canopycms 0.12.1 → 0.13.0

package/dist/worker/rebase.js

@@ -260,9 +260,14 @@ async function carryForwardRewrittenHistory(ctx, args) {
                     `${branchRef}, so the rewrite is not published`);
                 return;
             }
-            if (await forcePublishToLocalRemote(ctx, branchPath, branchRef, publishedSha)) {
+            const publish = await forcePublishToLocalRemote(ctx, branchPath, branchRef, publishedSha, rebasedHead);
+            if (publish.kind === 'published') {
                 await enqueueGitHubPush(ctx, branchRef, gatewayPolicy);
             }
+            else if (publish.kind === 'failed') {
+                const reason = redactCredentials(`this branch's rebased history could not be published into the deployment's repository: ${publish.message}`);
+                await recordRebaseFailure(ctx, branchPath, branchDir, reason, branchRef);
+            }
         }
         else {
             const divergence = `rebased locally, but remote.git holds ${publishedSha} for ${branchRef}, which this ` +
@@ -296,13 +301,13 @@ function worthAnotherCycle(branch) {
 }
 /**
  * Answer the branch's request for the latest changes in `lastBaseUpdate`, which ends the editor's
- * wait. Only from a cycle whose GitHub fetch began at or after the request, and only once the
- * branch holds the base that fetch found: an earlier fetch may predate the changes asked for, and a
- * base ref that didn't move (a held or failed update) isn't the latest. While the schema gate holds
- * the base the request stands. Anything else that settles nothing, a lock or a GitHub step on its
- * way among them, asks for another early cycle while the request is recent. Never throws.
+ * wait. Only from a fetch begun at or after the request, and only once the branch holds the base
+ * that fetch found: an earlier fetch may predate the changes asked for, and a base ref that didn't
+ * move (a held or failed update) isn't the latest. While the schema gate holds the base the request
+ * stands. Anything else that settles nothing, a lock or a GitHub step on its way among them, asks
+ * for another early cycle while the request is recent. Never throws.
  */
-async function answerBaseUpdate(ctx, branchDir, branchPath, probe, outcome, gitHub, requested) {
+async function answerBaseUpdate(ctx, branchDir, branchPath, probe, outcome, source, requested) {
     const { request } = probe;
     if (!request) {
         // Skipped before its request was read: a provisioning lock held elsewhere.
@@ -313,7 +318,7 @@ async function answerBaseUpdate(ctx, branchDir, branchPath, probe, outcome, gitH
         }
         return;
     }
-    if (!gitHub || ctx.ensureStatusReport().baseHold)
+    if (!source || ctx.ensureStatusReport().baseHold)
         return;
     const askAgain = () => {
         if (worthAnotherCycle({ status: 'editing', baseUpdateRequestedAt: request.requestedAt })) {
@@ -321,17 +326,16 @@ async function answerBaseUpdate(ctx, branchDir, branchPath, probe, outcome, gitH
         }
     };
     // The request's time is the Lambda's clock and the fetch's this host's: both keep NTP time.
-    if (gitHub.fetchedAt < Date.parse(request.requestedAt))
+    if (source.fetchedAt < Date.parse(request.requestedAt))
         return askAgain();
     const answer = answerFor(outcome, probe);
     if (answer === undefined)
         return askAgain();
-    const gitHubBase = gitHub.tips.get(ctx.baseBranch);
-    if (answer !== 'failed' && gitHubBase !== undefined && probe.baseSha !== gitHubBase) {
+    if (answer !== 'failed' && source.baseTip !== undefined && probe.baseSha !== source.baseTip) {
         return askAgain();
     }
     const lastBaseUpdate = {
-        at: new Date(gitHub.fetchedAt).toISOString(),
+        at: new Date(source.fetchedAt).toISOString(),
         outcome: answer,
         ...(probe.baseSha !== undefined && { baseSha: probe.baseSha }),
         ...(answer === 'conflicts' && { keptEntries: probe.keptEntries }),
@@ -350,19 +354,32 @@ async function answerBaseUpdate(ctx, branchDir, branchPath, probe, outcome, gitH
         workerLogWarn(`  ${branchDir}: could not record the answer to its request for the latest changes: ${getErrorMessage(err)}`);
     }
 }
+/** A run with no GitHub publishes nothing there: an empty namespace is a gateway that pushes nothing. */
+const NO_GITHUB_POLICY = {
+    configured: [],
+    githubDefault: null,
+    namespace: '',
+    legacy: [],
+    settingsBranch: null,
+};
+/** The GitHub fetch's answer source: when it began, and the base it found. */
+const sourceOf = (ctx, gitHub) => ({
+    fetchedAt: gitHub.fetchedAt,
+    baseTip: gitHub.tips.get(ctx.baseBranch),
+});
 /**
  * Rebase every branch workspace that is behind the base branch, one cycle.
