create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/main-thread-lint-exemptions.json

@@ -2,6 +2,10 @@
   "version": 1,
   "description": "Owner-reviewed exemptions for existing main-hot sites. New entries require a non-empty justification.",
   "entries": [
+    {
+      "key": "server.js\tprocess-launch\texecFileCb(\texecFileCb('ps', ['-o', 'args=', '-p', String(numericPid)], { timeout: 2000, maxBuffer: 256 * 1024, killSignal: 'SIGKILL' }, (error, stdout) => {",
+      "justification": "Agent-bundle drift WP-3 (docs/agent-bundle-darwin-readonly-rename-2026-10-27.html D-11): ONE asynchronous `ps -o args= -p <pid>` per ADOPTED session, run once at boot inside _adoptStartupTaskSession to read the --add-dir tree a process this box did not spawn carries (a spawned session is stamped from its own spawn result and never runs ps). Bounded to a single pid, 2 s timeout, 256 KiB maxBuffer, SIGKILL on timeout; the callback resolves 'unknown' on any failure and reports it. Same shape as the baselined `ps -o command= -p <pid>` adoption probe below in this file; never on a request path."
+    },
     {
       "key": "lib/codex-native-history-prefix.js\tsync-api\tfs.realpathSync.native(\tconst canonical = fs.realpathSync.native(filePath);",
       "justification": "Provider-history WP-4: exact canonical containment check for one native rollout prefix, called only by readHistoryTransitionSnapshot/verifyHistoryTransitionFork inside the exclusive read-pool worker. Each request is bounded by the declared 64 MiB byte and 200,000-record limits, depth 8 and at most three candidates; no server request handler calls this synchronous resolver."
@@ -622,10 +626,6 @@
       "key": "db.js\tsync-api\tfs.rmSync(\ttry { fs.rmSync(destPath, { force: true }); } catch {}",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
-    {
-      "key": "db.js\tsync-api\tfs.rmSync(\ttry { fs.rmSync(p, { force: true }); } catch {}",
-      "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
-    },
     {
       "key": "db.js\tsync-api\tfs.rmSync(\ttry { fs.rmSync(tmp, { force: true }); } catch {}",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
@@ -1983,12 +1983,8 @@
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
-      "key": "server.js\tprocess-launch\texecFile(\texecFile(opener, ['-R', g.bundlePath], () => {}); // reveal the bundle so it can be dragged in",
-      "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
-    },
-    {
-      "key": "server.js\tprocess-launch\texecFile(\texecFile(opener, [g.settingsUrl], () => {}); // jump to Full Disk Access pane",
-      "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
+      "key": "server.js\tprocess-launch\texecFile(\tfor (const args of macCaps.fdaOpenCommands(g)) execFile(opener, args, () => {}); // one execFile per open command",
+      "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down. WP-2 (signin-flow-restart-settle-and-fda-target-identity-2026-10-26): one execFile per open command."
     },
     {
       "key": "server.js\tprocess-launch\texecFileCb(\texecFileCb('ps', ['-o', 'command=', '-p', String(pid)], { encoding: 'utf8', timeout: 2000 }, (err, stdout) => {",
@@ -2011,25 +2007,13 @@
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
-      "key": "server.js\tprocess-launch\tspawn(\tproc = spawn(resolveAgentCliCommand('claude'), ['--version'], { stdio: ['ignore', 'pipe', 'pipe'], timeout: 5000 });",
-      "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
-    },
-    {
-      "key": "server.js\tprocess-launch\tspawn(\tproc = spawn(resolveAgentCliCommand('claude'), ['auth', 'status'], {",
-      "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
-    },
-    {
-      "key": "server.js\tprocess-launch\tspawn(\tproc = spawn(resolveAgentCliCommand('codex'), ['login', 'status'], { stdio: ['ignore', 'pipe', 'pipe'], timeout: 10000, env: childEnv });",
+      "key": "lib/api/setup-wizard-handlers.js\tprocess-launch\tspawn(\tproc = spawn(_deps.resolveAgentCliCommand('claude'), ['--version'], { stdio: ['ignore', 'pipe', 'pipe'], timeout: 5000 });",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
       "key": "server.js\tprocess-launch\tspawn(\tproc = spawn(resolveRealNode(), args, {",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
-    {
-      "key": "server.js\tsync-api\texecFileSync(\tconst credJson = execFileSync('security', ['find-generic-password', '-s', 'Claude Code-credentials', '-w'], { encoding: 'utf8', timeout: 3000 }).trim();",
-      "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
-    },
     {
       "key": "server.js\tsync-api\texecFileSync(\tconst out = execFileSync(shell, ['-lc', `${getShellRcSource(shell)} printf %s \"$${name}\"`], {",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
@@ -2039,23 +2023,23 @@
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
-      "key": "server.js\tsync-api\tfs.copyFileSync(\tfs.copyFileSync(backup.backupPath, dst);",
+      "key": "lib/api/setup-wizard-handlers.js\tsync-api\tfs.copyFileSync(\t_deps.fs.copyFileSync(backup.backupPath, dst);",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
-      "key": "server.js\tsync-api\tfs.existsSync(\tconst exists = fs.existsSync(dir);",
+      "key": "lib/api/setup-wizard-handlers.js\tsync-api\tfs.existsSync(\tconst exists = _deps.fs.existsSync(dir);",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
-      "key": "server.js\tsync-api\tfs.existsSync(\tconst hasBackups = fs.existsSync(path.join(dir, 'backups'));",
+      "key": "lib/api/setup-wizard-handlers.js\tsync-api\tfs.existsSync(\tconst hasBackups = _deps.fs.existsSync(_deps.path.join(dir, 'backups'));",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
-      "key": "server.js\tsync-api\tfs.existsSync(\tconst hasBrainDb = fs.existsSync(path.join(dir, 'wall-e-brain.db'));",
+      "key": "lib/api/setup-wizard-handlers.js\tsync-api\tfs.existsSync(\tconst hasBrainDb = _deps.fs.existsSync(_deps.path.join(dir, 'wall-e-brain.db'));",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
-      "key": "server.js\tsync-api\tfs.existsSync(\tconst hasCtmDb = fs.existsSync(path.join(dir, 'task-manager.db'));",
+      "key": "lib/api/setup-wizard-handlers.js\tsync-api\tfs.existsSync(\tconst hasCtmDb = _deps.fs.existsSync(_deps.path.join(dir, 'task-manager.db'));",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
@@ -2079,7 +2063,7 @@
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
-      "key": "server.js\tsync-api\tfs.existsSync(\tif (!fs.existsSync(dst)) {",
+      "key": "lib/api/setup-wizard-handlers.js\tsync-api\tfs.existsSync(\tif (!_deps.fs.existsSync(dst)) {",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
@@ -2131,35 +2115,23 @@
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
-      "key": "server.js\tsync-api\tfs.mkdirSync(\tif (ctmDir) try { fs.mkdirSync(ctmDir, { recursive: true }); } catch {}",
+      "key": "lib/api/setup-wizard-handlers.js\tsync-api\tfs.mkdirSync(\tif (ctmDir) try { _deps.fs.mkdirSync(ctmDir, { recursive: true }); } catch {}",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
-      "key": "server.js\tsync-api\tfs.mkdirSync(\tif (walleDir) try { fs.mkdirSync(walleDir, { recursive: true }); } catch {}",
+      "key": "lib/api/setup-wizard-handlers.js\tsync-api\tfs.mkdirSync(\tif (walleDir) try { _deps.fs.mkdirSync(walleDir, { recursive: true }); } catch {}",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
       "key": "lib/api/worktrees.js\tsync-api\tfs.openSync(\tlogFd = fs.openSync(logPath, 'a');",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
-    {
-      "key": "server.js\tsync-api\tfs.readFileSync(\tconst auth = JSON.parse(fs.readFileSync(codexPaths.codexAuthPath(), 'utf8'));",
-      "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
-    },
     {
       "key": "server.js\tsync-api\tfs.readFileSync(\tconst cache = JSON.parse(fs.readFileSync(ANALYSIS_CACHE_FILE, 'utf8'));",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
-      "key": "server.js\tsync-api\tfs.readFileSync(\tconst claudeScript = fs.readFileSync(path.join(serverConfig.HOME, '.devbox', 'ai', 'claude', 'claude'), 'utf8');",
-      "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
-    },
-    {
-      "key": "server.js\tsync-api\tfs.readFileSync(\tconst existing = fs.readFileSync(envPath, 'utf8');",
-      "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
-    },
-    {
-      "key": "server.js\tsync-api\tfs.readFileSync(\tconst headers = fs.readFileSync(authFile, 'utf8').trim();",
+      "key": "lib/api/setup-wizard-handlers.js\tsync-api\tfs.readFileSync(\tconst existing = _deps.fs.readFileSync(envPath, 'utf8');",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
@@ -2171,7 +2143,7 @@
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
-      "key": "server.js\tsync-api\tfs.readFileSync(\tcreds = JSON.parse(fs.readFileSync(GEMINI_CLI_CREDS, 'utf8'));",
+      "key": "lib/api/setup-wizard-handlers.js\tsync-api\tfs.readFileSync(\tcreds = JSON.parse(_deps.fs.readFileSync(GEMINI_CLI_CREDS, 'utf8'));",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
     {
@@ -2222,10 +2194,6 @@
       "key": "server.js\tsync-api\tfs.writeFileSync(\tfs.writeFileSync(filePath, content);",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
-    {
-      "key": "server.js\tsync-api\treadFileSync(\tconst auth = JSON.parse(require('fs').readFileSync(codexPaths.codexAuthPath(), 'utf8'));",
-      "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
-    },
     {
       "key": "server.js\tsync-api\treadFileSync(\trequire('fs').readFileSync(envPath, 'utf8').split('\\n').forEach(line => {",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
@@ -2234,10 +2202,6 @@
       "key": "server.js\tsync-api\treadFileSync(\ttry { text = require('fs').readFileSync(p, 'utf8'); }",
       "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
     },
-    {
-      "key": "server.js\tsync-api\tspawnSync(\tconst proc = require('child_process').spawnSync(resolveAgentCliCommand('codex'), ['login', 'status'], { encoding: 'utf8', timeout: 8000 });",
-      "justification": "Pre-existing main-thread site migrated from the preserved baseline; tracked for burn-down."
