@edgehero/pi-dispatch 4.3.1 → 5.0.0

package/src/processor.mjs

@@ -1,4 +1,12 @@
-import { DAEMON_APPLIES_BOUNDS, DEFAULT_BACKEND, DOCKER_ENDPOINT_LOCAL, DOCKER_NEVER_STARTED_EXITS, PODMAN_ADDS_NO_MOUNTS, PODMAN_BACKEND, PODMAN_BOUNDS_DELEGATED, PODMAN_CONF_WIDENS_JOB, PODMAN_SERVICE_LOCAL, RUNTIME_ADDS_NO_MOUNTS } from "./backends.mjs";
+import { cleanTouch, touchScopeOf } from "./touch-state.mjs";
+import { SubscriptionWait } from "./subscription-wait.mjs";
+import { readQuestionContext } from "./question-context.mjs";
+import { stageModelRoleInputs } from "./agent-snapshot.mjs";
+import { effectiveCostCapMicros } from "./money.mjs";
+import { validateFork, forkBranch, forkArchiveFact, FORK_THINKING_LEVELS } from "./fork-job.mjs";
+import { sessionKeyFor } from "./session-key.mjs";
+import { join } from "node:path";
+import { ABSENT, OPENSHELL_BIND_LINGERING, backendFor, DAEMON_APPLIES_BOUNDS, DEFAULT_BACKEND, DOCKER_ENDPOINT_LOCAL, DOCKER_NEVER_STARTED_EXITS, PODMAN_ADDS_NO_MOUNTS, PODMAN_BACKEND, PODMAN_BOUNDS_DELEGATED, PODMAN_CONF_WIDENS_JOB, OPENSHELL_GATEWAY_LOCAL, PODMAN_SERVICE_LOCAL, RUNTIME_ADDS_NO_MOUNTS } from "./backends.mjs";
 import { resolveBackendName } from "./backend-registry.mjs";
 import { lstatSync } from "node:fs";
 import { checkTokenCap, recordTokenSpend, releaseLedgers, reserveLedgers } from "./budget.mjs";
@@ -6,12 +14,18 @@ import { configError } from "./config.mjs";
 import { unqualifiedScope } from "./pause-windows.mjs";
 import { PROJECT_CAP_REASON } from "./scoped-limits.mjs";
 import { DEFAULT_SECRETS_PROFILE, secretsArmed } from "./secrets.mjs";
+import { mergeBundleSecrets } from "./secret-bundles.mjs";
+import { providerKeyCandidates } from "./env-allowlist.mjs";
 import { RESERVED_ENV_NAMES } from "./triggers.mjs";
-import { MCP_REFUSAL_COMMENT } from "./mcp-preflight.mjs";
+import { imageFactsOf, loadedWithBase, loadedWithImage } from "./loaded-record.mjs";
+import { mcpRefusalComment } from "./mcp-preflight.mjs";
 import { EXIT_COMPLETED, EXIT_INFRA, EXIT_POLICY } from "./exit-code.mjs";
-import { COST_CAP_WHYS, EXIT_OOM_KILLED, RUNNER_POLICY_REASONS } from "./run-history.mjs";
+import { CONTAINER_EXIT_UNKNOWN, CONTAINER_INFRA_EXIT } from "./record-reason.mjs";
+import { COST_CAP_WHYS, EXIT_OOM_KILLED, RECORD_CLOCK_SKEW_MS, RUNNER_POLICY_REASONS, recoveryCounts, recoveryCountsFromProgress } from "./run-history.mjs";
+import { baseHasExtensions as baseHasExtensionsDefault, resetTrustPaths as resetTrustPathsDefault } from "./trust-paths.mjs";
+import { normalizeHost, removeCheckpointPointer as removePointerDefault } from "./run-checkpoint.mjs";
 import { DEFAULT_EGRESS_PROXY } from "./egress.mjs";
-import { CAPABILITY_GATES, EXIT_AUTH_CAPABILITY } from "./image-preflight.mjs";
+import { CAPABILITY_GATES, EXIT_AUTH_CAPABILITY, STEER_STDIN_CAPABILITY, TRANSCRIPT_STDERR_CAPABILITY } from "./image-preflight.mjs";
 import { modelListProblem, modelOnList, splitModelEntry } from "./model-ref.mjs";
 import { ALLOCATION_CAP_REASON, ENVELOPE_MISMATCH_REASON } from "./allocation.mjs";
 
@@ -19,8 +33,15 @@ import { ALLOCATION_CAP_REASON, ENVELOPE_MISMATCH_REASON } from "./allocation.mj
 export const LOCAL_FOLDER_PROJECT_CHANGED = "local-folder-project-changed";
 // Issue #505: a portfolio cron job refused before it spends, because this host could not apply the plan it would write.
 export const PORTFOLIO_NO_ENVELOPE = "portfolio-no-envelope";
-import { DOLLAR_CAP_REASON, DOLLAR_KEY_PREFIX, dollarLedgers, dollarSettlement, dollarsRecord, holdPart, meteredMicros, modelDollarSettlement, releaseDollars, reserveDollars, settleDollars } from "./dollar-budget.mjs";
-import { zeroRatedVerdict } from "./model-endpoints.mjs";
+import { DOLLAR_CAP_REASON, DOLLAR_KEY_PREFIX, deploymentWindowsOf, dollarLedgers, dollarSettlement, dollarsRecord, holdPart, meteredMicros, modelDollarSettlement, releaseDollars, reserveDollars, settleDollars } from "./dollar-budget.mjs";
+import { callableModelRefs, zeroRatedFor } from "./reserve-estimate.mjs";
+import { outputCapView } from "./output-cap.mjs";
+import { answerTrailComment, consoleAnswerBy, consoleDraftOf } from "./console-answer.mjs";
+import { forgeDeliveryJobId } from "./job-id.mjs";
+import { FORGE_JOB_RETENTION_MS } from "./retention.mjs";
+// The forge-comment tables (issue #710): every fixed sentence this file posts, in one leaf the reason catalog can import
+// without the job path. Re-exported below under the names they always had here.
+import { MODEL_AGENTS_INVALID_COMMENT, APPROVAL_COMMENTS, APPROVAL_PARK_NEWER_COMMENT, BUNDLE_COMMENTS, ENVELOPE_MISMATCH_COMMENTS, HELD_TAKEN_COMMENT, JOB_USER_COMMENTS, MODEL_NOT_ALLOWED_COMMENTS, MODEL_UNKNOWN_COMMENT, modelUnknownComment, NETNS_KEEPER_CRASH_LOOP, NETNS_KEEPER_NOT_HOLDING, OVERLAY_REFUSED_COMMENT, PARKED_COMMENT, PARKED_COMMENT_PR, PODMAN_CONF_COMMENTS, RECOVERY_COMMENTS, REFUSAL_COMMENTS, TERMINAL_COMMENTS, VENUE_BUNDLE_REFUSED_COMMENT, VENUE_REFUSED_COMMENT, parkedComment } from "./comment-tables.mjs";
 
 /**
  * The forge comment's reason for each observation a floor refusal missed (issues #278 and #345), keyed like
@@ -38,6 +59,9 @@ export const OBSERVATION_COMMENT = Object.freeze({
 	[PODMAN_BOUNDS_DELEGATED]: "the worker's rootless Podman is not observed applying a container's pid, memory and cpu bounds",
 	[PODMAN_ADDS_NO_MOUNTS]: "the worker's rootless Podman is not observed adding no mounts of its own to a job container",
 	[PODMAN_SERVICE_LOCAL]: "the podman CLI is not observed running containers on this host rather than through a remote service, so the job's credentials could cross a network the deployment does not own",
+	// Issue #683. Never reached through a floor alone: the openshell venue refuses a gateway it does not observe local
+	// whatever the floor says (`venueRefused`), and this sentence is the floor's half for a deployment that also asks.
+	[OPENSHELL_GATEWAY_LOCAL]: "the OpenShell gateway is not observed listening on this host, so the job's credentials could cross a network the deployment does not own",
 });
 
 /**
@@ -107,72 +131,9 @@ export function peakReachedLimit(memPeak, limit) {
 	return memPeak >= Math.ceil((limit * 9) / 10);
 }
 
-// The post-spend terminal comments (issue #288). Every FREE refusal above the container already comments;
-// these are the paths where money was spent and the run still ended without the agent's own status step,
-// which used to tell the issue nothing (REQ-JOB-STATUS-COMMENTS' acceptance -- "exactly one completion or
-// failure comment" -- held only below the spend line). Keyed by the reason token so a new abort
-// classification adds a ROW here, never a re-plumb; sentences are FIXED and path-free, because for a
-// local job the adapter logs the full text into a persistent service log (the "this folder" discipline
-// at the scope-cap refusal). The completed path stays silent on purpose: exit 0 is where the AGENT'S own
-// status comment lives (the prompt contract instructs it, including for "I cannot fix this"), and exit 2
-// by construction means the agent was cut off before that step.
-// EXPORTED only so a test can hold every RUNNER_POLICY_REASONS member to a row here (issue #437 review).
-export const TERMINAL_COMMENTS = {
-	"worker-abort": "Stopped: the worker ended this run before it finished (the 30-minute job limit, or a worker shutdown). Partial work may exist. Not retried.",
-	"operator-cancel": "Stopped: the operator cancelled this run. Partial work may exist. Not retried.",
-	"runner-policy": "Stopped: the run ended inside the container before finishing (a turn or token budget, or an in-container configuration refusal). Partial work may exist. Not retried.",
-	// Issue #437. Names the cause but never the provider's own message, which may echo a key fragment. "Or
-	// access" because a 403 is as often a key that works but may not use this model or route as a bad key.
-	"provider-auth-refused": "Stopped: the AI provider refused this worker's credentials or access (an authentication or permission error). The operator needs to check the provider key and what it is allowed to use. Not retried.",
-	// Issues #501, #502. The two stops name the policy, never the amount or the model: both are operator
-	// configuration, and the comment's reader may be an issue author who can act on neither.
-	"cost-cap": "Stopped: the next AI call could have taken this run past its cost limit, so it was not made. Partial work may exist. Not retried.",
-	"model-not-allowed": "Stopped: the run tried to call an AI model this trigger does not allow, or to change an AI request in a way it does not allow, so the call was not made. Partial work may exist. Not retried.",
-	"cost-cap-unenforceable": "Stopped: this run has a cost limit, and the job image could not enforce it before each AI call, so nothing was sent to the AI provider. The operator needs to update the job image. Not retried.",
-	"model-policy-unenforceable": "Stopped: this run is limited to certain AI models, and the job image could not enforce that before each AI call, so nothing was sent to the AI provider. The operator needs to update the job image. Not retried.",
-	// The runner's refusals of the job's MCP servers, each before the prompt. Never the server's name, its host or a
-	// variable: the exit line carries the name and the cause in its message, which the worker never parses (it reaches
-	// the worker's log as the container's output). Each says what the operator can check; the issue's author can act on
-	// none of it.
-	"mcp-unavailable": "Stopped: an MCP server this trigger names could not be used (it did not start, failed its handshake or refused the connection, an authentication error among them), so the run ended before the agent started. The operator needs to check that server and the job image. Not retried.",
-	"mcp-config-invalid": "Stopped: the list of MCP servers the worker wrote for this job is not one the job image accepts, so the run ended before the agent started. The operator needs to run a worker and a job image of the same release. Not retried.",
-	"mcp-config-mismatch": "Stopped: the MCP servers the worker wrote for this job are not the ones it named for it, so the run ended before the agent started. The operator needs to run a worker and a job image of the same release. Not retried.",
-	"mcp-secret-missing": "Stopped: a credential an MCP server this trigger names needs was not set inside the job, so the run ended before the agent started. The operator needs to check the secrets this trigger passes. Not retried.",
-	"mcp-command-missing": "Stopped: the job image does not have the program an MCP server this trigger names runs, so the run ended before the agent started. The operator needs to install that server in the job image or the overlay. Not retried.",
-	"mcp-shadowed": "Stopped: another extension in this job registers a tool or command that only the job's MCP servers may, so the run ended before the agent started. The operator needs to remove that extension or this trigger's MCP servers. Not retried.",
-	// Issue #625. The runner's two refusals of a job armed with run.awaitInput, each before the prompt.
-	"await-input-shadowed": "Stopped: another extension in this job registers the tool a run uses to stop and wait for an answer, so the run ended before the agent started. The operator needs to remove that extension or this trigger's run.awaitInput. Not retried.",
-	"await-input-without-session": "Stopped: this run may stop to wait for an answer but had nowhere to keep its work, so it ended before the agent started. The operator needs to run a worker and a job image of the same release. Not retried.",
-	// Issue #596. Never the size or the project: both are operator configuration, and the reader may be an issue author
-	// who can act on neither. The worker log and the run record carry them.
-	[EXIT_OOM_KILLED]: "Stopped: the job's container ran out of memory and was stopped. Partial work may exist. Not retried, because the same size would stop the same way. The operator can raise this job's memory size.",
-};
-
-// Issue #625: the one comment the COMPLETED path posts, on a run that ended awaiting-input. The agent posted its own
-// question (the tool tells it to, before it ends); this says how the run continues. Fixed and path-free, the
-// TERMINAL_COMMENTS rule, and it carries no model text: the question never crosses the exit line.
-// On an issue any reply continues it (the receiver routes it on the marker); a pull request's reply keeps the phrase,
-// since its session key needs a head branch that costs a token to read (parked.mjs).
-export const PARKED_COMMENT = "This run stopped to wait for an answer to the question above. Reply here, and the next run continues from here.";
-export const PARKED_COMMENT_PR = "This run stopped to wait for an answer to the question above. Reply in a comment that starts with this repository's pi-dispatch comment phrase, and the next run continues from here.";
-export function parkedComment(target) {
-	return target?.type === "pull_request" ? PARKED_COMMENT_PR : PARKED_COMMENT;
-}
-
-// Issue #502: the `model-unknown` refusal's comment. Names no model: the reader may be an issue author.
-export const MODEL_UNKNOWN_COMMENT = "Refused: this job names an AI model that this deployment does not know (it is in neither pi's model catalog nor the overlay models.json), so no container was started and nothing was spent. Ask the operator to check the trigger's model settings. Not run.";
-
-// The `model-unknown` refusal whose `why` is `overlay-*` (PR #558, the end-of-round check of #501 and #502): the deployment's overlay
-// models.json is the problem, not the job's model, so the generic text above would send the author to the wrong
-// place. Fixed text naming no path and no model; the operator finds which file and why in the worker log.
-export const OVERLAY_REFUSED_COMMENT = "Refused before starting: the deployment's model settings file (models.json in the overlay) cannot be used for this job, so no container was started and nothing was spent. The operator needs to fix that file. Not run.";
-
-// Issue #341: the forge comments for a `job-user-unmappable` refusal, keyed by cause. Shorter than the operator
-// texts in job-user.mjs on purpose: a comment's reader may be an issue author, who can act on none of it.
-const JOB_USER_COMMENTS = Object.freeze({
-	default: "Refused: the worker host's container runtime cannot give this job a non-root user that can read and write its own files. Not run.",
-	"runtime-unreadable": "Refused: the worker host's container runtime answered in a form the worker cannot read, so which user this job may run as is unknown. Not run.",
-});
+// The post-spend terminal comments (TERMINAL_COMMENTS, issue #288), the park's, the model and job-user refusals', the
+// durable-run refusals' and the bundle refusals' live in comment-tables.mjs since issue #710, with the rule each follows.
+export { HELD_TAKEN_COMMENT, MODEL_UNKNOWN_COMMENT, NETNS_KEEPER_CRASH_LOOP, NETNS_KEEPER_NOT_HOLDING, OVERLAY_REFUSED_COMMENT, PARKED_COMMENT, PARKED_COMMENT_PR, RECOVERY_COMMENTS, TERMINAL_COMMENTS, parkedComment };
 
