permissions = input.metadata().await?.permissions();
+    let mut output = File::create(destination).await?;
+    tokio::io::copy(&mut input, &mut output).await?;
+    output.flush().await?;
+    fs::set_permissions(destination, permissions).await?;
     make_writable(destination).await
 }
 
+/*
 pub(crate) async fn try_reflink(
     source: &Path,
     destination: &Path,
@@ -51,8 +57,6 @@ pub(crate) async fn try_reflink(
             Ok(true)
         }
         Err(error) => {
-            // Windows can wrap filesystem errors in an HRESULT. Unwrap it before
-            // deciding whether another storage method can work.
             let error = match error.raw_os_error().map(|code| code as u32) {
                 Some(code)
                     if cfg!(windows) && code & 0xffff0000 == 0x80070000 =>
@@ -83,6 +87,7 @@ pub(crate) async fn try_reflink(
         }
     }
 }
+*/
 
 async fn make_writable(destination: &Path) -> crate::Result<()> {
     let mut permissions = fs::metadata(destination).await?.permissions();
@@ -121,6 +126,7 @@ pub(in crate::state::content_store) async fn move_instance_file(
     Ok(())
 }
 
+#[cfg(windows)]
 pub(crate) fn link_unavailable(error: &std::io::Error) -> bool {
     matches!(
         error.kind(),
@@ -128,6 +134,7 @@ pub(crate) fn link_unavailable(error: &std::io::Error) -> bool {
     ) || cfg!(windows) && matches!(error.raw_os_error(), Some(1 | 50 | 1314))
 }
 
+/*
 pub(in crate::state::content_store) async fn try_hardlink(
     source: &Path,
     target: &Path,
@@ -145,6 +152,7 @@ pub(in crate::state::content_store) async fn try_hardlink(
         Err(error) => Err(error.into()),
     }
 }
+*/
 
 pub(crate) async fn remove_instance_file(path: &Path) -> crate::Result<()> {
     let metadata = fs::symlink_metadata(path).await?;
@@ -182,13 +190,12 @@ pub(crate) async fn remove_instance_file(path: &Path) -> crate::Result<()> {
     Ok(())
 }
 
-/// Returns `None` when sharing is unavailable, without creating a full copy.
-/// Background migration uses this to avoid duplicating existing files just to adopt them.
 pub(crate) async fn try_shared_file(
     source: &Path,
     destination: &Path,
     policy: FileStoragePolicy,
 ) -> crate::Result<Option<FileStorageKind>> {
+    /*
     if try_reflink(source, destination).await? {
         return Ok(Some(FileStorageKind::Reflink));
     }
@@ -197,6 +204,8 @@ pub(crate) async fn try_shared_file(
     {
         return Ok(Some(FileStorageKind::Hardlink));
     }
+    */
+    let _ = (source, destination, policy);
     Ok(None)
 }
 
@@ -212,8 +221,6 @@ pub(crate) async fn create_content_file(
     Ok(FileStorageKind::Copy)
 }
 
-/// Rejects linked parent directories because they can redirect an otherwise valid
-/// relative path outside the instance or store.
 pub(crate) async fn validate_parent_directories(
     root: &Path,
     path: &Path,
diff --git a/packages/app-lib/src/state/content_store/adapters/stored_objects.rs b/packages/app-lib/src/state/content_store/adapters/stored_objects.rs
index 68402a2164..b87f2cdc7f 100644
--- a/packages/app-lib/src/state/content_store/adapters/stored_objects.rs
+++ b/packages/app-lib/src/state/content_store/adapters/stored_objects.rs
@@ -9,8 +9,6 @@ use std::collections::HashSet;
 use std::path::Path;
 use tokio::fs::{self, ReadDir};
 
