@edgehero/pi-dispatch 1.10.3 → 2.0.0

package/src/start.mjs

@@ -1,9 +1,15 @@
-import { readFileSync, watch } from "node:fs";
+import { readdirSync, readFileSync, statSync, watch } from "node:fs";
+import { lookup as dnsLookup } from "node:dns/promises";
+import { homedir, networkInterfaces, release as osRelease, userInfo } from "node:os";
 import { dirname, basename, join } from "node:path";
-import { configError, loadConfig } from "./config.mjs";
-import { makeRedisClient, parseConnection } from "./connection.mjs";
+import { configError, ensureJobsDir, ensureSandboxDir, ensureUnderAccountRoot, loadConfig } from "./config.mjs";
+import { passwdNameFrom, probeTcpAddress, readSubuidRanges, resolveWorkerValkey } from "./podman-stack.mjs";
+import { valkeyClientContext } from "./valkey-endpoint.mjs";
+import { authRefusalFor, makeRedisClient, onValkeyError, parseConnection, valkeyAuthState, valkeyPasswordFor } from "./connection.mjs";
 import { reconcileGated, reloadSchedules } from "./cron.mjs";
 import { makeGitHubAuth } from "./get-token.mjs";
+import { InfraRetry, NETNS_KEEPER_CRASH_LOOP, NETNS_KEEPER_NOT_HOLDING } from "./processor.mjs";
+import { transientError } from "./transient.mjs";
 import { makeGitHubHost } from "./github-host.mjs";
 import { makeGitLabAuth } from "./gitlab-auth.mjs";
 import { makeGitLabHost } from "./gitlab-host.mjs";
@@ -18,25 +24,34 @@ import { cronFingerprint } from "./fingerprint.mjs";
 import { makeHostRegistry } from "./host-registry.mjs";
 import { makeImagePreflight } from "./image-preflight.mjs";
 import { createWorker, JOB_TIMEOUT_MS } from "./index.mjs";
+import { BOOT_REFUSING_JOB_USER_CAUSES, DAEMON_FACTS_TIMEOUT_MS, jobUserRefusal, makeDaemonFactsReader, makeJobUserResolver, relabelsPrivateMounts, resolveImageUser } from "./job-user.mjs";
 import { makeCollectChain } from "./outbox.mjs";
 import { containerPackagePaths, readStageManifest } from "./packages.mjs";
 import { makeCleanup, makeForgePreparers, makePrepareWorkspace } from "./prepare.mjs";
-import { listRunningSandboxes } from "./sandbox.mjs";
+import { listRunningSandboxes, makeSandboxNetworkSweeper, makeSandboxRuntimeWatch } from "./sandbox.mjs";
+import { makeRetentionSweep } from "./retention-sweep.mjs";
 import { makeSandboxReaper } from "./sandbox-store.mjs";
 import { makeSessionStore } from "./session-store.mjs";
+import { scrubCredentials } from "./redact.mjs";
 import { makeCheckOnceSpent, makeCheckWaitSkew, makeDisarmOnce } from "./triggers-file.mjs";
+import { WATCH_DEBOUNCE_MS, changedWhileArming, makeWatchCloser, readBeforeArming } from "./watch-closer.mjs";
 import { loadPauseWindows, pauseUntilMs } from "./pause-windows.mjs";
 import { loadScopedLimits, scopeKeyPrefix } from "./scoped-limits.mjs";
+import { makeOnFailure } from "./on-failure.mjs";
 import { makeWaitChecker } from "./wait-check.mjs";
 import { makeWaitState } from "./wait-state.mjs";
 import { hostQueueName, makeQueue } from "./queue.mjs";
-import { makeLocalBackend, makeReaper, makeStopContainer } from "./backend-local.mjs";
-import { makeBackendRegistry, reapAll } from "./backend-registry.mjs";
-import { DEFAULT_BACKEND } from "./backends.mjs";
+import { endpointShown, makeDockerEndpointResolver, makeLocalBackend, makeReaper, makeStopContainer, quotedShown } from "./backend-local.mjs";
+import { NETNS_KEEPER_MIN_AGE_MS, NETNS_KEEPER_YOUNG_MARGIN_MS, runtimeFromFacts } from "./netns-keeper.mjs";
+import { makeBackendRegistry, reapAll, resolveBackendName } from "./backend-registry.mjs";
+import { DEFAULT_BACKEND, DOCKER_ENDPOINT_LOCAL, PODMAN_ADDS_NO_MOUNTS, PODMAN_BACKEND, PODMAN_BOUNDS_DELEGATED, PODMAN_SERVICE_LOCAL, backendFor, observationRefusalIsTransient, observationRefusals, unobservedFloor } from "./backends.mjs";
+import { PODMAN_BOOT_REFUSING_CAUSES, PODMAN_INFO_TIMEOUT_MS, cachedPodmanInfo, decidePodmanJobUser, makePodmanBackend, makePodmanInfoReader, makePodmanReaper, observePodman, podmanConfRefusal, unavailableFor, podmanConfWidening, podmanJobUserRefusal, resolvePodmanImageUser } from "./backend-podman.mjs";
+import { PODMAN_RESTART_HOLD_EXPIRED, makePodmanServiceReader, onceFs, makeRootfulMemory, observeHost, observeRootfulConf, readRootfulService, rootfulConfRefusal, rootfulConfRetries, rootfulUnreadList, runtimeObservationKey } from "./runtime-observations.mjs";
 
 import { makeRunContainer } from "./run-container.mjs";
+import { resolveProviderCredential } from "./env-allowlist.mjs";
 import { makeSecretsResolver } from "./secrets.mjs";
-import { buildRecord, makeFindPreviousRun, makeLogReaper, makeLogSink, makeRecordWriter, sanitizeJobId } from "./run-history.mjs";
+import { buildRecord, makeFindPreviousRun, makeLogReaper, makeLogSink, makeRecordWriter, RUNNER_POLICY_REASONS, sanitizeJobId } from "./run-history.mjs";
 import { makeRunMirror } from "./run-mirror.mjs";
 import { effectiveSettings, readOverlay } from "./runtime-settings.mjs";
 import { authoredCron, loadSchedules, servedSchedules } from "./schedules.mjs";
@@ -46,6 +61,44 @@ import { makeStallGuard } from "./scheduler-stall-guard.mjs";
 /** How long boot will wait for `docker image inspect` before shipping without a digest. */
 const BOOT_IMAGE_TIMEOUT_MS = 5_000;
 
+/**
+ * How long boot waits for the daemon facts read (issues #341 and #345): the image read's 5 s, unless the floor asks for a
+ * word only a DAEMON observation earns (`isolation`, `mountSet`), when it waits the facts read's own bound plus 2 s. A
+ * busy host's `docker info` is the slow read, and a floor this boot met from the table before must not exit 1 on every
+ * restart of a healthy daemon. Exported for its test.
+ */
+export function bootFactsBoundMs({ backends, backendFloor }) {
+	const needsDaemon = unobservedFloor(backends, backendFloor, { [DOCKER_ENDPOINT_LOCAL]: true }).length > 0;
+	return needsDaemon ? DAEMON_FACTS_TIMEOUT_MS + 2_000 : BOOT_IMAGE_TIMEOUT_MS;
+}
+
+/**
+ * How long after a failed forge-auth re-resolve before another job is allowed to try again (issue #316).
+ *
+ * The in-flight promise dedupes concurrent callers; this bounds sequential ones. Thirty seconds is short
+ * enough that a forge coming back is picked up within one job of it, and long enough that a worker
+ * draining a thousand-job backlog against a forge that is still down opens tens of identity calls rather
+ * than a thousand -- each of which can otherwise sit on undici's 300-second header timeout with the queue
+ * waiting behind it.
+ */
+const AUTH_RETRY_COOLDOWN_MS = 30_000;
+
+/**
+ * How long a job will wait for a forge-auth re-resolve before giving up on it.
+ *
+ * This is the bound that keeps the re-resolve off the critical path, and without it the feature is a
+ * wedge rather than a repair. `mintToken` is awaited inside `runJob`, none of the four identity
+ * resolvers passes an `AbortSignal`, and undici's default `headersTimeout` is FIVE MINUTES -- so a forge
+ * that accepts the connection and then answers nothing (a load balancer draining, a firewall that drops
+ * rather than rejects) would hold every job for that long, with BullMQ renewing the lock the whole time
+ * so nothing ever stalls out. At `PI_CONCURRENCY=1` that is the queue stopped, with no error line.
+ *
+ * Ten seconds is far longer than a healthy `GET /user` and far shorter than anything an operator would
+ * call a hang. Losing the race does not cancel the underlying call: it is left to settle into the
+ * cooldown, so the next job still benefits from whatever it eventually learns.
+ */
+const AUTH_RESOLVE_TIMEOUT_MS = 10_000;
+
 /**
  * How long a fleet-wide scope claim lives. `JOB_TIMEOUT_MS` plus slack: a container cannot outlive that
  * ceiling, so the claim cannot expire underneath a live job -- which is what makes a refresh unnecessary
@@ -68,97 +121,40 @@ const WORKER_VERSION = (() => {
 	}
 })();
 
+// `makeWatchCloser` lives in its own module since issue #301 (the receiver's triggers watch registers
+// the same handle); re-exported here so every existing importer keeps its address.
+export { makeWatchCloser } from "./watch-closer.mjs";
+
 /**
- * Boot-time reaper: clear stray `pi-job-*` containers a previous worker crash left behind, before
- * the new worker starts draining. A leaked container keeps spending, so it must go before any new
- * job launches.
- *
- * It runs `docker ps` / `docker rm -f` ONLY. It never inspects a container's exit code, never touches
- * the queue, and never re-enqueues -- queue and retry state belong to Redis, not to docker
- * (INT-RUNNER-EXIT-CODE-PROTOCOL / CONST-RETRY-INFRA-ONLY). It logs container names only (no PII).
- *
- * It assumes ONE worker per docker daemon: a co-located second worker's boot would remove the first's
- * in-flight `pi-job-*` container. That is the accepted v1 shape (DES-CONCURRENCY-3, single worker per
- * host).
- *
- * `reap()` NEVER throws: a missing docker binary or a down daemon is caught, logged as
- * `reaper_skipped`, and boot continues to the worker.
- */
-/**
- * The stop handle every live-edit watch below hands back, so `startWorker` can register it in the same
- * `extraClosers` list that already closes the queues and the host registry (`index.mjs` -> shutdown).
- *
- * A WATCH NOTHING CAN CLOSE IS NOT A DETAIL (issue #295). `watch(dir, cb).unref?.()` retained nothing, so
- * the watch outlived the worker that armed it, and the reload it later fired ran through THAT boot's
- * `log` closure: that boot's injected `write`, stamped with that boot's `workerName`. One process running
- * one worker, that is a rounding error at exit. One process running forty boots, which is what a test file
- * is, and a worker that shut down two tests ago writes into a live worker's capture under a host that is
- * not running -- `every log line carries the host` went red in CI reading `runnervmejwal` where it
- * asserted `mac-mini-1`.
- *
- * UNREF'D IS NOT CLEANED UP, and that difference is what hid this across three features. `unref` says only
- * that a handle will not hold the event loop open; the watch stays armed either way.
- * `INT-HOST-REGISTRY-CONTRACT` states the same distinction from the opposite side, where a bound's timer
- * is deliberately NOT unref'd because an unref'd timer does not fire when the hung command is the last
- * thing holding the loop.
+ * Race a read against a fuse, and CLEAN THE FUSE UP whichever side wins (issue #300). The fuse is
+ * unref'd, deliberately: it exists so a wedged docker daemon cannot hold boot, and it must never itself
+ * hold the process. But unref'd is not cleaned up (#295's lesson, both halves): when the read won, the
+ * old inline race left its five-second timer armed for the full term. The LOSING read stays pending --
+ * a wedged `docker inspect` has no cancel -- which is the read-is-a-nicety posture the call site
+ * documents, unchanged here.
  *
- * Three properties, each one a way the shutdown breaks without it:
+ * NOT FOR BARE CONTEXTS, and the boundary is the fuse's own unref: awaited when nothing else holds the
+ * event loop, the fuse never fires and node exits mid-await (measured, exit 13). In this boot the shared
+ * redis client and the workers hold the loop, so the fallback always arrives; a caller with an empty
+ * loop needs a ref'd timer and a different trade.
  *
- * - It CLOSES the FSWatcher, which is the leak itself.
- * - It CANCELS the debounce the watcher already armed. Closing a watcher does not cancel a `setTimeout`
- *   the callback already set, and only the watcher was ever unref'd -- the 150ms timer never was. In a
- *   real worker that costs nothing, because the shutdown ends in `process.exit(0)` either way; it is the
- *   harness, where the loop is left to drain on its own, that the stray timer reaches.
- * - Its `close()` NEVER THROWS for the handles its three callers build, and is idempotent -- by NULLING
- *   what it closed rather than by an early return, which would be a guard with nothing behind it. Node's
- *   own `FSWatcher.close()` is already both (measured: a second close returns early and neither throws),
- *   but this closer must not
- *   INHERIT that guarantee, it must MAKE it: the shutdown loop in `index.mjs` cannot catch a SYNCHRONOUS
- *   throw from a closer, and the comment there carries the argument. The swallow is
- *   `makeHostRegistry.close`'s posture rather than a new one.
- *
- * A watch that was never created -- the `catch` arm of each function below, a platform without `fs.watch`
- * -- still gets a closer, so registration is unconditional and the list's shape never depends on the
- * platform. That is why all three return from OUTSIDE their try/catch.
- *
- * WHAT IT CANNOT DO, because the list above would otherwise read as complete: cancel a reload that has
- * ALREADY started. `reloadSchedules` is async and awaits a Valkey round trip, so a debounce that fired
- * just before the close is still running after it -- and the watchers stay armed for the whole drain
- * ahead of the closer loop, not merely 150ms. That reload cannot be recalled, so what is gated instead is
- * its VOICE: `reloadLog` below goes quiet once `closed` is set, and every reload is handed that instead
- * of the boot's own `log`, which is what the
- * issue actually asks for -- a stopped worker writes no line. The reload's own Valkey work may still be
- * cut off mid-flight by the queue closing beside it, leaving a scheduler set the next boot's reconcile
- * repairs; that race predates this change and is not narrowed by it.
- *
- * EXPORTED for the reason `reloadScopedLimits` is: none of the three properties is observable through a
- * real `fs.watch` without racing the filesystem, and a guarantee the shutdown rests on deserves a
- * deterministic pin rather than a sleep.
+ * EXPORTED for the reason `makeWatchCloser` is: the cleared-fuse property is not observable through a
+ * full boot without racing every other timer the boot arms, and a guarantee the shutdown story rests on
+ * deserves a deterministic pin rather than a census.
  */
-export function makeWatchCloser(handles, log) {
-	return {
-		// The reload's voice, and the reason this factory is handed the boot's `log` rather than only its
-		// handles. A reload already in flight cannot be recalled, so what the close gates is what it can
-		// still SAY: after `closed`, a line from this watch would carry the host of a worker that has
-		// stopped, which is the bleed the issue is about. The arming lines keep the real `log` -- they run
-		// before any close.
-		reloadLog: (event, fields) => {
-			if (!handles.closed) log(event, fields);
-		},
-		close() {
-			// `closed` FIRST, before anything is torn down: it is what gates `reloadLog` above and the watch
-			// callback below, so a callback or a reload landing mid-close is already silenced.
-			handles.closed = true;
-			clearTimeout(handles.timer);
-			handles.timer = null;
-			try {
-				handles.watcher?.close();
-			} catch {
-				// A close that failed has already stopped mattering, and a THROW here rejects the shutdown.
-			}
-			handles.watcher = null;
-		},
-	};
+export async function settleWithin(promise, ms, fallback) {
+	let timer = null;
+	try {
+		return await Promise.race([
+			promise,
+			new Promise((resolve) => {
+				timer = setTimeout(() => resolve(fallback), ms);
+				timer.unref?.();
+			}),
+		]);
+	} finally {
+		clearTimeout(timer);
+	}
 }
 
 /**
@@ -168,24 +164,36 @@ export function makeWatchCloser(handles, log) {
  * schedulers. The FSWatcher is unref'd (the debounce it arms is NOT), and the returned closer is what
  * `startWorker` registers so the watch dies with the worker that armed it (issue #295).
  */
-function watchTriggersFile(config, queue, log, ref, registry, tz, fleet) {
+function watchTriggersFile(config, queue, log, ref, registry, tz, fleet, atBoot) {
 	const path = config.triggersFile;
 	const dir = dirname(path) || ".";
 	const file = basename(path);
 	const handles = { watcher: null, timer: null, closed: false };
 	const closer = makeWatchCloser(handles, log);
+	const readFile = () => readFileSync(path, "utf8");
+	// The baseline is what the BOOT LOAD read, handed in: the reconcile above and everything between it and
+	// this arm -- the endpoint probe, forge auth, the reaper, Valkey -- is the window an edit is lost in
+	// (issue #386). A baseline taken here would measure the arming instead.
+	readBeforeArming(handles, readFile, atBoot);
 	try {
 		handles.watcher = watch(dir, (_event, changed) => {
 			if (handles.closed) return; // see makeWatchCloser: by construction, not by a delivery rule
 			if (changed && changed !== file) return; // only our file (a null name -> reload to be safe)
 			clearTimeout(handles.timer);
-			handles.timer = setTimeout(() => void reloadSchedules(config, queue, { log: closer.reloadLog, ref, registry, tz, fleet }), 150);
+			handles.timer = setTimeout(() => void reloadSchedules(config, queue, { log: closer.reloadLog, ref, registry, tz, fleet }), WATCH_DEBOUNCE_MS);
 		});
 		handles.watcher.unref?.();
 		log("triggers_watching", { path });
 	} catch (err) {
 		log("triggers_watch_unavailable", { reason: err?.message });
 	}
+	// ONLY WHEN THE BYTES MOVED, because this one costs a Valkey round trip and a reconcile: a quiet boot
+	// must not pay for the race it did not lose, and must not log a second `schedules` line saying nothing
+	// changed.
+	if (changedWhileArming(handles, readFile)) {
+		log("triggers_reread_after_arming", { path });
+		void reloadSchedules(config, queue, { log: closer.reloadLog, ref, registry, tz, fleet });
+	}
 	return closer;
 }
 
