@ricsam/r5d-worker 0.0.83 → 0.0.87

package/dist/mjs/main.mjs

@@ -28,11 +28,14 @@ import {
   PENDING_CREATED_BRANCH_AUTOMATIC_SYNC_GRACE_MS,
   pendingCreatedBranchAutomaticSyncDeferral,
   pendingCreatedBranchKey,
-  projectBranchHasActiveWorkspaceTarget
+  projectBranchHasActiveWorkspaceTarget,
+  projectBranchMountBusyDuringExclusiveSync,
+  workspacePlansMountBusyDuringExclusiveSync
 } from "./workspace-automatic-sync-policy.mjs";
 import {
   acquireWorkspaceCommandMutation,
   reserveWorkspaceCommandAfterCurrentSync,
+  runReservedWorkspaceCommand,
   runWorkspaceCommand
 } from "./workspace-command-sync-policy.mjs";
 import { WorkspaceMutationGate } from "./workspace-mutation-gate.mjs";
@@ -86,6 +89,7 @@ import {
   resetWorkspaceGit,
   synchronizeWorkspaceGit,
   workspaceGitHydrationIsCurrent,
+  workspaceGitMountsForRemediation,
   WorkspaceRemediationAncestryError
 } from "./workspace-git-sync.mjs";
 class ProjectWorkspaceConfigurationDeferredError extends Error {
@@ -843,6 +847,33 @@ function tryGit(args, options = {}) {
     return false;
   }
 }
+async function runGitAsync(args, options = {}) {
+  const command = workerGitCommand.commandArgs(args);
+  const subprocess = Bun.spawn(command, {
+    cwd: options.cwd,
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+    env: workerGitProcessEnvironment()
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(subprocess.stdout).text(),
+    new Response(subprocess.stderr).text(),
+    subprocess.exited
+  ]);
+  if (exitCode !== 0) {
+    throw new Error(`git ${args.join(" ")} failed: ${stderr.trim() || stdout.trim() || `exit ${exitCode}`}`);
+  }
+  return stdout.trim();
+}
+async function tryGitAsync(args, options = {}) {
+  try {
+    await runGitAsync(args, options);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function getGitBlobHashForContent(content) {
   const buffer = typeof content === "string" ? Buffer.from(content, "utf8") : content;
   return createHash("sha1").update(`blob ${buffer.length}\0`).update(buffer).digest("hex");
@@ -1539,10 +1570,20 @@ function workspaceConfigurationIncidentDeferral(input) {
   return { incidentId };
 }
 function workspaceIncidentTerminalClearDisposition(input) {
-  if (!input.deferredConfiguration) return "ordinary_resume";
-  void input.clearedIncidentId;
+  if (!input.deferredConfiguration) return "await_server_refresh";
+  if (input.deferredConfiguration.incidentId !== input.clearedIncidentId) return "reconnect_for_refresh";
   return input.deferredConfiguration.serverRefreshExpected ? "await_server_refresh" : "reconnect_for_refresh";
 }
+function workspaceIncidentTerminalRefreshFence(input) {
+  const disposition = workspaceIncidentTerminalClearDisposition(input);
+  return {
+    disposition,
+    deferredConfiguration: input.deferredConfiguration ?? { incidentId: input.clearedIncidentId, serverRefreshExpected: true }
+  };
+}
+function workspaceAutomaticSyncIsAdmitted(input) {
+  return input.workspaceConfigured && input.activeIncidentId === null && input.deferredConfiguration === null;
+}
 function deferredWorkspaceTargetIsAllowed(deferredConfiguration, activeIncidentId, target) {
   const canonicalTarget = target.type === "workspace" && target.rootProfile === "canonical_sync";
   if (deferredConfiguration) return activeIncidentId === deferredConfiguration.incidentId && canonicalTarget;
@@ -1564,6 +1605,9 @@ function deferredCredentialTransitionMustWait(input) {
 function workspaceConfigurationIncidentSnapshotIsCurrent(capturedIncidentId, activeIncidentId) {
   return capturedIncidentId === null ? activeIncidentId === null : activeIncidentId === null || activeIncidentId === capturedIncidentId;
 }
+function workspaceConfigurationResetToCanonicalIsAllowed(requested, incidentId) {
+  return requested === true && incidentId === null;
+}
 function deferredWorkspaceRefreshWatchdogIsCurrent(input) {
   return input.deferredConfiguration?.incidentId === input.capturedIncidentId && input.activeIncidentId === null;
 }
@@ -1636,12 +1680,15 @@ const workerGitSecurityTestHarness = {
   fenceUnsafeWorkspaceSyncFailure,
   workspaceConfigurationIncidentDeferral,
   workspaceIncidentTerminalClearDisposition,
+  workspaceIncidentTerminalRefreshFence,
+  workspaceAutomaticSyncIsAdmitted,
   deferredWorkspaceTargetIsAllowed,
   deferredWorkspaceSyncTriggerIsAllowed,
   workspaceOperationsAreFenced,
   workspaceCommandTransportIsAllowed,
   deferredCredentialTransitionMustWait,
   workspaceConfigurationIncidentSnapshotIsCurrent,
+  workspaceConfigurationResetToCanonicalIsAllowed,
   deferredWorkspaceRefreshWatchdogIsCurrent,
   incidentDeferredProjectCheckouts,
   deferredIncidentWorkspaceConfigurationResult,
@@ -3402,6 +3449,11 @@ async function startWorker(options) {
   let cliUpdateInProgress = false;
   let reloadAfterClose = false;
   let shutdownAfterClose = false;
+  const automaticWorkspaceSyncIsCurrentlyAdmitted = () => workspaceAutomaticSyncIsAdmitted({
+    workspaceConfigured,
