The server owns the trunk ref
A land squashes the branch’s committed delta onto trunk with pure git plumbing — merge-tree → commit-tree → update-ref under a compare-and-swap retry. It never touches a worktree, and it’s exactly-once across server restarts.