@@ -195,7 +203,7 @@ function watchTriggersFile(config, queue, log, ref, registry, tz, fleet) {
  * effect (OQ-008 live-edit safety) — the pause gate never loses its config to a typo. Best-effort; the
  * FSWatcher is unref'd and the returned closer stops the watch with the worker (issue #295).
  */
-function watchPauseWindowsFile(config, ref, log) {
+function watchPauseWindowsFile(config, ref, log, atBoot) {
 	const path = config.pauseWindowsFile;
 	const dir = dirname(path) || ".";
 	const file = basename(path);
@@ -209,18 +217,26 @@ function watchPauseWindowsFile(config, ref, log) {
 			closer.reloadLog("pause_windows_reload_invalid", { reason: err?.message });
 		}
 	};
+	const readFile = () => readFileSync(path, "utf8");
+	readBeforeArming(handles, readFile, atBoot); // the BOOT LOAD's own bytes; see watch-closer (issue #386)
 	try {
 		handles.watcher = watch(dir, (_event, changed) => {
 			if (handles.closed) return; // see makeWatchCloser: by construction, not by a delivery rule
 			if (changed && changed !== file) return;
 			clearTimeout(handles.timer);
-			handles.timer = setTimeout(reload, 150);
+			handles.timer = setTimeout(reload, WATCH_DEBOUNCE_MS);
 		});
 		handles.watcher.unref?.();
 		log("pause_windows_watching", { path });
 	} catch (err) {
 		log("pause_windows_watch_unavailable", { reason: err?.message });
 	}
+	// SAID, like the triggers watch says it: without a line of its own an operator cannot tell a boot-race
+	// reload from an ordinary one, and this is the only reload that happens with nobody editing.
+	if (changedWhileArming(handles, readFile)) {
+		log("pause_windows_reread_after_arming", { path });
+		reload();
+	}
 	return closer;
 }
 
@@ -244,24 +260,30 @@ export function reloadScopedLimits(config, ref, log) {
  * for atomic tmp+rename robustness, filtered to the one basename, debounced. Best-effort; the FSWatcher is
  * unref'd and the returned closer stops the watch with the worker (issue #295).
  */
-function watchScopedLimitsFile(config, ref, log) {
+function watchScopedLimitsFile(config, ref, log, atBoot) {
 	const path = config.scopedLimitsFile;
 	const dir = dirname(path) || ".";
 	const file = basename(path);
 	const handles = { watcher: null, timer: null, closed: false };
 	const closer = makeWatchCloser(handles, log);
+	const readFile = () => readFileSync(path, "utf8");
+	readBeforeArming(handles, readFile, atBoot); // the BOOT LOAD's own bytes; see watch-closer (issue #386)
 	try {
 		handles.watcher = watch(dir, (_event, changed) => {
 			if (handles.closed) return; // see makeWatchCloser: by construction, not by a delivery rule
 			if (changed && changed !== file) return;
 			clearTimeout(handles.timer);
-			handles.timer = setTimeout(() => reloadScopedLimits(config, ref, closer.reloadLog), 150);
+			handles.timer = setTimeout(() => reloadScopedLimits(config, ref, closer.reloadLog), WATCH_DEBOUNCE_MS);
 		});
 		handles.watcher.unref?.();
 		log("scoped_limits_watching", { path });
 	} catch (err) {
 		log("scoped_limits_watch_unavailable", { reason: err?.message });
 	}
+	if (changedWhileArming(handles, readFile)) {
+		log("scoped_limits_reread_after_arming", { path });
+		reloadScopedLimits(config, ref, closer.reloadLog);
+	}
 	return closer;
 }
 
@@ -292,34 +314,118 @@ export async function startWorker(
 		// tests in `start-wiring.test.mjs` were reported as not existing at all -- no name, no count, exit 0 --
 		// because this function's log line went through the same channel the runner needed (issue #266).
 		write = (chunk) => process.stdout.write(chunk),
+		// Issue #354: the configuration loader, a seam for ONE reason: a test venue that is not in the backend table (an
+		// injected `extraBackends` bundle) cannot be written through the real loader, which refuses a name it does not know.
+		// The table's own venues (`local`, and `podman` since part 2) go through the real loader.
+		loadConfig: loadConfigFn = loadConfig,
 		makeAuth = makeGitHubAuth,
 		makeHost = makeGitHubHost,
 		createWorkerFn = createWorker,
 		makeReaper: makeReaperFn = makeReaper,
 		makeBackendRegistry: makeBackendRegistryFn = makeBackendRegistry,
-		// Additional backend bundles, in registration order after `local`. The deployment still decides which
-		// are BLESSED (PI_BACKENDS) and which is default; this only says which exist.
+		// Additional backend bundles, in registration order after `local` (which is built only while blessed,
+		// issue #354). The deployment still decides which are BLESSED (PI_BACKENDS) and which is default; this only
+		// says which exist.
 		extraBackends = [],
 		makeLogSink: makeLogSinkFn = makeLogSink,
 		makeRecordWriter: makeRecordWriterFn = makeRecordWriter,
 		makeRunMirror: makeRunMirrorFn = makeRunMirror,
 		makeLogReaper: makeLogReaperFn = makeLogReaper,
 		makeSandboxReaper: makeSandboxReaperFn = makeSandboxReaper,
+		makeSandboxNetworkSweeper: makeSandboxNetworkSweeperFn = makeSandboxNetworkSweeper,
+		// Issue #429: the one call that asks a runtime which sandboxes are open, seamed so a wiring test can drive the real
+		// sandbox reaper against a real retention root without spawning docker or podman.
+		listRunningSandboxes: listRunningSandboxesFn = listRunningSandboxes,
+		makeRetentionSweep: makeRetentionSweepFn = makeRetentionSweep,
 		makeRunContainer: makeRunContainerFn = makeRunContainer,
 		makeSecretsResolver: makeSecretsResolverFn = makeSecretsResolver,
 		makeImagePreflight: makeImagePreflightFn = makeImagePreflight,
 		makeScopeClaimSweeper: makeScopeClaimSweeperFn = makeScopeClaimSweeper,
 		makeHostRegistry: makeHostRegistryFn = makeHostRegistry,
 		makeEgressPreflight: makeEgressPreflightFn = makeEgressPreflight,
+		// Which docker endpoint this host's CLI resolves (issue #278). A seam because the real one spawns the
+		// docker CLI, and a wiring test must decide what it answers.
+		resolveDockerEndpoint: resolveDockerEndpointFn = makeDockerEndpointResolver(),
+		// Issue #341: the one `docker info` the job-user decision reads, and the process facts it reads beside it.
+		// Seams for the same reason as the endpoint: a wiring test decides what the daemon and the process say.
+		readDaemonFacts: readDaemonFactsFn = makeDaemonFactsReader(),
+		// `home` (issue #354) is the account whose rootless Podman runs the podman venue's jobs: its own mounts.conf and
+		// containers.conf are read from there. Absent in a test's identity, it falls to the observation's own default.
+		jobUserIdentity = { platform: process.platform, release: osRelease(), euid: process.geteuid?.(), egid: process.getegid?.(), home: homedir() },
+		// Issue #345: the host files the runtime-mounts observation reads (Podman's mounts.conf and containers.conf). A seam so
+		// a wiring test never reads this machine's /etc.
+		observationFs = { statSync, readFileSync, readdirSync },
+		// Issue #448: `systemctl show podman.service`, read only where a local job runs on rootful Podman's Docker API on this
+		// host. A seam so a wiring test decides what the unit says, and never asks this machine's systemd.
+		readPodmanService: readPodmanServiceFn = makePodmanServiceReader(),
+		// Issue #354: the podman venue's three boot collaborators, each a seam for the endpoint's reason: the real ones spawn
+		// `podman`, and a wiring test must decide what `podman info` says, what the reaper lists and what the bundle is
+		// built from. Constructing the default reader spawns nothing; only a call does, and only while `podman` is blessed.
+		readPodmanInfo: readPodmanInfoFn = makePodmanInfoReader(),
+		makePodmanReaper: makePodmanReaperFn = makePodmanReaper,
+		makePodmanBackend: makePodmanBackendFn = makePodmanBackend,
 		makeGitLabAuth: makeGitLabAuthFn = makeGitLabAuth,
 		makeGitLabHost: makeGitLabHostFn = makeGitLabHost,
 		makeForgejoAuth: makeForgejoAuthFn = makeForgejoAuth,
 		makeForgejoHost: makeForgejoHostFn = makeForgejoHost,
 		makeAzureAuth: makeAzureAuthFn = makeAzureAuth,
 		makeAzureHost: makeAzureHostFn = makeAzureHost,
+		// The clock the forge-auth re-resolve cooldown reads. Injected because a test that asserts a window
+		// beside a subject built on the default `Date.now` is a fuse: it passes until the wall clock drifts
+		// past that window, then fails in CI on a tree nobody touched (issue #284).
+		now = () => Date.now(),
+		// Issue #476: how the boot waits out a rootless network keeper that is only too young. A seam so a wiring test
+		// proves the wait and its bound without spending real seconds.
+		sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+		// How long a job waits for a forge-auth re-resolve. A seam rather than a constant because the
+		// property under test is that the bound EXISTS, and a test that proved it by waiting ten real
+		// seconds would be paid for on every run for the life of the file.
+		authResolveTimeoutMs = AUTH_RESOLVE_TIMEOUT_MS,
+		// Issue #464: the jobs dir, created and checked as this account's at boot. A seam so a wiring test decides it.
+		ensureJobsDir: ensureJobsDirFn = ensureJobsDir,
+		// Issue #464: the same rule for the two durable stores, which default into that root on an account with no home.
+		ensureUnderAccountRoot: ensureUnderAccountRootFn = ensureUnderAccountRoot,
+		// Issue #464 (gate round 1): the sandbox dir, refused at boot when another account owns it, as the jobs dir is.
+		ensureSandboxDir: ensureSandboxDirFn = ensureSandboxDir,
+		// Issue #464 (gate round 2): whose Valkey VALKEY_URL reaches, judged here, where the connection is made, and the
+		// literal address every Valkey client of this worker then connects to. A seam: the real one reads /proc, probes
+		// this host's addresses and resolves the name, none of which belongs in a wiring test.
+		judgeValkey = defaultJudgeValkey,
 	} = {},
 ) {
-	const config = loadConfig(env);
+	const config = loadConfigFn(env);
+	// Issue #354: whether this deployment blesses the local adapter (its name is `DEFAULT_BACKEND`, the word
+	// `makeLocalBackend` stamps on its bundle). `local` stopped being mandatory in `PI_BACKENDS`, and every read
+	// below that asks THIS HOST'S DOCKER CLI something is a read about that one venue: its endpoint, its daemon's
+	// facts, its image, its reaper, its sandboxes. With `local` unblessed none of them runs, so a host without
+	// Docker never spawns `docker` at boot for a venue it will never use, and a floor naming an observation only
+	// `local` makes cannot hold such a worker at exit 1 forever. Everything is byte-identical while it is blessed.
+	const localBlessed = config.backends.includes(DEFAULT_BACKEND);
+	// The same split for the native podman venue (issue #354, `DES-PODMAN-NATIVE-ROOTLESS-BACKEND`): its `podman info`
+	// read, its reaper and its bundle exist only while it is blessed, so a deployment that never chose it spawns no
+	// `podman` and pays nothing for it being in the table.
+	const podmanBlessed = config.backends.includes(PODMAN_BACKEND);
+	// Issue #354: an ABSENT `observationPreflight` admits every job, which is the right answer only for a venue whose
+	// words hold without observing anything. A venue whose table entry names an `observedBy` and carries no preflight
+	// would have those words hold with nothing looking, and a floor naming one would pass on capability alone: the
+	// believed-in control `unarmedFloor` was written against. The registry cannot read the table, so it is refused
+	// here, and HERE rather than beside the registry: this runs before anything is spawned or connected, so the refusal
+	// leaves nothing open behind it. Only the extra bundles need it; `local`'s is built below carrying its preflight.
+	for (const bundle of extraBackends) {
+		// A string name only: `backendFor(undefined)` answers with the table's default, and a nameless bundle is the
+		// registry's refusal to make, with its own message.
+		const gated = typeof bundle?.name === "string" ? Object.keys(backendFor(bundle.name)?.observedBy ?? {}) : [];
+		if (gated.length > 0 && typeof bundle?.observationPreflight !== "function") {
+			throw new Error(`backend ${JSON.stringify(bundle.name)} declares ${gated.join(", ")} as held only while observed, and carries no observationPreflight to observe them`);
+		}
+	}
+	// Issue #464: the jobs dir is this account's, or the worker does not start. Before it built anything, and a
+	// `configError` (exit 2, never restarted) where another account owns it, since a restart meets the same owner: the
+	// shared `<tmp>/pi-dispatch/jobs` default let one account's jobs dir fail every other account's jobs with EACCES
+	// while the worker ran on. A failed mkdir is the fs error it is (exit 1).
+	ensureJobsDirFn(config.jobsDir, { env });
+	ensureSandboxDirFn(config.sandboxDir, { env });
+	for (const store of [config.logsDir, dirname(config.settingsFile)]) ensureUnderAccountRootFn(store, { env });
 	// `host` sits AFTER the spread, so it is authoritative rather than overridable (issue #57). No call
 	// site can know better than this closure which process wrote a line, and one that passed `host` would
 	// be lying by construction -- verified: none does. This is also why the stamp lives ONLY here. Every
@@ -328,6 +434,22 @@ export async function startWorker(
 	// while one added inside this closure cannot reach them.
 	const log = (event, fields = {}) => write(`${JSON.stringify({ event, ...fields, host: config.workerName })}\n`);
 
+	// Issue #464 (gate round 2): the owner rule where the connection is made. `service install`, `up` and doctor judge
+	// the Valkey too, but a VALKEY_URL edited after they refused it, a 0.0.0.0 URL, or another account publishing on ::1
+	// after the install each reached another account's queue through an unjudged worker (measured on Fedora 44). So the
+	// worker judges it itself, before it contacts Valkey at all, with the same function (`resolveWorkerValkey`), and
+	// every client below connects to the judged literal address, never to a name resolved again later. A refusal is a
+	// configError (exit 2, not restarted into the same answer); nothing answering is a plain error (exit 1, restarted).
+	const valkey = await judgeValkey({ url: config.valkeyUrl, venues: { localUsed: localBlessed, podmanUsed: podmanBlessed }, env });
+	for (const note of valkey.notes ?? []) log("valkey_note", { note });
+	if (valkey.pinned) log("valkey_pinned", { address: valkey.pinned.address, port: valkey.pinned.port, heldBy: valkey.pinned.heldBy });
+	// Every client below connects through connection.mjs' JudgedConnector, which judges the (pinned) address again on
+	// each connect, as this boot judged it: root refused as the boot decided it, PI_VALKEY_SHARED from the deployment .env.
+	const valkeyContext = workerValkeyContext(valkey, env);
+	// Issue #468: whether this worker sends a password, and never the password: the only thing a log line may say of it.
+	log("valkey_password", { set: Boolean(valkeyPasswordFor(valkey.url, valkeyContext).password) });
+	const valkeyConn = (opts = {}) => parseConnection(valkey.url, { ...opts, servername: valkey.servername, context: valkeyContext });
+
 	// DES-CRON-VIA-BULLMQ-SCHEDULER: load and validate the triggers file with the operator present and
 	// before any Valkey contact, so a misconfigured schedule refuses startup loudly (configError) rather
 	// than upserting a broken scheduler. [] means cron disabled (no PI_TRIGGERS_FILE, or no cron triggers).
@@ -336,16 +458,172 @@ export async function startWorker(
 	// scheduled, and a `const` frozen at boot would make it publish the pre-edit set forever -- so two
 	// hosts would see each other's fingerprint oscillate on the beat period, refusing or agreeing
 	// depending on which half of a beat a reload happened to land in.
-	const schedules = { current: loadSchedules(config, { fleet: config.workerNameDeclared }) };
+	// THE BOOT LOADS' OWN READS are the baselines for the three watches' boot-race checks (issue #386),
+	// captured through the seam each loader already has rather than re-read where the watch arms. The window
+	// this race lives in is between these lines and the arming a thousand lines below -- the endpoint probe,
+	// forge auth, the reaper, Valkey -- not the microseconds around the arming itself, which is what a first
+	// attempt measured. `null` where a file is not configured, which reads as "nothing to compare".
+	const atBoot = { triggers: null, pauseWindows: null, scopedLimits: null };
+	const recording = (into, path) => ({
+		readFileSync: (file, enc) => {
+			const text = readFileSync(file, enc);
+			if (file === path) atBoot[into] = text;
+			return text;
+		},
+	});
+	const schedules = { current: loadSchedules(config, { fleet: config.workerNameDeclared, ...recording("triggers", config.triggersFile) }) };
 
 	// REQ-SCOPED-PAUSE-WINDOWS: load + validate the pause-windows file with the operator present and before any
 	// Valkey contact, so a malformed file refuses startup (configError) rather than silently disabling scoped
 	// pauses. Held in a mutable ref so the live-reload watcher can hot-swap it. [] means no scoped pauses.
-	const pauseWindows = { current: loadPauseWindows(config) };
+	const pauseWindows = { current: loadPauseWindows(config, recording("pauseWindows", config.pauseWindowsFile)) };
 