-/// Visits objects in filesystem order so recovery can register each verified file
-/// before inspecting the next one. A later I/O error does not discard that progress.
 pub(in crate::state::content_store) struct UnregisteredFiles {
     prefixes: ReadDir,
     entries: Option<ReadDir>,
diff --git a/packages/app-lib/src/state/content_store/adapters/verified_files.rs b/packages/app-lib/src/state/content_store/adapters/verified_files.rs
index 29de620e15..27f1b39b93 100644
--- a/packages/app-lib/src/state/content_store/adapters/verified_files.rs
+++ b/packages/app-lib/src/state/content_store/adapters/verified_files.rs
@@ -82,8 +82,6 @@ impl FileStamp {
 }
 
 impl VerifiedFiles {
-    /// Reuses a hash only while identity, size, write time and change time match.
-    /// Filesystems without the required metadata are always read in full.
     pub(in crate::state::content_store) async fn hash_file(
         &self,
         path: &Path,
diff --git a/packages/app-lib/src/state/content_store/commands/cache.rs b/packages/app-lib/src/state/content_store/commands/cache.rs
index 268dda4f8a..095c5a3a08 100644
--- a/packages/app-lib/src/state/content_store/commands/cache.rs
+++ b/packages/app-lib/src/state/content_store/commands/cache.rs
@@ -154,9 +154,6 @@ impl ContentStore {
         .await
     }
 
-    /// Removes unused downloads, starting with the oldest content, to meet the cache limit.
-    /// Installed content and files needed for rollback remain available. `purge_unused`
-    /// also removes recent unused downloads instead of keeping them for another install.
     pub async fn cleanup(
         &self,
         state: &State,
diff --git a/packages/app-lib/src/state/content_store/commands/file_changes.rs b/packages/app-lib/src/state/content_store/commands/file_changes.rs
index 9f67c22c16..832cdeb7b3 100644
--- a/packages/app-lib/src/state/content_store/commands/file_changes.rs
+++ b/packages/app-lib/src/state/content_store/commands/file_changes.rs
@@ -20,16 +20,10 @@ pub(crate) struct PendingFileChange {
     journal: FileChangeJournal,
     pub(crate) stored_file: Option<StoredFileHandle>,
     _previous_file_lease: Option<StoredFileHandle>,
-    /// The failed change needs no further recovery and has preserved or restored the original file.
-    /// Background migration can skip this file and continue with the remaining files.
     pub(crate) safe_to_defer: bool,
 }
 
 impl ContentStore {
-    /// Saves the original file so a failed install, replacement, or removal can be undone.
-    ///
-    /// Recover earlier changes first. Hold the instance and store locks until commit or
-    /// rollback so another content operation cannot invalidate the saved original.
     pub(crate) async fn prepare_file_change(
         &self,
         instance: &Instance,
@@ -179,8 +173,6 @@ impl ContentStore {
         })
     }
 