-    },
     {
       "key": "api-prompts.js\tsync-api\tfs.statSync(\ttry { stat = fs.statSync(locator); } catch { return false; }",
       "justification": "Byte-complete short-circuit safety guard in _drainSourceFilesStillMatchObservedState, invoked only from the sliced conversation-import coop drain (not the interactive lane). Does ONE bounded fs.statSync per ingest-relevant member to confirm the file still exists at the recorded size before trusting the cached byte-complete verdict; this NET-REDUCES main-thread cost because it gates skipping a full catchUpTranscriptFiles scan+parse (WP-5a). Regression-anchored by tests/conversation-import-failure-cooldown.test.js."
@@ -2805,6 +2769,422 @@
     {
       "key": "lib/session-create/delegate-worker.js\tsync-api\tfs.readFileSync(\tconst bytes = fs.readFileSync(filePath);",
       "justification": "Lead-cost routing round 2 D-3 (docs/lead-cost-routing-round2-2026-10-24.html §6.2): getWorkerStatus() counts the distinct file:line citations of the text its report_source names -- one read of the worker's own report or --output-last-message file (tens of KB, capped at WORKER_REPORT_TEXT_CAP_BYTES for counting) per status/wait read of a TERMINAL worker only (non-terminal statuses read nothing), not a hot loop; synchronous for the same reason the report_present fs.existsSync and last-message fs.statSync exemptions above are: getWorkerStatus's §6.2 contract returns synchronously."
+    },
+    {
+      "key": "lib/sqlite-file-set.js\tsync-api\tunlinkSync(\tfsModule.unlinkSync(`${p}${suffix}`);",
+      "justification": "temp-file-leaks WP-2: removeSqliteFileSet unlinks the <=4 known paths of ONE SQLite file set (base, -journal, -wal, -shm) — metadata-only, no data read. Called only on a backup failure/teardown path (db.js _reclaimBackupDestinationSet after a backup writer threw, before the original error is rethrown); never in a request handler or a steady-state tick."
+    },
+    {
+      "key": "lib/transcript-source.js\tsync-api\tfs.unlinkSync(\tfs.unlinkSync(tmp);",
+      "justification": "temp-file-leaks WP-1 D-4: failure-path-only unlink of the sync decode writer's OWN temp (one path), run only after the already-ledgered writeFileSync/renameSync in the sync twin threw; never on the success path."
+    },
+    {
+      "key": "lib/walle-log-rotation.js\tsync-api\tunlinkSync(\ttry { fsModule.unlinkSync(target); }",
+      "justification": "temp-file-leaks WP-4: rotateInheritedStdio runs only from server.js runDiskHygiene (once at 60 s, then every 10 min), never in a request handler. Bounded: one stat of the log, one APFS clone (COPYFILE_FICLONE, metadata-only on APFS; rotation keeps the source near the 64 MiB threshold if a filesystem falls back to copying), one readdir of the log dir and at most keep+1 archive unlinks. Clone then ftruncate stay synchronous so no event-loop turn lands log writes between the snapshot and the truncate."
+    },
+    {
+      "key": "lib/walle-log-rotation.js\tsync-api\treaddirSync(\ttry { entries = fsModule.readdirSync(directory); }",
+      "justification": "temp-file-leaks WP-4: rotateInheritedStdio runs only from server.js runDiskHygiene (once at 60 s, then every 10 min), never in a request handler. Bounded: one stat of the log, one APFS clone (COPYFILE_FICLONE, metadata-only on APFS; rotation keeps the source near the 64 MiB threshold if a filesystem falls back to copying), one readdir of the log dir and at most keep+1 archive unlinks. Clone then ftruncate stay synchronous so no event-loop turn lands log writes between the snapshot and the truncate."
+    },
+    {
+      "key": "lib/walle-log-rotation.js\tsync-api\tunlinkSync(\ttry { fsModule.unlinkSync(path.join(directory, name)); }",
+      "justification": "temp-file-leaks WP-4: rotateInheritedStdio runs only from server.js runDiskHygiene (once at 60 s, then every 10 min), never in a request handler. Bounded: one stat of the log, one APFS clone (COPYFILE_FICLONE, metadata-only on APFS; rotation keeps the source near the 64 MiB threshold if a filesystem falls back to copying), one readdir of the log dir and at most keep+1 archive unlinks. Clone then ftruncate stay synchronous so no event-loop turn lands log writes between the snapshot and the truncate."
+    },
+    {
+      "key": "lib/walle-log-rotation.js\tsync-api\tstatSync(\ttry { pathStat = fsModule.statSync(logPath); }",
+      "justification": "temp-file-leaks WP-4: rotateInheritedStdio runs only from server.js runDiskHygiene (once at 60 s, then every 10 min), never in a request handler. Bounded: one stat of the log, one APFS clone (COPYFILE_FICLONE, metadata-only on APFS; rotation keeps the source near the 64 MiB threshold if a filesystem falls back to copying), one readdir of the log dir and at most keep+1 archive unlinks. Clone then ftruncate stay synchronous so no event-loop turn lands log writes between the snapshot and the truncate."
+    },
+    {
+      "key": "lib/walle-log-rotation.js\tsync-api\tcopyFileSync(\tfsModule.copyFileSync(logPath, clonePath, copyFlags);",
+      "justification": "temp-file-leaks WP-4: rotateInheritedStdio runs only from server.js runDiskHygiene (once at 60 s, then every 10 min), never in a request handler. Bounded: one stat of the log, one APFS clone (COPYFILE_FICLONE, metadata-only on APFS; rotation keeps the source near the 64 MiB threshold if a filesystem falls back to copying), one readdir of the log dir and at most keep+1 archive unlinks. Clone then ftruncate stay synchronous so no event-loop turn lands log writes between the snapshot and the truncate."
