# bb-status shows each box's sandbox image tag

status: ACTIVE
slug: k3s-proof
purpose: a small, real, self-contained improvement used as the acceptance run for the
factory-on-k3s path (submitted via `factory kubernetes`). The task's value is genuine;
its size is deliberately one seam.

## Task

`modules/workstation/claude/bin/bb-status` reports buildbox health but says nothing about
which sandbox image each box carries — today that answer needs manual ssh + cat of
`~/.local/share/overdeck-sandbox/agent-image-tag`, and image skew between boxes caused
real dispatch failures on 2026-08-16 (three launch-failure classes from new-launcher/
old-image mismatches).

Add one column/line per host to bb-status output: the box's current agent image tag,
read from `~/.local/share/overdeck-sandbox/agent-image-tag` over the existing ssh
transport bb-status already uses. Rules:

- Reuse bb-status's existing host list and ssh invocation pattern — no new config, no
  new transport.
- An unreachable box or missing tag file renders `image: unknown` — never a fabricated
  or stale value, and never a hard failure of the whole status output.
- When all reachable boxes report the same tag, print one summary line
  `images: converged (<tag>)`; otherwise print `images: SKEWED` followed by the per-host
  tags — skew is the fact the owner needs to see at a glance.
- Output stays owner-readable plain text in bb-status's existing style; no jargon.

## Tests

A test script next to the module's existing test style
(`modules/workstation/claude/test/` or `tests/` — follow the neighbors) covering:
converged tags, skewed tags, unreachable host → unknown + no hard failure, missing tag
file → unknown. Use a fake ssh shim on PATH — never a real box in tests.

## Verification

`bash -n` on the changed script; the new test green; no other module touched.

## Receipts

2026-08-16: plan authored as the factory-k3s acceptance target.