agent-relay-orchestrator 0.119.10 → 0.120.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-orchestrator",
-  "version": "0.119.10",
+  "version": "0.120.0",
   "description": "Agent Relay orchestrator — manages agent lifecycle across hosts",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
   },
   "dependencies": {
     "agent-relay-providers": "0.104.3",
-    "agent-relay-sdk": "0.2.106",
+    "agent-relay-sdk": "0.2.107",
     "callmux": "0.23.0"
   },
   "devDependencies": {

package/src/config.ts

@@ -93,6 +93,8 @@ export const TERMINAL_COMMAND_TIMEOUT_MS = envNonNegativeMax("AGENT_RELAY_TERMIN
 export const TERMINAL_GROUND_WAIT_MAX_MS = envNonNegativeMax("AGENT_RELAY_TERMINAL_GROUND_WAIT_MAX_MS", 500, 0);
 export const TERMINAL_BACKFILL_SCROLLBACK_LINES = envNonNegativeMax("AGENT_RELAY_TERMINAL_BACKFILL_SCROLLBACK", 1000, 0);
 export const TERMINAL_DEBUG = process.env.AGENT_RELAY_TERMINAL_DEBUG === "1";
+export const SCHEDULER_COMMAND_MAX_CONCURRENT = envNonNegativeMax("AGENT_RELAY_SCHEDULER_COMMAND_MAX_CONCURRENT", 4, 1);
+export const SCHEDULER_COMMAND_MAX_OUTPUT_BYTES = envNonNegativeMax("AGENT_RELAY_SCHEDULER_COMMAND_MAX_OUTPUT_BYTES", 256 * 1024, 4096);
 
 interface RawConfig {
   id?: string;

package/src/control.ts

@@ -1,6 +1,6 @@
-import { errMessage, isRecord, normalizeAgentLifecycle, normalizeWorkspaceMode, Semaphore } from "agent-relay-sdk";
+import { errMessage, isPathWithinBase, isRecord, normalizeAgentLifecycle, normalizeWorkspaceMode, Semaphore } from "agent-relay-sdk";
 import { getAllManifests, getManifest } from "agent-relay-providers";
-import type { OrchestratorConfig } from "./config";
+import { SCHEDULER_COMMAND_MAX_CONCURRENT, SCHEDULER_COMMAND_MAX_OUTPUT_BYTES, type OrchestratorConfig } from "./config";
 import type { ManagedAgentReport, RelayClient, RelayCommand } from "./relay";
 import { handleSelfUpgrade } from "./self-upgrade";
 import { readLocalProviderConfigs } from "./provider-config-migration";
@@ -9,6 +9,7 @@ import { cleanupWorkspace, discardRecoveryBranch, idleRefreshWorktree, mergeWork
 import { withMergePhaseTimeout } from "./workspace-probe/merge-timeouts";
 import { armWorkspacePrAutoMerge, mergeWorkspacePr, refreshWorkspacePrBranch } from "./workspace-pr";
 import type { WorkspaceMergeResult } from "agent-relay-sdk";
+import { execProcess } from "./process";
 
 // #638 — settle a `workspace.merge` command on whether it made progress, not on whether
 // the merge function threw. Every no-progress outcome (origin moved ahead, an unpredicted
@@ -64,6 +65,22 @@ export function resolveSpawnRegistrationTimeoutMs(env: NodeJS.ProcessEnv = proce
   return parsed;
 }
 
+export function resolveMaxConcurrentSchedulerCommands(env: NodeJS.ProcessEnv = process.env): number {
+  const raw = env.AGENT_RELAY_SCHEDULER_COMMAND_MAX_CONCURRENT;
+  if (raw === undefined || raw.trim() === "") return SCHEDULER_COMMAND_MAX_CONCURRENT;
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed) || parsed < 1) return SCHEDULER_COMMAND_MAX_CONCURRENT;
+  return parsed;
+}
+
+export function resolveSchedulerCommandMaxOutputBytes(env: NodeJS.ProcessEnv = process.env): number {
+  const raw = env.AGENT_RELAY_SCHEDULER_COMMAND_MAX_OUTPUT_BYTES;
+  if (raw === undefined || raw.trim() === "") return SCHEDULER_COMMAND_MAX_OUTPUT_BYTES;
+  const parsed = Number(raw);
+  if (!Number.isSafeInteger(parsed) || parsed < 4096) return SCHEDULER_COMMAND_MAX_OUTPUT_BYTES;
+  return parsed;
+}
+
 /** Awaits a spawn slot until the child registers, or resolves false at the fail-safe deadline. */
 export type WaitForRegistration = (agent: ManagedAgentReport, timeoutMs: number) => Promise<boolean>;
 
@@ -98,6 +115,8 @@ interface ControlHandlerDeps {
   registrationTimeoutMs?: number;
   // Injectable stop dispatch — production uses tmux/system process teardown.
   stopSession?: typeof stopSession;
+  maxConcurrentSchedulerCommands?: number;
+  schedulerCommandMaxOutputBytes?: number;
 }
 
 export function createControlHandler(
@@ -113,10 +132,13 @@ export function createControlHandler(
   const spawnSlots = new Semaphore(deps.maxConcurrentSpawns ?? resolveMaxConcurrentSpawns());
   const waitForRegistration = deps.waitForRegistration ?? waitForManagedRegistration;
   const registrationTimeoutMs = deps.registrationTimeoutMs ?? resolveSpawnRegistrationTimeoutMs();
+  const schedulerCommandSlots = new Semaphore(deps.maxConcurrentSchedulerCommands ?? resolveMaxConcurrentSchedulerCommands());
+  const schedulerCommandMaxOutputBytes = deps.schedulerCommandMaxOutputBytes ?? resolveSchedulerCommandMaxOutputBytes();
   // Backgrounded spawn tasks: each is claimed synchronously (status → accepted)
   // then runs to completion off the poll tick, holding a slot across the child's
   // registration window. Tracked so tests/shutdown can observe and settle them.
   const backgroundSpawns = new Set<Promise<void>>();
+  const backgroundCommands = new Set<Promise<void>>();
 
   async function spawnManagedAgent(opts: SpawnOptions, action = "Spawned"): Promise<ManagedAgentReport> {
     const agent = await dispatchSpawn(opts, config);
@@ -272,9 +294,69 @@ export function createControlHandler(
     // per-host cap (see dispatchSpawnCommand). Every other command is handled
     // inline, synchronously with the poll tick, exactly as before.
     if (command.type === "agent.spawn") return dispatchSpawnCommand(command);
+    if (command.type === "scheduler.command") return dispatchSchedulerCommand(command);
     return handleNonSpawnCommand(command);
   }
 
