create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/landing/stop.js

@@ -0,0 +1,49 @@
+'use strict';
+// WP-1 (docs/landing-train-member-withdraw-and-gate-fail-fast-2026-10-31.html §5 D-2/D-6, §6, §9
+// S-1/S-2): the two predicates the member-withdraw move needs. They live here rather than in
+// bin/land.js, which sits exactly at its file-size ceiling (lint/file-size-baseline.json), beside the
+// record they read (`stopRequest`, lib/landing/queue.js requestStop — §4 "Stop requests").
+
+// D-2: should the heartbeat abort this train's controller NOW?
+//
+// `members` are the job records of the train in flight, as read from disk (bin/land.js reads them
+// through `queue.readJob`). A null entry — a job file that vanished, or a read that failed — is not a
+// member and is ignored, so one unreadable file can neither make a train look stopped nor keep a
+// stopped one running.
+//
+//   * >= 2 members, at least one of them carrying a `kind: 'cancel'` request: the train's verdict is
+//     already void — a PASS would land code its owner has withdrawn (I-4: the chain was built from
+//     every member, lib/landing/train.js) and a FAIL would bisect the innocent — so the gate is
+//     aborted at once (P-1: a group's result is void once its content changes).
+//   * every member carries a request of some kind: today's rule, kept for the all-preempt case. A
+//     singleton's one member satisfies it trivially, so the serial runner behaves exactly as before.
+//
+// Only members still `in_progress` are in flight. batch-runner.runTrain bisects INSIDE one take, so the
+// runner's jobIds keep the whole original train while the requeued half sits `queued`; counting that
+// half kept a singleton half's own cancel from ever aborting it (observed 2026-10-31, attempt 2 of
+// batch b-01m697xcw391a8j042f3d5xvp1: `land cancel --force` recorded, gate ran on).
+function shouldAbortTrain(members) {
+  const present = (Array.isArray(members) ? members : []).filter((job) => Boolean(job) && job.state === 'in_progress');
+  if (!present.length) return false;
+  if (present.length >= 2 && present.some((job) => job.stopRequest && job.stopRequest.kind === 'cancel')) return true;
+  return present.every((job) => Boolean(job.stopRequest));
+}
+
+// D-6: is `job` in flight as a member of a RUNNING train of two or more? The lease record is what
+// says a train is running — the runner refreshes its `jobIds` on every heartbeat (§9 S-6) — so
+// `land cancel` may take the withdraw path only while the runner advertises this job as one of its
+// members. A singleton job (no batch, or a batch of one) is never a batch member, and the refusal it
+// keeps is the one that protects a running gate of its own (`--force`).
+//
+// R-3: `jobIds` is additive. A lease written by an older runner has no `jobIds`, and this answers
+// false for it — that runner predates batch members, would not honour the request, and would clobber
+// whatever state we wrote, which is exactly the refusal `cmdCancel` keeps for it.
+function isBatchMemberInFlight(job, leaseRecord) {
+  if (!job || !leaseRecord) return false;
+  const members = job.batch && Array.isArray(job.batch.members) ? job.batch.members : null;
+  if (!members || members.length < 2) return false;
+  const jobIds = Array.isArray(leaseRecord.jobIds) ? leaseRecord.jobIds : null;
+  return Boolean(jobIds) && jobIds.includes(job.id);
+}
+
+module.exports = { shouldAbortTrain, isBatchMemberInFlight };

package/template/coding-task-manager/lib/landing/sync-cli.js

@@ -0,0 +1,475 @@
+'use strict';
+// WP-0/WP-1, the CLI half (docs/fleet-origin-main-sync-skill-2026-10-31.html §6.1-§6.3, §7, §8
+// WP-0/WP-1): `land sync`, the queue side of a sync job, and the four origin doctor checks.
+//
+// This is a PURE MOVE out of bin/land.js (that file is under a frozen size ceiling). land.js keeps
+// owning the process-level helpers — `progress`/`emit*`, the detached runner spawn, the guard
+// renderer/reader, and the git wrappers — and hands them over ONCE through `configure()`. Nothing in
+// here is a second implementation of any of them, and no behaviour changed with the move.
