@ricsam/r5d-worker 0.0.83 → 0.0.86

package/dist/cjs/main.cjs

@@ -1535,10 +1535,20 @@ function workspaceConfigurationIncidentDeferral(input) {
   return { incidentId };
 }
 function workspaceIncidentTerminalClearDisposition(input) {
-  if (!input.deferredConfiguration) return "ordinary_resume";
-  void input.clearedIncidentId;
+  if (!input.deferredConfiguration) return "await_server_refresh";
+  if (input.deferredConfiguration.incidentId !== input.clearedIncidentId) return "reconnect_for_refresh";
   return input.deferredConfiguration.serverRefreshExpected ? "await_server_refresh" : "reconnect_for_refresh";
 }
+function workspaceIncidentTerminalRefreshFence(input) {
+  const disposition = workspaceIncidentTerminalClearDisposition(input);
+  return {
+    disposition,
+    deferredConfiguration: input.deferredConfiguration ?? { incidentId: input.clearedIncidentId, serverRefreshExpected: true }
+  };
+}
+function workspaceAutomaticSyncIsAdmitted(input) {
+  return input.workspaceConfigured && input.activeIncidentId === null && input.deferredConfiguration === null;
+}
 function deferredWorkspaceTargetIsAllowed(deferredConfiguration, activeIncidentId, target) {
   const canonicalTarget = target.type === "workspace" && target.rootProfile === "canonical_sync";
   if (deferredConfiguration) return activeIncidentId === deferredConfiguration.incidentId && canonicalTarget;
@@ -1560,6 +1570,9 @@ function deferredCredentialTransitionMustWait(input) {
 function workspaceConfigurationIncidentSnapshotIsCurrent(capturedIncidentId, activeIncidentId) {
   return capturedIncidentId === null ? activeIncidentId === null : activeIncidentId === null || activeIncidentId === capturedIncidentId;
 }
+function workspaceConfigurationResetToCanonicalIsAllowed(requested, incidentId) {
+  return requested === true && incidentId === null;
+}
 function deferredWorkspaceRefreshWatchdogIsCurrent(input) {
   return input.deferredConfiguration?.incidentId === input.capturedIncidentId && input.activeIncidentId === null;
 }
@@ -1632,12 +1645,15 @@ const workerGitSecurityTestHarness = {
   fenceUnsafeWorkspaceSyncFailure,
   workspaceConfigurationIncidentDeferral,
   workspaceIncidentTerminalClearDisposition,
+  workspaceIncidentTerminalRefreshFence,
+  workspaceAutomaticSyncIsAdmitted,
   deferredWorkspaceTargetIsAllowed,
   deferredWorkspaceSyncTriggerIsAllowed,
   workspaceOperationsAreFenced,
   workspaceCommandTransportIsAllowed,
   deferredCredentialTransitionMustWait,
   workspaceConfigurationIncidentSnapshotIsCurrent,
+  workspaceConfigurationResetToCanonicalIsAllowed,
   deferredWorkspaceRefreshWatchdogIsCurrent,
   incidentDeferredProjectCheckouts,
   deferredIncidentWorkspaceConfigurationResult,
@@ -3398,6 +3414,11 @@ async function startWorker(options) {
   let cliUpdateInProgress = false;
   let reloadAfterClose = false;
   let shutdownAfterClose = false;
+  const automaticWorkspaceSyncIsCurrentlyAdmitted = () => workspaceAutomaticSyncIsAdmitted({
+    workspaceConfigured,
+    activeIncidentId: activeWorkspaceIncidentId,
+    deferredConfiguration: deferredWorkspaceConfiguration
+  });
   const bearerAuthHeader = `Authorization: Bearer ${token}`;
   const workerCredentialUsername = credentialUsernameForAuthHeader(bearerAuthHeader);
   const projectBranchKey = (projectId, branchName) => `${projectId}\0${branchName}`;
@@ -3679,6 +3700,17 @@ async function startWorker(options) {
     const activeTargets = activeWorkspaceMutationTargets();
     return projectConfigById.get(projectId)?.executionDisabled === true || hasProjectWorktree(branchPath) && (0, import_project_worktrees.projectWorktreeOperationInProgress)(branchPath) || canonicalWorkspaceMutationIsActive(activeTargets) || (0, import_workspace_automatic_sync_policy.projectBranchHasActiveWorkspaceTarget)(projectId, branchName, activeTargets);
   };
+  const projectBranchMountExclusiveSyncBusy = (projectId, branchName, branchPath) => {
+    const activeTargets = activeWorkspaceMutationTargets();
+    return (0, import_workspace_automatic_sync_policy.projectBranchMountBusyDuringExclusiveSync)({
+      projectId,
+      branchName,
+      executionDisabled: projectConfigById.get(projectId)?.executionDisabled === true,
+      worktreeOperationInProgress: hasProjectWorktree(branchPath) && (0, import_project_worktrees.projectWorktreeOperationInProgress)(branchPath),
+      retainedCanonicalProcessGroup: canonicalWorkspaceMutationIsActive([...credentialBearingProcessGroupTargets.values()]),
+      activeTargets
+    });
+  };
   const projectBranchMountBusy = (projectId, branchName, branchPath) => !readyProjectIds.has(projectId) || projectBranchMountActivityBusy(projectId, branchName, branchPath);
   const buildWorkspaceMounts = (projects = projectConfigById.values()) => {
     const mounts = [];
@@ -3711,7 +3743,7 @@ async function startWorker(options) {
           preserveLocalOnHydrationBasisChange: preservesCheckoutPathMove,
           busy: () => projectBranchMountBusy(project.projectId, branch.branchName, branchPath),
           mutationToken: () => projectWorkspaceMutationToken(project.projectId, branch.branchName),
-          busyForRecovery: () => projectBranchMountActivityBusy(project.projectId, branch.branchName, branchPath)
+          busyForRecovery: () => projectBranchMountExclusiveSyncBusy(project.projectId, branch.branchName, branchPath)
         });
         mounts.push({
           id: projectPlanMountId(project.projectId, branch.branchName),
@@ -3725,7 +3757,7 @@ async function startWorker(options) {
           preserveLocalOnHydrationBasisChange: preservesCheckoutPathMove,
           busy: () => projectBranchMountBusy(project.projectId, branch.branchName, branchPath),
           mutationToken: () => projectWorkspaceMutationToken(project.projectId, branch.branchName),
-          busyForRecovery: () => projectBranchMountActivityBusy(project.projectId, branch.branchName, branchPath)
+          busyForRecovery: () => projectBranchMountExclusiveSyncBusy(project.projectId, branch.branchName, branchPath)
         });
       }
       void projectRoot;
@@ -3748,7 +3780,10 @@ async function startWorker(options) {
       mutationToken: () => String(visibleWorkspaceMutationEpoch),
       busyForRecovery: () => {
         const activeTargets = activeWorkspaceMutationTargets();
-        return canonicalWorkspaceMutationIsActive(activeTargets) || (0, import_workspace_automatic_sync_policy.hasActiveVisibleProjectsWorkspaceTarget)(activeTargets);
+        return (0, import_workspace_automatic_sync_policy.workspacePlansMountBusyDuringExclusiveSync)(
+          activeTargets,
+          canonicalWorkspaceMutationIsActive([...credentialBearingProcessGroupTargets.values()])
+        );
       }
     });
     for (const deletion of pendingMirrorDeletes.values()) {
@@ -4129,9 +4164,9 @@ async function startWorker(options) {
     if (!workspaceRemoteUrl || !workspaceCredentialHelper || !workspaceCredentialUsername || !workspaceGitIdentity) {
       throw new Error("Worker workspace configuration has not been received");
     }
-    const mounts = buildWorkspaceMounts();
+    const configuredMounts = buildWorkspaceMounts();
     if (input.resetToCanonical) {
-      const resetHasBusyLiveMount = mounts.some(
+      const resetHasBusyLiveMount = configuredMounts.some(
         (mount) => !(mount.deleteWhenSourceMissing && !import_node_fs.default.existsSync(mount.sourcePath)) && mount.busy?.()
       );
       if (resetHasBusyLiveMount) {
@@ -4147,7 +4182,7 @@ async function startWorker(options) {
         credentialHelper: workspaceCredentialHelper,
         credentialUsername: workspaceCredentialUsername,
         gitIdentity: workspaceGitIdentity,
-        mounts
+        mounts: configuredMounts
       });
       applyObservedProjectHeadsAfterInboundWorkspace(observedProjectHeads2, reset.activeMountIds, true);
       return {
@@ -4171,6 +4206,7 @@ async function startWorker(options) {
       };
     }
     const outerRemediation = input.trigger.type === "remediation" || input.trigger.type === "remediation_confirm";
+    const mounts = outerRemediation ? (0, import_workspace_git_sync.workspaceGitMountsForRemediation)(configuredMounts) : configuredMounts;
     const observedProjectHeads = outerRemediation ? [] : observeProjectHeadsBeforeOuterWorkspace({ allowNonFastForward: false, failClosed: false });
     const inboundMoveMountIds = new Set(
       observedProjectHeads.flatMap(
@@ -4322,7 +4358,7 @@ async function startWorker(options) {
