@edgehero/pi-dispatch 4.3.0 → 5.0.0

package/src/start.mjs

@@ -1,3 +1,32 @@
+import { subscriptionRoutes } from "./subscription-runtime.mjs";
+import { configuredSubscriptions } from "./subscription-config.mjs";
+import { publishSubscriptionStatus } from "./subscription-status.mjs";
+import { readBusy as canaryBusy } from "./canary-lock.mjs";
+import { makeReadModelRoles } from "./model-roles-file.mjs";
+import { makeWatchStore } from "./watch-store.mjs";
+import { makeTouchStore } from "./touch-state.mjs";
+import { makeTouchOutbox } from "./touch-outbox.mjs";
+import { makeQuestionGroupStore } from "./question-groups.mjs";
+import { makeQuestionGroupRuntime } from "./question-group-runtime.mjs";
+import { makeAnswerDraftStore } from "./answerer.mjs";
+import { makeAnswerDraftRuntime, readAnswerPending } from "./answerer-runtime.mjs";
+import { forgeApiRoot } from "./forges.mjs";
+import { enqueueAnswerDraftJob } from "./queue.mjs";
+import { makeWatchRuntime } from "./watch-runtime.mjs";
+import { makeWatchDrainer } from "./watch-drainer.mjs";
+import { makeWatchIssuePublisher } from "./watch-issue.mjs";
+import { makeWatchIssueAdapter } from "./watch-issue-adapter.mjs";
+import { checkFailoverCandidate, failoverEgressRequired } from "./model-failover.mjs";
+import { parseTriggers, parseTriggersDocument, TRIGGERS_FILE_VERSION } from "./triggers.mjs";
+import { watchDurationMs } from "./watch-contract.mjs";
+import { makeApprovalSessionCheck } from "./approval-session.mjs";
+import { APPROVAL_FINISHED_TTL_MS, makeApprovalStore } from "./approval-state.mjs";
+import { makeApprovalRuntime, approvalExpiryJobId } from "./approval-runtime.mjs";
+import { makeCheckApprovalPolicy } from "./approval-policy.mjs";
+import { APPROVAL_LABEL } from "./parked.mjs";
+import { createForkStore } from "./fork-store.mjs";
+import { makeCheckForkPolicy } from "./fork-policy.mjs";
+import { thinkingLevelAllowed } from "./thinking-level.mjs";
 import { readdirSync, readFileSync, statSync, watch } from "node:fs";
 import { lookup as dnsLookup } from "node:dns/promises";
 import { homedir, networkInterfaces, release as osRelease, userInfo } from "node:os";
@@ -8,7 +37,9 @@ import { valkeyClientContext } from "./valkey-endpoint.mjs";
 import { authRefusalFor, makeRedisClient, onValkeyError, parseConnection, valkeyAuthState, valkeyPasswordFor } from "./connection.mjs";
 import { reconcileGated, reloadSchedules } from "./cron.mjs";
 import { makeGitHubAuth } from "./get-token.mjs";
-import { InfraRetry, NETNS_KEEPER_CRASH_LOOP, NETNS_KEEPER_NOT_HOLDING } from "./processor.mjs";
+import { InfraRetry, NETNS_KEEPER_CRASH_LOOP, NETNS_KEEPER_NOT_HOLDING, checkDraftAnswerSource } from "./processor.mjs";
+import { consoleDraftOf } from "./console-answer.mjs";
+import { FAILED_COMMENT, FAILED_COMMENT_BY_REASON, RECOVERY_HOST_LOST_COMMENT } from "./comment-tables.mjs";
 import { transientError } from "./transient.mjs";
 import { makeGitHubHost } from "./github-host.mjs";
 import { githubFailureFields } from "./octokit-log.mjs";
@@ -24,8 +55,10 @@ import { MAX_SLOTS, loadModelEndpoints, modelEndpointsPath, readOverlayModels }
 import { builtinModel, checkModelsKnown } from "./model-catalog.mjs";
 import { capabilityTokens, serializeCaps } from "./capabilities.mjs";
 import { cronFingerprint } from "./fingerprint.mjs";
-import { makeHostRegistry } from "./host-registry.mjs";
+import { makeHostRegistry, readLiveHosts } from "./host-registry.mjs";
+import { endpointStatusFields, ENDPOINT_STATUS_VERSION } from "./endpoint-status.mjs";
 import { liveJobsFields, liveJobsOf } from "./live-jobs.mjs";
+import { makeSandboxTelemetry, parseBudgetFrom, parseCpuReserve } from "./host-telemetry.mjs";
 import { budgetField, readUserServiceLimits } from "./host-budget.mjs";
 import { makeCpuReserve, reservePlan } from "./cpu-reserve.mjs";
 import { makeImagePreflight } from "./image-preflight.mjs";
@@ -35,44 +68,73 @@ import { unenforcedSizeFlags } from "./job-size.mjs";
 import { makeCollectChain } from "./outbox.mjs";
 import { makeCollectPlan } from "./outbox-plan.mjs";
 import { makePortfolioSnapshot } from "./portfolio-snapshot.mjs";
-import { containerPackagePaths, readStageManifest } from "./packages.mjs";
+import { containerPackagePaths, PACKAGES_SUBDIR, readStageManifest, STAGE_MANIFEST } from "./packages.mjs";
 import { makeCleanup, makeForgePreparers, makePrepareWorkspace } from "./prepare.mjs";
-import { listRunningSandboxes, makeSandboxNetworkSweeper, makeSandboxRuntimeWatch } from "./sandbox.mjs";
+import { listRunningSandboxes, makeSandboxNetworkSweeper, makeSandboxRuntimeWatch, sandboxSyncRefusal } from "./sandbox.mjs";
+import { createSandboxPreparer } from "./sandbox-prepare.mjs";
+import { checkSandboxWorkspace } from "./sandbox-workspace-guard.mjs";
+import { startSandboxPrepareWorker } from "./sandbox-prepare-requests.mjs";
+import { makeSandboxInventory } from "./sandbox-inventory.mjs";
 import { makeRetentionSweep } from "./retention-sweep.mjs";
-import { makeSandboxReaper } from "./sandbox-store.mjs";
+import { FORGE_JOB_RETENTION_S } from "./retention.mjs";
+import { makeDoctorSpawner } from "./doctor-spawner.mjs";
+import { hostHasPending, publishCanaryFacts, UPDATES_LOOK_EVERY_HOURS } from "./updates.mjs";
+import { makePackageCanaryRuntime } from "./package-canary.mjs";
+
+/** How often a host asks whether a person wants something of it, and how long applying it may take: several npm installs on a slow link. */
+const UPDATES_RECONCILE_EVERY_MS = 2 * 60 * 1000;
+const UPDATES_RECONCILE_TIMEOUT_MS = 15 * 60 * 1000;
+import { fileURLToPath } from "node:url";
+import { listSandboxes, sandboxDeadline, makeSandboxReaper } from "./sandbox-store.mjs";
 import { makeSessionStore } from "./session-store.mjs";
 import { scrubCredentials } from "./redact.mjs";
-import { makeCheckOnceSpent, makeCheckPortfolioFlag, makeCheckWaitSkew, makeDisarmOnce } from "./triggers-file.mjs";
+import { makeCheckOnceSpent, makeCheckPortfolioFlag, makeCheckWaitSkew, makeDisarmOnce, makeFindSecretBundle } from "./triggers-file.mjs";
+import { makeBundleResolver } from "./secret-bundles.mjs";
 import { WATCH_DEBOUNCE_MS, changedWhileArming, makeWatchCloser, readBeforeArming } from "./watch-closer.mjs";
-import { loadPauseWindows, pauseUntilMs } from "./pause-windows.mjs";
-import { checkProjectRows, danglingProjectRows, dollarRowsWithoutCap, loadScopedLimits, SCOPED_LIMITS_VERSION, scopeClaimRows } from "./scoped-limits.mjs";
+import { loadPauseWindows, PAUSE_WINDOWS_VERSION, pauseUntilMs } from "./pause-windows.mjs";
+import { checkProjectRows, danglingProjectRows, dollarRowsWithoutCap, makeInFlight, loadScopedLimits, SCOPED_LIMITS_VERSION, scopeClaimRows } from "./scoped-limits.mjs";
 import { escapeControls, loadProjects, projectOf, projectsFingerprint } from "./projects.mjs";
 import { envelopeDigest, envelopeInsideJobPaths, loadEnvelopeChecked } from "./envelope.mjs";
 import { NO_ENVELOPE_FINGERPRINT, makeAllocationAudit, makeAllocationLogReaper, makeAllocationState } from "./allocation.mjs";
+import { makeConsoleAuditReaper } from "./console-audit.mjs";
 import { optionalUsdMicros } from "./money.mjs";
 import { makeOnFailure } from "./on-failure.mjs";
+import { makeHookRunsPublisher } from "./hook-runs.mjs";
 import { makeWaitChecker } from "./wait-check.mjs";
 import { makeWaitState } from "./wait-state.mjs";
-import { hostQueueName, makeQueue } from "./queue.mjs";
-import { endpointShown, execDockerBounded, makeContainerGone, makeDockerEndpointResolver, makeJobContainerLister, makeLocalBackend, makeReaper, makeStopContainer, quotedShown } from "./backend-local.mjs";
+import { hostQueueName, makeQueue, enqueueWatchJob, discoverHostQueuesReporting, QUEUE } from "./queue.mjs";
+import { endpointShown, execDockerBounded, makeDockerEndpointResolver, makeJobContainerLister, makeLocalBackend, makeReaper, makeStopContainer, quotedShown } from "./backend-local.mjs";
 import { NETNS_KEEPER_MIN_AGE_MS, NETNS_KEEPER_YOUNG_MARGIN_MS, runtimeFromFacts } from "./netns-keeper.mjs";
 import { makeBackendRegistry, reapAll, resolveBackendName } from "./backend-registry.mjs";
-import { DEFAULT_BACKEND, DOCKER_ENDPOINT_LOCAL, PODMAN_ADDS_NO_MOUNTS, PODMAN_BACKEND, PODMAN_BOUNDS_DELEGATED, PODMAN_SERVICE_LOCAL, backendFor, isPerMachineHost, observationRefusalIsTransient, observationRefusals, unobservedFloor } from "./backends.mjs";
+import { DEFAULT_BACKEND, DOCKER_ENDPOINT_LOCAL, OPENSHELL_BACKEND, OPENSHELL_BIND_BACKEND, PODMAN_ADDS_NO_MOUNTS, PODMAN_BACKEND, PODMAN_BOUNDS_DELEGATED, PODMAN_SERVICE_LOCAL, backendFor, hostBackendsField, isPerMachineHost, observationRefusalIsTransient, observationRefusals, unobservedFloor } from "./backends.mjs";
+import { makeOpenshellBackend, makeOpenshellReaper, openshellBootVersions } from "./backend-openshell.mjs";
 import { PODMAN_BOOT_REFUSING_CAUSES, PODMAN_INFO_TIMEOUT_MS, cachedPodmanInfo, decidePodmanJobUser, makePodmanBackend, makePodmanInfoReader, makePodmanReaper, observePodman, podmanConfRefusal, unavailableFor, podmanConfWidening, podmanJobUserRefusal, resolvePodmanImageUser } from "./backend-podman.mjs";
-import { PODMAN_RESTART_HOLD_EXPIRED, makePodmanServiceReader, onceFs, makeRootfulMemory, observeHost, observeRootfulConf, readRootfulService, rootfulConfRefusal, rootfulConfRetries, rootfulUnreadList, runtimeObservationKey } from "./runtime-observations.mjs";
+import { makePodmanServiceReader, onceFs, makeRootfulMemory, observeHost, observeRootfulConf, readRootfulService, rootfulConfRefusal, rootfulConfRetries, rootfulUnreadList, runtimeObservationKey } from "./runtime-observations.mjs";
 
 import { makeRunContainer } from "./run-container.mjs";
 import { piProviders, providerKeyCandidates, resolveProviderCredential } from "./env-allowlist.mjs";
 import { parseAllowlist } from "./egress-allowlist.mjs";
-import { MCP_TRANSIENT_READ_CODES, jobProviders, makeMcpCheck, providerKeyNames } from "./mcp-preflight.mjs";
-import { RESERVED_ENV_NAMES } from "./triggers.mjs";
-import { makeSecretsResolver } from "./secrets.mjs";
-import { buildRecord, EXIT_OOM_KILLED, makeFindPreviousRun, makeLogReaper, makeLogSink, makeReadRecord, makeRecordWriter, makeSettledRecord, newerRecord, RUNNER_POLICY_REASONS, sanitizeJobId, UNREADABLE_RECORD } from "./run-history.mjs";
+import { makeMcpCheck, reservedJobNames } from "./mcp-preflight.mjs";
+import { makeSecretsResolver, realExecutable } from "./secrets.mjs";
+import { servableSecretProfiles } from "./secret-profiles.mjs";
+import { buildRecord, EXIT_OOM_KILLED, makeFindPreviousRun, makeLogReaper, makeLogSink, makeReadRecord, makeRecordWriter, makeSettledRecord, newerRecord, recordOfThisJob, recordReadable, RUNNER_POLICY_REASONS, sanitizeJobId, UNREADABLE_RECORD } from "./run-history.mjs";
 import { makeRunMirror, readMirroredRecord } from "./run-mirror.mjs";
-import { readOverlay, resolveSettings } from "./runtime-settings.mjs";
+import { makeLiveTranscriptOpener } from "./live-transcript.mjs";
+import { makeInboxRelay } from "./inbox-relay.mjs";
+import { makeLateForge, settleInbox } from "./inbox-settle.mjs";
+import { makeHeldSettle } from "./held-settle.mjs";
+import { readProgressKey } from "./run-progress.mjs";
+import { makeStatusCommenter, makeStatusCommentRegistry, renderStatusText, STATUS_OUTCOMES, STATUS_RETRYING } from "./status-comment.mjs";
+import { readOverlay, resolveSettings, SETTINGS_VERSION } from "./runtime-settings.mjs";
+import { JOB_DATA_VERSION } from "./job-data-version.mjs";
 import { usdFingerprint } from "./dollar-fingerprint.mjs";
 import { authoredCron, envelopeJobPaths, loadSchedules, servedSchedules } from "./schedules.mjs";
 import { makeStallGuard } from "./scheduler-stall-guard.mjs";
+import { makeWorkspaceCheckpointer } from "./workspace-checkpoint.mjs";
+import { makeRunBudgetLedger } from "./run-budget-ledger.mjs";
+import { normalizeHost } from "./run-checkpoint.mjs";
+import { isRecoveryArmed, makeHostLostSweep, makeRecoveryEnqueuer, makeSalvager, pointedJobDirs, runIdOf, sweepOrphanJobDirs } from "./recovery-queue.mjs";
+import { finishModelAttempt, modelAttemptIdOf } from "./model-attempts.mjs";
 
 
 /** How long boot will wait for `docker image inspect` before shipping without a digest. */
@@ -142,6 +204,18 @@ const WORKER_VERSION = (() => {
 // the same handle); re-exported here so every existing importer keeps its address.
 export { makeWatchCloser } from "./watch-closer.mjs";
 
+/** The bound on `recordRun`'s final status edit for an attempt that registered no commenter, as the commenter's own. */
+const STATUS_UNREGISTERED_EDIT_MS = 4_000;
+
+/**
+ * The approval expiry job's options (issue #649): its id is the request's own (`approvalExpiryJobId`), and it is a
+ * forge-kind job built from the request's `resumeJob`, so it is kept as long as a forge job (`FORGE_JOB_RETENTION_S`,
+ * in SECONDS: BullMQ's `removeOn*.age`), the window in which its id still answers a second enqueue as the same job.
+ */
+export function approvalExpiryJobOpts(jobId) {
+	return { jobId, attempts: 2, backoff: { type: "exponential", delay: 5000 }, removeOnComplete: { age: FORGE_JOB_RETENTION_S }, removeOnFail: { age: FORGE_JOB_RETENTION_S } };
+}
+
 /**
  * Race a read against a fuse, and CLEAN THE FUSE UP whichever side wins (issue #300). The fuse is
  * unref'd, deliberately: it exists so a wedged docker daemon cannot hold boot, and it must never itself
@@ -174,14 +248,175 @@ export async function settleWithin(promise, ms, fallback) {
 	}
 }
 