+  async function dispatchSchedulerCommand(command: RelayCommand): Promise<boolean> {
+    await relay.updateCommand(command.id, "accepted");
+    const startedAt = Date.now();
+    const run = (async () => {
+      await schedulerCommandSlots.acquire();
+      try {
+        await relay.updateCommand(command.id, "running");
+        const commandText = typeof command.params.command === "string" ? command.params.command : "";
+        const cwd = typeof command.params.cwd === "string" ? command.params.cwd : config.baseDir;
+        if (!commandText.trim()) throw new Error("scheduler.command missing command");
+        if (!isPathWithinBase(cwd, config.baseDir)) throw new Error("scheduler.command cwd escapes orchestrator baseDir");
+        const timeoutMs = typeof command.params.timeoutMs === "number" && Number.isSafeInteger(command.params.timeoutMs) && command.params.timeoutMs > 0
+          ? command.params.timeoutMs
+          : undefined;
+        const env = isRecord(command.params.env)
+          ? Object.fromEntries(Object.entries(command.params.env).filter((entry): entry is [string, string] => typeof entry[1] === "string"))
+          : undefined;
+        const result = await execProcess(["bash", "-lc", commandText], {
+          cwd,
+          env: { ...process.env, ...(env ?? {}) },
+          timeoutMs,
+          timeoutLabel: `scheduler command ${command.id}`,
+          trimStdout: false,
+          trimStderr: false,
+          maxOutputBytes: schedulerCommandMaxOutputBytes,
+          // #968 hole 2 — reap the whole tree on every exit path so a backgrounded/daemonized
+          // child (e.g. `setsid … &`) can't survive after the command returns.
+          reapProcessGroup: true,
+        });
+        const finishedAt = Date.now();
+        await relay.updateCommand(command.id, result.ok ? "succeeded" : result.timedOut ? "timed_out" : "failed", {
+          command: commandText,
+          cwd,
+          startedAt,
+          finishedAt,
+          durationMs: finishedAt - startedAt,
+          exitCode: result.exitCode,
+          success: result.ok,
+          timedOut: result.timedOut === true,
+          stdoutTail: result.stdout,
+          stderrTail: result.stderr,
+          outputTruncated: result.outputTruncated === true,
+          outputLimitExceeded: result.outputLimitExceeded === true,
+        }, result.ok ? undefined : result.stderr || `command exited ${result.exitCode ?? "without code"}`);
+      } catch (error) {
+        await relay.updateCommand(command.id, "failed", {
+          startedAt,
+          finishedAt: Date.now(),
+          durationMs: Date.now() - startedAt,
+        }, errMessage(error));
+      } finally {
+        schedulerCommandSlots.release();
+      }
+    })();
+    backgroundCommands.add(run);
+    run.finally(() => backgroundCommands.delete(run));
+    return true;
+  }
+
   async function handleNonSpawnCommand(command: RelayCommand): Promise<boolean> {
     await relay.updateCommand(command.id, "accepted");
     await relay.updateCommand(command.id, "running");

package/src/process.ts

@@ -1,9 +1,14 @@
+import { mkdirSync, readFileSync, rmdirSync, writeFileSync } from "node:fs";
+import { isPidAlive, killPid, processTreePids, waitForPidsExit } from "agent-relay-sdk/process-utils";
+
 export interface ExecResult {
   ok: boolean;
   exitCode: number | null;
   stdout: string;
   stderr: string;
   timedOut?: boolean;
+  outputTruncated?: boolean;
+  outputLimitExceeded?: boolean;
 }
 
 interface ExecOptions {
@@ -16,31 +21,117 @@ interface ExecOptions {
   timeoutMs?: number;
   timeoutLabel?: string;
   streamDrainGraceMs?: number;
+  maxOutputBytes?: number;
   signal?: AbortSignal;
+  /** Reap ALL descendants on EVERY exit path — normal exit included — not just on timeout/abort
+   * (#968 hole 2). Set for scheduler commands, which may background/daemonize children that would
+   * otherwise outlive the parent shell. On Linux this confines the command to a dedicated cgroup v2
+   * and kills the whole cgroup (bulletproof: a `setsid`-detached child cannot escape cgroup
+   * membership); elsewhere it falls back to a detached process-group + descendant-tree kill. */
+  reapProcessGroup?: boolean;
 }
 
 const DEFAULT_STREAM_DRAIN_GRACE_MS = 1_000;
+const DEFAULT_KILL_GRACE_MS = 1_000;
+
+let commandCgroupSeq = 0;
+
+/** Create a dedicated child cgroup (v2) for a command so its entire process tree — including any
+ * `setsid`-detached grandchildren that reparent away and escape the process group — can be reaped
+ * in one shot via `cgroup.kill`. Returns the new cgroup's absolute path, or undefined when cgroup v2
+ * isn't available/writable (non-Linux, cgroup v1, or missing delegation) so callers fall back. */
+function createCommandCgroup(): string | undefined {
+  if (process.platform !== "linux") return undefined;
+  try {
+    const self = readFileSync("/proc/self/cgroup", "utf8").trim();
+    const idx = self.indexOf("::"); // cgroup v2 line: "0::/rel/path"
+    if (idx < 0) return undefined;
+    const rel = self.slice(idx + 2).trim();
+    const path = `/sys/fs/cgroup${rel}/arcmd-${process.pid}-${Date.now()}-${commandCgroupSeq++}`;
+    mkdirSync(path);
+    return path;
+  } catch {
+    return undefined;
+  }
+}
+
+function cgroupPids(cgPath: string): number[] {
+  try {
+    return readFileSync(`${cgPath}/cgroup.procs`, "utf8")
+      .split("\n")
+      .map((line) => Number(line.trim()))
+      .filter((pid) => Number.isFinite(pid) && pid > 0);
+  } catch {
+    return [];
+  }
+}
+
+/** Kill every process in the command's cgroup and remove the cgroup. `cgroup.kill` SIGKILLs the
+ * whole subtree atomically; we then wait out any lingering PID-table entries and rmdir (retrying
+ * a few times, never hanging) so we don't leak an empty cgroup dir. */
+async function reapCommandCgroup(cgPath: string): Promise<void> {
+  try { writeFileSync(`${cgPath}/cgroup.kill`, "1"); } catch {}
+  await waitForPidsExit(cgroupPids(cgPath), DEFAULT_KILL_GRACE_MS);
+  for (const pid of cgroupPids(cgPath)) killPid(pid, "SIGKILL");
+  for (let attempt = 0; attempt < 5; attempt++) {
+    try { rmdirSync(cgPath); return; } catch {}
+    await sleep(50);
+  }
+}
+
+/** Fallback reaper for hosts without cgroup v2: the command was spawned detached (its own process
+ * group, pgid === proc.pid), so signal the whole group plus any still-living descendants. Reuses the
+ * shared process helpers. NOTE: a `setsid`-detached child escapes the process group entirely — only
+ * the cgroup path above reaps those; this is the best achievable without cgroups. */
+async function reapDetachedProcessGroup(proc: Bun.Subprocess): Promise<void> {
+  try { process.kill(-proc.pid, "SIGTERM"); } catch {}
+  const pids = await processTreePids([proc.pid]).catch(() => [proc.pid]);
+  for (const pid of pids) killPid(pid, "SIGTERM");
+  const all = [proc.pid, ...pids];
+  if (await waitForPidsExit(all, DEFAULT_KILL_GRACE_MS)) return;
+  try { process.kill(-proc.pid, "SIGKILL"); } catch {}
+  for (const pid of all.filter(isPidAlive)) killPid(pid, "SIGKILL");
+}
 