+//
+// §5 R-3 keeps its shape across the move: the ONE publish site is `sync.pushMain` in
+// lib/landing/sync.js; the only other `git push` reachable from this module is doctor's
+// `--dry-run --porcelain` credential probe (AC-0c), which never transfers a ref.
+
+const fs = require('fs');
+const path = require('path');
+
+const { runGitRaw, revParseOrNull } = require('./git');
+const { strFlag } = require('../env-flags');
+const lease = require('./lease');
+const queue = require('./queue');
+const train = require('./train');
+const sync = require('./sync');
+const { loadLandingConfig, loadTargetLandingConfig } = require('./config');
+
+// Injected by bin/land.js at load time (see the `syncCli.configure({...})` call there). Held as plain
+// bindings rather than a `deps.` prefix so the moved function bodies stay byte-comparable with the
+// file they came from — which is the whole point of a pure move.
+let progress = () => {};
+let emitLine = () => {};
+let emitJson = () => {};
+let emitJsonOrLine = () => {};
+let delay = () => Promise.resolve();
+let context = null;
+let branchRef = null;
+let spawnRunner = null;
+let readGuardState = null;
+let CONTRACT = 1;
+let WAIT_TIMEOUT_MS = 4 * 60 * 60 * 1000;
+let POLL_MS = 200;
+
+// §6.2: `land sync [--wait] [--pull-only] [--json]`. The publish policy is read from the TARGET tree
+// (`loadTargetLandingConfig`), exactly like the gate policy, so a branch cannot weaken it. `--wait`
+// is accepted and implied: the verb is already synchronous.
+async function cmdSync(opts, cwd) {
+  const ctx = context(cwd);
+  const config = loadTargetLandingConfig(cwd);
+  const payload = await sync.syncOnce({
+    cwd,
+    common: ctx.common,
+    config,
+    pullOnly: opts.flags.has('pull-only'),
+    runGit: sync.gitRunner(cwd),
+    runTrain: (args) => runSyncTrain(ctx, config, args),
+    followRetry: (jobId) => waitForSyncJob(ctx, jobId),
+  });
+  sync.recordSyncVerdict(ctx.common, payload.verdict, {
+    jobId: payload.jobId || null,
+    attempts: payload.attempts || 1,
+    restart: payload.restart || null,
+  });
+  emitJsonOrLine(opts, payload, syncHumanLine(payload));
+  return sync.exitCodeForVerdict(payload.verdict);
+}
+
+// §6.2: the human line says the verdict, what origin holds, and — for the two contested verdicts —
+// the one thing a reader needs (retry later, or read `land inspect`).
+function syncHumanLine(payload) {
+  const where = payload.remote && payload.branch ? ` (${payload.remote}/${payload.branch})` : '';
+  const attempts = payload.attempts > 1 ? ` after ${payload.attempts} attempts` : '';
+  const hint = payload.hint ? `; run: ${payload.hint}` : '';
+  const id = payload.jobId ? ` [job ${payload.jobId}]` : '';
+  return `sync: ${payload.verdict}${where}${attempts}${id}${hint}`;
+}
+
+// §6.3 step 5 (CLI side): the sync job's train runs in the queue like any other job; this process
+// waits for its terminal state and reads the push verdict `finishSyncJob` wrote on the record.
+async function runSyncTrain(ctx, config, { tip, attempt }) {
+  const job = syncJobRecord(ctx, config, { tip, attempt });
+  queue.enqueue(ctx.root, job);
+  ensureRunner(ctx);
+  return waitForSyncJob(ctx, job.id);
+}
+
+// A sync job settles in TWO steps: the train lands (the queue record flips to `landed`) and only then
+// does the runner push and write `job.sync` (`finishSyncJob`). Waiting on the terminal state alone
+// would read the record inside that window and report a missing verdict, so this waits for the verdict
+// itself. A terminal state is only trusted once the runner that was going to write it is gone — that
+// case really is `sync_verdict_missing` and is reported, not waited out.
