feat(B-0894): reboot-survival worktree-location discipline — flip default from /private/tmp/ to ~/Documents/src/repos/Zeta/worktrees/

[AceHack]

Operator-named problem

"why are we putting any git stuff in /private/tmp/ this is terrible design"
"we need to survive reboots in any kind of inflight stuff"
— operator 2026-05-28T~04:30Z UTC

Empirical anchor (same restart that triggered the operator's critique)

Worktree location	Outcome on operator's 2026-05-28 restart
/private/tmp/zeta-* (95 instances, per prior rule recommendation)	All 95 pruned — git worktree list returned prunable; on-disk dirs gone
~/Documents/src/repos/Zeta/worktrees/<surface>-* (multiple, Lior + this PR's worktree)	All survived intact
~/.gemini/tmp/project/lior-* (multiple)	All survived intact (user-home is persistent)

The 04:09Z autonomous-loop tick had a substantive commit 4f89af885 on otto-cli/tick-0409z-sentinel-rearm-2026-05-28 with a backgrounded git push in flight when restart hit. Push never completed; branch ref + commit object survived in .git/objects/, but the worktree dir at /private/tmp/zeta-otto-cli-0409z-sentinel-rearm/ was gone post-restart. The /private/tmp/claude-501/<harness-id>/tasks/<task-id>.output background-task output file was also cleared, so couldn't even read whether push completed.

Dogfooding-proof: the worktree authoring this PR (~/Documents/src/repos/Zeta/worktrees/otto-cli-reboot-survival-fix-0434z/) survived the same restart cleanly. Used the new pattern to land the new pattern.

What this PR delivers

1. New backlog row B-0894 (P1) with 5-criteria acceptance + empirical anchor + composes_with B-0750 / B-0530 / B-0858.5
2. agent-worktree-hygiene rule update:
   • Carved sentence: includes reboot-survival as load-bearing invariant
   • Rule 2: default location flipped from /private/tmp/zeta-<task-tag>-<hhmmz>/ to ~/Documents/src/repos/Zeta/worktrees/<surface>-<task-tag>-<hhmmz>/ (per the empirically-validated Lior pattern)
   • New Rule 5: reboot-survival hard invariant + empirical-anchor table + operational discipline (commit immediately for /tmp/ migration; verify push outcome via git ls-remote not output-file)
   • Audit + verify-no-main-held commands updated to scan persistent-location surface

What this PR does NOT deliver (B-0894 sub-rows, follow-up scope)

• Criterion 2 (rest of): claim-acquire rule references to /private/tmp/ are mostly historical empirical anchors (preserved) + a few pedagogical examples (small follow-up PR)
• Criterion 3: bus envelope ZETA_BUS_DIR default migration to ~/.zeta-bus/ (filed as B-0894.1 work)
• Criterion 4: harness-level background-task output is not agent-fixable; document the workaround
• Criterion 5: per-agent persistent worktree-pool primitive (long-term mechanization; filed as B-0894.2 if shipped)

Composes with

• B-0750 (agent worktree cleanup) — sibling at cleanup-discipline scope
• B-0530 (cron-sentinel mutex) — sibling at multi-agent contention scope
• B-0858.5 (heartbeat consent-first state-gather) — sibling at state-persistence scope
• .claude/rules/tick-must-never-stop.md — sentinel session-exit is the harness-level companion to filesystem-level reboot-survival
• All 5 existing Lior ~/Documents/src/repos/Zeta/worktrees/lior-* worktrees — empirical proof the pattern works

Test plan

• B-0894 backlog row authored with substrate-inventory pass + empirical anchor + composes_with
• agent-worktree-hygiene rule edited: carved sentence + Rule 2 + new Rule 5 + audit commands
• Post-commit canary clean (ls-tree=61, matches origin/main)
• Worktree authoring this PR survived the operator's restart (the proof-point this rule names)
• Future autonomous-loop ticks create worktrees at ~/Documents/src/repos/Zeta/worktrees/<surface>-* per the new default (validation by observation)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.