@ricsam/r5d-worker 0.0.61 → 0.0.63

package/dist/cjs/main.cjs

@@ -1032,6 +1032,19 @@ function checkoutVisibleBranch(input) {
   }
   runGit(["checkout", "--no-recurse-submodules", "-B", input.branchName], { cwd: input.branchPath });
 }
+function reconcileRewrittenCanonicalHistory(input) {
+  const remoteRef = `refs/remotes/origin/${input.branchName}`;
+  if (!tryGit(["rev-parse", "--verify", "HEAD"], { cwd: input.branchPath })) return;
+  if (!tryGit(["show-ref", "--verify", "--quiet", remoteRef], { cwd: input.branchPath })) return;
+  if (tryGit(["merge-base", "HEAD", remoteRef], { cwd: input.branchPath })) return;
+  if (hasWorktreeChanges(input.branchPath)) return;
+  const localTree = runGit(["rev-parse", "HEAD^{tree}"], { cwd: input.branchPath });
+  const remoteTree = runGit(["rev-parse", `${remoteRef}^{tree}`], { cwd: input.branchPath });
+  if (localTree !== remoteTree) return;
+  const previousHead = runGit(["rev-parse", "HEAD"], { cwd: input.branchPath });
+  runGit(["update-ref", `refs/r5d/pre-canonical-checkout/${previousHead}`, previousHead], { cwd: input.branchPath });
+  runGit(["checkout", "--no-recurse-submodules", "-B", input.branchName, remoteRef], { cwd: input.branchPath });
+}
 function migrateExistingCheckoutToRequiredRemote(input) {
   if (originRemoteUrl(input.branchPath) === input.remoteUrl) return;
   const dirtyWorkingTree = hasWorktreeChanges(input.branchPath);
@@ -1139,6 +1152,9 @@ function ensureVisibleGitCheckout(input) {
   if (input.requireRemoteBranch && !tryGit(["show-ref", "--verify", "--quiet", `refs/remotes/origin/${input.branchName}`], { cwd: branchPath })) {
     throw new Error(`Existing checkout for ${input.branchName} does not contain its canonical remote branch`);
   }
+  if (input.requireRemoteBranch) {
+    reconcileRewrittenCanonicalHistory({ branchPath, branchName: input.branchName });
+  }
   if (input.requiredBaseCommit) {
     assertCheckoutDerivedFromRequiredBase({
       branchPath,
@@ -2489,6 +2505,7 @@ async function startWorker(options) {
             requestId: options2.requestId,
             trigger,
             dirtyGeneration: snapshot2.dirtyGeneration,
+            visibleBaselineHead: workspaceConvergence.visibleBaselineHead(),
             explicit: true,
             workInFlight: false,
             requestedAt: Date.now()
@@ -2525,6 +2542,7 @@ async function startWorker(options) {
           requestId,
           trigger,
           dirtyGeneration: snapshot.dirtyGeneration,
+          visibleBaselineHead: workspaceConvergence.visibleBaselineHead(),
           explicit: options2.requestId !== void 0,
           workInFlight: false,
           requestedAt: Date.now()
@@ -2728,6 +2746,7 @@ async function startWorker(options) {
         const newVisibleCheckouts = [...newVisibleCheckoutByKey.values()];
         const input = workspaceSyncInput(trigger, {
           ...overrides,
+          ...shouldEnsureCheckouts && !trigger.canonicalCheckoutOnly ? { visibleBaselineHead: workspaceConvergence.visibleBaselineHead() } : {},
           ...newVisibleCheckouts.length > 0 ? { newVisibleCheckouts } : {}
         });
         synchronizeStartedAt = Date.now();
@@ -2845,7 +2864,8 @@ async function startWorker(options) {
           canonicalResolverCheckout: true,
           browserPortForwarding: true,
           globalWorkspaceSyncLeaseV1: true,
-          eventualWorkspaceSyncV1: true
+          eventualWorkspaceSyncV1: true,
+          workspaceIncidentCandidatePinV1: true
         },
         projectRoot: projectsRoot,
         artifactRoot,
@@ -2912,7 +2932,15 @@ async function startWorker(options) {
             hydrateVisible: firstBootstrap && !activeWorkspaceIncidentId
           });
           if (!workspaceManifestRevision.isCurrent(revisionToken)) return false;
-          workspaceConvergence.setLocalHead(bootstrapped.localHead);
+          if ((0, import_workspace_convergence.workspaceBootstrapEstablishesVisibleBaseline)({
+            hydrated: bootstrapped.hydrated,
+            firstBootstrap,
+            incidentActive: Boolean(activeWorkspaceIncidentId),
+            currentLocalHead: workspaceConvergence.snapshot().localHead,
+            currentVisibleBaselineHead: workspaceConvergence.visibleBaselineHead()
+          })) {
+            workspaceConvergence.setLocalHead(bootstrapped.localHead);
+          }
           workspaceConvergence.observeCanonicalHead(bootstrapped.canonicalHead);
           for (const checkout of currentCheckouts) {
             const manifest = manifestByProjectId.get(checkout.projectId);
@@ -2985,6 +3013,7 @@ async function startWorker(options) {
             quarantineRef: message.quarantineRef,
             confirmedLargeDiff: message.confirmedLargeDiff,
             confirmationReason: message.confirmationReason,
+            expectedIncidentCandidateHead: message.expectedIncidentCandidateHead,
             resetToCanonical: message.resetToCanonical,
             skipVisibleMirror: message.skipVisibleMirror
           }
@@ -3063,6 +3092,7 @@ async function startWorker(options) {
                 attemptId: message.attemptId,
                 quarantineRef: message.quarantineRef,
                 expectedCanonicalHead: message.expectedHead,
+                visibleBaselineHead: publication.visibleBaselineHead,
                 newVisibleCheckouts: [...createdCheckouts, ...pendingTargets]
               })
             );
@@ -3140,6 +3170,7 @@ async function startWorker(options) {
             published: true
           });
         } else if (message.status === "blocked" && workspaceIncidentOrdering.permitsBlockedResponse(message.incidentId)) {
+          if (message.visibleBaselineHead) workspaceConvergence.setVisibleBaselineHead(message.visibleBaselineHead);
           workspaceConvergence.block();
           if (message.incidentId) activeWorkspaceIncidentId = message.incidentId;
         } else {
@@ -3191,7 +3222,11 @@ async function startWorker(options) {
       if (message.type === "workspace_incident_updated") {
         workspaceIncidentOrdering.observe(message);
         const previousIncidentId = activeWorkspaceIncidentId;
-        activeWorkspaceIncidentId = (0, import_workspace_incident_state.applyWorkspaceIncidentUpdate)(activeWorkspaceIncidentId, message);
+        const nextIncidentId = (0, import_workspace_incident_state.applyWorkspaceIncidentUpdate)(activeWorkspaceIncidentId, message);
+        if (message.incidentId && (previousIncidentId === message.incidentId || nextIncidentId === message.incidentId) && message.originWorkerLabel === label && message.visibleBaselineHead) {
+          workspaceConvergence.setVisibleBaselineHead(message.visibleBaselineHead);
+        }
+        activeWorkspaceIncidentId = nextIncidentId;
         const releasedHead = (0, import_workspace_incident_state.releasePendingWorkspaceHead)(
           previousIncidentId,
           activeWorkspaceIncidentId,

