canopycms 0.12.0 → 0.13.0

package/dist/worker/rebase.js

@@ -2,7 +2,9 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { BranchMetadataFileManager, buildMergedBranchUpdate, getBranchMetadataFileManager, } from '../branch-metadata.js';
 import { invalidateBranchContentCaches } from '../content-index-generation.js';
+import { MergeConflictStore } from '../merge-conflicts.js';
 import { isSettingsBranchName, sanitizeBranchName } from '../paths/branch-name.js';
+import { BASE_UPDATE_CLOCK_SKEW_MS, BASE_UPDATE_EARLY_RETRY_MS, isBaseUpdatePending, } from '../base-update.js';
 import { tryAcquireContentWriteLock } from '../utils/content-write-lock.js';
 import { holdProvisionedWorkspace, releaseProvisionedWorkspace, } from './provisioned-workspace.js';
 import { getErrorMessage, isNodeError, redactCredentials } from '../utils/error.js';
@@ -11,8 +13,8 @@ import { CANOPY_META_DIR, isCanopyInternalPath, isRebaseInProgress } from '../ut
 import { TRACKED_CANOPY_STATE_FIX, restoreRetiredSchemaCache, splitByUpstreamTracking, trackedCanopyStateChanges, } from './canopy-state.js';
 import { enqueueGitHubPush, forcePublishToLocalRemote, markHistoryRewritten, readPublishedSha, reconcilePendingRewrite, } from './history-rewrite.js';
 import { publishesBranch } from './branch-policy.js';
-import { commitsApart, conflictFilesToContentIds, recordConflicts } from './branch-merge.js';
-import { bringInGitHubCommits, mergeIntoBranch, returnToReview, rewriteCleared, } from './github-commits.js';
+import { commitsApart, mergesAsGitDoes, planMerge } from './branch-merge.js';
+import { bringInGitHubCommits, catchUpWithPublished, contains, isPublished, mergeIntoBranch, reconcileMergeConflicts, returnToReview, rewriteCleared, } from './github-commits.js';
 import { workerLog, workerLogWarn } from './log.js';
 import { SHARED_REPO_STATUS_ARGS, assertNoIncomingSubmodules, assertSharedRepoConfig, fetchFromRemoteGit, sharedRepoGit, } from './shared-repo-git.js';
 /**
@@ -46,8 +48,12 @@ export async function pollMergeState(ctx, branchDir, branchPath, metaFile) {
                     branch: buildMergedBranchUpdate(current.branch, data.merged_at ? new Date(data.merged_at) : undefined),
                 }
                 : null);
-            if (saved)
+            if (saved) {
                 workerLog(`  PR #${prNumber} for ${branchDir} is merged -> archived`);
+                // The base most likely moved with it, after this cycle's fetch: the next cycle brings
+                // that into the other branches without waiting out the interval.
+                ctx.requestBranchSync();
+            }
             return null;
         }
         const newState = data.state === 'closed' ? 'closed' : 'open';
@@ -131,44 +137,44 @@ async function abortRebase(git, branchPath) {
     }
 }
 /**
- * Drive `git rebase` to a finished state, resolving each conflict in favour of
- * the BRANCH's version, and report what happened.
+ * Drive `git rebase` to a finished state, stopping at the first conflict, and
+ * report what happened. A conflict is never resolved here: settling one by rule
+ * in a round's replay reverts base's change, and the merge the caller falls back
+ * to decides each value against the fork point.
  *
- * ABORT OWNERSHIP is split across FOUR sites, none redundant; "the caller owns
- * the abort" would be wrong in a way that invites deleting a live one:
+ * ABORT OWNERSHIP is split across several sites, none redundant; "the caller
+ * owns the abort" would be wrong in a way that invites deleting a live one:
  * - the **unexpected-error** exit aborts HERE, before breaking, so the caller's
  *   `!completed` abort is a caught no-op for that path;
+ * - the **conflict** exit aborts HERE too, and the caller's `conflicted` branch,
+ *   which returns before `!completed`, calls `abortRebase` again: a no-op abort
+ *   that tells the caches the replay moved the tree back;
  * - the **lock-compromised** exit leaves the rebase in progress and is aborted
  *   by `rebaseOneBranch`'s own `lockCompromised() && !completed` branch,
  *   which returns `skippedLocked` before the `!completed` block below it is
  *   reached -- a distinct site that cannot be folded into that one;
- * - the **conflict-resolution-failure** and **MAX_REBASE_ROUNDS** exits are the
- *   only two the caller's `!completed` abort actually covers;
+ * - the **MAX_REBASE_ROUNDS** exit is the only one the caller's `!completed`
+ *   abort actually covers;
  * - a THROW (`branchGit.status()` is the first statement of the round catch, so
  *   a vanished `.git` or an EFS error escapes, as can the test hook beside it)
  *   unwinds to `rebaseOneBranch`'s outer catch, where the last-resort abort in
  *   its `finally` is the backstop -- not dead code.
  * (A fifth abort, in the interrupted-rebase recovery, cleans up a PREVIOUS run.)
  *
- * What this function DOES guarantee is narrower: no per-file resolution failure
- * escapes it. `checkout --theirs` on a MODIFY/DELETE conflict throws straight
- * out of the round loop, skipping both abort sites and wedging the clone
- * forever, so those set `failureReason` and break instead.
- *
  * `isLockCompromised` is re-read every round rather than passed as a value:
- * [SYNC-C1] the content-write lock can be lost BETWEEN rounds, and
- * `--continue`/`--skip` are as destructive as the initial rebase.
+ * [SYNC-C1] the content-write lock can be lost BETWEEN rounds, and `--skip` is
+ * as destructive as the initial rebase.
  */
 async function runRebaseRounds(ctx, branchGit, branchDir, fetchedBaseTip, isLockCompromised) {
-    const conflictedFiles = [];
     let nextAction = 'start';
     let completed = false;
+    let conflicted = false;
     // Captured only on the "unexpected error" exit below, for the failed-summary
     // entry pushed at the `if (!completed)` check.
     let failureReason;
     for (let round = 0; round < MAX_REBASE_ROUNDS && !completed; round++) {
         // Re-checked every round: the compromise can land between rounds, and
-        // `--continue`/`--skip` are as destructive as the initial rebase. Handled
+        // `--skip` is as destructive as the initial rebase. Handled
         // after the loop so it cannot be mistaken for the `!completed`
         // rebase-FAILURE path below.
         if (isLockCompromised())
@@ -179,95 +185,38 @@ async function runRebaseRounds(ctx, branchGit, branchDir, fetchedBaseTip, isLock
                 // remote-tracking ref.
                 await branchGit.rebase([fetchedBaseTip]);
             }
-            else if (nextAction === 'continue') {
-                await branchGit.rebase(['--continue']);
-            }
             else {
                 await branchGit.rebase(['--skip']);
             }
             completed = true;
         }
         catch (rebaseErr) {
-            nextAction = 'continue';
             const st = await branchGit.status([...SHARED_REPO_STATUS_ARGS]);
             if (st.conflicted.length > 0) {
                 await ctx.afterConflictDetectedForTesting();
-                // During rebase, --theirs = the branch being replayed (the editor's
-                // work): git rebase reverses ours/theirs, "ours" being the target.
