The harbor: an on-demand lock serializes landing to git-main (#229, closes #195) 8adf34a2 · dbf3dbe6…
Fix pr-map ledger lost-update: serialize writes under pr-map.lock (#336)
review and land both did read -> mutate -> whole-file rewrite of
.loot/git-mirror/pr-map with no lock, and land's read happens minutes before
its write (tests, ferry, push) - a land clobbered all three rows sibling
reviews recorded mid-flight (live, 2026-07-18).
Every ledger write now funnels through one door, update_pr_map: take
git-mirror/pr-map.lock, re-read fresh, apply only this operation's own row
add/remove, replace atomically. Early reads in review/land are lookups only,
never written back. The ledger lock is deliberately separate from the harbor
lock: reviews must not queue behind a land's git-main section, and land's
ledger close-out runs after harbor release anyway.
The write is store::atomic_write like every replaced git-mirror spine file
(#307), and readers (orchestrator + loot lanes) use store::read_replaced so
the Windows rename-replace window (#293 tail) cannot read as an empty
ledger. HarborLock::acquire_contending carries a caller-supplied contended
message so a wedged ledger never claims to be a wedged harbor. ADR 0034
amended; concurrent.md ownership note refined. 11addd8f · dbf3dbe6…diff
the harbor lock measures silence, not duration: a long-running holder beats a heartbeat, so a land may hold it for minutes and a crashed one is reclaimed in seconds (#1013) b9376a30 · dbf3dbe6…diff
Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.