 	// Issue #242: same posture for the scoped-limits file -- fail-loud with the operator present, mutable
 	// ref for the live-reload watcher, [] when unset (the folder mutex is code and needs no file).
-	const scopedLimits = { current: loadScopedLimits(config) };
+	const scopedLimits = { current: loadScopedLimits(config, recording("scopedLimits", config.scopedLimitsFile)) };
+
+	// Issue #278: WHICH DOCKER DAEMON the job containers' credentials will travel to. Asked of the CLI at boot,
+	// AFTER the free file validations above (a wedged CLI costs up to its bound, and must not delay them) and
+	// BEFORE forge auth, the reaper, Valkey and the worker -- so a refusal here stops a process that built
+	// nothing. Without a floor naming credentialTransit a redirect is words only: pointing the worker at a
+	// daemon is the operator's call. With one asking for `enforced`, it refuses: a floor is not met by capability
+	// alone. A TRANSIENT failure to ask (a timeout, a spawn out of resources) throws untagged, exit 1, so the
+	// supervisor retries; everything else is a config error, exit 2.
+	//
+	// Issue #354: judged for `local` ALONE, not for every blessed venue. These are observations of this host's docker
+	// CLI and its daemon, which mean nothing for another venue's words: a venue with its own `observedBy` brings its own
+	// boot read (the podman venue's is below, judged for `podman` alone the same way).
+	const bootEndpoint = localBlessed ? await resolveDockerEndpointFn() : null;
+	if (bootEndpoint) {
+		logDockerEndpoint(log, bootEndpoint);
+		const [endpointRefusal] = observationRefusals({
+			backends: [DEFAULT_BACKEND],
+			backendFloor: config.backendFloor,
+			observations: { [DOCKER_ENDPOINT_LOCAL]: bootEndpoint.local === true },
+			evidence: { [DOCKER_ENDPOINT_LOCAL]: dockerEndpointEvidence(bootEndpoint) },
+			// The daemon has not been read yet; the runtime observations are checked once it has (issue #345).
+			only: [DOCKER_ENDPOINT_LOCAL],
+		});
+		if (endpointRefusal) throw bootEndpoint.local === null && bootEndpoint.transient ? new Error(endpointRefusal) : configError(endpointRefusal);
+	}
+	// The per-job read (below, `observationPreflight`) logs only when the answer CHANGES from the last one, so a
+	// deliberate, standing redirect writes one line at boot rather than one per job.
+	let endpointSeen = bootEndpoint ? dockerEndpointState(bootEndpoint) : null;
+
+	// Issue #341: WHO job containers run as on this daemon (`DES-JOB-USER-INFERRED-READ-BACK-ON-REQUEST`). Decided
+	// from facts, never a probe container, cached per endpoint state. Bounded like the boot image read, because a
+	// wedged daemon must not hang boot. Only an IDENTITY verdict refuses at boot, and only when `local` is the
+	// default venue: rootless, userns-remap, a root worker and Docker Desktop on Linux cannot run any local job here.
+	// An unknown answer (a daemon still starting) boots, so a unit with RestartPreventExitStatus=2 is never stranded
+	// by one; so does `runtime-unreadable`, which a later job re-reads.
+	const resolveJobUser = makeJobUserResolver({ readFacts: readDaemonFactsFn, ...jobUserIdentity });
+	// Issue #345: a floor that needs a DAEMON observation waits the facts read's own bound (plus a margin), not the image
+	// read's 5 s: a busy host's `docker info` is the slow read, and a floor this boot met from the table before would
+	// otherwise exit 1 on every restart of a healthy daemon.
+	// Issue #354: `null` throughout with `local` unblessed. There is no local job to decide a user for, so nothing is
+	// read, nothing is said, and the boot line carries `jobUser: null` rather than a decision about a daemon nobody asked.
+	const bootJobUser = bootEndpoint
+		? await settleWithin(
+				resolveJobUser({ endpoint: bootEndpoint, key: endpointSeen }).catch(() => null),
+				bootFactsBoundMs(config),
+				null,
+			)
+		: null;
+	const bootDecision = bootEndpoint ? (bootJobUser?.decision ?? { mode: "unknown", user: null, cause: null, reason: "boot-read-timeout" }) : null;
+	if (bootDecision) log("job_user", { mode: bootDecision.mode, user: bootDecision.user, cause: bootDecision.cause, reason: bootDecision.reason });
+	// Said again whenever a job's decision differs from the last one said, so a boot that read `unknown` (a daemon still
+	// starting) and a later answer that refuses every job are never separated by silence.
+	let jobUserSaid = bootDecision ? jobUserLogKey(bootDecision) : null;
+
+	// Issue #345: the RUNTIME observations, from that same facts read and this host's files, checked against the floor
+	// the way the endpoint was above: `isolation` holds only while the daemon is observed applying a container's bounds,
+	// `mountSet` only while the runtime is observed adding no mounts of its own. Without a floor naming either, this is
+	// words (worker_started, and doctor). A refusal resting only on a read that did not answer (a daemon still starting,
+	// the boot bound) throws untagged, exit 1, so the supervisor retries; one resting on an answer is a config error.
+	// Issue #354: for `local` alone, like the endpoint above, and not at all with `local` unblessed. This is the site that
+	// would otherwise hold a worker without `local` at exit 1 forever: a floor naming `isolation` against observations
+	// nobody made reads as unanswered, which is the transient arm, which the supervisor retries without end.
+	// Issue #448: `systemctl show podman.service`, read once here where the local daemon is rootful Podman on this host, and
+	// handed to both the mounts observation and the containers.conf refusal below, so they judge one answer.
+	// The deletion rule's memory (gate round 1 of PR #473): which chain files this worker saw while one service start ran.
+	const rootfulMemory = makeRootfulMemory();
+	const bootUnit = bootEndpoint && bootJobUser?.daemon ? await readRootfulService({ endpoint: bootEndpoint, daemon: bootJobUser.daemon, readService: readPodmanServiceFn }) : undefined;
+	const bootObserved = bootEndpoint ? observeHost({ endpoint: bootEndpoint, daemon: bootJobUser?.daemon ?? { answered: false, reason: "boot-read-timeout", transient: true }, fs: observationFs, unit: bootUnit, env, memory: rootfulMemory }) : null;
+	if (bootObserved) {
+		const bootObservedArgs = { backends: [DEFAULT_BACKEND], backendFloor: config.backendFloor, observations: bootObserved.observations, evidence: bootObserved.evidence };
+		const [runtimeRefusal] = observationRefusals(bootObservedArgs);
+		if (runtimeRefusal) throw observationRefusalIsTransient(bootObservedArgs) ? new Error(runtimeRefusal) : configError(runtimeRefusal);
+	}
+	let runtimeObservedSaid = bootObserved ? runtimeObservationKey(bootObserved) : null;
+
+	const bootRefusal = jobUserBootRefusal(bootDecision, config.defaultBackend);
+	if (bootRefusal) throw configError(bootRefusal);
+	// Issue #448: where a local job runs on rootful Podman's Docker API service on this host, the containers.conf that
+	// service reads (the system chain, root's own, the unit's CONTAINERS_CONF) and whether the running service started
+	// before it last changed. A VENUE refusal, as the podman venue's #428 one is and for its reason: with egress off no
+	// declared property covers what `env` or `annotations` add to a job. After the identity, whose fix comes first, and
+	// only while `local` is the default venue; merely blessed, each local job is refused and the default venue's run.
+	// Tagged (exit 2) since a restart reads the same bytes, except what heals by itself (exit 1): a read that failed for a
+	// moment, a running service older than its containers.conf, a change time ahead of the clock. What the worker's account
+	// cannot read under root's own config home is said once here, never refused on; any other unreadable part refuses.
+	const bootRootful = bootEndpoint && bootJobUser?.daemon ? await observeRootfulConf({ endpoint: bootEndpoint, daemon: bootJobUser.daemon, fs: observationFs, readService: readPodmanServiceFn, env, unit: bootUnit, memory: rootfulMemory }) : null;
+	let rootfulUnreadSaid = "";
+	const sayRootfulUnread = (rootful) => {
+		const said = rootfulUnreadList(rootful?.unread);
+		if (said === rootfulUnreadSaid) return;
+		rootfulUnreadSaid = said;
+		if (said !== "") log("local_podman_conf_unread", { unread: said });
+	};
+	sayRootfulUnread(bootRootful);
+	const localConfBoot = localConfBootRefusal(bootDecision, config.defaultBackend, bootRootful);
+	if (localConfBoot) throw localConfBoot.transient ? new Error(localConfBoot.message) : configError(localConfBoot.message);
+
+	// Issue #354: the podman venue's ONE facts read, `podman info --format json`, at boot, where local's reads are and for
+	// their reasons: free, before forge auth, the reaper and any Valkey client (the Valkey owner judgement above only reads
+	// sockets and probes addresses), so a refusal here stops a process that built nothing.
+	// Wrapped once in `cachedPodmanInfo` and the SAME wrapper is handed to the bundle below, so an answer read here is the
+	// one the first job is decided from rather than a second spawn. Bounded twice: the reader's own timeout (docker info's
+	// 15 s, reused) and this fuse two seconds past it, because a spawn that never settles has no timeout to fire.
+	const podmanInfo = podmanBlessed ? cachedPodmanInfo(readPodmanInfoFn) : null;
+	const bootPodmanRead = podmanInfo
+		? await settleWithin(
+				Promise.resolve()
+					.then(() => podmanInfo())
+					.catch(() => ({ answered: false, reason: "spawn-failed", transient: true })),
+				PODMAN_INFO_TIMEOUT_MS + 2_000,
+				{ answered: false, reason: "boot-read-timeout", transient: true },
+			)
+		: null;
+	const bootPodmanDecision = bootPodmanRead ? decidePodmanJobUser({ platform: jobUserIdentity.platform, euid: jobUserIdentity.euid, egid: jobUserIdentity.egid, read: bootPodmanRead }) : null;
+	// The IDENTITY verdict first, before the observations, and unlike `local`'s order on purpose: a rootful or remote
+	// Podman also fails the observations (the mounts check reads a rootless user's files, the service one its remoteness),
+	// and a floor refusal naming `podmanAddsNoMounts` would send the operator after a mounts.conf when the fix is the
+	// account Podman runs as. Only when `podman` is the DEFAULT venue, as `jobUserBootRefusal` for `local`: with it merely
+	// blessed, the jobs that name it are refused one by one and the default venue's still run.
+	const podmanRefusal = podmanBootRefusal(bootPodmanDecision, config.defaultBackend);
+	if (podmanRefusal) throw configError(podmanRefusal);
+	// Issue #428: the account's containers.conf, next, under the same rule (only while `podman` is the default venue; merely
+	// blessed, each podman job is refused and the default venue's still run). A VENUE refusal rather than a floor
+	// observation: with egress off no declared property covers what a job reaches on the host, so a floor would never
+	// fire on the deployments at risk. Read from this host's files with no daemon, so it is determinate whatever the info
+	// read said, and tagged (exit 2): a restart reads the same bytes. After the identity, whose fix comes first. The one
+	// exception is a read that failed for a moment (out of descriptors, an I/O error), which is untagged (exit 1) so the
+	// supervisor restarts it, as an unanswered observation is.
+	const podmanConfBoot = podmanConfBootRefusal(bootPodmanDecision, config.defaultBackend, { fs: observationFs, home: jobUserIdentity.home, env, euid: jobUserIdentity.euid, runRoot: bootPodmanRead?.answered === true && bootPodmanRead.info ? (bootPodmanRead.info.runRoot ?? null) : undefined });
+	if (podmanConfBoot) throw podmanConfBoot.transient ? new Error(podmanConfBoot.message) : configError(podmanConfBoot.message);
+	// The podman venue's own observations, judged for `podman` ALONE, as the endpoint and the daemon's are for `local`
+	// alone: each venue's words are earned by its own reads, and judging one venue's answers over every blessed venue
+	// would read the other's observations as unanswered, which is the transient arm, exit 1 on every restart. Same split
+	// as `local`'s: a refusal resting only on a read that did not answer is untagged (retried), one on an answer tagged.
+	const bootPodmanObserved = bootPodmanRead ? observePodman({ read: bootPodmanRead, fs: observationFs, home: jobUserIdentity.home, env, euid: jobUserIdentity.euid }) : null;
+	// Not judged at all when the venue's identity is already refused (it is then merely blessed, or the refusal above would
+	// have stopped the boot): every job naming it is refused by that cause, and a floor refusal here would stop the whole
+	// worker, the default venue's jobs included, with a fix (delegate controllers, empty a mounts.conf) that is not the one.
+	if (bootPodmanObserved && bootPodmanDecision?.mode !== "unmappable") {
+		const podmanObservedArgs = { backends: [PODMAN_BACKEND], backendFloor: config.backendFloor, observations: bootPodmanObserved.observations, evidence: bootPodmanObserved.evidence };
+		const [podmanObservationRefusal] = observationRefusals(podmanObservedArgs);
+		if (podmanObservationRefusal) throw observationRefusalIsTransient(podmanObservedArgs) ? new Error(podmanObservationRefusal) : configError(podmanObservationRefusal);
+	}
 
