@humwick/server 0.0.0-stage → 0.130.0

package/src/db/commands-landing.ts

@@ -0,0 +1,1046 @@
+import { assertWorkspaceMergeUnheld } from "./workspace-merge-hold";
+import { bindMergeLeaseCommand } from "./merge-lease";
+import { normalizeLandingBaseRef } from "../landing-base-ref";
+import { exactLandingSourceIdentity, isLandingCommandType, LEGACY_PUSH_ATTEMPT_ID, validateLandingCommandProgress,
+  ValidationError, type LandingCommandRunTuple, type LandingContainmentMode, type TerminalProcessProof } from "@humwick/sdk";
+import { getCommand } from "../commands-db.ts";
+import { commandTtlMs } from "../command-ttl.ts";
+import { sealCommandParams } from "../command-secrets.ts";
+import type { Command, CommandStatus, CreateCommandInput } from "../types.ts";
+import { isTerminalCommandStatus } from "./command-terminal-status.ts";
+import { getDb } from "./connection.ts";
+import { maskProviderSecrets } from "./provider-config-secrets.ts";
+import { audit } from "./landing-audit.ts";
+import { hostGatesDrained } from "./commands-host-land-admission";
+import { refreshPendingLandQueueLease, landClaimExclusion } from "./commands-claim-admission.ts";
+import { landStackPublishRefusal, recordLandStackCandidate } from "./land-stack.ts";
+import { restartEpochBlockingClaim, withRestartEpochAdmission } from "./restart-epoch-admission.ts";
+import type { LandingLaneIdentity } from "../landing-lane-key.ts";
+import { legacyLandingCompletenessSql, legacyLandingParamsCanonicalSql } from "./commands-landing-completeness.ts";
+import { landingRunTupleMatches, requiredTypedLandingResult } from "./commands-landing-tuples.ts";
+import { completeKernelRetirementProjection, kernelRetirementProofAllowed, landingControllerMatches as controllerMatches,
+  landingMembershipAllows as membershipAllows,
+  landingNeverStartedRetirementAllows, recordLandingClaimProjection } from "./landing-controllers.ts";
+export { audit } from "./landing-audit.ts";
+export { landingControllerMatches as controllerMatches, landingMembershipAllows as membershipAllows } from "./landing-controllers.ts";
+
+export interface LandingControllerFence {
+  readonly version: number;
+  readonly token: string;
+}
+
+export interface LandingExecutionFence {
+  readonly id: string;
+  readonly generation: number;
+  readonly ownerToken: string;
+}
+
+export interface LandingProgressTuple {
+  readonly epoch: number;
+  readonly sequence: number;
+  readonly run?: LandingCommandRunTuple;
+}
+
+export interface CreateLegacyLandingArgs {
+  readonly id: string;
+  readonly input: CreateCommandInput;
+  readonly laneIdentity: LandingLaneIdentity;
+  readonly expectedOwnershipVersion: number;
+  readonly expectedOwnershipToken: string;
+  readonly containmentMode: LandingContainmentMode;
+  readonly modeSelection: { orchestratorGeneration?: string; capabilityKey: string; reason: string };
+}
+
+export interface ClaimLandingArgs {
+  readonly commandId: string;
+  readonly expectedStatus: "pending";
+  readonly claimant: string;
+  readonly claimToken: string;
+  readonly leaseUntil: number;
+  readonly controller: LandingControllerFence;
+  readonly executionId: string;
+  readonly executionTreeHandle: string;
+}
+
+export interface AcceptLandingProgressArgs {
+  readonly commandId: string;
+  readonly controller: LandingControllerFence;
+  readonly execution: LandingExecutionFence;
+  readonly tuple: LandingProgressTuple;
+  readonly progress: Record<string, unknown>;
+}
+
+export interface AcceptLandingResultArgs {
+  readonly commandId: string;
+  readonly controller: LandingControllerFence;
+  readonly execution: LandingExecutionFence;
+  readonly tuple: LandingProgressTuple;
+  readonly result: { status: "succeeded" | "failed"; value?: Record<string, unknown>; error?: string };
+  readonly terminalEvidence: { evidenceId: string; proof: "completed"; hostEvidence: Record<string, unknown> };
+}
+
+export interface AcquireLegacyPublishFenceArgs {
+  readonly permitId: string;
+  readonly pushAttemptId: string;
+  readonly commandId: string;
+  readonly laneKey: string;
+  readonly controller: LandingControllerFence;
+  readonly execution: LandingExecutionFence;
+  readonly expectedBaseSha: string;
+  readonly sourceRef: string;
+  readonly sourceHeadSha: string;
+  readonly candidateHeadSha?: string;
+  readonly pushRemote?: string;
+}
+
+export interface ConsumeLegacyPublishPermitArgs extends Omit<AcquireLegacyPublishFenceArgs, "expectedBaseSha" | "sourceRef" | "sourceHeadSha" | "candidateHeadSha" | "pushRemote"> {}
+
+export interface RecordExecutionProofArgs {
+  readonly evidenceId: string;
+  readonly commandId: string;
+  readonly executionGeneration: number;
+  readonly proof: TerminalProcessProof;
+  readonly hostEvidence: Record<string, unknown>;
+}
+
+export interface TerminalizeLegacyLandingArgs {
+  readonly evidenceId: string;
+  readonly commandId: string;
+  readonly expectedStatus: "pending" | "accepted" | "running";
+  readonly controller: LandingControllerFence;
+  readonly execution?: LandingExecutionFence;
+  readonly proof: "never_started" | "process_tree_dead";
+  readonly hostEvidence: Record<string, unknown>;
+  readonly error: string;
+}
+
+export interface CancelPendingLegacyLandingsArgs {
+  readonly correlationId: string;
+  readonly reason: string;
+}
+
+export interface OwnershipRow {
+  lane_key: string;
+  repo_root: string;
+  remote_identity: string;
+  base_ref: string;
+  identity_digest: string;
+  controller_phase: "legacy_open" | "legacy_draining" | "kernel_owned";
+  phase_version: number;
+  controller_token: string | null;
+}
+
+export interface LandingCommandRow {
+  id: string;
+  type: string;
+  status: CommandStatus;
+  params: string;
+  correlation_id: string | null;
+  lane_key: string | null;
+  controller: string | null;
+  controller_version: number | null;
+  controller_token: string | null;
+  command_generation: number | null;
+  actuator: string | null;
+  execution_id: string | null;
+  execution_generation: number;
+  execution_owner_token: string | null;
+  process_group_id: number | null;
+  transient_unit: string | null;
+  claim_owner_token: string | null;
+  landing_progress_epoch: number | null;
+  landing_progress_sequence: number | null;
+  terminal_process_proof: TerminalProcessProof | null;
+  landing_blocker_code: string | null;
+  landing_blocker_detail: string | null;
+  landing_containment_mode: LandingContainmentMode | null;
+  admission: "admitted" | "parked" | "dry-run";
+  target: string;
+  updated_at: number;
+}
+
+export function ownership(laneKey: string): OwnershipRow | null {
+  return (getDb().query("SELECT * FROM landing_controller_ownership WHERE lane_key = ?").get(laneKey) as OwnershipRow | undefined) ?? null;
+}
+
+export function landingCommand(commandId: string): LandingCommandRow | null {
+  return (getDb().query("SELECT * FROM commands WHERE id = ? AND (type = 'workspace.merge' OR type LIKE 'landing.%')")
+    .get(commandId) as LandingCommandRow | undefined) ?? null;
+}
+
+export function executionMatches(command: LandingCommandRow, execution: LandingExecutionFence): boolean {
+  return command.execution_id === execution.id
+    && command.execution_generation === execution.generation
+    && command.execution_owner_token === execution.ownerToken;
+}
+
+function isNewerTuple(command: LandingCommandRow, tuple: LandingProgressTuple): boolean {
+  const epoch = command.landing_progress_epoch ?? -1;
+  const sequence = command.landing_progress_sequence ?? -1;
+  return tuple.epoch > epoch || (tuple.epoch === epoch && tuple.sequence > sequence);
+}
+
+function validIdentity(row: OwnershipRow, lane: LandingLaneIdentity): boolean {
+  return row.remote_identity === lane.remoteIdentity
+    && row.base_ref === lane.baseRef && row.identity_digest === lane.identityDigest;
+}
+
+/** The only production insert for the reserved workspace.merge command type. Generic command
+ * creation rejects it unconditionally; keeping the complete insert here makes the ownership
+ * transaction itself the capability instead of exporting a forgeable opt-in from commands-db. */
+function insertLegacyLandingCommand(input: CreateCommandInput, id: string, now: number): Command {
+  const expiresAt = input.ttlMs ? now + input.ttlMs : now + (commandTtlMs(input.type, input.params) ?? 60_000);
+  const command: Command = {
+    id,
+    type: input.type,
+    source: input.source,
+    target: input.target,
+    params: input.params ?? {},
+    status: "pending",
+    ...(input.correlationId ? { correlationId: input.correlationId } : {}),
+    ...(input.controller ? { controller: input.controller } : {}),
+    ...(input.controllerVersion !== undefined ? { controllerVersion: input.controllerVersion } : {}),
+    ...(input.controllerToken ? { controllerToken: input.controllerToken } : {}),
+    ...(input.laneKey ? { laneKey: input.laneKey } : {}),
+    ...(input.actuator ? { actuator: input.actuator } : {}),
+    ...(input.commandGeneration !== undefined ? { commandGeneration: input.commandGeneration } : {}),
+    ...(input.executionGeneration !== undefined ? { executionGeneration: input.executionGeneration } : {}),
+    ...(input.terminalProcessProof ? { terminalProcessProof: input.terminalProcessProof } : {}),
+    ...(input.landingContainmentMode ? { landingContainmentMode: input.landingContainmentMode } : {}),
+    // #2189 P7 — restart-epoch classification and admission travel with the row. Without them the
+    // seal checks and the release outbox would both be blind to a legacy landing.