+/**
+ * How long a queue's close waits for each of its two steps before it stops waiting (issue #813): first for the
+ * connection's own start, then for the close itself, after which the queue is disconnected. Five seconds, the bound the
+ * backend registry refusal already gave the same handles, which reads it from here. Against a live server the start
+ * settles in milliseconds (it is the INFO below) and a queue's close in about as long, so neither bound is reached by a
+ * queue's close that would have ended. A Worker's close also waits for the job it is running, so the one Worker closed
+ * this way gets a longer close step (`SANDBOX_CONTROL_CLOSE_BOUND_MS`).
+ */
+export const QUEUE_CLOSE_BOUND_MS = 5_000;
+
+/**
+ * The sandbox control Worker's bound for its CLOSE step (issue #813); its start keeps `QUEUE_CLOSE_BOUND_MS`. A
+ * Worker's close waits for the job it is running, and nothing aborts that job first: the control Worker is not among
+ * the workers `createWorker`'s stop cancels, and a human's preparation (a clone, a checkout) is not a paid run to cut
+ * short. Under the queues' five seconds a preparation still running was cut off with Valkey up (measured: an 8 s job
+ * left `active` at 5001 ms, where the unbounded close waited 8006 ms and the job completed). Twenty seconds, so the two
+ * waits together (25 s) stay inside the 30 s that systemd (`TimeoutStopSec`) and launchd (`ExitTimeOut`) give a stop
+ * (`service.mjs`). nssm waits 15 s after its Ctrl-C (`AppStopMethodConsole 15000`), so on Windows a preparation past
+ * about 15 s is still ended by nssm's later stop methods, as it was under the unbounded wait. One that outlasts this
+ * bound is disconnected like a queue, its job left `active` for BullMQ's stalled check.
+ */
+export const SANDBOX_CONTROL_CLOSE_BOUND_MS = 20_000;
+
+const TIMED_OUT = Symbol("timed out");
+
+/**
+ * `promise`'s own outcome, `{ value }` or `{ error }`, or `TIMED_OUT` once `ms` has passed; never rejects. The timer is
+ * REF'D, unlike `settleWithin`'s fuse, and cleared whichever side settles: a queue is closed where nothing else may hold
+ * the event loop (a refused boot draining to its exit code, a test's teardown), and an unref'd timer awaited there never
+ * fires, so node would abandon the await with the queue still open. Cleared, it holds the loop no longer than the wait.
+ */
+async function outcomeWithin(promise, ms) {
+	let timer = null;
+	try {
+		return await Promise.race([
+			Promise.resolve(promise).then(
+				(value) => ({ value }),
+				(error) => ({ error }),
+			),
+			new Promise((resolve) => {
+				timer = setTimeout(() => resolve(TIMED_OUT), ms);
+			}),
+		]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+
+/**
+ * The close `closeQueueSettled` and `settleCloseOf` share. It waits for the queue's start (`waitUntilReady`), at most
+ * `readyMs`, its failure ignored; then runs `close`, at most `closeMs`. A close that settled in time answers with its
+ * own value or rejection. One that did not is left pending and the queue is disconnected, as the backend registry
+ * refusal does: a queue whose connection came up closes by sending QUIT and awaiting the reply, which a server that
+ * stopped answering never sends. The disconnect is not awaited (BullMQ's awaits the start, which may never come), and
+ * its rejection is observed so it cannot surface as an unhandled one.
+ *
+ * After the close, whatever its outcome, each of the queue's connections gets a no-op `error` listener. BullMQ's
+ * `RedisConnection` constructor re-emits its start's rejection as an `error` on itself (`initializing.catch`), and its
+ * close strips every listener from it first (`removeAllListeners`). When the close lands during a connect attempt
+ * after a failed one, on a connection that never became ready, the start then rejects with the failed attempt's error
+ * and the emit finds no listener: an unhandled rejection (measured: now and then against a refused port, and every
+ * close after about 10 s against a host that drops packets). Attached before the close, the listener would be stripped
+ * with the rest. Each in a try: the connections are BullMQ's own objects, and nothing here may replace the close's
+ * answer.
+ */
+async function closeWithin(queue, close, { readyMs, closeMs }) {
+	await outcomeWithin(Promise.resolve().then(() => queue.waitUntilReady?.()), readyMs);
+	const closed = await outcomeWithin(Promise.resolve().then(close), closeMs);
+	for (const connection of [queue.connection, queue.blockingConnection]) {
+		try {
+			connection?.on?.("error", () => {});
+		} catch {
+			// a connection that takes no listener has none to re-emit to
+		}
+	}
+	if (closed !== TIMED_OUT) {
+		if ("error" in closed) throw closed.error;
+		return closed.value;
+	}
+	try {
+		void Promise.resolve(queue.disconnect?.()).catch(() => {});
+	} catch {
+		// a queue with nothing left to drop
+	}
+	return undefined;
+}
+
+/**
+ * Closes a BullMQ Queue only after its connection's own start has settled, and never throws. BullMQ's
+ * `RedisConnection.init` sends an INFO (the server's version and type) that nothing in BullMQ awaits; a queue closed
+ * while that INFO is still pending on a fail-fast client (`enableOfflineQueue: false`) rejects it as an UNHANDLED
+ * rejection, inside BullMQ ("Stream isn't writeable and enableOfflineQueue options is false", measured in CI on the
+ * boot that refuses right after making the reconcile queue, issue #645's PR). Waiting for `waitUntilReady` (its failure
+ * swallowed here) lets that INFO land or fail inside the init's own handling first.
+ *
+ * BOUNDED, by `QUEUE_CLOSE_BOUND_MS` (issue #813). A long-lived queue's start never ends when nothing answers
+ * VALKEY_URL: BullMQ's `waitUntilReady` resolves on `ready` and rejects only on `end`, and the client retries forever,
+ * so the unbounded wait held a stopping worker until its supervisor killed it, and the release workflow's suite for six
+ * hours. A fail-fast client's start does end, but not always inside the bound: against a host that drops packets the
+ * reconcile queue's client gives up after about 6.4 s (three 2 s connect timeouts and two 200 ms retry delays,
+ * `parseConnection`). Once the bound has passed the queue is closed anyway: BullMQ's close of a connection still
+ * starting disconnects it and swallows the start's own rejection, and the start's re-emitted `error` meets the
+ * listener `closeWithin` leaves behind. It is the hazard `receiver/src/start.mjs` avoids by releasing the raw client
+ * instead. Exported for the test, with the bound as an option for the same reason.
+ */
+export async function closeQueueSettled(queue, { boundMs = QUEUE_CLOSE_BOUND_MS } = {}) {
+	if (!queue) return;
+	try {
+		await closeWithin(queue, () => queue.close?.(), { readyMs: boundMs, closeMs: boundMs });
+	} catch {}
+}
+
+/**
+ * Routes a queue's own `close` through `closeQueueSettled`'s bounded wait, in place, so every closer that holds the
+ * queue (the closer list, the worker's shutdown) gets the settled close without a wrapper object. Unlike
+ * `closeQueueSettled` it keeps the close's own answer, a rejection included, when the close settles in time. Idempotent,
+ * and a queue with no `close` is left as it is. `closeBoundMs` bounds the close step alone, `boundMs` by default: a
+ * Worker whose close waits for a job it must let finish passes a longer one (`SANDBOX_CONTROL_CLOSE_BOUND_MS`).
+ */
+export function settleCloseOf(queue, { boundMs = QUEUE_CLOSE_BOUND_MS, closeBoundMs = boundMs } = {}) {
+	if (!queue || typeof queue.close !== "function" || queue.close.settled === true) return queue;
+	const close = queue.close.bind(queue);
+	const settled = (...args) => closeWithin(queue, () => close(...args), { readyMs: boundMs, closeMs: closeBoundMs });
+	settled.settled = true;
+	queue.close = settled;
+	return queue;
+}
+
+/**
+ * The triggers file's live reload (issue #761), EXPORTED apart from its watcher like `reloadPauseWindows`. The cron
+ * reload is `reloadSchedules`'s, unchanged: a file that does not load keeps the running schedules
+ * (`schedules_reload_invalid`). One state rides beside it, `state.newer`: SET when the loader refused the file as one
+ * a newer pi-dispatch wrote (its configError's `.newer`), logged `triggers_reload_newer`, and CLEARED the next time the
+ * file loads. An edit that breaks the file leaves it as it was: that says nothing about what the newer file held. The
+ * processor defers every job while it is set (`triggersNewer`), since the last good copy every reader would fall back
+ * to is no longer what the operator wrote. `reload` and `load` are injectable for tests; the rest is
+ * `reloadSchedules`' own options.
+ */
+export async function reloadTriggersFile(config, queue, state, { reload = reloadSchedules, load = loadSchedules, ...options } = {}) {
+	let loaded = false;
+	let thrown = null;
+	const loadFn = (cfg, opts) => {
+		try {
+			const schedules = load(cfg, opts);
+			loaded = true;
+			return schedules;
+		} catch (error) {
+			thrown = error;
+			throw error;
+		}
+	};
+	const result = await reload(config, queue, { ...options, loadFn });
+	if (loaded) {
+		state.newer = false;
+	} else if (thrown?.newer === true) {
+		state.newer = true;
+		options.log?.("triggers_reload_newer", { reason: thrown?.message ?? String(thrown) });
+	}
+	return result;
+}
+
 /**
  * Watch the DIRECTORY holding the triggers file (robust to the admin's atomic tmp+rename, which swaps the
  * inode a file-watch would lose), debounce, and re-reconcile the cron schedulers on change via
- * `reloadSchedules`. Best-effort: a platform without `fs.watch` logs and the worker keeps its boot-time
- * schedulers. The FSWatcher is unref'd (the debounce it arms is NOT), and the returned closer is what
- * `startWorker` registers so the watch dies with the worker that armed it (issue #295).
+ * `reloadTriggersFile` (which keeps `state.newer`, issue #761). Best-effort: a platform without `fs.watch` logs and
+ * the worker keeps its boot-time schedulers. The FSWatcher is unref'd (the debounce it arms is NOT), and the returned
+ * closer is what `startWorker` registers so the watch dies with the worker that armed it (issue #295).
  */
-function watchTriggersFile(config, queue, log, ref, registry, tz, fleet, atBoot, afterReload = () => {}) {
+function watchTriggersFile(config, queue, log, ref, registry, tz, fleet, atBoot, afterReload = () => {}, state = { newer: false }, watchFn = watch) {
 	const path = config.triggersFile;
 	const dir = dirname(path) || ".";
 	const file = basename(path);
@@ -193,13 +428,13 @@ function watchTriggersFile(config, queue, log, ref, registry, tz, fleet, atBoot,
 	// (issue #386). A baseline taken here would measure the arming instead.
 	readBeforeArming(handles, readFile, atBoot);
 	try {
-		handles.watcher = watch(dir, (_event, changed) => {
+		handles.watcher = watchFn(dir, (_event, changed) => {
 			if (handles.closed) return; // see makeWatchCloser: by construction, not by a delivery rule
 			if (changed && changed !== file) return; // only our file (a null name -> reload to be safe)
 			clearTimeout(handles.timer);
 			// Issue #504 part B: a cron folder or a skills dir an edit adds is a new job path, so the envelope's place is
 			// judged again after every triggers reload.
-			handles.timer = setTimeout(() => void reloadSchedules(config, queue, { log: closer.reloadLog, ref, registry, tz, fleet }).then(() => afterReload(closer.reloadLog)), WATCH_DEBOUNCE_MS);
+			handles.timer = setTimeout(() => void reloadTriggersFile(config, queue, state, { log: closer.reloadLog, ref, registry, tz, fleet }).then(() => afterReload(closer.reloadLog)), WATCH_DEBOUNCE_MS);
 		});
 		handles.watcher.unref?.();
 		log("triggers_watching", { path });
@@ -211,35 +446,54 @@ function watchTriggersFile(config, queue, log, ref, registry, tz, fleet, atBoot,
 	// changed.
 	if (changedWhileArming(handles, readFile)) {
 		log("triggers_reread_after_arming", { path });
-		void reloadSchedules(config, queue, { log: closer.reloadLog, ref, registry, tz, fleet }).then(() => afterReload(closer.reloadLog));
+		void reloadTriggersFile(config, queue, state, { log: closer.reloadLog, ref, registry, tz, fleet }).then(() => afterReload(closer.reloadLog));
 	}
 	return closer;
 }
 
+/**
+ * The pause-windows reload, EXPORTED apart from its watcher so its two states are testable without fs.watch (the
+ * scoped-limits reload's precedent). A good file replaces `ref.current` and clears `ref.newer`. A bad edit keeps the
+ * last-good windows in effect (OQ-008 live-edit safety), logged `pause_windows_reload_invalid`: the pause gate never
+ * loses its config to a typo.
+ *
+ * A file written by a newer pi-dispatch (issue #761, the loader's configError with `.newer`) keeps the last-good
+ * windows too, and ALSO sets `ref.newer`, logged `pause_windows_reload_newer`: it is no typo, and those windows are not
+ * what the operator wrote any more, since the newer file may pause a job they would run. The processor defers every job
+ * (`newer-release`) while it is set, and only the next good reload clears it: an edit that then breaks the file says
+ * nothing about what the newer one paused.
+ */
+export function reloadPauseWindows(config, ref, log, { load = loadPauseWindows } = {}) {
+	try {
+		ref.current = load(config);
+		ref.newer = false;
+		log("pause_windows_reloaded", { count: ref.current.length });
+	} catch (err) {
+		if (err?.newer === true) {
+			ref.newer = true;
+			log("pause_windows_reload_newer", { reason: err?.message });
+		} else {
+			log("pause_windows_reload_invalid", { reason: err?.message });
+		}
+	}
+}
+
 /**
  * Watch the DIRECTORY holding the pause-windows file (same atomic-rename robustness as the triggers watch)
- * and hot-swap the in-memory windows in `ref.current` on change. A bad edit keeps the last-good windows in
- * effect (OQ-008 live-edit safety) — the pause gate never loses its config to a typo. Best-effort; the
+ * and hot-swap the in-memory windows in `ref.current` on change (`reloadPauseWindows`). Best-effort; the
  * FSWatcher is unref'd and the returned closer stops the watch with the worker (issue #295).
  */
-function watchPauseWindowsFile(config, ref, log, atBoot) {
+function watchPauseWindowsFile(config, ref, log, atBoot, watchFn = watch) {
 	const path = config.pauseWindowsFile;
 	const dir = dirname(path) || ".";
 	const file = basename(path);
 	const handles = { watcher: null, timer: null, closed: false };
 	const closer = makeWatchCloser(handles, log);
-	const reload = () => {
-		try {
-			ref.current = loadPauseWindows(config);
-			closer.reloadLog("pause_windows_reloaded", { count: ref.current.length });
-		} catch (err) {
-			closer.reloadLog("pause_windows_reload_invalid", { reason: err?.message });
-		}
-	};
+	const reload = () => reloadPauseWindows(config, ref, closer.reloadLog);
 	const readFile = () => readFileSync(path, "utf8");
 	readBeforeArming(handles, readFile, atBoot); // the BOOT LOAD's own bytes; see watch-closer (issue #386)
 	try {
-		handles.watcher = watch(dir, (_event, changed) => {
+		handles.watcher = watchFn(dir, (_event, changed) => {
 			if (handles.closed) return; // see makeWatchCloser: by construction, not by a delivery rule
 			if (changed && changed !== file) return;
 			clearTimeout(handles.timer);
@@ -563,6 +817,36 @@ function watchModelEndpointsFile(config, ref, log, atBoot) {
  * per job (mintToken throws configError) rather than blocking startup. Collaborators are injectable
  * (defaulting to the real ones) so the wiring is testable offline with no Redis and no forge.
  */
+/**
+ * Whether a status comment for `jobId` could contain `phrase` (issue #644). The receiver starts a job on a comment that
+ * merely CONTAINS the phrase (receiver filter.mjs `body.includes`), so a bot comment matching its own deployment's phrase
+ * (a phrase like "pi-dispatch" or "Turn") would be read as a new request on every edit. The text is fixed words, the job
+ * id and integers, so this renders it for every word form it can take (singular and plural counts, each failure part,
+ * each phase form, running, every outcome and the retry) and compares with every digit run collapsed to one `0` on both sides: the
+ * integers are the only part that varies, and a phrase holding a number matches any number there. Conservative on
+ * purpose: a false yes costs one comment, a false no a comment loop.
+ */
+export function statusTextMayMatch(phrase, jobId, render = renderStatusText) {
+	if (typeof phrase !== "string" || phrase === "") return false;
+	const norm = (t) => String(t).replace(/[0-9]+/g, "0");
+	const needle = norm(phrase);
+	for (const c of [1, 2]) {
+		for (const failed of [0, c]) {
+			for (const interrupted of [0, c]) {
+				for (const phase of [null, { index: c - 1, done: null, total: null }, { index: c - 1, done: c, total: null }, { index: c - 1, done: c, total: c }]) {
+					for (const phases of [[], Array.from({ length: c + 1 }, () => "")]) {
+						for (const outcome of [undefined, ...STATUS_OUTCOMES]) {
+							const snapshot = { turn: c, steps: c, failed, interrupted, phase, phases };
+							if (norm(render({ jobId, snapshot, outcome })).includes(needle)) return true;
+						}
+					}
+				}
+			}
+		}
+	}
+	return false;
+}
+
 export async function startWorker(
 	env = process.env,
 	{
@@ -582,6 +866,7 @@ export async function startWorker(
 		makeAuth = makeGitHubAuth,
 		makeHost = makeGitHubHost,
 		createWorkerFn = createWorker,
+		makeRuntimeQueue: makeRuntimeQueueFn = makeQueue,
 		makeCpuReserve: makeCpuReserveFn = makeCpuReserve,
 		makeReaper: makeReaperFn = makeReaper,
 		makeBackendRegistry: makeBackendRegistryFn = makeBackendRegistry,
@@ -592,16 +877,40 @@ export async function startWorker(
 		makeLogSink: makeLogSinkFn = makeLogSink,
 		makeRecordWriter: makeRecordWriterFn = makeRecordWriter,
 		makeRunMirror: makeRunMirrorFn = makeRunMirror,
+		// Issue #761: the portfolio snapshot's factory, a seam so a wiring test sees the run index cap it is handed.
+		makePortfolioSnapshot: makePortfolioSnapshotFn = makePortfolioSnapshot,
 		// The fleet copy's by-id read, seamed so a wiring test can answer it without a live mirror.
 		readMirroredRecord: readMirroredRecordFn = readMirroredRecord,
 		makeLogReaper: makeLogReaperFn = makeLogReaper,
 		makeSandboxReaper: makeSandboxReaperFn = makeSandboxReaper,
+		createSandboxPreparer: createSandboxPreparerFn = createSandboxPreparer,
+		startSandboxPrepareWorker: startSandboxPrepareWorkerFn = startSandboxPrepareWorker,
+		makeSandboxInventory: makeSandboxInventoryFn = makeSandboxInventory,
+		listSandboxes: listSandboxesFn = listSandboxes,
 		makeSandboxNetworkSweeper: makeSandboxNetworkSweeperFn = makeSandboxNetworkSweeper,
 		// Issue #429: the one call that asks a runtime which sandboxes are open, seamed so a wiring test can drive the real
 		// sandbox reaper against a real retention root without spawning docker or podman.
 		listRunningSandboxes: listRunningSandboxesFn = listRunningSandboxes,
 		makeRetentionSweep: makeRetentionSweepFn = makeRetentionSweep,
+		makeTouchStore: makeTouchStoreFn = makeTouchStore,
+		makeTouchOutbox: makeTouchOutboxFn = makeTouchOutbox,
+		makeQuestionGroupStore: makeQuestionGroupStoreFn = makeQuestionGroupStore,
+		makeQuestionGroupRuntime: makeQuestionGroupRuntimeFn = makeQuestionGroupRuntime,
+		// Issue #712: the worker's own doctor runs, a seam so a wiring test sees the interval and never spawns a doctor.
+		makeDoctorSpawner: makeDoctorSpawnerFn = makeDoctorSpawner,
+		makeUpdatesRunner: makeUpdatesRunnerFn = makeDoctorSpawner,
 		makeRunContainer: makeRunContainerFn = makeRunContainer,
+		// Issue #643: the preparer factory, a seam so a test can see what the wiring hands it (`stageLive`).
+		makePrepareWorkspace: makePrepareWorkspaceFn = makePrepareWorkspace,
+		// Issue #644: the opener and the status commenter factories, seams so a wiring test sees the switches and the
+		// forge calls the wiring hands them.
+		makeLiveTranscriptOpener: makeLiveTranscriptOpenerFn = makeLiveTranscriptOpener,
+		// Issue #646: the steer inbox relay's factory, a seam so a wiring test sees the client and host it is bound to.
+		makeInboxRelay: makeInboxRelayFn = makeInboxRelay,
+		makeStatusCommenter: makeStatusCommenterFn = makeStatusCommenter,
+		// Issue #644: the progress key's bounded read, a seam so a wiring test can hand `recordRun` an earlier attempt's
+		// comment id without a Valkey.
+		readProgressKey: readProgressKeyFn = readProgressKey,
 		makeSecretsResolver: makeSecretsResolverFn = makeSecretsResolver,
 		makeImagePreflight: makeImagePreflightFn = makeImagePreflight,
 		makeScopeClaimSweeper: makeScopeClaimSweeperFn = makeScopeClaimSweeper,
@@ -636,6 +945,11 @@ export async function startWorker(
 		readPodmanInfo: readPodmanInfoFn = makePodmanInfoReader(),
 		makePodmanReaper: makePodmanReaperFn = makePodmanReaper,
 		makePodmanBackend: makePodmanBackendFn = makePodmanBackend,
+		// Issue #684: the openshell venue's three, podman's pattern: the boot's version read, its reaper and its bundle,
+		// each a seam because the real ones spawn `openshell`, and only while the venue is blessed.
+		readOpenshellVersions: readOpenshellVersionsFn = openshellBootVersions,
+		makeOpenshellReaper: makeOpenshellReaperFn = makeOpenshellReaper,
+		makeOpenshellBackend: makeOpenshellBackendFn = makeOpenshellBackend,
 		makeGitLabAuth: makeGitLabAuthFn = makeGitLabAuth,
 		makeGitLabHost: makeGitLabHostFn = makeGitLabHost,
 		makeForgejoAuth: makeForgejoAuthFn = makeForgejoAuth,
@@ -663,6 +977,9 @@ export async function startWorker(
 		// literal address every Valkey client of this worker then connects to. A seam: the real one reads /proc, probes
 		// this host's addresses and resolves the name, none of which belongs in a wiring test.
 		judgeValkey = defaultJudgeValkey,
+		// `fs.watch` for the triggers and pause-windows watchers, so a test can deliver a change itself: macOS can lose a
+		// real event outright (the rebuilt FSEvents stream, watch-closer.mjs), which is not what those tests are about.
+		watchFs = watch,
 		// The scoped-limits watcher, injectable so a test can see what it is armed with (PR #549's review: the cap
 		// thunk the reload warning reads). Production passes nothing and gets the real watcher.
 		watchScopedLimits: watchScopedLimitsFn = watchScopedLimitsFile,
@@ -670,6 +987,21 @@ export async function startWorker(
 		watchProjects: watchProjectsFn = watchProjectsFile,
 		// The envelope watcher (issue #504 part B), injectable for the same reason.
 		watchEnvelope: watchEnvelopeFn = watchEnvelopeFile,
+		// Issue #645 (durable runs): the checkpoint collaborators, seams so a wiring test sees what the boot hands each and
+		// what the processor and the opener are given. `loadRunCheckpoint` is the module holding the run checkpointer and
+		// the pointer reads (run-checkpoint.mjs), imported at boot rather than statically, so a test can hand in a double.
+		makeWorkspaceCheckpointer: makeWorkspaceCheckpointerFn = makeWorkspaceCheckpointer,
+		loadRunCheckpoint = () => import("./run-checkpoint.mjs"),
+		makeRunBudgetLedger: makeRunBudgetLedgerFn = makeRunBudgetLedger,
+		makeRecoveryEnqueuer: makeRecoveryEnqueuerFn = makeRecoveryEnqueuer,
+		// The host-lost sweep's factory: a wiring test reaches its `onLost` (the comment, the page, the record) without a
+		// live queue, since the harness's clients are closed by the time a test could drive a sweep.
+		makeHostLostSweep: makeHostLostSweepFn = makeHostLostSweep,
+		// The boot sweep of orphaned job directories, a seam so a wiring test drives it against a directory of its own.
+		sweepOrphanJobDirs: sweepOrphanJobDirsFn = sweepOrphanJobDirs,
+		// Issue #812: the expiry a finished job's model attempt key is given, a seam so a wiring test sees which id the
+		// listeners below hand it, since the harness's client is closed by the time a test drives one.
+		finishModelAttempt: finishModelAttemptFn = finishModelAttempt,
 	} = {},
 ) {
 	const config = loadConfigFn(env);
@@ -684,6 +1016,12 @@ export async function startWorker(
 	// read, its reaper and its bundle exist only while it is blessed, so a deployment that never chose it spawns no
 	// `podman` and pays nothing for it being in the table.
 	const podmanBlessed = config.backends.includes(PODMAN_BACKEND);
+	// Issue #684: and for the openshell venue, blessable since this issue: its CLI is spawned only while it is blessed.
+	// Issue #686 part 3: either of its two modes, which share the gateway, the CLI, the version read and the boot reaper;
+	// each mode's own bundle is built only while that mode is blessed.
+	const openshellCopyBlessed = config.backends.includes(OPENSHELL_BACKEND);
+	const openshellBindBlessed = config.backends.includes(OPENSHELL_BIND_BACKEND);
+	const openshellBlessed = openshellCopyBlessed || openshellBindBlessed;
 	// Issue #354: an ABSENT `observationPreflight` admits every job, which is the right answer only for a venue whose
 	// words hold without observing anything. A venue whose table entry names an `observedBy` and carries no preflight
 	// would have those words hold with nothing looking, and a floor naming one would pass on capability alone: the
@@ -719,7 +1057,10 @@ export async function startWorker(
 	// worker judges it itself, before it contacts Valkey at all, with the same function (`resolveWorkerValkey`), and
 	// every client below connects to the judged literal address, never to a name resolved again later. A refusal is a
 	// configError (exit 2, not restarted into the same answer); nothing answering is a plain error (exit 1, restarted).
-	const valkey = await judgeValkey({ url: config.valkeyUrl, venues: { localUsed: localBlessed, podmanUsed: podmanBlessed }, env });
+	// `openshellUsed` (issue #707, review round 2 of #715): an openshell venue on Podman is the queue's engine where no
+	// `local` or `podman` venue is (`openshellSetupOf`), and the judgement refuses root's listener there as `up` does. Left
+	// out, as it was, the rule saw no openshell venue and the boot took a root-held Valkey `up` had refused.
+	const valkey = await judgeValkey({ url: config.valkeyUrl, venues: { localUsed: localBlessed, podmanUsed: podmanBlessed, openshellUsed: openshellBlessed }, env });
 	for (const note of valkey.notes ?? []) log("valkey_note", { note });
 	if (valkey.pinned) log("valkey_pinned", { address: valkey.pinned.address, port: valkey.pinned.port, heldBy: valkey.pinned.heldBy });
 	// Every client below connects through connection.mjs' JudgedConnector, which judges the (pinned) address again on
@@ -751,11 +1092,16 @@ export async function startWorker(
 		},
 	});
 	const schedules = { current: loadSchedules(config, { fleet: config.workerNameDeclared, ...recording("triggers", config.triggersFile) }) };
+	// Issue #761: whether the triggers file on disk was written by a newer pi-dispatch, kept by the triggers watcher's
+	// reload (`reloadTriggersFile`). At boot such a file is the loader's configError, so it starts false.
+	const triggersState = { newer: false };
 
