@bevel-software/platform-core-backend 0.22.0 → 0.23.0

package/dist/modules/workspace/workspace.service.d.ts

@@ -87,6 +87,26 @@ export declare class WorkspaceService implements IWorkspaceService {
      * constructed service.
      */
     private readonly gitRunner;
+    /**
+     * Where a working copy of a repository that is no longer the configured
+     * one is kept. THE SAME VALUE THE KB STARTUP PHASE IS GIVEN — what the two
+     * of them move must end up in one place, and omitting it here falls back to
+     * a directory that does not survive a deployment's next recreate.
+     *
+     * Why, in one place: `setAsideRootFor` in `set-aside-clone.ts`.
+     */
+    private readonly setAsideRoot?;
+    /**
+     * What surrounds the setting aside of ONE working copy when a branch is
+     * opened and its clone turns out to be of another repository: given the
+     * workspace id and the move, it runs the move. The composition root
+     * passes what the startup phase does around its own set-asides: the
+     * commit worker held still, the copy's queued commits held back for a
+     * person, the locks on its branch dropped. If it throws, the copy stays
+     * where it was and the branch is refused with that reason. Absent, the
+     * move runs as it is.
+     */
+    private readonly aroundSetAside;
     /** Maps branch → absolute directory path. Lazily populated. */
     private readonly branchDirs;
     /**
@@ -158,7 +178,33 @@ export declare class WorkspaceService implements IWorkspaceService {
      * runner on its default deadline and no token, for a directly
      * constructed service.
      */
-    gitRunner?: IGitRunner);
+    gitRunner?: IGitRunner, 
+    /**
+     * Where a working copy of a repository that is no longer the configured
+     * one is kept. THE SAME VALUE THE KB STARTUP PHASE IS GIVEN — what the two
+     * of them move must end up in one place, and omitting it here falls back to
+     * a directory that does not survive a deployment's next recreate.
+     *
+     * Why, in one place: `setAsideRootFor` in `set-aside-clone.ts`.
+     */
+    setAsideRoot?: string | undefined, 
+    /**
+     * What surrounds the setting aside of ONE working copy when a branch is
+     * opened and its clone turns out to be of another repository: given the
+     * workspace id and the move, it runs the move. The composition root
+     * passes what the startup phase does around its own set-asides: the
+     * commit worker held still, the copy's queued commits held back for a
+     * person, the locks on its branch dropped. If it throws, the copy stays
+     * where it was and the branch is refused with that reason. Absent, the
+     * move runs as it is.
+     */
+    aroundSetAside?: (workspaceId: string, move: () => Promise<void>) => Promise<void>);
+    /**
+     * The set-asides in flight, one per branch. Two callers opening the same
+     * branch both find the clone of another repository; the second waits for
+     * the first's move instead of trying to move a directory that has gone.
+     */
+    private readonly inFlightSetAsides;
     private get kbDirName();
     private readonly kbRepoUrl;
     setDiffService(diffService: IDiffService): void;
@@ -287,6 +333,23 @@ export declare class WorkspaceService implements IWorkspaceService {
      */
     getOrCreateForUser(_user: AuthUser, branch?: string): Promise<WorkspaceInfo>;
     private buildWorkspaceInfo;
+    /**
+     * Publish a finished bootstrap's working copy to the branch→directory cache
+     * — unless the copy was taken out from under it while it ran.
+     *
+     * The save that replaces the knowledge-base repository sets every working
+     * copy aside and clears this cache (`forgetClone`), and a clone takes
+     * seconds: a bootstrap already in flight when that happens finishes
+     * afterwards, and a plain `registerBranchDir` would put the path back. The
+     * directory is gone (set aside), so every reader from then on gets an
+     * ENOENT off the fast path and nothing ever re-clones it — a cache entry
+     * is exactly what stops that.
+     *
+     * Refused rather than retried here: the address this bootstrap cloned from
+     * is not the one configured now, so there is nothing to salvage. The caller
+     * is told, and opening the branch again clones it from the new address.
+     */
+    private adoptBootstrapped;
     /**
      * Await the in-flight bootstrap for a branch (if any). On reject —
      * meaning the clone rolled back — drop the branch→dir mapping so the
@@ -299,6 +362,53 @@ export declare class WorkspaceService implements IWorkspaceService {
      * branch exists again, so there is nothing stale to remove.
      */
     isBootstrapInFlight(branch: string): boolean;
+    /**
+     * Whether the clone at `repoDir` belongs to a repository OTHER than the
+     * configured one.
