@edgehero/pi-dispatch 4.3.0 → 5.0.0

package/src/doctor.mjs

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 /**
  * `pi-dispatch doctor` — preflight the host before the first job. Prints a ✓/⚠/✗ line per prerequisite
  * with a one-line fix, and exits non-zero if any hard check fails, so it is usable in a setup script.
@@ -52,30 +53,33 @@
 import { accessSync, chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, readSync, realpathSync, rmSync, statSync } from "node:fs";
 import { lookup as dnsLookup } from "node:dns/promises";
 import { homedir, networkInterfaces, release as osRelease, tmpdir, userInfo } from "node:os";
+import { BlockList, isIPv4, isIPv6 } from "node:net";
+import * as nodeFs from "node:fs";
 import { NETNS_KEEPER, NETNS_KEEPER_FORMAT, NETNS_KEEPER_START, STACK_KEYS, STARTED_AT_FORMAT, VALKEY_SHARED_KEY, judgeNetnsKeeper, judgeValkeyListeners, netnsKeeperRemedy, pinnedValkeyUrl, podmanNeedsNetnsKeeper, probeTcpAddress, proxyConfCopyPath, readSubuidRanges, proxyRestartAdvice, readLinger, readValkeyKeys, valkeySharedOn, valkeyTarget } from "./podman-stack.mjs";
-import { basename, dirname, isAbsolute, join, delimiter, posix, resolve, win32 } from "node:path";
+import { basename, dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn as nodeSpawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { DEFAULT_MODEL, DEFAULT_PROVIDER, DEFAULT_VALKEY_URL, accountTempRoot, allowedModelsFrom, defaultLogsDir, defaultSandboxDir, defaultSettingsFile, defaultWorkerName, globalExtensionsEnabled, jobsDirOwnerFix, jobsDirPath, sandboxDirOwnerFix, legacyTempStateDir, logsDirPath, modelEndpointsFilePath, delimitedList, envelopeFilePath, pauseWindowsFilePath, projectsFilePath, safeHomeDir, scopedLimitsFilePath, settingsFilePath, underOsTempDir } from "./config.mjs";
+import { DEFAULT_MODEL, DEFAULT_PROVIDER, DEFAULT_VALKEY_URL, accountTempRoot, checkpointStoreCollision, checkpointsDirPath, allowedModelsFrom, modelFrom, providerFrom, defaultLogsDir, defaultSandboxDir, defaultSettingsFile, defaultWorkerName, globalExtensionsEnabled, jobsDirOwnerFix, jobsDirPath, sandboxDirOwnerFix, legacyTempStateDir, logsDirPath, modelEndpointsFilePath, delimitedList, envelopeFilePath, pauseWindowsFilePath, projectsFilePath, safeHomeDir, scopedLimitsFilePath, settingsFilePath, underOsTempDir, workerName as workerNameFrom } from "./config.mjs";
 import { SYSTEMD_HAZARD_SHAPES, decodeEnvFile, envFileHazard, envValueShown, quotedRegions, readEnvAssignments, renderEnvValue, envFileWrapperInternal, wrapperInternalSentence } from "./env-file.mjs";
 import { canonicalScope, danglingProjectRows, dollarRowsBelowJobCap, dollarRowsWithoutCap, isModelScope, isProjectScope, loadScopedLimits, parseScopedLimits, scopedLimitsVersionFor } from "./scoped-limits.mjs";
-import { EMPTY_PROJECTS_FINGERPRINT, loadProjects, projectsFingerprint } from "./projects.mjs";
+import { EMPTY_PROJECTS_FINGERPRINT, escapeControls, loadProjects, projectOf, projectsFingerprint } from "./projects.mjs";
 import { parseModelsJson, stripBom, stripJsonComments } from "./models-json.mjs";
-import { isTransientOverlayRead, overlayProviderProblem } from "./model-catalog.mjs";
+import { FIRST_CALL_MIN_CONTEXT_BYTES, FIRST_CALL_OVERHEAD_TOKENS, boundModelOf, firstCallFloorMicros, isTransientOverlayRead, overlayProviderProblem, serviceTierMultiplier } from "./model-catalog.mjs";
 import { EMPTY_USD_FINGERPRINT, usdFingerprint } from "./dollar-fingerprint.mjs";
 import { splitModelEntry } from "./model-ref.mjs";
+import { resolveConfiguredModelRuns as resolveDoctorModelRuns, cooldownModelRefs, RADIUS_COST_CAP_LABEL, RADIUS_COST_CAP_FIX } from "./model-observation.mjs";
 import { ignoredOutputCapModels, outputCapView, outputUnboundable } from "./output-cap.mjs";
 import { KEYLESS_API_KEY, KEYLESS_HOW, MODEL_ENDPOINTS_FILE_NAME, MODEL_ENDPOINTS_INCLUDE_NAME, MODEL_ENDPOINT_ID_RE, OVERLAY_LINK_FIX, OVERLAY_NOT_A_FILE_FIX, RENAMED_PROVIDERS, baseUrlTarget, endpointsAt, keylessVerdict, loadModelEndpoints, providerRenameHint, readOverlayModels, renderEndpointsInclude, unreportedUsageModels } from "./model-endpoints.mjs";
 import { declaredEndpointsIn, endpointsDeclaredIn, reloadCommand, rulesFileIncludes, rulesPredateEndpointsLine } from "./egress-cli.mjs";
-import { loadPauseWindows, parseScopeString } from "./pause-windows.mjs";
+import { loadPauseWindows, parsePauseWindows, parseScopeString, pauseWindowsVersionFor } from "./pause-windows.mjs";
 import { WAIT_AFTER_MAX_DEFAULT_MS, afterInstantMs, parseWaitProfiles } from "./wait-for.mjs";
 import { isForgeKind } from "./forges.mjs";
 import { findLiteralSecret, ADMIN_RE } from "./import-pi.mjs";
 import { mcpServerWhere, readOverlayMcp } from "./mcp-config.mjs";
 import { allowlistEntryFor, egressRefusalFor, packageRunnerHosts, parseAllowlist } from "./egress-allowlist.mjs";
 import { agentDirFrom, readHostPi } from "./host-pi.mjs";
-import { PACKAGES_SUBDIR, readStagedSkills, readStageManifest } from "./packages.mjs";
+import { PACKAGES_SUBDIR, readStagedSkills, readStageManifest, STAGE_MANIFEST } from "./packages.mjs";
 import { copySkillTree } from "./copy-tree.mjs";
 import { SKILL_NAME_RE } from "./flow-gate.mjs";
 import { GIT_READ_FLAGS } from "./git-hardening.mjs";
@@ -84,21 +88,21 @@ import { deploymentVenueEnv, sharedShellIgnored } from "./deployment-venue.mjs";
 import { readDeploymentEnv, resolveServiceEnv, serviceEnvFileOf, serviceEnvLoader } from "./service-env.mjs";
 import { imageRefProblem, jobImageFix, pullOffered } from "./image-ref.mjs";
 import { PROXY_STATE_FORMAT, parseProxyState, rulesIncludeEndpoints, shippedProxyDrift } from "./egress-proxy-state.mjs";
-import { PACKAGED_EGRESS_PROXY_CONF, judgeProxyConfCopy, packageCopyName, readPackagedProxyConf } from "./egress-conf-copy.mjs";
-import { ABSENT, ASSERTED, DAEMON_APPLIES_BOUNDS, DEFAULT_BACKEND, DOCKER_ENDPOINT_LOCAL, OBSERVATION_FIX, OBSERVATIONS, PODMAN_ADDS_NO_MOUNTS, PODMAN_BACKEND, PODMAN_BOUNDS_DELEGATED, PODMAN_ROOTFUL_WIDENING_KEYS, PODMAN_SERVICE_LOCAL, PROPERTY_NAMES, RUNTIME_ADDS_NO_MOUNTS, HOST_ROUTE_LAN, HOST_ROUTE_REFUTED, HOST_ROUTE_WORKS, declarationOf, floorShortfall, hostRouteFor, isProxyLocalHost, parseBackendFloor, parseBackendList, unarmedFloor, unobservedFloor, venuesOf } from "./backends.mjs";
-import { PODMAN_BOOT_REFUSING_CAUSES, PODMAN_FIRST_START_TIMEOUT_MS, PODMAN_INFO_TIMEOUT_MS, PODMAN_JOB_USER_FIX, decidePodmanJobUser, makePodmanInfoReader, observePodman, observeRootlessNetns, podmanConfFix, podmanConfWidening, resolvePodmanImageUser } from "./backend-podman.mjs";
-import { PODMAN_PINNED_FLAGS, buildPodmanRunArgs, containerSpec, podmanArgsFromSpec } from "./docker-run.mjs";
+import { PACKAGED_EGRESS_PROXY_CONF, PACKAGE_VERSION, judgeProxyConfCopy, packageCopyName, readPackagedProxyConf } from "./egress-conf-copy.mjs";
+import { ABSENT, ASSERTED, BACKENDS, DAEMON_APPLIES_BOUNDS, DEFAULT_BACKEND, DOCKER_ENDPOINT_LOCAL, OBSERVATION_FIX, OBSERVATIONS, PODMAN_ADDS_NO_MOUNTS, PODMAN_BACKEND, PODMAN_BOUNDS_DELEGATED, PODMAN_ROOTFUL_WIDENING_KEYS, PODMAN_SERVICE_LOCAL, PROPERTY_NAMES, RUNTIME_ADDS_NO_MOUNTS, HOST_ROUTE_LAN, HOST_ROUTE_REFUTED, HOST_ROUTE_WORKS, backendRefusals, declarationOf, floorShortfall, hostRouteFor, isProxyLocalHost, openshellSetupOf, parseBackendFloor, parseBackendList, unarmedFloor, unobservedFloor, venuesOf } from "./backends.mjs";
+import { PODMAN_BOOT_REFUSING_CAUSES, PODMAN_FIRST_START_TIMEOUT_MS, PODMAN_INFO_TIMEOUT_MS, PODMAN_JOB_USER_FIX, decidePodmanJobUser, makePodmanInfoReader, podmanPausable, observePodman, observeRootlessNetns, podmanConfFix, podmanConfWidening, resolvePodmanImageUser } from "./backend-podman.mjs";
+import { PODMAN_PINNED_FLAGS, buildDockerRunArgs, buildPodmanRunArgs, containerSpec, podmanArgsFromSpec } from "./docker-run.mjs";
 import { PODMAN_SERVICE_TIMEOUT_MS, PODMAN_SERVICE_UNIT, makePodmanServiceReader, observeHost, observeRootfulConf, readRootfulService, rootfulConfFix, rootfulConfRetries, rootfulConfResidual, rootfulUnreadList } from "./runtime-observations.mjs";
 import { JOB_NAME_PREFIX, endpointShown, makeDockerEndpointResolver, quotedShown } from "./backend-local.mjs";
 import { DEFAULT_EGRESS_PROXY, STOPPED_PROXY_STATES, EGRESS_CANARY_NET_PREFIX, EGRESS_CANARY_PROBE_PREFIX, EGRESS_ENDPOINT_PROBE_PREFIX, egressArmed, egressCanaryNetwork, egressCanaryProbe, egressEndpointProbe, egressEnv, egressProxyName, egressProxyUrl, networkEndpoints, removeNetworkOrSay } from "./egress.mjs";
 import { detachBlockedSentence, makeDetachGate, runtimeFromFacts } from "./netns-keeper.mjs";
 import { runLiveProbes } from "./live-probes.mjs";
-import { VALKEY_PASSWORD_KEY, VALKEY_PASSWORD_HOWTO, VALKEY_PORT_KEY, isLoopbackHost, valkeyPasswordProblem, valkeyPortConflict } from "./valkey-auth.mjs";
+import { COMPOSE_VALKEY_OVERRIDE, VALKEY_PASSWORD_KEY, VALKEY_PASSWORD_HOWTO, VALKEY_PORT_KEY, isLoopbackHost, valkeyContainerOwner, valkeyPasswordProblem, valkeyPortConflict } from "./valkey-auth.mjs";
 import { urlShown, valkeyContextFromResolution, valkeyPasswordFor, valkeyUrlProblem } from "./valkey-endpoint.mjs";
 import { SANDBOX_TOMBSTONE_STUCK_MS, isSandboxTombstone, sandboxTombstoneAge } from "./sandbox-store.mjs";
-import { installedUnitPaths, readUnitSeam, readUnitUser } from "./service.mjs";
+import { installedConsoleUnitPath, installedUnitPaths, readUnitSeam, readUnitUser } from "./service.mjs";
 import { CONTAINER_HOME, SHIPPED_IMAGE_UID, SIZE_LABEL_CPU, SIZE_LABEL_MEM } from "./container-spec.mjs";
-import { DEFAULT_JOB_SIZE, cpuCeilingCenti, formatCpus, formatMemory, jobSizeDefaults, resolveJobSize } from "./job-size.mjs";
+import { DEFAULT_JOB_SIZE, codemodeWorkersOf, cpuCeilingCenti, formatCpus, formatMemory, jobSizeDefaults, resolveJobSize } from "./job-size.mjs";
 import { SUGGEST_WINDOW_DAYS, cpusText, hostCap, refusalWords, sizeRefusal, suggestSize, suggestionCall, suggestionEvidence } from "./size-suggest.mjs";
 import { SIZING_RECORD_MAX_BYTES, readSizingRecords } from "./size-records.mjs";
 import { CAPACITY_WINDOWS, computeCapacity } from "./capacity.mjs";
@@ -107,19 +111,38 @@ import { CGROUP_PARENT, cgroupParentFor, operatorQuotaCommand, readQuota, reserv
 import { HOST_BUDGET_KEYS, computeHostBudget, hostBudgetSettings, largestFit, neverFits, projectBudgetRow, publishedBudget, readUserServiceLimits } from "./host-budget.mjs";
 import { makeImagePreflight, normalizeImageId } from "./image-preflight.mjs";
 import { BOOT_REFUSING_JOB_USER_CAUSES, DAEMON_FACTS_TIMEOUT_MS, JOB_USER_FIX, makeDaemonFactsReader, makeJobUserResolver, relabelsPrivateMounts, resolveImageUser } from "./job-user.mjs";
-import { parseSecretProfiles } from "./secret-profiles.mjs";
+import { mergeSecretProfiles, parseSecretProfiles, servableSecretProfiles } from "./secret-profiles.mjs";
 // The OAuth-suffix rule and the variable it selects live in their own import-free module so the worker
 // can share them: doctor NAMES a variable and env-allowlist WRITES one, and they must never differ.
 import { apiKeyVariable, nonApiKeyKind } from "./provider-key.mjs";
-import { parseTriggers } from "./triggers.mjs";
-import { readOverlay, resolveSettings } from "./runtime-settings.mjs";
-import { DOLLAR_KEY_PREFIX } from "./dollar-budget.mjs";
+import { WORKER_NAME_RE } from "./worker-name.mjs";
+import { parseTriggersDocument, triggersFileVersionFor } from "./triggers.mjs";
+import { jobDataVersionFor } from "./job-data-version.mjs";
+import { secretBundleChecks } from "./doctor-bundles.mjs";
+import { doctorModelProposalChecks } from "./doctor-model-proposals.mjs";
+
+/**
+ * How long `doctor --secrets` waits for one bundle resolver (issue #704): doctor's own 30 s capture bound, not the
+ * job path's tighter PI_SECRET_RESOLVE_TIMEOUT_MS. A job's read sits in front of a paid container and holds a slot;
+ * doctor's is an operator at a prompt asking whether the wiring works, and a slow manager is an answer, not a fault.
+ */
+const BUNDLE_DOCTOR_TIMEOUT_MS = 30_000;
+import { readOverlay, readOverlayDocument, resolveSettings, settingsVersionFor } from "./runtime-settings.mjs";
+import { DEPLOYMENT_WINDOWS, DOLLAR_KEY_PREFIX, deploymentWindowsAt, dollarWindowCaps, dollarWindowFloors, valkeyEndpointTag } from "./dollar-budget.mjs";
 import { dayKey, monthKey, weekKey } from "./budget.mjs";
 import { DOLLAR_ENV_NAMES, DOLLAR_SETTING_KEYS, checkDollarInvariant, effectiveCostCapMicros, formatMicros, optionalUsdMicros, parseUsdMicros } from "./money.mjs";
 import { cronPlacement, envelopeJobPaths } from "./schedules.mjs";
-import { envelopeDigest, loadEnvelopeChecked } from "./envelope.mjs";
+import { envelopeDigest, envelopeInsideJobPaths, loadEnvelopeChecked } from "./envelope.mjs";
+import { keptTokens, operatorCount, readTokensFile, tokensFilePath } from "./console-tokens.mjs";
+import { RUN_MIRROR_MAX_RUNS_DEFAULT, RUN_MIRROR_MAX_RUNS_MAX, RUN_MIRROR_MAX_RUNS_MIN, runMirrorMaxRunsOf } from "./retention.mjs";
+import { verifyConsoleAudit } from "./console-audit.mjs";
 import { OTHER } from "./priorities.mjs";
 import { ALLOC_PLAN_KEY, NO_ENVELOPE_FINGERPRINT } from "./allocation.mjs";
+import { assignCheckIds, buildDoctorRecord, doctorIntervalHours, publishRedactor, secretValuesIn } from "./doctor-results.mjs";
+import { olderStateFindings as olderStateFindingsReal, VALKEY_CONTAINER } from "./older-state.mjs";
+import { DOCTOR_PUBLISH_SKIPPED_PREFIX } from "./doctor-spawner.mjs";
+import { extensionsNotHere } from "./loaded-record.mjs";
+import { buildHostLoads, flowProbes, flowTierOf, mcpRowsOf, pathIsThere, readOverlayExtensionRows, readOverlaySkillNames } from "./host-loads.mjs";
 
 const NODE_FLOOR = [22, 19]; // pi's engine floor (22.19.0)
 
@@ -181,7 +204,8 @@ const ghProbeArgs = (image, bin) => ["run", "--rm", "-i", "--pull=never", ...(bi
 export async function runDoctor(shellVars = process.env, deps = {}) {
 	const {
 		cwd = process.cwd(),
-		out = (s) => process.stdout.write(s),
+		out: output = (s) => process.stdout.write(s),
+		json = false,
 		spawn = nodeSpawn,
 		// The bounds every `runCmd` goes through (issue #397). A seam so a test can drive the timeout path
 		// in milliseconds; nothing else passes it.
@@ -217,20 +241,55 @@ export async function runDoctor(shellVars = process.env, deps = {}) {
 		// without uninstalling a dependency. Threaded like every other seam: a seam collectChecks honours
 		// and runDoctor silently drops is a seam that cannot pin an EXIT CODE, only a check object.
 		providerOracle = defaultProviderOracle,
+		subscriptionFactory,
 		// Issues #501 and #502: the worker's model catalog and pi's own model loader, both imported lazily. Seams, so a test
 		// can drive the not-installed arm and a disagreement without editing pi. Undefined means the defaults.
 		modelCatalog,
 		piModelLoader,
+		modelProposals,
 		dollarKeysExist,
 		// Issue #504 part B: the applied split's envelope digest (`alloc:plan`), read once. Undefined means the default.
 		readAppliedSplit,
 		// Issue #599, phase 2: the capacity line's read of the run history (the run mirror and the logs directory).
 		// Undefined means the default, which reads the deployment's real Valkey and files.
 		readCapacity,
+		// Issue #761: the dollar window check's two reads, this host's records and then the counters (`doctorDollarWindows`),
+		// and the stores an older release left behind (`olderStateFindings`, older-state.mjs). Undefined means the defaults,
+		// which read the deployment's real files, Valkey and Docker.
+		readDollarRecords,
+		readDollarCounters,
+		olderStateFindings,
+		// Issue #708: whether the operator console answers (`probeConsole`, console-probe.mjs). Undefined means the default,
+		// which sends one GET /healthz to a loopback address or the socket, so a test passes its own.
+		consoleProbe,
 		// --live (issue #278, INT-LIVE-PROBE-CONTRACT): read the backend declarations back off short-lived real containers.
 		// STRICTLY `=== true`, so only the CLI's own flag arms it: a truthy string from a caller that forwarded an
 		// option bag runs nothing. The fs, PID-liveness and nonce are seams so the sequence is driven without Docker.
 		live = false,
+		// The granted browser action publishes observations without starting/sweeping probe containers (#774).
+		setupReadOnly = false,
+		// Issue #683: `--openshell`, the openshell venue's lines (doctor-openshell.mjs), strictly `=== true` as `live`.
+		// `openshellRun` is their spawn seam, for the tests.
+		openshell = false,
+		// Issue #704: `--secrets`, resolve each project secret bundle on this host and print its variable names and count,
+		// never a value (doctor-bundles.mjs). Strictly `=== true`, as `live`: it spawns every bundle resolver, which reads
+		// the operator's manager. `bundleSpawn` is its spawn seam, for the tests.
+		secrets = false,
+		bundleSpawn,
+		// Issue #712: publish this run's results to Valkey for the console and the panel (`doctor-results.mjs`). Strictly
+		// `=== true`, as `live`: the CLI passes it unless `--no-publish`, and a caller that hands runDoctor an option bag
+		// (every test) publishes nothing unless it says so. `publishDoctor(url, name, record, loads)` is the write, a seam so a
+		// test drives it against a fake Valkey; `writeErr` takes the one line said when it could not publish; `publishNow`
+		// stamps the record.
+		publish = false,
+		// `{ worker: true, every }` when the worker's own spawn ran this (`--by-worker=<hours>`): the record then carries the
+		// interval the worker actually runs at, not this resolution's reading of it.
+		publishBy = null,
+		publishDoctor = defaultPublishDoctor,
+		hostLoadsOf = doctorHostLoads,
+		writeErr = (s) => process.stderr.write(s),
+		publishNow = Date.now,
+		openshellRun,
 		liveFs = { chmodSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, statSync },
 		// Issue #341: who a job on this host would run as, decided from the same facts the worker reads. Seams because
 		// the answer is this process's own ids and a daemon, neither of which belongs in a unit test. `stat` reads the
@@ -247,6 +306,8 @@ export async function runDoctor(shellVars = process.env, deps = {}) {
 		readEnvFile = (path) => readFileSync(path),
 		// Issue #345: the host files the runtime-mounts observation reads (Podman's mounts.conf and containers.conf).
 		observationFs = { statSync, readFileSync, readdirSync },
+		// Issue #800: what the flow tiers read, so a test can stand in for a folder at mode 000, which root reads straight through.
+		flowFs = { statSync, readFileSync, readdirSync },
 		// Issue #464: the jobs dir check's reads (its owner, whether this account may write it, the old shared default's
 		// retained workspaces). Never a write: doctor says what the worker will meet, and the worker creates the dir.
 		jobsDirFs = { accessSync, lstatSync, readdirSync, statSync },
@@ -315,6 +376,8 @@ export async function runDoctor(shellVars = process.env, deps = {}) {
 	// against), and the text handed to the first `.env` read the checks below make, so a run still reads the file once.
 	// A file that is there and cannot be read is said, as `up` says it (gate round 2): the venue then comes from this
 	// shell alone. An absent one (ENOENT) is simply absent.
+	// JSON owns stdout; the same diagnostics and fixes remain visible on stderr.
+	const out = json === true ? writeErr : output;
 	const envPath = join(cwd, ".env");
 	// BYTES (issue #447): what systemd refuses to load is judged before decoding. Through ONE descriptor since gate round
 	// 2 (`readDeploymentEnv`, the panel's reader too): judged by `stat` and read by path, a folder another account could
@@ -390,7 +453,7 @@ export async function runDoctor(shellVars = process.env, deps = {}) {
 						return { ...(await valkeyAuthState(url, { context, withoutPassword })), passwordSet: Boolean(sent.password), from: sent.from };
 					}
 				: null;
-	const seams = { cwd, out, spawn, probeValkey, valkeyAuth: valkeyAuthSeam, readHosts, ...(modelCatalog ? { modelCatalog } : {}), ...(piModelLoader ? { piModelLoader } : {}), ...(dollarKeysExist ? { dollarKeysExist } : {}), ...(readAppliedSplit ? { readAppliedSplit } : {}), ...(readCapacity ? { readCapacity } : {}), fileExists, nodeVersion, mkdir, chmod, rm, agentDir, platform, home, providerOracle, facts, jobUserIdentity, stat, passwd, readUnit, readEnvFile: readEnvFileShared, observationFs, jobsDirFs, jobsDirUid, valkeyOwner: valkeyOwnerSeam, isAlive, pid, runTimeouts, live: live === true, wallClock, ...(readRunRecords ? { readRunRecords } : {}), venueChecks, userName, proxyFilesExist, proxyFileIsDirectory, ...(includeNeeds ? { includeNeeds } : {}), ...(declaredEndpoints ? { declaredEndpoints } : {}), ...(readOverlayFile ? { readOverlayFile } : {}), ...(lstatOverlayFile ? { lstatOverlayFile } : {}), ...(hostAddresses ? { hostAddresses } : {}), ...(readProxyConf ? { readProxyConf } : {}), ...(readPackagedConf ? { readPackagedProxyConf: readPackagedConf } : {}), ...(readPodmanService ? { readPodmanService } : {}), serviceEnvFile: envValues === null ? null : serviceEnvFileOf(envValues, envPath, serviceEnvLoader(platform)) };
+	const seams = { setupReadOnly: setupReadOnly === true, ...(subscriptionFactory ? { subscriptionFactory } : {}), ...(modelProposals ? { modelProposals } : {}), secrets: secrets === true, ...(bundleSpawn ? { bundleSpawn } : {}), openshell: openshell === true, ...(openshellRun ? { openshellRun } : {}), cwd, out, spawn, probeValkey, valkeyAuth: valkeyAuthSeam, readHosts, ...(modelCatalog ? { modelCatalog } : {}), ...(piModelLoader ? { piModelLoader } : {}), ...(dollarKeysExist ? { dollarKeysExist } : {}), ...(readAppliedSplit ? { readAppliedSplit } : {}), ...(readCapacity ? { readCapacity } : {}), ...(readDollarRecords ? { readDollarRecords } : {}), ...(readDollarCounters ? { readDollarCounters } : {}), ...(olderStateFindings ? { olderStateFindings } : {}), ...(consoleProbe ? { consoleProbe } : {}), fileExists, nodeVersion, mkdir, chmod, rm, agentDir, platform, home, providerOracle, facts, jobUserIdentity, stat, passwd, readUnit, readEnvFile: readEnvFileShared, observationFs, flowFs, jobsDirFs, jobsDirUid, valkeyOwner: valkeyOwnerSeam, isAlive, pid, runTimeouts, live: live === true, wallClock, ...(readRunRecords ? { readRunRecords } : {}), venueChecks, userName, proxyFilesExist, proxyFileIsDirectory, ...(includeNeeds ? { includeNeeds } : {}), ...(declaredEndpoints ? { declaredEndpoints } : {}), ...(readOverlayFile ? { readOverlayFile } : {}), ...(lstatOverlayFile ? { lstatOverlayFile } : {}), ...(hostAddresses ? { hostAddresses } : {}), ...(readProxyConf ? { readProxyConf } : {}), ...(readPackagedConf ? { readPackagedProxyConf: readPackagedConf } : {}), ...(readPodmanService ? { readPodmanService } : {}), serviceEnvFile: envValues === null ? null : serviceEnvFileOf(envValues, envPath, serviceEnvLoader(platform)) };
 	// Issue #471: every other service key, resolved ONCE for the whole run (the fix pass's re-collect and `--live` judge the
 	// same resolution). THE RULE (PR #474's round cap, after three rounds of trust patches): no program doctor starts is
 	// handed anything from `.env`. Every child gets this shell's own environment, the one it had before #471; a `.env`
@@ -425,6 +488,8 @@ export async function runDoctor(shellVars = process.env, deps = {}) {
 		}
 	}
 
+	// The --live read-backs, kept for the published record (issue #712).
+	const liveRendered = [];
 	// ONCE, and after --fix: the probes read the host as the fix pass left it, so a fix that pulled the job image is
 	// read back rather than reported absent. Rendered like every other check and judged by the same rule.
 	if (live === true) {
@@ -433,8 +498,26 @@ export async function runDoctor(shellVars = process.env, deps = {}) {
 		// Each venue's results are rendered BEFORE the next venue announces its containers, so what podman is about to
 		// start never lands between local's announcement and local's verdicts.
 		const liveSeams = { ...seams, liveFs, isAlive, pid, nonce, ...(now ? { now } : {}), ...(delay ? { delay } : {}) };
-		if (facts.localUsed !== false && render(await liveChecks(env, liveSeams, facts), out)) failed = true;
-		if (facts.podman && render(await podmanLiveChecks(env, liveSeams, facts), out)) failed = true;
+		if (facts.localUsed !== false) {
+			const read = await liveChecks(env, liveSeams, facts);
+			liveRendered.push(...read);
+			if (render(read, out)) failed = true;
+		}
+		if (facts.podman) {
+			const read = await podmanLiveChecks(env, liveSeams, facts);
+			liveRendered.push(...read);
+			if (render(read, out)) failed = true;
+		}
+	}
+
+	// Issue #712: what was judged, published for the console and the panel, after every check is in (the `--fix`
+	// re-collect and the `--live` read-backs included) and before the closing line. Best effort BY CONTRACT: whatever
+	// happens here leaves `failed`, and so the exit code, as it was, and a fault is one line on stderr, never on stdout,
+	// where a script reads doctor's verdict.
+	const record = doctorResultsRecord({ checks: [...checks, ...liveRendered], liveRendered, seams, env, at: publishNow(), by: publishBy });
+	if (json === true) output(`${JSON.stringify(record)}\n`);
+	if (publish === true) {
+		await publishResults({ seams, publishDoctor, hostLoadsOf, writeErr, record, env });
 	}
 
 	// Issue #477: whether anything doctor judged came from the deployment's `.env`, which a hand-started worker never reads.
@@ -449,6 +532,117 @@ export async function runDoctor(shellVars = process.env, deps = {}) {
 	return failed ? 1 : 0;
 }
 