 	// REQ-SCOPED-PAUSE-WINDOWS: load + validate the pause-windows file with the operator present and before any
 	// Valkey contact, so a malformed file refuses startup (configError) rather than silently disabling scoped
 	// pauses. Held in a mutable ref so the live-reload watcher can hot-swap it. [] means no scoped pauses.
-	const pauseWindows = { current: loadPauseWindows(config, recording("pauseWindows", config.pauseWindowsFile)) };
+	// `newer` (issue #761) is set by a live reload that met a file written by a newer pi-dispatch, which keeps these
+	// windows (`reloadPauseWindows`); at boot such a file is the loader's configError, so it starts false.
+	const pauseWindows = { current: loadPauseWindows(config, recording("pauseWindows", config.pauseWindowsFile)), newer: false };
 
 	// Issue #242: same posture for the scoped-limits file -- fail-loud with the operator present, mutable
 	// ref for the live-reload watcher, [] when unset (the folder mutex is code and needs no file).
@@ -889,6 +1235,18 @@ export async function startWorker(
 
 	const bootRefusal = jobUserBootRefusal(bootDecision, config.defaultBackend);
 	if (bootRefusal) throw configError(bootRefusal);
+	// Issue #684: the openshell venue's releases, read once at boot (the half #683 left to the blessing). A CLI or a gateway
+	// at another release than the one this venue was measured on refuses the boot (exit 2); a CLI that does not answer is
+	// restarted into (exit 1); a gateway that does not answer refuses nothing, since every job's preflight reads it again.
+	// Issue #712: whether the gateway is on this host, as the boot read it, for the registry row's `backends` word.
+	// `unknown` while not read (a gateway down at boot): a word published per beat must not spawn the CLI per beat.
+	let openshellGatewayWord = "unknown";
+	if (openshellBlessed) {
+		const versions = await readOpenshellVersionsFn({ gateway: config.openshell.gateway });
+		if (versions?.refusal) throw versions.transient ? new Error(versions.refusal) : configError(versions.refusal);
+		if (versions?.gatewayDown) log("openshell_gateway_down_at_boot", { gateway: config.openshell.gateway });
+		if (typeof versions?.gatewayLocal === "boolean") openshellGatewayWord = versions.gatewayLocal ? "local" : "remote";
+	}
 	// Issue #448: where a local job runs on rootful Podman's Docker API service on this host, the containers.conf that
 	// service reads (the system chain, root's own, the unit's CONTAINERS_CONF) and whether the running service started
 	// before it last changed. A VENUE refusal, as the podman venue's #428 one is and for its reason: with egress off no
@@ -1176,12 +1534,18 @@ export async function startWorker(
 		// boot reaper for a venue it does not hold.
 		// Issue #354: podman's the same way and for the same reason, `makeReaper` with `bin: "podman"`, so the sweep lists
 		// the store this account's jobs actually ran in. Docker's listing says nothing about it, and the reverse.
+		// Issue #684: the openshell venue's, by its owner label: crashed jobs' sandboxes, then their providers. Issue #686 part
+		// 3: ONE reaper for both modes, registered under each blessed name and run once: the owner label is shared, a crash's
+		// leftover of either mode is an orphan alike, and at boot no job of this process is live in either.
+		const openshellReap = openshellBlessed ? makeOpenshellReaperFn({ gateway: config.openshell.gateway, log }) : null;
 		backendReaps = {
 			...(localBlessed ? { [DEFAULT_BACKEND]: makeReaperFn({ log }) } : {}),
 			...(podmanBlessed ? { [PODMAN_BACKEND]: makePodmanReaperFn({ log }) } : {}),
+			...(openshellCopyBlessed ? { [OPENSHELL_BACKEND]: openshellReap } : {}),
+			...(openshellBindBlessed ? { [OPENSHELL_BIND_BACKEND]: openshellReap } : {}),
 			...Object.fromEntries(extraBackends.map((b) => [b?.name, b?.reap])),
 		};
-		const swept = (await reapAll(Object.values(backendReaps), { log }))?.reaped === true;
+		const swept = (await reapAll([...new Set(Object.values(backendReaps))], { log }))?.reaped === true;
 		// PROVEN FOR THE WHOLE HOST, or not at all (issue #354). `reapAll` is conservative over the reapers it is
 		// handed, and two gaps sit outside that. A BLESSED venue with no reaper here is refused by the registry, but
 		// only further down, after the scope sweep has already acted on this answer. And a host without `local` can
@@ -1216,6 +1580,13 @@ export async function startWorker(
 	// reaper above never reaches (it reaps the top-level `.log` and `.json` only). Never throws, so no double wrap.
 	const reapAllocationLogs = makeAllocationLogReaper({ logsDir: config.logsDir, retentionDays: config.logRetentionDays, log });
 	reapAllocationLogs();
+	// Issue #640: the operator console's audit files (`console-audit/YYYY-MM.jsonl`). The worker runs it, not the console,
+	// because the worker always runs and the console may never; it never reaps the newest file (the chain's head). Never
+	// throws. Issue #761: on its OWN retention (`PI_CONSOLE_AUDIT_RETENTION_DAYS`, which inherits the run history's when
+	// unset), so shortening the run history for privacy does not shorten the security trail. The periodic sweep below
+	// re-runs this closure, so boot and every tick read the one value.
+	const reapConsoleAudit = makeConsoleAuditReaper({ logsDir: config.logsDir, retentionDays: config.consoleAuditRetentionDays, log });
+	reapConsoleAudit();
 
 	// REQ-RESURRECTABLE-SANDBOX: sweep retained per-job directories past their window, so what `cleanup`
 	// kept for re-opening stays bounded. Third in the row and deliberately its own sweep -- a different
@@ -1264,9 +1635,17 @@ export async function startWorker(
 	// One raw Redis client, shared by the budget (via the worker) and the scheduler stall guard, so it is
 	// hoisted out of the createWorkerFn arg object.
 	const redis = makeRedisClient(valkey.url, { servername: valkey.servername, context: valkeyContext });
+	const subscriptions = configuredSubscriptions({ config, redis, now: () => Number(now()) });
 	// Its errors as one message-only line (PR #475's review, round 2), like every Queue and Worker's: without a listener
 	// ioredis printed a stack per reconnect attempt.
 	onValkeyError(redis, "shared client");
+	// Accounting is repaired independently of work: publication failure must never replay a human action.
+	const touchStore = makeTouchStoreFn({ redis, now, retentionDays: config.logRetentionDays });
+	const touchOutbox = makeTouchOutboxFn({ dir: join(config.logsDir, "touch-outbox"), store: touchStore, log });
+	const touchInitialized = await touchStore.initialize();
+	if (!touchInitialized.ok) log("touch_tracking_unavailable", { reason: touchInitialized.error });
+	await touchOutbox.repair();
+	const questionGroupStore = makeQuestionGroupStoreFn({ redis, now, retentionDays: config.logRetentionDays });
 
 	// Issue #504 part B: the applied split lives in Valkey (`alloc:plan`), shared by every host. Only with an envelope.
 	// The boot reconcile seeds the neutral split when there is none, expires a plan past its life and re-bases on an
@@ -1311,7 +1690,9 @@ export async function startWorker(
 	// collector enqueues chained children onto it -- the same pi-jobs queue, so one handle serves both.
 	// Non-failFast: a long-lived handle rides out a Valkey blip. Registered as an extraCloser so shutdown
 	// drains it after the worker.
-	const runtimeQueue = makeQueue(valkeyConn());
+	// Install the settled close before ANY later boot refusal can reach these handles. Waiting until
+	// the worker handoff left the backend registry's refusal racing BullMQ's initial INFO (#664).
+	const runtimeQueue = settleCloseOf(makeRuntimeQueueFn(valkeyConn()));
 
 	// THE HOST QUEUE (issue #57): work only this machine can do, because the folder lives here.
 	//
@@ -1327,7 +1708,80 @@ export async function startWorker(
 	// live triggers-file edit lands on the same queue the boot reconcile used; otherwise the shared
 	// runtime queue, exactly as before. Registered as an extraCloser only when it is a NEW handle --
 	// closing `runtimeQueue` twice would be closing another owner's connection.
-	const cronQueue = hostQueue ? makeQueue(valkeyConn(), { name: hostQueue }) : runtimeQueue;
+	const cronQueue = hostQueue ? settleCloseOf(makeRuntimeQueueFn(valkeyConn(), { name: hostQueue })) : runtimeQueue;
+
+	// Issue #645 (durable runs): the checkpoint collaborators, built once here and handed to the processor and the live
+	// transcript opener. Only with a store (`config.checkpointsDir`, PI_CHECKPOINTS_DIR else <PI_SESSIONS_DIR>/.checkpoints):
+	// without one an armed job is refused by the processor before it spends (`recover-store-unset`), so nothing below may
+	// pretend to checkpoint into nowhere. The run checkpointer's module is loaded unconditionally, because its pointer read
+	// is what the STALL listener needs on every host of a fleet, store or not: the host that notices a stall is any host.
+	let runCheckpointModule = null;
+	try {
+		runCheckpointModule = await loadRunCheckpoint();
+	} catch (err) {
+		// Fail loudly: every armed job on this host then falls back to today's path, and the operator is told why at boot.
+		log("run_checkpoint_unavailable", { reason: scrubCredentials(err?.message) });
+	}
+	const durableHost = config.workerName;
+	// `snapshotTimeoutMs` 20 s, not the module's 60 s default: a LIVE checkpoint snapshots a PAUSED container, so this bound
+	// is how long a paid job can sit frozen (its provider stream stalled, its tool timers running on the clock). A tree too
+	// big to walk in 20 s is skipped (`timeout`) and the run goes on, with its exit checkpoint as the fallback; 60 s of
+	// freeze per checkpoint would be long enough for a provider to drop the stream the agent is waiting on.
+	const forkStore = config.sessionsDir ? createForkStore({ dir: join(config.sessionsDir, ".fork-sources"), now, hostName: durableHost, hostQueue }) : null;
+	const workspaceCheckpointer = config.checkpointsDir ? makeWorkspaceCheckpointerFn({ storeDir: config.checkpointsDir, now, log, hostName: durableHost, limits: { snapshotTimeoutMs: 20_000 } }) : null;
+	const runCheckpointer =
+		workspaceCheckpointer && typeof runCheckpointModule?.makeRunCheckpointer === "function"
+			? runCheckpointModule.makeRunCheckpointer({ forkStore, checkpointer: workspaceCheckpointer, redis, hostName: durableHost, hostQueue, now, log })
+			: null;
+	// The per-run dollar ledger (run-budget-ledger.mjs): on every host, since a recovery settles the crashed attempt's hold
+	// wherever it runs, and an unarmed job never calls it.
+	const runBudgetLedger = makeRunBudgetLedgerFn({ redis, now, log });
+	const readCheckpointPointer = async ({ runId }) => {
+		if (typeof runCheckpointModule?.readCheckpointPointer !== "function") return null;
+		try {
+			return await runCheckpointModule.readCheckpointPointer({ redis, runId, timeoutMs: 2_000 });
+		} catch (err) {
+			log("checkpoint_pointer_read_failed", { code: typeof err?.code === "string" ? err.code : "error" });
+			return null;
+		}
+	};
+	// The queues a recovery can be routed to: the shared one, this host's own, or another host's (the crashed host's,
+	// when THIS host noticed the stall). Another host's handle is opened on first use and joins the closers then; the
+	// array is read at shutdown, not at handoff, which is what makes a late push sound (see `extraClosers` below).
+	const otherHostQueues = new Map();
+	const recoveryQueues = {
+		shared: () => runtimeQueue,
+		host: (name) => {
+			if (name === hostQueue) return cronQueue;
+			let q = otherHostQueues.get(name);
+			if (!q) {
+				q = makeQueue(valkeyConn(), { name });
+				otherHostQueues.set(name, q);
+				extraClosers.push({ close: () => closeQueueSettled(q) });
+			}
+			return q;
+		},
+	};
+	const enqueueRecovery = makeRecoveryEnqueuerFn({ redis, queues: recoveryQueues, hostQueueName, now, log });
+	// Issue #686 part 3, review round 1 (#714): on the openshell-bind venue a lost attempt's job dir is a sandbox's bind,
+	// and that sandbox may still be writing it, so the salvage first has the venue end it and confirm it gone. Resolved at
+	// call time: the bundle is built further down, and a salvage runs only once jobs are consumed.
+	const salvageCheckpoint = makeSalvager({ jobsDir: config.jobsDir, hostName: durableHost, workspaceCheckpointer, runCheckpointer, log, settleJobDir: (name) => (openshellBindBackend ? openshellBindBackend.settleJobDir(name) : true) });
+	// The boot sweep of orphaned `jobs/job-*` directories: a crashed worker's processor never cleaned up after its jobs.
+	// Here, before `createWorker` starts consuming, so no job of THIS process owns any of them; the age bound (the job
+	// timeout plus the abort grace's margin) covers another process on this host. A directory a checkpoint pointer of this
+	// host still names is kept for its recovery's salvage, and when those pointers cannot be read the sweep is skipped
+	// rather than run blind.
+	// The pointer read is BOUNDED: a Valkey that does not answer must not hold the boot (every command of this client waits
+	// for a connection rather than failing), and an unanswered read is the same skip as a failed one.
+	try {
+		const keep = workspaceCheckpointer ? await settleWithin(pointedJobDirs({ redis, hostName: durableHost }), 5_000, null) : new Set();
+		if (keep === null) throw new Error("the checkpoint pointers were not read within 5 s");
+		await sweepOrphanJobDirsFn({ jobsDir: config.jobsDir, olderThanMs: JOB_TIMEOUT_MS + 5 * 60 * 1000, now, keep, log });
+	} catch (err) {
+		log("job_dir_sweep_skipped", { reason: scrubCredentials(err?.message) });
+	}
+	log("durable_runs", { checkpointsDir: config.checkpointsDir ?? null, checkpointer: Boolean(runCheckpointer), pointerReads: typeof runCheckpointModule?.readCheckpointPointer === "function" });
 
