@teambit/ci 1.0.493 → 1.0.495

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@teambit/ci",
-  "version": "1.0.493",
+  "version": "1.0.495",
   "homepage": "https://bit.cloud/teambit/git/ci",
   "main": "dist/index.js",
   "componentId": {
     "scope": "teambit.git",
     "name": "ci",
-    "version": "1.0.493"
+    "version": "1.0.495"
   },
   "dependencies": {
     "chalk": "4.1.2",
@@ -17,30 +17,30 @@
     "@teambit/harmony": "0.4.12",
     "@teambit/cli": "0.0.1364",
     "@teambit/logger": "0.0.1457",
+    "@teambit/workspace": "1.0.1099",
+    "@teambit/builder": "1.0.1099",
+    "@teambit/checkout": "1.0.1100",
     "@teambit/component-id": "1.2.4",
     "@teambit/component.modules.merge-helper": "0.0.88",
     "@teambit/component.snap-distance": "0.0.146",
+    "@teambit/config-merger": "0.0.966",
+    "@teambit/dependency-resolver": "1.0.1099",
+    "@teambit/export": "1.0.1099",
     "@teambit/harmony.modules.concurrency": "0.0.42",
+    "@teambit/importer": "1.0.1099",
     "@teambit/lane-id": "0.0.312",
+    "@teambit/lanes": "1.0.1120",
     "@teambit/legacy.consumer-component": "0.0.146",
+    "@teambit/objects": "0.0.606",
+    "@teambit/snapping": "1.0.1099",
+    "@teambit/status": "1.0.1124",
     "@teambit/toolbox.promise.map-pool": "0.0.19",
     "@teambit/toolbox.string.random": "0.0.18",
     "@teambit/bit-error": "0.0.404",
     "@teambit/legacy.constants": "0.0.41",
     "@teambit/legacy.scope": "0.0.145",
     "@teambit/legacy.bit-map": "0.0.202",
-    "@teambit/toolbox.crypto.sha1": "0.0.20",
-    "@teambit/workspace": "1.0.1098",
-    "@teambit/builder": "1.0.1098",
-    "@teambit/checkout": "1.0.1099",
-    "@teambit/config-merger": "0.0.965",
-    "@teambit/dependency-resolver": "1.0.1098",
-    "@teambit/export": "1.0.1098",
-    "@teambit/importer": "1.0.1098",
-    "@teambit/lanes": "1.0.1119",
-    "@teambit/objects": "0.0.605",
-    "@teambit/snapping": "1.0.1098",
-    "@teambit/status": "1.0.1123"
+    "@teambit/toolbox.crypto.sha1": "0.0.20"
   },
   "devDependencies": {
     "@types/lodash": "4.14.165",

package/sync/git-ops.spec.ts

@@ -14,7 +14,9 @@ import {
   DEFAULT_GIT_USER_NAME,
   fetchRemoteHeads,
   isNonContentPath,
+  isNonFastForwardRejection,
   isStaleLeaseRejection,
+  redactUrlCredentials,
   parseLsRemoteSymref,
   parseOriginHeadRef,
   refetchBranchTip,
@@ -228,6 +230,64 @@ describe('deleteBranchArgs', () => {
   });
 });
 