+const SYNC_ORPHAN_GRACE_MS = 120000;
+
+async function waitForSyncJob(ctx, jobId) {
+  const deadline = Date.now() + WAIT_TIMEOUT_MS;
+  let orphanedSince = null;
+  for (;;) {
+    const job = queue.readJob(ctx.root, jobId);
+    if (job && job.sync) return { jobId, state: job.state, reason: job.reason || null, sync: job.sync, waited: true };
+    const holder = lease.read(ctx.root);
+    const live = Boolean(holder) && !lease.isDead(holder);
+    if (job && queue.TERMINAL_STATES.includes(job.state) && !(job.state === 'landed' && live)) {
+      // Settled without a verdict and nobody is left to write one: a real `sync_verdict_missing`.
+      return { jobId, state: job.state, reason: job.reason || null, sync: null, waited: true };
+    }
+    if (live) orphanedSince = null;
+    else {
+      if (orphanedSince === null) orphanedSince = Date.now();
+      // Nothing is draining the queue (the runner died, or never started): report rather than hang.
+      if (Date.now() - orphanedSince > SYNC_ORPHAN_GRACE_MS) {
+        return { jobId, state: job ? job.state : 'queued', reason: job ? job.reason || null : null, sync: null, waited: true };
+      }
+    }
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) return { jobId, state: job ? job.state : 'queued', reason: null, sync: null, waited: true };
+    await delay(Math.min(POLL_MS, remaining)); // eslint-disable-line no-await-in-loop
+  }
+}
+
+// D-2: a sync job is an ordinary queue job (R-3: it is the job that publishes), so it is submitted
+// exactly like one — enqueued under the mutex, then a detached runner started if none is live.
+function syncJobRecord(ctx, config, { tip, attempt }) {
+  const publish = config.publish;
+  return {
+    contract: CONTRACT,
+    id: queue.newJobId(),
+    // WP-1: the one marker that says "this job publishes origin" — `afterTrainLanded` reads it, and
+    // it is what stops a sync job from triggering another sync (R-9).
+    kind: 'sync',
+    syncAttempt: attempt,
+    repo: ctx.common,
+    branch: sync.ORIGIN_BRANCH,
+    tip,
+    title: `origin/${publish.branch} sync (attempt ${attempt})`,
+    submittedBy: { session: strFlag('CTM_SESSION_ID') || null, pid: process.pid, cwd: ctx.cwd },
+    state: 'queued',
+    reason: null,
+    priority: 'normal',
+    priorityHistory: [],
+    preemptions: 0,
+    base: null,
+    train: null,
+    tree: null,
+    verdict: null,
+    conflictPaths: [],
+    conflictPreview: null,
+    overlapWithTarget: [],
+    policySource: config.policySource || null,
+    runnerPid: null,
+    timestamps: { queued: queue.nowIso() },
+    gateLog: null,
+  };
+}
+
+function ensureRunner(ctx) {
+  const holder = lease.read(ctx.root);
+  if (holder && !lease.isDead(holder)) return { runner: 'other', pid: holder.pid };
+  const started = spawnRunner(ctx);
+  return { runner: 'self', pid: started ? started.pid : null };
+}
+
+// §6.3 step 5, second half (R-3): the push of the exact commit the train gated, run once the sync
+// job has landed. A rejected push is a CAS miss (R-4): fetch, materialise the new origin tip and
+// enqueue ONE retry train, bounded by `publish.maxRetrains` extra trains; any other failure is
+// `publish_failed` with git's stderr and is never retried.
