Expected (before): the off-site run fails within a bounded time with a clear household message and an operator alarm; nothing else breaks; the next run after the path returns catches up fully.
