@ricsam/r5d-worker 0.0.78 → 0.0.80

package/dist/mjs/main.mjs

@@ -4,6 +4,7 @@ import path from "node:path";
 import { createHash } from "node:crypto";
 import os, { hostname } from "node:os";
 import { spawn as spawnChildProcess } from "node:child_process";
+import { Database } from "bun:sqlite";
 import { installCliUpdate, readInstalledCliVersion } from "./cli-update.mjs";
 import { gitTransportSecurityArgs, workerGitProcessEnvironment } from "./git-process-environment.mjs";
 import {
@@ -14,40 +15,79 @@ import {
 import { terminateProcessTree } from "./process-tree.mjs";
 import { createPtyOutputCoalescer } from "./pty-output-coalescer.mjs";
 import { openWorkerPortForwardRelay } from "./port-forward-client.mjs";
+import {
+  configureGitHubRegistryAuthFiles,
+  planGitHubRegistryAuthFiles,
+  preparePrivateAuthFileGeneration,
+  registryAuthHasAppManagedGitHubCredential,
+  RegistryAuthConfigurationError
+} from "./registry-auth.mjs";
 import { applyWorkspaceIncidentUpdate } from "./workspace-incident-state.mjs";
-import { acquireWorkspaceCommandMutation, runWorkspaceCommand } from "./workspace-command-sync-policy.mjs";
+import {
+  hasActiveVisibleProjectsWorkspaceTarget,
+  PENDING_CREATED_BRANCH_AUTOMATIC_SYNC_GRACE_MS,
+  pendingCreatedBranchAutomaticSyncDeferral,
+  pendingCreatedBranchKey,
+  projectBranchHasActiveWorkspaceTarget
+} from "./workspace-automatic-sync-policy.mjs";
+import {
+  acquireWorkspaceCommandMutation,
+  reserveWorkspaceCommandAfterCurrentSync,
+  runWorkspaceCommand
+} from "./workspace-command-sync-policy.mjs";
 import { WorkspaceMutationGate } from "./workspace-mutation-gate.mjs";
+import { checkoutPathMovePublicationComplete, preserveProjectCheckoutPathMove } from "./workspace-path-move.mjs";
+import { busyProjectConfigurationChangeIds, deferredProjectConfigurationPendingBranches } from "./workspace-project-config-policy.mjs";
+import { creatorLocalProjectBranchIsAuthorized, workerProjectBranchDisposition } from "./workspace-preserve-only-policy.mjs";
+import { assertProjectBranchDeletionIncarnation } from "./workspace-branch-incarnation-policy.mjs";
+import { activeProjectBranchPublicationEvidence } from "./workspace-publication-evidence.mjs";
+import {
+  assertRepositoryExecutionEnabled,
+  assertRepositoryTransitionState,
+  enabledRepositoryTransitionRequiresReseed,
+  repositoryMirrorWritesAllowed
+} from "./repository-transition-policy.mjs";
 import {
   isRetryableWorkerServerStatus,
   superviseWorkerRuntime,
+  WORKER_CREDENTIAL_RESTART_EXIT_CODE,
   WORKER_RECONNECT_DELAY_MS,
   WORKER_RECONNECT_EXIT_CODE,
   WORKER_RELOAD_EXIT_CODE,
   WORKER_RUNTIME_ENV
 } from "./supervisor.mjs";
-import { managedProjectRoot, validateManagedBranchName } from "./managed-paths.mjs";
+import { assertDisjointManagedRoots, managedProjectRoot, validateManagedBranchName } from "./managed-paths.mjs";
 import {
-  cleanupStaleProjectWorktreeSnapshots,
-  createLinkedProjectBranch,
+  applyObservedProjectMirrorHeads,
+  assertProjectMirrorHeadsPushed,
+  recoverStaleProjectWorktreeSnapshots,
+  createOrRetryLinkedProjectBranch,
   deleteLinkedProjectBranch,
   deleteProjectMirrorBranch,
   ensureProjectWorktrees,
-  fastForwardProjectHeadsFromMirror,
+  observeProjectMirrorHeads,
+  projectBranchMayExistAfterCreateFailure,
+  projectOriginBranchName,
   projectWorktreeConfigurationFingerprint,
   projectWorktreeOperationInProgress,
   pushProjectMirrorHeads,
   removeProjectWorktrees
 } from "./project-worktrees.mjs";
 import {
+  ProjectWorkspacePendingBranchPathChangeError,
   ProjectWorkspaceStateStore,
   pruneAuthoritativelyDesiredBranchDeletions
 } from "./project-workspace-state.mjs";
 import {
   ensureWorkspaceGitClone,
   hydrateWorkspaceGitMounts,
+  recoverWorkspaceGitHydration,
   resetWorkspaceGit,
-  synchronizeWorkspaceGit
+  synchronizeWorkspaceGit,
+  workspaceGitHydrationIsCurrent
 } from "./workspace-git-sync.mjs";
+class ProjectWorkspaceConfigurationDeferredError extends Error {
+}
 class WorkerServerUnavailableError extends Error {
   name = "WorkerServerUnavailableError";
 }
@@ -60,12 +100,19 @@ const MAX_LINE_LENGTH = 2e3;
 const WORKSPACE_GIT_QUIET_MS = 5e3;
 const WORKSPACE_GIT_PERIODIC_MS = 6e4;
 const activeProcesses = /* @__PURE__ */ new Map();
+const credentialBearingProcessGroups = /* @__PURE__ */ new Map();
+const credentialBearingProcessGroupTargets = /* @__PURE__ */ new Map();
+const workspaceSyncPriorityProcessTargets = /* @__PURE__ */ new Map();
+const workspaceSyncPriorityOperationTargets = /* @__PURE__ */ new Map();
 const pendingProcessTerminals = /* @__PURE__ */ new Map();
 const cancelledProcessRuns = /* @__PURE__ */ new Set();
 const activePtys = /* @__PURE__ */ new Map();
+const workspaceSyncPriorityPtyTargets = /* @__PURE__ */ new Map();
 let currentWorkerSocket = null;
+let workerAdmissionGeneration = 0;
 const workspaceMutationGate = new WorkspaceMutationGate();
 let workspaceSyncQueue = Promise.resolve();
+let startupProjectSnapshotRecoveryCompleted = false;
 const workspaceSyncSingleFlight = {
   runExclusive(operation) {
     const queued = workspaceMutationGate.runSync(operation);
@@ -86,7 +133,29 @@ const workspaceSyncSingleFlight = {
   }
 };
 let githubCredential = null;
+let configuredCredentialGenerationFingerprint = null;
+let pendingCredentialGenerationIntentAtProcessStart = null;
+let bootstrapCredentialGenerationFingerprintAtProcessStart = null;
+let bootSessionIdentifierAtProcessStart = null;
+let machineIdentifierAtProcessStart = null;
+let systemdInvocationIdentifierAtProcessStart = null;
+let initialCredentialBootstrapProvenEmpty = false;
 let visibleGitIdentity = null;
+class StaleWorkerAdmissionError extends Error {
+  constructor() {
+    super("Worker command admission was invalidated before child creation");
+    this.name = "StaleWorkerAdmissionError";
+  }
+}
+function advanceWorkerAdmissionGeneration() {
+  workerAdmissionGeneration += 1;
+  return workerAdmissionGeneration;
+}
+function assertWorkerChildAdmission(input) {
+  if (input.capturedGeneration !== input.currentGeneration || !input.sourceSocketIsCurrent || !input.sourceSocketOpen || !input.workspaceConfigured || !input.runtimeHealthy) {
+    throw new StaleWorkerAdmissionError();
+  }
+}
 function defaultConfigPath() {
   return path.join(os.homedir(), ".config", "r5d", "r5dctl", "config.json");
 }
@@ -788,6 +857,183 @@ function readOnlyCredentialStoreHelper(storePath) {
 function credentialStoreDirectory() {
   return path.join(os.homedir(), ".r5d", "git-credentials");
 }
+function credentialGenerationReceiptPath(directoryPath = credentialStoreDirectory()) {
+  return path.join(directoryPath, ".auth-generation");
+}
+function pendingCredentialGenerationPath(directoryPath = credentialStoreDirectory()) {
+  return path.join(directoryPath, ".auth-generation-pending");
+}
+function bootstrapCredentialGenerationPath(directoryPath = credentialStoreDirectory()) {
+  return path.join(directoryPath, ".auth-generation-bootstrap");
+}
+const BOOT_SESSION_IDENTIFIER_PATTERN = /^(?:linux:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|darwin:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/;
+const MACHINE_IDENTIFIER_PATTERN = /^(?:linux:[0-9a-f]{32}|darwin:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|win32:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/;
+const SYSTEMD_INVOCATION_IDENTIFIER_PATTERN = /^[0-9a-f]{32}$/;
+function exactObjectKeys(value, expected) {
+  const actual = Object.keys(value).sort();
+  const expectedKeys = [...expected].sort();
+  return actual.length === expectedKeys.length && actual.every((key, index) => key === expectedKeys[index]);
+}
+function pendingCredentialGenerationIntentContent(intent) {
+  return `${JSON.stringify({ version: 1, fingerprint: intent.fingerprint, boundary: intent.boundary })}
+`;
+}
+function readPendingCredentialGenerationIntent(intentPath = pendingCredentialGenerationPath()) {
+  const stat = lstatIfExists(intentPath);
+  if (!stat) return null;
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    throw new RegistryAuthConfigurationError(new Error(`Pending credential generation intent must be a regular file: ${intentPath}`));
+  }
+  try {
+    const parsed = JSON.parse(fs.readFileSync(intentPath, "utf8"));
+    const boundary = parsed.boundary;
+    if (!parsed || Array.isArray(parsed) || !exactObjectKeys(parsed, ["boundary", "fingerprint", "version"]) || parsed.version !== 1 || typeof parsed.fingerprint !== "string" || !/^[0-9a-f]{64}$/.test(parsed.fingerprint) || !boundary || typeof boundary !== "object" || Array.isArray(boundary)) {
+      throw new Error("invalid intent fields");
+    }
+    const boundaryRecord = boundary;
+    const machineId = boundaryRecord.machineId;
+    if (!(machineId === null || typeof machineId === "string" && MACHINE_IDENTIFIER_PATTERN.test(machineId))) {
+      throw new Error("invalid machine identifier");
+    }
+    let parsedBoundary;
+    if (boundaryRecord.kind === "systemd" && exactObjectKeys(boundaryRecord, ["invocationId", "kind", "machineId"]) && typeof boundaryRecord.invocationId === "string" && SYSTEMD_INVOCATION_IDENTIFIER_PATTERN.test(boundaryRecord.invocationId)) {
+      parsedBoundary = {
+        kind: "systemd",
+        machineId,
+        invocationId: boundaryRecord.invocationId
+      };
+    } else if (boundaryRecord.kind === "boot" && exactObjectKeys(boundaryRecord, ["bootSessionId", "kind", "machineId"]) && (boundaryRecord.bootSessionId === null || typeof boundaryRecord.bootSessionId === "string" && BOOT_SESSION_IDENTIFIER_PATTERN.test(boundaryRecord.bootSessionId))) {
+      parsedBoundary = {
+        kind: "boot",
+        machineId,
+        bootSessionId: boundaryRecord.bootSessionId
+      };
+    } else {
+      throw new Error("invalid credential boundary");
+    }
+    return { fingerprint: parsed.fingerprint, boundary: parsedBoundary };
+  } catch (error) {
+    throw new RegistryAuthConfigurationError(
+      new Error(`Pending credential generation intent is malformed: ${intentPath}`, { cause: error })
+    );
+  }
+}
+function parseBootSessionIdentifier(probe) {
+  const value = probe.kernelValue.trim();
+  if (probe.platform === "linux") {
+    return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value) ? `linux:${value.toLowerCase()}` : null;
+  }
+  if (probe.platform === "darwin") {
+    return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value) ? `darwin:${value.toLowerCase()}` : null;
+  }
+  return null;
+}
+function readBootSessionIdentifier(probe) {
+  if (probe) return parseBootSessionIdentifier(probe);
+  try {
+    if (process.platform === "linux") {
+      return parseBootSessionIdentifier({
+        platform: process.platform,
+        kernelValue: fs.readFileSync("/proc/sys/kernel/random/boot_id", "utf8")
+      });
+    }
+    const command = process.platform === "darwin" ? ["/usr/sbin/sysctl", "-n", "kern.bootsessionuuid"] : null;
+    if (!command) return null;
+    const result = Bun.spawnSync(command, {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: workerGitProcessEnvironment(),
+      timeout: 2e3
+    });
+    if (result.exitCode !== 0) return null;
+    return parseBootSessionIdentifier({ platform: process.platform, kernelValue: result.stdout.toString() });
+  } catch {
+    return null;
+  }
+}
+function parseMachineIdentifier(probe) {
+  const value = probe.kernelValue.trim();
+  if (probe.platform === "linux") {
+    return /^[0-9a-f]{32}$/i.test(value) ? `linux:${value.toLowerCase()}` : null;
+  }
+  const uuid = probe.platform === "darwin" ? /["']?IOPlatformUUID["']?\s*=\s*["']([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})["']/i.exec(value)?.[1] : probe.platform === "win32" ? /^\{?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\}?$/i.exec(value)?.[1] : null;
+  return uuid ? `${probe.platform}:${uuid.toLowerCase()}` : null;
+}
+function readMachineIdentifier(probe) {
+  if (probe) return parseMachineIdentifier(probe);
+  try {
+    if (process.platform === "linux") {
+      return parseMachineIdentifier({ platform: process.platform, kernelValue: fs.readFileSync("/etc/machine-id", "utf8") });
+    }
+    const command = process.platform === "darwin" ? ["/usr/sbin/ioreg", "-rd1", "-c", "IOPlatformExpertDevice"] : null;
+    if (!command) return null;
+    const result = Bun.spawnSync(command, {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: workerGitProcessEnvironment(),
+      timeout: 2e3
+    });
+    if (result.exitCode !== 0) return null;
+    return parseMachineIdentifier({ platform: process.platform, kernelValue: result.stdout.toString() });
+  } catch {
+    return null;
+  }
+}
+function credentialAuthorityLockPath(rootPath = path.join(os.homedir(), ".r5d")) {
+  return path.join(rootPath, ".credential-authority.sqlite");
+}
+function acquireCredentialAuthorityLock(input) {
+  const rootPath = path.resolve(input.rootPath ?? path.join(os.homedir(), ".r5d"));
+  const rootStat = lstatIfExists(rootPath);
+  if (rootStat) {
+    if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+      throw new Error(`Worker credential authority root must be a directory: ${rootPath}`);
+    }
+  } else {
+    fs.mkdirSync(rootPath, { recursive: true, mode: 448 });
+  }
+  fs.chmodSync(rootPath, 448);
+  const lockPath = credentialAuthorityLockPath(rootPath);
+  const existing = lstatIfExists(lockPath);
+  if (existing && (existing.isSymbolicLink() || !existing.isFile())) {
+    throw new Error(`Worker credential authority database must be a regular file: ${lockPath}`);
+  }
+  const database = new Database(lockPath, { create: true, strict: true });
+  try {
+    database.exec("PRAGMA busy_timeout = 0; PRAGMA journal_mode = DELETE");
+    database.exec("CREATE TABLE IF NOT EXISTS authority_metadata (singleton INTEGER PRIMARY KEY CHECK (singleton = 1), machine_id TEXT)");
+    database.exec("BEGIN IMMEDIATE");
+    try {
+      const row = database.query("SELECT machine_id AS machineId FROM authority_metadata WHERE singleton = 1").get();
+      if (row) {
+        if (row.machineId === null || input.machineId === null) {
+          if (row.machineId !== input.machineId) {
+            throw new Error("Cannot prove that the worker credential authority database belongs to this machine");
+          }
+        } else if (row.machineId !== input.machineId) {
+          throw new Error("Worker credential authority home belongs to a different machine; refusing to move or share credential state");
+        }
+      } else {
+        database.query("INSERT INTO authority_metadata (singleton, machine_id) VALUES (1, ?)").run(input.machineId);
+      }
+      database.exec("COMMIT");
+    } catch (error) {
+      database.exec("ROLLBACK");
+      throw error;
+    }
+    database.exec("BEGIN EXCLUSIVE");
+    return { lockPath, database };
+  } catch (error) {
+    database.close(false);
+    if (error instanceof Error && /database is locked|SQLITE_BUSY/i.test(error.message)) {
+      throw new Error("Another r5d-worker credential authority is already running under this OS account", { cause: error });
+    }
+    throw error;
+  }
+}
+function releaseCredentialAuthorityLockHandle(handle) {
+  handle.database.close(false);
+}
 function legacySharedCredentialStorePath() {
   return path.join(os.homedir(), ".r5d", "github-credentials");
 }
@@ -818,9 +1064,24 @@ function ensurePrivateCredentialStoreDirectory(directoryPath) {
   fs.chmodSync(directoryPath, 448);
 }
 function removeLegacySharedCredentialStore(storePath = legacySharedCredentialStorePath()) {
-  fs.rmSync(storePath, { force: true });
+  const prepared = preparePrivateAuthFileGeneration([{ filePath: storePath, content: null, allowSymlinkRemoval: true }]);
+  prepared.commit();
 }
 let credentialStoreDirectoryInitialized = false;
+let credentialAuthorityLockHandle = null;
+function releaseCredentialAuthorityLock() {
+  const handle = credentialAuthorityLockHandle;
+  credentialAuthorityLockHandle = null;
+  if (!handle) return;
+  try {
+    releaseCredentialAuthorityLockHandle(handle);
+  } catch (error) {
+    process.stderr.write(
+      `[r5d-worker] could not release credential authority lock: ${error instanceof Error ? error.message : String(error)}
+`
+    );
+  }
+}
 function resetCredentialStoreDirectory(directoryPath = credentialStoreDirectory()) {
   const stat = lstatIfExists(directoryPath);
   if (stat) {
@@ -831,11 +1092,73 @@ function resetCredentialStoreDirectory(directoryPath = credentialStoreDirectory(
 }
 function initializeCredentialStoreDirectoryOnce() {
   if (credentialStoreDirectoryInitialized) return;
-  removeLegacySharedCredentialStore();
-  resetCredentialStoreDirectory();
+  systemdInvocationIdentifierAtProcessStart = SYSTEMD_INVOCATION_IDENTIFIER_PATTERN.test(process.env.INVOCATION_ID ?? "") ? process.env.INVOCATION_ID.toLowerCase() : null;
+  bootSessionIdentifierAtProcessStart = readBootSessionIdentifier();
+  machineIdentifierAtProcessStart = readMachineIdentifier();
+  credentialAuthorityLockHandle = acquireCredentialAuthorityLock({
+    machineId: machineIdentifierAtProcessStart
+  });
+  process.once("exit", releaseCredentialAuthorityLock);
+  initialCredentialBootstrapProvenEmpty = noPriorCredentialArtifactsAtProcessStart();
+  ensurePrivateCredentialStoreDirectory(credentialStoreDirectory());
+  configuredCredentialGenerationFingerprint = readCredentialGenerationReceipt();
+  pendingCredentialGenerationIntentAtProcessStart = readPendingCredentialGenerationIntent();
+  bootstrapCredentialGenerationFingerprintAtProcessStart = readCredentialGenerationReceipt(bootstrapCredentialGenerationPath());
   credentialStoreDirectoryInitialized = true;
 }
+function noPriorCredentialArtifactsAtProcessStart() {
+  if (lstatIfExists(credentialStoreDirectory()) || lstatIfExists(legacySharedCredentialStorePath())) return false;
