# Land-wait retirement slice

audience: AI coding agents first.

status: ACTIVE
task IDs: #24, #30, #31
source request: Implement controller-owned agent retirement. Agents checkpoint and exit after controller accepts external wait; controller resumes one fresh worker from durable evidence.

## Outcome

Retire resident polling for one land ticket. Reuse existing controller SQLite transitions, existing land ticket/verdict, and existing successor dispatch seam. NEVER create another controller or queue.

## Contract

1. Bind one land ticket to immutable operation receipt.
2. Persist controller acceptance before caller may retire.
3. Lease generation is monotonic fencing token. Reject stale transitions and dispatch.
4. Convert conductor verdict to idempotent controller event.
5. Startup reconciliation handles verdict persisted before event consumption.
6. Create exactly one fenced successor-dispatch intent through existing dispatch seam.
7. Keep bounded synchronous compatibility until installed canary proves retirement path.
8. Preserve all WIP. Never perform real landing or deployment during canary.

## Files

Inspect first; modify minimum required subset:

- `controller/src/store.ts`
- `controller/src/transitions.ts`
- `controller/src/server.ts`
- focused controller tests
- `modules/workstation/claude/workflows/lib/finish-branch.sh`
- focused landing tests
- this receipt

## Acceptance

- Duplicate verdict is idempotent.
- Stale fencing token is rejected.
- Crash between verdict and event recovers on restart.
- Lost wakeup recovers on startup.
- Expired lease is reclaimed with higher generation.
- One operation creates exactly one successor intent.
- Focused tests pass without warnings.
- If `modules/harness/**` changes, `python3 -m pytest modules/harness/factory/tests/ -q` passes.
- Local infrastructure is installed before Git landing.
- Real installed entrypoint proves receipt acceptance and recovery without actual land/deploy.

## Current receipt

APPROVED candidate chain through `b8c4ed37d`:

- `7796bf7fc`: persisted acceptance, fencing, conductor handoff.
- `e7fec1cec`: atomic receiver dispatch ledger; key/fingerprint binding, generation lease/CAS, stale rejection.
- `c892dfa26`: `seat-remote` receiver integration; `--dispatch-key`, `--accept-only`, structured acceptance, replay suppression; controller marks local dispatch only after receiver acceptance.
- `b8c4ed37d`: zero unused-test diagnostics.

Independent Sol/low review APPROVED. Fresh verification passed: dispatch-ledger test; seat-remote test; controller land-retirement 13/13; controller typecheck. Coverage proves receiver-accepted/controller-crash recovery, concurrent same-key dispatch, fingerprint mismatch, lease reclaim, stale generation rejection, accept-only behavior, structured acceptance, and conductor-lock retirement. Exactly one accepted worker identity; ambiguity fails closed. Two privileged network-namespace launcher fixtures skipped because sudo netns unavailable; unrelated to replay/fencing paths. No ignored diagnostics.

Installed proof remains required after guarded landing/deployment. Current live deploy-source incident is owned by canonical deployment cutover; NEVER mutate preserved dirty clones.

## Next executable action

Commit receipt/index metadata. Guarded land candidate chain. Deploy from repaired canonical immutable source. Prove installed receipt acceptance, crash recovery, and exactly-one successor.