+     *
+     * Errs towards NO — "could not tell" must never delete someone's work:
+     * an address that cannot be read (no `origin`, a git that would not run)
+     * leaves the clone alone, and only two addresses that are read and differ
+     * in more than their spelling count as different repositories (see
+     * `kb-fs/remote-url.ts`). An UNCONFIGURED address answers no as well: a
+     * process that does not know where the repository is has no business
+     * declaring a clone stale.
+     */
+    private isCloneOfAnotherRepository;
+    /**
+     * How many times each working copy has been taken out from under this
+     * process — see {@link forgetClone}. Deleting from the caches is not enough
+     * on a RUNNING server: work already in flight against the copy that went
+     * away finishes afterwards and writes its result back into those very
+     * caches. So every such reader records the count it started with and checks
+     * it before publishing: a count that moved means what it learned is about a
+     * working copy that no longer exists, and is dropped.
+     *
+     * Keyed by workspace id, which is what the phase announces and what both
+     * readers can derive (`workspaceIdForBranch`).
+     */
+    private readonly discardCount;
+    /**
+     * Both readers and `forgetClone` go through this, so a caller's spelling of
+     * a workspace id can never make them disagree about which working copy is
+     * meant: the id is taken back to its branch and spelled afresh, which is the
+     * one form the phase announces.
+     */
+    private discardKey;
+    private discardsOf;
+    /**
+     * Forget everything this process remembers about a working copy that was
+     * taken away underneath it — the KB startup phase setting aside a clone of a
+     * repository that was replaced.
+     *
+     * At boot there is nothing to forget; this is for the save that changes the
+     * address on a RUNNING server, where `branchDirs` would otherwise keep
+     * answering with the path of a directory that is gone and no later caller
+     * would ever re-clone it. The branch NAME is deliberately left in
+     * `branchesEverHeardOf` — the branch was real, and that record outlives
+     * its clone.
+     */
+    forgetClone(workspaceId: string): void;
     /**
      * Bring an adopted clone's config back to what a fresh clone would carry.
      *
@@ -600,10 +710,10 @@ export declare class WorkspaceService implements IWorkspaceService {
      */
     unzipFile(workspaceId: string, zipWsPath: string, destDirWsPath?: string, 
     /**
-     * Per-extracted-path write guard (ontology-session boundary). Called with
-     * each entry's workspace-relative target before it is written; if it throws,
-     * the entry is skipped (with the thrown message as the reason) rather than
-     * aborting the whole extraction. Omitted by non-agent / human callers.
+     * Per-extracted-path write guard. Called with each entry's
+     * workspace-relative target before it is written; if it throws, the entry
+     * is skipped (with the thrown message as the reason) rather than aborting
+     * the whole extraction. Omitted by non-agent / human callers.
      */
     guardWrite?: (wsRelativePath: string) => Promise<void>): Promise<UnzipResult>;
     getWorkspacePath(workspaceId: string): Promise<string>;

package/dist/modules/workspace/workspace.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.service.d.ts","sourceRoot":"","sources":["../../../src/modules/workspace/workspace.service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEjH,OAAO,EAML,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAa,KAAK,WAAW,EAAwB,MAAM,6BAA6B,CAAC;AAMhG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAa5D,OAAO,EAGL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AAQvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAO9D;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,4HAA4H;IAC5H,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC7C;AAeD;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;aAChB,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM;CAI/C;AAED;;;;;;;;;;GAUG;AACH,qBAAa,gBAAiB,SAAQ,mBAAmB;IAE3C,QAAQ,CAAC,SAAS,EAAE,iBAAiB;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM;IAD/E,QAAQ,CAAC,IAAI,EAAG,cAAc,CAAU;gBACnB,SAAS,EAAE,iBAAiB,EAAW,WAAW,EAAE,MAAM;CAQhF;AAoFD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC;AAElG,qBAAa,gBAAiB,YAAW,iBAAiB;IA0DtD,OAAO,CAAC,QAAQ,CAAC,cAAc;IAW/B,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS;IA9E5B,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IAExD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAoC;IAEvE,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,oGAAoG;IACpG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8B;IAC1D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IACpE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoC;IAC/D;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE;;;;;OAKG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0D;IAEpF;;;OAGG;IACH,OAAO,CAAC,WAAW,CAA6B;IAEhD;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB,CAAgD;gBAGtD,cAAc,EAAE,MAAM;IACvC;;;;;;;;OAQG;IACH,SAAS,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC;IAClC,uFAAuF;IACtE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,eAAe,CAAC,EAClD,IAAI,EAAE,WAAW;IAClC;;;;;;OAMG;IACc,SAAS,GAAE,UAAgC;IAK9D,OAAO,KAAK,SAAS,GAEpB;IAED,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