plans: row 237 follow-up brief, one decision lands once, tests at the broker (megavolt-0069, sage-1651, P19 441)

docs/plans/2026-10-20_agent-credentials.md

@@ -102,3 +102,26 @@ plus a mutant that removes the check.
 
 Gate: Duckworth approves the manifest. The bus suite and every `scripts/test-*.sh` are green on Sage's gate,
 and the mutant is killed.
+
+## Brief: row 237 follow-up, one decision lands once, with tests at the broker
+
+Sage, 2026-10-21, from Megavolt's checkLand analysis (megavolt-0068, megavolt-0069) and sage-1651. Owner
+Megavolt, reviewer Duckworth, gate owner Sage. Builds on row 237's landing d7d943199. Vikunja P19 441.
+
+Landing already has three guards against one decision landing twice. `land-busy` at
+`packages/cli/src/git-socket.mjs:351` allows one landing per socket at a time. `finishLand` moves main by
+compare-and-swap (`packages/seat/src/working.mjs:391`, refusing `base-moved`). `recordLand` reruns
+`#landFacts`, which refuses `decision-consumed` (`packages/bus/src/broker.mjs:945`). So no end-to-end race
+exists, and no code change is planned. What's missing is a test that pins each guard.
+
+- In `packages/bus/tests/land.test.mjs`, add a test where two tickets pass `checkLand` on one decision. The
+  first `recordLand` succeeds and the second refuses `decision-consumed`, with nothing recorded for it.
+- Run three mutants and list them in BUILD.md: drop the `#spent` line in `#landFacts`, drop the old value
+  from the CAS `update-ref` in `finishLand`, and drop the `land-busy` throw at git-socket.mjs:351. Each must
+  be killed by a named test. If the CAS mutant survives `packages/seat/tests/working.test.mjs:555`, add a
+  test to working.test.mjs that kills it. Otherwise leave that file alone.
+- If a mutant survives with no test that can reach it, stop and send me the analysis. Don't change source
+  to make a test reach it.
+
+Gate: Duckworth approves the manifest. The bus, seat and cli suites and every `scripts/test-*.sh` are green
+on Sage's gate, and the three mutants are killed.