+describe('isNonFastForwardRejection', () => {
+  // The GitHub-style client-side check, in the shape this code actually receives: simple-git appends
+  // `--porcelain` to every push, so the rejected ref arrives as a TAB-separated status line, not the
+  // human `! [rejected]` wording.
+  const CLIENT_SIDE_REJECTION =
+    '!\tHEAD:refs/heads/feature\t[rejected] (fetch first)\n' +
+    "error: failed to push some refs to '/remote'\n" +
+    'hint: Updates were rejected because the remote contains work that you do\n' +
+    'hint: not have locally.';
+
+  // The server-side ref-lock check: a plain push racing a concurrent ref update on the local/file
+  // transport surfaces the SAME wording as a lease refusal, with no lease involved (reproduced in
+  // ci-sync.e2e.ts's "a rejected sync-commit push" test).
+  const SERVER_SIDE_REJECTION =
+    '!\tHEAD:refs/heads/import-race-lane\t[remote rejected] (failed to update ref)\n' +
+    "remote: error: cannot lock ref 'refs/heads/import-race-lane': is at abc123 but expected def456\n" +
+    "error: failed to push some refs to '/remote'";
+
+  it('recognizes the client-side non-fast-forward wording, porcelain and human', () => {
+    expect(isNonFastForwardRejection(CLIENT_SIDE_REJECTION)).to.equal(true);
+    expect(isNonFastForwardRejection('!\tmain:refs/heads/main\t[rejected] (non-fast-forward)')).to.equal(true);
+    // the human layout (no --porcelain) still matches — the token test is layout-independent
+    expect(isNonFastForwardRejection('! [rejected] main -> main (non-fast-forward)')).to.equal(true);
+    expect(isNonFastForwardRejection('To /remote\n ! [rejected]        HEAD -> feature (fetch first)')).to.equal(true);
+  });
+
+  it('recognizes the server-side ref-lock wording a plain push can also hit', () => {
+    expect(isNonFastForwardRejection(SERVER_SIDE_REJECTION)).to.equal(true);
+    // Same wording `isStaleLeaseRejection` matches — a plain push can legitimately race into it too.
+    expect(isNonFastForwardRejection('! [rejected] (delete) -> my-lane (stale info)')).to.equal(true);
+  });
+
+  it('does not mistake a server-side hook decline for a race', () => {
+    // `[remote rejected]` alone (no ref-lock/fetch-first wording) — a protected-branch/hook decline,
+    // a real problem to surface, not a race to swallow.
+    expect(isNonFastForwardRejection('! [remote rejected] main -> main (protected branch hook declined)')).to.equal(
+      false
+    );
+    expect(
+      isNonFastForwardRejection('!\tHEAD:refs/heads/main\t[remote rejected] (pre-receive hook declined)')
+    ).to.equal(false);
+    expect(isNonFastForwardRejection('remote: GH006: Protected branch update failed')).to.equal(false);
+  });
+});
+
+describe('redactUrlCredentials', () => {
+  it('strips embedded credentials from a push-error remote URL', () => {
+    expect(
+      redactUrlCredentials("error: failed to push some refs to 'https://x-access-token:ghs_abc123@github.com/o/r'")
+    ).to.equal("error: failed to push some refs to 'https://***@github.com/o/r'");
+  });
+
+  it('leaves a credential-free message unchanged', () => {
+    const message = "error: failed to push some refs to 'https://github.com/o/r'\n ! [rejected] (fetch first)";
+    expect(redactUrlCredentials(message)).to.equal(message);
+  });
+});
+
 describe('isNonContentPath', () => {
   it('covers the two paths the executors never treat as workspace content, and nothing adjacent', () => {
     ['.bit', '.bit/objects/ab/cdef', 'node_modules/lodash/index.js'].forEach((p) =>

package/sync/git-ops.ts

@@ -178,6 +178,78 @@ export function isStaleLeaseRejection(message: string): boolean {
   return /stale info|force-with-lease|but expected|incorrect old value/i.test(message);
 }
 