  *
- * The per-branch work is {@link rebaseOneBranch}; what stays here is the walk
- * over `content-branches/`, the structural pre-filter (entries that are not
- * branch workspaces at all, plus the base branch's own clone), and folding
- * each branch's outcome into the summary.
+ * The per-branch work is {@link syncBranchDir}; what stays here is the walk
+ * over `content-branches/` and folding each branch's outcome into the summary.
+ * `source` answers requests for the latest changes; the GitHub fetch's by default. `local` is a
+ * run with no GitHub (see {@link syncBranchDir}).
  *
  * Deliberately sequential rather than concurrent: each branch's rebase holds
  * that branch's cross-host content-write lock and runs a series of git
  * subprocesses against a shared filesystem.
  */
-export async function runRebaseCycle(ctx, gatewayPolicy, gitHub, requested = new Set()) {
+export async function runRebaseCycle(ctx, gatewayPolicy, gitHub, requested = new Set(), source = gitHub && sourceOf(ctx, gitHub), local = false) {
     const rebased = [];
     const skippedDirty = [];
     const skippedLocked = [];
@@ -383,47 +400,9 @@ export async function runRebaseCycle(ctx, gatewayPolicy, gitHub, requested = new
             workerLog('  Rebase cycle stopped: the worker is draining');
             break;
         }
-        // Known structural entries under content-branches/, not branch workspaces:
-        // branches.json (registry snapshot) and dot-prefixed entries
-        // (.canopy-meta/, transient lock dirs). Skipped SILENTLY so the no-.git
-        // skip logs below don't fire for them every cycle; everything else still
-        // logs loudly on skip.
-        if (branchDir.startsWith('.') || branchDir === 'branches.json') {
-            continue;
-        }
-        const branchPath = path.join(ctx.contentBranchesPath, branchDir);
-        const gitDir = path.join(branchPath, '.git');
-        try {
-            const stat = await fs.stat(gitDir);
-            if (!stat.isDirectory()) {
-                workerLog(`  Skipping ${branchDir}: .git is not a directory`);
-                continue;
-            }
-        }
-        catch {
-            workerLog(`  Skipping ${branchDir}: no .git directory (not a branch workspace)`);
-            continue;
-        }
-        // The base branch's own clone is refreshed ff-only by
-        // refreshBaseBranchWorkspace() earlier in syncGit(). Routing it through
-        // this loop could rewrite its history (the rebase below) and stamp
-        // meaningless conflict metadata on it. Compare
-        // sanitized-vs-sanitized: branchDir is a filesystem name, ctx.baseBranch
-        // is raw.
-        if (branchDir === ctx.sanitizedBaseBranch) {
-            workerLog(`  Skipping ${branchDir}: base branch (refreshed separately)`);
+        const outcome = await syncBranchDir(ctx, branchDir, gatewayPolicy, gitHub, source, requested.has(branchDir), {}, local);
+        if (outcome === null)
             continue;
-        }
-        // A settings branch is an orphan: rebasing it onto the base would give it content
-        // history. The API refuses to provision one, so a directory under that name is a
-        // leftover and is left alone.