-                //
-                // MODIFY/DELETE conflicts have no "their version" to check out and must
-                // be resolved by staging a delete or an add instead. `git checkout
-                // --theirs` on one exits non-zero and simple-git throws -- and because
-                // this loop body IS the round loop's catch, that throw escapes the
-                // round loop entirely, skipping BOTH `rebase --abort` sites below and
-                // wedging the clone mid-rebase forever. The index/working-tree code
-                // pair identifies which side deleted (verified against real git):
-                //
-                //   U/D  "deleted by them"  -- the BRANCH deleted it, base modified it,
-                //        and git leaves base's version in the tree. Keeping the branch
-                //        version means honouring the delete: git rm.
-                //   D/U  "deleted by us"    -- base deleted it, the BRANCH modified it,
-                //        and git leaves the branch's version in the tree. Keeping the
-                //        branch version means keeping it: git add.
-                //
-                // A per-file resolution that STILL fails routes into the `!completed`
-                // path below, which aborts and records, rather than escaping.
-                //
-                // `--sparse` on add/rm: a conflicted path outside a sparse clone's cone
-                // is materialised for the conflict, but git refuses to stage it without.
-                const conflictKind = new Map(st.files.map((f) => [f.path, `${f.index}${f.working_dir}`]));
-                let resolutionFailure;
-                for (const file of st.conflicted) {
-                    const kind = conflictKind.get(file);
-                    try {
-                        if (kind === 'UD') {
-                            await branchGit.raw(['rm', '-f', '--sparse', '--', file]);
-                        }
-                        else if (kind === 'DU') {
-                            await branchGit.raw(['add', '--sparse', '--', file]);
-                        }
-                        else {
-                            await branchGit.raw(['checkout', '--theirs', '--', file]);
-                            await branchGit.raw(['add', '--sparse', '--', file]);
-                        }
-                    }
-                    catch (resolveErr) {
-                        resolutionFailure =
-                            `failed to resolve conflicted file '${file}' (status ${kind ?? '??'}): ` +
-                                getErrorMessage(resolveErr);
-                        break;
-                    }
-                    conflictedFiles.push(file);
-                }
-                if (resolutionFailure !== undefined) {
-                    // Same exit shape as the "unexpected error" branch below: set
-                    // failureReason and break, letting the `!completed` block do the
-                    // single `rebase --abort` and record the failure once.
-                    failureReason = resolutionFailure;
-                    break;
-                }
-                // nextAction stays 'continue'
+                workerLog(`  ${branchDir}: a replayed commit conflicts, so the base comes in by a merge`);
+                conflicted = true;
+                await branchGit.rebase(['--abort']).catch(() => { });
+                break;
+            }
+            const msg = rebaseErr instanceof Error ? rebaseErr.message : '';
+            if (msg.toLowerCase().includes('nothing to commit') ||
+                msg.toLowerCase().includes('apply --skip')) {
+                // A replayed commit base already holds: skip it.
+                nextAction = 'skip';
             }
             else {
-                const msg = rebaseErr instanceof Error ? rebaseErr.message : '';
-                if (msg.toLowerCase().includes('nothing to commit') ||
-                    msg.toLowerCase().includes('apply --skip')) {
-                    // Empty commit after --theirs resolution — skip it
-                    nextAction = 'skip';
-                }
-                else {
-                    // Unexpected error — abort and leave the branch behind.
-                    // conflictStatus/conflictFiles are deliberately not updated: the
-                    // rebase did not complete, so it replaced nothing to record.
-                    workerLogWarn(`  Unexpected rebase error in ${branchDir}: ${msg || 'Unknown error'}`);
-                    failureReason = msg || 'Unknown error';
-                    await branchGit.rebase(['--abort']).catch(() => { });
-                    break;
-                }
+                // Unexpected error — abort and leave the branch behind.
+                // conflictStatus/conflictFiles are deliberately not updated: the
+                // rebase did not complete, so it replaced nothing to record.
+                workerLogWarn(`  Unexpected rebase error in ${branchDir}: ${msg || 'Unknown error'}`);
+                failureReason = msg || 'Unknown error';
+                await branchGit.rebase(['--abort']).catch(() => { });
+                break;
             }
         }
     }
-    return { completed, conflictedFiles, failureReason };
+    return { completed, conflicted, failureReason };
 }
 /**
  * [SYNC-H1] Carry a just-rebased history forward into `remote.git`, and queue
@@ -311,9 +260,14 @@ async function carryForwardRewrittenHistory(ctx, args) {
                     `${branchRef}, so the rewrite is not published`);
                 return;
             }
-            if (await forcePublishToLocalRemote(ctx, branchPath, branchRef, publishedSha)) {
+            const publish = await forcePublishToLocalRemote(ctx, branchPath, branchRef, publishedSha, rebasedHead);
+            if (publish.kind === 'published') {
                 await enqueueGitHubPush(ctx, branchRef, gatewayPolicy);
             }
+            else if (publish.kind === 'failed') {
+                const reason = redactCredentials(`this branch's rebased history could not be published into the deployment's repository: ${publish.message}`);
+                await recordRebaseFailure(ctx, branchPath, branchDir, reason, branchRef);
+            }
         }
         else {
             const divergence = `rebased locally, but remote.git holds ${publishedSha} for ${branchRef}, which this ` +
@@ -324,19 +278,108 @@ async function carryForwardRewrittenHistory(ctx, args) {
         }
     }
 }
+/** What an outcome answers a request with; undefined when it settles nothing. */
+function answerFor(outcome, probe) {
+    // `rebased` on a failure: the base came in, and only publishing the rewrite failed.
+    if (outcome.kind === 'rebased' || (outcome.kind === 'failed' && outcome.rebased)) {
+        return probe.keptEntries ? 'conflicts' : 'merged';
+    }
+    if (outcome.kind === 'none')
+        return probe.upToDate ? 'up-to-date' : undefined;
+    // A save since the request, which the sync never commits: the editor's Retry commits it.
+    if (outcome.kind === 'failed' || outcome.kind === 'skippedDirty')
+        return 'failed';
+    return undefined;
+}
+/** Whether a request is unanswered and recent enough for the worker to chase with early cycles. */
+function worthAnotherCycle(branch) {
+    const age = Date.now() - Date.parse(branch.baseUpdateRequestedAt ?? '');
+    return (branch.status === 'editing' &&
+        isBaseUpdatePending(branch) &&
+        age >= -BASE_UPDATE_CLOCK_SKEW_MS &&
+        age < BASE_UPDATE_EARLY_RETRY_MS);
+}
+/**
+ * Answer the branch's request for the latest changes in `lastBaseUpdate`, which ends the editor's
+ * wait. Only from a fetch begun at or after the request, and only once the branch holds the base
+ * that fetch found: an earlier fetch may predate the changes asked for, and a base ref that didn't
+ * move (a held or failed update) isn't the latest. While the schema gate holds the base the request
+ * stands. Anything else that settles nothing, a lock or a GitHub step on its way among them, asks
+ * for another early cycle while the request is recent. Never throws.
