# I0-E Incident / FIRE Learning Harvest — Progress

## URGENT CROSS-LANE FINDINGS

### U1 — Lane C: result collection can silently lose valid nested Git/WIP

- **Finding:** Overdeck remote execution lost a committed Codex result because repository doctrine told the agent to use `.worktrees/` while result transport excluded `.worktrees`.
- **Evidence:** OD-005; DB `fire-85e1b08b1f122048` (2026-08-16T09:44:29.624Z).
- **Affected lane:** C (Workspace/Kubernetes/DBOS), with A for terminal state semantics.
- **Required invariant/test:** INV-FIRE-002; RT-001.
- **C0/C1 safety:** target AWP durability principle is correct, but any collector that can declare success without detecting excluded recoverable Git state is unsafe. Branch base contains only provider skeleton README, so no implementation proof exists here yet.

### U2 — Lane C/A: destructive cleanup needs generation fencing plus collection proof

- **Finding:** active worktrees were reaped multiple times; one lost Git registration mid-commit; an attached owner session was also killed during remediation.
- **Evidence:** OD-001, OD-002, OD-030; original Claude session `d43a079f-d608-4247-90b3-2b83298de7aa`.
- **Affected lane:** C + A.
- **Required invariant/test:** INV-FIRE-001/006; RT-002/003/030.
- **C0/C1 safety:** specs correctly make cleanup separately observable and WIP durable. Implementation is not safe to converge until stale-generation/destructive-race tests pass.

### U3 — Lane B/A: ambiguous publication success must reconcile before retry

- **Finding:** a historical land reported unreachable/failure after the merge had actually completed, exactly the shape that can cause duplicate mutation on retry.
- **Evidence:** OD-006; Claude owner report on 2026-08-15.
- **Affected lane:** B (GitHub) + A durable operation state.
- **Required invariant/test:** INV-FIRE-004; RT-006/007.
- **C0/C1 safety:** current target specs are safe; provider implementation remains unproven on this branch base.

### U4 — Lane B: mutable provider credential authority must be single-writer

- **Finding:** two independent refresh writers invalidated an OAuth grant; a separate Codex grant design also had multi-host/process mutable copies.
- **Evidence:** OD-007/008; `2026-08-15-systray-claude-token-rotation.md`; `2026-08-17-codex-grant-single-writer.md`.
- **Affected lane:** B.
- **Required invariant/test:** INV-FIRE-005; RT-008/009/016.
- **C0/C1 safety:** AWP domain spec already states the right invariant. This must not remain documentation-only.

### U5 — Lane C/A: process locks/heartbeats are not durable ownership

- **Finding:** inherited ghost lock caused 758 waiters and fork exhaustion; another supervision path emitted heartbeats before exclusive ownership and left inert false-liveness after lock contention.
- **Evidence:** OD-003/019.
- **Affected lane:** C + A.
- **Required invariant/test:** INV-FIRE-006/007; RT-010/011/012.
- **C0/C1 safety:** DBOS is the correct architectural direction, but it must own durable lease/generation semantics rather than wrap an unbounded process lock.

### U6 — Lane D/A: UI must never imply completion beyond authoritative lifecycle state

- **Finding:** enqueue looked shipped while downstream refusal was hidden; rich persisted failure evidence was collapsed into generic/blank UI; historical runs disappeared after restart/quarantine.
- **Evidence:** OD-014/020/025.
- **Affected lane:** D + A (and provider lanes for source evidence).
- **Required invariant/test:** INV-FIRE-009/010/025/026; RT-020/021/023/025/026.
- **C0/C1 safety:** target realtime/read-model specifications are sound; I1 UI must prove projection honesty end-to-end.

### U7 — Lane C: execution eligibility and runtime identity must be exact and preflighted

- **Finding:** reachable hosts repeatedly became unusable because runtime links, versions, images, shims or command-routing policy drifted.
- **Evidence:** OD-011/012; DB incidents `fire-1d6de776299fbf20`, `fire-9d4fa17551cfce65`, `fire-7e0a2234cd22ae61`, `fire-77a71a5d51d1df37`.
- **Affected lane:** C.
- **Required invariant/test:** INV-FIRE-008; RT-013/014/015/016.
- **C0/C1 safety:** MachineCapability/PlacementDecision concepts fit, but “reachable” must never be the eligibility test.

### U8 — Lanes A/B/C: semantic Task completion cannot be inferred from process/diff

- **Finding:** already-satisfied/no-diff work was classified as blocked while other empty-output cases genuinely failed.
- **Evidence:** OD-027.
- **Affected lane:** A plus execution/provider lanes.
- **Required invariant/test:** INV-FIRE-019; RT-034/035.
- **C0/C1 safety:** `factory-execution.md` already states process exit alone is not Task completion; implementation must preserve that distinction.

## Execution state

- Branch: `evidence/i0-e-fire-learning`
- Worktree: `/home/user/Projects/.worktrees/awp-i0-e-fire-learning`
- Branch base / `origin/main` observed at start: `75d80546d78380e7ee317a9df46964d951832ac1`
- Repaired C0 implementation reference supplied by assignment: `114b57a4ad37f9178b9c6309497c39663d4580e9`
- Canonical Overdeck repository inspected read-only: `/home/user/Projects/overdeck`
- Overdeck revision inspected: `8e20a23ea2cab9750d37cb4cff4cafce4d60a6ce`

## Source coverage

### Overdeck docs/index

- `docs/plans/INDEX.md` traversed systematically for FIRE/incident rows.
- 44 FIRE/incident link occurrences found in current index.
- 54 unique FIRE/incident corpus documents after union with incident/FIRE-named docs.
- High-value original incident/planning records read in detail; all 54 structurally traversed.