 /**
  * The runtime a venue's own preflights talk to, named in a retry's words (issue #354). The message is the job_failed log
@@ -225,20 +186,287 @@ function modelPrefixesOf(modelDollars) {
 }
 
 /**
- * The models a job may call (issue #501, #503 part 7), as `{ provider, id }` refs: its main model, and every entry of
- * its effective allowed-model list when it has one. A list entry that does not split is kept as `null`, which the
- * zero-rated check reads as "not zero-rated" (fail closed).
+ * How long a console answer's trail claim lives: a forge job's retained data (`FORGE_JOB_RETENTION_MS`, retention.mjs),
+ * the longest the same id can return. Derived, so a change to the retention moves the claim with it.
  */
-function callableModelRefs(job) {
-	const refs = [{ provider: job.provider, id: job.model }];
-	for (const entry of Array.isArray(job.models) ? job.models : []) {
-		const ref = splitModelEntry(entry);
-		refs.push(ref === null ? null : { provider: ref.provider, id: ref.model });
+export const CONSOLE_TRAIL_CLAIM_MS = FORGE_JOB_RETENTION_MS;
+
+/**
+ * Claim the one trail comment of a console answer (issue #642): true when this attempt set `console:trail:<jobId>` and
+ * so must post, false when an earlier attempt of the same job already did, when the job's id cannot be derived, or when
+ * Valkey did not answer (each logged by its kind, never the text). The id is the queue's own (`forgeDeliveryJobId` over
+ * the job's kind, delivery id and replica), so a retry of the same job, which keeps its data, reaches the same key.
+ * Never throws.
+ */
+async function claimConsoleTrail(redis, job, log) {
+	let jobId;
+	try {
+		jobId = forgeDeliveryJobId(job.kind, job.trigger?.deliveryId, job.replica);
+	} catch {
+		log("console_trail_skipped", { kind: job.kind ?? null, reason: "no-job-id" });
+		return false;
+	}
+	try {
+		const set = await redis.set(`console:trail:${jobId}`, "1", "PX", CONSOLE_TRAIL_CLAIM_MS, "NX");
+		if (set === "OK") return true;
+		log("console_trail_skipped", { kind: job.kind ?? null, reason: "already-posted" });
+		return false;
+	} catch (error) {
+		log("console_trail_skipped", { kind: job.kind ?? null, reason: "valkey-error", code: typeof error?.code === "string" ? error.code : "error" });
+		return false;
 	}
-	return refs;
+}
+
+// `callableModelRefs` (the models a job may call) moved to reserve-estimate.mjs (issue #642) with the zero-rated test
+// it feeds, so the console's reserve estimate and this processor's reserve judge one rule (`zeroRatedFor`).
+
+// ── Durable runs (issue #645) ───────────────────────────────────────────────────────────────────────────────────────
+
+/** How many times one run may be continued from its checkpoint: a recovery job numbered past this is `recovery-cap`. */
+export const RECOVERY_CAP = 2;
+/** The reason an armed run's attempt RETURNS with when its continuation was queued instead of a retry thrown. */
+export const RECOVERY_ENQUEUED = "recovery-enqueued";
+/** A recovery job whose run already reached its final outcome elsewhere: refused silently, never commented. */
+export const RECOVERY_SUPERSEDED = "recovery-superseded";
+/** How long a recovery job waits before asking again whether its base run's container is still running here. */
+export const RECOVERY_WAIT_MS = 30_000;
+/** How long a recovery job waits before trying again after a never-started fault (it has no attempt to retry with). */
+export const RECOVERY_RETRY_WAIT_MS = 60_000;
+
+/**
+ * The run this attempt belongs to, decided from the job data alone (issue #645): `{ armed, runId, isRecovery, recovery,
+ * recoverSkipped, seq, recovered, checkpoints }`. The last three are filled in as the attempt goes, so the record can say
+ * them on every exit.
+ *
+ * `runId` is `job.recoveryOf` for a recovery job, else the queue's own id, DERIVED like the console trail's
+ * (`forgeDeliveryJobId` over kind, delivery id and replica: queue.mjs `enqueueForgeJob` names every forge job so). The
+ * processor is handed the effective job, which has no `.id`, and a derivation from data the queue itself keyed on is one
+ * answer for every attempt, retries and recoveries included; a new wiring argument would be a second. A recovery job's
+ * id (`<runId>.r<n>`) is never parsed: `recoveryOf` and `recovery` carry it.
+ *
+ * Not armed, with the reason the record names (fail open and say which): a local job (`local`, v1 recovers forge jobs
+ * only, so it runs exactly as it did before #645) and a forge job whose id cannot be derived (`no-run-id`).
+ */
+function durableOf(job) {
+	const d = { armed: false, runId: null, isRecovery: false, recovery: null, recoverSkipped: null, seq: null, recovered: null, checkpoints: null };
+	if (job?.recover !== true) return d;
+	if (job.kind === "local") {
+		d.recoverSkipped = "local";
+		return d;
+	}
+	if (typeof job.recoveryOf === "string" && job.recoveryOf !== "") {
+		d.runId = job.recoveryOf;
+		d.isRecovery = true;
+		d.recovery = job.recovery;
+	} else {
+		try {
+			d.runId = forgeDeliveryJobId(job.kind, job.trigger?.deliveryId, job.replica);
+		} catch {
+			d.recoverSkipped = "no-run-id";
+			return d;
+		}
+	}
+	d.armed = true;
+	return d;
+}
+
+/** The durable-run facts the record carries, added to a result only when there are any (so every other is unchanged). */
+function withDurable(result, d) {
+	if (result === null || typeof result !== "object") return result;
+	if (d.recoverSkipped === null && d.recovered === null && d.checkpoints === null) return result;
+	return { ...result, ...(d.recoverSkipped !== null ? { recoverSkipped: d.recoverSkipped } : {}), ...(d.recovered !== null ? { recovered: d.recovered } : {}), ...(d.checkpoints !== null ? { checkpoints: d.checkpoints } : {}) };
+}
+
+/** The same on a throw, so a retried or failed attempt's record says them too (buildRecord reads the error). */
+function tagDurable(e, d) {
+	if (e === null || typeof e !== "object") return;
+	try {
+		if (d.recoverSkipped !== null && e.recoverSkipped === undefined) e.recoverSkipped = d.recoverSkipped;
+		if (d.recovered !== null && e.recovered === undefined) e.recovered = d.recovered;
+		if (d.checkpoints !== null && e.checkpoints === undefined) e.checkpoints = d.checkpoints;
+	} catch {
+		// a frozen error keeps its own fields
+	}
+}
+
+/**
+ * The run reached its final outcome (a completed or policy result): remove its checkpoint store entry, its Valkey
+ * pointer and its budget ledger. Each best effort and logged by name, never thrown: every one has a TTL or a sweep
+ * behind it, and a cleanup fault must not turn a finished run into a failure.
+ */
+async function endDurableRun(d, deps) {
+	const log = typeof deps.log === "function" ? deps.log : () => {};
+	const quietly = async (what, fn) => {
+		try {
+			const r = await fn();
+			if (r && typeof r === "object" && (r.error || r.skipped)) log("durable_cleanup_failed", { what, code: String(r.error ?? r.skipped).slice(0, 40) });
+		} catch (error) {
+			log("durable_cleanup_failed", { what, code: typeof error?.code === "string" ? error.code : "error" });
+		}
+	};
+	if (deps.workspaceCheckpointer) await quietly("store", () => deps.workspaceCheckpointer.remove(d.runId));
+	// The wiring's seam when it hands one over; else run-checkpoint.mjs's own delete on this processor's client, so a bare
+	// wiring cannot leave a pointer that makes a later recovery think the run is still live. It answers false, never a
+	// throw, when Valkey did not answer: logged, and the pointer's 7-day expiry is the backstop.
+	await quietly("pointer", async () => {
+		const done = typeof deps.removeCheckpointPointer === "function" ? await deps.removeCheckpointPointer({ runId: d.runId }) : await removePointerDefault({ redis: deps.redis, runId: d.runId });
+		return done === false ? { error: "unanswered" } : null;
+	});
+	if (deps.runBudgetLedger) await quietly("ledger", () => deps.runBudgetLedger.remove(d.runId));
+}
+
+/** A confirmed draft still belongs to the forge/account where it was captured. Check before even a
+ * refusal/approval comment can mint credentials; a restarted worker may serve another configured instance. */
+export async function checkDraftAnswerSource(job, deps) {
+	const provenance = consoleDraftOf(job?.console);
+	if (!provenance) return null;
+	const refused = reason => ({ outcome: "policy", reason, budgetReserved: false });
+	if (provenance.invalid || job.parkedReply !== true || !deps?.answerDraftStore || typeof deps.answerDraftRuntime?.checkSource !== "function") return refused("answer-draft-refused");
+	let meta, input;
+	try {
+		meta = await deps.answerDraftStore.readMeta(provenance.draftSourceRunId);
+		input = await deps.answerDraftStore.privateInput(provenance.draftSourceRunId);
+	} catch { throw new InfraRetry("answer draft provenance could not be read", { reason: "container-never-started", budgetReserved: false }); }
+	if (!meta || !["drafted", "sent"].includes(meta.status) || meta.draftRunId !== provenance.draftRunId || meta.draftDigest !== provenance.draftDigest || input?.source?.kind !== job.kind || String(input.source.repo).toLowerCase() !== String(job.repo).toLowerCase() || input.source.target?.type !== job.target?.type || input.source.target?.number !== job.target?.number || (input.source.projectId ?? null) !== (job.projectId ?? null) || (input.source.azure?.projectId ?? null) !== (job.azure?.projectId ?? null)) return refused("answer-draft-refused");
+	try { return await deps.answerDraftRuntime.checkSource(input.source) === true ? null : refused("answer-draft-config-changed"); }
+	catch { throw new InfraRetry("answer draft current forge identity could not be read", { reason: "container-never-started", budgetReserved: false }); }
 }
 