+    ...(input.restartSensitive ? { restartSensitive: true } : {}),
+    ...(input.admission ? { admission: input.admission } : {}),
+    ...(input.blockedByEpochId ? { blockedByEpochId: input.blockedByEpochId } : {}),
+    createdAt: typeof input.params?.heavyGateQueuePriority === "number" && Number.isFinite(input.params.heavyGateQueuePriority) && input.params.heavyGateQueuePriority > 0
+      ? Math.min(now, input.params.heavyGateQueuePriority) : now,
+    updatedAt: now,
+    expiresAt,
+  };
+  const landingWorkspaceId = typeof command.params.workspaceId === "string" ? command.params.workspaceId : null;
+  const landingSourceHeadSha = typeof command.params.expectedHeadSha === "string" ? command.params.expectedHeadSha.toLowerCase() : null;
+  const landingAttemptOrdinal = landingWorkspaceId && landingSourceHeadSha
+    ? ((getDb().query(`SELECT COALESCE(MAX(landing_attempt_ordinal), -1) + 1 AS ordinal FROM commands
+      WHERE type = 'workspace.merge' AND landing_workspace_id = ? AND landing_source_head_sha = ?`
+    ).get(landingWorkspaceId, landingSourceHeadSha) as { ordinal: number }).ordinal) : 0;
+  getDb().query(`INSERT INTO commands (
+    id, type, source, target, params, status, correlation_id,
+    controller, controller_version, controller_token, lane_key, actuator, command_generation,
+    execution_generation, terminal_process_proof, landing_containment_mode,
+    landing_workspace_id, landing_source_head_sha, landing_attempt_ordinal,
+    restart_sensitive, admission, blocked_by_epoch_id, created_at, updated_at, expires_at
+  ) VALUES (?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  ).run(command.id, command.type, command.source, command.target, JSON.stringify(sealCommandParams(command.params)),
+    command.correlationId ?? null, command.controller ?? null, command.controllerVersion ?? null,
+    command.controllerToken ?? null, command.laneKey ?? null, command.actuator ?? null,
+    command.commandGeneration ?? null, command.executionGeneration ?? 0, command.terminalProcessProof ?? null,
+    command.landingContainmentMode ?? null,
+    landingWorkspaceId, landingSourceHeadSha, landingAttemptOrdinal,
+    command.restartSensitive ? 1 : 0, command.admission ?? "admitted", command.blockedByEpochId ?? null,
+    command.createdAt, now, expiresAt);
+  return command;
+}
+
+function releaseBoundMergeLease(commandId: string): void {
+  getDb().query("DELETE FROM workspace_merge_leases WHERE command_id = ?").run(commandId);
+}
+
+function retireLivePublishPermits(commandId: string, now: number): void {
+  getDb().query(`UPDATE landing_publish_permits SET retired_at = ?
+    WHERE command_id = ? AND retired_at IS NULL`).run(now, commandId);
+}
+
+function exactSourceIdentity(params: Record<string, unknown>): { sourceRef: string; sourceHeadSha: string } | null {
+  return exactLandingSourceIdentity({ sourceRef: params.sourceRef ?? params.branch,
+    sourceHeadSha: params.sourceHeadSha ?? params.expectedHeadSha });
+}
+
+/** The sole terminal-process proof validator. Every writer that stamps completed/process_tree_dead
+ * or releases a command-bound merge lease must pass through here with the exact durable execution
+ * tuple. never_started is the only non-host proof and is valid solely for generation zero. */
+function requireTerminalProcessProof(
+  command: LandingCommandRow,
+  proof: TerminalProcessProof,
+  hostEvidence: Record<string, unknown>,
+): void {
+  if (command.landing_containment_mode !== "cgroup-v2-close-v1") {
+    throw new ValidationError("terminal process proof is reserved for cgroup-v2-close-v1 landing commands");
+  }
+  if (hostEvidence.reason === "ttl" || hostEvidence.reason === "lease-expired" || hostEvidence.expired === true) {
+    throw new ValidationError("TTL or lease expiry is reconciliation input, not execution proof");
+  }
+  if (proof === "never_started") {
+    if (command.execution_generation !== 0 || command.execution_id !== null || command.transient_unit !== null) {
+      throw new ValidationError("never_started proof requires the original unclaimed generation");
+    }
+    return;
+  }
+  if (!command.execution_id || command.execution_generation < 1 || !command.transient_unit
+    || hostEvidence.executionId !== command.execution_id
+    || hostEvidence.executionGeneration !== command.execution_generation
+    || hostEvidence.executionTreeHandle !== command.transient_unit
+    || hostEvidence.observedAbsent !== true
+    || hostEvidence.observation !== "host-execution-tree-close") {
+    throw new ValidationError(`${proof} requires an exact positively empty host-owned execution tree`);
+  }
+}
+
+function releaseBoundMergeLeaseAfterProof(
+  command: LandingCommandRow,
+  proof: TerminalProcessProof,
+  hostEvidence: Record<string, unknown>,
+): void {
+  requireTerminalProcessProof(command, proof, hostEvidence);
+  releaseBoundMergeLease(command.id);
+}
+
+export function createLegacyLandingBody(args: CreateLegacyLandingArgs, now: number): Command {
+  const containmentMode = args.containmentMode;
+  if (args.input.type !== "workspace.merge") throw new ValidationError("legacy landing create requires workspace.merge");
+  if (!exactSourceIdentity(args.input.params ?? {})) {
+    throw new ValidationError("legacy landing admission requires an exact source ref and host-resolved source HEAD");
+  }
+  const handle = typeof args.input.params?.executionTreeHandle === "string" && args.input.params.executionTreeHandle.trim()
+    ? args.input.params.executionTreeHandle.trim() : undefined;
+  if (containmentMode === "cgroup-v2-close-v1" && !handle) {
+    throw new ValidationError("cgroup-v2-close-v1 admission requires a pre-reserved host execution tree");
+  }
+  if (containmentMode === "legacy-unfenced-v0" && handle) {
+    throw new ValidationError("legacy-unfenced-v0 admission must not carry an execution-tree handle");
+  }
+  const row = ownership(args.laneIdentity.laneKey);
+  if (!row || !validIdentity(row, args.laneIdentity)) throw new ValidationError("LAND_CUTOVER_LANE_IDENTITY_MISMATCH");
+  if (row.controller_phase !== "legacy_open") throw new ValidationError(`legacy landing admission closed in ${row.controller_phase}`);
+  if (row.phase_version !== args.expectedOwnershipVersion || row.controller_token !== args.expectedOwnershipToken) {
+    throw new ValidationError("legacy landing ownership generation changed");
+  }
+  // The writer transaction is the final admission fence across all dispatchers (#2777).