### Overdeck databases

- Legacy `~/.factory/data/factory.db`: absent on this workstation; not assumed.
- Current stores discovered/read-only: `requests.sqlite`, `events.sqlite`, `incident-mutations.sqlite`, `incident-status.sqlite`, `report-history.sqlite` under `~/.overdeck`.
- `requests.sqlite`: 44 relevant request records systematically inspected.
- Coverage includes all 27 `priority='FIRE'` rows and all 13 `origin='agent-incident'` rows; related request events inspected where present.

### Claude workstation history

- `~/.claude/projects/**`: 230 Overdeck-encoded project dirs, 3,133 JSONL files, ~3.9 GB.
- Broad direct transcript user-role search: 2,887 matching JSONL files; 1,350 main-session candidates after excluding `subagents/` paths.
- `~/.claude/history.jsonl`: 2,669 Overdeck-scoped user rows parsed; 265 unique high-signal incident/failure prompts across 66 sessions.
- Representative critical cases followed into original session JSONL.

### Codex workstation history

- `~/.codex/sessions/**` + `~/.codex/archived_sessions/**`: 373 sessions whose recorded cwd is Overdeck-scoped, ~218 MB.
- 392 `user_message` records parsed; 172 unique high-signal records across 171 sessions.
- Codex messages are primarily supporting execution/failure-contract evidence, not owner-report counts.

### ChatGPT/personal-context history

- Available conversation/personal-context search was attempted/retried.
- It returned a small number of prior summary facts/constraints, but not a systematic original-message incident corpus with stable IDs.
- This limitation is recorded in `README.md` and `OPEN-QUESTIONS.md`; summary-only results are not counted as primary incident occurrences where direct evidence exists.

## Counts

- Structured source records examined for primary counting: **3,159** = 54 docs + 44 DB incident/request rows + 2,669 Claude user-history rows + 392 Codex Overdeck `user_message` rows.
- Additional direct transcript corpus searched: **3,133 Claude JSONL files** (~3.9 GB), with 2,887 broad incident matches; used to ground representative primary records.
- Normalized concrete incident occurrences retained: **30**.
- Unique failure classes: **22**.
- Critical/high recurring classes highlighted: **12**.
- Candidate AWP invariants: **30**.
- Concrete regression/failure-injection scenarios: **40**.
- Proposed I1 blocking subset: **13**.
- Urgent cross-lane findings: **8**.

## High-severity recurring classes

- destructive cleanup without durable WIP/liveness proof;
- shared Git/ref/workspace state contaminating trusted publication;
- ambiguous external mutation without reconciliation;
- multiple mutable credential authorities;
- process lock/ownership divergence;
- unbounded sessions/helpers/waiters;
- runner/cluster execution-profile drift;
- artifact/runtime/source identity divergence;
- historical state tied to ephemeral process/registry;
- UI/status weaker than persisted/provider truth;
- unbounded ambiguous waits;
- delivery acceptance/merge/deploy/activation conflation.

## Evidence files completed

- [x] `docs/evidence/overdeck-fire/README.md`
- [x] `docs/evidence/overdeck-fire/INCIDENT-CATALOG.md`
- [x] `docs/evidence/overdeck-fire/FAILURE-TAXONOMY.md`
- [x] `docs/evidence/overdeck-fire/AWP-LESSONS.md`
- [x] `docs/evidence/overdeck-fire/AWP-INVARIANT-CANDIDATES.md`
- [x] `docs/evidence/overdeck-fire/AWP-REGRESSION-TEST-MATRIX.md`
- [x] `docs/evidence/overdeck-fire/OPEN-QUESTIONS.md`
- [x] `docs/progress/i0-e-fire-learning.md`

## Unresolved evidence / non-blocking questions

- Original historical ChatGPT message corpus was not exposed systematically by available conversation search.
- Exact Lane B/C implementation details are not present on this branch base; provider directories are skeletons, so Lane E cannot verify parallel-lane implementations from this worktree.
- The implementation choice to forbid versus explicitly support nested worktrees inside an isolated Workspace remains open; silent exclusion is not acceptable either way.
- Exact DBOS lease/generation schema and execution-profile attestation fields are owned by implementation lanes.

## Completion state

- **Status:** complete.
- Systematic INDEX/FIRE traversal: complete.
- Systematic database extraction: complete.
- Systematic available historical user-chat/agent-history search: complete within documented ChatGPT-history limitation.
- Deduplication/taxonomy: complete.
- Lessons/invariants/tests: complete.
- Urgent cross-lane findings: surfaced above.
- Evidence/progress commit pushed: `16dfe4aca85a92c95889901c4b7cafd0a6178d6a`.

## Exact next task

- Lane E has no remaining evidence-harvest task. Consuming lanes should implement/ratify the identified invariants and priority tests during convergence.

## Latest pushed commit

- Evidence corpus commit already pushed: `16dfe4aca85a92c95889901c4b7cafd0a6178d6a`.
- This progress-finalization edit is intentionally a subsequent metadata-only commit. Its final self-hash cannot be embedded inside itself; the exact final pushed branch HEAD is reported in the completion response and is verifiable with `git rev-parse origin/evidence/i0-e-fire-learning`.