+  try {
+    return ![dockerConfigPath(), containersAuthPath()].some(registryAuthHasAppManagedGitHubCredential);
+  } catch {
+    return false;
+  }
+}
+function readCredentialGenerationReceipt(receiptPath = credentialGenerationReceiptPath()) {
+  const stat = lstatIfExists(receiptPath);
+  if (!stat) return null;
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    throw new RegistryAuthConfigurationError(new Error(`Credential generation receipt must be a regular file: ${receiptPath}`));
+  }
+  const content = fs.readFileSync(receiptPath, "utf8");
+  const match = /^([0-9a-f]{64})\n$/.exec(content);
+  if (!match) {
+    throw new RegistryAuthConfigurationError(new Error(`Credential generation receipt is malformed: ${receiptPath}`));
+  }
+  return match[1];
+}
 const APP_CREDENTIAL_STORE_FILE = /^(?:project|workspace)-[0-9a-f]{64}\.store$/;
+function planCredentialStoreGeneration(desiredFiles, directoryPath = credentialStoreDirectory()) {
+  ensurePrivateCredentialStoreDirectory(directoryPath);
+  const resolvedDirectory = path.resolve(directoryPath);
+  const updates = /* @__PURE__ */ new Map();
+  const symlinkRemovals = /* @__PURE__ */ new Set();
+  for (const [storePath, content] of desiredFiles) {
+    const resolvedStorePath = path.resolve(storePath);
+    if (path.dirname(resolvedStorePath) !== resolvedDirectory || !APP_CREDENTIAL_STORE_FILE.test(path.basename(resolvedStorePath))) {
+      throw new Error("Invalid app-owned Git credential-store path");
+    }
+    updates.set(resolvedStorePath, content);
+  }
+  for (const name of fs.readdirSync(directoryPath)) {
+    if (!APP_CREDENTIAL_STORE_FILE.test(name)) continue;
+    const storePath = path.join(resolvedDirectory, name);
+    const stat = fs.lstatSync(storePath);
+    if (stat.isSymbolicLink()) {
+      if (updates.has(storePath)) throw new Error(`Required Git credential store must not be a symlink: ${storePath}`);
+      updates.set(storePath, null);
+      symlinkRemovals.add(storePath);
+      continue;
+    }
+    if (!stat.isFile()) throw new Error(`Git credential store must be a regular file: ${storePath}`);
+    if (!updates.has(storePath)) updates.set(storePath, null);
+  }
+  return [...updates].map(([filePath, content]) => ({
+    filePath,
+    content,
+    ...symlinkRemovals.has(filePath) ? { allowSymlinkRemoval: true } : {}
+  }));
+}
 function pruneCredentialStoreFiles(requiredStorePaths, directoryPath = credentialStoreDirectory()) {
   ensurePrivateCredentialStoreDirectory(directoryPath);
   const resolvedDirectory = path.resolve(directoryPath);
@@ -853,9 +1176,10 @@ function pruneCredentialStoreFiles(requiredStorePaths, directoryPath = credentia
     const storePath = path.join(directoryPath, name);
     const stat = fs.lstatSync(storePath);
     if (!stat.isFile() && !stat.isSymbolicLink()) continue;
-    fs.unlinkSync(storePath);
     removed.push(storePath);
   }
+  const prepared = preparePrivateAuthFileGeneration(removed.map((filePath) => ({ filePath, content: null, allowSymlinkRemoval: true })));
+  prepared.commit();
   return removed;
 }
 function removeProjectCredentialStore(projectId) {
@@ -863,7 +1187,8 @@ function removeProjectCredentialStore(projectId) {
   const stat = lstatIfExists(storePath);
   if (!stat) return;
   if (!stat.isFile() && !stat.isSymbolicLink()) throw new Error("Git credential store must be a regular file");
-  fs.unlinkSync(storePath);
+  const prepared = preparePrivateAuthFileGeneration([{ filePath: storePath, content: null, allowSymlinkRemoval: true }]);
+  prepared.commit();
 }
 function decodeGitAuthHeader(authHeader) {
   const match = /^Authorization:\s*Basic\s+(.+)$/i.exec(authHeader.trim());
@@ -883,16 +1208,10 @@ function credentialUsernameForAuthHeader(authHeader) {
   return credentials.username;
 }
 function replaceCredentialStoreFile(storePath, content) {
-  const temporaryPath = path.join(path.dirname(storePath), `.${path.basename(storePath)}.${process.pid}.${crypto.randomUUID()}.tmp`);
-  try {
-    fs.writeFileSync(temporaryPath, content, { flag: "wx", mode: 384 });
-    fs.chmodSync(temporaryPath, 384);
-    fs.renameSync(temporaryPath, storePath);
-  } finally {
-    fs.rmSync(temporaryPath, { force: true });
-  }
+  const prepared = preparePrivateAuthFileGeneration([{ filePath: storePath, content }]);
+  prepared.commit();
 }
-function writeCredentialStoreEntries(remotes, storePath) {
+function credentialStoreContent(remotes) {
   const authoritativeEntries = /* @__PURE__ */ new Map();
   for (const input of remotes) {
     let remote;
@@ -924,23 +1243,179 @@ function writeCredentialStoreEntries(remotes, storePath) {
     }
     authoritativeEntries.set(hostKey, replacement);
   }
-  const storeStat = lstatIfExists(storePath);
-  if (storeStat) {
-    if (storeStat.isSymbolicLink() || !storeStat.isFile()) throw new Error("Git credential store must be a regular file");
-  }
   const replacements = [...authoritativeEntries.values()].filter((entry) => entry !== null);
-  if (replacements.length === 0) {
-    if (storeStat) fs.unlinkSync(storePath);
-    return null;
+  return replacements.length > 0 ? `${replacements.join("\n")}
+` : null;
+}
+function writeCredentialStoreEntries(remotes, storePath) {
+  const content = credentialStoreContent(remotes);
+  const prepared = preparePrivateAuthFileGeneration([{ filePath: storePath, content }]);
+  prepared.commit();
+  return content === null ? null : { hasCredentials: true, storePath };
+}
+function credentialHelperForRemotes(remotes, storePath, desiredFiles) {
+  if (!desiredFiles) {
+    const credentialStore = writeCredentialStoreEntries(remotes, storePath);
+    return credentialStore?.hasCredentials ? readOnlyCredentialStoreHelper(credentialStore.storePath) : null;
+  }
+  const resolvedStorePath = path.resolve(storePath);
+  const content = credentialStoreContent(remotes);
+  const previous = desiredFiles.get(resolvedStorePath);
+  if (desiredFiles.has(resolvedStorePath) && previous !== content) {
+    throw new Error(`Conflicting desired Git credentials for ${resolvedStorePath}`);
+  }
+  desiredFiles.set(resolvedStorePath, content);
+  return content === null ? null : readOnlyCredentialStoreHelper(resolvedStorePath);
+}
+function authenticatedRemoteCredentialSecret(remoteUrl, authHeader) {
+  if (authHeader == null) return null;
+  let remote;
+  try {
+    remote = new URL(remoteUrl);
+  } catch {
+    throw new Error("Invalid authenticated Git remote URL");
   }
-  ensurePrivateCredentialStoreDirectory(path.dirname(storePath));
-  replaceCredentialStoreFile(storePath, `${replacements.join("\n")}
-`);
-  return { hasCredentials: true, storePath };
+  if (remote.protocol !== "https:" && remote.protocol !== "http:") {
+    throw new Error("Unsupported authenticated Git remote protocol");
+  }
+  if (remote.username || remote.password) throw new Error("Git credentials must not be embedded in a remote URL");
+  const credentials = decodeGitAuthHeader(authHeader);
+  if (!credentials) throw new Error("Unsupported Git authorization header");
+  return credentials.password;
+}
+function credentialMaterialCommitment(kind, values) {
+  return createHash("sha256").update(JSON.stringify([`r5d-credential-${kind}-v1`, ...values])).digest("hex");
+}
+function credentialGenerationFingerprint(config) {
+  const workerApiUrl = new URL(config.workerBaseUrl);
+  if (workerApiUrl.protocol !== "https:" && workerApiUrl.protocol !== "http:") {
+    throw new Error("Unsupported worker API protocol");
+  }
+  const workerCredentials = decodeGitAuthHeader(config.workerAuthHeader);
+  if (!workerCredentials) throw new Error("Unsupported worker authorization header");
+  const materialCommitments = /* @__PURE__ */ new Set();
+  const addSecret = (secret) => {
+    materialCommitments.add(`secret:${credentialMaterialCommitment("secret", [secret])}`);
+  };
+  addSecret(workerCredentials.password);
+  const workspaceSecret = authenticatedRemoteCredentialSecret(config.workspaceRemoteUrl, config.workerAuthHeader);
+  if (workspaceSecret) addSecret(workspaceSecret);
+  for (const project of config.projects) {
+    if (!project.repoHttpUrl) continue;
+    const secret = authenticatedRemoteCredentialSecret(project.repoHttpUrl, project.repoAuthHeader);
+    if (secret) addSecret(secret);
+  }
+  if (config.githubCredential) {
+    addSecret(config.githubCredential.token);
+    materialCommitments.add(
+      `github_authority:${credentialMaterialCommitment("github_authority", [
+        config.githubCredential.token,
+        ...[...config.githubCredential.missingScopes].sort()
+      ])}`
+    );
+  }
+  return createHash("sha256").update(JSON.stringify([...materialCommitments].sort())).digest("hex");
+}
+function credentialGenerationTransitionPhase(input) {
+  if (input.committedFingerprint === input.incomingFingerprint) return "current";
+  if (input.pendingFingerprintAtProcessStart !== null) {
+    return input.pendingFingerprintAtProcessStart === input.incomingFingerprint ? "publish_from_clean_restart" : "stage_pending_restart";
+  }
+  return "stage_pending_restart";
+}
+function initialCredentialBootstrapIsSafe(input) {
+  return input.transitionPhase === "stage_pending_restart" && input.committedFingerprint === null && input.pendingFingerprintAtProcessStart === null && (input.bootstrapFingerprintAtProcessStart === null && input.credentialArtifactsProvenAbsentAtProcessStart || input.bootstrapFingerprintAtProcessStart === input.incomingFingerprint) && input.trackedChildTerminationProven && input.activeProcessCount === 0 && input.credentialProcessGroupCount === 0 && input.activePtyCount === 0;
 }
-function credentialHelperForRemotes(remotes, storePath) {
-  const credentialStore = writeCredentialStoreEntries(remotes, storePath);
-  return credentialStore?.hasCredentials ? readOnlyCredentialStoreHelper(credentialStore.storePath) : null;
+async function fenceCredentialGenerationAtConfigureEntry(input) {
+  if (input.currentFingerprint === input.incomingFingerprint) return false;
+  input.revokeInMemory();
+  await input.terminatePreviousGeneration();
+  return true;
+}
+function requireCredentialGenerationRestart(required, fatalExit = (exitCode2) => process.exit(exitCode2), exitCode = 1) {
+  if (!required) return;
+  fatalExit(exitCode);
+  throw new Error("Credential generation restart callback returned unexpectedly");
+}
+function pendingCredentialGenerationBoundary(input) {
+  if (input.systemdContract && input.systemdInvocationId !== null && SYSTEMD_INVOCATION_IDENTIFIER_PATTERN.test(input.systemdInvocationId)) {
+    return { kind: "systemd", machineId: input.machineId, invocationId: input.systemdInvocationId };
+  }
+  return { kind: "boot", machineId: input.machineId, bootSessionId: input.bootSessionId };
+}
+function credentialGenerationBoundaryIsComplete(boundary) {
+  return boundary.machineId !== null && (boundary.kind === "systemd" || boundary.bootSessionId !== null);
+}
+function credentialGenerationRestartIsContained(input) {
+  const pending = input.pendingBoundary;
+  if (pending === null || pending.machineId === null || input.currentMachineId === null || pending.machineId !== input.currentMachineId) {
+    return false;
+  }
+  if (pending.kind === "systemd") {
+    return input.systemdContract && input.currentSystemdInvocationId !== null && SYSTEMD_INVOCATION_IDENTIFIER_PATTERN.test(input.currentSystemdInvocationId) && pending.invocationId !== input.currentSystemdInvocationId;
+  }
+  return pending.bootSessionId !== null && input.currentBootSessionId !== null && pending.bootSessionId !== input.currentBootSessionId;
+}
+function credentialReapContractStatus(probe) {
+  let resolved = probe;
+  if (!resolved) {
+    if (process.platform !== "linux") return "direct";
+    try {
+      const cgroupText = fs.readFileSync("/proc/self/cgroup", "utf8");
+      const unit = cgroupText.match(/(?:^|\/)r5d-worker\.service(?:$|\n)/m)?.[0]?.replace(/^\//, "").trim();
+      if (unit !== "r5d-worker.service") {
+        return SYSTEMD_INVOCATION_IDENTIFIER_PATTERN.test(process.env.INVOCATION_ID ?? "") ? "systemd_unverified" : "direct";
+      }
+      const result = Bun.spawnSync(
+        [
+          "/usr/bin/systemctl",
+          "show",
+          unit,
+          "--no-pager",
+          "--property=KillMode",
+          "--property=Restart",
+          "--property=SendSIGKILL",
+          "--property=InvocationID"
+        ],
+        {
+          stdout: "pipe",
+          stderr: "pipe",
+          env: workerGitProcessEnvironment(),
+          timeout: 2e3
+        }
+      );
+      if (result.exitCode !== 0) return "systemd_unverified";
+      resolved = {
+        platform: process.platform,
+        invocationId: process.env.INVOCATION_ID,
+        cgroupText,
+        unitProperties: result.stdout.toString()
+      };
+    } catch {
+      return "systemd_unverified";
+    }
+  }
+  if (resolved.platform !== "linux") return "direct";
+  if (!/(?:^|\/)r5d-worker\.service(?:$|\n)/m.test(resolved.cgroupText)) {
+    return SYSTEMD_INVOCATION_IDENTIFIER_PATTERN.test(resolved.invocationId ?? "") ? "systemd_unverified" : "direct";
+  }
+  if (!SYSTEMD_INVOCATION_IDENTIFIER_PATTERN.test(resolved.invocationId ?? "")) return "systemd_unverified";
+  const properties = new Map(
+    resolved.unitProperties.split(/\r?\n/).filter(Boolean).map((line) => {
+      const separator = line.indexOf("=");
+      return separator < 1 ? [line, ""] : [line.slice(0, separator), line.slice(separator + 1)];
+    })
+  );
+  return properties.get("KillMode") === "control-group" && properties.get("Restart") === "always" && properties.get("SendSIGKILL") === "yes" && properties.get("InvocationID")?.toLowerCase() === resolved.invocationId?.toLowerCase() ? "verified_systemd" : "systemd_unverified";
+}
+function verifiedCredentialReapContract(probe) {
+  return credentialReapContractStatus(probe) === "verified_systemd";
+}
+function fenceUnsafeWorkspaceSyncFailure(input) {
+  if (input.hydrationCurrent) return false;
+  input.invalidateExecution();
+  requireCredentialGenerationRestart(true, input.fatalExit, input.exitCode);
+  return true;
 }
 const workerGitSecurityTestHarness = {
   commandArgs: workerGitCommand.commandArgs,
@@ -952,7 +1427,45 @@ const workerGitSecurityTestHarness = {
   pruneCredentialStoreFiles,
   readOnlyCredentialStoreHelper,
   resetCredentialStoreDirectory,
-  replaceCredentialStoreFile
+  replaceCredentialStoreFile,
+  configureGitHubAuth(credential, filePaths, configureFiles = configureGitHubRegistryAuthFiles) {
+    configureGitHubAuth(credential, filePaths, configureFiles);
+  },
+  githubCredential: () => githubCredential,
+  credentialGenerationFingerprint,
+  credentialGenerationTransitionPhase,
+  initialCredentialBootstrapIsSafe,
+  fenceCredentialGenerationAtConfigureEntry,
+  requireCredentialGenerationRestart,
+  pendingCredentialGenerationBoundary,
+  credentialGenerationBoundaryIsComplete,
+  credentialGenerationRestartIsContained,
+  credentialReapContractStatus,
+  verifiedCredentialReapContract,
+  fenceUnsafeWorkspaceSyncFailure,
+  assertWorkerChildAdmission,
+  terminateCredentialBearingChildren,
+  terminateCredentialBearingChildrenWithRetention,
+  async commitCredentialGeneration(prepared, credential, children, beforeMutation, previousGenerationFenced = false) {
+    return await commitCredentialGeneration(
+      prepared,
+      credential,
+      async () => await terminateCredentialBearingChildren(children),
+      beforeMutation,
+      previousGenerationFenced
+    );
+  },
+  credentialGenerationReceiptPath,
+  credentialAuthorityLockPath,
+  acquireCredentialAuthorityLock,
+  releaseCredentialAuthorityLockHandle,
+  pendingCredentialGenerationPath,
+  pendingCredentialGenerationIntentContent,
+  readPendingCredentialGenerationIntent,
+  readBootSessionIdentifier,
+  readMachineIdentifier,
+  bootstrapCredentialGenerationPath,
+  readCredentialGenerationReceipt
 };
 function dockerConfigPath() {
   return path.join(os.homedir(), ".docker", "config.json");
@@ -960,39 +1473,14 @@ function dockerConfigPath() {
 function containersAuthPath() {
   return path.join(os.homedir(), ".config", "containers", "auth.json");
 }
-function readJsonFile(filePath) {
-  if (!fs.existsSync(filePath)) {
-    return {};
-  }
-  try {
-    const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function writeRegistryAuthFile(filePath, credential) {
-  const config = readJsonFile(filePath);
-  const existingAuths = config.auths && typeof config.auths === "object" && !Array.isArray(config.auths) ? config.auths : {};
-  const auths = existingAuths;
-  auths[credential.registry] = {
-    username: credential.username,
-    password: credential.token,
-    auth: Buffer.from(`${credential.username}:${credential.token}`).toString("base64")
-  };
-  config.auths = auths;
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  fs.writeFileSync(filePath, `${JSON.stringify(config, null, 2)}
-`, { mode: 384 });
-  fs.chmodSync(filePath, 384);
+function configureGitHubAuth(credential, filePaths = [dockerConfigPath(), containersAuthPath()], configureFiles = configureGitHubRegistryAuthFiles) {
+  githubCredential = null;
+  configureFiles(filePaths, credential);
+  installGitHubCredentialGeneration(credential);
 }
-function configureGitHubAuth(credential) {
+function installGitHubCredentialGeneration(credential) {
   githubCredential = credential;
-  if (!credential) {
-    return;
-  }
-  writeRegistryAuthFile(dockerConfigPath(), credential);
-  writeRegistryAuthFile(containersAuthPath(), credential);
+  if (!credential) return;
   if (credential.missingScopes.length > 0) {
     process.stderr.write(
       `[r5d-worker] GitHub token is missing scope(s): ${credential.missingScopes.join(", ")}. Sign in with GitHub again if gh or GHCR access fails.