       pendingCreatedBranchPublicationNotBefore
     );
     const initialDeferral = pendingBranchDeferral();
-    if (!workspaceConfigured || activeWorkspaceIncidentId || deferredWorkspaceConfiguration || currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN || automaticSyncInFlight || initialDeferral?.kind === "active_target") {
+    if (!automaticWorkspaceSyncIsCurrentlyAdmitted() || currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN || automaticSyncInFlight || initialDeferral?.kind === "active_target") {
       return;
     }
     if (workspaceAutomaticTimer) clearTimeout(workspaceAutomaticTimer);
@@ -4330,8 +4366,7 @@ async function startWorker(options) {
       () => {
         workspaceAutomaticTimer = void 0;
         const scheduledTrigger = pendingAutomaticTrigger;
-        if (!scheduledTrigger || !workspaceConfigured || activeWorkspaceIncidentId || deferredWorkspaceConfiguration || currentWorkerSocket !== ws)
-          return;
+        if (!scheduledTrigger || !automaticWorkspaceSyncIsCurrentlyAdmitted() || currentWorkerSocket !== ws) return;
         const currentDeferral = pendingBranchDeferral();
         if (currentDeferral?.kind === "active_target") return;
         if (currentDeferral?.kind === "creation_grace") {
@@ -4353,7 +4388,7 @@ async function startWorker(options) {
         }).finally(() => {
           automaticSyncInFlight = false;
           heartbeatBusyGrace = (0, import_heartbeat.grantWorkerHeartbeatBusyGrace)(lastServerHeartbeatAt, heartbeatBusyGrace);
-          if (pendingAutomaticTrigger && !activeWorkspaceIncidentId && !deferredWorkspaceConfiguration) {
+          if (pendingAutomaticTrigger && automaticWorkspaceSyncIsCurrentlyAdmitted()) {
             scheduleAutomaticWorkspaceSync(pendingAutomaticTrigger, WORKSPACE_GIT_QUIET_MS);
           }
         });
@@ -4762,6 +4797,7 @@ async function startWorker(options) {
         const result = await performWorkspaceSync({
           attemptId: crypto.randomUUID(),
           trigger: { type: "connect" },
+          resetToCanonical: workspaceConfigurationResetToCanonicalIsAllowed(message.resetToCanonical, incidentDeferral.incidentId),
           assertStillAdmitted: assertConfigurationSyncStillAdmitted
         });
         assertConfigurationSyncStillAdmitted();
@@ -4860,7 +4896,7 @@ async function startWorker(options) {
       workspaceAutomaticTimer = void 0;
     }
     void (async () => {
-      if (workspaceConfigured && !activeWorkspaceIncidentId && !deferredWorkspaceConfiguration) {
+      if (automaticWorkspaceSyncIsCurrentlyAdmitted()) {
         await runWorkspaceSync({
           trigger: { type: "manual", detail: "graceful worker shutdown" }
         });
@@ -4911,7 +4947,8 @@ async function startWorker(options) {
           execStdinV1: true,
           ptyEnvFilesV1: true,
           workspaceRemediationAncestorGuardV1: true,
-          workspaceIncidentConfigDeferralV1: true
+          workspaceIncidentConfigDeferralV1: true,
+          workspaceConfigResetToCanonicalV1: true
         },
         projectRoot: projectsRoot,
         artifactRoot,
@@ -4975,7 +5012,7 @@ async function startWorker(options) {
           }, WORKSPACE_GIT_PERIODIC_MS);
           workspacePeriodicTimer.unref();
         }
-        if (pendingAutomaticTrigger && !activeWorkspaceIncidentId && !deferredWorkspaceConfiguration) {
+        if (pendingAutomaticTrigger && automaticWorkspaceSyncIsCurrentlyAdmitted()) {
           scheduleAutomaticWorkspaceSync(pendingAutomaticTrigger, 0);
         }
         return;
@@ -5215,35 +5252,33 @@ async function startWorker(options) {
         if (nextIncidentId !== previousIncidentId) advanceWorkerAdmissionGeneration();
         activeWorkspaceIncidentId = nextIncidentId;
         if (previousIncidentId && !activeWorkspaceIncidentId && (message.status === "resolved" || message.status === "confirmed" || message.status === "reset")) {
-          const disposition = workspaceIncidentTerminalClearDisposition({
+          const refresh = workspaceIncidentTerminalRefreshFence({
             deferredConfiguration: deferredWorkspaceConfiguration,
             clearedIncidentId: previousIncidentId
           });
-          if (disposition !== "ordinary_resume") {
-            pendingAutomaticTrigger ??= { type: "periodic", detail: "resume after workspace incident" };
-            workspaceConfigured = false;
-            advanceWorkerAdmissionGeneration();
-            if (disposition === "reconnect_for_refresh") {
-              ws.close(1012, "Refreshing deferred workspace configuration");
-            } else {
-              if (deferredWorkspaceConfigurationRefreshTimer) clearTimeout(deferredWorkspaceConfigurationRefreshTimer);
-              const deferredIncidentId = deferredWorkspaceConfiguration?.incidentId;
-              deferredWorkspaceConfigurationRefreshTimer = setTimeout(() => {
-                deferredWorkspaceConfigurationRefreshTimer = void 0;
-                if (!deferredIncidentId || !deferredWorkspaceRefreshWatchdogIsCurrent({
-                  capturedIncidentId: deferredIncidentId,
-                  deferredConfiguration: deferredWorkspaceConfiguration,
-                  activeIncidentId: activeWorkspaceIncidentId
-                }) || currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN) {
-                  return;
-                }
-                ws.close(1012, "Timed out waiting for deferred workspace configuration refresh");
-              }, WORKSPACE_INCIDENT_CONFIG_REFRESH_TIMEOUT_MS);
-              deferredWorkspaceConfigurationRefreshTimer.unref();
-            }
-            return;
+          deferredWorkspaceConfiguration = refresh.deferredConfiguration;
+          pendingAutomaticTrigger ??= { type: "periodic", detail: "resume after workspace incident" };
+          workspaceConfigured = false;
+          advanceWorkerAdmissionGeneration();
+          if (refresh.disposition === "reconnect_for_refresh") {
+            ws.close(1012, "Refreshing deferred workspace configuration");
+          } else {
+            if (deferredWorkspaceConfigurationRefreshTimer) clearTimeout(deferredWorkspaceConfigurationRefreshTimer);
+            const deferredIncidentId = deferredWorkspaceConfiguration.incidentId;
+            deferredWorkspaceConfigurationRefreshTimer = setTimeout(() => {
+              deferredWorkspaceConfigurationRefreshTimer = void 0;
+              if (!deferredWorkspaceRefreshWatchdogIsCurrent({
+                capturedIncidentId: deferredIncidentId,
+                deferredConfiguration: deferredWorkspaceConfiguration,
+                activeIncidentId: activeWorkspaceIncidentId
+              }) || currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN) {
+                return;
+              }
+              ws.close(1012, "Timed out waiting for deferred workspace configuration refresh");
+            }, WORKSPACE_INCIDENT_CONFIG_REFRESH_TIMEOUT_MS);
+            deferredWorkspaceConfigurationRefreshTimer.unref();
           }
-          scheduleAutomaticWorkspaceSync(pendingAutomaticTrigger ?? { type: "periodic", detail: "resume after workspace incident" }, 0);
+          return;
         }
         return;
       }
@@ -5616,7 +5651,12 @@ async function startWorker(options) {
                 if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
               });
             }
-            await (0, import_workspace_command_sync_policy.runWorkspaceCommand)(message.target, workspaceSyncSingleFlight, runCommand);
+            await (0, import_workspace_command_sync_policy.runReservedWorkspaceCommand)(message.target, workspaceSyncSingleFlight, runCommand, () => {
+              if (targetReserved) {
+                workspaceSyncPriorityProcessTargets.delete(message.runId);
+                targetReserved = false;
+              }
+            });
           } finally {
             if (targetReserved) workspaceSyncPriorityProcessTargets.delete(message.runId);
           }
@@ -5690,7 +5730,7 @@ async function startWorker(options) {
         } finally {
           if (reservesVisibleWorkspace) {
             workspaceSyncPriorityOperationTargets.delete(message.requestId);
-            if (pendingAutomaticTrigger && !activeWorkspaceIncidentId && !deferredWorkspaceConfiguration) {
+            if (pendingAutomaticTrigger && automaticWorkspaceSyncIsCurrentlyAdmitted()) {
               scheduleAutomaticWorkspaceSync(pendingAutomaticTrigger, dirtyTrigger ? WORKSPACE_GIT_QUIET_MS : 0);
             }
           }

