# Row 137 (#1631): agents land approved merges into the business working repository

Brief: `docs/plans/2026-10-15_q167-rows-r3.md`, section "Agents land approved
merges into the business working repository". I designed against blob
`f5ef29a2` (commit `c07c87fc2`, rev 1532). The row is now pinned to blob
`6805904555dc` (rev 1564). The section differs from `f5ef29a2` in one
paragraph, the read.mjs rule from sage-0505 and sage-0511, which this
candidate already follows (see "Arbiter path and `gated` refusal"
below). Owner Darkwing; reviewers Dewey and Filbert. Base `7a2987cf5` for
rounds 1 and 2; round 3 is rebased onto `63c82f1c4`, row 139's landing.

The design comes first, then "As built", the docs, the test map, and the
checks with the candidate.

## What lands where

A landing moves `refs/heads/main` in the business working repository,
`<dataRoot>/working/<business>/<project>.git`. Nothing writes the project
root, and canonical `refactor` is never a target. `scripts/land-work.sh`
keeps working as it does today.

## The seed (working.mjs)

Today `seed()` fetches the project root's HEAD as `+HEAD:refs/heads/main`,
forced, on every push and review. A landed main would be thrown away on the
next push. The new seed:

1. Fetch the root's HEAD as `+HEAD:refs/heads/root`, forced. A failure
   refuses `root-unreadable`, as now.
2. If main doesn't exist, create it at root's tip (`update-ref main <tip> ""`,
   which fails if another process created it first).
3. If main exists, isn't root's tip, and is an ancestor of root, fast-forward
   it with `update-ref main <tip> <old>` (compare and swap).
4. Otherwise leave main alone. It is never forced.

push, review and land all seed under the repository lock. Working
repositories that exist today need no migration: the first seed after the
change creates `refs/heads/root`, and main is already an ancestor of it.

### The push and fetch behaviour change

The brief asks for this to be named. After the first landing, main and root
diverge until the owner brings main into the root.

- push's unrelated-history check still compares against main. A push whose
  commit shares no history with main refuses `unrelated-history`. If the
  owner rewrites the root's history, main keeps the old one, and pushes
  built on the rewrite refuse until main is reconciled by hand.
- Coders clone from the project root, so a later task's branch doesn't have
  earlier landings. Its merge base with main is then the root commit it
  started from, and the reviewed diff `MB..C` is the task's own change, as
  before. Landing it on a main that has moved on can refuse `base-conflict`
  where the two touch the same lines.
- The reviewer's fetch now also has `refs/heads/root` in the repository, so
  its `have` negotiation knows the root's commits. What the reviewer gets is
  unchanged.
- When the owner merges main into the root, the next seed fast-forwards main
  and the two agree again.

## Who may land (broker)

The run that holds an approved `git.merge.protected` decision asks for the
landing. Row 136 lets a later run of the same instance use it.

**Target rule.** The raise's `context.target` must equal the task ref named
by the question's work ref (`vikunja:<project>/<task>` for
`work/vikunja-<project>-<task>`). Then `#consumeAuthority` writes the record
with that task ref as its subject, so the landing sits on the task's trail
and `task-subject-required` can't fire. `refactor` never matches a task ref,
so canonical refactor can't be a target, and land-work's decisions (target
`refactor`) and agent landings (target a task ref) can't be used for each
other.

**Shared checks.** `readLanding` moves from `scripts/land-work/read.mjs` to
`packages/bus/src/landing.mjs` and takes `{ into }`:

- `into: 'refactor'` (land-work): the raise targets `refactor`, and read.mjs
  still checks its `--base` is `refactor`.
- `into: 'main'` (agent landing): the raise targets the task ref.
- Anything else refuses `target-branch`.

It runs over a small query adapter (`get`, `all`), so read.mjs passes its
read-only `DatabaseSync` and the broker passes its Store. read.mjs keeps its
CLI and its own schema check.

The human check (`res.by === business.human`, `via === 'cli'`, one human
answer with no role or run) is in the shared `readLanding`. Under b2a2d741c
(sage-0517) land-work's check never changes: canonical `refactor` stays the
lead's landing. Only the host land op's call accepts a decision its arbiter
resolved (REQ-DEC-2). Row 139 landed first, so round 3 adds that with the
`arbiter` option only the broker passes, and the test that an
arbiter-resolved merge decision raised by merge-gate lands through the host
op. See "Round 3".

**New broker methods** (trusted, through the launch socket ops):

- `checkLand(cap, { task_ref, decision })`: the session's agent and task,
  `#checkAuthority(s, 'git.merge.protected', { decision, target: task_ref })`,
  decision not already consumed, then `readLanding` with `into: 'main'`. The
  project is the task's latest push; no push refuses `ref-moved`. A decision
  that names another project refuses `work-ref`.
- `recordLand(cap, land)`: reruns the checks inside the transaction (the
  verdict is still the latest and approving, nothing supersedes the
  decision), then `#consumeAuthority` writes the `action.allowed` with the
  landed commit, the old main, the reviewed commit, the verdict and the
  patch-id. The decision is spent.
- `recordEvent` reserves `action.allowed` for `git.merge.protected`, as it
  already does for `git.push.working`, so no run can write a fake landing.
- `landHeld({ business, role, thread })`: whether that role and thread hold
  a resolved, unconsumed merge decision with the approval option. The
  launcher asks it at launch.

### REQ-LAND-1 and the gated path (sage-0505)

PRD 1.5 round 2 (row 135) says only a role whose role file grants
`git.merge.protected` as a cross-role action may land, and an approval of a
gated-class merge decision never lands. Row 139 takes `git.merge.protected`
out of GATED_ONLY.