+  const workspaceIdForAdmission = args.input.params?.workspaceId;
+  if (typeof workspaceIdForAdmission === "string") {
+    assertWorkspaceMergeUnheld(workspaceIdForAdmission);
+    const active = getDb().query(`SELECT id FROM commands WHERE type = 'workspace.merge'
+      AND landing_workspace_id = ? AND status IN ('pending', 'accepted', 'running') LIMIT 1`)
+      .get(workspaceIdForAdmission) as { id: string } | null;
+    if (active) throw new ValidationError(`workspace merge already in progress (${active.id})`);
+  }
+  const input: CreateCommandInput = {
+    ...args.input,
+    controller: "legacy",
+    controllerVersion: row.phase_version,
+    controllerToken: row.controller_token,
+    laneKey: row.lane_key,
+    actuator: "legacy",
+    commandGeneration: 0,
+    executionGeneration: 0,
+    landingContainmentMode: containmentMode,
+    ...(containmentMode === "cgroup-v2-close-v1" ? { terminalProcessProof: "never_started" as const } : {}),
+  };
+  // #2189 P7 — this is the one create that does not pass through `createCommandInternal`, so it
+  // consults the open restart epoch explicitly. Same transaction, same seam function, no pre-read.
+  const command = insertLegacyLandingCommand(withRestartEpochAdmission(input), args.id, now);
+  bindMergeLeaseCommand(command.id, input.params);
+  if (containmentMode === "cgroup-v2-close-v1") {
+    getDb().query(`INSERT INTO landing_execution_proofs
+      (evidence_id, command_id, execution_generation, proof, host_evidence, created_at) VALUES (?, ?, 0, 'never_started', ?, ?)`
+    ).run(`create:${command.id}:never-started`, command.id, JSON.stringify({ admission: "created-pending" }), now);
+  }
+  audit(command.id, row.lane_key, "landing_containment_mode_selected", now, {
+    controllerToken: row.controller_token ?? undefined,
+    detail: { laneKey: row.lane_key, commandId: command.id, orchestratorGeneration: args.modeSelection.orchestratorGeneration,
+      mode: containmentMode, capabilityKey: args.modeSelection.capabilityKey,
+      reason: args.modeSelection.reason },
+  });
+  audit(command.id, row.lane_key, "created", now, { controllerToken: row.controller_token ?? undefined,
+    detail: { version: row.phase_version, landingContainmentMode: containmentMode } });
+  return command;
+}
+
+export function claimLandingBody(args: ClaimLandingArgs, now: number): { claimed: boolean; command: Command | null; reason?: string } {
+  const command = landingCommand(args.commandId);
+  if (!command || !command.lane_key) return { claimed: false, command: null, reason: "missing-landing-command" };
+  const row = ownership(command.lane_key);
+  const params = JSON.parse(command.params) as Record<string, unknown>;
+  if (params.executionTreeHandle !== args.executionTreeHandle) {
+    audit(command.id, command.lane_key, "claim-rejected", now, { reason: "execution-tree-reservation-mismatch" });
+    return { claimed: false, command: getCommand(command.id), reason: "execution-tree-reservation-mismatch" };
+  }
+  if (!controllerMatches(command, args.controller) || !membershipAllows(row, command)) {
+    audit(command.id, command.lane_key, "claim-rejected", now, { reason: "ownership-fence", controllerToken: args.controller.token });
+    return { claimed: false, command: getCommand(command.id), reason: "ownership-fence" };
+  }
+  if (command.status === "accepted" && command.execution_owner_token === args.claimToken) {
+    return { claimed: true, command: getCommand(command.id) };
+  }
+  // #2189 P7 — a pending→accepted claim is a restart-sensitive ADMISSION, so it consults the open
+  // epoch in this same transaction. Refusing here (rather than cancelling anything) is what keeps
+  // "accepted/running work continues untouched" true: only the transition INTO execution closes.
+  const blockingEpoch = restartEpochBlockingClaim(command.type, command.target);
+  if (blockingEpoch) {
+    audit(command.id, command.lane_key, "claim-rejected", now, { reason: "restart-epoch-open", detail: { epochId: blockingEpoch } });
+    return { claimed: false, command: getCommand(command.id), reason: "restart-epoch-open" };
+  }
+  if (command.status !== args.expectedStatus) {
+    audit(command.id, command.lane_key, "claim-rejected", now, { reason: "claim-cas-lost" });
+    return { claimed: false, command: getCommand(command.id), reason: "claim-cas-lost" };
+  }
+  if ((command.type === "workspace.merge" || command.type === "landing.gate") && hostGatesDrained(command.target)) {
+    getDb().query("UPDATE commands SET expires_at = MAX(COALESCE(expires_at, 0), ?), lane_wait_at = NULL WHERE id = ? AND status = 'pending'").run(now + 60_000, command.id);
+    return { claimed: false, command: getCommand(command.id), reason: "host-draining:gates-disabled" };
+  }
+  const generation = command.execution_generation + 1;
+  const land = command.type === "workspace.merge" ? landClaimExclusion(command.target, now) : undefined;
+  const changes = getDb().query(`UPDATE commands SET status = 'accepted', updated_at = ?, expires_at = ?,
+    claim_owner_token = ?, execution_id = ?, execution_generation = ?, execution_owner_token = ?, transient_unit = ?, terminal_process_proof = NULL,
+    command_generation = CASE WHEN actuator = 'kernel' THEN command_generation ELSE COALESCE(command_generation, 0) + 1 END${land?.set ?? ""}
+    WHERE id = ? AND status = 'pending' AND controller_version = ? AND controller_token = ?
+      ${land?.sql ?? ""}`
+  ).run(now, args.leaseUntil, args.claimToken, args.executionId, generation, args.claimToken, args.executionTreeHandle,
+    command.id, args.controller.version, args.controller.token, ...(land?.args ?? [])).changes;
+  if (changes === 0) {
+    const reason = refreshPendingLandQueueLease(command.id, now, true) ?? "claim-cas-lost";
+    return { claimed: false, command: getCommand(command.id), reason };
+  }
+  if (row) recordLandingClaimProjection(command, row, generation, now);
+  audit(command.id, command.lane_key, "claimed", now, { controllerToken: args.controller.token, executionGeneration: generation, detail: { claimant: args.claimant } });
+  return { claimed: true, command: getCommand(command.id) };
+}
+
+export function acceptLandingProgressBody(args: AcceptLandingProgressArgs, now: number): { accepted: boolean; auditOnly: boolean; command: Command | null } {
+  const command = landingCommand(args.commandId);
+  if (!command || !command.lane_key) return { accepted: false, auditOnly: true, command: null };
+  const row = ownership(command.lane_key);
+  const current = controllerMatches(command, args.controller) && membershipAllows(row, command)
+    && executionMatches(command, args.execution) && landingRunTupleMatches(command, args.tuple) && isNewerTuple(command, args.tuple)
+    && (command.status === "accepted" || command.status === "running");
+  if (!current) {
+    audit(command.id, command.lane_key, "late-progress", now, { reason: "stale-fence-or-tuple", executionGeneration: args.execution.generation, detail: args.tuple });
+    return { accepted: false, auditOnly: true, command: getCommand(command.id) };
+  }
+  const progress = isLandingCommandType(command.type) ? validateLandingCommandProgress(args.progress) : args.progress;
+  getDb().query(`UPDATE commands SET status = 'running', result = ?, landing_progress_epoch = ?, landing_progress_sequence = ?, updated_at = ?, expires_at = ? WHERE id = ?`)
+    .run(JSON.stringify(maskProviderSecrets(progress)), args.tuple.epoch, args.tuple.sequence, now, landingClaimLeaseUntil(getCommand(command.id)!, now), command.id);
+  if (command.type === "workspace.merge") recordLandStackCandidate(command.id, args.progress, now);
+  audit(command.id, command.lane_key, "progress", now, { executionGeneration: args.execution.generation, detail: args.tuple });
+  return { accepted: true, auditOnly: false, command: getCommand(command.id) };
+}
+
+/** #2613 item 2 — the DISTINCT non-retryable landing blocker code a host may report when its
+ *  land gate could not be keyed to a repository (fail-closed identity refusal). Read from the
+ *  settled merge result and stamped onto the row's landing_blocker_code beside the other
+ *  controller-owned codes; sanitized to the same charset the column's other writers use. */
+function mergeResultLandingBlockerCode(value: unknown): string | undefined {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return undefined;
+  const raw = (value as Record<string, unknown>).landingBlockerCode;
+  if (typeof raw !== "string") return undefined;
+  const cleaned = raw.trim().toLowerCase().replace(/[^a-z0-9_]/g, "");
+  return cleaned ? cleaned.slice(0, 120) : undefined;
+}
+
+/**
+ * #2613 R3 — a TERMINAL result that arrives for an ALREADY-terminal landing row must not lose
+ * its evidence. The concrete race: the watchdog terminalizes a merge row while its gate is still
+ * running; minutes later the gate finishes green and the executor's terminal report CAS-loses.
