# Normalized Incident Catalog

This catalog records concrete incident occurrences after deduplicating repeated reports across Overdeck documents, database rows, and workstation chat-agent histories. It is intentionally not a transcript archive.

## Normalized occurrences

### OD-001 — Active worktree reaped with uncommitted correction work

- **Severity:** critical
- **Primary class:** WIP durability / cleanup
- **Evidence:** Overdeck `docs/plans/2026-08-15-fire-session-harvest.md`; Claude session history `d43a079f-d608-4247-90b3-2b83298de7aa`, 2026-08-14T17:31Z.
- **Occurrence:** an implementer correction pass in `.worktrees/tmux-runtime-boundary` was uncommitted when the worktree reaper removed the directory. The work survived only because a salvage snapshot had been anchored as commit `147c78fb7`. The owner separately reported the reaper destroyed two active worktrees the same day; one lost Git registration mid-commit and produced no salvage ref.
- **Mechanism:** destructive cleanup treated apparent inactivity/registration state as sufficient evidence of disposability while live work still existed.
- **Impact:** recoverable work could have become irretrievable; active execution state and Git identity diverged.
- **Historical mitigation:** salvage/archive refs plus progressively stricter liveness/identity guards.
- **AWP relevance:** direct. Disposable Workspace cleanup must be fenced by durable lifecycle/collection state, not heuristic age alone.

### OD-002 — Attached owner session killed during load cleanup

- **Severity:** critical
- **Primary class:** Agent lifecycle / cleanup identity
- **Evidence:** `docs/plans/2026-08-11-cpu-load-session-sprawl.md`; Claude prompt 2026-08-12T04:51Z (“you killed my working session ...”).
- **Occurrence:** manual cleanup terminated the owner-attached `ipz-wip-triage` session while attempting to reduce machine load. The transcript survived, but the live tmux process/window did not.
- **Mechanism:** destructive cleanup acted without atomically binding process identity, session identity, attachment state, and post-classification revalidation.
- **Impact:** active interactive work was interrupted by infrastructure remediation.
- **Historical mitigation:** fail-closed attachment/identity proof; no kill on unreadable/changed identity.
- **AWP relevance:** direct principle even though AWP uses different execution mechanics.

### OD-003 — Ghost admission lock wedged the machine

- **Severity:** critical
- **Primary class:** Concurrency / locking / scheduling
- **Evidence:** `docs/plans/2026-08-15-fire-session-harvest.md`.
- **Occurrence:** `queue.lock` remained flock-held through an inherited descriptor after its creator died. 758 waiter jobs accumulated, each parking processes; `agent.slice` reached `TasksMax=3072`; forks failed with EAGAIN and Git/tests/builds failed machine-wide.
- **Mechanism:** lock ownership was not recoverable from durable generation/lease state; waiters consumed unbounded operating-system resources while blocked.
- **Impact:** a single admission lock became a workstation-wide outage.
- **Historical mitigation:** rotate wedged lock inode, terminate provably unwakeable waiters, raise task cap; these restored service but do not change the architectural lesson.
- **AWP relevance:** direct. Durable orchestration must not express product queue ownership as an indefinitely inherited process lock.

### OD-004 — Shared Git ref corruption blocked unrelated landing

- **Severity:** high
- **Primary class:** Git / publication isolation
- **Evidence:** `docs/plans/2026-08-11-land-queue-git-isolation.md`; `docs/plans/2026-08-11-cluster-push-oversize-trip.md`.
- **Occurrence:** an unrelated `refs/heads/wt/*` ref pointed to a missing object, causing `git fetch` from the shared checkout to fail `fatal: bad object`; another transient dangling worktree ref reproduced the same global failure shape.
- **Mechanism:** trusted land/publish operations shared object/ref namespace with mutable task worktrees.
- **Impact:** one damaged lane prevented unrelated refresh/landing work.
- **Historical mitigation:** isolate conductor transport/object/ref namespace and import only exact candidate refs.
- **AWP relevance:** direct invariant: trusted publication must consume explicit immutable candidate identity, not enumerate mutable workspace refs.

