agent-relay-orchestrator 0.119.10 → 0.119.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-orchestrator",
-  "version": "0.119.10",
+  "version": "0.119.11",
   "description": "Agent Relay orchestrator — manages agent lifecycle across hosts",
   "type": "module",
   "bin": {

package/src/workspace-probe/merge.ts

@@ -7,7 +7,7 @@ import { prMergedState } from "../workspace-pr";
 import { deleteBranchIfSafe, owningRepoRoot } from "./cleanup";
 import { refreshWorkspaceDeps } from "./deps";
 import { type LandGatesResult } from "./land-gates-runner";
-import { populateMergeState, resolveBranchRef, syncBaseFromOrigin, workspaceGitState } from "./git-state";
+import { populateMergeState, resolveBranchRef, syncBaseFromOrigin, upstreamRef, workspaceGitState } from "./git-state";
 import { type MergePhase, mergePhaseTimeoutMs, throwIfMergeAborted, withMergePhaseTimeout } from "./merge-timeouts";
 import { nextBranchName } from "./names";
 import { parseWorktrees, shortBranch } from "./parse";
@@ -438,6 +438,66 @@ export async function mergeWorkspace(input: WorkspaceMergeInput): Promise<Worksp
  *    agent with no checkout once cleanup reclaims the worktree (#327).
  *  - Gone owner: reclaim the spent worktree/branch and go terminal `merged`.
  */
+/**
+ * #950 — before a no-op land goes terminal `merged` (or recycles a live owner), verify the
+ * branch's landed work is actually on the UPSTREAM, not just on local base. A lost push race
+ * (see {@link mergeRebaseFf}) can leave a merge commit on local base that never reached origin;
+ * preview then fires `noop` because the branch is an ancestor of local base — and the old path
+ * blessed it as `merged` while origin never got it, diverging local base and wedging the repo.
+ * Outcomes:
+ *   - "clean":     no upstream / push disabled, or local base is already contained in origin
+ *                  (nothing unpublished) — safe to finalize as-is.
+ *   - "published": local base was cleanly AHEAD of origin (carried the unpushed land) and we
+ *                  fast-forward-pushed it — now safe to finalize, with pushed=true.
+ *   - "refuse":    local base DIVERGED from origin (unpushed commits that can't fast-forward),
+ *                  or the publish push failed — must NOT finalize unpushed work as merged.
+ */
+async function publishNoopBaseIfStranded(
+  input: WorkspaceMergeInput,
+  worktreePath: string,
+  repoRoot: string,
+  base: string | undefined,
+  signal?: AbortSignal,
+): Promise<"clean" | "published" | "refuse"> {
+  if (!base) return "clean";
+  if (input.push === false || !workspacePushEnabled()) return "clean";
+  const upstream = await upstreamRef(worktreePath, base, signal);
+  if (!upstream) return "clean";
+  const slash = upstream.indexOf("/");
+  const remote = slash > 0 ? upstream.slice(0, slash) : undefined;
+  if (!remote) return "clean";
+  throwIfMergeAborted(signal);
+  await mergeGit(["fetch", remote, base], worktreePath, "rebase", `workspace merge fetch ${remote}/${base} before noop finalize`, signal);
+  const upstreamSha = (await mergeGit(["rev-parse", "--verify", upstream], worktreePath, "rebase", `workspace merge resolve ${upstream} before noop finalize`, signal)).stdout;
+  const baseSha = (await mergeGit(["rev-parse", "--verify", base], worktreePath, "rebase", `workspace merge resolve ${base} before noop finalize`, signal)).stdout;
+  if (!upstreamSha || !baseSha || baseSha === upstreamSha) return "clean";
+  // Local base fully contained in origin (behind/equal) — the land is already published.
+  if ((await mergeGit(["merge-base", "--is-ancestor", baseSha, upstreamSha], worktreePath, "rebase", `workspace merge check ${base} contained in ${upstream}`, signal)).ok) return "clean";
+  // Local base strictly ahead of origin — publish the stranded land with a fast-forward push.