+ */
+async function answerBaseUpdate(ctx, branchDir, branchPath, probe, outcome, source, requested) {
+    const { request } = probe;
+    if (!request) {
+        // Skipped before its request was read: a provisioning lock held elsewhere.
+        if (requested && outcome.kind === 'skippedLocked') {
+            const meta = await BranchMetadataFileManager.loadOnly(branchPath).catch(() => null);
+            if (meta && worthAnotherCycle(meta.branch))
+                ctx.requestBranchSync(branchDir);
+        }
+        return;
+    }
+    if (!source || ctx.ensureStatusReport().baseHold)
+        return;
+    const askAgain = () => {
+        if (worthAnotherCycle({ status: 'editing', baseUpdateRequestedAt: request.requestedAt })) {
+            ctx.requestBranchSync(request.branchRef);
+        }
+    };
+    // The request's time is the Lambda's clock and the fetch's this host's: both keep NTP time.
+    if (source.fetchedAt < Date.parse(request.requestedAt))
+        return askAgain();
+    const answer = answerFor(outcome, probe);
+    if (answer === undefined)
+        return askAgain();
+    if (answer !== 'failed' && source.baseTip !== undefined && probe.baseSha !== source.baseTip) {
+        return askAgain();
+    }
+    const lastBaseUpdate = {
+        at: new Date(source.fetchedAt).toISOString(),
+        outcome: answer,
+        ...(probe.baseSha !== undefined && { baseSha: probe.baseSha }),
+        ...(answer === 'conflicts' && { keptEntries: probe.keptEntries }),
+    };
+    try {
+        // A newer request, made after this fetch began, waits for the next cycle's answer.
+        const saved = await getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath).update((existing) => existing?.branch.name === request.branchRef &&
+            existing.branch.status === 'editing' &&
+            existing.branch.baseUpdateRequestedAt === request.requestedAt
+            ? { branch: { lastBaseUpdate } }
+            : null, { keepUpdatedAt: true });
+        if (saved)
+            workerLog(`  ${branchDir}: answered the request for the latest changes (${answer})`);
+    }
+    catch (err) {
+        workerLogWarn(`  ${branchDir}: could not record the answer to its request for the latest changes: ${getErrorMessage(err)}`);
+    }
+}
+/** A run with no GitHub publishes nothing there: an empty namespace is a gateway that pushes nothing. */
+const NO_GITHUB_POLICY = {
+    configured: [],
+    githubDefault: null,
+    namespace: '',
+    legacy: [],
+    settingsBranch: null,
+};
+/** The GitHub fetch's answer source: when it began, and the base it found. */
+const sourceOf = (ctx, gitHub) => ({
+    fetchedAt: gitHub.fetchedAt,
+    baseTip: gitHub.tips.get(ctx.baseBranch),
+});
 /**
  * Rebase every branch workspace that is behind the base branch, one cycle.
  *
- * The per-branch work is {@link rebaseOneBranch}; what stays here is the walk
- * over `content-branches/`, the structural pre-filter (entries that are not
- * branch workspaces at all, plus the base branch's own clone), and folding
- * each branch's outcome into the summary.
+ * The per-branch work is {@link syncBranchDir}; what stays here is the walk
+ * over `content-branches/` and folding each branch's outcome into the summary.
+ * `source` answers requests for the latest changes; the GitHub fetch's by default. `local` is a
+ * run with no GitHub (see {@link syncBranchDir}).
  *
  * Deliberately sequential rather than concurrent: each branch's rebase holds
  * that branch's cross-host content-write lock and runs a series of git
  * subprocesses against a shared filesystem.
  */
-export async function runRebaseCycle(ctx, gatewayPolicy, gitHub) {
+export async function runRebaseCycle(ctx, gatewayPolicy, gitHub, requested = new Set(), source = gitHub && sourceOf(ctx, gitHub), local = false) {
     const rebased = [];
     const skippedDirty = [];
     const skippedLocked = [];
@@ -348,6 +391,8 @@ export async function runRebaseCycle(ctx, gatewayPolicy, gitHub) {
     catch {
         return { rebased, skippedDirty, skippedLocked, failed };
     }
+    // Branches someone is waiting on go first; the sort is stable, so the rest keep their order.
+    branchDirs.sort((a, b) => Number(requested.has(b)) - Number(requested.has(a)));
     for (const branchDir of branchDirs) {
         // A draining worker finishes the branch it is rebasing and starts no other:
         // a rebase killed mid-branch is recovered lossily on the next boot.
@@ -355,45 +400,9 @@ export async function runRebaseCycle(ctx, gatewayPolicy, gitHub) {
             workerLog('  Rebase cycle stopped: the worker is draining');
             break;
         }
-        // Known structural entries under content-branches/, not branch workspaces:
-        // branches.json (registry snapshot) and dot-prefixed entries
-        // (.canopy-meta/, transient lock dirs). Skipped SILENTLY so the no-.git
-        // skip logs below don't fire for them every cycle; everything else still
-        // logs loudly on skip.
-        if (branchDir.startsWith('.') || branchDir === 'branches.json') {
-            continue;
-        }
-        const branchPath = path.join(ctx.contentBranchesPath, branchDir);
-        const gitDir = path.join(branchPath, '.git');
-        try {
-            const stat = await fs.stat(gitDir);
-            if (!stat.isDirectory()) {
-                workerLog(`  Skipping ${branchDir}: .git is not a directory`);
-                continue;
-            }
-        }
-        catch {
-            workerLog(`  Skipping ${branchDir}: no .git directory (not a branch workspace)`);
-            continue;
-        }
-        // The base branch's own clone is refreshed ff-only by
-        // refreshBaseBranchWorkspace() earlier in syncGit(). Routing it through
-        // this conflict-resolution loop could rewrite its history (the --theirs
-        // loop below) and stamp meaningless conflict metadata on it. Compare
-        // sanitized-vs-sanitized: branchDir is a filesystem name, ctx.baseBranch
-        // is raw.
-        if (branchDir === ctx.sanitizedBaseBranch) {
-            workerLog(`  Skipping ${branchDir}: base branch (refreshed separately)`);
-            continue;
-        }
-        // A settings branch is an orphan: rebasing it onto the base would give it content
-        // history. The API refuses to provision one, so a directory under that name is a
-        // leftover and is left alone.
-        if (isSettingsBranchName(branchDir, ctx.ensureSettingsBranch())) {
-            workerLogWarn(`  Skipping ${branchDir}: settings branch, never a content workspace`);
+        const outcome = await syncBranchDir(ctx, branchDir, gatewayPolicy, gitHub, source, requested.has(branchDir), {}, local);
+        if (outcome === null)
             continue;
-        }
-        const outcome = await holdAndRebaseOneBranch(ctx, branchDir, branchPath, gatewayPolicy, gitHub);
         if (outcome.kind === 'rebased')
             rebased.push(branchDir);
         else if (outcome.kind === 'skippedDirty')
@@ -410,6 +419,82 @@ export async function runRebaseCycle(ctx, gatewayPolicy, gitHub) {
     }
     return { rebased, skippedDirty, skippedLocked, failed };
 }
+/**
+ * One entry of `content-branches/`: the structural pre-filter (entries that are not branch
+ * workspaces at all, the base branch's own clone, a settings branch), then
+ * {@link holdAndRebaseOneBranch} and the answer to its request. Null for an entry skipped before
+ * any of that. Never throws. A `local` run has no GitHub: it publishes nothing there, and
+ * `remote.git` is where a branch's work is published.
