fix(land): stop blaming a branch for a borrowed base, and give the lease a refusable schema, a writer and a stand-down

.serena/memories/core.md

@@ -11,6 +11,14 @@ This memory is the graph root: every other memory is reached from here, and the
 trigger for each is stated here rather than inside it (`mem:memory_maintenance`).
 Read on demand, never all of them.
 
+- `mem:evidence-hierarchy` — **before acting on anything a doc comment, a
+  `CLOUD-*` row, a PR body or a handoff asserts**, and before citing one as the
+  reason for a decision. The board audited at ~38% wrong; comments are no better.
+- `mem:decision/adr-process` — recording a decision; about to add a `status:`,
+  `superseded-by:` or version suffix to any document.
+- `mem:decision/landing-architecture` — touching `land.rs`, `lease.rs`,
+  `speculation.rs`, `pipeline.rs` or the landing workflows; any row about the
+  lease, the lap, speculation, eviction or landing throughput.
 - `mem:workflow/board-states` — starting or finishing a `CLOUD-*` issue;
   reasoning about what is in flight.
 - `mem:workflow/agent-fanout` — spawning a subagent, or running more than one

.serena/memories/decision/adr-process.md

@@ -0,0 +1,41 @@
+# Decision records: git is the amendment history
+
+Read when: recording an architectural decision, or about to add a `status:`,
+`superseded-by:`, `-v2`, `-amended` or "see the current version" pointer to any
+document in this repository.
+
+## The rule
+
+**A reader must see only the current correct state of the world.**
+
+- **One file per decision, always rewritten in place.** Never a chain.
+- **`git log` / `git blame` is the amendment history**, reachable only by
+  explicitly spelunking. History exists, costs nothing to keep, and is invisible
+  until asked for. Git already does versioned-document-with-history better than
+  any convention layered on top.
+- **No `status: superseded` field**, because a live file is the only kind there
+  is. A decision that no longer holds is a file that no longer says it.
+- **A gate, or it is not a process**: no decision record may carry a supersession
+  marker, a version suffix in its filename, or a pointer to another record "for
+  the current version."
+
+## Why, measured
+
+Superseded documents, `-amended` suffixes and a folder of near-duplicates make a
+doc tree **actively worse than no doc tree**: a reader cannot tell which file is
+live, and an agent will confidently quote the dead one. In one 2026-09-10 session
+this shape cost two wrong conclusions before the pattern was named — see
+`mem:evidence-hierarchy`.
+
+## Home
+
+`.serena/memories/decision/<slug>`, beside the operational memories.
+
+Chosen because it needs **no change to non-negotiable rule 7** (`no-docs-tree`
+fails a tracked `docs/` path and sends research to the tracker), and because that
+directory is already checked in, already read on demand, and already the surface
+a future session loads. Routing is `mem:core`'s existing table — the mechanism in
+use, not a second one invented alongside it.
+
+Writes go through Serena's memory tools; `protected-mutation` denies every other
+route, and `rename_memory` is the only one that rewrites `mem:` referrers.