+  if ((await mergeGit(["merge-base", "--is-ancestor", upstreamSha, baseSha], worktreePath, "rebase", `workspace merge check ${base} ahead of ${upstream}`, signal)).ok) {
+    throwIfMergeAborted(signal);
+    const push = await mergeGit(["push", remote, `${base}:${base}`], worktreePath, "rebase", `workspace merge publish stranded ${base} to ${remote}`, signal);
+    return push.ok ? "published" : "refuse";
+  }
+  // Diverged: unpushed local commits AND origin has commits we lack. Left as-is, local base stays
+  // diverged and EVERY later real land hits the divergence refusal forever — a repo-wide host wedge
+  // (#950 follow-up SHOULD-FIX 3). Attempt an auto-reconcile: replay the unpushed commits onto fresh
+  // origin in a clean base checkout and publish, converting the divergence into a clean, published
+  // state. Content is preserved (SHAs of the reconciled commits change — a merge replays as its
+  // first-parent delta); this only fires on an already-wedged base, so a content-faithful publish
+  // beats a permanent refusal. If it can't be done cleanly/safely, refuse — the caller escalates to
+  // a CLEAR conflict (steward) rather than a silent perpetual refusal.
+  const localOnly = (await mergeGit(["rev-list", "--reverse", "--first-parent", `${upstreamSha}..${baseSha}`], worktreePath, "rebase", `workspace merge scan unpushed ${base} commits before reconcile`, signal)).stdout.split("\n").filter(Boolean);
+  if (localOnly.length === 0) return "refuse";
+  const baseWorktree = await worktreeForBranch(repoRoot, base, signal);
+  if (!baseWorktree || baseWorktree.dirty) return "refuse";
+  const replay = await replayCommitsOntoUpstream(baseWorktree.path, upstreamSha, localOnly, baseSha, base, signal);
+  if (!replay.ok) return "refuse";
+  throwIfMergeAborted(signal);
+  const push = await mergeGit(["push", remote, `${base}:${base}`], baseWorktree.path, "rebase", `workspace merge publish reconciled ${base} to ${remote}`, signal);
+  return push.ok ? "published" : "refuse";
+}
+
 async function resolveNoopMerge(
   input: WorkspaceMergeInput,
   worktreePath: string,
@@ -453,6 +513,16 @@ async function resolveNoopMerge(
   signal?: AbortSignal,
 ): Promise<WorkspaceMergeResult> {
   throwIfMergeAborted(signal);
+  // #950 — a `noop` preview means the branch is already an ancestor of LOCAL base, but that base
+  // may carry a merge commit a lost push race never published. Verify it's on origin (publishing
+  // it if we cleanly can) before going terminal — never bless unpushed work as `merged`.
+  const publishState = await publishNoopBaseIfStranded(input, worktreePath, repoRoot, preview.baseRef, signal);
+  if (publishState === "refuse") {
+    // Diverged and could not auto-reconcile (SHOULD-FIX 3): escalate to a CLEAR steward-actionable
+    // state instead of a benign review_requested that would perpetually re-refuse and wedge the repo.
+    return head({ conflict: true, status: "conflict", error: `local ${preview.baseRef ?? "base"} carries unpushed landed work that diverged from origin and could not be auto-reconciled; a steward must reconcile and land it (#950)` });
+  }
+  const pushedStranded = publishState === "published" ? { pushed: true } : {};
   const ownerRepo = branch ? await owningRepoRoot(worktreePath, repoRoot) : repoRoot;
   // Live owner (#327): recycle-to-continue instead of bricking the session.
   if (input.deleteBranch === false) {
@@ -474,11 +544,11 @@ async function resolveNoopMerge(
         const reportDeps = depsRefresh.refreshed || depsRefresh.stale || depsRefresh.error;
         // merged:false → no `branch.landed` notice (nothing landed); newBranch makes the
         // relay repoint the row and return it to `active` rather than terminal `merged`.
-        return head({ merged: false, noop: true, status: "active", baseSha, worktreeRemoved: false, branch: fresh, newBranch: fresh, ...deleteResult, ...(reportDeps ? { depsRefresh } : {}), error: undefined });
+        return head({ merged: false, noop: true, status: "active", baseSha, worktreeRemoved: false, branch: fresh, newBranch: fresh, ...deleteResult, ...(reportDeps ? { depsRefresh } : {}), ...pushedStranded, error: undefined });
       }
     }
     // No base or checkout failed — stay live on the current branch, don't strand at `merged`.