+ * Dropping it (the old behavior) discarded the only proof the gate PASSED — the coordinator could
+ * not tell a zombie gate from a red one, and a re-land re-ran a suite that had already passed.
+ *
+ * The attach is evidence-only and fence-checked: same controller + same execution + same run
+ * tuple, terminal status CAS-pinned in the UPDATE so the row's STATUS never changes (no #930
+ * terminal-transition churn, no land-state written — settle still keys on `succeeded`). The
+ * completed-process proof rides along so the ledger's execution evidence stays complete.
+ */
+function attachLateLandingResultToTerminalRow(command: LandingCommandRow, args: AcceptLandingResultArgs, now: number): boolean {
+  if (!isTerminalCommandStatus(command.status)) return false;
+  if (!controllerMatches(command, args.controller) || !executionMatches(command, args.execution)
+    || !landingRunTupleMatches(command, args.tuple)) return false;
+  const value = requiredTypedLandingResult(command.type, args.result.value);
+  requireTerminalProcessProof(command, "completed", args.terminalEvidence.hostEvidence);
+  const evidenceId = args.terminalEvidence.evidenceId;
+  // OR IGNORE: a replayed late report can carry the SAME evidence id it already recorded; the
+  // evidence-preserving path must never throw on proof rows it already holds.
+  getDb().query(`INSERT OR IGNORE INTO landing_execution_proofs
+    (evidence_id, command_id, execution_generation, proof, host_evidence, created_at) VALUES (?, ?, ?, 'completed', ?, ?)`
+  ).run(evidenceId, command.id, command.execution_generation, JSON.stringify(args.terminalEvidence.hostEvidence), now);
+  const blockerCode = mergeResultLandingBlockerCode(value);
+  const changed = getDb().query(`UPDATE commands
+    SET result = ?, error = ?, terminal_process_proof = 'completed',
+        landing_blocker_code = COALESCE(?, landing_blocker_code), updated_at = ?
+    WHERE id = ? AND status = ? AND controller_version = ? AND controller_token = ?
+      AND execution_id = ? AND execution_generation = ? AND execution_owner_token = ?`
+  ).run(value === undefined ? null : JSON.stringify(maskProviderSecrets(value)), maskProviderSecrets(args.result.error) ?? null, blockerCode ?? null,
+    now, command.id, command.status, command.controller_version, command.controller_token,
+    command.execution_id, command.execution_generation, command.execution_owner_token).changes;
+  if (changed !== 1) return false;
+  releaseBoundMergeLeaseAfterProof(command, "completed", args.terminalEvidence.hostEvidence);
+  audit(command.id, command.lane_key ?? `unclassified:${command.id}`, "late-result-attached", now, {
+    executionGeneration: args.execution.generation,
+    detail: { terminalStatus: command.status, tuple: args.tuple, blockerCode },
+  });
+  return true;
+}
+
+export function acceptLandingResultBody(args: AcceptLandingResultArgs, now: number): { accepted: boolean; auditOnly: boolean; command: Command | null } {
+  const command = landingCommand(args.commandId);
+  if (!command || !command.lane_key) return { accepted: false, auditOnly: true, command: null };
+  const row = ownership(command.lane_key);
+  const current = controllerMatches(command, args.controller) && membershipAllows(row, command)
+    && executionMatches(command, args.execution) && landingRunTupleMatches(command, args.tuple) && isNewerTuple(command, args.tuple)
+    && (command.status === "accepted" || command.status === "running");
+  if (!current) {
+    // #2613 R3 — the late-result attach: same-execution evidence lands on the terminal row
+    // instead of being audited away. Only a fence MISMATCH keeps the plain late-result audit.
+    if (attachLateLandingResultToTerminalRow(command, args, now)) {
+      return { accepted: false, auditOnly: true, command: getCommand(command.id) };
+    }
+    audit(command.id, command.lane_key, "late-result", now, { reason: "stale-fence-or-tuple", executionGeneration: args.execution.generation, detail: args.tuple });
+    return { accepted: false, auditOnly: true, command: getCommand(command.id) };
+  }
+  const evidence = args.terminalEvidence.hostEvidence;
+  if (args.terminalEvidence.proof !== "completed") throw new ValidationError("landing result requires completed proof");
+  requireTerminalProcessProof(command, "completed", evidence);
+  const value = requiredTypedLandingResult(command.type, args.result.value);
+  // #2613 item 2 — a merge result may carry a DISTINCT non-retryable landing blocker code; it
+  // is stamped beside the row's other controller-owned codes (COALESCE never overwrites one).
+  const blockerCode = mergeResultLandingBlockerCode(value);
+  const changed = getDb().query(`UPDATE commands SET status = ?, result = ?, error = ?, terminal_process_proof = 'completed',
+      landing_blocker_code = COALESCE(?, landing_blocker_code),
+      landing_progress_epoch = ?, landing_progress_sequence = ?, updated_at = ?
+    WHERE id = ? AND status IN ('accepted', 'running') AND controller_version = ? AND controller_token = ?
+      AND execution_id = ? AND execution_generation = ? AND execution_owner_token = ?`
+  ).run(args.result.status, value === undefined ? null : JSON.stringify(maskProviderSecrets(value)),
+    maskProviderSecrets(args.result.error) ?? null, blockerCode ?? null, args.tuple.epoch, args.tuple.sequence, now, command.id,
+    args.controller.version, args.controller.token, args.execution.id, args.execution.generation,
+    args.execution.ownerToken).changes;
+  if (changed !== 1) {
+    // #2613 R3 — the read-CAS window: the row went terminal between the fence check and the
+    // UPDATE. Re-read and attach rather than throwing the evidence away.