 	// REQ-LOCAL-JOB-VISIBILITY durable run history, all host-side. The raw `.log` sink is gated on
 	// captureJobLogs (raw container output is user-authored data, opt-in per no-pii-in-logs); the id-only
@@ -1371,8 +1825,138 @@ export async function startWorker(
 	// a worker name: an unnamed one is a single host, its own files ARE the whole history, and a mirror
 	// would be bytes nothing reads. That is also what keeps a single-host deployment byte-identical, since
 	// no job then issues a single extra Valkey command.
-	const runMirror = config.workerNameDeclared ? makeRunMirrorFn({ redis, retentionDays: config.logRetentionDays, log }) : null;
-	const recordRun = ({ job, result, error, startedAt, endedAt, project, size = null, capacity = null, earlier = null }) => {
+	// Issue #761: trimmed to this host's `PI_RUN_MIRROR_MAX_RUNS`; every writer trims the shared index to its own cap, so a
+	// fleet's lowest wins, and each trim raises the horizon a reader sees the cut by.
+	const runMirror = config.workerNameDeclared ? makeRunMirrorFn({ redis, retentionDays: config.logRetentionDays, indexMax: config.runMirrorMaxRuns, log }) : null;
+	// Issue #644: the forge status comment's two calls, the `comment` adapter's shape below (forgeFor, the auth re-resolve,
+	// a token minted per call) and its rule: they NEVER throw, since the comment decides nothing. `statusPost` answers
+	// `{ id }` or null; `statusEdit` answers `{ ok: true }`, `{ stop }` for a 403, 404 or 429 (the comment is gone, the
+	// token may not edit it, or the forge is rate limiting: editing on would only repeat the refusal) and `{ ok: false }`
+	// for any other failure, which the commenter tries again on its next edit. Logs carry the job id and the status.
+	const draftReplyMayPost = async job => {
+		if (!consoleDraftOf(job?.console)) return true;
+		try { return await checkDraftAnswerSource(job, { answerDraftStore, answerDraftRuntime }) === null; }
+		catch { return false; }
+	};
+	const statusAuth = async (job) => {
+		const forge = forgeFor(job);
+		if (!forge?.host) return null;
+		let auth = forge.auth ?? null;
+		if (!auth) {
+			try {
+				auth = await ensureAuth(job.kind);
+			} catch {
+				auth = null;
+			}
+		}
+		return auth ? { forge, auth } : null;
+	};
+	const statusPost = async (job, text) => {
+		if (job?.answerDraft || job?.purpose === "answer-draft") return null;
+		try {
+			if (!await draftReplyMayPost(job)) return null;
+			const ready = await statusAuth(job);
+			if (!ready || typeof ready.forge.host.postStatusComment !== "function") return null;
+			const token = await ready.auth.mintToken(job);
+			const posted = await ready.forge.host.postStatusComment(job, job.target, text, token);
+			return typeof posted?.id === "string" && posted.id !== "" ? { id: posted.id } : null;
+		} catch (err) {
+			log("status_comment_failed", { jobId: job?.id, op: "post", status: Number.isSafeInteger(err?.status) ? err.status : null });
+			return null;
+		}
+	};
+	const statusEdit = async (job, id, text) => {
+		if (job?.answerDraft || job?.purpose === "answer-draft") return { stop: "answer-draft" };
+		try {
+			if (!await draftReplyMayPost(job)) return { stop: "answer-source-changed" };
+			const ready = await statusAuth(job);
+			if (!ready) return { ok: false }; // auth unreachable just now: the next edit asks again
+			if (typeof ready.forge.host.editStatusComment !== "function") return { stop: "no-edit" };
+			const token = await ready.auth.mintToken(job);
+			await ready.forge.host.editStatusComment(job, job.target, id, text, token);
+			return { ok: true };
+		} catch (err) {
+			if (err?.status === 403 || err?.status === 404 || err?.status === 429) return { stop: `http-${err.status}` };
+			log("status_comment_failed", { jobId: job?.id, op: "edit", status: Number.isSafeInteger(err?.status) ? err.status : null });
+			return { ok: false };
+		}
+	};
+	// The commenter for one job, asked by the opener only when its trigger set `run.statusComment` and progress is on;
+	// null for a job with no forge to post to (a local or cron job without a target) or a host that cannot edit, so such
+	// a job runs with no comment rather than with a comment it could never update.
+	// The commenters of the running jobs, by job id: the sink hands each its final snapshot when the container ends, and
+	// `recordRun` below makes the final edit with the record's outcome (status-comment.mjs says why not the exit's).
+	const statusComments = makeStatusCommentRegistry();
+	const makeProgressCommenter = ({ job, jobId, commentId, onId, finalTimeoutMs }) => {
+		const host = forgeFor(job)?.host;
+		if (!host || typeof host.editStatusComment !== "function" || typeof host.postStatusComment !== "function" || !job?.target) {
+			log("status_comment_skipped", { jobId: job?.id ?? null, reason: "no-forge-target" });
+			return null;
+		}
+		// The comment must never trigger a job of its own: skipped, and said once for this job, when its text could hold
+		// the phrase the job was started with. A job started otherwise carries no phrase (`matched.phrase` is the comment
+		// route's), so a deployment whose comment trigger has a colliding phrase is caught only on its comment jobs.
+		const phrase = job?.trigger?.matched?.phrase;
+		if (statusTextMayMatch(phrase, jobId)) {
+			log("status_comment_skipped", { jobId: job?.id ?? null, reason: "phrase-collision" });
+			return null;
+		}
+		const commenter = makeStatusCommenterFn({ jobId, post: (text) => statusPost(job, text), edit: (id, text) => statusEdit(job, id, text), commentId, onId, log, ...(finalTimeoutMs ? { finalTimeoutMs } : {}) });
+		return commenter ? statusComments.register(jobId, commenter) : null;
+	};
+	// Issue #643 (DES-LIVE-TRANSCRIPT-STREAM): every running job's transcript, redacted, to its own capped Valkey stream,
+	// on every deployment unless PI_LIVE_TRANSCRIPTS=0. Not gated on a worker name, unlike the mirror above: the panel on
+	// a single host reads the same stream. Handed to every venue's runContainer, which publish only beside a staged file,
+	// or, on openshell (issue #686), from the exec's stderr records.
+	//
+	// Issue #644 (DES-RUN-PROGRESS): the same opener reads each job's progress off the same file unless PI_RUN_PROGRESS=0,
+	// so it is built when either switch is on; with transcripts off it tails the file and writes no stream.
+	//
+	// Issue #645: the run checkpointer is the file's third reader (an armed job's quiet points schedule its checkpoints), so
+	// with a checkpointer the opener is built even with both switches off; it then tails the file for the checkpoint alone
+	// (no stream, no progress key). `checkpoint` is called per attempt with the open() arguments the attempt supplies.
+	//
+	// Issue #646: a steer-armed job's delivery acks are read off the same file (steer-ack.mjs, the fourth reader), so with a
+	// Valkey client the opener is built even with every other reader off (`steer: true`); a job that is not armed hands no
+	// ack consumer and is tailed exactly as before (or not at all).
+	const steerWired = Boolean(redis);
+	const openLiveTranscript =
+		config.liveTranscripts || config.runProgress || runCheckpointer || steerWired
+			? makeLiveTranscriptOpenerFn({ redis, log, transcripts: config.liveTranscripts, progress: config.runProgress, makeCommenter: makeProgressCommenter, ...(runCheckpointer ? { checkpoint: (args) => runCheckpointer.open(args) } : {}), ...(steerWired ? { steer: true } : {}) })
+			: null;
+	// Issue #646 (DES-STEER-VIA-READONLY-INBOX-MOUNT): the inbox relay's opener, handed to every venue's runContainer, which
+	// opens one per steer-ARMED attempt (on openshell, issue #686, one writing frames on the exec's stdin). Bound here to the worker's client and to the host name the run checkpointer
+	// writes (`durableHost`), the one this host is known by in the fleet: the open key names it.
+	const openInboxRelay = steerWired ? (args) => makeInboxRelayFn({ redis, host: durableHost, now, log, ...args,
+		onDelivered: async ({ runId, id, at }) => {
+			const intent = await touchOutbox.begin({ runId, cause: "steer", at, nonce: id });
+			const result = await touchOutbox.applied(intent);
+			if (!result.ok) log("touch_record_pending", { reason: result.error });
+		},
+	}) : null;
+	// Issue #644: the final edit for an attempt that registered no commenter, so nothing else would edit the comment again.
+	// That is an attempt refused before its container (a cost cap, a policy gate) after an earlier attempt posted the
+	// comment and left it saying "attempt ended, retrying": with no edit here it said so for good. The comment's id is
+	// the one the earlier attempt's final write put in the progress key; an attempt 1 refused before its container
+	// finds none (nothing was posted) and edits nothing. One edit, from the record's outcome and the key's last snapshot
+	// (the earlier attempt's counters, the last the run reached), bounded and never throwing; skipped, as the commenter
+	// is, when the text could hold the job's own phrase.
+	const settleUnregisteredStatus = async (job, outcome) => {
+		try {
+			const data = job?.data ?? {};
+			// Issue #645: the progress key and the comment are the RUN's, so a recovery (`.rN`) finds the comment its run posted.
+			const runId = runIdOf(job);
+			if (statusTextMayMatch(data.trigger?.matched?.phrase, runId)) return;
+			const key = await readProgressKeyFn({ redis, jobId: runId });
+			if (!key?.commentId) return;
+			const text = renderStatusText({ jobId: runId, snapshot: key.snapshot, outcome });
+			const done = await settleWithin(statusEdit(data, key.commentId, text), STATUS_UNREGISTERED_EDIT_MS, null);
+			if (done === null) log("status_comment_final_timeout", { jobId: job.id });
+		} catch {
+			// The comment decides nothing: a failure here costs a stale comment, never the record path.
+		}
+	};
+	const recordRun = ({ job, result, error, startedAt, endedAt, project, size = null, capacity = null, earlier = null, maxTurns = null }) => {
 		// The project (issue #499) was resolved at the pickup gate and rides here as `project` (an id or null), so a live
 		// edit of projects.json mid-run cannot make the record disagree with what the job was counted against. A record
 		// path that ends BEFORE the pickup gate (the wait gate's refusals) passes none, and resolves from the live ref
@@ -1382,8 +1966,24 @@ export async function startWorker(
 		// four `recordRun` call sites byte-unchanged and `buildRecord` a pure function of its arguments.
 		// The default venue rides the same way and for the same reason (#277): it is the value the registry
 		// below is built with, so the record resolves a job's venue exactly as dispatch does.
-		const record = buildRecord({ job, result, error, startedAt, endedAt, host: config.workerName, defaultBackend: config.defaultBackend, project: projectId, size, capacity, earlier });
+		const record = buildRecord({ job, result, error, startedAt, endedAt, host: config.workerName, defaultBackend: config.defaultBackend, project: projectId, size, capacity, earlier, maxTurns, touchTracking: true });
 		writeRecord(record);
+		// Issue #644: the status comment's last edit, from the record's classification. An infrastructure failure the queue
+		// will retry says the attempt ended and is being retried, not "finished": BullMQ retries an error that is not
+		// unrecoverable while attempts are left, and this record is written while the attempt still counts as running
+		// (`attemptsMade` is the attempts finished before it). Never throws, never awaited; a job with no commenter is a
+		// no-op.
+		try {
+			const attempts = Number.isSafeInteger(job?.opts?.attempts) ? job.opts.attempts : 1;
+			// Issue #645: an attempt whose run continues as a recovery (`recovery-enqueued`) is retrying too, not failed: the
+			// recovery picks the same comment up (it is the run's) and ends it with its own outcome.
+			const retrying = (!result && error instanceof InfraRetry && record.attempt < attempts) || record.reason === "recovery-enqueued";
+			const outcome = retrying ? STATUS_RETRYING : record.outcome;
+			// The commenters are registered by the RUN id (the opener is handed it), so a `.rN` record settles its run's.
+			const runId = runIdOf(job);
+			if (statusComments.has(runId)) void statusComments.settle(runId, outcome);
+			else if (job?.data?.statusComment === true) void settleUnregisteredStatus(job, outcome);
+		} catch {}
 		// STRICTLY AFTER the file, and deliberately not awaited. After, because a crash between the two must
 		// leave a record with no fleet row rather than a fleet row with no record -- the mirror is a VIEW,
 		// and a view that can outlive its source is a second source of truth. Not awaited, because this is
@@ -1408,17 +2008,39 @@ export async function startWorker(
 		readRecord,
 		readMirrored: runMirror ? (jobId) => readMirroredRecordFn(redis, sanitizeJobId(jobId)) : null,
 	});
+	// Issue #645: a run's record by job id, this host's file then the fleet's copy where a mirror is armed, for the
+	// processor's recovery gate (a recovery whose base run already settled is superseded, not run). A recovery may land on
+	// a host that never ran its base attempt, so a local-only read would miss exactly the fleet case. Never rejects;
+	// unreadable or unreachable is null.
+	// `keep`, when given, is the rule the caller's record must pass (the processor's: this run's settled record, issue
+	// #811), applied to EACH side: this host's file answers only when it passes, and the fleet's copy is asked otherwise.
+	// Without it a stale record an older job left in this host's file under a reused id would be the answer, and the
+	// settled record in the mirror would never be looked at. Without `keep`, any record this host holds answers, as before.
+	const readRunRecord = async (jobId, { keep = null } = {}) => {
+		const kept = (record) => (record && record !== UNREADABLE_RECORD && (typeof keep !== "function" || keep(record)) ? record : null);
+		const local = kept(readRecord(jobId));
+		if (local) return local;
+		if (!runMirror) return null;
+		const mirrored = await readMirroredRecordFn(redis, sanitizeJobId(jobId)).catch(() => null);
+		return kept(mirrored);
+	};
 	// The record a retry (or a pickup after a stall) is about to replace (issue #599), read BOTH ways: this host's file and
 	// the fleet's copy where a mirror is armed. Both, because each host keeps its own file: a job that ran on A, then B,
 	// then A again finds A's stale first attempt locally while B's second is in the mirror. `newerRecord` keeps the higher
-	// attempt (a tie: the later end). Its slot interval rides the new record as `earlier`. Never rejects: unreadable or
-	// unreachable is no record from that side.
-	const previousRecord = async (jobId) => {
+	// attempt (a tie: the later end). Its slot interval rides the new record as `earlier`. The failed listener's lost-lock
+	// check reads a job's own failed record through it too, for the same reason (issue #761). Never rejects: unreadable
+	// or unreachable is no record from that side.
+	// `keep`, when given, is the rule a caller's record must pass (`recordOfThisJob` for one attempt, pure and never
+	// throwing), applied to EACH side before the higher attempt is chosen. Applied after, it would judge only the side
+	// chosen: ids are reused, so a stale record an older job left at a higher attempt would win on attempt and then fail
+	// the rule, and this attempt's own record on the other side would never be looked at.
+	const previousRecord = async (jobId, { keep = null } = {}) => {
+		const kept = (record) => (record === null || typeof keep !== "function" || keep(record) ? record : null);
 		const read = readRecord(jobId);
-		const local = read === UNREADABLE_RECORD ? null : read;
+		const local = kept(read === UNREADABLE_RECORD ? null : read);
 		if (!runMirror) return local;
 		const mirrored = await readMirroredRecordFn(redis, sanitizeJobId(jobId)).catch(() => null);
-		return newerRecord(local, mirrored === UNREADABLE_RECORD ? null : mirrored);
+		return newerRecord(local, kept(mirrored === UNREADABLE_RECORD ? null : mirrored));
 	};
 
 	// INT-CONFIG-OVERLAY-CONTRACT: the worker reads the runtime-settings overlay at EACH job start, so this
@@ -1432,6 +2054,12 @@ export async function startWorker(
 		// (issue #501), so an overlay window with an env per-job cap is valid. `secretProfiles` rides alongside the
 		// effective keys; that function says why.
 		const res = resolveSettings(config, readOverlay(settingsFile, { log }));
+		// Issue #761: a file written by a newer pi-dispatch keeps `newer: true`, so the processor DEFERS the job
+		// (`newer-release`) instead of refusing it as settings-overlay-invalid. Its own line: it is no broken file.
+		if (res.invalid && res.newer === true) {
+			log("settings_overlay_newer", { reason: res.invalid, settingsFile });
+			return { invalid: res.invalid, newer: true };
+		}
 		if (res.invalid) {
 			log("settings_overlay_invalid", { reason: res.invalid, settingsFile });
 			return { invalid: res.invalid };
@@ -1460,6 +2088,52 @@ export async function startWorker(
 	// (`OQ-009`), so the working tree it needs is the one this machine just used: routing it anywhere
 	// else would enqueue a job only this host can run onto a queue every host drains.
 	const collectChain = makeCollectChain({ queue: cronQueue, config, log });
+	const watchStore = makeWatchStore(redis, { now });
+	const watchIssueAdapter = makeWatchIssueAdapter({ getContext: async target => {
+		const auth = forges[target.kind]?.auth ?? await ensureAuth(target.kind);
+		if (!auth) throw configError("watch: configure the target forge credentials");
+		const token = await auth.mintToken({ kind: target.kind, repo: target.repo, permissions: { issues: "write", metadata: "read" } });
+		return { apiUrl: target.kind === "github" ? "https://api.github.com" : config[target.kind]?.apiUrl, token };
+	} });
+	const watchPublisher = makeWatchIssuePublisher({ redis, adapter: watchIssueAdapter, now,
+		canClose: async mapping => {
+			const doc = parseTriggersDocument(readFileSync(onceTriggersFile, "utf8"), onceTriggersFile);
+			const rule = doc.triggers.find(t => t.on.type === "watch" && t.on.id === mapping.ruleId && t.on.source === mapping.source);
+			const target = rule?.run.issue;
+			return Boolean(doc.watchSources?.[mapping.source] && target?.closeAfter && target.kind === mapping.target.kind && target.repo === mapping.target.repo && watchDurationMs(target.closeAfter) === mapping.closeAfterMs);
+		},
+		reportClose: async (outcome, mapping) => { if (mapping?.ruleId) await watchStore.recordIssueOutcome(mapping.ruleId, outcome); },
+	});
+	const watchRuntime = makeWatchRuntime({ store: watchStore, triggersPath: onceTriggersFile, now, log, getSettings, pauseUntil: (job, at) => pauseUntilMs(pauseWindows.current, job, at), enqueue: (fields, opts) => enqueueWatchJob(cronQueue, fields, { now, ...opts }), publishIssue: watchPublisher });
+	const questionGroupRuntime = makeQuestionGroupRuntimeFn({ store: questionGroupStore, triggersPath: onceTriggersFile, getSettings,
+		resolveClassifier: ({ provider, id }) => {
+			const models = readOverlayModels(config.globalPiDir);
+			const entry = models?.providers?.[provider];
+			const custom = entry?.models?.find((model) => model.id === id);
+			if (custom) return custom;
+			const base = builtinModel(provider, id);
+			const override = entry?.modelOverrides?.[id];
+			return base ? { ...base, ...override, cost: { ...base.cost, ...override?.cost } } : null;
+		},
+	});
+	const answerDraftStore = makeAnswerDraftStore({ redis, now, retentionDays: config.logRetentionDays });
+	const answerDraftRuntime = makeAnswerDraftRuntime({ store: answerDraftStore, triggersPath: onceTriggersFile, now, log,
+		enqueue: fields => enqueueAnswerDraftJob(runtimeQueue, fields),
+		readParkedInfo: sessionStore.readParkedInfo,
+		readApproval: source => approvalStore.find(source),
+		readPendingAnswer: async source => {
+			const found = await discoverHostQueuesReporting(redis);
+			if (found.incomplete || found.names.length > 64) return { unknown: true };
+			const queues = [runtimeQueue, ...found.names.map(name => recoveryQueues.host(name))];
+			return readAnswerPending({ queues, source, runId: source.runId });
+		},
+		// The API root is the forge table's (`forgeApiRoot`), the one the console binds a completed draft to. Raw, as
+		// configured: the runner fetches under it and checks Forgejo's issue_url against it.
+		identity: async job => {
+			const auth = forgeFor(job)?.auth ?? await ensureAuth(job.kind);
+			return auth ? { selfId: job.kind === "azure" ? auth.selfId?.id : auth.selfId, apiUrl: forgeApiRoot(job.kind, config) } : null;
+		},
+	});
 
 	// Issue #505. One live-file check, shared by the pickup gate, the snapshot and the plan collector, so the three ask one
 	// file by one rule: the same file and rule as the one-shot checks below (`onceTriggersFile`). `pi-dispatch run
@@ -1471,7 +2145,8 @@ export async function startWorker(
 	const collectPlan = makeCollectPlan({ allocation: allocationState, governing: governingNow, projects: () => projects.current, checkPortfolioFlag, log });
 	// The snapshot a confirmed portfolio job reads as /job/portfolio.json, built at prepare. The run counts are complete
 	// only with the run mirror, which a declared worker name arms (the `runMirror` rule below).
-	const portfolioSnapshot = makePortfolioSnapshot({ checkPortfolioFlag, governing: governingNow, projects: () => projects.current, limits: () => scopedLimits.current, allocation: allocationState, redis, logsDir: config.logsDir, mirror: config.workerNameDeclared === true, log });
+	// `indexMax` (issue #761): the snapshot reads the whole index, which this host's own trim keeps at or under its cap.
+	const portfolioSnapshot = makePortfolioSnapshotFn({ checkPortfolioFlag, governing: governingNow, projects: () => projects.current, limits: () => scopedLimits.current, allocation: allocationState, redis, logsDir: config.logsDir, mirror: config.workerNameDeclared === true, indexMax: config.runMirrorMaxRuns, log });
 