package/dist/cjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.83",
+  "version": "0.0.86",
   "type": "commonjs"
 }

package/dist/cjs/workspace-automatic-sync-policy.cjs

@@ -23,7 +23,9 @@ __export(workspace_automatic_sync_policy_exports, {
   pendingCreatedBranchAutomaticSyncDeferral: () => pendingCreatedBranchAutomaticSyncDeferral,
   pendingCreatedBranchKey: () => pendingCreatedBranchKey,
   projectBranchHasActiveWorkspaceTarget: () => projectBranchHasActiveWorkspaceTarget,
-  shouldDeferAutomaticWorkspaceSyncForPendingBranch: () => shouldDeferAutomaticWorkspaceSyncForPendingBranch
+  projectBranchMountBusyDuringExclusiveSync: () => projectBranchMountBusyDuringExclusiveSync,
+  shouldDeferAutomaticWorkspaceSyncForPendingBranch: () => shouldDeferAutomaticWorkspaceSyncForPendingBranch,
+  workspacePlansMountBusyDuringExclusiveSync: () => workspacePlansMountBusyDuringExclusiveSync
 });
 module.exports = __toCommonJS(workspace_automatic_sync_policy_exports);
 const PENDING_CREATED_BRANCH_AUTOMATIC_SYNC_GRACE_MS = 12e4;
@@ -43,6 +45,12 @@ function projectBranchHasActiveWorkspaceTarget(projectId, branchName, activeTarg
   }
   return false;
 }
+function projectBranchMountBusyDuringExclusiveSync(input) {
+  return input.executionDisabled || input.worktreeOperationInProgress || input.retainedCanonicalProcessGroup || projectBranchHasActiveWorkspaceTarget(input.projectId, input.branchName, input.activeTargets);
+}
+function workspacePlansMountBusyDuringExclusiveSync(activeTargets, retainedCanonicalProcessGroup = false) {
+  return retainedCanonicalProcessGroup || hasActiveVisibleProjectsWorkspaceTarget(activeTargets);
+}
 function shouldDeferAutomaticWorkspaceSyncForPendingBranch(pendingCreatedBranches, activeTargets) {
   if (pendingCreatedBranches.length === 0) return false;
   const targets = [...activeTargets];
@@ -65,5 +73,7 @@ function pendingCreatedBranchAutomaticSyncDeferral(pendingCreatedBranches, activ
   pendingCreatedBranchAutomaticSyncDeferral,
   pendingCreatedBranchKey,
   projectBranchHasActiveWorkspaceTarget,
-  shouldDeferAutomaticWorkspaceSyncForPendingBranch
+  projectBranchMountBusyDuringExclusiveSync,
+  shouldDeferAutomaticWorkspaceSyncForPendingBranch,
+  workspacePlansMountBusyDuringExclusiveSync
 });

package/dist/cjs/workspace-command-sync-policy.cjs

@@ -20,6 +20,7 @@ var workspace_command_sync_policy_exports = {};
 __export(workspace_command_sync_policy_exports, {
   acquireWorkspaceCommandMutation: () => acquireWorkspaceCommandMutation,
   reserveWorkspaceCommandAfterCurrentSync: () => reserveWorkspaceCommandAfterCurrentSync,
+  runReservedWorkspaceCommand: () => runReservedWorkspaceCommand,
   runWorkspaceCommand: () => runWorkspaceCommand,
   shouldSerializeWorkspaceCommand: () => shouldSerializeWorkspaceCommand
 });
@@ -46,6 +47,25 @@ function shouldSerializeWorkspaceCommand(target) {
 function runWorkspaceCommand(target, coordinator, operation) {
   return shouldSerializeWorkspaceCommand(target) ? coordinator.runMutation(operation) : Promise.resolve().then(operation);
 }
+async function runReservedWorkspaceCommand(target, coordinator, operation, releaseReservation) {
+  let released = false;
+  const releaseOnce = () => {
+    if (released) return;
+    released = true;
+    releaseReservation();
+  };
+  try {
+    return await runWorkspaceCommand(target, coordinator, async () => {
+      try {
+        return await operation();
+      } finally {
+        releaseOnce();
+      }
+    });
+  } finally {
+    releaseOnce();
+  }
+}
 function acquireWorkspaceCommandMutation(target, coordinator) {
   return shouldSerializeWorkspaceCommand(target) ? coordinator.acquireMutation() : Promise.resolve(void 0);
 }
@@ -53,6 +73,7 @@ function acquireWorkspaceCommandMutation(target, coordinator) {
 0 && (module.exports = {
   acquireWorkspaceCommandMutation,
   reserveWorkspaceCommandAfterCurrentSync,
+  runReservedWorkspaceCommand,
   runWorkspaceCommand,
   shouldSerializeWorkspaceCommand
 });

