@edgehero/pi-dispatch-admin 5.2.0 → 5.2.1

package/dist/index.mjs

@@ -7620,6 +7620,13 @@ var init_worker_name = __esm({
 });
 
 // ../worker/src/job-size.mjs
+function wholeCpusOf(cpuCenti) {
+  return Math.ceil(cpuCenti / 100);
+}
+function jobSizeEnv(size) {
+  assertJobSize(size);
+  return { PI_JOB_SIZE_CPUS: String(wholeCpusOf(size.cpuCenti)), PI_JOB_SIZE_MEMORY_MIB: String(size.memMiB) };
+}
 function parseMemory(value) {
   if (typeof value !== "string" || !/^[1-9]\d*[mg]$/.test(value)) {
     throw new Error(`a memory size is a whole number of megabytes or gigabytes such as "512m", "1536m" or "4g" (got ${JSON.stringify(value)})`);
@@ -8803,6 +8810,19 @@ function roundCpusUp(cpuCenti) {
 function rank(sorted, pct5) {
   return sorted[Math.max(0, Math.ceil(pct5 * sorted.length / 100) - 1)];
 }
+function seenOf(record3) {
+  if (!CEILING_VENUES.includes(record3.backend)) return null;
+  const c = record3.capacity;
+  if (c === null || typeof c !== "object" || Array.isArray(c)) return null;
+  const cpus = Number.isSafeInteger(c.cpus) && c.cpus >= 1 && c.cpus <= HOST_CPUS_MAX ? c.cpus : null;
+  const budget = Number.isSafeInteger(c.cpuCenti) && c.cpuCenti >= 1 && c.cpuCenti <= HOST_CPUS_MAX * 100 ? c.cpuCenti : null;
+  const ceilingCenti = cpuCeilingCenti(cpus, budget);
+  return ceilingCenti === null ? null : seenCpusOf(ceilingCenti, cpus);
+}
+function seenCpusOf(ceilingCenti, runtimeCpus) {
+  if (ceilingCenti >= 100) return Math.floor(ceilingCenti / 100);
+  return Number.isSafeInteger(runtimeCpus) && runtimeCpus >= 1 ? runtimeCpus : null;
+}
 function evidenceOf(record3, project2, nowMs2) {
   if (record3 === null || typeof record3 !== "object" || Array.isArray(record3)) return null;
   if (record3.project !== project2) return null;
@@ -8822,7 +8842,7 @@ function evidenceOf(record3, project2, nowMs2) {
   };
   const memFullUsec = wallUsec !== null && isCount(r2.memFullUsec) ? r2.memFullUsec : null;
   if (memPeak === null && cpu.cpuUsec === null) return null;
-  return { at: at2, size, memPeak, oom: record3.reason === "oom-killed", wallUsec, ...cpu, memFullUsec };
+  return { at: at2, size, memPeak, oom: record3.reason === "oom-killed", wallUsec, ...cpu, memFullUsec, seenCpus: seenOf(record3) };
 }
 function heldToCap(wanted, current, cap) {
   if (wanted <= current) return { suggested: null, held: "largest" };
@@ -8831,6 +8851,14 @@ function heldToCap(wanted, current, cap) {
   if (wanted > cap) return { suggested: cap, held: "cap" };
   return { suggested: wanted, held: null };
 }
+function oomCeilingOf(relevant) {
+  const over = relevant.filter((e2) => e2.oom && e2.seenCpus !== null && e2.seenCpus > wholeCpusOf(e2.size.cpuCenti));
+  if (over.length === 0) return null;
+  const seen = over.map((e2) => e2.seenCpus);
+  const sizes = over.map((e2) => e2.size.cpuCenti);
+  const sizeCenti = Math.min(...sizes);
+  return { runs: over.length, seenCpus: Math.min(...seen), seenMaxCpus: Math.max(...seen), sizeCenti, sizeVaries: sizes.some((n3) => n3 !== sizeCenti) };
+}
 function suggestMemory(runs, current, cap) {
   const measured = runs.filter((e2) => e2.memPeak !== null);
   const relevant = measured.filter((e2) => e2.size.memMiB >= current);
@@ -8841,7 +8869,7 @@ function suggestMemory(runs, current, cap) {
   const oomSizes = measured.filter((e2) => e2.oom).map((e2) => e2.size.memMiB);
   const largestOom = oomSizes.length > 0 ? Math.max(...oomSizes) : null;
   const pressured = relevant.filter((e2) => !productAbove(e2.size.memMiB * MIB, 9, e2.memPeak, 10) && e2.memFullUsec !== null && productAbove(e2.memFullUsec, 100, e2.wallUsec, 1)).length;
-  const evidence = { samples, smaller: measured.length - samples, p95MiB: p95 === null ? null : Math.ceil(p95 / MIB), maxPeakMiB: maxPeak === null ? null : Math.ceil(maxPeak / MIB), ooms, largestOomMiB: largestOom, pressured };
+  const evidence = { samples, smaller: measured.length - samples, p95MiB: p95 === null ? null : Math.ceil(p95 / MIB), maxPeakMiB: maxPeak === null ? null : Math.ceil(maxPeak / MIB), ooms, largestOomMiB: largestOom, pressured, oomCeiling: oomCeilingOf(relevant) };
   const fact = pressured > 0 ? "pressure" : null;
   const out = (reason, suggested, more = {}) => ({ current, suggested: suggested === null || suggested === current ? null : suggested, reason, evidence, fact, held: null, wanted: null, ...more });
   if (ooms > 0) {
@@ -8964,6 +8992,15 @@ function notEnoughRunsText(dim, sizeText3) {
   const smaller = Number.isSafeInteger(e2.smaller) && e2.smaller > 0 ? `; ${e2.smaller} at smaller sizes` : "";
   return `not enough runs at ${sizeText3(dim.current)} (${samples}${smaller})`;
 }
+function oomCeilingWords(me) {
+  const o = me?.oomCeiling;
+  if (o === null || typeof o !== "object" || !Number.isSafeInteger(o.runs) || o.runs < 1 || !Number.isSafeInteger(o.seenCpus)) return "";
+  const ooms = Number.isSafeInteger(me.ooms) && me.ooms >= o.runs ? me.ooms : o.runs;
+  const whose = ooms === 1 ? "the killed run's tools" : o.runs === ooms ? "the killed runs' tools" : `the tools of ${o.runs} of the ${ooms} killed runs`;
+  const seen = `${o.seenCpus}${Number.isSafeInteger(o.seenMaxCpus) && o.seenMaxCpus > o.seenCpus ? ` to ${o.seenMaxCpus}` : ""} CPUs`;
+  const size = o.sizeVaries === true ? `sizes from ${cpusText(o.sizeCenti)}` : `a size of ${cpusText(o.sizeCenti)}`;
+  return `size per-CPU worker pools from PI_JOB_SIZE_CPUS: ${whose} counted at least ${seen} at ${size}`;
+}
 function suggestionEvidence(suggestion) {
   const m2 = suggestion?.memory ?? {};
   const c = suggestion?.cpu ?? {};
@@ -8994,10 +9031,11 @@ function suggestionEvidence(suggestion) {
     cpu: cpuWords[c.reason] ?? "",
     memoryHeld: heldWords[m2.held] ?? "",
     memoryFact: m2.fact === "pressure" ? `${me.pressured} of ${plural(me.samples, "run")} reached the memory limit while stalled for memory more than 1% of their time` : "",
-    cpuFact: c.fact === "ceiling" ? `the median run was held back ${ce.throttledPct}% of its time by this host's CPU ceiling (its CPU budget, shared by every job), which a job's cpus do not change` : ""
+    cpuFact: c.fact === "ceiling" ? `the median run was held back ${ce.throttledPct}% of its time by this host's CPU ceiling (its CPU budget, shared by every job), which a job's cpus do not change` : "",
+    memoryCeiling: m2.reason === "oom-killed" ? oomCeilingWords(me) : ""
   };
 }
-var SUGGEST_WINDOW_DAYS, SUGGEST_WINDOW_RUNS, SUGGEST_MIN_SAMPLES, SUGGEST_CLOCK_SKEW_MS, SUGGEST_MAX_WALL_MS, MEMORY_REASONS, CPU_REASONS, MEMORY_HELD, MEMORY_CAP_MISSING, SIZE_FACTS, MIB, DAY_MS, isCount, productAbove, quarterMoreMiB, quarterMoreCenti, capDim, isShare, shareOf, plural, coresText, cpusText;
+var SUGGEST_WINDOW_DAYS, SUGGEST_WINDOW_RUNS, SUGGEST_MIN_SAMPLES, SUGGEST_CLOCK_SKEW_MS, SUGGEST_MAX_WALL_MS, MEMORY_REASONS, CPU_REASONS, MEMORY_HELD, MEMORY_CAP_MISSING, SIZE_FACTS, CEILING_VENUES, MIB, DAY_MS, isCount, productAbove, quarterMoreMiB, quarterMoreCenti, capDim, isShare, shareOf, plural, coresText, cpusText;
 var init_size_suggest = __esm({
   "../worker/src/size-suggest.mjs"() {
     init_job_size();
@@ -9011,6 +9049,7 @@ var init_size_suggest = __esm({
     MEMORY_HELD = Object.freeze(["cap", "largest", "no-cap"]);
     MEMORY_CAP_MISSING = Object.freeze(["unread", "none-holds", "off"]);
     SIZE_FACTS = Object.freeze(["pressure", "ceiling"]);
+    CEILING_VENUES = Object.freeze(["local", "podman"]);
     MIB = 1024 * 1024;
     DAY_MS = 24 * 60 * 60 * 1e3;
     isCount = (v) => Number.isSafeInteger(v) && v >= 0;
@@ -10849,6 +10888,10 @@ var init_reserved_env = __esm({
       "PI_RUNNER_OBSERVABLE",
       // Issue #693: derived from the resolved job memory, never chosen by a trigger or forwarded host value.