IAEzC,cAAc,CAAC,WAAW,EAAE,YAAY,GAAG,IAAI;IAI/C,0BAA0B,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAIzE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD;;;;OAIG;IACH,kBAAkB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAIlD;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAKzB;;;;;;;OAOG;YACW,gBAAgB;IAgB9B;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAsBpB;;;;;;;OAOG;YACW,eAAe;IAqB7B;;;;;;;;;OASG;IACG,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmBlD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,oBAAoB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IA2CjG;;;;;OAKG;YACW,QAAQ;IAwBtB;;;;OAIG;IACG,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAuGlE;;;;;;OAMG;IACG,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAIlF,OAAO,CAAC,kBAAkB;IAU1B;;;;OAIG;YACW,qBAAqB;IAWnC;;;;OAIG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI5C;;;;;;;;;;;;;;;;;;;OAmBG;YACW,oBAAoB;IAalC;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAK7B,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAA6B;IAE1E;;;;;;;OAOG;YACW,qBAAqB;IA6CnC;;;;;;;;OAQG;YACW,8BAA8B;YAK9B,wBAAwB;IA4HhC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IASrE;;;;OAIG;IACG,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnD,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAKzF,iFAAiF;IACjF,OAAO,CAAC,QAAQ;IAIhB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,iBAAiB;IAYzB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ9D,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ1E;;;;;;;;;;;;;;;;OAgBG;YACW,oBAAoB;IAyClC;;;;;;;;;OASG;IACG,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAgB1E;;;;;;;;;;;;OAYG;IACG,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAyC3E;;;;;OAKG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAuBzB;;;;;;;;;;;OAWG;IACG,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAC/C,OAAO,CAAC,IAAI,CAAC;IA8ChB,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,2BAA2B;IAO7B,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBpE;;;;;;;OAOG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlD;;;;;;;;;OASG;IACG,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCzF;;;;;;;;;;;;OAYG;YACW,qBAAqB;IASnC;;;;;;;;OAQG;IACG,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC;IAQhB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAc5F;;;;;;;;;;;;;;OAcG;IACG,cAAc,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAwB7F;;;;;;;;;;;;;;OAcG;YACW,oBAAoB;IA8BlC;;;;;;;;;;;;;;;OAeG;IACG,SAAS,CACb,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,OAAO,CAAC,IAAI,CAAC;IA6CV,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAczE;;;;;;;OAOG;IACG,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB5E,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB3F;;;;;OAKG;IACG,SAAS,CACb,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM;IACtB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACrD,OAAO,CAAC,WAAW,CAAC;IAyNjB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI5D;;;;;;;OAOG;IACG,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuBrE;;;;;;;;;;;OAWG;IACH,eAAe,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAOxD;;;;;;;;;;;;;;;OAeG;IACG,iBAAiB,CACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAwCnC;;;;;;;;;;;;;;OAcG;IACG,uBAAuB,CAC3B,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,GAC9B,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAkCjC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;YAShB,mBAAmB;YA2CnB,aAAa;CA+F5B"}
+{"version":3,"file":"workspace.service.d.ts","sourceRoot":"","sources":["../../../src/modules/workspace/workspace.service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEjH,OAAO,EAML,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAa,KAAK,WAAW,EAAwB,MAAM,6BAA6B,CAAC;AAMhG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAa5D,OAAO,EAGL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAC;AAWvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAO9D;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,4HAA4H;IAC5H,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC7C;AAeD;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;aAChB,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM;CAI/C;AAED;;;;;;;;;;GAUG;AACH,qBAAa,gBAAiB,SAAQ,mBAAmB;IAE3C,QAAQ,CAAC,SAAS,EAAE,iBAAiB;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM;IAD/E,QAAQ,CAAC,IAAI,EAAG,cAAc,CAAU;gBACnB,SAAS,EAAE,iBAAiB,EAAW,WAAW,EAAE,MAAM;CAQhF;AAoFD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC;AAElG,qBAAa,gBAAiB,YAAW,iBAAiB;IA0DtD,OAAO,CAAC,QAAQ,CAAC,cAAc;IAW/B,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc;IAlGjC,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IAExD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAoC;IAEvE,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,oGAAoG;IACpG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8B;IAC1D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IACpE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoC;IAC/D;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE;;;;;OAKG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0D;IAEpF;;;OAGG;IACH,OAAO,CAAC,WAAW,CAA6B;IAEhD;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB,CAAgD;gBAGtD,cAAc,EAAE,MAAM;IACvC;;;;;;;;OAQG;IACH,SAAS,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC;IAClC,uFAAuF;IACtE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,eAAe,CAAC,EAClD,IAAI,EAAE,WAAW;IAClC;;;;;;OAMG;IACc,SAAS