@botbuddy/cli 1.41.1 → 1.42.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.41.1",
+  "version": "1.42.1",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/docker-hygiene.mjs

@@ -12,9 +12,11 @@ import { VERSION } from "./version.mjs";
 import { machineUuid } from "./machine-id.mjs";
 
 export const SCHEMA_VERSION = 1;
-export const DEFAULT_PROJECTED_ENDPOINTS = 10;
-export const DEFAULT_WARN_PRESSURE = 192;
-export const DEFAULT_FAIL_PRESSURE = 224;
+// BOT-2206: preflight applies policy v3's network term (BOT-2202). Docker's built-in
+// default-address-pools are 172.17–31.0.0/16 as /16s (15) + 192.168.0.0/16 as /20s (16).
+export const DEFAULT_NETWORK_LIMIT = 31;
+// The relay's accepted upper bound for `network_limit` (Helper DockerAddressPools).
+const MAX_NETWORK_LIMIT = 1_000_000;
 
 // BOT-1681 / BOT-1630 Step 3 — explicit Docker-engine allowlist. The org cut the
 // dev fleet back from OrbStack to Docker Desktop (OrbStack Helper heap runaway,
@@ -93,7 +95,8 @@ COMMANDS
   hygiene      Inventory stopped Supabase containers and empty
                supabase_network_* bridge networks. This is a dry-run unless
                --apply is explicitly present.
-  preflight    Read-only network-pressure check for a prospective managed stack.
+  preflight    Read-only check that the Docker daemon has a network for one more
+               managed stack (the server's admission network term).
 
 REQUIRED SELECTOR
   --context <name>     Explicit Docker context, e.g. orbstack
@@ -114,10 +117,12 @@ HYGIENE OPTIONS
                        Without it, no mutation.
   --json               Emit exactly one compact machine-readable receipt.
 
-PREFLIGHT OPTIONS
-  --projected-endpoints <n>  Expected endpoints in the new stack (default ${DEFAULT_PROJECTED_ENDPOINTS})
-  --warn-pressure <n>        Warn threshold (default ${DEFAULT_WARN_PRESSURE})
-  --fail-pressure <n>        Refuse threshold (default ${DEFAULT_FAIL_PRESSURE})
+PREFLIGHT
+  Counts user-defined bridge networks against the daemon's network limit, read
+  from docker info DefaultAddressPools (absent or malformed: Docker's default
+  ${DEFAULT_NETWORK_LIMIT}). The default bridge holds one subnet, so a start is
+  admitted while bridges + 1 <= limit - 1; it warns when the start would take the
+  last network and refuses (exit 2) when none is left. Endpoints are not scored.
   --json                       Emit exactly one compact machine-readable receipt.
 
   Engine allowlist (preflight): OrbStack and Docker Desktop are admitted by
@@ -169,15 +174,6 @@ const BUILTIN_NETWORKS = new Set(["bridge", "host", "none"]);
 // project's resources before its first container reaches running state.
 const ACTIVE_STATES = new Set(["created", "running", "paused", "restarting", "removing"]);
 
-function positiveInteger(value, option, errors, { allowZero = false } = {}) {
-  const parsed = Number(value);
-  if (!Number.isInteger(parsed) || parsed < (allowZero ? 0 : 1)) {
-    errors.push(`${option} must be ${allowZero ? "a non-negative" : "a positive"} integer`);
-    return null;
-  }
-  return parsed;
-}
-
 export function parseDockerArgs(argv) {
   const [command, ...rest] = argv;
   const errors = [];
@@ -189,9 +185,6 @@ export function parseDockerArgs(argv) {
     candidateIds: [],
     apply: false,
     json: false,
-    projectedEndpoints: DEFAULT_PROJECTED_ENDPOINTS,
-    warnPressure: DEFAULT_WARN_PRESSURE,
-    failPressure: DEFAULT_FAIL_PRESSURE,
   };
 