+ */
+async function syncBranchDir(ctx, branchDir, gatewayPolicy, gitHub, source, requested, probe, local = false) {
+    // Known structural entries under content-branches/, not branch workspaces:
+    // branches.json (registry snapshot) and dot-prefixed entries
+    // (.canopy-meta/, transient lock dirs). Skipped SILENTLY so the no-.git
+    // skip logs below don't fire for them every cycle; everything else still
+    // logs loudly on skip.
+    if (branchDir.startsWith('.') || branchDir === 'branches.json')
+        return null;
+    const branchPath = path.join(ctx.contentBranchesPath, branchDir);
+    const gitDir = path.join(branchPath, '.git');
+    try {
+        const stat = await fs.stat(gitDir);
+        if (!stat.isDirectory()) {
+            workerLog(`  Skipping ${branchDir}: .git is not a directory`);
+            return null;
+        }
+    }
+    catch {
+        workerLog(`  Skipping ${branchDir}: no .git directory (not a branch workspace)`);
+        return null;
+    }
+    // The base branch's own clone is refreshed ff-only by
+    // refreshBaseBranchWorkspace() earlier in syncGit(). Routing it through
+    // this loop could rewrite its history (the rebase below) and stamp
+    // meaningless conflict metadata on it. Compare
+    // sanitized-vs-sanitized: branchDir is a filesystem name, ctx.baseBranch
+    // is raw.
+    if (branchDir === ctx.sanitizedBaseBranch) {
+        workerLog(`  Skipping ${branchDir}: base branch (refreshed separately)`);
+        return null;
+    }
+    // A settings branch is an orphan: rebasing it onto the base would give it content
+    // history. The API refuses to provision one, so a directory under that name is a
+    // leftover and is left alone.
+    if (isSettingsBranchName(branchDir, ctx.ensureSettingsBranch())) {
+        workerLogWarn(`  Skipping ${branchDir}: settings branch, never a content workspace`);
+        return null;
+    }
+    const outcome = await holdAndRebaseOneBranch(ctx, branchDir, branchPath, local ? NO_GITHUB_POLICY : gatewayPolicy, gitHub, probe, local);
+    await answerBaseUpdate(ctx, branchDir, branchPath, probe, outcome, source, requested);
+    return outcome;
+}
+/**
+ * Bring the base into one branch now and answer its request for the latest changes, for a mode that
+ * runs no worker loop (operating-mode `baseUpdateRunsInRequest`). With no GitHub, the base is
+ * `remote.git`'s, so the answer is from this run's start. A run that answers nothing writes
+ * `failed`, since nothing else ever will: `busy` says a lock held it back, which a retry in a moment
+ * gets past. Never throws but for the metadata write of that fallback.
+ */
+export async function syncBranchNow(ctx, branchName) {
+    const startedAt = Date.now();
+    const branchDir = sanitizeBranchName(branchName);
+    const probe = {};
+    const outcome = await syncBranchDir(ctx, branchDir, undefined, undefined, { fetchedAt: startedAt }, true, probe, true);
+    const busy = outcome?.kind === 'skippedLocked';
+    const branchPath = path.join(ctx.contentBranchesPath, branchDir);
+    await getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath).update((existing) => existing?.branch.name === branchName &&
+        existing.branch.status === 'editing' &&
+        existing.branch.baseUpdateRequestedAt !== undefined &&
+        Date.parse(existing.branch.baseUpdateRequestedAt) <= startedAt &&
+        isBaseUpdatePending(existing.branch)
+        ? {
+            branch: {
+                lastBaseUpdate: { at: new Date(startedAt).toISOString(), outcome: 'failed' },
+            },
+        }
+        : null, { keepUpdatedAt: true });
+    return busy ? 'busy' : 'answered';
+}
 /**
  * The ref a branch clone's HEAD names, or null for a detached or unreadable one. Read from the
  * file rather than through git, so it runs before `assertSharedRepoConfig` vets the clone.
@@ -461,7 +546,7 @@ async function restoreRenamedBranch(ctx, branchDir, branchPath, metaFile, namesp
  * content-write lock inside it; see `provisioned-workspace.ts` for why that order cannot deadlock.
  * Never throws, like rebaseOneBranch.
  */
-async function holdAndRebaseOneBranch(ctx, branchDir, branchPath, gatewayPolicy, gitHub) {
+async function holdAndRebaseOneBranch(ctx, branchDir, branchPath, gatewayPolicy, gitHub, probe, local) {
     let hold;
     try {
         hold = await holdProvisionedWorkspace(ctx.contentBranchesPath, branchDir);
@@ -481,18 +566,62 @@ async function holdAndRebaseOneBranch(ctx, branchDir, branchPath, gatewayPolicy,
     if (hold.kind === 'not-provisioned')
         return { kind: 'none' };
     try {
-        return await rebaseOneBranch(ctx, branchDir, branchPath, hold.isCompromised, gatewayPolicy, gitHub);
+        return await rebaseOneBranch(ctx, branchDir, branchPath, hold.isCompromised, gatewayPolicy, gitHub, probe, local);
     }
     finally {
         await releaseProvisionedWorkspace(hold.release, branchDir);
     }
 }
-/** Clear a recorded failure and any recorded rewrite: the caller knows neither stands. */
-async function clearRebaseFailure(ctx, branchPath, branchRef) {
+/**
+ * Clear a recorded failure and any recorded rewrite, the caller knowing neither stands, with
+ * `alsoClear` in the same write.
+ */
+async function clearRebaseFailure(ctx, branchPath, branchRef, alsoClear = {}) {
     await getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath).update((current) => current?.branch.name === branchRef
-        ? { branch: { rebaseFailure: undefined, ...rewriteCleared(current.branch) } }
+        ? { branch: { rebaseFailure: undefined, ...rewriteCleared(current.branch), ...alsoClear } }
         : null);
 }
+/**
+ * {@link recordLatestChangesWaiting} for a branch the sync skips for its saved work: marked while it
+ * lacks the base `remote.git` holds. Read from `remote.git` rather than fetched, so the skip moves no
+ * ref. Best-effort, so the skip stays a skip.
+ */
+async function noteLatestChangesWaiting(ctx, git, branchPath, metaFile) {
+    if (metaFile.branch.status !== 'editing')
+        return;
+    let baseTip;
+    let behind;
+    try {
+        baseTip = await readPublishedSha(ctx, ctx.baseBranch);
+        behind = baseTip !== null && !(await contains(git, 'HEAD', baseTip));
+    }
+    catch (err) {
+        workerLogWarn(`  Could not compare ${escapeForLog(metaFile.branch.name)} with the base: ${getErrorMessage(err)}`);
+        return;
+    }
+    await recordLatestChangesWaiting(ctx, branchPath, metaFile, behind ? (baseTip ?? undefined) : undefined);
+}
+/**
+ * Mark the branch `metaFile` names as lacking `baseSha`, the base commit the sync first left out, or
+ * clear the mark when undefined: the automatic sync never commits saved work, so a branch holding
+ * some waits for its author's "Get latest changes" (base-update.ts). Written only when the mark comes
+ * or goes, as every save regenerates the branch registry, and as bookkeeping, which leaves
+ * `updatedAt`. Best-effort: a failure leaves the hint as it was until the next cycle.