 interface StreamCapture {
   done: Promise<void>;
   text(): string;
+  truncated(): boolean;
+  limitExceeded(): boolean;
   cancel(): void;
 }
 
-function captureStream(stream: ReadableStream<Uint8Array> | undefined): StreamCapture {
-  if (!stream) return { done: Promise.resolve(), text: () => "", cancel: () => {} };
+function captureStream(
+  stream: ReadableStream<Uint8Array> | undefined,
+  options: { maxOutputBytes?: number; onLimitExceeded?: () => void } = {},
+): StreamCapture {
+  if (!stream) return { done: Promise.resolve(), text: () => "", truncated: () => false, limitExceeded: () => false, cancel: () => {} };
   const reader = stream.getReader();
   const decoder = new TextDecoder();
   let output = "";
   let canceled = false;
+  let truncated = false;
+  let limitExceeded = false;
   const done = (async () => {
     try {
       while (!canceled) {
         const chunk = await reader.read();
         if (chunk.done) break;
         output += decoder.decode(chunk.value, { stream: true });
+        if (options.maxOutputBytes && output.length > options.maxOutputBytes) {
+          truncated = true;
+          output = output.slice(output.length - options.maxOutputBytes);
+          if (!limitExceeded) {
+            limitExceeded = true;
+            options.onLimitExceeded?.();
+          }
+        }
       }
       output += decoder.decode();
+      if (options.maxOutputBytes && output.length > options.maxOutputBytes) {
+        truncated = true;
+        output = output.slice(output.length - options.maxOutputBytes);
+      }
     } catch {
       // Intentional cancellation on process timeout or a stuck post-exit pipe.
     } finally {
@@ -50,6 +141,8 @@ function captureStream(stream: ReadableStream<Uint8Array> | undefined): StreamCa
   return {
     done,
     text: () => output,
+    truncated: () => truncated,
+    limitExceeded: () => limitExceeded,
     cancel: () => {
       canceled = true;
       void reader.cancel().catch(() => {});
@@ -74,35 +167,69 @@ function abortMessage(cmd: string[], options: ExecOptions): string {
   return `${label} aborted`;
 }
 
+async function terminateProcessTree(proc: Bun.Subprocess): Promise<void> {
+  const pids = await processTreePids([proc.pid]).catch(() => [proc.pid]);
+  for (const target of pids) killPid(target, "SIGTERM");
+  try { proc.kill("SIGTERM"); } catch {}
+  const exited = await waitForPidsExit(pids, DEFAULT_KILL_GRACE_MS);
+  const alive = exited ? [] : pids.filter(isPidAlive);
+  for (const target of alive) killPid(target, "SIGKILL");
+  if (alive.includes(proc.pid)) {
+    try { proc.kill("SIGKILL"); } catch {}
+  }
+  if (alive.length > 0) await waitForPidsExit(alive, DEFAULT_KILL_GRACE_MS);
+}
+
 export async function execProcess(cmd: string[], options: ExecOptions = {}): Promise<ExecResult> {
   if (options.signal?.aborted) {
     return { ok: false, exitCode: null, stdout: "", stderr: abortMessage(cmd, options) };
   }
-  const proc = Bun.spawn(cmd, {
+  // #968 hole 2 — for reap-on-every-exit commands, confine the whole tree to a dedicated cgroup so a
+  // `setsid`-detached child can't survive the parent. The wrapper joins the cgroup (writes its own
+  // pid to cgroup.procs) BEFORE exec-ing the real command, so every descendant is a member from birth
+  // (race-free); `exec "$0" "$@"` passes the original argv through untouched.
+  const cgroup = options.reapProcessGroup ? createCommandCgroup() : undefined;
+  const spawnCmd = cgroup
+    ? ["sh", "-c", `echo $$ > ${cgroup}/cgroup.procs 2>/dev/null || true; exec "$0" "$@"`, ...cmd]
+    : cmd;
+  const proc = Bun.spawn(spawnCmd, {
     cwd: options.cwd,
     env: options.env,
     stdin: "ignore",
     stdout: options.stdout ?? "pipe",
     stderr: options.stderr ?? "pipe",
+    // Own process group so the fallback reaper can group-signal without touching the orchestrator.
+    ...(options.reapProcessGroup ? { detached: true } : {}),
   });
-  const stdoutCapture = options.stdout === "ignore" ? captureStream(undefined) : captureStream(proc.stdout);
-  const stderrCapture = options.stderr === "ignore" ? captureStream(undefined) : captureStream(proc.stderr);
   let timedOut = false;
   let aborted = false;
+  let outputLimitExceeded = false;
+  let abortStarted = false;
   let timeout: ReturnType<typeof setTimeout> | undefined;
-  let killTimeout: ReturnType<typeof setTimeout> | undefined;
   let timeoutResolve: ((value: null) => void) | undefined;
   const timeoutPromise = new Promise<null>((resolve) => { timeoutResolve = resolve; });
-  const abortProcess = () => {
+  let abortDone: Promise<void> = Promise.resolve();
+  const abortProcess = (killParentImmediately = false) => {
+    if (abortStarted) return;
+    abortStarted = true;
     aborted = true;
-    try { proc.kill("SIGTERM"); } catch {}
-    killTimeout = setTimeout(() => {
-      try { proc.kill("SIGKILL"); } catch {}
-    }, 1_000);
-    killTimeout.unref?.();
-    timeoutResolve?.(null);
+    if (killParentImmediately) {
+      try { proc.kill("SIGTERM"); } catch {}
+    }
+    abortDone = terminateProcessTree(proc).finally(() => timeoutResolve?.(null));
+  };
+  const abortForOutputLimit = () => {
+    outputLimitExceeded = true;
+    abortProcess();
   };
-  options.signal?.addEventListener("abort", abortProcess, { once: true });
+  const stdoutCapture = options.stdout === "ignore"
+    ? captureStream(undefined)
+    : captureStream(proc.stdout, { maxOutputBytes: options.maxOutputBytes, onLimitExceeded: abortForOutputLimit });
+  const stderrCapture = options.stderr === "ignore"
+    ? captureStream(undefined)
+    : captureStream(proc.stderr, { maxOutputBytes: options.maxOutputBytes, onLimitExceeded: abortForOutputLimit });
+  const abortFromSignal = () => abortProcess(true);
+  options.signal?.addEventListener("abort", abortFromSignal, { once: true });
   if (options.timeoutMs && options.timeoutMs > 0) {
     timeout = setTimeout(() => {
       timedOut = true;
@@ -112,10 +239,10 @@ export async function execProcess(cmd: string[], options: ExecOptions = {}): Pro
   }
 
