fix(land): stop blaming a branch for a borrowed base, and give the lease a refusable schema, a writer and a stand-down - #934

…an outage

Four cases over the compiled binary, because the defect is not in `adjudicate`
— which is pure and whose unit cases passed throughout — but in what the
boundary does with a load that failed. `mediated_admission.rs` records the same
lesson from the other side.

The pairing is the point. Under the declared mutation
`unloadable-config-allows`, which restores the old fall-through, the two deny
cases redden and the two allow cases stay green:

  FAIL  a_config_this_build_cannot_load_denies_rather_than_failing_open
  FAIL  on_claude_code_the_refusal_is_the_document_rather_than_the_number
  PASS  a_loadable_config_still_allows_an_ordinary_call
  PASS  the_declared_hatch_still_reaches_a_clone_whose_config_will_not_load

Proved by hand rather than left to the nightly. The mirror is what stops the
change being satisfied by an adjudicator that denies every call in the fleet,
which is an outage wearing a fix's clothes; the hatch case is what keeps a
container recoverable when a stale binary meets a newer config.

The fixture is a `batten.toml` mid-edit, which is the largest measured bucket:
seven windows across one 5-day session, 1,149 calls, none of them judged.

Refs: CLOUD-1688

…fail-open

`run_hook` went to 126 lines against a 100 budget, so the deny arm becomes
`deny_unadjudicable` rather than gaining an `#[allow]` — a boundary this
load-bearing reads better on its own than as a match arm nine levels in.

The four `call_arguments` cases are the substantive half, and the change is
deliberate rather than green-making. Each asserted that a malformed config on
the ADJUDICATE path answers `1`:

  a bound of zero is a usage error, not a very strict policy
  a named key with no projection is a usage error
  a row that can never fire is a usage error, not a silently inert gate
  a projection on a branch-keyed row is a usage error, not an ignored column

Every one of those classifications is still true and none is edited. What
changed is that `1` is the code a harness reads as a non-blocking hook error,
so on the mediated boundary each of these let the call through unjudged —
1,149 calls did exactly that over one measured session.

The surfaces stay separate rather than one principle beating the other:
`doctor` still never answers `2` (`a_failing_diagnosis_is_never_a_policy_verdict`),
and the CLI verbs still raise a usage error over a config they cannot read.
`adjudicate` is the one surface where "cannot judge" must not resolve to
"proceed", because there the alternative is a tool call nobody looked at.

The diagnostics ride through unchanged, which the neighbouring assertion that
stderr still names `max_age = 0` is what proves.

Refs: CLOUD-1688

…code its reason

`run_hook` sat at exactly its 100-line budget, so the deny arm put it over.
Extracting `is_adjudicable` buys the room, and the predicate reads better named
than as a five-clause disjunction mid-function: every clause was added by a
separate measured defect — a dead `Stop` gate whose own suite stayed green
(CLOUD-1051), a `SessionStart` mint that could not see its manifests
(CLOUD-856) — and the doc keeps that history where the next reader meets it.

`call_ceiling`'s partial-ceiling case is the fifth of the same class as the
four in `call_arguments`: a config fault on the mediated path asserted as `1`.
Its comment cited `rules/rust.md`'s rule that no Batten failure may read as a
deny, and that rule still holds where it was written — `doctor` and the CLI
verbs. The mediated boundary is the exception, because there `1` is
non-blocking and the call it could not judge simply ran.

The `measures` diagnostic it pins is unchanged.

Refs: CLOUD-1688

The first pass refused on every `load_policy` failure. That conflates three
faults the tree already separates, and only one of them is a refusal.

Gates are registered fail-open, so a gate that fails open is INERT — it neither
allows nor denies, it is absent. A config fault is therefore never a choice
between refusing and allowing: it is a choice between keeping the enforcement
surface we still have and losing it entirely. An unknown key costs its own row,
a table whose validator refuses names that table, a version this build is too
old for still says so — each leaves every other row readable and enforceable,
and leaves an agent that can be told to repair the broken one. Refusing there
trades a working partial gate for nothing.

A file that is not TOML has no partial function to preserve: zero rows are
readable, nothing is enforced, and the refusal is the only signal left. That
asymmetry is the whole scope of the change.

`Native::ConfigUnreadable` carries it. The class is a DISCRIMINATOR rather than
a label, and it is identified positively: keying on "carries no declared class"
would also have caught the unsupported-version and `min_batten_version`
refusals, which leave the file readable, and would widen what denies with every
future unclassed error.