+    },
+    {
+      "key": "lib/walle-log-rotation.js\tsync-api\tunlinkSync(\ttry { fsModule.unlinkSync(clonePath); }",
+      "justification": "temp-file-leaks WP-4: rotateInheritedStdio runs only from server.js runDiskHygiene (once at 60 s, then every 10 min), never in a request handler. Bounded: one stat of the log, one APFS clone (COPYFILE_FICLONE, metadata-only on APFS; rotation keeps the source near the 64 MiB threshold if a filesystem falls back to copying), one readdir of the log dir and at most keep+1 archive unlinks. Clone then ftruncate stay synchronous so no event-loop turn lands log writes between the snapshot and the truncate."
+    },
+    {
+      "key": "lib/landing/config.js\tsync-api\tfs.readFileSync(\treturn fs.readFileSync(file, 'utf8');",
+      "justification": "WP-0 landing queue (§6.1): reads .ctm.json#landing and probes package.json/Makefile/etc. once per `land` CLI invocation for gate autodetect; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/config.js\tsync-api\tfs.realpathSync(\treturn fs.realpathSync(dir);",
+      "justification": "WP-0 landing queue (§6.1): reads .ctm.json#landing and probes package.json/Makefile/etc. once per `land` CLI invocation for gate autodetect; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/git.js\tsync-api\tfs.copyFileSync(\tfs.copyFileSync(realIndex, tmpIndex);",
+      "justification": "WP-0 landing queue (§5 D-3/D-11): synchronous --no-optional-locks git plumbing (merge-tree, commit-tree, update-ref CAS, ff-only) for the serial `land` CLI runner, where each step must complete before the next decision; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/git.js\tsync-api\tfs.realpathSync(\treturn fs.realpathSync(top);",
+      "justification": "WP-0 landing queue (§5 D-3/D-11): synchronous --no-optional-locks git plumbing (merge-tree, commit-tree, update-ref CAS, ff-only) for the serial `land` CLI runner, where each step must complete before the next decision; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/git.js\tsync-api\tfs.rmSync(\tfs.rmSync(file, { force: true });",
+      "justification": "WP-0 landing queue (§5 D-3/D-11): synchronous --no-optional-locks git plumbing (merge-tree, commit-tree, update-ref CAS, ff-only) for the serial `land` CLI runner, where each step must complete before the next decision; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/git.js\tsync-api\tspawnSync(\tconst res = spawnSync('git', ['--no-optional-locks', ...args], {",
+      "justification": "WP-0 landing queue (§5 D-3/D-11): synchronous --no-optional-locks git plumbing (merge-tree, commit-tree, update-ref CAS, ff-only) for the serial `land` CLI runner, where each step must complete before the next decision; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/lease.js\tsync-api\tfs.mkdirSync(\tfs.mkdirSync(staging, { recursive: true });",
+      "justification": "WP-0 landing queue (§5 D-2): the runner lease is the broker-ported mkdtemp+renameSync claim / tombstone-rename removal; atomic correctness depends on synchronous rename, and the module runs only inside the `land` CLI process, never on the CTM main thread."
+    },
+    {
+      "key": "lib/landing/lease.js\tsync-api\tfs.renameSync(\tfs.renameSync(dir, tombstone);",
+      "justification": "WP-0 landing queue (§5 D-2): the runner lease is the broker-ported mkdtemp+renameSync claim / tombstone-rename removal; atomic correctness depends on synchronous rename, and the module runs only inside the `land` CLI process, never on the CTM main thread."
+    },
+    {
+      "key": "lib/landing/lease.js\tsync-api\tfs.renameSync(\tfs.renameSync(tmp, dir);",
+      "justification": "WP-0 landing queue (§5 D-2): the runner lease is the broker-ported mkdtemp+renameSync claim / tombstone-rename removal; atomic correctness depends on synchronous rename, and the module runs only inside the `land` CLI process, never on the CTM main thread."
+    },
+    {
+      "key": "lib/landing/lease.js\tsync-api\tfs.rmSync(\tfs.rmSync(dir, { recursive: true, force: true });",
+      "justification": "WP-0 landing queue (§5 D-2): the runner lease is the broker-ported mkdtemp+renameSync claim / tombstone-rename removal; atomic correctness depends on synchronous rename, and the module runs only inside the `land` CLI process, never on the CTM main thread."
+    },
+    {
+      "key": "lib/landing/lease.js\tsync-api\tfs.rmSync(\tfs.rmSync(tombstone, { recursive: true, force: true });",
+      "justification": "WP-0 landing queue (§5 D-2): the runner lease is the broker-ported mkdtemp+renameSync claim / tombstone-rename removal; atomic correctness depends on synchronous rename, and the module runs only inside the `land` CLI process, never on the CTM main thread."
+    },
+    {
+      "key": "lib/landing/lease.js\tsync-api\tfs.writeFileSync(\tfs.writeFileSync(path.join(tmp, OWNER_FILENAME), `${JSON.stringify(record)}\\n`);",
+      "justification": "WP-0 landing queue (§5 D-2): the runner lease is the broker-ported mkdtemp+renameSync claim / tombstone-rename removal; atomic correctness depends on synchronous rename, and the module runs only inside the `land` CLI process, never on the CTM main thread."
+    },
+    {
+      "key": "lib/landing/lease.js\tsync-api\tspawnSync(\tconst res = spawnSync('ps', ['-o', 'command=', '-p', String(pid)], { encoding: 'utf8' });",
+      "justification": "WP-0 landing queue (§5 D-2): the runner lease is the broker-ported mkdtemp+renameSync claim / tombstone-rename removal; atomic correctness depends on synchronous rename, and the module runs only inside the `land` CLI process, never on the CTM main thread."
+    },
+    {
+      "key": "lib/landing/state.js\tsync-api\tfs.mkdirSync(\tfor (const name of SUBDIRS) fs.mkdirSync(path.join(root, name), { recursive: true });",
+      "justification": "WP-0 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-1/D-2, §6.3): lib/landing/ is the `land` CLI library; it runs in the land process (and, from WP-3, only in a CTM child spawned for `land run --once`), never on the CTM request path. State writes are tiny tmp+rename JSON files and a mkdir/rename mutex whose atomicity REQUIRES the synchronous rename syscall."
+    },
+    {
+      "key": "lib/landing/state.js\tsync-api\tfs.mkdirSync(\tfs.mkdirSync(path.dirname(file), { recursive: true });",
+      "justification": "WP-0 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-1/D-2, §6.3): lib/landing/ is the `land` CLI library; it runs in the land process (and, from WP-3, only in a CTM child spawned for `land run --once`), never on the CTM request path. State writes are tiny tmp+rename JSON files and a mkdir/rename mutex whose atomicity REQUIRES the synchronous rename syscall."
+    },
+    {
+      "key": "lib/landing/state.js\tsync-api\tfs.mkdirSync(\tfs.mkdirSync(root, { recursive: true });",
+      "justification": "WP-0 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-1/D-2, §6.3): lib/landing/ is the `land` CLI library; it runs in the land process (and, from WP-3, only in a CTM child spawned for `land run --once`), never on the CTM request path. State writes are tiny tmp+rename JSON files and a mkdir/rename mutex whose atomicity REQUIRES the synchronous rename syscall."
+    },
+    {
+      "key": "lib/landing/state.js\tsync-api\tfs.readFileSync(\traw = fs.readFileSync(file, 'utf8');",
+      "justification": "WP-0 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-1/D-2, §6.3): lib/landing/ is the `land` CLI library; it runs in the land process (and, from WP-3, only in a CTM child spawned for `land run --once`), never on the CTM request path. State writes are tiny tmp+rename JSON files and a mkdir/rename mutex whose atomicity REQUIRES the synchronous rename syscall."
+    },
+    {
+      "key": "lib/landing/state.js\tsync-api\tfs.renameSync(\tfs.renameSync(mutexDir, tombstone);",
+      "justification": "WP-0 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-1/D-2, §6.3): lib/landing/ is the `land` CLI library; it runs in the land process (and, from WP-3, only in a CTM child spawned for `land run --once`), never on the CTM request path. State writes are tiny tmp+rename JSON files and a mkdir/rename mutex whose atomicity REQUIRES the synchronous rename syscall."