This row takes the current gated path. A test role file can't hold the
grant: `role.mjs` refuses any GATED_ONLY action under `withinRole` or
`crossRole`, and the broker's `GATED` set classifies `git.merge.protected` as
`gated` before it reads the role file. So `checkLand` goes through
`#checkAuthority` with class `gated`, and the tests raise gated decisions.

The refusal of class `gated` belongs in `checkLand` and `recordLand`, right
after the authority check returns. The brief (c07c87fc2) says whichever of
rows 137 and 139 lands second carries it with its test, and Sage checks
that at each landing. Row 139 landed first as `63c82f1c4`, so round 3 adds
the refusal, the arbiter path and both tests, and `landHeld` asks for a
cross-role decision so the launcher binds the op only for a role that could
land. The paragraphs above describe the rounds 1 and 2 base; "Round 3" has
what changed.

## The land op (git socket)

The socket takes a third op, `land`, with `{ cap, task_ref, decision }`.
The launcher binds the git socket for a run whose role and thread hold a
merge decision (`landHeld`), as well as for the push and verdict roles it
binds today. The bundle shows a `land_work` tool only then. The broker
rechecks everything at request time, so binding grants nothing by itself.
A decision resolved while a run is going can only be landed from the next
run, because the bundle is fixed at launch.

### Asynchronous outcome (a choice, flagged for Sage)

A full gate takes longer than every timeout between the agent and the host:
the tool call's 60 s default (`callTool`), the runner's 900 s turn and the
git client's 300 s socket timeout. The op can't wait for it.

So `land` answers as soon as the gate has started:
`{ landing: "started", base, reviewed, patch_id }`. Every check that can
refuse before the gate answers synchronously as a refusal, as push does.
The host finishes in the background. The outcome is two records:

- the `action.allowed` (landed) or `action.refused` (`gate-failed`,
  `base-moved`, `host-closing`, ...) on the task's trail, and
- a RESULT message from the bus (`_bus`, run `bus`, as `#notice` sends) to
  the role in the decision's thread, saying what landed or why not. RESULT
  makes the runner take a turn and send no automatic reply.

That message is a broker change beyond "the authority check for the new op
only". The alternative is a run that polls the trail, which needs a read op
agents don't have. I took the message. If Sage wants the narrower scope, the
fallback is the records alone and the role learns the outcome from its next
launch.

The git socket runs one landing at a time. A second request while one is
running refuses `land-busy`. Two full gates at once would also fight over
Docker.

If the host closes during a gate, the gate's process group is killed and the
landing is refused `host-closing`; nothing moves. If the host dies outright,
nothing is recorded and the decision is still unspent, so the run can ask
again.

### The steps

In order, matching land-work's refusal order and codes:

1. Broker `checkLand`: `decision-not-found`, `not-a-merge`, `not-resolved`,
   `not-human`, `not-merge-option`, `work-ref`, `target-branch`,
   `superseded`, `no-verdict`, `not-approved`, plus `decision-consumed`.
2. Under the repository lock: seed; the work ref's tip must be the
   verdict's commit (`ref-moved`); OLD is main; `MB = merge-base(OLD, C)`,
   none refuses `base-conflict`; the reviewed patch is `MB..C` in land-work's
   fixed diff format, empty refuses `base-conflict`; its patch-id is taken.
3. Root file: an added top-level file, an added top-level directory OLD
   doesn't have, or anything under `src/` or `v1/` refuses `root-file`.
4. The squash, in a temporary index on OLD's tree: the patch is applied
   with `apply --cached`; failure refuses `base-conflict`; the patch-id of
   `OLD..tree` must equal the reviewed one (`patch-drift`). The commit is
   made with `commit-tree`, no ref, author and committer "Mosaic bus host"
   `<bus-host@mosaic.invalid>`, and land-work's message with
   `Applied-under: git socket land (bus host)`. The commit is fixed before
   the gate, so nothing the gate does can change what lands.
5. Gate check: the project root is a mosaic-stack checkout (below) with a
   `node_modules`; otherwise `gate-missing`. This is the last synchronous
   refusal; the op answers "started" here.
6. The gate, outside the lock, in a detached worktree of the new commit
   with the root's `node_modules` linked. A failing step refuses
   `gate-failed` with the step and its log.
7. Under the lock: `update-ref main NEW OLD`; failure refuses `base-moved`.
   Then `recordLand`. If recording throws, main goes back with
   `update-ref main OLD NEW`; if that fails too, the refusal is
   `rollback-failed` and names both commits.

The worktree, its `node_modules` link and the Docker network
`<name>_default` are removed on every path. Logs stay under
`<dataRoot>/bus-host/land/<id>/`.

### The exact mosaic-stack check

`git -C <root> merge-base --is-ancestor c2365ae5190aee751bfbd0a3d47105a706adb5e7 HEAD`.
c2365ae5 is the new foundation's root commit ("chore: baseline container POC
and atomic foundation plan", 2026-09-02, tag `poc-container-hello-v0`). The
repository has three root commits (c2365ae5, e7f338e3, ecde7443); a project
without c2365ae5 in its history isn't this one. The root must also have a
`node_modules` directory, which the gate links.

### The gate

One definition, in `packages/seat/src/landing.mjs`, used by the host and by
land-work.sh: every `packages/<p>/tests/*.test.mjs` suite except queue's
(`scripts/test-queue.sh` runs those), then every `scripts/test-*.sh`, each
step logged to `<step>.log` and summarised in `gate.log` with land-work's
line format, ending `GATE_PASSED`. land-work.sh calls it through node and
keeps its own worktree, refusal messages and Docker cleanup. The root-file
rule moves to the same module.

The gate runs reviewed, agent-authored code on the host, outside a sandbox,
with the host's environment. land-work.sh does the same today under the
conductor. Here a human-resolved decision and an approving review are what
authorize it.