@@ -1003,6 +1491,21 @@ function configureGitHubAuth(credential) {
 `);
   }
 }
+async function commitCredentialGeneration(prepared, credential, terminatePreviousGeneration, beforeMutation, previousGenerationFenced = false) {
+  const changed = prepared.changed;
+  try {
+    if (changed && !previousGenerationFenced) {
+      githubCredential = null;
+      await terminatePreviousGeneration();
+    }
+    prepared.commit(beforeMutation);
+  } catch (error) {
+    prepared.discard();
+    throw error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
+  }
+  installGitHubCredentialGeneration(credential);
+  return changed;
+}
 function containerRegistryEnv() {
   if (!githubCredential) {
     return {};
@@ -1032,6 +1535,44 @@ function githubProcessEnv() {
     ...githubCliEnv(githubCredential?.token)
   };
 }
+const INHERITED_WORKER_CREDENTIAL_ENV_KEYS = [
+  WORKER_RUNTIME_ENV,
+  "INVOCATION_ID",
+  "R5D_WORKER_TOKEN",
+  "R5D_TOKEN",
+  "R5DCTL_TOKEN",
+  "R5D_API_KEY",
+  "R5DCTL_API_KEY",
+  "GH_TOKEN",
+  "GITHUB_TOKEN",
+  "GH_ENTERPRISE_TOKEN",
+  "DOCKER_AUTH_CONFIG",
+  "REGISTRY_AUTH_FILE",
+  "R5D_GHCR_AUTH_FILE",
+  "NODE_AUTH_TOKEN",
+  "NPM_TOKEN",
+  "BUN_AUTH_TOKEN"
+];
+function workerChildProcessEnvironment(layers, inherited = process.env, platform = process.platform) {
+  const environment = {};
+  const reservedExact = new Set(INHERITED_WORKER_CREDENTIAL_ENV_KEYS);
+  const reservedFolded = new Set(INHERITED_WORKER_CREDENTIAL_ENV_KEYS.map((key) => key.toLowerCase()));
+  const assignLayer = (source, scrubInheritedCredentials) => {
+    for (const [key, value] of Object.entries(source)) {
+      const folded = key.toLowerCase();
+      if (scrubInheritedCredentials && (platform === "win32" ? reservedFolded.has(folded) : reservedExact.has(key))) continue;
+      if (platform === "win32") {
+        for (const existing of Object.keys(environment)) {
+          if (existing.toLowerCase() === folded) delete environment[existing];
+        }
+      }
+      environment[key] = value;
+    }
+  };
+  assignLayer(inherited, true);
+  for (const layer of layers) assignLayer(layer, false);
+  return environment;
+}
 function primaryProjectBranch(config) {
   if (config.branches.length === 0) throw new Error(`Project ${config.projectId} has no configured branches`);
   if (config.branches.some(({ branchName }) => branchName === "main")) return "main";
@@ -1059,6 +1600,8 @@ function describeWorkerSessionTarget(target) {
 function resolveWorkerSessionTarget(input) {
   if (input.target.type === "workspace") {
     if (input.target.rootProfile === "visible_projects") {
+      const disabled = [...input.projectConfigById.values()].find(({ executionDisabled }) => executionDisabled);
+      if (disabled) assertRepositoryExecutionEnabled(disabled);
       return { target: input.target, rootPath: input.projectsRoot };
     }
     if (!fs.existsSync(path.join(input.workspaceShadowRoot, ".git"))) {
@@ -1069,6 +1612,7 @@ function resolveWorkerSessionTarget(input) {
   const target = input.target;
   const config = input.projectConfigById.get(target.projectId);
   if (!config) throw new Error(`Project ${target.projectId} is missing from the worker workspace configuration`);
+  assertRepositoryExecutionEnabled(config);
   if (!config.branches.some(({ branchName }) => branchName === target.branchName)) {
     throw new Error(`Project branch ${target.projectId}/${target.branchName} is missing from the worker workspace configuration`);
   }
@@ -1768,6 +2312,7 @@ async function prepareShellEnvForTarget(input) {
 async function executeCommand(input) {
   const startedAt = Date.now();
   let timeout;
+  let spawnedProcess;
   try {
     const targetProcessEnv = await prepareShellEnvForTarget({
       target: input.resolvedTarget.target,
@@ -1779,18 +2324,17 @@ async function executeCommand(input) {
       activePlanId: input.message.env?.R5D_ACTIVE_PLAN_ID
     });
     const cwd = resolveCommandCwd(input.resolvedTarget.rootPath, input.message.cwd);
+    input.assertAdmission();
     const subprocess = Bun.spawn(input.message.argv, {
       cwd,
       stdout: "pipe",
       stderr: "pipe",
       detached: true,
-      env: {
-        ...process.env,
-        ...githubProcessEnv(),
-        ...input.message.env ?? {},
-        ...targetProcessEnv
-      }
+      env: workerChildProcessEnvironment([githubProcessEnv(), input.message.env ?? {}, targetProcessEnv])
     });
+    spawnedProcess = subprocess;
+    credentialBearingProcessGroups.set(subprocess.pid, subprocess);
+    credentialBearingProcessGroupTargets.set(subprocess.pid, input.resolvedTarget.target);
     activeProcesses.set(input.message.runId, {
       process: subprocess,
       target: input.resolvedTarget.target,
@@ -1827,6 +2371,7 @@ async function executeCommand(input) {
       durationMs: Date.now() - startedAt
     };
   } catch (error) {
+    if (error instanceof StaleWorkerAdmissionError) throw error;
     return {
       type: "exec_result",
       requestId: input.message.requestId,
@@ -1840,6 +2385,9 @@ async function executeCommand(input) {
     if (timeout) {
       clearTimeout(timeout);
     }
+    if (spawnedProcess) {
+      await reapCompletedCredentialBearingProcessGroup(input.message.runId, spawnedProcess);
+    }
     activeProcesses.delete(input.message.runId);
   }
 }
@@ -1848,6 +2396,7 @@ async function executeStreamingCommand(input) {
   let started = false;
   let timedOut = false;
   let timeout;
+  let spawnedProcess;
   try {
     if (cancelledProcessRuns.delete(input.message.runId)) {
       sendWorkerMessage(input.ws, {
@@ -1869,6 +2418,7 @@ async function executeStreamingCommand(input) {
     });
     const cwd = resolveCommandCwd(input.resolvedTarget.rootPath, input.message.cwd);
     const interactive = input.message.interactive === true;
+    input.assertAdmission();
     const subprocess = Bun.spawn(input.message.argv, {
       cwd,
       // Without an explicit stdin the process reads /dev/null and interactive
@@ -1877,13 +2427,11 @@ async function executeStreamingCommand(input) {
       stdout: "pipe",
       stderr: "pipe",
       detached: true,
-      env: {
-        ...process.env,
-        ...githubProcessEnv(),
-        ...input.message.env ?? {},
-        ...targetProcessEnv
-      }
+      env: workerChildProcessEnvironment([githubProcessEnv(), input.message.env ?? {}, targetProcessEnv])
     });
+    spawnedProcess = subprocess;
+    credentialBearingProcessGroups.set(subprocess.pid, subprocess);
+    credentialBearingProcessGroupTargets.set(subprocess.pid, input.resolvedTarget.target);
     activeProcesses.set(input.message.runId, {
       process: subprocess,
       target: input.resolvedTarget.target,
@@ -1948,6 +2496,7 @@ async function executeStreamingCommand(input) {
     pendingProcessTerminals.set(input.message.runId, terminal);
     sendWorkerMessage(input.ws, terminal);
   } catch (error) {
+    if (!started && error instanceof StaleWorkerAdmissionError) throw error;
     const message = error instanceof Error ? error.message : String(error);
     if (started) {
       const terminal = {
@@ -1971,10 +2520,27 @@ async function executeStreamingCommand(input) {
       clearTimeout(timeout);
     }
     closeProcessStdin(activeProcesses.get(input.message.runId));
+    if (spawnedProcess) {
+      await reapCompletedCredentialBearingProcessGroup(input.message.runId, spawnedProcess);
+    }
     activeProcesses.delete(input.message.runId);
     cancelledProcessRuns.delete(input.message.runId);
   }
 }
+async function reapCompletedCredentialBearingProcessGroup(runId, subprocess) {
+  try {
+    await terminateProcessTree(subprocess);
+    if (credentialBearingProcessGroups.get(subprocess.pid) === subprocess) {
+      credentialBearingProcessGroups.delete(subprocess.pid);
+      credentialBearingProcessGroupTargets.delete(subprocess.pid);
+    }
+  } catch (error) {
+    process.stderr.write(
+      `[r5d-worker] retained unreaped credential-bearing process group ${subprocess.pid} from ${runId}: ${error instanceof Error ? error.message : String(error)}
+`
+    );
+  }
+}
 function closeProcessStdin(active) {
   if (!active?.stdin) {
     return;
@@ -1994,6 +2560,15 @@ function sendWorkerMessage(ws, message) {
 `);
   }
 }
+function sendWorkerMessageFromCurrentSource(ws, message) {
+  if (currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN) return;
+  try {
+    ws.send(JSON.stringify(message));
+  } catch (error) {
+    process.stderr.write(`[r5d-worker] failed to send ${message.type}: ${error instanceof Error ? error.message : String(error)}
+`);
+  }
+}
 function buildActiveProcessReports() {
   return Array.from(activeProcesses.entries()).filter(([, active]) => active.sessionId.length > 0).map(([runId, active]) => ({
     runId,
@@ -2073,6 +2648,19 @@ rl.on("line", (line) => {
 
     if (message.type === "close") {
       ptyProcess.kill();
+      return;
+    }
+
+    if (message.type === "force_close") {
+      if (process.platform !== "win32" && Number.isSafeInteger(ptyProcess.pid) && ptyProcess.pid > 0) {
+        try {
+          process.kill(-ptyProcess.pid, "SIGKILL");
+        } catch (error) {
+          if (!error || error.code !== "ESRCH") throw error;
+        }
+      } else {
+        ptyProcess.kill("SIGKILL");
+      }
     }
   } catch (error) {
     send({ type: "error", error: error instanceof Error ? error.message : String(error) });
@@ -2104,14 +2692,26 @@ function nodePtyModulePaths() {
 }
 function createNodePtyBridge(options) {
   const child = spawnChildProcess("node", ["-e", PTY_BRIDGE_SCRIPT], {
-    env: {
-      ...process.env,
-      NODE_PATH: nodePtyModulePaths()
-    }
+    env: workerChildProcessEnvironment([{ NODE_PATH: nodePtyModulePaths() }])
   });
   let lineBuffer = "";
   let emittedTerminalEvent = false;
   let stderr = "";
+  let resolveTerminal;
+  const terminal = new Promise((resolve) => {
+    resolveTerminal = resolve;
+  });
+  const markTerminal = () => {
+    resolveTerminal?.();
+    resolveTerminal = void 0;
+  };
+  const terminalWithin = async (timeoutMs) => await Promise.race([
+    terminal.then(() => true),
+    new Promise((resolve) => {
+      const timer = setTimeout(() => resolve(false), timeoutMs);
+      timer.unref();
+    })
+  ]);
   const sendToChild = (message) => {
     if (child.stdin.writable) {
       child.stdin.write(`${JSON.stringify(message)}
@@ -2129,11 +2729,13 @@ function createNodePtyBridge(options) {
     }
     if (event.type === "exit") {
       emittedTerminalEvent = true;
+      markTerminal();
       options.onExit({ exitCode: event.exitCode, signal: event.signal });
       return;
     }
     if (event.type === "error") {
       emittedTerminalEvent = true;
+      markTerminal();
       options.onError(new Error(event.error));
     }
   };
@@ -2162,9 +2764,11 @@ function createNodePtyBridge(options) {
   });
   child.on("error", (error) => {
     emittedTerminalEvent = true;
+    markTerminal();
     options.onError(error);
   });
   child.on("exit", (code, signal) => {
+    markTerminal();
     if (emittedTerminalEvent) {
       return;
     }
@@ -2185,12 +2789,15 @@ function createNodePtyBridge(options) {
       sendToChild({ type: "resize", cols, rows });
     },
     kill() {
+      void this.terminate().catch((error) => options.onTerminationError(error instanceof Error ? error : new Error(String(error))));
+    },
+    async terminate() {
       sendToChild({ type: "close" });
-      setTimeout(() => {
-        if (!child.killed) {
-          child.kill();
-        }
-      }, 500);
+      if (await terminalWithin(500)) return;
+      sendToChild({ type: "force_close" });
+      if (await terminalWithin(500)) return;
+      child.kill("SIGKILL");
+      if (!await terminalWithin(500)) throw new Error(`PTY bridge ${child.pid ?? "unknown"} did not terminate after SIGKILL`);
     }
   };
 }
@@ -2228,6 +2835,7 @@ async function openPty(input) {
       });
     }
   });
+  input.assertAdmission();
   const ptyProcess = createNodePtyBridge({
     file: shell.file,
     args: shell.args,
@@ -2236,14 +2844,7 @@ async function openPty(input) {
       cols: Math.max(1, Math.min(Math.floor(input.message.cols || 80), 500)),
       rows: Math.max(1, Math.min(Math.floor(input.message.rows || 24), 500)),
       cwd: input.resolvedTarget.rootPath,
-      env: {
-        ...process.env,
-        ...githubProcessEnv(),
-        ...input.message.env ?? {},
-        ...planProcessEnv,
-        ...targetProcessEnv,
-        ...shell.env ?? {}
-      }
+      env: workerChildProcessEnvironment([githubProcessEnv(), input.message.env ?? {}, planProcessEnv, targetProcessEnv, shell.env ?? {}])
     },
     onOpened: () => {
       sendWorkerMessage(input.ws, {
@@ -2278,6 +2879,14 @@ async function openPty(input) {
         ptyId: input.message.ptyId,
         error: error.message
       });
+    },
+    onTerminationError: (error) => {
+      sendWorkerMessage(input.ws, {
+        type: "pty_error",
+        requestId: input.message.requestId,
+        ptyId: input.message.ptyId,
+        error: error.message
+      });
     }
   });
   activePtys.set(input.message.ptyId, {
@@ -2310,14 +2919,62 @@ function closePty(message) {
   if (!ptyProcess) {
     return;
   }
-  activePtys.delete(message.ptyId);
   ptyProcess.kill();
 }
 function closeAllPtys() {
   for (const ptyProcess of activePtys.values()) {
     ptyProcess.kill();
   }
-  activePtys.clear();
+}
+async function terminateCredentialBearingChildren(children) {
+  const results = await Promise.allSettled(children.map(async ({ terminate }) => await terminate()));
+  const failures = results.flatMap(
+    (result, index) => result.status === "rejected" ? [new Error(`Failed to terminate ${children[index].label}`, { cause: result.reason })] : []
+  );
+  if (failures.length > 0) throw new AggregateError(failures, "Credential-bearing child termination was incomplete");
+}
+async function terminateCredentialBearingChildrenWithRetention(children) {
+  const results = await Promise.allSettled(children.map(async ({ terminate }) => await terminate()));
+  const failures = [];
+  results.forEach((result, index) => {
+    const child = children[index];
+    if (result.status === "fulfilled") {
+      child.onTerminated();
+      return;
+    }
+    failures.push(new Error(`Failed to terminate ${child.label}`, { cause: result.reason }));
+  });
+  if (failures.length > 0) throw new AggregateError(failures, "Credential-bearing child termination was incomplete");
+}
+async function terminateActiveCredentialBearingChildren() {
+  const processGroups = [...credentialBearingProcessGroups.entries()];
+  const ptyEntries = [...activePtys.entries()];
+  for (const active of activeProcesses.values()) closeProcessStdin(active);
+  await terminateCredentialBearingChildrenWithRetention([
+    ...processGroups.map(([processGroupId, subprocess]) => ({
+      label: `process group ${processGroupId}`,
+      terminate: async () => await terminateProcessTree(subprocess),
+      onTerminated: () => {
+        if (credentialBearingProcessGroups.get(processGroupId) === subprocess) {
+          credentialBearingProcessGroups.delete(processGroupId);
+          credentialBearingProcessGroupTargets.delete(processGroupId);
+        }
+        for (const [runId, active] of activeProcesses) {
+          if (active.process === subprocess) activeProcesses.delete(runId);
+        }
+      }
+    })),
+    ...ptyEntries.map(([ptyId, active]) => ({
+      label: `PTY ${ptyId}`,
+      terminate: async () => await active.terminate(),
+      onTerminated: () => {
+        if (activePtys.get(ptyId) === active) activePtys.delete(ptyId);
+      }
+    }))
+  ]);
+  if (activeProcesses.size > 0 || credentialBearingProcessGroups.size > 0 || credentialBearingProcessGroupTargets.size > 0 || activePtys.size > 0) {
+    throw new Error("Credential-bearing child ownership remained after termination");
+  }
 }
 function websocketUrl(baseUrl, label) {
   const url = new URL("/worker/ws", baseUrl);
@@ -2327,6 +2984,7 @@ function websocketUrl(baseUrl, label) {
   return url.toString();
 }
 async function startWorker(options) {
+  advanceWorkerAdmissionGeneration();
   process.on("uncaughtException", (error) => {
     process.stderr.write(`[r5d-worker] uncaught exception: ${error instanceof Error ? error.stack ?? error.message : String(error)}
 `);
@@ -2345,8 +3003,15 @@ async function startWorker(options) {
   const projectsRoot = path.resolve(options.projectRoot ?? defaultProjectsRoot());
   const syncRoot = path.resolve(options.syncRoot ?? process.env.R5D_SYNC_ROOT ?? defaultSyncRoot());
   const workspaceShadowRoot = path.join(syncRoot, "workspace");
+  const projectWorktreeSnapshotsRoot = path.join(syncRoot, "project-worktree-snapshots");
   const artifactRoot = path.resolve(options.artifactRoot ?? process.env.R5D_ARTIFACTS_ROOT ?? defaultArtifactRoot());
   const planRoot = path.resolve(options.planRoot ?? process.env.R5D_PLANS_ROOT ?? defaultPlanRoot());
+  assertDisjointManagedRoots([
+    { label: "projects root", rootPath: projectsRoot },
+    { label: "sync root", rootPath: syncRoot },
+    { label: "artifacts root", rootPath: artifactRoot },
+    { label: "plans root", rootPath: planRoot }
+  ]);
   process.stdout.write(`[r5d-worker] label: ${label}
 `);
   process.stdout.write(`[r5d-worker] projects root: ${projectsRoot}
