---
name: od-emergency
description: Active Overdeck or workstation incident where owner work is blocked, laptop load is extreme, runtime is broken, or delivery is stalled. Invoke for fire, outage, broken live UI, offload failure, repeated session deaths, or "make it work now". Restores owner usefulness before Git ceremony.
---

# Overdeck emergency response

audience: AI coding agents first. BLUF: restore owner use NOW; Git/full gates last.

Machine frozen, black screen, SSH lockout, or reboot risk → also invoke `/od-recovery`; it owns evidence-before-reboot. This skill owns delivery sequencing and continuity.

## First response — execute immediately

1. Record incident + every requested outcome as tasks. Assign every runnable task an active owner.
2. Measure live failure, load, affected runtime, and last-known-good path. Never infer topology or root cause.
3. Restore proven fallback FIRST. Existing SSH offload beats unfinished k3s; last-known-good release beats a new release controller; exact service restart beats broad machine changes.
4. Run smallest check covering changed seam.
5. Build isolated candidate. Preserve atomic rollback. NEVER mutate served web output in place.
6. Install/promote into live runtime.
7. Prove actual owner use through installed entrypoint. UI fix requires real browser proof; HTTP 200 alone is insufficient.
8. Only after owner usefulness returns: run full gates, commit, land, redeploy landed source.

```text
DO NOT: diagnose → full gates → Git → queue/review → deploy → owner can work
TARGET: reproduce → seam check → isolated candidate+rollback → live proof → full gates → Git
```

## Split incidents; contain scope

1. Split independent failures by seam, owner, and receipt. NEVER bundle adjacent defects into active repair.
2. Run two lanes:
   - **Restoration:** smallest safe fix → focused regression → atomic live install → installed-entrypoint proof.
   - **Hardening:** deterministic tests, refactors, broad gates, review, landing. NEVER block restoration unless safety floor requires it.
3. Require each failed iteration to produce new evidence: changed diagnosis, narrower repro, or falsified hypothesis.
4. Two iterations without new evidence → stop worker, preserve WIP, reassign. NEVER reward guessing with more runtime.
5. Record each iteration: owner, seam, command, observed result, live state, rollback, next bounded action.

```text
DO NOT: timeout race + shutdown ordering + provider preflight → one repair loop
TARGET: one incident per independent failure → one owner + seam + receipt each
```

## Incident priority

Apply in order. Stop adding work that does not shorten current outage.

1. **Owner access/use** — restore blocked workflow.
2. **Load relief** — contain laptop work; offload through already-proven transport.
3. **Continuity** — keep coordinator/session state durable; resume surviving workers; never duplicate active work.
4. **Correct layer** — verify runtime topology before changing infrastructure. Healthy cluster + idle nodes means activation/integration fault, not cluster rebuild.
5. **Minimal safety floor** — seam test, isolated artifact, preflight candidate identity, rollback, exact-service scope.
6. **Durability** — source-of-truth update, full gates, Git, cleanup after fire.

## Coordination discipline

- Keep one live report synchronized after every verdict, install, incident, or blocker change.
- Treat launched worker != running work. Verify owner, current action, and output.
- Coordinator death recovery: reconstruct from transcript/task registry; contact existing workers before spawning replacements.
- Preserve rollback and uncommitted work. NEVER mutate shared main checkout.
- Do not block a fallback repair on a larger replacement architecture.
- Do not make Git, review queues, broad test suites, or documentation availability dependencies.
- Do not declare done from code/tests/HTTP alone. Done = installed and usable now.

## Load-fire rules

- Measure before ranking consumers.
- Protect owner sessions. NEVER kill by process name; act only on exact cgroup/service after proof.
- Route heavy build/test/browser pairs remotely through installed wrappers.
- Restore known-working remote transport before building its successor.
- Fail closed against accidental local execution, but continue until a real remote canary succeeds.

## Safety floor — never cut

- No in-place mutation of live Astro output.
- Candidate identity/PID must be proven; stale port response is not preflight.
- Release transitions must serialize with watchdog rollback.
- Rollback artifact must include immutable runtime dependencies.
- Any switch/restart/smoke failure triggers rollback.
- Security-sensitive change still needs focused adversarial validation before live install.
- Never touch owner sessions, broad-kill processes, or test destructive resource exhaustion on workstation/buildboxes.

## Diagnose elapsed time honestly

Report separately:

- core bug complexity;
- orchestration/coordination churn;
- overload delay;
- wrong-layer investigation;
- justified safety work;
- Git/gate/queue delay.

Never attribute multi-day downtime to a straightforward bug when delivery sequencing caused most elapsed time.

## Exit criteria

Emergency phase ends only when:

- owner-visible workflow works through installed runtime;
- laptop load is measurably usable or work is proven remote;
- rollback is available and tested at changed seam;
- every remaining outcome is running, genuinely externally blocked, or explicitly user-deferred;
- live report states what works now versus candidate-only work.

Then run normal full verification, commit, land, redeploy, and remove runtime/source drift.