-    /// Records an enable/disable rename so recovery can undo an interrupted toggle.
-    /// Uses the same recovery and locking requirements as `prepare_file_change`.
     pub(crate) async fn prepare_file_move(
         &self,
         instance: &Instance,
diff --git a/packages/app-lib/src/state/content_store/commands/migration.rs b/packages/app-lib/src/state/content_store/commands/migration.rs
index 8da01fc807..a8237150f6 100644
--- a/packages/app-lib/src/state/content_store/commands/migration.rs
+++ b/packages/app-lib/src/state/content_store/commands/migration.rs
@@ -1,9 +1,86 @@
-use crate::state::State;
-use crate::state::content_store::adapters::filesystem;
 use crate::state::content_store::adapters::sqlite as catalog;
+use crate::state::content_store::adapters::{downloads, filesystem};
+use crate::state::content_store::{
+    FileStorageKind, InstanceFileStatus, content_file_path, input,
+};
 use crate::state::dirs::move_app_directory::{
     relocate_tree, remove_migrated_tree,
 };
+use crate::state::instances::adapters::sqlite::instance_rows;
+use crate::state::{Instance, InstanceFile, InstanceInstallStage, State};
+use futures::{StreamExt, stream};
+use std::io::{Read, Write};
+use std::path::Path;
+use std::time::Instant;
+
+const COPY_CONCURRENCY: usize = 4;
+
+struct PreparedCopy {
+    temporary: tempfile::TempPath,
+    source: std::fs::File,
+    metadata: std::fs::Metadata,
+    hashes: crate::util::content_hash::FileHashes,
+}
+
+async fn prepare_copy(path: &Path) -> crate::Result<PreparedCopy> {
+    let path = path.to_path_buf();
+    tokio::task::spawn_blocking(move || -> crate::Result<PreparedCopy> {
+        let parent =
+            path.parent().ok_or_else(|| input("Invalid content path"))?;
+        let mut source = std::fs::File::open(&path)?;
+        let metadata = source.metadata()?;
+        if !metadata.is_file()
+            || std::fs::symlink_metadata(&path)?.file_type().is_symlink()
+        {
+            return Err(input("Managed content is not a regular file"));
+        }
+        filesystem::require_staging_space(parent, metadata.len())?;
+        let (mut output, temporary) =
+            tempfile::NamedTempFile::new_in(parent)?.into_parts();
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            output.set_permissions(std::fs::Permissions::from_mode(
+                metadata.permissions().mode() | 0o200,
+            ))?;
+        }
+        let mut hasher = crate::util::content_hash::ContentHasher::default();
+        let mut buffer = vec![0; 256 * 1024];
+        let mut size = 0;
+        loop {
+            let read = source.read(&mut buffer)?;
+            if read == 0 {
+                break;
+            }
+            output.write_all(&buffer[..read])?;
+            hasher.update(&buffer[..read]);
+            size += read as u64;
+        }
+        output.sync_all()?;
+        Ok(PreparedCopy {
+            temporary,
+            source,
+            metadata,
+            hashes: hasher.finish(size),
+        })
+    })
+    .await?
+}
+
+fn source_unchanged(
+    prepared: &PreparedCopy,
+    path: &Path,
+) -> crate::Result<bool> {
+    let current = std::fs::symlink_metadata(path)?;
+    if !current.is_file()
+        || current.len() != prepared.metadata.len()
+        || current.modified()? != prepared.metadata.modified()?
+    {
+        return Ok(false);
+    }
+    Ok(same_file::Handle::from_file(prepared.source.try_clone()?)?
+        == same_file::Handle::from_path(path)?)
+}
 