+/**
+ * Whether a failed push was a plain non-fast-forward rejection: a concurrent run already advanced
+ * `branch`, so ours is now stale. `commitAllAndPush` never uses `--force-with-lease`, yet a race can
+ * still surface the SAME wording `isStaleLeaseRejection` matches: git's ref-update transaction rejects
+ * an ordinary push exactly like a lease refusal once the remote's ref changed underneath it (confirmed
+ * empirically on the local/file transport this repo's e2e remotes use — "cannot lock ref … is at X but
+ * expected Y" — no lease involved). A GitHub-style remote instead rejects the ref with a
+ * `[rejected] … (fetch first)` or `(non-fast-forward)` line. That line's layout varies: simple-git
+ * appends `--porcelain` to every push, so the real shape is tab-separated
+ * (`!\tHEAD:refs/heads/x\t[rejected] (fetch first)`), NOT the human `! [rejected] …` — match the
+ * `[rejected]` token plus the reason, never the whitespace around them. `[remote rejected]` (a server
+ * hook decline, e.g. a protected branch) does not contain the bare `[rejected]` token and is excluded:
+ * that is a real problem to surface, not a race to swallow.
+ */
+export function isNonFastForwardRejection(message: string): boolean {
+  if (isStaleLeaseRejection(message)) return true;
+  return /\[rejected\]/.test(message) && /fetch first|non-fast-forward/i.test(message);
+}
+
+/**
+ * Whether a rejected plain push was a CONFIRMED race: the wording matches a non-fast-forward rejection
+ * AND a re-fetch shows `branch` actually moved off `baseSha` — the tip the rejected push was based on.
+ * The wording alone is not proof: the regexes are deliberately broad, so a PERSISTENT, unrelated push
+ * failure (bad credentials, a flaky transport) could repeat the same wording forever; unconfirmed
+ * answers 'not-a-race' and the caller fails loud. A failed re-fetch (`undefined` tip) is UNKNOWN, not
+ * confirmation — never treat not knowing as proof of a race. The one `remoteMoved` expression also
+ * covers a brand-new branch (`baseSha === undefined`): a defined tip already proves the branch now
+ * exists on the remote. `refetchTip` is injectable so callers stay unit-testable without a real remote.
+ */
+export async function confirmPushRace(
+  branch: string,
+  baseSha: string | undefined,
+  message: string,
+  refetchTip: (branch: string) => Promise<string | undefined> = refetchBranchTip
+): Promise<'confirmed-race' | 'not-a-race'> {
+  if (!isNonFastForwardRejection(message)) return 'not-a-race';
+  const currentTip = await refetchTip(branch);
+  const remoteMoved = currentTip !== undefined && currentTip !== baseSha;
+  return remoteMoved ? 'confirmed-race' : 'not-a-race';
+}
+
+/**
+ * Strip URL userinfo (`https://user:token@host` → `https://***@host`) from a git message before it
+ * reaches a log or a summary: git prints the remote URL in push errors, and a remote may embed
+ * credentials. Over-redaction is the safe direction — `ssh://git@host` loses nothing that matters.
+ */
+export function redactUrlCredentials(text: string): string {
+  return text.replace(/\/\/[^\s@/]+@/g, '//***@');
+}
+
+/**
+ * Move the local `branch` back to `origin/<branch>`, dropping unpushed commits — the cleanup after a
+ * lost push race, so the orphan commit cannot trip `checkoutPristine`'s guard on the clone's next run.
+ * `reset --hard` writes the index, so a stale `index.lock` blocks it; the `update-ref` fallback does
+ * not touch the index and still moves the ref off the orphan commit (the callers force-clean the tree
+ * afterwards, in `restoreWorkspace`). Returns the failure message instead of throwing: the drop is
+ * best-effort, and a failed drop must not escalate a confirmed-benign race.
+ */
+export async function dropLocalBranchToRemoteTip(branch: string): Promise<string | undefined> {
+  try {
+    await git.raw(['reset', '--hard', `origin/${branch}`]);
+    return undefined;
+  } catch (resetErr: any) {
+    try {
+      await git.raw(['update-ref', `refs/heads/${branch}`, `refs/remotes/origin/${branch}`]);
+      return undefined;
+    } catch {
+      return String(resetErr?.message || resetErr);
+    }
+  }
+}
+
 /** Whether `origin` has the given branch. Assumes a `git fetch` isn't required (uses `ls-remote`). */
 export async function branchExistsOnRemote(branch: string): Promise<boolean> {
   const out = await git.raw(['ls-remote', '--heads', 'origin', branch]);

package/sync/lane-sync-executor.spec.ts

@@ -13,9 +13,27 @@ import {
   laneHeadFingerprint,
   LaneSyncExecutor,
   laneSyncPrBody,
+  racedLedgerPushSummary,
 } from './lane-sync-executor';
 import { resolveSyncConfig } from './sync-config';
 
+/**
+ * One stub executor for every seam-based test: real executor code over stubbed deps, no repository.
+ * `warnings` collects `consoleWarning` lines for tests that assert on them.
+ */
+function stubExecutor(): { executor: LaneSyncExecutor; warnings: string[] } {
+  const warnings: string[] = [];
+  const executor = new LaneSyncExecutor({
+    lanes: {} as any,
+    ci: {} as any,
+    logger: { console: () => {}, consoleWarning: (msg: string) => warnings.push(msg), error: () => {} } as any,
+    gitHost: undefined,
+    cfg: resolveSyncConfig({}),
+    defaultScope: 'acme.shop',
+  });
+  return { executor, warnings };
+}
+
 type LaneComponents = Parameters<typeof laneHeadFingerprint>[0];
 