+/**
+ * Issue #712: publish one run's results (`INT-DOCTOR-RESULTS-KEY`). Never throws and never decides anything: a Valkey
+ * this run may not talk to, or one that does not answer, is ONE line on stderr whose wording starts with
+ * `DOCTOR_PUBLISH_SKIPPED_PREFIX` (the worker's spawner reads that prefix and nothing else), and no URL, path or value
+ * is in it. A record that landed without its `doctor:loads` beside it (issue #800) is one line in other words, for the same
+ * reader: it was published, and saying it was not would be false.
+ * The secrets the record must not carry are every secret-named value of the resolution (`env`, which holds
+ * this shell's whole environment with the service's `.env` values over it), plus the `.env` values the resolution did
+ * not take (a provider key resolved later, a value this shell disagrees with), so a value the file holds is as absent
+ * as one this shell exports.
+ */
+export function doctorResultsRecord({ checks, liveRendered = [], seams, env, at, by = null }) {
+	const live = new Set(liveRendered);
+	const ids = assignCheckIds(checks, (c) => (live.has(c) ? "live" : (seams.checkSection?.(c) ?? "env")));
+	const service = seams.serviceEnv ?? {};
+	const fileSide = Object.fromEntries((service.disagreements ?? []).map((d) => [d.key, d.file]));
+	const secrets = secretValuesIn(env, service.fromFile, service.extraFromFile, fileSide);
+	const worker = by?.worker === true;
+	const every = worker && Number.isSafeInteger(by.every) ? by.every : seams.publishTo?.every;
+	return buildDoctorRecord({ checks, ids, at, version: PACKAGE_VERSION, openshell: seams.openshellJudged === true, every, secrets, by: { uid: process.geteuid?.() ?? null, worker } });
+}
+
+/**
+ * Issue #800: what this host's jobs can load, for `doctor:loads:<name>` (`host-loads.mjs`), read when it is published and
+ * through the readers a job's worker uses, so a run by `--no-publish` reads nothing more. A part that cannot be read is
+ * named in `unread`, which a reader takes as unknown, and an empty list would read as none. Only ABSENT_CODES are absence
+ * (`pathIsThere`): an overlay this uid cannot enter is not an overlay with nothing in it. A throw that gets past that is
+ * the caller's to say: the doctor record goes out either way.
+ */
+export function doctorHostLoads({ seams, env, record, fs = { readFileSync, readdirSync, statSync } }) {
+	const overlay = typeof env.PI_GLOBAL_PI_DIR === "string" ? env.PI_GLOBAL_PI_DIR : "";
+	const unread = [];
+	const read = (part, fn, fallback) => {
+		try {
+			const value = fn();
+			if (value !== null) return value;
+		} catch {
+			// named below, by part alone: what failed is the doctor line's to say
+		}
+		unread.push(part);
+		return fallback;
+	};
+	const service = seams.serviceEnv ?? {};
+	const fileSide = Object.fromEntries((service.disagreements ?? []).map((d) => [d.key, d.file]));
+	const redact = publishRedactor(secretValuesIn(env, service.fromFile, service.extraFromFile, fileSide));
+	const extensions = read("extensions", () => readOverlayExtensionRows(overlay, { fs }), []);
+	const skills = read("skills", () => readOverlaySkillNames(overlay, { fs }), []);
+	const mcp = read("mcp", () => mcpRowsOf(readOverlayMcp(overlay, { readFileSync: seams.readOverlayFile ?? ((p, enc) => readFileSync(p, enc)), ...(seams.lstatOverlayFile ? { lstatSync: seams.lstatOverlayFile } : {}) })?.servers, { redact }), []);
+	// A manifest that is there and does not read is not "nothing staged": the job's own reader degrades, this one says so.
+	const packages = read("packages", () => {
+		if (overlay === "" || !pathIsThere(join(overlay, PACKAGES_SUBDIR, STAGE_MANIFEST), fs)) return [];
+		return readStageManifest({ globalPiDir: overlay, readFile: (p) => fs.readFileSync(p, "utf8"), fileExists: () => true })?.packages ?? null;
+	}, []);
+	// `none` says every tier was checked, and a tier in `unread` was not. Doctor's line stays as it is, since "visible here" is
+	// still true of it. What is published is what can be said: not that the flow is nowhere, only that it was not found.
+	const blind = unread.includes("skills") || unread.includes("packages");
+	const flows = (seams.flowRows ?? []).map((row) => (blind && row.tier === "none" && row.flow !== null ? { ...row, tier: "unknown" } : row));
+	return buildHostLoads({ at: record.at, every: record.every, by: record.by, overlayExtensionsAllowed: env.PI_GLOBAL_ALLOW_EXTENSIONS !== "0", extensions, skills, mcp, packages, flows, unread });
+}
+
+async function publishResults({ seams, publishDoctor, hostLoadsOf, writeErr, record, env }) {
+	const line = (text) => {
+		try {
+			writeErr(`${text}\n`);
+		} catch {
+			// A closed stderr cannot change the verdict either.
+		}
+	};
+	const say = (why) => line(`${DOCTOR_PUBLISH_SKIPPED_PREFIX} (${why}); the console and the panel keep the last published results`);
+	// Not that prefix, on purpose: the doctor record DID land, and the worker's spawner reads the prefix as "it did not". And not
+	// "readers say unknown", which is false: the last list stays for its seven days and reads as current until it is old.
+	const sayLoads = (why) => line(`doctor: results published, but not what this host's jobs can load (${why}); the console keeps the last list it had`);
+	const target = seams.publishTo;
+	if (!target) return say("doctor talked to no Valkey on this run");
+	if (target.refused) return say(target.refused);
+	let loads = null;
+	let loadsThrew = false;
+	try {
+		loads = hostLoadsOf({ seams, env, record });
+	} catch {
+		// Each part's own read fails into `unread`, so this is the build of it failing. The doctor record is the older promise
+		// and goes out on its own.
+		loadsThrew = true;
+	}
+	try {
+		await publishDoctor(target.url, target.name, record, loads);
+	} catch (error) {
+		return error?.doctorRecordLanded === true ? sayLoads("Valkey did not take them") : say("Valkey did not take them");
+	}
+	if (loadsThrew) sayLoads("this run could not read them");
+}
+
+/**
+ * The real write: doctor's own fail-fast client, bounded, always dropped (`withDoctorClient`). A fault on the second write says
+ * the first landed (`doctorRecordLanded`), since "nothing was published" would then be false of a record readers can see.
+ */
+export async function defaultPublishDoctor(url, name, record, loads = null, { makeClient } = {}) {
+	const { publishDoctorRecord } = await import("./doctor-results.mjs");
+	const { publishHostLoads } = await import("./host-loads.mjs");
+	await withDoctorClient(url, async (client) => {
+		await publishDoctorRecord(client, name, record);
+		if (loads === null) return;
+		// After the doctor record, whose write puts this host under the index both share.
+		try {
+			await publishHostLoads(client, name, loads);
+		} catch (cause) {
+			throw Object.assign(new Error("the doctor record landed and the loads did not", { cause }), { doctorRecordLanded: true });
+		}
+	}, { makeClient });
+}
+
 /**
  * Issue #477: how to start a worker that runs with what doctor judged. `pi-dispatch worker` started by hand reads this
  * shell's environment and no `.env` (docs/secrets.md: the worker parses no `.env` file), so where doctor took any value
@@ -601,10 +795,12 @@ export const ENV_FILE_READABLE_KEYS = Object.freeze(["PI_PAUSE_WINDOWS_FILE", "P
  *  the key's path, neither a secret); the inline key is only ever sniffed for its first bytes. */
 export const GITHUB_SERVICE_KEYS = Object.freeze(["GITHUB_AUTH_SOURCE", "GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY_PATH", "GITHUB_APP_PRIVATE_KEY"]);
 /** Issue #471: the worker's settings doctor judges, which it read from this shell alone while the service read them from
- *  `.env`. TEMP is TMPDIR's twin in the worker's temp root; PI_CODING_AGENT_DIR is where the worker reads auth.json. */
-export const WORKER_SERVICE_KEYS = Object.freeze(["PI_JOB_IMAGE", "PI_JOB_MEMORY", "PI_JOB_CPUS", "PI_CONCURRENCY", ...Object.values(HOST_BUDGET_KEYS), "PI_TRIGGERS_FILE", "PI_LOGS_DIR", "PI_LOG_RETENTION_DAYS", "PI_SETTINGS_FILE", "PI_SESSIONS_DIR", "PI_SESSIONS_TTL_DAYS", "PI_SESSION_MAX_AGE_DAYS", "PI_SESSION_MAX_CONTEXT_PCT", "PI_SESSION_MAX_RESUME_CHAIN", "PI_GLOBAL_PI_DIR", "PI_GLOBAL_ALLOW_EXTENSIONS", "PI_FORWARD_ENV", "PI_AUTH_FROM_PI", "PI_CODING_AGENT_DIR", "PI_BACKEND_FLOOR", "PI_SECRET_PROFILES", "PI_SECRET_RESOLVER_ROOTS", "PI_WAIT_PROFILES", "PI_WAIT_AFTER_MAX_MS", "PI_SANDBOX_RETENTION_HOURS", "PI_ALLOWED_MODELS", "PI_DISPATCH_RUN_ROOTS", "GITHUB_PAT_VAR", "TEMP", ...Object.values(DOLLAR_ENV_NAMES)]);
+ *  `.env`. TEMP is TMPDIR's twin in the worker's temp root; PI_CODING_AGENT_DIR is where the worker reads auth.json.
+ *  Issue #761: PI_CONSOLE_AUDIT_RETENTION_DAYS is here and not in `CONSOLE_ENV_KEYS` although it is named for the
+ *  console: the worker reads it (it runs the audit reaper), and a console key set alone makes doctor judge a console. */
+export const WORKER_SERVICE_KEYS = Object.freeze(["PI_JOB_IMAGE", "PI_JOB_MEMORY", "PI_JOB_CPUS", "PI_CONCURRENCY", ...Object.values(HOST_BUDGET_KEYS), "PI_TRIGGERS_FILE", "PI_LOGS_DIR", "PI_LOG_RETENTION_DAYS", "PI_CONSOLE_AUDIT_RETENTION_DAYS", "PI_RUN_MIRROR_MAX_RUNS", "PI_SETTINGS_FILE", "PI_SESSIONS_DIR", "PI_CHECKPOINTS_DIR", "PI_SESSIONS_TTL_DAYS", "PI_SESSION_MAX_AGE_DAYS", "PI_SESSION_MAX_CONTEXT_PCT", "PI_SESSION_MAX_RESUME_CHAIN", "PI_GLOBAL_PI_DIR", "PI_GLOBAL_ALLOW_EXTENSIONS", "PI_FORWARD_ENV", "PI_AUTH_FROM_PI", "PI_AUTH_CONNECTIONS_FILE", "PI_AUTH_STORE_DIR", "PI_CODING_AGENT_DIR", "PI_BACKEND_FLOOR", "PI_OPENSHELL_ENGINE", "PI_OPENSHELL_GATEWAY", "PI_SECRET_PROFILES", "PI_SECRET_BUNDLES", "PI_SECRET_RESOLVER_ROOTS", "PI_SECRET_RESOLVE_TIMEOUT_MS", "PI_WAIT_PROFILES", "PI_WAIT_AFTER_MAX_MS", "PI_SANDBOX_RETENTION_HOURS", "PI_DOCTOR_INTERVAL_HOURS", "PI_ALLOWED_MODELS", "PI_DISPATCH_RUN_ROOTS", "GITHUB_PAT_VAR", "TEMP", ...Object.values(DOLLAR_ENV_NAMES)]);
 /** Issue #471: the receiver's keys doctor judges its boot by (the receiver's unit reads the same `.env`). */
-export const RECEIVER_SERVICE_KEYS = Object.freeze(["WEBHOOK_SECRET", "RECEIVER_PORT", "GITLAB_TOKEN", "GITLAB_URL", "GITLAB_WEBHOOK_MODE", "GITLAB_WEBHOOK_SECRET", "FORGEJO_URL", "FORGEJO_TOKEN", "FORGEJO_WEBHOOK_SECRET", "AZURE_ORG_URL", "AZURE_TOKEN", "AZURE_WEBHOOK_MODE", "AZURE_WEBHOOK_SECRET", "AZURE_WEBHOOK_HEADER"]);
+export const RECEIVER_SERVICE_KEYS = Object.freeze(["WEBHOOK_SECRET", "RECEIVER_PORT", "GITLAB_TOKEN", "GITLAB_URL", "GITLAB_WEBHOOK_MODE", "GITLAB_WEBHOOK_SECRET", "FORGEJO_URL", "FORGEJO_TOKEN", "FORGEJO_PERMISSION_TOKEN", "FORGEJO_WEBHOOK_SECRET", "AZURE_ORG_URL", "AZURE_TOKEN", "AZURE_WEBHOOK_MODE", "AZURE_WEBHOOK_SECRET", "AZURE_WEBHOOK_HEADER"]);
 /**
  * Issue #471 (follow-up): the variables the CLIs doctor spawns read from their environment, by the CLI that reads them.
  * The worker starts podman, docker and gh with its OWN environment (no `env` option: `image-preflight.mjs`,
@@ -624,9 +820,17 @@ export const CLI_SERVICE_KEYS = Object.freeze({
 	podman: Object.freeze(["CONTAINERS_CONF", "CONTAINERS_CONF_OVERRIDE", "CONTAINERS_STORAGE_CONF", "CONTAINERS_REGISTRIES_CONF", "CONTAINER_HOST", "CONTAINER_CONNECTION", "XDG_CONFIG_HOME", "XDG_RUNTIME_DIR", "HOME"]),
 	docker: Object.freeze(["DOCKER_HOST", "DOCKER_CONTEXT", "DOCKER_CONFIG", "HOME"]),
 	gh: Object.freeze(["GH_TOKEN", "GITHUB_TOKEN", "GH_CONFIG_DIR", "GH_HOST", "XDG_CONFIG_HOME", "HOME"]),
+	// Issue #707: the openshell CLI keeps its gateway registrations (and so which gateway is the active one) under this
+	// account's config dir, XDG_CONFIG_HOME or else HOME/.config (measured on 0.1.4: `gateway add` writes there), so a
+	// `.env` that moves either points the SERVICE's CLI at another registration than doctor's. PATH is not listed: every
+	// shell sets one, which would make the line fire on every run, and where the CLI is found is `service install`'s to
+	// put in the unit (the plist's PATH carries its directory on macOS).
+	openshell: Object.freeze(["XDG_CONFIG_HOME", "HOME"]),
 });
 const CLI_KEY_NAMES = [...new Set(Object.values(CLI_SERVICE_KEYS).flat())];
-export const SERVICE_ENV_KEYS = Object.freeze([...STACK_KEYS, "VALKEY_URL", VALKEY_SHARED_KEY, VALKEY_PASSWORD_KEY, VALKEY_PORT_KEY, "PI_PROVIDER", "PI_MODEL", ...GITHUB_SERVICE_KEYS, "PI_JOBS_DIR", "PI_SANDBOX_DIR", "TMPDIR", "PI_WORKER_NAME", ...WORKER_SERVICE_KEYS, ...RECEIVER_SERVICE_KEYS, ...CLI_KEY_NAMES]);
+// A Set, since issue #707 made two of the worker's keys (PI_OPENSHELL_ENGINE, PI_OPENSHELL_GATEWAY) venue keys too: each
+// key once, in the order it is first named.
+export const SERVICE_ENV_KEYS = Object.freeze([...new Set([...STACK_KEYS, "VALKEY_URL", VALKEY_SHARED_KEY, VALKEY_PASSWORD_KEY, VALKEY_PORT_KEY, "PI_PROVIDER", "PI_MODEL", ...GITHUB_SERVICE_KEYS, "PI_JOBS_DIR", "PI_SANDBOX_DIR", "TMPDIR", "PI_WORKER_NAME", ...WORKER_SERVICE_KEYS, ...RECEIVER_SERVICE_KEYS, ...CLI_KEY_NAMES])]);
 
 /** Issue #471 (gate round 1): what a service manager gives every service itself, so a `.env` need not carry it. */
 const AMBIENT_SERVICE_KEYS = Object.freeze(["TMPDIR", "TEMP", "XDG_RUNTIME_DIR", "HOME"]);
@@ -651,6 +855,33 @@ function installedWorkerUnit(seams, cwd) {
 	return null;
 }
 
+/**
+ * Issue #707: whether the worker unit installed for this folder pulls in the OpenShell gateway's own user unit
+ * (`Wants=openshell-gateway.service`, which the 0.1.4 deb ships), as `service install` writes it for an openshell venue,
+ * and is NOT ordered after it: that unit is `After=default.target`, so an `After=` from a worker that is WantedBy
+ * default.target is an ordering cycle, and systemd deletes the worker's start job to break it (review round 1 of #715,
+ * measured). Read only on Linux, from the unit file itself (`installedWorkerUnit`); no unit for this folder says nothing,
+ * since the worker may run by hand. A ⚠, not a ✗: a missing `Wants=` costs a gateway the worker's boot only logs as
+ * down, and `service install --force` rewrites the unit.
+ */
+export function openshellUnitOrderChecks(seams, cwd) {
+	if (seams.platform !== "linux" || typeof seams.fileExists !== "function") return [];
+	const unit = installedWorkerUnit(seams, cwd);
+	if (!unit) return [];
+	if (unit.scope === "system") {
+		return [{ ok: true, warn: true, label: `openshell: the worker's unit (${unit.path}) is a system unit, which cannot pull in the gateway's user unit (openshell-gateway.service)`, fix: "install the worker in user scope (`pi-dispatch service install`, without --system), in the account whose user manager runs the gateway and whose home holds the CLI's gateway registration" }];
+	}
+	let text;
+	try {
+		text = String((seams.readUnit ?? ((path) => readFileSync(path, "utf8")))(unit.path));
+	} catch {
+		return [{ ok: true, warn: true, label: `openshell: whether the worker's unit (${unit.path}) pulls in the gateway could not be read`, fix: "make the unit file readable by this account, then re-run doctor" }];
+	}
+	const names = (key) => new RegExp(`^${key}=(?:.*\\s)?openshell-gateway\\.service(?:\\s|$)`, "m").test(text);
+	if (names("After")) return [{ ok: true, warn: true, label: `openshell: the worker's unit (${unit.path}) is After=openshell-gateway.service, an ordering cycle (the gateway's unit is After=default.target), which systemd breaks by deleting the worker's start job at boot`, fix: "`pi-dispatch service install --force` in the deployment folder rewrites the unit with Wants=openshell-gateway.service and no After= on it" }];
+	return [names("Wants") ? { ok: true, label: "openshell: the worker's unit pulls in the gateway's (Wants=openshell-gateway.service)" } : { ok: true, warn: true, label: `openshell: the worker's unit (${unit.path}) does not pull in the gateway's (openshell-gateway.service), so at boot the gateway starts only if something else starts it`, fix: "`pi-dispatch service install --force` in the deployment folder rewrites the unit with Wants=openshell-gateway.service" }];
+}
+
 /** The CLI variables that name a path, whose value a ⚠ may show; the rest (endpoints, names, tokens) it never shows. */
 const CLI_PATH_KEYS = Object.freeze(["CONTAINERS_CONF", "CONTAINERS_CONF_OVERRIDE", "CONTAINERS_STORAGE_CONF", "CONTAINERS_REGISTRIES_CONF", "XDG_CONFIG_HOME", "XDG_RUNTIME_DIR", "DOCKER_CONFIG", "GH_CONFIG_DIR", "HOME"]);
 /** The ones the worker's containers.conf chain check reads, which doctor runs in-process on the resolved values. */
@@ -662,11 +893,13 @@ const PODMAN_CHAIN_KEYS = Object.freeze(["CONTAINERS_CONF", "CONTAINERS_CONF_OVE
  * context name, or a token. Says that doctor's probes through that CLI describe this shell's view, and, for the keys
  * the containers.conf chain check reads, that the check itself judged the file's value, in-process, as the worker does.
  */
-export function cliNotHandedLines(service, envPath) {
+export function cliNotHandedLines(service, envPath, { openshellUsed = false } = {}) {
 	const listed = (items) => (items.length < 2 ? items.join("") : `${items.slice(0, -1).join(", ")} and ${items.at(-1)}`);
 	// Issue #481: an empty value is left out only where the tool's own source reads it as unset (`fileConfigures`).
 	return CLI_KEY_NAMES.filter((k) => Object.hasOwn(service.fromFile, k) && fileConfigures(k, service.fromFile[k])).map((k) => {
-		const names = Object.entries(CLI_SERVICE_KEYS).filter(([, ks]) => ks.includes(k)).map(([cli]) => cli);
+		// The openshell CLI is named only where an openshell venue is blessed (review round 1 of #715): elsewhere no probe
+		// of it runs, and the service never starts it.
+		const names = Object.entries(CLI_SERVICE_KEYS).filter(([cli, ks]) => ks.includes(k) && (cli !== "openshell" || openshellUsed)).map(([cli]) => cli);
 		const clis = listed(names);
 		// Grammar by count (round-cap re-review, D2): "podman, docker and gh use it", "podman uses it".
 		const verb = names.length > 1 ? "use" : "uses";
@@ -691,6 +924,7 @@ export const STEERING_SERVICE_KEYS = Object.freeze({
 	PI_BACKENDS: "which runtime doctor spawns: judged by the worker's own list parser, a shell/.env disagreement a ✗ (deploymentVenueEnv)",
 	PI_EGRESS: "whether the egress canary runs: the worker's own reading, a disagreement a ✗ (deploymentVenueEnv)",
 	PI_EGRESS_PROXY: "which proxy container doctor inspects: the worker's own name resolution, a disagreement a ✗ (deploymentVenueEnv)",
+	PI_OPENSHELL_ENGINE: "which engine the openshell lines spawn (its version, the job image in its store): docker or podman only, anything else named and nothing spawned (doctor-openshell.mjs), a disagreement a ✗ (deploymentVenueEnv, issue #707)",
 	VALKEY_URL: "which Valkey doctor connects to: the owner rule the worker applies at boot, and a line doctor cannot read makes it contact none",
 	PI_JOB_IMAGE: "the image doctor inspects and runs (the canary, the gh probe, --live): the worker's `||` default and the one image rule its boot applies (image-ref.mjs: blank, padded, a leading dash, a control character), a refused value named and not used",
 	GITHUB_AUTH_SOURCE: "whether doctor runs gh on this host: the worker's own three values",
@@ -708,6 +942,13 @@ export const STEERING_SERVICE_KEYS = Object.freeze({
 	GH_CONFIG_DIR: "which gh login the SERVICE's gh reads: never handed to doctor's gh, named in a ⚠",
 });
 
+/**
+ * The operator console's environment (issue #640): the keys `pi-dispatch-console` reads, resolved by the console's own
+ * rule (this shell's value where it sets one, else the deployment `.env`'s, as `panelEnv` does for the panel). Not
+ * service keys: no service reads them, so they are kept out of SERVICE_ENV_KEYS and its "set in this shell only" line.
+ */
+export const CONSOLE_ENV_KEYS = Object.freeze(["PI_CONSOLE_LISTEN", "PI_CONSOLE_TOKENS_FILE", "PI_CONSOLE_ALLOWED_HOSTS", "PI_CONSOLE_READ_ONLY", "PI_CONSOLE_BIND_PUBLIC", "PI_CONSOLE_IDLE_MINUTES", "PI_CONSOLE_MAX_HOURS", "PI_CONSOLE_MAX_STREAMS"]);
+
 /**
  * Issue #471: the variables doctor reads from THIS shell on purpose, each with why, so the bolt test can tell a read
  * that went back to the shell from one that was always meant to be there. A name read as `env.NAME` in doctor.mjs is in
@@ -723,11 +964,12 @@ export const DOCTOR_SHELL_KEYS = Object.freeze({
 	PI_MODEL_ENDPOINTS_FILE: "read from .env by its own two-subject rule (ENV_FILE_READABLE_KEYS), #503",
 	PI_ENVELOPE_FILE: "read from .env by its own two-subject rule (ENV_FILE_READABLE_KEYS), #504",
 	[VALKEY_SHARED_KEY]: "read from .env ONLY (#464); a value in this shell is named as ignored",
+	...Object.fromEntries(CONSOLE_ENV_KEYS.map((k) => [k, "the operator console's, not a service's: resolved by the console's own rule (this shell, else the deployment .env) apart from the service record, #640"])),
 });
 
 /** Issue #471: the service keys whose values a disagreement line never prints (set or unset only); URLs print as
  *  `urlShown` does. Every other key's two values are shown, quoted. */
-const SECRET_SERVICE_KEYS = new Set([VALKEY_PASSWORD_KEY, "GH_TOKEN", "GITHUB_TOKEN", "GITHUB_APP_PRIVATE_KEY", "WEBHOOK_SECRET", "GITLAB_TOKEN", "GITLAB_WEBHOOK_SECRET", "FORGEJO_TOKEN", "FORGEJO_WEBHOOK_SECRET", "AZURE_TOKEN", "AZURE_WEBHOOK_SECRET"]);
+const SECRET_SERVICE_KEYS = new Set([VALKEY_PASSWORD_KEY, "GH_TOKEN", "GITHUB_TOKEN", "GITHUB_APP_PRIVATE_KEY", "WEBHOOK_SECRET", "GITLAB_TOKEN", "GITLAB_WEBHOOK_SECRET", "FORGEJO_TOKEN", "FORGEJO_PERMISSION_TOKEN", "FORGEJO_WEBHOOK_SECRET", "AZURE_TOKEN", "AZURE_WEBHOOK_SECRET"]);
 const URL_SERVICE_KEYS = new Set(["VALKEY_URL", "GITLAB_URL", "FORGEJO_URL", "AZURE_ORG_URL"]);
 
 /** `keys` narrowed to `SERVICE_ENV_KEYS` plus the provider's own key variables. */
@@ -830,6 +1072,7 @@ export const EMPTY_READ_AS_UNSET = Object.freeze({
 	GITLAB_WEBHOOK_SECRET: "empty",
 	FORGEJO_URL: "empty",
 	FORGEJO_TOKEN: "empty",
+	FORGEJO_PERMISSION_TOKEN: "blank",
 	FORGEJO_WEBHOOK_SECRET: "empty",
 	AZURE_ORG_URL: "empty",
 	AZURE_TOKEN: "empty",
@@ -1020,7 +1263,7 @@ export function envFileKeys(path, keys, { fileExists, readEnvFile, statFile = st
  * loaders throw a `configError` on a path that does not exist and on content that does not parse, which is
  * exactly the boot this check is predicting.
  */
-const BOOT_FILES = Object.freeze([
+export const BOOT_FILES = Object.freeze([
 	Object.freeze({
 		key: "PI_PAUSE_WINDOWS_FILE",
 		noun: "scoped pauses",
@@ -1119,6 +1362,15 @@ const BOOT_FILES = Object.freeze([
 	}),
 ]);
 