   const needValue = (option, index) => {
@@ -246,30 +239,12 @@ export function parseDockerArgs(argv) {
         }
         break;
       }
-      case "--projected-endpoints": {
-        const value = needValue(arg, i);
-        if (value !== null) {
-          opts.projectedEndpoints = positiveInteger(value, arg, errors, { allowZero: true });
-          i += 1;
-        }
-        break;
-      }
-      case "--warn-pressure": {
-        const value = needValue(arg, i);
-        if (value !== null) {
-          opts.warnPressure = positiveInteger(value, arg, errors);
-          i += 1;
-        }
+      case "--projected-endpoints":
+      case "--warn-pressure":
+      case "--fail-pressure":
+        errors.push(`${arg} was retired (BOT-2206): preflight now checks Docker networks against the daemon's network limit, like server admission; endpoints are not scored`);
+        if (rest[i + 1] !== undefined && !rest[i + 1].startsWith("--")) i += 1;
         break;
-      }
-      case "--fail-pressure": {
-        const value = needValue(arg, i);
-        if (value !== null) {
-          opts.failPressure = positiveInteger(value, arg, errors);
-          i += 1;
-        }
-        break;
-      }
       case "--apply": opts.apply = true; break;
       case "--json": opts.json = true; break;
       case "--help":
@@ -306,9 +281,6 @@ export function parseDockerArgs(argv) {
       if (!opts.lockSlot || opts.lockSlot === "default") errors.push("--apply requires a non-default --lock-slot from the owning stack lifecycle");
       if (opts.candidateIds.length === 0) errors.push("--apply requires at least one exact --candidate-id from the reviewed dry run");
     }
-    if (opts.warnPressure !== null && opts.failPressure !== null && opts.failPressure <= opts.warnPressure) {
-      errors.push("--fail-pressure must be greater than --warn-pressure");
-    }
   }
 
   return { command, opts, errors };
@@ -765,6 +737,7 @@ function validateDockerEngine(runDocker, opts, allowlist = DOCKER_ENGINE_ALLOWLI
 
   return {
     selector,
+    networkLimit: networkLimitFromDockerInfo(info),
     receipt: {
       requested: opts.context ? { type: "context", value: opts.context } : { type: "endpoint", value: opts.endpoint },
       resolved_endpoint: resolvedEndpoint,
@@ -780,29 +753,73 @@ function validateDockerEngine(runDocker, opts, allowlist = DOCKER_ENGINE_ALLOWLI
   };
 }
 