+async function finishSyncJob(ctx, job) {
+  const config = loadTargetLandingConfig(ctx.cwd);
+  const publish = config.publish;
+  if (!publish) return null;
+  const runGit = sync.gitRunner(ctx.cwd);
+  const attempt = Number.isInteger(job.syncAttempt) ? job.syncAttempt : 1;
+  const sha = revParseOrNull(ctx.cwd, branchRef(config.target));
+  if (!sha) {
+    queue.updateJob(ctx.root, job.id, { sync: { verdict: 'publish_failed', at: queue.nowIso(), attempt, stderr: `${config.target} has no tip` } });
+    sync.recordSyncVerdict(ctx.common, 'publish_failed', { jobId: job.id, attempts: attempt });
+    return null;
+  }
+  const push = sync.pushMain(runGit, { remote: publish.remote, branch: publish.branch, sha });
+  const record = (verdict, extra = {}) => {
+    queue.updateJob(ctx.root, job.id, { sync: { verdict, at: queue.nowIso(), attempt, tip: sha, ...extra } });
+    sync.recordSyncVerdict(ctx.common, verdict, { jobId: job.id, attempts: attempt, restart: extra.restart || null });
+    return verdict;
+  };
+  if (push.outcome === 'ok') {
+    // §8 WP-2b: the train moved main and origin now holds it — this box converges onto its own build.
+    const restart = await sync.scheduleRestartForTip({ from: job.tip || null, to: sha, common: ctx.common });
+    progress(`sync: published ${sha.slice(0, 12)} to ${publish.remote}/${publish.branch}`);
+    return record('published', { restart });
+  }
+  if (push.outcome === 'up_to_date') { progress(`sync: ${publish.remote}/${publish.branch} already at ${sha.slice(0, 12)}`); return record('in_sync'); }
+  if (push.outcome === 'rejected' && attempt <= publish.maxRetrains) {
+    // R-4: origin moved between the fetch that built this train and the push. One more train.
+    const fetched = sync.fetchOrigin(runGit, publish);
+    const originTip = fetched.ok ? sync.revParseVia(runGit, sync.remoteRef(publish.remote, publish.branch)) : null;
+    if (originTip) {
+      sync.materializeOrigin(runGit, publish);
+      const retry = syncJobRecord(ctx, config, { tip: originTip, attempt: attempt + 1 });
+      queue.enqueue(ctx.root, retry);
+      progress(`sync: push rejected (origin moved); retraining as job ${retry.id} (attempt ${attempt + 1})`);
+      return record('retraining', { retryJobId: retry.id, stderr: push.stderr });
+    }
+    return record('publish_failed', { stderr: push.stderr || `cannot re-read ${sync.remoteRef(publish.remote, publish.branch)}` });
+  }
+  if (push.outcome === 'rejected') {
+    progress(`sync: publish contended after ${attempt} attempt(s)`);
+    return record('publish_contended', { stderr: push.stderr });
+  }
+  progress(`sync: push failed: ${push.stderr || `git push exited ${push.status}`}`);
+  return record('publish_failed', { stderr: push.stderr });
+}
+
+// §5 R-9 (S-7): the runner-side hook after a train lands. A landed `kind:"sync"` job publishes
+// itself; an ordinary landing runs the §6.3 step-1..5 logic once when `publish.auto` is on, and a
+// sync job never triggers another (`auto` is what stops `land sync` from recursing). Errors are
+// reported, never thrown: a publish failure must not turn a landed job into a crashed runner.
+async function afterTrainLanded(ctx, jobs) {
+  const landed = (Array.isArray(jobs) ? jobs : []).filter((job) => job && job.state === 'landed');
+  if (!landed.length) return null;
+  const syncJob = landed.find((job) => job.kind === 'sync');
+  if (syncJob) return finishSyncJob(ctx, syncJob);
+  let config;
+  try {
+    config = loadTargetLandingConfig(ctx.cwd);
+  } catch (error) {
+    /* REPORT: an unreadable policy is the job's own refusal to make; the landing stands */
+    return null;
+  }
+  if (!config.publish) return null;
+  // §5 R-7: every move of main schedules an idle restart — an ordinary landing moves main too, and
+  // auto-publish only PUSHES it (`pushed` never moves main, so it schedules nothing). Observed
+  // 2026-10-31: job 01m69v5chb9nngfe landed and published 5ad132e4d4 while the hub kept running
+  // ae6b643adf with sync-state restart:null. The outcome rides on each landed job's record.
