// NEW immutable companion after frozen Context/Async/Completion/retirement.
// The real Prepared remains retained; only frozen return_landed consumes it.
impl<B: CompletionBackend, const N: usize> CompletionBank<B, N> {
    pub fn os_k1060_check_return_landing(
        &self,
        token: &OwnedReturn,
    ) -> Result<ReturnObservation, Error> {
        self.validate(token)?;
        let p = self.pending.as_ref().ok_or(Error::Pending)?;
        if p.stage != ReturnStage::Departed {
            return Err(Error::State);
        }
        let bank = &self.handoff.bank;
        // Repeat the actual owning-CPU / masked-task gate BEFORE returned,
        // source-binding, physical stack or root-owner observations.
        let e = bank.backend.execution();
        if e.cpu != bank.cpu
            || e.daif & IRQ == 0
            || e.daif & !0x3c0 != 0
            || e.in_irq
            || !e.fp_enabled
            || e.critical_depth != 0
            || !e.safe_point
            || e.sp & 15 != 0
        {
            return Err(Error::Context);
        }
        bank.backend.returned(&p.prepared)?;
        let r = bank.validate(p.source.slot)?;
        if r.state != thread::State::Dead
            || e.thread.is_some()
            || e.root != bank.backend.return_root(&p.prepared)?
            || e.sp >= r.layout.guard() && e.sp <= r.layout.base + r.layout.bytes
        {
            return Err(Error::Active);
        }
        self.observation().ok_or(Error::Pending)
    }
}