-        if (isSettingsBranchName(branchDir, ctx.ensureSettingsBranch())) {
-            workerLogWarn(`  Skipping ${branchDir}: settings branch, never a content workspace`);
-            continue;
-        }
-        const probe = {};
-        const outcome = await holdAndRebaseOneBranch(ctx, branchDir, branchPath, gatewayPolicy, gitHub, probe);
-        await answerBaseUpdate(ctx, branchDir, branchPath, probe, outcome, gitHub, requested.has(branchDir));
         if (outcome.kind === 'rebased')
             rebased.push(branchDir);
         else if (outcome.kind === 'skippedDirty')
@@ -440,6 +419,82 @@ export async function runRebaseCycle(ctx, gatewayPolicy, gitHub, requested = new
     }
     return { rebased, skippedDirty, skippedLocked, failed };
 }
+/**
+ * One entry of `content-branches/`: the structural pre-filter (entries that are not branch
+ * workspaces at all, the base branch's own clone, a settings branch), then
+ * {@link holdAndRebaseOneBranch} and the answer to its request. Null for an entry skipped before
+ * any of that. Never throws. A `local` run has no GitHub: it publishes nothing there, and
+ * `remote.git` is where a branch's work is published.
+ */
+async function syncBranchDir(ctx, branchDir, gatewayPolicy, gitHub, source, requested, probe, local = false) {
+    // Known structural entries under content-branches/, not branch workspaces:
+    // branches.json (registry snapshot) and dot-prefixed entries
+    // (.canopy-meta/, transient lock dirs). Skipped SILENTLY so the no-.git
+    // skip logs below don't fire for them every cycle; everything else still
+    // logs loudly on skip.
+    if (branchDir.startsWith('.') || branchDir === 'branches.json')
+        return null;
+    const branchPath = path.join(ctx.contentBranchesPath, branchDir);
+    const gitDir = path.join(branchPath, '.git');
+    try {
+        const stat = await fs.stat(gitDir);
+        if (!stat.isDirectory()) {
+            workerLog(`  Skipping ${branchDir}: .git is not a directory`);
+            return null;
+        }
+    }
+    catch {
+        workerLog(`  Skipping ${branchDir}: no .git directory (not a branch workspace)`);
+        return null;
+    }
+    // The base branch's own clone is refreshed ff-only by
+    // refreshBaseBranchWorkspace() earlier in syncGit(). Routing it through
+    // this loop could rewrite its history (the rebase below) and stamp
+    // meaningless conflict metadata on it. Compare
+    // sanitized-vs-sanitized: branchDir is a filesystem name, ctx.baseBranch
+    // is raw.
+    if (branchDir === ctx.sanitizedBaseBranch) {
+        workerLog(`  Skipping ${branchDir}: base branch (refreshed separately)`);
+        return null;
+    }
+    // A settings branch is an orphan: rebasing it onto the base would give it content
+    // history. The API refuses to provision one, so a directory under that name is a
+    // leftover and is left alone.
+    if (isSettingsBranchName(branchDir, ctx.ensureSettingsBranch())) {
+        workerLogWarn(`  Skipping ${branchDir}: settings branch, never a content workspace`);
+        return null;
+    }
+    const outcome = await holdAndRebaseOneBranch(ctx, branchDir, branchPath, local ? NO_GITHUB_POLICY : gatewayPolicy, gitHub, probe, local);
+    await answerBaseUpdate(ctx, branchDir, branchPath, probe, outcome, source, requested);
+    return outcome;
+}
+/**
+ * Bring the base into one branch now and answer its request for the latest changes, for a mode that
+ * runs no worker loop (operating-mode `baseUpdateRunsInRequest`). With no GitHub, the base is
+ * `remote.git`'s, so the answer is from this run's start. A run that answers nothing writes
+ * `failed`, since nothing else ever will: `busy` says a lock held it back, which a retry in a moment
+ * gets past. Never throws but for the metadata write of that fallback.
+ */
+export async function syncBranchNow(ctx, branchName) {
+    const startedAt = Date.now();
+    const branchDir = sanitizeBranchName(branchName);
+    const probe = {};
+    const outcome = await syncBranchDir(ctx, branchDir, undefined, undefined, { fetchedAt: startedAt }, true, probe, true);
+    const busy = outcome?.kind === 'skippedLocked';
+    const branchPath = path.join(ctx.contentBranchesPath, branchDir);
+    await getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath).update((existing) => existing?.branch.name === branchName &&
+        existing.branch.status === 'editing' &&
+        existing.branch.baseUpdateRequestedAt !== undefined &&
+        Date.parse(existing.branch.baseUpdateRequestedAt) <= startedAt &&
+        isBaseUpdatePending(existing.branch)
+        ? {
+            branch: {
+                lastBaseUpdate: { at: new Date(startedAt).toISOString(), outcome: 'failed' },
+            },
+        }
+        : null, { keepUpdatedAt: true });
+    return busy ? 'busy' : 'answered';
+}
 /**
  * The ref a branch clone's HEAD names, or null for a detached or unreadable one. Read from the
  * file rather than through git, so it runs before `assertSharedRepoConfig` vets the clone.