 	// REQ-GLOBAL-PI-OVERLAY staged packages: read the operator's stage manifest at EACH job start, like
 	// getSettings above and the pause-window ref below.
@@ -1499,6 +2174,21 @@ export async function startWorker(
 		if (lastPackageKey !== null && key !== lastPackageKey) log("packages_stage_changed", { count: key === "" ? 0 : key.split(":").length });
 		lastPackageKey = key;
 	};
+	// Issue #800: the name and version each path of the last good read stood for, so the rows a job's record names are the
+	// read that chose its paths. Beside last-known-good, and replaced with it.
+	let stagedRowByPath = new Map();
+	// Issue #800: whether the set this returned says what is staged here, which the record needs before it calls a name absent. `readStageManifest` answers null
+	// for a manifest that is not there and for one that does not read, and only the first is a stage with nothing in it: with no last-good set the second returns
+	// [] too, and a package's real name would be recorded as one this host does not hold.
+	let stageRead = true;
+	const manifestIsAbsent = () => {
+		try {
+			statSync(join(config.globalPiDir, PACKAGES_SUBDIR, STAGE_MANIFEST));
+			return false;
+		} catch (error) {
+			return error?.code === "ENOENT";
+		}
+	};
 	const getPackagePaths = () => {
 		if (!config.globalPiDir) return [];
 		const staged = readStageManifest({ globalPiDir: config.globalPiDir });
@@ -1508,13 +2198,18 @@ export async function startWorker(
 				return lastGoodPackagePaths;
 			}
 			notePackageKey("");
+			stageRead = manifestIsAbsent();
 			return [];
 		}
+		stageRead = true;
 		const paths = containerPackagePaths(staged);
 		notePackageKey(paths.join(":"));
 		lastGoodPackagePaths = paths;
+		stagedRowByPath = new Map(staged.packages.map((p) => [containerPackagePaths({ packages: [p] })[0], { name: p.name, version: p.version }]));
 		return paths;
 	};
+	getPackagePaths.rowOf = (path) => stagedRowByPath.get(path) ?? null;
+	getPackagePaths.stageRead = () => stageRead;
 	// One read at boot, for the same log line the boot read always emitted, and to seed last-known-good.
 	if (config.globalPiDir && !readStageManifest({ globalPiDir: config.globalPiDir })) log("packages_manifest_absent", { overlay: config.globalPiDir });
 	getPackagePaths();
@@ -1547,6 +2242,8 @@ export async function startWorker(
 				egress: config.egress,
 				egressProxy: config.egressProxy,
 				openJobLog,
+				...(openLiveTranscript ? { openLiveTranscript } : {}),
+				...(openInboxRelay ? { openInboxRelay } : {}),
 				globalPiDir: config.globalPiDir,
 				allowGlobalExtensions: config.allowGlobalExtensions,
 				packagePaths: getPackagePaths,
@@ -1555,6 +2252,8 @@ export async function startWorker(
 				forgeHosts: { gitlab: config.gitlab?.apiUrl ?? null, forgejo: config.forgejo?.apiUrl ?? null, azure: config.azure?.orgUrl ?? null },
 				backendFloor: config.backendFloor,
 				reap: backendReaps[PODMAN_BACKEND],
+				// Issue #681: the budget's leftover listing, through the same seam local's takes.
+				listJobContainers: listJobContainersFn("podman"),
 				readInfo: podmanInfo,
 				platform: jobUserIdentity.platform,
 				euid: jobUserIdentity.euid,
@@ -1593,8 +2292,52 @@ export async function startWorker(
 		// Its own sentence (PR #463 round 3): the job-shaped one says "this job is retried", and at boot there is no job.
 		if (typeof bootKeeper?.keeper === "string") log("netns_keeper_not_holding_at_boot", { reason: bootKeeper.keeperAtBoot ?? bootKeeper.keeper });
 	}
-	// Every bundle this boot built beside local's, in registration order: the podman one first, then the injected ones.
-	const builtBackends = [...(podmanBackend ? [podmanBackend] : []), ...extraBackends];
+	// Issue #684: the openshell bundle, while blessed. Its policy reads the same two sources the squid venues' proxy reads
+	// and the MCP check reads (this folder's egress-allowlist.conf, a missing one admitting nothing, and the pickup's
+	// endpoint snapshot, or the boot-loaded one where a job carries none); its reaper is the boot sweep's own.
+	// ONE reader of this folder's egress-allowlist.conf for the MCP check and the openshell policy, so the two cannot
+	// disagree about what the proxy admits. No allowlist here: every host outside a declared endpoint is unreachable,
+	// which it is. Any other failure is the caller's to classify (a transient errno is retried).
+	const readEgressAllowlist = () => {
+		try {
+			return parseAllowlist(readFileSync(join(process.cwd(), "egress-allowlist.conf"), "utf8"));
+		} catch (error) {
+			if (error?.code === "ENOENT") return [];
+			throw error;
+		}
+	};
+	// Issue #686 part 3: one option set, so the two modes cannot drift apart in anything but their mode (and their key in
+	// the boot sweep's map, which holds one reaper for both).
+	const readOpenshellEndpoints = () => modelEndpoints.current ?? [];
+	const openshellOptions = (mode) => ({
+		mode,
+		image: config.jobImage,
+		// Review round 1 (#714): the bind probe's empty source directory is made under the jobs dir.
+		jobsDir: config.jobsDir,
+		engine: config.openshell.engine,
+		gateway: config.openshell.gateway,
+		readAllowlist: readEgressAllowlist,
+		readEndpoints: readOpenshellEndpoints,
+		hostEnv: env,
+		openJobLog,
+		// Issue #686: the same opener the binding venues get, fed from the exec's stderr records, and the same inbox relay
+		// opener, whose relay writes a steered job's messages as frames on the exec's stdin there (part 2).
+		...(openLiveTranscript ? { openLiveTranscript } : {}),
+		...(openInboxRelay ? { openInboxRelay } : {}),
+		globalPiDir: config.globalPiDir,
+		allowGlobalExtensions: config.allowGlobalExtensions,
+		packagePaths: getPackagePaths,
+		forwardEnv: config.forwardEnv,
+		authFromPi: config.authFromPi,
+		forgeHosts: { gitlab: config.gitlab?.apiUrl ?? null, forgejo: config.forgejo?.apiUrl ?? null, azure: config.azure?.orgUrl ?? null },
+		reap: backendReaps[mode === "bind" ? OPENSHELL_BIND_BACKEND : OPENSHELL_BACKEND],
+		log,
+	});
+	const openshellBackend = openshellCopyBlessed ? makeOpenshellBackendFn(openshellOptions("copy")) : null;
+	const openshellBindBackend = openshellBindBlessed ? makeOpenshellBackendFn(openshellOptions("bind")) : null;
+	// Every bundle this boot built beside local's, in registration order: podman, openshell, openshell-bind, then the
+	// injected ones.
+	const builtBackends = [...(podmanBackend ? [podmanBackend] : []), ...(openshellBackend ? [openshellBackend] : []), ...(openshellBindBackend ? [openshellBindBackend] : []), ...extraBackends];
 	// BOUNDED, because `.catch()` cannot rescue a promise that never settles: `runDocker` resolves only on
 	// the child's `close` or `error` and has no timeout of its own, so a wedged daemon would hang boot
 	// here. This read is a nicety -- a digest for the boot line and the registry -- and a nicety may
@@ -1629,7 +2372,10 @@ export async function startWorker(
 	}
 	// Resolved once: `Intl` is not free, and this value cannot change without a restart.
 	const hostTz = Intl.DateTimeFormat().resolvedOptions().timeZone ?? "";
+	const endpointSlots = makeInFlight();
+	const endpointStatusNow = () => endpointStatusFields(modelEndpoints.current, endpointSlots, config.workerNameDeclared);
 	const registry = makeHostRegistryFn({ redis, name: config.workerName, log });
+	const retainedNow = makeSandboxTelemetry({ list: () => listSandboxesFn({ sandboxDir: config.sandboxDir, throwOnReadFailure: true }), deadline: sandboxDeadline, retentionHours: config.sandboxRetentionHours, canOpen: (manifest) => !sandboxSyncRefusal({ jobId: manifest.jobId, manifest, blessed: config.backends }), now, log });
 	// Issue #596, phase 2: one integer of the host budget's snapshot for the beat, or "" before the worker exists.
 	const snapshotField = (key) => {
 		const snap = worker?.hostBudget?.snapshot?.();
@@ -1645,7 +2391,7 @@ export async function startWorker(
 				return [];
 			}
 		};
-		return liveJobsFields(liveJobsOf({ running: read(() => worker?.runningJobs?.list?.()), budgetEntries: read(() => worker?.hostBudget?.entries?.()) }));
+		return liveJobsFields(liveJobsOf({ defaultVenue: config.defaultBackend, running: read(() => worker?.runningJobs?.list?.()), budgetEntries: read(() => worker?.hostBudget?.entries?.()) }));
 	};
 	// NOT awaited, and that is load-bearing rather than an optimisation. `makeRedisClient` sets
 	// `maxRetriesPerRequest: null` -- required for BullMQ's blocking connections -- which means a command
@@ -1671,7 +2417,20 @@ export async function startWorker(
 		//
 		// Recomputed per beat rather than frozen at boot, for the reason the digest is: a host that gains a
 		// profile on restart must start attracting that work within one beat, and one that loses it must stop.
-		caps: () => serializeCaps(capabilityTokens(config)),
+		//
+		// Issue #704: the secret half is the profiles this host would RESOLVE, not only the env-declared ones. The
+		// overlay is read here each beat (without a log, `fpUsd`'s reason), so a profile declared in the panel is
+		// advertised within one beat of the write when its resolver sits inside PI_SECRET_RESOLVER_ROOTS, and
+		// never when it does not. A name declared in both sources makes this host refuse every secrets job, so it
+		// then advertises no secret profile at all. An overlay the job path refuses advertises the env profiles,
+		// the row it always published; every job on such a host refuses as settings-overlay-invalid anyway.
+		caps: () => {
+			// `resolveSettings`, the job path's own rule (getSettings): an overlay that refuses every job as
+			// settings-overlay-invalid, by its own validation or by the merged dollar rule, contributes no profile.
+			const settings = resolveSettings(config, readOverlay(settingsFile));
+			const served = servableSecretProfiles({ envProfiles: config.secretProfiles, overlayProfiles: settings.invalid ? {} : (settings.secretProfiles ?? {}), roots: config.secretResolverRoots, realExecutablePath: realExecutable });
+			return serializeCaps(capabilityTokens({ secretProfiles: served.ambiguous ? {} : served.profiles, waitProfiles: config.waitProfiles }));
+		},
 		// The host's IANA zone, because a cron PATTERN carries none: `triggers.json` has no `tz` field and
 		// BullMQ hands the pattern to cron-parser with no zone, so it resolves in each worker's LOCAL time.
 		// On one host that is exactly what an operator means; on two in different zones the same pattern is
@@ -1703,9 +2462,21 @@ export async function startWorker(
 		// Issue #596: the highest scoped-limits version this build reads, so doctor can name a worker that would keep its
 		// last good file (so no size and no later edit to the file applies on it) once the file is version 3. An integer.
 		limitsVersion: SCOPED_LIMITS_VERSION,
+		// Issue #761 (DES-STORE-VERSION-WHEN-NEEDED): the highest version this build reads of the settings overlay, the pause
+		// windows file, the triggers file and a queued job's data, integers, on `limitsVersion`'s model: only doctor reads
+		// them, to name a peer that would defer (or, from before these fields, misread) what this host's files now need.
+		settingsVersion: SETTINGS_VERSION,
+		pauseWindowsVersion: PAUSE_WINDOWS_VERSION,
+		triggersVersion: TRIGGERS_FILE_VERSION,
+		jobDataVersion: JOB_DATA_VERSION,
 		// Issue #596, phase 2: this host's budget and what its jobs hold against it, integers (MiB and hundredths of a CPU),
 		// `off` for a budget switched off and "" while unknown, so doctor and a forge job's never-fits check can read which
 		// host a size fits on. Thunks over the worker's one budget, so every beat says what is held now.
+		sandboxes: () => retainedNow().sandboxes,
+		sandboxesMore: () => retainedNow().sandboxesMore,
+		sandboxRetentionHours: () => retainedNow().sandboxRetentionHours,
+		budgetFrom: () => { const value = parseBudgetFrom(worker?.hostBudget?.detail?.()); return value ? JSON.stringify(value) : ""; },
+		cpuReserve: () => JSON.stringify(parseCpuReserve(cpuReserve.states?.()) ?? []),
 		budgetMemMiB: () => budgetField(worker?.hostBudget?.current().memMiB ?? null),
 		budgetCpuCenti: () => budgetField(worker?.hostBudget?.current().cpuCenti ?? null),
 		usedMemMiB: () => snapshotField("usedMemMiB"),
@@ -1721,6 +2492,10 @@ export async function startWorker(
 		waiters: () => snapshotField("waiters"),
 		jobs: () => (worker ? liveJobsNow().jobs : ""),
 		jobsMore: () => (worker ? liveJobsNow().jobsMore : ""),
+		endpointsVersion: ENDPOINT_STATUS_VERSION,
+		endpointsStartedAt: endpointStatusNow().endpointsStartedAt,
+		endpoints: () => endpointStatusNow().endpoints,
+		endpointsMore: () => endpointStatusNow().endpointsMore,
 		budgetHolds: () => snapshotField("holds"),
 		budgetOrphans: () => snapshotField("orphans"),
 		// whether the boot listing of the job containers left from before this worker started has been read
@@ -1731,6 +2506,10 @@ export async function startWorker(
 			if (typeof snap?.seeded !== "boolean") return "";
 			return snap.seeded ? "listed" : `unlisted:${(snap.unseeded ?? []).join(",")}`;
 		},
+		// Issue #712: the venues this host blesses (the first is its default), its floor and its OpenShell engine and
+		// gateway word, for the console's and the panel's Venues view (`hostBackendsField`: names and fixed words only).
+		// A value, not a thunk: every part is boot configuration or the boot's gateway read, none changes without a restart.
+		backends: hostBackendsField({ backends: config.backends, backendFloor: config.backendFloor, openshellEngine: config.openshell?.engine ?? null, gatewayWord: openshellGatewayWord }),
 	});
 
 
@@ -1864,6 +2643,8 @@ export async function startWorker(
 					// job containers, and an unproven answer must never free a slot.
 					stopContainer: makeStopContainer(),
 					reap: backendReaps[DEFAULT_BACKEND],
+					// Issue #681: the host budget's leftover listing rides on the bundle, so the boot seed asks each venue its own.
+					listJobContainers: listJobContainersFn("docker"),
 					// One deployment default, two consumers, adjacent by construction: the preflight that refuses a missing
 					// image BEFORE the budget slot, and the factory that puts it in the argv. Both resolve a trigger's own
 					// `run.image` through the same resolveJobImage, so the image that was checked is the image that runs.
@@ -1884,6 +2665,8 @@ export async function startWorker(
 						egress: config.egress, // REQ-EGRESS-ALLOWLIST: the per-job network and the proxy variables
 						egressProxy: config.egressProxy,
 						openJobLog,
+						openLiveTranscript, // issues #643 and #644: null when PI_LIVE_TRANSCRIPTS=0 and PI_RUN_PROGRESS=0 (and no Valkey client, #646)
+						openInboxRelay, // issue #646: the steer inbox relay, null without a Valkey client
 						globalPiDir: config.globalPiDir, // REQ-GLOBAL-PI-OVERLAY: :ro overlay mount when configured
 						allowGlobalExtensions: config.allowGlobalExtensions,
 						// REQ-GLOBAL-PI-OVERLAY: staged package paths; every job receives them unless its trigger set
@@ -1941,11 +2724,14 @@ export async function startWorker(
 		const opened = [registry, runtimeQueue, ...(cronQueue !== runtimeQueue ? [cronQueue] : [])];
 		// Bounded, then forced: a queue whose connection came up closes by sending QUIT and awaiting the reply, and against a
 		// server that stopped answering that wait never ends (measured through a stalling proxy), so the refusal itself would
-		// never travel. Five seconds covers the host registry's own bounded close; whatever is still open is disconnected.
-		await settleWithin(Promise.allSettled(opened.map((handle) => Promise.resolve().then(() => handle?.close?.()))), 5_000);
+		// never travel. `QUEUE_CLOSE_BOUND_MS` (five seconds) covers the host registry's own bounded close, and is the bound
+		// each queue's own close waits for each of its steps; whatever is still open is disconnected.
+		await settleWithin(Promise.allSettled(opened.map((handle) => Promise.resolve().then(() => handle?.close?.()))), QUEUE_CLOSE_BOUND_MS);
 		for (const handle of opened) {
 			try {
-				handle?.disconnect?.();
+				// BullMQ's disconnect awaits initialization and can reject asynchronously when that start failed.
+				// Observe that cleanup rejection without extending the bound or replacing the boot's refusal.
+				void Promise.resolve(handle?.disconnect?.()).catch(() => {});
 			} catch {
 				// a handle with nothing left to drop
 			}
@@ -1965,10 +2751,23 @@ export async function startWorker(
 	// a spread, a freeze, a snapshot inside `createWorker` -- un-registers the watchers in SILENCE and puts
 	// issue #295 back. Append only: two tests pin `[0]` as the runtime queue and `[1]` as the registry.
 	const extraClosers = [runtimeQueue, registry, ...(cronQueue === runtimeQueue ? [] : [cronQueue])];
+	if (subscriptions) {
+		const publish = () => publishSubscriptionStatus(redis, config.workerName, subscriptions.runtime).catch(() => log("subscription_status_unavailable", {}));
+		await publish();
+		const tick = setInterval(publish, 15_000);
+		tick.unref?.();
+		extraClosers.push({ close: () => clearInterval(tick) });
+	}
+	// A first source can arrive through live configuration after boot. Recovery and quiet-close
+	// draining must already exist then, even when the initial source registry was empty.
+	extraClosers.push(makeWatchDrainer({ runtime: watchRuntime, log }));
+	extraClosers.push(makeWatchDrainer({ runtime: answerDraftRuntime, log: () => log("answer_handoff_unavailable", {}) }));
 
 	// HOISTED out of the deps literal (issue #288): the terminal failed listener below needs the same
 	// adapter the processor gets, and two bodies would drift exactly where drift costs a public comment.
 	const comment = async (job, text) => {
+		if (job?.answerDraft || job?.purpose === "answer-draft") return;
+		if (!await draftReplyMayPost(job)) return;
 		// Best-effort: the processor awaits comment() inside its try, so a rejection here would
 		// corrupt the job outcome and could drive a wrong retry / second PR (CONST-RETRY-INFRA-ONLY).
 		// This adapter NEVER throws.
@@ -2002,11 +2801,27 @@ export async function startWorker(
 		log("comment", { jobId: job?.id, text });
 	};
 