-export function evaluatePressure({
-  bridgeNetworks,
-  attachedEndpoints,
-  projectedEndpoints = DEFAULT_PROJECTED_ENDPOINTS,
-  warn = DEFAULT_WARN_PRESSURE,
-  fail = DEFAULT_FAIL_PRESSURE,
+function isIPv4(address) {
+  const octets = address.split(".");
+  return octets.length === 4 && octets.every((octet) => /^(0|[1-9][0-9]{0,2})$/.test(octet) && Number(octet) <= 255);
+}
+
+/**
+ * BOT-2206: how many bridge networks the daemon can allocate — the Helper's
+ * DockerAddressPools.networkLimit (0.2.26), so preflight and the census agree. Each
+ * IPv4 `DefaultAddressPools` entry yields 2^(Size − prefix) subnets; IPv6 pools never
+ * raise it. Absent pools (Docker's built-ins report null) or ANY malformed pool is
+ * unknown → Docker's default 31, never a partial sum and never a refusal.
+ */
+export function networkLimitFromDockerInfo(info) {
+  const fallback = { network_limit: DEFAULT_NETWORK_LIMIT, network_limit_source: "default" };
+  const pools = info?.DefaultAddressPools;
+  if (!Array.isArray(pools) || pools.length === 0) return fallback;
+  let total = 0;
+  let sawIPv4 = false;
+  for (const pool of pools) {
+    const parts = typeof pool?.Base === "string" ? pool.Base.split("/") : [];
+    const size = pool?.Size;
+    if (parts.length !== 2 || !/^[0-9]+$/.test(parts[1]) || !Number.isInteger(size)) return fallback;
+    const prefix = Number(parts[1]);
+    if (parts[0].includes(":")) {
+      if (prefix > 128 || size < prefix || size > 128) return fallback;
+      continue;
+    }
+    if (!isIPv4(parts[0]) || prefix > 32 || size < prefix || size > 32) return fallback;
+    sawIPv4 = true;
+    const bits = size - prefix;
+    total = Math.min(MAX_NETWORK_LIMIT, total + (bits >= 20 ? MAX_NETWORK_LIMIT : 2 ** bits));
+  }
+  return sawIPv4 && total > 0 ? { network_limit: total, network_limit_source: "daemon" } : fallback;
+}
+
+/**
+ * BOT-2206: policy v3's network term (BOT-2202), evaluated locally. The default
+ * `bridge` network holds one subnet, so one more start is admitted while
+ * `user bridges + 1 <= network_limit - 1`. It warns when that start takes the last
+ * usable network. current/projected_pressure_units keep the server's v3 meaning.
+ */
+export function evaluateNetworks({
+  userBridgeNetworks,
+  networkLimit = DEFAULT_NETWORK_LIMIT,
+  networkLimitSource = "default",
 }) {
-  const current = Number(bridgeNetworks) + (2 * Number(attachedEndpoints));
-  const projected = current + 1 + (2 * Number(projectedEndpoints));
-  const status = projected >= fail ? "fail" : projected >= warn ? "warn" : "ok";
+  const current = Number(userBridgeNetworks);
+  const limit = Number(networkLimit);
+  const usable = limit - 1;
+  const projected = current + 1;
+  const status = projected > usable ? "fail" : projected === usable ? "warn" : "ok";
   return {
-    metric: "conservative_network_pressure_units",
-    formula: "bridge_networks + (2 * attached_endpoints)",
+    metric: "docker_networks",
+    policy: "host_docker_pressure_v1",
+    policy_version: 3,
+    formula: "user_bridge_networks + 1 <= network_limit - 1",
+    network_limit: limit,
+    network_limit_source: networkLimitSource,
+    // Every network the daemon holds, including the default bridge: `networks n/limit`.
+    networks_in_use: current + 1,
+    network_free_slots: Math.max(0, usable - current),
     current_pressure_units: current,
     projected_pressure_units: projected,
-    projected_endpoints: Number(projectedEndpoints),
-    warn_pressure: Number(warn),
-    fail_pressure: Number(fail),
     status,
-    // BOT-1412: a host-wide interface-pressure refusal is not a per-stack
-    // `supabase_local` lock wait.  Emit the relay's capacity condition in the
-    // machine receipt so callers park on the global policy and receive the
-    // eventual capacity signal, rather than retrying Docker locally.
+    // BOT-1412: a host-wide refusal is not a per-stack `supabase_local` lock wait.
+    // Emit the relay's capacity condition so callers park on the global policy and
+    // receive the eventual capacity signal, rather than retrying Docker locally.
     ...(status === "fail" ? {
       wait: {
         kind: "global_capacity",
@@ -810,10 +827,15 @@ export function evaluatePressure({
         command: "bb-wait 'capacity:policy=host_docker_pressure_v1,slots>=1'",
       },
     } : {}),
-    note: "Conservative pressure proxy; OrbStack does not expose a kernel interface ceiling through the Docker API.",
   };
 }
 
+/** `networks 31/31 (default limit)` — the preflight's one-line network verdict. */
+export function formatNetworks(pressure) {
+  const source = pressure.network_limit_source === "daemon" ? "daemon address pools" : "Docker default limit";
+  return `networks ${pressure.networks_in_use}/${pressure.network_limit} (${source})`;
+}
+
 function baseReceipt(command, opts, now) {
   return {
     schema_version: SCHEMA_VERSION,
@@ -858,7 +880,7 @@ export function buildReliabilityTelemetry(receipt, { dedupeKey } = {}) {
   }
   const ghostInventory = (receipt.inventory_errors?.length ?? 0) > 0;
   // A successful target check is not a capacity measurement. If discovery
-  // fails before evaluatePressure produces a decision, suppress the generic
+  // fails before evaluateNetworks produces a decision, suppress the generic
   // observation so the evidence view cannot count a zero-filled false pass.
   // Classified daemon and persistent-inventory faults remain reportable.
   if (receipt.command === "preflight" && !receipt.pressure && !unavailable && !ghostInventory) {
@@ -1108,13 +1130,12 @@ export function runDockerWorkflow(argv, {
   }
 