   const exitCode = await (timeout || options.signal ? Promise.race([proc.exited, timeoutPromise]) : proc.exited);
-  options.signal?.removeEventListener("abort", abortProcess);
+  options.signal?.removeEventListener("abort", abortFromSignal);
   if (timeout) clearTimeout(timeout);
-  if (!timedOut && !aborted && killTimeout) clearTimeout(killTimeout);
   if (timedOut || aborted) {
+    await abortDone;
     stdoutCapture.cancel();
     stderrCapture.cancel();
   }
@@ -125,20 +252,32 @@ export async function execProcess(cmd: string[], options: ExecOptions = {}): Pro
   stdoutCapture.cancel();
   stderrCapture.cancel();
 
+  // #968 hole 2 — reap the command's whole process tree on EVERY exit path (normal exit included),
+  // so a backgrounded/daemonized child can't outlive the command. Runs regardless of exit reason.
+  if (options.reapProcessGroup) {
+    if (cgroup) await reapCommandCgroup(cgroup);
+    else await reapDetachedProcessGroup(proc);
+  }
+
   const stdout = stdoutCapture.text();
   let stderr = stderrCapture.text();
   if (timedOut) {
     const msg = timeoutMessage(cmd, options);
     stderr = stderr ? `${stderr}\n${msg}` : msg;
+  } else if (outputLimitExceeded) {
+    const msg = `output exceeded ${options.maxOutputBytes} bytes`;
+    stderr = stderr ? `${stderr}\n${msg}` : msg;
   } else if (aborted) {
     const msg = abortMessage(cmd, options);
     stderr = stderr ? `${stderr}\n${msg}` : msg;
   }
   return {
-    ok: !timedOut && !aborted && exitCode === 0,
+    ok: !timedOut && !aborted && !outputLimitExceeded && exitCode === 0,
     exitCode,
     stdout: options.trimStdout === false ? stdout : stdout.trim(),
     stderr: options.trimStderr === false ? stderr : stderr.trim(),
     ...(timedOut ? { timedOut } : {}),
+    ...(stdoutCapture.truncated() || stderrCapture.truncated() ? { outputTruncated: true } : {}),
+    ...(outputLimitExceeded ? { outputLimitExceeded: true } : {}),
   };
 }

package/src/shared-callmux.ts

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-import { errMessage, isRecord } from "agent-relay-sdk";
+import { errMessage, isRecord, SHARED_CALLMUX_TOOL_CALL_TIMEOUT_MS } from "agent-relay-sdk";
 import { createListener, type CallmuxConfig, type CreateListenerOptions, type ListenerHealthSnapshot, type ProgrammaticListener } from "callmux";
 import type { OrchestratorConfig } from "./config";
 import { agentRelayHome } from "./config";
@@ -78,14 +78,18 @@ export function sharedMcpListenerUrl(): string {
 export function writeSharedCallmuxConfig(opts: Pick<SharedCallmuxOptions, "configPath" | "sourceConfigPath"> & { registryServers?: CallmuxConfig["servers"] }): CallmuxConfig {
   const source = readJsonObject(opts.sourceConfigPath);
   const sourceServers = isRecord(source.servers) ? source.servers : {};
-  const servers = opts.registryServers && Object.keys(opts.registryServers).length > 0
+  const rawServers = opts.registryServers && Object.keys(opts.registryServers).length > 0
     ? cloneServers(opts.registryServers)
     : fallbackSharedServers(sourceServers);
+  const servers = withSharedCallTimeoutFloor(rawServers);
   const generated: CallmuxConfig = {
     servers,
     cacheTtlSeconds: numberFromRecord(source, "cacheTtlSeconds") ?? 10,
     maxConcurrency: numberFromRecord(source, "maxConcurrency") ?? 20,
-    callTimeoutMs: numberFromRecord(source, "callTimeoutMs") ?? 180_000,
+    callTimeoutMs: Math.max(
+      numberFromRecord(source, "callTimeoutMs") ?? SHARED_CALLMUX_TOOL_CALL_TIMEOUT_MS,
+      SHARED_CALLMUX_TOOL_CALL_TIMEOUT_MS,
+    ),
     outputFormat: outputFormatFromRecord(source, "outputFormat") ?? "auto",
     // Relay workers consume only proxied tokenlean+github tools; suppress callmux meta-tools.
     exposeMetaTools: false,
@@ -305,6 +309,16 @@ function fallbackSharedServers(sourceServers: Record<string, unknown>): CallmuxC
   };
 }
 