.serena/memories/evidence-hierarchy.md

@@ -0,0 +1,68 @@
+# What counts as evidence, and what is only a claim
+
+Read when: about to act on anything a doc comment, a `CLOUD-*` row, a PR body, a
+previous session's handoff, `AGENTS.md` or another memory asserts — and ALWAYS
+before citing one as the reason for a design decision. Also read it before
+writing a claim into any of those surfaces yourself.
+
+## The ranking
+
+1. **Code and tests as they execute right now**, and **the output of a command
+   you ran and read yourself.**
+2. **Everything else is a CLAIM**: doc comments, the board, PR bodies, commit
+   messages, `AGENTS.md`, these memories. Comments are written by the same agents
+   who write the board, reviewed no harder, and go stale the same way.
+3. **Even (1) goes stale.** A command's output describes the moment it ran, and
+   the remote is shared and mutable.
+
+**The operational rule: if a claim is load-bearing, re-derive it from something
+executable. If nothing executable exists, THAT ABSENCE IS THE FINDING.** A
+constraint worth designing around is worth a test.
+
+`rules/scanning.md` row five is the same rule one level down: to know what a gate
+DECIDES, run it and read the exit code. Reading source to predict a verdict "is
+worse than guessing, because it looks like rigour."
+
+## The board's measured error rate
+
+**5 of 13** speculation/lease rows audited against the tree on 2026-09-10 were
+STALE or REFUTED — ~38%. Rows are written by agents, many running a stale binary
+that only ever saw a half-implementation.
+
+**A cheap discriminator, worth keeping:** a row or comment that cites a **retired
+artefact** — a shell variable (`spec_undo`, `spec_base`, `LAND_LOCK_HOLDER_PID`),
+a line number in `mise-tasks/land.sh` or `land-lock.sh` — was wrong **4 times in
+5**. A row citing live Rust paths was usually at least partly live. It is triage,
+not a substitute for reading the tree.
+
+## Worked examples, so the shape is recognisable
+
+- **A doc comment that is the foundation of a design and has no test.**
+  `lease.rs:1310-1315` asserts the agent proxy 403s a push outside `refs/heads`,
+  and concludes the landing lock must therefore be a branch. No test anywhere
+  asserts it; `git ls-remote origin` shows `refs/notes` DOES exist on the remote;
+  and `mem:github-access` measures the real mechanism — proxied, `git`
+  authenticates with the INJECTED token, which 403s writes it is not scoped for.
+  Same symptom, different cause. **CLOUD-416 records that this misdiagnosis cost
+  the lease being implemented four times.**
+- **A Done row whose landing claim is false.** CLOUD-1399 (Done) says commit
+  `46530200` landed the `egress-is-unproxied` `[[startup]]` row.
+  `git log -S'egress-is-unproxied' --all -- batten.toml` is EMPTY and `46530200`
+  is not a valid object. The detector (`doctor egress`) landed; the repair never
+  did.
+- **A false premise propagating from a PR body into pushed history and then into
+  a plan.** PR #934's body and commit `3a18fb5`'s message both state "the holder
+  lands by rebase, minting new ones for the same patches." **False** — landing is
+  fast-forward and PRESERVES the sha (`mem:decision/landing-architecture`). A
+  later session quoted it approvingly and built a fencing argument on it.
+- **Two Urgent rows refuted by inspection.** CLOUD-240 reasons over
+  `mise-tasks/land.sh:162`, a deleted file; CLOUD-1423 says `batten land` has zero
+  callers, but `land lap` is `mise.toml:3494`.
+
+## When you find one
+
+A row the tree refutes goes **back to Backlog with a comment saying what the tree
+says instead** — never a note edited into its body, which leaves the false claim
+in place above the correction. Then it is not worked until re-filed against
+reality. `mem:workflow/board-states`: a state is a claim about the tree, and the
+tree wins.

.serena/memories/github-access.md

@@ -81,10 +81,67 @@ mediated gate permitted for half a session: `no-tool-substitution`,
 `trailer_deny` trailer reach the remote. **At the hook boundary, refuse and permit
 are the same byte.** `mise run install:local` is the unblock.
 
+**Measured again 2026-09-10, with the version numbers, because this class recurs.**
+Installed binary **0.0.156**, tree at **0.0.159**. `batten.toml` declares
+`command_matcher` (commit `4bc4f57`'s key, whose own footer reads
+"`handler::Handler` gains a `command_matcher` field") and 0.0.156 cannot parse
+it, so `batten startup` refused the **whole config** — every mediated gate
+permitting, `egress-is-unproxied` never reachable, `hook-surfaces-are-battens`
+never reaped. `mise run install:local` fixed it; the gates went live immediately
+and began correctly denying `no-tool-substitution` and `background-redirect` on
+calls that had gone unjudged minutes earlier. `contract-drift` then self-reported:
+_"this session's SessionStart registration did not run … every mediated call until
+it appeared failed open and said nothing."_
+
+This is CLOUD-1775's shape and it is **self-referential**: the skew detector is
+declared with `command_matcher`, the very key a stale binary cannot parse, so it
+is unreachable in exactly the case it exists for.
+
+**`batten startup --repair` was ALSO needed by hand** in the same session, and
+`hook-surfaces-are-battens failed not-provisioned` went to `ok` only after it —
+which is what leaves the launcher's own stop hooks firing when batten is supposed
+to have zeroed them in place. Needing the repair by hand is the finding, not the
+fix.
+
 A repair the host refuses is the ONE ask to put to a human (CLOUD-680's shape).
 Name the refusal you actually got; never assert which settings key would have
 granted it unless you measured that key doing something.
 