The syntax probe runs on the error path only. `toml::de::Error` is one type for
two unlike faults and renders both as "TOML parse error at line N" — measured on
the `[[fact]]`-with-no-`returns` fixture, a schema fault the message alone
classed as unreadable. A `Table` parse answers it exactly, and costs nothing
until a parse has already failed, which is the probe `parse_ungated` records as
removed for costing one on the hot path.

Under `unloadable-config-allows` the two deny cases redden and the mirror, the
hatch and the rule-4 case stay green. 798 tests pass across the six suites this
touches; nine assertions from the first pass are reverted to their originals.

Refs: CLOUD-1677

…yload travel

`run_hook` sits at its 100-line budget and the speculative tree pushed it to
102, so the stdin read and the decode become `read_envelope`. The grouping is
the point rather than the line count: unreadable stdin and an undecodable
payload are one answer — the engine does not know what this call IS, and a
guard must never be the reason a session cannot proceed. That is the opposite
side of `unreadable_declaration`, where the engine knows the call perfectly
well and has been told it cannot enforce the rules over it. Naming them apart
is what stops the next reader collapsing the two.

The raw bytes travel with the decoded value because `dispatch_handlers` hands a
declared handler the payload as it arrived: stdin is consumed, so re-reading is
not available, and re-serializing would hand a handler a document the host
never sent. Caught by the compiler on the first extraction, and written down so
the tuple is not a mystery.

784 tests pass across the six suites this touches, `handler_dispatch` included.

Refs: CLOUD-1677

…ition is API

`Native` carries no `repr`, so a variant added in the middle shifts every later
discriminant. Placing `ConfigUnreadable` beside the other config classes for
readability moved eighteen of them, and `semver check` read the whole tail as
broken under `enum_no_repr_variant_discriminant_changed`.

Appended, and the reason is written onto the variant so the next reader who
wants to group it tidily meets the cost first. Declaration order is API and is
append-only; the reading order in `ALL` and `as_str` is free, and both keep the
class beside its siblings where a reader looks for it.

`semver check`: the API delta is patch-compatible against origin/main, so no
break is declared and none is owed. 459 tests pass across the census and the
affected suites.

Refs: CLOUD-1677

CLOUD-1770: a speculative lap threw away two lease acquisitions on keys it
never served. `closing-key-check` reads the PR's commit range through
`claimed-keys.sh`, which narrows on `$BATTEN_SPEC_BASE` — CLOUD-748's boundary,
and the shared reader that row asks for. The reader was shared; the FACT was
not.

`speculation::PUBLISHED_AS` was published into the environment of `verify`'s
child alone. `closing-key-check` runs at the Ready step, and `land::ready`
shelled out with no environment at all — so the narrowing found nothing, fell
back to the full range, and counted the lease holder's borrowed commits as this
branch's own stranded keys. Measured over one session: two acquisitions taken,
each spent on a 21-28 minute gate, each handed straight back.

The bet now reaches every body gate through the same `Bet::published()` the
verify step uses, so the publication stays a function of the bet rather than a
side effect kept in step with it: a lap with no bet outstanding publishes
nothing, and the entry is always emitted so `None` REMOVES the variable rather
than leaving an inherited one. The body FETCH is deliberately not given it —
that call reads the pull request's body, and the bet is a fact about the commit
range.

The case drives a child process's real environment rather than reading
`std::env::var`, which would pass against the defect it exists to catch, and
pins both directions: a bet published reaches the gate, and no bet publishes
nothing.

BREAKING CHANGE: `land::ready` takes the published speculation as a new fourth
argument, so a consumer calling it must pass the publication set. An empty slice
reproduces the previous behaviour, which published nothing to any gate.
`cargo-semver-checks` names this `function_parameter_count_changed`. The crate is
unpublished (CLOUD-205) and below `0.1.0` every release is a patch, so the type
stays `fix` and the footer is what declares the break — the shape `4bc4f57` set
for `handler::dispatch`'s new fourth argument.

Refs: CLOUD-1770

…tead

CLOUD-1681. `land.sh`'s invariant, quoted in `pipeline.rs`: "there is no path
from a losing bet to a push, which is what makes speculating safe rather than
merely fast." `Settle::Lost` has none — `Precheck::BetSettled` unwinds it at the
top of the lap. `Settle::Pending` had one, because that precheck deliberately
KEEPS a pending bet while the `Step::Push` row carried `precheck: None`.

