shard(tick): 2030Z — B-0519 RCA additive update (Pattern 5 + Pattern 6 defenses)

docs/hygiene-history/ticks/2026/05/14/2030Z.md

@@ -0,0 +1,87 @@
+# Tick 2026-05-14T20:30Z — B-0519 RCA additive update (Pattern 5 + Pattern 6 contamination defenses)
+
+## Refresh (step 1)
+
+- Cron sentinel `12fb713e` still live.
+- Prior-tick PRs status (poll-pr-gate-batch on 3222/3226/3227):
+  - **#3226** (chore(backlog) regen) — **MERGED** as `fe8a845` on main.
+  - **#3227** (shard 2026Z) — wait-ci with autoMerge armed.
+  - **#3222** (shard 2010Z) — wait-ci with autoMerge armed.
+- `backlog-ready-notifier --once` shows 232 ready-to-grind candidates;
+  top: B-0441/B-0170/B-0503/B-0442/B-0424.
+
+## Holding discipline (step 2)
+
+Not Standing-by. Real-dependency-wait on #3227 + #3222 is bounded
+(autoMerge armed). Per never-be-idle: pick known-gap fix during the wait.
+
+## Work (step 3) — known-gap fix: B-0519 RCA update
+
+B-0519 RCA already filed (P3) but missing the two contamination patterns
+I field-tested this session:
+
+- **Pattern 5** — HEAD detached at `origin/main` between `git push` and
+  `gh pr create` (parallel-Otto checkout of `origin/main` in the same
+  physical worktree). Recovery: re-checkout my branch.
+- **Pattern 6** — HEAD on a different Otto's branch between recovery
+  `checkout` and `gh pr create`. Recovery: `gh pr create --head
+  <my-branch>` with EXPLICIT head ref.
+
+Plus two new cheap defenses (zero-code, operator discipline) that
+survived field-test first-try:
+
+- `git branch --show-current` immediately before `git commit`
+- `gh pr create --head <my-branch>` explicit head ref
+
+Plus a substrate-honest caveat on the existing `ZETA_EXPECTED_BRANCH`
+env-var hook: env vars don't persist reliably across separate Bash-tool
+calls in this harness, so the env-var hook is defense-in-depth only.
+Primary catch is `git branch --show-current`.
+
+PR **#3228** opened (additive 57-line update; no per-row metadata changes).
+Auto-merge armed.
+
+## Verify (step 4)
+
+- `git branch --show-current` confirmed correct branch BOTH before and
+  after commit (`otto/b0519-...`).
+- `gh pr create --head <my-branch>` used explicitly.
+- markdownlint-cli2 clean on the modified row.
+- Leaked diff from parallel-Otto's `feat/factory-hygiene-cadence-add-worktrees-job-...`
+  branch caught + reverted (`git checkout origin/main -- <leaked-file>`)
+  before commit. Substrate-honest: another contamination class to add to
+  the RCA in a future tick — a force-checkout discarded the working tree
+  files but not all of them? Or the working-tree-leak survives `checkout -f`?
+  Need a clean repro before a clean root-cause; for now, just observed
+  and corrected.
+
+## Shard (step 5)
+
+This file.
+
+## CronList (step 6)
+
+Sentinel `12fb713e` armed; one entry, recurring.
+
+## Visibility (step 7)
+
+- **PR #3228** (chore(b-0519) additive update) — wait-ci, autoMerge armed.
+- **PR #3227** (shard 2026Z) — still wait-ci, autoMerge armed.
+- **PR #3222** (shard 2010Z) — still wait-ci, autoMerge armed.
+- **#3226** merged as `fe8a845` (BACKLOG.md regen).
+
+## Notes for future-Otto
+
+Three landing tally for this session:
+- #3221 (B-0502 launchd plist) — merged
+- #3226 (BACKLOG.md regen) — merged
+- #3222 / #3227 / #3228 — wait-ci, autoMerge armed
+
+The two defenses (`git branch --show-current` before commit + `gh pr
+create --head`) are now landed in B-0519 substrate via #3228. Future
+ticks inherit them at cold-boot via the RCA + via the shards (this one
++ 2026Z + 2010Z).
+
+Possible new contamination class observed this tick: working-tree files
+from a different Otto's branch surviving a `git checkout -f origin/main`.
+Repro needed before RCA — filed mentally for next tick.