+    const fresh = landingCommand(args.commandId);
+    if (fresh?.lane_key && attachLateLandingResultToTerminalRow(fresh, args, now)) {
+      return { accepted: false, auditOnly: true, command: getCommand(args.commandId) };
+    }
+    throw new ValidationError("landing result CAS lost");
+  }
+  getDb().query(`INSERT INTO landing_execution_proofs
+    (evidence_id, command_id, execution_generation, proof, host_evidence, created_at) VALUES (?, ?, ?, 'completed', ?, ?)`
+  ).run(args.terminalEvidence.evidenceId, command.id, args.execution.generation, JSON.stringify(args.terminalEvidence.hostEvidence), now);
+  retireLivePublishPermits(command.id, now);
+  releaseBoundMergeLeaseAfterProof(command, "completed", evidence);
+  audit(command.id, command.lane_key, "result", now, { executionGeneration: args.execution.generation, detail: { tuple: args.tuple, status: args.result.status } });
+  return { accepted: true, auditOnly: false, command: getCommand(command.id) };
+}
+
+export function acquireLegacyPublishFenceBody(args: AcquireLegacyPublishFenceArgs, now: number): { permitted: boolean; permitId?: string; reason?: string } {
+  const command = landingCommand(args.commandId);
+  if (!command || !command.lane_key || command.lane_key !== args.laneKey) return { permitted: false, reason: "lane-mismatch" };
+  const row = ownership(command.lane_key);
+  const params = JSON.parse(command.params) as Record<string, unknown>;
+  const source = exactSourceIdentity(params);
+  const sourceMatches = Boolean(source && source.sourceRef === args.sourceRef
+    && source.sourceHeadSha === args.sourceHeadSha.toLowerCase());
+  if (!row || !controllerMatches(command, args.controller) || !membershipAllows(row, command)
+    || !executionMatches(command, args.execution) || !sourceMatches
+    || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(args.expectedBaseSha)
+    || (args.candidateHeadSha !== undefined && !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(args.candidateHeadSha))
+    || (args.pushRemote !== undefined && !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(args.pushRemote))
+    || !LEGACY_PUSH_ATTEMPT_ID.test(args.pushAttemptId)
+    || (command.status !== "accepted" && command.status !== "running")) {
+    audit(command.id, command.lane_key, "publish-fence-rejected", now, { reason: "stale-or-mismatched-fence" });
+    return { permitted: false, reason: "stale-or-mismatched-fence" };
+  }
+  const stackRefusal = landStackPublishRefusal(command.id, args.expectedBaseSha, now);
+  if (stackRefusal) return { permitted: false, reason: stackRefusal };
+  const candidate = args.candidateHeadSha?.toLowerCase() ?? null;
+  const baseRef = typeof params.baseRef === "string" ? normalizeLandingBaseRef(params.baseRef) : null;
+  const frozenArgv = candidate && baseRef && args.pushRemote
+    ? JSON.stringify(["push", args.pushRemote, `${candidate}:refs/heads/${baseRef}`]) : null;
+  getDb().query(`INSERT INTO landing_publish_permits
+    (id, command_id, lane_key, controller_token, execution_generation, expected_base_sha, source_ref, source_head_sha, push_attempt_id, issued_at, candidate_head_sha, base_ref, frozen_argv)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(command_id, push_attempt_id) DO NOTHING`
+  ).run(args.permitId, command.id, command.lane_key, args.controller.token, args.execution.generation,
+    args.expectedBaseSha.toLowerCase(), source!.sourceRef, source!.sourceHeadSha, args.pushAttemptId, now, candidate, baseRef, frozenArgv);
+  const stored = getDb().query(`SELECT id, lane_key, controller_token, execution_generation,
+      expected_base_sha, source_ref, source_head_sha, consumed_at, retired_at, candidate_head_sha, base_ref, frozen_argv
+    FROM landing_publish_permits WHERE command_id = ? AND push_attempt_id = ?`
+  ).get(command.id, args.pushAttemptId) as { id: string; lane_key: string; controller_token: string;
+    execution_generation: number; expected_base_sha: string; source_ref: string; source_head_sha: string;
+    consumed_at: number | null; retired_at: number | null; candidate_head_sha: string | null; base_ref: string | null; frozen_argv: string | null } | undefined;
+  if (!stored || stored.lane_key !== command.lane_key || stored.controller_token !== args.controller.token
+    || stored.execution_generation !== args.execution.generation || stored.expected_base_sha !== args.expectedBaseSha.toLowerCase()
+    || stored.candidate_head_sha !== candidate || stored.base_ref !== baseRef || stored.frozen_argv !== frozenArgv
+    || stored.source_ref !== source!.sourceRef || stored.source_head_sha !== source!.sourceHeadSha || stored.retired_at !== null) {
+    return { permitted: false, reason: "push-attempt-conflict" };
+  }
+  audit(command.id, command.lane_key, "publish-permit", now, { executionGeneration: args.execution.generation, detail: { permitId: stored.id, pushAttemptId: args.pushAttemptId } });
+  return { permitted: stored.consumed_at === null, permitId: stored.id };
+}
+
+export function consumeLegacyPublishPermitBody(args: ConsumeLegacyPublishPermitArgs, now: number): { consumed: boolean; reason?: string } {
+  const command = landingCommand(args.commandId);
+  if (!command?.lane_key || command.lane_key !== args.laneKey) return { consumed: false, reason: "lane-mismatch" };
+  const row = ownership(command.lane_key);
+  if (!row || !controllerMatches(command, args.controller) || !membershipAllows(row, command)
+    || !executionMatches(command, args.execution) || (command.status !== "accepted" && command.status !== "running")) {
+    return { consumed: false, reason: "stale-or-mismatched-fence" };
+  }
+  const permit = getDb().query(`SELECT consumed_at, retired_at, expected_base_sha FROM landing_publish_permits
+    WHERE id = ? AND command_id = ? AND push_attempt_id = ? AND lane_key = ? AND controller_token = ? AND execution_generation = ?`
+  ).get(args.permitId, command.id, args.pushAttemptId, command.lane_key, args.controller.token, args.execution.generation) as {
+    consumed_at: number | null; retired_at: number | null; expected_base_sha: string;
+  } | undefined;
+  if (!permit || permit.retired_at !== null) return { consumed: false, reason: "permit-missing-or-retired" };
+  const stackRefusal = landStackPublishRefusal(command.id, permit.expected_base_sha, now);
+  if (stackRefusal) return { consumed: false, reason: stackRefusal };
+  if (permit.consumed_at === null) {
+    const changed = getDb().query(`UPDATE landing_publish_permits SET consumed_at = ?
+      WHERE id = ? AND consumed_at IS NULL AND retired_at IS NULL`).run(now, args.permitId).changes;
+    if (changed !== 1) return { consumed: false, reason: "permit-consume-cas-lost" };
+    audit(command.id, command.lane_key, "publish-permit-consumed", now,
+      { executionGeneration: args.execution.generation, detail: { permitId: args.permitId, pushAttemptId: args.pushAttemptId } });
+  }
+  return { consumed: true };
+}
+
+export function recordExecutionProofBody(args: RecordExecutionProofArgs, now: number): { recorded: boolean; command: Command | null } {
+  const command = landingCommand(args.commandId);
+  if (!command) return { recorded: false, command: null };
+  const row = command.lane_key ? ownership(command.lane_key) : null;
+  if (!row || (!membershipAllows(row, command) && !kernelRetirementProofAllowed(command))) {
+    throw new ValidationError("execution proof rejected by landing ownership fence");
+  }
+  const evidence = args.hostEvidence;
+  if (args.proof === "never_started" && !(command.status === "pending" || command.status === "canceled" || command.status === "rejected")) {
+    throw new ValidationError("never_started proof requires a command that never entered execution");
+  }
+  if (args.executionGeneration !== command.execution_generation) throw new ValidationError("execution proof generation mismatch");
+  requireTerminalProcessProof(command, args.proof, evidence);
+  getDb().query(`INSERT INTO landing_execution_proofs
+    (evidence_id, command_id, execution_generation, proof, host_evidence, created_at) VALUES (?, ?, ?, ?, ?, ?)`
+  ).run(args.evidenceId, command.id, args.executionGeneration, args.proof, JSON.stringify(evidence), now);
+  getDb().query("UPDATE commands SET terminal_process_proof = ?, updated_at = ? WHERE id = ?")
+    .run(args.proof, now, command.id);
+  completeKernelRetirementProjection(command, now);
+  if (args.proof === "completed" || args.proof === "process_tree_dead") {
+    retireLivePublishPermits(command.id, now);
+    if (["succeeded", "failed", "timed_out", "rejected", "canceled"].includes(command.status)) {
+      releaseBoundMergeLeaseAfterProof(command, args.proof, evidence);
+    }
+  }
+  audit(command.id, command.lane_key ?? `unclassified:${command.id}`, "execution-proof", now, { executionGeneration: args.executionGeneration, detail: { proof: args.proof } });
+  return { recorded: true, command: getCommand(command.id) };
+}
+
+/** Expiry is only a wake-up signal. This writer is the sole path that may turn that signal into a
+ * terminal legacy command: ownership membership, execution correlation, positive proof, and the
+ * terminal CAS all commit in one transaction before any lease can be released. */
+export function terminalizeLegacyLandingBody(args: TerminalizeLegacyLandingArgs, now: number): {
+  terminalized: boolean;
+  command: Command | null;
+  reason?: string;
+} {
+  const command = landingCommand(args.commandId);
+  if (!command || !command.lane_key) return { terminalized: false, command: null, reason: "missing-landing-command" };
+  const row = ownership(command.lane_key);
+  if (!row || !controllerMatches(command, args.controller)
+    || (!membershipAllows(row, command) && !landingNeverStartedRetirementAllows(row, command))) {
+    audit(command.id, command.lane_key, "reconcile-rejected", now, { reason: "ownership-fence" });
+    return { terminalized: false, command: getCommand(command.id), reason: "ownership-fence" };
+  }
+  if (command.status !== args.expectedStatus) {
+    audit(command.id, command.lane_key, "reconcile-rejected", now, { reason: "status-cas-lost" });
+    return { terminalized: false, command: getCommand(command.id), reason: "status-cas-lost" };
+  }
+  if (args.proof === "never_started") {
+    if (command.status !== "pending" || command.terminal_process_proof !== "never_started" || command.execution_generation !== 0) {
+      throw new ValidationError("never_started reconciliation requires the original pending generation");
+    }
+  } else {
+    if (!args.execution || !executionMatches(command, args.execution)) {
+      throw new ValidationError("process_tree_dead reconciliation requires the current execution fence");
+    }
+  }
+  requireTerminalProcessProof(command, args.proof, args.hostEvidence);
+  const generation = command.execution_generation;
+  getDb().query(`INSERT INTO landing_execution_proofs
+    (evidence_id, command_id, execution_generation, proof, host_evidence, created_at) VALUES (?, ?, ?, ?, ?, ?)`
+  ).run(args.evidenceId, command.id, generation, args.proof, JSON.stringify(args.hostEvidence), now);
+  const changed = getDb().query(`UPDATE commands SET status = 'timed_out', error = ?, terminal_process_proof = ?, updated_at = ?