       "PI_CODEMODE_MAX_WORKERS",
+      // Issue #865: the job's size as the job reads it (job-size.mjs `jobSizeEnv`). A trigger binding one through
+      // run.secrets, or a forwarded host value, would tell the job's tools a size the container was not given.
+      "PI_JOB_SIZE_CPUS",
+      "PI_JOB_SIZE_MEMORY_MIB",
       "PI_PROVIDER",
       "PI_MODEL",
       "PI_FORK_ENTRY",
@@ -13192,39 +13235,25 @@ function findDuplicateKey(text4) {
   };
   const skipString = () => {
     i2++;
+    let escaped = false;
     while (i2 < n3) {
-      const ch = s2[i2];
-      if (ch === '"') {
-        i2++;
-        return;
-      }
-      i2 += ch === "\\" ? 2 : 1;
-    }
-  };
-  const readString = () => {
-    i2++;
-    let out = "";
-    while (i2 < n3) {
-      const ch = s2[i2];
-      if (ch === '"') {
+      const c = s2.charCodeAt(i2);
+      if (c === 34) {
         i2++;
-        return out;
+        return escaped;
       }
-      if (ch === "\\") {
-        const esc = s2[i2 + 1];
+      if (c === 92) {
+        escaped = true;
         i2 += 2;
-        if (esc === "u") {
-          out += String.fromCharCode(Number.parseInt(s2.slice(i2, i2 + 4), 16));
-          i2 += 4;
-        } else {
-          out += SIMPLE_ESCAPES[esc] ?? esc;
-        }
-        continue;
+      } else {
+        i2++;
       }
-      out += ch;
-      i2++;
     }
-    return out;
+    return escaped;
+  };
+  const readKey = () => {
+    const start = i2;
+    return skipString() ? JSON.parse(s2.slice(start, i2)) : s2.slice(start + 1, i2 - 1);
   };
   let expectKey = false;
   while (i2 < n3) {
@@ -13273,8 +13302,11 @@ function findDuplicateKey(text4) {
     if (ch === '"') {
       const top = stack[stack.length - 1];
       if (expectKey && top && top.keys !== null) {
-        const key2 = readString();
-        if (top.keys.has(key2)) return { key: key2, at: [...path6, key2].join(".") };
+        const key2 = readKey();
+        if (top.keys.has(key2)) {
+          const own2 = JSON.parse(JSON.stringify(key2));
+          return { key: own2, at: [...path6, own2].join(".") };
+        }
         top.keys.add(key2);
         path6.push(key2);
         top.named = true;
@@ -13288,10 +13320,9 @@ function findDuplicateKey(text4) {
   }
   return null;
 }
-var SIMPLE_ESCAPES, STRUCTURAL;
+var STRUCTURAL;
 var init_json_duplicates = __esm({
   "../worker/src/json-duplicates.mjs"() {
-    SIMPLE_ESCAPES = { '"': '"', "\\": "\\", "/": "/", b: "\b", f: "\f", n: "\n", r: "\r", t: "	" };
     STRUCTURAL = /* @__PURE__ */ new Set([",", ":", "{", "}", "[", "]", '"', " ", "	", "\n", "\r"]);
   }
 });
@@ -39842,7 +39873,7 @@ function setMember(members, key2, value) {
     members[key2] = value;
   }
 }
-var MAX_REPORTED_DEPTH, ROOT_SLOT, CREDIT_PER_APPEND, CREDIT_PER_CHARACTER, MAX_PENDING_SCALAR_LENGTH, NUMBER, NUMBER_WITHOUT_EXPONENT_DIGITS, LITERALS, QUOTE, BACKSLASH, StreamingJsonParser, ToolCallArgumentsStream, SIMPLE_ESCAPES2;
+var MAX_REPORTED_DEPTH, ROOT_SLOT, CREDIT_PER_APPEND, CREDIT_PER_CHARACTER, MAX_PENDING_SCALAR_LENGTH, NUMBER, NUMBER_WITHOUT_EXPONENT_DIGITS, LITERALS, QUOTE, BACKSLASH, StreamingJsonParser, ToolCallArgumentsStream, SIMPLE_ESCAPES;
 var init_streaming_json = __esm({
   "../node_modules/@earendil-works/pi-ai/dist/utils/streaming-json.js"() {
     init_json_parse();
@@ -40035,7 +40066,7 @@ var init_streaming_json = __esm({
       /** Continue an escape with `char`; returns false when `char` is not part of it and must be read normally. */
       #continueEscape(open2, char) {
         if (open2.escape === "\\") {
-          const decoded2 = SIMPLE_ESCAPES2[char];
+          const decoded2 = SIMPLE_ESCAPES[char];
           if (decoded2 !== void 0) {
             open2.escape = "";
             this.#appendString(open2, decoded2);
@@ -40239,7 +40270,7 @@ var init_streaming_json = __esm({
         return this.#arguments;
       }
     };
-    SIMPLE_ESCAPES2 = {
+    SIMPLE_ESCAPES = {
       '"': '"',
       "\\": "\\",
       "/": "/",
@@ -114938,31 +114969,44 @@ function ranBefore(job) {
   return made === 1 ? "it made 1 attempt before and was waiting to retry; whatever that attempt recorded stays, and cancel writes none" : `it made ${made} attempts before and was waiting to retry; whatever those attempts recorded stays, and cancel writes none`;
 }
 async function holdInPlace(redis, jobId) {
-  if (typeof redis?.hexists !== "function") return false;
+  if (typeof redis?.hexists !== "function") return null;
   try {
     return await redis.hexists(jobKey(jobId), "since") === 1;
   } catch {
-    return false;
+    return null;
   }
 }
+function neverSent(err) {
+  return err?.code === "ETIMEDOUT" && err?.message === "Command timed out" && err?.valkeyMayStillRun !== true;
+}
+function noAnswer(err) {
+  return err?.code === "ETIMEDOUT" || err?.valkeyMayStillRun === true;
+}
 async function removeHeldJob({ redis, queue, jobId, timeoutMs = 2e3, dropDefer = false, touchStore = void 0, touchOutbox = null, now = Date.now, interventionOrigin = "human" }) {
   let cleared = false;
+  let step = null;
   try {
     const hash2 = await redis.hgetall(jobKey(jobId));
     if (!hash2 || !hash2.since) return { invalid: `job ${jobId} is not waiting on a condition` };
     const job = await queue.getJob(jobId);
     if (!job) return { invalid: `job ${jobId} is no longer in the queue` };
-    const state5 = await job.getState().catch(() => null);
+    let unread2 = null;
+    const state5 = await job.getState().catch((err) => (unread2 = err, null));
+    if (unread2 !== null) return { invalid: `the state of job ${jobId} could not be read, so nothing was changed: ${unread2?.message ?? String(unread2)}`, ...noAnswerOf(unread2) };
     if (state5 !== "delayed" && state5 !== "waiting" && state5 !== "prioritized") {
       return { invalid: `job ${jobId} is ${state5 ?? "in an unknown state"}, not waiting -- it has already left the hold` };
     }
     cleared = true;
+    step = "hold";
     try {
       await redis.del(jobKey(jobId));
     } catch (err) {
-      if (await holdInPlace(redis, jobId)) cleared = false;
+      const inPlace = await holdInPlace(redis, jobId);
+      if (inPlace === true || neverSent(err)) cleared = false;
+      else if (inPlace === false) step = null;
       throw err;
     }
+    step = null;
     await redis.srem(HELD_SET, jobId).catch(() => {
     });
     if (hash2.dedupId) {
@@ -114970,24 +115014,33 @@ async function removeHeldJob({ redis, queue, jobId, timeoutMs = 2e3, dropDefer =
       if (holder === jobId) await redis.del(leaseKey(hash2.dedupId));
     }
     const store = touchStore === void 0 ? typeof redis?.eval === "function" ? makeTouchStore({ redis, now }) : null : touchStore;
-    const removal2 = interventionOrigin === "agent" ? (await job.remove(), { ok: true }) : await trackTouchAction({ store, outbox: touchOutbox, event: stopTouch(job, queue, jobId, now), act: async () => {
+    const remove2 = async () => {
+      step = "job";
       await job.remove();
       return { ok: true };
-    }, succeeded: () => !(job.attemptsMade > 0) && isWorkload(job) });
+    };
+    const removal2 = interventionOrigin === "agent" ? await remove2() : await trackTouchAction({ store, outbox: touchOutbox, event: stopTouch(job, queue, jobId, now), act: remove2, succeeded: () => !(job.attemptsMade > 0) && isWorkload(job) });
+    step = null;
     await Promise.all([dropDefer ? dropDeferRecord(redis, jobId, timeoutMs) : null, dropAttemptOf(redis, queue, jobId, timeoutMs)]);
