fix(sync): sources sync on PUSH (a red build holds nothing) + prune only what the repo put there

[rbuergi]

What

Two policies. Both are registered in PolicyNotProse, and the manual is Doc/Architecture/SourcesSyncOnPush.

sources-sync-on-push. A push to a sync source's configured branch imports every source of that repository and branch at the pushed commit (after), through the new UpdateToPushedCommitFromGitHub. Nothing waits for a CI verdict. Inside the import, each module is still judged by ModuleSyncDecision.Decide:

• unchanged: nothing is written;
• changed: the module syncs;
• declared floor above the running platform: that module alone is declined, with both versions named.

The other parts of the change:

• Green builds. A green workflow_run now only records BuildCompletion, which the plugin catalog consumes. It no longer imports, because a green build of an older commit that finishes after a newer push would move the Space backwards.
• Lost deliveries. GitSyncBranchReconcileService runs every GitSync:BranchReconcileMinutes (default 10). It calls GitHubWebhookProcessor.ReconcileBranches(), which does one GetHeadSha lookup per repository branch and then runs the same per-source selection at that sha. A lost webhook therefore repairs itself, and a source that is already on the head costs only the lookup.

prune-requires-provenance. StaticRepoImporter.ComputePrunableNodes now prunes a node only when that node is in the prior import manifest, in every pruning mode. FullReplace used to prune every extra node. Nodes with unknown provenance are never pruned.

Why (measured on memex.systemorph.com)

• The freeze. Plugins main was red from 2026-10-04 14:39Z. AI/_GitSync and Hosting/_GitSync were last attempted at 14:56Z, then nothing happened for 15 h. A manual update at 05:29Z imported immediately: 18 NodeTypes recompiled, 0 compile errors. The green-build trigger had re-introduced the whole-repository hold that module-sync-per-manifest-hash removed.
• The prune. That same manual import pruned 16 runtime nodes, including Hosting/Babysitter and Hosting/Queues/*.

Overlap with open PRs

None of the five touches GitHubWebhookProcessor or ComputePrunableNodes.

• GitSync: never import a package's sources onto a dependency floor the loaded build does not meet (#6067 follow-up) #6110 and fix(sync): an import does not write a module whose requires names a newer module than this instance runs (Plugins#2715) #6111 touch ModuleSyncDecision, GitHubSyncService and ModuleSyncPerManifestHash.md. This PR only adds GetBranchHead near AskBranchState and changes one row of the lane table, so it should be a trivial textual merge.
• fix(modules): a store copy overrides the image's own module only as a strictly newer release (#6044) #6103, fix(compiler): a prebuilt's module dependency records the PACKAGE version — adoption declines one bound to a newer module than installed #6116 and fix(cd): seal only a SETTLED MeshWeaver.Plugins commit — never the raw main HEAD #6119 are disjoint.

Local results (Release, -warnaserror, one project per build)

Builds: 0 warnings, 0 errors for each of GitSync, Graph.Test, Hosting.Test, Documentation.Test, Memex.Portal.Shared, Memex.Portal.Shared.Test, Messaging.Hub.Test and PluginTester.

Suite	Scope	Result
Graph.Test	full	2510/2510
Documentation.Test	full	670/670
Hosting.Test	webhook, sync and prune classes	43/43, then 97/97 on a wider filter
Memex.Portal.Shared.Test	import and webhook classes	60/60
Messaging.Hub.Test	Localization	66/66

Negative controls (actually run):

• Restoring the old FullReplace rule fails 3 tests: ARuntimeNodeSurvivesAnImportTest and two in StaticRepoImporterSyncModeTest.
• Disabling the push import fails 2 tests in BuildTriggeredSyncPinsTheBuiltCommitTest: the push-while-red test, and the test where a green build does not import but a push does.

Not established

• Production behaviour after the roll. It is not checked whether the hooks deliver push events.
• No end-to-end decline of an incompatible module. The local -ci.0 platform makes floors advisory, so the decline is pinned by a pure decision test on a pushed tree.
• Replicas. Each replica runs the reconcile, so a duplicate import can happen. It is cheap, not prevented.
• Out-of-order push deliveries can still step a Space back until the next push or reconcile.
• Lost provenance. Partitions with a missing or partial manifest keep stale extras.
• The 16 already-pruned nodes are not restored.

Recycle after deploy

Hosting and AI NodeTypes pick up new sources through the import. No manual recycle is needed for this change.

Pairs-with: none — no public type or member is removed; additions only (UpdateToPushedCommitFromGitHub, GitHubSyncService.GetBranchHead, GitHubWebhookProcessor.ReconcileBranches).
Implementers: none — no interface member added.
Mirror-sync: none — the two new keys activity.gitsync.updateToPushedCommit.{title,fetching} are server-rendered activity lines; the React mirror sync (npm run sync:i18n -- --ref <merged core sha>) can ride the next routine sync.

🤖 Generated with Claude Code

[github-actions]

Test Results

    18 files      18 suites   42m 17s ⏱️
10 330 tests 10 330 ✅ 0 💤 0 ❌
10 343 runs  10 343 ✅ 0 💤 0 ❌

Results for commit 4d3bf45.

♻️ This comment has been updated with latest results.

[github-actions]

Test Results (shard 0)

  4 files    4 suites   3m 50s ⏱️
405 tests 405 ✅ 0 💤 0 ❌
409 runs  409 ✅ 0 💤 0 ❌

Results for commit 4d3bf45.

[github-actions]

Test Results (shard 2)

1 862 tests   1 862 ✅  5m 17s ⏱️
    3 suites      0 💤
    3 files        0 ❌

Results for commit 4d3bf45.

[github-actions]

Test Results (shard 1)

    3 files      3 suites   6m 32s ⏱️
2 923 tests 2 923 ✅ 0 💤 0 ❌
2 927 runs  2 927 ✅ 0 💤 0 ❌

Results for commit 4d3bf45.

[github-actions]

Test Results (shard 3)

1 629 tests   1 629 ✅  6m 33s ⏱️
    2 suites      0 💤
    2 files        0 ❌

Results for commit 4d3bf45.

[github-actions]

Test Results (shard 5)

    2 files      2 suites   8m 43s ⏱️
1 100 tests 1 100 ✅ 0 💤 0 ❌
1 101 runs  1 101 ✅ 0 💤 0 ❌

Results for commit 4d3bf45.

[github-actions]

Test Results (shard 4)

    4 files      4 suites   11m 20s ⏱️
2 411 tests 2 411 ✅ 0 💤 0 ❌
2 415 runs  2 415 ✅ 0 💤 0 ❌

Results for commit 4d3bf45.