refactor: extract withReflogAction helper and fix stale doc references

Extract the repeated GIT_REFLOG_ACTION try/finally pattern into a
withReflogAction() helper in core/operation.ts, replacing 10 manual
instances across 8 files. Fix ARCHITECTURE.md reference to nonexistent
sync/abort-flow.ts (now sync/undo/) and update stale sync/ directory
listing in CLAUDE.md.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: henrikje

ARCHITECTURE.md

@@ -133,7 +133,7 @@ Workspace config (`.arbws/config.json`) and project config (`.arb/config.json`)
 
 Commands that can fail partway through sequential multi-repo execution write an operation record to `.arbws/operation.json`, enabling `--continue` (resume after conflicts), `--abort` (cancel and restore), and `arb undo` (reverse a completed operation). Running a bare command during an in-progress operation is blocked with guidance — the user must explicitly choose `--continue` or `--abort`.
 
-The shared infrastructure lives in `core/operation.ts` (schema, I/O, gate, reconciliation), `sync/continue-flow.ts` (shared continue orchestration), and `sync/abort-flow.ts` (shared abort execution). Adding a new command type requires a thin handler and an undo switch case. See `decisions/0095-operation-record-and-recovery-model.md` for the design rationale, option analysis, and the relationship between `--abort` and `arb undo`.
+The shared infrastructure lives in `core/operation.ts` (schema, I/O, gate, reconciliation), `sync/continue-flow.ts` (shared continue orchestration), and `sync/undo/` (assessment, planning, execution for both `--abort` and `arb undo`). Adding a new command type requires a thin handler and an undo switch case. See `decisions/0095-operation-record-and-recovery-model.md` for the design rationale, option analysis, and the relationship between `--abort` and `arb undo`.
 
 ### Git worktree directory layout
 

CLAUDE.md

@@ -40,7 +40,7 @@ Organized into semantic subdirectories. Each directory has a barrel `index.ts` r
 - **`status/`** — Canonical status model: `status.ts` (RepoStatus, RepoFlags, gathering, filtering — see ARCHITECTURE.md), `skip-flags.ts`, `pr-detection.ts`, `ticket-detection.ts`, `test-helpers.ts` (makeRepo fixtures)
 - **`render/`** — Declarative render model: `model.ts` (Cell, Span, Attention, OutputNode types, cell helpers — zero lib imports), `analysis.ts` (analyze* functions, buildStatusCountsCell, formatStatusCounts, flagLabels), `render.ts` (OutputNode[] → ANSI string), `status-view.ts`, `status-verbose.ts`, `conflict-report.ts`, `repo-header.ts`, `plan-format.ts`, `integrate-graph.ts`, `integrate-cells.ts`, `phased-render.ts`, `height-fit.ts` (vertical truncation for watch mode)
 - **`workspace/`** — Workspace management: `arb-root.ts` (.arb/ marker detection), `repos.ts` (repo listing, selection), `worktrees.ts`, `branch.ts` (workspace branch detection), `context.ts` (requireWorkspace/requireBranch guards), `clean.ts`, `templates.ts`
-- **`sync/`** — Synchronization: `integrate.ts` (shared rebase/merge logic), `parallel-fetch.ts` (concurrent fetch with timeout), `mutation-flow.ts` (confirmation prompts, phased render integration)
+- **`sync/`** — Synchronization: `integrate.ts` (shared rebase/merge logic), `continue-flow.ts` (shared --continue orchestration), `undo/` (assessment, planning, execution for --abort and arb undo), `parallel-fetch.ts` (concurrent fetch with timeout), `mutation-flow.ts` (confirmation prompts, phased render integration), `assess-with-cache.ts` (shared status+classify factory), `classify-integrate.ts` / `classify-retarget.ts` (per-repo classifiers), `network-errors.ts`, `constants.ts`, `types.ts`
 - **`json/`** — JSON output: `json-types.ts` (Zod schemas), `json-schema.ts`
 - **`help/`** — Help topics
 

src/commands/branch-rename.ts

@@ -10,6 +10,7 @@ import {
   finalizeOperationRecord,
   readInProgressOperation,
   readWorkspaceConfig,
+  withReflogAction,
   writeOperationRecord,
   writeWorkspaceConfig,
 } from "../lib/core";
@@ -439,8 +440,7 @@ async function runRename(
   let renameOk = 0;
   const failures: string[] = [];
 