@@ -2359,26 +3024,43 @@ async function startWorker(options) {
 `);
   process.stdout.write(`[r5d-worker] server: ${baseUrl}
 `);
-  const snapshotCleanup = cleanupStaleProjectWorktreeSnapshots();
-  if (snapshotCleanup.removed.length > 0) {
-    process.stdout.write(`[r5d-worker] removed ${snapshotCleanup.removed.length} stale project snapshot(s)
-`);
-  }
-  for (const failure of snapshotCleanup.failed) {
-    process.stderr.write(`[r5d-worker] failed to remove stale project snapshot ${failure.path}: ${failure.error}
-`);
-  }
   runGit(["--version"]);
   await verifyR5dctlAuth(baseUrl, token);
-  fs.mkdirSync(projectsRoot, { recursive: true });
-  fs.mkdirSync(syncRoot, { recursive: true });
-  fs.mkdirSync(artifactRoot, { recursive: true });
-  fs.mkdirSync(planRoot, { recursive: true });
-  const projectWorkspaceStateStore = new ProjectWorkspaceStateStore({
-    stateRoot: path.join(syncRoot, "project-state"),
-    projectsRoot
+  const initializedWorkspaceState = await workspaceSyncSingleFlight.runExclusive(() => {
+    if (!startupProjectSnapshotRecoveryCompleted) {
+      const snapshotRecovery = recoverStaleProjectWorktreeSnapshots({
+        projectsRoot,
+        temporaryRoot: projectWorktreeSnapshotsRoot
+      });
+      if (snapshotRecovery.restored.length > 0) {
+        process.stdout.write(`[r5d-worker] restored ${snapshotRecovery.restored.length} interrupted project snapshot(s)
+`);
+      }
+      if (snapshotRecovery.removed.length > 0) {
+        process.stdout.write(`[r5d-worker] removed ${snapshotRecovery.removed.length} completed/incomplete project snapshot(s)
+`);
+      }
+      for (const failure of snapshotRecovery.failed) {
+        process.stderr.write(`[r5d-worker] failed to recover stale project snapshot ${failure.path}: ${failure.error}
+`);
+      }
+      if (snapshotRecovery.failed.length > 0) {
+        throw new Error("Project snapshot recovery is incomplete; refusing to mutate project checkouts");
+      }
+      startupProjectSnapshotRecoveryCompleted = true;
+    }
+    fs.mkdirSync(projectsRoot, { recursive: true });
+    fs.mkdirSync(syncRoot, { recursive: true });
+    fs.mkdirSync(artifactRoot, { recursive: true });
+    fs.mkdirSync(planRoot, { recursive: true });
+    const store = new ProjectWorkspaceStateStore({
+      stateRoot: path.join(syncRoot, "project-state"),
+      projectsRoot
+    });
+    return { store, state: store.read() };
   });
-  let projectWorkspaceState = projectWorkspaceStateStore.read();
+  const projectWorkspaceStateStore = initializedWorkspaceState.store;
+  let projectWorkspaceState = initializedWorkspaceState.state;
   const projectConfigById = /* @__PURE__ */ new Map();
   const pendingCheckouts = /* @__PURE__ */ new Map();
   const readyProjectIds = /* @__PURE__ */ new Set();
@@ -2394,6 +3076,7 @@ async function startWorker(options) {
   let workspaceAutomaticTimer;
   let workspacePeriodicTimer;
   let pendingAutomaticTrigger;
+  const pendingCreatedBranchPublicationNotBefore = /* @__PURE__ */ new Map();
   let automaticSyncInFlight = false;
   let terminalReplayTimer;
   let workspaceSyncRequestsInFlight = 0;
@@ -2408,7 +3091,7 @@ async function startWorker(options) {
   const projectPlanMountId = (projectId, branchName) => `plan:${projectId}:${encodeURIComponent(branchName)}`;
   const workspaceProjectRelativePath = (projectId, branchName) => path.posix.join("projects", projectId, "branches", encodeURIComponent(branchName));
   const workspacePlanRelativePath = (projectId, branchName) => path.posix.join("plans", projectId, encodeURIComponent(branchName));
-  const projectConnection = (project) => {
+  const projectConnection = (project, desiredFiles) => {
     const mirrorUrl = canonicalProjectRemoteUrl(baseUrl, project.projectId);
     const originUrl = project.repoHttpUrl ?? mirrorUrl;
     const originHeader = project.repoHttpUrl ? project.repoAuthHeader : bearerAuthHeader;
@@ -2417,7 +3100,8 @@ async function startWorker(options) {
         { remoteUrl: mirrorUrl, authHeader: bearerAuthHeader },
         { remoteUrl: originUrl, authHeader: originHeader }
       ],
-      credentialStorePathForProject(project.projectId)
+      credentialStorePathForProject(project.projectId),
+      desiredFiles
     );
     if (!credentialHelper) throw new Error("Project mirror credentials are unavailable");
     return {
@@ -2428,11 +3112,12 @@ async function startWorker(options) {
       credentialHelper
     };
   };
-  const projectMirrorConnection = (projectId) => {
+  const projectMirrorConnection = (projectId, desiredFiles) => {
     const mirrorUrl = canonicalProjectRemoteUrl(baseUrl, projectId);
     const credentialHelper = credentialHelperForRemotes(
       [{ remoteUrl: mirrorUrl, authHeader: bearerAuthHeader }],
-      credentialStorePathForProject(projectId)
+      credentialStorePathForProject(projectId),
+      desiredFiles
     );
     if (!credentialHelper) throw new Error("Project mirror credentials are unavailable");
     return { mirrorUrl, credentialHelper, mirrorCredentialUsername: workerCredentialUsername };
@@ -2505,6 +3190,29 @@ async function startWorker(options) {
     readyProjectIds.delete(project.projectId);
     reconciledProjectConfigFingerprints.delete(project.projectId);
   };
+  const deactivatePreserveOnlyProjectBranch = (project, branchName) => {
+    const branchPath = configuredProjectBranchPath(projectsRoot, project, branchName);
+    pendingCheckouts.delete(projectBranchKey(project.projectId, branchName));
+    if (!fs.existsSync(branchPath)) return;
+    if (!hasProjectWorktree(branchPath)) {
+      throw new Error(`Preserve-only project branch path ${project.projectId}/${branchName} is not a managed Git checkout`);
+    }
+    if (project.branches.length === 0) {
+      throw new Error(`Cannot hide preserve-only project branch ${project.projectId}/${branchName} without an active anchor branch`);
+    }
+    const primaryBranchName = primaryProjectBranch(project);
+    if (branchName === primaryBranchName) {
+      throw new Error(`Cannot hide preserve-only project branch ${project.projectId}/${branchName} because it is the active anchor`);
+    }
+    deleteLinkedProjectBranch({
+      projectRoot: configuredProjectRoot(projectsRoot, project),
+      primaryBranchName,
+      branchName
+    });
+    fs.rmSync(path.join(planRoot, project.projectId, ...branchName.split("/")), { recursive: true, force: true });
+    readyProjectIds.delete(project.projectId);
+    reconciledProjectConfigFingerprints.delete(project.projectId);
+  };
   const cleanupConfigForDurableDeletion = (deletion) => {
     const desiredLayout = projectWorkspaceState.desiredProjects.find(
       (project) => project.projectId === deletion.projectId && project.checkoutPathSegments[0] === deletion.checkoutPathSegments[0] && project.checkoutPathSegments[1] === deletion.checkoutPathSegments[1]
@@ -2519,8 +3227,13 @@ async function startWorker(options) {
       repoHttpUrl: liveConfig?.repoHttpUrl ?? null,
       repoAuthHeader: liveConfig?.repoAuthHeader ?? null,
       defaultBranch,
+      repositoryTransitionId: liveConfig?.repositoryTransitionId ?? null,
+      executionDisabled: false,
+      mirrorWritesDisabled: false,
+      preserveOnlyBranches: [],
       branches: branchNames.map(
         (branchName) => liveConfig?.branches.find((branch) => branch.branchName === branchName) ?? {
+          branchId: "deleted",
           branchName,
           sourceBranchName: null,
           // Deletion never consumes the baseline, but retain a structurally
@@ -2535,9 +3248,18 @@ async function startWorker(options) {
       const cleanupConfig = cleanupConfigForDurableDeletion(deletion);
       if (deletion.kind === "project") {
         if (!deletion.projectDeleted) {
-          if (fs.existsSync(deletion.managedPath)) {
-            removeProjectWorktrees({ projectRoot: deletion.managedPath, branchNames: deletion.branchNames });
-          }
+          const nextProject = projectConfigById.get(deletion.projectId);
+          if (!nextProject) throw new Error(`Checkout-path move lost desired project ${deletion.projectId}`);
+          preserveProjectCheckoutPathMove({
+            oldProjectRoot: deletion.managedPath,
+            newProjectRoot: configuredProjectRoot(projectsRoot, nextProject),
+            projectsDurabilityRoot: projectsRoot,
+            outerWorkspaceRoot: workspaceShadowRoot,
+            branches: deletion.branchNames.map((branchName) => ({
+              branchName,
+              outerWorkspaceRelativePath: workspaceProjectRelativePath(deletion.projectId, branchName)
+            }))
+          });
           readyProjectIds.delete(deletion.projectId);
           reconciledProjectConfigFingerprints.delete(deletion.projectId);
           continue;
@@ -2570,32 +3292,15 @@ async function startWorker(options) {
       });
     }
   };
-  const pruneStaleOuterWorkspaceEntries = (entries) => {
-    const remove = (candidate) => {
-      if (candidate) fs.rmSync(candidate, { recursive: true, force: true });
-    };
-    for (const entry of entries) {
-      if (entry.kind === "branch") {
-        projectWorkspaceState = projectWorkspaceStateStore.beginBranchDeletion({
-          projectId: entry.projectId,
-          branchName: entry.branchName
-        });
-        remove(entry.projectTreePath);
-        remove(entry.planTreePath);
-        continue;
-      }
-      remove(entry.projectTreePath);
-      remove(entry.planTreePath);
-      for (const branch of entry.branches) {
-        remove(branch.projectTreePath);
-        remove(branch.planTreePath);
-      }
-    }
-  };
   const effectiveWorkerProjects = (projects) => {
     const incomingById = new Map(projects.map((project) => [project.projectId, project]));
-    const pending = new Set(
-      projectWorkspaceState.locallyPendingCreatedBranches.map(({ projectId, branchName }) => projectBranchKey(projectId, branchName))
+    const preserveOnlyByKey = new Map(
+      projects.flatMap(
+        (project) => project.preserveOnlyBranches.map((branch) => [projectBranchKey(project.projectId, branch.branchName), branch])
+      )
+    );
+    const pending = new Map(
+      projectWorkspaceState.locallyPendingCreatedBranches.map((branch) => [projectBranchKey(branch.projectId, branch.branchName), branch])
     );
     return projectWorkspaceState.effectiveDesiredProjects.flatMap((layout) => {
       const incoming = incomingById.get(layout.projectId);
@@ -2603,10 +3308,21 @@ async function startWorker(options) {
       const existing = projectConfigById.get(layout.projectId);
       const branches = layout.branches.flatMap(({ branchName }) => {
         const configured = incoming.branches.find((branch) => branch.branchName === branchName);
-        if (configured) return [configured];
+        const pendingBranch = pending.get(projectBranchKey(layout.projectId, branchName));
+        const preservedBranch = preserveOnlyByKey.get(projectBranchKey(layout.projectId, branchName));
+        const pendingIncarnationIsAuthorized = creatorLocalProjectBranchIsAuthorized({
+          pendingBranchId: pendingBranch?.branchId,
+          preserveOnlyBranchId: preservedBranch?.branchId
+        });
+        const disposition = workerProjectBranchDisposition({
+          activeConfigured: Boolean(configured),
+          locallyPendingCreated: pendingIncarnationIsAuthorized
+        });
+        if (configured && disposition === "active") return [configured];
+        if (disposition === "preserve_only") return [];
         const retained = existing?.branches.find((branch) => branch.branchName === branchName);
         if (retained) return [retained];
-        if (!pending.has(projectBranchKey(layout.projectId, branchName))) return [];
+        if (!pendingBranch?.branchId) return [];
         const branchPath = configuredProjectBranchPath(
           projectsRoot,
           { ...incoming, checkoutPathSegments: layout.checkoutPathSegments },
@@ -2615,6 +3331,7 @@ async function startWorker(options) {
         if (!hasProjectWorktree(branchPath)) return [];
         return [
           {
+            branchId: pendingBranch.branchId,
             branchName,
             sourceBranchName: null,
             baseCommitHash: runGit(["rev-parse", "HEAD"], { cwd: branchPath })
@@ -2624,41 +3341,94 @@ async function startWorker(options) {
       return [{ ...incoming, checkoutPathSegments: [...layout.checkoutPathSegments], branches }];
     });
   };
-  const buildWorkspaceMounts = () => {
+  const activeWorkspaceMutationTargets = () => [
+    ...Array.from(activeProcesses.values(), ({ target }) => target),
+    ...credentialBearingProcessGroupTargets.values(),
+    ...workspaceSyncPriorityProcessTargets.values(),
+    ...workspaceSyncPriorityOperationTargets.values(),
+    ...Array.from(activePtys.values(), ({ target }) => target),
+    ...workspaceSyncPriorityPtyTargets.values()
+  ];
+  const canonicalWorkspaceMutationIsActive = (targets) => targets.some((target) => target.type === "workspace" && target.rootProfile === "canonical_sync");
+  const projectBranchMountActivityBusy = (projectId, branchName, branchPath) => {
+    const activeTargets = activeWorkspaceMutationTargets();
+    return projectConfigById.get(projectId)?.executionDisabled === true || hasProjectWorktree(branchPath) && projectWorktreeOperationInProgress(branchPath) || canonicalWorkspaceMutationIsActive(activeTargets) || projectBranchHasActiveWorkspaceTarget(projectId, branchName, activeTargets);
+  };
+  const projectBranchMountBusy = (projectId, branchName, branchPath) => !readyProjectIds.has(projectId) || projectBranchMountActivityBusy(projectId, branchName, branchPath);
+  const buildWorkspaceMounts = (projects = projectConfigById.values()) => {
     const mounts = [];
-    for (const project of [...projectConfigById.values()].sort((left, right) => left.projectId.localeCompare(right.projectId))) {
+    const creatorLocalIncarnations = new Map(
+      projectWorkspaceState.locallyPendingCreatedBranches.flatMap(
+        (branch) => branch.branchId ? [[projectBranchKey(branch.projectId, branch.branchName), branch.branchId]] : []
+      )
+    );
+    const checkoutPathMoveBranches = new Set(
+      projectWorkspaceState.pendingTreeDeletions.flatMap(
+        (deletion) => deletion.kind === "project" && !deletion.projectDeleted ? deletion.branchNames.map((branchName) => projectBranchKey(deletion.projectId, branchName)) : []
+      )
+    );
+    for (const project of [...projects].sort((left, right) => left.projectId.localeCompare(right.projectId))) {
       const projectRoot = configuredProjectRoot(projectsRoot, project);
       for (const branch of [...project.branches].sort((left, right) => left.branchName.localeCompare(right.branchName))) {
         const branchPath = configuredProjectBranchPath(projectsRoot, project, branch.branchName);
+        const branchKey = projectBranchKey(project.projectId, branch.branchName);
+        const creatorLocalIncarnation = creatorLocalIncarnations.get(branchKey) === branch.branchId;
+        const preservesCheckoutPathMove = checkoutPathMoveBranches.has(branchKey);
         mounts.push({
           id: projectMountId(project.projectId, branch.branchName),
+          hydrationIncarnationKey: branch.branchId,
           sourcePath: branchPath,
+          durabilityRootPath: projectsRoot,
           workspaceRelativePath: workspaceProjectRelativePath(project.projectId, branch.branchName),
           sourceMode: "git",
           hydrateDeletionMode: "git",
-          busy: () => hasProjectWorktree(branchPath) && projectWorktreeOperationInProgress(branchPath)
+          preserveLocalOnInitialOuterAbsence: creatorLocalIncarnation,
+          preserveLocalOnHydrationBasisChange: preservesCheckoutPathMove,
+          busy: () => projectBranchMountBusy(project.projectId, branch.branchName, branchPath),
+          busyForRecovery: () => projectBranchMountActivityBusy(project.projectId, branch.branchName, branchPath)
         });
         mounts.push({
           id: projectPlanMountId(project.projectId, branch.branchName),
+          hydrationIncarnationKey: branch.branchId,
           sourcePath: path.join(planRoot, project.projectId, ...branch.branchName.split("/")),
+          durabilityRootPath: planRoot,
           workspaceRelativePath: workspacePlanRelativePath(project.projectId, branch.branchName),
           sourceMode: "all",
-          hydrateDeletionMode: "all"
+          hydrateDeletionMode: "all",
+          preserveLocalOnInitialOuterAbsence: creatorLocalIncarnation,
+          preserveLocalOnHydrationBasisChange: preservesCheckoutPathMove,
+          busy: () => projectBranchMountBusy(project.projectId, branch.branchName, branchPath),
+          busyForRecovery: () => projectBranchMountActivityBusy(project.projectId, branch.branchName, branchPath)
         });
       }
       void projectRoot;
     }
     mounts.push({
       id: "workspace-plans",
+      hydrationIncarnationKey: "workspace-plans-v1",
       sourcePath: path.join(planRoot, "workspace"),
+      durabilityRootPath: planRoot,
       workspaceRelativePath: "workspace-plans",
       sourceMode: "all",
-      hydrateDeletionMode: "all"
+      hydrateDeletionMode: "all",
+      // Workspace-level agents receive this directory through R5D_PLANS_DIR.