@@ -491,7 +546,7 @@ async function restoreRenamedBranch(ctx, branchDir, branchPath, metaFile, namesp
  * content-write lock inside it; see `provisioned-workspace.ts` for why that order cannot deadlock.
  * Never throws, like rebaseOneBranch.
  */
-async function holdAndRebaseOneBranch(ctx, branchDir, branchPath, gatewayPolicy, gitHub, probe) {
+async function holdAndRebaseOneBranch(ctx, branchDir, branchPath, gatewayPolicy, gitHub, probe, local) {
     let hold;
     try {
         hold = await holdProvisionedWorkspace(ctx.contentBranchesPath, branchDir);
@@ -511,18 +566,62 @@ async function holdAndRebaseOneBranch(ctx, branchDir, branchPath, gatewayPolicy,
     if (hold.kind === 'not-provisioned')
         return { kind: 'none' };
     try {
-        return await rebaseOneBranch(ctx, branchDir, branchPath, hold.isCompromised, gatewayPolicy, gitHub, probe);
+        return await rebaseOneBranch(ctx, branchDir, branchPath, hold.isCompromised, gatewayPolicy, gitHub, probe, local);
     }
     finally {
         await releaseProvisionedWorkspace(hold.release, branchDir);
     }
 }
-/** Clear a recorded failure and any recorded rewrite: the caller knows neither stands. */
-async function clearRebaseFailure(ctx, branchPath, branchRef) {
+/**
+ * Clear a recorded failure and any recorded rewrite, the caller knowing neither stands, with
+ * `alsoClear` in the same write.
+ */
+async function clearRebaseFailure(ctx, branchPath, branchRef, alsoClear = {}) {
     await getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath).update((current) => current?.branch.name === branchRef
-        ? { branch: { rebaseFailure: undefined, ...rewriteCleared(current.branch) } }
+        ? { branch: { rebaseFailure: undefined, ...rewriteCleared(current.branch), ...alsoClear } }
         : null);
 }
+/**
+ * {@link recordLatestChangesWaiting} for a branch the sync skips for its saved work: marked while it
+ * lacks the base `remote.git` holds. Read from `remote.git` rather than fetched, so the skip moves no
+ * ref. Best-effort, so the skip stays a skip.
+ */
+async function noteLatestChangesWaiting(ctx, git, branchPath, metaFile) {
+    if (metaFile.branch.status !== 'editing')
+        return;
+    let baseTip;
+    let behind;
+    try {
+        baseTip = await readPublishedSha(ctx, ctx.baseBranch);
+        behind = baseTip !== null && !(await contains(git, 'HEAD', baseTip));
+    }
+    catch (err) {
+        workerLogWarn(`  Could not compare ${escapeForLog(metaFile.branch.name)} with the base: ${getErrorMessage(err)}`);
+        return;
+    }
+    await recordLatestChangesWaiting(ctx, branchPath, metaFile, behind ? (baseTip ?? undefined) : undefined);
+}
+/**
+ * Mark the branch `metaFile` names as lacking `baseSha`, the base commit the sync first left out, or
+ * clear the mark when undefined: the automatic sync never commits saved work, so a branch holding
+ * some waits for its author's "Get latest changes" (base-update.ts). Written only when the mark comes
+ * or goes, as every save regenerates the branch registry, and as bookkeeping, which leaves
+ * `updatedAt`. Best-effort: a failure leaves the hint as it was until the next cycle.