+    activeIncidentId: activeWorkspaceIncidentId,
+    deferredConfiguration: deferredWorkspaceConfiguration
+  });
   const bearerAuthHeader = `Authorization: Bearer ${token}`;
   const workerCredentialUsername = credentialUsernameForAuthHeader(bearerAuthHeader);
   const projectBranchKey = (projectId, branchName) => `${projectId}\0${branchName}`;
@@ -3683,6 +3735,17 @@ async function startWorker(options) {
     const activeTargets = activeWorkspaceMutationTargets();
     return projectConfigById.get(projectId)?.executionDisabled === true || hasProjectWorktree(branchPath) && projectWorktreeOperationInProgress(branchPath) || canonicalWorkspaceMutationIsActive(activeTargets) || projectBranchHasActiveWorkspaceTarget(projectId, branchName, activeTargets);
   };
+  const projectBranchMountExclusiveSyncBusy = (projectId, branchName, branchPath) => {
+    const activeTargets = activeWorkspaceMutationTargets();
+    return projectBranchMountBusyDuringExclusiveSync({
+      projectId,
+      branchName,
+      executionDisabled: projectConfigById.get(projectId)?.executionDisabled === true,
+      worktreeOperationInProgress: hasProjectWorktree(branchPath) && projectWorktreeOperationInProgress(branchPath),
+      retainedCanonicalProcessGroup: canonicalWorkspaceMutationIsActive([...credentialBearingProcessGroupTargets.values()]),
+      activeTargets
+    });
+  };
   const projectBranchMountBusy = (projectId, branchName, branchPath) => !readyProjectIds.has(projectId) || projectBranchMountActivityBusy(projectId, branchName, branchPath);
   const buildWorkspaceMounts = (projects = projectConfigById.values()) => {
     const mounts = [];
@@ -3715,7 +3778,7 @@ async function startWorker(options) {
           preserveLocalOnHydrationBasisChange: preservesCheckoutPathMove,
           busy: () => projectBranchMountBusy(project.projectId, branch.branchName, branchPath),
           mutationToken: () => projectWorkspaceMutationToken(project.projectId, branch.branchName),
-          busyForRecovery: () => projectBranchMountActivityBusy(project.projectId, branch.branchName, branchPath)
+          busyForRecovery: () => projectBranchMountExclusiveSyncBusy(project.projectId, branch.branchName, branchPath)
         });
         mounts.push({
           id: projectPlanMountId(project.projectId, branch.branchName),
@@ -3729,7 +3792,7 @@ async function startWorker(options) {
           preserveLocalOnHydrationBasisChange: preservesCheckoutPathMove,
           busy: () => projectBranchMountBusy(project.projectId, branch.branchName, branchPath),
           mutationToken: () => projectWorkspaceMutationToken(project.projectId, branch.branchName),
-          busyForRecovery: () => projectBranchMountActivityBusy(project.projectId, branch.branchName, branchPath)
+          busyForRecovery: () => projectBranchMountExclusiveSyncBusy(project.projectId, branch.branchName, branchPath)
         });
       }
       void projectRoot;
@@ -3752,7 +3815,10 @@ async function startWorker(options) {
       mutationToken: () => String(visibleWorkspaceMutationEpoch),
       busyForRecovery: () => {
         const activeTargets = activeWorkspaceMutationTargets();
-        return canonicalWorkspaceMutationIsActive(activeTargets) || hasActiveVisibleProjectsWorkspaceTarget(activeTargets);
+        return workspacePlansMountBusyDuringExclusiveSync(
+          activeTargets,
+          canonicalWorkspaceMutationIsActive([...credentialBearingProcessGroupTargets.values()])
+        );
       }
     });
     for (const deletion of pendingMirrorDeletes.values()) {
@@ -3779,10 +3845,14 @@ async function startWorker(options) {
     }
     return mounts;
   };
-  const workspaceLocalHead = () => fs.existsSync(path.join(workspaceShadowRoot, ".git")) && tryGit(["rev-parse", "--verify", "HEAD"], { cwd: workspaceShadowRoot }) ? runGit(["rev-parse", "HEAD"], { cwd: workspaceShadowRoot }) : null;
-  const workspaceGitStatus = () => {
+  const workspaceLocalHead = async () => {
+    if (!fs.existsSync(path.join(workspaceShadowRoot, ".git"))) return null;
+    if (!await tryGitAsync(["rev-parse", "--verify", "HEAD"], { cwd: workspaceShadowRoot })) return null;
+    return runGitAsync(["rev-parse", "HEAD"], { cwd: workspaceShadowRoot });
+  };
+  const workspaceGitStatus = async () => {
     try {
-      return runGit(["status", "--porcelain"], { cwd: workspaceShadowRoot });
+      return await runGitAsync(["status", "--porcelain"], { cwd: workspaceShadowRoot });
     } catch {
       return "";
     }
@@ -3795,7 +3865,7 @@ async function startWorker(options) {
       })
     )
   ].sort();
-  const ensureConfiguredProjects = () => {
+  const ensureConfiguredProjects = async () => {
     for (const project of projectConfigById.values()) {
       validateProjectId(project.projectId);
       assertRepositoryTransitionState(project);
@@ -3832,7 +3902,7 @@ async function startWorker(options) {
       }
       try {