,GAAE,UAAgC;IAC5D;;;;;;;OAOG;IACc,YAAY,CAAC,EAAE,MAAM,YAAA;IACtC;;;;;;;;;OASG;IACc,cAAc,GAAE,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAGtF;IAKb;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoC;IAEtE,OAAO,KAAK,SAAS,GAEpB;IAED,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IAEzC,cAAc,CAAC,WAAW,EAAE,YAAY,GAAG,IAAI;IAI/C,0BAA0B,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAIzE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IAEzD;;;;OAIG;IACH,kBAAkB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAIlD;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAKzB;;;;;;;OAOG;YACW,gBAAgB;IAgB9B;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAsBpB;;;;;;;OAOG;YACW,eAAe;IAqB7B;;;;;;;;;OASG;IACG,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmBlD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,oBAAoB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IA2CjG;;;;;OAKG;YACW,QAAQ;IAwBtB;;;;OAIG;IACG,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IA8KlE;;;;;;OAMG;IACG,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAIlF,OAAO,CAAC,kBAAkB;IAU1B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;;OAIG;YACW,qBAAqB;IAWnC;;;;OAIG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI5C;;;;;;;;;;;OAWG;YACW,0BAA0B;IAsBxC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAE1D;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,UAAU;IAIlB;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAkBtC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,oBAAoB;IAalC;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAK7B,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAA6B;IAE1E;;;;;;;OAOG;YACW,qBAAqB;IA6CnC;;;;;;;;OAQG;YACW,8BAA8B;YAK9B,wBAAwB;IA4HhC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IASrE;;;;OAIG;IACG,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnD,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAKzF,iFAAiF;IACjF,OAAO,CAAC,QAAQ;IAIhB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,iBAAiB;IAYzB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ9D,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ1E;;;;;;;;;;;;;;;;OAgBG;YACW,oBAAoB;IAyClC;;;;;;;;;OASG;IACG,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAgB1E;;;;;;;;;;;;OAYG;IACG,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAyC3E;;;;;OAKG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAuBzB;;;;;;;;;;;OAWG;IACG,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAC/C,OAAO,CAAC,IAAI,CAAC;IAuDhB,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,2BAA2B;IAO7B,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBpE;;;;;;;OAOG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlD;;;;;;;;;OASG;IACG,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCzF;;;;;;;;;;;;OAYG;YACW,qBAAqB;IASnC;;;;;;;;OAQG;IACG,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC;IAQhB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAc5F;;;;;;;;;;;;;;OAcG;IACG,cAAc,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAwB7F;;;;;;;;;;;;;;OAcG;YACW,oBAAoB;IA8BlC;;;;;;;;;;;;;;;OAeG;IACG,SAAS,CACb,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,OAAO,CAAC,IAAI,CAAC;IA6CV,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAczE;;;;;;;OAOG;IACG,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB5E,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB3F;;;;;OAKG;IACG,SAAS,CACb,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM;IACtB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACrD,OAAO,CAAC,WAAW,CAAC;IAyNjB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI5D;;;;;;;OAOG;IACG,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuBrE;;;;;;;;;;;OAWG;IACH,eAAe,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAOxD;;;;;;;;;;;;;;;OAeG;IACG,iBAAiB,CACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAwCnC;;;;;;;;;;;;;;OAcG;IACG,uBAAuB,CAC3B,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,GAC9B,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAkCjC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;YAShB,mBAAmB;YA2CnB,aAAa;CA+F5B"}

package/dist/modules/workspace/workspace.service.js

@@ -15,6 +15,9 @@ import { GitInternalsError, PathNotFoundError, PathTraversalError, UnreadableArc
 import { workspaceIdForBranch, branchForWorkspaceId } from '../../shared/workspace-id.js';
 import { BranchNotFoundError, RemoteBranchGoneError, WorkflowDomainError, isMissingRemoteBranchFailure, } from '../../shared/domain-errors.js';
 import { assertValidBranchName } from '../kb-fs/branch-name.js';
+import { normalizeRepositoryAddress, sameRepository } from '../kb-fs/remote-url.js';
+import { redactSecret, urlQuerySecrets } from '../../shared/redact-secret.js';
+import { setAsideClone, setAsideRootFor, setAsideStamp } from './set-aside-clone.js';
 import { cloneCredentialArgs, cloneCredentialConfigArgs, cloneTrackingConfigArgs, SAFE_IMPLICIT_FETCH_ARGS, } from '../kb-fs/clone-config.js';
 // Zip-bomb guardrails. The upload cap is 50 MB compressed; even a generous
 // 100× expansion ratio still fits inside these limits, so a well-behaved
@@ -142,6 +145,8 @@ export class WorkspaceService {
     kb;
     disk;
     gitRunner;
+    setAsideRoot;
+    aroundSetAside;
     /** Maps branch → absolute directory path. Lazily populated. */
     branchDirs = new Map();
     /**
@@ -213,13 +218,41 @@ export class WorkspaceService {
      * runner on its default deadline and no token, for a directly
      * constructed service.