 /** A stand-in for `LaneData`'s component entry; the helpers only read the id string, scope and head. */
@@ -314,16 +332,8 @@ describe('close-pr re-verifies the tip before retiring a branch', () => {
   const MOVED_SHA = 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb2';
 
   function retirer(currentTip: string | undefined, pushError?: Error) {
-    const warnings: string[] = [];
+    const { executor, warnings } = stubExecutor();
     const pushes: string[][] = [];
-    const executor = new LaneSyncExecutor({
-      lanes: {} as any,
-      ci: {} as any,
-      logger: { console: () => {}, consoleWarning: (msg: string) => warnings.push(msg), error: () => {} } as any,
-      gitHost: undefined,
-      cfg: resolveSyncConfig({}),
-      defaultScope: 'acme.shop',
-    });
     (executor as any).currentBranchTip = async () => currentTip;
     (executor as any).pushBranchDeletion = async (branch: string, sha: string) => {
       pushes.push([branch, sha]);
@@ -377,6 +387,95 @@ describe('close-pr re-verifies the tip before retiring a branch', () => {
   });
 });
 
+describe('classifyPushRejection confirms a race before calling it one', () => {
+  const BASE_SHA = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa1';
+  const MOVED_SHA = 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb2';
+  const REJECTION = new Error('! [rejected]        HEAD -> feature (fetch first)\nerror: failed to push some refs');
+
+  function classifier(currentTip: string | undefined) {
+    const { executor } = stubExecutor();
+    (executor as any).currentBranchTip = async () => currentTip;
+    return (baseSha: string | undefined, e: Error) =>
+      (executor as any).classifyPushRejection('my-branch', baseSha, e) as Promise<'confirmed-race' | 'not-a-race'>;
+  }
+
+  it('confirms the race when the branch actually moved off the base we pushed against', async () => {
+    const classify = classifier(MOVED_SHA);
+    expect(await classify(BASE_SHA, REJECTION)).to.equal('confirmed-race');
+  });
+
+  it('confirms the race for a brand-new branch that now exists on the remote', async () => {
+    const classify = classifier(MOVED_SHA);
+    expect(await classify(undefined, REJECTION)).to.equal('confirmed-race');
+  });
+
+  // Message-text matching alone is not proof: a persistent, unrelated rejection could repeat the same
+  // wording forever. Without this re-fetch-and-compare, that would go permanently green.
+  it('answers not-a-race when the branch did NOT move — the wording matched but nothing raced', async () => {
+    const classify = classifier(BASE_SHA);
+    expect(await classify(BASE_SHA, REJECTION)).to.equal('not-a-race');
+  });
+
+  it('answers not-a-race when a brand-new branch still does not exist on the remote', async () => {
+    const classify = classifier(undefined);
+    expect(await classify(undefined, REJECTION)).to.equal('not-a-race');
+  });
+
+  // The polarity bug this guards: `currentTip === undefined` here means the re-fetch FAILED (network
+  // blip, auth hiccup) — unknown, not evidence the branch moved. `undefined !== baseSha` reads as
+  // truthy if compared naively, which would misreport an unanswerable check as a confirmed race and
+  // paper over a real, persistent failure. Withhold like every other unknown-answer path in this file.
+  it('answers not-a-race when the re-fetch itself fails, even though a base sha is known', async () => {
+    const classify = classifier(undefined);
+    expect(await classify(BASE_SHA, REJECTION)).to.equal('not-a-race');
+  });
+
+  it('answers not-a-race for a rejection whose wording is not a non-fast-forward race at all', async () => {
+    const classify = classifier(MOVED_SHA);
+    const unrelated = new Error('remote: GH006: Protected branch update failed');
+    expect(await classify(BASE_SHA, unrelated)).to.equal('not-a-race');
+  });
+});
+
+// The live incident's actual shape: the snap/export onto the lane already succeeded — the lane truly
+// moved — and only the branch's OWN ledger-commit push (recordLaneHeadOnBranch) lost the race. Nothing
+// exercised `racedLedgerPushSummary` before this; a wording regression there would have gone unnoticed.
+describe('executeExportBranch reports the ledger-race wording when only the ledger push races', () => {
+  it('surfaces "lane updated; branch ledger commit lost the push race" without halting', async () => {
+    const { executor } = stubExecutor();
+    (executor as any).lastNonSyncCommitMessage = async () => 'feat: some change';
+    (executor as any).checkoutFromRemote = async () => {};
+    (executor as any).restoreWorkspace = async () => {};
+    // The export half already succeeded (undefined = no error, matching this file's `Error | undefined`
+    // contract for `snapAndExportOntoLane`); only the ledger commit that follows raced.
+    (executor as any).snapAndExportOntoLane = async () => undefined;
+    (executor as any).recordLaneHeadOnBranch = async () => ({ status: 'raced' });
+
+    const summary = await (executor as any).executeExportBranch({
+      target: { hostScope: 'acme.shop', name: 'my-lane' },
+      laneIdStr: 'acme.shop/my-lane',
+      branch: 'my-lane',
+      defaultBranch: 'main',
+    });
+
+    expect(summary).to.equal(
+      'my-lane -> raced (lane updated; branch ledger commit lost the push race — next run re-plans)'
+    );
+    expect(summary).to.not.include('HALTED');
+  });
+});
+
+// A destructive auto-resolution (onConflict git-wins/lane-wins) that already exported must not vanish
+// from the summary just because the ledger push raced.
+describe('racedLedgerPushSummary keeps the conflict-policy clause', () => {
+  it('carries the merge path’s policyClause through the raced ledger line', () => {
+    expect(racedLedgerPushSummary('my-lane', 'conflicts auto-resolved: git-wins on 3 file(s); ')).to.equal(
+      'my-lane -> raced (conflicts auto-resolved: git-wins on 3 file(s); lane updated; branch ledger commit ' +
+        'lost the push race — next run re-plans)'
+    );
+  });
+});
+
 describe('isProtectedBranch', () => {
   it('refuses the default branch and the main sync branch', () => {
     expect(isProtectedBranch('develop', 'develop', 'bit-sync/main')).to.equal(true);