         const connection = projectConnection(project);
-        const states = ensureProjectWorktrees({
+        const states = await ensureProjectWorktrees({
           projectRoot,
           snapshotRoot: projectWorktreeSnapshotsRoot,
           primaryBranchName: primaryProjectBranch(project),
@@ -3881,13 +3951,13 @@ async function startWorker(options) {
       }
     }
   };
-  const collectAheadOfOriginBranches = () => {
+  const collectAheadOfOriginBranches = async () => {
     const aheadBranches = [];
     for (const project of projectConfigById.values()) {
       if (project.executionDisabled || !readyProjectIds.has(project.projectId) || project.branches.length === 0) continue;
       const connection = projectConnection(project);
       const primaryPath = configuredProjectBranchPath(projectsRoot, project, primaryProjectBranch(project));
-      if (!tryGit(
+      if (!await tryGitAsync(
         [
           ...gitTransportSecurityArgs(connection.originUrl, connection.credentialHelper, connection.originCredentialUsername),
           "fetch",
@@ -3911,11 +3981,11 @@ async function startWorker(options) {
             primaryBranchName: primaryProjectBranch(project),
             defaultBranch: project.defaultBranch
           })}`;
-          if (tryGit(["show-ref", "--verify", "--quiet", originRef], { cwd: branchPath })) {
-            const counts = runGit(["rev-list", "--left-right", "--count", `${originRef}...HEAD`], { cwd: branchPath }).split(/\s+/).map(Number);
+          if (await tryGitAsync(["show-ref", "--verify", "--quiet", originRef], { cwd: branchPath })) {
+            const counts = (await runGitAsync(["rev-list", "--left-right", "--count", `${originRef}...HEAD`], { cwd: branchPath })).split(/\s+/).map(Number);
             ahead = Number.isSafeInteger(counts[1]) ? counts[1] : 0;
-          } else if (tryGit(["cat-file", "-e", `${branch.baseCommitHash}^{commit}`], { cwd: branchPath })) {
-            const count = Number(runGit(["rev-list", "--count", `${branch.baseCommitHash}..HEAD`], { cwd: branchPath }));
+          } else if (await tryGitAsync(["cat-file", "-e", `${branch.baseCommitHash}^{commit}`], { cwd: branchPath })) {
+            const count = Number(await runGitAsync(["rev-list", "--count", `${branch.baseCommitHash}..HEAD`], { cwd: branchPath }));
             ahead = Number.isSafeInteger(count) ? count : 0;
           }
           if (ahead > 0) aheadBranches.push({ projectId: project.projectId, branchName: branch.branchName, ahead });
@@ -3931,19 +4001,19 @@ async function startWorker(options) {
       (left, right) => left.projectId.localeCompare(right.projectId) || left.branchName.localeCompare(right.branchName)
     );
   };
-  const captureProjectHeadsForWorkspacePublication = () => {
+  const captureProjectHeadsForWorkspacePublication = async () => {
     const heads = /* @__PURE__ */ new Map();
     for (const project of projectConfigById.values()) {
       if (!readyProjectIds.has(project.projectId)) continue;
       for (const branch of project.branches) {
         const branchPath = configuredProjectBranchPath(projectsRoot, project, branch.branchName);
         if (!hasProjectWorktree(branchPath)) continue;
-        heads.set(projectMountId(project.projectId, branch.branchName), runGit(["rev-parse", "HEAD"], { cwd: branchPath }));
+        heads.set(projectMountId(project.projectId, branch.branchName), await runGitAsync(["rev-parse", "HEAD"], { cwd: branchPath }));
       }
     }
     return heads;
   };
-  const pushChangedProjectHeads = (activeMountIds, publishedHead, publicationHeads, suppressedMountIds = /* @__PURE__ */ new Set()) => {
+  const pushChangedProjectHeads = async (activeMountIds, publishedHead, publicationHeads, suppressedMountIds = /* @__PURE__ */ new Set()) => {
     const active = new Set(activeMountIds);
     for (const project of projectConfigById.values()) {
       if (!readyProjectIds.has(project.projectId) || !repositoryMirrorWritesAllowed(project)) continue;
@@ -3959,7 +4029,7 @@ async function startWorker(options) {
       }
       if (changed.size === 0) continue;
       const connection = projectConnection(project);
-      const results = pushProjectMirrorHeads({
+      const results = await pushProjectMirrorHeads({
         projectRoot: configuredProjectRoot(projectsRoot, project),
         branchNames: project.branches.map(({ branchName }) => branchName),
         mirrorUrl: connection.mirrorUrl,
@@ -3990,7 +4060,7 @@ async function startWorker(options) {
       if (!active.has(deletion.id)) continue;
       if (!repositoryMirrorWritesAllowed(projectConfigById.get(deletion.projectId))) continue;
       if (!deletion.projectDeleted) {
-        deleteProjectMirrorBranch({
+        await deleteProjectMirrorBranch({
           gitDirectory: deletion.gitDirectory,
           branchName: deletion.branchName,
           mirrorUrl: deletion.mirrorUrl,
@@ -4011,7 +4081,7 @@ async function startWorker(options) {
       lastObservedProjectHeads.delete(key);