+/**
+ * A boot file's published check id (issue #712, `NAMED_CHECK_IDS`): `<scaffold name>.file` for the SERVICE's verdict on
+ * the file it reads, `<scaffold name>.file-shell` for this shell's. Derived from the scaffold name so a sixth boot file
+ * names itself, and the test holding `NAMED_CHECK_IDS` to the source fails until it is listed.
+ */
+export function bootFileId(spec, subject = "service") {
+	return `${spec.scaffold.replace(/\.json$/, "")}.file${subject === "shell" ? "-shell" : ""}`;
+}
+
 /** A key's value when it is a non-empty string, else null: the boot reads an unset key as off. */
 function nonEmpty(value) {
 	return typeof value === "string" && value.trim() !== "" ? value : null;
@@ -1225,8 +1477,159 @@ function loadVerdict(spec, rawPath, cwd, io, platform = process.platform) {
 		spec.load(path, io.loaderIo, io.env);
 		return { ok: true };
 	} catch (err) {
-		return { ok: false, reason: envValueShown(err?.message ?? String(err)) };
+		// Issue #761: the loader's own flag says a newer pi-dispatch wrote the file (never the message's wording), so the
+		// fix can say to upgrade rather than to edit what that release wrote.
+		return { ok: false, reason: envValueShown(err?.message ?? String(err)), ...(err?.newer === true ? { newer: true } : {}) };
+	}
+}
+
+/**
+ * The fix for a file a newer pi-dispatch wrote (issue #761), whichever store: upgrade `who` and every writer of the file,
+ * never edit or delete it, which would lose what that release wrote. The one exception is a `version` an operator
+ * wrote by hand (earlier releases ignored the key): no release wrote that file, so removing the key is the fix. One
+ * sentence for the settings overlay, the pause windows file and the triggers file, so the three cannot drift apart.
+ */
+export function newerFileFix(who) {
+	return `upgrade ${who}, and every panel and console that writes this file, to the release that wrote it; do not edit or delete the file, which would lose what that release wrote, unless you added \`version\` to it yourself: then remove that key`;
+}
+
+/** The oldest git the checkpoint store accepts (issue #645), as `[major, minor]`. */
+export const CHECKPOINT_GIT_MIN = Object.freeze([2, 32]);
+
+/** `[major, minor]` out of `git --version`'s answer (`git version 2.43.0`, `git version 2.39.3 (Apple Git-146)`), or null. */
+export function parseGitVersion(text) {
+	const m = /\bgit version (\d{1,4})\.(\d{1,4})/.exec(String(text ?? ""));
+	return m ? [Number(m[1]), Number(m[2])] : null;
+}
+
+/**
+ * The checkpoint store's group (issue #645): where it is, whether it is a private directory of this account's, whether it
+ * sits under the OS temp dir, whether git is new enough, and whether each venue that runs jobs here can freeze one while
+ * its workspace is read. Pure over its reads, so every arm is driven without a host.
+ *
+ * WARN AT MOST, with ONE exception, and that is deliberate rather than lenient: the store is written only by jobs whose
+ * trigger arms `run.recover` (the worker's run checkpointer, issue #645), so a red doctor here would fail every deployment
+ * that configured the store and armed nothing, and a problem with it costs a durable run its recovery (the run falls back
+ * to today's retry), never a job its run. The exception is a store that
+ * COLLIDES with the session store (`checkpointStoreCollision`), which is ✗ because the worker itself refuses to load
+ * that configuration: doctor's verdict follows the worker's.
+ *
+ * 0700 AND THIS ACCOUNT'S, for the transcript store's reason: a checkpoint is a job's whole workspace, so as PII-bearing
+ * as a transcript, and an owner other than the worker could swap what a restore reads. A symbolic link is refused for the
+ * same reason (the store's contents would live wherever it points). Under the OS temp dir it is swept by the OS, which
+ * turns a durable run's resume into a silent cold start.
+ *
+ * GIT 2.32 because that is the first release that reads `GIT_CONFIG_GLOBAL`, which the store's git environment
+ * (`git-hardening.mjs`, `storeGitEnv`) points at /dev/null so no global config (a hook path, a filter, an fsmonitor)
+ * runs inside the store. An older git ignores the variable; the empty HOME beside it still hides `~/.gitconfig`, so the
+ * line warns rather than refuses, but the store then rests on one guard where it was built with two.
+ *
+ * PAUSABLE IS A FACT LINE (`ok: true`) either way, because nothing the operator does short of changing hosts clears it.
+ * What it costs is said in the line: a venue that cannot freeze a running job gets EXIT checkpoints only, taken once the
+ * container is gone, so a job there is not recovered from a worker that crashed mid-run. A checkpoint is never read
+ * from a workspace the job is still writing.
+ */
+export function checkpointStoreChecks({ dir, explicit = false, sessionsDir = null, fs = { lstatSync, statSync, accessSync }, uid, underTemp = () => false, gitVersion = null, venues = [DEFAULT_BACKEND], podmanRead = null }) {
+	const checks = [];
+	const shown = envValueShown(dir);
+	const where = explicit ? "PI_CHECKPOINTS_DIR" : "the default inside PI_SESSIONS_DIR";
+	const collision = checkpointStoreCollision(sessionsDir, dir);
+	if (collision) {
+		checks.push({
+			ok: false,
+			label: `checkpoint store ${shown} and the session store ${envValueShown(resolve(sessionsDir))} collide: ${collision}, so the session reaper and the checkpoint sweep would delete each other's folders, and the worker refuses to start with this configuration`,
+			fix: "unset PI_CHECKPOINTS_DIR (the default is <PI_SESSIONS_DIR>/.checkpoints) or point it at a directory outside PI_SESSIONS_DIR",
+		});
+	}
+	let st = null;
+	let missing = false;
+	try {
+		st = fs.lstatSync(dir);
+	} catch (err) {
+		if (err?.code === "ENOENT") missing = true;
+		else checks.push({ ok: false, warn: true, label: `checkpoint store ${shown} (${where}) could not be read (${err?.code ?? "error"})`, fix: "make it a directory this account can read, or point PI_CHECKPOINTS_DIR at one" });
+	}
+	if (missing) {
+		// The nearest ancestor that exists decides whether the checkpointer can create it, as `mkdir -p` would. One that
+		// exists and is NOT a directory (a file where a parent should be) is its own answer: `mkdir -p` fails on it.
+		let parent = dirname(dir);
+		let ancestor = null;
+		let blockedBy = null;
+		for (let i = 0; i < 64 && ancestor === null && blockedBy === null; i++) {
+			let pst = null;
+			try {
+				pst = fs.statSync(parent);
+			} catch {
+				pst = null;
+			}
+			if (pst?.isDirectory()) ancestor = parent;
+			else if (pst) blockedBy = parent;
+			else {
+				const up = dirname(parent);
+				if (up === parent) break;
+				parent = up;
+			}
+		}
+		let writable = false;
+		if (ancestor) {
+			try {
+				fs.accessSync(ancestor, fsConstants.W_OK | fsConstants.X_OK);
+				writable = true;
+			} catch {
+				writable = false;
+			}
+		}
+		checks.push(
+			writable
+				? { ok: true, label: `checkpoint store ${shown} (${where}) does not exist yet: it is created with mode 0700 inside ${envValueShown(ancestor)} when a durable run first writes one` }
+				: { ok: false, warn: true, label: `checkpoint store ${shown} (${where}) does not exist and cannot be created: ${ancestor ? `${envValueShown(ancestor)} is not writable by this account` : blockedBy ? `${envValueShown(blockedBy)} above it is not a directory` : "no directory above it exists"}`, fix: `create it as the worker's account: mkdir -p ${shown} && chmod 700 ${shown}` },
+		);
+	} else if (st) {
+		if (st.isSymbolicLink()) {
+			checks.push({ ok: false, warn: true, label: `checkpoint store ${shown} (${where}) is a symbolic link, so what a restore reads lives wherever it points`, fix: `replace it with a real directory: rm ${shown} && mkdir -p ${shown} && chmod 700 ${shown}` });
+		} else if (!st.isDirectory()) {
+			checks.push({ ok: false, warn: true, label: `checkpoint store ${shown} (${where}) is not a directory`, fix: `move it aside and create a directory there: mkdir -p ${shown} && chmod 700 ${shown}` });
+		} else {
+			// No uid (Windows): ownership and the mode bits mean nothing there, so neither is judged.
+			const problems = [];
+			if (Number.isInteger(uid) && st.uid !== uid) problems.push(`owned by uid ${st.uid}, not this account (uid ${uid})`);
+			if (Number.isInteger(uid) && (st.mode & 0o777) !== 0o700) problems.push(`mode ${(st.mode & 0o777).toString(8).padStart(4, "0")}, not 0700`);
+			checks.push(
+				problems.length === 0
+					? { ok: true, label: `checkpoint store ${shown} (${where}) is a private directory of this account's` }
+					: { ok: false, warn: true, label: `checkpoint store ${shown} (${where}) is ${problems.join(" and ")}: a checkpoint holds a job's whole workspace, as private as a transcript`, fix: `as the worker's account: chown "$(id -u)" ${shown} && chmod 700 ${shown}` },
+			);
+		}
+	}
+	if (underTemp(dir)) {
+		checks.push({ ok: false, warn: true, label: `checkpoint store ${shown} is under the OS temp dir, which the OS sweeps: a durable run would resume from nothing after a reboot or a cleaner pass`, fix: "point PI_CHECKPOINTS_DIR (or PI_SESSIONS_DIR) at a durable private directory" });
 	}
+	const version = parseGitVersion(gitVersion);
+	const [minMajor, minMinor] = CHECKPOINT_GIT_MIN;
+	if (version === null) {
+		checks.push({ ok: false, warn: true, label: "checkpoint store: `git --version` did not answer, so whether git is 2.32 or newer is not known", fix: "install git 2.32 or newer on the worker's PATH" });
+	} else if (version[0] < minMajor || (version[0] === minMajor && version[1] < minMinor)) {
+		checks.push({ ok: false, warn: true, label: `checkpoint store: git ${version.join(".")} is older than 2.32, which ignores GIT_CONFIG_GLOBAL, so the store's git keeps one of its two guards against this host's own config`, fix: "install git 2.32 or newer on the worker's PATH" });
+	} else {
+		checks.push({ ok: true, label: `checkpoint store: git ${version.join(".")} (2.32 or newer)` });
+	}
+	for (const venue of venues) {
+		const word = BACKENDS[venue]?.declares?.pausable ?? ABSENT;
+		let label;
+		const exitOnly = "so its jobs get exit checkpoints only, taken once the container is gone, and are not recovered from a worker crash mid-run";
+		if (word === ABSENT) label = `checkpoint store: ${venue} declares no freeze, ${exitOnly}`;
+		else if (venue === PODMAN_BACKEND) {
+			const can = podmanPausable(podmanRead);
+			label =
+				can.pausable === true
+					? `checkpoint store: ${venue} can freeze a job while its workspace is read (podman pause, cgroup v2)`
+					: can.pausable === false
+						? `checkpoint store: ${venue} cannot freeze a job here (rootless Podman on cgroup v1), ${exitOnly}`
+						: `checkpoint store: whether ${venue} can freeze a job is not known (podman info did not answer: ${can.reason}); on cgroup v1 it cannot, ${exitOnly}`;
+		} else label = `checkpoint store: ${venue} can freeze a job while its workspace is read (docker pause, the cgroup freezer)`;
+		checks.push({ ok: true, label });
+	}
+	return checks;
 }
 
 /**
@@ -1276,6 +1679,22 @@ export async function collectChecks(shellVars, seams) {
 	// ioredis's SELECT. It is a ✗ of its own, the worker's refusal (exit 2), and nothing below contacts a Valkey.
 	const valkeyDbProblem = unreadValkey ? null : valkeyUrlProblem(valkeyUrl);
 	const provider = env.PI_PROVIDER ?? "anthropic";
+	// Issue #673: is the service's PI_MODEL or PI_PROVIDER outside the one id shape (`modelFrom`, `providerFrom`)? Judged
+	// once, here, because the answer decides more than its own row (review round 1): the older rows that judge the same
+	// value (the provider-key row, the trigger-secret clash row and the deployment default's catalog row) are skipped for
+	// a malformed one. They print the value, so a control byte would reach the terminal, and their fix ("set PI_PROVIDER to
+	// a provider pi has") is not the one the boot refusal asks for; one root cause prints one row. A well-shaped value is
+	// judged by them unchanged. Null when the setting is unset or well-shaped, else the worker's own refusal message.
+	const envShapeProblem = {};
+	for (const [name, judge] of [["PI_MODEL", modelFrom], ["PI_PROVIDER", providerFrom]]) {
+		envShapeProblem[name] = null;
+		if (typeof env[name] !== "string") continue;
+		try {
+			judge(env);
+		} catch (err) {
+			envShapeProblem[name] = err?.message ?? "invalid";
+		}
+	}
 	// Issue #464 (gate round 1): this host's declared worker name, resolved with every other service key. Every reader
 	// below (the fleet line and its routing warning, the per-host backend wording, which cron triggers are scheduled
 	// here) uses this value: read from the shell alone, a deployment whose `.env` names its worker was told host routing
@@ -1290,8 +1709,25 @@ export async function collectChecks(shellVars, seams) {
 	let patFromFile = null;
 
 	const checks = [];
+	// Issue #712: the section each check was added in, for its published id (`assignCheckIds`, doctor-results.mjs). Each
+	// `section(name)` call hands every check added since the last one to the section that was current, then opens `name`.
+	// A WeakMap rather than a field on the check: a check may be a shared or frozen object, and a write to a frozen one
+	// throws in this strict module. Read back through `seams.checkSection`, set again on every collection (`--fix`
+	// re-collects).
+	const sectionOf = new WeakMap();
+	let currentSection = "node";
+	const tagSection = (list, name) => {
+		for (const c of list) if (c !== null && typeof c === "object" && !sectionOf.has(c)) sectionOf.set(c, name);
+	};
+	const section = (name) => {
+		tagSection(checks, currentSection);
+		currentSection = name;
+	};
+	seams.checkSection = (c) => sectionOf.get(c) ?? null;
+	section("node");
 	checks.push(nodeCheck(nodeVersion));
 
+	section("env");
 	checks.push({
 		ok: fileExists(join(cwd, ".env")),
 		warn: true, // advisory: env may be supplied by a service manager instead of a file
@@ -1390,10 +1826,11 @@ export async function collectChecks(shellVars, seams) {
 	// disagreement is said once at the end rather than lost.
 	const envPathShown = serviceEnvFile?.path ?? join(cwd, ".env");
 	// PR #474's round cap: each CLI variable the file sets, which no program doctor starts is handed.
-	checks.push(...cliNotHandedLines(service, envPathShown));
+	checks.push(...cliNotHandedLines(service, envPathShown, { openshellUsed: venuesOf(env).openshellUsed }));
 	const saidAtTop = { disagreements: service.disagreements.length, unread: service.unread.length };
 	// A CLI variable is not listed as read: no program doctor starts used it, and its own ⚠ says so.
 	checks.push(...serviceEnvLines(service, envPathShown, { said: ["VALKEY_URL", "PI_PROVIDER", ...GITHUB_SERVICE_KEYS, "PI_JOBS_DIR", "PI_SANDBOX_DIR", "TMPDIR", ...CLI_KEY_NAMES] }));
+	section("image");
 	if (jobImageRefused) {
 		checks.push({
 			ok: false,
@@ -1405,6 +1842,12 @@ export async function collectChecks(shellVars, seams) {
 	// Issue #354: which venues run jobs here. An unparseable PI_BACKENDS reads as the unset default, so every docker line
 	// below is exactly what it always was, and the backend section is what fails on it (the worker refuses to boot).
 	const { localUsed, podmanUsed, podmanDefault } = venuesOf(env);
+	// Issue #707: where an openshell-only deployment's Valkey runs (`openshellSetupOf`, the rule `up` and `service install`
+	// follow): on the gateway's engine, docker by default. The Valkey lines' fixes name THAT engine's way to start it, as
+	// they name docker's where `local` is blessed and the Quadlet unit's where `podman` is.
+	const openshellSetup = openshellSetupOf(venuesOf(env), env);
+	const valkeyVenues = { localUsed: localUsed || openshellSetup.valkeyEngine === "docker", podmanUsed: podmanUsed || openshellSetup.valkeyEngine === "podman" };
+	section("docker");
 	// THE FIRST DOCKER CALL OF THE RUN, which is why it was the one that hung (issue #397): a daemon that
 	// accepts the connection and never answers held doctor here, before it had printed anything. Bounded
 	// now, and the three outcomes are three different sentences, because telling someone whose daemon is
@@ -1446,9 +1889,17 @@ export async function collectChecks(shellVars, seams) {
 	// image checks just below, and `optingOut`/`requiring` colour the staged-packages lines further down.
 	// `optingOut` counts the only value that withholds the staged set; `requiring` counts an explicit
 	// run.packages: true, which arms nothing any more but is still an operator statement of intent.
-	const { requiring, waiting, listing, waitProfiles, waitAfters, optingOut, resuming, replicating, instructing, commands, secreting, onceArmed, onceSpent, secretProfiles, localSecretFolders, secretNames, folders, images, imageRoutes, namedBackends, skillsDirs, forges, repositories, flows, costCaps, modelRuns, parseError, path: triggersFilePath } = readTriggerFacts(env, fileExists, cwd, declaredWorkerName);
+	// Issue #761: the version tables, and the versions this build reads, that the store-version needs are judged by,
+	// per store: `{ settings: { supported, table, valueTable }, pauseWindows: { supported, table }, triggers: { supported,
+	// runTable, blockTable }, jobData: { table } }`, each part the store module's own when absent. This seam is how a test
+	// drives a need above 1 through the real collection, for a store whose table has no row of its own and at a version no row holds yet.
+	const versionTables = seams.versionTables ?? {};
+	const { watchSources: triggerWatchSources, watchRules: triggerWatchRules, modelRoles: triggerModelRoles, secretBundles: triggerBundles, requiring, waiting, listing, waitProfiles, waitAfters, optingOut, resuming, recovering, replicating, instructing, commands, secreting, onceArmed, onceSpent, secretProfiles, localSecretFolders, secretNames, folders, images, imageRoutes, namedBackends, skillsDirs, forges, repositories, flows, excludedNames, costCaps, modelRuns, triggersVersionNeed, jobDataVersionNeed, parseError, parseNewer: triggersFileIsNewer, path: triggersFilePath } = readTriggerFacts(env, fileExists, cwd, declaredWorkerName, versionTables);
+	const modelRoleProjects = readProjectFacts(env, fileExists).projects;
 	const scopedLimitFacts = readScopedLimitFacts(env, fileExists);
-	const pauseWindowFacts = readPauseWindowFacts(env, fileExists);
+	const pauseWindowFacts = readPauseWindowFacts(env, fileExists, versionTables.pauseWindows);
+	section("triggers");
+	checks.push(...watchDoctorChecks({ sources: triggerWatchSources, rules: triggerWatchRules, env }));
 	// FIRST, and fail rather than warn: every check below this line reads counts that a parse failure
 	// zeroed, so a green run here would be reporting on a file nobody could read. The receiver loads this
 	// file unconditionally and refuses to start without it, which is the consequence worth naming.
@@ -1461,6 +1912,7 @@ export async function collectChecks(shellVars, seams) {
 	if (triggersSet !== undefined && !fileExists(triggersPath(env, cwd))) {
 		const note = fromFileNote(fileSays("PI_TRIGGERS_FILE"));
 		checks.push({
+			id: "triggers.file-missing",
 			ok: false,
 			label: triggersSet === ""
 				? `PI_TRIGGERS_FILE is set to an empty value, which neither process reads as unset: the worker and the receiver refuse to start on it (exit 2)${note}`
@@ -1470,17 +1922,24 @@ export async function collectChecks(shellVars, seams) {
 	}
 	if (parseError) {
 		checks.push({
+			// Named (issue #712): the console quotes it beside "the triggers file does not load".
+			id: "triggers.file",
 			ok: false,
 			// "is refused at load" rather than "does not parse", because since issue #313 it is no longer
 			// only a syntax error: a duplicate key parses perfectly and is refused anyway. The loader's own
 			// message says which, and the old wording sent an operator hunting for a syntax error that was
 			// not there. It still covers the JSON case, whose message begins "is not valid JSON".
 			label: `triggers file is refused at load -- the receiver will refuse to start: ${parseError}`,
-			fix: `fix ${triggersFilePath} so it loads (the message above names the entry and the reason), then re-run doctor -- every trigger-derived check below is skipped until it loads`,
+			// Issue #761: a file a newer pi-dispatch wrote is no broken file, and editing it would lose what that release wrote.
+			fix: triggersFileIsNewer
+				? `${newerFileFix("this host's worker and receiver")} -- every trigger-derived check below is skipped until this host reads it`
+				: `fix ${triggersFilePath} so it loads (the message above names the entry and the reason), then re-run doctor -- every trigger-derived check below is skipped until it loads`,
 		});
 	}
+	section("dollars");
 	checks.push(...dollarChecks(env, costCaps, triggersSet !== undefined));
 
+	section("image");
 	// Only meaningful if docker itself responds; otherwise the image check is noise on top of a down daemon. Issue #433:
 	// and never without `local`, where the podman section's line (the image in THIS ACCOUNT'S store) is the image check.
 	const imageRun = dockerRun === null ? null : dockerCode === 0 ? await runCmd(spawn, "docker", ["image", "inspect", jobImage], runTimeouts.cmd) : { code: null, ended: "error" };
@@ -1526,6 +1985,7 @@ export async function collectChecks(shellVars, seams) {
 			: {}),
 	});
 
+	section("triggers");
 	// REQ-PER-TRIGGER-SKILLS (issue #60). Every distinct `run.skillsDir`, checked BEFORE anything fires,
 	// because the worker's own gate for these refuses at job time -- correct, but at 03:00 in a log nobody
 	// is reading. A deployment naming none adds no lines at all, so its output is byte-identical.
@@ -1584,14 +2044,20 @@ export async function collectChecks(shellVars, seams) {
 	// (DES-FLOW-RESOLUTION-TWO-ADVISORY-LAYERS): these probes read dir names, and a frontmatter
 	// `name:` rename is invisible to them, so a ⚠ here can be wrong in only the loud direction.
 	// A deployment with no triggers adds no lines at all, so its output is byte-identical.
+	// Issue #800: the same answer per trigger, for the record of what this host's jobs can load (`publishResults`). Set afresh
+	// on every collection, so a `--fix` re-collect replaces it, as `seams.checkSection` is.
+	seams.flowRows = [];
 	if (flows.length > 0) {
 		// One stage read for the whole run; each tuple's staged probe is a lookup on its result.
-		const staged = readStagedSkills({ globalPiDir: env.PI_GLOBAL_PI_DIR, readFile: (p) => readFileSync(p, "utf8"), fileExists });
+		const flowFs = seams.flowFs ?? { statSync, readFileSync, readdirSync };
+		const stagedProbes = flowProbes({ fileExists, fs: flowFs });
+		const staged = readStagedSkills({ globalPiDir: env.PI_GLOBAL_PI_DIR, readFile: stagedProbes.readFile, fileExists: stagedProbes.fileExists, readDir: stagedProbes.readDir });
 		const groups = new Map();
 		for (const f of flows) {
-			const key = JSON.stringify([f.flow, f.folder, f.skillsDir, f.packages]);
-			if (!groups.has(key)) groups.set(key, { ...f, labels: [] });
+			const key = JSON.stringify([f.flow, f.folder, f.skillsDir, f.packages, f.excludeExtensions]);
+			if (!groups.has(key)) groups.set(key, { ...f, labels: [], triggers: [] });
 			groups.get(key).labels.push(f.label);
+			groups.get(key).triggers.push(f.index);
 		}
 		for (const g of groups.values()) {
 			const at = g.labels.join(", ");
@@ -1605,37 +2071,18 @@ export async function collectChecks(shellVars, seams) {
 					label: `Trigger flow ${JSON.stringify(g.flow)} fails the skill name charset (${at})`,
 					fix: "a flow name must match the skill charset (lowercase alphanumerics, - and _, 64 max), or no tier can ever hold it -- fix run.flow",
 				});
+				// No tier can hold it, and a name that fails the charset is not published.
+				for (const trigger of g.triggers) seams.flowRows.push({ trigger, flow: null, tier: "none", package: null, repo: "unknown" });
 				continue;
 			}
-			let resolved = null;
-			const checked = [];
-			const unknown = [];
-			if (g.folder) {
-				const state = await repoFlowAtHead(spawn, g.folder, g.flow);
-				if (state === "present") resolved = `repo .pi/skills at HEAD of ${g.folder}`;
-				else if (state === "absent") checked.push("repo .pi/skills at HEAD");
-				else unknown.push(`repo (${g.folder} is not readable as a git repo here)`);
-			} else {
-				unknown.push("repo (a forge clone, not on this host)");
-			}
-			if (!resolved && g.skillsDir) {
-				if (fileExists(join(g.skillsDir, g.flow, "SKILL.md"))) resolved = `injected run.skillsDir ${g.skillsDir}`;
-				else checked.push("injected run.skillsDir");
-			}
-			if (!resolved && env.PI_GLOBAL_PI_DIR) {
-				if (fileExists(join(env.PI_GLOBAL_PI_DIR, "skills", g.flow, "SKILL.md"))) resolved = "the overlay skills/";
-				else checked.push("overlay skills/");
-			}
-			if (!resolved) {
-				if (!g.packages) {
-					checked.push("staged packages (withheld: run.packages false)");
-				} else {
-					const hit = staged.skills.find((s) => s.name === g.flow);
-					if (hit) resolved = `staged package ${hit.package}`;
-					else if (staged.unenumerable.length > 0) unknown.push(`staged package(s) ${staged.unenumerable.join(", ")} (manifest patterns, not enumerable here)`);
-					else checked.push("staged packages");
-				}
-			}
+			const probes = flowProbes({ fileExists, fs: flowFs });
+			const found = await flowTierOf(g, { repoFlowAtHead: (folder, flow) => repoFlowAtHead(spawn, folder, flow), fileExists: probes.fileExists, overlay: env.PI_GLOBAL_PI_DIR, staged });
+			const { resolved, checked, unknown } = found;
+			// `none` says every tier was checked. Per question, and the stage's read only where this one looks in the stage: a
+			// trigger that withholds the packages did not, and another trigger's unreadable folder says nothing of this one's.
+			const blind = probes.blind() || (g.packages !== false && stagedProbes.blind());
+			const tier = found.tier === "none" && blind ? "unknown" : found.tier;
+			for (const trigger of g.triggers) seams.flowRows.push({ trigger, flow: g.flow, tier, package: found.package, repo: found.repo });
 			if (resolved) {
 				checks.push({ ok: true, label: `Trigger flow "${g.flow}" resolves (${at}: ${resolved})` });
 			} else {
@@ -1643,7 +2090,38 @@ export async function collectChecks(shellVars, seams) {
 					ok: false,
 					warn: true,
 					label: `Trigger flow "${g.flow}" resolves in NO tier visible here (${at})`,
-					fix: `checked: ${checked.join(", ") || "nothing checkable"}${unknown.length > 0 ? `; not checkable here: ${unknown.join(", ")}` : ""} -- commit .pi/skills/${g.flow}/SKILL.md, add the skill to run.skillsDir or the overlay skills/, or stage a package shipping it; a job of this trigger runs without the flow it names (the runner logs flow_not_loaded) and still exits 0`,
+					fix: `checked: ${checked.join(", ") || "nothing checkable"}${unknown.length > 0 ? `; not checkable here: ${unknown.join(", ")}` : ""} -- commit .pi/skills/${g.flow}/SKILL.md, add the skill to run.skillsDir or the overlay skills/, or stage a package shipping it (one already staged must be off this trigger's run.excludeExtensions, and run.packages must not be false); a job of this trigger runs without the flow it names (the runner logs flow_not_loaded) and still exits 0`,
+				});
+			}
+		}
+	}
+
+	// Issue #800: a name in run.excludeExtensions that this host holds neither way. No job refuses over it and nothing loads for it, since a host's overlay
+	// and stage are its own and the file is shared, but a typo in a list that keeps code out of a job reads as kept out. ⚠ and never ✗. Only against what
+	// was read: an overlay or manifest that cannot be read says nothing of a name, and has its own line. A trigger that withholds the packages is passed
+	// over: its name may be a package's, which that trigger never looks for.
+	{
+		const overlayDir = env.PI_GLOBAL_PI_DIR;
+		let held = null;
+		try {
+			const entries = readOverlayExtensionRows(overlayDir, { fs: seams.flowFs ?? { readFileSync, readdirSync, statSync } });
+			const manifest = overlayDir && fileExists(join(overlayDir, PACKAGES_SUBDIR, STAGE_MANIFEST)) ? readStageManifest({ globalPiDir: overlayDir, readFile: (p) => readFileSync(p, "utf8"), fileExists }) : { packages: [] };
+			if (entries !== null && manifest !== null) held = { overlay: entries.map((row) => row.name), packages: manifest.packages };
+		} catch {
+			held = null;
+		}
+		if (held !== null) {
+			const lines = new Map();
+			for (const { label, names, packages } of excludedNames) {
+				if (!packages) continue;
+				for (const name of extensionsNotHere(names, held)) lines.set(name, [...(lines.get(name) ?? []), label]);
+			}
+			for (const [name, labels] of lines) {
+				checks.push({
+					ok: false,
+					warn: true,
+					label: `run.excludeExtensions names ${JSON.stringify(name)}, and this host has no staged package or overlay extension of that name (${labels.join(", ")})`,
+					fix: "nothing loads for it here, so a job is not refused: fix the name if it is a typo, since a misspelled name keeps nothing out on a host that has the real one",
 				});
 			}
 		}
@@ -1660,6 +2138,7 @@ export async function collectChecks(shellVars, seams) {
 		checks.push({ ok: true, label: `${commands} command trigger(s): a command is only verifiable in-container -- the runner refuses an unregistered one before the prompt is sent (command-unregistered)` });
 	}
 
+	section("venues");
 	// Issue #41: every DISTINCT image a trigger names in run.image, minus the deployment default already
 	// checked above. Two silent-failure modes, and both used to be impossible because there was one image.
 	//   1. the image was never built -- a job that refuses pre-spend at 03:00 in a log nobody is reading, and
@@ -1722,6 +2201,7 @@ export async function collectChecks(shellVars, seams) {
 	// of the default image is what gates their podman half; its lines are still printed after the backend section, where
 	// they always were, so moving the read changed the order of spawns and not a byte of output.
 	const podman = podmanUsed ? await podmanChecks(env, seams, { jobImage, jobImageNote }) : null;
+	section("images");
 	for (const img of images.filter((i) => i !== jobImage)) {
 		if (dockerRun !== null && dockerCode === 0 && dockerRouted.has(img)) {
 			const run = await runCmd(spawn, "docker", ["image", "inspect", img], runTimeouts.cmd);
@@ -1759,6 +2239,7 @@ export async function collectChecks(shellVars, seams) {
 		}
 	}
 
+	section("egress");
 	// REQ-EGRESS-ALLOWLIST (issue #202). [] when PI_EGRESS=0, so a deployment that declined it gets
 	// byte-identical output. Gated on docker and the image, because two of these checks run a container and
 	// the rest are noise on top of a down daemon.
@@ -1841,7 +2322,9 @@ export async function collectChecks(shellVars, seams) {
 				: dockerCode === null
 					? { answered: false, reason: "docker-not-found", transient: true }
 					: null);
+	section("backends");
 	checks.push(...backendChecks(env, { endpoint, daemon, fs: seams.observationFs, unit: jobUser.unit, ...(podman ? { podman: podman.observed } : {}) }));
+	section("sizing");
 	// Issue #596: the default job size, and what this host's runtime says about the bounds a size becomes.
 	// Each venue this deployment runs, from that venue's own read: `undefined` leaves a venue out, null is "not read".
 	// Issue #596, phase 2: the host budget a worker started now would compute, from the same two reads, and what it means
@@ -1874,6 +2357,8 @@ export async function collectChecks(shellVars, seams) {
 			const total = { memMiB: least(f.memTotalMiB, f.userMemMiB), cpuCenti: least(Number.isSafeInteger(f.hostCpus) ? f.hostCpus * 100 : null, f.userCpuCenti) };
 			checks.push(...sizeSuggestionChecks({ projects: sizingProjects, limits: budgetChecksArgs.limits, env, records: read.records, budget: { memMiB: budgetView.memMiB, cpuCenti: budgetView.cpuCenti }, total, nowMs }));
 			if (read.skipped > 0) checks.push({ ok: true, label: `size suggestions: ${read.skipped} run record${read.skipped === 1 ? "" : "s"} over ${SIZING_RECORD_MAX_BYTES / 1024} KiB skipped, not read` });
+			// Issue #761: a record a newer pi-dispatch wrote is not folded into a suggestion (`readSizingRecords`), said so.
+			if (read.newerSkipped > 0) checks.push({ ok: true, label: `size suggestions: ${read.newerSkipped} run record${read.newerSkipped === 1 ? "" : "s"} from a newer pi-dispatch not read` });
 		}
 	}
 	// Issue #596, phase 2: the aggregate CPU reserve per venue, read (never written) the way the worker reads it.
@@ -1889,8 +2374,29 @@ export async function collectChecks(shellVars, seams) {
 		});
 		checks.push(...cpuReserveChecks(reserveReads, budgetView.cpuCenti));
 	}
+	section("job-user");
 	checks.push(...jobUser.checks);
+	section("podman");
 	if (podman) checks.push(...podman.checks);
+	section("openshell");
+	// Issue #683: the openshell venue's lines, asked by `--openshell` (before a deployment blesses it), or on every run
+	// once PI_BACKENDS does (blessable since #684).
+	// Issue #686 part 3: either OpenShell venue runs the section; copy mode's image line where `openshell` is blessed (or
+	// asked for with neither blessed), bind mode's lines where `openshell-bind` is.
+	const openshellVenues = venuesOf(env);
+	// Issue #712: whether this run judged the openshell venue, for the published record.
+	seams.openshellJudged = seams.openshell === true || Boolean(openshellVenues.openshellUsed);
+	if (seams.openshell === true || openshellVenues.openshellUsed) {
+		const { openshellChecks } = await import("./doctor-openshell.mjs");
+		const modes = { copy: openshellVenues.openshellCopyUsed || !openshellVenues.openshellUsed, bind: openshellVenues.openshellBindUsed };
+		// Bind mode's job-user line reads the same identity doctor's local and podman lines read.
+		const ids = seams.jobUserIdentity ? { ids: { euid: seams.jobUserIdentity.euid ?? null, egid: seams.jobUserIdentity.egid ?? null } } : {};
+		const osPlatform = seams.jobUserIdentity?.platform ?? seams.platform;
+		// The probe's source under the jobs dir the service will use (review round 2 of #714).
+		const probeJobsDir = Number.isInteger(seams.jobsDirUid) ? jobsDirPath(env, seams.jobsDirUid) : null;
+		checks.push(...(await openshellChecks(env, { image: jobImage, modes, ...ids, jobsDir: probeJobsDir || null, ...(osPlatform ? { platform: osPlatform } : {}), ...(seams.openshellRun ? { run: seams.openshellRun } : {}), ...(seams.openshellMkdtemp ? { mkdtemp: seams.openshellMkdtemp, rmdir: () => {} } : {}) })));
+		if (openshellVenues.openshellUsed) checks.push(...openshellUnitOrderChecks(seams, cwd));
+	}
 	if (facts) facts.jobUser = jobUser.forLive;
 	// Issue #596, phase 2: the CPU budget the parent's quota is read back against by `--live`.
 	if (facts) facts.cpuBudgetCenti = budgetView.cpuCenti ?? null;
@@ -1898,6 +2404,7 @@ export async function collectChecks(shellVars, seams) {
 	if (facts) facts.daemon = jobUser.daemon;
 	// Issue #354: which read-backs `--live` runs, and the podman venue's facts for its own.
 	if (facts) Object.assign(facts, { localUsed, podman: podman?.forLive ?? null });
+	section("selinux");
 	// Issue #355: on a Podman host that confines containers with SELinux, the directories a job mounts that the worker
 	// did NOT make, which it therefore never relabels. Read from the same facts and endpoint as the line above. Issue #354:
 	// the podman venue relabels on the same rule (its own directories only), so the same lines, ONCE when both venues do.
@@ -1905,6 +2412,7 @@ export async function collectChecks(shellVars, seams) {
 		checks.push(...(await selinuxLabelChecks({ folders, overlay: env.PI_GLOBAL_PI_DIR || null, spawn: seams.spawn })));
 	}
 