+ */
+async function recordLatestChangesWaiting(ctx, branchPath, metaFile, baseSha) {
+    const { name } = metaFile.branch;
+    const flips = (current) => (current === undefined) !== (baseSha === undefined);
+    if (!flips(metaFile.branch.latestChangesWaiting))
+        return;
+    try {
+        await getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath).update((current) => current?.branch.name === name && flips(current.branch.latestChangesWaiting)
+            ? { branch: { latestChangesWaiting: baseSha } }
+            : null, { keepUpdatedAt: true });
+    }
+    catch (err) {
+        workerLogWarn(`  Could not record the latest changes waiting for ${escapeForLog(name)}: ${getErrorMessage(err)}`);
+    }
+}
 /** A branch github-commits.ts left for a person: logged, recorded, and in the cycle's summary. */
 async function recordBlocked(ctx, branchDir, branchPath, branchRef, reason) {
     // [REDACT] failed[] folds into worker-status.json, served to the browser, and these reasons name
@@ -510,6 +639,32 @@ async function lacksPublishedCommits(ctx, git, branchRef) {
     await fetchFromRemoteGit(git, ctx.remoteGitPath, `refs/heads/${branchRef}`);
     return (await commitsApart(git, 'HEAD', published)).onlyB > 0;
 }
+/**
+ * {@link reconcileMergeConflicts} for a submitted or approved branch, whose merges of GitHub's
+ * commits can leave records too, under the content-write lock as for a branch being edited. Only
+ * for a clone with a record, or with `conflictFiles` to clear, so others cost one stat. Never
+ * throws.
+ */
+async function reconcileInReview(ctx, branchDir, branchPath, metaFile, isProvisioningLockCompromised) {
+    try {
+        const flagged = (metaFile.branch.conflictFiles?.length ?? 0) > 0;
+        if (!flagged && !(await new MergeConflictStore(branchPath).exists()))
+            return;
+        await assertSharedRepoConfig(branchPath, 'worktree');
+        await withContentLockInReview(branchDir, branchPath, isProvisioningLockCompromised, async () => {
+            await reconcileMergeConflicts(ctx, {
+                git: sharedRepoGit(branchPath, 'worktree'),
+                branchPath,
+                branchDir,
+                branchRef: await readCloneRef(branchPath),
+            });
+            return { kind: 'none' };
+        });
+    }
+    catch (err) {
+        workerLogWarn(`  ${branchDir}: could not reconcile its conflict record: ${getErrorMessage(err)}`);
+    }
+}
 /**
  * {@link bringInGitHubCommits} for a submitted or approved branch, which skips the rest of the
  * rebase loop. Under the content-write lock, zero-retry, as a save or a submit can hold it. A
@@ -599,14 +754,20 @@ function pullRequestHoldOf(pullRequest, recordedBase) {
 /**
  * Record {@link pullRequestHoldOf} for the branch card, when it changed: every save regenerates the
  * branch registry. It's bookkeeping, so it leaves `updatedAt`, which the card shows as an edit.
- * Best-effort: a failure leaves the card as it was until the next cycle.
+ * `tookBase` says this cycle merged the base in, which GitHub measured the pull request before, so
+ * nothing holds it. Best-effort: a failure leaves the card as it was until the next cycle.
  */
-async function recordPullRequestHold(ctx, branchDir, branchPath, metaFile, pullRequest) {
+async function recordPullRequestHold(ctx, branchDir, branchPath, metaFile, pullRequest, tookBase) {
     const { name, baseBranch, pullRequestHold, submittedAt } = metaFile.branch;
-    const hold = pullRequestHoldOf(pullRequest, baseBranch ?? ctx.baseBranch);
-    if (hold === null || JSON.stringify(hold) === JSON.stringify(pullRequestHold))
-        return;
     try {
+        let hold = tookBase ? undefined : pullRequestHoldOf(pullRequest, baseBranch ?? ctx.baseBranch);
+        // A conflict counts only on the commit the clone holds: one measured on an older head, as while
+        // the worker's own merge is on its way to GitHub, says nothing about the branch now.
+        if (hold?.kind === 'conflicts' && pullRequest.headSha !== (await cloneHead(branchPath))) {
+            hold = pullRequestHold?.kind === 'conflicts' ? null : undefined;
+        }
+        if (hold === null || JSON.stringify(hold) === JSON.stringify(pullRequestHold))
+            return;
         await getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath).update(
         // A newer submit's pull request isn't the one measured.
         (current) => current?.branch.name === name && current.branch.submittedAt === submittedAt
@@ -617,17 +778,24 @@ async function recordPullRequestHold(ctx, branchDir, branchPath, metaFile, pullR
         workerLogWarn(`  ${branchDir}: could not record the PR's state: ${getErrorMessage(err)}`);
     }
 }
+/** The commit a branch clone holds. */
+async function cloneHead(branchPath) {
+    await assertSharedRepoConfig(branchPath, 'worktree');
+    return (await sharedRepoGit(branchPath, 'worktree').revparse(['HEAD'])).trim();
+}
 /**
  * Merge the base into a submitted or approved branch whose open pull request GitHub reports
- * `behind`, so it can merge. It keeps the approval and the PR body: the pull request's diff is what
- * was reviewed. Only from a clone, `remote.git` and GitHub all at one commit, since anything else
- * is work still on its way, and only for the base GitHub measured against: a pull request someone
- * retargeted would gain another branch's commits under its approval. A branch with a failed sync
- * is left for its next submit or a retry of the task, as a push here would clear that failure with
- * the PR still stale. A conflict leaves the branch as it is; withdrawing it brings the rebase
- * loop's rule into play, where an editor can see the result. A failure goes in the cycle's summary
- * only: the step before this one clears `rebaseFailure` each cycle, so recording it would reset its
- * age every time.
+ * `behind` or `dirty`, so it can merge. A submitted branch stays submitted: the pull request's diff
+ * is still the author's changes. An approved branch keeps its approval only for git's own clean
+ * merge; any merge the field merge settled sends it back to review (`mergeIntoBranch`). Only from a
+ * clone, `remote.git` and GitHub all at one commit, since anything else is work still on its way,
+ * and only for the base GitHub measured against: a pull request someone retargeted would gain
+ * another branch's commits under its approval. A branch with a failed sync is left for its next
+ * submit or a retry of the task, as a push here would clear that failure with the PR still stale. A
+ * merge that leaves a value or file for a person leaves the branch as it is (`mergeIntoBranch`'s
+ * `inReview`), and withdrawing it lets the merge for a branch being edited record the conflicts,
+ * where an editor can resolve them. A failure goes in the cycle's summary only: the step before
+ * this one clears `rebaseFailure` each cycle, so recording it would reset its age every time.