+## The fence covers `mise` and NOT batten itself — measured 2026-09-10
+
+`/root/.local/bin/mise` is a `provision-exec` wrapper whose declared env fences
+`github.com` and four sibling hosts out of `NO_PROXY`, sources the token from a
+first-set chain including `BATTEN_GITHUB_TOKEN`, carries
+`reject_prefix = "proxy-"` to refuse the injected placeholder, and unsets
+`HTTPS_PROXY` where the trust store names Anthropic. It is correct and complete.
+
+**It covers exactly one binary.** `/root/.local/bin/batten` is a bare stripped
+ELF, not a wrapper — so the engine, the session shell and `git` all run
+un-fenced. Confirmed in-container: `NO_PROXY` carries no `github.com`, while the
+PAT reaches GitHub off-proxy (`rate_limit` core **5000**, not 15000).
+
+`fetch.rs` honouring `*_PROXY` is **deliberate and correct**, not a defect —
+CLOUD-1399 argues it explicitly: _"that behaviour is correct and is what lets
+batten work on a host where a proxy is mandatory. The defect is a container's
+values."_ Only `get_direct` (the credential probe) refuses a proxy, because a
+question about a credential has no answer on a route that substitutes its own.
+
+**But the repair never landed.** CLOUD-1399 is Done and claims commit `46530200`
+shipped an `egress-is-unproxied` `[[startup]]` row.
+`git log -S'egress-is-unproxied' --all -- batten.toml` is EMPTY and `46530200` is
+not a valid object here. `batten doctor egress` correctly answers
+`egress failed egress-unfenced` and **nothing repairs it** — non-negotiable rule
+2's own words: _a gate that detects what it is wired to fix and waits to be asked
+is sensor only._ `BATTEN_ENVIRONMENT=disposable` IS set, so the trigger is not
+the problem; the row does not exist.
+
+CLOUD-1400 is the row for batten owning its own proxy (a decision spike, not
+work). CLOUD-1475 replaces the PAT-in-environment entirely with
+`repository_dispatch` as an authenticated bus and a webhook listener holding the
+secrets — zero bearer in the VM. Until then the standing constraints are: a live
+PAT in the environment, rotated frequently; **no access to any other system**;
+MCP is credentialless.
+
 ## Why the toolchain runs here (a per-host fence, NOT unsetting the proxy)
 
 **`mise` NEEDS BOTH HALVES, AND THE FIRST ONE IS `NO_PROXY`.** Re-measured
@@ -302,6 +359,16 @@ dropped), confirm green, and land.
   just the old SHA dropped when you pushed a new head.)
 - Never echo a credential. Check presence with `${VAR:+SET}` — never a bare
   `$VAR` or a `${VAR:-…}` that expands the value into the transcript.
+- **`${VAR:+SET}${VAR:-UNSET}` LEAKS THE VALUE, and it reads as safe.** Measured
+  2026-09-10: it printed a live `ghp_` PAT into a session transcript. `:-`
+  substitutes only when the variable is UNSET or empty, so when it is set the
+  second half expands the credential. The concatenated "report either way" form
+  is the trap; `${VAR:+SET}` alone is the whole check.
+- **Rotate a leaked PAT AFTER the session, never during.** A refreshed PAT can
+  only reach a session through its context, so rotating mid-session strands the
+  container with a dead credential and no route to the new one. Note also that a
+  GitHub credential disclosed _to GitHub_ is the least-bad case: GitHub scans its
+  own token formats and auto-revokes its own disclosed credentials.
 