+      // Keep both projection and hydration away from it while any visible-
+      // projects process, PTY, or built-in write/edit is active or reserved.
+      busy: () => {
+        const activeTargets = activeWorkspaceMutationTargets();
+        return canonicalWorkspaceMutationIsActive(activeTargets) || hasActiveVisibleProjectsWorkspaceTarget(activeTargets);
+      },
+      busyForRecovery: () => {
+        const activeTargets = activeWorkspaceMutationTargets();
+        return canonicalWorkspaceMutationIsActive(activeTargets) || hasActiveVisibleProjectsWorkspaceTarget(activeTargets);
+      }
     });
     for (const deletion of pendingMirrorDeletes.values()) {
       mounts.push({
         id: deletion.id,
+        hydrationIncarnationKey: deletion.tombstoneId ?? `deleted:${deletion.projectId}:${deletion.branchName}`,
         sourcePath: deletion.sourcePath,
+        durabilityRootPath: projectsRoot,
         workspaceRelativePath: deletion.workspaceRelativePath,
         sourceMode: "git",
         hydrateDeletionMode: "git",
@@ -2666,7 +3436,9 @@ async function startWorker(options) {
       });
       mounts.push({
         id: `${deletion.id}:plan`,
+        hydrationIncarnationKey: `${deletion.tombstoneId ?? `deleted:${deletion.projectId}:${deletion.branchName}`}:plan`,
         sourcePath: deletion.planSourcePath,
+        durabilityRootPath: planRoot,
         workspaceRelativePath: deletion.planWorkspaceRelativePath,
         sourceMode: "all",
         hydrateDeletionMode: "all",
@@ -2694,10 +3466,34 @@ async function startWorker(options) {
   const ensureConfiguredProjects = () => {
     for (const project of projectConfigById.values()) {
       validateProjectId(project.projectId);
+      assertRepositoryTransitionState(project);
       for (const branch of project.branches) validateBranchName(branch.branchName);
+      if (project.branches.length === 0) {
+        readyProjectIds.delete(project.projectId);
+        reconciledProjectConfigFingerprints.delete(project.projectId);
+        continue;
+      }
+      if (project.executionDisabled) {
+        readyProjectIds.delete(project.projectId);
+        reconciledProjectConfigFingerprints.delete(project.projectId);
+        for (const branch of project.branches) {
+          pendingCheckouts.delete(projectBranchKey(project.projectId, branch.branchName));
+        }
+        continue;
+      }
       const projectRoot = configuredProjectRoot(projectsRoot, project);
       const configFingerprint = projectWorktreeConfigurationFingerprint({ ...project, gitIdentity: workspaceGitIdentity });
-      const alreadyReady = readyProjectIds.has(project.projectId) && reconciledProjectConfigFingerprints.get(project.projectId) === configFingerprint && project.branches.every(({ branchName }) => hasProjectWorktree(configuredProjectBranchPath(projectsRoot, project, branchName)));
+      const durableEnabledTransition = projectWorkspaceState.enabledRepositoryTransitions.find(
+        ({ projectId }) => projectId === project.projectId
+      );
+      const transitionReseedRequired = enabledRepositoryTransitionRequiresReseed({
+        project,
+        lastEnabled: {
+          known: Boolean(durableEnabledTransition),
+          transitionId: durableEnabledTransition?.transitionId ?? null
+        }
+      });
+      const alreadyReady = !transitionReseedRequired && readyProjectIds.has(project.projectId) && reconciledProjectConfigFingerprints.get(project.projectId) === configFingerprint && project.branches.every(({ branchName }) => hasProjectWorktree(configuredProjectBranchPath(projectsRoot, project, branchName)));
       if (alreadyReady) {
         for (const branch of project.branches) pendingCheckouts.delete(projectBranchKey(project.projectId, branch.branchName));
         continue;
@@ -2706,8 +3502,11 @@ async function startWorker(options) {
         const connection = projectConnection(project);
         const states = ensureProjectWorktrees({
           projectRoot,
+          snapshotRoot: projectWorktreeSnapshotsRoot,
           primaryBranchName: primaryProjectBranch(project),
           branches: project.branches,
+          defaultBranch: project.defaultBranch,
+          ...transitionReseedRequired && project.repositoryTransitionId !== null ? { exactMirrorBranches: /* @__PURE__ */ new Set([primaryProjectBranch(project)]) } : {},
           originUrl: connection.originUrl,
           originCredentialUsername: connection.originCredentialUsername,
           mirrorUrl: connection.mirrorUrl,
@@ -2720,7 +3519,7 @@ async function startWorker(options) {
         for (const state of states) {
           pendingCheckouts.delete(projectBranchKey(project.projectId, state.branchName));
           const key = projectBranchKey(project.projectId, state.branchName);
-          if (!lastObservedProjectHeads.has(key)) lastObservedProjectHeads.set(key, state.mirrorHead);
+          if (transitionReseedRequired || !lastObservedProjectHeads.has(key)) lastObservedProjectHeads.set(key, state.mirrorHead);
           if ((state.ahead ?? 0) > 0) {
             process.stderr.write(
               `[r5d-worker] ${project.projectPath}/${state.branchName} is ${state.ahead} commit(s) ahead of origin; switching workers may require publishing or reconciling those commits
@@ -2728,6 +3527,12 @@ async function startWorker(options) {
             );
           }
         }
+        if (transitionReseedRequired) {
+          projectWorkspaceState = projectWorkspaceStateStore.recordEnabledRepositoryTransition({
+            projectId: project.projectId,
+            transitionId: project.repositoryTransitionId
+          });
+        }
       } catch (error) {
         readyProjectIds.delete(project.projectId);
         reconciledProjectConfigFingerprints.delete(project.projectId);
@@ -2747,7 +3552,7 @@ async function startWorker(options) {
   const collectAheadOfOriginBranches = () => {
     const aheadBranches = [];
     for (const project of projectConfigById.values()) {
-      if (!readyProjectIds.has(project.projectId) || project.branches.length === 0) continue;
+      if (project.executionDisabled || !readyProjectIds.has(project.projectId) || project.branches.length === 0) continue;
       const connection = projectConnection(project);
       const primaryPath = configuredProjectBranchPath(projectsRoot, project, primaryProjectBranch(project));
       if (!tryGit(
@@ -2769,7 +3574,11 @@ async function startWorker(options) {
         if (!hasProjectWorktree(branchPath)) continue;
         try {
           let ahead = 0;
-          const originRef = `refs/remotes/origin/${branch.branchName}`;
+          const originRef = `refs/remotes/origin/${projectOriginBranchName({
+            branchName: branch.branchName,
+            primaryBranchName: primaryProjectBranch(project),
+            defaultBranch: project.defaultBranch
+          })}`;
           if (tryGit(["show-ref", "--verify", "--quiet", originRef], { cwd: branchPath })) {
             const counts = runGit(["rev-list", "--left-right", "--count", `${originRef}...HEAD`], { cwd: branchPath }).split(/\s+/).map(Number);
             ahead = Number.isSafeInteger(counts[1]) ? counts[1] : 0;
@@ -2790,18 +3599,30 @@ async function startWorker(options) {
       (left, right) => left.projectId.localeCompare(right.projectId) || left.branchName.localeCompare(right.branchName)
     );
   };
-  const pushChangedProjectHeads = (activeMountIds, publishedHead) => {
-    const active = new Set(activeMountIds);
+  const captureProjectHeadsForWorkspacePublication = () => {
+    const heads = /* @__PURE__ */ new Map();
     for (const project of projectConfigById.values()) {
       if (!readyProjectIds.has(project.projectId)) continue;
-      const changed = /* @__PURE__ */ new Set();
       for (const branch of project.branches) {
-        if (!active.has(projectMountId(project.projectId, branch.branchName))) continue;
         const branchPath = configuredProjectBranchPath(projectsRoot, project, branch.branchName);
         if (!hasProjectWorktree(branchPath)) continue;
-        const head = runGit(["rev-parse", "HEAD"], { cwd: branchPath });
+        heads.set(projectMountId(project.projectId, branch.branchName), runGit(["rev-parse", "HEAD"], { cwd: branchPath }));
+      }
+    }
+    return heads;
+  };
+  const pushChangedProjectHeads = (activeMountIds, publishedHead, publicationHeads, suppressedMountIds = /* @__PURE__ */ new Set()) => {
+    const active = new Set(activeMountIds);
+    for (const project of projectConfigById.values()) {
+      if (!readyProjectIds.has(project.projectId) || !repositoryMirrorWritesAllowed(project)) continue;
+      const changed = /* @__PURE__ */ new Map();
+      for (const branch of project.branches) {
+        const mountId = projectMountId(project.projectId, branch.branchName);
+        if (!active.has(mountId) || suppressedMountIds.has(mountId)) continue;
+        const head = publicationHeads.get(mountId);
+        if (!head) throw new Error(`Missing pre-projection head for active project mount ${mountId}`);
         if (lastObservedProjectHeads.get(projectBranchKey(project.projectId, branch.branchName)) !== head) {
-          changed.add(branch.branchName);
+          changed.set(branch.branchName, head);
         }
       }
       if (changed.size === 0) continue;
@@ -2812,10 +3633,12 @@ async function startWorker(options) {
         mirrorUrl: connection.mirrorUrl,
         credentialHelper: connection.credentialHelper,
         credentialUsername: connection.mirrorCredentialUsername,
-        onlyBranches: changed
+        onlyBranches: new Set(changed.keys()),
+        publicationHeads: changed
       });
+      assertProjectMirrorHeadsPushed(results);
       for (const result of results) {
-        if (result.pushed) lastObservedProjectHeads.set(projectBranchKey(project.projectId, result.branchName), result.head);
+        lastObservedProjectHeads.set(projectBranchKey(project.projectId, result.branchName), result.head);
       }
     }
     const publishedTombstoneIds = [
@@ -2833,6 +3656,7 @@ async function startWorker(options) {
     }
     for (const [key, deletion] of pendingMirrorDeletes) {
       if (!active.has(deletion.id)) continue;
+      if (!repositoryMirrorWritesAllowed(projectConfigById.get(deletion.projectId))) continue;
       if (!deletion.projectDeleted) {
         deleteProjectMirrorBranch({
           gitDirectory: deletion.gitDirectory,
@@ -2855,73 +3679,105 @@ async function startWorker(options) {
       lastObservedProjectHeads.delete(key);
     }
   };
-  const refreshProjectHeadsAfterInboundWorkspace = () => {
+  const observeProjectHeadsBeforeOuterWorkspace = (input) => {
+    const bundles = [];
     for (const project of projectConfigById.values()) {
-      if (!readyProjectIds.has(project.projectId) || project.branches.length === 0) continue;
+      if (project.executionDisabled || !readyProjectIds.has(project.projectId) || project.branches.length === 0) continue;
       try {
         const connection = projectConnection(project);
-        const refreshed = fastForwardProjectHeadsFromMirror({
-          projectRoot: configuredProjectRoot(projectsRoot, project),
-          primaryBranchName: primaryProjectBranch(project),
-          branchNames: project.branches.map(({ branchName }) => branchName),
-          mirrorUrl: connection.mirrorUrl,
-          credentialHelper: connection.credentialHelper,
-          credentialUsername: connection.mirrorCredentialUsername
+        const projectRoot = configuredProjectRoot(projectsRoot, project);
+        const primaryBranchName = primaryProjectBranch(project);
+        bundles.push({
+          projectId: project.projectId,
+          projectRoot,
+          primaryBranchName,
+          observations: observeProjectMirrorHeads({
+            projectRoot,
+            primaryBranchName,
+            branchNames: project.branches.map(({ branchName }) => branchName),
+            mirrorUrl: connection.mirrorUrl,
+            credentialHelper: connection.credentialHelper,
+            credentialUsername: connection.mirrorCredentialUsername,
+            allowNonFastForward: input.allowNonFastForward
+          })
+        });
+      } catch (error) {
+        if (input.failClosed) throw error;
+        process.stderr.write(
+          `[r5d-worker] failed to observe project mirror heads before workspace update: ${error instanceof Error ? error.message : String(error)}
+`
+        );
+      }
+    }
+    return bundles;
+  };
+  const applyObservedProjectHeadsAfterInboundWorkspace = (bundles, activeMountIds, requireObservedHeads) => {
+    const active = new Set(activeMountIds);
+    for (const bundle of bundles) {
+      const project = projectConfigById.get(bundle.projectId);
+      if (!project || project.executionDisabled || !readyProjectIds.has(project.projectId)) continue;
+      const observations = bundle.observations.filter(({ branchName }) => active.has(projectMountId(project.projectId, branchName)));
+      if (observations.length === 0) continue;
+      try {
+        const refreshed = applyObservedProjectMirrorHeads({
+          projectRoot: bundle.projectRoot,
+          primaryBranchName: bundle.primaryBranchName,
+          observations,
+          branchMutationAllowed: (branchName, checkoutPath) => !projectBranchMountBusy(project.projectId, branchName, checkoutPath)
         });
+        if (requireObservedHeads) {
+          for (const observation of observations) {
+            if (!observation.shouldMove || !observation.mirrorHead) continue;
+            const checkoutPath = configuredProjectBranchPath(projectsRoot, project, observation.branchName);
+            const currentHead = runGit(["rev-parse", "HEAD"], { cwd: checkoutPath });
+            if (currentHead !== observation.mirrorHead) {
+              throw new Error(
+                `Project ${project.projectId}/${observation.branchName} did not apply observed hidden mirror head ${observation.mirrorHead}`
+              );
+            }
+          }
+        }
         for (const state of refreshed) {
           lastObservedProjectHeads.set(
             projectBranchKey(project.projectId, state.branchName),
-            state.fastForwarded && state.mirrorHead ? state.mirrorHead : state.previousHead
+            state.moved && state.mirrorHead ? state.mirrorHead : state.previousHead
           );
         }
       } catch (error) {
+        if (requireObservedHeads) throw error;
         process.stderr.write(
-          `[r5d-worker] failed to refresh project heads after workspace update: ${error instanceof Error ? error.message : String(error)}
+          `[r5d-worker] failed to apply observed project heads after workspace update: ${error instanceof Error ? error.message : String(error)}
 `
         );
       }
     }
   };
-  const reseedProjectHeadsAfterWorkspaceReset = () => {
-    for (const project of projectConfigById.values()) {
-      if (!readyProjectIds.has(project.projectId)) continue;
-      const connection = projectConnection(project);
-      const states = ensureProjectWorktrees({
-        projectRoot: configuredProjectRoot(projectsRoot, project),
-        primaryBranchName: primaryProjectBranch(project),
-        branches: project.branches,
-        originUrl: connection.originUrl,
-        originCredentialUsername: connection.originCredentialUsername,
-        mirrorUrl: connection.mirrorUrl,
-        mirrorCredentialUsername: connection.mirrorCredentialUsername,
-        credentialHelper: connection.credentialHelper,
-        gitIdentity: workspaceGitIdentity
-      });
-      for (const state of states) {
-        lastObservedProjectHeads.set(projectBranchKey(project.projectId, state.branchName), state.head);
-      }
-    }
+  const mapWorkspaceGitResult = (attemptId, trigger, result) => {
+    const activeProjectBranchPublications = activeProjectBranchPublicationEvidence([...projectConfigById.values()], result.activeMountIds);
+    return {
+      type: "workspace_sync",
+      attemptId,
+      workerLabel: label,
+      trigger,
+      outcome: result.outcome === "pushed" ? "published" : result.outcome,
+      startingHead: result.startingHead,
+      ...result.localHead ? { localHead: result.localHead } : {},
+      ...result.publishedHead ? { publishedHead: result.publishedHead } : {},
+      rebaseCount: result.rebaseCount,
+      diffSizeBytes: result.diffSizeBytes,
+      gitStatus: workspaceGitStatus(),
+      affectedProjects: affectedProjects(result.affectedPaths),
+      affectedPaths: result.affectedPaths,
+      activeMountIds: result.activeMountIds,
+      skippedMountIds: result.skippedMountIds,
+      activeProjectBranchPublications,
+      discardedPaths: [],
+      localChangesDiscarded: false,
+      ...result.conflictPaths ? { conflictPaths: result.conflictPaths } : {},
+      ...result.conflictSnapshotRefs ? { conflictSnapshotRefs: result.conflictSnapshotRefs } : {},
+      ...result.error ? { error: result.error } : {}
+    };
   };
-  const mapWorkspaceGitResult = (attemptId, trigger, result) => ({
-    type: "workspace_sync",
-    attemptId,
-    workerLabel: label,
-    trigger,
-    outcome: result.outcome === "pushed" ? "published" : result.outcome,
-    startingHead: result.startingHead,
-    ...result.localHead ? { localHead: result.localHead } : {},
-    ...result.publishedHead ? { publishedHead: result.publishedHead } : {},
-    rebaseCount: result.rebaseCount,
-    diffSizeBytes: result.diffSizeBytes,
-    gitStatus: workspaceGitStatus(),