 pub(crate) async fn migrate(state: &State) -> crate::Result<()> {
     let store = &state.content_store;
@@ -38,3 +115,243 @@ pub(crate) async fn migrate(state: &State) -> crate::Result<()> {
     store.recover_unregistered_files().await?;
     Ok(())
 }
+
+pub(crate) async fn migrate_instance_copies(
+    state: &State,
+) -> crate::Result<()> {
+    let store = &state.content_store;
+    for instance in
+        crate::state::instances::load_instance_rows(&state.pool).await?
+    {
+        let files = store.instance_files_with_storage(&instance).await;
+        let files = match files {
+            Ok(files) => files,
+            Err(error) => {
+                tracing::warn!(
+                    instance_id = %instance.id,
+                    "Content copy migration deferred: {error}",
+                );
+                continue;
+            }
+        };
+        let pending: Vec<_> = files
+            .into_iter()
+            .filter(|(_, binding)| {
+                binding.storage_kind != FileStorageKind::Copy
+            })
+            .collect();
+        if pending.is_empty() {
+            continue;
+        }
+        let started = Instant::now();
+        let total = pending.len();
+        tracing::info!(instance_id = %instance.id, total, concurrency = COPY_CONCURRENCY, "Content copy migration started");
+        let mut completed = 0usize;
+        let mut deferred = 0usize;
+        let mut migrations = stream::iter(pending)
+            .map(|(file, binding)| {
+                let instance = &instance;
+                async move {
+                    let result = migrate_file_copy(
+                        state,
+                        instance,
+                        &file,
+                        &binding.blob_sha512,
+                    )
+                    .await;
+                    (file.id, result)
+                }
+            })
+            .buffer_unordered(COPY_CONCURRENCY);
+        while let Some((file_id, result)) = migrations.next().await {
+            match result {
+                Ok(true) => completed += 1,
+                Ok(false) => deferred += 1,
+                Err(error) => {
+                    deferred += 1;
+                    tracing::warn!(instance_id = %instance.id, %file_id, "Content copy migration deferred: {error}");
+                }
+            }
+            tracing::info!(instance_id = %instance.id, completed, deferred, total,
+				elapsed_ms = started.elapsed().as_millis() as u64, "Content copy migration progress");
+        }
+        tracing::info!(instance_id = %instance.id, completed, deferred, total,
+			elapsed_ms = started.elapsed().as_millis() as u64, "Content copy migration pass finished");
+    }
+    Ok(())
+}
+
+async fn migrate_file_copy(
+    state: &State,
+    instance: &Instance,
+    file: &InstanceFile,
+    expected_sha512: &str,
+) -> crate::Result<bool> {
+    let store = &state.content_store;
+    let started = Instant::now();
+    if instance.install_stage != InstanceInstallStage::Installed
+        || crate::state::instance_has_running_process(&instance.id, state)
+            .await?
+        || instance_rows::is_instance_quarantined(&instance.id, &state.pool)
+            .await?
+    {
+        return Ok(false);
+    }
+    let original_path = store
+        .instance_path(&instance.path, &content_file_path(file))
+        .await?;
+    let prepared = prepare_copy(&original_path).await?;
+    let copy_ms = started.elapsed().as_millis() as u64;
+    let waiting = Instant::now();
+    let _turn = store.legacy_migration_priority.read().await;
+    let _instance = state.lock_instance_content(&instance.id).await;
+    let _files = store.files_lock.lock().await;
+    let lock_wait_ms = waiting.elapsed().as_millis() as u64;
+    let Some(instance) =
+        instance_rows::get_instance_by_id(&instance.id, &state.pool).await?
+    else {
+        return Ok(false);
+    };
+    if instance.install_stage != InstanceInstallStage::Installed
+        || crate::state::instance_has_running_process(&instance.id, state)
+            .await?
+        || instance_rows::is_instance_quarantined(&instance.id, &state.pool)
+            .await?
+    {
+        return Ok(false);
+    }
+    let Some(file) =
+        crate::state::instances::get_instance_file_by_relative_path(
+            &instance.id,
+            &file.relative_path,
+            &state.pool,
+        )
+        .await?
+        .filter(|current| current.id == file.id)
+    else {
+        return Ok(false);
+    };
+    let Some(binding) = catalog::file_storage(&state.pool, &file.id).await?
+    else {
+        return Ok(false);
+    };