-    return head({ merged: false, noop: true, status: "active", worktreeRemoved: false, branchDeleted: false, error: undefined });
+    return head({ merged: false, noop: true, status: "active", worktreeRemoved: false, branchDeleted: false, ...pushedStranded, error: undefined });
   }
   // Owner is gone — reclaim the spent worktree/branch and go terminal.
   if (branch) {
@@ -486,9 +556,9 @@ async function resolveNoopMerge(
     const removed = await mergeGit(["worktree", "remove", "--force", worktreePath], ownerRepo, "cleanup", "workspace merge remove noop worktree", signal);
     const worktreeRemoved = removed.ok;
     const deleteResult = worktreeRemoved ? await deleteBranchIfSafe(ownerRepo, branch, preview.baseRef, undefined, signal) : { branchDeleted: false };
-    return head({ status: "merged", noop: true, worktreeRemoved, ...deleteResult, error: undefined });
+    return head({ status: "merged", noop: true, worktreeRemoved, ...deleteResult, ...pushedStranded, error: undefined });
   }
-  return head({ status: "merged", noop: true, error: undefined });
+  return head({ status: "merged", noop: true, ...pushedStranded, error: undefined });
 }
 
 async function mergePr(
@@ -660,6 +730,145 @@ async function syncLocalBaseToUpstream(
   return { ok: true, baseSync };
 }
 
+/**
+ * Restore `baseWorktreePath` to `restoreSha` — the PRE-replay snapshot that still carries the
+ * preserved local-only commits — after an aborted/failed replay (#950). Runs its git ops WITHOUT
+ * the merge signal on purpose: the replay reset already moved base to origin, so the preserved work
+ * survives ONLY in `restoreSha`; if this cleanup reused the (possibly-aborted) merge signal,
+ * `mergeGit` would rethrow immediately on the aborted signal (see its `throwIfMergeAborted` guard)
+ * and SKIP the restoration, stranding base half-reset at origin with the work dropped — the exact
+ * data loss a cancellation must not cause. Clears any in-progress cherry-pick, hard-resets to
+ * `restoreSha`, then VERIFIES HEAD actually landed on it. Returns whether the restore is PROVEN, so
+ * the caller can escalate a hard conflict when it cannot confirm the base is safe (never assume).
+ */
+async function restoreBaseWorktreeToSnapshot(baseWorktreePath: string, restoreSha: string, base: string): Promise<boolean> {
+  try {
+    // No signal: this must run to completion even under an aborted/timed-out merge.
+    await mergeGit(["cherry-pick", "--abort"], baseWorktreePath, "cleanup", `workspace merge abort in-progress replay of ${base}`);
+    const reset = await mergeGit(["reset", "--hard", restoreSha], baseWorktreePath, "cleanup", `workspace merge restore ${base} to pre-replay snapshot`);
+    if (!reset.ok) return false;
+    const head = (await mergeGit(["rev-parse", "HEAD"], baseWorktreePath, "cleanup", `workspace merge verify ${base} restored to snapshot`)).stdout.trim();
+    return head !== "" && head === restoreSha.trim();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Replay `commits` (oldest-first) onto `upstreamSha` in a CLEAN base worktree via cherry-pick, so
+ * unpushed local commits that can no longer fast-forward are PRESERVED (their content re-lands on
+ * fresh origin) instead of being discarded by a hard reset (#950). Merge commits replay as their
+ * first-parent delta (`-m 1`). Commits are attributed to the relay identity like the no-ff land, so
+ * a base checkout without a configured git identity can still replay.
+ *
+ * ABORT-SAFE (#950 review): the reset-to-origin runs BEFORE the replay, so a merge cancellation /
+ * total-timeout firing after it would leave base at `upstreamSha` with the preserved commits gone.
+ * The whole replay therefore runs inside a try; on ANY failure OR abort we restore `restoreSha` with
+ * a FRESH (non-aborted) signal and VERIFY the restore landed. If restoration cannot be PROVEN we
+ * return an explicit `conflict` so the caller escalates to a steward rather than reporting a benign
+ * state over a half-reset base. The caller escalates for a manual/steward reconcile either way.