 export async function runJob(job, deps) {
+	const sourceRefusal = await checkDraftAnswerSource(job, deps);
+	if (sourceRefusal) return sourceRefusal;
+	const touches = [];
+	let touchLineageSkipped = null;
+	// Issue #796: what the runner said of a canary's candidate, carried on every way out, since a job can load its candidate and still end any way at all.
+	// Issue #800: what the job loaded, the same way and for the same reason, a retried attempt's record included: a server
+	// that timed out exits 1 and retries (`mcp-unreachable`), and that record is the one a person opens to find out why.
+	const canaryFacts = { load: null, loaded: null };
+	const recordTouch = async (value) => {
+		const event = cleanTouch(value);
+		if (!event) return;
+		touches.push(event);
+		try {
+			if (deps.touchOutbox) { const intent = await deps.touchOutbox.begin(event); await deps.touchOutbox.applied(intent); }
+			else if (deps.touchStore) await deps.touchStore.write(event);
+			else await deps.recordTouch?.(event);
+		} catch { deps.log?.("touch_record_pending", {}); }
+	};
+	try {
+		const result = withCanaryLoad(await runJobInner(job, { ...deps, recordTouch, recordTouchGap: () => { touchLineageSkipped = "source-unavailable"; }, canaryFacts }), canaryFacts);
+		return result && typeof result === "object" && (touches.length || touchLineageSkipped) ? { ...result, ...(touches.length ? { touches } : {}), ...(touchLineageSkipped ? { touchLineageSkipped } : {}) } : result;
+	} catch (error) {
+		if (canaryFacts.load !== null && error && typeof error === "object") error.canaryLoad = canaryFacts.load;
+		if (error && typeof error === "object") {
+			const ran = error.loaded ?? null;
+			// A throw that already holds what the container said (`InfraRetry`'s `loaded`) came out of the run's own wrapper before
+			// the processor could note it, so what is noted here is the worker's own facts alone. The line stands, with them added.
+			if (ran !== null && canaryFacts.loaded !== null) error.loaded = loadedWithBase({ ...ran, ...imageFactsOf(canaryFacts.loaded) }, canaryFacts.loaded.baseSha);
+			else if (ran === null && canaryFacts.loaded !== null) error.loaded = canaryFacts.loaded;
+		}
+		if (touches.length && error && typeof error === "object") error.touches = touches;
+		if (touchLineageSkipped && error && typeof error === "object") error.touchLineageSkipped = touchLineageSkipped;
+		throw error;
+	}
+}
+
+function withCanaryLoad(result, facts) {
+	if (result === null || typeof result !== "object" || (facts.load === null && facts.loaded === null)) return result;
+	return { ...result, ...(facts.load !== null ? { canaryLoad: facts.load } : {}), ...(facts.loaded !== null ? { loaded: facts.loaded } : {}) };
+}
+
+async function runJobInner(job, deps) {
+	// Queue fields never confer approval authority. Resolve the host-owned decision before the mint or any reserve.
+	job = { ...job };
+	delete job.approvalDecision;
+	let approval = null;
+	if (job.gates !== undefined || job.approvalRequestId !== undefined || job.resume === true && deps.approvalRuntime) {
+		const id = deps.queueJobId ?? forgeDeliveryJobId(job.kind, job.trigger?.deliveryId, job.replica);
+		if (!deps.approvalRuntime) return { outcome: "policy", reason: "approval-store-unavailable", budgetReserved: false, exitCode: null, turns: null, tokens: null };
+		approval = await deps.approvalRuntime.before({ ...job, id });
+		if (approval.error) throw new InfraRetry("approval state could not be read", { reason: "container-never-started", budgetReserved: false });
+		// Issue #761: the live triggers file was written by a newer pi-dispatch, so this build cannot judge the approval
+		// declaration. Before the mint and every reserve, and before any request is decided or claimed: the job waits for
+		// a worker that reads the file (`newer-release`), never refused, so neither the delivery nor the decision is lost.
+		if (approval.newer === true) throw new NewerReleaseHold("the triggers file");
+		if (!approval.ok) {
+			await deps.comment?.(job, `Refused: ${approval.refused}. Check the pending approval and current trigger declaration. Not run.`);
+			return { outcome: "policy", reason: approval.refused, ...(approval.audit ? { approval: approval.audit } : {}), budgetReserved: false, exitCode: null, turns: null, tokens: null };
+		}
+		if (approval.decision) {
+			job.approvalDecision = approval.decision;
+			// A phrase-prefixed /approve is a decision, not a new flow override. Continue the requesting flow.
+			if (typeof approval.request?.resumeJob?.flow === "string") job.flow = approval.request.resumeJob.flow;
+			if (deps.approvalSessionCheck) {
+				const session = deps.approvalSessionCheck(approval.request);
+				if (!session.ok) {
+					await deps.approvalRuntime.finish({ requestId: approval.request.requestId, jobId: id });
+					return { outcome: "policy", reason: "approval-session-unavailable", approval: approval.audit, budgetReserved: false, exitCode: null, turns: null, tokens: null };
+				}
+			}
+		}
+		if (approval.budgetCapUsd !== undefined) job.maxCostMicros = effectiveCostCapMicros(approval.budgetCapUsd, deps.deploymentMaxCostUsd ?? null);
+		deps = { ...deps, approvalRequest: approval.request ?? null, approvalJobId: id };
+	}
+
+	const durable = durableOf(job);
+	// Issue #704: what this attempt did with the project's secret bundle, for the record (`bundle` or `bundleSkipped`).
+	const bundleFacts = { bundle: null, bundleSkipped: null };
+	const archiveFacts = { value: null };
+	let result;
+	try {
+		result = await runAttempt(job, deps, durable, bundleFacts, archiveFacts);
+		if (approval?.audit && !result?.approval) result = { ...result, approval: approval.audit };
+		if (approval?.request && result?.outcome === "policy") {
+			const closed = await deps.approvalRuntime.finish({ requestId: approval.request.requestId, jobId: deps.approvalJobId });
+			if (!closed.ok) result = { ...result, reason: "approval-finish-unavailable" };
+		}
+	} catch (e) {
+		try { if (archiveFacts.value && e && typeof e === "object") e.forkSource = archiveFacts.value; } catch {}
+		if (approval?.audit && e && typeof e === "object") e.approval = approval.audit;
+		tagDurable(e, durable);
+		tagBundle(e, bundleFacts);
+		// A RECOVERY job has one attempt (recovery-queue.mjs), so a never-started retry would fail it for good over a
+		// blip (a pointer read, a ledger write, a restore that met a lock). Every such throw becomes a wait hold instead:
+		// `makeProcessor` delays it without spending the attempt, and the run's recovery deadline (`recoverBy`, the
+		// host-lost sweep) bounds how long it can wait. Nothing was started, so nothing is lost by asking again.
+		if (durable.isRecovery && e instanceof InfraRetry && e.reason === "container-never-started" && !(e instanceof RecoveryWaitHold)) {
+			const hold = new RecoveryWaitHold(e.message, { cause: e, reason: e.reason, provider: e.provider, model: e.model, budgetReserved: e.budgetReserved, dollars: e.dollars, resources: e.resources, exitCode: e.exitCode, turns: e.turns, tokens: e.tokens, session: e.session, usage: e.usage, waitMs: RECOVERY_RETRY_WAIT_MS });
+			tagDurable(hold, durable);
+			tagBundle(hold, bundleFacts);
+			deps?.log?.("recovery_retry_held", { delayMs: RECOVERY_RETRY_WAIT_MS });
+			throw hold;
+		}
+		throw e;
+	}
+	// The run's FINAL outcome cleans up after it. Not a queued recovery (its checkpoint is what the recovery restores),
+	// and not `recovery-superseded`: that one is decided on a pointer read that came back empty, and an empty read must
+	// never be the reason another run's store is deleted; the run that settled cleaned up after itself.
+	if (durable.armed && result?.reason !== RECOVERY_ENQUEUED && result?.reason !== RECOVERY_SUPERSEDED) await endDurableRun(durable, deps);
+	return withBundle(withDurable(archiveFacts.value ? { ...result, forkSource: archiveFacts.value } : result, durable), bundleFacts);
+}
+
+/**
+ * The secret-bundle facts the record carries (issue #704), added to a result only when there are any, so every other
+ * result is unchanged. NAMES only: `bundle` is `{ id, variables, shadowed }`, never a value.
+ */
+function withBundle(result, b) {
+	if (result === null || typeof result !== "object") return result;
+	if (b.bundle === null && b.bundleSkipped === null) return result;
+	return { ...result, ...(b.bundle !== null ? { bundle: b.bundle } : {}), ...(b.bundleSkipped !== null ? { bundleSkipped: b.bundleSkipped } : {}) };
+}
+
+/** The same on a throw, so a retried or failed attempt's record says what it held (buildRecord reads the error). */
+function tagBundle(e, b) {
+	if (e === null || typeof e !== "object") return;
+	try {
+		if (b.bundle !== null && e.bundle === undefined) e.bundle = b.bundle;
+		if (b.bundleSkipped !== null && e.bundleSkipped === undefined) e.bundleSkipped = b.bundleSkipped;
+	} catch {
+		// a frozen error keeps its own fields
+	}
+}
+
+async function runAttempt(job, deps, durable, bundleFacts = { bundle: null, bundleSkipped: null }, archiveFacts = { value: null }) {
 	const {
 		redis,
 		caps, // { day, week, month }; week/month null when that window is disabled (REQ-SPEND-CAPS-MULTI-WINDOW)
@@ -256,7 +484,8 @@ export async function runJob(job, deps) {
 		// this job names is on this host (image-preflight.mjs). Default admits everything, so a wiring that
 		// omits it behaves exactly as before -- the container's own failure stays the backstop.
 		imagePreflight = async () => ({ ok: true }),
-		// (job) => { ok } | { refused, at, jobId }. The one-shot pre-spend check (issue #231,
+		subscriptionAuthRequired = async () => false,
+		// (job) => { ok } | { refused, at, jobId } | { newer } (issue #761). The one-shot pre-spend check (issue #231,
 		// DES-ONE-SHOT-DISARM-IN-THE-FILE). Default admits everything -- an unwired processor behaves
 		// exactly as before, and the gate below only calls it for a job whose matched rule was a
 		// one-shot, so the default is never a probe running on every delivery.
@@ -271,6 +500,8 @@ export async function runJob(job, deps) {
 		// the real read happens where it always did, because threading a live credential through the processor
 		// would put it in scope for every log line and record between here and the container.
 		checkProviderCredential = () => ({ ok: true }),
+		prepareSubscriptionAuth = null,
+		validateSubscriptionAuth = null,
 		// (refs) => { ok } | { unknown: { provider, id }, why } | { unavailable: code } (issue #502). Is each of this
 		// job's models, its main one and every listed one, a model pi knows (model-catalog.mjs `checkModelsKnown`,
 		// the builtin catalog plus the overlay models.json)? Admit-everything by default, like the credential probe
@@ -306,6 +537,11 @@ export async function runJob(job, deps) {
 		// so the answer is not swallowed against it. Takes no job: the key belongs to the REAL BullMQ job, which only the
 		// wiring holds (index.mjs binds queue.mjs's `releaseSemanticWindow` to it). Never throws. The default does nothing.
 		releaseParkedWindow = async () => {},
+		// () => Promise<{ resumed } | null> (issue #638, DES-AWAIT-INPUT-ENDS-THE-JOB): take the replies held for this run
+		// while it was parking, after the window is released: the first recent one is enqueued as the resumed job, the
+		// rest answered once (held-settle.mjs `takeHeld`). Bound by the wiring to the REAL job, like the release. Never
+		// throws. The default takes nothing, so a wiring without it parks exactly as before.
+		takeHeldReplies = async () => null,
 		// The session store's root, or null when the feature is unavailable (REQ-RESUMABLE-SESSION). Read
 		// ONLY to answer the fail-closed gate below -- nothing here opens it, and it never reaches the
 		// container env (docker-run.mjs mounts a per-job COPY, never the store).
@@ -342,6 +578,29 @@ export async function runJob(job, deps) {
 		// would leave an INJECTED resolver running on every job, which is how a probe nobody wanted starts
 		// spawning a subprocess per delivery to learn nothing.
 		resolveSecrets = async (job) => ({ profileUnknown: job.secretsProfile ?? DEFAULT_SECRETS_PROFILE }),
+		// Issue #704, project secret bundles. `findSecretBundle(job, { project })` is the worker's own read of the triggers
+		// file's `secretBundles` (triggers-file.mjs `makeFindSecretBundle`); the default finds none, so a bare processor
+		// and every deployment without the key run exactly as before. `secretBundles` is the bundle seam
+		// (secret-bundles.mjs `makeBundleResolver`, its overlay and signal bound by the wiring): `lookup(profile)` with
+		// no spawn, `resolve(job, binding)` with one. Its default FAILS CLOSED, `resolveSecrets`' posture and reason:
+		// a wiring that finds a bundle and cannot resolve one must refuse, never start the job without the environment.
+		findSecretBundle = () => ({ none: true }),
+		secretBundles = { lookup: (profile) => ({ profileUnknown: profile }), resolve: async (_job, binding) => ({ profileUnknown: binding?.profile ?? null }) },
+		// `(job, token) => { headRef, headRepo }` for a pull-request target, the forge host's own (prepare-github.mjs reads
+		// the same seam for run.resume): whether the head lives in the base repository, answered by the FORGE, never the
+		// payload. Asked only for a job whose project has a bundle without `forkReviews`. Null on a bare wiring, which
+		// can confirm no head and so grants no bundle to a pull request (`bundleSkipped: "fork"`, the direction that
+		// grants nothing).
+		resolvePullRequestHead = null,
+		// Issue #704 review: whether a profile this host lacks DEFERS the job rather than refusing it: true only for a job
+		// on a multi-host worker's shared queue (index.mjs, the never-fits gate's predicate), where another host may serve
+		// it. False by default, so a single host refuses, as it always did.
+		bundleProfileDeferrable = false,
+		// Issue #704 part 3: the job's venue's judgement of its project secret bundle (the registry's `bundleGate`,
+		// backend-openshell.mjs's for both OpenShell venues), `(job, { endpoints, vars, shadowed })` => `{ ok, placeholders?,
+		// plain? }`, `{ venueRefused: { reason, comment } }` or `{ unavailable }`. The default admits, which is every venue
+		// that holds its env as values: there a bundle's variables simply join the env.
+		bundleGate = async () => ({ ok: true }),
 		// (job) => { ok, document } | { refused, name, why } | { unavailable: code } (REQ-MCP-OPERATOR-SERVERS,
 		// mcp-preflight.mjs). The default passes a job that names no server and refuses one that does, so a wiring that
 		// forgot the check can never run a job without the servers its trigger names.
@@ -381,7 +640,7 @@ export async function runJob(job, deps) {
 		// never sets it classifies every abort as worker-abort, exactly as before.
 		runContainer,
 		cleanup, // (dirs) => void
-		comment, // (job, text) => void   (issue status; no-op for local jobs)
+		comment: rawComment, // (job, text) => void   (issue status; no-op for local jobs)
 		log = () => {},
 		// The outbox chain collector (INT-OUTBOX-CONTRACT). No-op default so a job whose wiring omits it --
 		// or a github job with no /outbox -- chains nothing. It NEVER throws (outbox.mjs), so its counts are
@@ -392,6 +651,7 @@ export async function runJob(job, deps) {
 		// NEVER throws, so a refused plan is a recorded outcome of a completed job and never a retry. The default collects
 		// nothing (null: no plan), so a wiring that omits it records `plan: null`.
 		collectPlan = async () => null,
+		collectWatch = async () => {},
 		// Issue #501: the deployment's dollar windows `{ day, week, month }` in micro-dollars (each null when unset), or
 		// null when no window is set. Null is the default and the off switch: nothing is reserved or settled and no
 		// `budget:usd:*` key is written, so a deployment with no dollar setting is byte-identical.
@@ -414,6 +674,10 @@ export async function runJob(job, deps) {
 		otherDollars = null,
 		dollarCapSource = null,
 		envelopeMismatch = false,
+		// Issue #761: the endpoint tag of the Valkey this worker's dollar counters live in (`valkeyEndpointTag`), which the
+		// record's `dollars.reservedIn` carries so doctor sums only the records of the counter it reads. Null (an unwired
+		// processor) writes no `reservedIn`, so such a record keeps the shape it had.
+		valkeyTag = null,
 		// Issue #505: whether the LIVE triggers file still flags this job's cron trigger `run.portfolio: true`, as
 		// `(job) => boolean`, and this host's envelope `delegation` block (`{ enabled, writers }`), null with no envelope.
 		// The flag on the job data is what the trigger said when the job was queued; the file is what the operator says
@@ -438,8 +702,63 @@ export async function runJob(job, deps) {
 		// `builtinModel`). Read only by the zero-rated check; the default knows no builtin model, so an unwired
 		// processor judges overlay models alone and reserves for every other.
 		builtinModel = () => null,
+		// Issue #645, durable runs. Every one defaults to inert, and none is read unless the job armed `run.recover`, so an
+		// unwired processor runs every other job exactly as before. `workspaceCheckpointer` is workspace-checkpoint.mjs's
+		// (null when PI_CHECKPOINTS_DIR is unset), `runBudgetLedger` run-budget-ledger.mjs's, `readCheckpointPointer`
+		// `({ runId }) => pointer | null` and `enqueueRecovery` `({ job, cause, pointer }) => { enqueued, jobId, n } |
+		// { enqueued: false, reason }` (recovery-queue.mjs, bound to the real BullMQ job by the wiring). `stageRecovered`
+		// is the session store's (session-store.mjs). `resetTrustPaths` is trust-paths.mjs's. `runningJobs` is the
+		// processor's `{ list() }` of the jobs running on this host, and `hostName` this worker's name, as the checkpoint
+		// manifest records it.
+		workspaceCheckpointer = null,
+		forkStore = null,
+		checkForkPolicy = async () => ({ refused: "fork-policy-unavailable" }),
+		checkThinking = async () => false,
+		runBudgetLedger = null,
+		readCheckpointPointer = null,
+		enqueueRecovery = null,
+		stageRecovered = null,
+		resetTrustPaths = resetTrustPathsDefault,
+		runningJobs = null,
+		onDollarHold = () => {},
+		hostName = null,
+		// `({ runId, pointer, attempt }) => { seq } | { skipped }` (start.mjs): a salvage checkpoint from a crashed attempt's
+		// job directory still on this host, asked for a recovery job before its manifest is read. Null takes none.
+		salvageCheckpoint = null,
+		// `(jobId, { keep }) => record | null` (start.mjs `readRunRecord`): the settled-run check a recovery asks first, this
+		// host's file and then the fleet's copy, the first that passes `keep` when one is given. Null skips it, and the
+		// pointer and store logic below still decide.
+		readRecord = null,
+		// `({ workspace, baseSha }) => boolean` (trust-paths.mjs): whether the base commit holds anything under
+		// `.pi/extensions/`, which makes a run unrecoverable (see its use).
+		baseHasExtensions = baseHasExtensionsDefault,
 		now = new Date(),
 	} = deps;
+	// `armed` can still drop to false for a fresh attempt whose base holds `.pi/extensions/` (below), before anything durable.
+	let { armed } = durable;
+	const { runId, isRecovery } = durable;
+	// The checkpoint a recovery job restores, read and judged among the free gates below.
+	let manifest = null;
+	let forkSource = null;
+	let sourcePrimed = false;
+	let sourceRunId = deps.queueJobId ?? null;
+	if (sourceRunId === null) { try { sourceRunId = forgeDeliveryJobId(job.kind, job.trigger?.deliveryId, job.replica); } catch {} }
+	const forkRefusal = async (reason) => {
+		await comment(job, `Refused: ${reason}. No fork container was started. Check the source run, current trigger policy and retained workspace points.`);
+		return { outcome: "policy", reason, exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false };
+	};
+	let transcriptPath = null;
+	// Whether this attempt's dollar hold has a durable record (`recordHold`): only then do its settle and release go through
+	// the ledger's compare-and-set. A hold that failed to be recorded is given back directly, since no one else can see it.
+	let holdRecorded = false;
+	// Issue #645: the job-count slot an armed run carries from an earlier attempt (`claimSlot` answered "carried"). It is
+	// still counted, by the attempt that reserved it, so this attempt reserves none and refunds none.
+	let slotCarried = false;
+	// Whether an armed run's slot belongs to the RUN rather than to this attempt (any successful claim). Such a slot is not
+	// refunded by a never-started retry: the retry carries it (`claimSlot` answers "carried"), so refunding it here would
+	// let the retry run on a slot nothing counts. Only the run's final outcome gives a slot back (a refusal or
+	// config-refused, exactly as before).
+	let slotOwnedByRun = false;
 