Measured twice: four commits of another branch published under this one on
2026-09-08, eight on 2026-09-10, the second costing a full matrix on a head that
could not merge when it was graded.

WHY A PENDING BET IS UNPUBLISHABLE, corrected. The reason is not that the
holder's shas churn: landing is fast-forward and PRESERVES the sha, so a bet that
pays off was exactly right and its work carries over intact. The defect is
publishing a bet that has NOT paid off — the borrowed range is another branch's
unlanded commits, and this pull request's head must carry only its own, because
that head is what trunk fast-forwards onto. `Bet::pushed`'s own doc names the
outcome: the measured two-PRs-at-one-sha state.

(An earlier revision of this change argued from sha churn instead. That premise
is false and is corrected here rather than carried forward; the mechanism it
justified is unchanged and right. `mem:decision/landing-architecture` is the
authority.)

`Precheck::BetLive` answers `Lap`, never `Stop`. `Stop` would strand the waiter
behind CLOUD-1306's poisoned base indefinitely and empty the pipeline the
speculation exists to keep full — trading a wasted matrix for an unbounded
stall. The lap drops the borrowed range and re-enters: replay onto real trunk,
verify the unspeculated tree, publish this branch's own commits alone.

TWO THINGS THE ROW'S §3 DOES NOT STATE, both established from the tree.

The unwind is done by the arm rather than by the lap's compensations. No
`Compensation` drops a bet — `Nothing`, `Redraft`, `Abandon`, `ReleaseLease` —
so answering `Lap` alone would carry the borrowed range into the next lap. It
reuses `unwind_the_bet`, the same drop `Settle::Lost` already takes.

And `Bet::declined` is what makes the lap terminate. `place_the_bet`'s guards are
about the HOLDER, so without a memory of the decision the next lap re-bets the
same one, returns to this row and unwinds again until the lap budget is spent.
A bool rather than a base, because it records a decision about THIS LANDING and
not a judgement about a commit; it survives `forget`, which is what the unwind
calls.

BREAKING CHANGE: `speculation::Bet` gains a public `declined` field. `Bet` is a
constructible struct carrying no `#[non_exhaustive]`, so a downstream struct
literal over it stops compiling; `false` reproduces the previous behaviour, which
had no memory of a declined landing. `cargo-semver-checks` names this
`constructible_struct_adds_field` — the same lint `2ef3df5` declared for
`Config` and `resolve::Resolved`.

Refs: CLOUD-1681

`judge_admissions` demanded an articulation block for every staged protected
path. A path a `[[redirect]]` speaks for is written through a surface that
refuses nothing, so no admission is ever issued and there is nothing to
articulate — while the override route's own precondition says it exists for when
"writing the protected path directly is the only route left". Demanding a block
there left an honest author a choice between a false articulation and not
committing at all.

Measured: `.serena/memories/**` joined `protected` and the `[[redirect]]` table
together, and the first commit writing a memory through `write_memory` was
refused six times over. `ec32a76` is the root commit and the only commit in this
history touching that glob, so the pairing had never been exercised by either
half of the clause.

ONLY THE DEMAND IS DROPPED, NEVER THE INSPECTION. An earlier shape of this fix
exempted the path before looking at it, which silently lost `admits-tampered`
for the whole exempted set. Here the redirect answers only the absence case; a
block that claims a redirected path is still verified and still reported when it
does not recompute, and a declared `//MUTANT` pins that the exemption cannot
widen to cover it.

Not a receipt, and that is the design. CLOUD-1303's filed remedy was a receipt
minted where the write is allowed and read by this clause — but a receipt lives
in the container-scoped store, and CI runs the range half over the same
protected list on a runner that has never seen it. That is the local-pass,
CI-abstain asymmetry this module already forbids in prose and pins with
`the_clause_needs_no_store_to_decide`. The redirect table is config, so both
halves decide identically anywhere.

Closes CLOUD-1303

…t counts as evidence

Three new memories and three updated ones, none of which existed anywhere but a
context window that dies with the container.