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.61",
+  "version": "0.0.63",
   "type": "commonjs"
 }

package/dist/cjs/workspace-convergence.cjs

@@ -36,6 +36,7 @@ __export(workspace_convergence_exports, {
   processWorkspaceConvergenceState: () => processWorkspaceConvergenceState,
   readWorkspaceConvergenceState: () => readWorkspaceConvergenceState,
   waitForWorkspacePublicationOnShutdown: () => waitForWorkspacePublicationOnShutdown,
+  workspaceBootstrapEstablishesVisibleBaseline: () => workspaceBootstrapEstablishesVisibleBaseline,
   workspacePublicationIncidentAction: () => workspacePublicationIncidentAction,
   workspacePublicationTelemetry: () => workspacePublicationTelemetry
 });
@@ -113,6 +114,7 @@ class ExplicitWorkspacePublicationQueue {
 }
 const EMPTY_STATE = {
   localHead: null,
+  visibleBaselineHead: null,
   desiredCanonicalHead: null,
   dirtyGeneration: 0,
   publishedGeneration: 0
@@ -126,11 +128,12 @@ function validGeneration(value) {
 function readWorkspaceConvergenceState(statePath) {
   try {
     const parsed = JSON.parse(import_node_fs.default.readFileSync(statePath, "utf8"));
-    if (!validHead(parsed.localHead) || !validHead(parsed.desiredCanonicalHead) || !validGeneration(parsed.dirtyGeneration) || !validGeneration(parsed.publishedGeneration) || parsed.publishedGeneration > parsed.dirtyGeneration) {
+    if (!validHead(parsed.localHead) || !(parsed.visibleBaselineHead === void 0 || validHead(parsed.visibleBaselineHead)) || !validHead(parsed.desiredCanonicalHead) || !validGeneration(parsed.dirtyGeneration) || !validGeneration(parsed.publishedGeneration) || parsed.publishedGeneration > parsed.dirtyGeneration) {
       return { ...EMPTY_STATE };
     }
     return {
       localHead: parsed.localHead,
+      visibleBaselineHead: parsed.visibleBaselineHead === void 0 ? parsed.localHead : parsed.visibleBaselineHead,
       desiredCanonicalHead: parsed.desiredCanonicalHead,
       dirtyGeneration: parsed.dirtyGeneration,
       publishedGeneration: parsed.publishedGeneration
@@ -149,11 +152,26 @@ class WorkspaceConvergenceState {
   state;
   publicationState;
   snapshot() {
-    return { ...this.state, publicationState: this.publicationState };
+    return {
+      localHead: this.state.localHead,
+      desiredCanonicalHead: this.state.desiredCanonicalHead,
+      dirtyGeneration: this.state.dirtyGeneration,
+      publishedGeneration: this.state.publishedGeneration,
+      publicationState: this.publicationState
+    };
+  }
+  visibleBaselineHead() {
+    return this.state.visibleBaselineHead;
   }
   setLocalHead(localHead) {
     if (!validHead(localHead)) throw new Error("Invalid local workspace head");
     this.state.localHead = localHead;
+    this.state.visibleBaselineHead = localHead;
+    this.persist();
+  }
+  setVisibleBaselineHead(visibleBaselineHead) {
+    if (!validHead(visibleBaselineHead)) throw new Error("Invalid visible workspace baseline head");
+    this.state.visibleBaselineHead = visibleBaselineHead;
     this.persist();
   }
   observeCanonicalHead(canonicalHead) {
@@ -207,6 +225,7 @@ class WorkspaceConvergenceState {
     if (input.published) {
       this.state.publishedGeneration = Math.max(this.state.publishedGeneration, input.generation);
       this.state.localHead = input.canonicalHead;
+      this.state.visibleBaselineHead = input.canonicalHead;
       this.state.desiredCanonicalHead = input.canonicalHead;
     }
     this.publicationState = this.state.dirtyGeneration > this.state.publishedGeneration ? "scheduled" : "idle";
@@ -229,6 +248,10 @@ function processWorkspaceConvergenceState(statePath) {
   PROCESS_WORKSPACE_CONVERGENCE_STATES.set(key, created);
   return created;
 }
+function workspaceBootstrapEstablishesVisibleBaseline(input) {
+  if (input.hydrated) return true;
+  return input.firstBootstrap && !input.incidentActive && input.currentLocalHead === null && input.currentVisibleBaselineHead === null;
+}
 async function waitForWorkspacePublicationOnShutdown(input) {
   input.forcePublication();
   const deadline = Date.now() + (input.timeoutMs ?? 1e4);
@@ -251,6 +274,7 @@ async function waitForWorkspacePublicationOnShutdown(input) {
   processWorkspaceConvergenceState,
   readWorkspaceConvergenceState,
   waitForWorkspacePublicationOnShutdown,
+  workspaceBootstrapEstablishesVisibleBaseline,
   workspacePublicationIncidentAction,
   workspacePublicationTelemetry
 });

