fix(session): install the release at session start, never a compile

AGENTS.md

@@ -110,9 +110,9 @@ run in the web sandbox — read `mem:github-access` before doubting.)
    branch is rebased on current `origin/main`. "Green but stale" is not green.
 3. **`mise run linear-check`.** Don't ready by hand: `land` readies, after its
    push, and a ready spent before that buys only draft-era skips (CLOUD-247).
-4. **`mise run land`, backgrounded.** It drives the whole loop — **no timeout, no
-   cap, never the PR webhook** — and stops for three things only: a rebase
-   conflict, a failed `verify`, or red CI, re-drafting the PR. `mem:workflow/landing-loop`.
+4. **`mise run land`, backgrounded.** Drives the loop — no wall clock, only
+   counts, never the PR webhook. Stops on a conflict, a failed `verify`, red CI,
+   or a spent lap budget. **When a stop says run it again, run it again.**
 5. **Never re-run CI on an already-tested SHA.** Fast-forward means `main` takes
    the PR's exact, already-passed commits. Don't add push-to-`main` triggers.
 

batten.toml

@@ -13487,3 +13487,57 @@ id = "host-dependencies-present"
 gloss = "the released batten resolves by the bare name every hook registration invokes it under"
 check = ["env", "batten", "--version"]
 repair = ["mise", "run", "deps-install"]
+
+# THE COMMIT PATH IS A PRECONDITION, AND NOTHING DECLARED IT (CLOUD-1398).
+#
+# The five rows above ask whether the ENGINE can run. None of them asks whether
+# the engine is on the path a COMMIT takes, and in the container this repository
+# provisions for itself those came apart: `git commit` ran neither `pre-commit`
+# nor `commit-msg`, so every commit bypassed the gate while `batten startup`
+# reported every row green. The session-start advisory's "every declared repair
+# has already run this session; what is listed is what it did not fix" was TRUE
+# and useless — the hooks were never in the declared set at all.
+#
+# `mise-tasks/doctor.sh` did see it and emitted two `::error::` lines, which is
+# the CLOUD-1454 shape one layer up: a reporter is not a gate. Worse, its remedy
+# named `.claude/hooks/session-start.sh`, a program `7d188580` deleted, so the
+# refusal was right and its instruction could not be followed. Declaring the
+# precondition with a repair that RUNS is the half that closes it.
+#
+# NOT `hk install`, AND THAT IS MEASURED RATHER THAN PREFERRED (the row's §8).
+# On this container `hk` resolves only through the pin — `mise exec -- hk
+# --version` answers 1.56.1 while `doctor`'s bare-`PATH` probe reports
+# `program-not-on-path hk` and the pin record is absent. `hk install` generates a
+# hook whose body calls `hk` BARE, so the hook it installs makes every
+# `git commit` fail with `hk: not found`: a repair that reads as installed and
+# breaks the thing it installed. `mise.toml`'s `session:git-hooks` is the
+# symlink-based form that works, and it is already the session-start step — so
+# this row adds an ASSERTION rather than a second installer.
+#
+# WHY A `batten` VERB HERE, WHERE `toolchain-is-provisioned` REFUSED ONE. That
+# row's subject is a third party's install state, and an engine-side reader of it
+# would put a specific tool's output format in `crates/batten` — non-negotiable
+# rule 1. This row's subject is `$GIT_DIR/hooks`, which is git's own vocabulary
+# and every consumer's question, so the engine-side reader names nobody.
+#
+# `doctor gate` AND NOT `doctor commit-gate`: a man page is committed as the
+# hyphen-joined command path and the surface suite maps that filename back by
+# replacing every hyphen, so a sub-verb carrying an internal one is not
+# round-trippable. `crates/batten/src/surface.rs` records the measurement.
+#
+# AND THE SUB-VERB RATHER THAN BARE `doctor`, which is `host-dependencies-present`'s
+# trap approached from the other side. A row decides on an exit status and cannot
+# select one line out of a report, so `check = ["batten", "doctor"]` would fail
+# here whenever any unrelated declared program was unreachable — the state this
+# very container is in, on the `hk` reading above — and would then fire a
+# git-hook repair that cannot fix that, reporting `repair-failed` forever over a
+# gate that is installed.
+#
+# The repair writes under `$GIT_DIR/hooks`, which is outside the worktree and so
+# outside `protected`; this key in the committed authority is the authorisation
+# to run it.
+[[startup]]
+id = "commit-gate-installed"
+gloss = "this clone's commit path runs the gate, so a commit made here cannot bypass it"
+check = ["batten", "doctor", "gate"]
+repair = ["mise", "run", "session:git-hooks"]

