Fleet: Local fallback — deliberate offline hatch + rejoin (CONTEXT.md)

Acceptance Criteria

• Guard tools/fleet/amico-opencode-fleet-guard checks ~/.amico/ops/fleet/fallback.json before scutil --get LocalHostName; with marker present amico-mini's exit 1 is bypassed and frozen/VSIX/dev is execd even on MacBook-Pro-de-Aaron (verified touch fallback.json && guard --help shows opencode not refusing).
• Amicode: Fleet — Enter Local Fallback (palette, modal confirm) creates fallback.json with since + previousBinary/previousPort, clears amicode.opencodeBinary="" + opencodePort=0 (Global), restarts to vendored local server (ephemeral), status bar $(warning) Fleet: LOCAL FALLBACK (warning bg, tooltip fallbackStatusLabel, click → Rejoin) and amicode.healthcheck shows Fleet fallback: ACTIVE while Fleet guard/settings/tunnel are skipped — fallback active.
• Amicode: Fleet — Exit Local Fallback (modal) deletes marker, restores previousBinary→~/.local/bin/amico-opencode-fleet-guard + previousPort→4096, restarts to ride tunnel (health probe fails closed if mini still offline, with Rejoin hint).
• Amicode: Fleet — Rejoin when fallback active probes http://127.0.0.1:4096/ (and amicode.opencodePort); if tunnel still down offers Stay/Exit anyway/Check again; if up archives ~/.local/share/opencode/opencode.db → ~/.amico/fleet-recovery/<YYYY-MM-DD>/opencode-fallback-<ts>.db, then exits fallback and runs healthcheck.
• tailscale status aarons-mac-mini Online:false vs erlich Online:true proves normal ssh (ssh erlich ok) is unrelated to fleet ssh amico-mini timeout; Match host amico-mini LAN-first (ping Aarons-Mac-mini.local → .local vs 100.125.66.86) remains.
• bash packages/extension/scripts/assert_fleet_guard.sh checks fallback marker/hint; pnpm test includes fleet_fallback.test.ts (4) + fleet_health fallback aggregate (1), typecheck clean, vsce package includes extension/tools/fleet/amico-opencode-fleet-guard 2147B with fallback.

Testing Decisions

• Pure fleet_fallback.ts (enter/exit/isActive/read + atomic tmp→rename, mkdir -p) unit-tested with temp dir, no scutil/launchctl. Guard tested via touch fallback.json + guard --help (exec vs exit 1). Health aggregate tested with injected read returning fallback JSON → 4 checks with skipped rows. Manual: enter fallback on MacBook while tailscale ping timeout, verify lsof -iTCP:4096 no ssh LISTEN but local opencode LISTEN on ephemeral, status bar warning, health ACTIVE; rejoin after tailscale recovers.

Key Decisions

• Marker is a file, not a setting — amicode.* settings are machine but still JSON in settings.json; a file is the same machine-scoped contract as the Fleet token 0600 (ADR 0001) and is trivial for the bash guard to check without jq.
• Guard check is first: if [ -f "$FALLBACK" ]; then :; elif [ "$(scutil …)" != ... ]; then exit 1; fi — fallback is explicit, not a silent bypass of never-fork.
• Port in fallback is ephemeral (0) — avoids 4096 collision when the tunnel recovers; canonical 4096 is restored on exit.
• Rejoin is archive, not merge for now — copies opencode.db to fleet-recovery per “preserve, never delete” (ADR 0005 unmappable drift); full server-side fixture-locked merge (Local fallback + Rejoin merge (fixture-locked) #290) lands with identity routes.

Constraints & Invariants

• Exactly one canonical per fleet; client never spawns outside fallback; marker + settings never ride Settings Sync; loopback-only binding persists; shard preserved until verified merge.

Prior Art

• CONTEXT.md Local fallback/Rejoin, ADR 0005 Conditions of merge, Fleet hardening: lid-close/internet-loss disconnect and fork guard #324 guard exit 1, Fleet: preventive health + self-heal (guard/tunnel/settings drift) #328 preventive fleet_health + install.sh, normal ssh Match host amico-mini LAN-first.

Source

Part of Managed Fleet hatch — explicit offline work.

Notes

• Normal ssh (erlich.tail1c461a.ts.net → 100.104.59.70 ok) proves ~/.ssh/config tweak is not the fleet down cause; fleet down is aarons-mac-mini Online:false (Tailscale).