   if (parsed.command === "preflight") {
-    receipt.pressure = evaluatePressure({
-      bridgeNetworks: inventory.counts.user_bridge_networks,
-      attachedEndpoints: inventory.counts.attached_endpoints,
-      projectedEndpoints: parsed.opts.projectedEndpoints,
-      warn: parsed.opts.warnPressure,
-      fail: parsed.opts.failPressure,
+    receipt.pressure = evaluateNetworks({
+      userBridgeNetworks: inventory.counts.user_bridge_networks,
+      networkLimit: validated.networkLimit.network_limit,
+      networkLimitSource: validated.networkLimit.network_limit_source,
     });
+    const networks = formatNetworks(receipt.pressure);
     // BOT-1681: dry-run hygiene is the OrbStack-only remedy. On Docker Desktop it
     // refuses, so the pressure warning/refusal must not tell operators to run it;
     // point them at the engine-aware recommendation instead.
@@ -1122,13 +1143,13 @@ export function runDockerWorkflow(argv, {
     if (receipt.pressure.status === "warn") {
       receipt.outcome = "warn";
       receipt.warnings.push(pressureEngine === "orbstack"
-        ? "Projected OrbStack network pressure is at or above the warning threshold; run dry-run hygiene before starting another stack."
-        : "Projected Docker network pressure is at or above the warning threshold; reduce Docker load (see recommendation) before starting another stack.");
+        ? `This start takes the last free Docker network (${networks}); run dry-run hygiene before starting another stack.`
+        : `This start takes the last free Docker network (${networks}); reduce Docker load (see recommendation) before starting another stack.`);
     } else if (receipt.pressure.status === "fail") {
       receipt.outcome = "refused";
       receipt.errors.push(pressureEngine === "orbstack"
-        ? "Projected OrbStack network pressure is at or above the refusal threshold; cleanup or release an owning stack before start."
-        : "Projected Docker network pressure is at or above the refusal threshold; release an owning stack (see recommendation) before start.");
+        ? `No Docker network is free for another stack (${networks}); cleanup or release an owning stack before start.`
+        : `No Docker network is free for another stack (${networks}); release an owning stack (see recommendation) before start.`);
       return { exitCode: EXIT.PRESSURE, receipt, json: parsed.opts.json };
     }
     return { exitCode: EXIT.OK, receipt, json: parsed.opts.json };
@@ -1275,7 +1296,7 @@ export function formatHumanReceipt(receipt) {
   }
   if (!receipt.inventory_errors?.length) lines.push("  none");
   if (receipt.pressure) {
-    lines.push(`Pressure: ${receipt.pressure.projected_pressure_units} projected (${receipt.pressure.status}; warn ${receipt.pressure.warn_pressure}, fail ${receipt.pressure.fail_pressure})`);
+    lines.push(`Capacity: ${formatNetworks(receipt.pressure)} — ${receipt.pressure.status}; attached endpoints ${receipt.inventory?.attached_endpoints ?? "?"} (not scored)`);
   }
   lines.push(`Reliability telemetry: ${receipt.telemetry?.status || "not_attempted"}`);
   for (const warning of receipt.warnings) lines.push(`Warning: ${warning}`);