+  const landedTip = revParseOrNull(ctx.cwd, branchRef(config.target));
+  if (landedTip) {
+    const restart = await sync.scheduleRestartForTip({ from: null, to: landedTip, common: ctx.common });
+    for (const job of landed) queue.updateJob(ctx.root, job.id, { restart: { tip: landedTip, ...(restart || { spawned: false, reason: 'none' }) } });
+  }
+  if (!config.publish.auto) return null;
+  try {
+    const payload = await sync.syncOnce({
+      cwd: ctx.cwd,
+      common: ctx.common,
+      config,
+      pullOnly: false,
+      runGit: sync.gitRunner(ctx.cwd),
+      // The runner cannot block on its own queue: enqueue the train and let the next drain
+      // iteration run it (its landing calls this function again for the push).
+      runTrain: async ({ tip, attempt }) => {
+        const job = syncJobRecord(ctx, config, { tip, attempt });
+        queue.enqueue(ctx.root, job);
+        progress(`sync: enqueued ${config.publish.remote}/${config.publish.branch} publish job ${job.id} (attempt ${attempt})`);
+        return { jobId: job.id, state: 'queued', reason: null, waited: false };
+      },
+    });
+    if (payload.verdict !== 'publishing' && payload.verdict !== 'in_sync') {
+      sync.recordSyncVerdict(ctx.common, payload.verdict, { attempts: payload.attempts || 1, restart: payload.restart || null });
+    }
+    return payload;
+  } catch (error) {
+    progress(`sync: auto-publish skipped (${typeof error.code === 'string' ? error.code : 'error'}: ${error.message})`);
+    return null;
+  }
+}
+
+// --- WP-1 §6.2: the origin half of `land status` --------------------------------------------------
+
+// Ahead/behind against the LOCAL tracking ref (no fetch: `land status` stays a read verb) plus the
+// last sync verdict from `landing/sync-state.json`.
+function statusOrigin(dir, common, config) {
+  return sync.originStatus({
+    runGit: sync.gitRunner(dir),
+    target: config ? config.target : null,
+    config,
+    common,
+  });
+}
+
+// The human line, printed only for a repository that opted in — an unconfigured repo's status stays
+// byte-identical to what it printed before this change.
+function originStatusLine(config, origin) {
+  if (!config || !config.publish) return null;
+  const ahead = origin.ahead === null ? '?' : origin.ahead;
+  const behind = origin.behind === null ? '?' : origin.behind;
+  const last = origin.lastSync ? `, last sync ${origin.lastSync.verdict}` : '';
+  return `origin: ${config.publish.remote}/${config.publish.branch} ahead ${ahead} behind ${behind}${last}`;
+}
+
+// --- WP-0: the origin doctor checks (§7, §8 WP-0, §9 S-3) ----------------------------------------
+
+const REQUIRED_HOOKS = Object.freeze(['pre-commit', 'commit-msg']);
+
+function hooksState(cwd) {
+  const res = runGitRaw(cwd, ['rev-parse', '--path-format=absolute', '--git-path', 'hooks']);
+  if (res.status !== 0) return { ok: false, detail: 'cannot resolve the hooks dir' };
+  const dir = res.stdout.trim();
+  const missing = REQUIRED_HOOKS.filter((name) => {
+    try {
+      fs.accessSync(path.join(dir, name), fs.constants.X_OK);
+      return false;
+    } catch (error) {
+      /* expected: the hook is absent or not executable — both are "this box runs no gate" */
+      return true;
+    }
+  });
+  return { ok: missing.length === 0, detail: missing.length ? `missing ${missing.join(', ')} in ${dir}` : dir };
+}
+
+function remoteState(cwd, remote) {
+  const res = runGitRaw(cwd, ['remote']);
+  const remotes = res.status === 0 ? res.stdout.split('\n').map((line) => line.trim()).filter(Boolean) : [];
+  return { ok: remotes.includes(remote), detail: remotes.includes(remote) ? remote : `remote ${JSON.stringify(remote)} is not configured (have: ${remotes.join(', ') || 'none'})` };
+}
+
+// AC-0c: `git push --dry-run` with the §6.3 no-prompt env, so a box with no credentials reports
+// `push-auth: FAILED` instead of opening a browser or blocking on a prompt.