## Harness

- `land_work` tool, verb `working.land`, in `tools.mjs`, shown when the
  launcher says the session may land.
- `landWork()` client in `git-tools.mjs`.
- runner local handler for `working.land` over the session's git socket.

## Out of scope

Routing and GATED_ONLY (row 139), the merge-gate role (row 149), any push
to a remote, force-push or history rewrite.

## As built: where the candidate differs from the design above

- **The squash is made in a worktree, not a temporary index.** prepareLand
  adds a detached worktree of the bare repository at main under
  `bus-host/land/<id>/<id>` and applies the reviewed patch there with
  `git apply --index`. The applied diff (`--cached` against OLD) must have
  the reviewed patch-id. `write-tree`, `commit-tree` with OLD as the one
  parent, then `reset --soft` to the squash, so the gate runs in the tree
  that lands. The worktree goes on every refusal and at the end
  (`dropLand`, which removes the `node_modules` symlink first).
- **Patches are written by git.** Both diffs go through
  `git diff --output=<file>` with fixed prefixes, no textconv and no
  external diff, and patch-id reads the file. A file that isn't UTF-8
  keeps its patch-id.
- **Order.** The root-file check runs before the worktree is added, so a
  root-file refusal never touches the object store beyond reading.
  gate-missing comes after prepareLand, so the squash exists when the
  host answers `started`.
- **The `started` answer carries `commit`**, the squash, besides `base`,
  `reviewed` and `patch_id`. An agent can say what will land.
- **Tickets.** checkLand returns a ticket the host passes to recordLand
  and landRefused. A ticket outlives the run that asked, since the gate
  may end after the run did. An unknown ticket refuses `land-unknown`.
  recordLand checks authority with `#authorityFor` (the holder check is
  left out for that reason) and reruns the landing checks in the
  transaction; it writes the `action.allowed` itself rather than through
  `#consumeAuthority`, which would ask for the claim again.
- **`no-subject`.** land-work refuses a landing with no subject and no
  `--subject`. An agent has no `--subject`, so checkLand refuses a merge
  option with no first line `no-subject`.
- **`decision-consumed`** is checked in checkLand and again in recordLand.
- **The gate's environment.** The host runs the gate with `gateEnv`: PATH,
  HOME, USER, LOGNAME, SHELL, LANG, LC_ALL, TZ, TERM, TMPDIR,
  XDG_RUNTIME_DIR and DOCKER_HOST only. This replaces "with the host's
  environment" in the gate section. land-work.sh keeps the conductor's.
- **isMosaicStack is async** and runs git through `runGit` with only the
  environment's PATH, hooks at /dev/null and fsmonitor off.
- **The gate is injectable.** `createGitSocket({gate})` takes `LAND_GATE`'s
  shape, `{classify, run, dropNetwork}`, so the socket tests run a fake
  gate. A test checks that `LAND_GATE` holds the real `isMosaicStack` and
  `runGate`, and the refusals test runs the real classifier on a fixture
  project for gate-missing.
- **Harness.** `land_work` has no clone requirement and sits between
  `push_working` and `request_review`. The prompt line (round 3 wording):
  "Landing: once your merge decision is approved, land_work it with the task. The
  reply only says the landing started; the gate's outcome comes later as a
  RESULT from the bus. Don't land again while one is running." The
  launcher asks `landHeld` with the run's role instance and thread and
  binds the git socket when it answers true.
- **The runner's `working.land` route has no test of its own.** Neither do
  `working.push` and `working.fetch`. `landWork` is tested in
  git-tools.test.mjs against a fake host socket, and the launcher test
  checks the bundle and `session.json`.
- **Arbiter path and `gated` refusal** (sage-0511, sage-0517, sage-0565):
  rounds 1 and 2 left both out, since row 139 hadn't landed, and both
  callers of `readLanding` required a human/cli resolution. Row 139 landed
  first, so round 3 adds them (see "Round 3"). land-work's check in
  `scripts/land-work/read.mjs` is unchanged in effect in every round.
- **The raise is found by its body, not its subject.** read.mjs looked
  for the decision.raise `action.allowed` with `subject` equal to the
  decision id. The broker files a raise under its task ref when it has
  one (`a.task_ref ?? target-if-task-ref ?? id`), so every decision raised
  for a task, which is every one the host op lands, came back
  decision-not-found. The first gate run caught it (six land.test
  failures). `readLanding` now matches the business, the kind, the
  operation and `body.decision`, as the broker's own raise lookups do.
  For land-work this changes one thing: a refactor decision raised with a
  `task_ref` used to refuse decision-not-found and now reaches the checks
  after it, where a `task_ref` that disagrees with the question refuses
  work-ref. That branch existed in read.mjs but no real raise could reach
  it; the fixture in test-land-work.sh files every raise under the
  decision id, so its cases are unchanged. The human-only check is
  untouched. `recordEvent` refuses an `action.allowed` whose action is
  `git.merge.protected`, so an adapter can't add a second raise that
  passes.
- **landing.mjs is a runner file.** The broker imports it, so it joins
  `RUNNER_FILES` in packages/seat/src/sandbox.mjs, and the bus import
  closure test (project-runtime.test.mjs, row 138) lists the new import
  and checks that landing.mjs imports nothing.
- **thread-launch.test.mjs's host answers landHeld.** Its in-process host
  lists the launch ops it serves, and every launch now asks `landHeld`, so
  five of its tests failed with "invalid-host-request" until the op was
  added beside `threadIdle`.