-  try {
-    process.env.GIT_REFLOG_ACTION = "arb-branch-rename";
+  await withReflogAction("arb-branch-rename", async () => {
     for (const a of willRename) {
       inlineStart(a.repo, "renaming");
       const result = await renameBranch(a.repoDir, oldBranch, newBranch);
@@ -472,10 +472,7 @@ async function runRename(
         failures.push(a.repo);
       }
     }
-  } finally {
-    // biome-ignore lint/performance/noDelete: must truly unset env var, not coerce to string
-    delete process.env.GIT_REFLOG_ACTION;
-  }
+  });
 
   if (failures.length > 0) {
     process.stderr.write("\n");

src/commands/pull.ts

@@ -10,6 +10,7 @@ import {
   assertNoInProgressOperation,
   readInProgressOperation,
   readWorkspaceConfig,
+  withReflogAction,
   writeOperationRecord,
 } from "../lib/core";
 import {
@@ -276,8 +277,7 @@ export async function runPull(
     writeOperationRecord(wsDir, record);
   };
 
-  try {
-    process.env.GIT_REFLOG_ACTION = "arb-pull";
+  await withReflogAction("arb-pull", async () => {
     for (const a of willPull) {
       const strategy = a.pullStrategy ?? (a.pullMode === "rebase" ? "rebase-pull" : "merge-pull");
       inlineStart(a.repo, `pulling (${pullStrategyLabel(strategy)})`);
@@ -383,10 +383,7 @@ export async function runPull(
         }
       }
     }
-  } finally {
-    // biome-ignore lint/performance/noDelete: must truly unset env var, not coerce to string
-    delete process.env.GIT_REFLOG_ACTION;
-  }
+  });
 
   // Consolidated conflict report
   const conflictNodes = buildConflictReport(

src/commands/rename.ts

@@ -10,6 +10,7 @@ import {
   captureRepoState,
   readInProgressOperation,
   readWorkspaceConfig,
+  withReflogAction,
   writeOperationRecord,
   writeWorkspaceConfig,
 } from "../lib/core";
@@ -277,8 +278,7 @@ async function runWorkspaceRename(
     // Operation record tracks in-progress state (no config mutation until completion)
 
     const failures: string[] = [];
-    try {
-      process.env.GIT_REFLOG_ACTION = "arb-rename";
+    await withReflogAction("arb-rename", async () => {
       for (const a of willRename) {
         inlineStart(a.repo, "renaming");
         const result = await renameBranch(a.repoDir, oldBranch, newBranch);
@@ -304,10 +304,7 @@ async function runWorkspaceRename(
           failures.push(a.repo);
         }
       }
-    } finally {
-      // biome-ignore lint/performance/noDelete: must truly unset env var, not coerce to string
-      delete process.env.GIT_REFLOG_ACTION;
-    }
+    });
 
     if (failures.length > 0) {
       process.stderr.write("\n");

src/commands/reset.ts

@@ -8,6 +8,7 @@ import {
   assertNoInProgressOperation,
   captureRepoState,
   readWorkspaceConfig,
+  withReflogAction,
   writeOperationRecord,
 } from "../lib/core";
 import { getCommitsBetweenFull, getShortHead, gitLocal } from "../lib/git";
@@ -501,8 +502,7 @@ export function registerResetCommand(program: Command): void {
         let resetOk = 0;
         const failed: { assessment: ResetAssessment; stderr: string }[] = [];
 
-        try {
-          process.env.GIT_REFLOG_ACTION = "arb-reset";
+        await withReflogAction("arb-reset", async () => {
           for (const a of willReset) {
             inlineStart(a.repo, `resetting to ${a.target}`);
             const result = await gitLocal(a.repoDir, "reset", `--${resetMode}`, a.target);
@@ -526,10 +526,7 @@ export function registerResetCommand(program: Command): void {
               failed.push({ assessment: a, stderr: result.stderr });
             }
           }
-        } finally {
-          // biome-ignore lint/performance/noDelete: must truly unset env var, not coerce to string
-          delete process.env.GIT_REFLOG_ACTION;
-        }
+        });
 