+	// Issue #646 (DES-STEER-LATE-MESSAGE-RESUME-OR-REPLY): what a late forge message becomes at a steer-armed run's final
+	// outcome, for all three settle sites (the processor, the host-lost sweep, the failed listener): the run's semantic
+	// window released, then a resumed job on the queue that ran the run or one fixed reply through `comment` above. The
+	// recovery queues are the same handles a #645 recovery is routed through, so a host queue is reached by its name.
+	const lateForge = makeLateForge({ redis, queues: recoveryQueues, comment, log, now, canPublish: draftReplyMayPost });
+	// The host-lost sweep's run ended on a host that is gone, so its resumed job goes to the shared queue, never to that
+	// host's queue, where nothing would ever take it.
+	const lateForgeShared = (entries, context) => lateForge(entries, { ...context, queueName: QUEUE });
+	// Issue #638 (DES-AWAIT-INPUT-ENDS-THE-JOB): what an awaitInput run's held replies become. `take` runs inside the
+	// processor's park sequence and starts the first recent one as the resumed job, with the window; the settle at the
+	// same three final-outcome sites is the backstop that drops them for any run that did not park (held-settle.mjs).
+	// The host-lost sweep's run can never have parked, so there it only ever drops.
+	const heldSettle = makeHeldSettle({ redis, queues: recoveryQueues, comment, log, now });
+
 	// Issue #625: the forge's parked marker, set on a park and cleared when it no longer applies. comment()'s shape and its
 	// rule: it NEVER throws, because the marker decides nothing (the session store's sidecar does) and a forge that refuses
 	// the label must not flip an outcome. A local job has no forge and no marker. Issues only: a pull request's reply is
 	// routed on the phrase (parked.mjs).
-	const parkedLabel = async (job, on) => {
+	const parkedLabel = async (job, on, approval = false) => {
+		if (job?.answerDraft || job?.purpose === "answer-draft") return;
+		if (!await draftReplyMayPost(job)) return;
 		const forge = forgeFor(job);
 		if (!forge?.host?.setParkedLabel || job?.target?.type !== "issue") return;
 		try {
@@ -2014,11 +2829,58 @@ export async function startWorker(
 			if (!auth) return;
 			const token = await auth.mintToken(job);
 			await forge.host.setParkedLabel(job, job.target, on, token);
+			if (approval || !on) await forge.host.setParkedLabel(job, job.target, on && approval, token, APPROVAL_LABEL);
 		} catch (err) {
 			log("parked_label_failed", { jobId: job?.id, on, reason: err?.message });
 		}
 	};
 
+	const approvalSessionCheck = makeApprovalSessionCheck({ sessionsDir: config.sessionsDir, maxBytes: config.sessionMaxBytes, ttlDays: config.sessionsTtlDays, maxAgeDays: config.sessionMaxAgeDays, maxResumeChain: config.sessionMaxResumeChain, maxContextPct: config.sessionMaxContextPct, now });
+	const approvalStore = makeApprovalStore({ redis, now });
+	const approvalRuntime = makeApprovalRuntime({
+		store: approvalStore,
+		touchStore,
+		touchOutbox,
+		checkPolicy: makeCheckApprovalPolicy({ triggersPath: onceTriggersFile, parseTriggers }),
+		now,
+		host: durableHost,
+		hostQueue,
+		requireSessionDigest: true,
+		enqueueExpiry: async (request) => {
+			const queue = hostQueue ? cronQueue : runtimeQueue;
+			const jobId = approvalExpiryJobId(request.requestId);
+			await queue.add(request.kind, {
+				...request.resumeJob,
+				approvalRequestId: request.requestId,
+				trigger: { ...request.resumeJob.trigger, deliveryId: `expiry-${request.requestId}`, comment: { body: "/decline" } },
+			}, approvalExpiryJobOpts(jobId));
+			return { ok: true };
+		},
+		comment: async (request, text) => {
+			// One expiry comment per request: the mark lives as long as the request's finished state (MILLISECONDS, PX).
+			if (await redis.set(`run:approval:expiry-comment:${request.requestId}`, "1", "PX", APPROVAL_FINISHED_TTL_MS, "NX") === "OK") await comment(request.resumeJob, text);
+		},
+	});
+
+	let approvalSweep = null;
+	const startApprovalSweep = () => {
+		if (approvalSweep) return;
+		approvalSweep = makeRetentionSweepFn({
+			reapers: [{ name: "approval", reap: async () => {
+				const result = await approvalRuntime.sweep();
+				if (!result.ok) log("approval_expiry_unavailable", { failures: result.failures?.length ?? 1 });
+			} }], intervalMs: 60_000, log,
+		});
+		approvalSweep.start();
+		extraClosers.push(approvalSweep);
+	};
+	const publishApproval = approvalRuntime.afterPark;
+	approvalRuntime.afterPark = async (options) => {
+		const result = await publishApproval(options);
+		if (result.ok) startApprovalSweep();
+		return result;
+	};
+
 	// The operator's failure hook (issue #288, INT-ON-FAILURE-HOOK-CONTRACT). Constructed ONLY when the
 	// knob is set: an unset PI_ON_FAILURE builds nothing, spawns nothing, and logs nothing -- the
 	// byte-identical guarantee. Fired from the two terminal listeners below, never from the processor:
@@ -2027,8 +2889,10 @@ export async function startWorker(
 	// `hostEnv: env`, not the default process.env -- the #309 rule every spawner in this file follows
 	// (runContainer, resolveSecrets): a subprocess runs with THIS worker's env, identical on the real
 	// path and divergent only under an injected one, which is exactly where the difference would hide.
+	const hookRuns = config.onFailure ? makeHookRunsPublisher({ redis, name: config.workerName, now, log }) : null;
+	if (hookRuns) extraClosers.push(hookRuns);
 	const onFailure = config.onFailure
-		? makeOnFailure({ command: config.onFailure, timeoutMs: config.onFailureTimeoutMs, host: config.workerName ?? "", hostEnv: env, log })
+		? makeOnFailure({ command: config.onFailure, timeoutMs: config.onFailureTimeoutMs, host: config.workerName ?? "", hostEnv: env, log, publish: hookRuns.publish })
 		: null;
 	// Which POLICY reasons page the operator. Paid terminals only: worker-abort, runner-policy and every
 	// named runner reason cost a container and ended wrong. The runner's named reasons are SPREAD from
@@ -2043,24 +2907,45 @@ export async function startWorker(
 	// One predicate for the completed listener and the lost-lock path below, so a record replays exactly the page its
 	// result would have sent.
 	const pagesAsPolicy = (result) => Boolean(onFailure) && result?.outcome === "policy" && HOOK_POLICY_REASONS.has(result.reason) && result.budgetReserved !== false;
-	// The infra-terminal sentence (issue #288). FIXED, never err.message: the message classes that reach
-	// a failedReason carry host paths and library words (the #310 record), and for a local job this text
-	// lands verbatim in the service log through the adapter's stdout fallthrough. The worker log already
-	// holds the truncated reason on the job_failed line beside it.
-	const FAILED_COMMENT = "Failed: an error stopped this job and it will not be retried further. Ask the operator to check the worker log.";
-	// Issue #458 (PR #463 round 2): a job that never started because the podman venue's rootless network keeper did not
-	// hold says so, since the generic line sends an operator to a log that only says the job failed. Fixed text keyed by
-	// the fixed reason token, never the error's own words: a forge comment carries nothing a host read produced.
-	const FAILED_COMMENT_BY_REASON = Object.freeze({
-		// Neutral on the cause (PR #463 round 3): a keeper that is not running and a proxy that must restart after it both land here.
-		[NETNS_KEEPER_NOT_HOLDING]: "Failed before it started: this worker's rootless Podman egress proxy did not pass its pre-start check (its rootless network keeper, pi-dispatch-netns-keeper), so the job was retried and never run. Nothing was spent. Ask the operator to run `pi-dispatch doctor` on the worker for the exact fix.",
-		// Issue #476: a job held on a young keeper that kept restarting while it waited.
-		[NETNS_KEEPER_CRASH_LOOP]: "Failed before it started: this worker's rootless network keeper (pi-dispatch-netns-keeper), which its Podman egress proxy needs, kept restarting while the job waited for it, so the job was retried and never run. Nothing was spent. Ask the operator to run `pi-dispatch doctor` on the worker and read the keeper's log (`journalctl --user -u pi-dispatch-netns-keeper.service`).",
-		// Issue #448 (gate round 2 of PR #473): the hold's own ending, so the comment names the cause and the fix.
-		[PODMAN_RESTART_HOLD_EXPIRED]: "Failed before it started: rootful Podman's service on this worker kept running with a containers.conf older than its files (or a file's change time stayed ahead of the host's clock) for an hour, so the job was held and never run. Nothing was spent. Ask the operator to restart it while no local job runs (`sudo systemctl restart podman.service`), then run the job again.",
+	// Issue #645: the one RETURNED failure that pages. A recovery whose container ran, ended infra and could not queue
+	// another recovery returns `failed`/`recovery-failed` (the processor posts its own sentence), so it reaches the
+	// completed listener and never the failed one: without this it would be the only paid terminal that pages nobody.
+	const pagesAsReturnedFailure = (result) => Boolean(onFailure) && result?.outcome === "failed" && result.reason === "recovery-failed";
+	// The infra-terminal sentences (FAILED_COMMENT, FAILED_COMMENT_BY_REASON, issue #288) and the host-lost one
+	// (RECOVERY_HOST_LOST_COMMENT, issue #645) are module constants in comment-tables.mjs since issue #710, with why each is fixed.
+	// Fleet-wide, on every host: whichever host's sweep claims a due recovery first tells its run. The record says it too,
+	// so the panel's history shows the run ended rather than a recovery that vanished.
+	const sweepHostLost = makeHostLostSweepFn({
+		redis,
+		queues: recoveryQueues,
+		now,
+		log,
+		// The registry's live rows (host-registry.mjs heartbeats, HOST_TTL_MS): a recovery whose host is still beating is
+		// delayed (a pause window, a full host), not lost. Names in the run checkpointer's spelling, as the pointer has them;
+		// null when the registry could not be read, which extends rather than fails.
+		liveHosts: async () => {
+			const read = await readLiveHosts(redis, { now, prune: false });
+			if (read?.unreachable || !Array.isArray(read?.hosts)) return null;
+			return new Set(read.hosts.map((h) => normalizeHost(h.name)));
+		},
+		onLost: async (job) => {
+			const at = new Date(now()).toISOString();
+			// Issue #646: the run's final outcome, so its inbox is closed and counted here too (index.mjs's rule for every
+			// record it writes); a steer job's waiting messages are then `late`, never left `queued` until the key expires.
+			const lostError = { reason: "recovery-host-lost" };
+			if (job?.data?.steer === true) {
+				const steered = await settleInbox({ redis, job, error: lostError, log, onLateForge: lateForgeShared });
+				if (steered) lostError.steered = steered;
+			}
+			if (job?.data?.awaitInput === true) await heldSettle({ job, error: lostError, queueName: QUEUE });
+			recordRun({ job: { id: job.id, name: job.name, data: job.data, opts: job.opts, attemptsMade: 0, timestamp: job.timestamp }, error: lostError, startedAt: null, endedAt: at });
+			await comment({ ...job.data, id: job.id }, RECOVERY_HOST_LOST_COMMENT);
+			onFailure?.({ jobId: job.id, outcome: "failed", reason: "recovery-host-lost" });
+		},
 	});
 