     return { ok: true, jobId, attemptsMade: Number.isInteger(job.attemptsMade) && job.attemptsMade > 0 ? job.attemptsMade : 0, ...removal2.touchWarning ? { touchWarning: removal2.touchWarning } : {} };
   } catch (err) {
     const invalid = err?.message ?? String(err);
-    return cleared ? { invalid, cleared: true } : { invalid };
+    if (!cleared) return { invalid, ...noAnswerOf(err) };
+    return { invalid, cleared: true, ...err?.valkeyMayStillRun === true && step !== null ? { unanswered: step } : {} };
   }
 }
 async function removeQueuedJob({ redis, queue, job, jobId, state: state5 = null, timeoutMs = 2e3, guard = null, touchStore = void 0, touchOutbox = null, now = Date.now, interventionOrigin = "human" }) {
-  const hash2 = await Promise.resolve().then(() => redis.hgetall(jobKey(jobId))).catch(() => null);
+  let holdUnread = null;
+  const hash2 = typeof redis?.hgetall !== "function" ? null : await Promise.resolve().then(() => redis.hgetall(jobKey(jobId))).catch((err) => (holdUnread = err, null));
+  if (holdUnread !== null) {
+    const words = holdUnread?.message ?? String(holdUnread);
+    return { invalid: `could not read whether job ${jobId} is held on a wait condition, so nothing was changed: ${words}`, holdUnread: words, ...noAnswerOf(holdUnread) };
+  }
   if (hash2?.since) {
     const stop3 = await guarded(guard, job);
     if (stop3 !== null) return stop3;
     const res = await removeHeldJob({ redis, queue, jobId, timeoutMs, dropDefer: true, touchStore, touchOutbox, now, interventionOrigin });
-    if (!res.ok) return res.cleared === true ? { invalid: res.invalid, cleared: true } : { invalid: res.invalid };
+    if (!res.ok) return res.cleared === true ? { invalid: res.invalid, cleared: true, ...res.unanswered ? { unanswered: res.unanswered } : {} } : { invalid: res.invalid, ...res.noAnswer !== void 0 ? { noAnswer: res.noAnswer } : {} };
     return { ok: true, held: true, jobId: res.jobId, attemptsMade: res.attemptsMade, ...res.touchWarning ? { touchWarning: res.touchWarning } : {} };
   }
   if (!job) return { notQueued: true, state: "unknown" };
@@ -115027,7 +115080,7 @@ async function dropAttemptOf(redis, queue, jobId, timeoutMs) {
 function dropDeferRecord(redis, jobId, timeoutMs) {
   return dropKey(redis, deferKey(jobId), timeoutMs);
 }
-var isWorkload, CANCEL_REQ_TTL_MS, CANCEL_ACK_TTL_MS, cancelReqKey, cancelAckKey, agentCancelReqKey, agentCancelAckKey, cancelRequestKeyOf, QUEUED_STATES2;
+var isWorkload, CANCEL_REQ_TTL_MS, CANCEL_ACK_TTL_MS, cancelReqKey, cancelAckKey, agentCancelReqKey, agentCancelAckKey, cancelRequestKeyOf, noAnswerOf, QUEUED_STATES2;
 var init_cancel_state = __esm({
   "../worker/src/cancel-state.mjs"() {
     init_touch_state();
@@ -115044,6 +115097,7 @@ var init_cancel_state = __esm({
     agentCancelReqKey = (jobId) => `cancel:agent:req:${jobId}`;
     agentCancelAckKey = (jobId) => `cancel:agent:ack:${jobId}`;
     cancelRequestKeyOf = (jobId, interventionOrigin) => interventionOrigin === "agent" ? agentCancelReqKey(jobId) : cancelReqKey(jobId);
+    noAnswerOf = (err) => noAnswer(err) ? { noAnswer: err?.message ?? String(err) } : {};
     QUEUED_STATES2 = Object.freeze(["delayed", "waiting", "prioritized", "paused"]);
   }
 });
@@ -117405,10 +117459,12 @@ function valkeyClientContext({ env: env2 = process.env, cwd = process.cwd(), pla
   const envPath = join8(cwd, ".env");
   let content = null;
   let error = null;
+  let absent = false;
   try {
     content = readEnv3(envPath);
   } catch (err) {
-    if (err?.code !== "ENOENT") error = `${envPath} could not be read (${err?.code ?? err?.message})`;
+    if (err?.code === "ENOENT") absent = true;
+    else error = `${envPath} could not be read (${err?.code ?? err?.message})`;
   }
   const fileKeys = {};
   if (content !== null) {
@@ -117422,9 +117478,9 @@ function valkeyClientContext({ env: env2 = process.env, cwd = process.cwd(), pla
     if (keys3.error) error ??= keys3.error;
     else for (const k of [VALKEY_SHARED_KEY, VALKEY_PASSWORD_KEY, "VALKEY_URL"]) if (typeof keys3.keys[k] === "string") fileKeys[k] = keys3.keys[k];
   }
-  return valkeyContextFromKeys({ env: env2, envPath, fileKeys, error, platform, rootRefused });
+  return valkeyContextFromKeys({ env: env2, envPath, fileKeys, error, absent, platform, rootRefused });
 }
-function valkeyContextFromKeys({ env: env2 = process.env, envPath = null, fileKeys = {}, error = null, platform = process.platform, rootRefused } = {}) {
+function valkeyContextFromKeys({ env: env2 = process.env, envPath = null, fileKeys = {}, error = null, absent = false, platform = process.platform, rootRefused } = {}) {
   const fileVenue = typeof fileKeys.PI_BACKENDS === "string" ? { PI_BACKENDS: fileKeys.PI_BACKENDS } : {};
   const shared = valkeySharedOn(fileKeys[VALKEY_SHARED_KEY]);
   const filePassword = fileKeys[VALKEY_PASSWORD_KEY] || null;
@@ -117438,7 +117494,7 @@ function valkeyContextFromKeys({ env: env2 = process.env, envPath = null, fileKe
   const engine = typeof env2.PI_OPENSHELL_ENGINE === "string" ? env2.PI_OPENSHELL_ENGINE : fileKeys.PI_OPENSHELL_ENGINE;
   const derived = platform === "linux" && (venues.podmanUsed && !venues.localUsed || openshellSetupOf(venues, { PI_OPENSHELL_ENGINE: engine }).valkeyEngine === "podman");
   const envUrl = typeof env2.VALKEY_URL === "string" ? env2.VALKEY_URL : null;
-  return { envPath, shared, rootRefused: typeof rootRefused === "boolean" ? rootRefused : derived, error, password: { environment: envPassword, file: filePassword }, url: { environment: envUrl, file: fileUrl } };
+  return { envPath, shared, rootRefused: typeof rootRefused === "boolean" ? rootRefused : derived, error, absent: absent === true, password: { environment: envPassword, file: filePassword }, url: { environment: envUrl, file: fileUrl } };
 }
 function valkeyUrlProblem(url) {
   let u;
@@ -117577,6 +117633,11 @@ function scrubValkeyError(err) {
   }
   return err;
 }
+function refusedDatabaseOf(client) {
+  if (!client?.[DB_REFUSED]) return null;
+  const db = client.condition?.select ?? client.options?.db;
+  return { db: Number.isSafeInteger(db) ? db : null };
+}
 function isSelectRangeError(err) {
   return Boolean(err) && typeof err === "object" && String(err.command?.name ?? "").toLowerCase() === "select" && /DB index is out of range|invalid DB index/i.test(String(err.message ?? ""));
 }
@@ -117600,10 +117661,12 @@ function onValkeyError(emitter, what2, write = (line2) => process.stderr.write(l
 function givesUp(connection) {
   return connection?.[JUDGE]?.failFast === true;
 }
-function parseConnection(url, { failFast = false, servername = null, context = null, judge: judge2 = null, withoutPassword = false, freshContext = false } = {}) {
+function parseConnection(url, { failFast = false, servername = null, context = null, judge: judge2 = null, withoutPassword = false, freshContext = false, commandTimeoutMs = null } = {}) {
   const u = new URL(url);
   const dbProblem = valkeyUrlProblem(url);
   if (dbProblem) throw valkeyRefusal(dbProblem);
+  const bounded12 = Number.isSafeInteger(commandTimeoutMs) && commandTimeoutMs > 0;
+  if (bounded12 && !failFast) throw new TypeError("parseConnection: a command bound (commandTimeoutMs) is for a failFast client only, which has no offline queue to send a command that timed out from later");
   const where = context ?? defaultValkeyContext();
   const { password } = valkeyPasswordFor(url, where, { withoutPassword });
   return {
@@ -117612,7 +117675,9 @@ function parseConnection(url, { failFast = false, servername = null, context = n
     // reports. `context` is where the client stands (`valkeyClientContext`), the process's own when not given.
