# Emergency Offload and Workstation Recovery

audience: AI coding agents first.

status: IDLE
worker: none; remote canary `bp8lv83d6` completed
task IDs: #170
source request: Workstation is unusable while paid Debian1/2/3 cluster is idle. Restore work flow immediately; never gate delivery on k3s.

## Outcome

All heavy builds, tests, browsers, and delivery payloads execute on Debian1/2/3 through proven SSH offload now. Laptop runs control-plane work only. Remote failure queues/fails closed; never falls back locally.

## Acceptance criteria

- Installed build/e2e order includes Debian1 → Debian2 → Debian3.
- Real remote-only job succeeds with host + authoritative exit receipt.
- Concurrent work spills across at least two hosts.
- Whole-agent/customer delivery path works remotely.
- Local process audit shows no heavy payload fallback.
- Doctor either passes or remaining failures are proven non-blocking and separately recorded.

## Preserved WIP and completed proof

- Source and installed `~/.claude/buildbox-hosts.json` now order all three hosts.
- Focused canary from `/home/user/Projects/overdeck/.worktrees/task170-ssh-offload` ran on Debian1, exit 0, no local fallback.
- Oversized canary from `/home/user` timed out at Debian3 `rsync-push` after 117s; this was wrong source root, not proof of transport failure.
- Doctor passes SSH, remote rsync, and Node/pnpm/bun parity on Debian1/2.
- Doctor defects:
  - local GitHub-origin probe unresolved;
  - each `doctor-host` times out after 30s;
  - Debian3 Node local `24.18.0` vs remote `24.19.0`;
  - Debian3 pnpm local `11.5.2` vs remote `11.20.0`.
- Worktree `/home/user/Projects/overdeck/.worktrees/task170-ssh-offload` was clean; do not invent a source delta there.

## Constraints

- Never kill owner `human.slice` sessions.
- Never run spill tests as uncontrolled local fan-out.
- Never repeat proven single-host canary.
- Repair only defects blocking real work; no broad doctor cleanup prerequisite.

## Execution steps

1. Route an actual delivery task through installed remote-only path.
2. Record host, remote PID/unit, payload exit, and local process absence.
3. Prove bounded spill with existing admission telemetry or a minimal controlled workload.
4. Repair only blocking doctor defects.
5. Keep SSH plane production-active while k3s evolves.
6. Update report and index receipt.

## Current receipt

- Installed behavior: three-host order active.
- Authoritative build proof: `local-gate --remote-only` canary → Debian1 → exit 0.
- Authoritative whole-agent proof: installed `ca.sh` → remote seat `seat-20260810041617-286981` on Debian2 → constrained Podman container → Composer 2.5 → exit 0. Receipt explicitly reports `host=debian2 status=0`; no local agent fallback occurred.
- Not proven: real customer delivery and multi-host spill.

## Next executable action

Run one real pending customer-delivery payload through SSH remote-only and capture the complete receipt. Do not substitute another synthetic canary.