+ */
+async function recordLatestChangesWaiting(ctx, branchPath, metaFile, baseSha) {
+    const { name } = metaFile.branch;
+    const flips = (current) => (current === undefined) !== (baseSha === undefined);
+    if (!flips(metaFile.branch.latestChangesWaiting))
+        return;
+    try {
+        await getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath).update((current) => current?.branch.name === name && flips(current.branch.latestChangesWaiting)
+            ? { branch: { latestChangesWaiting: baseSha } }
+            : null, { keepUpdatedAt: true });
+    }
+    catch (err) {
+        workerLogWarn(`  Could not record the latest changes waiting for ${escapeForLog(name)}: ${getErrorMessage(err)}`);
+    }
+}
 /** A branch github-commits.ts left for a person: logged, recorded, and in the cycle's summary. */
 async function recordBlocked(ctx, branchDir, branchPath, branchRef, reason) {
     // [REDACT] failed[] folds into worker-status.json, served to the browser, and these reasons name
@@ -809,7 +908,7 @@ async function withContentLockInReview(branchDir, branchPath, isProvisioningLock
  * returned as `{ kind: 'failed' }`, so one unreadable branch cannot halt the
  * rest of the cycle ([SYNC-M2]).
  */
-async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCompromised, gatewayPolicy, gitHub, probe = {}) {
+async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCompromised, gatewayPolicy, gitHub, probe = {}, local = false) {
     // Read only by the catch below. See the `rebased` rider on
     // BranchRebaseOutcome.
     let didRebase = false;
@@ -832,6 +931,8 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
         // - archived: finished, with no PR left to poll.
         if (metaFile !== null && (branchStatus === 'submitted' || branchStatus === 'approved')) {
             workerLog(`  Skipping ${branchDir} (${branchStatus})`);
+            // Submit committed the saved work; a withdraw lets the next skip mark it again.
+            await recordLatestChangesWaiting(ctx, branchPath, metaFile);
             await reconcileInReview(ctx, branchDir, branchPath, metaFile, isProvisioningLockCompromised);
             const outcome = await bringInCommitsForBranchInReview(ctx, branchDir, branchPath, metaFile, isProvisioningLockCompromised, gatewayPolicy, gitHub);
             const pullRequest = await pollMergeState(ctx, branchDir, branchPath, metaFile);
@@ -999,6 +1100,27 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
                     lockLost: lockCompromised,
                 }
                 : null;
+            const skipIfDirty = async () => {
+                if (editorDirt.length === 0)
+                    return { kind: 'none' };
+                if (metaFile !== null)
+                    await noteLatestChangesWaiting(ctx, branchGit, branchPath, metaFile);
+                return { kind: 'skippedDirty' };
+            };
+            // A merge of GitHub's commits whose result holds the base `remote.git` holds answers a request
+            // for the latest changes as a merge of the base does, conflicts included.
+            const tookInByGitHubMerge = async (keptEntries) => {
+                if (editorDirt.length > 0)
+                    return await skipIfDirty();
+                const baseTip = await readPublishedSha(ctx, ctx.baseBranch).catch(() => null);
+                const holdsBase = baseTip !== null && (await contains(branchGit, 'HEAD', baseTip).catch(() => false));
+                if (!holdsBase)
+                    return { kind: 'none' };
+                probe.baseSha = baseTip;
+                probe.keptEntries = keptEntries;
+                await clearRebaseFailure(ctx, branchPath, branchRef, { latestChangesWaiting: undefined });
+                return { kind: 'rebased' };
+            };
             // Before the dirty return: a fast-forward passes saves that touch other files.
             let unpushed = false;
             if (commitArgs !== null) {
@@ -1008,20 +1130,21 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
                 }
                 if (outcome.kind === 'unpushed')
                     unpushed = true;
-                else if (outcome.kind !== 'in-step') {
-                    return editorDirt.length > 0 ? { kind: 'skippedDirty' } : { kind: 'none' };
-                }
+                else if (outcome.kind === 'merged')
+                    return await tookInByGitHubMerge(outcome.keptEntries);
+                else if (outcome.kind !== 'in-step')
+                    return await skipIfDirty();
                 // A merge of the base this worker published and never moved the clone to comes first.