+	section("forges");
 	// The receiver itself, when the triggers file names ANY forge (issue #80). Only forge deliveries need
 	// the receiver at all, so a cron/local-only deployment gets no receiver noise here. WARNS rather than
 	// fails, same doctrine as the gitlab block below: a deployment can legitimately be mid-setup (or run
@@ -2005,6 +2513,27 @@ export async function collectChecks(shellVars, seams) {
 		} else {
 			checks.push({ ok: true, label: `forgejo triggers configured (${urlShown(env.FORGEJO_URL)})` });
 		}
+		// Measured on Forgejo 14.0.5: the author gate's permission lookup answers 403 unless the token's account is a site
+		// admin, a repository admin, or the actor themselves. Which token asks is the receiver's choice (OQ-043):
+		// FORGEJO_PERMISSION_TOKEN when set, a read:repository token of an admin account that no job ever holds; else
+		// FORGEJO_TOKEN, every job's token, whose account must then be an admin. Doctor cannot ask Forgejo either way
+		// (forgejo triggers name no repository, each delivery does), so it says which token is in use: a FACT LINE when the
+		// dedicated one is set, with the requirement in the label (issue #462's form), and a WARNING on the fallback,
+		// because the fallback is the configuration that puts an admin's token into every job.
+		const permissionToken = typeof env.FORGEJO_PERMISSION_TOKEN === "string" && env.FORGEJO_PERMISSION_TOKEN.trim() !== "";
+		if (permissionToken) {
+			checks.push({
+				ok: true,
+				label: "forgejo author-gate lookups use FORGEJO_PERMISSION_TOKEN: its account must be an admin (or the owner) of every repository the triggers serve and the token needs read:repository only, while FORGEJO_TOKEN, which every job carries, stays a write collaborator's (docs/forgejo.md)",
+			});
+		} else {
+			checks.push({
+				ok: false,
+				warn: true,
+				label: "FORGEJO_PERMISSION_TOKEN is unset, so forgejo author-gate lookups use FORGEJO_TOKEN: Forgejo answers them only to a repository admin, so that account must be one, and then every forgejo job carries an admin's token that can change repository settings and branch protection (OQ-043)",
+				fix: "keep FORGEJO_TOKEN's account a write collaborator, and set FORGEJO_PERMISSION_TOKEN to a read:repository token of an account that is an admin (or the owner) of the repositories; only the receiver reads it (docs/forgejo.md)",
+			});
+		}
 	}
 
 	// Issue #508: with the egress policy on, a job reaches a forge only over https on port 443.
@@ -2061,6 +2590,7 @@ export async function collectChecks(shellVars, seams) {
 		}
 	}
 
+	section("github");
 	// The default source `gh` mints job tokens from the operator's gh login, so the FULL-scope login token
 	// reaches every token-carrying job container — the opposite of the App path's per-repo short-lived
 	// tokens (CONST-TOKEN-SCOPED-PER-JOB). Both checks below warn, never fail: a local-only deployment with
@@ -2269,7 +2799,7 @@ export async function collectChecks(shellVars, seams) {
 	// is podman's answer to the question docker's endpoint read answers below: the token must not ride to another
 	// machine. A deployment with `local` probes on docker exactly as before, and only there: one hand-off of the token per
 	// doctor run, not one per venue, and that deployment's output unchanged.
-	const ghProbeBin = localUsed
+	const ghProbeBin = seams.setupReadOnly ? null : localUsed
 		? dockerCode === 0 && imageCode === 0
 			? "docker"
 			: null
@@ -2358,6 +2888,7 @@ export async function collectChecks(shellVars, seams) {
 		}
 	}
 
+	section("valkey");
 	// Issue #464 (gate rounds 1 and 2): WHOSE Valkey that is, on the podman venue, by the one rule the worker applies at
 	// boot and `service install` and `up` apply (`judgeValkeyListeners`). Reachable is not enough: on a shared host a
 	// VALKEY_URL that reaches another account's Valkey (its port, its ::1 for a `localhost` URL, or 0.0.0.0) passed here,
@@ -2375,7 +2906,7 @@ export async function collectChecks(shellVars, seams) {
 	})();
 	if (!unreadValkey && !valkeyDbProblem && seams.valkeyOwner) {
 		if (typeof env[VALKEY_SHARED_KEY] === "string") checks.push({ ok: false, warn: true, label: sharedShellIgnored(env[VALKEY_SHARED_KEY], join(cwd, ".env")), fix: "put PI_VALKEY_SHARED=1 in the deployment's .env if that Valkey is shared on purpose, and unset it in this shell" });
-		ownerVerdict = await seams.valkeyOwner(valkeyUrl, { shared: valkeySharedOn(sharedInFile), user: userNameOf(seams), envPath: join(cwd, ".env"), rootOk: !(podmanUsed && !localUsed) });
+		ownerVerdict = await seams.valkeyOwner(valkeyUrl, { shared: valkeySharedOn(sharedInFile), user: userNameOf(seams), envPath: join(cwd, ".env"), rootOk: !((podmanUsed && !localUsed) || openshellSetup.valkeyEngine === "podman") });
 	}
 	// A name that does not resolve here cannot be judged (gate round 3): said, and talked to no more than a refused one.
 	const valkeyUnresolved = ownerVerdict?.unresolved ? `VALKEY_URL's host ${ownerVerdict.unresolved} did not resolve here (${ownerVerdict.why}), so whose Valkey it reaches cannot be judged; the worker waits for it and retries` : null;
@@ -2409,7 +2940,7 @@ export async function collectChecks(shellVars, seams) {
 	} else if (valkeyAuthVerdict && (valkeyAuthVerdict.state === "noauth" || valkeyAuthVerdict.state === "wrongpass")) {
 		// Issue #468: a Valkey that refuses this deployment's credential answers, so "not reachable" would be the wrong
 		// sentence: it is the password, named by its key and where it came from, never its value.
-		checks.push({ ok: false, label: `Valkey (${urlShown(valkeyUrl)}) answers, and ${valkeyAuthVerdict.state === "noauth" ? "requires a password this deployment does not send" : `refuses the ${VALKEY_PASSWORD_KEY} this deployment sends`}: the worker refuses to start on it (exit 2)`, fix: valkeyAuthFix(valkeyAuthVerdict.state, { localUsed, podmanUsed, envPath: join(cwd, ".env") }) });
+		checks.push({ ok: false, label: `Valkey (${urlShown(valkeyUrl)}) answers, and ${valkeyAuthVerdict.state === "noauth" ? "requires a password this deployment does not send" : `refuses the ${VALKEY_PASSWORD_KEY} this deployment sends`}: the worker refuses to start on it (exit 2)`, fix: valkeyAuthFix(valkeyAuthVerdict.state, { ...valkeyVenues, envPath: join(cwd, ".env") }) });
 	} else checks.push({
 		ok: await probeValkey(valkeyTalkUrl),
 		label: `Valkey reachable (${urlShown(valkeyUrl)})${fromFileNote(fileSays("VALKEY_URL"))}`,
@@ -2418,9 +2949,11 @@ export async function collectChecks(shellVars, seams) {
 		// the deployment's VALKEY_PASSWORD in the docker CLI's environment, and doctor hands no program anything from
 		// `.env`). It names the step: `pi-dispatch up`, which starts it with the password, labels its container and volume
 		// with this folder, and asks before it uses a volume it cannot attribute. The words hold on both venues.
-		fix: localUsed
+		fix: valkeyVenues.localUsed
 			? "run `pi-dispatch up` in the deployment folder: it starts Valkey with the deployment's VALKEY_PASSWORD (or, in a folder /dispatch setup handed to compose, compose's own: `docker compose -p <folder name> --env-file .env -f deploy/docker-compose.yml -f deploy/docker-compose.valkey.yml up -d valkey`)"
-			: "run `pi-dispatch up` (or `pi-dispatch service install`) as this account: on the podman venue both start Valkey as a Quadlet unit under its Podman (docs/podman.md, setup step 6); a Valkey you run yourself, a distribution package say, works too",
+			: openshellSetup.valkeyEngine !== "podman"
+				? "run `pi-dispatch up` (or `pi-dispatch service install`) as this account: on the podman venue both start Valkey as a Quadlet unit under its Podman (docs/podman.md, setup step 6); a Valkey you run yourself, a distribution package say, works too"
+				: "run `pi-dispatch up` (or `pi-dispatch service install`) as this account: with PI_OPENSHELL_ENGINE=podman both start Valkey as a Quadlet unit under its Podman (the openshell venue's engine; no egress proxy is started for it); a Valkey you run yourself, a distribution package say, works too",
 	});
 
 	// Round 3 of PR #475's review: PI_VALKEY_PORT is the port compose publishes its Valkey on, and VALKEY_URL's is the one
@@ -2443,11 +2976,12 @@ export async function collectChecks(shellVars, seams) {
 	if (ownerVerdict?.heldBy) {
 		checks.push({ ok: true, label: `Valkey (${urlShown(valkeyUrl)}) answers from a listener of ${ownerVerdict.heldBy}${ownerVerdict.chosen ? `; the worker connects to ${ownerVerdict.chosen} only` : ""}` });
 	}
-	checks.push(...(await valkeyPasswordChecks({ verdict: valkeyAuthVerdict, context: valkeyContext, seams, valkeyUrl, valkeyTalkUrl, localUsed, podmanUsed, platform, statSeam, fileValue })));
+	checks.push(...(await valkeyPasswordChecks({ verdict: valkeyAuthVerdict, context: valkeyContext, seams, valkeyUrl, valkeyTalkUrl, ...valkeyVenues, platform, statSeam, fileValue })));
 	for (const other of ownerVerdict?.elsewhere ?? []) {
 		checks.push({ ok: false, warn: true, label: `another account also listens on an address VALKEY_URL's host resolves to: ${other}. The worker connects only to the address judged this account's, so it never reaches that one`, fix: "nothing to change for this deployment; a client that resolves the name itself (`pi-dispatch run` from a shell) may still reach it, so prefer VALKEY_URL=redis://127.0.0.1:<port>" });
 	}
 
+	section("fleet");
 	// --- the fleet (issue #57) -------------------------------------------------------------------------
 	//
 	// Every line here is gated on a peer actually existing, so a single-host deployment's output is
@@ -2463,7 +2997,12 @@ export async function collectChecks(shellVars, seams) {
 	// Valkey doctor reads, a host row is another party's text, and a control byte in a name or zone must not reach the
 	// terminal. The registry's own charset already refuses them at the source; this is the reader not relying on it.
 	const peers = (fleet.hosts ?? []).map((h) => ({ ...h, name: printable(h.name), tz: h.tz ? printable(h.tz) : h.tz })).filter((h) => h.name !== workerNameOf(declaredWorkerName));
-	if (!env.PI_WORKER_NAME && peers.length > 0) checks.splice(budgetChecksAt, budgetChecksHere.length, ...hostBudgetChecks(budgetView, { ...budgetChecksArgs, peers: true }));
+	if (!env.PI_WORKER_NAME && peers.length > 0) {
+		// The budget lines are re-said for a fleet IN PLACE, so they keep the section they were first said in (issue #712).
+		const again = hostBudgetChecks(budgetView, { ...budgetChecksArgs, peers: true });
+		tagSection(again, "sizing");
+		checks.splice(budgetChecksAt, budgetChecksHere.length, ...again);
+	}
 	// Issue #596, phase 2: this host's own row, when its worker runs and publishes one. Its host budget ledger is held
 	// against the size labels of the job containers each venue's runtime lists, read only when the row carries the ledger.
 	const selfRow = (fleet.hosts ?? []).find((h) => printable(h.name) === workerNameOf(declaredWorkerName)) ?? null;
@@ -2494,6 +3033,17 @@ export async function collectChecks(shellVars, seams) {
 	// no envelope that refuses every job is told why. `{ digest }`, `{ undecodable: true }` for a key that exists and does
 	// not decode (the worker's EXISTS still counts it as governed), or null (no split, or no answer: nothing is said).
 	const valkeyUsable = !(unreadValkey || valkeyRefused || valkeyDbProblem || valkeyAuthVerdict?.state === "dbrange");
+	// Issue #712: where this run's results are published, by the rule every read above obeys: the Valkey doctor may talk
+	// to, at the address the worker pins, or none. Named for this host as the worker names it, so a record and its
+	// registry row share a name.
+	// A declared name the worker refuses at boot (review round 1) is never a key: the worker's own rule, not a copy.
+	let publishName = null;
+	try {
+		publishName = workerNameFrom({ PI_WORKER_NAME: declaredWorkerName });
+	} catch {
+		publishName = null;
+	}
+	seams.publishTo = !valkeyUsable ? null : publishName === null ? { refused: "PI_WORKER_NAME is a name the worker refuses at boot" } : { url: valkeyTalkUrl, name: publishName, every: doctorIntervalHours(env) };
 	const appliedSplit = valkeyUsable ? await (seams.readAppliedSplit ?? defaultReadAppliedSplit)(valkeyTalkUrl) : null;
 	// Read only when there is a peer to compare against. Every line below is gated on a peer existing, and
 	// the SUBPROCESS has to be too: otherwise every `doctor` run on every single-host deployment spawns an
@@ -2515,6 +3065,17 @@ export async function collectChecks(shellVars, seams) {
 		// The one thing that is silently WRONG rather than merely undeclared. Without a declared name this
 		// host enqueues its own folder work to the SHARED queue, where a peer that has no such folder can
 		// pop it -- so the routing that makes a fleet safe is simply off, and nothing else says so.
+		// Issue #645: a durable run's checkpoint lives on ONE host, and its recovery is routed there through that host's own
+		// queue. Without a declared name the recovery goes to the SHARED queue, where a peer that holds no checkpoint can pop
+		// it and refuse it (`recovery-checkpoint-absent`), so every crash on this host ends the run instead of continuing it.
+		if (!declaredWorkerName && recovering > 0) {
+			checks.push({
+				ok: false,
+				warn: true,
+				label: `${recovering} trigger(s) arm run.recover, but this worker has peers and no PI_WORKER_NAME, so a crashed run's recovery is queued where a host without its checkpoint can take it`,
+				fix: "set PI_WORKER_NAME in this host's .env and restart: a recovery is routed to the host holding the run's checkpoint through that host's own queue, which only a named worker drains",
+			});
+		}
 		if (!declaredWorkerName) {
 			checks.push({
 				ok: false,
@@ -2589,6 +3150,10 @@ export async function collectChecks(shellVars, seams) {
 		// no edit to the file applies on it. Judged on the DECLARED version, or the derived one if that is higher (gate
 		// round 2). SKIPPED when this host's file does not load.
 		if (scopedLimitFacts.parseError === null) checks.push(...fleetSizeChecks(Math.max(Number(scopedLimitFacts.declaredVersion) || 0, scopedLimitsVersionFor(scopedLimitFacts.limits)), peers));
+		// Issue #761: the version each of this host's own stores needs (the higher of what the file declares and what its
+		// content needs, the size check's rule), by registry field, against what every peer publishes. A store whose file
+		// does not load here is left out: its own line already fails, and comparing would name the wrong hosts.
+		checks.push(...fleetStoreVersionChecks(storeVersionNeeds({ settingsFile: settingsFilePath(env, home), fileExists, pauseWindowFacts, triggersVersionNeed, jobDataVersionNeed, triggersParsed: parseError === null, settingsVersions: versionTables.settings }), peers));
 		// Issue #596, phase 2: each host's budget and use, and which hosts each project's size fits on, from every row that
 		// publishes a budget (this host's own included). SKIPPED when this host's scoped-limits file does not load.
 		if (scopedLimitFacts.parseError === null) checks.push(...fleetBudgetChecks((fleet.hosts ?? []).map((h) => ({ ...h, name: printable(h.name) })), { limits: scopedLimitFacts.limits, env }));
@@ -2601,6 +3166,16 @@ export async function collectChecks(shellVars, seams) {
 		// Said, rather than silently absent: "no peers" and "could not ask" are different facts.
 		checks.push({ ok: true, label: `Fleet: could not read the host registry (${printable(fleet.unreachable)})` });
 	}
+	// Issue #761: the pi-dispatch versions the live workers report, and this doctor's own against this host's running
+	// worker, after the peers block so the second is said on a single host too. Workers only: a receiver's status row is
+	// never a doctor input (INT-RECEIVER-STATUS-KEY).
+	checks.push(...fleetVersionChecks({ installed: PACKAGE_VERSION, self: selfRow, selfName: workerNameOf(declaredWorkerName), peers }));
+	// Issue #761: a dollar window counter below what this host's own records settled into it (`doctorDollarWindows`).
+	// Re-opened here, where whether this command may talk to the Valkey is known, from the same Valkey at the address the
+	// worker pins.
+	section("dollars");
+	checks.push(...(await doctorDollarWindows({ seams, env, home, url: valkeyUsable ? valkeyTalkUrl : null, localHost: workerNameOf(declaredWorkerName), fileExists })));
+	section("capacity");
 	// Issue #599, phase 2: how busy each host was over the last 7 days, one fact line per host, never a warning (nothing
 	// decides on it). On every deployment, a single host too: its own files are read when the run mirror is not. Read from
 	// the same Valkey the fleet was, with the registry rows just read (their running jobs count up to now), every Valkey
@@ -2614,6 +3189,8 @@ export async function collectChecks(shellVars, seams) {
 		if (envelopeHere.parseError === null) checks.push(...appliedSplitChecks(appliedSplit, envelopeHere.envelope ? envelopeDigest(envelopeHere.envelope) : NO_ENVELOPE_FINGERPRINT, workerNameOf(declaredWorkerName), peers));
 	}
 
+	section("provider");
+	const subscriptionCredentials = await doctorSubscriptionCredentials(env, { cwd, home, now: seams.wallClock ?? Date.now, configure: seams.subscriptionFactory });
 	// Which variable holds a provider's key is PI'S fact, asked of pi rather than copied (issue #286).
 	// The copy this replaced had anthropic's two variables in the WRONG precedence order, invented
 	// GOOGLE_API_KEY, and invented a `gemini` provider pi has never had -- three ways for doctor to bless
@@ -2667,7 +3244,8 @@ export async function collectChecks(shellVars, seams) {
 			hintUnread = true;
 		}
 	}
-	const keyCheck = providerKeyCheck({ provider, env: { ...env, ...keyFromFile }, agentDir: keyAgentDir, oracle, nodeOk: checks[0]?.ok, keyless: { endpoints: keylessEndpoints, models: keylessModels, unreadable: keylessUnreadable, hintModels, hintUnread } });
+	const subscriptionDefault = await subscriptionCredentials.check(provider);
+	const keyCheck = subscriptionDefault.managed ? subscriptionCredentialCheck(provider, subscriptionDefault) : providerKeyCheck({ provider, env: { ...env, ...keyFromFile }, agentDir: keyAgentDir, oracle, nodeOk: checks[0]?.ok, keyless: { endpoints: keylessEndpoints, models: keylessModels, unreadable: keylessUnreadable, hintModels, hintUnread } });
 	const keyNamed = Object.keys(keyFromFile).filter((name) => keyCheck.label?.includes(`: ${name})`));
 	// Issue #481 (PR #485 review round 2): a key found nowhere doctor can look is one an env-setup script may export, which
 	// is the documented home for a provider key fetched from a secrets manager (docs/secrets.md).
@@ -2678,9 +3256,12 @@ export async function collectChecks(shellVars, seams) {
 		: setupSupplies(["worker"])
 			? credentialAbsent({ subject: `Provider key (${provider}: ${keyAbsent.join(" or ")}) not set`, names: keyNames, readers: ["worker"], refusal: "jobs cannot authenticate to the provider", fix: keyShown.fix })
 			: { ...keyShown, fix: `${keyShown.fix}${notSupplied(keyNames, ["worker"])}` };
-	checks.push({ ...keyLine, label: `${keyLine.label}${fromFileNote([...fileSays("PI_PROVIDER"), ...keyNamed, ...(keyAgentDir !== agentDir ? ["PI_CODING_AGENT_DIR"] : [])])}` });
+	// Not for a malformed PI_PROVIDER: its shape row below is the one line (issue #673, review round 1).
+	// Issue #737: the console reads whether the key is found by this id (`NAMED_CHECK_IDS`).
+	if (envShapeProblem.PI_PROVIDER === null) checks.push({ ...keyLine, id: "provider.key", label: `${keyLine.label}${fromFileNote([...fileSays("PI_PROVIDER"), ...keyNamed, ...(keyAgentDir !== agentDir ? ["PI_CODING_AGENT_DIR"] : [])])}` });
 
 
+	section("overlay");
 	// REQ-GLOBAL-PI-OVERLAY: read the extensions opt-out through the WORKER's own parser, so doctor reports
 	// the exact posture the worker will boot with and refuses the exact values it refuses. Checked with or
 	// without an overlay configured, because a malformed knob stops boot either way -- and a `false` an
@@ -2893,7 +3474,7 @@ export async function collectChecks(shellVars, seams) {
 				// A model a capped job may use is named by the cost-cap line below (`costCapFitChecks`), which runs on the
 				// same catalog seam, so this line names only the rest: one line per model.
 				const capEndpoints = (seams.declaredEndpoints ?? ((a) => declaredEndpointsIn({ ...a, fs: keylessIo })))({ env, cwd: seams.cwd, platform: seams.platform ?? process.platform, valkeyUrl: keylessValkey });
-				const capped = usageCatalog ? cappedModelNames(env, { runs: parseError ? [] : modelRuns, deployment: deploymentSettingsOf(env, settingsFilePath(env, home), fileExists) }) : new Set();
+				const capped = usageCatalog ? cappedModelNames(env, { runs: parseError ? [] : modelRuns, deployment: deploymentSettingsOf(env, settingsFilePath(env, home), fileExists), modelRoles: triggerModelRoles, projects: modelRoleProjects }) : new Set();
 				const uncapped = ignoredOutputCapModels({ models: overlayModels, endpoints: capEndpoints, builtinModel: usageCatalog?.builtinModel, builtinChatModels: usageCatalog?.builtinChatModels }).filter((m) => !capped.has(`${m.provider}/${m.modelId}`));
 				if (uncapped.length > 0) {
 					const SHOWN = 5;
@@ -2927,7 +3508,7 @@ export async function collectChecks(shellVars, seams) {
 			}
 
 			// Staged pi packages (REQ-GLOBAL-PI-OVERLAY): pinned third-party code the operator staged with
-			// `import-pi --with-packages`, loaded by every job whose trigger did not set `run.packages: false`.
+			// `import-pi --with-packages`, loaded by every job whose trigger did not set `run.packages: false` or name it in `run.excludeExtensions`.
 			// Keyed on the dir the same way the extensions pair above is, so a deployment that stages none
 			// prints nothing here.
 			const packagesDir = join(overlay, PACKAGES_SUBDIR);
@@ -2983,7 +3564,7 @@ export async function collectChecks(shellVars, seams) {
 						});
 					}
 					// There is no dormant state left to report: a staged, manifested package loads into every
-					// job whose trigger did not opt out -- INCLUDING jobs no trigger file describes at all
+					// job whose trigger did not opt out or leave it out by name -- INCLUDING jobs no trigger file describes at all
 					// (a matched webhook, `dispatch_run`, the CLI). So "staged" IS "loading", and the honest
 					// line says so and names how much of the trigger file withholds it. Warn, never fail: this
 					// is the intended posture, and it is stated so a forgotten stage cannot read as inert.
@@ -2992,8 +3573,9 @@ export async function collectChecks(shellVars, seams) {
 					checks.push({
 						ok: false,
 						warn: true,
-						label: `Staged packages LOAD in every job (${optingOut} trigger(s) opt out with run.packages: false)`,
-						fix: "they run third-party code against adversarial input with open egress -- vet each, keep every version exactly pinned, and set run.packages: false on any trigger that must not load them",
+						// Counted against this host's manifest: a name in the list may be an overlay extension, which withholds no package, and a trigger with packages off is counted above.
+						label: `Staged packages LOAD in every job (${optingOut} trigger(s) opt out with run.packages: false, ${(excludedNames ?? []).filter((listed) => listed.packages && listed.names.some((name) => manifest.packages.some((staged) => staged.name === name))).length} leave one or more out with run.excludeExtensions)`,
+						fix: "they run third-party code against adversarial input with open egress -- vet each, keep every version exactly pinned, and on a trigger that must not load them set run.packages: false, or name one in run.excludeExtensions",
 					});
 
 					// A staged package whose --ignore-scripts build never ran (issue #102, comment 1). The
@@ -3096,6 +3678,7 @@ export async function collectChecks(shellVars, seams) {
 		});
 	}
 
+	section("waits");
 	// Issue #230, `run.waitFor`. The PARSE is asked unconditionally, and the rest only when something waits.
 	// That split is not the usual "only report what this deployment uses": `loadConfig` calls
 	// `parseWaitProfiles` on every boot whether or not a trigger holds anything, so a garbled variable is a
@@ -3167,6 +3750,18 @@ export async function collectChecks(shellVars, seams) {
 		});
 	}
 
+	section("models");
+	// Issue #673: PI_MODEL and PI_PROVIDER are held to the one model-id and provider-id shape a trigger's run.model and
+	// run.provider are (`modelFrom`, `providerFrom`), and a value outside it is a worker that will not boot. Judged by the
+	// worker's own functions (`envShapeProblem`, above), the PI_ALLOWED_MODELS row's rule below, on the SERVICE's value.
+	// Only a failing row: a good value is judged further by the provider-key and model-catalog lines, which a malformed one
+	// skips. The value is never echoed, as the worker's own refusal never echoes it; the setting's name is all an
+	// operator needs to find the line.
+	for (const name of ["PI_MODEL", "PI_PROVIDER"]) {
+		if (envShapeProblem[name] === null) continue;
+		checks.push({ ok: false, label: `${name} is not a valid ${name === "PI_MODEL" ? "model" : "provider"} id`, fix: `${envShapeProblem[name]} -- the worker refuses to boot until this is fixed` });
+	}
+
 	// Issue #502, allowed-model lists. The deployment list is judged unconditionally, `PI_WAIT_PROFILES`' rule: a
 	// malformed or spaced value is a worker that will not boot. Its grammar is the worker's own (`allowedModelsFrom`).
 	// The value doctor reads is the SERVICE's (`WORKER_SERVICE_KEYS`), so a spaced value in a `.env` a shell sources is
@@ -3208,6 +3803,10 @@ export async function collectChecks(shellVars, seams) {
 	// pi-ai does not load: the provider key line below already fails on that. A triggers file that did not load
 	// contributes no trigger (its own line says so), and the deployment's default is still judged for its cap.
 	{
+		let roleEnvList = null;
+		try { roleEnvList = allowedModelsFrom(env); } catch {}
+		// Role refusals are determinate without pi; a missing catalog must not hide invalid reviewed policy.
+		checks.push(...resolveDoctorModelRuns({ runs: parseError ? [] : modelRuns, deployment: deploymentSettingsOf(env, settingsFilePath(env, home), fileExists), envList: roleEnvList, modelRoles: triggerModelRoles, projects: modelRoleProjects }).checks);
 		const catalog = await (seams.modelCatalog ?? defaultModelCatalog)();
 		if (catalog) {
 			const overlayDir = typeof env.PI_GLOBAL_PI_DIR === "string" && env.PI_GLOBAL_PI_DIR !== "" ? resolve(cwd, env.PI_GLOBAL_PI_DIR) : null;
@@ -3224,37 +3823,110 @@ export async function collectChecks(shellVars, seams) {
 			} catch {
 				// A malformed PI_ALLOWED_MODELS is its own line above (the worker refuses to boot on it).
 			}
-			const subjects = modelSubjects({ runs: parseError ? [] : modelRuns, deployment: deploymentSettingsOf(env, settingsFilePath(env, home), fileExists), envList });
-			checks.push(...unknownModelChecks(subjects, catalog.checkModelsKnown, readOverlayDoc));
-			checks.push(...costCapFitChecks(subjects, (ref) => boundModelOf(ref, { builtinModel: catalog.builtinModel, overlay: overlayDoc }), { unboundable: (ref) => outputUnboundable(outputCapView({ models: overlayDoc, provider: ref.provider, modelId: ref.id, builtinModel: catalog.builtinModel, builtinChatModels: catalog.builtinChatModels })) }));
+			const subjects = modelSubjects({ runs: parseError ? [] : modelRuns, deployment: deploymentSettingsOf(env, settingsFilePath(env, home), fileExists), envList, modelRoles: triggerModelRoles, projects: modelRoleProjects });
+			const subscriptionChecks = new Map();
+			for (const subjectProvider of new Set(subjects.flatMap((subject) => [subject.main.provider, ...subject.list.map((ref) => ref.provider)]))) {
+				const result = await subscriptionCredentials.check(subjectProvider);
+				subscriptionChecks.set(subjectProvider, result);
+				if (subjectProvider !== provider && result.managed) checks.push(subscriptionCredentialCheck(subjectProvider, result));
+			}
+
+			// The deployment default's catalog row prints PI_PROVIDER/PI_MODEL: not for a malformed one, whose shape row is
+			// the one line (issue #673, review round 1).
+			const envShapeBad = envShapeProblem.PI_MODEL !== null || envShapeProblem.PI_PROVIDER !== null;
+			checks.push(...unknownModelChecks(envShapeBad ? subjects.filter((s) => s.deployment !== true) : subjects, catalog.checkModelsKnown, readOverlayDoc));
+			checks.push(...costCapFitChecks(subjects, (ref) => boundModelOf(ref, { builtinModel: catalog.builtinModel, overlay: overlayDoc }), { unboundable: (ref) => outputUnboundable(outputCapView({ models: overlayDoc, provider: ref.provider, modelId: ref.id, builtinModel: catalog.builtinModel, builtinChatModels: catalog.builtinChatModels })), apiOf: (ref) => outputCapView({ models: overlayDoc, provider: ref.provider, modelId: ref.id, builtinModel: catalog.builtinModel, builtinChatModels: catalog.builtinChatModels })?.api }));
 			checks.push(
 				...listedProviderCredentialChecks(subjects, {
 					candidatesOf: (name) => (typeof oracle?.providerKeyCandidates === "function" ? oracle.providerKeyCandidates(name) : []),
 					forwarded: (env.PI_FORWARD_ENV ?? "").split(",").map((name) => name.trim()).filter((name) => name !== ""),
 					env,
 					overlay: overlayDoc,
+					subscriptionChecks,
 				}),
 			);
 		}
 	}
 