 	// The forge a job belongs to is resolved PER JOB from `job.kind`, not bound once for the process.
 	// Each entry is `{ auth, host }`: `auth` is get-token's `{ mintToken, selfId, source }` (null when that
@@ -356,24 +634,137 @@ export async function startWorker(
 	// Auth stays BEST-EFFORT per forge, exactly as it was: a local-only deployment has no GitHub
 	// credentials and must still boot and drain cron jobs. The refusal is deferred to the job that needs
 	// the missing credential (the mintToken fallback below), not raised at startup.
+	//
+	// WHAT CHANGED (issue #316): best-effort used to mean best-effort ONCE. Any throw left `auth` null for
+	// the lifetime of the process, so a forge that was merely unreachable during the seconds this loop ran
+	// stayed credential-less until somebody restarted the worker, and every job of that kind then hit the
+	// `configError` fallback below -- which, since #310, refunds the reserve and posts a public comment
+	// telling the issue author that the operator's deployment is misconfigured. A deployment that
+	// `doctor` reports as healthy. The boot posture is unchanged for a DETERMINATE failure, which is what
+	// the local-only case is (no `gh` on PATH is `ENOENT`); a TRANSIENT one now leaves a re-resolver
+	// behind instead of a permanent null.
 	const forges = { github: { auth: null, host: makeHost() } };
-	try {
-		forges.github.auth = await makeAuth(config.github);
-		log("self_identity", { kind: "github", id: forges.github.auth.selfId, source: forges.github.auth.source });
-	} catch (err) {
-		log("github_auth_unavailable", { kind: "github", reason: err?.message });
-	}
+	// Per forge kind, what it would take to resolve its auth again: the closure, and the `idOf` its log
+	// line needs. Present only while the last attempt failed transiently -- a determinate failure removes
+	// it, because retrying a wrong credential is how a deployment pays to be told the same thing twice.
+	const authRetries = new Map();
+	const authInFlight = new Map();
+	// When the last transient attempt happened, so a backlog draining against a forge that is still down
+	// does not open one identity round-trip per job. The in-flight promise below dedupes CONCURRENT
+	// callers; this bounds SEQUENTIAL ones, which is the shape a PI_CONCURRENCY=1 worker actually has.
+	const authCooldownUntil = new Map();
+	const authLastError = new Map();
+
+	/**
+	 * Boot-time attempt for one forge, and the record of what to do if it failed.
+	 *
+	 * `idOf` exists because azure's selfId is an object while the other three are scalars, which is the
+	 * one place a forge identity does not reduce to a single value.
+	 */
+	const attachAuth = async (kind, make, cfg, idOf = (auth) => auth.selfId) => {
+		try {
+			forges[kind].auth = await make(cfg);
+			log("self_identity", { kind, id: idOf(forges[kind].auth), source: forges[kind].auth.source });
+		} catch (err) {
+			// The tag is the whole discriminator, and it is now trustworthy at these sites: the identity
+			// modules throw untagged for a fetch rejection, a transient status and an unparseable body.
+			const transient = err?.piDispatchConfig !== true;
+			if (transient) authRetries.set(kind, { resolve: () => make(cfg), idOf });
+			log(`${kind}_auth_unavailable`, { kind, reason: err?.message, transient });
+		}
+	};
+
+	/**
+	 * The auth for a forge, resolving it now if boot could not and the reason was transient.
+	 *
+	 * THREE bounds, because "ask again" is a live network round-trip on the job path and each of them is a
+	 * different way of asking too often.
+	 *
+	 * ONE in-flight promise per forge dedupes CONCURRENT callers, which is what a worker at
+	 * PI_CONCURRENCY>1 draining a backlog produces. A COOLDOWN bounds sequential ones: without it a
+	 * PI_CONCURRENCY=1 worker chewing through a backlog against a forge that is still down opens one
+	 * identity call per job, forever, and each of them can sit on undici's 300-second header timeout with
+	 * the queue behind it. Inside the cooldown the last error is re-thrown immediately, which is the same
+	 * verdict at none of the cost. And a DETERMINATE answer retires the re-resolver entirely.
+	 *
+	 * The determinate error is RETHROWN rather than turned into `null`. Returning null sent every such job
+	 * to the generic "configure GITHUB_AUTH_SOURCE" message while the specific reason -- bad credentials,
+	 * a key that is not PKCS//8 -- was already in hand and went only to the log. The caller decides what to
+	 * do with it; the point is that it reaches the caller.
+	 */
+	const ensureAuth = async (kind) => {
+		if (forges[kind]?.auth) return forges[kind].auth;
+		const retry = authRetries.get(kind);
+		if (!retry) return null;
+		if (!authInFlight.has(kind)) {
+			const until = authCooldownUntil.get(kind) ?? 0;
+			if (now() < until) throw authLastError.get(kind) ?? transientError(`${kind} auth is still unavailable`);
+			const attempt = async () => {
+				try {
+					const auth = await retry.resolve();
+					forges[kind].auth = auth;
+					authCooldownUntil.delete(kind);
+					authLastError.delete(kind);
+					log("self_identity", { kind, id: retry.idOf(auth), source: auth.source });
+					return auth;
+				} catch (err) {
+					authLastError.set(kind, err);
+					if (err?.piDispatchConfig === true) {
+						authRetries.delete(kind);
+						log(`${kind}_auth_unavailable`, { kind, reason: err?.message, transient: false });
+					} else {
+						authCooldownUntil.set(kind, now() + AUTH_RETRY_COOLDOWN_MS);
+					}
+					throw err;
+				}
+			};
+			// The cleanup is chained OUTSIDE the async body rather than written as its `finally`, and that is
+			// not a style choice. An async function runs synchronously up to its first `await`, so a factory
+			// that throws SYNCHRONOUSLY runs the whole body -- catch and finally included -- before this
+			// `set` ever happens: the delete would find an empty map and the rejected promise would then be
+			// installed permanently, leaving that forge dead for the lifetime of the process. Which is the
+			// exact defect issue #316 exists to remove, reintroduced by its own fix. A `.finally` callback
+			// is always a microtask, so it cannot outrun the `set`, and the identity check makes it safe
+			// against a later attempt having already replaced the entry.
+			const inflight = attempt().finally(() => {
+				if (authInFlight.get(kind) === inflight) authInFlight.delete(kind);
+			});
+			// A handler, so that a caller losing the timeout race below cannot turn this into an unhandled
+			// rejection. Every awaiter still sees the rejection through its own `await`.
+			inflight.catch(() => {});
+			authInFlight.set(kind, inflight);
+		}
+		const inflight = authInFlight.get(kind);
+		let timer;
+		try {
+			return await Promise.race([
+				inflight,
+				new Promise((_resolve, reject) => {
+					timer = setTimeout(() => reject(transientError(`${kind} auth did not answer within ${authResolveTimeoutMs}ms`)), authResolveTimeoutMs);
+					timer.unref?.();
+				}),
+			]);
+		} catch (err) {
+			// A lost race is a forge that is not answering, which is exactly what the cooldown is for: the
+			// in-flight call is still out there and will set it when it settles, but the next job must not
+			// queue up behind it in the meantime.
+			if (!authLastError.has(kind)) {
+				authLastError.set(kind, err);
+				authCooldownUntil.set(kind, now() + AUTH_RETRY_COOLDOWN_MS);
+			}
+			throw err;
+		} finally {
+			clearTimeout(timer);
+		}
+	};
+
+	await attachAuth("github", makeAuth, config.github);
 	// GitLab joins the same map on the same best-effort terms. It appears only when configured: a forge
 	// with no entry refuses its jobs at mint time with a message naming what is missing, which is a better
 	// answer than an entry that exists and cannot authenticate.
 	if (config.gitlab) {
 		forges.gitlab = { auth: null, host: makeGitLabHostFn({ apiUrl: config.gitlab.apiUrl }) };
-		try {
-			forges.gitlab.auth = await makeGitLabAuthFn(config.gitlab);
-			log("self_identity", { kind: "gitlab", id: forges.gitlab.auth.selfId, source: forges.gitlab.auth.source });
-		} catch (err) {
-			log("gitlab_auth_unavailable", { kind: "gitlab", reason: err?.message });
-		}
+		await attachAuth("gitlab", makeGitLabAuthFn, config.gitlab);
 	}
 	// Forgejo joins on the same best-effort terms. Its auth can fail for one reason the others cannot: a
 	// repository-scoped token cannot call GET /user, so an operator who scoped their token without setting
@@ -381,24 +772,14 @@ export async function startWorker(
 	// credential-less, which refuses its jobs at mint time rather than running them unattributed.
 	if (config.forgejo) {
 		forges.forgejo = { auth: null, host: makeForgejoHostFn({ apiUrl: config.forgejo.apiUrl }) };
-		try {
-			forges.forgejo.auth = await makeForgejoAuthFn(config.forgejo);
-			log("self_identity", { kind: "forgejo", id: forges.forgejo.auth.selfId, source: forges.forgejo.auth.source });
-		} catch (err) {
-			log("forgejo_auth_unavailable", { kind: "forgejo", reason: err?.message });
-		}
+		await attachAuth("forgejo", makeForgejoAuthFn, config.forgejo);
 	}
 	// Azure joins on the same terms. Its selfId is an OBJECT (`{ id, email }`) rather than a scalar, because
 	// a pull-request delivery names an actor by GUID and a work item names them only by address -- the one
 	// place a forge's identity does not reduce to a single value.
 	if (config.azure) {
 		forges.azure = { auth: null, host: makeAzureHostFn({ orgUrl: config.azure.orgUrl }) };
-		try {
-			forges.azure.auth = await makeAzureAuthFn(config.azure);
-			log("self_identity", { kind: "azure", id: forges.azure.auth.selfId?.id ?? null, source: forges.azure.auth.source });
-		} catch (err) {
-			log("azure_auth_unavailable", { kind: "azure", reason: err?.message });
-		}
+		await attachAuth("azure", makeAzureAuthFn, config.azure, (auth) => auth.selfId?.id ?? null);
 	}
 
 	/** The `{ auth, host }` pair a job's kind names, or `undefined` for a local job (which has no forge). */
@@ -423,40 +804,97 @@ export async function startWorker(
 		// and a forgotten one is INVISIBLE, because `reapAll` is conservative over the reapers it is handed
 		// rather than over the venues that exist. A bundle already carries its own `reap`, so taking it from
 		// there is one place. `local`'s is built here because its bundle cannot exist yet.
-		backendReaps = { [DEFAULT_BACKEND]: makeReaperFn({ log }), ...Object.fromEntries(extraBackends.map((b) => [b?.name, b?.reap])) };
-		reaped = (await reapAll(Object.values(backendReaps), { log }))?.reaped === true;
+		// Issue #354: `local`'s only while it is blessed, since its bundle is built only then and the registry refuses a
+		// boot reaper for a venue it does not hold.
+		// Issue #354: podman's the same way and for the same reason, `makeReaper` with `bin: "podman"`, so the sweep lists
+		// the store this account's jobs actually ran in. Docker's listing says nothing about it, and the reverse.
+		backendReaps = {
+			...(localBlessed ? { [DEFAULT_BACKEND]: makeReaperFn({ log }) } : {}),
+			...(podmanBlessed ? { [PODMAN_BACKEND]: makePodmanReaperFn({ log }) } : {}),
+			...Object.fromEntries(extraBackends.map((b) => [b?.name, b?.reap])),
+		};
+		const swept = (await reapAll(Object.values(backendReaps), { log }))?.reaped === true;
+		// PROVEN FOR THE WHOLE HOST, or not at all (issue #354). `reapAll` is conservative over the reapers it is
+		// handed, and two gaps sit outside that. A BLESSED venue with no reaper here is refused by the registry, but
+		// only further down, after the scope sweep has already acted on this answer. And a host without `local` can
+		// still hold `pi-job-` containers under Docker, from before `local` was dropped from PI_BACKENDS, that no
+		// blessed venue's reaper lists: "every blessed venue enumerated" is then true while this host is not shown
+		// clean. The scope sweep is an optimisation over the TTL, so declining it costs one TTL of a stale claim, never
+		// a slot; claiming it would free slots for containers that may still be running. A venue that can prove the
+		// Docker side too (a read-only listing) is what lifts the second gap, and it is not this change.
+		reaped = swept && localBlessed && config.backends.every((name) => typeof backendReaps[name] === "function");
+		// Its own event, said once at boot: the sweeper's `scope_claims_sweep_skipped` says only that the reap did not
+		// prove the host, and this is the one case where every reaper answered and the host is still not proven.
+		if (swept && !reaped) log("host_reap_unproven", { reason: localBlessed ? "a blessed backend has no boot reaper" : "local is not blessed, so no reaper lists this host's docker containers" });
 	} catch (err) {
-		log("reaper_skipped", { reason: err?.message });
+		log("reaper_skipped", { reason: scrubCredentials(err?.message) });
 	}
 
 	// REQ-LOCAL-JOB-VISIBILITY: sweep aged `.log`/`.json` history at boot so the logs directory stays
 	// bounded across restarts. Best-effort with the same double-wrap posture as the container reaper: the
 	// reaper swallows its own fs errors, and this guard keeps any reaper failure from blocking draining.
+	// HELD, not discarded: the periodic sweep (issue #292) re-runs this exact closure, so one configuration
+	// read serves boot and every tick after it and the two cannot drift. The `let` with an inert default is
+	// what keeps a throwing FACTORY from leaving the sweep holding `undefined` -- the guard below promises
+	// that no reaper failure blocks draining, and that promise now has to cover construction too.
+	let reapLogs = () => {};
 	try {
-		await makeLogReaperFn({ logsDir: config.logsDir, retentionDays: config.logRetentionDays, log })();
+		reapLogs = makeLogReaperFn({ logsDir: config.logsDir, retentionDays: config.logRetentionDays, log });
+		await reapLogs();
 	} catch (err) {
-		log("log_reaper_skipped", { reason: err?.message });
+		log("log_reaper_skipped", { reason: scrubCredentials(err?.message) });
 	}
 
 	// REQ-RESURRECTABLE-SANDBOX: sweep retained per-job directories past their window, so what `cleanup`
 	// kept for re-opening stays bounded. Third in the row and deliberately its own sweep -- a different
-	// retention policy, a different PII class, and one thing neither sibling needs: it asks docker which
-	// sandboxes are live first, because an operator's shell can outlive a worker restart by design and
+	// retention policy, a different PII class, and one thing neither sibling needs: it asks the container runtimes
+	// which sandboxes are live first, because an operator's shell can outlive a worker restart by design and
 	// deleting a bind mount underneath it is a confusing failure with a boring cause. Same double-wrap.
+	// Held for the periodic sweep, same as the log reaper above. Safe to re-run on a timer without any
+	// state carried between calls: `makeSandboxReaper` declares `running` INSIDE its returned function and
+	// re-issues `listRunning` every call, so a docker outage costs one interval of retention overshoot
+	// rather than latching the sweep off until the next boot.
+	let reapSandboxes = async () => {};
 	try {
-		await makeSandboxReaperFn({
+		// Issue #429, as corrected by its review: which sandboxes are open is asked PER RETAINED RUN, of the runtime that
+		// run's manifest records, never of the runtimes this worker blesses. The opener's blessing is the OPENER's
+		// `PI_BACKENDS` and routinely differs from the worker's (`OQ-038`), so a blessed-list listing let a podman-only
+		// worker delete a local run's directory under a docker shell an operator had just opened. A runtime that cannot
+		// answer holds its own runs this pass and nothing else, so a stale docker CLI does not stop a podman sweep, and a
+		// run it cannot place (an unreadable manifest, a venue with no launcher) is asked of every runtime present.
+		// `blessed` only adds runtimes to the network sweep; a host that blesses neither and retains nothing from either
+		// spawns neither CLI.
+		// The store a podman run recorded is compared with THIS worker's podman store (review round 2): the cached boot
+		// read when podman is blessed, else one read through the same seam, asked only when a podman run recorded one.
+		const readPodmanStore = async () => {
+			const read = await (podmanInfo ?? readPodmanInfoFn)();
+			return read?.answered === true ? (read.info?.graphRoot ?? null) : null;
+		};
+		const watch = makeSandboxRuntimeWatch({ sandboxDir: config.sandboxDir, blessed: config.backends, list: listRunningSandboxesFn, readPodmanStore, makeSweeper: makeSandboxNetworkSweeperFn, proxy: config.egressProxy, log });
+		reapSandboxes = makeSandboxReaperFn({
 			sandboxDir: config.sandboxDir,
 			retentionHours: config.sandboxRetentionHours,
-			listRunning: listRunningSandboxes,
+			listRunning: watch.listRunning,
+			// Issue #337: the session networks a died-mid-session process left, one sweeper per runtime present (issue
+			// #429), each listing and removing in its own runtime. Unconditional on `PI_EGRESS`, on the boot reaper's own
+			// precedent (it lists `pi-job-` networks whatever the posture) and for a sharper reason: a deployment that has
+			// turned the policy OFF is exactly where the leftovers are guaranteed dead, since nothing is making new ones.
+			sweepNetworks: watch.sweepNetworks,
+			// Issue #446, gate round 1: each expired run's own runtime is asked once more right before it is renamed aside.
+			isOpen: watch.isOpen,
 			log,
-		})();
+		});
+		await reapSandboxes();
 	} catch (err) {
-		log("sandbox_reaper_skipped", { reason: err?.message });
+		log("sandbox_reaper_skipped", { reason: scrubCredentials(err?.message) });
 	}
 
 	// One raw Redis client, shared by the budget (via the worker) and the scheduler stall guard, so it is
 	// hoisted out of the createWorkerFn arg object.
-	const redis = makeRedisClient(config.valkeyUrl);
+	const redis = makeRedisClient(valkey.url, { servername: valkey.servername, context: valkeyContext });
+	// Its errors as one message-only line (PR #475's review, round 2), like every Queue and Worker's: without a listener
+	// ioredis printed a stack per reconnect attempt.
+	onValkeyError(redis, "shared client");
 
 	// This host's own stale scope claims, gated on the reaper having having enumerated: the
 	// reaper is what establishes that this machine holds no `pi-job-*` containers, so a claim naming this
@@ -468,14 +906,14 @@ export async function startWorker(
 		if (config.workerNameDeclared)
 			await makeScopeClaimSweeperFn({ redis, workerName: config.workerName, limits: scopedLimits.current.map((r) => ({ concurrent: r.concurrent, hash: scopeKeyPrefix(r.scope).slice("budget:s:".length) })), log })({ reaped });
 	} catch (err) {
-		log("scope_claims_sweep_skipped", { reason: err?.message });
+		log("scope_claims_sweep_skipped", { reason: scrubCredentials(err?.message) });
 	}
 
 	// The persistent runtime queue: the stall guard tears schedulers down through it, AND the outbox
 	// collector enqueues chained children onto it -- the same pi-jobs queue, so one handle serves both.
 	// Non-failFast: a long-lived handle rides out a Valkey blip. Registered as an extraCloser so shutdown
 	// drains it after the worker.
-	const runtimeQueue = makeQueue(parseConnection(config.valkeyUrl));
+	const runtimeQueue = makeQueue(valkeyConn());
 
 	// THE HOST QUEUE (issue #57): work only this machine can do, because the folder lives here.
 	//
@@ -491,7 +929,7 @@ export async function startWorker(
 	// live triggers-file edit lands on the same queue the boot reconcile used; otherwise the shared
 	// runtime queue, exactly as before. Registered as an extraCloser only when it is a NEW handle --
 	// closing `runtimeQueue` twice would be closing another owner's connection.
-	const cronQueue = hostQueue ? makeQueue(parseConnection(config.valkeyUrl), { name: hostQueue }) : runtimeQueue;
+	const cronQueue = hostQueue ? makeQueue(valkeyConn(), { name: hostQueue }) : runtimeQueue;
 