### OD-005 — Nested `.worktrees` silently omitted from remote result

- **Severity:** critical
- **Primary class:** WIP durability / remote execution
- **Evidence:** `~/.overdeck/requests.sqlite`, request `fire-85e1b08b1f122048`, 2026-08-16T09:44:29.624Z.
- **Occurrence:** repository instructions told an agent to work under `.worktrees/`; the remote Codex snapshot transport excluded `.worktrees`. The agent committed work in a nested worktree and the result never returned to the controller.
- **Mechanism:** workspace doctrine and result-transport exclusion rules contradicted each other; collection did not detect excluded Git/WIP state before declaring completion.
- **Impact:** correct agent behavior produced silent work loss.
- **Historical mitigation:** proposed prompt/contained-workspace override or transporting nested worktrees; the durable lesson is to make impossible states mechanically detectable.
- **AWP relevance:** urgent for Lane C result collection.

### OD-006 — Landing succeeded but reported failure

- **Severity:** critical
- **Primary class:** Idempotency / publication reconciliation
- **Evidence:** Claude Overdeck history/session `f7206ccd-6b70-4951-aca7-740f2f4cab41`, owner discussion 2026-08-15T14:11Z.
- **Occurrence:** a legacy landing operation stalled for about 56 minutes, emitted a false “unreachable”/failure verdict, but the merge had in fact completed.
- **Mechanism:** caller outcome was inferred from transport/process completion rather than reconciling provider state after an ambiguous response.
- **Impact:** an agent can retry a mutation that already succeeded, risking duplicate publication/merge or misleading lifecycle state.
- **Historical mitigation:** register and reconcile the ambiguity; phase out the legacy path.
- **AWP relevance:** direct, high-priority Lane B regression test.

### OD-007 — Two OAuth refresh writers invalidated a Claude grant

- **Severity:** critical
- **Primary class:** Credentials / account authority
- **Evidence:** `docs/plans/2026-08-15-systray-claude-token-rotation.md`; Claude session `8a00308a-9df8-4ffb-aa27-615bec3063ec`.
- **Occurrence:** systray usage/health polling refreshed the same grant that Claude Code refreshed. One-time refresh-token semantics made the loser replay an already-consumed token and the provider revoked the grant chain. Multiple account fingerprints showed repeated churn.
- **Mechanism:** more than one mutable credential authority existed for one logical provider account.
- **Impact:** active sessions lost authentication; at least one account grant was destroyed during investigation/probing.
- **Historical mitigation:** systray became read-only; the CLI remained sole writer.
- **AWP relevance:** direct security invariant already represented in AWP target specs; must be tested.

### OD-008 — Codex grant had multiple writers/copies with no authority fence

- **Severity:** high
- **Primary class:** Credentials / routing / state ownership
- **Evidence:** `docs/plans/2026-08-17-codex-grant-single-writer.md`; DB request `manual-cd8ebacb897706c6`, 2026-08-17T06:50:31.832Z.
- **Occurrence:** local Codex, systray, a proxy copy, remote seat copies, and reconciliation all interacted with variants of one grant. A stale/invalid state persisted while the owner-facing repair path was itself broken.
- **Mechanism:** file locking could not establish authority across CLI, remote hosts and containers; copies became independent mutable state.
- **Impact:** stale credentials, misleading health, and risk of invalidating the authoritative grant.
- **Historical mitigation:** design changed to one refresh-token owner distributing short-lived access credentials; fingerprint-only bounded transition logs.
- **AWP relevance:** direct security/provider-contract requirement.

### OD-009 — Dirty deploy clone globally blocked deployment

- **Severity:** high
- **Primary class:** Deployment / shared mutable state
- **Evidence:** `~/.overdeck/requests.sqlite`, `fire-62e45effb93dac92`, 2026-08-16T07:12:47.999Z; related user reports in Claude history.
- **Occurrence:** uncommitted Factory refactor work was parked in the “pristine” deployment clone; all deployments refused until that unrelated WIP was landed or parked.
- **Mechanism:** a globally shared mutable checkout was both a WIP carrier and deployment control input.
- **Impact:** one lane's local state became a fleet-wide delivery choke point.
- **Historical mitigation:** separate delivery clones/immutable inputs and guard dirty state.
- **AWP relevance:** AWP should use immutable source/artifact identities and isolated trusted provider state, not a shared mutable deployment checkout.