+	// Read only configured model identities. A keyspace scan would expose retired configuration and make a
+	// doctor run's cost depend on everything else sharing this Valkey.
+	{
+		let envList = null;
+		try { envList = allowedModelsFrom(env); } catch {}
+		const refs = cooldownModelRefs(parseError ? [] : modelRuns, deploymentSettingsOf(env, settingsFilePath(env, home), fileExists), { modelRoles: triggerModelRoles, projects: modelRoleProjects, envList });
+		if (refs.length > 0) {
+			const state = valkeyUsable ? await (seams.readModelCooldowns ?? defaultReadModelCooldowns)(valkeyTalkUrl, refs, { now: seams.wallClock ?? Date.now }) : null;
+			checks.push(...modelCooldownChecks(state));
+		}
+	}
+
+	checks.push(...await doctorModelProposalChecks(env, { cwd, credentials: service.extra(["ANTHROPIC_API_KEY", "OPENAI_API_KEY"]).env, now: seams.wallClock ?? Date.now, ...(seams.modelProposals ?? {}) }));
+	section("secrets");
 	// REQ-TRIGGER-SECRETS. Only reported when a trigger actually binds one, on the run.resume block's
 	// reasoning below: a deployment that uses no secrets should not be told about a variable it has no
 	// reason to set.
 	if (secreting > 0) {
-		const { profiles: declared, error: parseFailure } = parseSecretProfilesSafe(env.PI_SECRET_PROFILES);
-		const names = Object.keys(declared).sort();
+		const { profiles: envDeclared, error: parseFailure } = parseSecretProfilesSafe(env.PI_SECRET_PROFILES);
+		const roots = delimitedList(env.PI_SECRET_RESOLVER_ROOTS);
 		if (parseFailure) {
 			checks.push({ ok: false, label: "PI_SECRET_PROFILES does not parse", fix: `${parseFailure} -- the worker refuses to boot until this is fixed, rather than dropping the entry and leaving you a profile you believe is wired` });
 		} else {
+			// Issue #704: the worker resolves a profile from PI_SECRET_PROFILES AND the settings overlay's
+			// `secretProfiles`, so a profile declared in the panel is declared, and reading env alone told an
+			// operator it was missing. The worker's rules, reused rather than restated: a name in both sources is
+			// ambiguous (`mergeSecretProfiles`, and the worker then refuses every secrets job), and an overlay
+			// profile counts only when its resolver is an executable file whose realpath sits inside
+			// PI_SECRET_RESOLVER_ROOTS (`servableSecretProfiles`, the lookup the resolver makes). An invalid
+			// overlay contributes nothing here; its own check below already fails doctor.
+			//
+			// The probe is the resolver's own (`secrets.mjs -> realExecutable`), through a dynamic import for the
+			// reason `providerOracle` gives: that module loads pi through `env-allowlist.mjs`, and a static import
+			// would make doctor itself fail to start when pi does not load. Without it only the usability probe is
+			// skipped: the ambiguity check needs no pi and still runs on the raw overlay, and an overlay profile then
+			// counts as declared as written (the pi failure is already its own failing line).
+			//
+			// OWN properties only, in every lookup below: the profile charset admits `toString` and `constructor`.
+			const settingsRead = fileExists(settingsFilePath(env, home)) ? readOverlay(settingsFilePath(env, home)) : { overlay: {} };
+			let realExecutablePath = null;
+			try {
+				({ realExecutable: realExecutablePath } = await import("./secrets.mjs"));
+			} catch {
+				realExecutablePath = null;
+			}
+			const overlayDeclared = settingsRead.invalid ? {} : (settingsRead.overlay?.secretProfiles ?? {});
+			const ambiguousNames = Object.keys(overlayDeclared).filter((name) => Object.hasOwn(envDeclared, name)).sort();
+			const unambiguous = Object.fromEntries(Object.entries(overlayDeclared).filter(([name]) => !Object.hasOwn(envDeclared, name)));
+			const overlayUsable = realExecutablePath === null ? unambiguous : servableSecretProfiles({ envProfiles: {}, overlayProfiles: unambiguous, roots, realExecutablePath }).profiles;
+			const declared = { ...envDeclared, ...overlayUsable };
+			const names = Object.keys(declared).sort();
+			if (mergeSecretProfiles(envDeclared, overlayDeclared).ambiguous) {
+				checks.push({
+					ok: false,
+					label: `${ambiguousNames.length} secret profile name(s) are declared in both PI_SECRET_PROFILES and the settings overlay: ${ambiguousNames.join(", ")}`,
+					fix: "remove each name from one of the two (neither source wins a collision) -- until then the worker refuses every job that binds secrets as secret-profile-ambiguous, whatever profile it names",
+				});
+			}
+			// Named by a trigger, declared in the overlay, and not usable: said apart from "not declared",
+			// because the fix is the resolver or the roots, not a new declaration.
+			const unusable = secretProfiles.filter((name) => Object.hasOwn(unambiguous, name) && !Object.hasOwn(overlayUsable, name));
+			if (unusable.length > 0) {
+				checks.push({
+					ok: false,
+					label: `${unusable.length} named secret profile(s) are declared in the settings overlay but not usable: ${unusable.join(", ")}`,
+					fix:
+						roots.length === 0
+							? "PI_SECRET_RESOLVER_ROOTS is unset, so the worker uses no overlay-declared resolver: set it to the directory the resolver lives in, or declare the profile in PI_SECRET_PROFILES -- these jobs refuse pre-spend as secret-profile-unknown until you do"
+							: "the resolver must be an executable file whose real path sits inside PI_SECRET_RESOLVER_ROOTS -- these jobs refuse pre-spend as secret-profile-unknown until it is",
+				});
+			}
 			// A HARD FAIL, not a warning, and worded like the run.resume/PI_SESSIONS_DIR check below for the
 			// same reason: these jobs refuse pre-spend until it is set, deliberately, rather than running
 			// without their secrets and looking like they worked.
-			const missing = secretProfiles.filter((name) => !(name in declared));
+			const missing = secretProfiles.filter((name) => !Object.hasOwn(declared, name) && !unusable.includes(name) && !ambiguousNames.includes(name));
 			checks.push({
 				ok: missing.length === 0,
 				label: missing.length === 0 ? `${secreting} trigger(s) bind secrets, and every profile they name is declared` : `${secreting} trigger(s) bind secrets, but ${missing.length} named profile(s) are not declared: ${missing.join(", ")}`,
-				fix: `declare them in PI_SECRET_PROFILES as name:/absolute/path pairs (a resolver is one line, e.g. \`exec op read --no-newline "$1"\`) -- these jobs refuse pre-spend until you do`,
+				fix: `declare them in PI_SECRET_PROFILES as name:/absolute/path pairs (a resolver is one line, e.g. \`exec op read --no-newline "$1"\`), or through the panel with PI_SECRET_RESOLVER_ROOTS set -- these jobs refuse pre-spend until you do`,
 			});
 			// The declared table, so an operator sees what is wired without reading .env. NAMES and paths only:
 			// this is doctor's own stdout on the operator's host, not a public issue comment.
@@ -3265,7 +3937,6 @@ export async function collectChecks(shellVars, seams) {
 			// when closed and a disclosure when open. Issue #462: the disclosure is a FACT LINE too, since the operator opened
 			// it on purpose and nothing but closing it again clears it, so its advice lives in the label (an `ok: true` check
 			// never prints a fix line).
-			const roots = (env.PI_SECRET_RESOLVER_ROOTS ?? "").split(delimiter).map((r) => r.trim()).filter(Boolean);
 			checks.push({
 				ok: true,
 				...(roots.length === 0
@@ -3290,7 +3961,7 @@ export async function collectChecks(shellVars, seams) {
 		// one would be permanently false and this check would silently never run. It is skipped rather than
 		// failed when pi did not load, because providerKeyCheck above has already reported that as its own ✗
 		// and one root cause should print one line.
-		if (secretNames.length > 0 && oracle?.providerKeyCandidates) {
+		if (secretNames.length > 0 && oracle?.providerKeyCandidates && envShapeProblem.PI_PROVIDER === null) {
 			const candidates = oracle.providerKeyCandidates(provider);
 			const clashing = secretNames.filter((n) => candidates.includes(n));
 			checks.push({
@@ -3312,6 +3983,60 @@ export async function collectChecks(shellVars, seams) {
 		}
 	}
 
+	// Issue #704: the project secret bundles (doctor-bundles.mjs says what each line is for). Silent on a deployment that
+	// binds no bundle and declares no bundle profile. The overlay and the probe are read the way the run.secrets block
+	// above reads them, and `--secrets` (seams.secrets) resolves each bundle here, names only.
+	{
+		const bundleSettingsPath = settingsFilePath(env, home);
+		const bundleSettings = fileExists(bundleSettingsPath) ? readOverlay(bundleSettingsPath) : { overlay: {} };
+		const overlayBundles = bundleSettings.invalid ? {} : (bundleSettings.overlay?.secretBundles ?? {});
+		const anyBundle = Object.keys(triggerBundles ?? {}).length > 0 || (env.PI_SECRET_BUNDLES ?? "").trim() !== "" || Object.keys(overlayBundles).length > 0;
+		// Review round 2: the named residual. A worker that declares no bundle profile and has no triggers file reads "no
+		// bundles", so on a fleet a project another host's file binds would run here without its environment, with no
+		// skip reason. Doctor cannot see another host's file, so it warns where the shape allows it: a multi-host worker
+		// (PI_WORKER_NAME) with projects and no triggers file of its own.
+		if (!anyBundle && typeof env.PI_WORKER_NAME === "string" && env.PI_WORKER_NAME.trim() !== "" && !fileExists(triggersPath(env, cwd))) {
+			const fleetProjects = readProjectFacts(env, fileExists);
+			if (fleetProjects.parseError === null && fleetProjects.projects.length > 0) {
+				checks.push({ ok: true, warn: true, label: "this fleet worker has projects but no triggers file, so it applies no project secret bundle: a project another host's triggers.json binds would run here without its environment", fix: "keep the same triggers.json on every host (PI_TRIGGERS_FILE), or declare the bundle profiles here, which makes a missing file a retry instead" });
+			}
+		}
+		if (anyBundle) {
+			let realExecutablePath = null;
+			try {
+				({ realExecutable: realExecutablePath } = await import("./secrets.mjs"));
+			} catch {
+				realExecutablePath = null;
+			}
+			const projectFacts = readProjectFacts(env, fileExists);
+			let resolveBundle = null;
+			if (seams.secrets === true) {
+				try {
+					const { makeBundleResolver } = await import("./secret-bundles.mjs");
+					const { parseSecretBundleProfilesSafe } = await import("./doctor-bundles.mjs");
+					const resolver = makeBundleResolver({ envBundles: parseSecretBundleProfilesSafe(env.PI_SECRET_BUNDLES).bundles, roots: delimitedList(env.PI_SECRET_RESOLVER_ROOTS), forwardEnv: (env.PI_FORWARD_ENV ?? "").split(",").map((n) => n.trim()).filter((n) => n !== ""), hostEnv: spawnEnv, timeoutMs: Math.max(BUNDLE_DOCTOR_TIMEOUT_MS, Number(env.PI_SECRET_RESOLVE_TIMEOUT_MS) || 0), ...(seams.bundleSpawn ? { spawnFn: seams.bundleSpawn } : {}) });
+					resolveBundle = (binding) => resolver.resolve({ provider }, binding, { overlayBundles });
+				} catch {
+					checks.push({ ok: false, label: "--secrets could not load the bundle resolver (pi did not load; its own line above says why)" });
+				}
+			}
+			checks.push(
+				...(await secretBundleChecks({
+					bundles: triggerBundles ?? {},
+					triggersPresent: fileExists(triggersPath(env, cwd)),
+					projects: projectFacts.projects,
+					projectsError: projectFacts.parseError,
+					envRaw: env.PI_SECRET_BUNDLES,
+					overlayBundles,
+					roots: delimitedList(env.PI_SECRET_RESOLVER_ROOTS),
+					realExecutablePath,
+					resolveBundle,
+				})),
+			);
+		}
+	}
+
+	section("sessions");
 	// REQ-RESUMABLE-SESSION. Only reported when a trigger actually asked for it: a deployment that does
 	// not use resume should not be told about a directory it has no reason to create.
 	if (resuming > 0) {
@@ -3389,6 +4114,30 @@ export async function collectChecks(shellVars, seams) {
 		}
 	}
 
+	// Issue #645: the checkpoint store, only where one is configured (PI_CHECKPOINTS_DIR, or the default inside
+	// PI_SESSIONS_DIR). Never a ✗: only a job that arms run.recover writes it, a fault costs that run its recovery and never
+	// the job, and a deployment without durable runs must not fail doctor over a store it does not use. One `git --version`, bounded like every other spawn here.
+	const checkpointsDir = checkpointsDirPath(env);
+	if (checkpointsDir) {
+		// The hardening flags lead even here, where no repository is read, because the bolt that pins every host-side git
+		// argv to them (`prepare-local.test.mjs`) is worth more unbroken than one `--version` is without them.
+		const gitRead = await runCmdCapture(spawn, "git", [...GIT_READ_FLAGS, "--version"], { timeoutMs: runTimeouts.cmd, stdoutOnly: true });
+		checks.push(
+			...checkpointStoreChecks({
+				dir: checkpointsDir,
+				explicit: Boolean(env.PI_CHECKPOINTS_DIR),
+				sessionsDir: env.PI_SESSIONS_DIR || null,
+				fs: seams.checkpointFs,
+				uid: Object.hasOwn(seams, "checkpointUid") ? seams.checkpointUid : process.geteuid?.(),
+				underTemp: (path) => underTemp(path, env),
+				gitVersion: gitRead.code === 0 ? gitRead.output : null,
+				venues: blessedList ?? [DEFAULT_BACKEND],
+				podmanRead: podman?.observed?.read ?? null,
+			}),
+		);
+	}
+
+	section("triggers");
 	// REQ-PER-TRIGGER-INSTRUCTION. A plain fact line, not a warning: standing text is an ordinary operator
 	// choice. It is reported at all because it changes what EVERY job of that trigger is told, and unlike a
 	// flow (which lives in the repo, reviewed by a merge) it lives only in triggers.json, so nothing else
@@ -3443,6 +4192,7 @@ export async function collectChecks(shellVars, seams) {
 		});
 	}
 
+	section("files");
 	// REQ-SCOPED-PAUSE-WINDOWS, the panel-writes-what-the-worker-ignores trap (issue #99). Three defaults
 	// that are individually defensible and together silent:
 	//
@@ -3639,12 +4389,19 @@ export async function collectChecks(shellVars, seams) {
 			const verdict = loadVerdict(spec, fileRaw, cwd, seamsForLoad, platform);
 			checks.push(
 				verdict.ok
-					? { ok: true, label: `${spec.key} is set in ${join(cwd, ".env")} (${envValueShown(fileRaw)})${alsoExported === undefined ? "" : ", for this platform's loader,"} and loads: the service reads that file, this shell does not` }
+					? { id: bootFileId(spec), ok: true, label: `${spec.key} is set in ${join(cwd, ".env")} (${envValueShown(fileRaw)})${alsoExported === undefined ? "" : ", for this platform's loader,"} and loads: the service reads that file, this shell does not` }
 					: {
+							id: bootFileId(spec),
 							ok: false,
 							warn: envSetup !== null,
 							label: `${spec.key} is set in ${join(cwd, ".env")} (${envValueShown(fileRaw)}) to a file the worker cannot load, so a service started from it ${spec.fails}: ${verdict.reason}`,
-							fix: envSetup !== null ? `${envSetup} runs after that file and may replace it; if it does not, fix ${envValueShown(fileRaw)} or point the key at a file that loads` : `fix ${envValueShown(fileRaw)}, or point ${spec.key} at a file that loads`,
+							fix: verdict.newer
+								? envSetup !== null
+									? `${envSetup} runs after that file and may replace it; if it does not, ${newerFileFix("this host's worker")}`
+									: newerFileFix("this host's worker")
+								: envSetup !== null
+									? `${envSetup} runs after that file and may replace it; if it does not, fix ${envValueShown(fileRaw)} or point the key at a file that loads`
+									: `fix ${envValueShown(fileRaw)}, or point ${spec.key} at a file that loads`,
 						},
 			);
 		}
@@ -3660,9 +4417,10 @@ export async function collectChecks(shellVars, seams) {
 			const verdict = loadVerdict(spec, shellRaw, cwd, seamsForLoad, platform);
 			if (!verdict.ok) {
 				checks.push({
+					id: bootFileId(spec, "shell"),
 					ok: false,
 					label: `${spec.key} is set in this shell to a file the worker cannot load, so it ${spec.fails}: ${verdict.reason}`,
-					fix: `fix ${envValueShown(shellRaw)}, or point ${spec.key} at a file that loads`,
+					fix: verdict.newer ? newerFileFix("this host's worker") : `fix ${envValueShown(shellRaw)}, or point ${spec.key} at a file that loads`,
 				});
 			}
 		} else if (spec.defaultsToScaffold) {
@@ -3676,6 +4434,7 @@ export async function collectChecks(shellVars, seams) {
 				const verdict = loadVerdict(spec, scaffolded, cwd, seamsForLoad, platform);
 				if (!verdict.ok) {
 					checks.push({
+						id: bootFileId(spec),
 						ok: false,
 						label: `${spec.key} is unset, so ${spec.unsetMeans}, and it does not load: the worker ${spec.fails}: ${verdict.reason}`,
 						fix: `fix ${envValueShown(scaffolded)}, or empty its "endpoints" list`,
@@ -3711,6 +4470,7 @@ export async function collectChecks(shellVars, seams) {
 	// dead folder by one line and a bare repo by the other.
 	const folderOnly = (s) => scopeFormOf(s) !== "qualified" && (s.startsWith("/") || s.startsWith("./") || s.startsWith("../") || s.includes("\\") || !s.includes("/") || /^[A-Za-z]:/.test(s));
 
+	section("limits");
 	// The dead-scope advisory (issue #242), honest about what doctor can actually judge. A forge repo
 	// always contains "/" and never begins "/", "./" or "../" or carries a backslash, so a scope in any
 	// of THOSE shapes can only ever be a folder -- and a folder row that matches no trigger's canonical
@@ -3745,11 +4505,26 @@ export async function collectChecks(shellVars, seams) {
 		if (projectFacts.parseError === null) checks.push(...projectRowChecks(scopedLimitFacts.limits, projectFacts.projects, scopedLimitFacts.path));
 	}
 
+	section("envelope");
 	// Issue #504 part B: the envelope's advisories, on the file the service names, when it loads (a file that does not is
 	// the BOOT_FILES line's). Warnings only: the worker boots on both.
 	const envelopeFactsHere = readEnvelopeFacts(env);
 	if (envelopeFactsHere.envelope) checks.push(...envelopeChecks(envelopeFactsHere.envelope, envelopeFactsHere.projects, envelopeFactsHere.maxCostMicros));
 
+	section("console");
+	// Issue #640: the operator console, judged with its keys resolved by the console's own rule (this shell's value, else
+	// the deployment `.env`'s; DOCTOR_SHELL_KEYS). This shell's values are the ones `env` already carries (the resolution
+	// starts from a copy of this shell), so nothing here reads the shell a second way; and the resolution is apart from the
+	// service record, so a console key is never reported as a service's.
+	const consoleShell = Object.fromEntries(CONSOLE_ENV_KEYS.filter((k) => Object.hasOwn(env, k)).map((k) => [k, env[k]]));
+	const consoleEnv = { ...env, ...resolveServiceEnv({ env: consoleShell, file: serviceEnvFile, keys: CONSOLE_ENV_KEYS }).env };
+	const consoleLines = consoleChecks(consoleEnv, { cwd, home, platform, folders, skillsDirs });
+	checks.push(...consoleLines);
+	// Issue #708: whether a service keeps the console running, and whether it answers. Only for a deployment that has a
+	// console at all (the lines above), so a deployment that never set one up meets no probe.
+	if (consoleLines.length > 0) checks.push(...(await consoleServiceChecks(consoleEnv, { ...seams, cwd, home, platform })));
+
+	section("limits");
 	// Issue #498: a BARE repo scope (`acme/web`) matches that repo on every forge, so with triggers on more than one forge
 	// kind a bare row is one cap (one lease, one count) shared by GitHub's acme/web and Forgejo's, and a bare pause window
 	// pauses both. That may be meant, so this is a WARNING naming the qualified spellings, never a failure: refusing bare
@@ -3769,6 +4544,7 @@ export async function collectChecks(shellVars, seams) {
 		}
 	}
 
+	section("dirs");
 	// Issue #464: the jobs dir is this account's to write. PI_JOBS_DIR, PI_SANDBOX_DIR and TMPDIR as the service reads them
 	// (TMPDIR in .env is a documented way out of a squatted default root, so doctor judges the root the service will use).
 	let dirRefused = false;
@@ -3805,14 +4581,18 @@ export async function collectChecks(shellVars, seams) {
 		checks.push(...sandboxTombstoneChecks(sandboxDir, kept));
 	}
 
+	section("state");
+	// Issue #761: how long the console audit trail is kept and how many runs the shared run index holds, each a ✗ where
+	// the worker refuses to boot on its value (`WORKER_INT_SETTINGS`).
+	checks.push(...workerIntSettingChecks(env, (key) => fromFileNote(fileSays(key))));
 	// issue #290. The two DURABLE stores -- the run history everything folds over, and the overlay holding
 	// every cap the operator tuned from the panel -- used to default under the OS temp dir, which macOS
 	// sweeps on its own schedule and which is tmpfs (RAM) on several Linux distros. They now default under
 	// ~/.pi-dispatch, so this block is normally one green line; it warns only when a path RESOLVES under a
 	// temp dir, which after the move means an operator put it there.
 	//
-	// Deliberately NOT checked HERE: PI_JOBS_DIR, PI_SANDBOX_DIR and PI_GRAPH_DIR. Those are per-run,
-	// retention-bounded and regenerable respectively, and they stay under temp on purpose. Warning about a
+	// Deliberately NOT checked HERE: PI_JOBS_DIR and PI_SANDBOX_DIR. Those are per-run and
+	// retention-bounded respectively, and they stay under temp on purpose. Warning about a
 	// directory that is SUPPOSED to be swept is how an operator learns to skim this section, which costs
 	// more than it buys. Whose the jobs dir is, is checked above (`jobsDirChecks`, issue #464): that is a
 	// different question, and the one that failed every job of a second account on a shared host.
@@ -3892,22 +4672,51 @@ export async function collectChecks(shellVars, seams) {
 		// become invalid on upgrade: a duplicate key, which used to take the last value, is now refused. The reason names
 		// keys only, never values. Absent is the normal empty overlay and says nothing.
 		if (fileExists(settingsFile)) {
-			const overlay = readOverlay(settingsFile);
+			// The writer's read (issue #761), so the keys this build does not know are named below; its verdict is the
+			// worker's own (`readOverlay` is this read without the carry).
+			const overlay = readOverlayDocument(settingsFile);
 			if (overlay.invalid) {
+				// Issue #761: a file written by a newer pi-dispatch is no broken file. The worker DEFERS every job
+				// (newer-release) rather than refusing it, and the fix is an upgrade, never an edit or a delete, which would
+				// lose what the newer release wrote. The one exception is a `version` an operator wrote by hand (earlier
+				// releases ignored the key): no release wrote that file, so removing the key is the fix.
+				const newer = overlay.newer === true;
 				checks.push({
+					// Named (issue #712): the console quotes it beside "the settings overlay does not load".
+					id: "settings.overlay",
 					ok: false,
-					label: `settings overlay ${settingsFile} is invalid (${overlay.invalid}) -- the worker refuses every job as settings-overlay-invalid until it is fixed, and the panel refuses to write over it`,
+					label: newer
+						? `settings overlay ${settingsFile} cannot be read here (${overlay.invalid}) -- the worker defers every job (newer-release) until it is upgraded, and the panel refuses to write over it`
+						: `settings overlay ${settingsFile} is invalid (${overlay.invalid}) -- the worker refuses every job as settings-overlay-invalid until it is fixed, and the panel refuses to write over it`,
 					// The fix follows the reason: only a duplicate key gets the upgrade note, since only it loaded before #501.
-					fix: /duplicate key/.test(overlay.invalid)
-						? "remove the repeated key from that file, keeping the value you mean (a duplicate key is refused since issue #501; it used to take the last value), or delete the file to start from an empty overlay"
-						: "fix what the reason names in that file, or delete the file to start from an empty overlay",
+					fix: newer
+						? newerFileFix("this worker")
+						: /duplicate key/.test(overlay.invalid)
+							? "remove the repeated key from that file, keeping the value you mean (a duplicate key is refused since issue #501; it used to take the last value), or delete the file to start from an empty overlay"
+							: "fix what the reason names in that file, or delete the file to start from an empty overlay",
 				});
 			} else {
+				// Issue #761: the keys this build does not know, which the worker ignores and every writer from issue #761's
+				// release on keeps. An earlier panel or console (4.3.1 included) drops every key it does not know when it writes
+				// the file (`secretBundles` included, which it predates), so the fix says to upgrade those first. NAMES only,
+				// sorted and capped, never a value.
+				const unknown = [...(overlay.carry?.unknownKeys ?? [])].map((key) => printable(key).slice(0, UNKNOWN_KEY_NAME_MAX)).sort();
+				if (unknown.length > 0) {
+					const shown = unknown.slice(0, UNKNOWN_KEYS_SHOWN);
+					const more = unknown.length - shown.length;
+					checks.push({
+						id: "settings.unknown-keys",
+						ok: false,
+						warn: true,
+						label: `settings overlay ${settingsFile} holds ${unknown.length === 1 ? "a key" : `${unknown.length} keys`} this build does not know (${shown.join(", ")}${more > 0 ? `, and ${more} more` : ""}): the worker ignores ${unknown.length === 1 ? "it" : "them"}`,
+						fix: "a key from a newer release is ignored here and kept by every panel and console from 5.0.0 on, but an earlier one (4.3.1 included) drops every key it does not know when it writes this file, secretBundles included, so upgrade every panel and console first; a misspelt key is kept too, so remove it if it is a typo",
+					});
+				}
 				// Issue #501 (PR #542's review): a VALID overlay can still break the dollar invariant once merged over env
 				// (a window in one, no maxCostUsd in either), which the worker checks per job and answers by refusing every
 				// job. The env-only half is `dollarChecks`; this is the merged half, said only when env alone is fine.
 				const merged = overlayDollarProblem(overlay.overlay, env);
-				if (merged) checks.push({ ok: false, label: `settings overlay ${settingsFile}: ${merged} -- the worker refuses every job as settings-overlay-invalid`, fix: "set maxCostUsd in the overlay (or PI_MAX_COST_USD in .env), or remove the dollar window" });
+				if (merged) checks.push({ id: "settings.overlay-dollars", ok: false, label: `settings overlay ${settingsFile}: ${merged} -- the worker refuses every job as settings-overlay-invalid`, fix: "set maxCostUsd in the overlay (or PI_MAX_COST_USD in .env), or remove the dollar window" });
 			}
 		}
 		// PR #549's review: the scoped-limits dollar rows against the deployment's per-job cap, env and overlay merged
@@ -3970,7 +4779,29 @@ export async function collectChecks(shellVars, seams) {
 			});
 		}
 	}
-
+	// Issue #761: a store an older release left in a shape this build no longer writes (older-state.mjs), one warning per
+	// finding, each published under this one id (a second is `state.older-2`, `assignCheckIds`). The id is set here, never
+	// in that module, so it is written at one site. The three older-location hints above keep their own words and places.
+	// The container is judged as `up` judges it (`upValkeyContainerImage`): this deployment's, in a folder not handed to
+	// compose, and only where VALKEY_URL names this host, the one place `up` runs a Valkey. The hand-over is read as `up`
+	// reads it, by the override's presence; null where it cannot be, which names no container.
+	// Only where the `.env` reads cleanly through the reader `up` judges its Valkey by (`readValkeyKeys`, under
+	// `deploymentValkeyEnv`), from the file's bytes, and its VALKEY_URL, where it sets one, is the URL judged here. Not
+	// when that reader errors, this shell's VALKEY_URL set or not: under systemd, a NUL or invalid UTF-8 anywhere in the
+	// file (it loads none of it), or, in a file that spells one of its three Valkey keys, a line the service's loader reads
+	// differently or one of those keys on a line it cannot read. `up` refuses each of those on Linux, and elsewhere judges
+	// this shell's value or the default in the file's place. Nor when the file's VALKEY_URL is not `valkeyUrl` (this
+	// shell sets another, which `up` refuses everywhere). Either way the port judged may not be the one the service
+	// dials, and the fix's `pi-dispatch up` would start no Valkey, so the container is not asked about at all.
+	const upValkeyRead = serviceEnvFile ? readValkeyKeys(serviceEnvFile.raw ?? serviceEnvFile.text, { loader: serviceEnvFile.loader, path: serviceEnvFile.path }) : { keys: {} };
+	const valkeyUrlRead = !upValkeyRead.error && (!Object.hasOwn(upValkeyRead.keys, "VALKEY_URL") || upValkeyRead.keys.VALKEY_URL === valkeyUrl);
+	const valkeyContainer = valkeyContainerReader({ spawn, runTimeouts, asked: localUsed && dockerCode === 0 && valkeyUrlRead, cwd, valkeyUrl });
+	const handedOver = typeof fileExists === "function" && typeof cwd === "string" && cwd !== "" ? Boolean(fileExists(join(cwd, COMPOSE_VALKEY_OVERRIDE))) : null;
+	for (const f of await olderStateOf(seams, { cwd, home, valkeyContainer, handedOver })) {
+		checks.push({ id: "state.older", ok: false, warn: true, label: f.label, fix: f.fix });
+	}
+
+	section("env");
 	// Issue #471: what a key resolved above this point (the provider's variables, the PAT) added to the record.
 	checks.push(...serviceEnvLines({ fromFile: {}, disagreements: service.disagreements.slice(saidAtTop.disagreements), unread: service.unread.slice(saidAtTop.unread) }, envPathShown));
 	// Issue #471 (gate round 1): a key only this shell sets was taken in silence. Where a service for this folder is
@@ -3995,6 +4826,7 @@ export async function collectChecks(shellVars, seams) {
 		const { hazard } = serviceEnvFile;
 		checks.push({ ok: false, label: `${serviceEnvFile.path} line ${hazard.line} ${hazard.what}, so doctor read none of ${service.hazardSkipped.join(", ")} from it and judged this shell's values (or the defaults) instead: the service's own are unknown`, fix: hazard.fix });
 	}
+	tagSection(checks, currentSection);
 	return checks;
 }
 