+    },
+    {
+      "key": "lib/landing/state.js\tsync-api\tfs.renameSync(\tfs.renameSync(staging, mutexDir);",
+      "justification": "WP-0 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-1/D-2, §6.3): lib/landing/ is the `land` CLI library; it runs in the land process (and, from WP-3, only in a CTM child spawned for `land run --once`), never on the CTM request path. State writes are tiny tmp+rename JSON files and a mkdir/rename mutex whose atomicity REQUIRES the synchronous rename syscall."
+    },
+    {
+      "key": "lib/landing/state.js\tsync-api\tfs.renameSync(\tfs.renameSync(tmp, file);",
+      "justification": "WP-0 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-1/D-2, §6.3): lib/landing/ is the `land` CLI library; it runs in the land process (and, from WP-3, only in a CTM child spawned for `land run --once`), never on the CTM request path. State writes are tiny tmp+rename JSON files and a mkdir/rename mutex whose atomicity REQUIRES the synchronous rename syscall."
+    },
+    {
+      "key": "lib/landing/state.js\tsync-api\tfs.rmSync(\tfs.rmSync(dir, { recursive: true, force: true });",
+      "justification": "WP-0 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-1/D-2, §6.3): lib/landing/ is the `land` CLI library; it runs in the land process (and, from WP-3, only in a CTM child spawned for `land run --once`), never on the CTM request path. State writes are tiny tmp+rename JSON files and a mkdir/rename mutex whose atomicity REQUIRES the synchronous rename syscall."
+    },
+    {
+      "key": "lib/landing/state.js\tsync-api\tfs.rmSync(\tfs.rmSync(tmp, { force: true });",
+      "justification": "WP-0 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-1/D-2, §6.3): lib/landing/ is the `land` CLI library; it runs in the land process (and, from WP-3, only in a CTM child spawned for `land run --once`), never on the CTM request path. State writes are tiny tmp+rename JSON files and a mkdir/rename mutex whose atomicity REQUIRES the synchronous rename syscall."
+    },
+    {
+      "key": "lib/landing/state.js\tsync-api\tfs.rmSync(\tfs.rmSync(tombstone, { recursive: true, force: true });",
+      "justification": "WP-0 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-1/D-2, §6.3): lib/landing/ is the `land` CLI library; it runs in the land process (and, from WP-3, only in a CTM child spawned for `land run --once`), never on the CTM request path. State writes are tiny tmp+rename JSON files and a mkdir/rename mutex whose atomicity REQUIRES the synchronous rename syscall."
+    },
+    {
+      "key": "lib/landing/state.js\tsync-api\tfs.writeFileSync(\tfs.writeFileSync(tmp, `${JSON.stringify(payload, null, 2)}\\n`);",
+      "justification": "WP-0 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-1/D-2, §6.3): lib/landing/ is the `land` CLI library; it runs in the land process (and, from WP-3, only in a CTM child spawned for `land run --once`), never on the CTM request path. State writes are tiny tmp+rename JSON files and a mkdir/rename mutex whose atomicity REQUIRES the synchronous rename syscall."
+    },
+    {
+      "key": "lib/landing/state.js\tsync-api\trenameSync (\t// Atomic JSON write: `<file>.<pid>.<rand>.tmp` then renameSync (same-filesystem, so the rename",
+      "justification": "WP-0 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-1/D-2, §6.3): lib/landing/ is the `land` CLI library; it runs in the land process (and, from WP-3, only in a CTM child spawned for `land run --once`), never on the CTM request path. State writes are tiny tmp+rename JSON files and a mkdir/rename mutex whose atomicity REQUIRES the synchronous rename syscall."
+    },
+    {
+      "key": "lib/landing/state.js\tsync-api\trmSync(\t// the tombstone: rmSync(recursive) unlinks owner.json and rmdirs the path in two steps, which",
+      "justification": "WP-0 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-1/D-2, §6.3): lib/landing/ is the `land` CLI library; it runs in the land process (and, from WP-3, only in a CTM child spawned for `land run --once`), never on the CTM request path. State writes are tiny tmp+rename JSON files and a mkdir/rename mutex whose atomicity REQUIRES the synchronous rename syscall."
+    },
+    {
+      "key": "lib/landing/gate.js\tsync-api\tfs.mkdirSync(\tfs.mkdirSync(path.dirname(file), { recursive: true });",
+      "justification": "WP-1 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-4): the train gate bookkeeping (cache-path links, info/exclude, job log fd) inside the land runner process, a CLI child that is never on the CTM request path; each call touches a path the runner itself created."
+    },
+    {
+      "key": "lib/landing/gate.js\tsync-api\tfs.readFileSync(\texisting = fs.readFileSync(file, 'utf8');",
+      "justification": "WP-1 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-4): the train gate bookkeeping (cache-path links, info/exclude, job log fd) inside the land runner process, a CLI child that is never on the CTM request path; each call touches a path the runner itself created."
+    },
+    {
+      "key": "lib/landing/gate.js\tsync-api\tfs.appendFileSync(\tif (missing.length) fs.appendFileSync(file, `${existing && !existing.endsWith('\\n') ? '\\n' : ''}${missing.join('\\n')}\\n`);",
+      "justification": "WP-1 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-4): the train gate bookkeeping (cache-path links, info/exclude, job log fd) inside the land runner process, a CLI child that is never on the CTM request path; each call touches a path the runner itself created."
+    },
+    {
+      "key": "lib/landing/gate.js\tsync-api\tfs.mkdirSync(\tfs.mkdirSync(path.dirname(logFile), { recursive: true });",
+      "justification": "WP-1 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-4): the train gate bookkeeping (cache-path links, info/exclude, job log fd) inside the land runner process, a CLI child that is never on the CTM request path; each call touches a path the runner itself created."
+    },
+    {
+      "key": "lib/landing/gate.js\tsync-api\tfs.openSync(\tconst logFd = fs.openSync(logFile, 'a');",
+      "justification": "WP-1 landing queue (local-landing-queue-multi-session-integration-2026-10-26.html §5 D-4): the train gate bookkeeping (cache-path links, info/exclude, job log fd) inside the land runner process, a CLI child that is never on the CTM request path; each call touches a path the runner itself created."
+    },
+    {
+      "key": "lib/landing/queue.js\tsync-api\tfs.mkdirSync(\tfs.mkdirSync(logsDir(root), { recursive: true });",
+      "justification": "WP-1 landing queue (§5 D-2, §6.3): job/queue/metrics state of the land CLI, small JSON/JSONL files under $GIT_COMMON_DIR/landing written by the single runner or a submitter under the queue mutex; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/queue.js\tsync-api\tfs.readdirSync(\tnames = fs.readdirSync(jobsDir(root));",
+      "justification": "WP-1 landing queue (§5 D-2, §6.3): job/queue/metrics state of the land CLI, small JSON/JSONL files under $GIT_COMMON_DIR/landing written by the single runner or a submitter under the queue mutex; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/queue.js\tsync-api\tfs.mkdirSync(\tfs.mkdirSync(metricsDir(root), { recursive: true });",
+      "justification": "WP-1 landing queue (§5 D-2, §6.3): job/queue/metrics state of the land CLI, small JSON/JSONL files under $GIT_COMMON_DIR/landing written by the single runner or a submitter under the queue mutex; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/queue.js\tsync-api\tfs.appendFileSync(\tfs.appendFileSync(file, `${JSON.stringify({ contract: state.CONTRACT, ...entry })}\\n`);",
+      "justification": "WP-1 landing queue (§5 D-2, §6.3): job/queue/metrics state of the land CLI, small JSON/JSONL files under $GIT_COMMON_DIR/landing written by the single runner or a submitter under the queue mutex; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/queue.js\tsync-api\tfs.readdirSync(\tnames = fs.readdirSync(metricsDir(root));",
+      "justification": "WP-1 landing queue (§5 D-2, §6.3): job/queue/metrics state of the land CLI, small JSON/JSONL files under $GIT_COMMON_DIR/landing written by the single runner or a submitter under the queue mutex; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/queue.js\tsync-api\tfs.readFileSync(\traw = fs.readFileSync(path.join(metricsDir(root), name), 'utf8');",
+      "justification": "WP-1 landing queue (§5 D-2, §6.3): job/queue/metrics state of the land CLI, small JSON/JSONL files under $GIT_COMMON_DIR/landing written by the single runner or a submitter under the queue mutex; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/batch-runner.js\tsync-api\tfs.existsSync(\tif (fs.existsSync(trainDir)) train.removeTrainWorktree(workdir, trainDir);",
+      "justification": "landing pipeline WP-1 batched runner (moved out of bin/land.js): the land CLI's runner process, never the CTM request path — the same train-worktree cleanup and gate-log read runJobInner performs for a single job."