+function withSharedCallTimeoutFloor(servers: CallmuxConfig["servers"]): CallmuxConfig["servers"] {
+  return Object.fromEntries(Object.entries(servers).map(([name, server]) => {
+    const callTimeoutMs = Math.max(
+      server.callTimeoutMs ?? SHARED_CALLMUX_TOOL_CALL_TIMEOUT_MS,
+      SHARED_CALLMUX_TOOL_CALL_TIMEOUT_MS,
+    );
+    return [name, { ...server, callTimeoutMs }];
+  }));
+}
+
 function callmuxServerFromProvisioningVariant(value: unknown): { name: string; server: CallmuxConfig["servers"][string] } | null {
   if (!isRecord(value) || value.enabled === false || value.approvalStatus === "pending" || value.validationStatus === "invalid") return null;
   if (typeof value.name !== "string" || !value.name) return null;
@@ -383,7 +397,7 @@ function defaultGithubServer(): CallmuxConfig["servers"][string] {
     command: "github-mcp-server",
     args: ["stdio"],
     prefix: "gh",
-    callTimeoutMs: 60_000,
+    callTimeoutMs: SHARED_CALLMUX_TOOL_CALL_TIMEOUT_MS,
     tools: GITHUB_TOOLS,
     cachePolicy: { allowTools: ["issue_read", "list_issues", "search_issues", "search_code", "get_file_contents"] },
   };

package/src/workspace-probe/merge.ts

@@ -7,7 +7,7 @@ import { prMergedState } from "../workspace-pr";
 import { deleteBranchIfSafe, owningRepoRoot } from "./cleanup";
 import { refreshWorkspaceDeps } from "./deps";
 import { type LandGatesResult } from "./land-gates-runner";
-import { populateMergeState, resolveBranchRef, syncBaseFromOrigin, workspaceGitState } from "./git-state";
+import { populateMergeState, resolveBranchRef, syncBaseFromOrigin, upstreamRef, workspaceGitState } from "./git-state";
 import { type MergePhase, mergePhaseTimeoutMs, throwIfMergeAborted, withMergePhaseTimeout } from "./merge-timeouts";
 import { nextBranchName } from "./names";
 import { parseWorktrees, shortBranch } from "./parse";
@@ -438,6 +438,66 @@ export async function mergeWorkspace(input: WorkspaceMergeInput): Promise<Worksp
  *    agent with no checkout once cleanup reclaims the worktree (#327).
  *  - Gone owner: reclaim the spent worktree/branch and go terminal `merged`.
  */
+/**
+ * #950 — before a no-op land goes terminal `merged` (or recycles a live owner), verify the
+ * branch's landed work is actually on the UPSTREAM, not just on local base. A lost push race
+ * (see {@link mergeRebaseFf}) can leave a merge commit on local base that never reached origin;
+ * preview then fires `noop` because the branch is an ancestor of local base — and the old path
+ * blessed it as `merged` while origin never got it, diverging local base and wedging the repo.
+ * Outcomes:
+ *   - "clean":     no upstream / push disabled, or local base is already contained in origin
+ *                  (nothing unpublished) — safe to finalize as-is.
+ *   - "published": local base was cleanly AHEAD of origin (carried the unpushed land) and we
+ *                  fast-forward-pushed it — now safe to finalize, with pushed=true.
+ *   - "refuse":    local base DIVERGED from origin (unpushed commits that can't fast-forward),
+ *                  or the publish push failed — must NOT finalize unpushed work as merged.
+ */
+async function publishNoopBaseIfStranded(
+  input: WorkspaceMergeInput,
+  worktreePath: string,
+  repoRoot: string,
+  base: string | undefined,
+  signal?: AbortSignal,
+): Promise<"clean" | "published" | "refuse"> {
+  if (!base) return "clean";
+  if (input.push === false || !workspacePushEnabled()) return "clean";
+  const upstream = await upstreamRef(worktreePath, base, signal);
+  if (!upstream) return "clean";
+  const slash = upstream.indexOf("/");
+  const remote = slash > 0 ? upstream.slice(0, slash) : undefined;
+  if (!remote) return "clean";
+  throwIfMergeAborted(signal);
+  await mergeGit(["fetch", remote, base], worktreePath, "rebase", `workspace merge fetch ${remote}/${base} before noop finalize`, signal);
+  const upstreamSha = (await mergeGit(["rev-parse", "--verify", upstream], worktreePath, "rebase", `workspace merge resolve ${upstream} before noop finalize`, signal)).stdout;
+  const baseSha = (await mergeGit(["rev-parse", "--verify", base], worktreePath, "rebase", `workspace merge resolve ${base} before noop finalize`, signal)).stdout;
+  if (!upstreamSha || !baseSha || baseSha === upstreamSha) return "clean";
+  // Local base fully contained in origin (behind/equal) — the land is already published.
+  if ((await mergeGit(["merge-base", "--is-ancestor", baseSha, upstreamSha], worktreePath, "rebase", `workspace merge check ${base} contained in ${upstream}`, signal)).ok) return "clean";
+  // Local base strictly ahead of origin — publish the stranded land with a fast-forward push.
+  if ((await mergeGit(["merge-base", "--is-ancestor", upstreamSha, baseSha], worktreePath, "rebase", `workspace merge check ${base} ahead of ${upstream}`, signal)).ok) {
+    throwIfMergeAborted(signal);
+    const push = await mergeGit(["push", remote, `${base}:${base}`], worktreePath, "rebase", `workspace merge publish stranded ${base} to ${remote}`, signal);
+    return push.ok ? "published" : "refuse";
+  }
+  // Diverged: unpushed local commits AND origin has commits we lack. Left as-is, local base stays
+  // diverged and EVERY later real land hits the divergence refusal forever — a repo-wide host wedge
+  // (#950 follow-up SHOULD-FIX 3). Attempt an auto-reconcile: replay the unpushed commits onto fresh
+  // origin in a clean base checkout and publish, converting the divergence into a clean, published
+  // state. Content is preserved (SHAs of the reconciled commits change — a merge replays as its
+  // first-parent delta); this only fires on an already-wedged base, so a content-faithful publish
+  // beats a permanent refusal. If it can't be done cleanly/safely, refuse — the caller escalates to
+  // a CLEAR conflict (steward) rather than a silent perpetual refusal.
+  const localOnly = (await mergeGit(["rev-list", "--reverse", "--first-parent", `${upstreamSha}..${baseSha}`], worktreePath, "rebase", `workspace merge scan unpushed ${base} commits before reconcile`, signal)).stdout.split("\n").filter(Boolean);
+  if (localOnly.length === 0) return "refuse";
+  const baseWorktree = await worktreeForBranch(repoRoot, base, signal);
+  if (!baseWorktree || baseWorktree.dirty) return "refuse";
+  const replay = await replayCommitsOntoUpstream(baseWorktree.path, upstreamSha, localOnly, baseSha, base, signal);
+  if (!replay.ok) return "refuse";
+  throwIfMergeAborted(signal);
+  const push = await mergeGit(["push", remote, `${base}:${base}`], baseWorktree.path, "rebase", `workspace merge publish reconciled ${base} to ${remote}`, signal);
+  return push.ok ? "published" : "refuse";
+}
+
 async function resolveNoopMerge(
   input: WorkspaceMergeInput,
   worktreePath: string,
@@ -453,6 +513,16 @@ async function resolveNoopMerge(
   signal?: AbortSignal,
 ): Promise<WorkspaceMergeResult> {
   throwIfMergeAborted(signal);
+  // #950 — a `noop` preview means the branch is already an ancestor of LOCAL base, but that base
+  // may carry a merge commit a lost push race never published. Verify it's on origin (publishing
+  // it if we cleanly can) before going terminal — never bless unpushed work as `merged`.
+  const publishState = await publishNoopBaseIfStranded(input, worktreePath, repoRoot, preview.baseRef, signal);
+  if (publishState === "refuse") {
+    // Diverged and could not auto-reconcile (SHOULD-FIX 3): escalate to a CLEAR steward-actionable
+    // state instead of a benign review_requested that would perpetually re-refuse and wedge the repo.
+    return head({ conflict: true, status: "conflict", error: `local ${preview.baseRef ?? "base"} carries unpushed landed work that diverged from origin and could not be auto-reconciled; a steward must reconcile and land it (#950)` });
+  }
+  const pushedStranded = publishState === "published" ? { pushed: true } : {};
   const ownerRepo = branch ? await owningRepoRoot(worktreePath, repoRoot) : repoRoot;
   // Live owner (#327): recycle-to-continue instead of bricking the session.
   if (input.deleteBranch === false) {
@@ -474,11 +544,11 @@ async function resolveNoopMerge(
         const reportDeps = depsRefresh.refreshed || depsRefresh.stale || depsRefresh.error;
         // merged:false → no `branch.landed` notice (nothing landed); newBranch makes the
         // relay repoint the row and return it to `active` rather than terminal `merged`.
-        return head({ merged: false, noop: true, status: "active", baseSha, worktreeRemoved: false, branch: fresh, newBranch: fresh, ...deleteResult, ...(reportDeps ? { depsRefresh } : {}), error: undefined });
+        return head({ merged: false, noop: true, status: "active", baseSha, worktreeRemoved: false, branch: fresh, newBranch: fresh, ...deleteResult, ...(reportDeps ? { depsRefresh } : {}), ...pushedStranded, error: undefined });
       }
     }
     // No base or checkout failed — stay live on the current branch, don't strand at `merged`.
-    return head({ merged: false, noop: true, status: "active", worktreeRemoved: false, branchDeleted: false, error: undefined });
+    return head({ merged: false, noop: true, status: "active", worktreeRemoved: false, branchDeleted: false, ...pushedStranded, error: undefined });
   }
   // Owner is gone — reclaim the spent worktree/branch and go terminal.
   if (branch) {
@@ -486,9 +556,9 @@ async function resolveNoopMerge(
     const removed = await mergeGit(["worktree", "remove", "--force", worktreePath], ownerRepo, "cleanup", "workspace merge remove noop worktree", signal);
     const worktreeRemoved = removed.ok;
     const deleteResult = worktreeRemoved ? await deleteBranchIfSafe(ownerRepo, branch, preview.baseRef, undefined, signal) : { branchDeleted: false };
-    return head({ status: "merged", noop: true, worktreeRemoved, ...deleteResult, error: undefined });
+    return head({ status: "merged", noop: true, worktreeRemoved, ...deleteResult, ...pushedStranded, error: undefined });
   }
-  return head({ status: "merged", noop: true, error: undefined });
+  return head({ status: "merged", noop: true, ...pushedStranded, error: undefined });
 }
 