+    if binding.storage_kind == FileStorageKind::Copy {
+        return Ok(false);
+    }
+    let path = store
+        .instance_path(&instance.path, &content_file_path(&file))
+        .await?;
+    if path != original_path
+        || binding.blob_sha512 != expected_sha512
+        || !source_unchanged(&prepared, &path)?
+    {
+        tracing::debug!(file_id = %file.id, "Content copy migration source changed; retrying later");
+        return Ok(false);
+    }
+    if prepared.hashes.sha512 != binding.blob_sha512 {
+        if binding.storage_kind != FileStorageKind::Hardlink {
+            return Err(input(
+                "Changed instance content must be re-imported before migration",
+            ));
+        }
+        if store.any_instance_running(state).await? {
+            return Err(input(
+                "Stop Minecraft instances before repairing shared content",
+            ));
+        }
+        let stored = catalog::find_file(&state.pool, &binding.blob_sha512)
+            .await?
+            .ok_or_else(|| {
+                input("Managed content has no stored file record")
+            })?;
+        if store.is_healthy(&stored, true).await? {
+            if let Some(healthy) =
+                store.lookup(Some(&stored.sha512), None).await?
+            {
+                store.restore_quarantined_hardlinks(&healthy).await?;
+            }
+        } else {
+            let mut sources = catalog::file_sources(&stored)?;
+            if sources.is_empty() {
+                sources = downloads::repair_sources(
+                    &state.pool,
+                    &stored.sha512,
+                    state,
+                )
+                .await;
+            }
+            if sources.is_empty() {
+                return Err(input(
+                    "Damaged shared content must be re-imported before migration",
+                ));
+            }
+            store.repair_stored_file(&stored, &sources, state).await?;
+        }
+        if store
+            .check_instance_file(&instance, &file, &binding)
+            .await?
+            != InstanceFileStatus::Healthy
+        {
+            return Err(input(
+                "Damaged instance content could not be repaired before migration",
+            ));
+        }
+        return Ok(false);
+    }
+    let parent = path.parent().ok_or_else(|| input("Invalid content path"))?;
+    let bytes = prepared.hashes.size;
+    let temporary = prepared.temporary;
+    let publishing = Instant::now();
+    let destination = path.clone();
+    tokio::task::spawn_blocking(move || {
+        replace_file_copy(temporary, &destination)
+    })
+    .await??;
+    filesystem::sync_directory(parent).await?;
+    let replace_ms = publishing.elapsed().as_millis() as u64;
+    let committing = Instant::now();
+    let mut tx = state.pool.begin().await?;
+    catalog::set_file_storage(
+        &mut tx,
+        &file.id,
+        &binding.blob_sha512,
+        FileStorageKind::Copy,
+    )
+    .await?;
+    tx.commit().await?;
+    tracing::info!(instance_id = %instance.id, file_id = %file.id, bytes, copy_ms,
+		lock_wait_ms, replace_ms, commit_ms = committing.elapsed().as_millis() as u64,
+		elapsed_ms = started.elapsed().as_millis() as u64, "Content copy migration file completed");
+    Ok(true)
+}
+
+fn replace_file_copy(
+    temporary: tempfile::TempPath,
+    destination: &std::path::Path,
+) -> std::io::Result<()> {
+    let mut temporary = tempfile::TempPath::from_path(
+        temporary.keep().map_err(|error| error.error)?,
+    );
+    #[cfg(windows)]
+    let original = {
+        use std::os::windows::fs::OpenOptionsExt;
+        use windows::Win32::Storage::FileSystem::{
+            FILE_READ_ATTRIBUTES, FILE_WRITE_ATTRIBUTES,
+        };
+        let file = std::fs::OpenOptions::new()
+            .access_mode(FILE_READ_ATTRIBUTES.0 | FILE_WRITE_ATTRIBUTES.0)
+            .open(destination)?;
+        let permissions = file.metadata()?.permissions();
+        let mut writable = permissions.clone();
+        writable.set_readonly(false);
+        file.set_permissions(writable)?;
+        (file, permissions)
+    };
+    let result = std::fs::rename(&temporary, destination);
+    if result.is_ok() {
+        temporary.disable_cleanup(true);
+    }
+    #[cfg(windows)]
+    original.0.set_permissions(original.1)?;
+    result
+}
diff --git a/packages/app-lib/src/state/content_store/commands/mod.rs b/packages/app-lib/src/state/content_store/commands/mod.rs
index 1d20f010ac..b5242172f1 100644
--- a/packages/app-lib/src/state/content_store/commands/mod.rs
+++ b/packages/app-lib/src/state/content_store/commands/mod.rs
@@ -8,4 +8,4 @@ mod recovery;
 mod verify_content;
 