      */
-    gitRunner = new NodeGitRunner()) {
+    gitRunner = new NodeGitRunner(), 
+    /**
+     * Where a working copy of a repository that is no longer the configured
+     * one is kept. THE SAME VALUE THE KB STARTUP PHASE IS GIVEN — what the two
+     * of them move must end up in one place, and omitting it here falls back to
+     * a directory that does not survive a deployment's next recreate.
+     *
+     * Why, in one place: `setAsideRootFor` in `set-aside-clone.ts`.
+     */
+    setAsideRoot, 
+    /**
+     * What surrounds the setting aside of ONE working copy when a branch is
+     * opened and its clone turns out to be of another repository: given the
+     * workspace id and the move, it runs the move. The composition root
+     * passes what the startup phase does around its own set-asides: the
+     * commit worker held still, the copy's queued commits held back for a
+     * person, the locks on its branch dropped. If it throws, the copy stays
+     * where it was and the branch is refused with that reason. Absent, the
+     * move runs as it is.
+     */
+    aroundSetAside = (_workspaceId, move) => move()) {
         this.workspacesRoot = workspacesRoot;
         this.kb = kb;
         this.disk = disk;
         this.gitRunner = gitRunner;
+        this.setAsideRoot = setAsideRoot;
+        this.aroundSetAside = aroundSetAside;
         this.kbRepoUrl = typeof kbRepoUrl === 'function' ? kbRepoUrl : () => kbRepoUrl;
     }
+    /**
+     * The set-asides in flight, one per branch. Two callers opening the same
+     * branch both find the clone of another repository; the second waits for
+     * the first's move instead of trying to move a directory that has gone.
+     */
+    inFlightSetAsides = new Map();
     get kbDirName() {
         return this.kb.kbDirName;
     }
@@ -526,22 +559,96 @@ export class WorkspaceService {
         }
         // Check disk — the clone may have been bootstrapped by a previous
         // process and survived a restart.
-        try {
-            await fs.access(path.join(repoDir, '.git'));
-            // Migration for clones already on disk: re-stamp the tracking config the
-            // first time this process opens them, so a clone whose config drifted
-            // (duplicate fetch refspec / merge ref) is repaired before anything
-            // pulls it. Once per branch per process — the cached paths above return
-            // before reaching here.
-            await this.normalizeCloneConfig(repoDir, branch);
-            this.registerBranchDir(branch, workspaceDir);
-            return this.buildWorkspaceInfo(branch, workspaceDir);
+        const onDisk = await fs.access(path.join(repoDir, '.git')).then(() => true, () => false);
+        // A clone fetches and pushes through the address stored in its OWN
+        // `remote.origin.url`, which nothing rewrites when the configured
+        // repository changes. Adopting one of the repository that was replaced is
+        // how every later fetch answers "repository not found" — so it is set
+        // aside here and cloned fresh below, the same rule, and the same
+        // destination, as the KB startup phase applies to the whole workspaces
+        // root.
+        //
+        // SET ASIDE, never deleted. The phase sweeps only AFTER it has reached the
+        // configured remote, so that a typo in the address cannot cost anyone
+        // their work. This path has reached nothing: it is a branch being opened,
+        // and it runs in exactly the states where the address is stored but
+        // unproven — a gated boot, a break-glass start, a save that changed the
+        // address before the phase got to it. Deleting on a string difference
+        // there would throw away commits that exist nowhere else because somebody
+        // mistyped a host name.
+        //
+        // OUTSIDE the adoption `try` below, deliberately: a clone that cannot be
+        // moved must fail this call with that reason. Swallowed into "bootstrap
+        // below", it would be found again by the clone step, which sees a
+        // directory with a `.git` in it, calls that already-cloned, and hands back
+        // the very working copy this refused to adopt.