 	// REQ-LOCAL-JOB-VISIBILITY durable run history, all host-side. The raw `.log` sink is gated on
 	// captureJobLogs (raw container output is user-authored data, opt-in per no-pii-in-logs); the id-only
@@ -510,15 +948,19 @@ export async function startWorker(
 		maxAgeDays: config.sessionMaxAgeDays,
 		maxResumeChain: config.sessionMaxResumeChain,
 		maxContextPct: config.sessionMaxContextPct,
+		// The venue a transcript is stamped with and gated on (#277), resolved with the registry's own default.
+		defaultBackend: config.defaultBackend,
 		log,
 	});
 	// Boot sweep, beside the log reaper and for the same reason it is beside rather than inside it: these
-	// files have a different retention policy and a different PII class. The gate that actually matters is
-	// the age check at OPEN -- a worker that never restarts would otherwise resume forever (OQ-007).
+	// files have a different retention policy and a different PII class. Until issue #292 the age check at
+	// OPEN was carrying this alone, because a worker that never restarts never re-swept; the periodic sweep
+	// now covers the DISK half and the open gate covers the INPUT half, which is the one that matters
+	// (OQ-007, RESOLVED).
 	try {
 		sessionStore.reapSessions();
 	} catch (err) {
-		log("session_reaper_skipped", { reason: err?.message });
+		log("session_reaper_skipped", { reason: scrubCredentials(err?.message) });
 	}
 	// The one-shot file path (issue #231): PI_TRIGGERS_FILE, else ./triggers.json against this process's
 	// cwd -- doctor's own fallback, chosen for doctor's own reason ("the two must read the same file"),
@@ -535,7 +977,9 @@ export async function startWorker(
 	const recordRun = ({ job, result, error, startedAt, endedAt }) => {
 		// The `host` is stamped HERE rather than inside the processor, which is what keeps every one of its
 		// four `recordRun` call sites byte-unchanged and `buildRecord` a pure function of its arguments.
-		const record = buildRecord({ job, result, error, startedAt, endedAt, host: config.workerName });
+		// The default venue rides the same way and for the same reason (#277): it is the value the registry
+		// below is built with, so the record resolves a job's venue exactly as dispatch does.
+		const record = buildRecord({ job, result, error, startedAt, endedAt, host: config.workerName, defaultBackend: config.defaultBackend });
 		writeRecord(record);
 		// STRICTLY AFTER the file, and deliberately not awaited. After, because a crash between the two must
 		// leave a record with no fleet row rather than a fleet row with no record -- the mirror is a VIEW,
@@ -647,16 +1091,102 @@ export async function startWorker(
 	// ONE preflight instance, constructed once and shared: `start-wiring.test.mjs` pins that, and the
 	// reason is the module's own -- the tag the preflight checked has to be the tag `docker run` is
 	// handed, and two constructions are two chances for that to stop being true.
-	const imagePreflight = makeImagePreflightFn({ image: config.jobImage });
+	// Issue #354: built only while `local` is blessed, since it IS local's (`docker image inspect`). Without `local` the
+	// boot read below asks the default venue's own preflight instead, the one its jobs will be gated on.
+	const imagePreflight = localBlessed ? makeImagePreflightFn({ image: config.jobImage }) : null;
+	// Issue #354: the podman bundle, built only while `podman` is blessed, from the SAME deployment inputs local's
+	// runContainer is handed below (one image, one overlay, one forward list, one egress posture: a venue must not quietly
+	// run a different job than the one configured), plus what only this venue reads: the cached `podman info` the boot
+	// read above already asked, the floor its per-job observation preflight judges, the boot-built reaper, and the
+	// process's identity and host files, through the same seams local's decisions read. Built HERE rather than beside
+	// local's, because the boot image read just below asks the default venue's own preflight when that venue is podman.
+	const podmanBackend = podmanBlessed
+		? makePodmanBackendFn({
+				image: config.jobImage,
+				hostEnv: env,
+				egress: config.egress,
+				egressProxy: config.egressProxy,
+				openJobLog,
+				globalPiDir: config.globalPiDir,
+				allowGlobalExtensions: config.allowGlobalExtensions,
+				packagePaths: getPackagePaths,
+				forwardEnv: config.forwardEnv,
+				authFromPi: config.authFromPi,
+				forgeHosts: { gitlab: config.gitlab?.apiUrl ?? null, forgejo: config.forgejo?.apiUrl ?? null, azure: config.azure?.orgUrl ?? null },
+				backendFloor: config.backendFloor,
+				reap: backendReaps[PODMAN_BACKEND],
+				readInfo: podmanInfo,
+				platform: jobUserIdentity.platform,
+				euid: jobUserIdentity.euid,
+				egid: jobUserIdentity.egid,
+				fs: observationFs,
+				home: jobUserIdentity.home,
+				env,
+				log,
+			})
+		: null;
+	// Issue #458 (PR #463 round 2): on Podman 4.x with egress armed, the keeper read ONCE at boot through the bundle's own
+	// preflight, bounded, and said as its own event with the whole sentence. A deployment that upgraded without re-running
+	// `service install` or `up` has no keeper, and would otherwise learn it only from retried jobs. Only a warning: the
+	// per-job preflight is the gate: once the keeper holds, the next job runs (under a proxy up longer than the grace,
+	// 15 s, after the proxy's restart, which the job's retry message and doctor both ask for).
+	if (podmanBackend && config.egress) {
+		const readBootKeeper = () =>
+			settleWithin(
+				Promise.resolve()
+					.then(() => podmanBackend.egressPreflight({}))
+					.catch(() => ({})),
+				BOOT_IMAGE_TIMEOUT_MS * 4,
+				{},
+			);
+		let bootKeeper = await readBootKeeper();
+		// Issue #476: a keeper whose only fault is its age is waited out, once and bounded (at most the minimum age plus
+		// the margin), then judged again. A stack started together reads it under a second old (measured 0.5 to 0.8 s on
+		// 4.9.3), and warning then was wrong every time; a keeper still young after the wait restarted in it, and is said.
+		if (bootKeeper?.young && typeof bootKeeper.young === "object") {
+			const waitMs = Math.min(Number.isFinite(bootKeeper.young.waitMs) ? bootKeeper.young.waitMs : 0, NETNS_KEEPER_MIN_AGE_MS + NETNS_KEEPER_YOUNG_MARGIN_MS);
+			// Said as information, not a warning: the one line that shows a joint start was waited out, and for how long.
+			log("netns_keeper_young_at_boot", { keeperAgeMs: bootKeeper.young.ageMs ?? null, waitMs });
+			await sleep(Math.max(0, waitMs));
+			bootKeeper = await readBootKeeper();
+		}
+		// Its own sentence (PR #463 round 3): the job-shaped one says "this job is retried", and at boot there is no job.
+		if (typeof bootKeeper?.keeper === "string") log("netns_keeper_not_holding_at_boot", { reason: bootKeeper.keeperAtBoot ?? bootKeeper.keeper });
+	}
+	// Every bundle this boot built beside local's, in registration order: the podman one first, then the injected ones.
+	const builtBackends = [...(podmanBackend ? [podmanBackend] : []), ...extraBackends];
 	// BOUNDED, because `.catch()` cannot rescue a promise that never settles: `runDocker` resolves only on
 	// the child's `close` or `error` and has no timeout of its own, so a wedged daemon would hang boot
 	// here. This read is a nicety -- a digest for the boot line and the registry -- and a nicety may
 	// never be able to stop a worker starting. The per-JOB preflight keeps its unbounded wait, where a
 	// wedged daemon is the job's problem and the 30-minute job timeout already covers it.
-	const bootImage = await Promise.race([
-		imagePreflight({}).catch(() => ({})),
-		new Promise((resolve) => setTimeout(() => resolve({}), BOOT_IMAGE_TIMEOUT_MS).unref?.()),
-	]);
+	// Without `local` (issue #354) the default venue's own preflight, under the same bound and the same swallow: a
+	// nicety that throws synchronously must not stop a boot either, hence the `then`. None at all reads as no digest.
+	const defaultVenueImageRead = () => {
+		const read = builtBackends.find((b) => b?.name === config.defaultBackend)?.imagePreflight;
+		return Promise.resolve()
+			.then(() => (typeof read === "function" ? read({}) : {}))
+			.then((answer) => answer ?? {})
+			.catch(() => ({}));
+	};
+	const bootImage = await settleWithin(imagePreflight ? imagePreflight({}).catch(() => ({})) : defaultVenueImageRead(), BOOT_IMAGE_TIMEOUT_MS, {});
+	// Issue #341: say it at boot, not only as a refusal on every job. The deployment's default image cannot run as
+	// this worker's uid on this daemon, so every local job that uses it will be refused pre-spend.
+	if (bootDecision?.mode === "worker" && bootImage.ok) {
+		const planned = resolveImageUser(bootDecision, { capabilities: bootImage.capabilities ?? [], euid: jobUserIdentity.euid, egid: jobUserIdentity.egid, socket: bootJobUser?.socket ?? null });
+		if (planned.refused === "job-image-any-uid-unsupported") log("job_image_any_uid_unsupported", { image: config.jobImage });
+		else if (planned.refused) log("job_user_group_refused", { cause: planned.cause });
+		if (planned.user && config.forwardEnv.includes("HOME")) log("forward_env_home_overridden", { reason: "HOME is set beside --user" });
+	}
+	// Issue #354: the same boot sentence for a podman DEFAULT venue, whose image was read from this account's own store
+	// just above. Only as the default: with `local` the default, `bootImage` is docker's copy of the tag, which says
+	// nothing about the one in the podman store. `backend` names the venue, since `local`'s lines carry none.
+	if (config.defaultBackend === PODMAN_BACKEND && bootPodmanDecision?.mode === "worker" && bootImage.ok) {
+		const planned = resolvePodmanImageUser(bootPodmanDecision, { capabilities: bootImage.capabilities ?? [], euid: jobUserIdentity.euid, egid: jobUserIdentity.egid });
+		if (planned.refused === "job-image-any-uid-unsupported") log("job_image_any_uid_unsupported", { image: config.jobImage, backend: PODMAN_BACKEND });
+		else if (planned.refused) log("job_user_group_refused", { cause: planned.cause, backend: PODMAN_BACKEND });
+		if (planned.user && config.forwardEnv.includes("HOME")) log("forward_env_home_overridden", { reason: "HOME is set beside --user", backend: PODMAN_BACKEND });
+	}
 	// Resolved once: `Intl` is not free, and this value cannot change without a restart.
 	const hostTz = Intl.DateTimeFormat().resolvedOptions().timeZone ?? "";
 	const registry = makeHostRegistryFn({ redis, name: config.workerName, log });
@@ -698,6 +1228,107 @@ export async function startWorker(
 	});
 
 
+	// `local`'s two optional preflights (issue #354: they were `deps` closures, and are now the bundle's own members,
+	// dispatched per venue by the registry). Bodies unchanged.
+	//
+	// Issue #278: the docker endpoint read AGAIN before each job's spend, because a `docker context use`
+	// after boot redirects every later job, and a preflight that answered once at boot would give a
+	// wrong decision all day (the image preflight is not cached for the same reason). Only for a venue
+	// whose declaration is observation-gated on it, and only a refusal under a floor that needs it.
+	// Issue #345: the runtime observations come from the same per-job read, in the same place: the facts the job user is
+	// decided from (cached per endpoint state, so no second daemon call) and this host's Podman files, re-read per job
+	// because an operator creating the empty mounts.conf override must not need a restart.
+	const localObservationPreflight = async (job) => {
+		const venue = resolveBackendName(job, config.defaultBackend);
+		if (Object.keys(backendFor(venue)?.observedBy ?? {}).length === 0) return { ok: true };
+		const endpoint = await resolveDockerEndpointFn();
+		const state = dockerEndpointState(endpoint);
+		if (state !== endpointSeen) {
+			endpointSeen = state;
+			logDockerEndpoint(log, endpoint, { changed: true });
+		}
+		// The endpoint refusal FIRST, from the CLI's own configuration only, as boot does: a floor that distrusts this
+		// endpoint must not wait on, or send the CLI's own TLS client credentials to, the daemon behind it.
+		const endpointArgs = {
+			backends: [venue],
+			backendFloor: config.backendFloor,
+			observations: { [DOCKER_ENDPOINT_LOCAL]: endpoint.local === true },
+			evidence: { [DOCKER_ENDPOINT_LOCAL]: dockerEndpointEvidence(endpoint) },
+			only: [DOCKER_ENDPOINT_LOCAL],
+		};
+		const [endpointRefusal] = observationRefusals(endpointArgs);
+		if (endpointRefusal) {
+			if (endpoint.local === null && endpoint.transient) return { unavailable: true, reason: endpoint.reason };
+			return { refused: true, message: endpointRefusal, observations: [DOCKER_ENDPOINT_LOCAL] };
+		}
+		const jobUser = await resolveJobUser({ endpoint, key: state });
+		const unit = await readRootfulService({ endpoint, daemon: jobUser.daemon, readService: readPodmanServiceFn });
+		// One read of each host path for this job's two checks (`onceFs`, gate round 3 of PR #473), fresh per job.
+		const jobFs = onceFs(observationFs);
+		const observed = observeHost({ endpoint, daemon: jobUser.daemon, fs: jobFs, unit, env, memory: rootfulMemory });
+		if (runtimeObservationKey(observed) !== runtimeObservedSaid) {
+			runtimeObservedSaid = runtimeObservationKey(observed);
+			log("runtime_observed", { daemonAppliesBounds: observed.observations.daemonAppliesBounds, runtimeAddsNoMounts: observed.observations.runtimeAddsNoMounts, changed: true });
+		}
+		// Issue #448: rootful Podman's containers.conf, per job and before any spend, re-read every time because removing a
+		// key must need no worker restart (only the Podman service's). Handed back as the podman venue's refusal is
+		// (`podmanConfRefused`, `rootful: true`), ahead of the floor: it is what the venue IS on this host, and the processor
+		// returns it before the image preflight. Nothing is read where the daemon is not rootful Podman on this host.
+		const rootful = await observeRootfulConf({ endpoint, daemon: jobUser.daemon, fs: jobFs, readService: readPodmanServiceFn, env, unit, memory: rootfulMemory });
+		sayRootfulUnread(rootful);
+		if (rootful?.refusal) return { ok: true, endpoint, jobUser, podmanConfRefused: rootfulRefused(rootful.refusal) };
+		const args = {
+			backends: [venue],
+			backendFloor: config.backendFloor,
+			observations: observed.observations,
+			evidence: { [DOCKER_ENDPOINT_LOCAL]: dockerEndpointEvidence(endpoint), ...observed.evidence },
+		};
+		const [refusal] = observationRefusals(args);
+		if (!refusal) return { ok: true, endpoint, jobUser };
+		const missed = [...new Set(unobservedFloor(args.backends, args.backendFloor, args.observations).map((m) => m.observedBy))];
+		if (observationRefusalIsTransient(args)) return unavailableFor(observed, missed[0]);
+		return { refused: true, message: refusal, observations: missed };
+	};
+	// Issue #452, gate round 5: the runtime each local job was admitted on, by job id, taken (and forgotten) by that job's
+	// teardown. Bounded: a job refused after its job-user preflight never reaches a teardown, so the oldest entries go first.
+	const admittedRuntimes = new Map();
+	const ADMITTED_RUNTIMES_MAX = 1000;
+	const recordAdmittedRuntime = (job, runtime) => {
+		if (job?.id === undefined || runtime === undefined) return;
+		admittedRuntimes.delete(job.id);
+		admittedRuntimes.set(job.id, runtime);
+		while (admittedRuntimes.size > ADMITTED_RUNTIMES_MAX) admittedRuntimes.delete(admittedRuntimes.keys().next().value);
+	};
+	const takeAdmittedRuntime = (job) => {
+		const runtime = admittedRuntimes.get(job?.id);
+		admittedRuntimes.delete(job?.id);
+		return runtime;
+	};
+	// Issue #341: the job user, for a job on the `local` venue only (its containers are this host's docker
+	// CLI's). The endpoint is the one `observationPreflight` just read, so one job's two decisions agree.
+	const localJobUserPreflight = async (job, { capabilities = [], observed } = {}) => {
+		const venue = resolveBackendName(job, config.defaultBackend);
+		if (venue !== DEFAULT_BACKEND) return { user: null, home: null };
+		const endpoint = observed?.endpoint ?? (await resolveDockerEndpointFn());
+		const admittedOn = observed?.jobUser ?? (await resolveJobUser({ endpoint, key: dockerEndpointState(endpoint) }));
+		const { decision, socket, facts } = admittedOn;
+		// Issue #452, gate round 5: the runtime THIS job is admitted on, recorded per job for its teardown's detach gate. The
+		// resolver's cache is per endpoint state and moves when the endpoint does, so reading it at teardown could hand a
+		// job the answer of another endpoint's daemon.
+		recordAdmittedRuntime(job, admittedOn?.daemon?.answered ? runtimeFromFacts(admittedOn.daemon) : undefined);
+		if (jobUserLogKey(decision) !== jobUserSaid) {
+			jobUserSaid = jobUserLogKey(decision);
+			log("job_user", { mode: decision.mode, user: decision.user, cause: decision.cause, reason: decision.reason });
+		}
+		const chosen = resolveImageUser(decision, { capabilities, euid: jobUserIdentity.euid, egid: jobUserIdentity.egid, socket });
+		// Issue #355: whether this job's own mounts carry `:Z`, from the SAME facts and endpoint the user was decided
+		// from, so one job's two answers cannot come from two reads. Only on a path that runs (a refusal or an
+		// undecidable daemon runs nothing), and only when true: every host this does not apply to keeps the answer
+		// shape, and so the argv, it had before.
+		if (chosen.refused || chosen.unavailable) return chosen;
+		return relabelsPrivateMounts(facts, endpoint, jobUserIdentity.platform) ? { ...chosen, relabel: true } : chosen;
+	};
+
 	// #227: WHERE this job's container runs. The three functions that decide whether a container may start and
 	// then start it -- two pre-spend gates and the launcher -- bundled into one value with a completeness
 	// check, so the set has a name instead of being three unrelated `deps` keys. Byte-identical to passing them individually -- the same three functions reach the same three keys,
@@ -707,67 +1338,105 @@ export async function startWorker(
 	// Assigned key by key below rather than spread, because the bundle also carries `name` and `declares`,
 	// and `deps` is the processor's namespace: a spread would put a backend's name into it under a key the
 	// processor is free to mean something else by.
-	const localBackend = makeLocalBackend({
-		// #227. The two the earlier slices deferred, now real seams. `reap` keeps its tri-state: the boot
-		// sweep below only sweeps this host's scope claims once the reaper has PROVEN this host holds no
-		// job containers, and an unproven answer must never free a slot.
-		stopContainer: makeStopContainer(),
-		reap: backendReaps[DEFAULT_BACKEND],
-		// One deployment default, two consumers, adjacent by construction: the preflight that refuses a missing
-		// image BEFORE the budget slot, and the factory that puts it in the argv. Both resolve a trigger's own
-		// `run.image` through the same resolveJobImage, so the image that was checked is the image that runs.
-		// Nothing is memoised (see its construction above): `docker image inspect` costs ~tens of ms against a
-		// container run of minutes, and a cache would be wrong in both directions -- an operator who builds the
-		// image mid-day would stay refused, one who removes it would stay admitted. Contrast the staged-package
-		// manifest, correctly read once at boot because it is deploy-time state under a :ro mount.
-		imagePreflight,
-		// REQ-EGRESS-ALLOWLIST, and built here for the same reason the image preflight is: one deployment
-		// value, one place, so the gate that checks the proxy and the runner that attaches to its network
-		// cannot disagree about which proxy is meant. Nothing is memoised here either -- an operator who
-		// starts the proxy mid-day must not stay refused, and one who stops it must not stay admitted.
-		// Unarmed it spawns nothing at all, so a deployment without a policy pays for none of this.
-		egressPreflight: makeEgressPreflightFn({ proxy: config.egressProxy, armed: config.egress }),
-		runContainer: makeRunContainerFn({
-			image: config.jobImage,
-			hostEnv: env,
-			egress: config.egress, // REQ-EGRESS-ALLOWLIST: the per-job network and the proxy variables
-			egressProxy: config.egressProxy,
-			openJobLog,
-			globalPiDir: config.globalPiDir, // REQ-GLOBAL-PI-OVERLAY: :ro overlay mount when configured
-			allowGlobalExtensions: config.allowGlobalExtensions,
-			// REQ-GLOBAL-PI-OVERLAY: staged package paths; every job receives them unless its trigger set
-			// packages:false. A RESOLVER, not the array: the factory is still constructed exactly once, only
-			// the value it reads became a call, so a re-stage takes effect on the next job without a restart.
-			packagePaths: getPackagePaths,
-			forwardEnv: config.forwardEnv,
-			authFromPi: config.authFromPi, // source the provider key from ~/.pi/agent/auth.json when env has none
-			// Self-hosted instance URLs, keyed by forge. A MAP rather than one scalar per forge: the table says
-			// which variable each lands in, so a forge with no self-hosted concept simply has no entry, and
-			// adding one does not widen this signature again.
-			forgeHosts: { gitlab: config.gitlab?.apiUrl ?? null, forgejo: config.forgejo?.apiUrl ?? null, azure: config.azure?.orgUrl ?? null },
-		}),
-	});
+	//
+	// Issue #354: built ONLY while `local` is blessed. Built unconditionally, as it was while PI_BACKENDS had to include
+	// it, it would be a registered venue this deployment never chose, whose reaper the boot map must then carry and
+	// whose reads spawn `docker` on a host that may have none. The two optional preflights ride on the bundle rather
+	// than through `makeLocalBackend`, whose completeness check treats every member it takes as required.
+	const localBackend = localBlessed
+		? {
+				...makeLocalBackend({
+					// #227. The two the earlier slices deferred, now real seams. `reap` keeps its tri-state: the boot
+					// sweep below only sweeps this host's scope claims once the reaper has PROVEN this host holds no
+					// job containers, and an unproven answer must never free a slot.
+					stopContainer: makeStopContainer(),
+					reap: backendReaps[DEFAULT_BACKEND],
+					// One deployment default, two consumers, adjacent by construction: the preflight that refuses a missing
+					// image BEFORE the budget slot, and the factory that puts it in the argv. Both resolve a trigger's own
+					// `run.image` through the same resolveJobImage, so the image that was checked is the image that runs.
+					// Nothing is memoised (see its construction above): `docker image inspect` costs ~tens of ms against a
+					// container run of minutes, and a cache would be wrong in both directions -- an operator who builds the
+					// image mid-day would stay refused, one who removes it would stay admitted. Contrast the staged-package
+					// manifest, correctly read once at boot because it is deploy-time state under a :ro mount.
+					imagePreflight,
+					// REQ-EGRESS-ALLOWLIST, and built here for the same reason the image preflight is: one deployment
+					// value, one place, so the gate that checks the proxy and the runner that attaches to its network
+					// cannot disagree about which proxy is meant. Nothing is memoised here either -- an operator who
+					// starts the proxy mid-day must not stay refused, and one who stops it must not stay admitted.
+					// Unarmed it spawns nothing at all, so a deployment without a policy pays for none of this.
+					egressPreflight: makeEgressPreflightFn({ proxy: config.egressProxy, armed: config.egress }),
+					runContainer: makeRunContainerFn({
+						image: config.jobImage,
+						hostEnv: env,
+						egress: config.egress, // REQ-EGRESS-ALLOWLIST: the per-job network and the proxy variables
+						egressProxy: config.egressProxy,
+						openJobLog,
+						globalPiDir: config.globalPiDir, // REQ-GLOBAL-PI-OVERLAY: :ro overlay mount when configured
+						allowGlobalExtensions: config.allowGlobalExtensions,
+						// REQ-GLOBAL-PI-OVERLAY: staged package paths; every job receives them unless its trigger set
+						// packages:false. A RESOLVER, not the array: the factory is still constructed exactly once, only
+						// the value it reads became a call, so a re-stage takes effect on the next job without a restart.
+						packagePaths: getPackagePaths,
+						forwardEnv: config.forwardEnv,
+						authFromPi: config.authFromPi, // source the provider key from ~/.pi/agent/auth.json when env has none
+						// Self-hosted instance URLs, keyed by forge. A MAP rather than one scalar per forge: the table says
+						// which variable each lands in, so a forge with no self-hosted concept simply has no entry, and
+						// adding one does not widen this signature again.
+						forgeHosts: { gitlab: config.gitlab?.apiUrl ?? null, forgejo: config.forgejo?.apiUrl ?? null, azure: config.azure?.orgUrl ?? null },
+						// Issue #452, gate round 4: the teardown's detach gate uses the `docker info` facts this job was admitted
+						// on (the job-user resolver's cached answer), never a fresh read, which on Docker Engine read as
+						// `runtime-unreadable` whenever it timed out or failed and leaked the job's network. No cached answer: it
+						// reads. A refused teardown is logged with its token.
+						teardownRuntime: (job) => takeAdmittedRuntime(job),
+						log,
+					}),
+				}),
+				observationPreflight: localObservationPreflight,
+				jobUserPreflight: localJobUserPreflight,
+			}
+		: null;
 
