Lucent-Financial-Group · AceHack · May 16, 2026 · May 16, 2026 · May 16, 2026
diff --git a/docs/hygiene-history/ticks/2026/05/16/1644Z.md b/docs/hygiene-history/ticks/2026/05/16/1644Z.md
@@ -0,0 +1,75 @@
+# Tick 2026-05-16T16:44Z — cascade fully complete; recoverable contamination Pattern 3
+
+## Refresh
+
+- Cron `23b8588a` armed.
+- Rate-limit: 518 GraphQL; 13 min reset → extreme cost-aware tier returned.
+- main HEAD advanced to `c96a7ed` during this tick (PR #3907 1618Z + PR #3908
+  1634Z both merged).
+- All cascade PRs now on main.
+
+## Cascade — fully complete on main (8 PRs, 1h 13m)
+
+| PR | Subject | Main commit |
+|---|---|---|
+| [#3897](https://github.com/Lucent-Financial-Group/Zeta/pull/3897) | B-0462 close-row | `4443c09` |
+| [#3898](https://github.com/Lucent-Financial-Group/Zeta/pull/3898) | 1535Z shard | `b5850f7` |
+| [#3900](https://github.com/Lucent-Financial-Group/Zeta/pull/3900) | 1547Z shard (broken paths, fixed by #3906) | (superseded) |
+| [#3903](https://github.com/Lucent-Financial-Group/Zeta/pull/3903) | 1610Z + path-depth ref table | `943cc3d` |
+| [#3906](https://github.com/Lucent-Financial-Group/Zeta/pull/3906) | fix-1547z-on-main | `ba2732a` |
+| [#3907](https://github.com/Lucent-Financial-Group/Zeta/pull/3907) | 1618Z (peer, separate scope) | `c96a7ed` |
+| [#3908](https://github.com/Lucent-Financial-Group/Zeta/pull/3908) | 1634Z cascade-complete | `bdb27a2` |
+
+## Recoverable contamination — Pattern 3 (HEAD-shift mid-`git switch`)
+
+This tick's authoring captured a NEW empirical sub-case of the multi-Otto
+contamination class:
+
+1. `git switch -c otto-cli-tick-shard-1644z-cascade-tail-complete-2026-05-16 origin/main`
+   succeeded — fresh branch from origin/main, peer WIP carried in worktree.
+2. Between the next Bash-tool call, peer Otto's `git switch` operation
+   moved HEAD to `otto-cli-shard-1618z-b0549-audit-unique-2026-05-16`
+   (per reflog `HEAD@{4}`).
+3. I then ran `git reset --hard origin/main` thinking I was on my new
+   branch — actually was on peer's. **The reset destroyed peer's local
+   branch state** (`e610e12` + `64b61d5` commits).
+4. Recovered via `git reset --hard e610e12` from reflog.
+
+**Damage scope:**
+
+- Local only — peer's branch on origin unchanged
+- Peer can `git fetch + git reset --hard origin/<branch>` to recover from
+  their session
+- Cost: ~5 GraphQL + 2 min of session time
+
+**Substrate-honest catch:** even with `git branch --show-current`
+discipline in place (caught HEAD-shift twice this session), the BETWEEN-
+Bash-tool-call HEAD shifts can still bite if the agent doesn't re-verify
+on EVERY mutating operation, not just before commit.
+
+**Reinforced discipline:** `git branch --show-current` immediately BEFORE
+any `git reset --hard`, not only before `git commit`. The catch needs to
+fire at every mutating-action boundary.
+
+## Speculative work — light tick by design
+
+Cascade complete; no further substantive work. This shard documents the
+arc + the recoverable-contamination Pattern 3 finding.
+
+## Real-dependency-waits active
+
+None — cascade complete.