package/src/stack.mjs

@@ -174,6 +174,11 @@ ${bold("REMOTE LEASES")} (BOT-2142, stack run)
   The receipt carries execution_mode (local|remote), execution_host_key, requester_host,
   transport (none|ssh-forward), and for a remote lease forwards [{name, remote, local}] + bundle.
   The child also gets BOTBUDDY_STACK_EXECUTION_MODE and BOTBUDDY_STACK_TRANSPORT.
+  Requeue (BOT-2207): under auto, a lease that QUEUES on this machine uploads its bundle at once;
+  every minute the control plane re-offers it to this owner's other hosts and it may move there
+  (placement_reason moved_remote_on_requeue), and run then forwards to the new host. While queued,
+  run prints one \`considered: <host> — <verdict>\` line per host weighed (e.g. "census stale 131 s");
+  the receipt carries placement_reason and considered[].
   5 REMOTE_UNREACHABLE    the host has no ssh_target (an operator must set it), or
                           \`ssh <target>\` could not open the forwards (BatchMode: key auth only)
   5 REMOTE_UNSUPPORTED    --remote, but the control plane placed the lease locally (pre-remote server)
@@ -455,6 +460,35 @@ export function describeQueuePosition(d) {
  * starved lease names its holders instead of only its position. Other tenants' leases are
  * tenant + state + since; unleased stacks are 5-character prefixes (the server redacts).
  */
+// BOT-2207: one human line per host the control plane weighed for an \`auto\` lease
+// (request_stack_lease / get_stack_lease \`considered[]\`), e.g. "considered: mac-mini — census
+// stale 131 s". An unknown verdict code is printed as-is.
+const CONSIDERED_VERDICT_TEXT = {
+  ADMITS: (c) => `admits (${c.free_slots ?? 0} free)`,
+  HOST_CAPACITY_INVENTORY_STALE: (c) => (Number.isFinite(c.snapshot_age_seconds) ? `census stale ${c.snapshot_age_seconds} s` : "no census yet"),
+  HOST_CAPACITY_SOURCE_STALE: () => "capacity beacon stale",
+  HOST_CAPACITY_WAIT: () => "Docker pressure full",
+  HOST_CAPACITY_BUDGET_FULL: () => "slot budget full",
+  HOST_CAPACITY_INVENTORY_UNKNOWN: () => "unknown Docker resources in its census",
+  TENANT_RESERVATION_FULL: () => "tenant reservation full",
+  SLOT_HELD: () => "this slot is already leased there",
+  HOST_HELPER_OUTDATED: () => "Helper predates remote leases (protocol < 4)",
+  HOST_NO_SSH_TARGET: () => "no ssh_target set",
+  HOST_INACTIVE: () => "host inactive",
+};
+
+export function describeConsidered(considered) {
+  if (!Array.isArray(considered)) return [];
+  return considered
+    .filter((c) => c && typeof c === "object" && typeof c.host_key === "string")
+    .map((c) => {
+      const name = (typeof c.display_name === "string" && c.display_name) || c.host_key;
+      const where = c.location === "local" ? " (this machine)" : "";
+      const text = CONSIDERED_VERDICT_TEXT[c.verdict_code]?.(c) ?? String(c.verdict_code ?? "unknown");
+      return `considered: ${name}${where} — ${text}`;
+    });
+}
+
 export function describeUnitLedger(ledger) {
   if (!ledger || typeof ledger !== "object") return [];
   const cap = ledger.capacity ?? {};
@@ -2752,7 +2786,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   // BOT-2142: the remote lease's forwards, and whether they died under a running child.
   let tunnel = null;
   let tunnelLost = null;
-  const placement = { mode: null, hostKey: null, requesterHost: null, transport: "none", forwards: null, bundle: null };
+  const placement = { mode: null, hostKey: null, requesterHost: null, transport: "none", forwards: null, bundle: null, placementReason: null, considered: null };
   incidentBox.execution = placement;
   const closeTunnel = async () => {
     if (!tunnel) return;
@@ -2995,6 +3029,9 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     placement.mode = request.data.execution_mode ?? null;
     placement.hostKey = request.data.host_key ?? null;
     placement.requesterHost = request.data.requester_host ?? null;
+    // BOT-2207: why the server placed (or queued) it there, and every host it weighed.
+    placement.placementReason = request.data.placement_reason ?? null;
+    placement.considered = Array.isArray(request.data.considered) ? request.data.considered : null;
     if (executionRequest === "remote" && !remoteLease) {
       const cleanup = await requestCleanup();
       return {
@@ -3045,6 +3082,23 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       }
       placement.bundle = { sha256: bundle.sha256, bytes: bundle.size };
       stderrLine(`stack: lease ${leaseId} is remote on ${placement.hostKey ?? "?"} — uploaded the ${bundle.size}-byte stack bundle (sha256 ${bundle.sha256.slice(0, 12)}…)`);
+    } else if (bundle && state === "queued" && request.data.bundle_upload_url) {
+      // BOT-2207: the lease queued HERE but may still move: every minute the control plane
+      // re-offers it to the owner's other hosts, and it can only move with its bundle in
+      // storage. Upload now. A failed upload is not fatal — the lease just stays queued here.
+      activeWaitAbort = new AbortController();
+      const uploaded = await uploadBundle(request.data.bundle_upload_url, bundle, { signal: activeWaitAbort.signal });
+      activeWaitAbort = null;
+      if (receivedSignal) {
+        const cleanup = await requestCleanup();
+        return { exitCode: SIGNAL_EXIT[receivedSignal], outcome: "interrupted", leaseId, cleanup };
+      }
+      if (uploaded?.ok) {
+        placement.bundle = { sha256: bundle.sha256, bytes: bundle.size };
+        stderrLine(`stack: lease ${leaseId} queued on ${placement.hostKey ?? "?"} — uploaded the ${bundle.size}-byte stack bundle so it can move to another owned host that admits first`);
+      } else {
+        stderrLine(`${yellow("⚠")} stack: could not upload the stack bundle (${uploaded?.error || "upload failed"}); lease ${leaseId} stays queued on ${placement.hostKey ?? "this host"} and cannot move to another host.`);
+      }
     }
     if (receivedSignal) {
       const cleanup = await requestCleanup();
@@ -3054,6 +3108,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       // BOT-2019: say where the lease sits (server dispatch rank, or why it has none) before parking.
       stderrLine(`stack: lease ${leaseId} queued — ${describeQueuePosition(request.data)}`);
       for (const line of describeUnitLedger(request.data.ledger)) stderrLine(`stack: ${line}`);
+      for (const line of describeConsidered(request.data.considered)) stderrLine(`stack: ${line}`);
       activeWaitAbort = new AbortController();
       // BOT-2013: every reap state (reaping / reaped / reap_failed) means the queued lease is lost.
       // BOT-2099: an auth/availability blip is retried inside the park until its deadline;
@@ -3123,8 +3178,20 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
 
