agent-relay-orchestrator 0.129.10 → 0.129.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-orchestrator",
-  "version": "0.129.10",
+  "version": "0.129.12",
   "description": "Agent Relay orchestrator — manages agent lifecycle across hosts",
   "type": "module",
   "bin": {
@@ -16,8 +16,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "agent-relay-providers": "0.104.5",
-    "agent-relay-sdk": "0.2.128",
+    "agent-relay-providers": "0.104.6",
+    "agent-relay-sdk": "0.2.130",
     "callmux": "0.24.2"
   },
   "devDependencies": {

package/src/api.ts

@@ -3,8 +3,10 @@ import { errMessage, stringValue } from "agent-relay-sdk";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 import type { ServerWebSocket } from "bun";
 import { proxyArtifactRequest } from "./artifact-proxy";
+import { fireAndForget } from "./async-guard";
 import type { OrchestratorConfig } from "./config";
 import type { ProviderProbeCache } from "./provider-probe";
+import type { RegistrationDriver } from "./registration";
 import type { RelayClient } from "./relay";
 import { captureSession, captureSessionMirror, captureTerminal, createTerminalGuest, listSessions, sendTerminalInput, resizeTerminal, stopTerminalGuest, validateTerminalInputData, validateTerminalResize } from "./spawn";
 import { acquireTerminalStream, type TerminalStreamHandle, type TerminalStreamSubscriber } from "./terminal-stream";
@@ -390,7 +392,7 @@ export interface CodexResetConsumer {
   }>;
 }
 
-export function startApiServer(config: OrchestratorConfig, probeCache: ProviderProbeCache, relay?: RelayClient, codexResetConsumer?: CodexResetConsumer): { stop(): void; url: string } {
+export function startApiServer(config: OrchestratorConfig, probeCache: ProviderProbeCache, relay?: RelayClient, codexResetConsumer?: CodexResetConsumer, registration?: Pick<RegistrationDriver, "getHealth">): { stop(): void; url: string } {
   const server = Bun.serve<TerminalSocketData>({
     port: config.apiPort,
     hostname: "0.0.0.0",
@@ -669,7 +671,19 @@ export function startApiServer(config: OrchestratorConfig, probeCache: ProviderP
       }
 
       if (req.method === "GET" && url.pathname === "/api/health") {
-        return json({ status: "ok", ok: true, id: config.id, hostname: config.hostname });
+        // #1676 — surface relay-peer and registration degradation here so a host stuck
+        // re-registering is distinguishable from a healthy one WITHOUT log archaeology
+        // (previously it looked identical, and spawns routed to it burned their full
+        // timeout). `status`/`ok` deliberately stay "ok": this probe is the
+        // Relay-INDEPENDENT local readiness signal the self-upgrade guard gates on, and a
+        // degraded peer must not make this process look un-upgradable. Read `degraded`.
+        const peer = relay?.getHealth();
+        const reg = registration?.getHealth();
+        return json({
+          status: "ok", ok: true, id: config.id, hostname: config.hostname,
+          degraded: Boolean(peer?.degraded || reg?.degraded),
+          ...(peer ? { relay: peer } : {}), ...(reg ? { registration: reg } : {}),
+        });
       }
 