## Docs

Only the landing paragraphs the brief names:

- `packages/seat/README.md`: push step 2 and the review paragraph now
  describe the root seed; "No other ref moves" names the seed's refs; a new
  "Landing on main (#1631)" subsection covers prepareLand, finishLand,
  dropLand and `src/landing.mjs`; the sandbox bind list adds `landHeld`.
- `packages/cli/README.md`, "Git socket": the bind rule, a `land` row in
  the op table, `checkLand` in the check order, a landing paragraph (steps,
  land-busy, landRefused, the RESULT outcome, logs, `LAND_GATE`), and
  close() stopping a gate.
- `packages/bus/README.md`: the four row 137 ops and the ticket.
- `packages/harness/README.md`: the `land_work` paragraph, runner step 3,
  the git socket bind rule.
- `docs/TOOLS.md`: one paragraph after land-work's on the shared modules.

Each passes `tools/unslop-hook/unslop-check.js`.

## Tests, against the brief's list

| Brief | Test |
|---|---|
| A reseed moves root and leaves a landed main | working.test "a reseed moves root but leaves a landed main, and main forwards once root contains it" |
| main fast-forwards to root when it's an ancestor, stays put when it isn't | the same test, and "after a landing, a push built on the root still lands and main stays where the landing put it" |
| push's unrelated-history check against main | working.test "a branch with no history in common with main refuses unrelated-history", where main and root are the same commit, and (round 2) "once the root shares no history with a landed main, a push is checked against main, not the root", where they share nothing: a push built on main lands and one built on the root refuses |
| A mosaic-stack checkout runs the gate | landing.test "isMosaicStack: ... node_modules; nothing else" (true on a child of the root commit) and the runGate tests; git-socket.test "land: the squash runs the gate in its own worktree, then main moves and the broker records it" with a classifier that says yes |
| Another project refuses gate-missing | git-socket.test "land: refusals before the gate ..." with the real `isMosaicStack` on the fixture project |
| Each land-work refusal code | On the shared module: `scripts/test-land-work.sh` runs every `readLanding` code through land-work (`into: 'refactor'`), unchanged from row 116. On the host side: land.test "checkLand refuses on the decision and the review" (the broker's decision-not-found, decision-not-approved, decision-mismatch, no-verdict, ref-moved), "checkLand refuses with land-work's codes past the authority check..." (work-ref twice, target-branch, superseded, not-approved, and a `refactor` decision refused decision-mismatch), "no-subject", and decision-consumed in the first test; working.test ref-moved, base-conflict, root-file, base-moved, rollback-failed, and (round 2) patch-drift, with a git first on the PATH that adds a line to what `apply --index` staged, as test-land-work.sh does; git-socket.test gate-missing, gate-failed, land-busy, host-closing, unknown-project and a broker refusal at record |

On the host side, `#checkAuthority` runs first, so `not-a-merge`,
`not-resolved` and `not-merge-option` reach the role as the broker's
`decision-mismatch` or `decision-not-approved`. In rounds 1 and 2,
`not-human` couldn't happen there, since only the human resolved a gated
decision. In round 3 it still can't reach checkLand: a gated decision
refuses `not-authorized` first, and the broker resolves a cross-role one
only through its route, the arbiter or the human. The round 3 test checks
`not-human` on `readLanding` directly instead (see "Round 3").

Also new: landing.test (rootHits, gateEnv, gateSteps, runGate pass, fail
and abort, the CLI), land.test (ticket, landRefused, landHeld, the
reserved event), the launcher test for `landHeld` binding, and the
harness tests for the tool, the prompt line and `landWork`.
`scripts/test-land-work.sh` is unchanged and runs land-work through the
shared gate and root-file CLI.

## Candidate

`r1/build.patch` against BASE `7a2987cf5`
(sha256 `49d5048f6bb53e1b546a6b2dbdec14ef4a9bfe5087f20e218018a62481266611`).
`r1/candidate-manifest.sha256` lists the 31 files: 27 changed and 4 new.
The new ones are packages/bus/src/landing.mjs, packages/bus/tests/land.test.mjs,
packages/seat/src/landing.mjs and packages/seat/tests/landing.test.mjs.
I applied the patch to a fresh worktree at BASE, `sha256sum -c` passed on
every line, and I removed that worktree. Canonical HEAD was `b71268b8e` at
18:56Z. `git diff 7a2987cf5 b71268b8e` on the 27 changed paths is empty, and
none of the 4 new paths exists at HEAD.

## Checks

The slot was mine from 18:37Z (sage-0519) until 18:55:30Z. `r1/gate.sh`
runs `node --test tests/*.test.mjs` in every package with a tests/
directory except queue (test-queue.sh runs that suite), then every
`scripts/test-*.sh`. The suites run one after another, each teed to its own
log, and the script stops at the first failure. TMPDIR was
`~/darkwing-scratch/r137/tmp`. cli's launcher.test ran on its own under the
session's inherited TMPDIR, because the bwrap runner fails "did not start"
under an override. DOCKER_HOST was unset, Docker 29.7.2 was up, and
COMPOSE_PROJECT_NAME was `darkwing-r137`. An EXIT trap removes
`darkwing-r137_default` only when it has 0 containers.

Round 5, the candidate, ran from 18:49:43 to 18:55:25 UTC and ended
GATE_PASSED (`r1/gate-run.log`, step logs in `r1/gate/`):

| Step | Pass | Fail |
|---|---|---|
| bus | 302 | 0 |
| business | 109 | 0 |
| cli (all but launcher) | 202 | 0 |
| cli launcher.test, inherited TMPDIR | 19 | 0 |
| control-board | 124 | 0 |
| conversation | 182 | 0 |
| discord | 183 | 0 |
| harness | 108 | 0 |
| ledger | 86 | 0 |
| mosaic | 69 | 0 |
| plugins | 28 | 0 |
| project | 30 | 0 |
| runs | 43 | 0 |
| seat | 148 | 0 |
| tasks | 97 | 0 |
| webui | 113 | 0 |
| test-auth | 15 | 0 |
| test-conductor | 17 | 0 |
| test-config | 24 | 0 |
| test-discord | 78 | 0 |
| test-extension-package | 18 | 0 |
| test-foundation | 44 | 0 |
| test-land-work | 84 | 0 |
| test-queue | 156 node, 28 suite | 0 |
| test-release | 14 | 0 |
| test-task | 98 | 0 |

The trap printed "network darkwing-r137_default removed". Afterwards no
Docker network created today remained, no container carried the
darkwing-r137 project label, and no node or docker process of mine had a
cwd under my r137 scratch.