`evidence-hierarchy` is the rule that would have prevented two errors in one
session. Code and tests as they execute now, and the output of a command I ran
myself, are evidence. Doc comments, the board, PR bodies and prior handoffs are
claims of equal standing: comments are written by the same agents who write the
board, reviewed no harder, and go stale the same way. Measured: 5 of 13 audited
speculation and lease rows are wrong, and a row or comment citing a retired
artefact is wrong 4 times in 5.

`decision/landing-architecture` carries the design. The fast-forward
sha-preservation guarantee, and that the holder does NOT land by rebase — #934's
body is named as the source of that error, because it will be read again. The
pipeline model: serial metered trunk, parallel free agents, speculation as
pipelining rather than opportunism, and the three metrics nothing measures.
Why k=1. Why CAS and not Paxos, with openraft and raft-rs named as
considered-and-declined so nobody reopens it cold. Fencing rather than voting,
because no failure detector is accurate and the design must be safe under a
false suspicion. Log-as-branch, the priority queue and its starvation caveat,
the identity tuple, and transcript preservation as parentless orphans.

`decision/adr-process` records the shape: one file per decision, rewritten in
place, git blame as the amendment history, no supersession markers and no
version suffixes — a reader sees only the current correct state of the world.

The updates: `github-access` gains the leak form that bit this session, the fact
that only mise is wrapped while the engine and git run unfenced, and the
measured stale-binary instance. `workflow/landing-loop` demotes the lease's
"it is a BRANCH" premise from settled fact to an open question with the
experiment named. `core` routes the three new ones.

Refs: CLOUD-1778

…g this branch

Two halves of one mechanism. Neither is worth anything alone, which is what the
first attempt at this got wrong.

`progress_of` gains a `Basis` qualifier — `Own` or `Borrowed` — reaching exactly
one cell: the gate's own refusal. The base table keeps `Stop`, which is right for
a branch on trunk; `progress`'s reasoning that "the replay and the gate both
answer about THIS tree" is exactly right there and exactly wrong over a holder's
unlanded commits, where the refusal has two candidate causes and the exit code
separates neither. Stopping attributed the failure to the author on no evidence,
discarded a prepared branch from the pipeline so the slot freed with nothing
ready to take it, burned the agent's remaining tokens, and left the
poisoned-base path inert — its own comment says "the NEXT lap settles Poisoned"
and behind that cell there was no next lap.

The second half is what makes the first honest. `unwind_lap` calls `Bet::forget`,
which clears `base`, and `would_rebet` compares `base` — so lapping would have
re-borrowed the identical commits, refused for the identical reason, and proved
nothing. `Bet::poisoned` is `conflicts`'s twin: a judgement about a COMMIT rather
than about this landing, surviving `forget` for the same reason and read by the
same function. Written before the progress arms run, since the lap settles the
bet. The inverted assertion in `the_same_candidate_is_not_bet_on_twice` is the
review's cue that behaviour moved, which is what that pin asked for.

Bounded by `Bound::SpeculativeRefusals`, default 2, refunding its lap and
charging its own bound. Small where the two neighbours are 60: those count events
carrying no information, and one lap here IS the experiment — the next replay
goes to trunk and answers with `Basis::Own`, which either stops with real
evidence or clears it. The refund is what stops a neighbour's base exhausting an
innocent branch's backstop and the exhaustion then being reported against that
branch, which is this row's own misattribution arriving one bound lower down.

Stated rather than overclaimed: a refusal over a borrowed base has two causes
this clone cannot separate — the base is broken, or base and branch are each fine
and conflict semantically. The behaviour is correct under both. Under the second
the error does not survive, because when the holder lands the next replay puts
their change on trunk and the same gate refuses with `Basis::Own`, stopping with
the conflict correctly attributed. Worst case is one deferred stop, never a wrong
one.

`settle` is deliberately unchanged. It answers from the holder and the trunk, and
from there a poisoned base is byte-identical to a slow holder; no fourth arm is
derivable from inputs that do not include the gate's verdict. The case pinning
that is renamed to say so and its assertion is untouched.

Closes CLOUD-1306

…iter

"There is one administrator" is false here by construction: the fleet runs
whatever versions its agents happen to carry and nothing coordinates an upgrade.
The body had no way to say "you do not speak this" and the parser had no way to
hear it — unknown keys were ignored, so a format change would have become silent
disagreement across a mixed fleet, with a lock under it.