 	const worker = createWorkerFn({
+		endpointSlots,
 		connection: valkeyConn(),
 		// Issue #596, phase 2 (DES-HOST-BUDGET): the host budget's inputs. `createWorker` builds the ONE budget from them and
 		// shares it between both queues' processors. The settings and the default size were refused at boot if bad.
@@ -2069,7 +2954,10 @@ export async function startWorker(
 			jobDefault: { memMiB: config.jobSize.memMiB, cpuCenti: config.jobSize.cpuCenti },
 			readFacts: readHostFacts,
 			onRefresh: syncCpuReserve,
-			containerGone: containerGoneFn ?? makeContainerGone({ binOf: (venue) => (resolveBackendName(venue ?? {}, config.defaultBackend) === PODMAN_BACKEND ? "podman" : "docker") }),
+			// Issue #681: asked of the venue that holds the container, through the registry. This used to pick the CLI from the
+			// venue's name and send every venue but podman to docker, so a third venue's orphan was either freed while it still
+			// ran (docker lists no such name) or never freed (no docker on the host).
+			containerGone: containerGoneFn ?? backends.containerGone,
 			// AFTER the boot reaper (above), every blessed venue's remaining job containers, seeded into the ledger
 			// as orphans from their size labels. PER VENUE (gate round 2 of phase 2): a venue that cannot be listed
 			// stops only its own jobs until a tick reads it, because a container nobody counted is an overcommit, while the
@@ -2078,18 +2966,26 @@ export async function startWorker(
 			// cause that refuses a boot (the venue's boot-refusing set: every job on it is refused before a container, so this
 			// worker starts none there). A cause decided from one unreadable answer is re-decided per job and can clear, so
 			// it leaves the venue unread.
+			// Issue #681: every BLESSED registered venue, each listed by its own bundle; it used to be local and podman by name,
+			// so a third venue was never seeded and its leftover containers were never counted. Only local and podman have a
+			// boot job-user decision; another venue's holds-none rule is ENOENT alone.
 			survivors: Object.fromEntries(
-				[...(localBlessed ? [[DEFAULT_BACKEND, "docker", bootDecision, BOOT_REFUSING_JOB_USER_CAUSES]] : []), ...(podmanBlessed ? [[PODMAN_BACKEND, "podman", bootPodmanDecision, PODMAN_BOOT_REFUSING_CAUSES]] : [])].map(([backend, bin, decision, stable]) => [
-					backend,
-					async () => {
-						try {
-							return (await listJobContainersFn(bin)()).map((c) => ({ ...c, venue: { backend } }));
-						} catch (error) {
-							if (error?.code === "ENOENT" || (decision?.mode === "unmappable" && stable.has(decision.cause))) return [];
-							throw error;
-						}
-					},
-				]),
+				Object.entries(backends.listers())
+					.filter(([backend]) => config.backends.includes(backend))
+					.map(([backend, list]) => {
+						const [decision, stable] = backend === DEFAULT_BACKEND ? [bootDecision, BOOT_REFUSING_JOB_USER_CAUSES] : backend === PODMAN_BACKEND ? [bootPodmanDecision, PODMAN_BOOT_REFUSING_CAUSES] : [null, new Set()];
+						return [
+							backend,
+							async () => {
+								try {
+									return (await list()).map((c) => ({ ...c, venue: { backend } }));
+								} catch (error) {
+									if (error?.code === "ENOENT" || (decision?.mode === "unmappable" && stable.has(decision.cause))) return [];
+									throw error;
+								}
+							},
+						];
+					}),
 			),
 			defaultVenue: config.defaultBackend,
 			now,
@@ -2110,6 +3006,7 @@ export async function startWorker(
 		name: config.workerName,
 		concurrency: bootConcurrency,
 		getSettings,
+		readModelRoles: makeReadModelRoles({ triggersPath: onceTriggersFile, log }),
 		redis,
 		recordRun,
 		settledRecord,
@@ -2118,6 +3015,12 @@ export async function startWorker(
 		// REQ-SCOPED-PAUSE-WINDOWS: the processor defers a job whose folder/repo is inside an active window.
 		// Reads the live-reloaded ref, so an operator edit takes effect on the next job without a restart.
 		pauseUntil: (job, now) => pauseUntilMs(pauseWindows.current, job, now),
+		// Issue #761: while the file on disk was written by a newer pi-dispatch, `pauseUntil` above reads the last good
+		// windows, which may not pause what the file pauses, so every job waits for this host's upgrade instead.
+		pauseWindowsNewer: () => pauseWindows.newer === true,
+		// Issue #761: while the triggers file on disk was written by a newer pi-dispatch, every reader of it holds a last
+		// good copy or refuses, so every job waits for this host's upgrade instead (the processor's first gates).
+		triggersNewer: () => triggersState.newer === true,
 		// Issue #242: the scoped-limits snapshot the pickup gate and the scoped budget read, once per
 		// pickup, from the live-reloaded ref -- same next-job grain as pauseUntil above.
 		scopedLimits: () => scopedLimits.current,
@@ -2174,6 +3077,26 @@ export async function startWorker(
 		deps: {
 			collectChain,
 			collectPlan,
+			// Issue #646: the late-message branches at the processor's settle (index.mjs `settleSteer`).
+			onLateForge: lateForge,
+			watchRuntime,
+			questionGroupRuntime,
+			questionGroupStore,
+			questionCaptureEnabled: () => {
+				try { return parseTriggersDocument(readFileSync(onceTriggersFile, "utf8"), onceTriggersFile).zeroTouch?.capture === true; }
+				catch { log("question_capture_unavailable", { reason: "configuration-unreadable" }); return false; }
+			},
+			touchStore,
+			touchOutbox,
+			touchNow: now,
+			collectWatch: watchRuntime.collect,
+			// Issue #638: held replies at the processor's settle (index.mjs `settleSteer` calls it first). Wired, it also arms
+			// the keeper that makes an awaitInput run reachable while it runs.
+			settleHeld: heldSettle,
+			// The take inside the park sequence (processor.mjs), which starts the held answer before the parked comment.
+			takeHeld: heldSettle.take,
+			answerDraftRuntime,
+			answerDraftStore,
 			// The one-shot pre-spend check (issue #231): reads the same file the disarm writes, refuses
 			// only on a FOREIGN positive mark (index.mjs binds the real queue jobId so a retry of the
 			// spending delivery is excused). In the compose topology this check is the once-enforcement
@@ -2191,24 +3114,53 @@ export async function startWorker(
 			// A PROBE: whatever it resolves is dropped on the floor. The credential itself is read where it always
 			// was, inside buildContainerEnv, so no live key is ever in scope in the processor.
 			// Issue #503: `modelEndpoints` is the pickup's snapshot, the same one runContainer hands buildContainerEnv.
+			subscriptionRuntime: subscriptions?.runtime ?? null,
+			subscriptionAuthRequired: async (job) => {
+				if (!subscriptions) return false;
+				for (const ref of subscriptionRoutes(job)) if ((await subscriptions.auth.check(ref.provider)).managed) return true;
+				return false;
+			},
 			checkProviderCredential: (job, { modelEndpoints = null } = {}) => {
-				try {
-					resolveProviderCredential({ provider: job.provider, hostEnv: env, authFromPi: config.authFromPi, forwardEnv: config.forwardEnv, modelEndpoints });
-					return { ok: true };
-				} catch (error) {
-					// Only OUR determinate refusal. Anything else (a bug here, an fs fault the module does not model)
-					// must not become a policy refusal on the operator's issue: it rethrows into runJob's catch, which
-					// classifies it the way it always did.
-					// Issue #503: a transient overlay read at this pickup is no verdict; the processor retries it as infra.
-					if (error?.piDispatchTransient === true) return { ok: false, unavailable: error.code ?? "unreadable" };
-					if (error?.piDispatchConfig !== true) throw error;
-					return { ok: false, message: error.message };
-				}
+				const legacy = () => {
+					try {
+						resolveProviderCredential({ provider: job.provider, hostEnv: env, authFromPi: config.authFromPi, forwardEnv: job.answerDraft || job.watch || job.questionGrouping ? [] : config.forwardEnv, modelEndpoints });
+						return { ok: true };
+					} catch (error) {
+						// Only OUR determinate refusal. Anything else (a bug here, an fs fault the module does not model)
+						// must not become a policy refusal on the operator's issue: it rethrows into runJob's catch, which
+						// classifies it the way it always did.
+						// Issue #503: a transient overlay read at this pickup is no verdict; the processor retries it as infra.
+						if (error?.piDispatchTransient === true) return { ok: false, unavailable: error.code ?? "unreadable" };
+						if (error?.piDispatchConfig !== true) throw error;
+						return { ok: false, message: error.message };
+					}
+				};
+				return subscriptions ? subscriptions.auth.check(job.provider).then((checked) => checked.managed ? checked : legacy()) : legacy();
 			},
 			// Issue #502. The model-exists gate: pi's builtin catalog, then the overlay models.json, read at most once per
 			// job and only when a model is not builtin, so the operator's edits apply without a restart. The SAME file
 			// the endpoint gate reads, through the same reader, so absent, unreadable and unparseable mean one thing.
 			checkModelsKnown: (refs) => checkModelsKnown(refs, { readOverlay: () => readOverlayModels(config.globalPiDir) }),
+			checkFailoverCandidate: (job, { models, endpoints }) => {
+				const egress = failoverEgressRequired(job, { egress: config.egress, defaultBackend: config.backends[0] });
+				return checkFailoverCandidate(job, {
+					models, endpoints, egress, allowlist: egress ? readEgressAllowlist() : [],
+					credential: async (candidate, { modelEndpoints }) => {
+						if (subscriptions) {
+							const checked = await subscriptions.auth.check(candidate.provider);
+							if (checked.managed) return checked;
+						}
+						try {
+							resolveProviderCredential({ provider: candidate.provider, hostEnv: env, authFromPi: config.authFromPi, forwardEnv: config.forwardEnv, modelEndpoints });
+							return { ok: true };
+						} catch (error) {
+							if (error?.piDispatchTransient) return { unavailable: true };
+							if (error?.piDispatchConfig) return { ok: false };
+							throw error;
+						}
+					},
+				});
+			},
 			// Issue #503 part 7: the builtin catalog's model object, for the zero-rated check that lets a job on local
 			// zero-rated models reserve nothing in the dollar windows (processor.mjs, `zeroRatedVerdict`).
 			builtinModel,
@@ -2242,9 +3194,9 @@ export async function startWorker(
 				const held = await runtimeQueue.getJob(id);
 				if (!held) return false;
 				// EXISTENCE IS NOT LIVENESS, and the difference decides whether a target stays deafened:
-				// `removeOnComplete`/`removeOnFail` keep a finished job's hash for 31 days, so a holder that
-				// can never wake again would answer "still waiting" for a month. Only a state it can still be
-				// picked up from counts.
+				// `removeOnComplete`/`removeOnFail` keep a finished job's hash for `FORGE_JOB_RETENTION_S`, so a
+				// holder that can never wake again would answer "still waiting" for a month. Only a state it can
+				// still be picked up from counts.
 				const state = await held.getState();
 				return state === "delayed" || state === "waiting" || state === "active" || state === "prioritized" || state === "waiting-children";
 			},
@@ -2255,10 +3207,17 @@ export async function startWorker(
 			// `local`'s are the closures built beside its bundle below, unchanged.
 			observationPreflight: backends.observationPreflight,
 			jobUserPreflight: backends.jobUserPreflight,
+			// Issue #704 part 3: the venue's judgement of a project secret bundle, dispatched like the two above.
+			bundleGate: backends.bundleGate,
 			// Completed-only, so a policy or infra exit leaves the canonical transcript byte-identical and a
 			// retry starts from what the first attempt did (CONST-RETRY-INFRA-ONLY).
 			promoteSession: sessionStore.promoteSession,
+			// Issue #645: a recovery stages its checkpoint's transcript as the job's session (`reason: "recovered"`).
+			...(typeof sessionStore.stageRecovered === "function" ? { stageRecovered: sessionStore.stageRecovered } : {}),
 			isParked: sessionStore.isParked,
+			readParkedInfo: sessionStore.readParkedInfo,
+			approvalRuntime,
+			approvalSessionCheck,
 			parkedLabel,
 			// The same value the store above was built from, passed explicitly so the processor's fail-closed
 			// `run.resume` gate answers from THIS config rather than from its own env default. Identical on the
@@ -2278,6 +3237,30 @@ export async function startWorker(
 			// injected env they were not, which is the divergence this file already calls out by name for
 			// sessionsDir. One deployment value, one place, same rule as the profiles below it.
 			resolveSecrets: makeSecretsResolverFn({ envProfiles: config.secretProfiles, roots: config.secretResolverRoots, timeoutMs: config.secretResolveTimeoutMs, forwardEnv: config.forwardEnv, hostEnv: env, log }),
+			// Issue #704, project secret bundles. The binding is read from the SAME triggers file the one-shot, skew and
+			// portfolio checks read (`onceTriggersFile`), by the worker, never carried by the receiver, and answered from
+			// the last good read while the file is broken (triggers-file.mjs says why). The resolver is the run.secrets
+			// seam's sibling, with the same roots, timeout, forwarded names and host env.
+			// `bundlesDeclared`: whether this host declares any bundle profile, env or panel. On such a host a MISSING
+			// triggers file is a failure (last good read, else retry), never "no bundles" (triggers-file.mjs says why).
+			canaryBusy: () => canaryBusy(redis),
+			findSecretBundle: makeFindSecretBundle({
+				triggersPath: onceTriggersFile,
+				log,
+				bundlesDeclared: () => {
+					if (Object.keys(config.secretBundleProfiles ?? {}).length > 0) return true;
+					const settings = getSettings();
+					return !settings.invalid && Object.keys(settings.secretBundles ?? {}).length > 0;
+				},
+			}),
+			secretBundles: makeBundleResolver({ envBundles: config.secretBundleProfiles ?? {}, roots: config.secretResolverRoots, timeoutMs: config.secretResolveTimeoutMs, forwardEnv: config.forwardEnv, hostEnv: env, log }),
+			// The fork check's seam: the job's own forge host, the one prepare hands run.resume's fork gate. A forge with
+			// no host (none configured for that kind) answers nothing, which the processor reads as a fork: no bundle.
+			resolvePullRequestHead: async (job, token) => {
+				const host = forgeFor(job)?.host;
+				if (typeof host?.resolvePullRequestHead !== "function") return null;
+				return await host.resolvePullRequestHead(job, token);
+			},
 			// REQ-MCP-OPERATOR-SERVERS: the overlay's mcp.json read once per job that names a server, never at boot (an
 			// operator who re-runs import-pi must not have to restart the worker). The allowlist is the one the proxy
 			// mounts, this folder's egress-allowlist.conf on both venues (up.mjs, podman-stack.mjs), and the endpoints
@@ -2289,29 +3272,9 @@ export async function startWorker(
 				egress: config.egress,
 				// DES-FORGE-MCP: the GitLab a gitlab job's forge server calls, the same URL its clone and its glab use.
 				gitlabUrl: config.gitlab?.apiUrl ?? null,
-				// The credentials the job is set up to spend with (providerKeyNames). A read of the overlay models.json that
-				// may pass on a retry is thrown to the check, which retries the job; any other failure adds no overlay
-				// names, and the model gates, which ran first, refuse every job such a file breaks.
-				reserved: (job) => {
-					let overlayModels = null;
-					try {
-						overlayModels = readOverlayModels(config.globalPiDir);
-					} catch (error) {
-						if (MCP_TRANSIENT_READ_CODES.has(error?.code)) throw error;
-					}
-					const providers = jobProviders(job, { defaultProvider: config.provider, allowedModels: config.allowedModels, everyProvider: piProviders() });
-					return new Set([...RESERVED_ENV_NAMES, ...providerKeyNames({ providers, candidatesOf: providerKeyCandidates, overlayModels })]);
-				},
-				allowlist: () => {
-					try {
-						return parseAllowlist(readFileSync(join(process.cwd(), "egress-allowlist.conf"), "utf8"));
-					} catch (error) {
-						// No allowlist here: every server outside a declared endpoint is unreachable, which it is. Any other
-						// failure is the check's to classify (a transient errno is retried).
-						if (error?.code === "ENOENT") return [];
-						throw error;
-					}
-				},
+				// The credentials the job is set up to spend with (`reservedJobNames`, which the console's preview asks too).
+				reserved: (job) => reservedJobNames(job, { readModels: () => readOverlayModels(config.globalPiDir), defaultProvider: config.provider, allowedModels: config.allowedModels, everyProvider: piProviders(), candidatesOf: providerKeyCandidates }),
+				allowlist: readEgressAllowlist,
 				endpoints: () => modelEndpoints.current,
 			}),
 			// #227. What PI_BACKENDS blessed, so a trigger naming an unblessed venue refuses pre-spend. The
@@ -2329,8 +3292,14 @@ export async function startWorker(
 			// Off the REGISTRY's surface, like every other per-job backend fact. Rebuilding it at the call site
 			// is how a fact ends up dispatched on one path and hardcoded on another.
 			neverStartedExits: backends.neverStartedExits,
-			prepareWorkspace: makePrepareWorkspace({
+			checkSandboxWorkspace: (job) => checkSandboxWorkspace(job, { sandboxDir: config.sandboxDir }),
+			packageCanary: makePackageCanaryRuntime({ globalPiDir: config.globalPiDir, env, host: config.workerName, log, publishFacts: (facts) => publishCanaryFacts(redis, facts) }),
+			prepareWorkspace: makePrepareWorkspaceFn({
 				jobsDir: config.jobsDir,
+				// Issue #643: with PI_LIVE_TRANSCRIPTS=0 no live file is staged either, so a job without a resume transcript
+				// runs exactly as it did before the feature (its session in memory, no /session mount). Since issue #644 the
+				// progress reader needs the same file, so it is left out only when both switches are off.
+				...(config.liveTranscripts || config.runProgress ? {} : { stageLive: null }),
 				// Issue #464: the boot's own check, asked again before every job against the same env.
 				ensureDir: (dir) => ensureJobsDirFn(dir, { env }),
 				forgeFor,
@@ -2341,7 +3310,7 @@ export async function startWorker(
 				defaultBackend: config.defaultBackend,
 				// Issue #504 part B: a local job's folder is resolved at prepare and mounted resolved; one named inside a run
 				// root or a cron folder must still resolve inside it, and none may be the envelope's folder or above it.
-				localPlacement: { jobPaths: envelopeJobPathsNow, envelopeFile: config.envelopeFile ?? null },
+				localPlacement: { jobPaths: envelopeJobPathsNow, envelopeFile: config.envelopeFile ?? null, sandboxDir: config.sandboxDir, authStoreDir: subscriptions?.storeDir ?? null },
 				// Issue #505: /job/portfolio.json for a confirmed portfolio job.
 				portfolioSnapshot,
 				preparers: makeForgePreparers({ gitlabApiUrl: config.gitlab?.apiUrl ?? null, forgejoApiUrl: config.forgejo?.apiUrl ?? null, azureOrgUrl: config.azure?.orgUrl ?? null }),
@@ -2395,6 +3364,21 @@ export async function startWorker(
 				if (!host) throw configError(`no forge host is configured for job kind ${JSON.stringify(job?.kind)}`);
 				return await host.isDefaultBranchProtected(job, token);
 			},
+			// Issue #645 (durable runs), built above. Null where this host has no store (`recover-store-unset` refuses an
+			// armed job before it spends); the ledger, the pointer read and the enqueue exist on every host.
+			workspaceCheckpointer,
+			forkStore,
+			checkForkPolicy: makeCheckForkPolicy({ triggersPath: onceTriggersFile }),
+			checkThinking: (job) => thinkingLevelAllowed(job, { models: readOverlayModels(config.globalPiDir), builtinModel }),
+			runCheckpointer,
+			runBudgetLedger,
+			readCheckpointPointer,
+			enqueueRecovery,
+			// A recovery landing on the host that crashed takes one more checkpoint from the crashed attempt's job directory
+			// before it restores (recovery-queue.mjs `makeSalvager`): `salvageCheckpoint({ runId, pointer, attempt })`.
+			salvageCheckpoint,
+			readRecord: readRunRecord,
+			hostName: durableHost,
 		},
 	});
 
@@ -2406,6 +3390,15 @@ export async function startWorker(
 	// the live Worker held the loop forever. The catch below covers the REGION, not a list of calls,
 	// so a step added tomorrow is covered the day it is added.
 	try {
+		// Human preparation uses its own bounded control worker, outside the paid processor and its slot ledgers.
+		const prepareSandbox = createSandboxPreparerFn({ config, env, forgeFor, readTriggers: () => readFileSync(onceTriggersFile, "utf8"), projects: () => projects.current, limits: () => scopedLimits.current, now });
+		const sandboxControl = startSandboxPrepareWorkerFn({ connection: valkeyConn(), host: config.workerName, config, prepare: prepareSandbox, now, log });
+		// Its close waits for the preparation it is running, which nothing aborts first, so that step gets the longer bound.
+		settleCloseOf(sandboxControl, { closeBoundMs: SANDBOX_CONTROL_CLOSE_BOUND_MS });
+		extraClosers.push(sandboxControl);
+		const sandboxInventory = makeSandboxInventoryFn({ redis, host: config.workerName, read: retainedNow, settings: { image: config.jobImage, defaultBackend: config.defaultBackend, backends: config.backends, egress: config.egress, egressProxy: config.egressProxy, sandboxRetentionHours: config.sandboxRetentionHours, sandboxPinDays: config.sandboxPinDays, jobMemory: env.PI_JOB_MEMORY, jobCpus: env.PI_JOB_CPUS }, now, log });
+		sandboxInventory.start();
+		extraClosers.push(sandboxInventory);
 