     Connector: JudgedConnector,
     // `judge` is a test seam only: the function asked for the address (judgedEndpoint when not given).
-    [JUDGE]: { url, context: where, ...judge2 ? { judge: judge2 } : {}, ...freshContext && !context ? { freshContext: true } : {}, ...failFast ? { failFast: true } : {} },
+    // `freshPassword` (issue #845): a client that judges by the context as it is at each connect sends the password that
+    // context gives then, unless it was built to send none (`withoutPassword`, a probe of what another account sees).
+    [JUDGE]: { url, context: where, ...judge2 ? { judge: judge2 } : {}, ...freshContext && !context ? { freshContext: true, ...withoutPassword ? {} : { freshPassword: true } } : {}, ...failFast ? { failFast: true } : {}, ...bounded12 ? { commandBound: true } : {} },
     // WHATWG URL keeps an IPv6 literal's brackets in `hostname` (`[::1]`), and net.connect then looks up the name
     // "[::1]", which never resolves, so a `redis://[::1]:6379` VALKEY_URL never connected (issue #464, measured on
     // Fedora 44: ETIMEDOUT). The address is the part inside them.
@@ -117634,7 +117699,10 @@ function parseConnection(url, { failFast = false, servername = null, context = n
       // don't buffer commands while disconnected -- error now
       retryStrategy: (attempts) => attempts > 2 ? null : 200
       // give up after ~2 tries
-    } : {}
+    } : {},
+    // ioredis' resend of what was on a connection that died is off with the bound: the caller was told such a command
+    // failed, and a resend on the next connection would make it run after that.
+    ...bounded12 ? { commandTimeout: commandTimeoutMs, autoResendUnfulfilledCommands: false } : {}
   };
 }
 function makeRedisClient(url, { servername = null, context = null, failFast = false, lazyConnect = false, judge: judge2 = null, withoutPassword = false, disconnectTimeoutMs = null, noOfflineQueue = false, commandTimeoutMs = null, freshContext = false } = {}) {
@@ -117642,6 +117710,30 @@ function makeRedisClient(url, { servername = null, context = null, failFast = fa
   const options = { ...parseConnection(url, { failFast, servername, context, judge: judge2, withoutPassword, freshContext }), ...noOfflineQueue ? { enableOfflineQueue: false, maxRetriesPerRequest: 1 } : {}, ...lazyConnect ? { lazyConnect: true } : {}, ...Number.isSafeInteger(disconnectTimeoutMs) && disconnectTimeoutMs >= 0 ? { disconnectTimeout: disconnectTimeoutMs } : {}, ...bounded12 ? { commandTimeout: commandTimeoutMs, autoResendUnfulfilledCommands: false } : {} };
   return bounded12 ? new BoundedRedis(options) : new Redis(options);
 }
+function sameValkeyServer(a, b) {
+  const x2 = valkeyTarget(a);
+  const y = valkeyTarget(b);
+  return !x2.error && !y.error && x2.host === y.host && x2.port === y.port;
+}
+function freshPasswordVerdict(judge2, context, held) {
+  if (!context || context.error || context.absent === true) return { take: false, declined: null };
+  if ((context.envPath ?? null) !== (judge2?.context?.envPath ?? null)) return { take: false, declined: null };
+  const { password, from } = valkeyPasswordFor(judge2.url, context);
+  const fromFile2 = from !== "VALKEY_URL" && from !== "the environment";
+  if (fromFile2 && !sameValkeyServer(context.url?.file ?? DEFAULT_VALKEY_URL, judge2.url)) return { take: false, declined: (password ?? null) !== (held ?? null) };
+  return { take: true, password: password ?? null };
+}
+function passwordDeclinedOf(client) {
+  const connector = client?.connector;
+  if (connector?.[PASSWORD_DECLINED] !== true) return false;
+  const judge2 = connector.options?.[JUDGE];
+  if (judge2?.freshPassword !== true) return false;
+  try {
+    return freshPasswordVerdict(judge2, defaultValkeyContext(), connector.options.password).declined === true;
+  } catch {
+    return false;
+  }
+}
 function isJudgedConnection(connection) {
   const options = connection?.options ?? connection;
   return options?.Connector === JudgedConnector && Boolean(options?.[JUDGE]);
@@ -117672,7 +117764,7 @@ async function claimValkeyOwner(url, folder2, { context = null, waitMs = 15e3, m
     await sleep5(500);
   }
 }
-var SCRUBS, DB_REFUSED, SELECT_HOOK, VALKEY_ERROR_QUIET_MS, VALKEY_ERRORS_HELD, saidAt, BoundedRedis, JUDGE, JudgedConnector;
+var SCRUBS, DB_REFUSED, SELECT_HOOK, VALKEY_ERROR_QUIET_MS, VALKEY_ERRORS_HELD, saidAt, COMMAND_BOUND_HOOK, BoundedRedis, JUDGE, FRESH_PASSWORD, PASSWORD_DECLINED, JudgedConnector, FRESH_PASSWORD_HOOK;
 var init_connection = __esm({
   "../worker/src/connection.mjs"() {
     init_valkey_auth();
@@ -117724,6 +117816,23 @@ var init_connection = __esm({
     VALKEY_ERROR_QUIET_MS = 6e4;
     VALKEY_ERRORS_HELD = 256;
     saidAt = /* @__PURE__ */ new Map();
+    COMMAND_BOUND_HOOK = /* @__PURE__ */ Symbol.for("pi-dispatch.valkey-command-bound");
+    if (!Redis.prototype[COMMAND_BOUND_HOOK]) {
+      const sendCommand = Redis.prototype.sendCommand;
+      Redis.prototype.sendCommand = function sendCommandWithBound(command3, stream11) {
+        const answer = sendCommand.call(this, command3, stream11);
+        if (this.options?.[JUDGE]?.commandBound !== true) return answer;
+        command3._commandTimeoutTimer?.unref?.();
+        if (this.commandQueue?.peekBack?.()?.command !== command3) return answer;
+        answer?.catch?.((err) => {
+          if (!err || typeof err !== "object" || err.name === "ReplyError" || err.valkeyRefused) return;
+          if (err.message === "Command timed out") err.code ??= "ETIMEDOUT";
+          err.valkeyMayStillRun = true;
+        });
+        return answer;
+      };
+      Redis.prototype[COMMAND_BOUND_HOOK] = true;
+    }
     BoundedRedis = class extends Redis {
       sendCommand(command3, stream11) {
         const answer = super.sendCommand(command3, stream11);
@@ -117744,6 +117853,8 @@ var init_connection = __esm({
       }
     };
     JUDGE = "piDispatchValkeyJudge";
+    FRESH_PASSWORD = /* @__PURE__ */ Symbol.for("pi-dispatch.valkey-fresh-password");
+    PASSWORD_DECLINED = /* @__PURE__ */ Symbol.for("pi-dispatch.valkey-password-declined");
     JudgedConnector = class _JudgedConnector extends AbstractConnector {
       constructor(options) {
         super(options.disconnectTimeout);
@@ -117753,6 +117864,55 @@ var init_connection = __esm({
       check() {
         return !this[DB_REFUSED];
       }
+      /**
+       * Issue #845: a `freshPassword` client's password, as `valkeyPasswordFor` reads it from the context as it is now, put
+       * where ioredis reads it for the connect about to start (the hook below). Here and not in `connect()`: by the time
+       * ioredis asks the connector for a stream it has already built that connect's AUTH from `options.password`. The options
+       * are the client's own object (ioredis hands its `options` to the Connector it constructs), so this is what the client
+       * sends. A password from VALKEY_URL's userinfo comes back as it is, so it stays fixed. The last password is kept by a
+       * context that:
+       *   - throws, or names an `error` (a `.env` that cannot be read, or a line in it the service's loader reads
+       *     differently): it cannot say which password the file holds, and dropping the one that worked would refuse a client
+       *     that is fine;
+       *   - finds no file (`absent`): a `.env` gone, for good or for the moment an editor replaces it, is not a file that
+       *     sets no password, so it does not drop one either (the console says to put the file back before a restart);
+       *   - would answer from the `.env` while that file does not name the Valkey this client dials: a password the file
+       *     gives (or the lack of one) belongs to the Valkey the file's VALKEY_URL names, the default one when it names
+       *     none, and a held client never moves to another Valkey. Review of PR #878, measured with two Valkeys: one
+       *     deployment moving to another Valkey changes both lines together, a symlinked deployment folder repointed reads
+       *     another deployment's file through the same path, and a shell that exports VALKEY_URL keeps the client on its URL
+       *     whatever the file says; in each the new Valkey's password went to the old one, which refused it, and the pages
+       *     lost the old Valkey too. The check is against the URL the client dials, not the context's own choice of URL
+       *     (`valkeyUrlFor`, which prefers this shell's and so never moved), and by the server each names (`sameValkeyServer`:
+       *     `valkeyTarget`'s host and port, so a scheme alias, a database path or a trailing `/` is the same Valkey, while
+       *     `localhost` and `127.0.0.1` stay two names, as `valkeyEndpointTag` keeps them). A rotation keeps the file's URL,
+       *     so it is taken, and so is a password a bad line hid at start once the line is fixed, when the file names the
+       *     client's Valkey. A password declined here that is not the one the client holds is recorded (`PASSWORD_DECLINED`,
+       *     `passwordDeclinedOf`), so the console names VALKEY_PASSWORD as needing a restart rather than going on refused in
+       *     silence (a shell that exports `redis://localhost:6440` over a file's `redis://127.0.0.1:6440`, say);
+       *   - is read from another `.env` path than the one the client was built with: the pi extension's context follows the
+       *     deployment pointer, and that alone says the file is another deployment's.