`schema:` is the one field a reader may refuse over. A major above what this
build speaks does not parse, which the caller already renders as
`Observed::Garbage`: still held, still respected until it ages out, and now
diagnosable rather than silently misread. A `schema:` that will not parse as a
number is refused on the same ground — a body whose version field is
unintelligible was written by something that does not agree with us about what
the field is, and reading it as the oldest format is the loose parse the field
exists to stop.

ABSENT MEANS 1, which is the compatibility hinge. Every lease written before this
field existed carries no such line and those bodies ARE major 1, so the default is
a reading rather than a guess: a reader that refused them would stop the fleet on
the deploy that introduced the field.

READERS SHIP BEFORE WRITERS, which is why this emits 1 rather than 2. An old
reader ignores an unknown key, so it would parse a `schema: 2` body loosely and
act on it — the exact failure being closed here. The major may only be raised
once a release that refuses an unknown one is out across the fleet.

`writer:` advertises the build that minted the body, so version skew is visible
rather than inferred from behaviour. It is advisory and decides nothing: refusing
to honour a lease because its writer is old would hand every upgrade a fleet-wide
outage, and an identity another clone could derive is one another clone could
accidentally claim. It is stamped at every mint rather than carried forward,
because `reservation` is minted by a WAITER onto the holder's body — carrying it
would attribute that write to the holder and make the one field that exists to
expose skew the field that hides it. The holder is still carried, which is what
keeps that from being a steal.

Refs: CLOUD-1778

…decides

A waiter behind a wedged holder could do nothing but wait out the TTL. This adds
the advisory half of eviction: `stand-down:` on the lease body, written by a peer
through the same CAS that admits a successor, read by the holder's beat, and
honoured at a lap boundary.

IT IS NOT A STEAL WEARING A DIFFERENT NAME, which is the property to protect.
`notice` moves one field: the requester does not become the holder and does not
become the admitted successor, and the expiry is re-minted as it was. Honouring a
notice RELEASES the lease; the asker then races the next acquire like anybody
else. A route by which naming yourself gets you the lease is a steal however
politely it is spelled, and "I suspect you are stuck" would be the fastest way to
the front of the queue.

IT IS A REQUEST, NOT AN EVICTION, and that is forced rather than chosen. No
failure detector is accurate in an asynchronous system, so every suspicion that a
holder is wedged is a heuristic and some are wrong. A peer that could TAKE the
lease on suspicion would be wrong in exactly those cases. So the field carries no
authority: the holder reads it and the holder decides. The unilateral half — a
fenced compare-and-set whose advanced token makes the evicted holder's next write
fail — is the referee's and is not built here. Both exist because each is sound
for something the other is not.

AND IT IS HONOURED AT A LAP BOUNDARY, NEVER MID-MATRIX. The beat keeps renewing
while a notice is pending, which looks like ignoring it and is the opposite: a
holder that stopped renewing would lose the lease inside its own CI matrix and a
second lander would start — precisely the overlap the heartbeat was written to
close, reintroduced by the mechanism meant to be polite. Between laps there is no
matrix in flight, so releasing costs the fleet nothing and costs this branch one
re-run.

`beat` answers a `Beat` rather than a `bool` because it is the only thing that
reads the lease every few seconds, so it is where a notice is seen and a `bool`
had nowhere to put it. Collapsing it into `false` would have been worse than
dropping it: `false` means "one beat did not write", which the caller is
explicitly told is not news. The request is latched across laps rather than
re-read, because the beat re-mints the body and a later writer can overwrite the
field — once asked, this holder has been asked.

Standing down exits 3, never 2: nothing about this tree is wrong and the head is
still landable, so it reads as "the loop stopped asking" and the caller runs it
again. A 2 would send an agent to fix a defect that does not exist.

A self-named notice is ignored, because the holder re-mints the whole body every
beat and such a notice would survive its own release and ask every future holder
to stand down forever. A fresh claim clears the field for the same reason.

Refs: CLOUD-1778

BREAKING CHANGE: `lease::beat` answers `lease::Beat` rather than `bool`, and
`lease::Body` gains `schema`, `writer` and `stand_down`. The body's wire format
gains three lines; readers of an older major are unaffected because an absent
`schema:` reads as major 1.