 	// "Forge-backed" is the negation of local, not an enumeration of forges: a job that is not editing a
 	// folder on this host is working against a remote, and every gate below applies for the same reason
@@ -452,6 +771,11 @@ export async function runJob(job, deps) {
 	const wantsForgeToken = isForgeBacked || job.github === true;
 	let token = null;
 	let prepared = null;
+	const comment = job.answerDraft ? async () => {} : rawComment;
+	let watchCompleted = false;
+	let answerUsage = null;
+	let watchUsage = null;
+	let watchPolicyRefused = false;
 	// The job-count reservations still standing, in reserve order (issue #499 part B): what `reserveLedgers` took and
 	// no refund has given back yet. EVERY refund below is `releaseLedgers` over this one list, last first, so no path
 	// can give back one ledger and forget another, and none can give one back twice: a released ledger leaves the list.
@@ -461,7 +785,8 @@ export async function runJob(job, deps) {
 	// refund, global-only as INT-RUN-HISTORY-FILE-CONTRACT has it. A scoped or project slot a failed refund left behind
 	// is in the `budget_release_failed` log line, not in this field.
 	let globalLedger = null;
-	const globalHeld = () => globalLedger !== null && held.includes(globalLedger);
+	// A carried slot (issue #645) is held too: by the run, under the attempt that reserved it.
+	const globalHeld = () => (globalLedger !== null && held.includes(globalLedger)) || slotCarried;
 	// Give back every held job-count slot, NEVER throwing: a refund that did not land must not replace the caller's
 	// classification with a Redis message. Logged with `at`; returns whether the list is empty afterwards.
 	const refundLedgers = async (at) => {
@@ -489,9 +814,14 @@ export async function runJob(job, deps) {
 	// taken or once it has been settled or given back, so no path can settle or refund it twice. `dollars` is what
 	// the record says about it (INT-RUN-HISTORY-FILE-CONTRACT), null until the reservation step ran.
 	let dollarHold = null;
+	// A reporting failure must never change admission, settlement or the result of a paid run.
+	const publishDollarHold = (hold) => { try { onDollarHold(hold); } catch {} };
 	let dollars = null;
 	// Issue #596: what the container used (`resources` off its exit line), null until a container ran and reported it.
 	let resources = null;
+	// Issue #644: the run's progress summary (run-progress.mjs `summary`), null until a container ran with the reducer on.
+	// Display only: carried to the record like `resources`, and never read by any decision below.
+	let progress = null;
 
 	try {
 		// The one-shot pre-spend check (issue #231), FIRST on the ladder: one file read, cheaper than
@@ -504,6 +834,11 @@ export async function runJob(job, deps) {
 		// there, not optional hardening.
 		if (job.trigger?.matched?.once === true) {
 			const spent = await checkOnceSpent(job);
+			// Issue #761: the one answer that is not fail-open. A triggers file written by a newer pi-dispatch may hold this
+			// one-shot's disarm in a shape this build cannot read, and this build's own disarm of it would be refused, so
+			// running would fire the one-shot again on every delivery. Deferred (`newer-release`), never refused: a refusal
+			// would use up the delivery. Thrown here, first on the ladder, so nothing is minted, cloned or reserved.
+			if (spent.newer === true) throw new NewerReleaseHold("the triggers file");
 			if (spent.refused) {
 				// Commented like every sibling policy refusal: explainability is this refusal's whole
 				// purpose, and only a DISTINCT re-close reaches it past the GUID dedup, so the noise
@@ -523,8 +858,12 @@ export async function runJob(job, deps) {
 		// standing between a stale receiver and a paid job that ran when the operator wrote "wait".
 		{
 			const skew = await checkWaitSkew(job);
-			// Issue #502: an authored NARROWING field the job arrived without (`AUTHORED_NARROWING_FIELDS`, triggers-file.mjs),
-			// today `run.models` and `run.maxCostUsd`. The same two causes as a dropped wait, and the same refusal shape; without it the job would
+			// Issue #761: a triggers file written by a newer pi-dispatch may author a narrowing field this build has no row
+			// for, which no job field can show missing, so neither "skewed" nor "fine" is an answer this build can give. The
+			// job waits for a worker that reads the file (`newer-release`), before any spend, the once check's posture.
+			if (skew.newer === true) throw new NewerReleaseHold("the triggers file");
+			// Issue #502: an authored NARROWING field the job arrived without, one of the rows of `AUTHORED_NARROWING_FIELDS`
+			// (triggers-file.mjs). The same two causes as a dropped wait, and the same refusal shape; without it the job would
 			// run on the deployment's list, or on none, while every record reads like a correct run. The FIELD is named,
 			// never its value: the comment's reader may be an issue author.
 			if (skew.skewed && typeof skew.field === "string") {
@@ -567,6 +906,16 @@ export async function runJob(job, deps) {
 			log("refused_backend_unblessed", { backend: job.backend, blessed: blessedBackends });
 			return { outcome: "policy", reason: "backend-unblessed", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
 		}
+		// Issue #683: a folder job (a local run, a cron trigger's folder) on a venue that declares `localFolders` absent.
+		// The loader refuses a trigger that NAMES such a venue (`refusesLocalWorkspace`); this is the one it could not
+		// see, a trigger with no `run.backend` on a deployment whose DEFAULT is such a venue. A copy is edited elsewhere
+		// and written back afterwards, racing every edit the operator makes meanwhile (`DES-OPENSHELL-VENUE`).
+		const venueName = resolveBackendName(job, blessedBackends[0]);
+		if (job.kind === "local" && backendFor(venueName)?.declares?.localFolders === ABSENT) {
+			await comment(job, `Refused: this job runs against a folder on this machine, and its venue "${venueName}" copies a job's files instead of editing a folder in place. Run it on a venue that mounts folders (local or podman). Not run.`);
+			log("refused_venue_local_folders", { backend: venueName });
+			return { outcome: "policy", reason: "venue-local-folders-unsupported", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+		}
 