         // Failure report
         if (failed.length > 0) {

src/commands/retarget.ts

@@ -10,6 +10,7 @@ import {
   assertNoInProgressOperation,
   readInProgressOperation,
   readWorkspaceConfig,
+  withReflogAction,
   writeOperationRecord,
   writeWorkspaceConfig,
 } from "../lib/core";
@@ -305,8 +306,7 @@ export function registerRetargetCommand(program: Command): void {
         let succeeded = 0;
         const conflicted: { assessment: RetargetAssessment; stdout: string; stderr: string }[] = [];
 
-        try {
-          process.env.GIT_REFLOG_ACTION = "arb-retarget";
+        await withReflogAction("arb-retarget", async () => {
           for (const a of willRetarget) {
             const targetRef = `${a.baseRemote}/${a.targetBranch}`;
 
@@ -352,10 +352,7 @@ export function registerRetargetCommand(program: Command): void {
               conflicted.push({ assessment: a, stdout: result.stdout, stderr: result.stderr });
             }
           }
-        } finally {
-          // biome-ignore lint/performance/noDelete: must truly unset env var, not coerce to string
-          delete process.env.GIT_REFLOG_ACTION;
-        }
+        });
 
         // Phase 7: conflict report
         const conflictNodes = buildConflictReport(

src/lib/core/index.ts

@@ -31,6 +31,7 @@ export {
   deleteOperationRecord,
   finalizeOperationRecord,
   readInProgressOperation,
+  withReflogAction,
   readOperationRecord,
   writeOperationRecord,
 } from "./operation";

src/lib/core/operation.ts

@@ -158,6 +158,23 @@ export function finalizeOperationRecord(wsDir: string, outcome: OperationOutcome
   }
 }
 
+// ── Reflog action ──
+
+/**
+ * Run an async function with `GIT_REFLOG_ACTION` set so git reflog entries
+ * are tagged (e.g. `arb-rebase`, `arb-undo`). The env var is always cleaned
+ * up, even if the function throws.
+ */
+export async function withReflogAction<T>(action: string, fn: () => Promise<T>): Promise<T> {
+  process.env.GIT_REFLOG_ACTION = action;
+  try {
+    return await fn();
+  } finally {
+    // biome-ignore lint/performance/noDelete: must truly unset env var, not coerce to string
+    delete process.env.GIT_REFLOG_ACTION;
+  }
+}
+
 // ── Gate ──
 
 export async function assertNoInProgressOperation(wsDir: string): Promise<void> {

src/lib/sync/continue-flow.ts

@@ -1,7 +1,7 @@
 import { basename } from "node:path";
 import { ArbError } from "../core/errors";
 import type { OperationRecord } from "../core/operation";
-import { classifyContinueRepo, writeOperationRecord } from "../core/operation";
+import { classifyContinueRepo, withReflogAction, writeOperationRecord } from "../core/operation";
 import { gitLocal } from "../git/git";
 import { buildConflictReport } from "../render/conflict-report";
 import type { Cell, OutputNode } from "../render/model";
@@ -172,8 +172,7 @@ export async function runContinueFlow(params: ContinueFlowParams): Promise<void>
   let succeeded = 0;
   const newConflicts: { repo: string; stdout: string; stderr: string }[] = [];
 
-  try {
-    process.env.GIT_REFLOG_ACTION = `arb-${mode}-continue`;
+  await withReflogAction(`arb-${mode}-continue`, async () => {
     for (const c of willContinue) {
       inlineStart(c.repo, `continuing ${mode}`);
       const cmd = typeof gitContinueCmd === "string" ? gitContinueCmd : await gitContinueCmd(c.repoDir);
@@ -197,10 +196,7 @@ export async function runContinueFlow(params: ContinueFlowParams): Promise<void>
         newConflicts.push({ repo: c.repo, stdout: result.stdout, stderr: result.stderr });
       }
     }
-  } finally {
-    // biome-ignore lint/performance/noDelete: must truly unset env var, not coerce to string
-    delete process.env.GIT_REFLOG_ACTION;
-  }
+  });
 
   // Step 9: Show conflict details for failures (B2 fix)
   if (newConflicts.length > 0) {