 		// REQ-LOCAL-JOB-VISIBILITY: exactly one terminal line per job, carrying the job id and outcome,
 		// where the operator is already looking. This is the local counterpart of the GitHub issue
@@ -2419,7 +3412,19 @@ export async function startWorker(
 		// BOTH workers, or a cron job on the host queue produces no `job_completed` line at all -- and
 		// REQ-LOCAL-JOB-VISIBILITY's whole point is that a missing line is what tells a human a run did nothing.
 		const allWorkers = [worker, ...(worker.hostWorker ? [worker.hostWorker] : [])];
+		// Issue #812: a finished job's model attempt key gets its expiry (model-attempts.mjs), on the queue's own word that
+		// the job finished: this event, and `failed` with `finishedOn` below. Fire and forget, inside the existing listener
+		// bodies: an expiry that fails leaves the key as it was, without one, and the fixed line says so. The id is the
+		// processor's (index.mjs `modelAttemptId`); a job with no queue name to read names no key, so nothing is sent.
+		const finishAttempt = (w, job) => {
+			const queueName = job?.queueName ?? w.name;
+			if (typeof queueName !== "string" || queueName === "" || job?.id === undefined || job?.id === null) return;
+			void Promise.resolve()
+				.then(() => finishModelAttemptFn(redis, modelAttemptIdOf(queueName, job.id)))
+				.catch(() => log("model_attempt_finish_failed", { jobId: String(job.id) }));
+		};
 		for (const w of allWorkers) w.on("completed", (job, result) => {
+			finishAttempt(w, job);
 			log("job_completed", { jobId: job?.id, outcome: result?.outcome, ...(result?.reason ? { reason: result.reason } : {}) });
 			// The hook's POLICY half (issue #288): worker-abort, runner-policy and provider-auth-refused RETURN, so they land here
 			// and never in the failed listener -- a failed-only mount would miss exactly the paid terminals
@@ -2431,11 +3436,26 @@ export async function startWorker(
 			if (pagesAsPolicy(result)) {
 				onFailure({ jobId: job?.id, outcome: "policy", reason: result.reason });
 			}
+			if (pagesAsReturnedFailure(result)) onFailure({ jobId: job?.id, outcome: "failed", reason: result.reason });
 		});
 		// The failed listener's body, for a failure the queue decided. Split out only so the lost-lock check below can
 		// run it after an await; a failure of any other reason runs it synchronously, exactly as before.
-		const onFailed = (job, err) => {
-			log("job_failed", { jobId: job?.id, attempt: job?.attemptsMade, reason: String(err?.message ?? err).slice(0, 120) });
+		//
+		// `settledElsewhere` (issue #761) is a terminal failure whose attempt another host already ended and recorded,
+		// in a record this build can read only by its core (the lost-lock check below says which). It runs the terminal
+		// duties below, so nothing the job held is left open: the processor never closes the approval claim of a failed
+		// attempt, so without this one its target would refuse new requests `target-pending` for good. Two things
+		// differ: the terminal line is `job_lost_lock_after_completion` with the outcome alone, and nothing is posted.
+		// The page is the same as any terminal failure's, and a stall's error carries no reason, so the hook's argv reads
+		// `infra`. The run's inbox and held replies close as the run's end says (below). What the host that ran the
+		// attempt may already have done is safe to do again: a second close of an inbox or of held replies acts on
+		// nothing, and the draft's refusal writes the same state.
+		const approvalFinalizers = new Set();
+		let approvalFinalizerCloser = false;
+		const onFailed = (job, err, { settledElsewhere = false } = {}) => {
+			// Exactly one terminal line either way (REQ-LOCAL-JOB-VISIBILITY).
+			if (settledElsewhere) log("job_lost_lock_after_completion", { jobId: job?.id, outcome: "failed" });
+			else log("job_failed", { jobId: job?.id, attempt: job?.attemptsMade, reason: String(err?.message ?? err).slice(0, 120) });
 			// The one reason whose sentence is the fix itself (issue #458): logged WHOLE, beside the cut line above.
 			if (err?.reason === NETNS_KEEPER_NOT_HOLDING || err?.reason === NETNS_KEEPER_CRASH_LOOP) log("job_failed_netns_keeper", { jobId: job?.id, attempt: job?.attemptsMade, reason: String(err?.message ?? "") });
 			// The TERMINAL failed attempt only (issue #288): `finishedOn` is set by BullMQ's own move on the
@@ -2446,7 +3466,37 @@ export async function startWorker(
 			// never sees: the stall-kill (maxStalledCount 0 fails a crashed worker's job at next pickup)
 			// and the wait-gate rethrow that escapes above the processor's catch.
 			if (job?.finishedOn) {
-				void comment({ ...job.data, id: job.id }, (typeof err?.reason === "string" && Object.hasOwn(FAILED_COMMENT_BY_REASON, err.reason) ? FAILED_COMMENT_BY_REASON[err.reason] : null) ?? FAILED_COMMENT);
+				if (job.data?.answerDraft) void answerDraftRuntime.refused(job.data, { reason: "failed" }).catch(() => log("answer_terminal_unavailable", {}));
+				// An exhausted retry has no future container to consume its claim. Close only this queue job's
+				// authority, never another job's, and let a new authorized run request a fresh approval.
+				if (job.data?.approvalRequestId) {
+					const finishing = settleWithin(Promise.resolve().then(() => approvalRuntime.finish({ requestId: job.data.approvalRequestId, jobId: String(job.id) })), 2500, { error: "approval-finish-timeout" })
+						.then((result) => { if (!result?.ok) log("approval_terminal_finish_failed", { jobId: String(job.id), reason: "approval-finish-unavailable" }); })
+						.catch(() => log("approval_terminal_finish_failed", { jobId: String(job.id), reason: "approval-finish-unavailable" }))
+						.finally(() => approvalFinalizers.delete(finishing));
+					approvalFinalizers.add(finishing);
+					if (!approvalFinalizerCloser) {
+						approvalFinalizerCloser = true;
+						extraClosers.push({ close: () => Promise.allSettled([...approvalFinalizers]) });
+					}
+				}
+				// Issue #646, review finding F2: a TERMINAL failure the processor never saw (a stall-kill of a crashed worker's
+				// job with no recovery enqueued, a rethrow above the processor's catch) is the run's final outcome too, so its
+				// inbox is closed here and what waits becomes `late` instead of sitting `queued` until the key expires. A
+				// terminal failure the processor did see was settled before its record: this second close returns the same entries
+				// with `first: false` (steer-inbox.mjs closeInbox), so settleInbox answers nothing again (review round 1, F2).
+				// Both closes are the RUN's, keyed by its run id, which a #645 recovery keeps. A run settled elsewhere may have
+				// been handed to a recovery there (a `recovery-enqueued` this build cannot read), and that recovery must find
+				// both open (inbox-settle.mjs `isFinalOutcome`): closing them would answer its waiting messages as late, on the
+				// forge, about a run that goes on. So they close then only for a job no recovery can continue, whose run ended
+				// with it.
+				if (!settledElsewhere || !isRecoveryArmed(job.data)) {
+					if (job.data?.steer === true) void settleInbox({ redis, job, error: { reason: typeof err?.reason === "string" ? err.reason : "infra" }, log, onLateForge: lateForge });
+					// Issue #638: the same for an awaitInput run's held replies; a failure never parked, so they are dropped, and
+					// a second close (the processor settled first) acts on nothing.
+					if (job.data?.awaitInput === true) void heldSettle({ job, error: { reason: typeof err?.reason === "string" ? err.reason : "infra" } });
+				}
+				if (!settledElsewhere) void comment({ ...job.data, id: job.id }, (typeof err?.reason === "string" && Object.hasOwn(FAILED_COMMENT_BY_REASON, err.reason) ? FAILED_COMMENT_BY_REASON[err.reason] : null) ?? FAILED_COMMENT);
 				onFailure?.({ jobId: job?.id, outcome: "failed", reason: typeof err?.reason === "string" ? err.reason : "infra" });
 			}
 		};
@@ -2459,7 +3509,59 @@ export async function startWorker(
 		// the completed listener would have sent for that record (a paid policy stop) is sent here instead, because
 		// that listener never saw the first finish. No record, an earlier attempt's, a `failed` one, or a lookup fault
 		// keeps the failure path below: the comment and the page.
+		// Issue #645 (durable runs): a terminal stall of an ARMED job whose run has a checkpoint pointer is not the end of
+		// the run. The worker that ran it died (that is what a stall is), so the processor never got to take its infra-exit
+		// path; this listener takes it instead: the recovery is enqueued (routed to the host holding the checkpoint), the
+		// crashed attempt's record is written (`failed`, `recovery-enqueued`: nothing else would write it, its processor is
+		// gone), and the failure comment and on_failure are SUPPRESSED, because the run is continuing. Anything short of an
+		// enqueued recovery (no pointer, the cap, an enqueue that failed) answers false, and the caller runs today's path:
+		// the comment and the page, loudly, never a run that silently stops.
+		const recoverStall = async (job) => {
+			if (!isRecoveryArmed(job?.data)) return false;
+			const runId = runIdOf(job);
+			const pointer = await readCheckpointPointer({ runId });
+			if (!pointer) {
+				log("job_recovery_skipped", { jobId: job.id, reason: "no-checkpoint" });
+				return false;
+			}
+			// Issue #662: the crashed attempt's start and how far it got, off the run's progress key, read BEFORE the enqueue,
+			// because the recovery's first progress write replaces that key with its own empty snapshot. NOT `job.processedOn`:
+			// BullMQ's stall check does not fail a stalled job outright, it moves it back to wait with the deferred failure
+			// marked (`moveStalledJobsToWait` sets `defa`), and the next pickup's `prepareJobForProcessing` stamps a fresh
+			// `processedOn` before it fails the job, so `processedOn` here is the re-pick time (a three-minute attempt read
+			// as 23 ms long in the #645 lab). The key's `startedAt` is the attempt's own, written by its writer, and it is
+			// taken only when three checks pass: the key has not ended (a crash never writes the final snapshot), its start is
+			// not after now, and its start is no earlier than this job's enqueue time (`job.timestamp`). The last one ties the
+			// key to THIS job: the key is the RUN's, so a recovery that died before its own first write (or ran on a host with
+			// PI_RUN_PROGRESS=0) would otherwise find the base attempt's unended key and record a start from before the
+			// recovery existed, with the base's counts. A retry of the same job id cannot be told apart by this (its
+			// timestamp is the job's first enqueue); its writer's first write replaces the key, so only a retry that died
+			// before writing would show the earlier attempt's start. Anything else is null, an honest unknown. Bounded and
+			// never throwing (`readProgressKey`); the key is display only, so it decides nothing here either.
+			const at0 = now();
+			const key = await Promise.resolve().then(() => readProgressKeyFn({ redis, jobId: runId })).catch(() => null);
+			const snap = key?.snapshot;
+			const own = snap !== null && typeof snap === "object" && snap.ended === false && Number.isSafeInteger(snap.startedAt) && snap.startedAt > 0 && snap.startedAt <= at0 && Number.isSafeInteger(job.timestamp) && snap.startedAt >= job.timestamp;
+			const crashedProgress = own ? { turns: snap.turn, steps: snap.steps, failed: snap.failed, interrupted: snap.interrupted, replayed: snap.replayed } : null;
+			const r = await enqueueRecovery({ job, cause: "stall", pointer });
+			if (!r?.enqueued) return false;
+			// `attemptsMade` already counts this attempt here (moveToFailed added one), and `buildRecord` adds one for a record
+			// written while processing, so the record is handed the count from before the move: it then names THIS attempt.
+			const at = now();
+			recordRun({
+				job: { id: job.id, name: job.name, data: job.data, opts: job.opts, attemptsMade: Math.max(0, (Number.isSafeInteger(job.attemptsMade) ? job.attemptsMade : 1) - 1), timestamp: job.timestamp },
+				// The snapshot's integer counts, rebuilt by `buildRecord` (`recordedProgress`): a bad value is dropped, never copied.
+				result: { outcome: "failed", reason: "recovery-enqueued", ...(crashedProgress !== null ? { progress: crashedProgress } : {}) },
+				startedAt: own ? new Date(snap.startedAt).toISOString() : null,
+				endedAt: new Date(at).toISOString(),
+			});
+			log("job_failed", { jobId: job.id, attempt: job.attemptsMade, reason: "recovery-enqueued" });
+			return true;
+		};
 		for (const w of allWorkers) w.on("failed", (job, err) => {
+			// `finishedOn` is the queue's word that no retry follows (`onFailed` reads it the same way), so the expiry is set
+			// here, before any path below returns: the terminal failure, the stall and the lost-lock checks alike.
+			if (job?.finishedOn) finishAttempt(w, job);
 			if (!(job?.finishedOn && err?.message === STALLED_FAILED_REASON)) return onFailed(job, err);
 			void (async () => {
 				// `attemptsMade` is read AFTER BullMQ's moveToFailed added one, so it equals the attempt number the
@@ -2468,9 +3570,54 @@ export async function startWorker(
 				// can see why the record did not suppress it (a clock skew past the tolerance reads `older-than-job`).
 				const onReject = (reason, source) => log("job_lost_lock_record_rejected", { jobId: job.id, reason, source });
 				const record = await settledRecord(job.id, { attempt: job.attemptsMade, since: job.timestamp, onReject });
-				if (!record) return onFailed(job, err);
-				log("job_lost_lock_after_completion", { jobId: job.id, outcome: record.outcome, ...(record.reason ? { reason: record.reason } : {}) });
-				if (pagesAsPolicy(record)) onFailure({ jobId: job.id, outcome: "policy", reason: record.reason });
+				if (!record) {
+					// Issue #645: a RETURNED failure of this attempt that then lost its lock. `settledRecord` refuses every
+					// `failed` record (a failure is the failure path's to report), but two returned failures already said
+					// everything: `recovery-failed` posted its own sentence (so only its page is owed, once), and
+					// `recovery-enqueued` handed the run to a recovery (nothing is owed). Running the failure path for either
+					// would post a second failure comment, the second one false for a run that continues.
+					// Read BOTH ways (`previousRecord`), never this host's file alone: on a fleet this host may hold an earlier
+					// attempt's file while the host that ran THIS attempt wrote its record to the mirror. And each side held to
+					// the rule every lookup of a job's own record shares (`recordOfThisJob`: the id, this attempt, and not older
+					// than the job) BEFORE the higher attempt is kept, because ids are reused: a failed record an older job left
+					// under the same id must not stand in for this attempt's and take away its recovery or its comment, and,
+					// at a higher attempt, must not hide this attempt's own record on the other side either.
+					const keep = (record) => recordOfThisJob(record, { jobId: job.id, attempt: job.attemptsMade, since: job.timestamp });
+					const own = await previousRecord(job.id, { keep }).catch(() => null);
+					const ownFailure = own !== null && own.outcome === "failed";
+					// Issue #761: this attempt's `failed` record, written by a newer pi-dispatch. Its id, attempt, times and
+					// outcome are stable core fields, so it says that the attempt ended on that host and what became of it was
+					// decided there. Its `reason` is not core, so this build cannot tell `recovery-enqueued` (the run continues,
+					// nothing is owed) from `recovery-failed` (its sentence posted, its page owed) from an ordinary failure (the
+					// comment and the page owed). The failure path below fits only the last, and breaks the first:
+					// `recoverStall` would ask for the newer host's recovery again and write this build's record over the newer
+					// one, and the comment would say "will not be retried further" of a run that continues. So the terminal
+					// failure path runs without its comment (`settledElsewhere`): every duty that closes what the job held, and
+					// one page, which is owed or harmless in all three cases, where a wrong comment is wrong on the forge, in
+					// front of everyone. An ordinary failure's comment is what this costs, and only while the fleet runs two
+					// releases.
+					if (ownFailure && !recordReadable(own)) return onFailed(job, err, { settledElsewhere: true });
+					if (ownFailure && (own.reason === "recovery-failed" || own.reason === "recovery-enqueued")) {
+						log("job_lost_lock_after_completion", { jobId: job.id, outcome: own.outcome, reason: own.reason });
+						if (pagesAsReturnedFailure(own)) onFailure({ jobId: job.id, outcome: "failed", reason: own.reason });
+						return;
+					}
+					// No settled record: the attempt died running. A run that can continue from its checkpoint does; any
+					// fault on that path falls through to the failure comment and the page.
+					let recovered = false;
+					try {
+						recovered = await recoverStall(job);
+					} catch (e) {
+						log("job_recovery_enqueue_failed", { jobId: job.id, code: typeof e?.code === "string" ? e.code : "error" });
+					}
+					if (recovered) return;
+					return onFailed(job, err);
+				}
+				// Issue #761: a record a newer pi-dispatch wrote is read for its stable core only; its reason may mean
+				// something else there, so it is neither logged nor paged on.
+				const readable = recordReadable(record);
+				log("job_lost_lock_after_completion", { jobId: job.id, outcome: record.outcome, ...(readable && record.reason ? { reason: record.reason } : {}) });
+				if (readable && pagesAsPolicy(record)) onFailure({ jobId: job.id, outcome: "policy", reason: record.reason });
 			})().catch(() => {}); // `settledRecord` never rejects; this only keeps a throwing log line from going unhandled
 		});
 
@@ -2511,7 +3658,7 @@ export async function startWorker(
 				const r = await reconcileGated(rq, served, { registry, log, tz: hostTz, authored: authoredCron(config) });
 				log("schedules_installed", { installed: r.installed, removed: r.removed, ...(unserved.length > 0 && { unserved: unserved.length }) });
 			} finally {
-				await rq.close().catch(() => {});
+				await closeQueueSettled(rq);
 			}
 		} else {
 			log("schedules_installed", { installed: 0, removed: 0, ...(unserved.length > 0 && { unserved: unserved.length }) });
@@ -2522,13 +3669,13 @@ export async function startWorker(
 		// Only when a triggers file is configured; best-effort; a bad edit keeps the running schedulers. The
 		// closer each of the three returns joins `extraClosers`, so the watch stops with the worker (issue #295).
 		if (config.triggersFile) {
-			extraClosers.push(watchTriggersFile(config, cronQueue, log, schedules, registry, hostTz, config.workerNameDeclared, atBoot.triggers, checkEnvelopePlace));
+			extraClosers.push(watchTriggersFile(config, cronQueue, log, schedules, registry, hostTz, config.workerNameDeclared, atBoot.triggers, checkEnvelopePlace, triggersState, watchFs));
 		}
 
 		// REQ-SCOPED-PAUSE-WINDOWS live edit: watch the pause-windows file and hot-swap the in-memory windows, so
 		// an operator's add/delete of a pause window takes effect without a worker restart. A bad edit is kept out.
 		if (config.pauseWindowsFile) {
-			extraClosers.push(watchPauseWindowsFile(config, pauseWindows, log, atBoot.pauseWindows));
+			extraClosers.push(watchPauseWindowsFile(config, pauseWindows, log, atBoot.pauseWindows, watchFs));
 		}
 
 		// Issue #499 part B: the two files a project row joins reload as a pair; the deployment cap rides along so a limits
@@ -2556,6 +3703,15 @@ export async function startWorker(
 			extraClosers.push(watchModelEndpointsFile(config, modelEndpoints, log, atBoot.modelEndpoints));
 		}
 
+		// Arm expiry only for declarations this host serves, including after a live edit first publishes a request.
+		let declaresApprovals = false;
+		try { declaresApprovals = parseTriggers(readFileSync(onceTriggersFile, "utf8"), onceTriggersFile).some((entry) => entry.run?.gates); } catch {}
+		const retainedApprovals = await settleWithin(approvalStore.hasPending(durableHost), 2500, { error: "store-unavailable" });
+		if (!retainedApprovals.ok) log("approval_expiry_scan_unavailable", { reason: "store-unavailable" });
+		// A revoked declaration still has unanswered requests to retire. On an unreadable index, arm the retrying
+		// sweep and name the uncertainty; do not silently abandon a durable deadline.
+		if (declaresApprovals || retainedApprovals.pending || !retainedApprovals.ok) startApprovalSweep();
+
 		// issue #292 / OQ-007: re-run the three retention sweeps on a timer, because the supported deployment
 		// is a service that restarts only on failure, so the healthy worker was the one that never re-swept.
 		// Armed HERE, at the end of boot beside the watches: all three closures exist, boot's own sweeps have
@@ -2567,14 +3723,38 @@ export async function startWorker(
 		// reaper. It is registered in `extraClosers` for issue #295's finding that UNREF'D IS NOT CLEANED UP --
 		// this handle holds an `rmSync`, and a tick landing mid-drain could delete a retained workspace behind a
 		// worker that already reported a clean shutdown.
+		// Issue #645: the two durable-run sweeps, run once here at boot and then on every tick. The host-lost sweep on every
+		// host (a fleet's recoveries are judged by whichever host gets there first); the checkpoint store's retention only
+		// where there is a store. A fault is a log line, never a refused boot: both are backstops over a TTL.
+		// The store sweep is given NO `active` list, deliberately: it removes a run's store only when its newest manifest is
+		// older than the store TTL (7 days), and a run running here has written to its store within the job timeout (30
+		// minutes: primeBase at its start, a checkpoint at most a minute apart), so no running run can be judged stale and an
+		// active list could change no verdict. A run waiting for its recovery is bounded the same way: the host-lost sweep
+		// gives up on it at RECOVERY_MAX_WAIT_MS, which IS that TTL. (The processor's running list holds job ids, not run
+		// ids, so passing it would also name a `.rN` job's store wrongly.)
+		const reapForkSources = forkStore ? () => forkStore.sweep() : null;
+		const reapCheckpoints = workspaceCheckpointer ? async () => void (await workspaceCheckpointer.sweep()) : null;
+		const reapHostLost = async () => void (await sweepHostLost());
+		// NOT awaited: the host-lost sweep's first command waits for Valkey however long it is away, and the boot must not.
+		// Each settles into its own log line; neither can reject unhandled.
+		for (const [name, reap] of [["recovery_host_lost", reapHostLost], ...(reapForkSources ? [["fork_source", reapForkSources]] : []), ...(reapCheckpoints ? [["checkpoint", reapCheckpoints]] : [])]) {
+			void Promise.resolve()
+				.then(reap)
+				.catch((err) => log(`${name}_reaper_skipped`, { reason: scrubCredentials(err?.message) }));
+		}
 		if (config.sweepIntervalHours > 0) {
 			const sweep = makeRetentionSweepFn({
 				reapers: [
 					{ name: "log", reap: reapLogs },
 					// Issue #504 part B: where boot runs it, right after the run history it sits beside.
 					{ name: "allocation_log", reap: reapAllocationLogs },
+					{ name: "console_audit", reap: reapConsoleAudit },
+					{ name: "touch_outbox", reap: () => touchOutbox.repair() },
 					{ name: "sandbox", reap: reapSandboxes },
 					{ name: "session", reap: () => sessionStore.reapSessions() },
+					...(reapForkSources ? [{ name: "fork_source", reap: reapForkSources }] : []),
+					{ name: "recovery_host_lost", reap: reapHostLost },
+					...(reapCheckpoints ? [{ name: "checkpoint", reap: reapCheckpoints }] : []),
 				],
 				intervalMs: config.sweepIntervalHours * 3600000,
 				log,
@@ -2583,6 +3763,37 @@ export async function startWorker(
 			extraClosers.push(sweep);
 		}
 
+		// Issue #712 (`DES-DOCTOR-RESULTS-PUBLISHED`): `pi-dispatch doctor --publish` as a child, shortly after boot and every
+		// PI_DOCTOR_INTERVAL_HOURS, so every host publishes its checks whether or not anyone runs doctor there. After the
+		// registry has started (above), so the first run's fleet lines see this host's own row. At 0 nothing is constructed,
+		// the sweep's posture: no timer, no closer, no child is reachable.
+		if (config.doctorIntervalHours > 0) {
+			const doctorRuns = makeDoctorSpawnerFn({
+				cliPath: fileURLToPath(new URL("./cli.mjs", import.meta.url)),
+				intervalMs: config.doctorIntervalHours * 3600000,
+				log,
+			});
+			doctorRuns.start();
+			extraClosers.push(doctorRuns);
+		}
+
+		// Issue #796 (`DES-PACKAGE-UPDATES-PREPARED-NOT-APPLIED`): the look, off until PI_UPDATES_LOOK=1, and each host applying what a person asked for. Children for
+		// doctor's reason: neither belongs on the loop that renews paid job locks. The reconcile starts nothing until a person asked for something, and reaches a
+		// registry only then, which is why it needs no switch of its own: until then it is one free Valkey read every two minutes.
+		const cliPath = fileURLToPath(new URL("./cli.mjs", import.meta.url));
+		if (config.updatesLook) {
+			const look = makeUpdatesRunnerFn({ cliPath, intervalMs: UPDATES_LOOK_EVERY_HOURS * 3600000, log, args: ["updates", "look"], events: { overlapped: "updates_look_overlapped", spawnFailed: "updates_look_failed", finished: "updates_look_finished" } });
+			look.start();
+			extraClosers.push(look);
+		}
+		const reconcile = makeUpdatesRunnerFn({
+			cliPath, intervalMs: UPDATES_RECONCILE_EVERY_MS, bootDelayMs: UPDATES_RECONCILE_EVERY_MS, timeoutMs: UPDATES_RECONCILE_TIMEOUT_MS, log, args: ["updates", "reconcile"],
+			events: { overlapped: "updates_reconcile_overlapped", spawnFailed: "updates_reconcile_failed", finished: "updates_reconcile_finished" },
+			shouldRun: () => hostHasPending(redis, config.workerName),
+		});
+		reconcile.start();
+		extraClosers.push(reconcile);
+
 		log("worker_started", {
 			queue: "pi-jobs",
 			// Issue #278: the service's OWN answer to which daemon its jobs go to. `doctor` reads its caller's
@@ -2606,6 +3817,7 @@ export async function startWorker(
 			imageDigest: bootImage.imageDigest ?? null, // two hosts on two builds of one tag used to emit byte-identical boot lines
 			concurrency: bootConcurrency, // the slot count the Worker is actually constructed with (overlay may raise/lower it)
 			sweepIntervalHours: config.sweepIntervalHours, // 0 = boot-only sweeps, this version's pre-#292 behaviour
+			doctorIntervalHours: config.doctorIntervalHours, // issue #712: 0 = the worker runs no doctor of its own
 			dailyCap: config.dailyCap,
 			weeklyCap: config.weeklyCap, // null when the weekly window is disabled
 			monthlyCap: config.monthlyCap, // null when the monthly window is disabled
@@ -2626,7 +3838,13 @@ export async function startWorker(
 			settingsFile: config.settingsFile,
 			captureJobLogs: config.captureJobLogs,
 			logRetentionDays: config.logRetentionDays,
+			consoleAuditRetentionDays: config.consoleAuditRetentionDays, // issue #761: the console audit trail's own; 0 = kept forever
+			runMirrorMaxRuns: config.runMirrorMaxRuns, // issue #761: the shared run index's cap this host trims to
 			sandboxRetentionHours: config.sandboxRetentionHours, // 0 = retention off; a run's directory is deleted as before
+			// Issue #645 (durable runs): where checkpoints go (null = none: an armed job is refused before it spends) and
+			// whether this host takes them (the store AND the run checkpointer); doctor reads the same directory.
+			checkpointsDir: config.checkpointsDir ?? null,
+			durableRuns: Boolean(runCheckpointer),
 		});
 		return worker;
 	} catch (err) {