# Runtime and Session Safety

audience: AI coding agents first.

status: IDLE
worker: none
task IDs: #23 (DONE), #41, #148, #164, #169, #172, #178 (DONE)
source request: Keep live runtime stable, prevent worktrees from rewriting it, make sessions attachable/recoverable, restore UI availability, and never kill owner sessions.

## Outcome

Runtime loads one landed/deployed provenance; no protected path points into `.worktrees`; agent sessions are attachable and recoverable; UI stays available; kill/recovery operates on exact cgroups only.

## Preserved WIP

- #178 frozen source remains inspection-only at `/home/user/Projects/overdeck/.worktrees/runtime-provenance-guard` (`0bfcbad15fc9ca8cecf6c3a7bcf9e3d601505d49`; preservation ref `refs/recovery/wip-triage/20260811T061444Z/worktree-head/runtime-provenance-guard-refs-heads-wt-runtime-provenance-guard-bb448ed9e6`). Its provenance intent is superseded by landed commit `4ba0589e8` on current `origin/main`; no source recovery is required.
- Live `~/.claude/hooks` resolves into the standalone immutable deploy clone under `~/.local/share/overdeck/deploy`, not a worktree.
- #169 `task169-release-controller` WIP preserved. Prior local red used PATH-shimmed `sleep`; environment-invalid.
- #41/#148 attachability candidate refs conflict: `c6bc60ddd`, `2b27753b`; preserve until superset proven.
- #164 Ctrl+T recovered-task visibility remains open.
- #172 must use exact cgroup evidence; never process-name kills.

## Acceptance criteria

- Protected runtime paths resolve only to deployed/landed source.
- Runtime revision is inspectable and singular.
- Every agent session has attach target and survives UI navigation.
- Ctrl+T exposes recovered work.
- UI health remains available through restart/redeploy.
- Owner `human.slice` sessions are never killed by automation.
- `cld-human` launches the intended unsafe human CLI mode automatically, while fail-closing when invoked from agent runtime.
- Overdeck-owned runtime/state lives under `~/.overdeck/` or `~/Projects/overdeck/`; reconcile existing scattered paths incrementally instead of creating more `~/.claude` islands.

## Execution steps

1. Treat #178 source recovery as complete: current main already contains the equivalent or stronger guard.
2. Reconcile attachability refs; choose verified superset.
3. Repair Ctrl+T visibility on same session model.
4. Verify UI remotely and through browser wrapper.
5. Land/deploy each independent item immediately.

## Current receipt

#178 recovery inspection found no missing source behavior. Frozen `0bfcbad15` and current main expose the same guard and call seam; current main is stronger only by using absolute `/usr/bin/git`. Both enforce deploy-clone identity, standalone Git metadata, rejection of linked worktrees, a clean checkout, and `HEAD == origin/main`. The implementation landed originally in `4ba0589e8`; reconciliation landed and deployed at `c5d071c60`. `bash tests/os/deckctl-sync.test.sh` passes 60/60. Installed proof: worktree `deckctl` refused deploy-sourced `claude:hooks`; deploy-clone `deckctl` accepted the same sync; live `~/.claude/hooks` resolves to `~/.local/share/overdeck/deploy`; deploy clone `HEAD` equals `origin/main`. No production source changed. Deployment emitted pre-existing `shim-drift(copy)` hazards for unrelated frozen carriers; live shims match `origin/main`, so task #23 neither caused nor concealed that separate WIP.

Retirement recommendation: frozen source `/home/user/Projects/overdeck/.worktrees/runtime-provenance-guard` is superseded and eligible for a separately approved retirement pass. Preserve it and its recovery ref unchanged until that gate; do not delete it as part of task #23.

## Next executable action

Task #23 is complete. The next unclaimed runtime-safety work is attachability-ref reconciliation; frozen-source retirement remains separately gated.