     }
   };
-  const observeProjectHeadsBeforeOuterWorkspace = (input) => {
+  const observeProjectHeadsBeforeOuterWorkspace = async (input) => {
     const bundles = [];
     for (const project of projectConfigById.values()) {
       if (project.executionDisabled || !readyProjectIds.has(project.projectId) || project.branches.length === 0) continue;
@@ -4023,7 +4093,7 @@ async function startWorker(options) {
           projectId: project.projectId,
           projectRoot,
           primaryBranchName,
-          observations: observeProjectMirrorHeads({
+          observations: await observeProjectMirrorHeads({
             projectRoot,
             primaryBranchName,
             branchNames: project.branches.map(({ branchName }) => branchName),
@@ -4043,7 +4113,7 @@ async function startWorker(options) {
     }
     return bundles;
   };
-  const applyObservedProjectHeadsAfterInboundWorkspace = (bundles, activeMountIds, requireObservedHeads) => {
+  const applyObservedProjectHeadsAfterInboundWorkspace = async (bundles, activeMountIds, requireObservedHeads) => {
     const active = new Set(activeMountIds);
     for (const bundle of bundles) {
       const project = projectConfigById.get(bundle.projectId);
@@ -4051,7 +4121,7 @@ async function startWorker(options) {
       const observations = bundle.observations.filter(({ branchName }) => active.has(projectMountId(project.projectId, branchName)));
       if (observations.length === 0) continue;
       try {
-        const refreshed = applyObservedProjectMirrorHeads({
+        const refreshed = await applyObservedProjectMirrorHeads({
           projectRoot: bundle.projectRoot,
           primaryBranchName: bundle.primaryBranchName,
           observations,
@@ -4061,7 +4131,7 @@ async function startWorker(options) {
           for (const observation of observations) {
             if (!observation.shouldMove || !observation.mirrorHead) continue;
             const checkoutPath = configuredProjectBranchPath(projectsRoot, project, observation.branchName);
-            const currentHead = runGit(["rev-parse", "HEAD"], { cwd: checkoutPath });
+            const currentHead = await runGitAsync(["rev-parse", "HEAD"], { cwd: checkoutPath });
             if (currentHead !== observation.mirrorHead) {
               throw new Error(
                 `Project ${project.projectId}/${observation.branchName} did not apply observed hidden mirror head ${observation.mirrorHead}`
@@ -4084,7 +4154,7 @@ async function startWorker(options) {
       }
     }
   };
-  const mapWorkspaceGitResult = (attemptId, trigger, result) => {
+  const mapWorkspaceGitResult = async (attemptId, trigger, result) => {
     const activeProjectBranchPublications = activeProjectBranchPublicationEvidence([...projectConfigById.values()], result.activeMountIds);
     return {
       type: "workspace_sync",
@@ -4097,7 +4167,7 @@ async function startWorker(options) {
       ...result.publishedHead ? { publishedHead: result.publishedHead } : {},
       rebaseCount: result.rebaseCount,
       diffSizeBytes: result.diffSizeBytes,
-      gitStatus: workspaceGitStatus(),
+      gitStatus: await workspaceGitStatus(),
       affectedProjects: affectedProjects(result.affectedPaths),
       affectedPaths: result.affectedPaths,
       activeMountIds: result.activeMountIds,
@@ -4112,48 +4182,51 @@ async function startWorker(options) {
       ...result.error ? { error: result.error } : {}
     };
   };
-  const failedWorkspaceSyncResult = (attemptId, trigger, error) => ({
-    type: "workspace_sync",
-    attemptId,
-    workerLabel: label,
-    trigger,
-    outcome: "failed",
-    startingHead: workspaceLocalHead(),
-    ...workspaceLocalHead() ? { localHead: workspaceLocalHead() } : {},
-    rebaseCount: 0,
-    diffSizeBytes: 0,
-    gitStatus: workspaceGitStatus(),
-    affectedProjects: [],
-    affectedPaths: [],
-    discardedPaths: [],
-    localChangesDiscarded: false,
-    error: error instanceof Error ? error.message : String(error)
-  });
+  const failedWorkspaceSyncResult = async (attemptId, trigger, error) => {
+    const localHead = await workspaceLocalHead();
+    return {
+      type: "workspace_sync",
+      attemptId,
+      workerLabel: label,
+      trigger,
+      outcome: "failed",
+      startingHead: localHead,
+      ...localHead ? { localHead } : {},
+      rebaseCount: 0,
+      diffSizeBytes: 0,
+      gitStatus: await workspaceGitStatus(),
+      affectedProjects: [],
+      affectedPaths: [],
+      discardedPaths: [],
+      localChangesDiscarded: false,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  };
   const performWorkspaceSync = async (input) => {
     if (!workspaceRemoteUrl || !workspaceCredentialHelper || !workspaceCredentialUsername || !workspaceGitIdentity) {
       throw new Error("Worker workspace configuration has not been received");
     }
-    const mounts = buildWorkspaceMounts();
+    const configuredMounts = buildWorkspaceMounts();