 pub(crate) use file_changes::PendingFileChange;
-pub(crate) use migration::migrate;
+pub(crate) use migration::{migrate, migrate_instance_copies};
diff --git a/packages/app-lib/src/state/content_store/commands/recovery.rs b/packages/app-lib/src/state/content_store/commands/recovery.rs
index f58dd7485b..2278cd35ef 100644
--- a/packages/app-lib/src/state/content_store/commands/recovery.rs
+++ b/packages/app-lib/src/state/content_store/commands/recovery.rs
@@ -231,8 +231,6 @@ impl ContentStore {
         self.finish_journal(journal).await
     }
 
-    /// Recovers stored files that reached disk before a crash prevented their database entry.
-    /// Checks each file against its expected hash before making it available for reuse.
     pub(crate) async fn recover_unregistered_files(&self) -> crate::Result<()> {
         let known = catalog::known_hashes(&self.pool).await?;
         let Some(mut files) =
diff --git a/packages/app-lib/src/state/content_store/commands/verify_content.rs b/packages/app-lib/src/state/content_store/commands/verify_content.rs
index f812829733..021c294c01 100644
--- a/packages/app-lib/src/state/content_store/commands/verify_content.rs
+++ b/packages/app-lib/src/state/content_store/commands/verify_content.rs
@@ -115,7 +115,16 @@ impl ContentStore {
         }
         if !restoration_pending {
             for path in quarantined {
-                filesystem::remove_unused_file(&path).await?;
+                let name = path
+                    .file_name()
+                    .ok_or_else(|| input("Invalid quarantined content path"))?;
+                let backup = self.root.join("recovered-content").join(name);
+                filesystem::move_instance_file(&path, &backup).await?;
+                tracing::warn!(
+                    sha512 = %stored_file.metadata.sha512,
+                    path = %backup.display(),
+                    "Preserved original content after repair; remove this recovery file manually when no longer needed",
+                );
             }
         }
         Ok(())
@@ -228,7 +237,7 @@ impl ContentStore {
         Ok(report)
     }
 
-    async fn repair_stored_file(
+    pub(in crate::state::content_store) async fn repair_stored_file(
         &self,
         stored_file: &StoredFileMetadata,
         sources: &[String],
diff --git a/packages/app-lib/src/state/content_store/mod.rs b/packages/app-lib/src/state/content_store/mod.rs
index 817df49c62..e44dee2541 100644
--- a/packages/app-lib/src/state/content_store/mod.rs
+++ b/packages/app-lib/src/state/content_store/mod.rs
@@ -1,19 +1,3 @@
-//! Reuses downloaded and imported mods and packs across instances.
-//!
-//! Files are identified by their SHA-512 hash, so installing the same content again
-//! can reuse the stored file without another download. Each instance still has its
-//! own file path. We prefer reflinks, then hardlinks, then an ordinary copy when
-//! the filesystem cannot share the data.
-//!
-//! Reflinks let an instance change its file without changing the stored original.
-//! Hardlinks share the original file, so app content updates replace the instance
-//! file rather than writing into it. The Files tab prevents edits to managed content.
-//!
-//! Cleanup keeps files needed by installed content, unfinished changes, and install
-//! backups even when the unused-cache limit is exceeded. If a change is interrupted,
-//! recovery restores the previous files. It preserves files changed outside the app
-//! and reports conflicts instead of overwriting them.
-
 mod adapters;
 mod commands;
 mod domain;
@@ -30,7 +14,9 @@ pub(crate) use adapters::sqlite::{
     file_storage, find_file, instance_storage, retained_owners,
     set_file_storage, set_setting, setting,
 };
-pub(crate) use commands::{PendingFileChange, migrate};
+pub(crate) use commands::{
+    PendingFileChange, migrate, migrate_instance_copies,
+};
 pub(crate) use domain::{
     content_file_path, file_path_on_disk, is_managed_content_path, normalize,
     object_relative_path, relative_link, validate_digest, validate_relative,
diff --git a/packages/app-lib/src/state/content_store/model/instance_file.rs b/packages/app-lib/src/state/content_store/model/instance_file.rs
index 712e6c858e..645c686882 100644
--- a/packages/app-lib/src/state/content_store/model/instance_file.rs
+++ b/packages/app-lib/src/state/content_store/model/instance_file.rs
@@ -5,8 +5,6 @@ pub(crate) enum InstanceFileStatus {
     Conflict,
 }
 
