fix(forks): route new workflows through one row builder and harden lineage locking

[waleedlatif1]

Summary

Follow-up to #8318 (opt-in fork sync for new workflows).

Correctness

• Every genuinely new workflow (create, duplicate, admin/superuser import, workspace and fork starters) now goes through one buildNewWorkflowRow, which reads the workspace's fork-sync policy itself — a new insert path can no longer silently fall back to the column default. Fork/promote copies still write forkSyncExcluded: false
• createFork takes the lineage lock shared: forks in one lineage no longer serialize behind each other's full copy (and risk the 10s lock timeout), while the default write and unlink stay exclusive
• unlinkForkEdge re-checks the lineage root under the lock (409 if an unlink higher up moved it; still idempotent when this edge is already gone), matching createFork and setForkSyncDefault
• setForkSyncDefault walks the lineage once instead of three times, locks only live members whose value differs (FOR NO KEY UPDATE, id order), so a no-op toggle takes no row locks and FK inserts aren't blocked
• assertForkSourceVersions restored to its pre-feat(forks): opt-in fork sync for new workflows #8318 predicate — it was loosened for the "Copy unsynced workflows" override that was reverted before merge
• Toggling the default also invalidates open sync previews (their fingerprint covers the rewritten workspace rows)

Cleanup

• Lineage traversal moved to lib/lineage/lineage-root.ts (it no longer has anything to do with the sync default); central @sim/testing mock for it
• Removed the always-false forkSyncExcluded from the promote plan / copy params, the dead createWorkflowRecord, and an unneeded resources refetch
• Synced-workflows list: real error state instead of a false "no deployed workflows", aria-expanded, consistent disabled styling; toggle only renders once this workspace's lineage has loaded
• Docs: settings path is Workspace → Workspace forks (was Organization, in four places); toggle labels and copy semantics match the UI; comment pass trimmed review-history narration and fixed stale lock-table entries

Type of Change

• Bug fix

Testing

• fork-sync.integration.ts (real Postgres): new end-to-end case — set from a fork reaches the parent, repeat is a no-op, create/duplicate/starter take the policy, copies stay synced, archived middle member is traversed but not written
• fork-lock-order.integration.ts: shipped order (shared fork lock) completes; pre-fix order asserts deadlock by error code
• Unit: unlink re-check (both branches), lineage membership 409, cap boundary, fork policy inheritance
• Mutation-checked: reverting each guard (builder policy read, starter via tx, archived traversal, no-op filter, unlink re-check, membership check, inheritance) turns its test red
• bun run lint, full type-check, check:audits (52/52), check:migrations, docs-manifest:check, 3190 unit tests across the touched areas

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 29, 2026 6:08am UTC

[cubic-dev-ai]

All reported issues were addressed across 40 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[High risk] Refactors workflow creation and fork lineage locking across multiple code paths.

The PR appears safe to merge based on the current review.

Summary

The PR centralizes policy-aware creation of genuinely new workflows and adjusts fork-lineage locking, traversal, and default updates. It also refreshes sync previews after policy changes and clarifies the Forks UI and documentation.

• Fork copies remain synced; new workflows take their workspace’s current policy.
• Fork creation takes a shared lineage lock, while default changes and unlink retain exclusive locks.
• Tests cover policy inheritance, lineage membership, and lock ordering.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Create[Create, duplicate, import, or starter] --> Builder[buildNewWorkflowRow]
  Builder --> Policy[Read workspace fork-sync policy]
  Policy --> NewRow[Insert new workflow]
  Fork[Create fork] --> Shared[Shared lineage lock]
  Shared --> Copy[Copy synced workflows]
  Shared --> Starter[Build starter if no copies]
  Default[Change lineage default] --> Exclusive[Exclusive lineage lock]
  Unlink[Unlink edge] --> Exclusive

Loading

_{Reviews (2) · Last reviewed commit: "fix(workflows): read the fork-sync polic..."}

[greptile-apps]

Comments Outside Diff

These findings could not be posted inline.

•  Workflow selection loses regression tests apps/sim/ee/workspace-forking/components/fork-synced-workflows/fork-synced-workflows.test.ts:1 ▶

  Deleting this suite removes checks that a workflow with a missing folder stays selectable and that a parent folder’s select-all includes nested workflows. The replacement tests do not cover either case, so a later tree-traversal change could silently submit the wrong workflow IDs. Please retain or replace these focused tests.

  Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 40 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}