     if (input.resetToCanonical) {
-      const resetHasBusyLiveMount = mounts.some(
+      const resetHasBusyLiveMount = configuredMounts.some(
         (mount) => !(mount.deleteWhenSourceMissing && !fs.existsSync(mount.sourcePath)) && mount.busy?.()
       );
       if (resetHasBusyLiveMount) {
         throw new Error("Workspace reset cannot observe project mirror heads while a live mount is busy; remediation remains active");
       }
-      const observedProjectHeads2 = observeProjectHeadsBeforeOuterWorkspace({
+      const observedProjectHeads2 = await observeProjectHeadsBeforeOuterWorkspace({
         allowNonFastForward: true,
         failClosed: true
       });
-      const reset = resetWorkspaceGit({
+      const reset = await resetWorkspaceGit({
         workspacePath: workspaceShadowRoot,
         remoteUrl: workspaceRemoteUrl,
         credentialHelper: workspaceCredentialHelper,
         credentialUsername: workspaceCredentialUsername,
         gitIdentity: workspaceGitIdentity,
-        mounts
+        mounts: configuredMounts
       });
-      applyObservedProjectHeadsAfterInboundWorkspace(observedProjectHeads2, reset.activeMountIds, true);
+      await applyObservedProjectHeadsAfterInboundWorkspace(observedProjectHeads2, reset.activeMountIds, true);
       return {
         type: "workspace_sync",
         attemptId: input.attemptId,
@@ -4165,7 +4238,7 @@ async function startWorker(options) {
         ...reset.remoteHead ? { publishedHead: reset.remoteHead } : {},
         rebaseCount: 0,
         diffSizeBytes: 0,
-        gitStatus: workspaceGitStatus(),
+        gitStatus: await workspaceGitStatus(),
         affectedProjects: affectedProjects(reset.discardedPaths),
         affectedPaths: reset.discardedPaths,
         activeMountIds: reset.activeMountIds,
@@ -4175,13 +4248,14 @@ async function startWorker(options) {
       };
     }
     const outerRemediation = input.trigger.type === "remediation" || input.trigger.type === "remediation_confirm";
-    const observedProjectHeads = outerRemediation ? [] : observeProjectHeadsBeforeOuterWorkspace({ allowNonFastForward: false, failClosed: false });
+    const mounts = outerRemediation ? workspaceGitMountsForRemediation(configuredMounts) : configuredMounts;
+    const observedProjectHeads = outerRemediation ? [] : await observeProjectHeadsBeforeOuterWorkspace({ allowNonFastForward: false, failClosed: false });
     const inboundMoveMountIds = new Set(
       observedProjectHeads.flatMap(
         ({ projectId, observations }) => observations.filter(({ shouldMove }) => shouldMove).map(({ branchName }) => projectMountId(projectId, branchName))
       )
     );
-    const publicationHeads = outerRemediation ? /* @__PURE__ */ new Map() : captureProjectHeadsForWorkspacePublication();
+    const publicationHeads = outerRemediation ? /* @__PURE__ */ new Map() : await captureProjectHeadsForWorkspacePublication();
     const result = await synchronizeWorkspaceGit({
       attemptId: input.attemptId,
       workerLabel: label,
@@ -4196,13 +4270,13 @@ async function startWorker(options) {
       skipMountMirror: outerRemediation,
       requiredAncestorHeads: input.requiredAncestorHeads,
       assertStillAdmitted: input.assertStillAdmitted,
-      afterWorkspacePublished: outerRemediation ? void 0 : ({ activeMountIds, publishedHead }) => {
-        pushChangedProjectHeads(activeMountIds, publishedHead, publicationHeads, inboundMoveMountIds);
+      afterWorkspacePublished: outerRemediation ? void 0 : async ({ activeMountIds, publishedHead }) => {
+        await pushChangedProjectHeads(activeMountIds, publishedHead, publicationHeads, inboundMoveMountIds);
       }
     });
     input.assertStillAdmitted?.();
     if (["no_change", "updated", "pushed"].includes(result.outcome) && !outerRemediation) {
-      applyObservedProjectHeadsAfterInboundWorkspace(observedProjectHeads, result.activeMountIds, false);
+      await applyObservedProjectHeadsAfterInboundWorkspace(observedProjectHeads, result.activeMountIds, false);
     }
     return mapWorkspaceGitResult(input.attemptId, input.trigger, result);
   };
@@ -4233,7 +4307,7 @@ async function startWorker(options) {
     };
     if (!deferredWorkspaceSyncTriggerIsAllowed(deferredWorkspaceConfiguration, activeWorkspaceIncidentId, input.trigger)) {
       const result2 = {
-        ...failedWorkspaceSyncResult(
+        ...await failedWorkspaceSyncResult(
           attemptId,
           input.trigger,
           new Error(
@@ -4260,7 +4334,7 @@ async function startWorker(options) {
         queueEnteredAt = Date.now();
         syncStartedAt = Date.now();
         if (!deferredWorkspaceSyncTriggerIsAllowed(deferredWorkspaceConfiguration, activeWorkspaceIncidentId, input.trigger)) {
-          return failedWorkspaceSyncResult(
+          return await failedWorkspaceSyncResult(
             attemptId,
             input.trigger,
             new Error(