@@ -4414,7 +5246,8 @@ function nodeCheck(version) {
  * that every image a trigger names is actually on this host -- with `--pull=never` nothing will fetch one at
  * job time, so this is the only warning that arrives BEFORE the trigger fires at 03:00.
  *
- * `optingOut` counts `run.packages: false` -- the only thing that now withholds the staged set from a job.
+ * `optingOut` counts `run.packages: false` -- the only thing that withholds the whole staged set from a job. `run.excludeExtensions`
+ * withholds one package at a time, and `excludedNames` holds those names.
  * `requiring` counts explicit `run.packages: true`, which arms nothing any more but is still an operator
  * asserting "this flow needs those packages"; that assertion is what makes an empty stage a hard failure.
  *
@@ -4616,6 +5449,228 @@ function readProjectFacts(env, fileExists) {
 	}
 }
 
+// `sun_path` sizes, NUL terminator included, as the console's own `parseListen` (admin/src/console/listen.mjs) holds
+// them; doctor-console.test.mjs compares the two parsers' verdicts, since the worker cannot import the admin.
+const CONSOLE_SUN_PATH = { darwin: 104, freebsd: 104, openbsd: 104, netbsd: 104, linux: 108 };
+const CONSOLE_LOOPBACK = new BlockList();
+CONSOLE_LOOPBACK.addSubnet("127.0.0.0", 8, "ipv4");
+CONSOLE_LOOPBACK.addAddress("::1", "ipv6");
+
+/**
+ * PI_CONSOLE_LISTEN as the console parses it: `{ shown, loopback }` or `{ refusal }`. IP literals only (`ip:port`,
+ * `[ipv6]:port`) or `unix:/abs/path` within the platform's socket path size; loopback is 127.0.0.0/8 and ::1. Unset or
+ * empty is the default, 127.0.0.1:4790. The non-loopback refusal is the caller's (it depends on PI_CONSOLE_BIND_PUBLIC).
+ */
+export function consoleListenOf(value, platform = process.platform) {
+	const text = typeof value === "string" ? value.trim() : "";
+	if (text === "") return { shown: "127.0.0.1:4790 (the default)", loopback: true };
+	if (text.startsWith("unix:")) {
+		const path = text.slice("unix:".length);
+		if (!isAbsolute(path)) return { refusal: "a unix socket path must be absolute: write unix:/abs/path" };
+		const limit = CONSOLE_SUN_PATH[platform] ?? 108;
+		if (Buffer.byteLength(path) >= limit) return { refusal: `the unix socket path is ${Buffer.byteLength(path)} bytes, and this platform allows at most ${limit - 1}: choose a shorter path` };
+		return { shown: text, loopback: true };
+	}
+	const m = /^(?:\[([^\]]*)\]|([^:[\]]*)):([0-9]{1,5})$/.exec(text);
+	if (!m || Number(m[3]) > 65535) return { refusal: "it is not ip:port, [ipv6]:port or unix:/abs/path (the port a number from 0 to 65535)" };
+	const host = m[1] ?? m[2];
+	if (m[1] !== undefined ? !isIPv6(host) : !isIPv4(host)) return { refusal: `${host} is not an IP literal; a hostname can resolve anywhere, so write 127.0.0.1 or [::1]` };
+	const loopback = CONSOLE_LOOPBACK.check(host, m[1] !== undefined ? "ipv6" : "ipv4");
+	return { shown: text, loopback };
+}
+
+/**
+ * Issue #761: the worker settings read with `config.mjs`'s `nonNegativeInt` or `boundedInt` whose bad value doctor
+ * names, by that same rule (unset or empty is the default; any other value must be exactly the integer, spaces around
+ * it allowed, inside the bounds): a value the worker refuses to boot on (exit 2, a configuration error naming the key)
+ * fails here too, and nothing else does. `want` is the loader's own phrase for the rule.
+ */
+export const WORKER_INT_SETTINGS = Object.freeze({
+	PI_CONSOLE_AUDIT_RETENTION_DAYS: Object.freeze({ min: 0, max: undefined, want: "a non-negative integer", fix: "set it to a whole number of days (0 keeps the console audit trail forever), or delete the line so the trail is kept as long as PI_LOG_RETENTION_DAYS keeps run history" }),
+	PI_RUN_MIRROR_MAX_RUNS: Object.freeze({ min: RUN_MIRROR_MAX_RUNS_MIN, max: RUN_MIRROR_MAX_RUNS_MAX, want: `an integer ${RUN_MIRROR_MAX_RUNS_MIN}-${RUN_MIRROR_MAX_RUNS_MAX}`, fix: `set it to a whole number from ${RUN_MIRROR_MAX_RUNS_MIN} to ${RUN_MIRROR_MAX_RUNS_MAX}, or delete the line for the default (${RUN_MIRROR_MAX_RUNS_DEFAULT})` }),
+});
+
+/** Whether `raw` is a value `config.mjs`'s `boundedInt` takes for `rule` (see `WORKER_INT_SETTINGS`). */
+function workerIntAccepted(raw, { min, max }) {
+	if (raw === undefined || raw === "") return true;
+	const n = Number.parseInt(raw, 10);
+	return Number.isInteger(n) && n >= min && (max === undefined || n <= max) && String(n) === String(raw).trim();
+}
+
+/**
+ * A ✗ for each `WORKER_INT_SETTINGS` key `env` sets to a value the worker refuses to boot on; `note(key)` says where it
+ * came from. The keys are the table's own, so a setting added there is judged here with nothing else to change.
+ */
+export function workerIntSettingChecks(env, note = () => "") {
+	return Object.entries(WORKER_INT_SETTINGS)
+		.filter(([key, rule]) => !workerIntAccepted(env[key], rule))
+		.map(([key, rule]) => ({ ok: false, label: `${key} is ${quotedShown(env[key])}, which is not ${rule.want}: the worker refuses to boot on it (exit 2)${note(key)}`, fix: rule.fix }));
+}
+
+/**
+ * The console's lines (issue #640, REQ-CONSOLE-SECURITY). NONE for a deployment that never set the console up: no
+ * tokens file at the resolved path (nothing at all there, by lstat) and no PI_CONSOLE_* key set. Otherwise:
+ *   - the tokens file as the console reads it (`readTokensFile`: owner-only regular file, valid), ✗ with its own fix;
+ *   - at least one operator token, ✗ (with none, nobody can change anything from the console);
+ *   - the tokens file outside every path a job container can see, ✗: a local trigger's run.folder is bind-mounted
+ *     read-write, so a job there could read the file or add a token of its own. Judged by `envelopeInsideJobPaths`, the
+ *     envelope's identity-based containment check (a firmlink or bind alias of a folder is caught), on the file's real
+ *     path, with the local folders, skills dirs, absolute run roots and the overlay;
+ *   - entries kept for a role this release does not know (issue #761, `keptTokens`), ⚠: a newer release writes such
+ *     entries, and a console of this release signs them in nowhere;
+ *   - PI_CONSOLE_LISTEN parseable (✗, the console refuses to start) and PI_CONSOLE_BIND_PUBLIC=1 (⚠, plain HTTP);
+ *   - the audit chain (`verifyConsoleAudit`), ⚠ when broken, nothing while the log holds no row; an intact chain with
+ *     rows whose shaped action or outcome this release does not know (issue #761, `unknown`; a newer console writes
+ *     such rows) is still ok, and its line counts them.
+ * `env` must already carry the console keys resolved (`collectChecks` does it). Seams: `cwd` (the deployment folder),
+ * `fs`, `uid`, `home`, `platform`, `folders` (canonical local run.folders), `skillsDirs`, `realpath`.
+ */
+export function consoleChecks(env, { cwd = process.cwd(), fs = nodeFs, uid = process.geteuid?.(), home, platform = process.platform, folders = [], skillsDirs = [], realpath = realpathSync.native } = {}) {
+	const path = tokensFilePath({ PI_CONSOLE_TOKENS_FILE: env.PI_CONSOLE_TOKENS_FILE }, cwd);
+	let present = true;
+	try {
+		fs.lstatSync(path);
+	} catch {
+		present = false;
+	}
+	const keysSet = CONSOLE_ENV_KEYS.filter((k) => typeof env[k] === "string" && env[k] !== "");
+	if (!present && keysSet.length === 0) return [];
+	const checks = [];
+	const shownPath = quotedShown(path);
+	const read = readTokensFile({ path, fs, uid });
+	if (read.refusal) {
+		checks.push({ ok: false, label: `console: the tokens file ${shownPath} cannot be used, so \`pi-dispatch-console serve\` refuses to start`, fix: escapeControls(read.refusal) });
+	} else {
+		const operators = operatorCount(read.file);
+		const viewers = read.file.tokens.length - operators;
+		if (operators === 0) {
+			checks.push({ ok: false, label: `console: the tokens file ${shownPath} holds no operator token, so nobody can make a change from the console`, fix: "run `pi-dispatch-console token add --name <you> --role operator`" });
+		}
+		const inside = consoleTokensInsideJobPaths(path, env, { cwd, fs, folders, skillsDirs, realpath });
+		if (inside.problem) {
+			checks.push({ ok: false, label: `console: the tokens file ${shownPath} ${inside.problem}`, fix: inside.fix });
+		} else if (operators > 0) {
+			checks.push({ ok: true, label: `console: tokens file ${shownPath} is owner-only and outside every job folder (${operators} operator${operators === 1 ? "" : "s"}, ${viewers} viewer${viewers === 1 ? "" : "s"})` });
+		}
+		const kept = keptTokens(read.file).length;
+		if (kept > 0) {
+			const said = kept === 1 ? "1 token carries a role this pi-dispatch does not know, so a console of this release signs it in nowhere" : `${kept} tokens carry a role this pi-dispatch does not know, so a console of this release signs them in nowhere`;
+			checks.push({ ok: false, warn: true, label: `console: ${said}`, fix: "upgrade pi-dispatch and the console" });
+		}
+	}
+	const listen = consoleListenOf(env.PI_CONSOLE_LISTEN, platform);
+	const bindPublic = env.PI_CONSOLE_BIND_PUBLIC === "1";
+	if (listen.refusal) {
+		checks.push({ ok: false, label: `console: PI_CONSOLE_LISTEN ${quotedShown(env.PI_CONSOLE_LISTEN)} cannot be used, so \`pi-dispatch-console serve\` refuses to start: ${listen.refusal}`, fix: "write 127.0.0.1:4790, [::1]:4790 or unix:/abs/path, or unset PI_CONSOLE_LISTEN for the default" });
+	} else if (!listen.loopback && !bindPublic) {
+		checks.push({ ok: false, label: `console: PI_CONSOLE_LISTEN ${quotedShown(env.PI_CONSOLE_LISTEN)} is not a loopback address, so \`pi-dispatch-console serve\` refuses to start`, fix: "listen on 127.0.0.1, [::1] or a unix: socket and reach it with ssh -L; or, to accept plain HTTP on a network, set PI_CONSOLE_BIND_PUBLIC=1" });
+	} else {
+		checks.push({ ok: true, label: `console: listens on ${escapeControls(listen.shown)}` });
+	}
+	if (bindPublic) {
+		checks.push({ ok: false, warn: true, label: "console: PI_CONSOLE_BIND_PUBLIC=1 lets the console listen on a non-loopback address, where tokens and session cookies cross the network in plain HTTP", fix: "keep it only behind a TLS proxy on a network you trust; otherwise unset PI_CONSOLE_BIND_PUBLIC, listen on 127.0.0.1, [::1] or a unix: socket, and reach it with ssh -L" });
+	}
+	const logsDir = logsDirPath(env, home);
+	const audit = verifyConsoleAudit({ logsDir, fs });
+	if (!audit.ok) {
+		const where = audit.broken.file === null ? "" : ` at ${audit.broken.file} line ${audit.broken.line}`;
+		checks.push({ ok: false, warn: true, label: `console: the audit log chain is broken${where}: ${escapeControls(audit.broken.reason)}`, fix: `a row was changed, removed or moved after it was written, or the file was damaged. Keep a copy of ${join(logsDir, "console-audit")} for review; \`pi-dispatch-console audit verify\` names the same link, and a damaged LAST line makes the console refuse every write until that file is moved aside` });
+	} else if (audit.rows > 0) {
+		const start = audit.startsAt ? `, starting at seq ${audit.startsAt.seq} in ${audit.startsAt.file} (older rows reaped)` : "";
+		// Issue #761: what the check knows of such rows, that their words are unknown here and shaped, never who wrote them.
+		// Last, since its colon would otherwise run into the start's clause.
+		const unknown = audit.unknown > 0 ? `, ${audit.unknown} not known to this pi-dispatch: a newer console writes such rows` : "";
+		checks.push({ ok: true, label: `console: audit log chain intact (${audit.rows} row${audit.rows === 1 ? "" : "s"}${start}${unknown})` });
+	}
+	return checks;
+}
+
+/** The console's service name on Windows, where nssm keeps one machine-scoped service per name (service.mjs). */
+const CONSOLE_NSSM_SERVICE = "pi-dispatch-console";
+
+/**
+ * The console service unit installed for the deployment in `cwd` (issue #708): `{ path }` (the unit file, or the nssm
+ * service's name on win32), else null. Read as the worker's unit is (`installedWorkerUnit`): a unit FILE whose
+ * WorkingDirectory is this folder (`readUnitSeam`), in either scope; on win32 the nssm service by name, since nssm
+ * keeps the folder apart (AppDirectory) and there is one such service per machine.
+ */
+async function installedConsoleUnit({ platform, home, cwd, fileExists, readUnit = (path) => readFileSync(path, "utf8"), spawn }) {
+	if (platform === "win32") {
+		if (typeof spawn !== "function") return null;
+		const got = await runCmdCapture(spawn, "nssm", ["status", CONSOLE_NSSM_SERVICE]);
+		return got.code === 0 ? { path: CONSOLE_NSSM_SERVICE } : null;
+	}
+	const path = installedConsoleUnitPath({ platform, home, cwd, fileExists, readUnit });
+	return path === null ? null : { path };
+}
+
+/**
+ * The console's service lines (issue #708): whether a service unit keeps the console of this deployment running, and
+ * whether the console answers (`probeConsole`: one GET /healthz to the loopback address or the socket it binds, 1 s).
+ *   - a unit installed and the console answering: ✓;
+ *   - a unit installed and nothing answering: ✗, since the service exists to keep it answering (`serve` exits 2 on a
+ *     refusal and the unit then stays stopped, so the unit's log says which);
+ *   - no unit and nothing answering: ⚠, with the install command;
+ *   - no unit and the console answering: ✓, saying it was started by hand and stops with its terminal;
+ *   - an address the probe may not or cannot ask (port 0, a non-loopback bind): the unit line alone, and why the
+ *     answer is not known.
+ * NOTHING when the console could not start on its listen address at all: `consoleChecks` already fails that line, and a
+ * second line saying it does not answer would be the same fact twice. `env` carries the console keys resolved as
+ * `collectChecks` resolves them; no other key is read. Seams: `consoleProbe(env)`, `fileExists`, `readUnit`, `spawn`.
+ */
+export async function consoleServiceChecks(env, seams = {}) {
+	const { platform = process.platform, cwd = process.cwd() } = seams;
+	const listen = consoleListenOf(env.PI_CONSOLE_LISTEN, platform);
+	if (listen.refusal || (!listen.loopback && env.PI_CONSOLE_BIND_PUBLIC !== "1")) return [];
+	const unit = await installedConsoleUnit({ ...seams, platform, cwd, fileExists: seams.fileExists ?? existsSync });
+	const probe = seams.consoleProbe ?? (async (e) => (await import("./console-probe.mjs")).probeConsole(e));
+	let answer;
+	try {
+		answer = await probe(env);
+	} catch (err) {
+		answer = { state: "unknown", reason: `the probe failed (${escapeControls(err?.message ?? String(err))})` };
+	}
+	const at = answer.target ? ` on ${escapeControls(answer.target)}` : "";
+	const why = answer.reason ? ` (${escapeControls(answer.reason)})` : "";
+	const unitShown = unit ? quotedShown(unit.path) : null;
+	const logs = platform === "linux" ? "`journalctl --user -u pi-dispatch-console` (or without --user for a system unit)" : platform === "darwin" ? `${join(cwd, "logs", "console.err.log")}` : `${join(cwd, "logs", "console.err.log")} and \`nssm status ${CONSOLE_NSSM_SERVICE}\``;
+	if (answer.state === "unknown") {
+		return [{ ok: true, label: `console: ${unit ? `the service ${unitShown} serves this deployment; ` : "no service unit keeps it running; "}whether it answers is not checked${why}` }];
+	}
+	if (unit && answer.state === "running") return [{ ok: true, label: `console: the service ${unitShown} keeps it running, and it answers${at}` }];
+	if (unit) {
+		const lock = join(logsDirPath(env, seams.home), "console-audit", ".console.lock");
+		return [{ ok: false, label: `console: the service ${unitShown} is installed for this deployment, but nothing answers${at}${why}`, fix: `\`pi-dispatch service status --console\` says whether it runs, and ${logs} says why it stopped: \`pi-dispatch-console serve\` exits 2 on a refusal (no operator token, the lock held by another console, an address in use), and the unit then stays stopped until it is started again (\`pi-dispatch service start --console\`). After a crash the lock ${escapeControls(lock)} can name a pid another process has since taken, which keeps every start refusing: when that pid is not a console, remove the lock, then start the unit` }];
+	}
+	if (answer.state === "running") return [{ ok: true, label: `console: answers${at}, started by hand (no service unit for this deployment, so it stops with the terminal that runs it)` }];
+	return [{ ok: false, warn: true, label: `console: not running${at}${why}, and no service unit keeps it running`, fix: "`pi-dispatch service install --console` keeps it running (it needs an operator token); or start it in a terminal with `pi-dispatch-console serve`" }];
+}
+
+/**
+ * Whether a job container can see the console tokens file: `{}` or `{ problem, fix }`. The file's REAL path is judged
+ * (the containment check requires a canonical path, and the console reads whatever the configured one resolves to). A
+ * second hard link is refused as the envelope's is: another name of the file could sit in a job folder unseen. A
+ * relative run root is skipped here (the envelope refuses one; the console has no such rule to borrow), and a path
+ * that cannot be judged is said, not passed.
+ */
+function consoleTokensInsideJobPaths(path, env, { cwd, fs, folders, skillsDirs, realpath }) {
+	const fix = "move the tokens file out of every local trigger's run.folder and run.skillsDir, every PI_DISPATCH_RUN_ROOTS root and PI_GLOBAL_PI_DIR, and point PI_CONSOLE_TOKENS_FILE at its new path";
+	try {
+		const st = fs.statSync(path);
+		if (st.nlink > 1) return { problem: `has ${st.nlink} hard links: another name of the file could sit inside a folder a job can see, so keep exactly one`, fix: `remove the other names (\`find / -samefile ${path}\` lists them)` };
+		const real = realpath(path);
+		const runRoots = delimitedList(env.PI_DISPATCH_RUN_ROOTS).filter((r) => isAbsolute(r));
+		const globalPiDir = typeof env.PI_GLOBAL_PI_DIR === "string" && env.PI_GLOBAL_PI_DIR !== "" ? env.PI_GLOBAL_PI_DIR : null;
+		// PWD comes from the process environment inside the check, as on doctor's envelope load (`loadEnvelopeChecked`).
+		const inside = envelopeInsideJobPaths(real, { cronFolders: folders, runRoots, skillsDirs, globalPiDir }, { cwd });
+		if (inside === null) return {};
+		const what = { "cron-folder": "a local trigger's run.folder", "run-root": "a PI_DISPATCH_RUN_ROOTS root", "skills-dir": "a trigger's run.skillsDir", "global-pi-dir": "PI_GLOBAL_PI_DIR" }[inside.kind] ?? inside.kind;
+		return { problem: `lies inside ${what} (${quotedShown(inside.path)}), which a job container can see: a job there could read the token hashes or add a token of its own`, fix };
+	} catch (err) {
+		return { problem: `could not be judged against the folders a job can see (${escapeControls(err?.code ?? "the path could not be resolved")})`, fix: `make ${path} and the trigger folders readable here, then run doctor again` };
+	}
+}
+
 /**
  * The envelope facts (issue #504 part B): the envelope as the worker would load it, the projects and the per-job cap it
  * was judged against, or a parse error when `PI_ENVELOPE_FILE` is set and does not load (the BOOT_FILES line's).
@@ -4765,6 +5820,30 @@ export async function defaultReadAppliedSplit(url) {
 	}
 }
 
+export { cooldownModelRefs } from "./model-observation.mjs";
+
+/** A failed bounded read is visible, never reported as "no cooldown". */
+export async function defaultReadModelCooldowns(url, refs, options) {
+	try {
+		// Kept lazy like the other model checks: doctor must start even when pi cannot be imported.
+		const { readModelCooldowns } = await import("./model-failover.mjs");
+		return await withDoctorClient(url, (client) => boundedOp(readModelCooldowns(client, refs, options), DOCTOR_VALKEY_OP_TIMEOUT_MS));
+	} catch {
+		return null;
+	}
+}
+
+/** Warn lines are also published to the console's existing Doctor panel, with the observation's age. */
+export function modelCooldownChecks(rows) {
+	if (!Array.isArray(rows)) return [{ ok: false, warn: true, label: "Model cooldowns could not be read", fix: "check Valkey and re-run doctor; failover jobs retry infrastructure failures before they spend" }];
+	return rows.filter((row) => splitModelEntry(row?.ref) && ["rate-limited", "quota-exhausted", "overloaded"].includes(row.kind) && Number.isSafeInteger(row.until) && row.until >= 0 && row.until <= 253402300799999).map((row) => ({
+		ok: false,
+		warn: true,
+		label: `Model ${row.ref} is cooling down until ${new Date(row.until).toISOString()} (${row.kind})`,
+		fix: "new failover jobs skip this model until then and use only the reviewed fallback list; recovery keeps its checkpoint model",
+	}));
+}
+
 /**
  * A FAILURE per scoped-limits file that holds a `project:<id>` row whose id is not a project in `projects` (issue #499
  * part B): the worker refuses to start on it, and a live reload that would create one is kept out. Rows are named by
@@ -4785,15 +5864,24 @@ export function projectRowChecks(limits, projects, path) {
 /**
  * The pause-windows facts (issue #498): the parsed windows when PI_PAUSE_WINDOWS_FILE is set, else none. A file that
  * does not load is the BOOT_FILES check's line, so here it only silences the advisories that read the windows.
+ * `versionNeed` (issue #761) is the version the file needs, the higher of what it declares and what its RAW windows'
+ * fields need, for the fleet line that names a peer that cannot read it; 1 without a file. `versions` is the
+ * `{ supported, table, valueTable }` the file is read and its need judged by (collectChecks' `versionTables`), the
+ * module's own by default.
  */
-function readPauseWindowFacts(env, fileExists) {
+function readPauseWindowFacts(env, fileExists, versions = {}) {
 	const path = env.PI_PAUSE_WINDOWS_FILE;
-	if (typeof path !== "string" || path.trim() === "") return { windows: [], parseError: null };
+	if (typeof path !== "string" || path.trim() === "") return { windows: [], versionNeed: 1, parseError: null };
 	try {
-		if (!fileExists(path) || !statSync(path).isFile()) return { windows: [], parseError: "unreadable" };
-		return { windows: loadPauseWindows({ pauseWindowsFile: path }, { readFileSync, existsSync: fileExists }), parseError: null };
+		if (!fileExists(path) || !statSync(path).isFile()) return { windows: [], versionNeed: 1, parseError: "unreadable" };
+		// The loader's own parse (`loadPauseWindows` is this read after the existence check above), handed the versions.
+		const text = readFileSync(path, "utf8");
+		const windows = parsePauseWindows(text, path, versions);
+		// The parse just accepted this text, so it parses, and a declared version is an integer.
+		const doc = JSON.parse(text);
+		return { windows, versionNeed: Math.max(Number.isSafeInteger(doc?.version) ? doc.version : 1, pauseWindowsVersionFor(doc?.windows, versions)), parseError: null };
 	} catch (e) {
-		return { windows: [], parseError: e?.message ?? String(e) };
+		return { windows: [], versionNeed: 1, parseError: e?.message ?? String(e) };
 	}
 }
 
@@ -4985,6 +6073,76 @@ export function fleetSizeChecks(fileVersion, peers) {
 	}];
 }
 
+/** The overlay keys `settings.unknown-keys` names at most (issue #761), and how much of each name it shows. */
+export const UNKNOWN_KEYS_SHOWN = 8;
+const UNKNOWN_KEY_NAME_MAX = 64;
+
+/**
+ * The stores a host publishes a version for (issue #761, `DES-STORE-VERSION-WHEN-NEEDED`), by registry field: what the
+ * store is, what a peer does with this host's file when it publishes a LOWER version (this release's rule: it defers
+ * the job, `newer-release`) and when it publishes NONE (a worker from before issue #761: it reads the file without its
+ * version and drops what it does not know), and who else writes it, for the fix. A test holds the fields to the ones
+ * start.mjs publishes.
+ *
+ * A lower peer that watches the pause windows or the triggers file defers every job from its next reload of it, not
+ * only the jobs that read the file: its worker-wide newer state is read by the triggers gate at the processor's head,
+ * and by the pickup's pause gate and the watch branch's (a job ended before those, by the draft-source or sandbox
+ * check, a runtime's own result, a lost lock's replay or a grouping job's deleted project, spends nothing). Job data
+ * is written by the receivers, the console and the workers' own builders, and a receiver publishes no registry row,
+ * so its fix names the receivers as a set doctor cannot see.
+ */
+export const STORE_FLEET_LINES = Object.freeze({
+	settingsVersion: Object.freeze({ store: "the settings overlay", older: "defers every job (newer-release) while it reads this file", silent: "drops the overlay keys it does not know, so a cap they set does not apply on it", writers: "every panel and console that writes the settings overlay (one from before issue #761 drops a key it does not know when it writes)" }),
+	pauseWindowsVersion: Object.freeze({ store: "the pause windows file", older: "defers every job (newer-release) from its next reload of this file, and refuses the file at its next start", silent: "drops the window fields it does not know, so a window pauses at the wrong time on it", writers: "every panel and console that writes the pause windows file (one from before issue #761 drops a key it does not know when it writes)" }),
+	triggersVersion: Object.freeze({ store: "the triggers file", older: "defers every job (newer-release) from its next reload of this file, keeps its last good schedules, and refuses the file at its next start", silent: "drops the run keys it does not know, so a trigger's jobs run wider on it than the file says", writers: "every panel and console that writes the triggers file (one from before issue #761 drops a key it does not know when it writes)" }),
+	jobDataVersion: Object.freeze({ store: "the jobs this host's triggers queue", older: "defers each such job (newer-release) until it is upgraded", silent: "drops the job fields it does not know, so such a job runs wider on it than its trigger says", writers: "every receiver and every console that queues these jobs (a receiver publishes no registry row, so doctor cannot see which receivers are older)" }),
+});
+
+/**
+ * The version each of this host's stores needs, by registry field (issue #761): the settings overlay (read by the
+ * worker's own reader), the pause windows file and the triggers file (from the facts doctor already read), and the job
+ * data their triggers queue. A store whose file does not load is left out. `settingsVersions` is the overlay's
+ * `{ supported, table, valueTable }` (collectChecks' `versionTables`), the module's own by default.
+ */
+export function storeVersionNeeds({ settingsFile, fileExists, pauseWindowFacts, triggersVersionNeed, jobDataVersionNeed, triggersParsed, settingsVersions = {} }) {
+	const needs = {};
+	const settings = fileExists(settingsFile) ? readOverlayDocument(settingsFile, settingsVersions) : { overlay: {}, carry: null };
+	if (!settings.invalid) {
+		const declared = settings.carry?.doc?.version;
+		needs.settingsVersion = Math.max(Number.isSafeInteger(declared) ? declared : 1, settingsVersionFor(settings.overlay, settingsVersions));
+	}
+	if (pauseWindowFacts.parseError === null) needs.pauseWindowsVersion = pauseWindowFacts.versionNeed;
+	if (triggersParsed) {
+		needs.triggersVersion = triggersVersionNeed;
+		needs.jobDataVersion = jobDataVersionNeed;
+	}
+	return needs;
+}
+
+/**
+ * The fleet's store versions (issue #761): for each store whose need (`needs`, registry field -> the version this host's
+ * own file needs) is above 1, a WARNING naming the peers that publish that field below the need (they defer what the
+ * file touches until they are upgraded) and one naming the peers that publish no such field at all (workers from before
+ * the field: they read the file without its version and drop what they do not know, which can widen a job). Nothing
+ * at all while every need is 1, which is a deployment whose files use nothing a table has a row for. Hosts are named,
+ * never a file's content. `fleetSizeChecks` keeps its own line: a peer without `limitsVersion` still reads version 2.
+ */
+export function fleetStoreVersionChecks(needs, peers) {
+	const checks = [];
+	const warn = (label, fix) => checks.push({ id: "fleet.store-versions", ok: false, warn: true, label, fix });
+	const fix = (line, need) => `upgrade and restart the workers named, and ${line.writers}, to a release that reads version ${need}`;
+	for (const [field, line] of Object.entries(STORE_FLEET_LINES)) {
+		const need = needs?.[field];
+		if (!Number.isSafeInteger(need) || need <= 1) continue;
+		const silent = peers.filter((h) => h[field] === undefined || h[field] === null || h[field] === "");
+		const older = peers.filter((h) => !silent.includes(h) && !(Number.isSafeInteger(Number(h[field])) && Number(h[field]) >= need));
+		const names = (hosts) => hosts.map((h) => h.name).join(", ");
+		if (older.length > 0) warn(`${names(older)} ${older.length === 1 ? "reads" : "read"} ${line.store} only below version ${need}, the version this host's file needs: ${older.length === 1 ? "it" : "each"} ${line.older}`, fix(line, need));
+		if (silent.length > 0) warn(`${names(silent)} ${silent.length === 1 ? "publishes" : "publish"} no version for ${line.store} (a worker from before issue #761), while this host's file needs version ${need}: ${silent.length === 1 ? "it" : "each"} ${line.silent}`, fix(line, need));
+	}
+	return checks;
+}
+
 export function fleetProjectsChecks(mine, peers) {
 	const checks = [];
 	const opinions = peers.filter((h) => typeof h.fpProjects === "string" && h.fpProjects !== "");
@@ -5010,72 +6168,11 @@ export function fleetProjectsChecks(mine, peers) {
 	return checks;
 }
 