  * Never throws.
  */
 async function updateBranchInReviewFromBase(ctx, branchDir, branchPath, pullRequest, isProvisioningLockCompromised, gatewayPolicy, gitHub) {
@@ -682,7 +850,7 @@ async function updateBranchInReviewFromBase(ctx, branchDir, branchPath, pullRequ
                 other: baseTip,
                 message: `Merge ${base} into ${branchRef}`,
                 fromGitHub: false,
-                stopOnConflict: true,
+                inReview: true,
             });
             if (outcome.kind === 'blocked') {
                 const error = redactCredentials(outcome.reason);
@@ -728,8 +896,9 @@ async function withContentLockInReview(branchDir, branchPath, isProvisioningLock
     }
 }
 /**
- * Rebase ONE branch workspace onto the base branch, keeping the branch's
- * version of every conflicting file.
+ * Bring the base branch into ONE branch workspace: by a rebase where nothing
+ * needs a person, else by a merge that leaves each value both sides changed
+ * differently for one.
  *
  * `branchDir` is the sanitized directory name and `branchPath` its absolute
  * path; the caller has already established that this is a real branch
@@ -739,7 +908,7 @@ async function withContentLockInReview(branchDir, branchPath, isProvisioningLock
  * returned as `{ kind: 'failed' }`, so one unreadable branch cannot halt the
  * rest of the cycle ([SYNC-M2]).
  */
-async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCompromised, gatewayPolicy, gitHub) {
+async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCompromised, gatewayPolicy, gitHub, probe = {}, local = false) {
     // Read only by the catch below. See the `rebased` rider on
     // BranchRebaseOutcome.
     let didRebase = false;
@@ -747,6 +916,14 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
         // Restored first: everything below this cycle compares `name`.
         const metaFile = await restoreRenamedBranch(ctx, branchDir, branchPath, await BranchMetadataFileManager.loadOnly(branchPath), gatewayPolicy?.namespace);
         const branchStatus = metaFile?.branch.status;
+        // Only an editing branch takes the base in, so only its request can be answered.
+        const requestedAt = metaFile?.branch.baseUpdateRequestedAt;
+        if (metaFile !== null &&
+            branchStatus === 'editing' &&
+            requestedAt !== undefined &&
+            isBaseUpdatePending(metaFile.branch)) {
+            probe.request = { branchRef: metaFile.branch.name, requestedAt };
+        }
         // Skip branches that must not be mutated:
         // - submitted/approved: in review, so never rewrite history under an active
         //   PR -- but do poll GitHub for the PR's resolution, since nothing else
@@ -754,19 +931,23 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
         // - archived: finished, with no PR left to poll.
         if (metaFile !== null && (branchStatus === 'submitted' || branchStatus === 'approved')) {
             workerLog(`  Skipping ${branchDir} (${branchStatus})`);
+            // Submit committed the saved work; a withdraw lets the next skip mark it again.
+            await recordLatestChangesWaiting(ctx, branchPath, metaFile);
+            await reconcileInReview(ctx, branchDir, branchPath, metaFile, isProvisioningLockCompromised);
             const outcome = await bringInCommitsForBranchInReview(ctx, branchDir, branchPath, metaFile, isProvisioningLockCompromised, gatewayPolicy, gitHub);
             const pullRequest = await pollMergeState(ctx, branchDir, branchPath, metaFile);
-            if (pullRequest !== null) {
-                await recordPullRequestHold(ctx, branchDir, branchPath, metaFile, pullRequest);
-            }
-            // GitHub reports `behind` only where up-to-date branches are required, so a repository
-            // that doesn't require them gets no commits or CI runs from this.
-            if (outcome.kind === 'none' &&
+            // GitHub reports `behind` only where up-to-date branches are required, and `dirty` only where
+            // git's merge conflicts, so a pull request that merges as it is gets no commits or CI runs.
+            const updated = outcome.kind === 'none' &&
                 pullRequest?.state === 'open' &&
-                pullRequest.mergeable_state === 'behind') {
-                return updateBranchInReviewFromBase(ctx, branchDir, branchPath, pullRequest, isProvisioningLockCompromised, gatewayPolicy, gitHub);
+                (pullRequest.mergeable_state === 'behind' || pullRequest.mergeable_state === 'dirty')
+                ? await updateBranchInReviewFromBase(ctx, branchDir, branchPath, pullRequest, isProvisioningLockCompromised, gatewayPolicy, gitHub)
+                : outcome;
+            if (pullRequest !== null) {
+                const tookBase = updated.kind === 'rebased';
+                await recordPullRequestHold(ctx, branchDir, branchPath, metaFile, pullRequest, tookBase);
             }
-            return outcome;
+            return updated;
         }
         if (branchStatus === 'archived') {
             workerLog(`  Skipping ${branchDir} (${branchStatus})`);
@@ -778,13 +959,11 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
         // The pins also keep git non-interactive (core.editor=true): a rebase never waits on an editor.
         const branchGit = sharedRepoGit(branchPath, 'worktree');
         // [SYNC-C1] Take the branch's cross-host content-write lock BEFORE the
-        // dirty check, and hold it for the whole rebase. The dirty check alone is
-        // check-then-act, and its residual window spans fetch, replay and N
-        // conflict rounds of awaited git subprocesses on EFS. A save landing in
-        // there is destroyed two ways: `checkout --theirs` below overwrites the
-        // just-saved file with the branch's committed version and the rebase then
-        // SUCCEEDS (nothing logs a failure at all), and `rebase --abort`
-        // hard-resets the tree. The editor already got its 200 either way.
+        // dirty check, and hold it for the whole rebase or merge. The dirty check
+        // alone is check-then-act, and its residual window spans fetch, replay and
+        // the merge's awaited git subprocesses on EFS. A save landing in there makes
+        // the next replayed commit fail, and the `rebase --abort` that follows
+        // hard-resets the tree, discarding it. The editor already got its 200.
         //
         // Zero-retry acquisition, deliberately: on contention this branch is
         // skipped and retried next sync cycle (~5 min), the same principle as the
@@ -902,6 +1081,12 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
             // every publish path stays disarmed -- the safe direction.
             const branchRef = (await branchGit.revparse(['--abbrev-ref', 'HEAD'])).trim();
             const canPublish = branchRef.length > 0 && branchRef !== 'HEAD';
+            await reconcileMergeConflicts(ctx, {
+                git: branchGit,
+                branchPath,
+                branchDir,
+                branchRef: canPublish ? branchRef : null,
+            });
             const commitArgs = canPublish && metaFile !== null
                 ? {
                     git: branchGit,
@@ -915,6 +1100,27 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
                     lockLost: lockCompromised,
                 }
                 : null;
+            const skipIfDirty = async () => {
+                if (editorDirt.length === 0)
+                    return { kind: 'none' };
+                if (metaFile !== null)
+                    await noteLatestChangesWaiting(ctx, branchGit, branchPath, metaFile);
+                return { kind: 'skippedDirty' };
+            };
+            // A merge of GitHub's commits whose result holds the base `remote.git` holds answers a request
+            // for the latest changes as a merge of the base does, conflicts included.