+function pushAuthState(cwd, publish, target) {
+  const sha = revParseOrNull(cwd, branchRef(target));
+  if (!sha) return { ok: false, detail: `cannot resolve ${target}` };
+  const res = runGitRaw(cwd, ['push', '--dry-run', '--porcelain', publish.remote, `${sha}:refs/heads/${publish.branch}`], { env: sync.NO_PROMPT_ENV });
+  if (res.status === 0) return { ok: true, detail: `${publish.remote}/${publish.branch}` };
+  // A `[rejected]` ref line means git reached the remote, authenticated and read its refs; only the
+  // ref STATE refused the update (local main is behind or diverged from origin — exactly what
+  // `land sync` resolves). Observed 2026-10-31 on the hub and the MacBook Pro: a diverged main made
+  // this probe print "push-auth: FAILED" while a dry-run push of origin's own tip was "up to date".
+  const refLine = String(res.stdout || '').split('\n').find((line) => line.startsWith('!\t'));
+  if (refLine && /\[rejected\]/.test(refLine)) {
+    const why = (refLine.match(/\[rejected\]\s*\(([^)]*)\)/) || [])[1] || 'rejected';
+    return { ok: true, detail: `${publish.remote}/${publish.branch} (credentials ok; local ${target} is not a fast-forward: ${why} — land sync resolves it)` };
+  }
+  const first = String(res.stderr || res.stdout || '').trim().split('\n')[0];
+  return { ok: false, detail: first || `git push --dry-run exited ${res.status}` };
+}
+
+// Only reported when the repository opted in: a repo with no `landing.publish` has no origin contract
+// to prove, and four FAILED lines on every other user's install would be noise, not signal.
+function originChecks(ctx, config) {
+  let publish = null;
+  try {
+    publish = loadTargetLandingConfig(ctx.cwd).publish;
+  } catch (error) {
+    /* expected: an unreadable target policy is already a doctor finding above (or the repository
+       never opted into publishing) — the origin half then reports "not configured", never a throw */
+  }
+  if (!publish) return { lines: [], problems: 0, payload: { configured: false, checks: null } };
+  const lines = [];
+  const checks = {};
+  let problems = 0;
+  const record = (name, state) => {
+    checks[name] = { ok: state.ok, detail: state.detail || null };
+    lines.push(`origin ${name}: ${state.ok ? 'ok' : `FAILED (${state.detail})`}`);
+    if (!state.ok) problems += 1;
+  };
+  record('hooks', hooksState(ctx.cwd));
+  const guard = readGuardState(ctx.common, config ? config.target : null);
+  record('guard', { ok: guard === 'present', detail: guard });
+  record('remote', remoteState(ctx.cwd, publish.remote));
+  record('push-auth', pushAuthState(ctx.cwd, publish, config ? config.target : null));
+  return { lines, problems, payload: { configured: true, remote: publish.remote, branch: publish.branch, checks } };
+}
+
+function cmdDoctor(opts, cwd) {
+  // WP-0 (AC-0a): `--json` emits the findings as ONE payload; the prose lines are the human form.
+  const jsonMode = opts.flags.has('json');
+  const say = jsonMode ? () => {} : emitLine;
+  const ctx = context(cwd);
+  let problems = 0;
+  say(`repo: ${ctx.common}`);
+  say(`state: ${ctx.root}`);
+  try {
+    fs.accessSync(ctx.root, fs.constants.W_OK);
+    say('state dir: writable');
+  } catch (error) {
+    /* expected: the state directory has not been created yet (nothing has been submitted) or is
+       not writable — both are reported below as a doctor finding, never thrown */
+    if (fs.existsSync(ctx.root)) {
+      say(`state dir: NOT writable (${error.code})`);
+      problems += 1;
+    } else {
+      say('state dir: not created yet (nothing queued)');
+    }
+  }
+  let config = null;
+  try {
+    config = loadLandingConfig(cwd);
+    say(`config: ok (target ${config.target}, mode ${config.mode}, ${config.gates.length} gate(s) from ${config.gatesSource})`);
+  } catch (error) {
+    say(`config: ${typeof error.code === 'string' ? error.code : 'invalid'}: ${error.message}`);
+    problems += 1;
+  }
+  // WP-6 E-1: the reference-transaction fence. `present` (ours, for the configured target) is never
+  // a problem; `missing` / `foreign` are one only where the repository asked for the fence
+  // (`.ctm.json` `landing.guard: true`).
