# Source summary — Prune Data-Loss (four-gate isolation)

Provenance trail for every artifact in this package. Internal repository paths establish provenance for
review; they are not themselves public links.

| Published artifact | Derived from (internal source) | Sanitization |
| --- | --- | --- |
| `artifacts/four-gate-contract.md` | `system/_operator/docs/CLOSE_PROMOTE_DEPLOY_CONTRACT.md § 1` (I75–I78) + the four gate-script headers `system/_operator/scripts/{close,promote,prune,deploy}-session.mjs` | none required (framework orchestration logic / fleet contract) |
| `artifacts/prune-exit-codes.md` | `system/_operator/scripts/prune-session.mjs` (EXIT map ~L74–84; reachability HALTs ~L443–461 and ~L584–600) | none required (framework orchestration logic) |
| `artifacts/c112-contract.md` | `system/caliber/lib/c112-four-gate-prune-isolation.mjs` (header) + `system/caliber/docs/CRITERIA.md § Criterion 112` (~L4003) | none required (scanner logic / criterion doc) |
| `artifacts/incident-sequence.md` | `system/_operator/plans/2026-05-13-promote-session-resilience-push-before-prune.md` (Objective ~L76, Defect D1 ~L92, failure narrative ~L96) | internal identifiers `apps/rentos-canary`, `cc1fc8a`, `202cec2` retained (load-bearing, non-sensitive); raw git history not published |

## Chain of causation (from the incident to the control)

1. **Cure v2 blind-benchmark contamination-barrier work** authored canary commit `cc1fc8a` on a
   **non-`main` branch inside the `apps/rentos-canary` submodule**.
2. Close-time detection (`git diff --submodule=short forkPoint..HEAD`) either missed the entry or lacked
   the `branch` metadata the push step needed → `cc1fc8a` was **never pushed** to any submodule origin.
3. Promote's `execute` step recorded **no push failure** for the unpublished SHA and returned
   `EXIT.SUCCESS` (0); it can also return `EXIT.PARTIAL_SUCCESS` (21).
4. The **buried "Step 5.5" prune** ran `git worktree remove --force` + `git branch -d` on any exit in
   `{SUCCESS, PARTIAL_SUCCESS}`, labelling failures **"NON-FATAL"** with a WARN + "Manual cleanup:"
   line and exiting 0 → worktree removed, branch deleted, `cc1fc8a` **unreachable**. Recovery:
   hand-reconstruct as `202cec2`, re-advance the gitlink.
5. **Remedy (plan `2026-05-13-…`):** three structural defects named (D1 prune-on-PARTIAL_SUCCESS,
   D2 prune-buried-in-promote, D3 prune-failures-non-fatal); prune promoted to its **own fourth gate**
   `prune-session.mjs`; **push-before-prune** made binding (promote must not spawn prune on Exit 21 or
   when reachability is false); every prune failure mode made **fail-closed** with a named exit code
   (30/31/32/33) + sidecar; ambiguous `.gitmodules` reachability made a **HALT** (exit 33).
6. **Made mechanical:** Caliber **C112 (Four-Gate Prune-Boundary Isolation)** — Critical, 2pt,
   Engineering family, **no bootstrap grace, no kill switch** — audits five dimensions (A–E) that keep
   destructive tokens out of promote, keep prune fail-closed, and forbid the "non-fatal / best-effort /
   Manual cleanup" framing that made the incident possible.

## Internal-only companions (not published here)

- The raw incident git history — destroyed commit `cc1fc8a`, recovery `202cec2`, gitlink re-advance
  `7c3205f` / `11faae1` / `cf2afd5` — `apps/rentos-canary` submodule + monorepo root history.
- The owner plan's full 13-section body (only Objective + Defects D1–D3 + failure narrative are excerpted
  here).

**Reviewer:** FoundryOS operator · **Review date:** 2026-08-02