+            const tookInByGitHubMerge = async (keptEntries) => {
+                if (editorDirt.length > 0)
+                    return await skipIfDirty();
+                const baseTip = await readPublishedSha(ctx, ctx.baseBranch).catch(() => null);
+                const holdsBase = baseTip !== null && (await contains(branchGit, 'HEAD', baseTip).catch(() => false));
+                if (!holdsBase)
+                    return { kind: 'none' };
+                probe.baseSha = baseTip;
+                probe.keptEntries = keptEntries;
+                await clearRebaseFailure(ctx, branchPath, branchRef, { latestChangesWaiting: undefined });
+                return { kind: 'rebased' };
+            };
             // Before the dirty return: a fast-forward passes saves that touch other files.
             let unpushed = false;
             if (commitArgs !== null) {
@@ -924,13 +1130,21 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
                 }
                 if (outcome.kind === 'unpushed')
                     unpushed = true;
-                else if (outcome.kind !== 'in-step') {
-                    return editorDirt.length > 0 ? { kind: 'skippedDirty' } : { kind: 'none' };
+                else if (outcome.kind === 'merged')
+                    return await tookInByGitHubMerge(outcome.keptEntries);
+                else if (outcome.kind !== 'in-step')
+                    return await skipIfDirty();
+                // A merge of the base this worker published and never moved the clone to comes first.
+                const caughtUp = await catchUpWithPublished(ctx, commitArgs);
+                if (caughtUp?.kind === 'blocked') {
+                    return recordBlocked(ctx, branchDir, branchPath, branchRef, caughtUp.reason);
                 }
+                if (caughtUp)
+                    return await skipIfDirty();
             }
             if (editorDirt.length > 0) {
                 workerLog(`  Skipping ${branchDir}: has uncommitted changes`);
-                return { kind: 'skippedDirty' };
+                return await skipIfDirty();
             }
             // `git rebase` refuses to start over ANY modified tracked file, so
             // tracked canopycms state blocks. The worker never untracks it here:
@@ -952,21 +1166,32 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
                 await recordRebaseFailure(ctx, branchPath, branchDir, reason);
                 return { kind: 'failed', error: reason };
             }
-            // [SYNC-H1] Self-heal: finish an interrupted publish even when this
-            // branch is not behind base. Every crash window in the arming sequence
-            // below leaves the marker set with the work unfinished, and this is what
-            // completes it -- without it one lost lease race strands the branch until
-            // the base happens to advance again. Gated on the loop-top snapshot, so
-            // unmarked branches (nearly all of them, every cycle) cost nothing.
+            // [SYNC-H1] Self-heal: finish a publish that never left remote.git at
+            // the marker's commit, even when this branch is not behind base -- a
+            // crash in the arming sequence below, or a failed push. Gated on the
+            // loop-top snapshot, so unmarked branches (nearly all of them, every
+            // cycle) cost nothing.
             if (canPublish && metaFile?.branch.historyRewrittenFrom) {
-                await reconcilePendingRewrite(ctx, {
+                const pending = await reconcilePendingRewrite(ctx, {
                     branchPath,
                     branchDir,
                     branchRef,
                     headSha: (await branchGit.revparse(['HEAD'])).trim(),
                     marker: metaFile.branch.historyRewrittenFrom,
+                    target: metaFile.branch.historyRewrittenTo,
                     gatewayPolicy,
                 });
+                // A rebase now would replace the rewrite remote.git still waits for, along with any commit
+                // made on top of it since, which only a submit may publish.
+                if (pending.kind === 'failed') {
+                    // [REDACT] failed[] is served to the browser via worker-status.json.
+                    const reason = redactCredentials(pending.reason);
+                    workerLogWarn(`  Skipping ${branchDir}: ${reason}`);
+                    await recordRebaseFailure(ctx, branchPath, branchDir, reason, branchRef);
+                    return { kind: 'failed', error: reason };
+                }
+                if (pending.kind === 'waiting')
+                    return { kind: 'none' };
             }
             await fetchFromRemoteGit(branchGit, ctx.remoteGitPath, ctx.baseBranch);
             // rev-list, not status.behind, which needs an upstream tracking branch
@@ -977,7 +1202,9 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
             const fetchedBaseTip = (await branchGit.revparse(['FETCH_HEAD'])).trim();
             const behindCount = parseInt((await branchGit.raw(['rev-list', '--count', `HEAD..${fetchedBaseTip}`])).trim(), 10);
             const meta = getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath);
+            probe.baseSha = fetchedBaseTip;
             if (behindCount === 0) {
+                probe.upToDate = true;
                 // Already in sync -- the overwhelmingly common outcome per branch per
                 // cycle, so skip the save entirely when metadata already reflects a
                 // clean state. save() eager-regenerates the branch registry
@@ -988,14 +1215,15 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
                 // concurrent editor-driven metadata change in that window is not
                 // clobbered by a stale skip decision.
                 //
-                // Catching up leaves the conflict record alone: it names entries whose
-                // base change this branch's version replaced, which stays true until
-                // the branch merges (see recordConflicts). A lingering rebaseFailure
+                // Catching up leaves the conflict record alone: it names values a person
+                // has yet to choose, which stays true until they do. A lingering rebaseFailure
                 // is cleared, or it sticks as a stale warning forever: nothing else
                 // touches a caught-up branch, so no other save site clears it. One
                 // whose cause stands stays: remote.git still holds a commit this clone
                 // lacks, and the next submit is refused for it.
                 const currentMeta = await BranchMetadataFileManager.loadOnly(branchPath);
+                if (currentMeta !== null)
+                    await recordLatestChangesWaiting(ctx, branchPath, currentMeta);
                 if (currentMeta?.branch.rebaseFailure === undefined) {
                     return { kind: 'none' };
                 }
@@ -1007,17 +1235,46 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
                 return { kind: 'none' };
             }
             // `git rebase` drops merge commits and replays what they merged, so whatever one settled
-            // (a kept version, a maintainer's conflict resolution) would be undone, then force-published.
-            // A branch holding one merges the base instead. So does one whose commits touch canopycms
-            // state: a replay writes their bytes over the live files, and a pair that adds then removes
-            // a file deletes it.
+            // (a value a person chose, a maintainer's conflict resolution) would be undone, then
+            // force-published. A branch holding one merges the base instead. So does one whose commits
+            // touch canopycms state: a replay writes their bytes over the live files, and a pair that
+            // adds then removes a file deletes it.
             const aboveBase = `${fetchedBaseTip}..HEAD`;
             const countAboveBase = async (args) => (await branchGit.raw(['rev-list', '--count', ...args])).trim();
             const cannotReplay = (await countAboveBase(['--merges', '--end-of-options', aboveBase])) !== '0' ||
                 (await countAboveBase(['--end-of-options', aboveBase, '--', CANOPY_META_DIR])) !== '0';
-            if (commitArgs !== null && (cannotReplay || unpushed)) {
+            const head = (await branchGit.revparse(['HEAD'])).trim();
+            // Commits on top of what this branch published, as "Get latest changes" makes from saved work
+            // on a branch submitted once, or a submit whose push failed: a rebase would rewrite the
+            // published commit under them, which reads as a push this clone never saw. A merge keeps
+            // them, unpublished until the submit pushes it (publish-decision.ts). A same-named ref at a
+            // commit the base holds is no work of this branch.