+ */
+async function replayCommitsOntoUpstream(
+  baseWorktreePath: string,
+  upstreamSha: string,
+  commits: string[],
+  restoreSha: string,
+  base: string,
+  signal?: AbortSignal,
+): Promise<{ ok: true } | { ok: false; conflict?: boolean; error: string }> {
+  let failure: string | undefined;
+  try {
+    const reset = await mergeGit(["reset", "--hard", upstreamSha], baseWorktreePath, "rebase", `workspace merge rewind ${base} to origin before replay`, signal);
+    if (!reset.ok) {
+      failure = reset.stderr || `failed to rewind ${base} to origin before replaying unpushed commits`;
+    } else {
+      for (const sha of commits) {
+        throwIfMergeAborted(signal);
+        const parents = (await mergeGit(["rev-list", "--parents", "-n", "1", sha], baseWorktreePath, "rebase", `workspace merge inspect ${sha} parents before replay`, signal)).stdout.split(/\s+/).filter(Boolean);
+        const pickArgs = parents.length > 2
+          ? ["-c", `user.name=${LAND_COMMITTER.name}`, "-c", `user.email=${LAND_COMMITTER.email}`, "cherry-pick", "-m", "1", sha]
+          : ["-c", `user.name=${LAND_COMMITTER.name}`, "-c", `user.email=${LAND_COMMITTER.email}`, "cherry-pick", sha];
+        const pick = await mergeGit(pickArgs, baseWorktreePath, "rebase", `workspace merge replay unpushed ${sha} onto origin`, signal);
+        if (!pick.ok) {
+          failure = `cannot cleanly replay unpushed ${base} commit ${sha.slice(0, 9)} onto origin; needs manual reconcile (#950)`;
+          break;
+        }
+      }
+    }
+  } catch (err) {
+    // Abort / total-timeout / unexpected throw mid-replay — base may be half-reset at origin.
+    failure = `replay of unpushed ${base} commits interrupted before completion (${errMessage(err)}); restoring ${base} (#950)`;
+  }
+
+  if (!failure) return { ok: true };
+
+  // Restore the pre-replay snapshot (still holding the preserved commits) with a fresh signal, then
+  // PROVE it landed. If we cannot, the base may be stranded at origin with the work dropped — a hard
+  // conflict for a steward, never a silent half-reset.
+  const restored = await restoreBaseWorktreeToSnapshot(baseWorktreePath, restoreSha, base);
+  if (!restored) {
+    return { ok: false, conflict: true, error: `${failure}; and could not restore ${base} to its pre-replay snapshot ${restoreSha.slice(0, 9)} — base may be left reset to origin with unpushed work dropped; escalating to steward (#950)` };
+  }
+  return { ok: false, error: failure };
+}
+
+/**
+ * Undo a base-ref advance whose publish lost a push race (#950). The merge commit is only on the
+ * LOCAL base and origin moved past us, so it can no longer fast-forward — stranding it would
+ * diverge local base from origin and wedge every later land (preview would see the branch as an
+ * ancestor of local base → noop → terminal `merged` for work never published). Rewind local base
+ * to the fetched origin tip so local == origin: no phantom merge, no divergence.
+ *
+ * MUST-FIX (#950 review): local base may carry PRE-EXISTING unpushed commits that are NOT the merge
+ * we just created (e.g. work stranded by an EARLIER push race). Committed work isn't dirty, so the
+ * clean-worktree guard doesn't catch it — a blind hard reset to origin would DISCARD it. So compute
+ * the local-only commits on the PRE-land base tip (`preLandBaseSha`, which excludes the merge we're
+ * intentionally dropping); if there are none, rewind to origin as before; if there are some, PRESERVE
+ * them by replaying onto fresh origin (a clean worktree is required to do this safely — otherwise
+ * REFUSE and surface for a steward, never reset over the unpushed work). Returns an explicit
+ * success/failure so the caller can VERIFY the base actually healed before reporting a recoverable
+ * state (a failed rollback must not masquerade as healed).
+ */
+async function rewindBaseAfterPushRace(
+  repoRoot: string,
+  base: string,
+  advancedBaseTip: string,
+  preLandBaseSha: string | undefined,
+  upstreamSha: string,
+  baseWorktree: { path: string; dirty: boolean } | undefined,
+  dirtyBefore: Set<string> | undefined,
+  signal?: AbortSignal,
+): Promise<{ ok: true } | { ok: false; conflict?: boolean; error: string }> {
+  // Commits on the PRE-land base tip that origin lacks — pre-existing unpushed work, NOT the merge
+  // we just made (that lives only on advancedBaseTip). These must survive the rewind.