                 const caughtUp = await catchUpWithPublished(ctx, commitArgs);
                 if (caughtUp?.kind === 'blocked') {
                     return recordBlocked(ctx, branchDir, branchPath, branchRef, caughtUp.reason);
                 }
                 if (caughtUp)
-                    return editorDirt.length > 0 ? { kind: 'skippedDirty' } : { kind: 'none' };
+                    return await skipIfDirty();
             }
             if (editorDirt.length > 0) {
                 workerLog(`  Skipping ${branchDir}: has uncommitted changes`);
-                return { kind: 'skippedDirty' };
+                return await skipIfDirty();
             }
             // `git rebase` refuses to start over ANY modified tracked file, so
             // tracked canopycms state blocks. The worker never untracks it here:
@@ -1043,21 +1166,32 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
                 await recordRebaseFailure(ctx, branchPath, branchDir, reason);
                 return { kind: 'failed', error: reason };
             }
-            // [SYNC-H1] Self-heal: finish an interrupted publish even when this
-            // branch is not behind base. Every crash window in the arming sequence
-            // below leaves the marker set with the work unfinished, and this is what
-            // completes it -- without it one lost lease race strands the branch until
-            // the base happens to advance again. Gated on the loop-top snapshot, so
-            // unmarked branches (nearly all of them, every cycle) cost nothing.
+            // [SYNC-H1] Self-heal: finish a publish that never left remote.git at
+            // the marker's commit, even when this branch is not behind base -- a
+            // crash in the arming sequence below, or a failed push. Gated on the
+            // loop-top snapshot, so unmarked branches (nearly all of them, every
+            // cycle) cost nothing.
             if (canPublish && metaFile?.branch.historyRewrittenFrom) {
-                await reconcilePendingRewrite(ctx, {
+                const pending = await reconcilePendingRewrite(ctx, {
                     branchPath,
                     branchDir,
                     branchRef,
                     headSha: (await branchGit.revparse(['HEAD'])).trim(),
                     marker: metaFile.branch.historyRewrittenFrom,
+                    target: metaFile.branch.historyRewrittenTo,
                     gatewayPolicy,
                 });
+                // A rebase now would replace the rewrite remote.git still waits for, along with any commit
+                // made on top of it since, which only a submit may publish.
+                if (pending.kind === 'failed') {
+                    // [REDACT] failed[] is served to the browser via worker-status.json.
+                    const reason = redactCredentials(pending.reason);
+                    workerLogWarn(`  Skipping ${branchDir}: ${reason}`);
+                    await recordRebaseFailure(ctx, branchPath, branchDir, reason, branchRef);
+                    return { kind: 'failed', error: reason };
+                }
+                if (pending.kind === 'waiting')
+                    return { kind: 'none' };
             }
             await fetchFromRemoteGit(branchGit, ctx.remoteGitPath, ctx.baseBranch);
             // rev-list, not status.behind, which needs an upstream tracking branch
@@ -1088,6 +1222,8 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
                 // whose cause stands stays: remote.git still holds a commit this clone
                 // lacks, and the next submit is refused for it.
                 const currentMeta = await BranchMetadataFileManager.loadOnly(branchPath);
+                if (currentMeta !== null)
+                    await recordLatestChangesWaiting(ctx, branchPath, currentMeta);
                 if (currentMeta?.branch.rebaseFailure === undefined) {
                     return { kind: 'none' };
                 }
@@ -1110,13 +1246,17 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
             const head = (await branchGit.revparse(['HEAD'])).trim();
             // Commits on top of what this branch published, as "Get latest changes" makes from saved work
             // on a branch submitted once, or a submit whose push failed: a rebase would rewrite the
-            // published commit under them, which reads as a push this clone never saw. A merge publishes
-            // them as a fast-forward. A same-named ref at a commit the base holds is no work of this branch.
+            // published commit under them, which reads as a push this clone never saw. A merge keeps
+            // them, unpublished until the submit pushes it (publish-decision.ts). A same-named ref at a
+            // commit the base holds is no work of this branch.
             const published = canPublish ? await readPublishedSha(ctx, branchRef) : null;
+            // With no GitHub, a commit of the branch's in remote.git is published however it got there.
             const aheadOfPublished = published !== null &&
-                published !== head &&
                 metaFile?.branch.name === branchRef &&
-                isPublished(metaFile) &&
+                (local ||
+                    (published !== head &&
+                        // A rewrite's tip is this branch's own publish, on GitHub or not.