 async function mergePr(
@@ -660,6 +730,145 @@ async function syncLocalBaseToUpstream(
   return { ok: true, baseSync };
 }
 
+/**
+ * Restore `baseWorktreePath` to `restoreSha` — the PRE-replay snapshot that still carries the
+ * preserved local-only commits — after an aborted/failed replay (#950). Runs its git ops WITHOUT
+ * the merge signal on purpose: the replay reset already moved base to origin, so the preserved work
+ * survives ONLY in `restoreSha`; if this cleanup reused the (possibly-aborted) merge signal,
+ * `mergeGit` would rethrow immediately on the aborted signal (see its `throwIfMergeAborted` guard)
+ * and SKIP the restoration, stranding base half-reset at origin with the work dropped — the exact
+ * data loss a cancellation must not cause. Clears any in-progress cherry-pick, hard-resets to
+ * `restoreSha`, then VERIFIES HEAD actually landed on it. Returns whether the restore is PROVEN, so
+ * the caller can escalate a hard conflict when it cannot confirm the base is safe (never assume).
+ */
+async function restoreBaseWorktreeToSnapshot(baseWorktreePath: string, restoreSha: string, base: string): Promise<boolean> {
+  try {
+    // No signal: this must run to completion even under an aborted/timed-out merge.
+    await mergeGit(["cherry-pick", "--abort"], baseWorktreePath, "cleanup", `workspace merge abort in-progress replay of ${base}`);
+    const reset = await mergeGit(["reset", "--hard", restoreSha], baseWorktreePath, "cleanup", `workspace merge restore ${base} to pre-replay snapshot`);
+    if (!reset.ok) return false;
+    const head = (await mergeGit(["rev-parse", "HEAD"], baseWorktreePath, "cleanup", `workspace merge verify ${base} restored to snapshot`)).stdout.trim();
+    return head !== "" && head === restoreSha.trim();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Replay `commits` (oldest-first) onto `upstreamSha` in a CLEAN base worktree via cherry-pick, so
+ * unpushed local commits that can no longer fast-forward are PRESERVED (their content re-lands on
+ * fresh origin) instead of being discarded by a hard reset (#950). Merge commits replay as their
+ * first-parent delta (`-m 1`). Commits are attributed to the relay identity like the no-ff land, so
+ * a base checkout without a configured git identity can still replay.
+ *
+ * ABORT-SAFE (#950 review): the reset-to-origin runs BEFORE the replay, so a merge cancellation /
+ * total-timeout firing after it would leave base at `upstreamSha` with the preserved commits gone.
+ * The whole replay therefore runs inside a try; on ANY failure OR abort we restore `restoreSha` with
+ * a FRESH (non-aborted) signal and VERIFY the restore landed. If restoration cannot be PROVEN we
+ * return an explicit `conflict` so the caller escalates to a steward rather than reporting a benign
+ * state over a half-reset base. The caller escalates for a manual/steward reconcile either way.
+ */
+async function replayCommitsOntoUpstream(
+  baseWorktreePath: string,
+  upstreamSha: string,
+  commits: string[],
+  restoreSha: string,
+  base: string,
+  signal?: AbortSignal,
+): Promise<{ ok: true } | { ok: false; conflict?: boolean; error: string }> {
+  let failure: string | undefined;
+  try {
+    const reset = await mergeGit(["reset", "--hard", upstreamSha], baseWorktreePath, "rebase", `workspace merge rewind ${base} to origin before replay`, signal);
+    if (!reset.ok) {
+      failure = reset.stderr || `failed to rewind ${base} to origin before replaying unpushed commits`;
+    } else {
+      for (const sha of commits) {
+        throwIfMergeAborted(signal);
+        const parents = (await mergeGit(["rev-list", "--parents", "-n", "1", sha], baseWorktreePath, "rebase", `workspace merge inspect ${sha} parents before replay`, signal)).stdout.split(/\s+/).filter(Boolean);
+        const pickArgs = parents.length > 2
+          ? ["-c", `user.name=${LAND_COMMITTER.name}`, "-c", `user.email=${LAND_COMMITTER.email}`, "cherry-pick", "-m", "1", sha]
+          : ["-c", `user.name=${LAND_COMMITTER.name}`, "-c", `user.email=${LAND_COMMITTER.email}`, "cherry-pick", sha];
+        const pick = await mergeGit(pickArgs, baseWorktreePath, "rebase", `workspace merge replay unpushed ${sha} onto origin`, signal);
+        if (!pick.ok) {
+          failure = `cannot cleanly replay unpushed ${base} commit ${sha.slice(0, 9)} onto origin; needs manual reconcile (#950)`;
+          break;
+        }
+      }
+    }
+  } catch (err) {
+    // Abort / total-timeout / unexpected throw mid-replay — base may be half-reset at origin.
+    failure = `replay of unpushed ${base} commits interrupted before completion (${errMessage(err)}); restoring ${base} (#950)`;
+  }
+
+  if (!failure) return { ok: true };
+
+  // Restore the pre-replay snapshot (still holding the preserved commits) with a fresh signal, then
+  // PROVE it landed. If we cannot, the base may be stranded at origin with the work dropped — a hard
+  // conflict for a steward, never a silent half-reset.
+  const restored = await restoreBaseWorktreeToSnapshot(baseWorktreePath, restoreSha, base);
+  if (!restored) {
+    return { ok: false, conflict: true, error: `${failure}; and could not restore ${base} to its pre-replay snapshot ${restoreSha.slice(0, 9)} — base may be left reset to origin with unpushed work dropped; escalating to steward (#950)` };
+  }
+  return { ok: false, error: failure };