+        // Counted before the disk is looked at: the startup phase may take this
+        // very copy away while the checks below are awaited (`forgetClone`), and a
+        // copy that went must not be registered as the branch's.
+        const discardsAtAdoption = this.discardsOf(id);
+        const setAsideInFlight = this.inFlightSetAsides.get(branch);
+        if (setAsideInFlight) {
+            // Someone else is moving it. Wait, then clone below; a move that failed
+            // refuses this caller with the same reason.
+            await setAsideInFlight;
+        }
+        else if (onDisk && (await this.isCloneOfAnotherRepository(repoDir))) {
+            // Asked again: another caller may have started the move while the
+            // address was being read.
+            const startedMeanwhile = this.inFlightSetAsides.get(branch);
+            if (startedMeanwhile) {
+                await startedMeanwhile;
+            }
+            else {
+                const kept = path.join(setAsideRootFor(this.workspacesRoot, this.setAsideRoot), setAsideStamp(), id);
+                // What surrounds the move may wait, and the startup phase may set
+                // this very copy aside meanwhile. Then there is nothing left to move:
+                // the phase did it, and said so.
+                let moved = false;
+                const moving = this.aroundSetAside(id, async () => {
+                    if (this.discardsOf(id) !== discardsAtAdoption)
+                        return;
+                    await setAsideClone(repoDir, kept);
+                    moved = true;
+                }).finally(() => {
+                    this.inFlightSetAsides.delete(branch);
+                });
+                this.inFlightSetAsides.set(branch, moving);
+                await moving;
+                if (moved) {
+                    log.warn(`the "${branch}" working copy was a clone of another repository. Set aside at ${kept}; nothing was ` +
+                        'deleted, and it is being cloned fresh from the configured one. Work that was never pushed is in ' +
+                        'that folder: `git log` there shows it.');
+                }
+            }
         }
-        catch {
-            // Not on disk — bootstrap below.
+        else if (onDisk) {
+            try {
+                // Migration for clones already on disk: re-stamp the tracking config
+                // the first time this process opens them, so a clone whose config
+                // drifted (duplicate fetch refspec / merge ref) is repaired before
+                // anything pulls it. Once per branch per process — the cached paths
+                // above return before reaching here.
+                await this.normalizeCloneConfig(repoDir, branch);
+                // Taken away meanwhile: nothing to adopt, clone below.
+                if (this.discardsOf(id) !== discardsAtAdoption)
+                    throw new Error('the working copy was set aside');
+                this.registerBranchDir(branch, workspaceDir);
+                return this.buildWorkspaceInfo(branch, workspaceDir);
+            }
+            catch {
+                // No longer worth adopting — bootstrap below.
+            }
         }
         // Single-flight bootstrap. Concurrent callers for the same branch
         // share the first one's promise instead of stacking clones.
+        //
+        // Recorded before any of it: a clone takes seconds, and the save that
+        // replaces the repository can land in the middle of one. Whatever this
+        // bootstrap produces is about the repository configured NOW, so if the
+        // working copy is taken away while it runs (`forgetClone`) the result must
+        // not be published — see `adoptBootstrapped`.
+        const discardsAtBootstrap = this.discardsOf(workspaceIdForBranch(branch));
         let resolveBootstrap;
         let rejectBootstrap;
         const bootstrap = new Promise((res, rej) => {
@@ -552,7 +659,7 @@ export class WorkspaceService {
         const existingBootstrap = this.inFlightBootstraps.get(branch);
         if (existingBootstrap) {
             await existingBootstrap;
-            this.registerBranchDir(branch, workspaceDir);
+            this.adoptBootstrapped(branch, workspaceDir, discardsAtBootstrap);
             return this.buildWorkspaceInfo(branch, workspaceDir);
         }
         this.inFlightBootstraps.set(branch, bootstrap);
@@ -566,7 +673,7 @@ export class WorkspaceService {
             // naturally; seeding the remote is the KB startup phase's job, at boot.
             createdWorkspaceDir = await fs.mkdir(workspaceDir, { recursive: true });
             await this.cloneProcessMapForBranch(workspaceDir, branch);
-            this.registerBranchDir(branch, workspaceDir);
+            this.adoptBootstrapped(branch, workspaceDir, discardsAtBootstrap);
             resolveBootstrap();
         }
         catch (err) {
@@ -611,6 +718,30 @@ export class WorkspaceService {
             kbDirName: this.kbDirName,
         };
     }
+    /**
+     * Publish a finished bootstrap's working copy to the branch→directory cache
+     * — unless the copy was taken out from under it while it ran.