@@ -4299,7 +4373,7 @@ async function startWorker(options) {
             },
             exitCode: 1
           });
-          return failedWorkspaceSyncResult(attemptId, input.trigger, error);
+          return await failedWorkspaceSyncResult(attemptId, input.trigger, error);
         }
       });
     } finally {
@@ -4326,7 +4400,7 @@ async function startWorker(options) {
       pendingCreatedBranchPublicationNotBefore
     );
     const initialDeferral = pendingBranchDeferral();
-    if (!workspaceConfigured || activeWorkspaceIncidentId || deferredWorkspaceConfiguration || currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN || automaticSyncInFlight || initialDeferral?.kind === "active_target") {
+    if (!automaticWorkspaceSyncIsCurrentlyAdmitted() || currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN || automaticSyncInFlight || initialDeferral?.kind === "active_target") {
       return;
     }
     if (workspaceAutomaticTimer) clearTimeout(workspaceAutomaticTimer);
@@ -4334,8 +4408,7 @@ async function startWorker(options) {
       () => {
         workspaceAutomaticTimer = void 0;
         const scheduledTrigger = pendingAutomaticTrigger;
-        if (!scheduledTrigger || !workspaceConfigured || activeWorkspaceIncidentId || deferredWorkspaceConfiguration || currentWorkerSocket !== ws)
-          return;
+        if (!scheduledTrigger || !automaticWorkspaceSyncIsCurrentlyAdmitted() || currentWorkerSocket !== ws) return;
         const currentDeferral = pendingBranchDeferral();
         if (currentDeferral?.kind === "active_target") return;
         if (currentDeferral?.kind === "creation_grace") {
@@ -4357,7 +4430,7 @@ async function startWorker(options) {
         }).finally(() => {
           automaticSyncInFlight = false;
           heartbeatBusyGrace = grantWorkerHeartbeatBusyGrace(lastServerHeartbeatAt, heartbeatBusyGrace);
-          if (pendingAutomaticTrigger && !activeWorkspaceIncidentId && !deferredWorkspaceConfiguration) {
+          if (pendingAutomaticTrigger && automaticWorkspaceSyncIsCurrentlyAdmitted()) {
             scheduleAutomaticWorkspaceSync(pendingAutomaticTrigger, WORKSPACE_GIT_QUIET_MS);
           }
         });
@@ -4399,7 +4472,7 @@ async function startWorker(options) {
     if (incidentDeferral.error) {
       workspaceConfigured = false;
       return {
-        result: failedWorkspaceSyncResult(crypto.randomUUID(), { type: "connect" }, incidentDeferral.error),
+        result: await failedWorkspaceSyncResult(crypto.randomUUID(), { type: "connect" }, incidentDeferral.error),
         pending: incidentDeferredProjectCheckouts(message.projects),
         aheadOfOriginBranches: []
       };
@@ -4427,7 +4500,7 @@ async function startWorker(options) {
       canonicalRemediationActive: canonicalWorkspaceMutationIsActive(activeWorkspaceMutationTargets())
     })) {
       return {
-        result: failedWorkspaceSyncResult(
+        result: await failedWorkspaceSyncResult(
           crypto.randomUUID(),
           { type: "connect" },
           new Error("Workspace credential rotation is deferred until the active canonical remediation command finishes")
@@ -4486,7 +4559,7 @@ async function startWorker(options) {
       } catch (error) {
         const wrapped = error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
         return {
-          result: failedWorkspaceSyncResult(crypto.randomUUID(), { type: "connect" }, wrapped),
+          result: await failedWorkspaceSyncResult(crypto.randomUUID(), { type: "connect" }, wrapped),
           pending: [],
           aheadOfOriginBranches: []
         };
@@ -4663,7 +4736,7 @@ async function startWorker(options) {
         }));
         const nextProjectConfigById = new Map(effectiveProjects.map((project) => [project.projectId, project]));
         if (incidentDeferral.incidentId) {
-          configureExistingWorkspaceGitForRemediation({
+          await configureExistingWorkspaceGitForRemediation({
             workspacePath: workspaceShadowRoot,
             remoteUrl: message.workspaceRemoteUrl,
             credentialHelper: nextWorkspaceCredentialHelper,
@@ -4682,7 +4755,7 @@ async function startWorker(options) {
             result: deferredIncidentWorkspaceConfigurationResult({
               attemptId: crypto.randomUUID(),
               workerLabel: label,
-              head: workspaceLocalHead(),
+              head: await workspaceLocalHead(),
               skippedMountIds: buildWorkspaceMounts().map(({ id }) => id)
             }),
             pending: pending2,
@@ -4690,7 +4763,7 @@ async function startWorker(options) {
             deferredWorkspaceSyncForIncidentId: incidentDeferral.incidentId
           };
         }
-        ensureWorkspaceGitClone({
+        await ensureWorkspaceGitClone({
           workspacePath: workspaceShadowRoot,
           remoteUrl: message.workspaceRemoteUrl,
           credentialHelper: nextWorkspaceCredentialHelper,