       return error("Not found", 404);
@@ -739,7 +753,7 @@ function startTerminalSocket(ws: TerminalSocket): void {
     // Wait for the client's resize to size the pane before backfilling. Fall back to
     // the pane's current size if no resize arrives (e.g. a non-fitting client).
     ws.data.syncTimer = setTimeout(() => {
-      if (!ws.data.synced) void syncAndBackfill(ws);
+      if (!ws.data.synced) void fireAndForget("Terminal socket sync/backfill", () => syncAndBackfill(ws));
     }, 700);
   } catch (e) {
     ws.send(JSON.stringify({ type: "error", error: errMessage(e) }));
@@ -826,7 +840,7 @@ function handleTerminalSocketMessage(ws: TerminalSocket, data: string | Buffer):
       // First resize sizes the pane and triggers the (size-matched) backfill;
       // later ones just reflow the live stream.
       if (!ws.data.synced) {
-        void syncAndBackfill(ws, cols, rows);
+        void fireAndForget("Terminal socket sync/backfill", () => syncAndBackfill(ws, cols, rows));
       } else {
         ws.data.stream?.resize(cols, rows);
       }
@@ -840,10 +854,10 @@ function handleTerminalSocketMessage(ws: TerminalSocket, data: string | Buffer):
       if (wasPaused && !ws.data.paused && ws.data.synced) {
         const dropped = ws.data.droppedWhilePaused ?? 0;
         ws.data.droppedWhilePaused = 0;
-        if (dropped > 0) void sendBackfill(ws, undefined, undefined, true);
+        if (dropped > 0) void fireAndForget("Terminal socket backfill", () => sendBackfill(ws, undefined, undefined, true));
       }
     } else if (frame.type === "refresh") {
-      if (ws.data.synced) void sendBackfill(ws, undefined, undefined, true);
+      if (ws.data.synced) void fireAndForget("Terminal socket backfill", () => sendBackfill(ws, undefined, undefined, true));
     } else if (frame.type === "interactive") {
       // Read-only watchers must not reflow the shared tmux window (#273); the typist owns
       // sizing. The client reports its interactivity so the stream knows who may resize.

package/src/async-guard.ts

@@ -0,0 +1,42 @@
+// #1676 — orchestrator adapter over the SHARED async guards in `agent-relay-sdk`.
+//
+// The primitives themselves live in `sdk/src/async-guard.ts` because #1665 is the same
+// defect class in the runner: an unguarded `void <promise>` / async timer callback whose
+// rejection reaches the runtime and (in Bun) exits the process. One implementation, two
+// processes. Import from `agent-relay-sdk` directly if you are outside this package.
+//
+// All this file adds is the `[orchestrator]` log prefix, so the daemon's log format is
+// unchanged and call sites pass a bare label ("Relay heartbeat", not the prefix).
+
+import {
+  fireAndForget as sdkFireAndForget,
+  guardedInterval as sdkGuardedInterval,
+  guardedTimeout as sdkGuardedTimeout,
+  installUnhandledRejectionGuard as sdkInstallUnhandledRejectionGuard,
+  type GuardLog,
+} from "agent-relay-sdk";
+
+export { describeFailure, isAbortError, type GuardLog } from "agent-relay-sdk";
+
+const PREFIX = "[orchestrator]";
+
+/** See {@link import("agent-relay-sdk").fireAndForget}. Replaces bare `void promise()`. */
+export function fireAndForget(label: string, work: Promise<unknown> | (() => Promise<unknown> | unknown), log?: GuardLog): Promise<void> {
+  return sdkFireAndForget(`${PREFIX} ${label}`, work, log);
+}
+
+/** See {@link import("agent-relay-sdk").guardedInterval}. Replaces `setInterval(asyncFn, ms)`. */
+export function guardedInterval(label: string, intervalMs: number, fn: () => Promise<unknown> | unknown, log?: GuardLog): ReturnType<typeof setInterval> {
+  return sdkGuardedInterval(`${PREFIX} ${label}`, intervalMs, fn, log);
+}
+
+/** See {@link import("agent-relay-sdk").guardedTimeout}. Replaces `setTimeout(asyncFn, ms)`. */
+export function guardedTimeout(label: string, delayMs: number, fn: () => Promise<unknown> | unknown, log?: GuardLog): ReturnType<typeof setTimeout> {
+  return sdkGuardedTimeout(`${PREFIX} ${label}`, delayMs, fn, log);
+}
+
+/** Install the non-fatal unhandled-rejection backstop. See the SDK function for the
+ *  reasoning behind "log and survive" and why `uncaughtException` stays fatal. */
+export function installUnhandledRejectionGuard(log?: GuardLog): () => void {
+  return sdkInstallUnhandledRejectionGuard(PREFIX, log);
+}