     placement.hostKey = current.data.host_key ?? placement.hostKey;
     placement.mode = current.data.execution_mode ?? placement.mode ?? (remoteLease ? "remote" : null);
+    placement.placementReason = current.data.placement_reason ?? placement.placementReason;
+    if (Array.isArray(current.data.considered)) placement.considered = current.data.considered;
+    // BOT-2207: a queued auto lease may have been MOVED to another owned host while it waited.
+    // Follow it exactly like a first-time remote placement: forward to the NEW host's ssh_target.
+    const servedRemote = remoteLease || current.data.execution_mode === "remote";
+    if (servedRemote && !remoteLease) {
+      stderrLine(`stack: lease ${leaseId} moved to ${placement.hostKey ?? "another host"} while queued (${placement.placementReason ?? "moved"}) — forwarding to it`);
+      if (opts.callbackPort != null) {
+        const cleanup = await requestCleanup();
+        return { exitCode: EXIT.INVALID, outcome: "error", code: CALLBACK_PORT_UNSUPPORTED_REMOTE, leaseId, cleanup, error: CALLBACK_PORT_REMOTE_REFUSAL };
+      }
+    }
     let childConnection = current.data.connection;
-    if (remoteLease) {
+    if (servedRemote) {
       // BOT-2142: forward every stack port over ONE ssh and hand the child the local ports.
       sshTarget = current.data.connection?.ssh_target ?? current.data.ssh_target ?? sshTarget;
       try {
@@ -3162,7 +3229,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       BOTBUDDY_STACK_CONNECTION_FILE: connectionFile,
       // BOT-2142: lets a lane's own checks (e.g. the port-owner preflight) know the
       // listeners are SSH forwards to another host, not this machine's Docker.
-      BOTBUDDY_STACK_EXECUTION_MODE: remoteLease ? "remote" : (placement.mode ?? "local"),
+      BOTBUDDY_STACK_EXECUTION_MODE: servedRemote ? "remote" : (placement.mode ?? "local"),
       BOTBUDDY_STACK_TRANSPORT: placement.transport,
       ...(leasedTestConfig ? {
         BB_INTEGRATION_ENV_FILE: leasedTestConfig.envFile,
@@ -3262,6 +3329,9 @@ async function cmdRun(opts, childArgv) {
     transport: result.execution?.transport ?? "none",
     ...(result.execution?.forwards ? { forwards: result.execution.forwards } : {}),
     ...(result.execution?.bundle ? { bundle: result.execution.bundle } : {}),
+    // BOT-2207: why it ran where it did (e.g. moved_remote_on_requeue) and every host weighed.
+    ...(result.execution?.placementReason ? { placement_reason: result.execution.placementReason } : {}),
+    ...(result.execution?.considered ? { considered: result.execution.considered } : {}),
     fenced: result.fenced ?? false, error: result.error ?? result.cleanup?.error ?? null,
     // BOT-2099: a platform auth/availability blip during the park is reported as an
     // incident (reason, window, attempts, recovered) — never as the lease's outcome.