 	// #227. WHICH backend runs which job, and the one place that decides. One bundle today, so every
 	// resolution returns it -- but the mechanism is real, so `run.backend` stops being a validated label and
 	// the abort path can reach a venue it did not build. `config.backends[0]` is the deployment's default,
 	// and the registry refuses a default it does not hold rather than discovering it at the first pickup.
-	const backends = makeBackendRegistryFn({
-		// #227. A SEAM, not a literal. `docs/backends.md` tells an adapter author to register their bundle
-		// here, and until this was injectable that instruction described code nobody could run: the array
-		// was hard-coded, so a venue could pass the conformance suite, get a table entry and be blessed in
-		// PI_BACKENDS, and then be refused at boot as blessed-but-unbuilt with nowhere to put it. It is also
-		// what lets a wiring test prove `startWorker` actually CONNECTS the registry to the processor --
-		// six mutations reverting that connection survived the whole suite, which is the same shape as the
-		// bug that shipped: invisible while there is one venue.
-		bundles: [localBackend, ...extraBackends],
-		defaultName: config.defaultBackend,
-		// Cross-checked at boot rather than discovered at the first pickup: a name PI_BACKENDS blesses but
-		// nothing builds passes both the loader and the pre-spend gate, and a venue with no boot reaper is
-		// swept by nothing while still reporting the host as proven clean.
-		blessed: config.backends,
-		reaps: backendReaps,
-	});
+	// A refusal here comes AFTER boot opened the Redis client, the runtime and cron queues and the host registry, so all of
+	// them are released before the refusal travels: any one left open keeps the event loop alive, and a worker that refused
+	// to boot would hang instead of exiting (measured against a real Valkey: two sockets held past 30 s).
+	let backends;
+	try {
+		backends = makeBackendRegistryFn({
+			// #227. A SEAM, not a literal. `docs/backends.md` tells an adapter author to register their bundle
+			// here, and until this was injectable that instruction described code nobody could run: the array
+			// was hard-coded, so a venue could pass the conformance suite, get a table entry and be blessed in
+			// PI_BACKENDS, and then be refused at boot as blessed-but-unbuilt with nowhere to put it. It is also
+			// what lets a wiring test prove `startWorker` actually CONNECTS the registry to the processor --
+			// six mutations reverting that connection survived the whole suite, which is the same shape as the
+			// bug that shipped: invisible while there is one venue.
+			bundles: [...(localBackend ? [localBackend] : []), ...builtBackends],
+			defaultName: config.defaultBackend,
+			// Cross-checked at boot rather than discovered at the first pickup: a name PI_BACKENDS blesses but
+			// nothing builds passes both the loader and the pre-spend gate, and a venue with no boot reaper is
+			// swept by nothing while still reporting the host as proven clean.
+			blessed: config.backends,
+			reaps: backendReaps,
+		});
+	} catch (err) {
+		const opened = [registry, runtimeQueue, ...(cronQueue !== runtimeQueue ? [cronQueue] : [])];
+		// Bounded, then forced: a queue whose connection came up closes by sending QUIT and awaiting the reply, and against a
+		// server that stopped answering that wait never ends (measured through a stalling proxy), so the refusal itself would
+		// never travel. Five seconds covers the host registry's own bounded close; whatever is still open is disconnected.
+		await settleWithin(Promise.allSettled(opened.map((handle) => Promise.resolve().then(() => handle?.close?.()))), 5_000);
+		for (const handle of opened) {
+			try {
+				handle?.disconnect?.();
+			} catch {
+				// a handle with nothing left to drop
+			}
+		}
+		redis.disconnect();
+		throw err;
+	}
 
 	// The auxiliary handles the shutdown closes after the worker drains (`index.mjs` -> shutdown). A NAMED
 	// array rather than the literal it used to be, because up to three of its members do not exist yet: the
@@ -781,8 +1450,81 @@ export async function startWorker(
 	// issue #295 back. Append only: two tests pin `[0]` as the runtime queue and `[1]` as the registry.
 	const extraClosers = [runtimeQueue, registry, ...(cronQueue === runtimeQueue ? [] : [cronQueue])];
 
+	// HOISTED out of the deps literal (issue #288): the terminal failed listener below needs the same
+	// adapter the processor gets, and two bodies would drift exactly where drift costs a public comment.
+	const comment = async (job, text) => {
+		// Best-effort: the processor awaits comment() inside its try, so a rejection here would
+		// corrupt the job outcome and could drive a wrong retry / second PR (CONST-RETRY-INFRA-ONLY).
+		// This adapter NEVER throws.
+		const forge = forgeFor(job);
+		// Same re-resolve as the mint path, and it matters more here: a comment is how a refusal
+		// reaches the person who asked for the job, so a forge whose auth was merely unreachable at
+		// boot must not degrade every later comment to a stdout line nobody is watching.
+		//
+		// A THROWING re-resolve is treated as no auth rather than as a failed comment, which is what
+		// keeps the fallthrough below reachable: the text still lands on stdout instead of being
+		// replaced by a `comment_failed` line that does not carry it. This adapter never throws.
+		let auth = forge?.auth ?? null;
+		if (forge && !auth) {
+			try {
+				auth = await ensureAuth(job.kind);
+			} catch {
+				auth = null;
+			}
+		}
+		if (auth) {
+			try {
+				const token = await auth.mintToken(job);
+				await forge.host.postStatusComment(job, job.target, text, token);
+			} catch (err) {
+				log("comment_failed", { jobId: job?.id, reason: err?.message });
+			}
+			return;
+		}
+		// A local job, or a forge-backed one whose auth never came up. Either way there is nowhere to
+		// post, so the line on stdout IS the completion signal (REQ-LOCAL-JOB-VISIBILITY).
+		log("comment", { jobId: job?.id, text });
+	};
+
+	// The operator's failure hook (issue #288, INT-ON-FAILURE-HOOK-CONTRACT). Constructed ONLY when the
+	// knob is set: an unset PI_ON_FAILURE builds nothing, spawns nothing, and logs nothing -- the
+	// byte-identical guarantee. Fired from the two terminal listeners below, never from the processor:
+	// a hook fault must not be able to flip an outcome, and the listeners sit outside every try that
+	// decides one.
+	// `hostEnv: env`, not the default process.env -- the #309 rule every spawner in this file follows
+	// (runContainer, resolveSecrets): a subprocess runs with THIS worker's env, identical on the real
+	// path and divergent only under an injected one, which is exactly where the difference would hide.
+	const onFailure = config.onFailure
+		? makeOnFailure({ command: config.onFailure, timeoutMs: config.onFailureTimeoutMs, host: config.workerName ?? "", hostEnv: env, log })
+		: null;
+	// Which POLICY reasons page the operator. Paid terminals only: worker-abort, runner-policy and every
+	// named runner reason cost a container and ended wrong. The runner's named reasons are SPREAD from
+	// RUNNER_POLICY_REASONS rather than listed, because each is an exit 2 that would have paged as
+	// runner-policy before it got its own label, and a label must not be the thing that silences a page;
+	// provider-auth-refused (issue #437) is the case in point, a refusal only the operator can fix. Excluded on purpose: `completed` and every pre-spend refusal (free, and
+	// each already comments -- a delivery storm against a spent cap must not page anyone), and
+	// `operator-cancel`, because the operator initiated it and a push telling them what they just did is
+	// noise with a pager attached.
+	const HOOK_POLICY_REASONS = new Set(["worker-abort", "runner-policy", ...RUNNER_POLICY_REASONS]);
+	// The infra-terminal sentence (issue #288). FIXED, never err.message: the message classes that reach
+	// a failedReason carry host paths and library words (the #310 record), and for a local job this text
+	// lands verbatim in the service log through the adapter's stdout fallthrough. The worker log already
+	// holds the truncated reason on the job_failed line beside it.
+	const FAILED_COMMENT = "Failed: an error stopped this job and it will not be retried further. Ask the operator to check the worker log.";
+	// Issue #458 (PR #463 round 2): a job that never started because the podman venue's rootless network keeper did not
+	// hold says so, since the generic line sends an operator to a log that only says the job failed. Fixed text keyed by
+	// the fixed reason token, never the error's own words: a forge comment carries nothing a host read produced.
+	const FAILED_COMMENT_BY_REASON = Object.freeze({
+		// Neutral on the cause (PR #463 round 3): a keeper that is not running and a proxy that must restart after it both land here.
+		[NETNS_KEEPER_NOT_HOLDING]: "Failed before it started: this worker's rootless Podman egress proxy did not pass its pre-start check (its rootless network keeper, pi-dispatch-netns-keeper), so the job was retried and never run. Nothing was spent. Ask the operator to run `pi-dispatch doctor` on the worker for the exact fix.",
+		// Issue #476: a job held on a young keeper that kept restarting while it waited.
+		[NETNS_KEEPER_CRASH_LOOP]: "Failed before it started: this worker's rootless network keeper (pi-dispatch-netns-keeper), which its Podman egress proxy needs, kept restarting while the job waited for it, so the job was retried and never run. Nothing was spent. Ask the operator to run `pi-dispatch doctor` on the worker and read the keeper's log (`journalctl --user -u pi-dispatch-netns-keeper.service`).",
+		// Issue #448 (gate round 2 of PR #473): the hold's own ending, so the comment names the cause and the fix.
+		[PODMAN_RESTART_HOLD_EXPIRED]: "Failed before it started: rootful Podman's service on this worker kept running with a containers.conf older than its files (or a file's change time stayed ahead of the host's clock) for an hour, so the job was held and never run. Nothing was spent. Ask the operator to restart it while no local job runs (`sudo systemctl restart podman.service`), then run the job again.",
+	});
+
 	const worker = createWorkerFn({
-		connection: parseConnection(config.valkeyUrl),
+		connection: valkeyConn(),
 		// #227. The abort path's stop, resolved per job rather than hard-wired to docker. A container NAME is
 		// not enough to find the runtime holding it once there is more than one venue.
 		stopContainer: backends.stopContainer,
@@ -847,6 +1589,29 @@ export async function startWorker(
 			// spending delivery is excused). In the compose topology this check is the once-enforcement
 			// layer, because the receiver's single-file :ro mount pins a dead inode until restart.
 			checkOnceSpent: makeCheckOnceSpent({ triggersPath: onceTriggersFile }),
+			// Issue #310. The free provider-credential gate, bound from EXACTLY the values the container builder
+			// is handed, and asserted to be the same by a wiring test. A gate that resolves against different
+			// inputs than the writer is the divergence class this whole cluster of issues is about: it would pass
+			// a job the container then refuses, or refuse one the container would have run. `agentDir` is
+			// defaulted by both, from the same `hostEnv`.
+			//
+			// A processor dep and NOT a backend bundle member: the bundle is a closed set about how a venue runs
+			// a container, and this is a question about the deployment, asked before any venue is chosen.
+			//
+			// A PROBE: whatever it resolves is dropped on the floor. The credential itself is read where it always
+			// was, inside buildContainerEnv, so no live key is ever in scope in the processor.
+			checkProviderCredential: (job) => {
+				try {
+					resolveProviderCredential({ provider: job.provider, hostEnv: env, authFromPi: config.authFromPi, forwardEnv: config.forwardEnv });
+					return { ok: true };
+				} catch (error) {
+					// Only OUR determinate refusal. Anything else (a bug here, an fs fault the module does not model)
+					// must not become a policy refusal on the operator's issue: it rethrows into runJob's catch, which
+					// classifies it the way it always did.
+					if (error?.piDispatchConfig !== true) throw error;
+					return { ok: false, message: error.message };
+				}
+			},
 			// Issue #230. The same file and the same fail-open posture, but its own mtime-cached read: this one
 			// asks whether the AUTHORED entry declares wait conditions the job arrived without, which is how a
 			// service below the version floor turns a wait into a paid run nothing can tell from a correct
@@ -878,6 +1643,11 @@ export async function startWorker(
 			},
 			imagePreflight: backends.imagePreflight,
 			egressPreflight: backends.egressPreflight,
+			// Issue #354: both are the VENUE's, dispatched through the registry like the two gates above, so a job on a
+			// venue that carries neither gets the processor's own defaults and never asks this host's docker CLI anything.
+			// `local`'s are the closures built beside its bundle below, unchanged.
+			observationPreflight: backends.observationPreflight,
+			jobUserPreflight: backends.jobUserPreflight,
 			// Completed-only, so a policy or infra exit leaves the canonical transcript byte-identical and a
 			// retry starts from what the first attempt did (CONST-RETRY-INFRA-ONLY).
 			promoteSession: sessionStore.promoteSession,
@@ -893,7 +1663,12 @@ export async function startWorker(
 			// because the settings file is read at each job start and an operator who declares a profile in
 			// the panel should not have to restart the worker to use it. A deployment that declares nothing
 			// spawns nothing at all: the gate only calls this when a trigger is armed.
-			resolveSecrets: makeSecretsResolverFn({ envProfiles: config.secretProfiles, roots: config.secretResolverRoots, timeoutMs: config.secretResolveTimeoutMs, forwardEnv: config.forwardEnv, log }),
+			// `hostEnv` is the env THIS worker was started with, not `process.env` by default (issue #309). It is
+			// the environment the resolver subprocess runs in, and makeRunContainer above is handed the same
+			// `env` for the container it builds. Identical on the real path, where both are process.env; under an
+			// injected env they were not, which is the divergence this file already calls out by name for
+			// sessionsDir. One deployment value, one place, same rule as the profiles below it.
+			resolveSecrets: makeSecretsResolverFn({ envProfiles: config.secretProfiles, roots: config.secretResolverRoots, timeoutMs: config.secretResolveTimeoutMs, forwardEnv: config.forwardEnv, hostEnv: env, log }),
 			// #227. What PI_BACKENDS blessed, so a trigger naming an unblessed venue refuses pre-spend. The
 			// panel's picker is bounded by the same list, and this is the half that binds: the overlay is
 			// not the reviewed artifact (DES-PER-TRIGGER-SECRET-PROFILE).
@@ -911,10 +1686,14 @@ export async function startWorker(
 			neverStartedExits: backends.neverStartedExits,
 			prepareWorkspace: makePrepareWorkspace({
 				jobsDir: config.jobsDir,
+				// Issue #464: the boot's own check, asked again before every job against the same env.
+				ensureDir: (dir) => ensureJobsDirFn(dir, { env }),
 				forgeFor,
 				// REQ-RESURRECTABLE-SANDBOX: the deployment default, resolved per job against run.image so a
 				// retained directory records the image that actually ran and a sandbox re-opens that one.
 				jobImage: config.jobImage,
+				// #277: the venue a retained directory records, which the sandbox refuses by when it is not here.
+				defaultBackend: config.defaultBackend,
 				preparers: makeForgePreparers({ gitlabApiUrl: config.gitlab?.apiUrl ?? null, forgejoApiUrl: config.forgejo?.apiUrl ?? null, azureOrgUrl: config.azure?.orgUrl ?? null }),
 				// The cron event.json's previousRunAt (INT-CONTAINER-JOB-INPUTS): read back from the same
 				// per-job run-history sidecars recordRun writes above -- no new store, no new query surface.
@@ -927,24 +1706,7 @@ export async function startWorker(
 			// REQ-RESURRECTABLE-SANDBOX. With the window at 0 this IS the old bare `cleanup`, by the same
 			// `rm` on the same path -- a deployment that wants no retention keeps today's behaviour exactly.
 			cleanup: makeCleanup({ sandboxDir: config.sandboxDir, retentionHours: config.sandboxRetentionHours, log }),
-			comment: async (job, text) => {
-				// Best-effort: the processor awaits comment() inside its try, so a rejection here would
-				// corrupt the job outcome and could drive a wrong retry / second PR (CONST-RETRY-INFRA-ONLY).
-				// This adapter NEVER throws.
-				const forge = forgeFor(job);
-				if (forge?.auth) {
-					try {
-						const token = await forge.auth.mintToken(job);
-						await forge.host.postStatusComment(job, job.target, text, token);
-					} catch (err) {
-						log("comment_failed", { jobId: job?.id, reason: err?.message });
-					}
-					return;
-				}
-				// A local job, or a forge-backed one whose auth never came up. Either way there is nowhere to
-				// post, so the line on stdout IS the completion signal (REQ-LOCAL-JOB-VISIBILITY).
-				log("comment", { jobId: job?.id, text });
-			},
+			comment,
 			log,
 			// Resolved per job so the credential always comes from the job's OWN forge. A job whose forge has
 			// no working auth refuses here, at mint time, rather than running anonymously -- and the refusal
@@ -956,7 +1718,22 @@ export async function startWorker(
 			// token comes from must always be something the trigger said.
 			mintToken: async (job) => {
 				const kind = job?.kind === "local" ? "github" : job?.kind;
-				const auth = forges[kind]?.auth;
+				// `ensureAuth` returns the boot-time auth when there is one, and otherwise re-resolves once
+				// if boot's failure was transient (issue #316). It throws the transient failure through, and
+				// that throw is UNTAGGED, so the arm below turns it into the retryable class rather than
+				// letting it reach the processor's config classifier: "the forge was unreachable a moment
+				// ago" is not "this deployment is misconfigured", and only one of those deserves a public
+				// comment saying so.
+				let auth;
+				try {
+					auth = await ensureAuth(kind);
+				} catch (err) {
+					// A determinate re-resolve failure carries the REAL reason (bad credentials, a key that
+					// is not PKCS//8), which is strictly better than the generic message below, so it is
+					// passed straight through rather than collapsed into it.
+					if (err?.piDispatchConfig === true) throw err;
+					throw new InfraRetry(`${kind} auth could not be resolved: ${err?.message ?? "unknown"}`);
+				}
 				if (auth) return await auth.mintToken(job);
 				if (kind === "github") {
 					throw configError("github jobs and cron triggers with run.github require a working GITHUB_AUTH_SOURCE (gh/pat/app)");
@@ -971,105 +1748,350 @@ export async function startWorker(
 		},
 	});
 