package/src/command-poller.ts

@@ -1,3 +1,4 @@
+import { fireAndForget } from "./async-guard";
 import type { RelayClient, RelayCommand } from "./relay";
 
 interface CommandPollerControl {
@@ -79,7 +80,7 @@ export function createCommandPoller({
     if (stopped) return;
     timer = setTimeout(() => {
       timer = undefined;
-      void runCycle(generation);
+      void fireAndForget("Command poll cycle", () => runCycle(generation), log);
     }, delayMs);
     timer.unref?.();
   }

package/src/command-result-report.ts

@@ -0,0 +1,32 @@
+import type { WorkspaceMergeResult } from "agent-relay-sdk";
+
+// #638 — settle a `workspace.merge` command on whether it made progress, not on whether
+// the merge function threw. Every no-progress outcome (origin moved ahead, an unpredicted
+// replay conflict, a push race) returns merged:false with an `error` set; every genuine
+// land / recycle / noop-resolve / PR-opened leaves `error` undefined. Reporting `succeeded`
+// for an unlanded branch is what let the auto-merge job believe it was progressing and
+// busy-loop the repo's merge lease. Mirrors the pr-merge / pr-arm settle contract.
+export function mergeCommandStatus(result: WorkspaceMergeResult): "succeeded" | "failed" {
+  return result.error ? "failed" : "succeeded";
+}
+
+// Command PATCH bodies are capped at 64 KiB by the relay. A failing full land gate
+// may retain 256 KiB of output for artifact upload, so forwarding it verbatim can
+// reject the *terminal* update and leave expiry to misreport a red gate as a timeout.
+// Keep ordinary output intact; when it will not fit, retain the bounded tail that is
+// already intended for the worker/coordinator notification.
+const MAX_COMMAND_REPORT_CHARS = 60 * 1024;
+
+export function prepareWorkspaceMergeResultForReport(result: WorkspaceMergeResult): WorkspaceMergeResult {
+  const gateFailure = result.gateFailure;
+  if (!gateFailure?.output) return result;
+  const body = JSON.stringify({ status: mergeCommandStatus(result), result, error: result.error });
+  if (body.length <= MAX_COMMAND_REPORT_CHARS) return result;
+  return {
+    ...result,
+    gateFailure: {
+      ...gateFailure,
+      output: gateFailure.outputTail,
+    },
+  };
+}

package/src/config.ts

@@ -32,6 +32,34 @@ export function gitShaFromEnv(): string | undefined {
   return process.env.AGENT_RELAY_GIT_SHA || process.env.GIT_SHA || undefined;
 }
 