+    WHERE id = ? AND status = ? AND controller_version = ? AND controller_token = ? AND execution_generation = ?`
+  ).run(args.error, args.proof, now, command.id, args.expectedStatus, args.controller.version, args.controller.token, generation).changes;
+  if (changed !== 1) throw new ValidationError("legacy landing terminalization CAS lost");
+  retireLivePublishPermits(command.id, now);
+  releaseBoundMergeLeaseAfterProof(command, args.proof, args.hostEvidence);
+  audit(command.id, command.lane_key, "reconciled-terminal", now, {
+    executionGeneration: generation,
+    detail: { proof: args.proof, priorStatus: args.expectedStatus },
+  });
+  return { terminalized: true, command: getCommand(command.id) };
+}
+
+/** Ownership-aware containment for workspace abandon. Only the original never-started generation
+ * can be canceled; claim and cancel serialize on the same writer and exactly one wins. */
+export function cancelPendingLegacyLandingsBody(args: CancelPendingLegacyLandingsArgs, now: number): { canceled: number } {
+  const rows = getDb().query(`SELECT id FROM commands
+    WHERE type = 'workspace.merge' AND correlation_id = ? AND status = 'pending'
+    ORDER BY created_at LIMIT 100`
+  ).all(args.correlationId) as Array<{ id: string }>;
+  let canceled = 0;
+  for (const candidate of rows) {
+    const command = landingCommand(candidate.id);
+    if (command?.landing_containment_mode === "legacy-unfenced-v0") {
+      const changed = getDb().query(`UPDATE commands SET status = 'canceled', error = ?, updated_at = ?
+        WHERE id = ? AND status = 'pending' AND landing_containment_mode = 'legacy-unfenced-v0'`)
+        .run(args.reason, now, command.id).changes;
+      if (changed === 1) {
+        releaseBoundMergeLease(command.id);
+        audit(command.id, command.lane_key ?? `unclassified:${command.id}`, "legacy-unfenced-canceled", now,
+          { detail: { landingContainmentMode: "legacy-unfenced-v0" } });
+        canceled += 1;
+      }
+      continue;
+    }
+    if (!command?.lane_key || command.controller !== "legacy" || command.execution_generation !== 0
+      || command.terminal_process_proof !== "never_started") continue;
+    const row = ownership(command.lane_key);
+    if (!row || (!membershipAllows(row, command) && !landingNeverStartedRetirementAllows(row, command))) {
+      audit(command.id, command.lane_key, "cancel-rejected", now, { reason: "ownership-fence" });
+      continue;
+    }
+    const changed = getDb().query(`UPDATE commands SET status = 'canceled', error = ?, updated_at = ?
+      WHERE id = ? AND status = 'pending' AND controller = 'legacy' AND controller_version = ?
+        AND controller_token = ? AND execution_generation = 0 AND terminal_process_proof = 'never_started'`
+    ).run(args.reason, now, command.id, command.controller_version, command.controller_token).changes;
+    if (changed !== 1) continue;
+    releaseBoundMergeLeaseAfterProof(command, "never_started", { source: "ownership-aware-cancel" });
+    audit(command.id, command.lane_key, "canceled-never-started", now, { controllerToken: command.controller_token ?? undefined });
+    canceled += 1;
+  }
+  return { canceled };
+}
+
+export interface CancelLegacyLandingExecutionArgs {
+  readonly commandId: string;
+  /** The workspace the withdraw keys on — the command must belong to it (belt against a stale id). */
+  readonly correlationId: string;
+  readonly reason: string;
+  readonly superseded?: boolean;
+}
+
+/** Blocker code stamped on a legacy merge command canceled by a coordinator withdraw (#2609).
+ * Defined here beside its single writer; task-land-withdraw re-exports the same binding. */
+export const LAND_WITHDRAWN_COMMAND_BLOCKER = "land_withdrawn";
+
+/** Consumption precedes the external push; without a settle fact its outcome is unknown. */
+export function legacyLandingPublishConsumed(commandId: string): boolean {
+  return Boolean(getDb().query(`SELECT 1 FROM landing_publish_permits
+    WHERE command_id = ? AND consumed_at IS NOT NULL LIMIT 1`).get(commandId));
+}
+
+/**
+ * #2609 — the coordinator withdraw's LEGACY-lane mid-flight cancel. Handles BOTH dispatch states:
+ *
+ *   - `pending` (merge_planned, not yet claimed): delegates to the existing never-started cancel
+ *     (ownership-fenced; the bound merge lease is released — nothing was executing).
+ *   - `accepted`/`running` (gate_running/merging): CAS the live row to `canceled` and retire its
+ *     live publish permits. Semantics (documented for #2609): the cancel is CLEAN only pre-push.
+ *     In the fenced `cgroup-v2-close-v1` mode the executor's push must win the last-adjacent
+ *     publish fence, which re-reads this status — a canceled command can no longer acquire a
+ *     permit, so the land cannot reach origin. In `legacy-unfenced-v0` there is no publish fence:
+ *     the cancel is advisory and a host that already pushed will still land (visible later via
+ *     the receipt/ancestry reconciliation — the point of no return is the origin push, and after
+ *     it the "cannot un-land" rule governs). The merge LEASE is deliberately kept bound here: the
+ *     executor process may still be alive, and releasing it would let a second merge start under
+ *     a live process. It self-expires at the lease TTL or is released by the existing
+ *     ownership-aware proof paths.
+ *
+ * The executor's late terminal report for a canceled row CAS-loses (`terminalizeLegacyLandingBody`
+ * matches the pre-cancel status) and progress acceptance is dead (`settleWorkspaceMergeCommand`
+ * only advances from a `running` row), so the ledger stays truthful after the cancel.
+ */
+export function cancelLegacyLandingExecutionBody(args: CancelLegacyLandingExecutionArgs, now: number): {
+  canceled: boolean;
+  command: Command | null;
+  reason?: string;
+} {
+  const command = landingCommand(args.commandId);
+  if (!command || command.type !== "workspace.merge" || command.correlation_id !== args.correlationId) {
+    return { canceled: false, command: null, reason: "missing-landing-command" };
+  }
+  if (command.status === "pending") {
+    const result = cancelPendingLegacyLandingsBody({ correlationId: args.correlationId, reason: args.reason }, now);
+    const fresh = getCommand(args.commandId);
+    return { canceled: result.canceled > 0, command: fresh, reason: result.canceled > 0 ? undefined : "never-started-cancel-lost" };
+  }
+  if (command.status !== "accepted" && command.status !== "running") {
+    return { canceled: false, command: getCommand(args.commandId), reason: `already-${command.status}` };
+  }
+  // Serialized with permit consumption: cancellation can stop a pre-push command, but cannot
+  // revoke a push that already crossed its final fence or call an already-published SHA withdrawn.
+  if (legacyLandingPublishConsumed(command.id)) {
+    return { canceled: false, command: getCommand(command.id), reason: "publish-outcome-unresolved" };
+  }
+  const changed = getDb().query(`UPDATE commands SET status = 'canceled', error = ?,
+      landing_blocker_code = ?, updated_at = ?
+    WHERE id = ? AND type = 'workspace.merge' AND correlation_id = ?