### OD-010 — Durability board disappeared during collector restart

- **Severity:** high
- **Primary class:** State persistence / availability / UX
- **Evidence:** `~/.overdeck/requests.sqlite`, `fire-ee4a23c88e565ae7`, 2026-08-16T06:10:39.041Z; Claude discussion 2026-08-16T09:38Z.
- **Occurrence:** collector hit a 4 GB memory peak/restart and the requests board was unreachable for roughly 90 seconds until the service rebound. The same logs contained repeated database-lock errors.
- **Mechanism:** the user-facing durability/status seam was coupled to a restarting process with no seamless serving handoff/read fallback.
- **Impact:** the system of record became unavailable precisely when sessions were at elevated risk of loss/recovery.
- **Historical mitigation:** CLI retry deadline; user correctly identified that avoiding unnecessary restart/downtime was a deeper fix.
- **AWP relevance:** authoritative state must survive process replacement; UI transport outage must not erase or fabricate work state.

### OD-011 — Remote-only typecheck policy blocked every land

- **Severity:** high
- **Primary class:** CI / runner routing / environment drift
- **Evidence:** `~/.overdeck/requests.sqlite`, `fire-7e0a2234cd22ae61`, 2026-08-16T04:58:40.188Z.
- **Occurrence:** land queue invoked typecheck through `bash -c`; the remote-build classifier treated `bash` as an opaque local-only wrapper; `--remote-only` therefore refused execution. Every land failed with exit 97 while queue depth reached 86.
- **Mechanism:** two independently correct policy layers composed into an impossible route; no preflight proved an executable end-to-end path before queue accumulation.
- **Impact:** global delivery stopped.
- **Historical mitigation:** repair dispatch classification/command shape.
- **AWP relevance:** CI/provider admission must expose a typed infrastructure error and viable placement before work is admitted, not after a large queue forms.

### OD-012 — Fleet-wide environment/runtime drift blocked dispatch

- **Severity:** high
- **Primary class:** Kubernetes / runner / runtime identity
- **Evidence:** DB incidents `fire-1d6de776299fbf20`, `fire-9d4fa17551cfce65`, `fire-cc69cfec3822160e`, `fire-77a71a5d51d1df37` during 2026-08-16.
- **Occurrence:** dangling runtime links, Node version drift, generated shim/manifest drift, and stale seat images each caused remote execution/deploy gates to reject otherwise reachable hosts.
- **Mechanism:** executable runtime identity and configuration parity were mutable across hosts and validated late.
- **Impact:** one or all remote execution paths became unusable, cascading into blocked landing/build work.
- **Historical mitigation:** rebuild/reprovision and explicit self-tests.
- **AWP relevance:** Attempt/runner/workspace must record and preflight immutable execution profile/image/tool identity; an unhealthy host should be ineligible, not silently selected.

### OD-013 — Pre-submission and long-running work hung silently

- **Severity:** high
- **Primary class:** Agent lifecycle / bounded waits / observability
- **Evidence:** `docs/plans/2026-08-12-ask-gpt-silent-hangs.md`; Claude history 2026-08-17T13:45Z and 2026-08-17T14:59Z.
- **Occurrence:** prompt submission could wait without proving that the prompt was sent; separately, owner observed a process stuck for 2h35m and required hard deadline/loud stage output rather than indefinite waiting.
- **Mechanism:** asynchronous phases had no explicit stage deadline/receipt, so “working”, “waiting to start”, and “dead” were indistinguishable.
- **Impact:** owner babysitting, wasted capacity, and ambiguous retry decisions.
- **Historical mitigation:** stage deadlines, nonzero timeout exit, truthful lifecycle transitions.
- **AWP relevance:** every durable external wait needs a typed stage, last-progress timestamp, deadline/retry policy, and terminal/attention state.