+// #1452 — host-side gate for REVIEW-REF PUBLISHING (the origin-mutating half). The host must
+// decide this itself and NOT trust the relay/caller: a queued, replayed, or hand-crafted
+// publish-review command must NOT mutate origin unless THIS host has the feature enabled. The
+// operator sets AGENT_RELAY_REVIEW_PUBLISH=1 on both the relay AND the orchestrator to activate;
+// unset here ⇒ the host no-ops every publish (fail-safe OFF). UNPUBLISH is deliberately NOT
+// gated on this — a ref created during a prior ON era must still be cleanable after it flips OFF.
+export function reviewPublishEnabled(): boolean {
+  return process.env.AGENT_RELAY_REVIEW_PUBLISH === "1";
+}
+
+// #1452 round-3 (H5) — a hard ceiling on every review-ref git op that touches `origin`. Short
+// enough that a dead/hung remote fails fast instead of freezing the teardown/land/command loop that
+// awaits it, generous enough for a real push over a slow link. Clamped to a sane minimum.
+//
+// #1452 round-12 — the ceiling is now LOAD-BEARING, not just a fail-fast bound. The push fence
+// (fencePublishForPush) refreshes the relay's publish-command lease (WORKSPACE_COMMAND_TTL_MS = 40 min)
+// immediately before the push, and its correctness relies on the git-timeout-bounded push completing
+// WITHIN that fresh lease so the TTL sweep can never fire between the fence and the push. Without an
+// UPPER clamp, an operator misconfig (AGENT_RELAY_REVIEW_REF_GIT_TIMEOUT_MS above the lease) would let a
+// single git op outlast the lease → mid-op timeout → the later push races the reconciler's cleanup
+// (also LOW-1's over-cleanup of a live push). The 5-min ceiling keeps "the lease comfortably exceeds
+// every review-ref git op" a STRUCTURAL invariant — even a handful of sequential pre-push ops finish
+// well inside 40 min. A guard test asserts ceiling << lease so the two constants can't silently drift.
+export const REVIEW_REF_GIT_TIMEOUT_CEILING_MS = 5 * 60_000;
+export function reviewRefGitTimeoutMs(): number {
+  return Math.min(REVIEW_REF_GIT_TIMEOUT_CEILING_MS, Math.max(1_000, Number(process.env.AGENT_RELAY_REVIEW_REF_GIT_TIMEOUT_MS) || 15_000));
+}
+
 export function agentRelayHome(): string {
   return process.env.AGENT_RELAY_HOME || join(homedir(), ".agent-relay");
 }
@@ -90,6 +118,25 @@ export function tmuxSocketSweepIntervalMs(): number {
   return envNonNegativeMax("AGENT_RELAY_TMUX_SOCKET_SWEEP_INTERVAL_MS", 10 * 60 * 1000, 60_000);
 }
 
+// #1514 — reaper for orphaned, idle managed tmux sessions (e.g. a headless Claude
+// session wedged at the "Exit anyway / Move to background / Stay" dialog). On by
+// default; set AGENT_RELAY_WEDGED_SESSION_REAP=0 to disable.
+export function wedgedSessionReapEnabled(): boolean {
+  return process.env.AGENT_RELAY_WEDGED_SESSION_REAP !== "0";
+}
+
+export function wedgedSessionReapIntervalMs(): number {
+  return envNonNegativeMax("AGENT_RELAY_WEDGED_SESSION_REAP_INTERVAL_MS", 5 * 60 * 1000, 60_000);
+}
+
+// A session must show no tmux activity for at least this long before an unmanaged
+// session is reaped. Generous so a brief spawn/registration race (record not yet
+// written) or a momentary state-file gap can never clip a healthy session; a real
+// wedge sits idle for hours/days.
+export function wedgedSessionIdleThresholdMs(): number {
+  return envNonNegativeMax("AGENT_RELAY_WEDGED_SESSION_IDLE_THRESHOLD_MS", 30 * 60 * 1000, 5 * 60 * 1000);
+}
+
 export const TERMINAL_FLUSH_MS = envNonNegativeMax("AGENT_RELAY_TERMINAL_FLUSH_MS", 6, 0);
 export const TERMINAL_FLUSH_MAX_BYTES = envNonNegativeMax("AGENT_RELAY_TERMINAL_FLUSH_MAX_BYTES", 65536, 4096);
 export const TERMINAL_BACKPRESSURE_MAX_BYTES = envNonNegativeMax("AGENT_RELAY_TERMINAL_BACKPRESSURE_MAX_BYTES", 8 << 20, 1 << 20);