+    },
+    {
+      "key": "lib/landing/batch-runner.js\tsync-api\tfs.readFileSync(\tplanBase: finalBuilt.base, tree: finalBuilt.tree, logText: fs.readFileSync(result.logPath, 'utf8'),",
+      "justification": "landing pipeline WP-1 batched runner (moved out of bin/land.js): the land CLI's runner process, never the CTM request path — the same train-worktree cleanup and gate-log read runJobInner performs for a single job."
+    },
+    {
+      "key": "lib/landing/train.js\tprocess-launch\tspawn(\tchild = spawn('/bin/sh', ['-c', command], {",
+      "justification": "WP-1 landing queue (§5 D-3/D-5/D-8): the land runner train-worktree housekeeping and its async detached gate spawn (process-group kill on timeout); CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/train.js\tsync-api\tfs.lstatSync(\tfs.lstatSync(dir);",
+      "justification": "WP-1 landing queue (§5 D-3/D-5/D-8): the land runner train-worktree housekeeping and its async detached gate spawn (process-group kill on timeout); CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/train.js\tsync-api\tfs.rmSync(\tfs.rmSync(dir, { recursive: true, force: true });",
+      "justification": "WP-1 landing queue (§5 D-3/D-5/D-8): the land runner train-worktree housekeeping and its async detached gate spawn (process-group kill on timeout); CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/train.js\tsync-api\tfs.openSync(\tconst logFd = log ? fs.openSync(log, 'a') : null;",
+      "justification": "WP-1 landing queue (§5 D-3/D-5/D-8): the land runner train-worktree housekeeping and its async detached gate spawn (process-group kill on timeout); CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/train.js\tsync-api\tfs.appendFileSync(\tif (log) fs.appendFileSync(log, `[regenerate] committed ${train} (tree ${tree})\\n`);",
+      "justification": "WP-1 landing queue (§5 D-3/D-5/D-8): the land runner train-worktree housekeeping and its async detached gate spawn (process-group kill on timeout); CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/train.js\tsync-api\tfs.appendFileSync(\tif (log) fs.appendFileSync(log, `[refresh] no owned path changed (${entries.length} entry/entries); train ${built.train} unchanged\\n`);",
+      "justification": "WP-0 landing.refresh (landing-throughput design 2026-10-29 §5 D-2/D-3): the land runner appends the refresh pass outcome to the job log, exactly like the regenerate line above; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/train.js\tsync-api\tfs.appendFileSync(\tif (log) fs.appendFileSync(log, `[refresh] committed ${train} (tree ${tree})\\n`);",
+      "justification": "WP-0 landing.refresh (landing-throughput design 2026-10-29 §5 D-2/D-3): the land runner appends the refresh pass outcome to the job log, exactly like the regenerate line above; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/radar.js\tsync-api\tfs.readdirSync(\tnames = fs.readdirSync(claimsDir(cwd));",
+      "justification": "WP-2 landing queue (§5 D-7): the advisory conflict radar of the land CLI lists the soft-claim files under $GIT_COMMON_DIR/landing/claims once per sweep; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/api/landing.js\tprocess-launch\texecFile(\texecFile(process.execPath, [CLI_PATH, ...args], {",
+      "justification": "WP-3 landing queue (§6.3, D-1): the ASYNC land CLI child (execFile with callback, timeout and maxBuffer) and the detached unref(d) land run --once runner; neither blocks the event loop, and the CLI is deliberately a separate process so the synchronous lib/landing code never runs in the CTM server."
+    },
+    {
+      "key": "lib/api/landing.js\tprocess-launch\tspawn(\tconst child = spawn(process.execPath, [CLI_PATH, 'run', '--once'], {",
+      "justification": "WP-3 landing queue (§6.3, D-1): the ASYNC land CLI child (execFile with callback, timeout and maxBuffer) and the detached unref(d) land run --once runner; neither blocks the event loop, and the CLI is deliberately a separate process so the synchronous lib/landing code never runs in the CTM server."
+    },
+    {
+      "key": "lib/agent-presets.js\tsync-api\tfs.readFileSync(\tconst parsed = JSON.parse(fs.readFileSync(path.join(configDir, 'settings.json'), 'utf8'));",
+      "justification": "Restore-seed alt-screen trap WP-2 (R-4): one synchronous read of the user's small Claude settings.json per Claude launch, inside the already-synchronous spawn-env assembly (resolveCreateLaunchParams / resume spawn); the file is a few KB, read once per process spawn, never on a request hot path or per frame."
+    },
+    {
+      "key": "lib/background-stop.js\tprocess-launch\texecFile(\texecFile(binary, PS_STOP_ARGS, { timeout: PS_TIMEOUT_MS, maxBuffer: PS_MAX_BUFFER }, (error, out) => {",
+      "justification": "Background-task termination WP-3a (§6.4/§6.5): the operator's Stop click re-reads the process table with one async `ps -axo pid=,ppid=,pgid=,lstart=,command=` -- at most four reads per explicit stop of one declared background shell (two identity reads, one after the TERM grace, one after KILL), never on a timer or per request. Async callback form because the hermetic preload's execFile wrapper drops util.promisify.custom, so promisify(execFile) would resolve with bare stdout (same hazard as lib/harness-model-profile.js)."
+    },
+    {
+      "key": "lib/fleet-update.js\tprocess-launch\texecFile(\texecFile('git', args, { cwd, timeout }, (error, stdout) => {",
+      "justification": "Fleet auto-update version truth + box-side bundle ingress (docs/fleet-auto-update-pooled-machines-2026-10-26.html S-4/S-6): ONE async execFile('git', argv array, explicit timeout - 5 s for the status reads, 60 s for `bundle verify`/`fetch`); readHubTarget memoizes per repo for 15 s, readFleetStatus serves one peer GET, acceptFleetBundle runs at most four git calls per pushed bundle. Never synchronous, never a shell string, and every failure is handled as an empty/unknown field or a 400/409 refusal."
+    },
+    {
+      "key": "lib/fleet-update.js\tprocess-launch\texecFile(\texecFile('systemd-run', systemdRunArgv(to, { repoRoot, dataDir, port, logPath }),",
+      "justification": "Fleet auto-update WP-1 fix 3 (docs/fleet-auto-update-pooled-machines-2026-10-26.html S-6, measured on the DGX Spark 2026-10-27): on a systemd HOST ONLY (platform === 'linux' && INVOCATION_ID, i.e. we ARE ctm.service), the helper is launched with `systemd-run --user --collect --quiet`, so it lands in its own transient unit instead of ctm.service's cgroup - KillMode=control-group would otherwise reap it when the exit-42 restart stops the unit, stranding the box in `restarting` with no confirm and no rollback. One argv array, no shell, 10 s launcher timeout, at most once per accepted bundle; a non-zero exit falls back to the detached child (below). Never runs on macOS."
+    },
+    {
+      "key": "lib/fleet-update.js\tprocess-launch\tspawn(\tconst child = spawn(process.execPath, [path.join(repoRoot, 'bin', 'fleet-apply.js'), to], {",
+      "justification": "Fleet auto-update WP-1 (docs/fleet-auto-update-pooled-machines-2026-10-26.html S-6/D-4): the box-side bundle route's DEFAULT helper launcher - one detached `node bin/fleet-apply.js <to>` per accepted bundle, stdio on <dataDir>/fleet/apply-<to12>.log, unref'd immediately so the apply survives the CTM restart it triggers. This is the only way the box applies (the hub runs no command on it); the spawn happens at most once per accepted bundle, and acceptFleetBundle's tests inject spawnHelper instead."