### OD-014 — Enqueue looked like ship; later refusal was hidden

- **Severity:** high
- **Primary class:** Observability / UX / state honesty
- **Evidence:** Claude session `6c0d0325-0ad1-4dca-9c7d-a822ad48a22c`, 2026-08-16T07:24–07:54Z discussion; `docs/plans/2026-08-12-ci-cd-incremental-delivery.md` deploy-status work.
- **Occurrence:** landing session enqueued work and walked away; later deploy refusal occurred in a journal the session/user did not see. Successful deployments notified the owner while refusals did not.
- **Mechanism:** accepted intent, queued execution, delivery completion and failure were collapsed into an implied success path.
- **Impact:** user/agent believed work shipped when downstream execution was blocked.
- **Historical mitigation:** edge-triggered refusal notification and richer status.
- **AWP relevance:** UI/API must never call accepted/queued work “done”; downstream failure remains attached to the durable work item with next action.

### OD-015 — Session compaction/loss erased work intent

- **Severity:** high
- **Primary class:** Agent lifecycle / durable continuation
- **Evidence:** Claude session `f7206ccd-6b70-4951-aca7-740f2f4cab41`, reports 2026-08-15T02:05–04:09 and 2026-08-16T04:17–10:23Z.
- **Occurrence:** sessions were killed/lost or compacted; the owner reported seven hours believing work was done, then discovered lost sessions/auth failures. Later the “memory-organizer” session itself lost awareness of migration/progress/tasks; 17 sessions initially classified abandoned were actually lost work from an earlier FIRE thread.
- **Mechanism:** assignment/progress/next-action existed in chat/session context rather than a durable work primitive authoritative outside the model window.
- **Impact:** duplicate asks, forgotten work, costly archaeology and incorrect abandonment decisions.
- **Historical mitigation:** reconstruct from full transcript and move status into durable request/plan registry.
- **AWP relevance:** direct principle: conversational memory is not authoritative workflow state.

### OD-016 — Session sprawl saturated the workstation

- **Severity:** critical
- **Primary class:** Resource scheduling / agent lifecycle
- **Evidence:** `docs/plans/2026-08-11-cpu-load-session-sprawl.md`; Claude incident `319a7266-b59a-4cbe-ac4f-0b06394e1cc9`, 2026-08-14T16:59Z.
- **Occurrence:** measured load averaged 74/66/71 on 16 cores with dozens of Claude/tmux/tsserver processes; later owner again reported 100% CPU and workstation lag with load reaching roughly 145 during investigation.
- **Mechanism:** sessions/helpers accumulated without lifecycle/resource budgets; idle sessions still consumed material CPU/RAM; blocked delivery kept sessions alive much longer than useful execution time.
- **Impact:** workstation became unresponsive and failures cascaded into more cleanup/recovery work.
- **Historical mitigation:** scope-aware cleanup/offload/resource caps.
- **AWP relevance:** scheduling must bound concurrent resource consumption and decouple durable run identity from long-lived idle processes.

### OD-017 — Disk recovery treated symptoms while producers kept refilling storage

- **Severity:** high
- **Primary class:** Capacity / recovery automation
- **Evidence:** Claude history 2026-08-12T15:02Z, 2026-08-14T08:23–13:42Z; user correction at 2026-08-14T12:22Z.
- **Occurrence:** repeated HDD FIREs returned after artifact/cache cleanup. Owner explicitly identified that deleting rebuildable artifacts while something continuously rebuilt them increased disk churn and NVMe wear.
- **Mechanism:** recovery automated deletion without first controlling the producer/admission rate and without a durable capacity ceiling.
- **Impact:** repeated incidents, storage churn, blocked work and risk to workstation health.
- **Historical mitigation:** later size ceilings/oldest-first eviction and producer analysis.
- **AWP relevance:** self-healing must verify root condition/postcondition; repeated identical recovery without improving state escalates rather than loops.