+       * A password from this process's environment, or from VALKEY_URL's own userinfo, is not the file's, and is taken as it
+       * comes. A context that passes all of these and gives no password drops it, as a restart would.
+       */
+      [FRESH_PASSWORD]() {
+        const judge2 = this.options?.[JUDGE];
+        if (judge2?.freshPassword !== true) return;
+        let context;
+        try {
+          context = defaultValkeyContext();
+        } catch {
+          return;
+        }
+        const verdict2 = freshPasswordVerdict(judge2, context, this.options.password);
+        if (!verdict2.take) {
+          if (verdict2.declined !== null) this[PASSWORD_DECLINED] = verdict2.declined;
+          return;
+        }
+        this[PASSWORD_DECLINED] = false;
+        if (verdict2.password) this.options.password = verdict2.password;
+        else delete this.options.password;
+      }
       connect() {
         const { options } = this;
         if (this[DB_REFUSED]) return Promise.reject(this[DB_REFUSED]);
@@ -117784,6 +117944,18 @@ var init_connection = __esm({
       }
     };
     JudgedConnector.dial = { net: netConnect2, tls: tlsConnect };
+    FRESH_PASSWORD_HOOK = /* @__PURE__ */ Symbol.for("pi-dispatch.valkey-fresh-password-hook");
+    if (!Redis.prototype[FRESH_PASSWORD_HOOK]) {
+      const connect = Redis.prototype.connect;
+      Redis.prototype.connect = function connectWithFreshPassword(...args) {
+        try {
+          this.connector?.[FRESH_PASSWORD]?.();
+        } catch {
+        }
+        return connect.apply(this, args);
+      };
+      Redis.prototype[FRESH_PASSWORD_HOOK] = true;
+    }
   }
 });
 
@@ -118877,6 +119049,10 @@ var init_redact_secrets = __esm({
     NON_SECRET_ENV_KEYS = /* @__PURE__ */ new Set([
       // Issue #693: a memory-derived concurrency count, never a credential; keep it in the structural venue env.
       "PI_CODEMODE_MAX_WORKERS",
+      // Issue #865: the job's size, two integers, never a secret. Listed, or OpenShell would put each in the job's credential
+      // provider and the agent would read a placeholder where a tool's worker count needs the number.
+      "PI_JOB_SIZE_CPUS",
+      "PI_JOB_SIZE_MEMORY_MIB",
       "PI_PROVIDER",
       "PI_MODEL",
       "PI_FORK_ENTRY",
@@ -121675,7 +121851,7 @@ function hostsAgree(rows3) {
   const [first, ...others] = rows3.map(loadsFingerprint);
   return others.every((other) => other === first);
 }
-var HOST_LOADS_CAPS, HOST_LOADS_MAX_BYTES, FIT_ORDER, HOST_LOADS_PARTS, HOST_LOADS_MORE, HOST_LOADS_LISTS, LOADS_EXTENSION_KINDS, LOADS_TRANSPORTS, LOADS_FLOW_TIERS, LOADS_REPO_STATES, isObject4, LOADS_IGNORE_FILES;
+var HOST_LOADS_CAPS, HOST_LOADS_MAX_BYTES, FIT_ORDER, HOST_LOADS_PARTS, HOST_LOADS_MORE, HOST_LOADS_LISTS, LOADS_EXTENSION_KINDS, LOADS_TRANSPORTS, LOADS_FLOW_TIERS, LOADS_REPO_STATES, isObject4, FLOW_INPUT_FIELDS, FLOW_BASIS_HEX, FLOW_BASIS_RE, LOADS_IGNORE_FILES;
 var init_host_loads = __esm({
   "../worker/src/host-loads.mjs"() {
     init_doctor_results();
@@ -121695,6 +121871,9 @@ var init_host_loads = __esm({
     LOADS_FLOW_TIERS = Object.freeze(["repository", "trigger", "overlay", "package", "none", "unknown"]);
     LOADS_REPO_STATES = Object.freeze(["present", "absent", "unknown"]);
     isObject4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+    FLOW_INPUT_FIELDS = Object.freeze(["flow", "folder", "skillsDir", "packages", "excludeExtensions"]);
+    FLOW_BASIS_HEX = 8;
+    FLOW_BASIS_RE = new RegExp(`^[0-9a-f]{${FLOW_BASIS_HEX}}$`);
     LOADS_IGNORE_FILES = Object.freeze([".gitignore", ".ignore", ".fdignore"]);
   }
 });
@@ -121888,7 +122067,7 @@ var init_mcp_preflight = __esm({
       "mcp-list-invalid": "the list this job carries is not one the triggers file's loader writes (a service in this deployment may be at another version)",
       "mcp-config-invalid": "this deployment's list of MCP servers (mcp.json in the overlay) cannot be used",
       "mcp-server-unknown": "this deployment does not offer that server",
-      "mcp-secret-reserved": "that server would be handed a credential this deployment keeps for the job itself",
+      "mcp-secret-reserved": "that server would be handed a variable this deployment keeps for the job itself",
       "mcp-secret-unmapped": "a credential that server needs is not passed by this trigger",
       "mcp-excluded": "this trigger's run.excludeTools removes every way the job could reach that server",
       "mcp-egress-unreachable": "the egress policy does not let a job reach that server",
@@ -122143,7 +122322,7 @@ var init_reason_catalog = __esm({
       ["mcp-config-invalid", "Refused: the list of MCP servers could not be used: the overlay `mcp.json` before the job started, or the list the worker wrote for the job inside its container. Not run.", "Fix the overlay `mcp.json` (`pi-dispatch doctor` checks it), and run a worker and a job image of the same release."],
       ["mcp-server-unknown", mcpRefusalComment("mcp-server-unknown", null), "Declare the server in the overlay `mcp.json`, or fix the name in `run.mcp`."],
       ["mcp-secret-unmapped", mcpRefusalComment("mcp-secret-unmapped", null), "Pass the credential the server needs in the trigger's `run.secrets`."],
-      ["mcp-secret-reserved", mcpRefusalComment("mcp-secret-reserved", null), "Give the server's credential a variable of its own."],
+      ["mcp-secret-reserved", mcpRefusalComment("mcp-secret-reserved", null), "Give the server a variable of its own, not one the job keeps."],
       ["mcp-excluded", mcpRefusalComment("mcp-excluded", null), "Remove the server from `run.mcp`, or keep a tool that reaches it out of `run.excludeTools`."],
       ["mcp-egress-unreachable", mcpRefusalComment("mcp-egress-unreachable", null), "Add the server's host to the egress allowlist, or drop the server from `run.mcp`."],
       ["mcp-package-runner", mcpRefusalComment("mcp-package-runner", null), "Allow the package registry in the egress allowlist, or install the server in the job image."],
@@ -123831,11 +124010,11 @@ function readDeploymentEnv({ dir, fs: fs9, uid = process.geteuid?.(), names: nam
   }
 }
 function deploymentServiceEnv({ env: env2, dir, keys: keys3, platform = process.platform, fs: fs9, uid = process.geteuid?.() }) {
-  const { path: path6, bytes, unreadable: unreadable3, untrusted } = readDeploymentEnv({ dir, fs: fs9, uid });
+  const { path: path6, bytes, absent, unreadable: unreadable3, untrusted } = readDeploymentEnv({ dir, fs: fs9, uid });
   const raw = untrusted ? null : bytes;
   const file = raw === null ? null : serviceEnvFileOf(raw, path6, serviceEnvLoader(platform));
   const shellRunsLine = file?.loader === "shell" && file.hazard !== null && file.hazard.shape !== "shell-crlf-comment" ? file.hazard.line : null;