+    },
+    {
+      "key": "lib/fleet-hub.js\tprocess-launch\texecFile(\texecFile('git', args, { cwd, timeout }, (error, stdout) => {",
+      "justification": "Fleet auto-update WP-2 hub reconciler (docs/fleet-auto-update-pooled-machines-2026-10-26.html §8 WP-2, §9 S-8): ONE async execFile('git', argv array, explicit 5 s timeout) for the `git merge-base --is-ancestor <boxHead> <target>` ancestry probe - at most once per behind box per sweep (the pool is two boxes today, and only a box whose head is a full sha and differs from the target is probed), never synchronous, never a shell string, and a non-zero exit (1 = not an ancestor, 128 = unknown sha) is a handled `diverged`, not a throw."
+    },
+    {
+      "key": "lib/fleet-hub.js\tprocess-launch\tspawn(\tchild = spawn('git', ['-C', repoRoot, 'bundle', 'create', '-', `${from}..main`], { stdio: ['ignore', 'pipe', 'pipe'] });",
+      "justification": "Fleet auto-update WP-2 hub reconciler (docs/fleet-auto-update-pooled-machines-2026-10-26.html §8 WP-2 D-3): the hub's bundle build `git bundle create - <from>..main`, one argv array, no shell, run at most once per sending pass (at most one box in flight across the pool, D-7). stdout is capped at FLEET_BUNDLE_MAX_BYTES - past the cap the child is SIGKILLed and the promise rejects with code `too_large` - and a non-zero exit rejects with the stderr tail, which the reconciler records as a refusal instead of throwing into the sweep."
+    },
+    {
+      "key": "lib/api/setup.js\tprocess-launch\tspawn(\tproc = spawn(_deps.resolveAgentCliCommand('claude'), ['auth', 'status'], {",
+      "justification": "WP-5 shard S2 (landing-throughput design 2026-10-29 §5 D-10): relocated VERBATIM from server.js into lib/api/setup.js / setup-network.js -- the same pre-existing setup-flow site (key probe, CLI login status, env-file read) behind _deps.; not a new main-thread site."
+    },
+    {
+      "key": "lib/api/setup.js\tprocess-launch\tspawn(\tproc = spawn(_deps.resolveAgentCliCommand('codex'), ['login', 'status'], { stdio: ['ignore', 'pipe', 'pipe'], timeout: 10000, env: childEnv });",
+      "justification": "WP-5 shard S2 (landing-throughput design 2026-10-29 §5 D-10): relocated VERBATIM from server.js into lib/api/setup.js / setup-network.js -- the same pre-existing setup-flow site (key probe, CLI login status, env-file read) behind _deps.; not a new main-thread site."
+    },
+    {
+      "key": "lib/api/setup.js\tsync-api\tfs.readFileSync(\tconst auth = JSON.parse(_deps.fs.readFileSync(_deps.codexPaths.codexAuthPath(), 'utf8'));",
+      "justification": "WP-5 shard S2 (landing-throughput design 2026-10-29 §5 D-10): relocated VERBATIM from server.js into lib/api/setup.js / setup-network.js -- the same pre-existing setup-flow site (key probe, CLI login status, env-file read) behind _deps.; not a new main-thread site."
+    },
+    {
+      "key": "lib/api/setup.js\tsync-api\tspawnSync(\tconst proc = require('child_process').spawnSync(_deps.resolveAgentCliCommand('codex'), ['login', 'status'], { encoding: 'utf8', timeout: 8000 });",
+      "justification": "WP-5 shard S2 (landing-throughput design 2026-10-29 §5 D-10): relocated VERBATIM from server.js into lib/api/setup.js / setup-network.js -- the same pre-existing setup-flow site (key probe, CLI login status, env-file read) behind _deps.; not a new main-thread site."
+    },
+    {
+      "key": "lib/api/setup.js\tsync-api\treadFileSync(\tconst auth = JSON.parse(require('fs').readFileSync(_deps.codexPaths.codexAuthPath(), 'utf8'));",
+      "justification": "WP-5 shard S2 (landing-throughput design 2026-10-29 §5 D-10): relocated VERBATIM from server.js into lib/api/setup.js / setup-network.js -- the same pre-existing setup-flow site (key probe, CLI login status, env-file read) behind _deps.; not a new main-thread site."
+    },
+    {
+      "key": "lib/api/setup.js\tsync-api\tfs.readFileSync(\tconst headers = _deps.fs.readFileSync(authFile, 'utf8').trim();",
+      "justification": "WP-5 shard S2 (landing-throughput design 2026-10-29 §5 D-10): relocated VERBATIM from server.js into lib/api/setup.js / setup-network.js -- the same pre-existing setup-flow site (key probe, CLI login status, env-file read) behind _deps.; not a new main-thread site."
+    },
+    {
+      "key": "lib/api/setup.js\tsync-api\tfs.readFileSync(\tconst claudeScript = _deps.fs.readFileSync(_deps.path.join(_deps.serverConfig.HOME, '.devbox', 'ai', 'claude', 'claude'), 'utf8');",
+      "justification": "WP-5 shard S2 (landing-throughput design 2026-10-29 §5 D-10): relocated VERBATIM from server.js into lib/api/setup.js / setup-network.js -- the same pre-existing setup-flow site (key probe, CLI login status, env-file read) behind _deps.; not a new main-thread site."
+    },
+    {
+      "key": "lib/api/setup.js\tsync-api\texecFileSync(\tconst credJson = _deps.execFileSync('security', ['find-generic-password', '-s', 'Claude Code-credentials', '-w'], { encoding: 'utf8', timeout: 3000 }).trim();",
+      "justification": "WP-5 shard S2 (landing-throughput design 2026-10-29 §5 D-10): relocated VERBATIM from server.js into lib/api/setup.js / setup-network.js -- the same pre-existing setup-flow site (key probe, CLI login status, env-file read) behind _deps.; not a new main-thread site."
+    },
+    {
+      "key": "lib/api/setup.js\tsync-api\tfs.readFileSync(\tconst existing = _deps.fs.readFileSync(envPath, 'utf8');",
+      "justification": "WP-5 shard S2 (landing-throughput design 2026-10-29 §5 D-10): relocated VERBATIM from server.js into lib/api/setup.js / setup-network.js -- the same pre-existing setup-flow site (key probe, CLI login status, env-file read) behind _deps.; not a new main-thread site."
+    },
+    {
+      "key": "lib/landing/train.js\tsync-api\tfs.statSync(\tstat = fs.statSync(source);",
+      "justification": "WP-2 landing triage (landing-throughput design 2026-10-29 §5 D-6/D-7): the land runner reruns the failed files on the base commit in a second train worktree and appends the launcher output to the job log; CLI-only, never on the CTM request path (same class as the regenerate/refresh rows above)."
+    },
+    {
+      "key": "lib/landing/train.js\tsync-api\tfs.mkdirSync(\tfs.mkdirSync(path.dirname(link), { recursive: true });",
+      "justification": "WP-2 landing triage (landing-throughput design 2026-10-29 §5 D-6/D-7): the land runner reruns the failed files on the base commit in a second train worktree and appends the launcher output to the job log; CLI-only, never on the CTM request path (same class as the regenerate/refresh rows above)."
+    },
+    {
+      "key": "lib/landing/train.js\tsync-api\tfs.mkdirSync(\tfs.mkdirSync(path.dirname(logFile), { recursive: true });",
+      "justification": "WP-2 landing triage (landing-throughput design 2026-10-29 §5 D-6/D-7): the land runner reruns the failed files on the base commit in a second train worktree and appends the launcher output to the job log; CLI-only, never on the CTM request path (same class as the regenerate/refresh rows above)."
