# E72-G/H — Cross-host execution and recovery

## Cross-host (E72-G): two independent demonstrations

Two distinct VMs: host A `45.76.60.231` (8 vCPU development host) and host B `45.76.169.191` (2 vCPU replica).
Different boot ids and machine-id hashes. Inbound TCP is blocked on both, so host A reaches a coordinator bound to
`127.0.0.1` on host B through an **SSH local-forward tunnel**. The coordinator, authority keys, durable SQLite
mission state, evidence store and an isolated etcd (`127.0.0.1:12379`) live on host B. Workers execute on both hosts.

### A. SSH-tunnel + SQLite (this work)

Mission `COMPLETED`, 80/80 tasks `VERIFIED`, **18 EXECUTE verified on host A and 22 on host B**, **0 duplicate
results**, evidence verified on host B and again locally, etcd fencing token 358.

### B. PostgreSQL shared state + real reboot (concurrent E72.1 run, preserved)

A second run used a PostgreSQL primary on host B, a coordinator on each host, and workers on both. Mission **M1
completed with 12 tasks produced on one host and independently verified on the other**; the evidence event chain has
**972 events and verifies**; **0 duplicate results**. Mission M2 (120 tasks) reached 45 verified before the leader-kill
attempt.

**Coordinator failover**: the first attempt (04:13) did **not** take over (`b_took_over=false`, fencing `2 -> 2`,
leader remained `coord-host-a`). The run was repeated at 04:40 and succeeded: host B became leader `coord-vultr-b`,
the fencing token advanced **2 -> 3**, mission M2 **COMPLETED** with **0 duplicate results**. Gate E72-G11 is **PASS**
for the successful run, and the failed first attempt is recorded here rather than erased. Network partition was not
induced.

### C. Real host reboot (demonstrated)

Host B was actually rebooted during the run: boot id changed from `32cacb7c…` to `e245c1ff…`, uptime reset to 120 s
(verified again on the live host after the run), mission **M4 resumed and completed 100/100 verified tasks**, and
**5 tasks holding a 12 s expired grant were refused** after recovery. Gate E72-G13 is **PASS**. This is one reboot,
not a repeated soak, and not a production disaster-recovery proof.

**Still not demonstrated:** network partition and repeated reboot recovery. PostgreSQL is a single primary, not
Byzantine fault tolerant; a quorum over a single write primary is not BFT.

## Recovery (E72-H): what is safe to test

- Worker SIGKILL mid-mission: mission `COMPLETED`, 96/96 verified, **max attempt 2**, 0 duplicate results, evidence
  verified.
- SQLite exclusively locked: an independent writer **fails closed** (`database is locked`); `integrity_check` is
  `ok` after release.
- Coordinator cold process restart on the same durable root: prior mission preserved; new mission completes; new
  evidence verifies.
- Graceful shutdown: evidence preserved.

**Full host reboot: BLOCKED.** No isolated reboot authorization exists, and a cold process restart is **not** a
machine reboot. This is not claimed as reboot recovery.