+      AND status IN ('accepted','running')`)
+    .run(args.reason.slice(0, 2_000), args.superseded ? "land_superseded" : LAND_WITHDRAWN_COMMAND_BLOCKER, now, args.commandId, args.correlationId).changes;
+  if (changed !== 1) {
+    return { canceled: false, command: getCommand(args.commandId), reason: "status-cas-lost" };
+  }
+  retireLivePublishPermits(args.commandId, now);
+  audit(args.commandId, command.lane_key ?? `unclassified:${args.commandId}`, args.superseded ? "superseded" : "withdraw-canceled", now, {
+    detail: { reason: args.reason.slice(0, 500), containmentMode: command.landing_containment_mode ?? undefined },
+  });
+  return { canceled: true, command: getCommand(args.commandId) };
+}
+
+export interface LegacyLandingBackfillCandidate {
+  readonly id: string;
+  readonly target: string;
+  readonly status: CommandStatus;
+  readonly params: Record<string, unknown>;
+  readonly paramsJson: string;
+  readonly updatedAt: number;
+  readonly claimOwnerToken?: string;
+  readonly executionId?: string;
+  readonly executionGeneration: number;
+  readonly executionOwnerToken?: string;
+  readonly processGroupId?: number;
+  readonly transientUnit?: string;
+  readonly terminalProcessProof?: TerminalProcessProof;
+  readonly controller?: string;
+  readonly controllerVersion?: number;
+  readonly controllerToken?: string;
+  readonly laneKey?: string;
+  readonly actuator?: string;
+  readonly commandGeneration?: number;
+  readonly landingProgressEpoch?: number;
+  readonly landingProgressSequence?: number;
+  readonly landingBlockerCode?: string;
+  readonly landingBlockerDetail?: string;
+  readonly landingContainmentMode?: LandingContainmentMode;
+  readonly duplicateConsumedParams?: boolean;
+}
+
+export function listLegacyLandingBackfillCandidatesBody(input: { afterId?: string; limit?: number }): LegacyLandingBackfillCandidate[] {
+  const limit = Math.max(1, Math.min(100, input.limit ?? 100));
+  const rows = getDb().query(`SELECT id, target, status, params, updated_at, claim_owner_token, execution_id,
+      execution_generation, execution_owner_token, process_group_id, transient_unit, terminal_process_proof,
+      controller, controller_version, controller_token, lane_key, actuator, command_generation,
+      landing_progress_epoch, landing_progress_sequence, landing_blocker_code, landing_blocker_detail,
+      landing_containment_mode, ${legacyLandingParamsCanonicalSql("commands")} AS params_canonical,
+      CASE WHEN json_valid(params) = 0 THEN 2 WHEN json_type(params) != 'object' THEN 2
+        ELSE (SELECT count(*) FROM json_each(params) WHERE key = 'executionTreeHandle') END AS execution_tree_handle_count
+      FROM commands
+    WHERE type = 'workspace.merge' AND status IN ('pending','accepted','running') AND id > ?
+      AND NOT ${legacyLandingCompletenessSql("commands")}
+    ORDER BY id LIMIT ?`).all(input.afterId ?? "", limit) as Array<{
+      id: string; target: string; status: CommandStatus; params: string; updated_at: number; claim_owner_token: string | null;
+      execution_id: string | null; execution_generation: number; execution_owner_token: string | null;
+      process_group_id: number | null;
+      transient_unit: string | null;
+      terminal_process_proof: TerminalProcessProof | null;
+      controller: string | null; controller_version: number | null; controller_token: string | null;
+      lane_key: string | null; actuator: string | null; command_generation: number | null;
+      landing_progress_epoch: number | null; landing_progress_sequence: number | null;
+      landing_blocker_code: string | null; landing_blocker_detail: string | null;
+      landing_containment_mode: LandingContainmentMode | null;
+      params_canonical: number;
+      execution_tree_handle_count: number;
+    }>;
+  const parseParams = (value: string): Record<string, unknown> => {
+    try {
+      const parsed = JSON.parse(value) as unknown;
+      return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)
+        ? parsed as Record<string, unknown> : {};
+    } catch { return {}; }
+  };
+  return rows.map((row) => ({
+    id: row.id,
+    target: row.target,
+    status: row.status,
+    params: row.params_canonical === 1 ? parseParams(row.params) : {},
+    paramsJson: row.params,
+    updatedAt: row.updated_at,
+    ...(row.claim_owner_token ? { claimOwnerToken: row.claim_owner_token } : {}),
+    ...(row.execution_id ? { executionId: row.execution_id } : {}),
+    executionGeneration: row.execution_generation,
+    ...(row.execution_owner_token ? { executionOwnerToken: row.execution_owner_token } : {}),
+    ...(row.process_group_id ? { processGroupId: row.process_group_id } : {}),
+    ...(row.transient_unit ? { transientUnit: row.transient_unit } : {}),
+    ...(row.terminal_process_proof ? { terminalProcessProof: row.terminal_process_proof } : {}),
+    ...(row.controller ? { controller: row.controller } : {}),
+    ...(row.controller_version !== null ? { controllerVersion: row.controller_version } : {}),
+    ...(row.controller_token ? { controllerToken: row.controller_token } : {}),
+    ...(row.lane_key ? { laneKey: row.lane_key } : {}),
+    ...(row.actuator ? { actuator: row.actuator } : {}),
+    ...(row.command_generation !== null ? { commandGeneration: row.command_generation } : {}),
+    ...(row.landing_progress_epoch !== null ? { landingProgressEpoch: row.landing_progress_epoch } : {}),
+    ...(row.landing_progress_sequence !== null ? { landingProgressSequence: row.landing_progress_sequence } : {}),
+    ...(row.landing_blocker_code ? { landingBlockerCode: row.landing_blocker_code } : {}),
+    ...(row.landing_blocker_detail ? { landingBlockerDetail: row.landing_blocker_detail } : {}),
+    ...(row.landing_containment_mode ? { landingContainmentMode: row.landing_containment_mode } : {}),
+    ...((row.params_canonical !== 1 || row.execution_tree_handle_count > 1) ? { duplicateConsumedParams: true } : {}),
+  }));
+}
+
+export interface BackfillLegacyLandingRow {
+  readonly commandId: string;
+  readonly expectedStatus: CommandStatus;
+  readonly expectedParamsJson: string;
+  readonly expectedUpdatedAt: number;
+  readonly expectedTarget: string;
+  readonly expectedClaimOwnerToken?: string;
+  readonly expectedController?: string;
+  readonly expectedControllerVersion?: number;
+  readonly expectedControllerToken?: string;
+  readonly expectedLaneKey?: string;
+  readonly expectedActuator?: string;
+  readonly expectedCommandGeneration?: number;
+  readonly expectedLandingProgressEpoch?: number;
+  readonly expectedLandingProgressSequence?: number;
+  readonly expectedLandingBlockerCode?: string;
+  readonly expectedLandingBlockerDetail?: string;
+  readonly expectedLandingContainmentMode?: LandingContainmentMode;
+  readonly expectedExecutionId?: string;
+  readonly expectedExecutionGeneration: number;
+  readonly expectedExecutionOwnerToken?: string;
+  readonly expectedProcessGroupId?: number;
+  readonly expectedTransientUnit?: string;
+  readonly expectedTerminalProcessProof?: TerminalProcessProof;
+  readonly laneIdentity?: LandingLaneIdentity;
+  readonly controller?: LandingControllerFence;
+  readonly execution?: LandingExecutionFence;
+  readonly terminalProof?: TerminalProcessProof;
+  readonly hostEvidence?: Record<string, unknown>;
+  readonly blockerDetail?: string;
+  readonly classifiedParamsJson?: string;
+}
+
+export function backfillLegacyLandingPageBody(args: { rows: BackfillLegacyLandingRow[] }, now: number): { inspected: number; stamped: number; blocked: number; conflicted: number } {
+  let stamped = 0;
+  let blocked = 0;
+  let conflicted = 0;
+  for (const item of args.rows.slice(0, 100)) {
+    try {
+      const command = landingCommand(item.commandId);
+      if (!command) { conflicted += 1; continue; }
+      const factsMatch = command.target === item.expectedTarget && command.status === item.expectedStatus
+        && command.updated_at === item.expectedUpdatedAt && command.params === item.expectedParamsJson
+        && (command.claim_owner_token ?? undefined) === item.expectedClaimOwnerToken
+        && (command.controller ?? undefined) === item.expectedController
+        && (command.controller_version ?? undefined) === item.expectedControllerVersion
+        && (command.controller_token ?? undefined) === item.expectedControllerToken
+        && (command.lane_key ?? undefined) === item.expectedLaneKey
+        && (command.actuator ?? undefined) === item.expectedActuator
+        && (command.command_generation ?? undefined) === item.expectedCommandGeneration
+        && (command.landing_progress_epoch ?? undefined) === item.expectedLandingProgressEpoch
+        && (command.landing_progress_sequence ?? undefined) === item.expectedLandingProgressSequence
+        && (command.execution_id ?? undefined) === item.expectedExecutionId
+        && command.execution_generation === item.expectedExecutionGeneration
+        && (command.execution_owner_token ?? undefined) === item.expectedExecutionOwnerToken
+        && (command.process_group_id ?? undefined) === item.expectedProcessGroupId
+        && (command.transient_unit ?? undefined) === item.expectedTransientUnit
+        && (command.terminal_process_proof ?? undefined) === item.expectedTerminalProcessProof
+        && (command.landing_blocker_code ?? undefined) === item.expectedLandingBlockerCode
+        && (command.landing_blocker_detail ?? undefined) === item.expectedLandingBlockerDetail
+        && (command.landing_containment_mode ?? undefined) === item.expectedLandingContainmentMode;
+      if (!factsMatch) { conflicted += 1; continue; }
+
+      const casSuffix = ` AND target = ? AND status = ? AND updated_at = ? AND params = ?