package/dist/cjs/workspace-sync.cjs

@@ -1195,6 +1195,48 @@ function mirrorVisibleWorkspaceToShadow(input, excludedCheckouts = /* @__PURE__
   projection.opaqueRoots = [...new Set(projection.opaqueRoots)].sort();
   return projection;
 }
+function visibleWorkspaceMatchesProjection(input, projection) {
+  const preimages = projection.visiblePreimages;
+  if (!preimages) return false;
+  const workspacePlansRoot = localWorkspacePlansPath(input.plansRoot);
+  const workspacePlansPreimage = preimages.get(workspacePlansRoot);
+  if (!workspacePlansPreimage || !visibleRegularRootMatchesCopiedPreimage(
+    input,
+    workspacePlansRoot,
+    [...workspacePlansPreimage.keys()].sort(),
+    workspacePlansPreimage,
+    (filePath) => filePath.endsWith(".plan.md")
+  )) {
+    return false;
+  }
+  for (const manifest of input.projects) {
+    for (const branchName of manifest.branches) {
+      const relativeRoot = workspaceProjectBranchRelativePath(manifest.projectId, branchName);
+      const visibleRoot = visibleProjectBranchPath(input.projectsRoot, manifest, branchName);
+      const projectPreimage = preimages.get(visibleRoot);
+      if (!projectPreimage) return false;
+      const gitlinks = [...projectPreimage].filter((entry) => entry[1].kind === "gitlink").map(([filePath, entry]) => ({ filePath, objectId: entry.objectId })).sort((left, right) => left.filePath.localeCompare(right.filePath));
+      const ordinaryFiles = [...projectPreimage].filter(([, entry]) => entry.kind === "blob").map(([filePath]) => filePath).sort();
+      const rootPrefix = `${relativeRoot}/`;
+      const opaqueRoots = projection.opaqueRoots.filter((root) => root.startsWith(rootPrefix)).map((root) => root.slice(rootPrefix.length));
+      if (!visibleProjectMatchesCopiedPreimage(input, visibleRoot, ordinaryFiles, gitlinks, projectPreimage, opaqueRoots)) {
+        return false;
+      }
+      const plansRoot = localPlansBranchPath(input.plansRoot, manifest.projectId, branchName);
+      const plansPreimage = preimages.get(plansRoot);
+      if (!plansPreimage || !visibleRegularRootMatchesCopiedPreimage(
+        input,
+        plansRoot,
+        [...plansPreimage.keys()].sort(),
+        plansPreimage,
+        (filePath) => filePath.endsWith(".plan.md")
+      )) {
+        return false;
+      }
+    }
+  }
+  return true;
+}
 function reconcileNewVisibleCheckouts(input) {
   const projection = { entries: [], opaqueRoots: [], visiblePreimages: /* @__PURE__ */ new Map() };
   for (const target of input.newVisibleCheckouts ?? []) {
@@ -1584,6 +1626,54 @@ function resetUncommittedShadowSnapshot(input) {
   }
   runGit(input, input.shadowRoot, ["clean", "-fd"], "clean interrupted workspace snapshot");
 }
+function restoreShadowToVisibleBaseline(input, canonicalHead) {
+  if (input.skipVisibleMirror || input.trigger.canonicalCheckoutOnly) return void 0;
+  if (input.visibleBaselineHead === void 0) {
+    if (revParse(input, "HEAD") !== canonicalHead) {
+      throw new Error("visible_workspace_baseline_missing: shadow HEAD differs from canonical main");
+    }
+    return void 0;
+  }
+  const baselineHead = input.visibleBaselineHead;
+  const currentHead = revParse(input, "HEAD");
+  if (!baselineHead) {
+    if (canonicalHead) {
+      throw new Error("Visible workspace has an unborn baseline after canonical main was created");
+    }
+    if (!currentHead) return null;
+    resetUncommittedShadowSnapshot(input);
+    const symbolicHead = runGit(input, input.shadowRoot, ["symbolic-ref", "-q", "HEAD"], "resolve unborn workspace branch");
+    runGit(input, input.shadowRoot, ["update-ref", "-d", symbolicHead], "restore unborn visible workspace baseline");
+    runGit(input, input.shadowRoot, ["read-tree", "--empty"], "clear unborn visible workspace index");
+    runGit(input, input.shadowRoot, ["clean", "-fdx"], "clean unborn visible workspace baseline");
+    return null;
+  }
+  if (currentHead === baselineHead) return baselineHead;
+  if (revParse(input, `${baselineHead}^{commit}`) !== baselineHead) {
+    throw new Error(`Visible workspace baseline ${baselineHead} is not available in the shadow repository`);
+  }
+  resetUncommittedShadowSnapshot(input);
+  runGit(input, input.shadowRoot, ["reset", "--hard", baselineHead], "restore visible workspace publication baseline");
+  runGit(input, input.shadowRoot, ["clean", "-fd"], "clean restored visible workspace publication baseline");
+  return baselineHead;
+}
+function restoreCleanShadowToExpectedIncidentCandidate(input) {
+  const expectedHead = input.expectedIncidentCandidateHead;
+  if (expectedHead === void 0) return;
+  if (input.trigger.type !== "remediation" || input.trigger.canonicalCheckoutOnly || input.trigger.processRunId !== void 0 || input.trigger.toolCallId !== void 0 || input.skipVisibleMirror !== true || input.confirmedLargeDiff === true || input.resetToCanonical === true) {
+    throw new Error("An expected incident candidate may only be used for stable remediation preparation");
+  }
+  const status = gitStatus(input);
+  if (status) {
+    throw new Error("incident_candidate_shadow_dirty: refusing to replace a dirty remediation shadow checkout");
+  }
+  if (revParse(input, `${expectedHead}^{commit}`) !== expectedHead) {
+    throw new Error(`incident_candidate_unavailable: elected workspace candidate ${expectedHead} is not available`);
+  }
+  if (revParse(input, "HEAD") !== expectedHead) {
+    runGit(input, input.shadowRoot, ["reset", "--hard", expectedHead], "restore elected workspace incident candidate");
+  }
+}
 function activeWorkspaceRebase(input) {
   for (const name of ["rebase-merge", "rebase-apply"]) {
     const resolved = runGitResult(input, input.shadowRoot, ["rev-parse", "--git-path", name]);
@@ -1776,7 +1866,7 @@ function uploadWorkspaceCandidate(input, candidateHead) {
     throw new Error("A server-issued workspace candidate ref is required before uploading a canonical workspace candidate");
   }
   assertWorkspaceQuarantineRef(quarantineRef);
-  return runGitResult(input, input.shadowRoot, ["push", "origin", `HEAD:${quarantineRef}`]);
+  return runGitResult(input, input.shadowRoot, ["push", "origin", `${candidateHead}:${quarantineRef}`]);
 }
 function resetShadowToRemote(input, opaqueWorkspaceRoots = []) {
   runGit(input, input.shadowRoot, ["fetch", "origin", "--prune"], "fetch canonical workspace before reset");
@@ -1785,7 +1875,9 @@ function resetShadowToRemote(input, opaqueWorkspaceRoots = []) {
   runGitResult(input, input.shadowRoot, ["rebase", "--abort"]);
   runGit(input, input.shadowRoot, ["reset", "--hard", `origin/${WORKSPACE_BRANCH}`], "reset workspace to canonical state");
   runGit(input, input.shadowRoot, ["clean", "-fd"], "clean reset workspace");
-  if (!input.trigger.canonicalCheckoutOnly) mirrorShadowWorkspaceToVisible(input, opaqueWorkspaceRoots);
+  if (!input.trigger.canonicalCheckoutOnly && !input.skipVisibleMirror) {
+    mirrorShadowWorkspaceToVisible(input, opaqueWorkspaceRoots);
+  }
   return remoteHead;
 }
 function baseResult(input, startingHead) {
@@ -1879,6 +1971,39 @@ function preserveWorkspaceConflictCandidate(input, observed, options) {
     };
   }
 }
+function preserveInProgressWorkspaceRebaseConflict(input, observed, options) {
+  try {
+    assertUnscopedCanonicalCheckoutSubtreesMatchRemote(input, options.candidateHead);
+    const upload = uploadWorkspaceCandidate(input, options.candidateHead);
+    if (upload.exitCode !== 0) {
+      throw new Error(upload.stderr || upload.stdout || "workspace rebase conflict candidate upload failed");
+    }
+    const conflictPaths = [...new Set(options.conflictPaths)].sort();
+    return {
+      ...observed,
+      outcome: "conflict_blocked",
+      expectedHead: options.expectedHead,
+      candidateHead: options.candidateHead,
+      quarantineRef: input.quarantineRef,
+      rebaseCount: options.rebaseCount,
+      affectedProjects: affectedProjects(conflictPaths),
+      affectedPaths: reportedPaths(conflictPaths),
+      error: options.error,
+      gitStatus: gitStatus(input)
+    };
+  } catch (error) {
+    runGitResult(input, input.shadowRoot, ["rebase", "--abort"]);
+    return {
+      ...observed,
+      outcome: "failed",
+      rebaseCount: options.rebaseCount,
+      affectedProjects: affectedProjects(options.conflictPaths),
+      affectedPaths: reportedPaths(options.conflictPaths),
+      error: `Workspace synchronization found a rebase conflict but could not preserve its durable candidate: ${error instanceof Error ? error.message : String(error)}`,
+      gitStatus: gitStatus(input)
+    };
+  }
+}
 function preserveLargeDiffCandidate(input, observed, error) {
   try {
     if (stagedPaths(input).length > 0) {
@@ -1929,6 +2054,10 @@ async function synchronizeWorkspace(rawInput) {
         error: `canonical_head_advanced: expected ${input.expectedCanonicalHead ?? "unborn"}, fetched ${remoteHeadAtStart ?? "unborn"}`
       };
     }
+    const inProgressRemediation = remediationRebaseInProgressResult(input, result);
+    if (inProgressRemediation) return inProgressRemediation;
+    restoreCleanShadowToExpectedIncidentCandidate(input);
+    const visibleBaselineHead = restoreShadowToVisibleBaseline(input, remoteHeadAtStart);
     const inboundConflictsAtStart = input.skipVisibleMirror && !isCanonicalRemediationSync && remoteHeadAtStart ? visibleHydrationConflictPaths(input, hydrationPreimages, `origin/${WORKSPACE_BRANCH}`) : [];
     if (input.resetToCanonical) {
       if (input.trigger.canonicalCheckoutOnly) {
@@ -1943,8 +2072,6 @@ async function synchronizeWorkspace(rawInput) {
         gitStatus: gitStatus(input)
       };
     }
-    const inProgressRemediation = remediationRebaseInProgressResult(input, result);
-    if (inProgressRemediation) return inProgressRemediation;
     if (!input.skipVisibleMirror) resetUncommittedShadowSnapshot(input);
     restoreUnscopedCanonicalCheckoutSubtrees(input);
     if (!input.skipVisibleMirror) {
@@ -1954,6 +2081,10 @@ async function synchronizeWorkspace(rawInput) {
       mergeGitlinkProjection(mirroredGitlinkProjection, reconcileNewVisibleCheckouts(input));
       mirroredGitlinkProjection.opaqueRoots = [...new Set(mirroredGitlinkProjection.opaqueRoots)].sort();
       hydrationPreimages = mirroredGitlinkProjection.visiblePreimages ?? hydrationPreimages;
+      if (input.trigger.type === "remediation" && !visibleWorkspaceMatchesProjection(input, mirroredGitlinkProjection)) {
+        resetUncommittedShadowSnapshot(input);
+        throw new Error("visible_workspace_unstable: visible files changed while preparing the remediation snapshot");
+      }
     }
     const stagePathspecs = mirroredGitlinkProjection.opaqueRoots.flatMap((root) => [`:(exclude,literal)${root}`]);
     runGit(input, input.shadowRoot, ["add", "-A", "--", ".", ...stagePathspecs], "stage workspace changes");
@@ -1962,7 +2093,8 @@ async function synchronizeWorkspace(rawInput) {
     if (redundantInboundCandidate) return redundantInboundCandidate;
     const sampledCanonicalCheckoutTreeHash = sampleCanonicalCheckoutTree(input);
     const stagedWorkingPaths = stagedPaths(input);
-    const baseRevision = candidateBaseRevision(input);
+    const preservesDivergentVisibleSnapshot = input.confirmedLargeDiff === true || input.trigger.type === "remediation" || input.trigger.type === "remediation_confirm";
+    const baseRevision = preservesDivergentVisibleSnapshot ? remoteHeadAtStart : visibleBaselineHead !== void 0 ? visibleBaselineHead : candidateBaseRevision(input);
     const paths = stagedPaths(input, baseRevision);
     const diffSizeBytes = await stagedDiffSizeBytes(input, baseRevision);
     const statusBeforeCommit = reportedStatus(gitStatus(input));
@@ -1975,16 +2107,12 @@ async function synchronizeWorkspace(rawInput) {
       ...sampledCanonicalCheckoutTreeHash ? { sampledCanonicalCheckoutTreeHash } : {}
     };
     const destructiveReductions = destructiveCheckoutReductions(input, baseRevision);
+    let blockedDiffError;
     if (destructiveReductions.length > 0 && !input.confirmedLargeDiff) {
       const summary = destructiveReductions.map(({ root, trackedBefore, trackedAfter }) => `${root} (${trackedBefore} -> ${trackedAfter} tracked files)`).join(", ");
-      return preserveLargeDiffCandidate(input, observed, `Workspace safety guard blocked a destructive checkout reduction: ${summary}`);
-    }
-    if (paths.length > 0 && diffSizeBytes > MAX_WORKSPACE_SYNC_DIFF_BYTES && !input.confirmedLargeDiff && !input.trigger.canonicalCheckoutOnly) {
-      return preserveLargeDiffCandidate(
-        input,
-        observed,
-        `Workspace safety guard blocked a ${diffSizeBytes}-byte diff above the ${MAX_WORKSPACE_SYNC_DIFF_BYTES}-byte automatic publication limit.`
-      );
+      blockedDiffError = `Workspace safety guard blocked a destructive checkout reduction: ${summary}`;
+    } else if (paths.length > 0 && diffSizeBytes > MAX_WORKSPACE_SYNC_DIFF_BYTES && !input.confirmedLargeDiff && !input.trigger.canonicalCheckoutOnly) {
+      blockedDiffError = `Workspace safety guard blocked a ${diffSizeBytes}-byte diff above the ${MAX_WORKSPACE_SYNC_DIFF_BYTES}-byte automatic publication limit.`;
     }
     if (stagedWorkingPaths.length > 0) {
       runGit(input, input.shadowRoot, ["commit", "-m", commitMessage(input)], "commit workspace changes");
@@ -1992,8 +2120,11 @@ async function synchronizeWorkspace(rawInput) {
     let candidateHead = revParse(input, "HEAD");
     const candidateHeadBeforeRebase = candidateHead;
     if (candidateHead) assertUnscopedCanonicalCheckoutSubtreesMatchRemote(input, candidateHead);
-    const hasRemoteMain = Boolean(revParse(input, `origin/${WORKSPACE_BRANCH}`));
-    const hasUnpushedCommit = candidateHead ? !hasRemoteMain || !tryGit(input, input.shadowRoot, ["merge-base", "--is-ancestor", candidateHead, `origin/${WORKSPACE_BRANCH}`]) : false;
+    const remoteHeadBeforeRebase = revParse(input, `origin/${WORKSPACE_BRANCH}`);
+    const hasRemoteMain = Boolean(remoteHeadBeforeRebase);
+    const hasCapturedVisibleDelta = visibleBaselineHead === void 0 || paths.length > 0;
+    const mustDropVisibleBaselinePrefix = !preservesDivergentVisibleSnapshot && visibleBaselineHead !== void 0 && visibleBaselineHead !== remoteHeadBeforeRebase && stagedWorkingPaths.length > 0;
+    const hasUnpushedCommit = candidateHead && hasCapturedVisibleDelta ? mustDropVisibleBaselinePrefix || !hasRemoteMain || !tryGit(input, input.shadowRoot, ["merge-base", "--is-ancestor", candidateHead, `origin/${WORKSPACE_BRANCH}`]) : false;
     if (hasUnpushedCommit && inboundConflictsAtStart.length > 0) {
       const conflictPaths = [.../* @__PURE__ */ new Set([...paths, ...inboundConflictsAtStart])].sort();
       return preserveWorkspaceConflictCandidate(input, observed, {
@@ -2067,13 +2198,36 @@ async function synchronizeWorkspace(rawInput) {
       };
     }
     let rebaseCount = 0;
-    const expectedHead = revParse(input, `origin/${WORKSPACE_BRANCH}`);
-    if (candidateHead && expectedHead && !tryGit(input, input.shadowRoot, ["merge-base", "--is-ancestor", expectedHead, candidateHead])) {
-      const rebase = runGitResult(input, input.shadowRoot, ["rebase", `origin/${WORKSPACE_BRANCH}`]);
+    const expectedHead = remoteHeadBeforeRebase;
+    if (mustDropVisibleBaselinePrefix && !expectedHead) {
+      return {
+        ...observed,
+        outcome: "failed",
+        candidateHead: candidateHead ?? void 0,
+        error: "Cannot normalize a visible workspace tail onto an unborn canonical workspace",
+        gitStatus: gitStatus(input)
+      };
+    }
+    if (candidateHead && expectedHead && (mustDropVisibleBaselinePrefix || !tryGit(input, input.shadowRoot, ["merge-base", "--is-ancestor", expectedHead, candidateHead]))) {
+      const rebase = runGitResult(
+        input,
+        input.shadowRoot,
+        mustDropVisibleBaselinePrefix && visibleBaselineHead ? ["rebase", "--onto", `origin/${WORKSPACE_BRANCH}`, visibleBaselineHead] : ["rebase", `origin/${WORKSPACE_BRANCH}`]
+      );
       rebaseCount += 1;
       if (rebase.exitCode !== 0) {
         const conflicted = runGitResult(input, input.shadowRoot, ["diff", "--name-only", "--diff-filter=U", "-z"]);
         const conflictPaths = [.../* @__PURE__ */ new Set([...paths, ...conflicted.stdout.split("\0").filter(Boolean)])].sort();
+        if (mustDropVisibleBaselinePrefix) {
+          const originalCandidateHead = revParse(input, "ORIG_HEAD") ?? candidateHead;
+          return preserveInProgressWorkspaceRebaseConflict(input, observed, {
+            candidateHead: originalCandidateHead,
+            expectedHead,
+            rebaseCount,
+            conflictPaths,
+            error: `Workspace tail conflicts with canonical head ${expectedHead}; local changes were preserved for reconciliation in the in-progress rebase.`
+          });
+        }
         runGit(input, input.shadowRoot, ["rebase", "--abort"], "preserve workspace candidate after rebase conflict");
         return preserveWorkspaceConflictCandidate(input, observed, {
           baseRevision: candidateHead,
@@ -2119,6 +2273,9 @@ async function synchronizeWorkspace(rawInput) {
         error: "Workspace changed while its candidate was reconciling; visible changes and the old-base candidate were preserved."
       });
     }
+    if (blockedDiffError) {
+      return preserveLargeDiffCandidate(input, { ...observed, rebaseCount }, blockedDiffError);
+    }
     const upload = uploadWorkspaceCandidate(input, candidateHead);
     if (upload.exitCode !== 0) {
       return {