+}
+
+/**
+ * Undo a base-ref advance whose publish lost a push race (#950). The merge commit is only on the
+ * LOCAL base and origin moved past us, so it can no longer fast-forward — stranding it would
+ * diverge local base from origin and wedge every later land (preview would see the branch as an
+ * ancestor of local base → noop → terminal `merged` for work never published). Rewind local base
+ * to the fetched origin tip so local == origin: no phantom merge, no divergence.
+ *
+ * MUST-FIX (#950 review): local base may carry PRE-EXISTING unpushed commits that are NOT the merge
+ * we just created (e.g. work stranded by an EARLIER push race). Committed work isn't dirty, so the
+ * clean-worktree guard doesn't catch it — a blind hard reset to origin would DISCARD it. So compute
+ * the local-only commits on the PRE-land base tip (`preLandBaseSha`, which excludes the merge we're
+ * intentionally dropping); if there are none, rewind to origin as before; if there are some, PRESERVE
+ * them by replaying onto fresh origin (a clean worktree is required to do this safely — otherwise
+ * REFUSE and surface for a steward, never reset over the unpushed work). Returns an explicit
+ * success/failure so the caller can VERIFY the base actually healed before reporting a recoverable
+ * state (a failed rollback must not masquerade as healed).
+ */
+async function rewindBaseAfterPushRace(
+  repoRoot: string,
+  base: string,
+  advancedBaseTip: string,
+  preLandBaseSha: string | undefined,
+  upstreamSha: string,
+  baseWorktree: { path: string; dirty: boolean } | undefined,
+  dirtyBefore: Set<string> | undefined,
+  signal?: AbortSignal,
+): Promise<{ ok: true } | { ok: false; conflict?: boolean; error: string }> {
+  // Commits on the PRE-land base tip that origin lacks — pre-existing unpushed work, NOT the merge
+  // we just made (that lives only on advancedBaseTip). These must survive the rewind.
+  // `--first-parent` walks base's MAINLINE (the sequence of lands): each merge replays once as its
+  // first-parent delta (`-m 1`) instead of also re-applying the branch commits it already contains.
+  const localOnly = preLandBaseSha
+    ? (await mergeGit(["rev-list", "--reverse", "--first-parent", `${upstreamSha}..${preLandBaseSha}`], repoRoot, "rebase", `workspace merge scan unpushed ${base} commits before rewind`, signal)).stdout.split("\n").filter(Boolean)
+    : [];
+
+  if (localOnly.length === 0) {
+    // Nothing but the phantom merge to drop — safe to rewind straight to origin.
+    if (baseWorktree && !baseWorktree.dirty) {
+      const reset = await mergeGit(["reset", "--hard", upstreamSha], baseWorktree.path, "rebase", `workspace merge rewind ${base} to ${upstreamSha} after push race`, signal);
+      if (!reset.ok) return { ok: false, error: reset.stderr || `failed to rewind ${base} worktree to origin after push race` };
+      return { ok: true };
+    }
+    const update = await mergeGit(["update-ref", `refs/heads/${base}`, upstreamSha, advancedBaseTip], repoRoot, "rebase", `workspace merge rewind ${base} ref after push race`, signal);
+    if (!update.ok) return { ok: false, error: update.stderr || `failed to rewind ${base} ref to origin after push race` };
+    if (baseWorktree?.dirty && dirtyBefore) await syncDirtyBaseWorktreeAfterRefAdvance(base, baseWorktree, advancedBaseTip, upstreamSha, dirtyBefore, signal);
+    return { ok: true };
+  }
+
+  // Pre-existing unpushed commits present. Replaying requires a CLEAN base checkout; without one we
+  // refuse rather than risk discarding committed work — the branch and the unpushed commits both
+  // stay put and a steward reconciles.
+  if (!baseWorktree || baseWorktree.dirty) {
+    return { ok: false, error: `local ${base} carries ${localOnly.length} unpushed commit(s) not on origin and its checkout is ${baseWorktree ? "dirty" : "absent"}; refusing to rewind (would discard committed work) — needs manual/steward reconcile (#950)` };
+  }
+  return await replayCommitsOntoUpstream(baseWorktree.path, upstreamSha, localOnly, advancedBaseTip, base, signal);
+}
+
 async function mergeRebaseFf(
   input: WorkspaceMergeInput,
   worktreePath: string,
@@ -782,6 +991,10 @@ async function mergeRebaseFf(
   // land: fall through to ref-plumbing (update-ref / synthesized no-ff merge) below, then
   // best-effort sync clean landed paths in the dirty checkout while preserving WIP (#681).
   let baseTip = headSha;
+  // Snapshot base's PRE-advance tip so a lost-push-race rewind can tell the merge we're about to
+  // create (which it should drop) apart from any PRE-EXISTING unpushed commits on base (which it
+  // must PRESERVE, not hard-reset over) — #950 data-loss guard.
+  const preLandBaseSha = (await mergeGit(["rev-parse", base], repoRoot, "rebase", `workspace merge snapshot ${base} tip before advance`, signal)).stdout || undefined;
   throwIfMergeAborted(signal);
   const baseWorktree = await worktreeForBranch(repoRoot, base, signal);
   const dirtyBasePathsBefore = baseWorktree?.dirty ? await dirtyPathSet(baseWorktree.path, signal) : undefined;
@@ -830,14 +1043,54 @@ async function mergeRebaseFf(
   const baseWorktreeSyncField = baseSync && !baseSync.reconciled ? { baseWorktreeSync: baseSync } : {};
   if (baseSync && !baseSync.reconciled && baseWorktree) logBaseWorktreeStrand(base, baseWorktree.path, baseSync);
 
