[convenientlymike]

Problem

A shared lane branch was repeatedly reset --hard origin/main, dropping in-flight slice commits from HEAD (recovered by hand via reflog, 3×). Operator-greenlit hardening so committed work can never be silently lost.

Fix — an auto-backup attic + a pre-reset guard

fleet.sh attic (.fleet/bin/attic.sh, lazy-loaded), installable per repo:

• Auto-backup on commit (post-commit hook → attic backup): writes a GC-proof ref refs/attic/<agent>/<epoch>-<sha> (a reset can't drop it; git gc keeps a ref's commit reachable) and a browsable patch + metadata under the git-common state dir (<state>/commit-attic/<agent>/). <agent> = the fleet session id, else the branch.
• Pre-reset guard (reference-transaction hook → attic guard): BLOCKS a branch rewind that would drop a commit not recoverable from the attic. Passes: a fast-forward, a rewind whose dropped commits are all atticed, and any non-branch ref (incl. refs/attic/* — so backups never self-block). Escape: FLEET_ATTIC_FORCE=1.
• CLI: fleet.sh attic install | list | recover <sha>.
• Doctrine it pairs with: each agent commits to a dedicated per-slice branch; the coordinator integrates via batch-land — never reset a shared branch carrying others' work.

Forcing function — .fleet/bin/selftest-attic.sh (hermetic, wired into CI)

Each guarantee BITES, each with a control that fires:

check	guarantee	control
A1	attic backup makes a ref + patch	—
A2/A3	guard BLOCKS an un-atticed rewind	allows a fast-forward
A4	guard ALLOWS an atticed (recoverable) rewind	FLEET_ATTIC_FORCE=1 escapes
A5	a dropped commit is recoverable (attic recover)	—
A6	ignores non-branch refs (no self-block)	—
A7	install writes both executable hooks	—

Verification

• shellcheck --severity=warning install.sh .fleet/bin/*.sh — clean
• selftest-attic.sh — 9/9, deterministic
• selftest-collateral / selftest-brain-retire / selftest-labels — green (no regression)

🤖 Generated with Claude Code