package/dist/mjs/main.mjs

@@ -22,6 +22,7 @@ import {
   WorkspaceManifestRevisionFence,
   processWorkspaceConvergenceState,
   waitForWorkspacePublicationOnShutdown,
+  workspaceBootstrapEstablishesVisibleBaseline,
   workspacePublicationIncidentAction,
   workspacePublicationTelemetry
 } from "./workspace-convergence.mjs";
@@ -1002,6 +1003,19 @@ function checkoutVisibleBranch(input) {
   }
   runGit(["checkout", "--no-recurse-submodules", "-B", input.branchName], { cwd: input.branchPath });
 }
+function reconcileRewrittenCanonicalHistory(input) {
+  const remoteRef = `refs/remotes/origin/${input.branchName}`;
+  if (!tryGit(["rev-parse", "--verify", "HEAD"], { cwd: input.branchPath })) return;
+  if (!tryGit(["show-ref", "--verify", "--quiet", remoteRef], { cwd: input.branchPath })) return;
+  if (tryGit(["merge-base", "HEAD", remoteRef], { cwd: input.branchPath })) return;
+  if (hasWorktreeChanges(input.branchPath)) return;
+  const localTree = runGit(["rev-parse", "HEAD^{tree}"], { cwd: input.branchPath });
+  const remoteTree = runGit(["rev-parse", `${remoteRef}^{tree}`], { cwd: input.branchPath });
+  if (localTree !== remoteTree) return;
+  const previousHead = runGit(["rev-parse", "HEAD"], { cwd: input.branchPath });
+  runGit(["update-ref", `refs/r5d/pre-canonical-checkout/${previousHead}`, previousHead], { cwd: input.branchPath });
+  runGit(["checkout", "--no-recurse-submodules", "-B", input.branchName, remoteRef], { cwd: input.branchPath });
+}
 function migrateExistingCheckoutToRequiredRemote(input) {
   if (originRemoteUrl(input.branchPath) === input.remoteUrl) return;
   const dirtyWorkingTree = hasWorktreeChanges(input.branchPath);
@@ -1109,6 +1123,9 @@ function ensureVisibleGitCheckout(input) {
   if (input.requireRemoteBranch && !tryGit(["show-ref", "--verify", "--quiet", `refs/remotes/origin/${input.branchName}`], { cwd: branchPath })) {
     throw new Error(`Existing checkout for ${input.branchName} does not contain its canonical remote branch`);
   }
+  if (input.requireRemoteBranch) {
+    reconcileRewrittenCanonicalHistory({ branchPath, branchName: input.branchName });
+  }
   if (input.requiredBaseCommit) {
     assertCheckoutDerivedFromRequiredBase({
       branchPath,
@@ -2459,6 +2476,7 @@ async function startWorker(options) {
             requestId: options2.requestId,
             trigger,
             dirtyGeneration: snapshot2.dirtyGeneration,
+            visibleBaselineHead: workspaceConvergence.visibleBaselineHead(),
             explicit: true,
             workInFlight: false,
             requestedAt: Date.now()
@@ -2495,6 +2513,7 @@ async function startWorker(options) {
           requestId,
           trigger,
           dirtyGeneration: snapshot.dirtyGeneration,
+          visibleBaselineHead: workspaceConvergence.visibleBaselineHead(),
           explicit: options2.requestId !== void 0,
           workInFlight: false,
           requestedAt: Date.now()
@@ -2698,6 +2717,7 @@ async function startWorker(options) {
         const newVisibleCheckouts = [...newVisibleCheckoutByKey.values()];
         const input = workspaceSyncInput(trigger, {
           ...overrides,
+          ...shouldEnsureCheckouts && !trigger.canonicalCheckoutOnly ? { visibleBaselineHead: workspaceConvergence.visibleBaselineHead() } : {},
           ...newVisibleCheckouts.length > 0 ? { newVisibleCheckouts } : {}
         });
         synchronizeStartedAt = Date.now();
@@ -2815,7 +2835,8 @@ async function startWorker(options) {
           canonicalResolverCheckout: true,
           browserPortForwarding: true,
           globalWorkspaceSyncLeaseV1: true,
-          eventualWorkspaceSyncV1: true
+          eventualWorkspaceSyncV1: true,
+          workspaceIncidentCandidatePinV1: true
         },
         projectRoot: projectsRoot,
         artifactRoot,
@@ -2882,7 +2903,15 @@ async function startWorker(options) {
             hydrateVisible: firstBootstrap && !activeWorkspaceIncidentId
           });
           if (!workspaceManifestRevision.isCurrent(revisionToken)) return false;
-          workspaceConvergence.setLocalHead(bootstrapped.localHead);
+          if (workspaceBootstrapEstablishesVisibleBaseline({
+            hydrated: bootstrapped.hydrated,
+            firstBootstrap,
+            incidentActive: Boolean(activeWorkspaceIncidentId),
+            currentLocalHead: workspaceConvergence.snapshot().localHead,
+            currentVisibleBaselineHead: workspaceConvergence.visibleBaselineHead()
+          })) {
+            workspaceConvergence.setLocalHead(bootstrapped.localHead);
+          }
           workspaceConvergence.observeCanonicalHead(bootstrapped.canonicalHead);
           for (const checkout of currentCheckouts) {
             const manifest = manifestByProjectId.get(checkout.projectId);
@@ -2955,6 +2984,7 @@ async function startWorker(options) {
             quarantineRef: message.quarantineRef,
             confirmedLargeDiff: message.confirmedLargeDiff,
             confirmationReason: message.confirmationReason,
+            expectedIncidentCandidateHead: message.expectedIncidentCandidateHead,
             resetToCanonical: message.resetToCanonical,
             skipVisibleMirror: message.skipVisibleMirror
           }
@@ -3033,6 +3063,7 @@ async function startWorker(options) {
                 attemptId: message.attemptId,
                 quarantineRef: message.quarantineRef,
                 expectedCanonicalHead: message.expectedHead,
+                visibleBaselineHead: publication.visibleBaselineHead,
                 newVisibleCheckouts: [...createdCheckouts, ...pendingTargets]
               })
             );
@@ -3110,6 +3141,7 @@ async function startWorker(options) {
             published: true
           });
         } else if (message.status === "blocked" && workspaceIncidentOrdering.permitsBlockedResponse(message.incidentId)) {
+          if (message.visibleBaselineHead) workspaceConvergence.setVisibleBaselineHead(message.visibleBaselineHead);
           workspaceConvergence.block();
           if (message.incidentId) activeWorkspaceIncidentId = message.incidentId;
         } else {
@@ -3161,7 +3193,11 @@ async function startWorker(options) {
       if (message.type === "workspace_incident_updated") {
         workspaceIncidentOrdering.observe(message);
         const previousIncidentId = activeWorkspaceIncidentId;
-        activeWorkspaceIncidentId = applyWorkspaceIncidentUpdate(activeWorkspaceIncidentId, message);
+        const nextIncidentId = applyWorkspaceIncidentUpdate(activeWorkspaceIncidentId, message);
+        if (message.incidentId && (previousIncidentId === message.incidentId || nextIncidentId === message.incidentId) && message.originWorkerLabel === label && message.visibleBaselineHead) {
+          workspaceConvergence.setVisibleBaselineHead(message.visibleBaselineHead);
+        }
+        activeWorkspaceIncidentId = nextIncidentId;
         const releasedHead = releasePendingWorkspaceHead(
           previousIncidentId,
           activeWorkspaceIncidentId,

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.61",
+  "version": "0.0.63",
   "type": "module"
 }