@@ -4710,7 +4783,7 @@ async function startWorker(options) {
           sourcePath: recoverySourceOverrides.get(mount.id) ?? mount.sourcePath,
           busy: mount.busyForRecovery ?? mount.busy
         }));
-        recoverWorkspaceGitHydration(workspaceShadowRoot, recoveryMounts, { preserveStaleBases: true });
+        await recoverWorkspaceGitHydration(workspaceShadowRoot, recoveryMounts, { preserveStaleBases: true });
         for (const project of message.projects) {
           for (const { branchName } of project.preserveOnlyBranches) {
             if (stillPendingCreatedBranches.has(pendingCreatedBranchKey(project.projectId, branchName))) {
@@ -4747,7 +4820,7 @@ async function startWorker(options) {
         }
         stageDurableWorkspaceDeletions();
         const mountsBeforeGit = buildWorkspaceMounts();
-        hydrateWorkspaceGitMounts(
+        await hydrateWorkspaceGitMounts(
           workspaceShadowRoot,
           mountsBeforeGit.filter((mount) => !mount.deleteWhenSourceMissing && !fs.existsSync(mount.sourcePath) && mount.busy?.() !== true),
           // These mounts are intentionally hydrated before their project Git
@@ -4756,7 +4829,7 @@ async function startWorker(options) {
           // checkout initialization from erasing synchronized dirt.
           { ignoreBusy: true }
         );
-        ensureConfiguredProjects();
+        await ensureConfiguredProjects();
         const configurationSyncAdmissionGeneration = workerAdmissionGeneration;
         const assertConfigurationSyncStillAdmitted = () => {
           if (receiptGeneration !== workspaceConfigurationReceiptGeneration || configurationSyncAdmissionGeneration !== workerAdmissionGeneration || !workspaceConfigurationIncidentSnapshotIsCurrent(incidentDeferral.incidentId, activeWorkspaceIncidentId) || currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN) {
@@ -4766,6 +4839,7 @@ async function startWorker(options) {
         const result = await performWorkspaceSync({
           attemptId: crypto.randomUUID(),
           trigger: { type: "connect" },
+          resetToCanonical: workspaceConfigurationResetToCanonicalIsAllowed(message.resetToCanonical, incidentDeferral.incidentId),
           assertStillAdmitted: assertConfigurationSyncStillAdmitted
         });
         assertConfigurationSyncStillAdmitted();
@@ -4800,12 +4874,12 @@ async function startWorker(options) {
         const pending = [...pendingCheckouts.values()].sort(
           (left, right) => left.projectId.localeCompare(right.projectId) || left.branchName.localeCompare(right.branchName)
         );
-        return { result, pending, aheadOfOriginBranches: collectAheadOfOriginBranches() };
+        return { result, pending, aheadOfOriginBranches: await collectAheadOfOriginBranches() };
       });
     } catch (error) {
       if (receiptGeneration !== workspaceConfigurationReceiptGeneration) {
         return {
-          result: failedWorkspaceSyncResult(crypto.randomUUID(), { type: "connect" }, error),
+          result: await failedWorkspaceSyncResult(crypto.randomUUID(), { type: "connect" }, error),
           pending: incidentDeferredProjectCheckouts(message.projects),
           aheadOfOriginBranches: []
         };
@@ -4837,7 +4911,7 @@ async function startWorker(options) {
         pendingCheckouts.set(projectBranchKey(pending.projectId, pending.branchName), pending);
       }
       return {
-        result: failedWorkspaceSyncResult(crypto.randomUUID(), { type: "connect" }, error),
+        result: await failedWorkspaceSyncResult(crypto.randomUUID(), { type: "connect" }, error),
         pending: [...pendingCheckouts.values()].sort(
           (left, right) => left.projectId.localeCompare(right.projectId) || left.branchName.localeCompare(right.branchName)
         ),
@@ -4864,7 +4938,7 @@ async function startWorker(options) {
       workspaceAutomaticTimer = void 0;
     }
     void (async () => {
-      if (workspaceConfigured && !activeWorkspaceIncidentId && !deferredWorkspaceConfiguration) {
+      if (automaticWorkspaceSyncIsCurrentlyAdmitted()) {
         await runWorkspaceSync({
           trigger: { type: "manual", detail: "graceful worker shutdown" }
         });
@@ -4915,7 +4989,8 @@ async function startWorker(options) {
           execStdinV1: true,
           ptyEnvFilesV1: true,
           workspaceRemediationAncestorGuardV1: true,
-          workspaceIncidentConfigDeferralV1: true
+          workspaceIncidentConfigDeferralV1: true,
+          workspaceConfigResetToCanonicalV1: true
         },
         projectRoot: projectsRoot,
         artifactRoot,
@@ -4979,7 +5054,7 @@ async function startWorker(options) {
           }, WORKSPACE_GIT_PERIODIC_MS);
           workspacePeriodicTimer.unref();
         }
-        if (pendingAutomaticTrigger && !activeWorkspaceIncidentId && !deferredWorkspaceConfiguration) {
+        if (pendingAutomaticTrigger && automaticWorkspaceSyncIsCurrentlyAdmitted()) {
           scheduleAutomaticWorkspaceSync(pendingAutomaticTrigger, 0);