-  return { ...resolveServiceEnv({ env: env2, file, keys: keys3 }), path: path6, unreadable: unreadable3, untrusted, hazard: file?.hazard ?? null, shellRunsLine };
+  return { ...resolveServiceEnv({ env: env2, file, keys: keys3 }), path: path6, absent, unreadable: unreadable3, untrusted, hazard: file?.hazard ?? null, shellRunsLine };
 }
 var init_service_env = __esm({
   "../worker/src/service-env.mjs"() {
@@ -127157,6 +127336,7 @@ __export(read_model_exports, {
   liveAbsentCause: () => liveAbsentCause,
   liveJobsOfRun: () => liveJobsOfRun,
   loaderRefuses: () => loaderRefuses,
+  loaderTriggers: () => loaderTriggers,
   makeLocalRunIndex: () => makeLocalRunIndex,
   mapSchedulers: () => mapSchedulers,
   mergedDollarProblem: () => mergedDollarProblem,
@@ -127303,7 +127483,7 @@ import { execFileSync as execFileSync3 } from "node:child_process";
 import { homedir as homedir3 } from "node:os";
 function resolvePaths(env2 = process.env) {
   return {
-    valkeyUrl: env2.VALKEY_URL ?? "redis://127.0.0.1:6379",
+    valkeyUrl: env2.VALKEY_URL ?? DEFAULT_VALKEY_URL,
     logsDir: logsDirPath(env2),
     settingsFile: settingsFilePath(env2),
     // Cwd defaults match what `pi-dispatch init` scaffolds (and, since issue #80, what the receiver
@@ -127463,7 +127643,7 @@ function panelValkeyContext({ env: env2 = process.env, pointerDir = null, owned
   if (pointerDir === null) return valkeyContextFromKeys({ env: own2, platform });
   const res = deploymentServiceEnv({ env: {}, dir: pointerDir, keys: VALKEY_CONTEXT_KEYS, platform, fs: fs9, uid });
   const error = res.untrusted ? `${res.path} ${res.untrusted}` : res.unreadable ? `${res.path} could not be read (${res.unreadable})` : res.hazardSkipped.length > 0 ? `${res.path} line ${res.hazard.line} ${res.hazard.what}` : res.unread.length > 0 ? `${res.path} assigns ${res.unread.map((u) => `${u.key} (line ${u.line})`).join(", ")} in a form the service's loader may read differently` : null;
-  return valkeyContextFromKeys({ env: own2, envPath: res.path, fileKeys: res.fromFile, error, platform });
+  return valkeyContextFromKeys({ env: own2, envPath: res.path, fileKeys: res.fromFile, error, absent: res.absent === true, platform });
 }
 function installPanelValkeyContext({ env: env2 = process.env } = {}) {
   useValkeyContext(() => {
@@ -128873,11 +129053,13 @@ function readTriggers({ triggersPath, fs: fs9 = nodeFs11 }) {
   return { triggers: triggers2, count: entries.length, ...bundles !== null && { secretBundles: bundles }, ...loaderRefuses(text4, triggersPath) && { doesNotLoad: true } };
 }
 function loaderRefuses(text4, path6) {
+  return loaderTriggers(text4, path6) === null;
+}
+function loaderTriggers(text4, path6) {
   try {
-    parseTriggers(text4, path6);
-    return false;
+    return parseTriggers(text4, path6);
   } catch {
-    return true;
+    return null;
   }
 }
 function configLocationsOf({ paths = {}, deploymentDir = null, home = homedir3() } = {}) {
@@ -130617,6 +130799,21 @@ function createFleetReader(paths, {
     async sandboxEnd(request2) {
       return requestSandboxEndFn({ redis, ...request2, now: nowFn });
     },
+    /**
+     * Issue #845: the database this reader's held client was refused (`refusedDatabaseOf`: `{ db }`, or null when it holds
+     * no refusal). The queues are rebuilt and try again; the held client never does, so its reads stay refused until the
+     * process is restarted, and the console says that rather than only that Valkey could not be read. Reads no Valkey.
+     */
+    refusedDatabase() {
+      return refusedDatabaseOf(redis);
+    },
+    /**
+     * Issue #845, review of PR #878: whether this reader's held client last declined a VALKEY_PASSWORD the `.env` now
+     * gives, because the file does not name the Valkey it dials as it dials it (`passwordDeclinedOf`). Reads no Valkey.
+     */
+    passwordDeclined() {
+      return passwordDeclinedOf(redis);
+    },
     async dispose() {
       disposed = true;
       for (const q of sandboxQueues.values()) {
@@ -150381,9 +150578,15 @@ function buildSandboxRunArgs({ venue = DEFAULT_BACKEND, image, name: name2, work
       TMOUT: idleSeconds > 0 ? String(idleSeconds) : void 0,
       // Beside `--user` only (issue #341). Not a credential either.
       HOME: user !== null ? home : void 0,
+      // Issue #865: the size this shell is built at (`size`: the manifest's, the run's own or, for a prepared
+      // sandbox, its trigger's), by the job env's own function (`jobSizeEnv`), so a flow command copied in here
+      // (`jest --maxWorkers=$PI_JOB_SIZE_CPUS`) sizes its pool as a job of that size would instead of expanding to
+      // nothing. A run retained before this release never had the variables; its shell gets them for its recorded
+      // size all the same. Two integers, not a credential.
+      ...jobSizeEnv(size),
       // Still NO CREDENTIALS, and that clause is untouched: a proxy URL is not a credential, and
       // buildContainerEnv is still not reused here. The env is two variables about the terminal, HOME
-      // beside `--user`, and, when a policy is armed, four about the network.
+      // beside `--user`, two about the run's size and, when a policy is armed, four about the network.
       ...proxyEnv
     },
     // Ahead of the env and the mounts, and well ahead of the image, which the builder keeps as
@@ -153105,7 +153308,7 @@ function sizingLines(sizing, id7, iw, styler) {
   if (verdicts.length > 0) push(wrapColumns(verdicts.join("; "), sub2, styler), tone);
   if (typeof s2.call === "string") out.push(...callLines(cellOf(s2.call), iw, styler, indent.length));
   if (over) push(wrapColumns(`no live host admits it (${cellOf(s2.words?.refusal ?? "")}): a job of it would wait for a host that never comes`, sub2, styler), "error");
-  for (const fact of [s2.words?.memoryFact, s2.words?.cpuFact]) if (typeof fact === "string" && fact !== "") push(wrapColumns(cellOf(fact), sub2, styler), "dim");
+  for (const fact of [s2.words?.memoryFact, s2.words?.cpuFact, s2.words?.memoryCeiling]) if (typeof fact === "string" && fact !== "") push(wrapColumns(cellOf(fact), sub2, styler), "dim");
   return out;
 }
 function projectRows(snapshot, info = null) {
@@ -161534,18 +161737,28 @@ function agreeRow2(row2, trigger2) {
     skills: row2.skills ?? [],
     mcp: (row2.mcp ?? []).filter((server) => named2.includes(server.name) && server.enabled === true),
     packages: packagesLoaded(row2, trigger2),
-    flows: (row2.flows ?? []).filter((entry3) => entry3.trigger === trigger2.index && entry3.flow === trigger2.flow)
+    // Its answer for the file as it is, without the basis: two hosts that answer for it hold the same one, and a host on a release before
+    // #869 holds none, which would otherwise be a difference no job meets.