package/dist/mjs/workspace-convergence.mjs

@@ -71,6 +71,7 @@ class ExplicitWorkspacePublicationQueue {
 }
 const EMPTY_STATE = {
   localHead: null,
+  visibleBaselineHead: null,
   desiredCanonicalHead: null,
   dirtyGeneration: 0,
   publishedGeneration: 0
@@ -84,11 +85,12 @@ function validGeneration(value) {
 function readWorkspaceConvergenceState(statePath) {
   try {
     const parsed = JSON.parse(fs.readFileSync(statePath, "utf8"));
-    if (!validHead(parsed.localHead) || !validHead(parsed.desiredCanonicalHead) || !validGeneration(parsed.dirtyGeneration) || !validGeneration(parsed.publishedGeneration) || parsed.publishedGeneration > parsed.dirtyGeneration) {
+    if (!validHead(parsed.localHead) || !(parsed.visibleBaselineHead === void 0 || validHead(parsed.visibleBaselineHead)) || !validHead(parsed.desiredCanonicalHead) || !validGeneration(parsed.dirtyGeneration) || !validGeneration(parsed.publishedGeneration) || parsed.publishedGeneration > parsed.dirtyGeneration) {
       return { ...EMPTY_STATE };
     }
     return {
       localHead: parsed.localHead,
+      visibleBaselineHead: parsed.visibleBaselineHead === void 0 ? parsed.localHead : parsed.visibleBaselineHead,
       desiredCanonicalHead: parsed.desiredCanonicalHead,
       dirtyGeneration: parsed.dirtyGeneration,
       publishedGeneration: parsed.publishedGeneration
@@ -107,11 +109,26 @@ class WorkspaceConvergenceState {
   state;
   publicationState;
   snapshot() {
-    return { ...this.state, publicationState: this.publicationState };
+    return {
+      localHead: this.state.localHead,
+      desiredCanonicalHead: this.state.desiredCanonicalHead,
+      dirtyGeneration: this.state.dirtyGeneration,
+      publishedGeneration: this.state.publishedGeneration,
+      publicationState: this.publicationState
+    };
+  }
+  visibleBaselineHead() {
+    return this.state.visibleBaselineHead;
   }
   setLocalHead(localHead) {
     if (!validHead(localHead)) throw new Error("Invalid local workspace head");
     this.state.localHead = localHead;
+    this.state.visibleBaselineHead = localHead;
+    this.persist();
+  }
+  setVisibleBaselineHead(visibleBaselineHead) {
+    if (!validHead(visibleBaselineHead)) throw new Error("Invalid visible workspace baseline head");
+    this.state.visibleBaselineHead = visibleBaselineHead;
     this.persist();
   }
   observeCanonicalHead(canonicalHead) {
@@ -165,6 +182,7 @@ class WorkspaceConvergenceState {
     if (input.published) {
       this.state.publishedGeneration = Math.max(this.state.publishedGeneration, input.generation);
       this.state.localHead = input.canonicalHead;
+      this.state.visibleBaselineHead = input.canonicalHead;
       this.state.desiredCanonicalHead = input.canonicalHead;
     }
     this.publicationState = this.state.dirtyGeneration > this.state.publishedGeneration ? "scheduled" : "idle";
@@ -187,6 +205,10 @@ function processWorkspaceConvergenceState(statePath) {
   PROCESS_WORKSPACE_CONVERGENCE_STATES.set(key, created);
   return created;
 }
+function workspaceBootstrapEstablishesVisibleBaseline(input) {
+  if (input.hydrated) return true;
+  return input.firstBootstrap && !input.incidentActive && input.currentLocalHead === null && input.currentVisibleBaselineHead === null;
+}
 async function waitForWorkspacePublicationOnShutdown(input) {
   input.forcePublication();
   const deadline = Date.now() + (input.timeoutMs ?? 1e4);
@@ -208,6 +230,7 @@ export {
   processWorkspaceConvergenceState,
   readWorkspaceConvergenceState,
   waitForWorkspacePublicationOnShutdown,
+  workspaceBootstrapEstablishesVisibleBaseline,
   workspacePublicationIncidentAction,
   workspacePublicationTelemetry
 };