+            const published = canPublish ? await readPublishedSha(ctx, branchRef) : null;
+            // With no GitHub, a commit of the branch's in remote.git is published however it got there.
+            const aheadOfPublished = published !== null &&
+                metaFile?.branch.name === branchRef &&
+                (local ||
+                    (published !== head &&
+                        // A rewrite's tip is this branch's own publish, on GitHub or not.
+                        (isPublished(metaFile) || published === metaFile.branch.historyRewrittenTo))) &&
+                (await contains(branchGit, head, published)) &&
+                !(await contains(branchGit, fetchedBaseTip, published));
+            /**
+             * The base taken in by a merge (github-commits.ts), which decides each value against the fork
+             * point and leaves what both sides changed differently for a person, rather than a rebase,
+             * whose rounds can only settle a conflict by rule. A clone with no branch checked out, or no
+             * `branch.json`, cannot name the ref the merge publishes, so it stays behind.
+             */
+            const takeBaseByMerge = async () => {
+                if (commitArgs === null) {
+                    const reason = `the base conflicts with this clone's work, and the clone has no branch checked out, ` +
+                        `or no branch.json, to merge it into`;
+                    workerLogWarn(`  Skipping ${branchDir}: ${reason}`);
+                    await recordRebaseFailure(ctx, branchPath, branchDir, reason);
+                    return { kind: 'failed', error: reason };
+                }
                 const outcome = await mergeIntoBranch(ctx, commitArgs, {
-                    head: (await branchGit.revparse(['HEAD'])).trim(),
+                    head,
                     other: fetchedBaseTip,
                     message: `Merge ${ctx.baseBranch} into ${branchRef}`,
                     fromGitHub: false,
@@ -1025,20 +1282,42 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
                 if (outcome.kind === 'blocked') {
                     return recordBlocked(ctx, branchDir, branchPath, branchRef, outcome.reason);
                 }
-                if (outcome.kind !== 'merged')
-                    return { kind: 'none' };
-                await clearRebaseFailure(ctx, branchPath, branchRef);
+                if (outcome.kind !== 'merged') {
+                    if (!lockCompromised())
+                        return { kind: 'none' };
+                    workerLogWarn(`  Skipping ${branchDir}: a lock it held was lost mid-merge (retrying next cycle)`);
+                    return { kind: 'skippedLocked' };
+                }
+                probe.keptEntries = outcome.keptEntries;
+                await clearRebaseFailure(ctx, branchPath, branchRef, { latestChangesWaiting: undefined });
                 return { kind: 'rebased' };
+            };
+            if (commitArgs !== null && (cannotReplay || unpushed || aheadOfPublished)) {
+                return await takeBaseByMerge();
+            }
+            // A rebase only where it takes in exactly what a merge would, with nothing for a person: git
+            // conflicts nowhere, and the field merge decides no file otherwise than git does.
+            if (commitArgs !== null &&
+                !mergesAsGitDoes(await planMerge(branchGit, branchPath, {
+                    head,
+                    other: fetchedBaseTip,
+                    contentRoot: ctx.contentRoot,
+                    timeoutMs: ctx.taskTimeoutMs,
+                }))) {
+                return await takeBaseByMerge();
             }
             workerLog(`Rebasing ${branchDir} (${behindCount} commits behind)...`);
             // Read BOTH sides before rewriting anything: the arming guard after the
             // rebase compares what remote.git published against what this clone is
             // about to rebase away, and the clone's pre-rebase tip is exactly what
             // the rebase makes unreadable.
-            const preRebaseHead = (await branchGit.revparse(['HEAD'])).trim();
-            const publishedSha = canPublish ? await readPublishedSha(ctx, branchRef) : null;
+            const preRebaseHead = head;
+            const publishedSha = published;
             await assertNoIncomingSubmodules(branchGit, branchPath, preRebaseHead, fetchedBaseTip);
-            const { completed, conflictedFiles, failureReason } = await runRebaseRounds(ctx, branchGit, branchDir, fetchedBaseTip, lockCompromised);
+            const { completed, conflicted, failureReason } = await runRebaseRounds(ctx, branchGit, branchDir, fetchedBaseTip, lockCompromised);
+            // The tip the rebase made, read before anything else awaits: past a lost lock a commit can
+            // land on it, and only this tip may be published as the rewrite.
+            const rebasedHead = (await branchGit.revparse(['HEAD'])).trim();
             // Outside the round loop's try/catch, so a throwing test hook can
             // never be misread as a rebase error.
             if (completed)
@@ -1072,6 +1351,11 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
             if (lockCompromised()) {
                 workerLogWarn(`  A lock held for ${branchDir} was compromised, but its rebase had already completed -- finishing the sync (history is rewritten; skipping now would strand the history-rewrite marker and wedge the branch)`);
             }
+            if (conflicted) {
+                // The round loop aborted the rebase; this tells the caches the tree moved back.
+                await abortRebase(branchGit, branchPath).catch(() => { });
+                return await takeBaseByMerge();
+            }
             if (!completed) {
                 // failureReason is only set on the "unexpected error" break above;
                 // MAX_REBASE_ROUNDS exhaustion is a distinct exit with no message of
@@ -1098,19 +1382,16 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
             // and (via the on-disk generation marker) in the Lambda containers
             // sharing this filesystem.
             await invalidateBranchContentCaches(branchPath);
-            const conflictIdsDeduped = conflictFilesToContentIds(conflictedFiles, ctx.contentRoot);
-            const hadConflicts = conflictIdsDeduped.length > 0;
-            workerLog(hadConflicts
-                ? `  Rebased ${branchDir} (kept branch version for ${conflictIdsDeduped.length} conflicting file(s))`
-                : `  Rebased ${branchDir} successfully`);
-            // Recorded only on a branch.json that still names the branch this cycle read.
+            probe.keptEntries = 0;
+            workerLog(`  Rebased ${branchDir} successfully`);
+            // Recorded only on a branch.json that still names the branch this cycle read. The cycle
+            // completed, so any prior failure record goes, whatever conflicts stay on record.
             await meta.update((existing) => existing !== null && existing.branch.name === metaFile?.branch.name
                 ? {
                     branch: {
-                        ...recordConflicts(existing.branch.conflictFiles, conflictIdsDeduped),
-                        // The cycle completed, so clear any prior failure record regardless
-                        // of the conflict outcome.
+                        conflictStatus: (existing.branch.conflictFiles?.length ?? 0) > 0 ? 'conflicts-detected' : 'clean',
                         rebaseFailure: undefined,
+                        latestChangesWaiting: undefined,
                     },
                 }
                 : null);
@@ -1121,7 +1402,7 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
                 branchRef,
                 publishedSha,
                 preRebaseHead,
-                rebasedHead: (await branchGit.revparse(['HEAD'])).trim(),
+                rebasedHead,
                 gatewayPolicy,
             });
             return { kind: 'rebased' };