+     *
+     * The save that replaces the knowledge-base repository sets every working
+     * copy aside and clears this cache (`forgetClone`), and a clone takes
+     * seconds: a bootstrap already in flight when that happens finishes
+     * afterwards, and a plain `registerBranchDir` would put the path back. The
+     * directory is gone (set aside), so every reader from then on gets an
+     * ENOENT off the fast path and nothing ever re-clones it — a cache entry
+     * is exactly what stops that.
+     *
+     * Refused rather than retried here: the address this bootstrap cloned from
+     * is not the one configured now, so there is nothing to salvage. The caller
+     * is told, and opening the branch again clones it from the new address.
+     */
+    adoptBootstrapped(branch, workspaceDir, discardsAtStart) {
+        if (this.discardsOf(workspaceIdForBranch(branch)) !== discardsAtStart) {
+            this.branchDirs.delete(branch);
+            throw new Error(`The knowledge-base repository was replaced while the "${branch}" working copy was being created, so ` +
+                'that copy was set aside instead of being used. Open it again to get one of the new repository.');
+        }
+        this.registerBranchDir(branch, workspaceDir);
+    }
     /**
      * Await the in-flight bootstrap for a branch (if any). On reject —
      * meaning the clone rolled back — drop the branch→dir mapping so the
@@ -636,6 +767,94 @@ export class WorkspaceService {
     isBootstrapInFlight(branch) {
         return this.inFlightBootstraps.has(branch);
     }
+    /**
+     * Whether the clone at `repoDir` belongs to a repository OTHER than the
+     * configured one.
+     *
+     * Errs towards NO — "could not tell" must never delete someone's work:
+     * an address that cannot be read (no `origin`, a git that would not run)
+     * leaves the clone alone, and only two addresses that are read and differ
+     * in more than their spelling count as different repositories (see
+     * `kb-fs/remote-url.ts`). An UNCONFIGURED address answers no as well: a
+     * process that does not know where the repository is has no business
+     * declaring a clone stale.
+     */
+    async isCloneOfAnotherRepository(repoDir) {
+        const configured = this.kbRepoUrl().trim();
+        if (configured === '')
+            return false;
+        let origin;
+        try {
+            const { stdout } = await this.gitRunner.run(repoDir, ['config', '--get', 'remote.origin.url']);
+            origin = stdout.trim();
+        }
+        catch {
+            return false;
+        }
+        if (origin === '' || sameRepository(origin, configured))
+            return false;
+        // Normalizing strips the userinfo but KEEPS the query string, and the
+        // knowledge-base address is one that may carry its credential there (a
+        // signed URL — see `urlQuerySecrets`). So the address is scrubbed on the
+        // way into the log, exactly as the startup phase scrubs its own.
+        log.warn(`the "${path.basename(path.dirname(repoDir))}" working copy is a clone of another repository ` +
+            `(${redactSecret(normalizeRepositoryAddress(origin), urlQuerySecrets(origin))}).`);
+        return true;
+    }
+    /**
+     * How many times each working copy has been taken out from under this
+     * process — see {@link forgetClone}. Deleting from the caches is not enough
+     * on a RUNNING server: work already in flight against the copy that went
+     * away finishes afterwards and writes its result back into those very
+     * caches. So every such reader records the count it started with and checks
+     * it before publishing: a count that moved means what it learned is about a
+     * working copy that no longer exists, and is dropped.
+     *
+     * Keyed by workspace id, which is what the phase announces and what both
+     * readers can derive (`workspaceIdForBranch`).
+     */
+    discardCount = new Map();
+    /**
+     * Both readers and `forgetClone` go through this, so a caller's spelling of
+     * a workspace id can never make them disagree about which working copy is
+     * meant: the id is taken back to its branch and spelled afresh, which is the
+     * one form the phase announces.
+     */
+    discardKey(workspaceId) {
+        return workspaceIdForBranch(branchForWorkspaceId(workspaceId));
+    }
+    discardsOf(workspaceId) {
+        return this.discardCount.get(this.discardKey(workspaceId)) ?? 0;
+    }
+    /**
+     * Forget everything this process remembers about a working copy that was
+     * taken away underneath it — the KB startup phase setting aside a clone of a
+     * repository that was replaced.
+     *
+     * At boot there is nothing to forget; this is for the save that changes the
+     * address on a RUNNING server, where `branchDirs` would otherwise keep
+     * answering with the path of a directory that is gone and no later caller
+     * would ever re-clone it. The branch NAME is deliberately left in
+     * `branchesEverHeardOf` — the branch was real, and that record outlives
+     * its clone.