package/dist/cjs/workspace-git-sync.cjs

@@ -42,6 +42,7 @@ __export(workspace_git_sync_exports, {
   resetWorkspaceGit: () => resetWorkspaceGit,
   synchronizeWorkspaceGit: () => synchronizeWorkspaceGit,
   workspaceGitHydrationIsCurrent: () => workspaceGitHydrationIsCurrent,
+  workspaceGitMountsForRemediation: () => workspaceGitMountsForRemediation,
   workspaceGitSyncTestHarness: () => workspaceGitSyncTestHarness
 });
 module.exports = __toCommonJS(workspace_git_sync_exports);
@@ -58,6 +59,9 @@ const WORKSPACE_GIT_INTEGRATED_REF = "refs/r5d/workspace-local/integrated";
 const WORKSPACE_GIT_HYDRATED_RECEIPT = "r5d/workspace-hydrated-head";
 const WORKSPACE_GIT_HYDRATION_TRANSACTION = "r5d/workspace-hydration-transaction";
 const WORKSPACE_GIT_CHECKOUT_DURABILITY = "r5d/workspace-checkout-durability";
+function workspaceGitMountsForRemediation(mounts) {
+  return mounts.map((mount) => ({ ...mount, busy: mount.busyForRecovery ?? mount.busy }));
+}
 class WorkspaceRemediationAncestryError extends Error {
   constructor(message) {
     super(message);
@@ -1342,6 +1346,9 @@ function resetWorkspaceGit(input) {
     const outerPath = import_node_path.default.join(workspacePath, ...mount.workspaceRelativePath.replace(/\\/g, "/").split("/"));
     return import_node_fs.default.existsSync(outerPath);
   });
+  const bootstrapMountIds = new Set(bootstrapMounts.map(({ id }) => id));
+  const durablyAbsentMounts = selected.skipped.filter((mount) => !bootstrapMountIds.has(mount.id) && mount.sourceMode === "all");
+  const uncoveredSkippedMounts = selected.skipped.filter((mount) => !bootstrapMountIds.has(mount.id) && mount.sourceMode !== "all");
   const hydrationMounts = [...selected.active, ...bootstrapMounts];
   const requiredLiveMounts = [
     ...new Map([...requiredLiveMountsBeforeHydration, ...bootstrapMounts].map((mount) => [mount.id, mount])).values()
@@ -1349,7 +1356,7 @@ function resetWorkspaceGit(input) {
   const hydration = hydrateWorkspaceGitMountsTransactionally({
     workspacePath,
     mounts: hydrationMounts,
-    durabilityMounts: [...requiredLiveMounts, ...selected.tombstones],
+    durabilityMounts: [...requiredLiveMounts, ...selected.tombstones, ...durablyAbsentMounts],
     receiptMounts: input.mounts,
     requiredMounts: requiredLiveMounts,
     recordCurrentHead: true
@@ -1365,7 +1372,7 @@ function resetWorkspaceGit(input) {
     remoteHead,
     discardedPaths,
     activeMountIds: hydration.hydratedMountIds,
-    skippedMountIds: [.../* @__PURE__ */ new Set([...selected.skipped.map(({ id }) => id), ...hydration.skippedMountIds])].sort()
+    skippedMountIds: [.../* @__PURE__ */ new Set([...uncoveredSkippedMounts.map(({ id }) => id), ...hydration.skippedMountIds])].sort()
   };
 }
 function stagedPaths(workspacePath) {
@@ -1881,5 +1888,6 @@ const workspaceGitSyncTestHarness = {
   resetWorkspaceGit,
   synchronizeWorkspaceGit,
   workspaceGitHydrationIsCurrent,
+  workspaceGitMountsForRemediation,
   workspaceGitSyncTestHarness
 });