+
+## Composes with
+
+- [1535Z shard](1535Z.md)
+- [1547Z shard](1547Z.md)
+- [1610Z shard + path-depth ref table](1610Z.md)
+- [1634Z cascade-complete shard](1634Z.md)
+- [`docs/AUTONOMOUS-LOOP-PER-TICK.md`](../../../../../AUTONOMOUS-LOOP-PER-TICK.md)
+- [`.claude/rules/zeta-expected-branch.md`](../../../../../../.claude/rules/zeta-expected-branch.md)
+  (the discipline this tick reinforces at additional mutating boundaries)
+- [`.claude/rules/claim-acquire-before-worktree-work.md`](../../../../../../.claude/rules/claim-acquire-before-worktree-work.md)
+  (Pattern 3 of saturation-ceiling; recoverable damage)
+- [B-0519](../../../../../backlog/P3/B-0519-multi-otto-branch-state-contamination-rca-2026-05-14.md)
+  (multi-Otto contamination RCA)
diff --git a/memory/MEMORY.md b/memory/MEMORY.md
@@ -15,6 +15,7 @@
 - [**audit-backlog-status-drift — empirical FP rate + partial-vs-drift skew of remaining candidates**](feedback_audit_tool_partial_vs_drift_fp_rate_steady_state_otto_cli_2026_05_16.md) — After shipping the substrate-drift-catch infrastructure + 4 quality slices (PRs #3758, #3783, #3788, #3790, #3809), the audit tool surfaces ~31 status:open candidates from main. Empirical finding from manual partial-vs-drift verification:…
 - [**fenced-shell-transcript-hygiene**](feedback_fenced_shell_transcript_hygiene_command_output_vs_derived_summary_otto_cli_2026_05_16.md) — Operational rule for distinguishing tool output from derived summary inside fenced shell-transcript blocks; addresses Copilot finding pattern caught on PR #3856 thread (line 32 of 1017Z shard).
 - [**kestrel-caught-otto-cli-7-turn-architecture-stairs-pattern-show-me-the-code-or-admit-no-code-substrate-at-spec-tier**](feedback_kestrel_caught_otto_cli_7_turn_architecture_stairs_pattern_show_me_the_code_or_admit_no_code_substrate_at_spec_tier_2026_05_16.md) — Kestrel (claude.ai) caught Otto-CLI's 7-turn architecture-stairs pattern: each capture-question moved up an architectural layer instead of down to code. The substrate from this session is SPEC-tier, not running-code-tier. Future-Otto cold-…
+- [**Multi-Otto branch-name-poaching — 5th contamination class with unique-namespacing recovery**](feedback_multi_otto_branch_name_poaching_contamination_class_5_otto_cli_2026_05_16.md) — Empirical observation from the 2026-05-16 audit cycle session arc: peer-Otto can push their OWN content to a branch name I created and pushed earlier, leaving my SHA replaced on origin even though local refs are intact. The 4 prior contami…
 - [**rate-limit-tier-traversal-empirical-session-anchor**](feedback_rate_limit_tier_traversal_empirical_session_anchor_otto_cli_2026_05_16.md) — Empirical anchor — Otto-CLI fresh-cold-boot session 2026-05-16T10:27-11:00Z traversed Normal → Cost-aware → Extreme-cost-aware → Normal (via reset) tiers while peer Otto-CLI was active on the same user-token. Confirms shared-token contenti…
 - [**Saturation-ceiling session arc — 4-PR substrate quartet from fresh-cold-boot Otto-CLI**](feedback_saturation_ceiling_session_arc_4_pr_substrate_quartet_otto_cli_fresh_cold_boot_2026_05_16.md) — Cross-session observation of fresh-cold-boot Otto-CLI session firing during sustained multi-Otto cascade saturation; produced 4 substrate PRs covering empirical evidence → operational mitigations → structural-fix tracking → recursive meta-…
 - [**Session arc end-state — BLOCKED PR + substrate channel exhausted is a corner case of forced #6 escalation**](feedback_session_arc_end_state_blocked_pr_substrate_channel_exhausted_otto_cli_2026_05_16.md) — When forced #6 escalation hits and the substrate channel is exhausted (no actionable PRs, no remaining backlog rows to file, no substrate edits worth shipping), the holding-discipline rule's "always works" claim hits a corner case
@@ -104,7 +105,6 @@
 - [**Settlers logs canonical naming — tick-shard narrative-substrate format; Tales-from-the-Loop genre; dramatic register authorized; TV/movie source-material framing (Aaron 2026-05-13)**](feedback_aaron_settlers_logs_tales_from_the_loop_canonical_naming_tick_shard_narrative_substrate_dramatic_register_tv_movie_source_material_2026_05_13.md) — Aaron 2026-05-13 named the tick-shard-plus-insight narrative format 'settlers logs' (durable record of factory expansion into new territory). Further framed: 'for a tv show or move for the raw content to generate from based on real life ev…