-	// REQ-LOCAL-JOB-VISIBILITY: exactly one terminal line per job, carrying the job id and outcome,
-	// where the operator is already looking. This is the local counterpart of the GitHub issue
-	// comment and the signal for CONST-PI-VERSION-PINNED's silent-no-op mode -- a missing line is
-	// what tells a human a run did nothing. The container's own output already streams via
-	// runContainer's onOutput during the run.
-	// `reason` is a fixed enum (worker-abort | over-budget | unprotected-branch | runner-policy |
-	// job-image-missing), never
-	// user content. Included only when present so success lines stay clean; a shutdown-aborted job logs
-	// { outcome: "policy", reason: "worker-abort" }, making a restart-dropped job visible.
-	// BOTH workers, or a cron job on the host queue produces no `job_completed` line at all -- and
-	// REQ-LOCAL-JOB-VISIBILITY's whole point is that a missing line is what tells a human a run did nothing.
-	const allWorkers = [worker, ...(worker.hostWorker ? [worker.hostWorker] : [])];
-	for (const w of allWorkers) w.on("completed", (job, result) =>
-		log("job_completed", { jobId: job?.id, outcome: result?.outcome, ...(result?.reason ? { reason: result.reason } : {}) }),
-	);
-	for (const w of allWorkers) w.on("failed", (job, err) =>
-		log("job_failed", { jobId: job?.id, attempt: job?.attemptsMade, reason: String(err?.message ?? err).slice(0, 120) }),
-	);
-
-	// CONST-RETRY-INFRA-ONLY money backstop: BullMQ's maxStalledCount does not bound scheduler jobs, so a
-	// wedged scheduled run is re-paid on every stall. The guard counts stalls per scheduler and tears the
-	// scheduler down past the threshold. Keyed on "stalled", not "failed" -- only a stall is the unbounded re-run.
-	const onStalled = makeStallGuard({
-		redis,
-		threshold: config.schedulerStallMax,
-		// The queue the schedulers were actually INSTALLED on. Torn down from `runtimeQueue` on a named
-		// host, this money backstop -- a wedged scheduled run is re-paid on every stall -- silently no-ops.
-		removeJobScheduler: (id) => cronQueue.removeJobScheduler(id),
-		log,
-	});
-	// `makeStallGuard` returns the LISTENER, not an object holding one -- hence the name of the local. It was
-	// called as `guard.onStalled(jobId)` here for the whole life of the feature, which is `undefined(jobId)`,
-	// so every stall threw a TypeError and the money backstop never counted one (issue #267).
-	for (const w of allWorkers) w.on("stalled", (jobId) => void onStalled(jobId));
-
-	// DES-CRON-VIA-BULLMQ-SCHEDULER: install the schedule set (and prune orphans) before announcing the
-	// worker is up, so schedules_installed always precedes worker_started. An empty set skips the reconcile
-	// queue entirely -- no getJobSchedulers Redis hit -- but still logs {0,0} so the operator sees cron is off.
-	// What this host will NOT be running, said once at boot and per trigger. A folder that belongs to
-	// another machine is ordinary on a fleet; a folder that belongs to NO machine is a trigger that will
-	// silently never fire, which is the silent no-op this project refuses -- and which `doctor` is the
-	// right place to catch, because it can ask the registry and this cannot.
-	const { served, unserved } = servedSchedules(schedules.current);
-	for (const s of unserved) log("schedule_unserved", { schedulerId: s.schedulerId, reason: s.unserved });
-
-	if (served.length > 0) {
-		// Onto the HOST queue when one is armed. That makes Gap 1 structural rather than merely gated: a
-		// host queue's resident schedulers are only ever that host's, so `reconcile`'s "resident minus my
-		// config" is correct again by construction and two hosts can no longer prune each other at all. The
-		// fingerprint gate stays, because it still catches the divergence itself -- including a timezone
-		// disagreement, which no queue split can detect.
-		const rq = makeQueue(parseConnection(config.valkeyUrl, { failFast: true }), { ...(hostQueue ? { name: hostQueue } : {}) });
-		try {
-			const r = await reconcileGated(rq, served, { registry, log, tz: hostTz, authored: authoredCron(config) });
-			log("schedules_installed", { installed: r.installed, removed: r.removed, ...(unserved.length > 0 && { unserved: unserved.length }) });
-		} finally {
-			await rq.close().catch(() => {});
+	// FROM HERE TO THE RETURN, THE WORKER IS LIVE AND THE BOOT CAN STILL REFUSE (issue #299). The
+	// Worker starts consuming at construction, so everything below runs beside a paid drain --
+	// registrations, the stall guard, the boot reconcile (the reachable refusal, reproduced), the
+	// watcher pushes, the retention sweep's construction and start. A refusal that merely threw left
+	// the process printing an error while taking jobs, because `cli.mjs` sets `process.exitCode` and
+	// the live Worker held the loop forever. The catch below covers the REGION, not a list of calls,
+	// so a step added tomorrow is covered the day it is added.
+	try {
+
+		// REQ-LOCAL-JOB-VISIBILITY: exactly one terminal line per job, carrying the job id and outcome,
+		// where the operator is already looking. This is the local counterpart of the GitHub issue
+		// comment and the signal for CONST-PI-VERSION-PINNED's silent-no-op mode -- a missing line is
+		// what tells a human a run did nothing. The container's own output already streams via
+		// runContainer's onOutput during the run.
+		// `reason` is a fixed enum (worker-abort | over-budget | unprotected-branch | runner-policy |
+		// provider-auth-refused | job-image-missing), never
+		// user content. Included only when present so success lines stay clean; a shutdown-aborted job logs
+		// { outcome: "policy", reason: "worker-abort" }, making a restart-dropped job visible.
+		// BOTH workers, or a cron job on the host queue produces no `job_completed` line at all -- and
+		// REQ-LOCAL-JOB-VISIBILITY's whole point is that a missing line is what tells a human a run did nothing.
+		const allWorkers = [worker, ...(worker.hostWorker ? [worker.hostWorker] : [])];
+		for (const w of allWorkers) w.on("completed", (job, result) => {
+			log("job_completed", { jobId: job?.id, outcome: result?.outcome, ...(result?.reason ? { reason: result.reason } : {}) });
+			// The hook's POLICY half (issue #288): worker-abort, runner-policy and provider-auth-refused RETURN, so they land here
+			// and never in the failed listener -- a failed-only mount would miss exactly the paid terminals
+			// the feature exists for. Folded into the existing listener body, never a second w.on: the
+			// start-wiring harness records ONE handler per event, and two would race the log line's pin.
+			if (onFailure && result?.outcome === "policy" && HOOK_POLICY_REASONS.has(result.reason)) {
+				onFailure({ jobId: job?.id, outcome: "policy", reason: result.reason });
+			}
+		});
+		for (const w of allWorkers) w.on("failed", (job, err) => {
+			log("job_failed", { jobId: job?.id, attempt: job?.attemptsMade, reason: String(err?.message ?? err).slice(0, 120) });
+			// The one reason whose sentence is the fix itself (issue #458): logged WHOLE, beside the cut line above.
+			if (err?.reason === NETNS_KEEPER_NOT_HOLDING || err?.reason === NETNS_KEEPER_CRASH_LOOP) log("job_failed_netns_keeper", { jobId: job?.id, attempt: job?.attemptsMade, reason: String(err?.message ?? "") });
+			// The TERMINAL failed attempt only (issue #288): `finishedOn` is set by BullMQ's own move on the
+			// non-retry branch alone, and the emit follows it, so this guard reads the queue's decision
+			// instead of re-deriving attempts arithmetic that could drift from shouldRetry. A retried
+			// attempt comments nothing (a flaky daemon must not post three comments for one recovery) and
+			// pages nobody; a recovery comments nothing at all. This seam also catches what the processor
+			// never sees: the stall-kill (maxStalledCount 0 fails a crashed worker's job at next pickup)
+			// and the wait-gate rethrow that escapes above the processor's catch.
+			if (job?.finishedOn) {
+				void comment({ ...job.data, id: job.id }, (typeof err?.reason === "string" && Object.hasOwn(FAILED_COMMENT_BY_REASON, err.reason) ? FAILED_COMMENT_BY_REASON[err.reason] : null) ?? FAILED_COMMENT);
+				onFailure?.({ jobId: job?.id, outcome: "failed", reason: typeof err?.reason === "string" ? err.reason : "infra" });
+			}
+		});
+
+		// CONST-RETRY-INFRA-ONLY money backstop: BullMQ's maxStalledCount does not bound scheduler jobs, so a
+		// wedged scheduled run is re-paid on every stall. The guard counts stalls per scheduler and tears the
+		// scheduler down past the threshold. Keyed on "stalled", not "failed" -- only a stall is the unbounded re-run.
+		const onStalled = makeStallGuard({
+			redis,
+			threshold: config.schedulerStallMax,
+			// The queue the schedulers were actually INSTALLED on. Torn down from `runtimeQueue` on a named
+			// host, this money backstop -- a wedged scheduled run is re-paid on every stall -- silently no-ops.
+			removeJobScheduler: (id) => cronQueue.removeJobScheduler(id),
+			log,
+		});
+		// `makeStallGuard` returns the LISTENER, not an object holding one -- hence the name of the local. It was
+		// called as `guard.onStalled(jobId)` here for the whole life of the feature, which is `undefined(jobId)`,
+		// so every stall threw a TypeError and the money backstop never counted one (issue #267).
+		for (const w of allWorkers) w.on("stalled", (jobId) => void onStalled(jobId));
+
+		// DES-CRON-VIA-BULLMQ-SCHEDULER: install the schedule set (and prune orphans) before announcing the
+		// worker is up, so schedules_installed always precedes worker_started. An empty set skips the reconcile
+		// queue entirely -- no getJobSchedulers Redis hit -- but still logs {0,0} so the operator sees cron is off.
+		// What this host will NOT be running, said once at boot and per trigger. A folder that belongs to
+		// another machine is ordinary on a fleet; a folder that belongs to NO machine is a trigger that will
+		// silently never fire, which is the silent no-op this project refuses -- and which `doctor` is the
+		// right place to catch, because it can ask the registry and this cannot.
+		const { served, unserved } = servedSchedules(schedules.current);
+		for (const s of unserved) log("schedule_unserved", { schedulerId: s.schedulerId, reason: s.unserved });
+
+		if (served.length > 0) {
+			// Onto the HOST queue when one is armed. That makes Gap 1 structural rather than merely gated: a
+			// host queue's resident schedulers are only ever that host's, so `reconcile`'s "resident minus my
+			// config" is correct again by construction and two hosts can no longer prune each other at all. The
+			// fingerprint gate stays, because it still catches the divergence itself -- including a timezone
+			// disagreement, which no queue split can detect.
+			const rq = makeQueue(valkeyConn({ failFast: true }), { ...(hostQueue ? { name: hostQueue } : {}) });
+			try {
+				const r = await reconcileGated(rq, served, { registry, log, tz: hostTz, authored: authoredCron(config) });
+				log("schedules_installed", { installed: r.installed, removed: r.removed, ...(unserved.length > 0 && { unserved: unserved.length }) });
+			} finally {
+				await rq.close().catch(() => {});
+			}
+		} else {
+			log("schedules_installed", { installed: 0, removed: 0, ...(unserved.length > 0 && { unserved: unserved.length }) });
 		}
-	} else {
-		log("schedules_installed", { installed: 0, removed: 0, ...(unserved.length > 0 && { unserved: unserved.length }) });
-	}
 
-	// DES-CRON-VIA-BULLMQ-SCHEDULER live edit (OQ-008): watch the triggers file and re-reconcile schedulers
-	// on change, so an operator's add/edit/delete of a cron trigger takes effect without a worker restart.
-	// Only when a triggers file is configured; best-effort; a bad edit keeps the running schedulers. The
-	// closer each of the three returns joins `extraClosers`, so the watch stops with the worker (issue #295).
-	if (config.triggersFile) {
-		extraClosers.push(watchTriggersFile(config, cronQueue, log, schedules, registry, hostTz, config.workerNameDeclared));
-	}
+		// DES-CRON-VIA-BULLMQ-SCHEDULER live edit (OQ-008): watch the triggers file and re-reconcile schedulers
+		// on change, so an operator's add/edit/delete of a cron trigger takes effect without a worker restart.
+		// Only when a triggers file is configured; best-effort; a bad edit keeps the running schedulers. The
+		// closer each of the three returns joins `extraClosers`, so the watch stops with the worker (issue #295).
+		if (config.triggersFile) {
+			extraClosers.push(watchTriggersFile(config, cronQueue, log, schedules, registry, hostTz, config.workerNameDeclared, atBoot.triggers));
+		}
 