-    affectedProjects: affectedProjects(result.affectedPaths),
-    affectedPaths: result.affectedPaths,
-    discardedPaths: [],
-    localChangesDiscarded: false,
-    ...result.conflictPaths ? { conflictPaths: result.conflictPaths } : {},
-    ...result.conflictSnapshotRefs ? { conflictSnapshotRefs: result.conflictSnapshotRefs } : {},
-    ...result.error ? { error: result.error } : {}
-  });
   const failedWorkspaceSyncResult = (attemptId, trigger, error) => ({
     type: "workspace_sync",
     attemptId,
@@ -2945,6 +3801,16 @@ async function startWorker(options) {
     }
     const mounts = buildWorkspaceMounts();
     if (input.resetToCanonical) {
+      const resetHasBusyLiveMount = mounts.some(
+        (mount) => !(mount.deleteWhenSourceMissing && !fs.existsSync(mount.sourcePath)) && mount.busy?.()
+      );
+      if (resetHasBusyLiveMount) {
+        throw new Error("Workspace reset cannot observe project mirror heads while a live mount is busy; remediation remains active");
+      }
+      const observedProjectHeads2 = observeProjectHeadsBeforeOuterWorkspace({
+        allowNonFastForward: true,
+        failClosed: true
+      });
       const reset = resetWorkspaceGit({
         workspacePath: workspaceShadowRoot,
         remoteUrl: workspaceRemoteUrl,
@@ -2953,7 +3819,7 @@ async function startWorker(options) {
         gitIdentity: workspaceGitIdentity,
         mounts
       });
-      reseedProjectHeadsAfterWorkspaceReset();
+      applyObservedProjectHeadsAfterInboundWorkspace(observedProjectHeads2, reset.activeMountIds, true);
       return {
         type: "workspace_sync",
         attemptId: input.attemptId,
@@ -2968,11 +3834,23 @@ async function startWorker(options) {
         gitStatus: workspaceGitStatus(),
         affectedProjects: affectedProjects(reset.discardedPaths),
         affectedPaths: reset.discardedPaths,
+        activeMountIds: reset.activeMountIds,
+        skippedMountIds: reset.skippedMountIds,
         discardedPaths: reset.discardedPaths,
         localChangesDiscarded: reset.discardedPaths.length > 0 || reset.startingHead !== reset.remoteHead
       };
     }
     const outerRemediation = input.trigger.type === "remediation" || input.trigger.type === "remediation_confirm";
+    const ordinaryCycleHasBusyLiveMount = mounts.some(
+      (mount) => !(mount.deleteWhenSourceMissing && !fs.existsSync(mount.sourcePath)) && mount.busy?.()
+    );
+    const observedProjectHeads = outerRemediation || ordinaryCycleHasBusyLiveMount ? [] : observeProjectHeadsBeforeOuterWorkspace({ allowNonFastForward: false, failClosed: false });
+    const inboundMoveMountIds = new Set(
+      observedProjectHeads.flatMap(
+        ({ projectId, observations }) => observations.filter(({ shouldMove }) => shouldMove).map(({ branchName }) => projectMountId(projectId, branchName))
+      )
+    );
+    const publicationHeads = outerRemediation ? /* @__PURE__ */ new Map() : captureProjectHeadsForWorkspacePublication();
     const result = await synchronizeWorkspaceGit({
       attemptId: input.attemptId,
       workerLabel: label,
@@ -2985,13 +3863,12 @@ async function startWorker(options) {
       commitDetail: input.confirmationReason ?? input.trigger.detail,
       allowLargeDiff: input.confirmedLargeDiff,
       skipMountMirror: outerRemediation,
-      skipMountHydration: outerRemediation,
       afterWorkspacePublished: outerRemediation ? void 0 : ({ activeMountIds, publishedHead }) => {
-        pushChangedProjectHeads(activeMountIds, publishedHead);
+        pushChangedProjectHeads(activeMountIds, publishedHead, publicationHeads, inboundMoveMountIds);
       }
     });
     if (["no_change", "updated", "pushed"].includes(result.outcome) && !outerRemediation) {
-      refreshProjectHeadsAfterInboundWorkspace();
+      applyObservedProjectHeadsAfterInboundWorkspace(observedProjectHeads, result.activeMountIds, false);
     }
     return mapWorkspaceGitResult(input.attemptId, input.trigger, result);
   };
@@ -3035,6 +3912,28 @@ async function startWorker(options) {
             resetToCanonical: input.resetToCanonical
           });
         } catch (error) {
+          let hydrationCurrent = input.resetToCanonical !== true;
+          if (hydrationCurrent) {
+            try {
+              hydrationCurrent = workspaceGitHydrationIsCurrent(workspaceShadowRoot, buildWorkspaceMounts());
+            } catch {
+              hydrationCurrent = false;
+            }
+          }
+          if (!hydrationCurrent) {
+            process.stderr.write(
+              `[r5d-worker] workspace synchronization failed with an incompletely hydrated visible tree; exiting for exact recovery: ${error instanceof Error ? error.message : String(error)}
+`
+            );
+          }
+          fenceUnsafeWorkspaceSyncFailure({
+            hydrationCurrent,
+            invalidateExecution: () => {
+              workspaceConfigured = false;
+              advanceWorkerAdmissionGeneration();
+            },
+            exitCode: 1
+          });
           return failedWorkspaceSyncResult(attemptId, input.trigger, error);
         }
       });
@@ -3056,7 +3955,13 @@ async function startWorker(options) {
   };
   const scheduleAutomaticWorkspaceSync = (trigger, delayMs = WORKSPACE_GIT_QUIET_MS) => {
     pendingAutomaticTrigger = trigger;
-    if (!workspaceConfigured || activeWorkspaceIncidentId || currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN || automaticSyncInFlight) {
+    const pendingBranchDeferral = () => pendingCreatedBranchAutomaticSyncDeferral(
+      projectWorkspaceState.locallyPendingCreatedBranches,
+      activeWorkspaceMutationTargets(),
+      pendingCreatedBranchPublicationNotBefore
+    );
+    const initialDeferral = pendingBranchDeferral();
+    if (!workspaceConfigured || activeWorkspaceIncidentId || currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN || automaticSyncInFlight || initialDeferral?.kind === "active_target") {
       return;
     }
     if (workspaceAutomaticTimer) clearTimeout(workspaceAutomaticTimer);
@@ -3064,8 +3969,14 @@ async function startWorker(options) {
       () => {
         workspaceAutomaticTimer = void 0;
         const scheduledTrigger = pendingAutomaticTrigger;
-        pendingAutomaticTrigger = void 0;
         if (!scheduledTrigger || !workspaceConfigured || activeWorkspaceIncidentId || currentWorkerSocket !== ws) return;
+        const currentDeferral = pendingBranchDeferral();
+        if (currentDeferral?.kind === "active_target") return;
+        if (currentDeferral?.kind === "creation_grace") {
+          scheduleAutomaticWorkspaceSync(scheduledTrigger, currentDeferral.retryAfterMs);
+          return;
+        }
+        pendingAutomaticTrigger = void 0;
         automaticSyncInFlight = true;
         void runWorkspaceSync({ trigger: scheduledTrigger }).then((result) => {
           if (result.outcome === "failed") {
@@ -3085,7 +3996,7 @@ async function startWorker(options) {
           }
         });
       },
-      Math.max(0, delayMs)
+      Math.max(0, delayMs, initialDeferral?.kind === "creation_grace" ? initialDeferral.retryAfterMs : 0)
     );
     workspaceAutomaticTimer.unref();
   };
@@ -3093,32 +4004,190 @@ async function startWorker(options) {
     scheduleAutomaticWorkspaceSync(trigger, force ? 0 : WORKSPACE_GIT_QUIET_MS);
   };
   const targetMayMutateVisibleWorkspace = (target) => target.type === "project" || target.rootProfile === "visible_projects";
-  const resolveMessageTarget = (target) => resolveWorkerSessionTarget({
-    target,
-    projectsRoot,
-    workspaceShadowRoot,
-    projectConfigById
-  });
+  const resolveMessageTarget = (target) => {
+    if (!workspaceConfigured) throw new Error("Worker workspace configuration has not completed successfully");
+    if (target.type === "project" && !readyProjectIds.has(target.projectId)) {
+      throw new Error(`Project ${target.projectId} is not ready on this worker`);
+    }
+    if (target.type === "workspace" && target.rootProfile === "visible_projects" && [...projectConfigById.keys()].some((projectId) => !readyProjectIds.has(projectId))) {
+      throw new Error("Visible project execution is unavailable while project configuration is incomplete");
+    }
+    return resolveWorkerSessionTarget({
+      target,
+      projectsRoot,
+      workspaceShadowRoot,
+      projectConfigById
+    });
+  };
   const configureWorkerWorkspace = async (message) => {
+    const incomingCredentialGenerationFingerprint = credentialGenerationFingerprint({
+      ...message,
+      workerBaseUrl: baseUrl,
+      workerAuthHeader: bearerAuthHeader
+    });
+    const credentialTransitionPhase = credentialGenerationTransitionPhase({
+      committedFingerprint: configuredCredentialGenerationFingerprint,
+      pendingFingerprintAtProcessStart: pendingCredentialGenerationIntentAtProcessStart?.fingerprint ?? null,
+      incomingFingerprint: incomingCredentialGenerationFingerprint
+    });
+    const credentialReapStatus = credentialReapContractStatus();
+    const verifiedCredentialReapContractNow = credentialReapStatus === "verified_systemd";
+    const credentialRestartIsContained = credentialGenerationRestartIsContained({
+      systemdContract: verifiedCredentialReapContractNow,
+      pendingBoundary: pendingCredentialGenerationIntentAtProcessStart?.boundary ?? null,
+      currentSystemdInvocationId: systemdInvocationIdentifierAtProcessStart,
+      currentBootSessionId: bootSessionIdentifierAtProcessStart,
+      currentMachineId: machineIdentifierAtProcessStart
+    });
+    let trackedChildTerminationProven = true;
+    if (credentialTransitionPhase !== "current") {
+      workspaceConfigured = false;
+      githubCredential = null;
+      advanceWorkerAdmissionGeneration();
+      try {
+        await terminateActiveCredentialBearingChildren();
+      } catch (error) {
+        trackedChildTerminationProven = false;
+        process.stderr.write(
+          `[r5d-worker] tracked credential-bearing child termination was incomplete at the credential transition boundary: ${error instanceof Error ? error.message : String(error)}
+`
+        );
+      }
+    }
+    const initialBootstrapAuthorized = initialCredentialBootstrapIsSafe({
+      transitionPhase: credentialTransitionPhase,
+      committedFingerprint: configuredCredentialGenerationFingerprint,
+      pendingFingerprintAtProcessStart: pendingCredentialGenerationIntentAtProcessStart?.fingerprint ?? null,
+      bootstrapFingerprintAtProcessStart: bootstrapCredentialGenerationFingerprintAtProcessStart,
+      incomingFingerprint: incomingCredentialGenerationFingerprint,
+      credentialArtifactsProvenAbsentAtProcessStart: initialCredentialBootstrapProvenEmpty,
+      trackedChildTerminationProven,
+      activeProcessCount: activeProcesses.size,
+      credentialProcessGroupCount: credentialBearingProcessGroups.size,
+      activePtyCount: activePtys.size
+    });
+    const staleIntentCleanupAuthorized = credentialTransitionPhase === "current" && (pendingCredentialGenerationIntentAtProcessStart !== null || bootstrapCredentialGenerationFingerprintAtProcessStart !== null);
+    const credentialPublicationPreauthorized = credentialTransitionPhase === "publish_from_clean_restart" && credentialRestartIsContained || initialBootstrapAuthorized || staleIntentCleanupAuthorized;
+    if (initialBootstrapAuthorized && bootstrapCredentialGenerationFingerprintAtProcessStart === null) {
+      try {
+        const bootstrap = preparePrivateAuthFileGeneration([
+          { filePath: bootstrapCredentialGenerationPath(), content: `${incomingCredentialGenerationFingerprint}
+` }
+        ]);
+        bootstrap.commit();
+        bootstrapCredentialGenerationFingerprintAtProcessStart = incomingCredentialGenerationFingerprint;
+      } catch (error) {
+        const wrapped = error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
+        return {
+          result: failedWorkspaceSyncResult(crypto.randomUUID(), { type: "connect" }, wrapped),
+          pending: [],
+          aheadOfOriginBranches: []
+        };
+      }
+    }
+    if (credentialTransitionPhase === "stage_pending_restart" && !initialBootstrapAuthorized) {
+      if (credentialReapStatus === "systemd_unverified") {
+        process.stderr.write(
+          "[r5d-worker] this process is inside r5d-worker.service but its credential-reaping contract could not be verified; no pending credential generation was written and the service may retry safely\n"
+        );
+        requireCredentialGenerationRestart(true, void 0, 1);
+      }
+      const boundary = pendingCredentialGenerationBoundary({
+        systemdContract: verifiedCredentialReapContractNow,
+        systemdInvocationId: systemdInvocationIdentifierAtProcessStart,
+        bootSessionId: bootSessionIdentifierAtProcessStart,
+        machineId: machineIdentifierAtProcessStart
+      });
+      if (!credentialGenerationBoundaryIsComplete(boundary)) {
+        process.stderr.write(
+          process.platform === "win32" ? "[r5d-worker] credential rotation is unavailable for a direct Windows worker because no authoritative per-boot identifier is supported; move it behind the verified systemd contract or reprovision a clean worker host\n" : "[r5d-worker] could not attest this worker's stable machine and boot identifiers; no pending credential generation was written\n"
+        );
+        requireCredentialGenerationRestart(true, void 0, 1);
+      }
+      try {
+        const pending = preparePrivateAuthFileGeneration([
+          {
+            filePath: pendingCredentialGenerationPath(),
+            content: pendingCredentialGenerationIntentContent({
+              fingerprint: incomingCredentialGenerationFingerprint,
+              boundary
+            })
+          }
+        ]);
+        pending.commit();
+      } catch (error) {
+        process.stderr.write(
+          `[r5d-worker] could not stage pending credential generation before fatal restart: ${error instanceof Error ? error.message : String(error)}
+`
+        );
+        requireCredentialGenerationRestart(true, void 0, 1);
+      }
+      process.stderr.write(
+        verifiedCredentialReapContractNow ? "[r5d-worker] credential transition staged without secrets; restarting through the service cgroup boundary\n" : "[r5d-worker] credential transition staged without secrets; reboot this worker host or VM before starting r5d-worker again\n"
+      );
+      requireCredentialGenerationRestart(true, void 0, WORKER_CREDENTIAL_RESTART_EXIT_CODE);
+    }
+    if (credentialTransitionPhase !== "current" && !trackedChildTerminationProven) {
+      requireCredentialGenerationRestart(true, void 0, 1);
+    }
+    if (credentialTransitionPhase === "publish_from_clean_restart" && !credentialRestartIsContained) {
+      const pendingBoundary = pendingCredentialGenerationIntentAtProcessStart?.boundary ?? null;
+      const detail = pendingBoundary?.machineId === null || machineIdentifierAtProcessStart === null ? "credential transition cannot prove it is still on the same worker host; keep the credential directory host-local and ensure the OS machine identifier is available" : pendingBoundary?.kind === "systemd" ? "credential transition is waiting for a new verified r5d-worker.service invocation on the same host" : pendingBoundary?.bootSessionId === null || bootSessionIdentifierAtProcessStart === null ? "credential transition cannot prove a portable whole-host restart; ensure its kernel boot identifier is available" : "credential transition is still in the boot session that staged it";
+      process.stderr.write(
+        `[r5d-worker] ${detail}; no new credential bytes were published. ${pendingBoundary?.kind === "boot" ? "Reboot the entire worker host or VM before starting r5d-worker again." : "The verified systemd unit must start a new invocation before retrying."}
+`
+      );
+      requireCredentialGenerationRestart(true, void 0, WORKER_CREDENTIAL_RESTART_EXIT_CODE);
+    }
+    if (credentialPublicationPreauthorized) workspaceConfigured = false;
     workspaceSyncRequestsInFlight += 1;
     try {
       return await workspaceSyncSingleFlight.runExclusive(async () => {
+        for (const project of message.projects) assertRepositoryTransitionState(project);
+        const busyConfigurationChanges = busyProjectConfigurationChangeIds({
+          currentProjects: [...projectConfigById.values()],
+          incomingProjects: message.projects,
+          activeTargets: activeWorkspaceMutationTargets(),
+          currentFingerprint: (project) => projectWorktreeConfigurationFingerprint({ ...project, gitIdentity: workspaceGitIdentity }),
+          incomingFingerprint: (project) => projectWorktreeConfigurationFingerprint({ ...project, gitIdentity: message.gitIdentity }),
+          currentProjectReady: (project) => {
+            const fingerprint = projectWorktreeConfigurationFingerprint({ ...project, gitIdentity: workspaceGitIdentity });
+            return readyProjectIds.has(project.projectId) && reconciledProjectConfigFingerprints.get(project.projectId) === fingerprint && project.branches.every(({ branchName }) => hasProjectWorktree(configuredProjectBranchPath(projectsRoot, project, branchName)));
+          }
+        });
+        if (busyConfigurationChanges.length > 0) {
+          throw new ProjectWorkspaceConfigurationDeferredError(
+            `Project workspace configuration deferred while visible checkout activity is active: ${busyConfigurationChanges.join(", ")}`
+          );
+        }