+    },
+    {
+      "key": "lib/landing/train.js\tsync-api\tfs.appendFileSync(\tfs.appendFileSync(logFile, `\\n[triage] rerun on base ${String(base).slice(0, 12)}\\n`);",
+      "justification": "WP-2 landing triage (landing-throughput design 2026-10-29 §5 D-6/D-7): the land runner reruns the failed files on the base commit in a second train worktree and appends the launcher output to the job log; CLI-only, never on the CTM request path (same class as the regenerate/refresh rows above)."
+    },
+    {
+      "key": "lib/landing/train.js\tsync-api\tfs.existsSync(\tif (!fs.existsSync(path.join(dir, file))) continue; // added by the branch: base cannot be broken by it",
+      "justification": "WP-2 landing triage (landing-throughput design 2026-10-29 §5 D-6/D-7): the land runner reruns the failed files on the base commit in a second train worktree and appends the launcher output to the job log; CLI-only, never on the CTM request path (same class as the regenerate/refresh rows above)."
+    },
+    {
+      "key": "lib/landing/train.js\tsync-api\tfs.appendFileSync(\tfs.appendFileSync(logFile, `$ (cd ${group.launcher.dir || '.'} && ${command})\\n`);",
+      "justification": "WP-2 landing triage (landing-throughput design 2026-10-29 §5 D-6/D-7): the land runner reruns the failed files on the base commit in a second train worktree and appends the launcher output to the job log; CLI-only, never on the CTM request path (same class as the regenerate/refresh rows above)."
+    },
+    {
+      "key": "lib/landing/train.js\tsync-api\tfs.openSync(\tconst outFd = fs.openSync(outFile, 'a');",
+      "justification": "WP-2 landing triage (landing-throughput design 2026-10-29 §5 D-6/D-7): the land runner reruns the failed files on the base commit in a second train worktree and appends the launcher output to the job log; CLI-only, never on the CTM request path (same class as the regenerate/refresh rows above)."
+    },
+    {
+      "key": "lib/landing/train.js\tsync-api\tfs.readFileSync(\tconst output = fs.readFileSync(outFile, 'utf8');",
+      "justification": "WP-2 landing triage (landing-throughput design 2026-10-29 §5 D-6/D-7): the land runner reruns the failed files on the base commit in a second train worktree and appends the launcher output to the job log; CLI-only, never on the CTM request path (same class as the regenerate/refresh rows above)."
+    },
+    {
+      "key": "lib/landing/train.js\tsync-api\tfs.appendFileSync(\tfs.appendFileSync(logFile, output);",
+      "justification": "WP-2 landing triage (landing-throughput design 2026-10-29 §5 D-6/D-7): the land runner reruns the failed files on the base commit in a second train worktree and appends the launcher output to the job log; CLI-only, never on the CTM request path (same class as the regenerate/refresh rows above)."
+    },
+    {
+      "key": "lib/landing/train.js\tsync-api\tfs.rmSync(\tfs.rmSync(scratch, { recursive: true, force: true });",
+      "justification": "WP-2 landing triage (landing-throughput design 2026-10-29 §5 D-6/D-7): the land runner reruns the failed files on the base commit in a second train worktree and appends the launcher output to the job log; CLI-only, never on the CTM request path (same class as the regenerate/refresh rows above)."
+    },
+    {
+      "key": "lib/landing/gate.js\tsync-api\tfs.rmSync(\tfs.rmSync(selectionFile, { force: true });",
+      "justification": "WP-0 landing gate-once telemetry (landing-queue-gate-once-merge-delta-2026-10-29.html §5 D-8): clears this job's previous-round --selection-out record before a retrained gate, inside the land runner process, a CLI child that is never on the CTM request path; the path is one the runner itself owns."
+    },
+    {
+      "key": "lib/landing/merge-delta.js\tprocess-launch\tspawn(\tchild = spawn(process.execPath, plannerArgs(trainDir, base), {",
+      "justification": "WP-3a merge-delta shadow (docs/landing-queue-gate-once-merge-delta-2026-10-29.html §5 D-3, §6.5, §8 WP-3a): the ASYNC planner spawn — at most two `node <trainDir>/bin/test-plan.js --json` children per merge train, one argv array, no shell, stdout piped and capped by the 5-minute PLANNER_TIMEOUT_MS kill — and it never blocks the runner's event loop (the lease heartbeat is an interval). CLI-only (the land runner), never on the CTM request path, and unit tests inject `planner` so no child is spawned in the tests/ tier."
+    },
+    {
+      "key": "lib/landing/merge-delta.js\tsync-api\tfs.readFileSync(\treturn fs.readFileSync(file, 'utf8');",
+      "justification": "WP-3a merge-delta shadow (§8 WP-3a): ONE synchronous read of the current job's own gate log, in the runner process immediately after that gate returned, to list the failing test files the runners printed (`[test-suite] FAILED (N file(s)):` blocks) and compare them against S. One bounded read per terminal FAIL of a merge train; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/proof.js\tsync-api\tfs.readdirSync(\treturn fs.readdirSync(path.join(root, 'verdicts')).sort();",
+      "justification": "WP-3a treeHasProof (§5 D-3(a), §6.3): the `verdicts/` listing needed to answer \"has this tree ever passed a gate under this gates hash\" for the merge base. One readdir of a small directory (the number of proofs recorded for one repository) per merge train, sorted for a deterministic reader; CLI-only, never on the CTM request path."
+    },
+    {
+      "key": "lib/host-fseventsd-sampler.js\tprocess-launch\texecFile(\treturned = execFile(file, args, options, callback);",
+      "justification": "fsevents-churn-followups-r2 WP-2 (D-4/D-6): the host fseventsd sampler's single child-launch helper. It only calls the ASYNC child_process.execFile (pgrep, top ~2.5 s, and at most one 30 s fs-event-census per 6 h) with an explicit timeout, awaited inside tick(), which runs from one unref'd 30 min interval plus one unref'd 60 s post-boot tick in the primary only (never on a dev instance, never in a request handler)."
+    },
+    {
+      "key": "lib/hub-bridge-access.js\tsync-api\tfs.statSync(\tstat = fs.statSync(file);",
+      "justification": "Hub bridge WP-2 (docs/remote-session-hub-bridge-2026-10-30.html R-11): the per-machine trust policy is read when each gated hub-bridge op is decided (decide() is synchronous on the op's request path). The file is the tiny getDataDir()/hub-bridge-trust.json ({v,default,machines}); the read runs only when statSync's mtime/size differ from the cached copy, so the steady state is one stat per gated op, at most 4 in flight per machine (R-8). Writes, the audit append and the audit tail are async (fs.promises)."
+    },
+    {
+      "key": "lib/hub-bridge-access.js\tsync-api\tfs.readFileSync(\ttext = fs.readFileSync(file, 'utf8');",
+      "justification": "Hub bridge WP-2 (docs/remote-session-hub-bridge-2026-10-30.html R-11): the per-machine trust policy is read when each gated hub-bridge op is decided (decide() is synchronous on the op's request path). The file is the tiny getDataDir()/hub-bridge-trust.json ({v,default,machines}); the read runs only when statSync's mtime/size differ from the cached copy, so the steady state is one stat per gated op, at most 4 in flight per machine (R-8). Writes, the audit append and the audit tail are async (fs.promises)."
+    },
+    {
+      "key": "lib/fleet-update.js\tprocess-launch\texecFile(\texecFile('systemd-run', systemdRunArgv(to, { repoRoot, dataDir, port, logPath, local: true }),",
+      "justification": "Fleet origin-main sync WP-2b (docs/fleet-origin-main-sync-skill-2026-10-31.html §8): the LOCAL launch shape on a systemd host, a transient unit for `bin/fleet-apply.js --local <sha>` started only by scheduleLocalApply after its four guards (CTM_DATA_DIR+CTM_PORT set, non-dev CTM_INSTANCE_TAG, synced repo realpath == the repo that ships this file, /readyz build.sha not already current). Separate from the bundle-mode row because this lint keys on the whole line. Covered by tests/landing-sync-push-sites.test.js."