package/dist/mjs/main.mjs

@@ -28,11 +28,14 @@ import {
   PENDING_CREATED_BRANCH_AUTOMATIC_SYNC_GRACE_MS,
   pendingCreatedBranchAutomaticSyncDeferral,
   pendingCreatedBranchKey,
-  projectBranchHasActiveWorkspaceTarget
+  projectBranchHasActiveWorkspaceTarget,
+  projectBranchMountBusyDuringExclusiveSync,
+  workspacePlansMountBusyDuringExclusiveSync
 } from "./workspace-automatic-sync-policy.mjs";
 import {
   acquireWorkspaceCommandMutation,
   reserveWorkspaceCommandAfterCurrentSync,
+  runReservedWorkspaceCommand,
   runWorkspaceCommand
 } from "./workspace-command-sync-policy.mjs";
 import { WorkspaceMutationGate } from "./workspace-mutation-gate.mjs";
@@ -86,6 +89,7 @@ import {
   resetWorkspaceGit,
   synchronizeWorkspaceGit,
   workspaceGitHydrationIsCurrent,
+  workspaceGitMountsForRemediation,
   WorkspaceRemediationAncestryError
 } from "./workspace-git-sync.mjs";
 class ProjectWorkspaceConfigurationDeferredError extends Error {
@@ -1539,10 +1543,20 @@ function workspaceConfigurationIncidentDeferral(input) {
   return { incidentId };
 }
 function workspaceIncidentTerminalClearDisposition(input) {
-  if (!input.deferredConfiguration) return "ordinary_resume";
-  void input.clearedIncidentId;
+  if (!input.deferredConfiguration) return "await_server_refresh";
+  if (input.deferredConfiguration.incidentId !== input.clearedIncidentId) return "reconnect_for_refresh";
   return input.deferredConfiguration.serverRefreshExpected ? "await_server_refresh" : "reconnect_for_refresh";
 }
+function workspaceIncidentTerminalRefreshFence(input) {
+  const disposition = workspaceIncidentTerminalClearDisposition(input);
+  return {
+    disposition,
+    deferredConfiguration: input.deferredConfiguration ?? { incidentId: input.clearedIncidentId, serverRefreshExpected: true }
+  };
+}
+function workspaceAutomaticSyncIsAdmitted(input) {
+  return input.workspaceConfigured && input.activeIncidentId === null && input.deferredConfiguration === null;
+}
 function deferredWorkspaceTargetIsAllowed(deferredConfiguration, activeIncidentId, target) {
   const canonicalTarget = target.type === "workspace" && target.rootProfile === "canonical_sync";
   if (deferredConfiguration) return activeIncidentId === deferredConfiguration.incidentId && canonicalTarget;
@@ -1564,6 +1578,9 @@ function deferredCredentialTransitionMustWait(input) {
 function workspaceConfigurationIncidentSnapshotIsCurrent(capturedIncidentId, activeIncidentId) {
   return capturedIncidentId === null ? activeIncidentId === null : activeIncidentId === null || activeIncidentId === capturedIncidentId;
 }
+function workspaceConfigurationResetToCanonicalIsAllowed(requested, incidentId) {
+  return requested === true && incidentId === null;
+}
 function deferredWorkspaceRefreshWatchdogIsCurrent(input) {
   return input.deferredConfiguration?.incidentId === input.capturedIncidentId && input.activeIncidentId === null;
 }
@@ -1636,12 +1653,15 @@ const workerGitSecurityTestHarness = {
   fenceUnsafeWorkspaceSyncFailure,
   workspaceConfigurationIncidentDeferral,
   workspaceIncidentTerminalClearDisposition,
+  workspaceIncidentTerminalRefreshFence,
+  workspaceAutomaticSyncIsAdmitted,
   deferredWorkspaceTargetIsAllowed,
   deferredWorkspaceSyncTriggerIsAllowed,
   workspaceOperationsAreFenced,
   workspaceCommandTransportIsAllowed,
   deferredCredentialTransitionMustWait,
   workspaceConfigurationIncidentSnapshotIsCurrent,
+  workspaceConfigurationResetToCanonicalIsAllowed,
   deferredWorkspaceRefreshWatchdogIsCurrent,
   incidentDeferredProjectCheckouts,
   deferredIncidentWorkspaceConfigurationResult,
@@ -3402,6 +3422,11 @@ async function startWorker(options) {
   let cliUpdateInProgress = false;
   let reloadAfterClose = false;
   let shutdownAfterClose = false;
+  const automaticWorkspaceSyncIsCurrentlyAdmitted = () => workspaceAutomaticSyncIsAdmitted({
+    workspaceConfigured,
+    activeIncidentId: activeWorkspaceIncidentId,
+    deferredConfiguration: deferredWorkspaceConfiguration
+  });
   const bearerAuthHeader = `Authorization: Bearer ${token}`;
   const workerCredentialUsername = credentialUsernameForAuthHeader(bearerAuthHeader);
   const projectBranchKey = (projectId, branchName) => `${projectId}\0${branchName}`;
@@ -3683,6 +3708,17 @@ async function startWorker(options) {
     const activeTargets = activeWorkspaceMutationTargets();
     return projectConfigById.get(projectId)?.executionDisabled === true || hasProjectWorktree(branchPath) && projectWorktreeOperationInProgress(branchPath) || canonicalWorkspaceMutationIsActive(activeTargets) || projectBranchHasActiveWorkspaceTarget(projectId, branchName, activeTargets);
   };
+  const projectBranchMountExclusiveSyncBusy = (projectId, branchName, branchPath) => {
+    const activeTargets = activeWorkspaceMutationTargets();
+    return projectBranchMountBusyDuringExclusiveSync({
+      projectId,
+      branchName,
+      executionDisabled: projectConfigById.get(projectId)?.executionDisabled === true,
+      worktreeOperationInProgress: hasProjectWorktree(branchPath) && projectWorktreeOperationInProgress(branchPath),
+      retainedCanonicalProcessGroup: canonicalWorkspaceMutationIsActive([...credentialBearingProcessGroupTargets.values()]),
+      activeTargets
+    });
+  };
   const projectBranchMountBusy = (projectId, branchName, branchPath) => !readyProjectIds.has(projectId) || projectBranchMountActivityBusy(projectId, branchName, branchPath);
   const buildWorkspaceMounts = (projects = projectConfigById.values()) => {
     const mounts = [];
@@ -3715,7 +3751,7 @@ async function startWorker(options) {
           preserveLocalOnHydrationBasisChange: preservesCheckoutPathMove,
           busy: () => projectBranchMountBusy(project.projectId, branch.branchName, branchPath),
           mutationToken: () => projectWorkspaceMutationToken(project.projectId, branch.branchName),
-          busyForRecovery: () => projectBranchMountActivityBusy(project.projectId, branch.branchName, branchPath)
+          busyForRecovery: () => projectBranchMountExclusiveSyncBusy(project.projectId, branch.branchName, branchPath)
         });
         mounts.push({
           id: projectPlanMountId(project.projectId, branch.branchName),
@@ -3729,7 +3765,7 @@ async function startWorker(options) {
           preserveLocalOnHydrationBasisChange: preservesCheckoutPathMove,
           busy: () => projectBranchMountBusy(project.projectId, branch.branchName, branchPath),
           mutationToken: () => projectWorkspaceMutationToken(project.projectId, branch.branchName),
-          busyForRecovery: () => projectBranchMountActivityBusy(project.projectId, branch.branchName, branchPath)
+          busyForRecovery: () => projectBranchMountExclusiveSyncBusy(project.projectId, branch.branchName, branchPath)
         });
       }
       void projectRoot;
@@ -3752,7 +3788,10 @@ async function startWorker(options) {
       mutationToken: () => String(visibleWorkspaceMutationEpoch),
       busyForRecovery: () => {
         const activeTargets = activeWorkspaceMutationTargets();
-        return canonicalWorkspaceMutationIsActive(activeTargets) || hasActiveVisibleProjectsWorkspaceTarget(activeTargets);
+        return workspacePlansMountBusyDuringExclusiveSync(
+          activeTargets,
+          canonicalWorkspaceMutationIsActive([...credentialBearingProcessGroupTargets.values()])
+        );
       }
     });
     for (const deletion of pendingMirrorDeletes.values()) {
@@ -4133,9 +4172,9 @@ async function startWorker(options) {
     if (!workspaceRemoteUrl || !workspaceCredentialHelper || !workspaceCredentialUsername || !workspaceGitIdentity) {
       throw new Error("Worker workspace configuration has not been received");
     }
-    const mounts = buildWorkspaceMounts();
+    const configuredMounts = buildWorkspaceMounts();
     if (input.resetToCanonical) {
-      const resetHasBusyLiveMount = mounts.some(
+      const resetHasBusyLiveMount = configuredMounts.some(
         (mount) => !(mount.deleteWhenSourceMissing && !fs.existsSync(mount.sourcePath)) && mount.busy?.()
       );
       if (resetHasBusyLiveMount) {
@@ -4151,7 +4190,7 @@ async function startWorker(options) {
         credentialHelper: workspaceCredentialHelper,
         credentialUsername: workspaceCredentialUsername,
         gitIdentity: workspaceGitIdentity,
-        mounts
+        mounts: configuredMounts
       });
       applyObservedProjectHeadsAfterInboundWorkspace(observedProjectHeads2, reset.activeMountIds, true);
       return {
@@ -4175,6 +4214,7 @@ async function startWorker(options) {
       };
     }
     const outerRemediation = input.trigger.type === "remediation" || input.trigger.type === "remediation_confirm";
+    const mounts = outerRemediation ? workspaceGitMountsForRemediation(configuredMounts) : configuredMounts;