+    flows: [flowRowFor(row2, trigger2)?.row].filter(Boolean).map((found) => ({ trigger: found.trigger, flow: found.flow, tier: found.tier, package: found.package, repo: found.repo }))
   };
 }
-function flowAnswer(row2, trigger2) {
-  const found = (row2.flows ?? []).find((entry3) => entry3.trigger === trigger2.index && entry3.flow === trigger2.flow);
-  if (!found) return null;
+function flowRowFor(row2, trigger2) {
+  if (typeof trigger2.flow !== "string") return null;
+  const here = (row2.flows ?? []).filter((entry3) => entry3.trigger === trigger2.index);
+  const found = here.find((entry3) => entry3.flow === trigger2.flow);
+  if (!found) return here.some((entry3) => typeof entry3.basis === "string" && entry3.basis !== trigger2.flowBasis) ? { stale: true } : null;
+  if (typeof found.basis === "string") return found.basis === trigger2.flowBasis ? { row: found } : { stale: true };
   if (found.tier === "package" && (trigger2.excludeExtensions ?? []).includes(found.package)) return null;
   if (found.tier === "package" && trigger2.packages === false) return null;
+  return { row: found };
+}
+function flowAnswer(row2, trigger2) {
+  const found = flowRowFor(row2, trigger2)?.row;
+  if (!found) return null;
   return found.tier === "package" ? `from ${found.package ?? "a staged package"}` : FLOW_TIER_WORDS[found.tier] ?? null;
 }
 function lacksFlow(row2, trigger2) {
-  const found = trigger2.flow === null ? null : (row2.flows ?? []).find((entry3) => entry3.trigger === trigger2.index && entry3.flow === trigger2.flow);
+  const found = flowRowFor(row2, trigger2)?.row;
   return found?.tier === "none" && found.repo === "absent";
 }
 function hostPills(rows3, trigger2, liveList, fileVersion) {
@@ -161638,8 +161851,13 @@ function flowRow({ trigger: trigger2, rows: rows3, editor: editor3 }) {
   const choices = offered.filter((entry3) => !seen.has(entry3.name) && seen.add(entry3.name)).slice(0, FLOW_CHOICES_MAX);
   const groups = /* @__PURE__ */ new Map();
   const silent = [];
+  const stale = [];
   for (const row2 of rows3) {
     if (trigger2.flow === null || row2.state !== "current") continue;
+    if (flowRowFor(row2, trigger2)?.stale === true) {
+      stale.push(row2.name);
+      continue;
+    }
     const word3 = flowAnswer(row2, trigger2);
     if (word3 === null) silent.push(row2.name);
     else groups.set(word3, [...groups.get(word3) ?? [], row2.name]);
@@ -161648,7 +161866,11 @@ function flowRow({ trigger: trigger2, rows: rows3, editor: editor3 }) {
   const lacking = rows3.filter((row2) => row2.state === "current" && lacksFlow(row2, trigger2)).map((row2) => row2.name);
   const said = [
     ...[...groups].map(([word3, names2]) => `${listed(names2)} ${names2.length === 1 ? "finds" : "find"} ${trigger2.flow} ${word3}`),
-    silent.length > 0 ? `${listed(silent)} ${silent.length === 1 ? "has" : "have"} no answer for it yet` : null,
+    // Issue #869: an answer judged before a change to what the flow is found by. One sentence for one host or many, so it reads alike,
+    // and none promises a later answer: a spent one-shot, a file the loaders refuse or a host whose own triggers file differs gets none.
+    stale.length > 0 ? `${listed(stale)} ${TRIGGER_GETS_WORDS.flowStale}` : null,
+    // No "yet": a flow that fails the skill charset, or a spent one-shot, never gets one.
+    silent.length > 0 ? `${listed(silent)} ${silent.length === 1 ? "has" : "have"} no answer for it` : null,
     unknown3.length > 0 ? `${listed(unknown3)} ${unknown3.length === 1 ? "has" : "have"} no answer to read` : null
   ].filter(Boolean);
   return {
@@ -161846,9 +162068,11 @@ function triggerGetsOf({ trigger: trigger2, records = [], historyUnread = false,
 function freshFlowWords(row2, trigger2) {
   if (trigger2.flow === null) return SANDBOX_FRESH_WORDS.noFlow;
   const who = `a job of trigger ${trigger2.index + 1} on this host`;
+  const at2 = flowRowFor(row2, trigger2);
+  if (at2?.stale === true) return `Whether ${who} would find ${trigger2.flow} is unknown: ${SANDBOX_FRESH_WORDS.flowStale}.`;
   const word3 = flowAnswer(row2, trigger2);
   if (word3 === null) return `Whether ${who} would find ${trigger2.flow} is unknown: its last doctor run has no answer for it.`;
-  const tier = (row2.flows ?? []).find((entry3) => entry3.trigger === trigger2.index && entry3.flow === trigger2.flow)?.tier;
+  const tier = at2.row.tier;
   if (tier === "none" || tier === "unknown") return `Whether ${who} would find ${trigger2.flow} is unknown: doctor found it ${word3}, and the repository, which is on no host, may hold it.`;
   if (tier === "repository") return `${who.charAt(0).toUpperCase()}${who.slice(1)} would find ${trigger2.flow} ${word3}.`;
   return `${who.charAt(0).toUpperCase()}${who.slice(1)} would find ${trigger2.flow} ${word3}, unless the repository holds it at its base commit, which comes first.`;
@@ -161880,7 +162104,7 @@ function freshMcpWords(row2, named2) {
   ].filter(Boolean);
   return `${said.join("; ")}.`;
 }
-function sandboxFreshRows({ hostLoads, host, triggerIndex, flow = null, mcp = [], withholdsPackages = false, excludes = [], image = null }) {
+function sandboxFreshRows({ hostLoads, host, triggerIndex, flow = null, flowBasis = null, mcp = [], withholdsPackages = false, excludes = [], image = null }) {
   const rows3 = [[`On ${host}`, sandboxFreshLine({ hostLoads, host, triggerIndex, withholdsPackages, excludes, image, mcp })]];
   const row2 = hostLoadsRow(hostLoads, host);
   if (row2.state === "unknown") return rows3;
@@ -161891,7 +162115,7 @@ function sandboxFreshRows({ hostLoads, host, triggerIndex, flow = null, mcp = []
     if (listedNames.length > 0) rows3.push([SANDBOX_FRESH_WORDS.mcpLabel, [`${listed(listedNames)} unknown here: its last doctor run is old.`]]);
     return rows3;
   }
-  rows3.push([SANDBOX_FRESH_WORDS.flowLabel, [freshFlowWords(row2, { index: triggerIndex, flow: named2, excludeExtensions: excludes, packages: withholdsPackages ? false : void 0 })]]);
+  rows3.push([SANDBOX_FRESH_WORDS.flowLabel, [freshFlowWords(row2, { index: triggerIndex, flow: named2, excludeExtensions: excludes, packages: withholdsPackages ? false : void 0, flowBasis })]]);
   const mcpWords = freshMcpWords(row2, mcp);
   if (mcpWords !== null) rows3.push([SANDBOX_FRESH_WORDS.mcpLabel, [mcpWords]]);
   return rows3;
@@ -161948,6 +162172,7 @@ var init_trigger_gets_view = __esm({
       viewer: "An operator changes these on this page, with one preview and one Confirm.",
       noTool: "No tool reaches this action; dispatch_trigger_edit keeps today\u2019s scope.",
       flowPicker: "It leaves out what is in a skills folder, or in a repository not on this host, and any other name can be typed.",
+      flowStale: "answered for another version of the triggers file, so it is unknown there",
       reloadDrops: "A Confirm elsewhere on this page reloads it, and drops any change not yet written in What its jobs get.",
       othersUnread: "This page read the triggers file, and its other reads failed: the run history, the hosts and the jobs in line are unknown.",
       pillOrder: "differs in the order or kind of what it loads",
@@ -161981,6 +162206,7 @@ var init_trigger_gets_view = __esm({
     alsoNaming = (list5, name2) => list5.filter((other) => other !== name2 && (overlayEntryNamed(other, name2) || overlayEntryNamed(name2, other)));
     SANDBOX_FRESH_WORDS = Object.freeze({
       noFlow: "This trigger names no flow.",
+      flowStale: "its last doctor run answered for another version of the triggers file",
       flowLabel: "Flow",
       mcpLabel: "MCP servers"
     });
@@ -162026,7 +162252,7 @@ function sandboxNew(v) {
   const plan = data5?.plan;