### OD-018 — Exact-key incident dedup created a duplicate FIRE

- **Severity:** medium
- **Primary class:** Idempotency / incident correlation
- **Evidence:** `~/.overdeck/requests.sqlite`: `fire-2360721c184ce327`, 2026-08-16T11:06:19.802Z explicitly identifies itself as duplicate of `fire-77a71a5d51d1df37` because a different signature string bypassed exact-key dedup.
- **Occurrence:** the same remote seat incident became two incident records.
- **Mechanism:** correlation equated deduplication with exact string identity rather than a stable operation/provider identity plus evidence linkage.
- **Impact:** duplicate remediation/escalation and misleading incident counts.
- **Historical mitigation:** manually mark duplicate; broader consumer/playbook design followed.
- **AWP relevance:** events/commands need deterministic provider IDs/idempotency keys; semantic incident correlation should link candidates rather than silently merge uncertain events.

### OD-019 — Lock-contention crash left inert supervised process and incident storm

- **Severity:** critical
- **Primary class:** Concurrency / lifecycle / recovery
- **Evidence:** Codex Overdeck incident prompts 2026-07-30, especially session `019fb0c0-40a8-7ce3-a7c2-1398141d15ec`.
- **Occurrence:** v2 harness heartbeat started before coordinator lock acquisition. Lock contention threw before cleanup, leaving an inert process emitting heartbeats. Legacy/canonical registry mixing produced `identity-unverified`; watchdog logged the same ownership mismatch roughly 515 times instead of transitioning once.
- **Mechanism:** side effects began before exclusive ownership; cleanup was not in the failure path; ownership schema was ambiguous; incident emission lacked edge/idempotency semantics.
- **Impact:** false liveness, duplicate coordinator ambiguity, noisy incident storm and unsafe recovery decisions.
- **Historical mitigation:** acquire ownership before heartbeat/child work, canonicalize registry identity, emit ownership receipt, transition/dedup once.
- **AWP relevance:** direct DBOS/Workspace/runner failure-injection requirement.

### OD-020 — Quarantine/restart erased historical run visibility

- **Severity:** critical
- **Primary class:** State persistence / recovery / UI
- **Evidence:** Codex prompts `019fb0e5-c4f5-7ac1-a1dc-ed94721f682a` and `019fb199-579f-7fe0-b8bd-deb56756e937`, 2026-07-30.
- **Occurrence:** moving bad supervision records into quarantine caused `/plans` to show no runs; a later release exposed history before restart but lost it again after service restart because the importer/checkpoint path did not deterministically reattach durable archives.
- **Mechanism:** historical observability was derived from active registry/discovery side effects rather than a durable canonical history projection.
- **Impact:** completed/failed work disappeared from operator view after legitimate recovery/restart.
- **Historical mitigation:** durable history archive always loaded; discovery checkpoint used only to suppress expensive rediscovery, not history loading.
- **AWP relevance:** authoritative lifecycle history must not depend on live executor registry or current process lifetime.

### OD-021 — Collector latched stale/dead provider endpoint

- **Severity:** high
- **Primary class:** Realtime / provider reconciliation
- **Evidence:** Codex prompt `019fac53-e514-71a3-8a15-6369a4f53cb7`, 2026-07-29.
- **Occurrence:** two harness control APIs shared a pointer file; v2 reclaimed it periodically while a legacy server was dead/hanging. Collector read the pointer once at boot and cached it forever, so UI could remain connected to dead legacy state and never show live v2 runs.
- **Mechanism:** mutable provider discovery was treated as immutable connection identity; network/auth failure did not force authoritative rediscovery.
- **Impact:** persisted/live truth existed but UI remained stale indefinitely.
- **Historical mitigation:** reread discovery on poll/reconnect; invalidate cached connection on network/timeout/auth failure.
- **AWP relevance:** client/provider projections need revision/gap/reconnect semantics; transport endpoints are not domain identity.

### OD-022 — Release cutter produced incomplete/broken engine artifacts

- **Severity:** critical
- **Primary class:** CI / artifact integrity / deployment
- **Evidence:** Codex prompts `019fadf0-7211-75e0-b98d-95aa5c3df482` and `019fadf6-8889-7f81-a4bb-0dd5c8598a76`, 2026-07-29.
- **Occurrence:** release bundles 0.1.85/0.1.86 omitted required runtime directories including `bin/runplan` because packaging used a stale hardcoded subset. `CURRENT` was rolled back to 0.1.84.
- **Mechanism:** packaging did not validate artifact completeness against an authoritative manifest/runtime smoke check before activation.
- **Impact:** successful source delivery activated an unusable runtime artifact.
- **Historical mitigation:** authoritative manifest plus pre-activation bundle validation; rollback kept prior known-good current.
- **AWP relevance:** exact Artifact digest/provenance alone is insufficient unless required contents/entrypoints are verified before promotion.

