---
name: od-emergency
description: Active Overdeck or workstation incident where owner work is blocked, laptop load is extreme, runtime is broken, or delivery is stalled. Invoke for fire, outage, broken live UI, offload failure, repeated session deaths, or "make it work now". Restores owner usefulness before Git ceremony.
---

# Overdeck emergency response

audience: AI coding agents first. BLUF: restore owner use NOW; Git/full gates last.

Machine frozen, black screen, SSH lockout, or reboot risk → also invoke `/od-recovery`; it owns evidence-before-reboot. This skill owns delivery sequencing and continuity.

## First response — execute immediately

1. Work in current workspace for measurement, diagnosis, runtime action, and non-code recovery. MUST NOT create a worktree unless writing code.
2. If code change becomes necessary, create isolated worktree before first code edit. Preserve shared checkout WIP.
3. Record incident + every requested outcome as tasks. Assign every runnable task an active owner.
4. Measure live failure, load, affected runtime, and last-known-good path. Never infer topology or root cause.
5. Restore proven fallback FIRST. Existing SSH offload beats unfinished k3s; last-known-good release beats a new release controller; exact service restart beats broad machine changes.
6. Run smallest check covering changed seam.
7. Build isolated candidate. Preserve atomic rollback. NEVER mutate served web output in place.
8. Install/promote into live runtime.
9. Prove actual owner use through installed entrypoint. UI fix requires real browser proof; HTTP 200 alone is insufficient.
10. Only after owner usefulness returns: run full gates, commit, land, redeploy landed source.

```text
DO NOT: diagnose → full gates → Git → queue/review → deploy → owner can work
TARGET: reproduce → seam check → isolated candidate+rollback → live proof → full gates → Git
```

## Split incidents; contain scope

1. Split independent failures by seam, owner, and receipt. NEVER bundle adjacent defects into active repair.
2. Run two lanes:
   - **Restoration:** smallest safe fix → focused regression → atomic live install → installed-entrypoint proof.
   - **Hardening:** deterministic tests, refactors, broad gates, review, landing. NEVER block restoration unless safety floor requires it.
3. Require each failed iteration to produce new evidence: changed diagnosis, narrower repro, or falsified hypothesis.
4. Two iterations without new evidence → stop worker, preserve WIP, reassign. NEVER reward guessing with more runtime.
5. Record each iteration: owner, seam, command, observed result, live state, rollback, next bounded action.

```text
DO NOT: timeout race + shutdown ordering + provider preflight → one repair loop
TARGET: one incident per independent failure → one owner + seam + receipt each
```

## Incident priority

Apply in order. Stop adding work that does not shorten current outage.

1. **Owner access/use** — restore blocked workflow.
2. **Load relief** — contain laptop work; offload through already-proven transport.
3. **Continuity** — keep coordinator/session state durable; resume surviving workers; never duplicate active work.
4. **Correct layer** — verify runtime topology before changing infrastructure. Healthy cluster + idle nodes means activation/integration fault, not cluster rebuild.
5. **Minimal safety floor** — seam test, isolated artifact, preflight candidate identity, rollback, exact-service scope.
6. **Durability** — source-of-truth update, full gates, Git, cleanup after fire.

## Coordination discipline

- Keep one live report synchronized after every verdict, install, incident, or blocker change.
- Treat launched worker != running work. Verify owner, current action, and output.
- Coordinator death recovery: reconstruct from transcript/task registry; contact existing workers before spawning replacements.
- Preserve rollback and uncommitted work. NEVER mutate shared main checkout.
- Do not block a fallback repair on a larger replacement architecture.
- Do not make Git, review queues, broad test suites, or documentation availability dependencies.
- Do not declare done from code/tests/HTTP alone. Done = installed and usable now.

## Load-fire rules

- Measure before ranking consumers.
- Protect owner sessions. NEVER kill by process name; act only on exact cgroup/service after proof.
- Route heavy build/test/browser pairs remotely through installed wrappers.
- Restore known-working remote transport before building its successor.
- Opaque remote wrappers (for example base64 E2E payload carriers) must expose non-semantic dependency-owner hints to admission; never make the runner decode or execute the opaque payload merely to discover its package lock.
- Fleet parity must fail closed when managed-runtime provisioning itself refuses (especially dirty-source/integrity failures); never follow that refusal with a bootstrap that replaces managed seat links with real files.
- Fail closed against accidental local execution, but continue until a real remote canary succeeds.

## Safety floor — never cut

- No in-place mutation of live Astro output.
- Candidate identity/PID must be proven; stale port response is not preflight.
- Release transitions must serialize with watchdog rollback.
- Rollback artifact must include immutable runtime dependencies.
- Any switch/restart/smoke failure triggers rollback.
- Security-sensitive change still needs focused adversarial validation before live install.
- Never touch owner sessions, broad-kill processes, or test destructive resource exhaustion on workstation/buildboxes.

## Diagnose elapsed time honestly

Report separately:

- core bug complexity;
- orchestration/coordination churn;
- overload delay;
- wrong-layer investigation;
- justified safety work;
- Git/gate/queue delay.

Never attribute multi-day downtime to a straightforward bug when delivery sequencing caused most elapsed time.

## Exit criteria

Emergency phase ends only when:

- owner-visible workflow works through installed runtime;
- laptop load is measurably usable or work is proven remote;
- rollback is available and tested at changed seam;
- every remaining outcome is running, genuinely externally blocked, or explicitly user-deferred;
- live report states what works now versus candidate-only work.

Then run normal full verification, commit, land, redeploy, and remove runtime/source drift.

## Self-update — MANDATORY

This doc is the fleet's memory. You changed the architecture, wiring, commands, or
doctrine this skill describes — or a live incident just proved a rule here wrong or
missing → EDIT THIS FILE in the same landing as the change. Adopted AND rejected
decisions both go in, with the measured why. An owner reminder to record a lesson is
a failure of this rule, not the trigger for it.