---
name: od-data-safety
description: Data safety incidents — lost work, uncommitted WIP gone, overwrite, retention failure, transcript loss, file sprawl, scatter across worktrees. Triggers on lost work, data loss, deleted, overwritten, backup, uncommitted, discarded, file sprawl. Invoke BEFORE any restore or git write.
---

# Data safety — incident playbook

audience: AI coding agents first. BLUF: stop writes → prove backup exists → restore from artifact → NEVER destructive git in shared checkout.

## Covers

**Absorbs:** `lost-work`, `data-retention`, `file-sprawl`.

**Keywords:** lost work, data loss, deleted, overwritten, wip, retention, backup, transcript, file sprawl, scatter, uncommitted, discarded.

**Registry coverage:** 9 of 217 (2026-08-08). Recurring: `ORPHANED` session (process gone, `finishedAt` null); destructive git in main checkout; work scattered across worktrees without push.

## Doctrine

Stop writes FIRST. Prove backup exists before any restore. Never destructive git in shared checkout.

## First steps — freeze then hunt

1. **Stop writes:** no more edits, commits, `git clean`, branch deletes in affected tree until inventory done.
2. **Session ledger:** `session-recovery --cwd <cwd>` — unclean = SIGKILL mid-turn; transcript may be only truth.
3. **Git recovery:** `git fsck --lost-found`; `git reflog`; stash list; worktree list. Main checkout damage → check `.worktrees/*` for unmerged work.
4. **Transcript:** on-disk jsonl under `~/.claude/projects/**` — search session id; last completed turn boundary.
5. **Backups:** `~/.local/state/overdeck/backups`; pushed `wip/<run-id>` branches (harness salvage-push); remote before local-only assumptions.
6. **File sprawl:** inventory duplicates across worktrees; converge to one canonical path; push branch before deleting stray trees.
7. **Restore only with proof:** name backup source + digest before `git checkout`/`git restore`.

## Never-touch — applies here

From `modules/workstation/claude/incidents/never-touch.md`:

- NEVER write in shared main checkout (`~/Projects/overdeck`) — worktree only.
- NEVER `git restore`/`checkout --`/`reset --hard`/`stash drop` in main checkout — destroys other sessions' work.
- NEVER read `~/stupid.user`.

## Placement map — read these paths

`modules/workstation/claude/incidents/placement-map.md`:

- `~/Projects/overdeck/.worktrees/<slug>` — where safe edits live.
- `~/.local/state/overdeck/backups` — runtime backups.
- `~/.claude/projects/**` — session transcripts.
- Harness run outputs — `wip/<run-id>` on origin (salvage-push).

## Resolve — exact CLI (never guess syntax)

```
od-incidents list [--type data-safety] [--state S]
od-incidents show <id>
od-incidents search <query>
od-incidents resolve <id> --artifact <ref> [--summary <line>]
```

`resolve` REFUSES without `--artifact` (exit 2). Artifact = recovered commit sha, transcript path + line range, or backup verify command output.

## Self-update — MANDATORY

This doc is the fleet's memory. You changed the architecture, wiring, commands, or
doctrine this skill describes — or a live incident just proved a rule here wrong or
missing → EDIT THIS FILE in the same landing as the change. Adopted AND rejected
decisions both go in, with the measured why. An owner reminder to record a lesson is
a failure of this rule, not the trigger for it.