+  // `--first-parent` walks base's MAINLINE (the sequence of lands): each merge replays once as its
+  // first-parent delta (`-m 1`) instead of also re-applying the branch commits it already contains.
+  const localOnly = preLandBaseSha
+    ? (await mergeGit(["rev-list", "--reverse", "--first-parent", `${upstreamSha}..${preLandBaseSha}`], repoRoot, "rebase", `workspace merge scan unpushed ${base} commits before rewind`, signal)).stdout.split("\n").filter(Boolean)
+    : [];
+
+  if (localOnly.length === 0) {
+    // Nothing but the phantom merge to drop — safe to rewind straight to origin.
+    if (baseWorktree && !baseWorktree.dirty) {
+      const reset = await mergeGit(["reset", "--hard", upstreamSha], baseWorktree.path, "rebase", `workspace merge rewind ${base} to ${upstreamSha} after push race`, signal);
+      if (!reset.ok) return { ok: false, error: reset.stderr || `failed to rewind ${base} worktree to origin after push race` };
+      return { ok: true };
+    }
+    const update = await mergeGit(["update-ref", `refs/heads/${base}`, upstreamSha, advancedBaseTip], repoRoot, "rebase", `workspace merge rewind ${base} ref after push race`, signal);
+    if (!update.ok) return { ok: false, error: update.stderr || `failed to rewind ${base} ref to origin after push race` };
+    if (baseWorktree?.dirty && dirtyBefore) await syncDirtyBaseWorktreeAfterRefAdvance(base, baseWorktree, advancedBaseTip, upstreamSha, dirtyBefore, signal);
+    return { ok: true };
+  }
+
+  // Pre-existing unpushed commits present. Replaying requires a CLEAN base checkout; without one we
+  // refuse rather than risk discarding committed work — the branch and the unpushed commits both
+  // stay put and a steward reconciles.
+  if (!baseWorktree || baseWorktree.dirty) {
+    return { ok: false, error: `local ${base} carries ${localOnly.length} unpushed commit(s) not on origin and its checkout is ${baseWorktree ? "dirty" : "absent"}; refusing to rewind (would discard committed work) — needs manual/steward reconcile (#950)` };
+  }
+  return await replayCommitsOntoUpstream(baseWorktree.path, upstreamSha, localOnly, advancedBaseTip, base, signal);
+}
+
 async function mergeRebaseFf(
   input: WorkspaceMergeInput,
   worktreePath: string,
@@ -782,6 +991,10 @@ async function mergeRebaseFf(
   // land: fall through to ref-plumbing (update-ref / synthesized no-ff merge) below, then
   // best-effort sync clean landed paths in the dirty checkout while preserving WIP (#681).
   let baseTip = headSha;
+  // Snapshot base's PRE-advance tip so a lost-push-race rewind can tell the merge we're about to
+  // create (which it should drop) apart from any PRE-EXISTING unpushed commits on base (which it
+  // must PRESERVE, not hard-reset over) — #950 data-loss guard.
+  const preLandBaseSha = (await mergeGit(["rev-parse", base], repoRoot, "rebase", `workspace merge snapshot ${base} tip before advance`, signal)).stdout || undefined;
   throwIfMergeAborted(signal);
   const baseWorktree = await worktreeForBranch(repoRoot, base, signal);
   const dirtyBasePathsBefore = baseWorktree?.dirty ? await dirtyPathSet(baseWorktree.path, signal) : undefined;
@@ -830,14 +1043,54 @@ async function mergeRebaseFf(
   const baseWorktreeSyncField = baseSync && !baseSync.reconciled ? { baseWorktreeSync: baseSync } : {};
   if (baseSync && !baseSync.reconciled && baseWorktree) logBaseWorktreeStrand(base, baseWorktree.path, baseSync);
 
-  // Publish the advanced base so local and origin converge (#190). We verified
-  // origin was an ancestor of base above, so this is a fast-forward; a failure
-  // means origin raced us — surface it instead of claiming an unpublished land.