         workspaceConfigured = false;
+        const preserveOnlyBranches = message.projects.flatMap(
+          (project) => project.preserveOnlyBranches.map(({ branchId, branchName }) => ({ branchId, projectId: project.projectId, branchName }))
+        );
         projectWorkspaceState = projectWorkspaceStateStore.reconcile({
-          desiredProjects: message.projects
+          desiredProjects: message.projects,
+          preserveOnlyBranches
         });
-        const requiredCredentialStorePaths = /* @__PURE__ */ new Set();
+        const stillPendingCreatedBranches = new Map(
+          projectWorkspaceState.locallyPendingCreatedBranches.map((branch) => [
+            pendingCreatedBranchKey(branch.projectId, branch.branchName),
+            branch
+          ])
+        );
+        for (const key of pendingCreatedBranchPublicationNotBefore.keys()) {
+          if (!stillPendingCreatedBranches.has(key)) pendingCreatedBranchPublicationNotBefore.delete(key);
+        }
+        const desiredCredentialStoreFiles = /* @__PURE__ */ new Map();
         const workspaceStorePath = credentialStorePathForWorkspace(message.workspaceRemoteUrl);
-        requiredCredentialStorePaths.add(workspaceStorePath);
         const nextWorkspaceCredentialHelper = credentialHelperForRemotes(
           [{ remoteUrl: message.workspaceRemoteUrl, authHeader: bearerAuthHeader }],
-          workspaceStorePath
+          workspaceStorePath,
+          desiredCredentialStoreFiles
         );
         if (!nextWorkspaceCredentialHelper) throw new Error("Workspace credentials are unavailable");
         const desiredProjectConfigById = new Map(message.projects.map((project) => [project.projectId, project]));
         for (const project of message.projects) {
-          requiredCredentialStorePaths.add(credentialStorePathForProject(project.projectId));
-          projectConnection(project);
+          projectConnection(project, desiredCredentialStoreFiles);
         }
         const pendingCredentialProjectIds = /* @__PURE__ */ new Set([
           ...[...pendingMirrorDeletes.values()].map(({ projectId }) => projectId),
@@ -3127,30 +4196,81 @@ async function startWorker(options) {
         ]);
         for (const projectId of pendingCredentialProjectIds) {
           const desiredProject = desiredProjectConfigById.get(projectId);
-          if (desiredProject) projectConnection(desiredProject);
-          else projectMirrorConnection(projectId);
-          requiredCredentialStorePaths.add(credentialStorePathForProject(projectId));
+          if (desiredProject) projectConnection(desiredProject, desiredCredentialStoreFiles);
+          else projectMirrorConnection(projectId, desiredCredentialStoreFiles);
         }
         for (const deletion of pendingMirrorDeletes.values()) {
           const desiredProject = desiredProjectConfigById.get(deletion.projectId);
-          const connection = desiredProject ? projectConnection(desiredProject) : projectMirrorConnection(deletion.projectId);
+          const connection = desiredProject ? projectConnection(desiredProject, desiredCredentialStoreFiles) : projectMirrorConnection(deletion.projectId, desiredCredentialStoreFiles);
           deletion.mirrorUrl = connection.mirrorUrl;
           deletion.credentialHelper = connection.credentialHelper;
           deletion.credentialUsername = connection.mirrorCredentialUsername;
         }
-        pruneCredentialStoreFiles(requiredCredentialStorePaths);
-        configureGitHubAuth(message.githubCredential);
+        let preparedAuthGeneration;
+        try {
+          preparedAuthGeneration = preparePrivateAuthFileGeneration([
+            ...planCredentialStoreGeneration(desiredCredentialStoreFiles),
+            ...planGitHubRegistryAuthFiles([dockerConfigPath(), containersAuthPath()], message.githubCredential),
+            { filePath: legacySharedCredentialStorePath(), content: null, allowSymlinkRemoval: true },
+            { filePath: credentialGenerationReceiptPath(), content: `${incomingCredentialGenerationFingerprint}
+` },
+            { filePath: pendingCredentialGenerationPath(), content: null },
+            { filePath: bootstrapCredentialGenerationPath(), content: null }
+          ]);
+        } catch (error) {
+          throw error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
+        }
+        await commitCredentialGeneration(
+          preparedAuthGeneration,
+          message.githubCredential,
+          terminateActiveCredentialBearingChildren,
+          void 0,
+          credentialPublicationPreauthorized
+        );
+        configuredCredentialGenerationFingerprint = incomingCredentialGenerationFingerprint;
+        pendingCredentialGenerationIntentAtProcessStart = null;
+        bootstrapCredentialGenerationFingerprintAtProcessStart = null;
         visibleGitIdentity = message.gitIdentity;
         workspaceGitIdentity = message.gitIdentity;
         workspaceRemoteUrl = message.workspaceRemoteUrl;
         workspaceCredentialHelper = nextWorkspaceCredentialHelper;
         workspaceCredentialUsername = workerCredentialUsername;
-        pruneAuthoritativelyDesiredBranchDeletions(pendingMirrorDeletes, message.projects);
+        pruneAuthoritativelyDesiredBranchDeletions(pendingMirrorDeletes, projectWorkspaceState.desiredProjects);
         const effectiveProjects = effectiveWorkerProjects(message.projects).map((project) => ({
           ...project,
           branches: project.branches.filter(({ branchName }) => !pendingMirrorDeletes.has(projectBranchKey(project.projectId, branchName)))
         }));
         const nextProjectConfigById = new Map(effectiveProjects.map((project) => [project.projectId, project]));
+        ensureWorkspaceGitClone({
+          workspacePath: workspaceShadowRoot,
+          remoteUrl: message.workspaceRemoteUrl,
+          credentialHelper: nextWorkspaceCredentialHelper,
+          credentialUsername: workerCredentialUsername,
+          gitIdentity: message.gitIdentity
+        });
+        const recoverySourceOverrides = /* @__PURE__ */ new Map();
+        for (const deletion of projectWorkspaceState.pendingTreeDeletions) {
+          if (deletion.kind !== "project" || deletion.projectDeleted) continue;
+          for (const branchName of deletion.branchNames) {
+            const oldBranchPath = path.join(deletion.managedPath, ...branchName.split("/"));
+            if (fs.existsSync(oldBranchPath)) recoverySourceOverrides.set(projectMountId(deletion.projectId, branchName), oldBranchPath);
+          }
+        }
+        const recoveryMounts = buildWorkspaceMounts(effectiveProjects).map((mount) => ({
+          ...mount,
+          sourcePath: recoverySourceOverrides.get(mount.id) ?? mount.sourcePath,
+          busy: mount.busyForRecovery ?? mount.busy
+        }));
+        recoverWorkspaceGitHydration(workspaceShadowRoot, recoveryMounts);
+        for (const project of message.projects) {
+          for (const { branchName } of project.preserveOnlyBranches) {
+            if (stillPendingCreatedBranches.has(pendingCreatedBranchKey(project.projectId, branchName))) {
+              continue;
+            }
+            deactivatePreserveOnlyProjectBranch(project, branchName);
+          }
+        }
+        const preserveOnlyKeys = new Set(preserveOnlyBranches.map(({ projectId, branchName }) => projectBranchKey(projectId, branchName)));
         for (const existingProject of projectConfigById.values()) {
           const nextProject = nextProjectConfigById.get(existingProject.projectId);
           if (!nextProject) {
@@ -3160,6 +4280,7 @@ async function startWorker(options) {
           const nextBranches = new Set(nextProject.branches.map(({ branchName }) => branchName));
           for (const existingBranch of existingProject.branches) {
             if (!nextBranches.has(existingBranch.branchName)) {
+              if (preserveOnlyKeys.has(projectBranchKey(existingProject.projectId, existingBranch.branchName))) continue;
               stageProjectBranchDeletion(existingProject, existingBranch.branchName, false);
             }
           }
@@ -3175,40 +4296,30 @@ async function startWorker(options) {
         for (const projectId of [...readyProjectIds]) {
           if (!projectConfigById.has(projectId)) readyProjectIds.delete(projectId);
         }
-        ensureWorkspaceGitClone({
-          workspacePath: workspaceShadowRoot,
-          remoteUrl: message.workspaceRemoteUrl,
-          credentialHelper: nextWorkspaceCredentialHelper,
-          credentialUsername: workerCredentialUsername,
-          gitIdentity: message.gitIdentity
-        });
-        pruneStaleOuterWorkspaceEntries(projectWorkspaceStateStore.discoverStaleOuterEntries(workspaceShadowRoot));
         stageDurableWorkspaceDeletions();
         const mountsBeforeGit = buildWorkspaceMounts();
         hydrateWorkspaceGitMounts(
           workspaceShadowRoot,
-          mountsBeforeGit.filter((mount) => !mount.deleteWhenSourceMissing && !fs.existsSync(mount.sourcePath))
+          mountsBeforeGit.filter((mount) => !mount.deleteWhenSourceMissing && !fs.existsSync(mount.sourcePath) && mount.busy?.() !== true),
+          // These mounts are intentionally hydrated before their project Git
+          // layouts can be marked ready. No process can resolve an unready
+          // target, and preserving the fetched outer tree here prevents clean
+          // checkout initialization from erasing synchronized dirt.
+          { ignoreBusy: true }
         );
         ensureConfiguredProjects();
-        let result = await performWorkspaceSync({
+        const result = await performWorkspaceSync({
           attemptId: crypto.randomUUID(),
           trigger: { type: "connect" }
         });
-        if (["no_change", "published", "updated", "conflict_reset", "reset"].includes(result.outcome)) {
-          const staleAfterInbound = projectWorkspaceStateStore.discoverStaleOuterEntries(workspaceShadowRoot);
-          if (staleAfterInbound.length > 0) {
-            pruneStaleOuterWorkspaceEntries(staleAfterInbound);
-            stageDurableWorkspaceDeletions();
-            result = await performWorkspaceSync({
-              attemptId: crypto.randomUUID(),
-              trigger: { type: "connect" }
-            });
-          }
-        }
         const publishedHead = result.publishedHead ?? result.localHead ?? result.startingHead;
         if (publishedHead && ["no_change", "published", "updated", "conflict_reset", "reset"].includes(result.outcome)) {
+          const activeMountIds = new Set(result.activeMountIds ?? []);
           const layoutCleanupIds = projectWorkspaceState.pendingTreeDeletions.flatMap(
-            (deletion) => deletion.kind === "project" && !deletion.projectDeleted ? [deletion.tombstoneId] : []
+            (deletion) => deletion.kind === "project" && !deletion.projectDeleted && checkoutPathMovePublicationComplete(
+              deletion.branchNames.map((branchName) => projectMountId(deletion.projectId, branchName)),
+              activeMountIds
+            ) ? [deletion.tombstoneId] : []
           );
           if (layoutCleanupIds.length > 0) {
             projectWorkspaceState = projectWorkspaceStateStore.recordTreePublication({
@@ -3224,18 +4335,37 @@ async function startWorker(options) {
         return { result, pending, aheadOfOriginBranches: collectAheadOfOriginBranches() };
       });
     } catch (error) {
-      workspaceConfigured = fs.existsSync(path.join(workspaceShadowRoot, ".git"));
-      for (const project of message.projects) {
-        for (const branch of project.branches) {
-          pendingCheckouts.set(projectBranchKey(project.projectId, branch.branchName), {
-            projectId: project.projectId,
-            branchName: branch.branchName
-          });
+      if (error instanceof RegistryAuthConfigurationError) {
+        workspaceConfigured = false;
+        githubCredential = null;
+        configuredCredentialGenerationFingerprint = null;
+        let childTerminationProven = true;
+        try {
+          await terminateActiveCredentialBearingChildren();
+        } catch (childError) {
+          childTerminationProven = false;
+          process.stderr.write(
+            `[r5d-worker] failed to fully terminate credential-bearing children: ${childError instanceof Error ? childError.message : String(childError)}
+`
+          );
         }
+        process.stderr.write(
+          `[r5d-worker] fatal credential-generation transition failure; exiting for whole-runtime cleanup: ${error instanceof Error ? error.message : String(error)}
+`
+        );
+        requireCredentialGenerationRestart(true, void 0, 1);
+      }
+      workspaceConfigured = false;
+      const deferred = error instanceof ProjectWorkspaceConfigurationDeferredError || error instanceof ProjectWorkspacePendingBranchPathChangeError;
+      if (deferred) pendingCheckouts.clear();
+      for (const pending of deferredProjectConfigurationPendingBranches(message.projects)) {
+        pendingCheckouts.set(projectBranchKey(pending.projectId, pending.branchName), pending);
       }
       return {
         result: failedWorkspaceSyncResult(crypto.randomUUID(), { type: "connect" }, error),
-        pending: [...pendingCheckouts.values()],
+        pending: [...pendingCheckouts.values()].sort(
+          (left, right) => left.projectId.localeCompare(right.projectId) || left.branchName.localeCompare(right.branchName)
+        ),
         aheadOfOriginBranches: []
       };
     } finally {
@@ -3330,12 +4460,22 @@ async function startWorker(options) {
   ws.addEventListener("message", (event) => {
     void (async () => {
       const message = JSON.parse(String(event.data));
+      const messageAdmissionGeneration = workerAdmissionGeneration;
+      const assertMessageAdmission = () => assertWorkerChildAdmission({
+        capturedGeneration: messageAdmissionGeneration,
+        currentGeneration: workerAdmissionGeneration,
+        sourceSocketIsCurrent: currentWorkerSocket === ws,
+        sourceSocketOpen: ws.readyState === WebSocket.OPEN,
+        workspaceConfigured,
+        runtimeHealthy: !shutdownAfterClose && !heartbeatTimedOut
+      });
       if (message.type === "connected") {
         return;
       }
       if (message.type === "workspace_config") {
+        advanceWorkerAdmissionGeneration();
         const configured = await configureWorkerWorkspace(message);
-        sendWorkerMessage(ws, {
+        sendWorkerMessageFromCurrentSource(ws, {
           type: "workspace_configured",
           requestId: message.requestId,
           result: configured.result,
@@ -3370,59 +4510,85 @@ async function startWorker(options) {
       }
       if (message.type === "create_project_branch") {
         try {
-          projectWorkspaceState = projectWorkspaceStateStore.recordPendingCreatedBranch({
+          const pendingBranch = {
+            branchId: message.branchId,
             projectId: message.projectId,
             branchName: message.targetBranch
-          });
+          };
           const created = await workspaceSyncSingleFlight.runMutation(() => {
             const project = projectConfigById.get(message.projectId);
             if (!project) throw new Error(`Project ${message.projectId} is missing from the worker workspace configuration`);
-            if (!readyProjectIds.has(project.projectId)) {
-              throw new Error(`Project ${project.projectPath} is not initialized on this worker`);
+            assertRepositoryExecutionEnabled(project);
+            if (!repositoryMirrorWritesAllowed(project)) {
+              throw new Error(`Project ${message.projectId} branch creation is disabled while its repository connection is transitioning`);
             }
-            if (!project.branches.some(({ branchName }) => branchName === message.sourceBranch)) {
-              throw new Error(`Source branch ${message.sourceBranch} is missing from the worker workspace configuration`);
-            }
-            if (project.branches.some(({ branchName }) => branchName === message.targetBranch)) {
-              throw new Error(`Project branch ${message.targetBranch} already exists`);
-            }
-            const createdBranch = createLinkedProjectBranch({
-              projectRoot: configuredProjectRoot(projectsRoot, project),
-              sourceBranchName: message.sourceBranch,
-              branchName: message.targetBranch
-            });
-            projectConfigById.set(project.projectId, {
-              ...project,
-              branches: [
-                ...project.branches,
-                {
-                  branchName: message.targetBranch,
-                  sourceBranchName: message.sourceBranch,
-                  baseCommitHash: createdBranch.baseCommitHash
+            const pendingWasRecorded = projectWorkspaceState.locallyPendingCreatedBranches.some(
+              ({ projectId, branchName }) => projectId === message.projectId && branchName === message.targetBranch
+            );
+            projectWorkspaceState = projectWorkspaceStateStore.recordPendingCreatedBranch(pendingBranch);
+            let gitBranchCreated = false;
+            try {
+              if (!readyProjectIds.has(project.projectId)) {
+                throw new Error(`Project ${project.projectPath} is not initialized on this worker`);
+              }
+              if (!project.branches.some(({ branchName }) => branchName === message.sourceBranch)) {