package/src/control.ts

@@ -1,26 +1,20 @@
 import { errMessage, isPathWithinBase, isRecord, normalizeAgentLifecycle, normalizeWorkspaceMode, Semaphore } from "agent-relay-sdk";
+import { fireAndForget } from "./async-guard";
 import { getAllManifests, getManifest } from "agent-relay-providers";
 import { SCHEDULER_COMMAND_MAX_CONCURRENT, SCHEDULER_COMMAND_MAX_OUTPUT_BYTES, type OrchestratorConfig } from "./config";
+import { checkHostHeadroom, isHostAdmissionDisabled, queuedSpawnFromCommand, resolveAdmissionMaxWaitMs, resolveAdmissionPollMs, resolveMinFreeMemMb, waitForHostHeadroom, type HostHeadroomResult } from "./host-admission";
 import type { ManagedAgentReport, RelayClient, RelayCommand } from "./relay";
+import type { QueuedSpawn } from "agent-relay-sdk";
 import { handleSelfUpgrade } from "./self-upgrade";
 import { readLocalProviderConfigs } from "./provider-config-migration";
 import { findSessionRecord, isSessionAlive, readRunnerInfo, spawnAgent, stopSession, type SpawnOptions } from "./spawn";
-import { cleanupWorkspace, discardRecoveryBranch, idleRefreshWorktree, mergeWorkspace, mergeWorkspacePlainGit, pruneWorktrees, reconcileWorkspace, refreshWorkspaceDeps, workspacesRoot } from "./workspace-probe";
+import { cleanupWorkspace, discardRecoveryBranch, handleReviewRefCommand, idleRefreshWorktree, mergeWorkspace, mergeWorkspacePlainGit, pruneWorktrees, reconcileWorkspace, refreshWorkspaceDeps, runClaimGatedPublishReview, workspacesRoot } from "./workspace-probe";
 import { withMergePhaseTimeout } from "./workspace-probe/merge-timeouts";
 import { withRepoLock } from "./repo-lock";
 import { armWorkspacePrAutoMerge, mergeWorkspacePr, refreshWorkspacePrBranch } from "./workspace-pr";
 import type { WorkspaceMergeResult } from "agent-relay-sdk";
 import { execProcess } from "./process";
-
-// #638 — settle a `workspace.merge` command on whether it made progress, not on whether
-// the merge function threw. Every no-progress outcome (origin moved ahead, an unpredicted
-// replay conflict, a push race) returns merged:false with an `error` set; every genuine
-// land / recycle / noop-resolve / PR-opened leaves `error` undefined. Reporting `succeeded`
-// for an unlanded branch is what let the auto-merge job believe it was progressing and
-// busy-loop the repo's merge lease. Mirrors the pr-merge / pr-arm settle contract.
-export function mergeCommandStatus(result: WorkspaceMergeResult): "succeeded" | "failed" {
-  return result.error ? "failed" : "succeeded";
-}
+import { mergeCommandStatus, prepareWorkspaceMergeResultForReport } from "./command-result-report";
 
 // #1020 (B2) — command types that mutate a physical repo's git refs / worktrees. These take the
 // per-repoRoot lock (see repo-lock.ts) so they can't interleave with the background spawn's
@@ -145,6 +139,12 @@ interface ControlHandlerDeps {
   registrationSettleMs?: number;
   // #1201 F2 — injectable safe-point re-check. Defaults to relay.recheckSelfRestartSafePoint.
   recheckSafePoint?: (agentId: string) => Promise<{ ok: boolean; reason?: string }>;
+  // #893 — injectable host headroom check. Defaults to a real os.freemem()/loadavg() read.
+  // Tests override it to drive the admission gate deterministically.
+  checkHostHeadroom?: () => HostHeadroomResult;
+  hostAdmissionDisabled?: boolean;
+  admissionMaxWaitMs?: number;
+  admissionPollMs?: number;
 }
 