 ## Transparent TLS interception — tools that carry their own CA roots
 

.serena/memories/workflow/landing-loop.md

@@ -16,6 +16,15 @@ listed at the bottom with their bypasses so a refusal can be told from a defect.
 fetch → rebase → `verify` → `verified` → push → `ci-wait` ∥ `main-watch` →
 `/fast-forward` → read the answer → lap.
 
+**What the lap is FOR, before any of its mechanics: landing is fast-forward and
+PRESERVES the sha**, so the runs that went green on the pushed head _are_ the
+runs on trunk and CI never runs twice. The lock is therefore the **linearization**
+mechanism — it exists to keep CI saturated with only green matrices on the
+critical path — and **speculation is pipelining**, not opportunism. The holder
+does NOT land by rebase; PR #934's body and commit `3a18fb5`'s message both claim
+it does and both are wrong. Full architecture, metrics and the consensus
+reasoning: `mem:decision/landing-architecture`.
+
 A refusal is **the design working**, not a failure. Each lap rebases onto a
 little more landed work, so conflicts arrive one small resolvable increment at a
 time; batching laps removes no refusal and only makes each one bigger. An agent
@@ -52,10 +61,20 @@ with the branch gone (`git ls-remote` confirms). There is nothing to repair here
 operation, no service, no API. Four things the design was pressure-tested into,
 each of which cost an incident:
 
-- **It is a BRANCH.** The agent proxy 403s a push outside `refs/heads`, and
-  GitHub does not enforce the fast-forward rule off `refs/heads` either — a
-  parentless orphan `PATCH` with `force:false` was _accepted_ on a custom
-  namespace. The atomicity the design rests on exists only on `refs/heads`.
+- **It is a BRANCH — and this premise is UNTESTED and probably a misdiagnosis.**
+  The claim was: the agent proxy 403s a push outside `refs/heads`, and GitHub does
+  not enforce the fast-forward rule off `refs/heads` either. **No test anywhere
+  asserts either half**; the code only _defaults_ unqualified names to
+  `refs/heads/` (`lease.rs:2845`), which is a naming convenience. `git ls-remote
+origin` shows `refs/notes` DOES exist on this remote. And `mem:github-access`
+  measures the real mechanism: **proxied, `git` authenticates with the INJECTED
+  token, which 403s any write it is not scoped for** — same symptom, different
+  cause, and the same root cause as CLOUD-1569. CLOUD-416 (Urgent, never started)
+  records that this misdiagnosis cost **the lease being implemented four times**,
+  and CLOUD-416 itself repeats the wrong cause, so its write probe must run
+  fenced and PAT-authenticated or it will re-measure the credential bug and bake
+  it in as an environment fact. Treat the namespace question as open; see
+  `mem:decision/landing-architecture`.
 - **Renewal is `--force-with-lease=<ref>:<observed>`**, a true CAS. `PATCH` with
   `force:false` does not give one. Create stays a plain push, so acquire is an
   atomic test-and-set.