Rounds 1 to 4 each stopped on a fault in the candidate or its tests. None
was load or timing (sage-0527). Each fix was rerun singly before the next
round. The round summaries, the failing step logs and the reruns I logged
are in `r1/earlier/`. The git-socket rerun in round 2 has no saved log;
round 5 covers it.

1. Round 1, bus, 295 pass, 7 fail. Six land.test tests refused
   decision-not-found, the raise lookup described in "As built". The
   project-runtime import closure test didn't list the broker's new import.
   After both fixes, land.test and project-runtime.test passed 11 of 11.
2. Round 2, cli, 196 pass, 6 fail. git-socket.test expected a newline
   after the Applied-under line, which `w.git` trims, so the test now
   anchors that line at the end of the message. Five thread-launch tests
   failed because the test host lacked `landHeld`. A rerun under the
   inherited TMPDIR failed the same five (`r2-thread-launch-inherited-tmpdir.log`),
   which ruled out TMPDIR. With the op added, the file passed 8 of 8.
   This round also changed gate.sh: its launcher line used `env -u TMPDIR`,
   and it now passes the inherited TMPDIR.
3. Round 3, cli launcher.test, 18 pass, 1 fail. The `landHeld` test's
   wrapper used `Object.assign` on a host whose `op` is a read-only
   inherited property and threw a TypeError. It now uses `Object.create`.
   19 of 19 passed, 0 skipped.
4. Round 4, seat, 146 pass, 2 fail. Two runGate tests named their "must
   not run" script test-three.sh, which sorts before test-two.sh, so it
   ran first. It is now test-z.sh, with a comment saying why. landing.test
   passed 8 of 8.

Researcher's row 148 gate ran from /mnt/storage/scratch/researcher/q148
during my slot (sage-0527). I didn't look inside that directory. Each
failure above traces to a line in the candidate or its tests, so I
changed code rather than rerunning for a flake.

Not run: mutants. Builder rounds may be targeted (decision 136), and the
reviewers have the gate above.

## Round 2 (Filbert's comment 28782, sage-0541)

Filbert asked for two tests the brief requires. Both are in
packages/seat/tests/working.test.mjs, the only file that changed.

- B1, "a landing whose applied diff isn't the reviewed one refuses
  patch-drift and leaves no worktree". A `git` first on the PATH runs the
  real git, then adds a line to the README that `apply --index` staged, as
  scripts/test-land-work.sh does for land-work. prepareLand refuses
  `patch-drift`, main stays put and no worktree is left. The same landing
  with the real git then prepares.
- B2, "once the root shares no history with a landed main, a push is
  checked against main, not the root". After a landing, the owner starts
  the root over on an orphan branch. The seed moves root to it and leaves
  main. A push built on main lands, and a push built on the new root
  refuses `unrelated-history`.

Also fixed: the stale "Row 139 isn't built yet" in "Arbiter path and
`gated` refusal left out". The test table above names both tests.

### Candidate, round 2

`r2/build.patch` against BASE `7a2987cf5`
(sha256 `383fc8329ef340f804de68f981146593bf06e597481991fa9889649e29cb8691`).
`r2/candidate-manifest.sha256` (sha256
`3311b46a61e525a1897190bbce05de15a850843d00fce4497ef3d4828434c09f`) lists
the same 31 paths as r1. Only the working.test.mjs line differs. I applied
the patch to a fresh worktree at BASE: `sha256sum -c` passed on every line
and `git diff --cached --check` was clean (31 files, +2043 -255). Canonical
HEAD was `96fd8593e`, and `git diff 7a2987cf5 96fd8593e` on the 31 paths is
empty.

### Checks, round 2

The slot was mine from 19:18Z (sage-0547). This round was targeted
(decision 136). `r2/round.sh` ran each file singly with TMPDIR
`~/darkwing-scratch/r137/tmp` and no Docker, then probed each check the way
Filbert did. A probe edits working.mjs in place, runs working.test, and
restores the file. The script then checks working.mjs's sha256 against the
one it started with, and it must fail on exactly the new test. Output is in
`r2/gate-run.log`, step logs in `r2/gate/`.

| Step | Pass | Fail |
|---|---|---|
| seat working.test, candidate | 26 | 0 |
| cli git-socket.test, candidate | 23 | 0 |
| probe B1: line 348 `if (false) refuse("patch-drift", ...)` | 25 | 1 |
| probe B2: line 224 merge-base against `refs/heads/root` | 25 | 1 |
| seat, whole suite, restored candidate | 150 | 0 |

- Probe B1 failed only "a landing whose applied diff isn't the reviewed one
  refuses patch-drift and leaves no worktree", with "Missing expected
  rejection".
- Probe B2 failed only "once the root shares no history with a landed main,
  a push is checked against main, not the root". The push built on main
  refused `unrelated-history`.

After each probe working.mjs was back at
`0d332d73596e94d2114751c1924c4f8463c387aba9ffdb0924d61f6228e1c463`, its
manifest hash. Afterwards `sha256sum -c` on the r2 manifest passed in my
worktree, no `.orig` file was left, and no node process of mine was
running.

Not run in this round: the other package suites, the scripts/test-*.sh and
mutants. Round 2 changes one test file. The r1 gate above covers the other
30 paths, which are unchanged.