+                        (isPublished(metaFile) || published === metaFile.branch.historyRewrittenTo))) &&
                 (await contains(branchGit, head, published)) &&
                 !(await contains(branchGit, fetchedBaseTip, published));
             /**
@@ -1149,7 +1289,7 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
                     return { kind: 'skippedLocked' };
                 }
                 probe.keptEntries = outcome.keptEntries;
-                await clearRebaseFailure(ctx, branchPath, branchRef);
+                await clearRebaseFailure(ctx, branchPath, branchRef, { latestChangesWaiting: undefined });
                 return { kind: 'rebased' };
             };
             if (commitArgs !== null && (cannotReplay || unpushed || aheadOfPublished)) {
@@ -1175,6 +1315,9 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
             const publishedSha = published;
             await assertNoIncomingSubmodules(branchGit, branchPath, preRebaseHead, fetchedBaseTip);
             const { completed, conflicted, failureReason } = await runRebaseRounds(ctx, branchGit, branchDir, fetchedBaseTip, lockCompromised);
+            // The tip the rebase made, read before anything else awaits: past a lost lock a commit can
+            // land on it, and only this tip may be published as the rewrite.
+            const rebasedHead = (await branchGit.revparse(['HEAD'])).trim();
             // Outside the round loop's try/catch, so a throwing test hook can
             // never be misread as a rebase error.
             if (completed)
@@ -1248,6 +1391,7 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
                     branch: {
                         conflictStatus: (existing.branch.conflictFiles?.length ?? 0) > 0 ? 'conflicts-detected' : 'clean',
                         rebaseFailure: undefined,
+                        latestChangesWaiting: undefined,
                     },
                 }
                 : null);
@@ -1258,7 +1402,7 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
                 branchRef,
                 publishedSha,
                 preRebaseHead,
-                rebasedHead: (await branchGit.revparse(['HEAD'])).trim(),
+                rebasedHead,
                 gatewayPolicy,
             });
             return { kind: 'rebased' };

package/dist/worker/task-runner.js

@@ -16,6 +16,7 @@ import { writeWorkerStatus } from '../task-queue/worker-status.js';
 import { SYNC_PR_COMMENTS_ACTION, refreshCommentsBlock, renderPrCommentsBody } from '../pr-comments.js';
 import { SYNC_BRANCH_ACTION } from '../base-update.js';
 import { COMMIT_ID, REWRITTEN_PUSH_REFUSAL, SEEN_COMMIT_GONE_PUSH_REFUSAL, enqueueReviewBlockSync, } from './github-commits.js';
+import { getHttpStatus, isRateLimitSignal403 } from './github-errors.js';
 import { workerLog, workerLogError, workerLogWarn } from './log.js';
 import { assertSharedRepoConfig } from './shared-repo-git.js';
 /**
@@ -85,45 +86,6 @@ export function isPermanentTaskFailure(err) {
         return false;
     return status >= 400 && status < 500;
 }
-/** Extract an HTTP status from an error, if present (Octokit RequestError shape). */
-function getHttpStatus(err) {
-    if (err instanceof Error && 'status' in err) {
-        const status = err.status;
-        if (typeof status === 'number')
-            return status;
-    }
-    return null;
-}
-/** Narrow an unknown value to a response-headers record, if present (Octokit lowercases header names). */
-function getResponseHeaders(err) {
-    if (typeof err !== 'object' || err === null || !('response' in err))
-        return null;
-    const response = err.response;
-    if (typeof response !== 'object' || response === null || !('headers' in response))
-        return null;
-    const headers = response.headers;
-    if (typeof headers !== 'object' || headers === null)
-        return null;
-    return headers;
-}
-/**
- * Whether a 403 is a GitHub rate-limit response rather than a plain permission
- * denial. GitHub signals rate limiting on 403s three ways: the primary limit
- * zeroes `x-ratelimit-remaining`, secondary limits often carry `retry-after`,
- * and both produce a message containing "rate limit".