 		// Issue #278. PI_BACKEND_FLOOR can ask for a guarantee a backend declares but EARNS only while something
 		// about this host is observed -- `local`'s credentialTransit, which holds only while the docker CLI sends
@@ -614,6 +963,16 @@ export async function runJob(job, deps) {
 				budgetReserved: false,
 			};
 		}
+		// Issue #683: a venue's own refusal, made before spend whatever the floor says: the openshell venue's gateway is not
+		// on this host, has a gateway-wide policy in force, or the host has no Landlock (`CONST-VENUE-EGRESS-LAYER`'s third
+		// and fourth conditions). Determinate, so a RETURN (CONST-RETRY-INFRA-ONLY), ahead of the image preflight and the
+		// mint. The comment is the venue's fixed sentence for its reason, never anything the runtime said.
+		if (observed?.venueRefused && typeof observed.venueRefused.reason === "string") {
+			const { reason, comment: text } = observed.venueRefused;
+			await comment(job, typeof text === "string" && text !== "" ? text : VENUE_REFUSED_COMMENT);
+			log("refused_venue", { reason });
+			return { outcome: "policy", reason, exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+		}
 		if (observed?.unavailable) {
 			// The local venue's words stay what they were (they are its log line and BullMQ's failedReason); another venue
 			// is not docker's to name.
@@ -662,15 +1021,15 @@ export async function runJob(job, deps) {
 				job,
 				rootful
 					? key
-						? "Refused: the worker host's Podman configuration adds to every job's container what this venue does not allow (variables, the Podman service's groups, looser limits and filters, or the programs that run it), so the operator must change it before local jobs run. Not run."
-						: "Refused: the worker host's Podman configuration could not be read in full, or is written in a form the worker does not decode, so whether it adds to a job's container what this venue does not allow is not known, and the operator must fix that before local jobs run. Not run."
+						? PODMAN_CONF_COMMENTS["rootful-widens"]
+						: PODMAN_CONF_COMMENTS["rootful-unread"]
 					: live
 						? key
-							? "Refused: the worker host's running Podman network still lets a job's container reach the host's own services, with an option from a configuration since changed, so the operator must restart that network before podman jobs run. Not run."
-							: "Refused: the worker host's running Podman network could not be read, so whether it lets a job's container reach more than this venue allows is not known, and the operator must fix that before podman jobs run. Not run."
+							? PODMAN_CONF_COMMENTS["live-widens"]
+							: PODMAN_CONF_COMMENTS["live-unread"]
 						: key
-							? "Refused: the worker host's Podman configuration lets a job's container reach more than this venue allows (the host's own services, the worker account's groups, or looser limits and filters than the worker sets), so the operator must change it before podman jobs run. Not run."
-							: "Refused: the worker host's Podman configuration could not be read in full, or is written in a form the worker does not decode, so whether it lets a job's container reach more than this venue allows is not known, and the operator must fix that before podman jobs run. Not run.",
+							? PODMAN_CONF_COMMENTS.widens
+							: PODMAN_CONF_COMMENTS.unread,
 			);
 			log("refused_podman_conf_widens_job", { key: key ?? null, ...(live ? { live: true } : {}), ...(rootful ? { rootful: true } : {}), message: observed.podmanConfRefused.message });
 			return { outcome: "policy", reason: PODMAN_CONF_WIDENS_JOB, exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
@@ -681,12 +1040,22 @@ export async function runJob(job, deps) {
 		// image refuses without minting a credential it will not use, cloning a repo it will not read, or
 		// burning a cap slot. Jobs run with --pull=never (docker-run.mjs), so an absent image is never
 		// fetched -- this refusal IS the whole diagnosis, not a race with a background pull.
-		const img = await imagePreflight(job);
+		const needsSubscriptionAuth = await subscriptionAuthRequired(job);
+		if (typeof needsSubscriptionAuth !== "boolean") throw new Error("the subscription image requirement is unavailable");
+		const checkedImage = await imagePreflight(job, { subscriptionAuthRequired: needsSubscriptionAuth });
+		// Enforce the same host-only requirement at the DI seam too: a preflight returning capabilities
+		// cannot accidentally admit an older image before access preparation, mint or reservations.
+		const img = checkedImage.ok && needsSubscriptionAuth && !(checkedImage.capabilities ?? []).includes("subscriptionAuth")
+			? { subscriptionAuthUnsupported: checkedImage.image ?? job.image ?? "configured job image", declared: checkedImage.capabilities ?? [] }
+			: checkedImage;
 		// The image's declared pi version, read on the inspect the preflight already ran. Needed BEFORE the
 		// container starts, because a transcript written by a different pi may hold tool-call arguments the
 		// current schema no longer accepts -- so the resume has to be refused, not repaired mid-run. Null
 		// when the image declares none, which downstream means "never resume": the safe direction.
 		const piVersion = img.piVersion ?? null;
+		// Issue #800: from here a refusal can say which image it would have run on. Before this, and on a preflight that found
+		// no usable image, no value is set, so such a record is byte-identical to what it was.
+		if (deps.canaryFacts && img.ok === true) deps.canaryFacts.loaded = loadedWithImage(null, img);
 		if (img.missing) {
 			await comment(job, `Refused: the job image "${img.missing}" is not present on the worker host. Not run.`);
 			log("refused_image_missing", { image: img.missing });
@@ -716,6 +1085,22 @@ export async function runJob(job, deps) {
 			log("refused_image_forge_unsupported", { image: img.forgeUnsupported, kind: img.kind, declared: img.declared });
 			return { outcome: "policy", reason: "job-image-forge-unsupported", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
 		}
+		if (deps.approvalRequest && deps.approvalSessionCheck) {
+			const ready = deps.approvalSessionCheck(deps.approvalRequest, { piVersion: img.piVersion, venue: resolveBackendName(job, blessedBackends[0]), provider: job.provider, modelId: job.model });
+			if (!ready.ok) return { outcome: "policy", reason: "approval-session-unavailable", exitCode: null, turns: null, tokens: null, budgetReserved: false };
+		}
+
+		if (job.fallbackModels !== undefined && !(img.capabilities ?? []).includes(EXIT_AUTH_CAPABILITY)) {
+			const required = CAPABILITY_GATES.find((row) => row.token === "modelFailover");
+			await comment(job, required.comment(img.image ?? job.image ?? "selected image", "lacks authenticated exit support"));
+			return { outcome: "policy", reason: "job-image-model-failover-unsupported", exitCode: null, turns: null, tokens: null, budgetReserved: false };
+		}
+		if (job.answerDraft && !(img.capabilities ?? []).includes(EXIT_AUTH_CAPABILITY)) return { outcome: "policy", reason: "job-image-answer-draft-unsupported", budgetReserved: false };
+		if (job.gates && !(img.capabilities ?? []).includes(EXIT_AUTH_CAPABILITY)) {
+			await comment(job, APPROVAL_COMMENTS["job-image-approval-auth-unsupported"]);
+			return { outcome: "policy", reason: "job-image-approval-auth-unsupported", exitCode: null, turns: null, tokens: null, budgetReserved: false };
+		}
+
 		// The image capability gates (one table, CAPABILITY_GATES in image-preflight.mjs): the image is present and
 		// does not declare a feature this job carries, so its runner would silently ignore it. Determinate, so a
 		// refusal rather than a retry, and pre-spend, because no version of this gets better by running. Like the
@@ -790,7 +1175,7 @@ export async function runJob(job, deps) {
 			if (known?.unknown) {
 				// An `overlay-*` why is the deployment's file, not the job's model: its own comment.
 				const why = typeof known.why === "string" ? known.why : null;
-				await comment(job, why?.startsWith("overlay-") ? OVERLAY_REFUSED_COMMENT : MODEL_UNKNOWN_COMMENT);
+				await comment(job, modelUnknownComment(why));
 				// `why` is a fixed token: `overlay-unparseable` tells the operator the file is the problem, not the id.
 				log("refused_model_unknown", { provider: known.unknown.provider ?? null, model: known.unknown.id ?? null, why: known.why ?? null });
 				return { outcome: "policy", reason: "model-unknown", why, exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
@@ -800,7 +1185,7 @@ export async function runJob(job, deps) {
 			// does not list `PI_MODEL`, or a `dispatch_set model` that moved the default off a trigger's list. Both
 			// halves are compared, exact (`modelOnList`), the runner guard's rule.
 			if (Array.isArray(job.models) && !modelOnList(job.models, job.provider, job.model)) {
-				await comment(job, "Refused: the AI model this job would run on is not on the list of models it is allowed to use, so no container was started and nothing was spent. Ask the operator to check the trigger's model settings. Not run.");
+				await comment(job, MODEL_NOT_ALLOWED_COMMENTS.main);
 				log("refused_model_not_allowed", { provider: job.provider ?? null, model: job.model ?? null });
 				return { outcome: "policy", reason: "model-not-allowed", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
 			}
@@ -809,12 +1194,15 @@ export async function runJob(job, deps) {
 			// the container started; on any other api the worker is stricter than the runner, by decision. Refused here, free. The log names the listed model, the operator's own configuration; the
 			// comment names none.
 			if (known?.fallbackUnlisted) {
-				await comment(job, "Refused: a model this job is allowed to use declares fallback models that are not on the job's list, so no container was started and nothing was spent. Ask the operator to list those models too, or remove that model. Not run.");
+				await comment(job, MODEL_NOT_ALLOWED_COMMENTS["fallback-unlisted"]);
 				log("refused_model_not_allowed", { provider: known.fallbackUnlisted.provider ?? null, model: known.fallbackUnlisted.id ?? null, why: "fallback-unlisted" });
 				return { outcome: "policy", reason: "model-not-allowed", why: "fallback-unlisted", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
 			}
 		}
 
+		if (job.watch?.project && job.watch.project !== pickupProject) return { outcome: "policy", reason: "watch-project-mismatch", budgetReserved: false };
+		if (job.answerDraft?.project && job.answerDraft.project !== pickupProject) return { outcome: "policy", reason: "answer-draft-config-changed", budgetReserved: false };
+
 		// Is there a credential to run this job with at all? FREE, determinate and I/O-light: a pure function
 		// of the job's provider, the worker env, and (only when the env has no key) one small readFileSync of
 		// pi's auth.json. So it goes here, with the other free gates, which is further than issue #310 asked
@@ -853,8 +1241,8 @@ export async function runJob(job, deps) {
 			await comment(
 				job,
 				absent
-					? "Refused: this worker has no budget envelope while the other workers share an applied budget split, so no container was started and nothing was spent. Ask the operator to install the envelope on this worker, or to turn delegated allocation off for every worker (`pi-dispatch doctor` says how). Not run."
-					: "Refused: this worker's budget envelope differs from the one the current budget split was made for, so no container was started and nothing was spent. Ask the operator to run `pi-dispatch doctor`. Not run.",
+					? ENVELOPE_MISMATCH_COMMENTS["no-envelope"]
+					: ENVELOPE_MISMATCH_COMMENTS.mismatch,
 			);
 			log("refused_envelope_mismatch", absent ? { envelope: "none" } : {});
 			return { outcome: "policy", reason: ENVELOPE_MISMATCH_REASON, exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
@@ -884,28 +1272,46 @@ export async function runJob(job, deps) {
 			}
 		}
 
