Critical Description
The scenario is as follows:
We start out with the following repository structure:
/folder1/node1
/folder2
Session s1 modifies /folder1 (for instance set a property or add a node, it doesn't matter, as long as it creates a transient item state for /folder1)
Session s2 moves /folder1/node1 to /folder2/node1
Session s2 does a save
Session s1 modifies /folder2/node1 (for instance set a property or add a node, it doesn't matter, as long as it creates a transient item state for node2)
Session s1 does a save
The repository is now inconsistent: /folder1 has a child node entry for node1 whereas node1 has parent id for /folder2
The problem is in the NodeStateMerger.merge method. When on s1.save a merge is attempted on the child node entries of /folder1 the transient state has a child node entry for node1 (which was actually moved to /folder2). This expected. The merger decides to add this node if one of two conditions is true: the child node entry is either in the added set of the change log or it is in the modified set of the change log (the latter because the child node will be in the modified set if it was moved to this node). The latter condition is the problem. Because node1 was modified it is indeed in the modified set and thus added.
However it has a different parent id (the parent id of the folder it was moved to). That means that /folder1 is saved with a child node entry for node1.
Attached is a test case that shows that the above scenario leads to an inconsistency.
Also attached is a proposal for a fix. The fix checks whether the child node entry to be added actually has the state that is currently being merged as its parent and only adds it when it does.