…vector clocks

The fallacy table was seven rows and one of them was wrong. Bandwidth and
transport cost were merged, which deleted the fallacy this project is most
directly a response to; the reliability row said "every read fails open", which
the tree contradicts exactly where it matters — `Live::decide` fails CLOSED
because failing open there makes a network blip the thing that lands somebody
else's work, while `authorises` fails open because a lease it cannot read would
stop the whole fleet. Same read, opposite directions, decided by the question.
The replacement commitment is per (read, decision) pair.

The record layer is new. What we rent from the forge — CAS atomicity, rollback
protection, admission control — against what we only assumed: any binding between
a body and the writer who wrote it. The forge authenticates the push, never the
record. Self-certifying addresses cover the immutable half and git gives us that
for free; BEP 44 covers the mutable half and we have it nowhere. The Sybil
half of the DHT toolkit is not needed here because the writer population is not
open. Replay is where the analogy runs out: signatures do not stop a rollback,
and the sequence has to anchor in a ref with server-side rollback protection
because our readers are containers with no memory.

And the clocks, which is what the fallacy row was really about. `now_unix` is
CLOCK_REALTIME and answers 0 on failure, which makes `expired` say nothing is
ever expired. But no clock choice fixes the real defect: an absolute instant
crosses the wire and is compared against another agent's predicate. Expiry must
be observer-local, and the progress token beside it already is.

Two jobs, one of which needs real time: ordering is the log index, and failure
detection irreducibly needs a timeout that can only be confined, never removed.
Vector clocks recorded as considered-and-declined, with the one case that would
require them — independent logs under a multi-address design.

Refs: CLOUD-1778
Refs: CLOUD-1784

Five sites reached `Command::new` with the program named directly, so rung 0 —
the pin — never fired. `policy/spawn-adapters.rego` places this module, which
sanctions the SPAWN; it says nothing about how the program is RESOLVED, and that
gap is what let the bypass sit here.

`rules.rs` already measured the cost: "nothing a toolchain manager provides is on
bare PATH -- nor should it be". So a `cargo` the project pins was reached around
every time and whatever the ambient environment exposed was used instead.

`toolchain()` was the worst of the five, and its own doc says why: it calls itself
a READ of the pin rather than a fourth copy of the number. It read that pin off a
`rustc` resolved on bare PATH — a different compiler from the one the project
pins — so the authority was whichever toolchain the environment happened to
expose.

The `+{toolchain}` ordering survives. That rule is about cargo's own argv, and
where rung 3 fires the program becomes an interpreter while `extra` carries the
script, so `+{toolchain}` is still the first argument cargo itself sees. The
baseline doc build resolves against `root` rather than the materialized worktree,
which carries no toolchain configuration of its own and would fall through to
bare PATH — the same bypass through a different door.

A case asserts no spawn in the module names its program directly. It took three
attempts, and the failures are the argument for the idiom rather than noise: the
first found the call spelled in its own doc comment, the second found its own
search literal in executable code. `git.rs` already assembles its needle from
parts for exactly this reason, undocumented, so each new scanner rediscovered the
defect instead of the remedy. That is now written down in rules/scanning.md.

Refs: CLOUD-1494

…moves or the pool idles

Nothing stopped it before. A holder whose matrix goes red releases and may win the
very next acquire, replay onto the same trunk and buy another matrix on the same
defect — spending the metered resource twice to learn what it already knows, while
every waiter that prepped behind it sits through both.

THE CONDITION IS TWO EVENTS, NEVER A DURATION. This is the mechanism most likely
to have been written as a timer, and both lapse conditions are observable
directly, so the no-wall-clock invariant survives it.

The trunk moving lapses it because the cooldown is a claim about ONE base — that
this branch, on that trunk, is red. Once the trunk advances the claim is about a
tree that no longer exists, and holding the agent back further punishes it for a
state nobody is in.

An idle pool lapses it, and that arm is the anti-outage half rather than a
kindness. Waiting exists so somebody else gets the slot; with no lease on the ref
there is nobody else, and a cooldown that survived an empty pool would strand a
single-agent fleet completely — one red matrix and nothing can ever land again.
CLOUD-1043 makes the same argument for its own mechanism and it is preserved here
rather than rediscovered. A tombstone counts as idle for the same reason: the
holder handed it back, so the ref exists and nobody is holding it.

A ref nobody can read counts as NOT idle. Reading a failed parse as an empty pool
would let the one agent that just poisoned CI take the lease on the strength of
it, and `turn` already answers Wait for that state — the cooldown agrees with its
neighbour rather than arguing with it.

Refs: CLOUD-1778