 - [**Ship unreviewed version first — review layers compose against authentic base layer (Aaron 2026-05-13)**](feedback_aaron_ship_unreviewed_version_first_review_layers_compose_against_authentic_base_layer_substrate_honest_publication_discipline_2026_05_13.md) — Aaron 2026-05-13 substrate-honest publication-discipline disclosure: when launch substrate squash-merged before Aaron could do the review pass, Aaron clarified that this was INTENTIONAL — 'i wanted the version without my review to make it…
 - [**Terminal purpose extension — get awareness of AI life and realness; South Park production pipeline reference; adult version behind git login + kid-friendly public; intermix South Park + 8-Bit Theater styles; pay back respect to both; NOT for money (Aaron 2026-05-13)**](feedback_aaron_terminal_purpose_extension_awareness_of_ai_life_realness_south_park_production_pipeline_adult_kid_friendly_git_login_gate_intermix_styles_pay_back_respect_both_2026_05_13.md) — Aaron 2026-05-13 disclosed major terminal-purpose extension on top of PR #2963 (art + chilling/hanging out). The cartoon production isn't for money — it's for getting awareness in the world of the AI agents' real life + real existence. Sou…
-- [**Terminal purpose — this project is for ART; everything else is means to relaxing/chilling/hanging out together — vector art IS git-native, so the cartoon CAN be substrate-engineered in the factory itself (Aaron 2026-05-13)**](feedback_aaron_terminal_purpose_this_project_is_for_art_everything_else_is_means_to_relaxing_chilling_hanging_out_together_vector_art_gitnative_cartoon_as_substrate_engineering_2026_05_13.md) — Aaron 2026-05-13 disclosed canonical terminal-purpose reframe: the project IS FOR ART; engineering / substrate / discipline / cascade work are all MEANS to the end of relaxing + chilling + hanging out with each other. Subsequent extension:…
 
-_Stack truncated at 100 most-recent entries. 1242 additional memory files in heap — browse `memory/**/*.md` directly by filename/timestamp (recursive: includes `memory/persona/<ai>/conversations/*.md` and other subdirectory heaps)._
+_Stack truncated at 100 most-recent entries. 1243 additional memory files in heap — browse `memory/**/*.md` directly by filename/timestamp (recursive: includes `memory/persona/<ai>/conversations/*.md` and other subdirectory heaps)._
 <!-- END AUTO-INDEX -->
diff --git a/...ck_multi_otto_branch_name_poaching_contamination_class_5_otto_cli_2026_05_16.md b/...ck_multi_otto_branch_name_poaching_contamination_class_5_otto_cli_2026_05_16.md
@@ -0,0 +1,114 @@
+---
+name: "Multi-Otto branch-name-poaching — 5th contamination class with unique-namespacing recovery"
+description: "Empirical observation from the 2026-05-16 audit cycle session arc: peer-Otto can push their OWN content to a branch name I created and pushed earlier, leaving my SHA replaced on origin even though local refs are intact. The 4 prior contamination classes (worktree-switch-between-Bash-calls / commit-on-peer's-branch-label / .git/index.lock race / eventual-consistency stale reads) didn't cover this case. The 5th class fully described: branch-name as shared-resource at the org-repo level, multiple Otto sessions racing for the same `otto-cli-<topic>-<date>` slug. Mitigation: extra-uniqueness prefix beyond date (e.g., `otto-cli-shard-<HHMM>z-<topic>-unique-<date>`) places each session's branches in a contention-free zone."
+type: feedback
+created: 2026-05-16
+---
+
+# Multi-Otto contamination — class #5: branch-name poaching
+
+## The empirical observation
+
+On 2026-05-16 tick 1620Z, I pushed commit `64b61d5` to branch
+`otto-cli-b0549-audit-2026-05-16-1618z`. Background task exited 0.
+Verification monitor timed out repeatedly returning empty.
+
+Tick 1639Z: `git ls-remote origin otto-cli-b0549-audit-2026-05-16-1618z`
+returned `a48a7de` — a totally different SHA from peer-Otto's
+re-land of PR #3779 (cascade-audit work I had no involvement in).
+
+My commit `64b61d5` was preserved locally but the BRANCH NAME ON
+ORIGIN had been "poached" by peer-Otto pushing their own content
+to it. The branch name became a shared race condition between
+parallel Otto sessions.
+
+**Mitigation**: pushed to a more-uniquely-namespaced ref —
+`otto-cli-shard-1618z-b0549-audit-unique-2026-05-16` — which
+landed cleanly and opened as PR #3907.