+  const guardState = readGuardState(ctx.common, config ? config.target : null);
+  say(`guard: ${guardState}`);
+  // A repository that requires the fence is unhealthy without OUR hook on the target: absent and
+  // foreign (someone else's hook, or ours baked for another branch) both leave it unfenced.
+  if (guardState !== 'present' && config !== null && config.guard === true) problems += 1;
+  // WP-4 (§7 "Guard"): a config that leaves the fence off can have main moved by hand (I-2), which
+  // discards whatever the queue gated. A warning line only — doctor has no warning channel, so the
+  // exit code is unchanged; only `problems` moves it.
+  if (config !== null && config.guard !== true) say('guard: disabled in .ctm.json (landing.guard: false) — main can be moved outside the queue');
+  const holder = lease.read(ctx.root);
+  if (!holder) {
+    say('lease: none');
+  } else {
+    const dead = lease.isDead(holder);
+    say(`lease: pid ${holder.pid} ${dead ? 'dead (the next submit reaps it)' : 'alive'}${holder.jobId ? ` job ${holder.jobId}` : ''}`);
+  }
+  // D-8: the revisit trigger for a floor, measured rather than guessed — a normal job that waited
+  // more than 180 min while a higher-ranked job started inside that window. Informational: it is not
+  // a finding, so it never counts toward `problems`.
+  try {
+    say(`priority: ${queue.priorityStarvationCount(ctx.root)} normal job(s) waited > 180 min behind a higher-ranked job (14 days)`);
+  } catch (error) {
+    /* expected: the job files are the only input, and an unreadable one (which readJob already
+       treats as "no job") is not a doctor failure — report the count as unknown rather than
+       failing the whole check */
+    say(`priority: unreadable (${error.message})`);
+  }
+  try {
+    const trainsRoot = train.trainsRoot(cwd, ctx.common);
+    say(`trains: ${trainsRoot.dir} (${trainsRoot.source})`);
+  } catch (error) {
+    /* expected: `git check-ignore` could not answer for the repository root — doctor reports the
+       fallback it would use rather than failing the whole check */
+    say(`trains: ${path.join(ctx.common, 'landing', 'trains')} (common-dir, probe failed: ${error.message})`);
+  }
+  // WP-0: the four origin checks. `--json` emits the same findings as a payload (AC-0a), so the
+  // Machines card can render a box's doctor verdict without parsing prose.
+  const origin = originChecks(ctx, config);
+  for (const line of origin.lines) say(line);
+  problems += origin.problems;
+  if (opts.flags.has('json')) {
+    emitJson({ contract: CONTRACT, repo: ctx.common, state: ctx.root, problems, origin: origin.payload });
+  }
+  return problems ? 1 : 0;
+}
+
+// bin/land.js calls this once, at load, with its own process-level helpers. Required — a caller that
+// forgets it gets a module whose emitter is a no-op rather than a thrown TypeError mid-command.
+function configure(injected) {
+  ({
+    progress,
+    emitLine,
+    emitJson,
+    emitJsonOrLine,
+    delay,
+    context,
+    branchRef,
+    spawnRunner,
+    readGuardState,
+    CONTRACT,
+    WAIT_TIMEOUT_MS,
+    POLL_MS,
+  } = injected);
+  return module.exports;
+}
+
+module.exports = {
+  configure,
+  cmdSync,
+  cmdDoctor,
+  syncHumanLine,
+  runSyncTrain,
+  waitForSyncJob,
+  syncJobRecord,
+  ensureRunner,
+  finishSyncJob,
+  afterTrainLanded,
+  statusOrigin,
+  originStatusLine,
+  hooksState,
+  remoteState,
+  pushAuthState,
+  originChecks,
+  SYNC_ORPHAN_GRACE_MS,
+  REQUIRED_HOOKS,
+};