-/**
- * The runner's own input overhead (`BOUND_OVERHEAD_TOKENS`, image/runner/src/usage-meter.mjs), which its bound adds to
- * every call. Copied, because the worker package does not ship the runner; `doctor.test.mjs` holds the two equal.
- */
-export const FIRST_CALL_OVERHEAD_TOKENS = 8192;
-/**
- * The least a job's FIRST call carries before its task, in bytes: pi 0.99.1's default system prompt (1,753 bytes) and
- * the schemas of its four default tools (2,712 bytes) serialise to 4,465 bytes, and PR #542's lab measured 10,667 for
- * a short task. 4,096 is below both, so the bound below stays a lower bound for a job that adds nothing.
- */
-export const FIRST_CALL_MIN_CONTEXT_BYTES = 4096;
+// The first-call bound moved to model-catalog.mjs (issue #800), where the console's preview can read it without loading this
+// module. Re-exported so every caller and test of doctor's own lines reads the one rule as before.
+export { FIRST_CALL_MIN_CONTEXT_BYTES, FIRST_CALL_OVERHEAD_TOKENS, boundModelOf, firstCallFloorMicros, serviceTierMultiplier };
 
-/**
- * A LOWER BOUND, in integer micro-dollars, on what the runner's cost guard (`callCostBound`) reserves for a job's
- * first call on `model`, or null when this cannot say. The guard refuses a call when its bound would pass the cap, so
- * a per-job cap below this number can never admit a call on the model: with the main model, the job makes no call at
- * all (PR #542's lab: the default model's first call was bounded at $1.03 under a $1 cap).
- *
- * The guard's bound is (request bytes + 8,192) x the dearest input rate + the output limit x the dearest output rate,
- * times a service-tier multiplier, over the model's table, its tiers and its fallbacks. This takes the parts of that
- * which cannot be smaller: the model's own table (not its tiers or fallbacks, which only raise the bound), the output
- * limit `model.maxTokens` (pi sends none of its own, so the guard uses the model's), an input of the overhead plus
- * `FIRST_CALL_MIN_CONTEXT_BYTES`, and the runner's own service-tier multiplier (`serviceTierMultiplier`). The input
- * rate is the guard's: the highest of input, cache read and cache write (not the 1h write, which needs long
- * retention). Null for a table or limit it cannot read.
- */
-export function firstCallFloorMicros(model) {
-	const cost = model?.cost;
-	const usable = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0;
-	if (!cost || !["input", "output", "cacheRead", "cacheWrite"].every((field) => usable(cost[field]))) return null;
-	const maxTokens = model.maxTokens;
-	if (!(typeof maxTokens === "number" && Number.isFinite(maxTokens) && maxTokens > 0)) return null;
-	const inputRate = Math.max(cost.input, cost.cacheRead, cost.cacheWrite);
-	return Math.ceil(((FIRST_CALL_OVERHEAD_TOKENS + FIRST_CALL_MIN_CONTEXT_BYTES) * inputRate + maxTokens * cost.output) * serviceTierMultiplier(model));
-}
-
-/**
- * The runner's service-tier multiplier (`callCostBound` step 7, image/runner/src/usage-meter.mjs), copied like the
- * overhead above: pi multiplies a settled cost by the tier the RESPONSE reports on these two apis, which can be the
- * account's default rather than the request's, so the runner always bounds at the dearest tier. Leaving it out
- * (PR #551's review) let doctor stay silent on a cap the runner refuses every call under: openai/gpt-5.5 under $5.
- * `fleet-dollars.test.mjs` derives the runner's multiplier from its own bound for every priced api and holds this
- * equal to it.
- */
-export function serviceTierMultiplier(model) {
-	if (model?.api !== "openai-responses" && model?.api !== "openai-codex-responses") return 1;
-	return model.id === "gpt-5.5" ? 2.5 : 2;
-}
-
-/**
- * The model object the floor above is computed from: the builtin catalog's (`builtinModel`, model-catalog.mjs), or a
- * CUSTOM model the overlay `models.json` defines (its own `cost` and `maxTokens`). Null, so the model is not judged,
- * when the overlay redefines or overrides a builtin model: pi composes the two, and this does not copy that rule.
- */
-export function boundModelOf({ provider, id }, { builtinModel, overlay = null }) {
-	const providers = overlay?.providers;
-	const entry = providers !== null && typeof providers === "object" && !Array.isArray(providers) && Object.hasOwn(providers, provider) ? providers[provider] : null;
-	const builtin = builtinModel(provider, id);
-	if (entry !== null && typeof entry === "object") {
-		const overrides = entry.modelOverrides;
-		if (overrides !== null && typeof overrides === "object" && Object.hasOwn(overrides, id)) return null;
-		const definition = Array.isArray(entry.models) ? entry.models.find((m) => m !== null && typeof m === "object" && m.id === id) : undefined;
-		if (definition !== undefined) return builtin ? null : definition;
-	}
-	return builtin;
-}
+export { resolveConfiguredModelRuns as resolveDoctorModelRuns } from "./model-observation.mjs";
 
 /**
  * Who runs on which models under which cap (issues #501 and #502), as the worker resolves a job: the deployment's own
@@ -5086,7 +6183,7 @@ export function boundModelOf({ provider, id }, { builtinModel, overlay = null })
  * trigger's and the deployment's, `effectiveCostCapMicros`) or null, and `named` says the trigger names a provider, a
  * model or a list of its own.
  */
-export function modelSubjects({ runs = [], deployment, envList = null }) {
+export function modelSubjects({ runs = [], deployment, envList = null, modelRoles = {}, projects = [] }) {
 	const listOf = (list) => (Array.isArray(list) ? list.map(splitModelEntry).filter((ref) => ref !== null).map((ref) => ({ provider: ref.provider, id: ref.model })) : []);
 	const capOf = (triggerValue) => {
 		try {
@@ -5096,7 +6193,7 @@ export function modelSubjects({ runs = [], deployment, envList = null }) {
 		}
 	};
 	const subjects = [{ label: "the deployment default", main: { provider: deployment.provider, id: deployment.model }, list: listOf(envList), cap: capOf(undefined), secretNames: [], named: false, deployment: true }];
-	for (const run of runs) {
+	for (const run of resolveDoctorModelRuns({ runs, deployment, envList, modelRoles, projects }).runs) {
 		subjects.push({
 			label: run.label,
 			main: { provider: run.provider ?? deployment.provider, id: run.model ?? deployment.model },
@@ -5114,7 +6211,7 @@ export function modelSubjects({ runs = [], deployment, envList = null }) {
  * `modelSubjects` resolves them), for the overlay's output-cap line to leave to `costCapFitChecks` (issue #507). Empty
  * when the settings cannot be read.
  */
-export function cappedModelNames(env, { runs, deployment }) {
+export function cappedModelNames(env, { runs, deployment, modelRoles = {}, projects = [] }) {
 	let envList = null;
 	try {
 		envList = allowedModelsFrom(env);
@@ -5122,7 +6219,7 @@ export function cappedModelNames(env, { runs, deployment }) {
 		// A malformed PI_ALLOWED_MODELS is its own line.
 	}
 	const names = new Set();
-	for (const s of modelSubjects({ runs, deployment, envList })) {
+	for (const s of modelSubjects({ runs, deployment, envList, modelRoles, projects })) {
 		if (s.cap === null || s.cap === undefined) continue;
 		for (const ref of [s.main, ...s.list]) names.add(`${ref.provider}/${ref.id}`);
 	}
@@ -5137,10 +6234,13 @@ export function cappedModelNames(env, { runs, deployment }) {
  * Issue #507: `unboundable(ref)` says the runner cannot bound the model's output at all (`outputUnboundable`,
  * output-cap.mjs: openai-completions to a server off the trusted hosts without `compat.maxTokensField: "max_tokens"`),
  * so every call to it is refused under any cap. Such a model gets a line of its own, grouped by model, and no floor.
+ * Radius and every composed pi-messages model have a separate diagnosis: their server-reported billing and input
+ * rewrites are not bounded by the catalog, including rows whose listed rates are zero (issue #693).
  */
-export function costCapFitChecks(subjects, modelOf, { unboundable = () => false } = {}) {
+export function costCapFitChecks(subjects, modelOf, { unboundable = () => false, apiOf = (ref) => modelOf(ref)?.api } = {}) {
 	const groups = new Map();
 	const unbounded = new Map();
+	const radius = new Map();
 	for (const s of subjects) {
 		if (s.cap === null || s.cap === undefined) continue;
 		const seen = new Set();
@@ -5148,6 +6248,15 @@ export function costCapFitChecks(subjects, modelOf, { unboundable = () => false
 			const name = `${ref.provider}/${ref.id}`;
 			if (seen.has(name)) continue;
 			seen.add(name);
+			// The gateway reports its own prices and may rewrite input, so even a zero-rate catalog row is no bound.
+			const api = apiOf(ref);
+			if (api === "pi-messages" || (api === undefined && ref.provider === "radius")) {
+				if (!radius.has(name)) radius.set(name, { main: false, labels: [] });
+				const r = radius.get(name);
+				r.main ||= ref === s.main;
+				r.labels.push(s.label);
+				continue;
+			}
 			if (unboundable(ref)) {
 				if (!unbounded.has(name)) unbounded.set(name, { main: false, labels: [] });
 				const u = unbounded.get(name);
@@ -5164,6 +6273,15 @@ export function costCapFitChecks(subjects, modelOf, { unboundable = () => false
 		}
 	}
 	const out = [];
+	if (radius.size > 0) {
+		const items = [...radius].map(([name, r]) => `${printable(name)}${r.main ? " (the main model, so such a job makes no call at all)" : ""} (${r.labels.join(", ")})`);
+		out.push({
+			ok: false,
+			warn: true,
+			label: `${RADIUS_COST_CAP_LABEL}: ${items.join("; ")}`,
+			fix: RADIUS_COST_CAP_FIX,
+		});
+	}
 	if (unbounded.size > 0) {
 		const items = [...unbounded].map(([name, u]) => `${printable(name)}${u.main ? " (the main model, so such a job makes no call at all)" : ""} (${u.labels.join(", ")})`);
 		out.push({
@@ -5248,7 +6366,7 @@ export function unknownModelChecks(subjects, checkModelsKnown, readOverlay) {
  * Said nothing about a provider it cannot judge: no names at all (Bedrock reads the AWS chain), the keyless marker
  * (#503), or an `apiKey` that is not a variable reference.
  */
-export function listedProviderCredentialChecks(subjects, { candidatesOf, forwarded = [], env = {}, overlay = null }) {
+export function listedProviderCredentialChecks(subjects, { candidatesOf, forwarded = [], env = {}, overlay = null, subscriptionChecks = new Map() }) {
 	const providers = overlay?.providers;
 	const namesFor = (provider) => {
 		const entry = providers !== null && typeof providers === "object" && !Array.isArray(providers) && Object.hasOwn(providers, provider) ? providers[provider] : null;
@@ -5264,6 +6382,7 @@ export function listedProviderCredentialChecks(subjects, { candidatesOf, forward
 	for (const s of subjects) {
 		for (const provider of new Set(s.list.map((ref) => ref.provider))) {
 			if (provider === s.main.provider) continue;
+			if (subscriptionChecks.get(provider)?.managed) continue;
 			const names = namesFor(provider);
 			if (names.length === 0) continue;
 			if (names.some((n) => s.secretNames.includes(n) || (forwarded.includes(n) && typeof env[n] === "string" && env[n] !== ""))) continue;
@@ -5306,6 +6425,43 @@ export function deploymentSettingsOf(env, settingsFile, fileExists) {
 	return Object.fromEntries(Object.keys(fromEnv).map((key) => [key, resolved[key] ?? null]));
 }
 
+/** Subscription diagnostics use only local credential metadata, independently of forge validity or Valkey. */
+export async function doctorSubscriptionCredentials(env, { cwd = process.cwd(), home = safeHomeDir(), now = Date.now, configure } = {}) {
+	if (!env.PI_AUTH_CONNECTIONS_FILE) return { check: async () => ({ ok: true, managed: false }) };
+	let auth;
+	try {
+		configure ??= (await import("./subscription-config.mjs")).configuredSubscriptions;
+		const config = { authConnectionsFile: resolve(cwd, env.PI_AUTH_CONNECTIONS_FILE), authStoreDir: env.PI_AUTH_STORE_DIR ? resolve(cwd, env.PI_AUTH_STORE_DIR) : null, settingsFile: settingsFilePath(env, home), workerName: workerNameFrom(env), globalPiDir: env.PI_GLOBAL_PI_DIR || null, jobsDir: jobsDirPath(env), sandboxDir: env.PI_SANDBOX_DIR || defaultSandboxDir(env) };
+		auth = configure({ config, redis: null, now })?.auth;
+		if (typeof auth?.check !== "function") throw new Error();
+	} catch { return { check: async () => ({ ok: false, managed: true, reason: "auth-policy-invalid" }) }; }
+	const cache = new Map();
+	return { check(provider) {
+		if (!cache.has(provider)) cache.set(provider, Promise.resolve().then(() => auth.check(provider, { readOnly: true })).catch(() => ({ ok: false, managed: true, reason: "auth-state-unavailable" })));
+		return cache.get(provider);
+	} };
+}
+
+export function subscriptionCredentialCheck(provider, row) {
+	const name = printable(provider);
+	const owner = typeof row.ownerHost === "string" && WORKER_NAME_RE.test(row.ownerHost) ? ` on owner ${row.ownerHost}` : "";
+	const id = typeof (row.connectionId ?? row.id) === "string" && WORKER_NAME_RE.test(row.connectionId ?? row.id) ? ` ${row.connectionId ?? row.id}` : " CONNECTION";
+	if (row.ok === true) return { ok: true, label: `Subscription credential selected (${name})${owner}; the host renews access before admitted jobs` };
+	const words = {
+		"auth-owner-host": "belongs to another owner host; this worker defers its subscription jobs",
+		"auth-reauth-required": "requires sign-in on its owner host",
+		"auth-refresh-uncertain": "requires reconnect after an uncertain token refresh",
+		"auth-adapter-unpinned": "requires reviewed adapter staging",
+		"auth-adapter-source-mismatch": "requires reviewed adapter staging",
+		"auth-adapter-version-mismatch": "has an incompatible adapter version",
+		"auth-adapter-unavailable": "has no usable staged adapter",
+		"auth-store-permissions": "has unsafe private credential-store permissions",
+		"auth-credential-invalid": "has an invalid stored subscription credential",
+		"auth-policy-invalid": "has an unavailable or invalid connection policy",
+	};
+	return { ok: false, ...(row.reason === "auth-owner-host" ? { warn: true } : {}), label: `Subscription credential selected (${name}) ${words[row.reason] ?? "has unavailable credential metadata"}`, fix: row.reason === "auth-reauth-required" || row.reason === "auth-refresh-uncertain" ? `run \`pi-dispatch auth login${id}\` on the connection owner host` : "run `pi-dispatch auth status` on the connection owner host and correct its reviewed policy, adapter or private store" };
+}
+
 /** The worker's model catalog (model-catalog.mjs), imported lazily for `defaultProviderOracle`'s reason, or null. */
 async function defaultModelCatalog() {
 	try {
@@ -5405,8 +6561,8 @@ function triggerLabel(t, index) {
 	return t.on.type === "cron" ? `cron "${t.on.id}"` : `${t.on.type} trigger #${index}`;
 }
 
-function readTriggerFacts(env, fileExists, cwd, declaredWorkerName) {
-	const none = { requiring: 0, waiting: 0, listing: 0, waitProfiles: [], waitAfters: [], optingOut: 0, resuming: 0, replicating: 0, instructing: 0, commands: 0, secreting: 0, onceArmed: 0, onceSpent: 0, secretProfiles: [], localSecretFolders: [], secretNames: [], folders: [], images: [], imageRoutes: [], namedBackends: [], skillsDirs: [], forges: [], repositories: [], flows: [], costCaps: [], modelRuns: [], parseError: null, path: null };
+function readTriggerFacts(env, fileExists, cwd, declaredWorkerName, versionTables = {}) {
+	const none = { watchSources: {}, watchRules: 0, modelRoles: {}, secretBundles: {}, requiring: 0, waiting: 0, listing: 0, waitProfiles: [], waitAfters: [], optingOut: 0, resuming: 0, recovering: 0, replicating: 0, instructing: 0, commands: 0, secreting: 0, onceArmed: 0, onceSpent: 0, secretProfiles: [], localSecretFolders: [], secretNames: [], folders: [], images: [], imageRoutes: [], namedBackends: [], skillsDirs: [], forges: [], repositories: [], flows: [], excludedNames: [], costCaps: [], modelRuns: [], triggersVersionNeed: 1, jobDataVersionNeed: 1, parseError: null, parseNewer: false, path: null };
 	try {
 		// Unset falls back to ./triggers.json in cwd, MIRRORING the receiver's own default
 		// (receiver/src/config.mjs) -- the two must read the same file, or doctor preflights a deployment
@@ -5417,14 +6573,16 @@ function readTriggerFacts(env, fileExists, cwd, declaredWorkerName) {
 		// naming a FIFO hangs the command with no output and no timeout that can reach it.
 		if (!statSync(path).isFile()) return { ...none, parseError: `triggers file is not a regular file: ${path}`, path };
 		const text = readFileSync(path, "utf8");
-		const triggers = parseTriggers(text, path);
+		// The document parser, so the file's `secretBundles` (issue #704) is judged by the loaders' one rule too.
+		const { triggers, secretBundles, modelRoles, watchSources } = parseTriggersDocument(text, path, versionTables.triggers);
 		// The one-shot facts are counted from the RAW entries, not the parsed records, because the
 		// validator collapses a disarmed entry to a sentinel that carries neither `once` nor
 		// `disarmed` -- exactly so nothing can match it -- which also erases it from every parsed
 		// count above. Doctor is the surface that must still SEE the spent entry: "why did nothing
 		// fire" is answered by a spent row, and only the raw file still holds it. Safe unguarded:
 		// parseTriggers just accepted this same text, so JSON.parse cannot throw here.
-		const rawEntries = JSON.parse(text)?.triggers ?? [];
+		const rawDocument = JSON.parse(text);
+		const rawEntries = rawDocument?.triggers ?? [];
 		// Issue #433 review rounds 2 and 3: whether THIS HOST'S WORKER schedules a cron trigger, for the unblessed-venue
 		// line, by the worker's two conditions and nothing else. (a) The worker schedules cron only from a PI_TRIGGERS_FILE
 		// it was given (`config.triggersFile` is null without one, and `loadSchedules` then returns []), while doctor
@@ -5438,10 +6596,25 @@ function readTriggerFacts(env, fileExists, cwd, declaredWorkerName) {
 		const fleet = Boolean(declaredWorkerName);
 		const cronScheduledHere = (t) => env.PI_TRIGGERS_FILE !== undefined && cronPlacement(t.run, { existsSync: fileExists, fleet }) !== "elsewhere";
 		return {
+			// Issue #761: the version this file needs (the higher of what it declares and what its keys need), and the version
+			// the jobs its triggers queue need (`jobDataVersionFor`): for the fleet line that names a peer that cannot read
+			// either. The loader just accepted this text, so a declared version is an integer. The FILE's need is the raw
+			// keys', since an older loader reads the raw file; the JOBS' need is what the loader KEPT, each parsed entry's
+			// `run`, which is what the builders copy into job data (schedules.mjs, the receiver). A raw run key the loader
+			// drops (a hand-written `run.packageCanary`, which only the Updates page's canary job carries) reaches no job,
+			// so it needs no version, and a line claiming one would send an operator to upgrade for nothing.
+			triggersVersionNeed: Math.max(Number.isSafeInteger(rawDocument?.version) ? rawDocument.version : 1, triggersFileVersionFor(rawDocument, versionTables.triggers)),
+			jobDataVersionNeed: triggers.reduce((need, t) => Math.max(need, jobDataVersionFor(t?.run, versionTables.jobData)), 1),
+			watchSources,
+			watchRules: triggers.filter(t => t.on.type === "watch").length,
+			secretBundles,
+			modelRoles,
 			onceArmed: rawEntries.filter((t) => t?.on?.once === true && t.on.disarmed === undefined).length,
 			onceSpent: rawEntries.filter((t) => t?.on?.disarmed !== undefined).length,
 			requiring: triggers.filter((t) => t.run.packages === true).length,
 			resuming: triggers.filter((t) => t.run.resume === true).length,
+			// Issue #645: durable runs. Counted for the fleet line: a recovery is routed to the host holding its checkpoint.
+			recovering: triggers.filter((t) => t.run.recover === true).length,
 			// REQ-PER-TRIGGER-INSTRUCTION. Counted beside `resuming` for the same reason: it is a per-trigger
 			// choice that changes what every job of it is told, and an operator should see it before it fires.
 			instructing: triggers.filter((t) => typeof t.run.instructions === "string").length,
@@ -5519,14 +6692,18 @@ function readTriggerFacts(env, fileExists, cwd, declaredWorkerName) {
 			// entries by raw file position (the admin's trigger:<index> identity).
 			flows: triggers
 				.map((t, index) => ({
+					index,
 					label: triggerLabel(t, index),
 					flow: t.run.flow,
 					kind: t.run.kind,
 					folder: typeof t.run.folder === "string" ? t.run.folder : null,
 					skillsDir: typeof t.run.skillsDir === "string" ? t.run.skillsDir : null,
 					packages: t.run.packages !== false,
+					excludeExtensions: Array.isArray(t.run.excludeExtensions) ? t.run.excludeExtensions : [],
 				}))
 				.filter((f) => typeof f.flow === "string"),
+			// Issue #800: each trigger's run.excludeExtensions, for the line that says a name is on neither side of this host.
+			excludedNames: triggers.flatMap((t, index) => (Array.isArray(t.run.excludeExtensions) ? [{ label: triggerLabel(t, index), names: t.run.excludeExtensions, packages: t.run.packages !== false }] : [])),
 			// Issue #501: every trigger that sets run.maxCostUsd, with the label the cap check names it by. The value
 			// already parsed (the loader validated it), so the check below only compares.
 			costCaps: triggers.map((t, index) => ({ label: triggerLabel(t, index), maxCostUsd: t.run.maxCostUsd })).filter((r) => r.maxCostUsd !== undefined && r.maxCostUsd !== null),
@@ -5535,9 +6712,13 @@ function readTriggerFacts(env, fileExists, cwd, declaredWorkerName) {
 			// a model the worker does not know is refused wherever the job runs.
 			modelRuns: triggers.map((t, index) => ({
 				label: triggerLabel(t, index),
+				kind: t.run.kind,
+				folder: t.run.folder,
+				repository: t.run.repository,
 				provider: typeof t.run.provider === "string" ? t.run.provider : undefined,
 				model: typeof t.run.model === "string" ? t.run.model : undefined,
 				models: Array.isArray(t.run.models) ? t.run.models : undefined,
+				fallbackModels: Array.isArray(t.run.fallbackModels) ? t.run.fallbackModels : undefined,
 				maxCostUsd: t.run.maxCostUsd ?? undefined,
 				secretNames: t.run.secrets !== undefined && t.run.secrets !== null ? Object.keys(t.run.secrets) : [],
 			})),
@@ -5562,7 +6743,9 @@ function readTriggerFacts(env, fileExists, cwd, declaredWorkerName) {
 		// a directory), which is not a statement about the file's CONTENT and has no fix an operator can act
 		// on from this line. Those keep the old silent zeroes.
 		if (e?.piDispatchConfig !== true) return none;
-		return { ...none, parseError: e.message, path: triggersPath(env, cwd) };
+		// Issue #761: `parseNewer` is the loader's own flag for a file a newer pi-dispatch wrote, so the fix below says to
+		// upgrade rather than to edit it.
+		return { ...none, parseError: e.message, parseNewer: e.newer === true, path: triggersPath(env, cwd) };
 	}
 }
 
@@ -6189,7 +7372,7 @@ async function egressChecks(env, seams, { dockerCode, imageCode, jobImage, endpo
 	// ONE detach gate for this doctor run (issue #452, gate round 3), shared by the sweep and the canary: `local` can be a
 	// rootless Podman 4.x reached as `docker`, where both of them detach the running proxy.
 	const gate = makeDetachGate(canaryDocker, { bin: "docker", ...(seams.readFactsOnce ? { readRuntime: async () => runtimeFromFacts(await seams.readFactsOnce()) } : {}) });
-	checks.push(...(await sweepStaleCanaryNetworks({ run: canaryDocker, pid, isAlive, endpoint, gate })));
+	if (!seams.setupReadOnly) checks.push(...(await sweepStaleCanaryNetworks({ run: canaryDocker, pid, isAlive, endpoint, gate })));
 
 	// `docker inspect` on the container, not `ps`: it answers present-vs-absent and running-vs-stopped in
 	// one call, and those are two different fixes. The FIELD_SEP habit is image-preflight.mjs's -- neither
@@ -6268,6 +7451,8 @@ async function egressChecks(env, seams, { dockerCode, imageCode, jobImage, endpo
 	// `--live` reads, so the output never reads healthy right before saying the proxy is not this deployment's.
 	const staleRunning = up && !custom && judged.drift.length > 0;
 	const proxyCheck = {
+		// Issue #737: the console reads whether the proxy runs by this id (`NAMED_CHECK_IDS`).
+		id: "egress.proxy",
 		ok: up,
 		...(retried ? { warn: true } : {}),
 		label: up
@@ -6299,6 +7484,8 @@ async function egressChecks(env, seams, { dockerCode, imageCode, jobImage, endpo
 	if (!custom) {
 		if (judged.drift.length > 0) {
 			checks.push({
+				// This line stands in for the proxy's own (not pushed while `staleRunning`), so it carries that line's id.
+				id: proxyCheck.id,
 				ok: false,
 				label: judged.outOfDate ? `Egress proxy is this deployment's proxy but out of date (${proxy}): ${judged.drift.join("; ")}` : `Egress proxy is running but is not this deployment's (${proxy}): ${judged.drift.join("; ")}`,
 				fix: `${replaceFix}; until then every job's egress runs through a policy this deployment did not ship`,
@@ -6347,6 +7534,10 @@ async function egressChecks(env, seams, { dockerCode, imageCode, jobImage, endpo
 		const mounted = readIncludeBindSource(parsed?.mounts);
 		checks.push(endpointsIncludeCheck({ answer: inside, endpoints, bin: "docker", proxy, prefix: "", mounted, recreate: custom ? `recreate ${proxy} so it mounts the file anew` : `\`docker rm -f -v ${proxy}\`, then \`pi-dispatch up\` starts it on the file anew (a restart cuts running jobs' tunnels)` }));
 	}
+	if (seams.setupReadOnly) {
+		checks.push({ ok: false, warn: true, label: "Egress canary: not run by browser setup", fix: "run pi-dispatch doctor in the deployment terminal for the container probe" });
+		return checks;
+	}
 	if (imageCode !== 0) return checks;
 	// Issue #431: the canary itself is `runEgressCanary`, shared with the podman venue's `--live` and the conformance
 	// script. docker's probes keep `runCmdCapture` (its 30 s bound, stderr merged, SIGTERM at the bound) rather than the
@@ -7121,7 +8312,8 @@ export function allowlistHostAliases(text) {
 }
 