+  // Publish the advanced base so local and origin converge (#190). We verified origin was an
+  // ancestor of base above, so this is a fast-forward — but that check ran BEFORE the base
+  // advance, and origin can move in the fetch→push window (#950: a sibling host landing the same
+  // origin, CI, a human push). If it did, this push is a non-ff and is rejected AFTER local base
+  // already carries the merge commit. Leaving the merge stranded on local base is the historical
+  // multi-host land wedge: local base diverges from origin, later previews see the branch as an
+  // ancestor of local base → noop → terminal `merged` for work never published, and every land
+  // after refuses on divergence. So on a push failure, re-fetch and try to publish in the SAME
+  // execution; if origin genuinely moved past us, rewind local base to the fresh origin tip
+  // (local == origin, no phantom, no divergence) and bounce to review_requested for the next scan.
   let pushed = false;
   if (upstream && remote && pushEnabled) {
     throwIfMergeAborted(signal);
-    const push = await mergeGit(["push", remote, `${base}:${base}`], worktreePath, "rebase", `workspace merge push ${base} to ${remote}`, signal);
-    if (!push.ok) return head({ status: "review_requested", mergedSha: headSha, error: push.stderr || `git push to ${remote}/${base} failed` });
+    let push = await mergeGit(["push", remote, `${base}:${base}`], worktreePath, "rebase", `workspace merge push ${base} to ${remote}`, signal);
+    if (!push.ok) {
+      throwIfMergeAborted(signal);
+      const refetch = await mergeGit(["fetch", remote, base], worktreePath, "rebase", `workspace merge re-fetch ${remote}/${base} after push race`, signal);
+      const upstreamSha = refetch.ok ? (await mergeGit(["rev-parse", "--verify", upstream], worktreePath, "rebase", `workspace merge resolve ${upstream} after push race`, signal)).stdout : "";
+      // Transient loss (a ref lock, or a compatible parallel push): origin is still an ancestor
+      // of our advanced base, so the merge is a clean fast-forward — just re-push it.
+      if (upstreamSha && (await mergeGit(["merge-base", "--is-ancestor", upstreamSha, baseTip], worktreePath, "rebase", "workspace merge check base still ff after push race", signal)).ok) {
+        throwIfMergeAborted(signal);
+        push = await mergeGit(["push", remote, `${base}:${base}`], worktreePath, "rebase", `workspace merge re-push ${base} to ${remote} after race`, signal);
+      }
+      if (!push.ok) {
+        // Origin moved past us — the advanced merge can't fast-forward. Rewind local base to the
+        // fresh origin tip so nothing is stranded (no mergedSha: nothing landed), PRESERVING any
+        // pre-existing unpushed commits (#950 MUST-FIX 1). Then VERIFY the base actually healed
+        // before reporting the retryable review_requested — a failed rollback must surface a HARD
+        // state (conflict → steward), never masquerade as healed (#950 MUST-FIX 2).
+        if (!upstreamSha) {
+          return head({ conflict: true, status: "conflict", error: `push to ${remote}/${base} failed and the fresh origin tip is unresolvable; cannot safely rewind ${base} — escalating (#950)` });
+        }
+        const rewind = await rewindBaseAfterPushRace(repoRoot, base, baseTip, preLandBaseSha, upstreamSha, baseWorktree, dirtyBasePathsBefore, signal);
+        if (!rewind.ok) {
+          return head({ conflict: true, status: "conflict", error: rewind.error });
+        }
+        // Verify, don't assume: local base must now contain the fresh origin tip AND must NOT still
+        // carry the phantom merge we failed to publish. Anything else means the base is still wedged.
+        const healedBaseSha = (await mergeGit(["rev-parse", base], repoRoot, "rebase", `workspace merge verify ${base} healed after push race`, signal)).stdout;
+        const originContained = Boolean(healedBaseSha) && (await mergeGit(["merge-base", "--is-ancestor", upstreamSha, healedBaseSha], repoRoot, "rebase", `workspace merge verify origin contained in ${base} after rewind`, signal)).ok;
+        const phantomDropped = Boolean(healedBaseSha) && !(await mergeGit(["merge-base", "--is-ancestor", baseTip, healedBaseSha], repoRoot, "rebase", `workspace merge verify phantom dropped from ${base} after rewind`, signal)).ok;
+        if (!originContained || !phantomDropped) {
+          return head({ conflict: true, status: "conflict", error: `rewind of ${base} after push race did not heal (origin ${originContained ? "contained" : "MISSING"}, phantom ${phantomDropped ? "dropped" : "STILL PRESENT"}); escalating rather than reporting healed (#950)` });
+        }
+        return head({ status: "review_requested", error: push.stderr || `git push to ${remote}/${base} failed` });
+      }
+    }
     pushed = true;
   }