-/// Keeps one observation of a path so recovery can compare both journal hashes
-/// without reading the file twice. Non-file entries always remain conflicts.
 pub(in crate::state::content_store) enum InstancePathContent {
     Missing,
     File(String),
diff --git a/packages/app-lib/src/state/content_store/model/storage.rs b/packages/app-lib/src/state/content_store/model/storage.rs
index 7e517472be..d60c085e9c 100644
--- a/packages/app-lib/src/state/content_store/model/storage.rs
+++ b/packages/app-lib/src/state/content_store/model/storage.rs
@@ -18,9 +18,6 @@ pub(crate) enum FileStorageKind {
     Copy,
 }
 
-/// Controls whether changing an instance file can also change the stored original.
-/// Use `Independent` when edits must stay local to the instance. Reflinks meet this
-/// requirement because the filesystem separates the data when either file changes.
 #[derive(Clone, Copy)]
 pub(crate) enum FileStoragePolicy {
     Shared,
diff --git a/packages/app-lib/src/state/content_store/store.rs b/packages/app-lib/src/state/content_store/store.rs
index 94c69ee11a..197adbe045 100644
--- a/packages/app-lib/src/state/content_store/store.rs
+++ b/packages/app-lib/src/state/content_store/store.rs
@@ -22,7 +22,6 @@ pub struct ContentStore {
     pub(super) publish_locks: [Mutex<()>; 64],
     pub(crate) files_lock: Mutex<()>,
     pub(super) verified_files: VerifiedFiles,
-    /// Lets Play prioritize the selected instance over migration of other instances.
     pub(crate) legacy_migration_priority: RwLock<()>,
     _process_lock: File,
     _content_process_lock: Option<File>,
@@ -98,8 +97,6 @@ impl ContentStore {
     }
 }
 
-/// Content ready to read or install. Keep the handle while using the file so cache
-/// cleanup cannot delete it midway through the operation.
 #[derive(Clone, Debug)]
 pub(crate) struct StoredFileHandle {
     pub metadata: StoredFileMetadata,
@@ -107,8 +104,6 @@ pub(crate) struct StoredFileHandle {
     pub(super) _guard: Arc<OwnedRwLockReadGuard<()>>,
 }
 
-/// Locates content for repair, including files that are missing or damaged.
-/// Unlike `StoredFileHandle`, this does not guarantee that the file is usable.
 #[derive(Clone, Debug)]
 pub(crate) struct StoredFileRecord {
     pub metadata: StoredFileMetadata,
diff --git a/packages/app-lib/src/state/mod.rs b/packages/app-lib/src/state/mod.rs
index 97f23948a5..f2c6cf6970 100644
--- a/packages/app-lib/src/state/mod.rs
+++ b/packages/app-lib/src/state/mod.rs
@@ -188,6 +188,16 @@ impl State {
         state
             .startup_complete
             .store(true, std::sync::atomic::Ordering::Release);
+        tokio::spawn(async move {
+            loop {
+                if let Err(error) =
+                    content_store::migrate_instance_copies(state).await
+                {
+                    tracing::warn!("Content copy migration deferred: {error}");
+                }
+                tokio::time::sleep(std::time::Duration::from_secs(10)).await;
+            }
+        });
         tokio::spawn(async move {
             let mut interval =
                 tokio::time::interval(std::time::Duration::from_secs(600));