proposal: start V1R4C4 SR-01 Gitea branch sync fix

docs/proposals/V1R4C4-SR01-gitea-branch-sync-fix.md

@@ -0,0 +1,131 @@
+# V1R4C4 SR-01: Gitea Branch Sync Fix
+
+Status: started
+
+Priority: P0
+
+Risk: medium
+
+Baseline dependency: V1R4C3
+
+## Decision
+
+Start V1R4C4 with SR-01 only.
+
+SR-04 Portal AIOS Integration Merge remains deferred and is not part of this execution scope.
+
+## Background
+
+V1R4C3 completed the immediate branch_sync mitigation by changing branch synchronization to use `git ls-remote` instead of depending on the Gitea branch API pagination path.
+
+That mitigation avoids the user-visible failure path, but it does not fully certify or eliminate the root reliability issue:
+
+```text
+bare repository refs
+        !=
+Gitea branch metadata / DB index
+        !=
+Gitea branch API visible state
+```
+
+SR-01 exists to validate and fix the root problem category: Gitea branch metadata/index drift from the bare repository state.
+
+## Scope
+
+SR-01 includes:
+
+1. Confirm current branch_sync no longer depends on Gitea API pagination.
+2. Validate that Gitea DB branch metadata is consistent with bare repository refs.
+3. Add or activate consistency verification around branch metadata drift.
+4. Ensure autonomous operations do not continue mutating state when drift is detected.
+5. Produce a repeatable acceptance test for future incidents.
+
+SR-01 excludes:
+
+- Portal AIOS Integration Merge.
+- Search Gateway real provider binding.
+- Broad P1 capability merges.
+- Bulk patch merge or branch deletion.
+
+## Required Checks
+
+### Branch sync path
+
+Verify branch_sync source of truth:
+
+```text
+git ls-remote / bare repository refs
+```
+
+The Gitea branch API must not be the mandatory source of truth for synchronization.
+
+### Gitea consistency path
+
+Verify equality between:
+
+```text
+bare repository refs count
+Gitea branch live metadata count
+Gitea branch API paginated visible count
+```
+
+Any mismatch must be treated as reliability drift.
+
+### Safe-mode behavior
+
+When drift is detected:
+
+1. Stop autonomous mutations.
+2. Preserve read-only diagnostics.
+3. Emit safe-mode marker.
+4. Require controlled recovery before mutation resumes.
+
+## Acceptance Criteria
+
+SR-01 is complete when all of the following are true:
+
+1. branch_sync continues to work without Gitea branch API pagination dependency.
+2. Gitea branch metadata drift can be detected deterministically.
+3. Drift causes autonomous safe mode instead of continued mutation.
+4. Recovery procedure includes minimal repair, not default restart.
+5. Runtime acceptance passes:
+
+```text
+getRuntimeStatus
+    ->
+getBaseline
+    ->
+createBranch
+    ->
+createPatch
+```
+
+Expected results:
+
+- runtime status is active;
+- baseline reads V1R4C3 or later;
+- createBranch returns commit/rev/sync status;
+- createPatch returns commit/rev/sync status.
+
+## Execution Order
+
+1. Open SR-01 patch branch.
+2. Review V1R4C3 branch_sync behavior.
+3. Integrate Gitea branch consistency sentinel and safe-mode gate.
+4. Run runtime acceptance.
+5. If clean, prepare V1R4C4 reliability baseline proposal.
+
+## Follow-on Gates
+
+SR-02 Watcher State Cleanup may start after SR-01 acceptance is green.
+
+SR-03 Search Gateway Real Provider Binding may start after SR-01 confirms GitOps/Gitea reliability is stable enough for non-P0 work.
+
+SR-04 Portal AIOS Integration Merge remains deferred pending explicit approval.
+
+## Safety Rules
+
+- Do not bulk merge old patches.
+- Do not delete remote branches during SR-01 unless the branch consistency sentinel is already deployed and healthy.
+- Do not restart Gitea unless process-level failure is proven.
+- Do not modify Gitea DB without backup and owner/admin approval.