## Round 3 (sage-0565): rebased onto row 139, with both carry items

Row 139 landed first as `63c82f1c4`, so this row carries the two items the
brief gives the second lander (brief blob `6805904555dc`). The r2 patch
applied to `63c82f1c4` without a conflict. B1 and B2 are unchanged.

### What row 139 changed under this row

In broker.mjs, `GATED` is now the hard-wait set, and vocabulary.mjs's
`GATED_ONLY` matches it. `git.merge.protected` isn't in it. A role file
may grant a merge cross-role, and a business that grants a hard wait at
either class refuses `invalid-authority` (REQ-WAIT-2). So a hard wait is
never a cross-role decision. decision.raise routes:

- cross-role to `arbiters[domain]`, or to the human when the arbiter is
  the raiser's own role;
- gated and cited to the arbiter;
- gated and uncited, or any hard wait, to the human.

An agent's resolution writes `via: 'broker'` with its run as `by`. A
human-routed decision resolved by an agent refuses `human-required`.

### (a) REQ-LAND-1: a gated merge decision never lands

`#landFacts` starts with `if (cls === 'gated') fail('not-authorized')`.
checkLand passes the class `#checkAuthority` returned, and recordLand
passes the one from `#authorityFor`, so both run the same line. The class
can't change between the two: `#authorityFor` requires the decision's class
to be the one the role holds. The refusal comes before
`decision-consumed` and `readLanding`, so who resolved a gated decision
doesn't matter.

### (b) REQ-DEC-2: the host op accepts an arbiter-resolved merge

`readLanding` takes `{ into, arbiter = false }`. It accepts a resolution
when one of these holds:

- the human resolved it through the CLI with one human answer, the check
  rounds 1 and 2 already had; or
- `arbiter` is true, the decision is `cross-role`, its `route_to` isn't
  `human`, the resolution came `via: 'broker'`, and there is no human
  answer.

Only the broker's `#landFacts` passes `arbiter: true`. read.mjs is
unchanged, so land-work passes nothing and stays human-only (item 4). The
route check holds because the broker lets only a run of the `route_to` role
resolve an agent-routed decision.

### Item 5: no hard wait through the arbiter path

A hard wait can't reach the arbiter path, for three reasons:

1. `readLanding` refuses `not-a-merge` for any action but
   `git.merge.protected`, which isn't a hard wait.
2. The arbiter path takes only `cross-role`, and REQ-WAIT-2 keeps a hard
   wait out of that class.
3. A gated decision refuses `not-authorized` before `readLanding` runs.

### landHeld and the prompt

`landHeld` now skips any decision that isn't `cross-role`, so the launcher
binds the land op only for a role that could land. The bundle's prompt
line no longer says the human approved the merge. It reads "Landing: once
your merge decision is approved, land_work it with the task." The harness
bundle test and the cli launcher test assert it.

### Tests (packages/bus/tests/land.test.mjs)

The world gains a `merge-gate` role granted `git.merge.protected`
cross-role, with pm as the technical and delivery arbiter. The landing
tests now use it instead of a coder raising a gated decision.

- **(b)**, "REQ-DEC-2: a merge-gate raise its arbiter resolved lands
  through the host op: ...". The raise routes `cross-role` to pm, and pm
  resolves it (`by: 'pm-run'`, `via: 'broker'`). `readLanding` without
  `arbiter` refuses `not-human` on it. checkLand answers the facts with
  `by: 'pm-run'`, and recordLand writes the merge event with class
  `cross-role` and spends the decision once.
- **(a)**, "REQ-LAND-1: a gated merge decision refuses not-authorized,
  cited and approved by the arbiter or uncited and approved by the human".
  On row 139's spec fixture, the coder pushes, gets an approving review and
  raises a merge citing `spec/north-star.md` at the fixture commit. The
  raise routes `gated` to pm, and pm approves. checkLand refuses
  `not-authorized`, `readLanding` with `arbiter: true` refuses `not-human`,
  and landHeld is false. Then, uncited: the raise routes `gated` to the
  human, the human approves, and checkLand still refuses `not-authorized`.
  Nothing merges.
- New: "a cross-role merge that routes to the human, because merge-gate is
  its own arbiter, lands on the human's CLI answer". pm's resolve refuses
  `human-required`; the human's lands with `by` set to the human.
- landHeld's test adds a coder's gated decision approved by the human,
  for which landHeld is false.

`not-human` still can't reach checkLand (see the test table above). A
comment above the land-work codes test says so.

### Docs, round 3

- `packages/bus/README.md`: land-work accepts only a human CLI resolution;
  the broker's `arbiter: true` also accepts a cross-role decision its
  arbiter resolved; `not-authorized` for gated (REQ-LAND-1); checkLand and
  landHeld name `cross-role`.
- `packages/cli/README.md`: a role granted the merge cross-role lands once
  its arbiter or the human approved the decision.
- `packages/cli/tests/git-socket.test.mjs`: one comment. Its broker is a
  stand-in, and no logic changed.

### Candidate, round 3

`r3/build.patch` against BASE `63c82f1c4`
(sha256 `52c1f1d6564d9e5e12b5708cbf2f12675dee0582b5fc42ece2fcc203fb5b2a7a`).
`r3/candidate-manifest.sha256` (sha256
`0fae2b6fa41f1cbcf2117b637a2f7a89cb2af209bf32647f0afc1612a9a34e16`) lists
the same 31 paths as r2. Round 3 changed 9 of them: the bus and cli
READMEs, broker.mjs, landing.mjs, land.test.mjs, git-socket.test.mjs,
launcher.test.mjs, bundle.mjs and bundle.test.mjs. I applied the patch to a
fresh worktree at BASE. `sha256sum -c` passed on every line, and
`git diff --cached --check` was clean (31 files, +2115 -255). I removed
that worktree. Canonical HEAD was `c492f4aaa`, and
`git diff 63c82f1c4 c492f4aaa` on the 31 paths is empty.