crates/batten/src/commit.rs

@@ -197,8 +197,40 @@ impl Commit {
 /// which is the whole reason the block spells every binding field out instead of
 /// carrying a reference. A tier that needed the store would pass locally and
 /// abstain in CI, which is the shape of a gate that is not there.
+///
+/// # A path with a sanctioned mutation owes no block, and that is the override
+/// route's own precondition read back (CLOUD-1303)
+///
+/// `path write refused` declares its override route for the case where *"the
+/// surface this class names cannot express the change, so writing the protected
+/// path directly is the only route left"*. A path a `[[redirect]]` speaks for is
+/// the negation of that sentence: the surface exists, the write goes through it,
+/// nothing is refused, and so **no admission is ever issued and there is nothing
+/// to articulate**. Demanding a block there leaves exactly one route — an
+/// override whose precondition is false — so the honest author must either write
+/// a false articulation or not commit at all. Measured: `.serena/memories/**`
+/// joined `protected` and the `[[redirect]]` table together, and the first commit
+/// to write a memory through `write_memory` was refused six times over.
+///
+/// Articulation is therefore owed by protected paths with **no** sanctioned
+/// mutation — which is the set the precondition describes.
+///
+/// **ONLY THE DEMAND IS DROPPED, NEVER THE INSPECTION.** The earlier shape of
+/// this fix exempted the path before looking at it, which silently lost
+/// `admits-tampered` for the whole exempted set — a doctored block on a memory
+/// would have gone unexamined. Here the redirect answers only the *absence* case:
+/// a block that claims the path is still verified, and still reported when it
+/// does not recompute. The graver finding keeps its whole subject set.
+///
+/// `redirects` is the config's own table, passed in rather than resolved here for
+/// [`ArmSequence`]'s reason: the predicate stays a pure function of its arguments,
+/// so it decides identically on a runner that cannot reach the store OR the
+/// config — which is what keeps the range half and the pending half from drifting.
 #[must_use]
-pub fn judge_admissions(writes: &[crate::git::CommitWrite]) -> Vec<Finding> {
+pub fn judge_admissions(
+    writes: &[crate::git::CommitWrite],
+    redirects: &[crate::redirect::Redirect],
+) -> Vec<Finding> {
     let mut found = Vec::new();
     for write in writes {
         let blocks = crate::admission::blocks(&write.message);
@@ -207,15 +239,23 @@ pub fn judge_admissions(writes: &[crate::git::CommitWrite]) -> Vec<Finding> {
                 .iter()
                 .filter(|block| block.binding.subject == *path)
                 .collect();
-            // A path with no block at all is the missing case. A path with blocks
-            // of which at least one verifies is clean — several are legitimate,
-            // since re-articulating the same path on one commit chains rather than
-            // replaces.
+            // A path with no block at all is the missing case — unless a
+            // `[[redirect]]` sanctions a mutation for it, which means the write
+            // had a route that refuses nothing and issues nothing. A path with
+            // blocks of which at least one verifies is clean — several are
+            // legitimate, since re-articulating the same path on one commit chains
+            // rather than replaces.
             let field = if claims.is_empty() {
+                if crate::redirect::resolve(redirects, path).is_some() {
+                    continue;
+                }
                 "admits"
             } else if claims.iter().any(|block| block.recomputes()) {
                 continue;
             } else {
+                // REACHED FOR A REDIRECTED PATH TOO, and that is the half the
+                // superseded fix dropped.
+                //MUTANT admits-tampered-survives-the-redirect|s/^            } else if claims/            } else if crate::redirect::resolve(redirects, path).is_some() || claims/|a tampered block on a redirected path is still refused
                 "admits-tampered"
             };
             found.push(Finding {
@@ -239,12 +279,19 @@ pub fn judge_admissions(writes: &[crate::git::CommitWrite]) -> Vec<Finding> {
 /// explicitly not what this commit is about, and demanding a block for it would
 /// refuse a commit that does not touch the path at all.
 #[must_use]
-pub fn judge_pending(message: &str, staged: &std::collections::BTreeSet<String>) -> Vec<Finding> {
-    judge_admissions(&[crate::git::CommitWrite {
-        commit: "pending".to_owned(),
-        message: message.to_owned(),
-        paths: staged.clone(),
-    }])
+pub fn judge_pending(
+    message: &str,
+    staged: &std::collections::BTreeSet<String>,
+    redirects: &[crate::redirect::Redirect],
+) -> Vec<Finding> {
+    judge_admissions(
+        &[crate::git::CommitWrite {
+            commit: "pending".to_owned(),
+            message: message.to_owned(),
+            paths: staged.clone(),
+        }],
+        redirects,
+    )
 }
 
 /// One commit's two conserves-ledger sets, ready to intersect (CLOUD-1402).