package/sync/lane-sync-executor.ts

@@ -30,10 +30,13 @@ import {
   checkoutPristine,
   checkoutPristineRestore,
   commitWithIdentity,
+  confirmPushRace,
   deleteBranchArgs,
+  dropLocalBranchToRemoteTip,
   fetchRemoteHeads,
   isAncestor,
   isStaleLeaseRejection,
+  redactUrlCredentials,
   refetchBranchTip,
 } from './git-ops';
 
@@ -51,6 +54,41 @@ export const HALT_SUMMARY_PREFIX = 'HALTED';
  */
 export const REFUSED_SUMMARY_PREFIX = 'REFUSED';
 
+/**
+ * A raced verdict: the run lost a push race to a concurrent run and exits green — never a halt, never
+ * the `bit-sync-conflict` label; a raced push is not a content conflict. Nothing retries in-run, so
+ * convergence waits on the NEXT trigger (webhook or scheduled run): a deployment without the cron can
+ * mirror stale content until the next event. One builder so the `-> raced (` stem a consumer routes on
+ * lives at one site, like `HALT_SUMMARY_PREFIX`.
+ */
+function racedSummary(laneName: string, detail: string): string {
+  return `${laneName} -> raced (${detail})`;
+}
+
+/**
+ * `executeImportLane`'s own push (materializing the lane onto the branch) lost the race. Nothing on
+ * the LANE changed here — only the branch-side commit failed to land — so the next run's plan is
+ * unaffected: it simply retries the same import against the winner's tip.
+ */
+function racedBranchPushSummary(laneName: string): string {
+  return racedSummary(laneName, 'branch push lost the race to a concurrent run; next run re-plans');
+}
+
+/**
+ * `recordLaneHeadOnBranch`'s ledger-commit push lost the race, AFTER the snap/export that precedes it
+ * already succeeded — the lane genuinely moved. Only the branch's own acknowledgment of that (the
+ * `.bitmap` pointer commit) failed to land, so the next run reads the branch as behind the lane it
+ * itself just updated and plans `import-lane` to catch it up. `policyClause` carries a destructive
+ * auto-resolution (onConflict git-wins/lane-wins) that already exported — it must not vanish from the
+ * summary just because the ledger push raced.
+ */
+export function racedLedgerPushSummary(laneName: string, policyClause = ''): string {
+  return racedSummary(
+    laneName,
+    `${policyClause}lane updated; branch ledger commit lost the push race — next run re-plans`
+  );
+}
+
 export type LaneSyncDeps = {
   lanes: LanesMain;
   /** for snapPrCommit + getDefaultBranchName + switchToLaneForSync */
@@ -583,7 +621,13 @@ export class LaneSyncExecutor {
         });
       }
 