+        AND claim_owner_token IS ? AND controller IS ? AND controller_version IS ? AND controller_token IS ?
+        AND lane_key IS ? AND actuator IS ? AND command_generation IS ?
+        AND landing_progress_epoch IS ? AND landing_progress_sequence IS ?
+        AND execution_id IS ? AND execution_generation = ? AND execution_owner_token IS ?
+        AND process_group_id IS ? AND transient_unit IS ? AND terminal_process_proof IS ?
+        AND landing_blocker_code IS ? AND landing_blocker_detail IS ? AND landing_containment_mode IS ?`;
+      const casArgs = [command.id, item.expectedTarget, item.expectedStatus, item.expectedUpdatedAt,
+        item.expectedParamsJson, item.expectedClaimOwnerToken ?? null, item.expectedController ?? null,
+        item.expectedControllerVersion ?? null, item.expectedControllerToken ?? null, item.expectedLaneKey ?? null,
+        item.expectedActuator ?? null, item.expectedCommandGeneration ?? null,
+        item.expectedLandingProgressEpoch ?? null, item.expectedLandingProgressSequence ?? null,
+        item.expectedExecutionId ?? null, item.expectedExecutionGeneration, item.expectedExecutionOwnerToken ?? null,
+        item.expectedProcessGroupId ?? null, item.expectedTransientUnit ?? null,
+        item.expectedTerminalProcessProof ?? null, item.expectedLandingBlockerCode ?? null,
+        item.expectedLandingBlockerDetail ?? null, item.expectedLandingContainmentMode ?? null] as const;
+
+      const owner = item.laneIdentity ? ownership(item.laneIdentity.laneKey) : null;
+      const disagreement = item.laneIdentity && command.lane_key && command.lane_key !== item.laneIdentity.laneKey
+        ? "persisted lane disagrees with host-classified lane"
+        : command.controller && command.controller !== "legacy" ? "persisted controller is not legacy"
+        : item.controller && command.controller_version !== null && command.controller_version !== item.controller.version
+          ? "persisted controller version disagrees with lane ownership"
+        : item.controller && command.controller_token !== null && command.controller_token !== item.controller.token
+          ? "persisted controller token disagrees with lane ownership"
+        : command.actuator && command.actuator !== "legacy" ? "persisted actuator is not legacy"
+        : undefined;
+      const ownershipProblem = item.laneIdentity && owner && owner.controller_phase !== "legacy_open"
+        ? `legacy residue discovered after lane entered ${owner.controller_phase}`
+        : item.laneIdentity && item.controller && (!owner || !validIdentity(owner, item.laneIdentity)
+          || owner.phase_version !== item.controller.version || owner.controller_token !== item.controller.token)
+          ? "landing ownership changed during host classification" : undefined;
+      const blockerDetail = item.blockerDetail ?? disagreement ?? ownershipProblem;
+      const laneKey = command.lane_key ?? item.laneIdentity?.laneKey ?? `unclassified:${command.id}`;
+      const mayAdoptOwnership = Boolean(item.laneIdentity && item.controller
+        && laneKey === item.laneIdentity.laneKey && !disagreement && !ownershipProblem);
+      const controllerVersion = command.controller_version ?? (mayAdoptOwnership ? item.controller!.version : null);
+      const controllerToken = command.controller_token ?? (mayAdoptOwnership ? item.controller!.token : null);
+
+      if (!item.laneIdentity || !item.controller || blockerDetail) {
+        const changed = getDb().query(`UPDATE commands SET controller = COALESCE(controller, 'legacy'),
+          controller_version = COALESCE(controller_version, ?), controller_token = COALESCE(controller_token, ?),
+          lane_key = COALESCE(lane_key, ?), actuator = COALESCE(actuator, 'legacy'),
+          command_generation = COALESCE(command_generation, 0),
+          landing_blocker_code = 'LAND_CUTOVER_UNCLASSIFIED_LEGACY', landing_blocker_detail = ?, updated_at = ?
+          WHERE id = ?${casSuffix}`
+        ).run(controllerVersion, controllerToken, laneKey,
+          blockerDetail ?? "repo/base/execution identity could not be proven", now, ...casArgs);
+        if (changed.changes !== 1) { conflicted += 1; continue; }
+        audit(command.id, laneKey, "backfill-blocked", now, { reason: "LAND_CUTOVER_UNCLASSIFIED_LEGACY" });
+        blocked += 1;
+        continue;
+      }
+
+      const hostEvidence = item.hostEvidence ?? { source: "legacy-backfill" };
+      if (item.terminalProof) requireTerminalProcessProof(command, item.terminalProof, hostEvidence);
+      const changed = getDb().query(`UPDATE commands SET controller = COALESCE(controller, 'legacy'),
+        controller_version = COALESCE(controller_version, ?), controller_token = COALESCE(controller_token, ?),
+        lane_key = COALESCE(lane_key, ?), actuator = COALESCE(actuator, 'legacy'),
+        command_generation = COALESCE(command_generation, 0),
+        params = ?,
+        terminal_process_proof = COALESCE(terminal_process_proof, ?),
+        landing_blocker_code = NULL, landing_blocker_detail = NULL, updated_at = ?
+        WHERE id = ?${casSuffix}`
+      ).run(item.controller.version, item.controller.token, item.laneIdentity.laneKey,
+        item.classifiedParamsJson ?? item.expectedParamsJson, item.terminalProof ?? null, now, ...casArgs);
+      if (changed.changes !== 1) { conflicted += 1; continue; }
+      if (item.terminalProof) {
+        getDb().query(`INSERT OR IGNORE INTO landing_execution_proofs
+          (evidence_id, command_id, execution_generation, proof, host_evidence, created_at) VALUES (?, ?, ?, ?, ?, ?)`
+        ).run(`backfill:${command.id}:${command.execution_generation}:${item.terminalProof}`, command.id,
+          command.execution_generation, item.terminalProof, JSON.stringify(hostEvidence), now);
+        if (item.terminalProof === "process_tree_dead" && (command.status === "accepted" || command.status === "running")) {
+          getDb().query("UPDATE commands SET status = 'timed_out', error = ?, updated_at = ? WHERE id = ?")
+            .run("legacy execution process tree confirmed dead during backfill", now, command.id);
+        }
+        if (item.terminalProof === "completed" || item.terminalProof === "process_tree_dead") {
+          releaseBoundMergeLeaseAfterProof(command, item.terminalProof, hostEvidence);
+        }
+      }
+      audit(command.id, item.laneIdentity.laneKey, "backfilled", now, {
+        controllerToken: item.controller.token, executionGeneration: command.execution_generation,
+      });
+      stamped += 1;
+    } catch (error) {
+      conflicted += 1;
+      const command = landingCommand(item.commandId);
+      if (command) audit(command.id, command.lane_key ?? `unclassified:${command.id}`, "backfill-conflict", now, {
+        reason: error instanceof Error ? error.message.slice(0, 500) : "backfill row conflict",
+      });
+    }
+  }
+  return { inspected: Math.min(args.rows.length, 100), stamped, blocked, conflicted };
+}
+
+export function landingClaimLeaseUntil(command: Pick<Command, "type" | "params" | "expiresAt">, now: number): number {
+  const ttl = commandTtlMs(command.type, command.params);
+  return ttl !== undefined ? now + ttl : command.expiresAt ?? now + 60_000;
+}