# Isolate land queue from task-worktree Git corruption

audience: AI coding agents first.

status: DONE
task IDs: session task #1
source request (2026-08-11): "how do you make it so nothing like that will ever happen? isnt this what trains are for ? dont we have them? or am i not even in the right track"

## Outcome

Keep existing FIFO single-conductor land train. Remove shared task-worktree ref/object database from conductor fetch, candidate assembly, and publication path. One corrupt lane MUST fail only its own ticket; unrelated tickets and `origin/main` fetch/publication MUST continue.

## Acceptance criteria

1. Reproduce current failure: unrelated `refs/heads/wt/*` points to missing object; current shared-root fetch fails `fatal: bad object`.
2. Conductor transport uses self-contained Git object/ref namespace containing only authoritative remote base plus explicitly imported ticket source.
3. Import ticket source by exact ref/object value. Never enumerate or trust unrelated task refs.
4. Corrupt unrelated task ref MUST NOT block conductor base refresh, candidate gate, push, verdict, or next ticket.
5. Missing/corrupt ticket source MUST reject only that ticket with explicit verdict; queue continues FIFO.
6. Preserve single conductor, land authority, fast-forward-only main, exact candidate gates, rescue ref, crash reconciliation, and owner-side cleanup invariants.
7. Add deterministic regression tests for unrelated-ref containment and own-ticket corruption.
8. Install shared land brain before landing; prove installed entrypoint against isolated fixture; then land/deploy.
9. Never ask owner to choose or execute Git mechanics. Owner sees track, containment result, and nothing-to-do receipt.

## Preserved WIP

- Existing active worktrees/branches/refs remain untouched, including `wt/factory-gpt-engine` and all controller-owned dark-delivery WIP.
- Existing land queue state under shared Git common dir remains authoritative for FIFO tickets/conductor lock.
- Cluster recovery remains DONE at `docs/plans/2026-08-11-cluster-push-oversize-trip.md`.
- Controller lifecycle work remains owned by `docs/plans/2026-08-11-controller-owned-dark-delivery.md`.

## Constraints

- Do NOT promise universal impossibility of failure. Guarantee containment for this failure class through namespace isolation and fail-closed ticket validation.
- Do NOT repair/delete unrelated refs as part of landing.
- Do NOT add another daemon, queue, or lifecycle authority.
- Do NOT weaken tests, land authority, fast-forward checks, or recovery refs.
- Factory reliability suite required if harness phase/retry/gate/commit behavior changes.

## Execution steps

1. Trace exact failure and identify architectural boundary violation.
2. Specify minimal self-contained conductor repository plus exact-source transfer.
3. Add red regression fixtures.
4. Implement isolated base fetch/candidate/publication and per-ticket source rejection.
5. Run focused land-brain tests and full Factory reliability suite.
6. Install runtime, invoke real installed entrypoint against corrupt-ref fixture, and verify unrelated ticket lands.
7. Commit, guarded-land, deploy, and record exact receipts.

## Current receipt

- Worker `main` active in `/home/user/Projects/overdeck/.worktrees/git-ref-isolation`.
- Existing "trains" are two different systems: `/ci` displays GitHub PR merge trains; `finish-branch.sh` owns local FIFO guarded landing.
- Local landing already has FIFO tickets, one conductor lock, candidate gates, land authority, and crash recovery.
- Boundary defect confirmed: `_stage_a_fetch_main` and candidate creation read shared root refs/object DB. Fixture proves one unrelated missing-object branch makes even exact `origin/main` fetch fail.
- Historical reflog proves `wt/factory-gpt-engine` commit `73d14eb08...` existed, then its object disappeared while referenced. Exact deletion mechanism remains unproven. Containment does not depend on that mechanism.
- Implementation now keeps authoritative base state in self-contained `publisher.git`, exports only ticket rescue ref through `git bundle`, imports base plus ticket source into a disposable self-contained candidate, and publishes from that candidate under its own lock-bound scoped authority.
- Candidate publication replays the original absolute pre-push policy with preserved stdin, runs generation-v3 land guard independently, preserves all push URLs, and carries repository-local transport configuration.
- Crash recovery strictly removes stale authority-bearing candidates and stale source bundles before writing a successful recovered verdict.
- Deterministic regressions prove: shared-root fetch fails on unrelated dangling ref while isolated landing succeeds; missing-object ticket receives `source-export-failed` while next FIFO ticket lands; stale authority is unusable; recovery cleans candidate/bundle residue; existing sibling-dependent pre-push policy runs; multiple push URLs and custom upload-pack semantics survive isolation.
- Focused land-brain suite: `PASS=115 FAIL=0`, zero warnings under valid locale.
- Mandatory Factory reliability suite: `151 passed`, zero warnings.
- Runtime installed from tested candidate `54563361ef42983959624eb9e706e6f12af4ebd8` with generation-v3 guard armed.
- Real installed `~/.claude/workflows/lib/finish-branch.sh` fixture: shared-root fetch failed on dangling unrelated ref (`rc=1`), installed lander succeeded (`rc=0`), exact source reached remote main, dangling ref remained untouched, publisher had no alternates, zero warnings.
- Independent final review: clean; no remaining concrete correctness or security findings.
- Implementation commit `1d4f6be37` (`Isolate guarded landing Git state`) and installed-proof receipt `73b68a772` landed through guarded FIFO publication. Standard deployment activated release `9643263a`.
- Post-deploy reconciliation: `origin/main` and deployed clone both reached `832acc72665e49a1a3f4f19b66fd2810b59d2e48`; implementation commit `1d4f6be37` is an ancestor of both.
- Owner-visible runtime proof: `overdeck-web.service`, `overdeck-collector.service`, `overdeck-controller.service`, `botmaster-proxy.service`, and `overdeck-web-watchdog.service` active; web HTTP `200`; unauthenticated collector probe HTTP `401` as expected. Deployment's transient final `collector_http:"000"` did not persist.
- No owner action required. This closes containment for unrelated dangling/missing task refs; it does not claim all possible Git or infrastructure failures are impossible.

## Next executable action

None. Installed, landed, deployed, and runtime-verified.