-      await this.commitAllAndPush(branch, buildSyncCommitMessage(laneIdStr, laneHead));
+      const pushResult = await this.commitAllAndPush(branch, buildSyncCommitMessage(laneIdStr, laneHead));
+      if (pushResult.raced) {
+        // Still ensure the PR: this early return skips the file's only PR-creation site, and the
+        // converged state every later run reads plans a bare noop, which never repairs a missing PR.
+        if (!pr) await this.openPrForLane({ target, laneIdStr, branch, defaultBranch, laneHead, remoteLane });
+        return racedBranchPushSummary(laneName);
+      }
 
       let prUrl = pr?.htmlUrl;
       if (!pr) {
@@ -633,8 +677,9 @@ export class LaneSyncExecutor {
         });
       }
 
-      const laneHead = await this.recordLaneHeadOnBranch(target, laneIdStr, branch);
-      if (!laneHead) {
+      const recorded = await this.recordLaneHeadOnBranch(target, laneIdStr, branch);
+      if (recorded.status === 'raced') return racedLedgerPushSummary(laneName);
+      if (recorded.status === 'unreadable') {
         return await this.executeHalt({
           laneName,
           laneIdStr,
@@ -643,7 +688,10 @@ export class LaneSyncExecutor {
           pr: await this.findPr(branch),
         });
       }
-      return `${laneName} -> export-branch (lane ${laneIdStr} @ ${laneHead.slice(0, 9)}, branch ${branch} updated)`;
+      return (
+        `${laneName} -> export-branch (lane ${laneIdStr} @ ${recorded.laneHead.slice(0, 9)}, ` +
+        `branch ${branch} updated)`
+      );
     } finally {
       await this.restoreWorkspace(defaultBranch);
     }
@@ -751,13 +799,14 @@ export class LaneSyncExecutor {
       }
 
       // ---- step 3: record the new lane head on the branch --------------------------------------
-      const laneHead = await this.recordLaneHeadOnBranch(target, laneIdStr, branch);
-      if (!laneHead) {
+      const recorded = await this.recordLaneHeadOnBranch(target, laneIdStr, branch);
+      if (recorded.status === 'raced') return racedLedgerPushSummary(laneName, policyClause);
+      if (recorded.status === 'unreadable') {
         return await halt(`lane ${laneIdStr} could not be read back from the remote after the merge export`);
       }
       return (
         `${laneName} -> merge-diverged (${policyClause}merged lane into branch, then exported; lane ${laneIdStr} @ ` +
-        `${laneHead.slice(0, 9)}, branch ${branch} updated)`
+        `${recorded.laneHead.slice(0, 9)}, branch ${branch} updated)`
       );
     } catch (e: any) {
       // Something unforeseen — halt anyway: no single lane may abort the rest of the run.
@@ -799,18 +848,21 @@ export class LaneSyncExecutor {
   /**
    * Record on the branch which lane state it now mirrors: re-query the lane (the export just moved it,
    * so any earlier fingerprint is stale), commit — crucially the `.bitmap` the snap rewrote — and push.
-   * Returns undefined when the lane can no longer be read, in which case the caller halts.
+   * `unreadable` means the lane could no longer be read back, in which case the caller halts;
+   * `raced` means a concurrent run's push already got there first, in which case the caller reports
+   * a benign noop instead.
    */
   private async recordLaneHeadOnBranch(
     target: LaneTarget,
     laneIdStr: string,
     branch: string
-  ): Promise<string | undefined> {
+  ): Promise<{ status: 'unreadable' } | { status: 'raced' } | { status: 'ok'; laneHead: string }> {
     const remoteLane = await this.getRemoteLane(target);
-    if (!remoteLane) return undefined;
+    if (!remoteLane) return { status: 'unreadable' };
     const laneHead = laneHeadFingerprint(remoteLane.components);
-    await this.commitAllAndPush(branch, buildSyncCommitMessage(laneIdStr, laneHead));
-    return laneHead;
+    const pushResult = await this.commitAllAndPush(branch, buildSyncCommitMessage(laneIdStr, laneHead));
+    if (pushResult.raced) return { status: 'raced' };
+    return { status: 'ok', laneHead };
   }
 