-		const credential = await checkProviderCredential(job, { modelEndpoints });
-		if (credential.unavailable) {
-			// Issue #503: the overlay models.json could not be read at this pickup for a transient reason, so the gate has no
-			// verdict for a provider that may be keyless. Retried, never refused: a refusal is permanent and public, and the
-			// next attempt may read the file. The code is a fixed errno token, never file text.
-			log("provider_credential_unavailable", { provider: job.provider ?? null, reason: credential.unavailable });
-			throw new InfraRetry("the provider credential could not be decided", { reason: "container-never-started", provider: job.provider ?? null, model: job.model ?? null });
-		}
-		if (!credential.ok) {
-			// The PROVIDER is named and the message is not. The provider is operator-authored config, already
-			// on the record and the mirror, and named freely by the sibling refusals (`backend-unblessed` names
-			// the backend, `job-image-missing` names the image), so withholding it would tell the operator less
-			// than is safe. The message is withheld from BOTH surfaces: `credentialFromPiAuth`'s refusals carry
-			// `auth.json`'s absolute path, which is an OS account name, and the scoped-budget refusal below
-			// keeps a host path out of its own log line citing no-pii-in-logs. `doctor` prints the variable and
-			// the path, on the operator's terminal, which is where that belongs.
-			await comment(job, `Refused: this deployment has no usable credential for the "${job.provider}" provider, so no container was started and nothing was spent. Ask the operator to run \`pi-dispatch doctor\`. Not run.`);
-			log("refused_provider_unconfigured", { provider: job.provider ?? null });
-			return { outcome: "policy", reason: "provider-unconfigured", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+		const credentialJobs = [job];
+		if (job.watch && job.watchDecisionModel && job.watchDecisionModel.provider !== job.provider) credentialJobs.push({ ...job, provider: job.watchDecisionModel.provider, model: job.watchDecisionModel.id });
+		if (job.questionGrouping && job.questionGroupModel && job.questionGroupModel.provider !== job.provider) credentialJobs.push({ ...job, provider: job.questionGroupModel.provider, model: job.questionGroupModel.id });
+		if (job.answerDraft && job.answerDecisionModel && job.answerDecisionModel.provider !== job.provider) credentialJobs.push({ ...job, provider: job.answerDecisionModel.provider, model: job.answerDecisionModel.id });
+		for (const credentialJob of credentialJobs) {
+			const credential = await checkProviderCredential(credentialJob, { modelEndpoints });
+			if (credential.unavailable) {
+				// Issue #503: the overlay models.json could not be read at this pickup for a transient reason, so the gate has no
+				// verdict for a provider that may be keyless. Retried, never refused: a refusal is permanent and public, and the
+				// next attempt may read the file. The code is a fixed errno token, never file text.
+				log("provider_credential_unavailable", { provider: credentialJob.provider ?? null, reason: credential.unavailable });
+				throw new InfraRetry("the provider credential could not be decided", { reason: "container-never-started", provider: job.provider ?? null, model: job.model ?? null });
+			}
+			if (!credential.ok) {
+				// The PROVIDER is named and the message is not. The provider is operator-authored config, already
+				// on the record and the mirror, and named freely by the sibling refusals (`backend-unblessed` names
+				// the backend, `job-image-missing` names the image), so withholding it would tell the operator less
+				// than is safe. The message is withheld from BOTH surfaces: `credentialFromPiAuth`'s refusals carry
+				// `auth.json`'s absolute path, which is an OS account name, and the scoped-budget refusal below
+				// keeps a host path out of its own log line citing no-pii-in-logs. `doctor` prints the variable and
+				// the path, on the operator's terminal, which is where that belongs.
+				await comment(job, `Refused: this deployment has no usable credential for the "${credentialJob.provider}" provider, so no container was started and nothing was spent. Ask the operator to run \`pi-dispatch doctor\`. Not run.`);
+				log("refused_provider_unconfigured", { provider: credentialJob.provider ?? null });
+				return { outcome: "policy", reason: "provider-unconfigured", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+			}
 		}
 
 
+		// Access-only handoff is prepared after local determinate gates and before any paid work.
+		let subscriptionAuth = [];
+		if (prepareSubscriptionAuth) {
+			const preparedAuth = await prepareSubscriptionAuth(job);
+			if (!preparedAuth.ok) {
+				if (preparedAuth.wait) throw new SubscriptionWait(preparedAuth);
+				if (preparedAuth.unavailable) throw new InfraRetry("subscription authentication unavailable", { reason: "container-never-started", budgetReserved: false });
+				return { outcome: "policy", reason: preparedAuth.reason ?? "subscription-quota", exitCode: null, budgetReserved: false };
+			}
+			subscriptionAuth = preparedAuth.snapshots;
+		}
+
 		// REQ-EGRESS-ALLOWLIST. The egress policy this deployment claims must be able to serve this job
 		// BEFORE the job costs anything. It is one `docker inspect` when the policy is armed and ZERO spawns
 		// when it is not, so a deployment without one pays nothing at all.
@@ -990,13 +1396,39 @@ export async function runJob(job, deps) {
 		// mark beside its transcript, and it is free to read, so it is asked here, before the mint and before any spend.
 		// Without it the reply is ordinary conversation on an issue: refused, silently (no comment, since the person was
 		// talking to people), and the stale marker is cleared so the next comment is not routed here again.
+		if (job.fork !== undefined) {
+			try { validateFork(job.fork); } catch { return await forkRefusal("fork-request-invalid"); }
+			if (job.kind === "local" || job.target?.type !== "issue" || job.command || job.replica !== undefined || job.replicas !== undefined) return await forkRefusal("fork-target-unsupported");
+			const venue = resolveBackendName(job, blessedBackends[0]);
+			if (venue === "openshell") return await forkRefusal("openshell-fork-unsupported");
+			if (job.awaitInput === true) return await forkRefusal("fork-await-input-unsupported");
+			if (!isRecovery && !forkStore) return await forkRefusal("fork-source-store-unset");
+			const policy = await checkForkPolicy(job);
+			if (policy?.ok !== true) return await forkRefusal(policy?.refused ?? "fork-policy-unavailable");
+			const expected = job.forkReserveMicros;
+			if (expected !== null && (!Number.isSafeInteger(expected) || expected < 0)) return await forkRefusal("fork-request-invalid");
+			if (expected !== null && !zeroRatedFor(job, { modelEndpoints, builtinModel }).zeroRated && (expected === 0 || !Number.isSafeInteger(job.maxCostMicros) || job.maxCostMicros > expected)) return await forkRefusal("fork-reservation-changed");
+			const sourceKey = sessionKeyFor({ ...job, fork: undefined });
+			if (sourceKey !== job.fork.rootKey) return await forkRefusal("fork-source-target-mismatch");
+			// A recovery continues THIS fork's checkpoint; selecting the parent's original point again loses its work.
+			if (!isRecovery) {
+				forkSource = await forkStore.readPoint({ runId: job.fork.fromJob, sourceDigest: job.fork.sourceDigest, entryId: job.fork.fromEntry, position: job.fork.position });
+				if (forkSource?.unavailable) throw new InfraRetry("the fork source could not be read just now", { reason: "container-never-started", budgetReserved: false });
+				if (!forkSource?.ok) return await forkRefusal(forkSource?.refused ?? "fork-source-unavailable");
+				if (forkSource.manifest.sessionKey !== sourceKey) return await forkRefusal("fork-source-target-mismatch");
+				if (forkSource.manifest.piVersion !== piVersion) return await forkRefusal("fork-source-pi-version-mismatch");
+				if (forkSource.manifest.venue !== venue) return await forkRefusal("fork-source-venue-mismatch");
+				if (hostName && forkSource.manifest.host !== normalizeHost(hostName)) return await forkRefusal("fork-source-host-mismatch");
+			}
+		}
+		if (job.thinkingLevel !== undefined && (!FORK_THINKING_LEVELS.includes(job.thinkingLevel) || !(await checkThinking(job)))) return await forkRefusal("thinking-level-unsupported");
 		if (job.parkedReply === true && !isParked(job)) {
 			log("refused_not_parked", { kind: job.kind ?? null });
 			await parkedLabel(job, false);
 			return { outcome: "policy", reason: "not-parked", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
 		}
 		if (job.resume === true && !sessionsDir) {
-			await comment(job, "Refused: this trigger set `run.resume` but PI_SESSIONS_DIR is unset, so there is nowhere to persist the transcript -- the job would run with no session and still report success. Set PI_SESSIONS_DIR to a private directory outside every repo, or drop `run.resume` from this trigger. Not run.");
+			await comment(job, REFUSAL_COMMENTS["sessions-dir-unset"]);
 			// The variable NAME, never a value: there is no path to print here (its absence IS the refusal),
 			// and the store's path is the one setting SECURITY.md calls a PII store. `kind` is host-assigned,
 			// the same PII class as the `repo` on the branch refusal below.
@@ -1007,6 +1439,144 @@ export async function runJob(job, deps) {
 			return { outcome: "policy", reason: "sessions-dir-unset", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
 		}
 