     const observedProjectHeads = outerRemediation ? [] : observeProjectHeadsBeforeOuterWorkspace({ allowNonFastForward: false, failClosed: false });
     const inboundMoveMountIds = new Set(
       observedProjectHeads.flatMap(
@@ -4326,7 +4366,7 @@ async function startWorker(options) {
       pendingCreatedBranchPublicationNotBefore
     );
     const initialDeferral = pendingBranchDeferral();
-    if (!workspaceConfigured || activeWorkspaceIncidentId || deferredWorkspaceConfiguration || currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN || automaticSyncInFlight || initialDeferral?.kind === "active_target") {
+    if (!automaticWorkspaceSyncIsCurrentlyAdmitted() || currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN || automaticSyncInFlight || initialDeferral?.kind === "active_target") {
       return;
     }
     if (workspaceAutomaticTimer) clearTimeout(workspaceAutomaticTimer);
@@ -4334,8 +4374,7 @@ async function startWorker(options) {
       () => {
         workspaceAutomaticTimer = void 0;
         const scheduledTrigger = pendingAutomaticTrigger;
-        if (!scheduledTrigger || !workspaceConfigured || activeWorkspaceIncidentId || deferredWorkspaceConfiguration || currentWorkerSocket !== ws)
-          return;
+        if (!scheduledTrigger || !automaticWorkspaceSyncIsCurrentlyAdmitted() || currentWorkerSocket !== ws) return;
         const currentDeferral = pendingBranchDeferral();
         if (currentDeferral?.kind === "active_target") return;
         if (currentDeferral?.kind === "creation_grace") {
@@ -4357,7 +4396,7 @@ async function startWorker(options) {
         }).finally(() => {
           automaticSyncInFlight = false;
           heartbeatBusyGrace = grantWorkerHeartbeatBusyGrace(lastServerHeartbeatAt, heartbeatBusyGrace);
-          if (pendingAutomaticTrigger && !activeWorkspaceIncidentId && !deferredWorkspaceConfiguration) {
+          if (pendingAutomaticTrigger && automaticWorkspaceSyncIsCurrentlyAdmitted()) {
             scheduleAutomaticWorkspaceSync(pendingAutomaticTrigger, WORKSPACE_GIT_QUIET_MS);
           }
         });
@@ -4766,6 +4805,7 @@ async function startWorker(options) {
         const result = await performWorkspaceSync({
           attemptId: crypto.randomUUID(),
           trigger: { type: "connect" },
+          resetToCanonical: workspaceConfigurationResetToCanonicalIsAllowed(message.resetToCanonical, incidentDeferral.incidentId),
           assertStillAdmitted: assertConfigurationSyncStillAdmitted
         });
         assertConfigurationSyncStillAdmitted();
@@ -4864,7 +4904,7 @@ async function startWorker(options) {
       workspaceAutomaticTimer = void 0;
     }
     void (async () => {
-      if (workspaceConfigured && !activeWorkspaceIncidentId && !deferredWorkspaceConfiguration) {
+      if (automaticWorkspaceSyncIsCurrentlyAdmitted()) {
         await runWorkspaceSync({
           trigger: { type: "manual", detail: "graceful worker shutdown" }
         });
@@ -4915,7 +4955,8 @@ async function startWorker(options) {
           execStdinV1: true,
           ptyEnvFilesV1: true,
           workspaceRemediationAncestorGuardV1: true,
-          workspaceIncidentConfigDeferralV1: true
+          workspaceIncidentConfigDeferralV1: true,
+          workspaceConfigResetToCanonicalV1: true
         },
         projectRoot: projectsRoot,
         artifactRoot,
@@ -4979,7 +5020,7 @@ async function startWorker(options) {
           }, WORKSPACE_GIT_PERIODIC_MS);
           workspacePeriodicTimer.unref();
         }
-        if (pendingAutomaticTrigger && !activeWorkspaceIncidentId && !deferredWorkspaceConfiguration) {
+        if (pendingAutomaticTrigger && automaticWorkspaceSyncIsCurrentlyAdmitted()) {
           scheduleAutomaticWorkspaceSync(pendingAutomaticTrigger, 0);
         }
         return;
@@ -5219,35 +5260,33 @@ async function startWorker(options) {
         if (nextIncidentId !== previousIncidentId) advanceWorkerAdmissionGeneration();
         activeWorkspaceIncidentId = nextIncidentId;
         if (previousIncidentId && !activeWorkspaceIncidentId && (message.status === "resolved" || message.status === "confirmed" || message.status === "reset")) {
-          const disposition = workspaceIncidentTerminalClearDisposition({
+          const refresh = workspaceIncidentTerminalRefreshFence({
             deferredConfiguration: deferredWorkspaceConfiguration,
             clearedIncidentId: previousIncidentId
           });
-          if (disposition !== "ordinary_resume") {
-            pendingAutomaticTrigger ??= { type: "periodic", detail: "resume after workspace incident" };
-            workspaceConfigured = false;
-            advanceWorkerAdmissionGeneration();
-            if (disposition === "reconnect_for_refresh") {
-              ws.close(1012, "Refreshing deferred workspace configuration");
-            } else {
-              if (deferredWorkspaceConfigurationRefreshTimer) clearTimeout(deferredWorkspaceConfigurationRefreshTimer);
-              const deferredIncidentId = deferredWorkspaceConfiguration?.incidentId;
-              deferredWorkspaceConfigurationRefreshTimer = setTimeout(() => {
-                deferredWorkspaceConfigurationRefreshTimer = void 0;
-                if (!deferredIncidentId || !deferredWorkspaceRefreshWatchdogIsCurrent({
-                  capturedIncidentId: deferredIncidentId,
-                  deferredConfiguration: deferredWorkspaceConfiguration,
-                  activeIncidentId: activeWorkspaceIncidentId
-                }) || currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN) {
-                  return;
-                }
-                ws.close(1012, "Timed out waiting for deferred workspace configuration refresh");
-              }, WORKSPACE_INCIDENT_CONFIG_REFRESH_TIMEOUT_MS);
-              deferredWorkspaceConfigurationRefreshTimer.unref();
-            }
-            return;
+          deferredWorkspaceConfiguration = refresh.deferredConfiguration;
+          pendingAutomaticTrigger ??= { type: "periodic", detail: "resume after workspace incident" };
+          workspaceConfigured = false;
+          advanceWorkerAdmissionGeneration();
+          if (refresh.disposition === "reconnect_for_refresh") {
+            ws.close(1012, "Refreshing deferred workspace configuration");
+          } else {
+            if (deferredWorkspaceConfigurationRefreshTimer) clearTimeout(deferredWorkspaceConfigurationRefreshTimer);
+            const deferredIncidentId = deferredWorkspaceConfiguration.incidentId;
+            deferredWorkspaceConfigurationRefreshTimer = setTimeout(() => {
+              deferredWorkspaceConfigurationRefreshTimer = void 0;
+              if (!deferredWorkspaceRefreshWatchdogIsCurrent({
+                capturedIncidentId: deferredIncidentId,
+                deferredConfiguration: deferredWorkspaceConfiguration,
+                activeIncidentId: activeWorkspaceIncidentId
+              }) || currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN) {
+                return;
+              }
+              ws.close(1012, "Timed out waiting for deferred workspace configuration refresh");
+            }, WORKSPACE_INCIDENT_CONFIG_REFRESH_TIMEOUT_MS);
+            deferredWorkspaceConfigurationRefreshTimer.unref();
           }
-          scheduleAutomaticWorkspaceSync(pendingAutomaticTrigger ?? { type: "periodic", detail: "resume after workspace incident" }, 0);
+          return;
         }
         return;
       }
@@ -5620,7 +5659,12 @@ async function startWorker(options) {
                 if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
               });
             }
-            await runWorkspaceCommand(message.target, workspaceSyncSingleFlight, runCommand);
+            await runReservedWorkspaceCommand(message.target, workspaceSyncSingleFlight, runCommand, () => {
+              if (targetReserved) {
+                workspaceSyncPriorityProcessTargets.delete(message.runId);
+                targetReserved = false;
+              }
+            });
           } finally {
             if (targetReserved) workspaceSyncPriorityProcessTargets.delete(message.runId);
           }
@@ -5694,7 +5738,7 @@ async function startWorker(options) {
         } finally {
           if (reservesVisibleWorkspace) {
             workspaceSyncPriorityOperationTargets.delete(message.requestId);
-            if (pendingAutomaticTrigger && !activeWorkspaceIncidentId && !deferredWorkspaceConfiguration) {
+            if (pendingAutomaticTrigger && automaticWorkspaceSyncIsCurrentlyAdmitted()) {
               scheduleAutomaticWorkspaceSync(pendingAutomaticTrigger, dirtyTrigger ? WORKSPACE_GIT_QUIET_MS : 0);
             }
           }

