# Emergency Offload and Workstation Recovery

audience: AI coding agents first.

status: SUPERSEDED (2026-08-15) — see "Superseded" section below
worker: FIRE-HDD incident session (2026-08-14); dispatch-path repair landed and proven
task IDs: #170
source request: Workstation is unusable while paid Debian1/2/3 cluster is idle. Restore work flow immediately; never gate delivery on k3s.

## Outcome

All heavy builds, tests, browsers, and delivery payloads execute on Debian1/2/3 through proven SSH offload now. Laptop runs control-plane work only. Remote failure queues/fails closed; never falls back locally.

## Acceptance criteria

- Installed build/e2e order includes Debian1 → Debian2 → Debian3.
- Real remote-only job succeeds with host + authoritative exit receipt.
- Concurrent work spills across at least two hosts.
- Whole-agent/customer delivery path works remotely.
- Local process audit shows no heavy payload fallback.
- Doctor either passes or remaining failures are proven non-blocking and separately recorded.

## Preserved WIP and completed proof

- Source and installed `~/.claude/buildbox-hosts.json` now order all three hosts.
- Focused canary from `/home/user/Projects/overdeck/.worktrees/task170-ssh-offload` ran on Debian1, exit 0, no local fallback.
- Oversized canary from `/home/user` timed out at Debian3 `rsync-push` after 117s; this was wrong source root, not proof of transport failure.
- Doctor passes SSH, remote rsync, and Node/pnpm/bun parity on Debian1/2.
- Doctor defects:
  - local GitHub-origin probe unresolved;
  - each `doctor-host` times out after 30s;
  - Debian3 Node local `24.18.0` vs remote `24.19.0`;
  - Debian3 pnpm local `11.5.2` vs remote `11.20.0`.
- Worktree `/home/user/Projects/overdeck/.worktrees/task170-ssh-offload` was clean; do not invent a source delta there.

## Constraints

- Never kill owner `human.slice` sessions.
- Never run spill tests as uncontrolled local fan-out.
- Never repeat proven single-host canary.
- Repair only defects blocking real work; no broad doctor cleanup prerequisite.

## Execution steps

1. Route an actual delivery task through installed remote-only path.
2. Record host, remote PID/unit, payload exit, and local process absence.
3. Prove bounded spill with existing admission telemetry or a minimal controlled workload.
4. Repair only blocking doctor defects.
5. Keep SSH plane production-active while k3s evolves.
6. Update report and index receipt.

## Root-cause repairs landed 2026-08-14

- Dispatch abort at `git-overlay-list`: overlay listing walked every ignored tree (measured 2m15s wall vs 120s budget in the deploy clone) so every dispatch died locally before reaching a host. Fixed in `modules/workstation/claude/lib/remote-build.mjs` (exact paths listed directly; basename patterns use `--directory` so ignored dirs collapse; measured 4.7s). Landed `8e37f7e8b`, deployed, unit tests green.
- Main-checkout poison: perms-000 leftover `temp-user/.tmpjail-work/work/` broke `git add` snapshots for every dispatch from the main checkout, surfacing as a fake "timed out". Removed.
- Web release accumulation filled the disk (26 stale releases): `web-release.sh prune` runs after every activation, landed `e9c12c14b`, observed shrinking `.releases` 10G→643M.

## Current receipt

- Installed behavior: three-host order active; land-queue gates (`finish-branch.sh` → `local-gate`) and cpu-guard-intercepted pnpm/tsc/vitest now dispatch remotely by default.
- Authoritative build proof (2026-08-14): `local-gate --remote-only` trivial canary → debian1 → 24s. Real test gate `pnpm --filter @overdeck/deck-ui test` → debian2 → 412 tests green, 52s round-trip, 0.8s local CPU. Lander-shape gate (no force flag) → remote → 34s, 0.8s local CPU. Real web build `pnpm --filter web build` → remote → 53s, 0.95s local CPU, `dist/` artifacts synced back fresh (mtime advanced).
- Authoritative whole-agent proof: installed `ca.sh` → remote seat `seat-20260810041617-286981` on Debian2 → constrained Podman container → Composer 2.5 → exit 0. Receipt explicitly reports `host=debian2 status=0`; no local agent fallback occurred.
- Not proven: real customer delivery and multi-host spill under load; deploy-run observation of remote web build inside `deploy-local.sh` (proven standalone only).

## Next executable action

Observe the next natural land+deploy end-to-end and record that its gates and web build executed remotely (hosts + local CPU seconds). Then run one real customer-delivery payload remote-only and capture the complete receipt. k3s destination proceeds in parallel in the factory-k3s session under the owner's 2026-08-14 de-Gitea instruction (deploy key in Kubernetes Secret; no internal Gitea; receipt-or-nothing).

## Superseded (2026-08-15)

Superseded by [Laptop as terminal](2026-08-15-laptop-as-terminal.md), which registers
the actual destination this plan's offload work was always heading toward: the
orchestrator session itself moves off the laptop, not just its heavy builds. Offload is
now proven (180 of 200 recent `cdx exec` runs land in rootless podman on the buildboxes)
and the git-push delta transport this plan needed has landed. This file stays as the
record of the incident and the offload repairs it delivered.