   const source2 = data5?.fromRun ? html`<p class="sx-p">Preparing from <a class="link" href="${`/run?${new URLSearchParams({ id: data5.fromRun })}`}">${data5.fromRun}</a>. The ref starts at HEAD because the record holds no created pull request. ${data5.sourceRun?.historicalIndex !== null && data5.sourceRun?.historicalIndex !== void 0 ? `Its historical trigger row was ${data5.sourceRun.historicalIndex + 1}; that does not prove the current row's identity.` : "Its original trigger identity is unavailable."} Choose the current trigger explicitly.${String(data5.sourceRun?.backend).startsWith("openshell") ? " Its original OpenShell venue cannot prepare a sandbox; deliberately choose a compatible local or podman trigger." : ""}</p>` : null;
   const form = html`${source2}<form method="get" action="/runs/sandboxes" data-live-hold>${data5?.fromRun ? html`<input type="hidden" name="fromRun" value="${data5.fromRun}">` : null}<div class="sx-form">${fields3}</div><div class="sx-form-end">${btn({ type: "submit", label: "Review settings" })}</div></form>`;
-  const fresh = plan ? html`${facts(sandboxFreshRows({ hostLoads: v.data?.hostLoads, host: plan.host, triggerIndex: s2.index, flow: data5?.flow ?? null, mcp: data5?.mcp ?? [], withholdsPackages: data5?.withholdsPackages === true, excludes: data5?.excludes ?? [], image: plan.image }).map(([label3, parts2]) => [label3, wordsHtml(parts2)]), { cols: 1 })}<p class="sx-small">${icon("info", { size: "sm" })}<span>${LOADED_WORDS.freshFoot}</span></p>` : null;
+  const fresh = plan ? html`${facts(sandboxFreshRows({ hostLoads: v.data?.hostLoads, host: plan.host, triggerIndex: s2.index, flow: data5?.flow ?? null, flowBasis: data5?.flowBasis ?? null, mcp: data5?.mcp ?? [], withholdsPackages: data5?.withholdsPackages === true, excludes: data5?.excludes ?? [], image: plan.image }).map(([label3, parts2]) => [label3, wordsHtml(parts2)]), { cols: 1 })}<p class="sx-small">${icon("info", { size: "sm" })}<span>${LOADED_WORDS.freshFoot}</span></p>` : null;
   const preparation = plan ? html`<h3 class="sx-h3">Given by the trigger, not chosen here</h3>${facts5(plan)}${fresh}<p class="sx-p">${plan.pin ? `Pinned for ${plan.pinDays} days` : `Kept for ${plan.retentionHours} hours`}, on ${plan.host}. The worker clones on that host with a credential for this repository, then drops it. No container starts, no model runs, no dollars are spent and no run slot is taken.</p>${acts2(v) ? actForm({ action: "sandbox-prepare", hidden: [["repo", s2.repo], ["index", s2.index, "int"], ["ref", s2.ref], ["host", s2.host], ["pin", Boolean(s2.pin), "json"]], label: "Preview preparation", kind: ["primary"], icon: "plus" }) : html`<p class="card__sub">This console is read-only. Prepare from the host's terminal.</p>`}${cmd(["pi-dispatch", "sandbox", "--new", s2.repo, "--ref", s2.ref, "--as", String(s2.index), ...s2.pin ? ["--pin"] : []])}<p class="card__sub">The CLI’s --as takes a zero-based file index: trigger row ${s2.index + 1} is index ${s2.index}.</p>` : html`<p class="sx-p" role="status">${data5?.refusal ?? "Choose a repository, its trigger, a ref and a host, then review their settings."}</p>`;
   return card3("Without a run", html`${form}${preparation}<noscript><p class="card__sub">${SANDBOX_WORDS.noScript}</p></noscript>`, "a fresh clone with a trigger's image and a job's isolation");
 }
@@ -163516,7 +163742,7 @@ function projectSizing2(v) {
   const s2 = p.sizing;
   const dim = (label3, d, words) => html`<p class="proj-verdict"><b>${label3}: ${d?.suggested ? `suggest ${label3 === "Memory" ? gibText(d.suggested) : formatCpus(d.suggested) + " CPUs"}` : d?.reason === "not-enough-runs" ? "not enough runs" : d?.reason ?? "unknown"}.</b> ${(label3 === "Memory" ? memoryWords(words) : words) ?? "No suggestion could be read."}</p>`;
   const action2 = s2?.action;
-  return card6("Job size", html`${projectSizingChart(p)}${s2 ? html`${dim("Memory", s2.memory, s2.words?.memory)}${dim("CPUs", s2.cpu, s2.words?.cpu)}${[memoryWords(s2.words?.memoryHeld), s2.words?.memoryFact, s2.words?.cpuFact, memoryWords(s2.words?.refusal)].filter(Boolean).map(note2)}` : note2("No size suggestion could be read.")}${p.sizingUnreadable ? note2("The measurements or scoped limits could not be read completely.") : null}${note2("Measured inside the jobs, so advisory.")}${s2?.call && canAct(v) ? html`<p class="proj-sub">The exact call</p><div class="cmd"><code>${s2.call}</code><button class="btn btn--sm" type="button" data-copy hidden>Copy</button></div>${action2 ? note2(action2.row === null ? `Adds a scoped-limits row for project:${p.id}.` : `Applies to scoped-limits row ${action2.row}, project:${p.id}.`) : null}${canAct(v) && action2 ? actForm3(action2.action, { hidden: [...action2.index === void 0 ? [] : [["index", action2.index, "int"]], ["limit", JSON.stringify(action2.limit), "json"]], label: "Preview this size" }) : null}` : null}`, "peak memory per run, last 30 days");
+  return card6("Job size", html`${projectSizingChart(p)}${s2 ? html`${dim("Memory", s2.memory, s2.words?.memory)}${dim("CPUs", s2.cpu, s2.words?.cpu)}${[memoryWords(s2.words?.memoryHeld), s2.words?.memoryFact, s2.words?.cpuFact, memoryWords(s2.words?.refusal), s2.words?.memoryCeiling].filter(Boolean).map(note2)}` : note2("No size suggestion could be read.")}${p.sizingUnreadable ? note2("The measurements or scoped limits could not be read completely.") : null}${note2("Measured inside the jobs, so advisory.")}${s2?.call && canAct(v) ? html`<p class="proj-sub">The exact call</p><div class="cmd"><code>${s2.call}</code><button class="btn btn--sm" type="button" data-copy hidden>Copy</button></div>${action2 ? note2(action2.row === null ? `Adds a scoped-limits row for project:${p.id}.` : `Applies to scoped-limits row ${action2.row}, project:${p.id}.`) : null}${canAct(v) && action2 ? actForm3(action2.action, { hidden: [...action2.index === void 0 ? [] : [["index", action2.index, "int"]], ["limit", JSON.stringify(action2.limit), "json"]], label: "Preview this size" }) : null}` : null}`, "peak memory per run, last 30 days");
 }
 function projectRecent(v) {
   if (!ready(v)) return null;
@@ -172285,6 +172511,14 @@ var init_watch = __esm({
   }
 });
 
+// src/console/restart-notice.mjs
+var init_restart_notice = __esm({
+  "src/console/restart-notice.mjs"() {
+    init_kit();
+    init_html();
+  }
+});
+
 // src/console/session-ends.mjs
 function streamEndOf(v) {
   return typeof v === "string" && STREAM_ENDS.includes(v) ? v : null;
@@ -172351,6 +172585,7 @@ var init_shell = __esm({
     init_html();
     init_kit();
     init_pages();
+    init_restart_notice();
     init_pulse_icons();
     init_signin();
     init_theme();
@@ -178182,8 +178417,8 @@ var init_setup_wizard = __esm({
     init_connection();
     init_service_env();
     init_index();
-    RUNTIME_VERSION = "5.2.0";
-    RECEIVER_VERSION = "5.2.0";
+    RUNTIME_VERSION = "5.2.1";
+    RECEIVER_VERSION = "5.2.1";
     RUNTIME_PKG = "@edgehero/pi-dispatch";
     RECEIVER_PKG = "@edgehero/pi-dispatch-receiver";
     NUDGE_MARKER_BASENAME = "pi-dispatch-setup.nudged";
@@ -180063,7 +180298,7 @@ The project's runs could not be read (${sizing.unreachable}).`;
     if (dim.held === "largest") return `no larger size (${dim.reason}: ${words})`;
     return dim.reason === "not-enough-runs" ? notEnoughRunsText(dim, shown3 === formatCpus ? cpusText : shown3) : "fits";
   };
-  const facts7 = [s2.words.memoryFact, s2.words.cpuFact].filter(Boolean);
+  const facts7 = [s2.words.memoryFact, s2.words.cpuFact, s2.words.memoryCeiling].filter(Boolean);
   return `
 Project ${id7}'s runs (the last ${SUGGEST_WINDOW_DAYS} days, measured inside the jobs, so advisory): size now ${formatMemory(m2.current)}, ${cpusText(c.current)}; ${peaks}. They suggest memory ${said(m2, s2.words.memory, formatMemory)}, CPUs ${said(c, s2.words.cpu, formatCpus)}.${facts7.length > 0 ? ` ${facts7.map((f3) => `${f3[0].toUpperCase()}${f3.slice(1)}.`).join(" ")}` : ""}`;
 }