Function land_assets 

pub fn land_assets(
    ir: &Value,
    ir_path: &Path,
    out_dir: &Path,
) -> Result<Vec<PathBuf>, String>

Land the assets an IR’s components declare into out_dir, verifying each against its manifest.

Why this exists. IR 0.7 lets a component declare the files it needs and compile records their identity, but nothing consumed that manifest: a component declared its files and the agent then ran in a directory that did not contain them, with no error at all. Landing them is what makes the declaration mean something.

Content comes from the directory compile wrote beside the IR (asset_dir_for_ir) — compile is the only place that has it, since the compiler is sans-IO and a Hub component was resolved over the network there. See decision-101.

Both failure modes are loud. A manifest entry with no file in the asset directory, and one whose content does not hash to the recorded value, each stop the dispatch. Silence is the bug being fixed, and a half-landed asset set is harder to diagnose than a refusal.