   /**
@@ -1222,15 +1274,68 @@ export class LaneSyncExecutor {
   /**
    * Stage everything, commit with the annotated sync message, and push. NEVER force-pushes: a rejected
    * push means someone pushed concurrently and the next run should re-plan rather than clobber.
-   * `--allow-empty` is only insurance against `git commit` failing the lane outright.
+   * `--allow-empty` is only insurance against `git commit` failing the lane outright. Returns whether
+   * the push was rejected by a CONFIRMED race (`classifyPushRejection`) — the caller's cue to report a
+   * benign noop instead of halting; any other push failure still throws.
    */
-  private async commitAllAndPush(branch: string, message: string) {
+  private async commitAllAndPush(branch: string, message: string): Promise<{ raced: boolean }> {
+    // The local knowledge of `origin/<branch>` right now — no fetch, `fetchOnce` already ran for this
+    // whole executor run — is exactly what our about-to-be-made commit is based on. After a rejection,
+    // this is the baseline `classifyPushRejection` checks the remote against to confirm a real race.
+    const baseSha = await this.localRemoteTip(branch);
     await addAllExceptScopeAndModules();
     await commitWithIdentity(message, { extraArgs: ['--allow-empty'] });
-    // `HEAD:refs/heads/<branch>`: a full-ref destination cannot be resolved as a tag or reinterpreted —
-    // the configured branch name is user input (see `sync-config.ts`).
-    await git.push(['origin', `HEAD:refs/heads/${branch}`]);
+    try {
+      // `HEAD:refs/heads/<branch>`: a full-ref destination cannot be resolved as a tag or
+      // reinterpreted — the configured branch name is user input (see `sync-config.ts`).
+      await git.push(['origin', `HEAD:refs/heads/${branch}`]);
+    } catch (e: any) {
+      if ((await this.classifyPushRejection(branch, baseSha, e)) !== 'confirmed-race') throw e;
+      // Drop the losing commit: left on refs/heads/<branch>, its orphan sibling would trip
+      // `checkoutPristine`'s guard on this clone's next branch-touching run. The confirmation just
+      // refetched the winner's tip, so `origin/<branch>` resolves.
+      const dropErr = await dropLocalBranchToRemoteTip(branch);
+      if (dropErr) {
+        this.deps.logger.consoleWarning(`Could not drop the unpushed sync commit on ${branch}: ${dropErr}`);
+      }
+      // Keep the original rejection text (redacted: git prints the remote URL, which may embed
+      // credentials): the raced verdict exits green, and without the text a persistent wording-matched
+      // failure on a busy branch would leave no diagnosable trace anywhere.
+      this.deps.logger.console(
+        formatWarningSummary(
+          `Push to ${branch} was rejected and the branch has since moved — a concurrent run got there first; ` +
+            `re-planning on the next sync. The rejection: ${redactUrlCredentials(String(e?.message || e))}`
+        )
+      );
+      return { raced: true };
+    }
     this.deps.logger.console(chalk.green(`Pushed ${branch}`));
+    return { raced: false };
+  }
+
+  /** `origin/<branch>`'s tip as this local clone currently knows it — no fetch. Undefined if unknown. */
+  private async localRemoteTip(branch: string): Promise<string | undefined> {
+    try {
+      return String(await git.raw(['rev-parse', `origin/${branch}`])).trim() || undefined;
+    } catch {
+      return undefined;
+    }
+  }
+
+  /**
+   * `confirmPushRace` (git-ops) with this executor's seam: `currentBranchTip` (shared with the close-pr
+   * retirement path) keeps the confirmation unit-testable without a real remote. Residual risk,
+   * accepted: "the branch moved" is not "a sync run won" — on a branch that moves during every run
+   * window, a persistent wording-matched failure still classifies as raced each time. The caller logs
+   * the original rejection text so that shape stays diagnosable. Only answers; the caller decides to
+   * swallow or rethrow.
+   */
+  private async classifyPushRejection(
+    branch: string,
+    baseSha: string | undefined,
+    e: any
+  ): Promise<'confirmed-race' | 'not-a-race'> {
+    return confirmPushRace(branch, baseSha, String(e?.message || e), (b) => this.currentBranchTip(b));
   }
 