package/dist/mjs/workspace-sync.mjs

@@ -1144,6 +1144,48 @@ function mirrorVisibleWorkspaceToShadow(input, excludedCheckouts = /* @__PURE__
   projection.opaqueRoots = [...new Set(projection.opaqueRoots)].sort();
   return projection;
 }
+function visibleWorkspaceMatchesProjection(input, projection) {
+  const preimages = projection.visiblePreimages;
+  if (!preimages) return false;
+  const workspacePlansRoot = localWorkspacePlansPath(input.plansRoot);
+  const workspacePlansPreimage = preimages.get(workspacePlansRoot);
+  if (!workspacePlansPreimage || !visibleRegularRootMatchesCopiedPreimage(
+    input,
+    workspacePlansRoot,
+    [...workspacePlansPreimage.keys()].sort(),
+    workspacePlansPreimage,
+    (filePath) => filePath.endsWith(".plan.md")
+  )) {
+    return false;
+  }
+  for (const manifest of input.projects) {
+    for (const branchName of manifest.branches) {
+      const relativeRoot = workspaceProjectBranchRelativePath(manifest.projectId, branchName);
+      const visibleRoot = visibleProjectBranchPath(input.projectsRoot, manifest, branchName);
+      const projectPreimage = preimages.get(visibleRoot);
+      if (!projectPreimage) return false;
+      const gitlinks = [...projectPreimage].filter((entry) => entry[1].kind === "gitlink").map(([filePath, entry]) => ({ filePath, objectId: entry.objectId })).sort((left, right) => left.filePath.localeCompare(right.filePath));
+      const ordinaryFiles = [...projectPreimage].filter(([, entry]) => entry.kind === "blob").map(([filePath]) => filePath).sort();
+      const rootPrefix = `${relativeRoot}/`;
+      const opaqueRoots = projection.opaqueRoots.filter((root) => root.startsWith(rootPrefix)).map((root) => root.slice(rootPrefix.length));
+      if (!visibleProjectMatchesCopiedPreimage(input, visibleRoot, ordinaryFiles, gitlinks, projectPreimage, opaqueRoots)) {
+        return false;
+      }
+      const plansRoot = localPlansBranchPath(input.plansRoot, manifest.projectId, branchName);
+      const plansPreimage = preimages.get(plansRoot);
+      if (!plansPreimage || !visibleRegularRootMatchesCopiedPreimage(
+        input,
+        plansRoot,
+        [...plansPreimage.keys()].sort(),
+        plansPreimage,
+        (filePath) => filePath.endsWith(".plan.md")
+      )) {
+        return false;
+      }
+    }
+  }
+  return true;
+}
 function reconcileNewVisibleCheckouts(input) {
   const projection = { entries: [], opaqueRoots: [], visiblePreimages: /* @__PURE__ */ new Map() };
   for (const target of input.newVisibleCheckouts ?? []) {
@@ -1533,6 +1575,54 @@ function resetUncommittedShadowSnapshot(input) {
   }
   runGit(input, input.shadowRoot, ["clean", "-fd"], "clean interrupted workspace snapshot");
 }
+function restoreShadowToVisibleBaseline(input, canonicalHead) {
+  if (input.skipVisibleMirror || input.trigger.canonicalCheckoutOnly) return void 0;
+  if (input.visibleBaselineHead === void 0) {
+    if (revParse(input, "HEAD") !== canonicalHead) {
+      throw new Error("visible_workspace_baseline_missing: shadow HEAD differs from canonical main");
+    }
+    return void 0;
+  }
+  const baselineHead = input.visibleBaselineHead;
+  const currentHead = revParse(input, "HEAD");
+  if (!baselineHead) {
+    if (canonicalHead) {
+      throw new Error("Visible workspace has an unborn baseline after canonical main was created");
+    }
+    if (!currentHead) return null;
+    resetUncommittedShadowSnapshot(input);
+    const symbolicHead = runGit(input, input.shadowRoot, ["symbolic-ref", "-q", "HEAD"], "resolve unborn workspace branch");
+    runGit(input, input.shadowRoot, ["update-ref", "-d", symbolicHead], "restore unborn visible workspace baseline");
+    runGit(input, input.shadowRoot, ["read-tree", "--empty"], "clear unborn visible workspace index");
+    runGit(input, input.shadowRoot, ["clean", "-fdx"], "clean unborn visible workspace baseline");
+    return null;
+  }
+  if (currentHead === baselineHead) return baselineHead;
+  if (revParse(input, `${baselineHead}^{commit}`) !== baselineHead) {
+    throw new Error(`Visible workspace baseline ${baselineHead} is not available in the shadow repository`);
+  }
+  resetUncommittedShadowSnapshot(input);
+  runGit(input, input.shadowRoot, ["reset", "--hard", baselineHead], "restore visible workspace publication baseline");
+  runGit(input, input.shadowRoot, ["clean", "-fd"], "clean restored visible workspace publication baseline");
+  return baselineHead;
+}
+function restoreCleanShadowToExpectedIncidentCandidate(input) {
+  const expectedHead = input.expectedIncidentCandidateHead;
+  if (expectedHead === void 0) return;
+  if (input.trigger.type !== "remediation" || input.trigger.canonicalCheckoutOnly || input.trigger.processRunId !== void 0 || input.trigger.toolCallId !== void 0 || input.skipVisibleMirror !== true || input.confirmedLargeDiff === true || input.resetToCanonical === true) {
+    throw new Error("An expected incident candidate may only be used for stable remediation preparation");
+  }
+  const status = gitStatus(input);
+  if (status) {
+    throw new Error("incident_candidate_shadow_dirty: refusing to replace a dirty remediation shadow checkout");
+  }
+  if (revParse(input, `${expectedHead}^{commit}`) !== expectedHead) {
+    throw new Error(`incident_candidate_unavailable: elected workspace candidate ${expectedHead} is not available`);
+  }
+  if (revParse(input, "HEAD") !== expectedHead) {
+    runGit(input, input.shadowRoot, ["reset", "--hard", expectedHead], "restore elected workspace incident candidate");
+  }
+}
 function activeWorkspaceRebase(input) {
   for (const name of ["rebase-merge", "rebase-apply"]) {
     const resolved = runGitResult(input, input.shadowRoot, ["rev-parse", "--git-path", name]);
@@ -1725,7 +1815,7 @@ function uploadWorkspaceCandidate(input, candidateHead) {
     throw new Error("A server-issued workspace candidate ref is required before uploading a canonical workspace candidate");
   }
   assertWorkspaceQuarantineRef(quarantineRef);
-  return runGitResult(input, input.shadowRoot, ["push", "origin", `HEAD:${quarantineRef}`]);
+  return runGitResult(input, input.shadowRoot, ["push", "origin", `${candidateHead}:${quarantineRef}`]);
 }
 function resetShadowToRemote(input, opaqueWorkspaceRoots = []) {
   runGit(input, input.shadowRoot, ["fetch", "origin", "--prune"], "fetch canonical workspace before reset");
@@ -1734,7 +1824,9 @@ function resetShadowToRemote(input, opaqueWorkspaceRoots = []) {
   runGitResult(input, input.shadowRoot, ["rebase", "--abort"]);
   runGit(input, input.shadowRoot, ["reset", "--hard", `origin/${WORKSPACE_BRANCH}`], "reset workspace to canonical state");
   runGit(input, input.shadowRoot, ["clean", "-fd"], "clean reset workspace");
-  if (!input.trigger.canonicalCheckoutOnly) mirrorShadowWorkspaceToVisible(input, opaqueWorkspaceRoots);
+  if (!input.trigger.canonicalCheckoutOnly && !input.skipVisibleMirror) {
+    mirrorShadowWorkspaceToVisible(input, opaqueWorkspaceRoots);
+  }
   return remoteHead;
 }
 function baseResult(input, startingHead) {
@@ -1828,6 +1920,39 @@ function preserveWorkspaceConflictCandidate(input, observed, options) {
     };
   }
 }
+function preserveInProgressWorkspaceRebaseConflict(input, observed, options) {
+  try {
+    assertUnscopedCanonicalCheckoutSubtreesMatchRemote(input, options.candidateHead);
+    const upload = uploadWorkspaceCandidate(input, options.candidateHead);
+    if (upload.exitCode !== 0) {
+      throw new Error(upload.stderr || upload.stdout || "workspace rebase conflict candidate upload failed");
+    }
+    const conflictPaths = [...new Set(options.conflictPaths)].sort();
+    return {
+      ...observed,
+      outcome: "conflict_blocked",
+      expectedHead: options.expectedHead,
+      candidateHead: options.candidateHead,
+      quarantineRef: input.quarantineRef,
+      rebaseCount: options.rebaseCount,
+      affectedProjects: affectedProjects(conflictPaths),
+      affectedPaths: reportedPaths(conflictPaths),
+      error: options.error,
+      gitStatus: gitStatus(input)
+    };
+  } catch (error) {
+    runGitResult(input, input.shadowRoot, ["rebase", "--abort"]);
+    return {
+      ...observed,
+      outcome: "failed",
+      rebaseCount: options.rebaseCount,
+      affectedProjects: affectedProjects(options.conflictPaths),
+      affectedPaths: reportedPaths(options.conflictPaths),
+      error: `Workspace synchronization found a rebase conflict but could not preserve its durable candidate: ${error instanceof Error ? error.message : String(error)}`,
+      gitStatus: gitStatus(input)
+    };
+  }
+}
 function preserveLargeDiffCandidate(input, observed, error) {
   try {
     if (stagedPaths(input).length > 0) {
@@ -1878,6 +2003,10 @@ async function synchronizeWorkspace(rawInput) {