### Checks, round 3

The slot was mine from 19:43:51Z to 19:46:02Z (sage-0569). Before the
start, /proc showed no `node --test` process outside my own cwd. This
round was targeted (decision 136). `r3/round.sh` ran every test file the
candidate touches, plus row 139's hard-waits.test, each on its own with
TMPDIR `~/darkwing-scratch/r137/tmp` and no Docker. cli launcher.test and
thread-launch.test ran under the inherited TMPDIR. Then came
scripts/test-land-work.sh and one kill per check. A kill edits one source
file in place, runs one test file, which must fail on the named test, and
restores the file. The script checks each restored file against its
starting sha256. Last came the whole bus and seat suites. Output is in
`r3/gate-run.log`, step logs in `r3/gate/`. It ran from 19:43:51 to
19:45:35 UTC and ended ROUND_PASSED.

| Step | Pass | Fail |
|---|---|---|
| bus land.test | 10 | 0 |
| bus hard-waits.test (row 139) | 12 | 0 |
| bus project-runtime.test | 3 | 0 |
| seat landing.test | 8 | 0 |
| seat working.test | 26 | 0 |
| harness bundle.test | 22 | 0 |
| harness git-tools.test | 5 | 0 |
| harness tools.test | 19 | 0 |
| cli git-socket.test | 23 | 0 |
| cli launcher.test, inherited TMPDIR | 19 | 0 |
| cli thread-launch.test, inherited TMPDIR | 8 | 0 |
| scripts/test-land-work.sh | 86 | 0 |
| bus, whole suite, restored candidate | 316 | 0 |
| seat, whole suite, restored candidate | 150 | 0 |

0 skipped in each.

| Kill | Edit | Must fail | Failing |
|---|---|---|---|
| B1 | working.mjs:348 `if (false) refuse("patch-drift", ...)` | the patch-drift test, exactly 1 | 1 |
| B2 | working.mjs:224 merge-base against `refs/heads/root` | the root-history test, exactly 1 | 1 |
| (a) gated refusal | broker.mjs:815 `if (false) fail('not-authorized')` | REQ-LAND-1, exactly 1 | 1 |
| (b) arbiter path | landing.mjs:112 `arbitrated = false && ...` | REQ-DEC-2, one or more | 6 |
| item 5, cross-role only | landing.mjs:112 drops `d.class === 'cross-role'` | REQ-LAND-1, exactly 1 | 1 |
| land-work stays human-only | landing.mjs:91 `arbiter = true` | REQ-DEC-2, exactly 1 | 1 |
| landHeld cross-role | broker.mjs:924 drops `d.class !== 'cross-role'` | the landHeld test, one or more | 2 |

- Kill (b) fails all 6 land.test tests that land or check an
  arbiter-resolved merge.
- The item 5 kill fails only REQ-LAND-1. With the gated refusal in place,
  the `readLanding` call with `arbiter: true` on the arbiter-resolved gated
  decision is the only check that sees it.
- The arbiter-default kill fails REQ-DEC-2 on its `readLanding` call
  without `arbiter`, which must refuse `not-human`.
- The landHeld kill fails the landHeld test and REQ-LAND-1, since both
  assert landHeld is false for a gated decision.

Afterwards no node or chromium process of mine had a cwd under
`~/darkwing-scratch`. No `.orig` file was left, and every killed file was
back at its starting sha256. The r137 TMPDIR held 847 entries from round
1's full gate (newest 18:53Z) and none from this run. I removed them.

Not run in this round: the other package suites, the other
scripts/test-*.sh, Docker and mutants. Some untouched test files also read
a source round 3 changed, and they didn't run on this base:

- broker.mjs: packages/cli/tests/helpers.mjs (and so the cli tests that
  build a broker through it), cli tester.test and harness runner.test;
- launcher.mjs, which asks landHeld: cli launch-limits.test;
- bundle.mjs: harness claude-gate, claude-session, mcp-server and
  pi-session tests.

All of them passed in the r1 full gate on `7a2987cf5`, before the gated
refusal, the arbiter path and landHeld's filter. The reviewers' gates and
Sage's gate at the landing target run them on `63c82f1c4`.

## Round 4 (sage-0585): B1, the class refusal and the landing.mjs comment

Dewey asked for changes on round 3 (#1631 comment 28801, rev 1595), and
Filbert approved it (comment 28804, manifest `0fae2b6f`). sage-0585 fixed
round 4 as three items. Everything else in round 3 is unchanged. Base is
still `63c82f1c4`.

### Item 1, Dewey B1: the squash names the real channel

Round 3's `landMessage` wrote "Resolved <choice> by <by> via the CLI" for
every landing. For an arbiter's landing that put "by pm-run via the CLI"
into main's history, which is false. Now:

- `readLanding` returns `via: res.via`, and `#landFacts` passes it into
  checkLand's facts. The broker's ticket answer gains `via`.
- git-socket.mjs maps it: `cli` writes "via the CLI", and `broker` writes
  "as its arbiter, via the broker". readLanding accepts no other value. If
  one ever got through, the line would print `via <value>`. It never falls
  back to the CLI.
- land-work's read.mjs prints every key, so it now prints a `via` line too.
  land-work.sh reads keys by name and still writes "via the CLI" itself,
  which holds, since it accepts only a human CLI resolution.

### Item 2, Filbert note 1 and Dewey N1: every class but cross-role refuses

`#landFacts` now starts with `if (cls !== 'cross-role') fail('not-authorized')`,
ahead of the spent check and the human check in readLanding. Round 3
refused only `gated`. A role granted `git.merge.protected` within-role
resolves its own raise (`via: 'broker'`), so its landing got past that
line and refused `not-human` in readLanding instead. It now refuses
`not-authorized`, like a gated one. role.mjs is unchanged: whether it
should refuse a within-role merge grant at load is a follow-up for row 149
(sage-0585).