- */
-function isRateLimitSignal403(err) {
-    const headers = getResponseHeaders(err);
-    if (headers) {
-        if (headers['x-ratelimit-remaining'] === '0')
-            return true;
-        if (typeof headers['retry-after'] === 'string' && headers['retry-after'].length > 0)
-            return true;
-    }
-    if (err instanceof Error && /rate limit/i.test(err.message))
-        return true;
-    return false;
-}
 // Payload validation helpers — fail fast with clear errors instead of silent `as` casts
 /**
  * Whether `branch` carries the reserved settings-branch prefix, which routes a submit to a push
@@ -602,6 +564,7 @@ export async function updateBranchMetadata(ctx, task, result) {
             return;
         }
         let found = false;
+        let newPullRequest = false;
         // Bookkeeping: the save that queued this already said when the branch last changed.
         await meta.update((existing) => {
             if (existing?.branch.name !== branch)
@@ -626,6 +589,7 @@ export async function updateBranchMetadata(ctx, task, result) {
             if (result.prUrl && !archived)
                 updates.pullRequestUrl = result.prUrl;
             if (result.prNumber && !archived) {
+                newPullRequest = existing.branch.pullRequestNumber !== result.prNumber;
                 updates.pullRequestNumber = result.prNumber;
                 // As soon as the PR exists the field reads 'open', rather than staying
                 // absent until the next poll cycle observes it. Exception: the git-sync
@@ -641,6 +605,9 @@ export async function updateBranchMetadata(ctx, task, result) {
         }, { keepUpdatedAt: true });
         if (!found)
             noMetadataToRecord(branch, `${task.action} outcome`);
+        // The sync its push woke may have run before the number was recorded, and skipped the branch.
+        if (newPullRequest)
+            ctx.requestBranchSync(branch);
     }
     catch (err) {
         workerLogError(`Failed to update metadata for ${branch}:`, err instanceof Error ? err.message : err);
@@ -848,6 +815,7 @@ export async function pushBranchToGitHub(ctx, branch, signal) {
         // has moved past the rewritten commit and the marker is spent.
         await clearHistoryRewrittenMarker(ctx, branchPath, branch);
         await recordPushedToGitHub(ctx, branchPath, branch, outgoingSha);
+        wakeForConflictsStatus(ctx, branch, outcome);
         logPushOutcome(ctx, branch, outcome, 'GitHub had already moved past the rewritten commit');
         return;
     }
@@ -859,8 +827,17 @@ export async function pushBranchToGitHub(ctx, branch, signal) {
         await clearHistoryRewrittenMarker(ctx, branchPath, branch);
     }
     await recordPushedToGitHub(ctx, branchPath, branch, outgoingSha);
+    wakeForConflictsStatus(ctx, branch, outcome);
     logPushOutcome(ctx, branch, outcome);
 }
+/**
+ * A pull request's new head has no conflicts status until a git sync sets one
+ * (worker/conflicts-status.ts), and a required check waits on it: wake the sync for the branch.
+ */
+function wakeForConflictsStatus(ctx, branch, outcome) {
+    if (outcome.moved && !isSettingsBranch(branch))
+        ctx.requestBranchSync(branch);
+}
 /** An unmoved ref is routine (a task re-run after a crash), so it is logged at debug level. */
 function logPushOutcome(ctx, branch, outcome, note) {
     const suffix = note === undefined ? '' : `; ${note}`;

package/dist/worker/worker-context.d.ts

@@ -110,6 +110,12 @@ export interface WorkerContext {
      * restarted worker warns afresh.
      */
     warnedDivergences(): Map<string, string>;
+    /**
+     * The conflicts status this worker last set on each branch's pull request head, by branch name,
+     * and the tip each `not-head:` key last woke a sync for (worker/conflicts-status.ts). Held per
+     * instance, so a restarted worker sets each once again.
+     */
+    conflictsStatusesSet(): Map<string, string>;
     /**
      * Run the git sync early, coalesced: once it has rested `EARLY_RUN_MIN_REST_MS` (cms-worker.ts),
      * or its own interval if shorter, counting from when the last cycle ended, so a request during a

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@codemirror/language, @lezer/highlight: workaround — @mdxeditor/editor uses cm6-theme-basic-light which peer-requires these but mdxeditor doesn't declare them as dependencies",
   "name": "canopycms",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "description": "CanopyCMS core package: schema-driven content, branch-aware editing, and editor UI for Next.js.",
   "license": "MIT",
   "repository": {