         }
         return;
@@ -5219,35 +5294,33 @@ async function startWorker(options) {
         if (nextIncidentId !== previousIncidentId) advanceWorkerAdmissionGeneration();
         activeWorkspaceIncidentId = nextIncidentId;
         if (previousIncidentId && !activeWorkspaceIncidentId && (message.status === "resolved" || message.status === "confirmed" || message.status === "reset")) {
-          const disposition = workspaceIncidentTerminalClearDisposition({
+          const refresh = workspaceIncidentTerminalRefreshFence({
             deferredConfiguration: deferredWorkspaceConfiguration,
             clearedIncidentId: previousIncidentId
           });
-          if (disposition !== "ordinary_resume") {
-            pendingAutomaticTrigger ??= { type: "periodic", detail: "resume after workspace incident" };
-            workspaceConfigured = false;
-            advanceWorkerAdmissionGeneration();
-            if (disposition === "reconnect_for_refresh") {
-              ws.close(1012, "Refreshing deferred workspace configuration");
-            } else {
-              if (deferredWorkspaceConfigurationRefreshTimer) clearTimeout(deferredWorkspaceConfigurationRefreshTimer);
-              const deferredIncidentId = deferredWorkspaceConfiguration?.incidentId;
-              deferredWorkspaceConfigurationRefreshTimer = setTimeout(() => {
-                deferredWorkspaceConfigurationRefreshTimer = void 0;
-                if (!deferredIncidentId || !deferredWorkspaceRefreshWatchdogIsCurrent({
-                  capturedIncidentId: deferredIncidentId,
-                  deferredConfiguration: deferredWorkspaceConfiguration,
-                  activeIncidentId: activeWorkspaceIncidentId
-                }) || currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN) {
-                  return;
-                }
-                ws.close(1012, "Timed out waiting for deferred workspace configuration refresh");
-              }, WORKSPACE_INCIDENT_CONFIG_REFRESH_TIMEOUT_MS);
-              deferredWorkspaceConfigurationRefreshTimer.unref();
-            }
-            return;
+          deferredWorkspaceConfiguration = refresh.deferredConfiguration;
+          pendingAutomaticTrigger ??= { type: "periodic", detail: "resume after workspace incident" };
+          workspaceConfigured = false;
+          advanceWorkerAdmissionGeneration();
+          if (refresh.disposition === "reconnect_for_refresh") {
+            ws.close(1012, "Refreshing deferred workspace configuration");
+          } else {
+            if (deferredWorkspaceConfigurationRefreshTimer) clearTimeout(deferredWorkspaceConfigurationRefreshTimer);
+            const deferredIncidentId = deferredWorkspaceConfiguration.incidentId;
+            deferredWorkspaceConfigurationRefreshTimer = setTimeout(() => {
+              deferredWorkspaceConfigurationRefreshTimer = void 0;
+              if (!deferredWorkspaceRefreshWatchdogIsCurrent({
+                capturedIncidentId: deferredIncidentId,
+                deferredConfiguration: deferredWorkspaceConfiguration,
+                activeIncidentId: activeWorkspaceIncidentId
+              }) || currentWorkerSocket !== ws || ws.readyState !== WebSocket.OPEN) {
+                return;
+              }
+              ws.close(1012, "Timed out waiting for deferred workspace configuration refresh");
+            }, WORKSPACE_INCIDENT_CONFIG_REFRESH_TIMEOUT_MS);
+            deferredWorkspaceConfigurationRefreshTimer.unref();
           }
-          scheduleAutomaticWorkspaceSync(pendingAutomaticTrigger ?? { type: "periodic", detail: "resume after workspace incident" }, 0);
+          return;
         }
         return;
       }
@@ -5620,7 +5693,12 @@ async function startWorker(options) {
                 if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
               });
             }
-            await runWorkspaceCommand(message.target, workspaceSyncSingleFlight, runCommand);
+            await runReservedWorkspaceCommand(message.target, workspaceSyncSingleFlight, runCommand, () => {
+              if (targetReserved) {
+                workspaceSyncPriorityProcessTargets.delete(message.runId);
+                targetReserved = false;
+              }
+            });
           } finally {
             if (targetReserved) workspaceSyncPriorityProcessTargets.delete(message.runId);
           }
@@ -5694,7 +5772,7 @@ async function startWorker(options) {
         } finally {
           if (reservesVisibleWorkspace) {
             workspaceSyncPriorityOperationTargets.delete(message.requestId);
-            if (pendingAutomaticTrigger && !activeWorkspaceIncidentId && !deferredWorkspaceConfiguration) {
+            if (pendingAutomaticTrigger && automaticWorkspaceSyncIsCurrentlyAdmitted()) {
               scheduleAutomaticWorkspaceSync(pendingAutomaticTrigger, dirtyTrigger ? WORKSPACE_GIT_QUIET_MS : 0);
             }
           }