+		// Issue #645, durable runs: `run.recover`'s free refusals, here beside run.resume's and for its reasons. Free (a
+		// value in hand, a Valkey GET, a manifest read off this host's disk), determinate, and strictly before the mint,
+		// the clone, the token-cap read and every reserve (CONST-BUDGET-BEFORE-TOKENS).
+		//
+		// The store's absence is run.resume's one fail-CLOSED case again: without a checkpoint store nothing is kept, a
+		// lost run is retried from scratch, and the job still looks protected. A wiring that has a store but not the
+		// rest of the machinery (a ledger, the pointer read, the enqueuer) is a defect of this build, not of the operator's
+		// settings, so it is a config refusal: refunded, `doctor`-pointed, never run half-armed.
+		if (armed && !workspaceCheckpointer) {
+			await comment(job, RECOVERY_COMMENTS["recover-store-unset"]);
+			log("refused_checkpoints_dir_unset", { kind: job.kind ?? null });
+			return { outcome: "policy", reason: "recover-store-unset", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+		}
+		if (armed && (!runBudgetLedger || typeof readCheckpointPointer !== "function" || typeof enqueueRecovery !== "function")) {
+			throw configError("run.recover is armed, and this worker was built without the run budget ledger, the checkpoint pointer read or the recovery enqueuer");
+		}
+		if (isRecovery) {
+			const n = durable.recovery;
+			// SETTLED, first of all: the run (its base attempt or an earlier recovery) already wrote a completed or policy
+			// record, so it reached its final outcome and there is nothing to continue. Silent, and cleans nothing (that
+			// outcome cleaned up after itself). Asked BEFORE the pointer and the store, because those can disagree after a
+			// cleanup that half failed (a store removal that failed beside a pointer delete that landed), and that
+			// disagreement must never put a failure comment under a run that completed.
+			// Only a record of THIS run settles it (issue #811). Ids come back (a lost queue, a hand redelivery) while records
+			// stay for the retention window, so a `completed` record an older job left under the run's id would end this
+			// recovery as superseded, silently, and the lost run would be neither continued nor reported. The recovery's data
+			// carries the base run's creation time (`recoveryOfCreatedAt`, recovery-queue.mjs `recoveryDataOf`), and a record
+			// whose time (`startedAt`, or `endedAt` with no start) is older than that, less `RECORD_CLOCK_SKEW_MS`, is
+			// another job's and settles nothing. Only a time that PARSES is judged so: `whyNotThisJob` would take a record
+			// with no readable time for another job's, but here that would run a run that may have completed, and paying
+			// twice for a settled run is the worse mistake, so such a record still settles, as before. A recovery without
+			// the field (queued by a build from before it) keeps the check without an age. Both sides are read, this host's
+			// file and the fleet's copy, each held to the rule (`keep`), so a stale record on this host cannot hide the
+			// settled one in the mirror; the answer is judged again, so a reader that ignores `keep` cannot settle the run
+			// on a record that fails it. Every field read is in the record's stable core, so a newer release's record is
+			// judged the same way.
+			const since = Number.isSafeInteger(job.recoveryOfCreatedAt) && job.recoveryOfCreatedAt >= 0 ? job.recoveryOfCreatedAt : null;
+			const settlesRun = (rec, id) => {
+				if (!rec || typeof rec !== "object" || rec.jobId !== id || (rec.outcome !== "completed" && rec.outcome !== "policy")) return false;
+				if (since === null) return true;
+				const at = Date.parse(rec.startedAt ?? rec.endedAt ?? "");
+				return !(Number.isFinite(at) && at < since - RECORD_CLOCK_SKEW_MS);
+			};
+			if (typeof readRecord === "function") {
+				const ids = [runId, ...Array.from({ length: Number.isSafeInteger(n) && n > 1 ? Math.min(n, RECOVERY_CAP + 1) - 1 : 0 }, (_, k) => `${runId}.r${k + 1}`)];
+				for (const id of ids) {
+					let rec = null;
+					try {
+						rec = await readRecord(id, { keep: (record) => settlesRun(record, id) });
+					} catch {
+						rec = null;
+					}
+					if (settlesRun(rec, id)) {
+						log("recovery_superseded", { n: Number.isSafeInteger(n) ? n : null, by: "record" });
+						return { outcome: "policy", reason: RECOVERY_SUPERSEDED, exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+					}
+				}
+			}
+			// THE CAP: a run continued twice is not continued a third time, whatever its checkpoint holds.
+			if (!Number.isSafeInteger(n) || n < 1 || n > RECOVERY_CAP) {
+				await comment(job, RECOVERY_COMMENTS["recovery-cap"]);
+				log("refused_recovery_cap", { n: Number.isSafeInteger(n) ? n : null, cap: RECOVERY_CAP });
+				return { outcome: "policy", reason: "recovery-cap", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+			}
+			// SUPERSEDED: the base run reached its final outcome after this recovery was queued (a completed or policy result
+			// removes the pointer), so there is nothing left to continue. Silent: that outcome already said what it had to.
+			// A read that THROWS is not an answer, so it is retried, never taken for "settled".
+			let pointer;
+			try {
+				pointer = await readCheckpointPointer({ runId });
+			} catch {
+				throw new InfraRetry("the run's checkpoint pointer could not be read", { reason: "container-never-started", provider: job.provider ?? null, model: job.model ?? null });
+			}
+			// The pointer read answers null for "no pointer" AND for "Valkey did not answer in time" (run-checkpoint.mjs never
+			// throws), so null alone must not decide: a silent refusal would drop a live run's continuation over a blip. A
+			// run's final outcome removes its STORE ENTRY before its pointer (`endDurableRun`), so superseded is a missing
+			// pointer AND a missing store. A missing pointer beside a store that is still there is ambiguous, and is
+			// retried loudly rather than guessed either way (continuing could re-run a run that completed).
+			if (pointer === null || pointer === undefined) {
+				const still = await workspaceCheckpointer.readManifest(runId);
+				if (still?.absent === true) {
+					log("recovery_superseded", { n });
+					return { outcome: "policy", reason: RECOVERY_SUPERSEDED, exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+				}
+				// A store a newer pi-dispatch wrote is one this build cannot judge either way: waited on like the read below.
+				if (still?.newer === true) throw new NewerReleaseHold("the run's checkpoint");
+				log("recovery_pointer_unread", { n });
+				throw new InfraRetry("the run's checkpoint pointer is missing while its checkpoint is still there", { reason: "container-never-started", provider: job.provider ?? null, model: job.model ?? null });
+			}
+			// THE BASE STILL RUNNING HERE: its container may still be alive and spending, so this recovery must neither
+			// settle its hold as crashed nor start a second agent on the same branch. It waits, without an attempt
+			// (`RecoveryWaitHold`), until that container is gone. Asked of this host only: the recovery is queued to the
+			// host the checkpoint is on, which is the host the base ran on.
+			// THIS job is in that list too (the processor admits a job before it runs it), under the id the recovery queue
+			// gave it (`<runId>.r<n>`, recovery-queue.mjs), so its own entry is excluded: without that every recovery would
+			// find itself running and wait for ever.
+			const ownId = `${runId}.r${n}`;
+			const live = typeof runningJobs?.list === "function" ? runningJobs.list() : [];
+			if (live.some((e) => typeof e?.id === "string" && e.id !== ownId && (e.id === runId || e.id.startsWith(`${runId}.r`)))) {
+				log("recovery_waits_for_base", { n, delayMs: RECOVERY_WAIT_MS });
+				throw new RecoveryWaitHold("the run this recovery continues is still running on this host", { reason: "container-never-started", provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false, waitMs: RECOVERY_WAIT_MS });
+			}
+			// SALVAGE, before the manifest is read: a crashed attempt whose job directory is still on this host (the worker
+			// died, the directory did not) gets one last checkpoint taken from it (`kind: "salvage"`), so the recovery
+			// continues from where the run really got to rather than from its last live checkpoint. The wiring's
+			// (start.mjs); it never throws by contract, and is guarded anyway: a failed salvage leaves the last committed
+			// checkpoint, which is still a correct place to continue from.
+			if (typeof salvageCheckpoint === "function") {
+				const salvaged = await Promise.resolve()
+					.then(() => salvageCheckpoint({ runId, pointer, attempt: pointer.attempt }))
+					.catch(() => ({ skipped: "error" }));
+				log("recovery_salvage", Number.isSafeInteger(salvaged?.seq) ? { seq: salvaged.seq } : { skipped: typeof salvaged?.skipped === "string" ? salvaged.skipped.slice(0, 40) : "unknown" });
+			}
+			// THE CHECKPOINT, judged before anything spends: valid (readManifest hashes the transcript against its
+			// manifest), taken on THIS host, by THIS image's pi version, in THIS job's venue. A transcript from another pi
+			// may hold tool-call arguments the current schema refuses (the run.resume rule), and a checkpoint from another
+			// venue was quiesced under another runtime's pause.
+			const read = await workspaceCheckpointer.readManifest(runId);
+			// Issue #761: a checkpoint a newer pi-dispatch wrote is not an absent one. Refused here, the run's final outcome
+			// would remove its store and its pointer (`endDurableRun`) and a host upgraded again could never continue it; so
+			// the recovery WAITS (`newer-release`, index.mjs) for a worker that reads the checkpoint, without spending its one
+			// attempt (the never-started conversion in `runJobInner` takes only `container-never-started`, which this is
+			// not), with no comment and no record, and with the store, the pointer and the job directory left in place. What
+			// bounds the wait is the host-lost sweep's hard maximum (recovery-queue.mjs, `RECOVERY_MAX_WAIT_MS`).
+			if (read?.newer === true) throw new NewerReleaseHold("the run's checkpoint");
+			const m = read?.ok === true ? read.manifest : null;
+			const venue = resolveBackendName(job, blessedBackends[0]);
+			const why = m === null ? (read?.absent ? "absent" : "invalid") : typeof hostName === "string" && hostName !== "" && m.host !== normalizeHost(hostName) ? "host" : piVersion === null || m.piVersion !== piVersion ? "pi-version" : m.venue !== venue ? "venue" : (m.provider !== job.provider || m.model !== job.model) ? "model" : null;
+			if (why !== null) {
+				await comment(job, RECOVERY_COMMENTS["recovery-checkpoint-absent"]);
+				// `why` is a fixed token, and `invalid`'s detail is the store's own fixed reason (`field:seq`, `transcript-mismatch`).
+				log("refused_recovery_checkpoint_absent", { n, why, ...(why === "invalid" && typeof read?.reason === "string" ? { detail: read.reason.slice(0, 40) } : {}) });
+				return { outcome: "policy", reason: "recovery-checkpoint-absent", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+			}
+			manifest = m;
+			transcriptPath = read.transcriptPath;
+		}
+
 		// REQ-PER-TRIGGER-SKILLS. A trigger that named a skills directory the worker cannot see would run
 		// its flow WITHOUT the skills it was written against, produce a plausible report, and exit 0. Free
 		// and determinate -- one lstat, no credential needed to know the answer -- so it belongs among the
@@ -1016,7 +1586,7 @@ export async function runJob(job, deps) {
 		// image blocks every job on this host, an unset sessions dir blocks every armed trigger, a bad
 		// skillsDir blocks one trigger.
 		if (job.skillsDir && !isReadableDir(job.skillsDir)) {
-			await comment(job, "Refused: this trigger set `run.skillsDir`, and that path is absent or is not a directory on the worker host. The job would have run without the skills the flow was written against. Not run.");
+			await comment(job, REFUSAL_COMMENTS["skills-dir-missing"]);
 			// The FIELD name, never its value. `comment` posts publicly on the issue, so a host path here
 			// would publish the operator's filesystem layout to anyone reading the thread; the log line is
 			// the same restraint refused_sessions_dir_unset keeps.
@@ -1024,6 +1594,22 @@ export async function runJob(job, deps) {
 			return { outcome: "policy", reason: "skills-dir-missing", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
 		}
 
+		// Issue #796: a canary's refusals, free and determinate like the one above, so before the mint and everything after it. The registry read is free too; one that cannot
+		// be asked is infrastructure and retries (CONST-RETRY-INFRA-ONLY), since the same job can succeed. The ladder's narrowest gate, so it asks the network last.
+		let canaryPlan = null;
+		if (job.packageCanary !== undefined) {
+			if (!deps.packageCanary) return { outcome: "policy", reason: "package-canary-invalid", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false };
+			try {
+				canaryPlan = await deps.packageCanary.check(job);
+			} catch {
+				throw new InfraRetry("the registry could not be asked about the canary's version", { reason: "container-never-started", budgetReserved: false, provider: job.provider ?? null, model: job.model ?? null });
+			}
+			if (canaryPlan.refused) {
+				log("refused_package_canary", { reason: canaryPlan.refused });
+				return { outcome: "policy", reason: canaryPlan.refused, exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false };
+			}
+		}
+
 		// REQ-MCP-OPERATOR-SERVERS. A trigger that named MCP servers its job cannot use would run its flow without them,
 		// or hand a server the job's own credentials, or open a connection the egress proxy refuses at its first call:
 		// each a plausible report and a clean exit. One read of the overlay's mcp.json, no credential and no network, so
@@ -1038,11 +1624,84 @@ export async function runJob(job, deps) {
 			// The server NAME is the operator's own configuration, the same class as the image ref on the image refusal.
 			// `why` can name an internal host or a variable (never a value, a url's path or its query), so it goes to the
 			// worker's log and the public comment says only which rule refused.
-			await comment(job, `Refused: this trigger names MCP server${mcpChecked.name ? ` "${mcpChecked.name}"` : "s"} in \`run.mcp\`, and ${MCP_REFUSAL_COMMENT[mcpChecked.refused] ?? "it cannot be used"}. The job would have run without the servers its flow was written against; the worker's log says why (\`refused_mcp\`). Not run.`);
+			await comment(job, mcpRefusalComment(mcpChecked.refused, mcpChecked.name));
 			log("refused_mcp", { kind: job.kind ?? null, reason: mcpChecked.refused, server: mcpChecked.name ?? null, why: mcpChecked.why });
 			return { outcome: "policy", reason: mcpChecked.refused, exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
 		}
 