The comment above land.test's land-work codes test now matches the code.
checkLand never gives `not-human`: #landFacts refuses every class but
cross-role first, and the broker resolves a cross-role decision only
through the human's CLI answer or its arbiter's decision.resolve.

### Item 3, Dewey N2: the comment at landing.mjs:112

The arbiter path's line now has a comment above it. A cross-role decision
routed to an agent closes only through decision.resolve, which takes it
from the routed role alone (`s.role === route_to`, else `not-resolver`), so
`res.by` there is the arbiter's run.

### Tests, round 4

- land.test, REQ-DEC-2: checkLand's facts gain `via: 'broker'`.
- land.test, the human-routed cross-role landing: checkLand answers
  `by: 'jason'`, `via: 'cli'`.
- land.test, new: "REQ-LAND-1: a within-role merge grant refuses
  not-authorized at the land". The world's merge-gate holds the grant
  within-role, so its raise with `choice: 'yes'` closes in the call
  (`within-role`, routed to itself, `via: 'broker'`). checkLand refuses
  `not-authorized`, landHeld is false, and nothing merges or refuses on
  the trail. `setup` takes a `roles` override for it.
- git-socket.test, the first land test: the stand-in's facts gain
  `via: "cli"`, and the squash's message must hold "Resolved yes by jason
  via the CLI at 2026-10-16T00:00:00.000Z."
- git-socket.test, new: "land: an arbiter-resolved landing's squash says
  the arbiter resolved it through the broker". The stand-in answers
  `by: "pm-run", via: "broker"`. The message must hold "Resolved yes by
  pm-run as its arbiter, via the broker at ..." and no "via the CLI".

### Docs, round 4

- `packages/bus/README.md`: not-authorized for every class but
  `cross-role`, gated and within-role named; checkLand's answer carries
  the resolution's `via`.
- `packages/cli/README.md`: the squash's Resolved line names the channel
  from the ticket's `via`.

### Interdiff, round 3 to round 4

`r4/interdiff.patch` (sha256
`dcc4672cf6f6ad01cf068725969bfb724d52460528df1adeb405c75a13856af3`), 7
files, +65 -20:

| File | Change |
|---|---|
| packages/bus/src/broker.mjs | the class refusal and its comment; `via` in the facts |
| packages/bus/src/landing.mjs | `via` in readLanding's return; the N2 comment |
| packages/cli/src/git-socket.mjs | `RESOLVED_VIA` and the Resolved line |
| packages/bus/tests/land.test.mjs | `via` in two tests, the within-role test, the comment, `setup`'s `roles` |
| packages/cli/tests/git-socket.test.mjs | `via: "cli"` in the stand-in, the CLI assertion, the arbiter test |
| packages/bus/README.md | the refusal's classes, `via` in the answer |
| packages/cli/README.md | the Resolved line |

### Candidate, round 4

`r4/build.patch` against BASE `63c82f1c4`
(sha256 `0cabe175b095dd632e6ee6e166efad19089a1c87ffba6198a32c6849a1a80965`).
`r4/candidate-manifest.sha256` (sha256
`548ee477baca2a172d2585dd3074979f299b83db4484d1ec89674bb3142a9928`) lists
the same 31 paths as r3, and differs from it on the 7 above. I applied the
patch to a fresh worktree at BASE. `sha256sum -c` passed on every line,
and `git diff --cached --check` was clean (31 files, +2160 -255). I
removed that worktree. Canonical HEAD was `4ebef2284`, and
`git diff 63c82f1c4 4ebef2284` on the 31 paths is empty.

### Checks, round 4

`r4/round.sh` is round 3's script with three kills added and kill (a)
moved to the new line:

| Kill | Edit | Must fail |
|---|---|---|
| (a) class refusal | broker.mjs:815 `if (false) fail('not-authorized')` | the within-role test, one or more |
| item 2, gated only | broker.mjs:815 back to round 3's `cls === 'gated'` | the within-role test, exactly 1 |
| B1, CLI text | git-socket.mjs:259 hard-codes "via the CLI" | the arbiter squash test, exactly 1 |

The other six kills are round 3's.

I ran it on Sage's go (sage-0592) from 2026-10-16T20:38:29Z to
20:40:26Z, in `~/darkwing-scratch/r137/wt4` at BASE with the patch
applied. Log: `r4/gate-run.log`, per-step logs under `r4/gate/`.
ROUND_PASSED.

| Step | Result |
|---|---|
| bus land, hard-waits, project-runtime | 11, 12, 3 pass, 0 fail |
| seat landing, working | 8, 26 pass, 0 fail |
| harness bundle, git-tools, tools | 22, 5, 19 pass, 0 fail |
| cli git-socket | 24 pass, 0 fail |
| cli launcher, thread-launch (inherited TMPDIR) | 19, 8 pass, 0 fail |
| scripts/test-land-work.sh | 86 passed, 0 failed |
| whole bus suite | 317 pass, 0 fail |
| whole seat suite | 150 pass, 0 fail |

All nine kills killed:

| Kill | Failing |
|---|---|
| b1-patch-drift | 1 |
| b2-against-root | 1 |
| (a) class refusal | 2 |
| item 2, gated only | 1 |
| B1, CLI text | 1 |
| b-arbiter-path | 6 |
| 5-cross-role-only | 1 |
| arbiter-default | 1 |
| held-cross-role | 3 |

Each named test was among the failures. After the run the sweep found
none of my processes left, no `.orig` file remained, and `sha256sum -c`
on the manifest still passed. This is a targeted builder round
(decisions 136/137). The whole cli and harness suites and the other
`scripts/test-*.sh` are the landing gate's.