completions/batten.bash

@@ -310,6 +310,9 @@ _batten() {
             batten__subcmd__doctor,egress)
                 cmd="batten__subcmd__doctor__subcmd__egress"
                 ;;
+            batten__subcmd__doctor,gate)
+                cmd="batten__subcmd__doctor__subcmd__gate"
+                ;;
             batten__subcmd__doctor,help)
                 cmd="batten__subcmd__doctor__subcmd__help"
                 ;;
@@ -325,6 +328,9 @@ _batten() {
             batten__subcmd__doctor__subcmd__help,egress)
                 cmd="batten__subcmd__doctor__subcmd__help__subcmd__egress"
                 ;;
+            batten__subcmd__doctor__subcmd__help,gate)
+                cmd="batten__subcmd__doctor__subcmd__help__subcmd__gate"
+                ;;
             batten__subcmd__doctor__subcmd__help,help)
                 cmd="batten__subcmd__doctor__subcmd__help__subcmd__help"
                 ;;
@@ -562,6 +568,9 @@ _batten() {
             batten__subcmd__help__subcmd__doctor,egress)
                 cmd="batten__subcmd__help__subcmd__doctor__subcmd__egress"
                 ;;
+            batten__subcmd__help__subcmd__doctor,gate)
+                cmd="batten__subcmd__help__subcmd__doctor__subcmd__gate"
+                ;;
             batten__subcmd__help__subcmd__doctor,hooks)
                 cmd="batten__subcmd__help__subcmd__doctor__subcmd__hooks"
                 ;;
@@ -2911,7 +2920,7 @@ _batten() {
             return 0
             ;;
         batten__subcmd__doctor)
-            opts="-J -q -v -y -h --json --strictness --fail-on-warning --config-from --config-in --silent --quiet --verbose --debug --trace --log-level --no-color --no-input --yes --help mediator egress hooks session help"
+            opts="-J -q -v -y -h --json --strictness --fail-on-warning --config-from --config-in --silent --quiet --verbose --debug --trace --log-level --no-color --no-input --yes --help mediator egress gate hooks session help"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -2970,8 +2979,38 @@ _batten() {
             COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
             return 0
             ;;
+        batten__subcmd__doctor__subcmd__gate)
+            opts="-J -q -v -y -h --json --strictness --fail-on-warning --config-from --config-in --silent --quiet --verbose --debug --trace --log-level --no-color --no-input --yes --help"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --strictness)
+                    COMPREPLY=($(compgen -W "permissive standard strict" -- "${cur}"))
+                    return 0
+                    ;;
+                --config-from)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --config-in)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                --log-level)
+                    COMPREPLY=($(compgen -W "silent quiet normal verbose debug trace" -- "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
         batten__subcmd__doctor__subcmd__help)
-            opts="mediator egress hooks session help"
+            opts="mediator egress gate hooks session help"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -2998,6 +3037,20 @@ _batten() {
             COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
             return 0
             ;;
+        batten__subcmd__doctor__subcmd__help__subcmd__gate)
+            opts=""
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
         batten__subcmd__doctor__subcmd__help__subcmd__help)
             opts=""
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
@@ -3945,7 +3998,7 @@ _batten() {
             return 0
             ;;
         batten__subcmd__help__subcmd__doctor)
-            opts="mediator egress hooks session"
+            opts="mediator egress gate hooks session"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -3972,6 +4025,20 @@ _batten() {
             COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
             return 0
             ;;
+        batten__subcmd__help__subcmd__doctor__subcmd__gate)
+            opts=""
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
         batten__subcmd__help__subcmd__doctor__subcmd__hooks)
             opts=""
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 4 ]] ; then