         error: `canonical_head_advanced: expected ${input.expectedCanonicalHead ?? "unborn"}, fetched ${remoteHeadAtStart ?? "unborn"}`
       };
     }
+    const inProgressRemediation = remediationRebaseInProgressResult(input, result);
+    if (inProgressRemediation) return inProgressRemediation;
+    restoreCleanShadowToExpectedIncidentCandidate(input);
+    const visibleBaselineHead = restoreShadowToVisibleBaseline(input, remoteHeadAtStart);
     const inboundConflictsAtStart = input.skipVisibleMirror && !isCanonicalRemediationSync && remoteHeadAtStart ? visibleHydrationConflictPaths(input, hydrationPreimages, `origin/${WORKSPACE_BRANCH}`) : [];
     if (input.resetToCanonical) {
       if (input.trigger.canonicalCheckoutOnly) {
@@ -1892,8 +2021,6 @@ async function synchronizeWorkspace(rawInput) {
         gitStatus: gitStatus(input)
       };
     }
-    const inProgressRemediation = remediationRebaseInProgressResult(input, result);
-    if (inProgressRemediation) return inProgressRemediation;
     if (!input.skipVisibleMirror) resetUncommittedShadowSnapshot(input);
     restoreUnscopedCanonicalCheckoutSubtrees(input);
     if (!input.skipVisibleMirror) {
@@ -1903,6 +2030,10 @@ async function synchronizeWorkspace(rawInput) {
       mergeGitlinkProjection(mirroredGitlinkProjection, reconcileNewVisibleCheckouts(input));
       mirroredGitlinkProjection.opaqueRoots = [...new Set(mirroredGitlinkProjection.opaqueRoots)].sort();
       hydrationPreimages = mirroredGitlinkProjection.visiblePreimages ?? hydrationPreimages;
+      if (input.trigger.type === "remediation" && !visibleWorkspaceMatchesProjection(input, mirroredGitlinkProjection)) {
+        resetUncommittedShadowSnapshot(input);
+        throw new Error("visible_workspace_unstable: visible files changed while preparing the remediation snapshot");
+      }
     }
     const stagePathspecs = mirroredGitlinkProjection.opaqueRoots.flatMap((root) => [`:(exclude,literal)${root}`]);
     runGit(input, input.shadowRoot, ["add", "-A", "--", ".", ...stagePathspecs], "stage workspace changes");
@@ -1911,7 +2042,8 @@ async function synchronizeWorkspace(rawInput) {
     if (redundantInboundCandidate) return redundantInboundCandidate;
     const sampledCanonicalCheckoutTreeHash = sampleCanonicalCheckoutTree(input);
     const stagedWorkingPaths = stagedPaths(input);
-    const baseRevision = candidateBaseRevision(input);
+    const preservesDivergentVisibleSnapshot = input.confirmedLargeDiff === true || input.trigger.type === "remediation" || input.trigger.type === "remediation_confirm";
+    const baseRevision = preservesDivergentVisibleSnapshot ? remoteHeadAtStart : visibleBaselineHead !== void 0 ? visibleBaselineHead : candidateBaseRevision(input);
     const paths = stagedPaths(input, baseRevision);
     const diffSizeBytes = await stagedDiffSizeBytes(input, baseRevision);
     const statusBeforeCommit = reportedStatus(gitStatus(input));
@@ -1924,16 +2056,12 @@ async function synchronizeWorkspace(rawInput) {
       ...sampledCanonicalCheckoutTreeHash ? { sampledCanonicalCheckoutTreeHash } : {}
     };
     const destructiveReductions = destructiveCheckoutReductions(input, baseRevision);
+    let blockedDiffError;
     if (destructiveReductions.length > 0 && !input.confirmedLargeDiff) {
       const summary = destructiveReductions.map(({ root, trackedBefore, trackedAfter }) => `${root} (${trackedBefore} -> ${trackedAfter} tracked files)`).join(", ");
-      return preserveLargeDiffCandidate(input, observed, `Workspace safety guard blocked a destructive checkout reduction: ${summary}`);
-    }
-    if (paths.length > 0 && diffSizeBytes > MAX_WORKSPACE_SYNC_DIFF_BYTES && !input.confirmedLargeDiff && !input.trigger.canonicalCheckoutOnly) {
-      return preserveLargeDiffCandidate(
-        input,
-        observed,
-        `Workspace safety guard blocked a ${diffSizeBytes}-byte diff above the ${MAX_WORKSPACE_SYNC_DIFF_BYTES}-byte automatic publication limit.`
-      );
+      blockedDiffError = `Workspace safety guard blocked a destructive checkout reduction: ${summary}`;
+    } else if (paths.length > 0 && diffSizeBytes > MAX_WORKSPACE_SYNC_DIFF_BYTES && !input.confirmedLargeDiff && !input.trigger.canonicalCheckoutOnly) {
+      blockedDiffError = `Workspace safety guard blocked a ${diffSizeBytes}-byte diff above the ${MAX_WORKSPACE_SYNC_DIFF_BYTES}-byte automatic publication limit.`;
     }
     if (stagedWorkingPaths.length > 0) {
       runGit(input, input.shadowRoot, ["commit", "-m", commitMessage(input)], "commit workspace changes");
@@ -1941,8 +2069,11 @@ async function synchronizeWorkspace(rawInput) {
     let candidateHead = revParse(input, "HEAD");
     const candidateHeadBeforeRebase = candidateHead;
     if (candidateHead) assertUnscopedCanonicalCheckoutSubtreesMatchRemote(input, candidateHead);
-    const hasRemoteMain = Boolean(revParse(input, `origin/${WORKSPACE_BRANCH}`));
-    const hasUnpushedCommit = candidateHead ? !hasRemoteMain || !tryGit(input, input.shadowRoot, ["merge-base", "--is-ancestor", candidateHead, `origin/${WORKSPACE_BRANCH}`]) : false;
+    const remoteHeadBeforeRebase = revParse(input, `origin/${WORKSPACE_BRANCH}`);
+    const hasRemoteMain = Boolean(remoteHeadBeforeRebase);
+    const hasCapturedVisibleDelta = visibleBaselineHead === void 0 || paths.length > 0;
+    const mustDropVisibleBaselinePrefix = !preservesDivergentVisibleSnapshot && visibleBaselineHead !== void 0 && visibleBaselineHead !== remoteHeadBeforeRebase && stagedWorkingPaths.length > 0;
+    const hasUnpushedCommit = candidateHead && hasCapturedVisibleDelta ? mustDropVisibleBaselinePrefix || !hasRemoteMain || !tryGit(input, input.shadowRoot, ["merge-base", "--is-ancestor", candidateHead, `origin/${WORKSPACE_BRANCH}`]) : false;
     if (hasUnpushedCommit && inboundConflictsAtStart.length > 0) {
       const conflictPaths = [.../* @__PURE__ */ new Set([...paths, ...inboundConflictsAtStart])].sort();
       return preserveWorkspaceConflictCandidate(input, observed, {
@@ -2016,13 +2147,36 @@ async function synchronizeWorkspace(rawInput) {
       };
     }
     let rebaseCount = 0;
-    const expectedHead = revParse(input, `origin/${WORKSPACE_BRANCH}`);
-    if (candidateHead && expectedHead && !tryGit(input, input.shadowRoot, ["merge-base", "--is-ancestor", expectedHead, candidateHead])) {
-      const rebase = runGitResult(input, input.shadowRoot, ["rebase", `origin/${WORKSPACE_BRANCH}`]);
+    const expectedHead = remoteHeadBeforeRebase;
+    if (mustDropVisibleBaselinePrefix && !expectedHead) {
+      return {
+        ...observed,
+        outcome: "failed",
+        candidateHead: candidateHead ?? void 0,
+        error: "Cannot normalize a visible workspace tail onto an unborn canonical workspace",
+        gitStatus: gitStatus(input)
+      };
+    }
+    if (candidateHead && expectedHead && (mustDropVisibleBaselinePrefix || !tryGit(input, input.shadowRoot, ["merge-base", "--is-ancestor", expectedHead, candidateHead]))) {
+      const rebase = runGitResult(
+        input,
+        input.shadowRoot,
+        mustDropVisibleBaselinePrefix && visibleBaselineHead ? ["rebase", "--onto", `origin/${WORKSPACE_BRANCH}`, visibleBaselineHead] : ["rebase", `origin/${WORKSPACE_BRANCH}`]
+      );
       rebaseCount += 1;
       if (rebase.exitCode !== 0) {
         const conflicted = runGitResult(input, input.shadowRoot, ["diff", "--name-only", "--diff-filter=U", "-z"]);
         const conflictPaths = [.../* @__PURE__ */ new Set([...paths, ...conflicted.stdout.split("\0").filter(Boolean)])].sort();
+        if (mustDropVisibleBaselinePrefix) {
+          const originalCandidateHead = revParse(input, "ORIG_HEAD") ?? candidateHead;
+          return preserveInProgressWorkspaceRebaseConflict(input, observed, {
+            candidateHead: originalCandidateHead,
+            expectedHead,
+            rebaseCount,
+            conflictPaths,
+            error: `Workspace tail conflicts with canonical head ${expectedHead}; local changes were preserved for reconciliation in the in-progress rebase.`
+          });
+        }
         runGit(input, input.shadowRoot, ["rebase", "--abort"], "preserve workspace candidate after rebase conflict");
         return preserveWorkspaceConflictCandidate(input, observed, {
           baseRevision: candidateHead,
@@ -2068,6 +2222,9 @@ async function synchronizeWorkspace(rawInput) {
         error: "Workspace changed while its candidate was reconciling; visible changes and the old-base candidate were preserved."
       });
     }
+    if (blockedDiffError) {
+      return preserveLargeDiffCandidate(input, { ...observed, rebaseCount }, blockedDiffError);
+    }
     const upload = uploadWorkspaceCandidate(input, candidateHead);
     if (upload.exitCode !== 0) {
       return {