### OD-023 — Journal sequence reset after reopen

- **Severity:** high
- **Primary class:** Persistence / event ordering / crash recovery
- **Evidence:** Codex prompt `019fae86-294f-7882-9b70-3106f08a8138`, 2026-07-29.
- **Occurrence:** v2 journal writer restarted sequence numbering when an existing journal was reopened. A newer monotonicity check correctly aborted the run when sequence regressed.
- **Mechanism:** writer state was process-local rather than reconstructed from durable tail; reopen/crash recovery path violated event-order invariant.
- **Impact:** otherwise valid resumed run aborted; projections could not trust ordering.
- **Historical mitigation:** recover sequence from last parseable durable record and tolerate torn trailing line without reusing sequence IDs.
- **AWP relevance:** durable event/outbox sequences and consumers require restart monotonicity tests.

### OD-024 — Deployed runtime remained on stale release after newer source landed

- **Severity:** high
- **Primary class:** Deployment / runtime provenance
- **Evidence:** Codex prompt `019fb1c7-0a43-7b63-a9d3-c9ce0e0dace5`, 2026-07-30; related TUI/control-API acceptance prompts.
- **Occurrence:** source/release 0.1.100 landed while active control API remained on 0.1.99; later acceptance had to verify the actual process executable/version rather than infer deployment from Git state.
- **Mechanism:** landing/release/deploy/activation were distinct transitions but status could imply completion before runtime identity converged.
- **Impact:** tests/UI could target a different implementation than the one believed deployed.
- **Historical mitigation:** explicit installed/runtime version proof after activation.
- **AWP relevance:** Deployment completion must bind observed runtime/artifact identity, not source commit alone.

### OD-025 — UI collapsed rich failure evidence into generic/blank state

- **Severity:** high
- **Primary class:** Observability / UX projection
- **Evidence:** Codex prompts `019fb113-e30f-78a0-b3a9-30a796c7e230`, `019fb144-68ed-7d70-b740-9e3956a468b0`, `019fb17f-5556-7e13-a7af-239b9f7fa73d`, 2026-07-30.
- **Occurrence:** TUI showed generic `ERROR`, blank failure/attempt fields, and “No events yet” while persisted journal/API contained exact failure class, cause, retries and events.
- **Mechanism:** projection/schema path dropped nested fields and/or consumed stale endpoint behavior; UI treated missing projection fields as if source evidence did not exist.
- **Impact:** operator could not distinguish product failure, timeout, no-op/already-done, or infrastructure failure.
- **Historical mitigation:** typed projection preserving nested failure data, explicit malformed/absent states, live PTY acceptance.
- **AWP relevance:** Lane D must prove important failure evidence survives domain → transport → UI without synthetic/generic collapse.

### OD-026 — Consumer implemented against producer contract that did not exist

- **Severity:** high
- **Primary class:** Architecture / ownership boundary
- **Evidence:** Codex prompt `019f73cb-43a6-79d2-a6d7-0a6fae866466`, 2026-07-18.
- **Occurrence:** Overdeck offload adapter was built to consume a controller `/status` + metrics seam that had never been implemented by the producer.
- **Mechanism:** cross-component interface was assumed independently by consumer work rather than versioned/verified as a shared contract.
- **Impact:** implementation could pass local assumptions yet have no viable production integration.
- **Historical mitigation:** author shared producer/consumer spec and adversarial seam review before further implementation.
- **AWP relevance:** provider adapters need contract tests/fakes representing real supported seams; architecture tests alone cannot prove provider capability exists.