 export function createControlHandler(
@@ -167,6 +167,12 @@ export function createControlHandler(
     return session ? isSessionAlive(session) : false;
   });
   const recheckSafePoint = deps.recheckSafePoint ?? ((agentId: string) => relay.recheckSelfRestartSafePoint(agentId));
+  // #893 — per-host memory/load admission gate. Runs once per spawn, right before launch, so a
+  // spawn that would tip the host into swap-thrash queues (bounded poll/retry) instead of firing.
+  const headroomCheck = deps.checkHostHeadroom ?? checkHostHeadroom;
+  const admissionDisabled = deps.hostAdmissionDisabled ?? isHostAdmissionDisabled();
+  const admissionMaxWaitMs = deps.admissionMaxWaitMs ?? resolveAdmissionMaxWaitMs();
+  const admissionPollMs = deps.admissionPollMs ?? resolveAdmissionPollMs();
   const schedulerCommandSlots = new Semaphore(deps.maxConcurrentSchedulerCommands ?? resolveMaxConcurrentSchedulerCommands());
   const schedulerCommandMaxOutputBytes = deps.schedulerCommandMaxOutputBytes ?? resolveSchedulerCommandMaxOutputBytes();
   // Backgrounded spawn tasks: each is claimed synchronously (status → accepted)
@@ -174,6 +180,18 @@ export function createControlHandler(
   // registration window. Tracked so tests/shutdown can observe and settle them.
   const backgroundSpawns = new Set<Promise<void>>();
   const backgroundCommands = new Set<Promise<void>>();
+  // #1513 — spawns currently held back by the host headroom admission gate, keyed by command id.
+  // Published on the roster PATCH so the dashboard shows a "queued: waiting for host memory" row and
+  // the relay notifies the spawner. Entries are added on the first queued poll and removed once the
+  // spawn is admitted or times out (see the onQueued/onSettled wiring in runSpawnToRegistration).
+  const queuedSpawns = new Map<string, QueuedSpawn>();
+  const minFreeMemMb = resolveMinFreeMemMb();
+
+  function publishQueuedSpawns(): void {
+    // Best-effort — a failed roster write is retried by the reconnect resync (which carries the held
+    // snapshot). Never let a roster-push rejection escape into the backgrounded spawn task.
+    void Promise.resolve(relay.updateManagedAgents(managedAgents, [], [...queuedSpawns.values()])).catch(() => undefined);
+  }
 
   async function spawnManagedAgent(opts: SpawnOptions, action = "Spawned"): Promise<ManagedAgentReport> {
     const agent = await dispatchSpawn(opts, config);
@@ -244,7 +262,7 @@ export function createControlHandler(
       console.error(`[orchestrator] backgrounded spawn task error (swallowed): ${errMessage(error)}`);
     });
     backgroundSpawns.add(task);
-    void task.finally(() => backgroundSpawns.delete(task));
+    void fireAndForget("Background spawn bookkeeping", task.finally(() => backgroundSpawns.delete(task)));
     return true;
   }
 
@@ -260,6 +278,25 @@ export function createControlHandler(
       }
       await relay.updateCommand(command.id, "running");
       try {
+        // #893 — host memory/load admission gate; see host-admission.ts.
+        // #1513 — surface the queued state: publish a "queued for host memory" roster row (and let the
+        // relay notify the spawner) while held back, updating the reason/free-memory as headroom moves,
+        // and clear it once the spawn is admitted or the wait ceiling is exceeded.
+        const queuedAt = Date.now();
+        await waitForHostHeadroom({
+          disabled: admissionDisabled,
+          maxWaitMs: admissionMaxWaitMs,
+          pollMs: admissionPollMs,
+          check: headroomCheck,
+          log: (message) => console.error(`[orchestrator] ${message}`),
+          onQueued: (result) => {
+            queuedSpawns.set(command.id, queuedSpawnFromCommand(command.params, result, queuedAt, minFreeMemMb, admissionMaxWaitMs));
+            publishQueuedSpawns();
+          },
+          onSettled: () => {
+            if (queuedSpawns.delete(command.id)) publishQueuedSpawns();
+          },
+        });
         await spawnAndWaitForRegistration(spawnOptionsFromControl(command.params, config));
         launched = true;
       } catch (error) {
@@ -452,6 +489,11 @@ export function createControlHandler(
   }
 