-  // Publish the advanced base so local and origin converge (#190). We verified
-  // origin was an ancestor of base above, so this is a fast-forward; a failure
-  // means origin raced us — surface it instead of claiming an unpublished land.
+  // Publish the advanced base so local and origin converge (#190). We verified origin was an
+  // ancestor of base above, so this is a fast-forward — but that check ran BEFORE the base
+  // advance, and origin can move in the fetch→push window (#950: a sibling host landing the same
+  // origin, CI, a human push). If it did, this push is a non-ff and is rejected AFTER local base
+  // already carries the merge commit. Leaving the merge stranded on local base is the historical
+  // multi-host land wedge: local base diverges from origin, later previews see the branch as an
+  // ancestor of local base → noop → terminal `merged` for work never published, and every land
+  // after refuses on divergence. So on a push failure, re-fetch and try to publish in the SAME
+  // execution; if origin genuinely moved past us, rewind local base to the fresh origin tip
+  // (local == origin, no phantom, no divergence) and bounce to review_requested for the next scan.
   let pushed = false;
   if (upstream && remote && pushEnabled) {
     throwIfMergeAborted(signal);
-    const push = await mergeGit(["push", remote, `${base}:${base}`], worktreePath, "rebase", `workspace merge push ${base} to ${remote}`, signal);
-    if (!push.ok) return head({ status: "review_requested", mergedSha: headSha, error: push.stderr || `git push to ${remote}/${base} failed` });
+    let push = await mergeGit(["push", remote, `${base}:${base}`], worktreePath, "rebase", `workspace merge push ${base} to ${remote}`, signal);
+    if (!push.ok) {
+      throwIfMergeAborted(signal);
+      const refetch = await mergeGit(["fetch", remote, base], worktreePath, "rebase", `workspace merge re-fetch ${remote}/${base} after push race`, signal);
+      const upstreamSha = refetch.ok ? (await mergeGit(["rev-parse", "--verify", upstream], worktreePath, "rebase", `workspace merge resolve ${upstream} after push race`, signal)).stdout : "";
+      // Transient loss (a ref lock, or a compatible parallel push): origin is still an ancestor
+      // of our advanced base, so the merge is a clean fast-forward — just re-push it.
+      if (upstreamSha && (await mergeGit(["merge-base", "--is-ancestor", upstreamSha, baseTip], worktreePath, "rebase", "workspace merge check base still ff after push race", signal)).ok) {
+        throwIfMergeAborted(signal);
+        push = await mergeGit(["push", remote, `${base}:${base}`], worktreePath, "rebase", `workspace merge re-push ${base} to ${remote} after race`, signal);
+      }
+      if (!push.ok) {
+        // Origin moved past us — the advanced merge can't fast-forward. Rewind local base to the
+        // fresh origin tip so nothing is stranded (no mergedSha: nothing landed), PRESERVING any
+        // pre-existing unpushed commits (#950 MUST-FIX 1). Then VERIFY the base actually healed
+        // before reporting the retryable review_requested — a failed rollback must surface a HARD
+        // state (conflict → steward), never masquerade as healed (#950 MUST-FIX 2).
+        if (!upstreamSha) {
+          return head({ conflict: true, status: "conflict", error: `push to ${remote}/${base} failed and the fresh origin tip is unresolvable; cannot safely rewind ${base} — escalating (#950)` });
+        }
+        const rewind = await rewindBaseAfterPushRace(repoRoot, base, baseTip, preLandBaseSha, upstreamSha, baseWorktree, dirtyBasePathsBefore, signal);
+        if (!rewind.ok) {
+          return head({ conflict: true, status: "conflict", error: rewind.error });
+        }
+        // Verify, don't assume: local base must now contain the fresh origin tip AND must NOT still
+        // carry the phantom merge we failed to publish. Anything else means the base is still wedged.
+        const healedBaseSha = (await mergeGit(["rev-parse", base], repoRoot, "rebase", `workspace merge verify ${base} healed after push race`, signal)).stdout;
+        const originContained = Boolean(healedBaseSha) && (await mergeGit(["merge-base", "--is-ancestor", upstreamSha, healedBaseSha], repoRoot, "rebase", `workspace merge verify origin contained in ${base} after rewind`, signal)).ok;
+        const phantomDropped = Boolean(healedBaseSha) && !(await mergeGit(["merge-base", "--is-ancestor", baseTip, healedBaseSha], repoRoot, "rebase", `workspace merge verify phantom dropped from ${base} after rewind`, signal)).ok;
+        if (!originContained || !phantomDropped) {
+          return head({ conflict: true, status: "conflict", error: `rewind of ${base} after push race did not heal (origin ${originContained ? "contained" : "MISSING"}, phantom ${phantomDropped ? "dropped" : "STILL PRESENT"}); escalating rather than reporting healed (#950)` });
+        }
+        return head({ status: "review_requested", error: push.stderr || `git push to ${remote}/${base} failed` });
+      }
+    }
     pushed = true;
   }