+     */
+    forgetClone(workspaceId) {
+        const branch = branchForWorkspaceId(workspaceId);
+        const workspaceDir = path.join(this.workspacesRoot, workspaceId);
+        const repoDir = path.join(workspaceDir, this.kbDirName);
+        this.discardCount.set(this.discardKey(workspaceId), this.discardsOf(workspaceId) + 1);
+        this.branchDirs.delete(branch);
+        this.lastFetchAt.delete(repoDir);
+        this.lastFetchOk.delete(repoDir);
+        // Dropped as well as un-stamped: the promise still running belongs to the
+        // working copy that went away, so a caller that joined it would be told a
+        // fetch of a directory that is gone refreshed the one that replaced it.
+        // The count above is what stops that promise re-stamping the TTL when it
+        // finally settles.
+        this.inFlightFetches.delete(repoDir);
+        // Keyed by branch, not by directory — see `stampCredentialHelper`.
+        this.stampedCredentialFingerprint.delete(branch);
+    }
     /**
      * Bring an adopted clone's config back to what a fresh clone would carry.
      *
@@ -1154,14 +1373,25 @@ export class WorkspaceService {
         // This driver runs outside the git layer's per-workspace mutex, so it may
         // only run the safe implicit-fetch shape — see `SAFE_IMPLICIT_FETCH_ARGS`
         // in `kb-fs/clone-config.ts` for the full rationale.
+        // What this fetch is ABOUT: the working copy in that directory as it is
+        // now. Should the repository be replaced while the fetch runs, the copy is
+        // set aside and a fresh one is cloned to the SAME path — so stamping the
+        // result afterwards would hand the new clone a freshness it never earned
+        // (or a failure that was the old one's), and the next reader would skip
+        // refreshing it for the whole TTL.
+        const discardsAtFetch = this.discardsOf(workspaceId);
+        const stillTheSameClone = () => this.discardsOf(workspaceId) === discardsAtFetch;
         const promise = this.gitRunner
             .run(repoDir, [...SAFE_IMPLICIT_FETCH_ARGS])
             .then(() => {
+            if (!stillTheSameClone())
+                return;
             this.lastFetchAt.set(repoDir, Date.now());
             this.lastFetchOk.set(repoDir, true);
         })
             .catch((err) => {
-            this.lastFetchOk.set(repoDir, false);
+            if (stillTheSameClone())
+                this.lastFetchOk.set(repoDir, false);
             log.warn('git fetch origin failed:', { detail: redactError(err, this.gitRunner.credentials.token()) });
         })
             .finally(() => {
@@ -1544,10 +1774,10 @@ export class WorkspaceService {
      */
     async unzipFile(workspaceId, zipWsPath, destDirWsPath, 
     /**
-     * Per-extracted-path write guard (ontology-session boundary). Called with
-     * each entry's workspace-relative target before it is written; if it throws,
-     * the entry is skipped (with the thrown message as the reason) rather than
-     * aborting the whole extraction. Omitted by non-agent / human callers.
+     * Per-extracted-path write guard. Called with each entry's
+     * workspace-relative target before it is written; if it throws, the entry
+     * is skipped (with the thrown message as the reason) rather than aborting
+     * the whole extraction. Omitted by non-agent / human callers.
      */
     guardWrite) {
         const { workspaceDir, relativePath: zipRelativePath, absolutePath: zipAbsolute } = await this.resolveInsideRepo(workspaceId, zipWsPath);
@@ -1656,10 +1886,10 @@ export class WorkspaceService {
             const relForReport = path
                 .relative(workspaceDir, targetAbsolute)
                 .replace(/\\/g, '/');
-            // Ontology-session boundary: a write-blocked (or cross-ontology) entry is
-            // skipped, not extracted, so an archive can't be a write path around it.
-            // Runs before any filesystem side effect — including directory creation —
-            // so a blocked entry leaves nothing behind on disk.
+            // An entry the write guard refuses is skipped, not extracted, so an
+            // archive can't be a way around whatever the guard enforces. Runs before
+            // any filesystem side effect — including directory creation — so a
+            // refused entry leaves nothing behind on disk.
             const allowEntry = async () => {
                 if (!guardWrite)
                     return true;
@@ -1668,7 +1898,7 @@ export class WorkspaceService {
                     return true;
                 }
                 catch (err) {
-                    skipped.push({ path: rawName, reason: err instanceof Error ? err.message : 'Blocked by the ontology-session boundary' });
+                    skipped.push({ path: rawName, reason: err instanceof Error ? err.message : 'Refused before it was written' });
                     return false;
                 }
             };