   async function runNonSpawnCommand(command: RelayCommand): Promise<boolean> {
+    // #1452 round-11 HIGH#1 — the review publish force-pushes to origin, so it is gated on an ATOMIC
+    // claim (helper in workspace-probe/review-ref): push ONLY IF the claim won, so a reconciler cancel
+    // (round closed) provably precludes a late orphaning push. The ONLY command gated on the claim —
+    // all others keep the generic accepted→running flow, confining the CAS blast radius to publish.
+    if (command.type === "workspace.publish-review") return runClaimGatedPublishReview(command, relay, managedAgents);
     // #1201 F4 — at-most-once guard for restart/shutdown, mirroring runSpawnToRegistration's
     // terminal-status re-fetch. A redelivered agent.restart (e.g. relay reconcile after an
     // orchestrator bounce) must not spawn a SECOND successor sharing the predecessor's fresh
@@ -482,6 +524,7 @@ export function createControlHandler(
           reason: typeof command.params.reason === "string" ? command.params.reason : undefined,
           workspacesRoot: workspacesRoot(config.baseDir),
         });
+        // #1452 — the review ref (if any) is dropped inside cleanupWorkspace itself, host-side.
         await relay.updateCommand(command.id, "succeeded", result);
       } else if (command.type === "workspace.reconcile") {
         const result = await reconcileWorkspace({
@@ -501,6 +544,7 @@ export function createControlHandler(
             repoRoot: typeof command.params.repoRoot === "string" ? command.params.repoRoot : undefined,
             worktreePath: typeof command.params.worktreePath === "string" ? command.params.worktreePath : undefined,
             branch: typeof command.params.branch === "string" ? command.params.branch : undefined,
+            expectedHeadSha: typeof command.params.expectedHeadSha === "string" ? command.params.expectedHeadSha : undefined,
             baseRef: typeof command.params.baseRef === "string" ? command.params.baseRef : undefined,
             baseSha: typeof command.params.baseSha === "string" ? command.params.baseSha : undefined,
             strategy: command.params.strategy === "pr" || command.params.strategy === "rebase-ff" || command.params.strategy === "auto" ? command.params.strategy : undefined,
@@ -550,7 +594,8 @@ export function createControlHandler(
         // (recoverAgedInFlightWorkspaces, the #1025 A7 timed_out→succeeded correction) settles it.
         // Same belt-and-suspenders as the spawn path (#930, markSpawnCommandFailed).
         try {
-          await relay.updateCommand(command.id, mergeCommandStatus(result), result as unknown as Record<string, unknown>, result.error);
+          const report = prepareWorkspaceMergeResultForReport(result);
+          await relay.updateCommand(command.id, mergeCommandStatus(report), report as unknown as Record<string, unknown>, report.error);
         } catch (reportError) {
           console.error(`[orchestrator] workspace.merge result report failed for ${command.id} (not re-stamping as failed — relay reconcile owns recovery): ${errMessage(reportError)}`);
         }
@@ -618,6 +663,11 @@ export function createControlHandler(
           repoRoot: typeof command.params.repoRoot === "string" ? command.params.repoRoot : undefined,
         });
         await relay.updateCommand(command.id, "succeeded", result);
+      } else if (command.type === "workspace.unpublish-review") {
+        // #1452 — REVIEW-ONLY unpublish of the worker tip's refs/review/* ref on origin (never
+        // refs/heads/*/main, never lands). PUBLISH is intercepted earlier and runs the claim+fence+token-
+        // gated path (runClaimGatedPublishReview); only unpublish reaches here. Safety is host-side.
+        await handleReviewRefCommand(command, relay);
       } else if (command.type === "orchestrator.migrate-provider-config") {
         // Report our host-local provider config files; the relay seeds the central
         // provider-config rows with its own authority (#465). We don't write anything.

package/src/git.ts

@@ -11,6 +11,12 @@ interface GitOptions {
   timeoutMs?: number;
   timeoutLabel?: string;
   signal?: AbortSignal;
+  /** Override the child's environment (default: inherit `process.env`, the existing behavior for
+   * every caller that omits this). #1145 round-6 — the ONLY current use is the hermetic
+   * gitignore-guard materialization (integrated-land-gates.ts), which must run with every
+   * ambient git config source (global/system/command-scope) scrubbed; every other caller is
+   * unaffected by this option existing. */
+  env?: Record<string, string | undefined>;
 }
 
 /** Run `git -C cwd <args>` and capture trimmed stdout/stderr; never throws. */