-	// REQ-SCOPED-PAUSE-WINDOWS live edit: watch the pause-windows file and hot-swap the in-memory windows, so
-	// an operator's add/delete of a pause window takes effect without a worker restart. A bad edit is kept out.
-	if (config.pauseWindowsFile) {
-		extraClosers.push(watchPauseWindowsFile(config, pauseWindows, log));
-	}
+		// REQ-SCOPED-PAUSE-WINDOWS live edit: watch the pause-windows file and hot-swap the in-memory windows, so
+		// an operator's add/delete of a pause window takes effect without a worker restart. A bad edit is kept out.
+		if (config.pauseWindowsFile) {
+			extraClosers.push(watchPauseWindowsFile(config, pauseWindows, log, atBoot.pauseWindows));
+		}
+
+		// Issue #242 live edit: hot-swap the scoped limits on file change, keeping last-good on a bad edit.
+		if (config.scopedLimitsFile) {
+			extraClosers.push(watchScopedLimitsFile(config, scopedLimits, log, atBoot.scopedLimits));
+		}
+
+		// issue #292 / OQ-007: re-run the three retention sweeps on a timer, because the supported deployment
+		// is a service that restarts only on failure, so the healthy worker was the one that never re-swept.
+		// Armed HERE, at the end of boot beside the watches: all three closures exist, boot's own sweeps have
+		// long finished, and the first tick lands one full interval later rather than during the schedules
+		// reconcile, which is Redis-destructive work a small test interval would otherwise land inside.
+		//
+		// NOT CONSTRUCTED AT ALL when the knob is 0. That is how "0 is byte-identical to before" is a fact
+		// rather than a claim: with no object there is no timer, no closer and no reachable second call to any
+		// reaper. It is registered in `extraClosers` for issue #295's finding that UNREF'D IS NOT CLEANED UP --
+		// this handle holds an `rmSync`, and a tick landing mid-drain could delete a retained workspace behind a
+		// worker that already reported a clean shutdown.
+		if (config.sweepIntervalHours > 0) {
+			const sweep = makeRetentionSweepFn({
+				reapers: [
+					{ name: "log", reap: reapLogs },
+					{ name: "sandbox", reap: reapSandboxes },
+					{ name: "session", reap: () => sessionStore.reapSessions() },
+				],
+				intervalMs: config.sweepIntervalHours * 3600000,
+				log,
+			});
+			sweep.start();
+			extraClosers.push(sweep);
+		}
 
-	// Issue #242 live edit: hot-swap the scoped limits on file change, keeping last-good on a bad edit.
-	if (config.scopedLimitsFile) {
-		extraClosers.push(watchScopedLimitsFile(config, scopedLimits, log));
+		log("worker_started", {
+			queue: "pi-jobs",
+			// Issue #278: the service's OWN answer to which daemon its jobs go to. `doctor` reads its caller's
+			// shell, and a service's EnvironmentFile or a systemd User= can resolve differently.
+			// Issue #354: all five null with `local` unblessed, where this host's docker CLI was not asked.
+			dockerContext: bootEndpoint ? bootEndpoint.context : null,
+			dockerEndpointLocal: bootEndpoint ? bootEndpoint.local : null,
+			jobUser: bootDecision ? { mode: bootDecision.mode, user: bootDecision.user, cause: bootDecision.cause } : null, // issue #341
+			// Issue #345: whether this daemon is observed applying a container's bounds and adding no mounts of its own; null = not read.
+			daemonAppliesBounds: bootObserved ? bootObserved.observations.daemonAppliesBounds : null,
+			runtimeAddsNoMounts: bootObserved ? bootObserved.observations.runtimeAddsNoMounts : null,
+			// Issue #354: the podman venue's own boot answers, all null with `podman` unblessed (no `podman info` was asked):
+			// the version it reported, whether it is rootless and whose uid its jobs run as, and its three observations.
+			podmanVersion: bootPodmanRead?.answered ? bootPodmanRead.info.version : null,
+			podmanRootless: bootPodmanRead?.answered ? bootPodmanRead.info.rootless : null,
+			podmanJobUser: bootPodmanDecision ? { mode: bootPodmanDecision.mode, user: bootPodmanDecision.user, cause: bootPodmanDecision.cause, reason: bootPodmanDecision.reason } : null,
+			podmanBoundsDelegated: bootPodmanObserved ? bootPodmanObserved.observations[PODMAN_BOUNDS_DELEGATED] : null,
+			podmanAddsNoMounts: bootPodmanObserved ? bootPodmanObserved.observations[PODMAN_ADDS_NO_MOUNTS] : null,
+			podmanServiceLocal: bootPodmanObserved ? bootPodmanObserved.observations[PODMAN_SERVICE_LOCAL] : null,
+			host: config.workerName, // issue #57; `log` stamps it on every line, and the boot line names it where an operator looks first
+			imageDigest: bootImage.imageDigest ?? null, // two hosts on two builds of one tag used to emit byte-identical boot lines
+			concurrency: bootConcurrency, // the slot count the Worker is actually constructed with (overlay may raise/lower it)
+			sweepIntervalHours: config.sweepIntervalHours, // 0 = boot-only sweeps, this version's pre-#292 behaviour
+			dailyCap: config.dailyCap,
+			weeklyCap: config.weeklyCap, // null when the weekly window is disabled
+			monthlyCap: config.monthlyCap, // null when the monthly window is disabled
+			softHoldPct: config.softHoldPct, // null when the soft-hold band is disabled
+			scopedLimitsFile: config.scopedLimitsFile, // null = no scoped caps/concurrency (the folder mutex holds regardless)
+			scopedLimits: scopedLimits.current.length, // row count -- money config deserves boot visibility; the watcher logs only changes
+			image: config.jobImage,
+			valkey: config.valkeyUrl,
+			// Issue #464: the literal address every Valkey client of this worker dials, beside the URL as written; null
+			// where nothing was pinned (another machine's Valkey, dialled by name).
+			valkeyPinned: valkey.pinned ? `${valkey.pinned.address.includes(":") ? `[${valkey.pinned.address}]` : valkey.pinned.address}:${valkey.pinned.port}` : null,
+			logsDir: config.logsDir,
+			settingsFile: config.settingsFile,
+			captureJobLogs: config.captureJobLogs,
+			logRetentionDays: config.logRetentionDays,
+			sandboxRetentionHours: config.sandboxRetentionHours, // 0 = retention off; a run's directory is deleted as before
+		});
+		return worker;
+	} catch (err) {
+		// STOP WHAT WAS BUILT, THEN RETHROW, and both halves carry weight. The stop is the shutdown
+		// minus the exit -- the cancel, the close, the closer drain, the client release -- so nothing is
+		// left holding the loop and the process drains to the refusal's OWN exit code: entryExitCode
+		// turns a tagged configError into EXIT_POLICY 2 and infra into the retryable 1, and a swallow
+		// here would hand a supervisor a clean 0 for a boot that refused. `Promise.resolve`, not an
+		// optional-chained `.catch`: a test double whose recording `stop` is synchronous would otherwise
+		// raise a TypeError OVER the boot's real error, and the exit-code assertion meant to go red
+		// under mutation would go green for the wrong reason. A synchronous throw from `stop` itself
+		// still escapes, exactly as the closer loop documents for `extraClosers` -- a known bound.
+		await Promise.resolve(worker?.stop?.()).catch(() => {});
+		throw err;
 	}
+}
 
-	log("worker_started", {
-		queue: "pi-jobs",
-		host: config.workerName, // issue #57; `log` stamps it on every line, and the boot line names it where an operator looks first
-		imageDigest: bootImage.imageDigest ?? null, // two hosts on two builds of one tag used to emit byte-identical boot lines
-		concurrency: bootConcurrency, // the slot count the Worker is actually constructed with (overlay may raise/lower it)
-		dailyCap: config.dailyCap,
-		weeklyCap: config.weeklyCap, // null when the weekly window is disabled
-		monthlyCap: config.monthlyCap, // null when the monthly window is disabled
-		softHoldPct: config.softHoldPct, // null when the soft-hold band is disabled
-		scopedLimitsFile: config.scopedLimitsFile, // null = no scoped caps/concurrency (the folder mutex holds regardless)
-		scopedLimits: scopedLimits.current.length, // row count -- money config deserves boot visibility; the watcher logs only changes
-		image: config.jobImage,
-		valkey: config.valkeyUrl,
-		logsDir: config.logsDir,
-		settingsFile: config.settingsFile,
-		captureJobLogs: config.captureJobLogs,
-		logRetentionDays: config.logRetentionDays,
-		sandboxRetentionHours: config.sandboxRetentionHours, // 0 = retention off; a run's directory is deleted as before
+/**
+ * The boot refusal text for a job-user decision, or `null` to boot. Exported so its default-venue branch is pinned on the
+ * predicate as well as end to end (a podman default reaches it since issue #354 part 2, and must not refuse on local's causes).
+ */
+export function jobUserBootRefusal(decision, defaultBackend) {
+	if (decision?.mode !== "unmappable" || !BOOT_REFUSING_JOB_USER_CAUSES.has(decision.cause)) return null;
+	return defaultBackend === DEFAULT_BACKEND ? jobUserRefusal(decision) : null;
+}
+
+/**
+ * The boot refusal text for a podman job-user decision, or `null` to boot (issue #354): an identity cause no podman job
+ * can get past (`PODMAN_BOOT_REFUSING_CAUSES`), and only while `podman` is the DEFAULT venue, `jobUserBootRefusal`'s rule.
+ * Kept apart from that function rather than merged into it, because the two venues' causes share a name
+ * (`worker-is-root`) and not a remedy, and each venue's text comes from its own map.
+ */
+export function podmanBootRefusal(decision, defaultBackend) {
+	if (defaultBackend !== PODMAN_BACKEND) return null;
+	if (decision?.mode !== "unmappable" || !PODMAN_BOOT_REFUSING_CAUSES.has(decision.cause)) return null;
+	return podmanJobUserRefusal(decision);
+}
+
+/**
+ * The boot refusal for a rootful Podman containers.conf that reaches a local job (issue #448), from `observeRootfulConf`'s
+ * answer, or `null`: only while `local` is the default venue, and not when the local job user is already refused (that
+ * refusal, earlier at boot or per job, is the one to fix first). `transient` (thrown untagged, exit 1, so the supervisor
+ * restarts it) is a read that failed for a moment AND, since gate round 1 of PR #473, a service older than its
+ * containers.conf or a change time ahead of the clock: each heals by itself, so none may strand a unit with
+ * `RestartPreventExitStatus=2`. Exported for the doc test, as `podmanConfBootRefusal` is.
+ */
+export function localConfBootRefusal(decision, defaultBackend, rootful) {
+	if (defaultBackend !== DEFAULT_BACKEND || !rootful?.refusal || decision?.mode === "unmappable") return null;
+	return { message: rootfulConfRefusal(rootful.refusal), transient: rootfulConfRetries(rootful.refusal) };
+}
+
+/**
+ * A rootful finding as the processor's `podmanConfRefused` (issue #448): the podman venue's shape, marked `rootful`.
+ * `retry` marks what the processor throws for the queue's retry rather than returns (a moment's read failure, a service
+ * older than its containers.conf, a clock behind a change time), with the evidence its retry message names.
+ */
+function rootfulRefused(found) {
+	return {
+		reason: found.cause,
+		key: found.key ?? null,
+		message: rootfulConfRefusal(found),
+		rootful: true,
+		...(found.restart ? { restart: true } : {}),
+		...(found.skew ? { skew: true } : {}),
+		...(found.transient ? { transient: true } : {}),
+		...(rootfulConfRetries(found) ? { retry: true, evidence: found.evidence } : {}),
+	};
+}
+
+/**
+ * The boot refusal for a widening containers.conf on the podman venue (issue #428), as `{ message, transient }`, or
+ * `null` to boot: only while `podman` is the DEFAULT venue, `podmanBootRefusal`'s rule, and not when the identity is
+ * already refused (that refusal names the fix that comes first, and with `podman` merely blessed its jobs are refused
+ * one by one anyway). `transient` is a read that failed for a moment, which the caller throws untagged.
+ */
+export function podmanConfBootRefusal(decision, defaultBackend, files) {
+	if (defaultBackend !== PODMAN_BACKEND || !decision || decision.mode === "unmappable") return null;
+	const widened = podmanConfWidening(files);
+	return widened ? { message: podmanConfRefusal(widened), transient: widened.transient === true } : null;
+}
+
+/** What makes two job-user decisions the same for the `job_user` log line. */
+function jobUserLogKey(decision) {
+	return `${decision?.mode}|${decision?.user ?? ""}|${decision?.cause ?? ""}|${decision?.reason ?? ""}`;
+}
+
+/** A one-line summary of an endpoint answer, used only to notice that it changed. */
+function dockerEndpointState(endpoint) {
+	return `${endpoint.local}|${endpoint.context ?? ""}|${endpoint.endpoint ?? ""}|${endpoint.reason ?? ""}`;
+}
+
+/**
+ * What an endpoint answer shows, for a refusal message. The context name is operator config; the endpoint is
+ * the display form, which is the value reduced to `scheme://host` or withheld, never edited (`displayEndpoint`).
+ */
+function dockerEndpointEvidence(endpoint) {
+	if (endpoint.local === null) return `the docker CLI did not say which endpoint it resolves (${endpoint.reason})`;
+	return `the docker CLI resolves context ${quotedShown(endpoint.context)} to ${endpointShown(endpoint)}${endpoint.local ? ", on this host" : ", which is not shown to be on this host"}`;
+}
+
+/** Log an endpoint answer that is not plainly local; a return to local is logged only as a change. */
+function logDockerEndpoint(log, endpoint, { changed = false } = {}) {
+	if (endpoint.local === false) log("docker_endpoint_not_local", { context: endpoint.context, endpoint: endpoint.endpoint });
+	else if (endpoint.local === null) log("docker_endpoint_unresolved", { reason: endpoint.reason });
+	else if (changed) log("docker_endpoint_local", { context: endpoint.context, endpoint: endpoint.endpoint });
+}
+
+/**
+ * Where the worker's clients stand (issue #464): enforced exactly as its boot judgement was (`valkey.enforce`), so a
+ * reconnect is judged by the rule the boot applied, never a looser one; PI_VALKEY_SHARED from the deployment `.env`.
+ */
+export function workerValkeyContext(valkey, env, { cwd = process.cwd(), readEnv } = {}) {
+	return valkeyClientContext({ env, cwd, rootRefused: valkey?.rootRefused === true, ...(readEnv ? { readEnv } : {}) });
+}
+
+/**
+ * The worker's real Valkey judgement (issue #464, gate round 2): `resolveWorkerValkey` with this host's facts. The
+ * deployment `.env` is the one in the working directory (the unit's WorkingDirectory is the deployment folder), read
+ * only for PI_VALKEY_SHARED; nothing else of it is loaded into this process.
+ */
+async function defaultJudgeValkey({ url, venues, env }) {
+	const envPath = join(process.cwd(), ".env");
+	let envText = null;
+	try {
+		// Bytes (gate round 3): the hardened reader checks what systemd refuses to load before it decodes.
+		envText = readFileSync(envPath);
+	} catch (err) {
+		// No .env here: nothing opts in. Any other failure is said, never read as "no opt-in" (gate round 3).
+		if (err?.code !== "ENOENT") throw configError(`${envPath} could not be read (${err?.code ?? err?.message}), and the worker reads PI_VALKEY_SHARED from it, so it does not start`);
+	}
+	const fs = { readFileSync };
+	const euid = process.geteuid?.();
+	let user = null;
+	try {
+		user = userInfo().username;
+	} catch {
+		// A uid with no passwd entry: its subordinate ranges are read by uid.
+	}
+	const valkey = await resolveWorkerValkey({
+		url,
+		venues,
+		platform: process.platform,
+		env,
+		envText,
+		envPath,
+		probeTcp: probeTcpAddress,
+		lookup: (host, opts) => dnsLookup(host, opts),
+		fs,
+		euid,
+		user,
+		ownerName: (uid) => passwdNameFrom(fs, uid),
+		interfaces: networkInterfaces,
+		subuids: readSubuidRanges({ user, euid, fs }),
+		configError,
 	});
-	return worker;
+	await refuseValkeyAuth(valkey, env);
+	return valkey;
+}
+
+/**
+ * Issue #468: the worker's credential asked once at boot, on the judged address, before anything is built on it. A
+ * Valkey that requires a password this worker does not send (NOAUTH), or refuses the one it sends (WRONGPASS), is a
+ * configError (exit 2, not restarted into the same answer), naming VALKEY_PASSWORD and never its value: left to the
+ * clients, it was an endless stream of NOAUTH errors from a worker that looked alive. Nothing answering is left to the
+ * clients' own retries, as before. Exported for its test; `authState` is the seam.
+ */
+export async function refuseValkeyAuth(valkey, env, { cwd = process.cwd(), authState = valkeyAuthState } = {}) {
+	const context = workerValkeyContext(valkey, env, { cwd });
+	const { state, error } = await authState(valkey.url, { context, servername: valkey.servername ?? null });
+	// Gate round 2 of PR #478: a database the server does not have (`/16` on a default Valkey) is a refusal, exit 2.
+	if (state === "dbrange") throw configError(error);
+	if (state === "noauth" || state === "wrongpass") throw configError(authRefusalFor(state, valkey.url, context));
 }