ADR 0391: Landings compose a moved trunk in an integration worktree

Status: accepted on 2026-09-12. Implements the addition ADR 0389 deferred ("landing a moved trunk through an integration worktree is a separate decision") under its second workspace allowance. Amends ADR 0375 (the declared composition procedure now exists: merge-trunk in a discern-created worktree), ADR 0366 (the recorded transaction's ownership now covers the integration copy and the exact submission), and ADR 0194 (a second acceptance queues at the boundary instead of refusing). Uses the format latitude of ADR 0390.

Under ADR 0389 a trunk that moved after a submission's Proof made accept refuse with the update route, so every landing a parallel effort fell behind cost its agent an update, another done, and another accept — a retry loop discern itself could run. The workspace contract already named the shape that removes it: a disposable integration worktree discern creates for one landing and removes when it ends, the one composition allowed to hold another revision. What remained were the decisions that make that shape exact: what the candidate proves when the tested commit is no longer the author's tip, where cleanup intent lives so a killed check cannot strand an anonymous checkout, how landings serialize without deadlocking against their own composed update and done cores, and what one call reports when it lands several submissions.

When the shared branch has moved since a submission's Proof, accept composes and checks the combined code in an integration worktree it owns, and lands the proven result under the existing acceptance transaction. The submitted revision and its evidence are frozen first and never replaced by the author's later branch tip. The copy is created from the submitted revision through the same creation core start uses — [worktree] setup and resources included — on an integration/<effort>-<suffix> branch beside the authoring prefix. The update core brings the trunk in and regenerates; the done core proves the combined committed tree; authority is rechecked over the exact composed diff; then the trunk advances to that exact proven commit by the recorded compare-and-swap. The direct fast-forward runs exactly when the submitted revision already contains the current tip — its Proof proved that exact tree, so containment needs no re-verification; ancestry decides, never queue length or predecessor equality.

The candidate records composition inputs, not a second author. Its sources list (one entry today) is the canonical input; the predecessor trunk and the tested resulting commit and tree are separate facts; an explicit integration: merge-trunk marker distinguishes an integrated result, and an unmarked candidate keeps the source-tip invariant. Readers reach the author through the list, so the integration copy is never described as the author. The completion-record format stays at version 1: the store's reader migrates a stored singular-source candidate to the list shape in memory only.

Ownership and the exact input identity are recorded, never parsed from names. An integration-landing record in common Git administration persists the owner process, the frozen submission snapshot, and the copy's identity — intent before any setup effect, ready after setup, removed after the copy. Status, the queue, the fleet, and discern worktree prune read this one record: a live owner's copy is never pruned; a dead owner's is reclaimed with its resources, branch, and record. The acceptance journal (still version 1) gains optional fields — the submission id, the Proof pointer, the integration block — so a retry completes Proof recording, consumes exactly the recorded submission, cleans up the recorded copy, and never lands twice; submission consumption is compare-and-clear everywhere, so a replacement submission survives settling an older snapshot.

Landings serialize on a dedicated acceptance boundary; a second accept waits there. Landings queue on their own boundary — never on the short common publication boundary — so a long combined check starves no sibling completion, and the author checkout is acquired non-blockingly so a running done there refuses the landing instead of deadlocking against its own publication. accept (alone) queues behind the holder, reports whose landing it waits behind with the running handle, and resumes on its own; after acquiring the boundary it re-reads its frozen submission's settled state and returns a predecessor's landing as the verified outcome instead of repeating anything. The common boundary joins only for the transition core — the authority recheck, consent resolution, and the compare-and-swap with its journal and claim — bounded exactly like a completion publication; Proof-note recording, convergence, and every cleanup, including external resource teardown, run outside it under the acceptance boundary alone. The integration worktree's checkout lease is taken once under the held acceptance boundary, so the composed cores reuse held leases instead of deadlocking, and the integration gate takes an ordinary [gate].concurrent_test_runs slot.

An explicit selection walks the queue. With --target (the desk's Land shares the path), the selected submission lands first; the remaining submissions follow the queue's one canonical ordering, each needing its own honored Proof and a verified effort grant or standing scope — conversation consent covers only the selected landing — and the walk stops at the first refusal or failure. Every apply result carries the canonical data.landings collection with the selected member marked; data.landing stays the selected landing's projection; and a call whose walk stopped is false under the completion policy while its message and preserved effects state exactly what landed.

The explicit nos:

• No new configuration and no parallel scheduling. One composition at a time, one bounded repeat composition when the trunk moves during the checks, then an explicit retry route. Batching, speculation, worktree reuse, preview environments, daemons, and capacity settings stay later decisions; the contracts merely leave optional room for them.
• No decision is invented in the copy. The author's recorded checkpoint conclusions and standard-limit proposals travel with their evidence and are checked again by their own currency rules on the combined tree; a newly fired question or stale conclusion stops the landing with the author route, and recorded grants still never cover variances or standard proposals.
• No installation into any authoring checkout. Conflicts and red combined checks clean the copy up and return to the author with the trunk and the author's checkout untouched; author work that arrives during checking is excluded and preserved.

• An effort overtaken by the trunk lands through one accept; the owner can pre-authorize a task, go to sleep, and find it landed behind later work, while a dependent await --landed returns on its own.
• Trunk history now carries composed commits: the landed object can differ from the submitted tip, with the Proof note naming the author's branch and the complete evidence naming both the sources and the tested result.
• Every landing pays the combined check when the trunk moved; the queue reduces retries, not gate cost. Serial landings mean a long check delays the queue behind it — visible through the running handle on the row being checked.
• A crash at any point leaves recorded state something can finish: the journal for the transaction, the integration record for the copy, worktree prune for a dead owner's remains.
• The public queue-row and accept contracts gained only optional fields; the closed vocabularies kept their members and meanings, so pinned additive readers keep reading.

• Compose in the author's worktree. Rejected in ADR 0389 and still: it installs a revision the agent did not author into the checkout the agent is working in.
• Land the submitted tip and let the next gate catch breakage. Rejected: the trunk would carry combined states no gate proved, severing Proof from what actually lands.
• Refuse when the author's branch moved on during checking. Rejected: the submission is exact by construction, so later author work changes nothing about what was reviewed; excluding and preserving it keeps both truths.
• A fourth guard allowance for integration mutations. Rejected: the workspace contract's second allowance already covers worktrees discern creates; the registered rows name the integration case in their reasons instead of widening the vocabulary.