package/dist/mjs/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.83",
+  "version": "0.0.86",
   "type": "module"
 }

package/dist/mjs/workspace-automatic-sync-policy.mjs

@@ -15,6 +15,12 @@ function projectBranchHasActiveWorkspaceTarget(projectId, branchName, activeTarg
   }
   return false;
 }
+function projectBranchMountBusyDuringExclusiveSync(input) {
+  return input.executionDisabled || input.worktreeOperationInProgress || input.retainedCanonicalProcessGroup || projectBranchHasActiveWorkspaceTarget(input.projectId, input.branchName, input.activeTargets);
+}
+function workspacePlansMountBusyDuringExclusiveSync(activeTargets, retainedCanonicalProcessGroup = false) {
+  return retainedCanonicalProcessGroup || hasActiveVisibleProjectsWorkspaceTarget(activeTargets);
+}
 function shouldDeferAutomaticWorkspaceSyncForPendingBranch(pendingCreatedBranches, activeTargets) {
   if (pendingCreatedBranches.length === 0) return false;
   const targets = [...activeTargets];
@@ -36,5 +42,7 @@ export {
   pendingCreatedBranchAutomaticSyncDeferral,
   pendingCreatedBranchKey,
   projectBranchHasActiveWorkspaceTarget,
-  shouldDeferAutomaticWorkspaceSyncForPendingBranch
+  projectBranchMountBusyDuringExclusiveSync,
+  shouldDeferAutomaticWorkspaceSyncForPendingBranch,
+  workspacePlansMountBusyDuringExclusiveSync
 };

package/dist/mjs/workspace-command-sync-policy.mjs

@@ -20,12 +20,32 @@ function shouldSerializeWorkspaceCommand(target) {
 function runWorkspaceCommand(target, coordinator, operation) {
   return shouldSerializeWorkspaceCommand(target) ? coordinator.runMutation(operation) : Promise.resolve().then(operation);
 }
+async function runReservedWorkspaceCommand(target, coordinator, operation, releaseReservation) {
+  let released = false;
+  const releaseOnce = () => {
+    if (released) return;
+    released = true;
+    releaseReservation();
+  };
+  try {
+    return await runWorkspaceCommand(target, coordinator, async () => {
+      try {
+        return await operation();
+      } finally {
+        releaseOnce();
+      }
+    });
+  } finally {
+    releaseOnce();
+  }
+}
 function acquireWorkspaceCommandMutation(target, coordinator) {
   return shouldSerializeWorkspaceCommand(target) ? coordinator.acquireMutation() : Promise.resolve(void 0);
 }
 export {
   acquireWorkspaceCommandMutation,
   reserveWorkspaceCommandAfterCurrentSync,
+  runReservedWorkspaceCommand,
   runWorkspaceCommand,
   shouldSerializeWorkspaceCommand
 };

package/dist/mjs/workspace-git-sync.mjs

@@ -15,6 +15,9 @@ const WORKSPACE_GIT_INTEGRATED_REF = "refs/r5d/workspace-local/integrated";
 const WORKSPACE_GIT_HYDRATED_RECEIPT = "r5d/workspace-hydrated-head";
 const WORKSPACE_GIT_HYDRATION_TRANSACTION = "r5d/workspace-hydration-transaction";
 const WORKSPACE_GIT_CHECKOUT_DURABILITY = "r5d/workspace-checkout-durability";
+function workspaceGitMountsForRemediation(mounts) {
+  return mounts.map((mount) => ({ ...mount, busy: mount.busyForRecovery ?? mount.busy }));
+}
 class WorkspaceRemediationAncestryError extends Error {
   constructor(message) {
     super(message);
@@ -1299,6 +1302,9 @@ function resetWorkspaceGit(input) {
     const outerPath = path.join(workspacePath, ...mount.workspaceRelativePath.replace(/\\/g, "/").split("/"));
     return fs.existsSync(outerPath);
   });
+  const bootstrapMountIds = new Set(bootstrapMounts.map(({ id }) => id));
+  const durablyAbsentMounts = selected.skipped.filter((mount) => !bootstrapMountIds.has(mount.id) && mount.sourceMode === "all");
+  const uncoveredSkippedMounts = selected.skipped.filter((mount) => !bootstrapMountIds.has(mount.id) && mount.sourceMode !== "all");
   const hydrationMounts = [...selected.active, ...bootstrapMounts];
   const requiredLiveMounts = [
     ...new Map([...requiredLiveMountsBeforeHydration, ...bootstrapMounts].map((mount) => [mount.id, mount])).values()
@@ -1306,7 +1312,7 @@ function resetWorkspaceGit(input) {
   const hydration = hydrateWorkspaceGitMountsTransactionally({
     workspacePath,
     mounts: hydrationMounts,
-    durabilityMounts: [...requiredLiveMounts, ...selected.tombstones],
+    durabilityMounts: [...requiredLiveMounts, ...selected.tombstones, ...durablyAbsentMounts],
     receiptMounts: input.mounts,
     requiredMounts: requiredLiveMounts,
     recordCurrentHead: true
@@ -1322,7 +1328,7 @@ function resetWorkspaceGit(input) {
     remoteHead,
     discardedPaths,
     activeMountIds: hydration.hydratedMountIds,
-    skippedMountIds: [.../* @__PURE__ */ new Set([...selected.skipped.map(({ id }) => id), ...hydration.skippedMountIds])].sort()
+    skippedMountIds: [.../* @__PURE__ */ new Set([...uncoveredSkippedMounts.map(({ id }) => id), ...hydration.skippedMountIds])].sort()
   };
 }
 function stagedPaths(workspacePath) {
@@ -1837,5 +1843,6 @@ export {
   resetWorkspaceGit,
   synchronizeWorkspaceGit,
   workspaceGitHydrationIsCurrent,
+  workspaceGitMountsForRemediation,
   workspaceGitSyncTestHarness
 };