### OD-027 — Recovery classified successful/no-diff tasks as blocked

- **Severity:** high
- **Primary class:** State reconciliation / verification semantics
- **Evidence:** Codex prompt `019fb0fa-caeb-7773-a522-e2b4e6f3d32d`, 2026-07-30.
- **Occurrence:** several tasks had successful gates or already-landed work but ended `blocked empty-diff`; a timed-out task used a different timeout contract than its wrapper and did not reach expected fallback behavior.
- **Mechanism:** task completion was inferred from local diff/process outcome rather than reconciling intended outcome, existing source state and verification evidence.
- **Impact:** false failures and unnecessary retry/correction work.
- **Historical mitigation:** distinguish already-satisfied/no-op from missing output; align timeout/fallback contracts.
- **AWP relevance:** Agent process exit/diff is not Task completion; current AWP spec already states this and needs executable cases.

### OD-028 — Output filtering hid a 3,840-file destructive diff

- **Severity:** critical near-miss
- **Primary class:** Git / observability / destructive safety
- **Evidence:** original Claude transcript `f7206ccd-6b70-4951-aca7-740f2f4cab41`, 2026-08-15T04:10:29Z.
- **Occurrence:** a worktree was partially destroyed while being created; missing files appeared to Git as deletions. An output-shortening filter hid the scale and a 3,840-file deletion commit was created blindly. A separate file-count check caught it before landing.
- **Mechanism:** destructive candidate validation relied on lossy human-facing output instead of structured invariant checks on tree identity/change magnitude.
- **Impact:** near-loss of most repository files if trusted publication had accepted the candidate.
- **Historical mitigation:** file-count/tree validation and clean rebuild.
- **AWP relevance:** trusted publication must validate exact candidate plus policy/invariants from machine-readable data; display truncation can never be a safety control.

### OD-029 — Hidden/inactive plans caused repeated duplicate asks/work

- **Severity:** medium/high operational
- **Primary class:** Human-in-loop / planning state / UX
- **Evidence:** Claude session `f7206ccd-6b70-4951-aca7-740f2f4cab41`, 2026-08-14T06:13Z and later; `docs/plans/2026-08-11-wip-worktree-triage.md` shows the resulting huge recovery surface.
- **Occurrence:** owner repeatedly asked for work already in progress because plan/task status was not globally visible and conversation threads became hard to find. This created duplicate lanes and later WIP triage across hundreds of refs/worktrees.
- **Mechanism:** intent/progress was discoverable only by remembering a thread or waiting for plan docs to land.
- **Impact:** duplicated implementation, conflicting WIP, recovery cost, operator uncertainty.
- **Historical mitigation:** live requests/plan registry with claims/status/last activity.
- **AWP relevance:** durable searchable work identity and current owner/status are product correctness, not cosmetic UX.

### OD-030 — Recovery automation could amplify the incident

- **Severity:** high
- **Primary class:** Recovery automation / fail-closed ownership
- **Evidence:** `docs/plans/2026-08-12-ask-gpt-xvfb-startup.md`; `docs/plans/2026-08-11-cpu-load-session-sprawl.md`; repeated Claude FIRE reports.
- **Occurrence:** historical remediation required explicit rules against broad process kills, broad socket/temp deletion, age-only cleanup, and repeated blind retries because those approaches had either killed active work or could race replaced identities.
- **Mechanism:** remediation action was chosen from symptom/name/age rather than exact resource identity and verified ownership/postcondition.
- **Impact:** a recovery operation could destroy healthy work or leave the same root cause active.
- **Historical mitigation:** descriptor/generation/cgroup/resource identity binding, exact owned-resource mutation, postcondition proof.
- **AWP relevance:** Incident Resolver recipes must declare applicability, authority, idempotency/reconciliation and postcondition; current AWP target already points this direction.

## Corpus summary

- **Normalized concrete incident occurrences retained:** 30
- **Cross-source duplicates intentionally collapsed:** yes; notably worktree-reaper, CPU, credential and deploy-queue incidents appeared in several sources.
- **Highest-consequence recurring themes:** recoverable WIP destruction, shared/global mutable control state, ambiguous external mutation results, ownership/lock races, runtime/config drift, conversational state loss, and UI/status claims that were weaker than persisted/provider truth.