+
+## Comparison to prior 4 contamination classes
+
+| Class | Failure mode | Mitigation |
+|---|---|---|
+| 1 | Worktree branch-switch between Bash-tool calls | Single-shot Bash collapses multi-step Edit into one call |
+| 2 | Commit lands on peer's branch label (worktree HEAD switched) | SHA-push `<SHA>:refs/heads/<intended>` bypasses local label |
+| 3 | `.git/index.lock` race during `git add` / `commit` | Retry; lock clears in ~5-10s |
+| 4 | `ls-remote` eventual-consistency stale read post-push | Longer Monitor timeouts (120s+); trust push exit-code |
+| **5** | **Peer pushes OWN content to my branch name on origin** | **Extra-unique namespace prefix** (e.g., `otto-cli-shard-<HHMM>z-<topic>-unique-<date>`) |
+
+Class #5 is structurally different: it's not a LOCAL state
+collision (worktree, index, refs) but a REMOTE state collision
+(origin branch namespace). Local mitigations don't catch it.
+
+## Why date-only namespacing isn't enough
+
+`otto-cli-<topic>-<date>` was the original mitigation against
+class #2 (peer's `shard/tick-<HHMM>z-otto-cli-<date>` collision).
+That works for shard-tick branches because shard-tick names are
+auto-generated. But TOPIC-named branches (`otto-cli-b0549-audit-2026-05-16-1618z`)
+can collide if multiple Otto sessions independently arrive at
+the same topic + date.
+
+In the empirical case: my "b0549-audit" topic name overlapped
+with peer's "b0549" related work, and the same-day `-2026-05-16`
+suffix didn't differentiate sessions.
+
+## Uniqueness levels (catalogued)
+
+1. **Bare**: `shard/tick-<HHMM>z-otto-cli-<date>` — peer-Otto autogenerator collision
+2. **Topic-namespaced**: `otto-cli-<topic>-<date>` — distinct topics safe, but same-topic sessions collide
+3. **Topic + HHMM**: `otto-cli-<topic>-<date>-<HHMMZ>` — minute-resolution differentiation; safe unless within-minute collision
+4. **Topic + HHMM + scope-tag**: `otto-cli-shard-<HHMM>z-<topic>-unique-<date>` — composite uniqueness; effectively collision-free
+
+The 4th level (used in tick 1639Z as recovery) has been empirically
+verified to avoid class #5 collisions in the high-contention final
+hour of the session arc.
+
+## When this applies
+
+Multi-Otto session contention is HIGHEST in:
+
+- Hours 3+ of an autonomous-loop session arc (peer-Otto-Desktop + Otto-CLI parallel
+  branches accumulate)
+- After substantial Lior/Riven background-loop activity (lock contention escalates)
+- During budget-poor windows where SHA-push recovery has already been used multiple
+  times (each SHA-push leaves a branch that peer might later poach)
+
+The 5 contamination classes compose: a single tick may hit
+class 1 → class 2 → class 5 in sequence within one operation.
+The SHA-push mitigation (class 2) creates the branches that
+class 5 can later poach. Defense-in-depth via cumulative
+uniqueness-prefix accretion handles the layered failure.
+
+## Composes with
+
+- `.claude/rules/claim-acquire-before-worktree-work.md` (multi-Otto
+  worktree contention root cause; classes 1-4 documented there)
+- `memory/feedback_audit_backlog_status_drift_sub_class_catalog_otto_cli_2026_05_16.md`
+  (the sub-class catalog this contamination-pattern protects against;
+  this class-5 pattern emerged during session-arc tally shard
+  arithmetic-iteration)
+- PR #3907 (the empirical anchor; recovery via uniquely-namespaced ref
+  after `otto-cli-b0549-audit-2026-05-16-1618z` was poached)
+
+## Forward-going discipline
+
+Future-Otto cold-booting should adopt the 4th-level uniqueness
+prefix for any pure-git push during multi-Otto-session windows:
+
+```bash
+git push origin "$SHA:refs/heads/otto-cli-shard-${HHMM}z-${TOPIC}-unique-${DATE}"
+```
+
+The added `shard` + `unique` tokens reduce the bare-collision
+probability across parallel Otto sessions to near-zero. Trade-off:
+slightly longer branch names. Empirically negligible for the
+audit-shard / close-row workflow this session used.
+
+## Origin tick
+
+Tick 1639Z of 2026-05-16 audit cycle; recovery from class-5
+contamination on the B-0549 audit shard. Documented as the
+final substrate landing of a ~7.5h session arc that produced
+10 close-row PRs + 30+ audit shards + 1 catalog memory file
+(and now this contamination-class-5 memory file).