package/dist/types/workspace-convergence.d.ts

@@ -46,7 +46,9 @@ export declare class ExplicitWorkspacePublicationQueue<TTrigger> {
     enqueue(publication: ExplicitWorkspacePublication<TTrigger>, pendingRequestId?: string): void;
     next(): ExplicitWorkspacePublication<TTrigger> | undefined;
 }
-type PersistedWorkspaceConvergenceState = Omit<WorkspaceConvergenceSnapshot, "publicationState">;
+type PersistedWorkspaceConvergenceState = Omit<WorkspaceConvergenceSnapshot, "publicationState"> & {
+    visibleBaselineHead: string | null;
+};
 export declare function readWorkspaceConvergenceState(statePath: string): PersistedWorkspaceConvergenceState;
 export declare class WorkspaceConvergenceState {
     private readonly statePath;
@@ -54,7 +56,9 @@ export declare class WorkspaceConvergenceState {
     private publicationState;
     constructor(statePath: string);
     snapshot(): WorkspaceConvergenceSnapshot;
+    visibleBaselineHead(): string | null;
     setLocalHead(localHead: string | null): void;
+    setVisibleBaselineHead(visibleBaselineHead: string | null): void;
     observeCanonicalHead(canonicalHead: string | null): boolean;
     markDirty(): number;
     schedule(): void;
@@ -73,6 +77,13 @@ export declare class WorkspaceConvergenceState {
     private persist;
 }
 export declare function processWorkspaceConvergenceState(statePath: string): WorkspaceConvergenceState;
+export declare function workspaceBootstrapEstablishesVisibleBaseline(input: {
+    hydrated: boolean;
+    firstBootstrap: boolean;
+    incidentActive: boolean;
+    currentLocalHead: string | null;
+    currentVisibleBaselineHead: string | null;
+}): boolean;
 export declare function waitForWorkspacePublicationOnShutdown(input: {
     snapshot: () => WorkspaceConvergenceSnapshot;
     forcePublication: () => void;

package/dist/types/workspace-sync.d.ts

@@ -78,6 +78,15 @@ export type WorkspaceSyncInput = {
     quarantineRef?: string;
     /** Exact canonical head fenced by publication authority. */
     expectedCanonicalHead?: string | null;
+    /** Elected incident candidate pinned only while preparing remediation. */
+    expectedIncidentCandidateHead?: string;
+    /**
+     * Commit whose tree the visible workspace most recently reflected.
+     * Exact remediation may advance the disposable shadow checkout without
+     * hydrating visible files. A later visible snapshot must therefore rebuild
+     * its delta from this durable baseline before rebasing onto canonical main.
+     */
+    visibleBaselineHead?: string | null;
     confirmedLargeDiff?: boolean;
     confirmationReason?: string;
     resetToCanonical?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.61",
+  "version": "0.0.63",
   "type": "module",
   "main": "./dist/cjs/main.cjs",
   "module": "./dist/mjs/main.mjs",