+                throw new Error(`Source branch ${message.sourceBranch} is missing from the worker workspace configuration`);
+              }
+              const existingBranch = project.branches.find(({ branchName }) => branchName === message.targetBranch);
+              if (existingBranch) {
+                if (!pendingWasRecorded) throw new Error(`Project branch ${message.targetBranch} already exists`);
+                if (existingBranch.branchId !== message.branchId) {
+                  throw new Error(`Pending project branch ${message.targetBranch} belongs to another durable branch incarnation`);
                 }
-              ]
-            });
-            lastObservedProjectHeads.set(projectBranchKey(project.projectId, message.targetBranch), null);
-            return createdBranch;
+                const existingPath = configuredProjectBranchPath(projectsRoot, project, message.targetBranch);
+                if (!hasProjectWorktree(existingPath)) {
+                  throw new Error(`Pending project branch ${message.targetBranch} is not initialized on this worker`);
+                }
+                return { branchPath: existingPath, baseCommitHash: existingBranch.baseCommitHash };
+              }
+              const createdBranch = createOrRetryLinkedProjectBranch({
+                projectRoot: configuredProjectRoot(projectsRoot, project),
+                primaryBranchName: primaryProjectBranch(project),
+                sourceBranchName: message.sourceBranch,
+                branchName: message.targetBranch,
+                pendingRetry: pendingWasRecorded
+              });
+              gitBranchCreated = true;
+              projectConfigById.set(project.projectId, {
+                ...project,
+                branches: [
+                  ...project.branches,
+                  {
+                    branchId: message.branchId,
+                    branchName: message.targetBranch,
+                    sourceBranchName: message.sourceBranch,
+                    baseCommitHash: createdBranch.baseCommitHash
+                  }
+                ]
+              });
+              lastObservedProjectHeads.set(projectBranchKey(project.projectId, message.targetBranch), null);
+              return createdBranch;
+            } catch (error) {
+              if (!pendingWasRecorded && !gitBranchCreated && !projectBranchMayExistAfterCreateFailure(error)) {
+                projectWorkspaceState = projectWorkspaceStateStore.rollbackPendingCreatedBranch(pendingBranch);
+              }
+              throw error;
+            }
           });
+          pendingCreatedBranchPublicationNotBefore.set(
+            pendingCreatedBranchKey(message.projectId, message.targetBranch),
+            Date.now() + PENDING_CREATED_BRANCH_AUTOMATIC_SYNC_GRACE_MS
+          );
           sendWorkerMessage(ws, {
             type: "operation_result",
             requestId: message.requestId,
             result: {
               type: "create_project_branch",
+              branchId: message.branchId,
               branchName: message.targetBranch,
               baseCommitHash: created.baseCommitHash
             }
           });
-          markWorkspaceDirty(
-            {
-              type: "manual",
-              projectId: message.projectId,
-              branchName: message.targetBranch,
-              detail: `created project branch from ${message.sourceBranch}`
-            },
-            true
-          );
         } catch (error) {
           sendWorkerMessage(ws, {
             type: "operation_result",
@@ -3435,42 +4601,66 @@ async function startWorker(options) {
       if (message.type === "delete_project_branch") {
         try {
           const deletionKey = projectBranchKey(message.projectId, message.branchName);
-          projectWorkspaceState = projectWorkspaceStateStore.beginBranchDeletion({
-            projectId: message.projectId,
-            branchName: message.branchName
-          });
-          await workspaceSyncSingleFlight.runMutation(() => {
+          const deletionNeedsSync = await workspaceSyncSingleFlight.runMutation(() => {
             const project = projectConfigById.get(message.projectId);
             if (!project) throw new Error(`Project ${message.projectId} is missing from the worker workspace configuration`);
-            if (pendingMirrorDeletes.has(deletionKey)) return;
+            assertRepositoryExecutionEnabled(project);
+            if (!repositoryMirrorWritesAllowed(project)) {
+              throw new Error(`Project ${message.projectId} branch deletion is disabled while its repository connection is transitioning`);
+            }
+            const configuredBranch = project.branches.find(({ branchName }) => branchName === message.branchName);
+            const pendingLocalBranch = projectWorkspaceState.locallyPendingCreatedBranches.find(
+              ({ projectId, branchName }) => projectId === message.projectId && branchName === message.branchName
+            );
+            assertProjectBranchDeletionIncarnation({
+              requiredBranchId: message.branchId,
+              configuredBranch,
+              pendingLocalBranch
+            });
+            const hasDurableTombstone = projectWorkspaceState.tombstones.some(
+              (tombstone) => tombstone.kind === "branch" && tombstone.projectId === message.projectId && tombstone.branchName === message.branchName
+            );
+            if (!configuredBranch && !pendingLocalBranch && !hasDurableTombstone && !pendingMirrorDeletes.has(deletionKey)) {
+              return false;
+            }
+            projectWorkspaceState = projectWorkspaceStateStore.beginBranchDeletion({
+              projectId: message.projectId,
+              branchName: message.branchName
+            });
+            pendingCreatedBranchPublicationNotBefore.delete(pendingCreatedBranchKey(message.projectId, message.branchName));
+            if (pendingMirrorDeletes.has(deletionKey)) return true;
             stageProjectBranchDeletion(project, message.branchName, true);
             projectConfigById.set(project.projectId, {
               ...project,
               branches: project.branches.filter(({ branchName }) => branchName !== message.branchName)
             });
+            return true;
           });
-          const result = await runWorkspaceSync({
-            trigger: {
-              type: "manual",
-              projectId: message.projectId,
-              branchName: message.branchName,
-              detail: "deleted project branch"
-            },
-            confirmedLargeDiff: true,
-            confirmationReason: "explicit project branch deletion",
-            sendResult: false
-          });
-          if (result.outcome === "failed" || result.outcome === "conflict_blocked" || result.outcome === "large_diff_blocked") {
-            throw new Error(result.error ?? `Project branch deletion workspace sync ended with ${result.outcome}`);
-          }
-          if (pendingMirrorDeletes.has(deletionKey)) {
-            throw new Error("Project branch deletion did not remove the hidden mirror ref");
+          if (deletionNeedsSync) {
+            const result = await runWorkspaceSync({
+              trigger: {
+                type: "manual",
+                projectId: message.projectId,
+                branchName: message.branchName,
+                detail: "deleted project branch"
+              },
+              confirmedLargeDiff: true,
+              confirmationReason: "explicit project branch deletion",
+              sendResult: false
+            });
+            if (result.outcome === "failed" || result.outcome === "conflict_blocked" || result.outcome === "large_diff_blocked") {
+              throw new Error(result.error ?? `Project branch deletion workspace sync ended with ${result.outcome}`);
+            }
+            if (pendingMirrorDeletes.has(deletionKey)) {
+              throw new Error("Project branch deletion did not remove the hidden mirror ref");
+            }
           }
           sendWorkerMessage(ws, {
             type: "operation_result",
             requestId: message.requestId,
             result: {
               type: "delete_project_branch",
+              branchId: message.branchId,
               branchName: message.branchName
             }
           });
@@ -3658,9 +4848,13 @@ async function startWorker(options) {
           });
           return;
         }
-        const releaseWorkspaceMutation = await acquireWorkspaceCommandMutation(message.target, workspaceSyncSingleFlight);
+        await reserveWorkspaceCommandAfterCurrentSync(message.target, workspaceSyncSingleFlight, () => {
+          workspaceSyncPriorityPtyTargets.set(message.ptyId, message.target);
+        });
+        let releaseWorkspaceMutation;
         let mutationLeaseTransferred = false;
         try {
+          releaseWorkspaceMutation = await acquireWorkspaceCommandMutation(message.target, workspaceSyncSingleFlight);
           const resolvedTarget = resolveMessageTarget(message.target);
           process.stdout.write(`[r5d-worker] pty ${message.ptyId}: ${describeWorkerSessionTarget(message.target)}
 `);
@@ -3669,6 +4863,7 @@ async function startWorker(options) {
             message,
             resolvedTarget,
             planRoot,
+            assertAdmission: assertMessageAdmission,
             ...releaseWorkspaceMutation ? { releaseWorkspaceMutation } : {},
             ...targetMayMutateVisibleWorkspace(message.target) ? {
               onTerminal: () => {
@@ -3678,13 +4873,14 @@ async function startWorker(options) {
           });
           mutationLeaseTransferred = releaseWorkspaceMutation !== void 0;
         } catch (error) {
-          sendWorkerMessage(ws, {
+          sendWorkerMessageFromCurrentSource(ws, {
             type: "pty_error",
             requestId: message.requestId,
             ptyId: message.ptyId,
             error: error instanceof Error ? error.message : String(error)
           });
         } finally {
+          workspaceSyncPriorityPtyTargets.delete(message.ptyId);
           if (!mutationLeaseTransferred) releaseWorkspaceMutation?.();
         }
         return;
@@ -3721,15 +4917,29 @@ async function startWorker(options) {
           return;
         }
         let result;
+        let targetReserved = false;
         try {
+          await reserveWorkspaceCommandAfterCurrentSync(message.target, workspaceSyncSingleFlight, () => {
+            workspaceSyncPriorityProcessTargets.set(message.runId, message.target);
+            targetReserved = true;
+          });
           const runCommand = async () => {
             const resolvedTarget = resolveMessageTarget(message.target);
             process.stdout.write(`[r5d-worker] exec ${message.runId}: ${message.argv.join(" ")}
 `);
-            return await executeCommand({ message, resolvedTarget, baseUrl, token, artifactRoot, planRoot });
+            return await executeCommand({
+              message,
+              resolvedTarget,
+              baseUrl,
+              token,
+              artifactRoot,
+              planRoot,
+              assertAdmission: assertMessageAdmission
+            });
           };
           result = await runWorkspaceCommand(message.target, workspaceSyncSingleFlight, runCommand);
         } catch (error) {
+          if (error instanceof StaleWorkerAdmissionError) return;
           result = {
             type: "exec_result",
             requestId: message.requestId,
@@ -3738,6 +4948,8 @@ async function startWorker(options) {
             exitCode: 1,
             error: error instanceof Error ? error.message : String(error)
           };
+        } finally {
+          if (targetReserved) workspaceSyncPriorityProcessTargets.delete(message.runId);
         }
         ws.send(JSON.stringify(result));
         if (targetMayMutateVisibleWorkspace(message.target)) {
@@ -3775,7 +4987,8 @@ async function startWorker(options) {
               baseUrl,
               token,
               artifactRoot,
-              planRoot
+              planRoot,
+              assertAdmission: assertMessageAdmission
             });
           } finally {
             if (targetMayMutateVisibleWorkspace(message.target)) {
@@ -3791,9 +5004,21 @@ async function startWorker(options) {
             }
           }
         };
-        const execution = runWorkspaceCommand(message.target, workspaceSyncSingleFlight, runCommand);
+        const execution = (async () => {
+          let targetReserved = false;
+          try {
+            await reserveWorkspaceCommandAfterCurrentSync(message.target, workspaceSyncSingleFlight, () => {
+              workspaceSyncPriorityProcessTargets.set(message.runId, message.target);
+              targetReserved = true;
+            });
+            await runWorkspaceCommand(message.target, workspaceSyncSingleFlight, runCommand);
+          } finally {
+            if (targetReserved) workspaceSyncPriorityProcessTargets.delete(message.runId);
+          }
+        })();
         void execution.catch((error) => {
-          sendWorkerMessage(ws, {
+          if (error instanceof StaleWorkerAdmissionError) return;
+          sendWorkerMessageFromCurrentSource(ws, {
             type: "exec_start_error",
             requestId: message.requestId,
             runId: message.runId,
@@ -3803,6 +5028,14 @@ async function startWorker(options) {
         return;
       }
       if (message.type === "read" || message.type === "write" || message.type === "edit" || message.type === "grep" || message.type === "find" || message.type === "ls" || message.type === "view_file_bytes" || message.type === "code_list" || message.type === "code_read") {
+        const reservesVisibleWorkspace = targetMayMutateVisibleWorkspace(message.target);
+        const mutatesVisibleWorkspace = (message.type === "write" || message.type === "edit") && targetMayMutateVisibleWorkspace(message.target);
+        if (reservesVisibleWorkspace) {
+          await reserveWorkspaceCommandAfterCurrentSync(message.target, workspaceSyncSingleFlight, () => {
+            workspaceSyncPriorityOperationTargets.set(message.requestId, message.target);
+          });
+        }
+        let dirtyTrigger;
         try {
           const result = await runWorkspaceCommand(message.target, workspaceSyncSingleFlight, async () => {
             const resolvedTarget = resolveMessageTarget(message.target);
@@ -3822,13 +5055,14 @@ async function startWorker(options) {
               result
             })
           );
-          if ((message.type === "write" || message.type === "edit") && targetMayMutateVisibleWorkspace(message.target)) {
-            markWorkspaceDirty({
+          if (mutatesVisibleWorkspace) {
+            dirtyTrigger = {
               type: message.type,
               sessionId: message.sessionId,
               toolCallId: message.requestId,
               ...message.target.type === "project" ? { projectId: message.target.projectId, branchName: message.target.branchName } : {}
-            });
+            };
+            markWorkspaceDirty(dirtyTrigger);
           }
         } catch (error) {
           ws.send(
@@ -3838,6 +5072,13 @@ async function startWorker(options) {
               error: error instanceof Error ? error.message : String(error)
             })
           );
+        } finally {
+          if (reservesVisibleWorkspace) {
+            workspaceSyncPriorityOperationTargets.delete(message.requestId);
+            if (pendingAutomaticTrigger && !activeWorkspaceIncidentId) {
+              scheduleAutomaticWorkspaceSync(pendingAutomaticTrigger, dirtyTrigger ? WORKSPACE_GIT_QUIET_MS : 0);
+            }
+          }
         }
         return;
       }
@@ -3875,6 +5116,7 @@ async function startWorker(options) {
       terminalReplayTimer = void 0;
     }
     if (currentWorkerSocket === ws) {
+      advanceWorkerAdmissionGeneration();
       currentWorkerSocket = null;
     }
     closeAllPtys();
@@ -3887,16 +5129,16 @@ async function startWorker(options) {
     if (shutdownAfterClose) {
       process.exit(0);
     }
-    if (activeProcesses.size > 0 || pendingProcessTerminals.size > 0) {
+    if (activeProcesses.size > 0 || credentialBearingProcessGroups.size > 0 || activePtys.size > 0 || pendingProcessTerminals.size > 0) {
       process.stderr.write(
-        `[r5d-worker] ${activeProcesses.size} process(es) active and ${pendingProcessTerminals.size} terminal report(s) pending; reconnecting in ${WORKER_RECONNECT_DELAY_MS}ms
+        `[r5d-worker] ${activeProcesses.size} process(es), ${credentialBearingProcessGroups.size} owned process group(s), and ${activePtys.size} PTY(s) active with ${pendingProcessTerminals.size} terminal report(s) pending; reconnecting in ${WORKER_RECONNECT_DELAY_MS}ms
 `
       );
       const reconnect = () => {
         void startWorker(options).catch((error) => {
           process.stderr.write(`[r5d-worker] reconnect failed: ${error instanceof Error ? error.message : String(error)}
 `);
-          if (activeProcesses.size > 0 || pendingProcessTerminals.size > 0) {
+          if (activeProcesses.size > 0 || credentialBearingProcessGroups.size > 0 || activePtys.size > 0 || pendingProcessTerminals.size > 0) {
             setTimeout(reconnect, WORKER_RECONNECT_DELAY_MS);
             return;
           }
@@ -3978,6 +5220,7 @@ export {
   resolveWorkerFilePath,
   resolveWorkerSessionTarget,
   syncSessionArtifacts,
+  workerChildProcessEnvironment,
   workerGitSecurityTestHarness,
   writeWorkerTextFile
 };