+    },
+    {
+      "key": "lib/fleet-update.js\tprocess-launch\tspawn(\tconst child = spawn(process.execPath, [path.join(repoRoot, 'bin', 'fleet-apply.js'), '--local', to], {",
+      "justification": "Fleet origin-main sync WP-2b (docs/fleet-origin-main-sync-skill-2026-10-31.html §8): the non-systemd LOCAL launch: one detached, unref'd `bin/fleet-apply.js --local <sha>` per `land sync` that moved this box's own main, stdio on <dataDir>/fleet/apply-<to12>.log; reached only through scheduleLocalApply's four guards, so a scratch or foreign repo never restarts a CTM (tests/landing-sync-push-sites.test.js, tests-integration/landing-sync.test.js)."
+    },
+    {
+      "key": "lib/landing/sync-cli.js\tsync-api\tfs.existsSync(\tif (fs.existsSync(ctx.root)) {",
+      "justification": "Fleet origin-main sync WP-0/WP-1 (docs/fleet-origin-main-sync-skill-2026-10-31.html §7): one existence check inside `land doctor`'s state-dir probe, in the `land` CLI process only (never the CTM request path); moved verbatim from bin/land.js (unscanned) when the sync/doctor CLI half moved to this module."
+    },
+    {
+      "key": "lib/systemd-scope.js\tsync-api\treadFileSync(\tconst mine = _cgroupLine(readFileSync('/proc/self/cgroup', 'utf8'));",
+      "justification": "Session-host cgroup survival WP-2 (docs/session-host-cgroup-survival-and-durable-jobs-2026-10-31.html D-5): pidSurvivesServiceStop reads /proc/self/cgroup and /proc/<hostPid>/cgroup (procfs, kernel-generated, a few dozen bytes, never disk I/O) inside the synchronous restart-guard snapshot. Only on a systemd service host; one pair per hosted session per guard snapshot (update-gate polls / restart requests), never on a terminal I/O path. Must be synchronous because summarizeRestartGuard is."
+    },
+    {
+      "key": "lib/systemd-scope.js\tsync-api\treadFileSync(\tconst theirs = _cgroupLine(readFileSync(`/proc/${n}/cgroup`, 'utf8'));",
+      "justification": "Session-host cgroup survival WP-2 (docs/session-host-cgroup-survival-and-durable-jobs-2026-10-31.html D-5): pidSurvivesServiceStop reads /proc/self/cgroup and /proc/<hostPid>/cgroup (procfs, kernel-generated, a few dozen bytes, never disk I/O) inside the synchronous restart-guard snapshot. Only on a systemd service host; one pair per hosted session per guard snapshot (update-gate polls / restart requests), never on a terminal I/O path. Must be synchronous because summarizeRestartGuard is."
+    },
+    {
+      "key": "lib/landing/gate.js\tsync-api\tfs.openSync(\tfd = fs.openSync(full, 'r');",
+      "justification": "Join follow-ups WP-2 (wall-e/docs/shared-memory-join-followups-2026-10-31.html R-8): reads at most DIRT_HEAD_BYTES (160) of one stray .merge_file_* after a gate already failed gate_dirtied_tree, so the next occurrence names the ledger git was merging. One bounded open/read/close per such path, in the land runner process (a CLI child), never on the CTM request path."
+    },
+    {
+      "key": "lib/landing/gate.js\tsync-api\tfs.lstatSync(\tstat = fs.lstatSync(path.join(dir, relPath));",
+      "justification": "Join follow-ups WP-2 (wall-e/docs/shared-memory-join-followups-2026-10-31.html R-8): one lstat per path git status already reported dirty (at most DIRT_EVIDENCE_MAX_PATHS = 20) to record kind/size/mtime/birthtime in the job log after a failed gate, in the land runner process (a CLI child), never on the CTM request path."
+    },
+    {
+      "key": "lib/agent-hooks-shim.js\tsync-api\tfs.readFileSync(\ttry { return fs.readFileSync(target, 'utf8'); }",
+      "justification": "codex-hook-stable-shim-trust-safe-self-repair-2026-11-01 WP-0: the per-port Codex hook shim (~/.walle/bin/ctm-hook-<port>, a few hundred bytes) is read/written once per explicit codex install/uninstall POST or once at the primary boot refresh, synchronously alongside the already-ledgered applyPlan() config write it must precede (a user-triggered / once-per-boot action, not a hot loop)."
+    },
+    {
+      "key": "lib/agent-hooks-shim.js\tsync-api\tfs.mkdirSync(\tfs.mkdirSync(path.dirname(target), { recursive: true });",
+      "justification": "codex-hook-stable-shim-trust-safe-self-repair-2026-11-01 WP-0: the per-port Codex hook shim (~/.walle/bin/ctm-hook-<port>, a few hundred bytes) is read/written once per explicit codex install/uninstall POST or once at the primary boot refresh, synchronously alongside the already-ledgered applyPlan() config write it must precede (a user-triggered / once-per-boot action, not a hot loop)."
+    },
+    {
+      "key": "lib/agent-hooks-shim.js\tsync-api\tfs.writeFileSync(\tfs.writeFileSync(tmpPath, body, { mode: 0o755 });",
+      "justification": "codex-hook-stable-shim-trust-safe-self-repair-2026-11-01 WP-0: the per-port Codex hook shim (~/.walle/bin/ctm-hook-<port>, a few hundred bytes) is read/written once per explicit codex install/uninstall POST or once at the primary boot refresh, synchronously alongside the already-ledgered applyPlan() config write it must precede (a user-triggered / once-per-boot action, not a hot loop)."
+    },
+    {
+      "key": "lib/agent-hooks-shim.js\tsync-api\tfs.renameSync(\tfs.renameSync(tmpPath, target);",
+      "justification": "codex-hook-stable-shim-trust-safe-self-repair-2026-11-01 WP-0: the per-port Codex hook shim (~/.walle/bin/ctm-hook-<port>, a few hundred bytes) is read/written once per explicit codex install/uninstall POST or once at the primary boot refresh, synchronously alongside the already-ledgered applyPlan() config write it must precede (a user-triggered / once-per-boot action, not a hot loop)."
+    },
+    {
+      "key": "lib/agent-hooks-shim.js\tsync-api\tfs.unlinkSync(\ttry { fs.unlinkSync(tmpPath); } catch { /* expected: tmp file may already be gone */ }",
+      "justification": "codex-hook-stable-shim-trust-safe-self-repair-2026-11-01 WP-0: the per-port Codex hook shim (~/.walle/bin/ctm-hook-<port>, a few hundred bytes) is read/written once per explicit codex install/uninstall POST or once at the primary boot refresh, synchronously alongside the already-ledgered applyPlan() config write it must precede (a user-triggered / once-per-boot action, not a hot loop)."
+    },
+    {
+      "key": "lib/agent-hooks-shim.js\tsync-api\tfs.unlinkSync(\ttry { fs.unlinkSync(hookShimPath(port, { homeDir })); return true; }",
+      "justification": "codex-hook-stable-shim-trust-safe-self-repair-2026-11-01 WP-0: the per-port Codex hook shim (~/.walle/bin/ctm-hook-<port>, a few hundred bytes) is read/written once per explicit codex install/uninstall POST or once at the primary boot refresh, synchronously alongside the already-ledgered applyPlan() config write it must precede (a user-triggered / once-per-boot action, not a hot loop)."
+    },
+    {
+      "key": "lib/fleet-origin-follower.js\tprocess-launch\tspawn(\tchild = spawn(process.execPath, [landScriptPath(repoRoot), ...landArgv({ pullOnly })], {",
+      "justification": "Fleet origin-main sync WP-3 (docs/fleet-origin-main-sync-skill-2026-10-31.html §5 R-8, §6.5): the CTM origin follower's one process launch — this repo's coding-task-manager/bin/land.js `sync --pull-only --json` under process.execPath, cwd repoRoot, no shell, 120 s timeout, at most once per publish.followIntervalMs (15 min) from an unref'd interval, skipped while a previous tick runs, never on a dev- tag, without landing.publish, or off main. Not on a request path."
     }
   ]
 }