You are running ON debian1, a buildbox, deliberately — the owner's laptop is saturated and this work must NOT run there. Keep all compute on this box.

TASK: fix the land authority-file race that is currently failing every land in the overdeck repo.

Repo mirror on this box: /home/user/builds/overdeck-f7f63179e1c7 (git). Fetch origin first; work on a branch.

THE BUG (root-caused on the laptop, evidence below — do not re-derive it, verify and fix it):
- File: modules/workstation/claude/workflows/lib/finish-branch.sh, around lines 786-815.
- It generates a nonce, writes it to the SINGLE shared path "$common_dir/harness/land-authority", then runs: HARNESS_LAND_TOKEN=$nonce git push origin "$candidate_ref:refs/heads/main".
- The pre-push hook (repo core.hooksPath -> .git/harness/hooks/pre-push, lines 28-40) compares HARNESS_LAND_TOKEN against the contents of that file.
- With concurrent landers, lander B does `rm -f authority` + writes ITS nonce in the window between lander A's write and A's push. A's hook then reads B's nonce, mismatches, and rejects with "pre-push: rejected — unauthorized main update".
- The lander records this as {"status":"push-failed","detail":"plain candidate push to origin main failed"}, which reads like a remote problem and is actually local mutual exclusion failing.
- PROOF collected: auth is fine (`git push --dry-run origin main:refs/heads/main` -> "Everything up-to-date", exit 0); no remote churn (main == origin/main == ls-remote == 1740d0dd at failure time, so the retry branch at :806-813 never fires); the real rejection text was reproduced by building an equivalent candidate and dry-run pushing it.

FIX, both parts:
1. Remove the race structurally. Preferred: per-push authorization so two landers cannot share a slot — the writer creates "land-authority.<nonce>" and the hook checks for the file named by $HARNESS_LAND_TOKEN (atomic creation, no clobber window, and a stale file authorizes nothing because the nonce is unguessable). A flock around write->push->cleanup is acceptable if you can show it covers EVERY writer. Whichever you choose, the hook and the lander must change together and stay consistent.
2. Stop discarding the push error. Line ~799 pushes with >/dev/null 2>&1 and throws away the hook's exact, actionable reason. Capture stderr and put it in the verdict detail.

PROVE IT with a test in modules/workstation/claude/tests/ (test-finish-branch.sh is the existing suite, 97 tests): two landers overlapping must both succeed, or fail for an honest reason — never reject each other. Run the whole suite and report pass/fail counts.

ALSO CHECK: every writer of main must go through the land queue. Merges on main titled "harness: land wt/..." suggest a harness path that may push outside the queue. If one bypasses it, that is the serialization hole — report it precisely.

DELIVERY: commit on a branch and push it to origin (gh is installed here; if push credentials are missing on this box, say so explicitly and stop — do NOT try to route the work back to the laptop). Report the branch name so the land can be driven from the laptop.

ABSOLUTE RULES: never push or force-push main by hand. Never run a fork-bomb/exhaustion/destructive test anywhere. Never kill a process by name. Do not touch this box's sshd or network config — two buildboxes were bricked today. Fix or explicitly justify every warning.