package/dist/types/main.d.ts

@@ -91,6 +91,7 @@ type WorkerServerMessage = {
     gitIdentity: WorkerGitIdentity;
     githubCredential: WorkerGitHubCredential | null;
     deferWorkspaceSyncForIncidentId?: string;
+    resetToCanonical?: boolean;
 } | {
     type: "sync_workspace";
     requestId: string;
@@ -565,8 +566,20 @@ type DeferredWorkspaceConfiguration = {
 };
 declare function workspaceIncidentTerminalClearDisposition(input: {
     deferredConfiguration: DeferredWorkspaceConfiguration | null;
-    clearedIncidentId: string | null;
-}): "ordinary_resume" | "await_server_refresh" | "reconnect_for_refresh";
+    clearedIncidentId: string;
+}): "await_server_refresh" | "reconnect_for_refresh";
+declare function workspaceIncidentTerminalRefreshFence(input: {
+    deferredConfiguration: DeferredWorkspaceConfiguration | null;
+    clearedIncidentId: string;
+}): {
+    disposition: "await_server_refresh" | "reconnect_for_refresh";
+    deferredConfiguration: DeferredWorkspaceConfiguration;
+};
+declare function workspaceAutomaticSyncIsAdmitted(input: {
+    workspaceConfigured: boolean;
+    activeIncidentId: string | null;
+    deferredConfiguration: DeferredWorkspaceConfiguration | null;
+}): boolean;
 declare function deferredWorkspaceTargetIsAllowed(deferredConfiguration: DeferredWorkspaceConfiguration | null, activeIncidentId: string | null, target: WorkerSessionTarget): boolean;
 declare function deferredWorkspaceSyncTriggerIsAllowed(deferredConfiguration: DeferredWorkspaceConfiguration | null, activeIncidentId: string | null, trigger: WorkspaceSyncTrigger): boolean;
 declare function workspaceOperationsAreFenced(deferredConfiguration: DeferredWorkspaceConfiguration | null, activeIncidentId: string | null): boolean;
@@ -577,6 +590,7 @@ declare function deferredCredentialTransitionMustWait(input: {
     canonicalRemediationActive: boolean;
 }): boolean;
 declare function workspaceConfigurationIncidentSnapshotIsCurrent(capturedIncidentId: string | null, activeIncidentId: string | null): boolean;
+declare function workspaceConfigurationResetToCanonicalIsAllowed(requested: boolean | undefined, incidentId: string | null): boolean;
 declare function deferredWorkspaceRefreshWatchdogIsCurrent(input: {
     capturedIncidentId: string;
     deferredConfiguration: DeferredWorkspaceConfiguration | null;
@@ -629,12 +643,15 @@ export declare const workerGitSecurityTestHarness: {
     fenceUnsafeWorkspaceSyncFailure: typeof fenceUnsafeWorkspaceSyncFailure;
     workspaceConfigurationIncidentDeferral: typeof workspaceConfigurationIncidentDeferral;
     workspaceIncidentTerminalClearDisposition: typeof workspaceIncidentTerminalClearDisposition;
+    workspaceIncidentTerminalRefreshFence: typeof workspaceIncidentTerminalRefreshFence;
+    workspaceAutomaticSyncIsAdmitted: typeof workspaceAutomaticSyncIsAdmitted;
     deferredWorkspaceTargetIsAllowed: typeof deferredWorkspaceTargetIsAllowed;
     deferredWorkspaceSyncTriggerIsAllowed: typeof deferredWorkspaceSyncTriggerIsAllowed;
     workspaceOperationsAreFenced: typeof workspaceOperationsAreFenced;
     workspaceCommandTransportIsAllowed: typeof workspaceCommandTransportIsAllowed;
     deferredCredentialTransitionMustWait: typeof deferredCredentialTransitionMustWait;
     workspaceConfigurationIncidentSnapshotIsCurrent: typeof workspaceConfigurationIncidentSnapshotIsCurrent;
+    workspaceConfigurationResetToCanonicalIsAllowed: typeof workspaceConfigurationResetToCanonicalIsAllowed;
     deferredWorkspaceRefreshWatchdogIsCurrent: typeof deferredWorkspaceRefreshWatchdogIsCurrent;
     incidentDeferredProjectCheckouts: typeof incidentDeferredProjectCheckouts;
     deferredIncidentWorkspaceConfigurationResult: typeof deferredIncidentWorkspaceConfigurationResult;

package/dist/types/workspace-automatic-sync-policy.d.ts

@@ -21,6 +21,23 @@ export type PendingCreatedBranchAutomaticSyncDeferral = {
 export declare function pendingCreatedBranchKey(projectId: string, branchName: string): string;
 export declare function hasActiveVisibleProjectsWorkspaceTarget(activeTargets: Iterable<ProjectTarget | WorkspaceTarget>): boolean;
 export declare function projectBranchHasActiveWorkspaceTarget(projectId: string, branchName: string, activeTargets: Iterable<ProjectTarget | WorkspaceTarget>): boolean;
+/**
+ * Activity fence evaluated from inside the workspace mutation gate's exclusive
+ * sync lease. Canonical-sync targets are deliberately absent: an immediately
+ * reserved follow-up remediation command may already be queued, but the gate
+ * proves that it cannot overlap this sync. A credential-bearing process group
+ * that survived command teardown is tracked separately and still fails closed.
+ */
+export declare function projectBranchMountBusyDuringExclusiveSync(input: {
+    projectId: string;
+    branchName: string;
+    executionDisabled: boolean;
+    worktreeOperationInProgress: boolean;
+    retainedCanonicalProcessGroup: boolean;
+    activeTargets: Iterable<ProjectTarget | WorkspaceTarget>;
+}): boolean;
+/** Fence visible activity and any retained canonical descendant that outlived its command lease. */
+export declare function workspacePlansMountBusyDuringExclusiveSync(activeTargets: Iterable<ProjectTarget | WorkspaceTarget>, retainedCanonicalProcessGroup?: boolean): boolean;
 /**
  * A workspace sync is global and synchronous enough to monopolize the worker
  * event loop. Keep automatic intent pending while an agent process is active

package/dist/types/workspace-command-sync-policy.d.ts

@@ -25,5 +25,12 @@ export declare function reserveWorkspaceCommandAfterCurrentSync(target: Workspac
  */
 export declare function shouldSerializeWorkspaceCommand(target: WorkspaceCommandTarget): boolean;
 export declare function runWorkspaceCommand<T>(target: WorkspaceCommandTarget, coordinator: WorkspaceCommandMutationCoordinator, operation: () => Promise<T> | T): Promise<T>;
+/**
+ * Run a command whose target was reserved before asynchronous preparation.
+ * For a serialized canonical command, the reservation must disappear inside
+ * the mutation operation: removing it after `runMutation` resolves is too
+ * late because releasing the lease can synchronously wake a queued sync.
+ */
+export declare function runReservedWorkspaceCommand<T>(target: WorkspaceCommandTarget, coordinator: WorkspaceCommandMutationCoordinator, operation: () => Promise<T> | T, releaseReservation: () => void): Promise<T>;
 export declare function acquireWorkspaceCommandMutation(target: WorkspaceCommandTarget, coordinator: WorkspaceCommandMutationCoordinator): Promise<(() => void) | undefined>;
 export {};

package/dist/types/workspace-git-sync.d.ts

@@ -34,6 +34,14 @@ export type WorkspaceGitMount = {
     /** Activity-only fence used before checkout readiness is established on reconnect. */
     busyForRecovery?: () => boolean;
 };
+/**
+ * Incident-bound configuration keeps project checkouts unready while the
+ * canonical remediation owns the workspace. The guarded remediation sync is
+ * nevertheless allowed to hydrate an existing checkout when its activity-only
+ * fence is clear; the ordinary `busy` predicate would mistake that deliberate
+ * unready state for concurrent visible work.
+ */
+export declare function workspaceGitMountsForRemediation(mounts: readonly WorkspaceGitMount[]): WorkspaceGitMount[];
 export type WorkspaceGitSyncOutcome = "no_change" | "updated" | "pushed" | "large_diff_blocked" | "conflict_blocked";
 export type WorkspaceGitSyncResult = {
     outcome: WorkspaceGitSyncOutcome;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricsam/r5d-worker",
-  "version": "0.0.83",
+  "version": "0.0.86",
   "type": "module",
   "main": "./dist/cjs/main.cjs",
   "module": "./dist/mjs/main.mjs",