 /**
- * The worker and receiver services installed for THIS folder, as `[{ which, source, setup }]` (`setup` null for a unit
+ * The services installed for THIS folder (the worker, the receiver and, since issue #708, the console), as
+ * `[{ which, source, setup }]` (`setup` null for a unit
  * rendered without `--env-setup`): an installed unit whose WorkingDirectory is this folder (systemd, launchd), or the
  * nssm service by name on win32, where nssm keeps the folder in a separate AppDirectory property and there is exactly
  * one machine-scoped service per name. Read ONCE (issue #481, PR #485's final review) and shared by the env-setup lines
@@ -7131,7 +8323,7 @@ async function installedServices(seams) {
 	const { cwd, spawn, fileExists, platform, home } = seams;
 	const found = [];
 	if (platform === "win32") {
-		for (const which of ["worker", "receiver"]) {
+		for (const which of ["worker", "receiver", "console"]) {
 			const service = `pi-dispatch-${which}`;
 			const got = await runCmdCapture(spawn, "nssm", ["get", service, "AppEnvironmentExtra"]);
 			// Not installed, or nssm not on PATH: silence. Same doctrine as check-ignore below -- a check
@@ -7700,7 +8892,7 @@ export function jobSizeChecks(env, { daemon = undefined, podman = undefined, cpu
 		return [{ ok: false, label: `job size does not parse: ${error.message}, so the worker REFUSES TO START`, fix: "set PI_JOB_MEMORY like 512m, 1536m or 4g and PI_JOB_CPUS like 0.5 or 2 (or unset them for 4g and 2), then re-run doctor" }];
 	}
 	const where = d.memSet || d.cpuSet ? "PI_JOB_MEMORY and PI_JOB_CPUS" : "the built-in default";
-	const checks = [{ ok: true, label: `Job size: ${formatMemory(d.memMiB)} of memory with no swap beyond it, and the CPU weight of ${formatCpus(d.cpuCenti)} CPUs, per job (${where}; a project row's memory and cpus override it, docs/scoped-limits.md)` }];
+	const checks = [{ ok: true, label: `Job size: ${formatMemory(d.memMiB)} of memory with no swap beyond it, and the CPU weight of ${formatCpus(d.cpuCenti)} CPUs, per job (${where}; a project row's memory and cpus override it, docs/scoped-limits.md); codemode workers: ${codemodeWorkersOf(d.memMiB)} (PI_CODEMODE_MAX_WORKERS, half the memory reserved for pi, tools and worker overhead; a sizing heuristic, not an RSS guarantee)` }];
 	const venues = [];
 	// `reason` is the reader's own token (`timeout`, `unparseable`, ...), never the runtime's text.
 	const reasonOf = (read) => (typeof read?.reason === "string" && /^[a-z0-9-]{1,40}$/.test(read.reason) ? read.reason : "not read");
@@ -7953,22 +9145,26 @@ export const CAPACITY_DOCTOR_TIMEOUT_MS = 5_000;
 
 /**
  * The capacity lines (issue #599, phase 2): the report over the last 7 days (`capacity.mjs`, the CLI's function), read
- * by `seams.readCapacity` (default: `readCapacityRecords` through a fail-fast client, `prune`-free and writing nothing).
- * Never throws and never warns: an unreadable history is one line saying so.
+ * by `seams.readCapacity` (default: `readCapacityRecords` through a fail-fast client, `prune`-free and writing nothing;
+ * `seams.readCapacityRecords` stands in for `readCapacityRecords` alone, see `defaultReadCapacity`). Never throws and
+ * never warns: an unreadable history is one line saying so.
  */
 export async function doctorCapacity({ seams, env, home, url, hosts, localHost }) {
 	try {
 		const window = CAPACITY_WINDOWS["7d"];
 		const nowMs = (typeof seams.wallClock === "function" ? seams.wallClock : Date.now)();
 		const retention = typeof env.PI_LOG_RETENTION_DAYS === "string" && /^\d{1,6}$/.test(env.PI_LOG_RETENTION_DAYS) ? Number(env.PI_LOG_RETENTION_DAYS) : 30;
+		// The mirror's cap (PI_RUN_MIRROR_MAX_RUNS, issue #761), so an index the workers may grow past the built-in cap is not
+		// read as one a trim cut short. Lenient: a bad value is the worker's refusal, which `workerIntSettingChecks` names.
+		const indexMax = runMirrorMaxRunsOf(env.PI_RUN_MIRROR_MAX_RUNS).value;
 		// The read is told to stop when the bound passes (`signal`): giving up on it is not enough, since a client still
 		// waiting on its connection would keep this process alive after doctor has printed everything.
 		const stop = new AbortController();
-		const args = { url, logsDir: logsDirPath(env, home), sinceMs: nowMs - window.ms, nowMs, retentionDays: retention, localHost, signal: stop.signal };
+		const args = { url, logsDir: logsDirPath(env, home), sinceMs: nowMs - window.ms, nowMs, retentionDays: retention, localHost, indexMax, signal: stop.signal };
 		let timer;
 		const read = await Promise.race([
 			Promise.resolve()
-				.then(() => (seams.readCapacity ?? defaultReadCapacity)(args))
+				.then(() => (seams.readCapacity ?? ((a) => defaultReadCapacity(a, seams.readCapacityRecords)))(args))
 				.finally(() => clearTimeout(timer)),
 			new Promise((resolve) => {
 				timer = setTimeout(() => {
@@ -8003,11 +9199,14 @@ export const CAPACITY_CONNECT_TIMEOUT_MS = 2_000;
 /**
  * The default capacity read: a fail-fast client, its connection bounded (`connectWithin`: a server that accepts TCP and
  * never answers holds ioredis in its ready check forever) and DISCONNECTED when `signal` aborts, so a read doctor gave
- * up on cannot keep the process alive.
+ * up on cannot keep the process alive. `readRecords` (doctor's `seams.readCapacityRecords`, for a test) stands in for
+ * `readCapacityRecords` and receives exactly what it would, the mirror's cap included. The forbidden-read guard still
+ * runs first, whether or not it is given: it is a seam for a test process that never forbade the real read, and it
+ * lifts the guard for no other test.
  */
-async function defaultReadCapacity({ url, logsDir, sinceMs, nowMs, retentionDays, localHost, signal }) {
+async function defaultReadCapacity({ url, logsDir, sinceMs, nowMs, retentionDays, localHost, indexMax, signal }, readRecords = undefined) {
 	if (defaultCapacityReadForbidden) throw Object.assign(new Error("doctor reached its real capacity read in a test: pass readCapacity"), { [FORBIDDEN_READ]: true });
-	const { readCapacityRecords } = await import("./capacity-records.mjs");
+	const readCapacityRecords = readRecords ?? (await import("./capacity-records.mjs")).readCapacityRecords;
 	let client = null;
 	// Measured on ioredis 5.11: `disconnect()` ends the socket and arms a timer (`disconnectTimeout`, 2 s by default)
 	// that destroys it unless the socket's `close` clears it first, and the client's own failed ready check disconnects
@@ -8036,7 +9235,7 @@ async function defaultReadCapacity({ url, logsDir, sinceMs, nowMs, retentionDays
 		}
 	}
 	try {
-		return await readCapacityRecords({ redis: client, logsDir, sinceMs, nowMs, retentionDays, localHost, noMirrorReason: url ? "the Valkey did not answer: only this host's files were read" : "no Valkey to read: only this host's files were read" });
+		return await readCapacityRecords({ redis: client, logsDir, sinceMs, nowMs, retentionDays, localHost, indexMax, noMirrorReason: url ? "the Valkey did not answer: only this host's files were read" : "no Valkey to read: only this host's files were read" });
 	} finally {
 		signal?.removeEventListener?.("abort", drop);
 		drop();
@@ -8059,6 +9258,239 @@ export function connectWithin(client, ms, signal) {
 	});
 }
 
+// ---- issue #761: what an upgrade leaves behind ----------------------------------------------------------------------
+
+/** A version a registry row may carry: npm's characters, at most 32 of them. Anything else, `""` included, is unknown. */
+const ROW_VERSION_RE = /^[0-9A-Za-z.+-]{1,32}$/;
+const rowVersion = (v) => (typeof v === "string" && ROW_VERSION_RE.test(v) ? v : null);
+
+/**
+ * The fleet's versions (issue #761): one `fleet.versions` check, or none. PURE.
+ *   - `installed`: this doctor's own package version (`PACKAGE_VERSION`), null when it could not be read;
+ *   - `self`: this host's own registry row (its worker's), null when it publishes none; `selfName` its name;
+ *   - `peers`: every other live worker's row.
+ * A WARNING when the live workers do not all report one version (an unreadable one, which a worker publishes as `""`
+ * when it cannot read its own manifest, or a row's value outside the charset, is its own group, "unknown"), or when
+ * this doctor's version is not the one this host's worker row reports. The second is worded as exactly that, two facts,
+ * never "not restarted" and never "the running worker": doctor may run from another install (npx, another checkout),
+ * and then it is that, not the service, which differs; and a row outlives a worker that died without deleting it for up
+ * to its TTL (`HOST_TTL_MS`, 90 s), so what reports the version is the row, not a worker known to run. The headline says
+ * "differ" only of versions it read: two readable ones among the workers, or this doctor's against this host's row.
+ * Where the only other group is "unknown" it says the versions "cannot all be read", since an unread version may be the
+ * same one. The fix is the order of docs/upgrading.md for each host: pause, wait for no active job, restart, resume.
+ * Not `service restart --drain`, which covers this host's queues alone (the shared one and its own) and resumes them
+ * after its own restart, so it is not the fleet's pause: a peer's own queue keeps running under it. An ok line when
+ * peers exist and every one, this host's included, reports one known version, naming them as the workers with a live
+ * row (this host's worker may publish none); nothing on a single host whose worker row reports this doctor's version,
+ * or publishes none, so its output is unchanged. Workers only: the receiver's status row is never a doctor input
+ * (INT-RECEIVER-STATUS-KEY).
+ */
+export function fleetVersionChecks({ installed, self = null, selfName = null, peers = [] }) {
+	const others = Array.isArray(peers) ? peers : [];
+	const rows = [...(self ? [{ name: printable(String(selfName ?? self.name ?? "")), version: rowVersion(self.version) }] : []), ...others.map((p) => ({ name: printable(String(p?.name ?? "")), version: rowVersion(p?.version) }))];
+	const groups = new Map();
+	for (const r of rows) groups.set(r.version ?? "unknown", [...(groups.get(r.version ?? "unknown") ?? []), r.name]);
+	const parts = [];
+	if (groups.size > 1) parts.push(`the live workers report ${groups.size} versions: ${[...groups.entries()].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)).map(([v, names]) => `${v} (${names.sort().join(", ")})`).join(", ")}`);
+	const mine = rowVersion(installed);
+	const running = self ? rowVersion(self.version) : null;
+	const apart = mine !== null && running !== null && mine !== running;
+	if (apart) parts.push(`this doctor ${mine}, this host's worker row reports ${running}`);
+	const warn = parts.length > 0;
+	const differ = [...groups.keys()].filter((v) => v !== "unknown").length > 1 || apart;
+	const agreed = !warn && others.length > 0 && groups.size === 1 && !groups.has("unknown");
+	if (!warn && !agreed) return [];
+	const fix = `finish the upgrade in one window (docs/upgrading.md): the same version on every host; on each host \`pi-dispatch pause\`, wait until \`pi-dispatch status\` shows no active job, restart the worker, then \`pi-dispatch resume\`${apart ? ". If this doctor is not the install the service runs (npx, another checkout), run that install's doctor instead" : ""}`;
+	const one = rows.length === 1;
+	const ok = `Fleet versions: the ${rows.length} ${one ? "worker with a live row reports" : "workers with a live row report"} ${[...groups.keys()][0]}`;
+	return [{ id: "fleet.versions", ok: !warn, ...(warn ? { warn: true } : {}), label: warn ? `pi-dispatch versions ${differ ? "differ" : "cannot all be read"}: ${parts.join("; ")}` : ok, ...(warn ? { fix } : {}) }];
+}
+
+/** The most the dollar window check may take, its records read and its counter read together. */
+export const DOLLAR_WINDOWS_DOCTOR_TIMEOUT_MS = 5_000;
+
+const WINDOW_WORDS = Object.freeze({ day: { its: "today's", cap: "daily" }, week: { its: "this week's", cap: "weekly" }, month: { its: "this month's", cap: "monthly" } });
+/** A counter value as micro-dollars, sign kept: `-$2.00` for a counter a give-back took below 0. */
+const usdSigned = (micros) => (micros < 0 ? `-$${formatMicros(-micros)}` : `$${formatMicros(micros)}`);
+const utcMinute = (ms) => `${new Date(ms).toISOString().slice(0, 16).replace("T", " ")} UTC`;
+
+/**
+ * The dollar window reset check (issue #761, DES-DOLLAR-RESERVE-AND-SETTLE): whether a deployment dollar window's
+ * counter holds less than this host's own run records settled into it, which only lost history explains (a flushed,
+ * replaced or restored Valkey, an evicted key, a hand edit): the cap then counts from less than was spent and can let
+ * at least the difference more be spent. One warning for every such window, or nothing.
+ *
+ *   1. The deployment's day, week and month caps, overlay over env (`deploymentSettingsOf`, `dollarWindowCaps`, which
+ *      throws on a value the worker refuses: that is its own line, and this check says nothing). None set, or no Valkey
+ *      this command may talk to (`url` null): nothing is read.
+ *   2. This host's records FIRST (`seams.readDollarRecords`; default: `readLocalWindow` from the start of the earliest
+ *      active window, a file at a time until the bound passes), summed per window by `dollarWindowFloors` over this
+ *      host's name and the endpoint tag of `url` (`valkeyEndpointTag`, the worker's).
+ *   3. THEN the counters of the windows whose sum is above 0 (`seams.readDollarCounters`; default: one MGET). In this
+ *      order every record read was settled before its counter was read, so a counter read after it cannot be
+ *      legitimately below it.
+ *   4. A counter that is absent, or an integer below the sum (a negative one included), is a finding; one that is not
+ *      an integer is skipped.
+ * Both default reads share one bound (`DOLLAR_WINDOWS_DOCTOR_TIMEOUT_MS`) and are refused in tests
+ * (`forbidDefaultDollarWindowRead`). A read that fails or runs out of time says nothing: this check claims a reset only
+ * where it sees one, and its silence is never a claim that nothing was lost. It sees this host's share only (another
+ * host's records are not here) and only the deployment windows (a scoped, project or model key is a hash per ledger),
+ * from the records written since issue #761 (`dollars.reservedIn`).
+ */
+export async function doctorDollarWindows({ seams = {}, env = {}, home, url, localHost, fileExists = existsSync }) {
+	// Resolved first, then judged: `deploymentSettingsOf` never throws and hands back values as written, which
+	// `dollarWindowCaps` may refuse.
+	const settings = deploymentSettingsOf(env, settingsFilePath(env, home), fileExists);
+	let caps = null;
+	try {
+		caps = dollarWindowCaps(settings);
+	} catch {
+		return [];
+	}
+	const valkey = url ? valkeyEndpointTag(url) : null;
+	if (caps === null || valkey === null) return [];
+	try {
+		const nowMs = (typeof seams.wallClock === "function" ? seams.wallClock : Date.now)();
+		const at = deploymentWindowsAt(nowMs);
+		const active = DEPLOYMENT_WINDOWS.filter((w) => caps[w] !== null && caps[w] !== undefined && at[w].bucket !== null).map((w) => ({ window: w, cap: caps[w], ...at[w] }));
+		if (active.length === 0) return [];
+		// The bound runs on the real clock, never the injected one a test fixes: it measures how long this read takes.
+		const clock = typeof seams.dollarWindowsClock === "function" ? seams.dollarWindowsClock : Date.now;
+		const deadlineAt = clock() + (seams.dollarWindowsTimeoutMs ?? DOLLAR_WINDOWS_DOCTOR_TIMEOUT_MS);
+		const read = await (seams.readDollarRecords ?? defaultReadDollarRecords)({ logsDir: logsDirPath(env, home), sinceMs: Math.min(...active.map((w) => w.startMs)), deadlineAt, clock });
+		const floors = dollarWindowFloors(read?.records, { host: localHost, valkey, buckets: Object.fromEntries(active.map((w) => [w.window, w.bucket])) });
+		const due = active.filter((w) => floors[w.window] > 0);
+		if (due.length === 0) return [];
+		const counters = await (seams.readDollarCounters ?? defaultReadDollarCounters)({ url, keys: due.map((w) => w.key), deadlineAt, clock });
+		if (!Array.isArray(counters) || counters.length !== due.length) return [];
+		const found = [];
+		due.forEach((w, i) => {
+			const raw = counters[i];
+			if (raw === null || raw === undefined) return void found.push({ ...w, floor: floors[w.window], counter: null });
+			const text = typeof raw === "number" ? String(raw) : raw;
+			if (typeof text !== "string" || !/^-?\d{1,16}$/.test(text) || !Number.isSafeInteger(Number(text))) return;
+			if (Number(text) < floors[w.window]) found.push({ ...w, floor: floors[w.window], counter: Number(text) });
+		});
+		return dollarWindowResetChecks(found);
+	} catch (err) {
+		if (err?.[FORBIDDEN_READ]) throw err;
+		return [];
+	}
+}
+
+/**
+ * The one `dollars.window-reset` warning for `found` (`doctorDollarWindows`), each `{ window, key, cap, floor, counter,
+ * ttlSeconds, endMs }` (`counter` null for an absent key), or none for an empty list. PURE. It says "at least" and
+ * "this host's" wherever it gives an amount: the other hosts' records are not here, so the real shortfall can only be
+ * larger. The fix puts the shortfall back (`INCRBY`, then `EXPIRE` with the window's own TTL, printed, and without
+ * `NX`, which an operator's older Valkey may not take), lowers the cap, or pauses until the window ends. On a fleet
+ * the amount is the sum of every host's settled share less what the counter holds, never the sum of each host's
+ * shortfall: each shortfall subtracts the counter, so adding them subtracts it once per host and puts back too little.
+ * The sum is in micro-dollars, as `INCRBY` takes it, while the label names dollars.
+ */
+export function dollarWindowResetChecks(found) {
+	if (!Array.isArray(found) || found.length === 0) return [];
+	const parts = found.map((f) => {
+		const short = f.floor - (f.counter ?? 0);
+		const holds = f.counter === null ? "is missing" : `holds ${usdSigned(f.counter)}`;
+		return `${WINDOW_WORDS[f.window].its} (${f.key}) ${holds} while this host's own run records settled $${formatMicros(f.floor)} into it, so the $${formatMicros(f.cap)} ${WINDOW_WORDS[f.window].cap} cap counts at least $${formatMicros(short)} too little`;
+	});
+	const put = found.map((f) => `\`valkey-cli INCRBY ${f.key} ${f.floor - (f.counter ?? 0)}\` then \`valkey-cli EXPIRE ${f.key} ${f.ttlSeconds}\``);
+	const ends = found.map((f) => `${WINDOW_WORDS[f.window].its} at ${utcMinute(f.endMs)}`);
+	const one = found.length === 1;
+	return [
+		{
+			id: "dollars.window-reset",
+			ok: false,
+			warn: true,
+			label: `${one ? "A dollar window counter is" : "Dollar window counters are"} below what this host's own runs settled into ${one ? "it" : "them"}, so ${one ? "its" : "their"} history was lost (a flushed, replaced or restored Valkey, an evicted key, or a hand edit) and the cap can let at least that much more be spent: ${parts.join("; ")}. Other hosts' runs are not counted here`,
+			fix: `put back at least this host's share for the rest of the window: ${put.join("; ")} (on a fleet, run doctor on every host first, then \`INCRBY\` the sum, in micro-dollars, of what each says its records settled, less what the counter holds now), or lower the cap by what was already spent, or run \`pi-dispatch pause\` and resume once the window ends (${ends.join("; ")}). A counter lowered on purpose is named here until its window ends (docs/costs.md, "When a counter resets")`,
+		},
+	];
+}
+
+/**
+ * Set by the test helper (test/helpers/doctor.mjs), as `forbidDefaultCapacityRead` is: from then on the dollar window
+ * check's DEFAULT reads throw an error doctor does not swallow, so a test that reaches the developer's real logs
+ * directory and Valkey fails loudly instead of judging whatever that machine holds.
+ */
+let defaultDollarWindowReadForbidden = false;
+export function forbidDefaultDollarWindowRead() {
+	defaultDollarWindowReadForbidden = true;
+}
+const forbiddenDollarRead = () => Object.assign(new Error("doctor reached its real dollar window read in a test: pass readDollarRecords and readDollarCounters"), { [FORBIDDEN_READ]: true });
+
+/** The default records read: this host's files, a file at a time until `deadlineAt` (`readLocalWindow`). */
+async function defaultReadDollarRecords({ logsDir, sinceMs, deadlineAt, clock }) {
+	if (defaultDollarWindowReadForbidden) throw forbiddenDollarRead();
+	const { readLocalWindow } = await import("./capacity-records.mjs");
+	return readLocalWindow(logsDir, { sinceMs, deadlineAt, clock });
+}
+
+/**
+ * The default counters read: one MGET through a fail-fast client, its connection and its command each bounded by what
+ * is left before `deadlineAt`, so the whole check stays inside its bound. Null when it could not be read.
+ */
+async function defaultReadDollarCounters({ url, keys, deadlineAt, clock }) {
+	if (defaultDollarWindowReadForbidden) throw forbiddenDollarRead();
+	const left = () => Math.max(0, deadlineAt - clock());
+	if (left() === 0) return null;
+	try {
+		return await withDoctorClient(url, (client) => boundedOp(client.mget(...keys), left()), { connectTimeoutMs: left() });
+	} catch {
+		return null;
+	}
+}
+
+/**
+ * The findings of older-state.mjs (`olderStateFindings({ cwd, home, readFile, valkeyContainer, handedOver })`, a promise
+ * of `{ store, label, fix }` each), through `seams.olderStateFindings` when given. Never throws: an answer of another
+ * shape is no finding, and every label and fix is made printable here, the printer not relying on it.
+ */
+async function olderStateOf(seams, { cwd, home, valkeyContainer, handedOver }) {
+	try {
+		const find = typeof seams.olderStateFindings === "function" ? seams.olderStateFindings : olderStateFindingsReal;
+		const found = await find({ cwd, home, readFile: (path) => readFileSync(path, "utf8"), valkeyContainer, handedOver });
+		return (Array.isArray(found) ? found : []).filter((f) => typeof f?.label === "string" && typeof f?.fix === "string").map((f) => ({ label: printable(f.label), fix: printable(f.fix) }));
+	} catch {
+		return [];
+	}
+}
+
+/**
+ * older-state.mjs's `valkeyContainer`: `valkeyContainerOwner`'s verdict on the container `up` starts the deployment's
+ * Valkey as (`docker container inspect pi-dispatch-valkey`, judged by up's own rule with this folder, as given and as its
+ * real path, and VALKEY_URL's port), or null; it never throws. A container docker cannot describe, or none, is a verdict
+ * that is not `ours`, which names nothing. Null itself, so the container is not asked about at all, unless:
+ *   - `asked`: this deployment runs jobs on Docker and the daemon answered `docker info`, since doctor spawns no docker
+ *     anywhere else (issue #433), and VALKEY_URL was read as the service reads it (the caller's gate);
+ *   - and VALKEY_URL names this host by an IPv4 loopback address or `localhost`, where `up` runs a Valkey (it adds none
+ *     for another host's, and refuses an IPv6 literal). Elsewhere a `pi-dispatch-valkey` here is not the queue the
+ *     worker dials, whatever port it publishes, and the fix would remove it.
+ */
+function valkeyContainerReader({ spawn, runTimeouts, asked, cwd, valkeyUrl }) {
+	if (!asked || typeof cwd !== "string" || cwd === "") return null;
+	const target = valkeyTarget(valkeyUrl);
+	if (target.error || !isLoopbackHost(target.host) || target.host.includes(":")) return null;
+	let deployment = cwd;
+	try {
+		deployment = realpathSync(cwd);
+	} catch {
+		// Unresolvable: the folder as given, as `up` does.
+	}
+	const query = async (cmd, args) => {
+		const r = await runCmdCapture(spawn, cmd, args, { stdoutOnly: true, timeoutMs: runTimeouts?.cmd ?? RUN_TIMEOUTS.cmd });
+		return { code: r.code, stdout: r.output, stderr: "" };
+	};
+	return async () => {
+		try {
+			return await valkeyContainerOwner(VALKEY_CONTAINER, { dirs: [deployment, cwd], port: target.port, query });
+		} catch {
+			return null;
+		}
+	};
+}
+
 /**
  * One fact line per host of a capacity report (`INT-CAPACITY-REPORT`), `{ ok: true, label }` each, never a warning:
  * `Host a: last 7d busy 63% (avg 2.1 of 4 slots, full 12%), promised 48% memory / 40% CPU, used 18% CPU of 8, wait p50
@@ -8329,6 +9761,13 @@ export function backendChecks(env, { endpoint = null, daemon = null, fs = { stat
 		// that could not start.
 		checks.push({ ok: false, label: `PI_EGRESS does not parse, so what this deployment actually gets cannot be determined: ${error.message}`, fix: 'set PI_EGRESS to exactly "0" (off) or "1"/unset (on)' });
 	}
+	// Issue #684 (review): the worker's own boot rule for a layer venue with egress off, replayed from `backendRefusals`
+	// so doctor and the worker say one sentence. Only that rule: the floor rules are this section's own lines below.
+	if (switches.PI_EGRESS === false) {
+		for (const refusal of backendRefusals({ backends, backendFloor: {}, egress: false }).filter((r) => r.startsWith("PI_EGRESS=0 cannot run"))) {
+			checks.push({ ok: false, label: refusal, fix: "unset PI_EGRESS (armed is the default), or remove that backend from PI_BACKENDS: the worker refuses to boot otherwise" });
+		}
+	}
 
 	// The dispatch landed in slice 4, so the "nothing selects yet" qualifier came off -- and it came off HERE
 	// as well as in the code, because a stale caveat on the one surface that makes the table admissible is
@@ -8340,8 +9779,12 @@ export function backendChecks(env, { endpoint = null, daemon = null, fs = { stat
 			const d = declarationOf(name, property);
 			if (!d) continue;
 			// FIRST, ahead of the gate: a control that does not exist is not a control that is unarmed.
+			// A WARNING since issue #707, no longer a ✗: since the openshell venues, a blessed venue legitimately declares
+			// properties absent (`localFolders`, `pausable`), and a ✗ here failed doctor, and so `up`, on every such
+			// deployment. Whether the deployment NEEDS the property is the floor's to say, and that refusal is its own ✗
+			// below (`PI_BACKEND_FLOOR is not met`), as the worker's boot refusal is unchanged.
 			if (d.word === ABSENT) {
-				checks.push({ ok: false, label: `${name}: ${property} is ABSENT -- ${d.question}`, fix: `this backend does not provide ${property}; a deployment that needs it must not run jobs on ${name}` });
+				checks.push({ ok: false, warn: true, label: `${name}: ${property} is ABSENT -- ${d.question}`, fix: `this backend does not provide ${property}: a PI_BACKEND_FLOOR naming ${property} refuses the boot while ${name} is blessed, so a deployment that needs it must not run jobs on ${name}` });
 				continue;
 			}
 			if (d.armedBy && switches[d.armedBy] === undefined) {
@@ -8894,6 +10337,8 @@ export async function podmanChecks(env, seams, { jobImage, jobImageNote = "" })
 		const crashLoop = status === "stopped" || status === "restarting";
 		const retried = state.code === 0 && !proxyRunning && /^[a-z]{1,20}$/.test(status ?? "") && !STOPPED_PROXY_STATES.has(status) && !crashLoop;
 		checks.push({
+			// Issue #737: docker's proxy line's id, for this venue's proxy (`REPEATED_CHECK_IDS`).
+			id: "egress.proxy",
 			ok: proxyRunning,
 			...(retried ? { warn: true } : {}),
 			label: proxyRunning ? `podman: egress proxy running under this account's Podman (${proxy})` : state.code === 0 ? `podman: egress proxy is ${/^[a-z]{1,20}$/.test(status ?? "") ? status : "in a state it did not report"} under this account's Podman (${proxy})` : `podman: egress proxy is not under this account's Podman (${proxy})`,
@@ -9244,6 +10689,9 @@ export async function liveChecks(env, seams, facts) {
 	// endpoint the job-user line was decided from. The fixture's global directory is never relabelled, like a job's.
 	const relabel = relabelsPrivateMounts(facts.daemon?.answered ? facts.daemon.facts : null, facts.endpoint, ids.platform ?? seams.platform);
 	const result = await runLiveProbes({
+		// Issue #681: the local venue's builder and CLI, named rather than defaulted.
+		buildArgs: buildDockerRunArgs,
+		bin: "docker",
 		image: facts.jobImage ?? jobImageOf(env).image,
 		// Issue #596: the deployment's default size, and the `--cpus` ceiling from the same `docker info` answer, so the
 		// probe is built at the size a job gets and reads back memory, swap, weight and ceiling against it.
@@ -9838,3 +11286,20 @@ export function liveRunVia(spawn, { bin = "docker" } = {}) {
 			child.on("close", (code) => finish(code, "close"));
 		});
 }
+
+/** Diagnose reviewed source bindings without resolving or printing credential values. */
+export function watchDoctorChecks({ sources = {}, rules = 0, env = {} } = {}) {
+	const entries = Object.entries(sources);
+	if (!entries.length) return [];
+	const checks = [{ id: "watch.sources", ok: true, label: `${entries.length} watch source(s), ${rules} watch rule(s); daily caps are required at load` }];
+	for (const [source, declaration] of entries) {
+		const identity = createHash("sha256").update(source).digest("hex").slice(0, 16);
+		const present = typeof env[declaration.secretEnv] === "string" && env[declaration.secretEnv].length > 0;
+		checks.push({ id: `watch.secret-${identity}`, ok: present, ...(!present ? { warn: true } : {}), label: present ? `watch source ${source}: signing secret is available` : `watch source ${source}: signing secret ${declaration.secretEnv} is missing; push requests return 503`, ...(!present ? { fix: `Set ${declaration.secretEnv} on the receiver host, or use the configured pull source without serving push requests.` } : {}) });
+		if (declaration.pull?.secretEnv) {
+			const name = declaration.pull.secretEnv; const available = typeof env[name] === "string" && env[name].length > 0;
+			checks.push({ id: `watch.pull-${identity}`, ok: available, ...(!available ? { warn: true } : {}), label: available ? `watch source ${source}: pull credential is available` : `watch source ${source}: pull credential ${name} is missing`, ...(!available ? { fix: `Set ${name} on the watch collector host.` } : {}) });
+		}
+	}
+	return checks;
+}