   private async openPrForLane({

package/sync/main-sync-executor.ts

@@ -16,10 +16,13 @@ import {
   checkoutPristine,
   checkoutPristineRestore,
   commitWithIdentity,
+  confirmPushRace,
+  dropLocalBranchToRemoteTip,
   fetchRemoteHeads,
   gitWithIdentity,
   isNonContentPath,
   isStaleLeaseRejection,
+  redactUrlCredentials,
 } from './git-ops';
 
 export type MainSyncDeps = {
@@ -89,7 +92,7 @@ export class MainSyncExecutor {
         if (catchUpErr) {
           const refork = await this.reforkIfMachineOwned(branch);
           if (refork === 'human-owned') return `${HALT_SUMMARY_PREFIX} main -> ${catchUpErr}`;
-          if (refork === 'raced') return `main -> ${branch} was updated by a concurrent run — deferring to it`;
+          if (refork === 'raced') return racedMainSummary(branch);
         }
       }
 
@@ -156,10 +159,34 @@ export class MainSyncExecutor {
 
       await addAllExceptScopeAndModules();
       await commitWithIdentity(mainSyncCommitMessage(drift.length));
-      // Never force: a rejected push means a concurrent run pushed in between, and in direct-push mode
-      // that rejection is the whole safety story for the default branch. Unambiguous refspec — see
-      // `lane-sync-executor.commitAllAndPush`.
-      await git.push(['origin', `HEAD:refs/heads/${branch}`]);
+      // The local knowledge of `origin/<branch>` — the tip this run built on; after a rejection it is
+      // the baseline `confirmPushRace` checks the re-fetched remote against.
+      const baseSha = await git
+        .revparse([`origin/${branch}`])
+        .then((sha) => sha.trim() || undefined)
+        .catch(() => undefined);
+      // Never force. Unambiguous refspec — see `lane-sync-executor.commitAllAndPush`. A rejection means
+      // a concurrent run pushed in between; what happens next depends on the mode. Direct-push: the
+      // rejection IS the default branch's safety story — stay loud, never swallow. 'pr' mode: the push
+      // targets the machine-owned sync branch, where a concurrent-run overlap is the same benign race
+      // the lane executor tolerates (`reforkIfMachineOwned` already defers the same way) — confirm it
+      // and defer.
+      try {
+        await git.push(['origin', `HEAD:refs/heads/${branch}`]);
+      } catch (e: any) {
+        const message = String(e?.message || e);
+        if (directPush || (await confirmPushRace(branch, baseSha, message)) !== 'confirmed-race') throw e;
+        // Drop the losing commit: left on the local sync branch, its orphan sibling would trip the
+        // next run's `checkoutPristine` guard. The original rejection text is kept for diagnosability.
+        const dropErr = await dropLocalBranchToRemoteTip(branch);
+        if (dropErr) {
+          logger.consoleWarning(`Could not drop the unpushed sync commit on ${branch}: ${dropErr}`);
+        }
+        logger.console(
+          formatWarningSummary(`main -> push to ${branch} lost to a concurrent run: ${redactUrlCredentials(message)}`)
+        );
+        return racedMainSummary(branch);
+      }
       logger.console(chalk.green(`Pushed ${branch}`));
 
       if (directPush) {
@@ -329,6 +356,11 @@ export class MainSyncExecutor {
   }
 }
 
+/** The deferral line both raced shapes share: the catch-up refork race and the sync-branch push race. */
+function racedMainSummary(branch: string): string {
+  return `main -> ${branch} was updated by a concurrent run — deferring to it`;
+}
+
 /** The sync commit message: no `Bit-Lane-Head` trailer — main sync keeps no state. */
 function mainSyncCommitMessage(driftCount: number): string {
   return [