# Restore e2e-remote registry lookup integrity

status: DONE
task IDs: #1
source request: 2026-08-11 owner reports work blocked again. Browser verification reproduces an `e2e-remote` harness defect: second PATH-shimmed registry lookup can offload independently and fail despite reachable hosts. Fix runtime and return to blocked work as soon as possible.

## Acceptance criteria

- Reproduce failed second registry lookup through installed `~/.claude/bin/e2e-remote`.
- Ensure one invocation resolves registry/host state without independently offloading its internal lookup.
- Add focused regression covering PATH-shim behavior.
- Preserve atomic rollback for installed runtime.
- Install candidate through canonical deployment path; prove installed entrypoint runs real browser workload remotely on reachable host.
- Confirm no browser/dev-server workload runs locally and report measured laptop state.
- Run applicable full gates cleanly; commit, land, redeploy landed source, then re-prove installed behavior.
- Return control to previously blocked browser-verification work.

## Preserved WIP

- Shared checkout untouched; existing dirty files and active plans remain owned by other sessions.
- Repair worktree: `/home/user/Projects/overdeck/.worktrees/e2e-remote-registry-fix`, branch `wt/e2e-remote-registry-fix`, base `a3e00a664`.
- Installed runtime before repair: `/home/user/.claude/bin/e2e-remote`.

## Constraints

- Emergency order: reproduce → focused seam check → isolated candidate + rollback → live install → installed browser proof → broad gates → Git.
- NEVER launch headless browser/dev-server pair locally.
- Use buildbox registry as sole host source; reachable hosts only; fail closed.
- Keep source and installed runtime byte-identical after canonical deployment.
- Do not modify unrelated active WIP.

## Execution steps

1. Capture installed-path identity, live load, registry state, and deterministic failing invocation.
2. Trace source and PATH shim boundaries; identify exact second lookup process boundary.
3. Write regression reproducing independent offload; implement smallest fail-closed fix.
4. Run focused tests and isolated candidate canary.
5. Save immutable rollback artifact; install via canonical deploy; invoke installed browser path and verify remote execution.
6. Run full applicable workstation tests and resolve all signals.
7. Commit locally, update from `origin/main`, direct-land emergency fix, deploy landed source, re-prove runtime.
8. Mark restoration done and resume blocked browser verification.

## Current receipt

- 2026-08-11: task #1 created, assigned to `main`, status `in_progress`.
- Isolated worktree created at `a3e00a664`; shared checkout not modified.
- Live measurement: installed entrypoint resolves to `/home/user/.claude/bin/e2e-remote`; `overdeck-web.service` active; load average `21.74 26.74 25.32` at 21:11 local.
- Mandatory cross-project docs indexed and queried; preservation-first and shared-root isolation constraints confirmed.
- Root cause proven in source: PATH-shimmed `node ... hosts --order build` is classified as heavy from literal `build` before `CPU_GUARD_ACTIVE` bypass is evaluated; this registry query can therefore dispatch through `local-gate` independently.
- Candidate pins control-plane registry/config execution to `/usr/bin/node`; focused config regression injects a PATH node shim that fails only `hosts --order build`.
- Focused checks green: config regression, attestation suite, and shell syntax. Attestation emitted `netns inode mismatch` from its expected rejection case; benign and asserted by the test.
- Emergency runtime overlay created at `~/.local/state/overdeck/emergency/e2e-remote-registry-20260811T1420Z`; rollback target recorded as deploy clone bin. Atomic rollback-to-old and candidate switch both succeeded; 108 non-target bin entries are byte-identical.
- First candidate install accidentally copied the shared-checkout source because Bash retained the primary cwd; live hash check caught the mismatch before acceptance. Corrected from the absolute isolated-worktree path; installed source now contains `NODE_BIN` registry calls and matches candidate bytes.
- First browser canary on the stale candidate reproduced exit 97: `local-gate ... host=fleet reason=unavailable`, followed by no usable host. This is the target defect, not accepted restoration evidence.
- Corrected installed-entrypoint browser canary exited 0 and pulled `.ci-results/e2e-remote-canary.png`; visual inspection shows expected `remote` page. Actual local browser executable count remained zero during the run. Owner browser-verification path is restored now.
- Independent review found one valid defect: fixed `/usr/bin/node` preflight ran before remote-seat fast path and could reject a seat that never needs Node. Check moved after seat branch; attestation regression pins that ordering. Focused config/attestation/syntax checks pass after correction.
- Reviewed candidate reinstalled; second real browser canary exited 0 and visually rendered `remote-reviewed` remotely.
- Final broad host-safe aggregator: 65/84 passed; 19 are not accepted as change regressions because QuietContext ran them inside its `/tmp/.ctx-mode-*` jail. Failures explicitly include suites that self-refuse there (`agent-session-ledger`, `agent-session-passthrough`), fixture binaries lost through the jail, and pre-existing unrelated expectation drift (`agent-seat-slice`, retired Cursor dispatch). Focused changed-seam tests remain clean. Bare canonical runner cannot legally select all safe suites while excluding danger-lab files.
- Optional ShellCheck surfaced existing intentional diagnostics: SC2163 dynamic `export "$kv"` (covered by spacing regression), SC2016 deferred child-shell expansion, SC2155 fixture assignment. None originate in this change; no suppression or unrelated cleanup added.
- Normal fetch and negotiation-tip fetch both fail on pre-existing shared dangling ref `refs/rescued/claude-20260811T134909Z-006422`; no shared ref was modified. `git ls-remote` proves `origin/main` remains exactly worktree base `a3e00a664`.

- Landed commit `f1028e745` directly to `main`; remote fast-forward base was verified by `ls-remote` immediately before push.
- Canonical deploy clone checked out landed `f1028e745` and contains byte-identical fixed `e2e-remote`. Full `deploy-local.sh` later stopped at `sync apply claude bin` because another active change made `modules/workstation/claude/lib/remote-build.mjs` dirty (4 additions, 1 deletion). That WIP was inspected and preserved; no reset, checkout, or overwrite occurred.
- Live `~/.claude/bin` atomically switched from emergency overlay to landed deploy-clone bin. Final installed-entrypoint Playwright screenshot exited 0, visually rendered `landed`, and local browser executable count was zero.
- Final runtime: `~/.claude/bin` resolves to `/home/user/.local/share/overdeck/deploy/modules/workstation/claude/bin`; deploy HEAD and remote main are `f1028e745`; web/controller/collector services active. Load average after proof: `18.15 20.49 23.19`; browser workload itself was proven remote.
- Rollback overlay remains immutable at `~/.local/state/overdeck/emergency/e2e-remote-registry-20260811T1420Z`; changed seam rollback switch was tested before promotion.

## Next executable action

Resume the browser verification work that this harness defect blocked. The unrelated deploy-clone `remote-build.mjs` owner must finish or preserve their WIP before the next full canonical deployment; this e2e runtime is already landed and live.