+		// PROJECT SECRET BUNDLES, the free half (issue #704, REQ-TRIGGER-SECRETS, DES-PROJECT-SECRET-BUNDLES). WHICH jobs
+		// get their project's bundle is decided here, before the mint, the clone and every reserve, from one cached read
+		// of the triggers file and the host's declarations: no spawn, no network (CONST-BUDGET-BEFORE-TOKENS). The read
+		// itself comes after the run.secrets resolver and, like it, before the mint, except for a pull request that needs
+		// the fork check: that one needs the forge and the job's token, so its read follows the mint (below).
+		//
+		// TRIGGER-MADE JOBS ONLY, and the predicate is the portfolio gate's: a chained `/outbox` child and every manual
+		// run (`pi-dispatch run`, `/dispatch run`, `dispatch_run`) hold none, each recorded as `bundleSkipped`. The
+		// operator's grant was to the triggers they reviewed, not to what a job queues next or what a model asks for
+		// (outbox.mjs keeps `run.secrets` off children for the same reason). Chained is asked first: a child may carry
+		// its parent's trigger context, and it must never read as manual. A trigger's `run.secretBundle: false` is
+		// `opted-out`, read from the live file rather than the job data (triggers-file.mjs says why).
+		//
+		// Every refusal RETURNS (CONST-RETRY-INFRA-ONLY): an undeclared or doubly declared profile, a resumed job
+		// (`run.resume` would replay a transcript that may hold an echoed value into every later job on its key, the
+		// rule that refuses `run.secrets` beside it at load, which cannot be applied at load here because the file
+		// cannot know a job's project), and a trigger the file no longer holds. A file that has never been read and
+		// validated in this process RETRIES a job with a project (the finder answers from its last good read otherwise),
+		// and a profile this host lacks is DEFERRED on a multi-host worker's shared queue, the never-fits gate's rule,
+		// since another host may serve it. A venue's refusal of the bundle itself comes with the read (`readBundle`).
+		const bundleChained = job.parentJobId !== undefined || job.chainDepth !== undefined;
+		const bundleManual = job.trigger === undefined || job.trigger === null;
+		let bundleBinding = null;
+		const bundleFound = await Promise.resolve()
+			.then(() => findSecretBundle(job, { project: pickupProject }))
+			.catch(() => ({ unreadable: "read-error", transient: true }));
+		if (bundleFound?.unreadable !== undefined) {
+			// Never a good read in this process, and the job has a project: which bundle it would hold is unknown. RETRIED,
+			// never refused (a refused webhook delivery is gone, and the fix is the operator's next save) and never run
+			// without (the silent no-op). A chained or manual job could hold none whatever the file says, so it runs.
+			if (!bundleChained && !bundleManual) {
+				// The errno or our own word (`invalid`), never a path or file text.
+				log("secret_bundles_unreadable", { kind: job.kind ?? null, why: String(bundleFound.unreadable).slice(0, 40) });
+				throw new InfraRetry("the triggers file's secretBundles could not be read, and has not been in this process", { reason: "container-never-started", provider: job.provider ?? null, model: job.model ?? null });
+			}
+		} else if (bundleFound && bundleFound.none !== true) {
+			if (bundleChained) bundleFacts.bundleSkipped = "chained";
+			else if (bundleManual) bundleFacts.bundleSkipped = "manual";
+			else if (bundleFound.triggerChanged === true) {
+				await comment(job, BUNDLE_COMMENTS["secret-bundle-trigger-changed"]);
+				log("refused_secret_bundle_trigger_changed", { kind: job.kind ?? null, bundle: bundleFound.id });
+				return { outcome: "policy", reason: "secret-bundle-trigger-changed", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+			} else if (bundleFound.optedOut === true) bundleFacts.bundleSkipped = "opted-out";
+			else {
+				if (job.resume === true) {
+					await comment(job, BUNDLE_COMMENTS["secret-bundle-resume"]);
+					log("refused_secret_bundle_resume", { kind: job.kind ?? null, bundle: bundleFound.id });
+					return { outcome: "policy", reason: "secret-bundle-resume", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+				}
+				const looked = secretBundles.lookup(bundleFound.bundle.profile);
+				if (looked?.ok !== true && bundleProfileDeferrable === true) {
+					// A multi-host worker's SHARED queue: another host may declare the profile, and routing does not steer a
+					// bundled job there (DES-PROJECT-SECRET-BUNDLES says why). So this host does not refuse a job it merely
+					// cannot serve: it hands it back, the never-fits gate's deferral, without spending an attempt.
+					log("secret_bundle_profile_deferred", { kind: job.kind ?? null, bundle: bundleFound.id, profile: bundleFound.bundle.profile, ambiguous: looked?.ambiguous !== undefined });
+					throw new SecretBundleProfileHold("this host cannot serve the job's secret bundle profile; another host may", { reason: looked?.ambiguous !== undefined ? "secret-bundle-profile-ambiguous" : "secret-bundle-profile-unknown", provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false });
+				}
+				if (looked?.ok !== true) {
+					// The profile LABEL in the log only, and the bundle id: both operator config. The comment names neither,
+					// the run.secrets refusals' restraint (the declared names would publish the operator's vault topology).
+					const reason = looked?.ambiguous !== undefined ? "secret-bundle-profile-ambiguous" : "secret-bundle-profile-unknown";
+					await comment(job, BUNDLE_COMMENTS[reason]);
+					log(reason === "secret-bundle-profile-ambiguous" ? "refused_secret_bundle_profile_ambiguous" : "refused_secret_bundle_profile_unknown", { kind: job.kind ?? null, bundle: bundleFound.id, profile: bundleFound.bundle.profile });
+					return { outcome: "policy", reason, exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+				}
+				// Issue #704 part 3: no venue refusal here any more. Part 2 refused a bundled job on both OpenShell venues at
+				// this point, which was AHEAD of the fork check, so a fork's job that would have run without the bundle was
+				// refused for it. The venue's own judgement of the bundle (`bundleGate`) now runs inside the read below,
+				// which a fork's job never reaches.
+				bundleBinding = { id: bundleFound.id, ...bundleFound.bundle };
+			}
+		}
+
 		// REQ-TRIGGER-SECRETS. A trigger that named secret references the worker cannot resolve would run its
 		// flow with those variables UNSET, get a 401 from whatever it was meant to reach, write a plausible
 		// report about why the integration is down, and exit 0.
@@ -1070,10 +1729,11 @@ export async function runJob(job, deps) {
 		// carry `secrets` the current set would refuse, and buildContainerEnv would write every one of them.
 		// The same set the loader uses, imported, so the two cannot drift, and checked before the resolver so
 		// no wiring of it can skip the check.
-		const loadReserved = secretsArmed(job) ? Object.keys(job.secrets ?? {}).find((name) => RESERVED_ENV_NAMES.has(name)) : undefined;
-		const resolved = loadReserved !== undefined ? { reserved: loadReserved, atLoad: true } : secretsArmed(job) ? await resolveSecrets(job) : { ok: true, secrets: {} };
+		const secondaryCredentialNames = new Set(job.answerDraft && job.answerDecisionModel ? providerKeyCandidates(job.answerDecisionModel.provider) : job.questionGrouping && job.questionGroupModel ? providerKeyCandidates(job.questionGroupModel.provider) : job.watch && job.watchDecisionModel ? providerKeyCandidates(job.watchDecisionModel.provider) : []);
+		const loadReserved = secretsArmed(job) ? Object.keys(job.secrets ?? {}).find((name) => RESERVED_ENV_NAMES.has(name) || secondaryCredentialNames.has(name)) : undefined;
+		const resolved = loadReserved !== undefined ? { reserved: loadReserved, atLoad: RESERVED_ENV_NAMES.has(loadReserved) } : secretsArmed(job) ? await resolveSecrets(job) : { ok: true, secrets: {} };
 		if (resolved.profileUnknown) {
-			await comment(job, "Refused: this trigger set `run.secrets`, and the resolver profile it names is not usable on this worker host. No profile of that name is declared, or its resolver is absent or not executable. The job would have started with those variables unset, and an agent that gets a 401 writes a plausible report and exits 0. Run `pi-dispatch doctor` on the worker to see which profiles it has. Not run.");
+			await comment(job, REFUSAL_COMMENTS["secret-profile-unknown"]);
 			// The operator's own profile LABEL, and never a path, a reference, or a byte the resolver printed.
 			// `comment` posts publicly on the issue: a resolver path there publishes the operator's filesystem
 			// layout, and the DECLARED profile names would publish their vault topology -- which is why the
@@ -1090,7 +1750,7 @@ export async function runJob(job, deps) {
 			// anywhere -- redirect a profile the operator wrote in .env. This project already refuses ambiguity
 			// rather than resolving it (PI_EGRESS: "a typo must never leave you believing you have a policy you
 			// do not"), and an operator who sees this fixes it in seconds.
-			await comment(job, "Refused: this trigger set `run.secrets`, and the resolver profile it names is declared twice on this worker host, once in the environment and once in the settings overlay. Neither wins, on purpose: the job would otherwise run against whichever one happened to be picked. Remove one of the two. Not run.");
+			await comment(job, REFUSAL_COMMENTS["secret-profile-ambiguous"]);
 			log("refused_secret_profile_ambiguous", { kind: job.kind ?? null, profile: resolved.ambiguous });
 			return { outcome: "policy", reason: "secret-profile-ambiguous", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
 		}
@@ -1147,7 +1807,136 @@ export async function runJob(job, deps) {
 			log("secret_resolver_unreachable", { kind: job.kind ?? null, name: resolved.unreachable, failure: resolved.failure ?? null, code: resolved.code ?? null, stderrBytes: resolved.stderrBytes ?? 0 });
 			throw new InfraRetry(`secret resolver could not answer for ${resolved.unreachable}`, { reason: "secret-resolver-unreachable", provider: job.provider ?? null, model: job.model ?? null });
 		}
-		const secrets = resolved.secrets ?? {};
+		// `let`: a project bundle's variables join it after the mint (below), under the trigger's own values.
+		let secrets = resolved.secrets ?? {};
+		// Issue #704 part 3: the bundle's `{ endpoints, plain }` split, for the venue (null: no bundle reached this job).
+		let bundleKeys = null;
+
+		// Issue #704 part 3: the venue's answer, the same handling for both of its asks below. A refusal RETURNS with the
+		// venue's fixed sentence (its log names the variable and host, never the comment); a source it could not read
+		// RETRIES, as the observation preflight's does.
+		// The hosts this job's OWN credentials are sent to beyond the forge's (issue #704 part 3, review round 1, H2), which a
+		// bundle endpoint may not claim on a venue that binds one provider per host: the composed `baseUrl` of every model
+		// the job may call (the overlay's models.json over pi's catalog, `outputCapView`, the composition the output cap and
+		// the zero-rated check read), every declared model endpoint's host (keyed or not: the simple rule), and every
+		// HTTP MCP server's host (its headers may carry a run.secrets value). A model whose baseUrl cannot be composed adds
+		// nothing, and is said so in DES-OPENSHELL-VENUE.
+		const credentialHosts = () => {
+			const hosts = new Set();
+			const add = (url) => {
+				try {
+					if (typeof url === "string" && url !== "") hosts.add(new URL(url).hostname.toLowerCase());
+				} catch {}
+			};
+			for (const ref of callableModelRefs(job)) {
+				if (ref === null) continue;
+				try {
+					add(outputCapView({ models: modelEndpoints?.models ?? null, provider: ref.provider, modelId: ref.id, builtinModel })?.baseUrl);
+				} catch {}
+			}
+			for (const ep of modelEndpoints?.endpoints ?? []) if (typeof ep?.host === "string") hosts.add(ep.host.toLowerCase());
+			for (const server of Object.values(mcpChecked?.document?.servers ?? {})) add(server?.url);
+			return [...hosts].sort();
+		};
+		const askBundleGate = async (ask) => {
+			const judged = await bundleGate(job, { ...ask, credentialHosts: credentialHosts(), capabilities: img.capabilities ?? [] });
+			if (judged?.venueRefused && typeof judged.venueRefused.reason === "string") {
+				const { reason, comment: text } = judged.venueRefused;
+				await comment(job, typeof text === "string" && text !== "" ? text : VENUE_BUNDLE_REFUSED_COMMENT);
+				log("refused_venue", { reason, bundle: bundleBinding.id });
+				return { refused: { outcome: "policy", reason, exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false } }; // return => not retried
+			}
+			if (judged?.unavailable) throw new InfraRetry("the job's venue could not judge its secret bundle", { reason: "container-never-started", provider: job.provider ?? null, model: job.model ?? null });
+			return { judged };
+		};
+		// PROJECT SECRET BUNDLES, the read (issue #704). ONE resolver call, then the strict parse, the reserved names and
+		// the merge. BEFORE the mint for every job that needs no fork check (CONST-BUDGET-BEFORE-TOKENS: its determinate
+		// refusals spend nothing, not even a token), and right after the mint for a pull request whose head must be asked
+		// of the forge first; either way before branch protection, the clone, the token-cap read and every reserve.
+		// Returns null, or the result to return.
+		const readBundle = async () => {
+			if (bundleBinding === null) return null;
+			// Issue #704 part 3: the hosts first, before the resolver runs, so a file naming a host this job's venue cannot
+			// bind costs no read of the operator's manager. Here rather than among the free gates above (where part 2
+			// refused every OpenShell bundle), because only here is the fork check behind it: a fork's job runs without
+			// the bundle, so nothing about the bundle may refuse it.
+			const endpoints = bundleBinding.endpoints ?? {};
+			if (Object.keys(endpoints).length > 0) {
+				const pre = await askBundleGate({ endpoints, vars: null });
+				if (pre.refused) return pre.refused;
+			}
+			const bundleRead = await secretBundles.resolve(job, bundleBinding);
+			if (bundleRead?.ok !== true) {
+				if (bundleRead?.unreachable) {
+					// INDETERMINATE (exit 1, an unknown exit, a spawn fault, a timeout): retried, the run.secrets rule. A
+					// rate-limited manager read lands here, which is why its documented resolvers exit 1 for one.
+					log("secret_bundle_resolver_unreachable", { kind: job.kind ?? null, bundle: bundleBinding.id, failure: bundleRead.failure ?? null, code: bundleRead.code ?? null, stderrBytes: bundleRead.stderrBytes ?? 0 });
+					throw new InfraRetry(`the secret bundle's resolver could not answer for bundle ${bundleBinding.id}`, { reason: "secret-resolver-unreachable", provider: job.provider ?? null, model: job.model ?? null });
+				}
+				if (bundleRead?.reserved !== undefined) {
+					// The variable NAME, in the log, so the operator can rename it in their manager. Not in the public
+					// comment: a bundle's names are the contents of the operator's manager, not of the reviewed file.
+					await comment(job, BUNDLE_COMMENTS["secret-name-reserved"]);
+					log("refused_secret_bundle_name_reserved", { kind: job.kind ?? null, bundle: bundleBinding.id, name: bundleRead.reserved });
+					return { outcome: "policy", reason: "secret-name-reserved", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+				}
+				if (bundleRead?.profileUnknown !== undefined || bundleRead?.ambiguous !== undefined) {
+					// Only if the declarations changed between the lookup above and this read: refused as there.
+					const reason = bundleRead.ambiguous !== undefined ? "secret-bundle-profile-ambiguous" : "secret-bundle-profile-unknown";
+					await comment(job, BUNDLE_COMMENTS[reason]);
+					log(reason === "secret-bundle-profile-ambiguous" ? "refused_secret_bundle_profile_ambiguous" : "refused_secret_bundle_profile_unknown", { kind: job.kind ?? null, bundle: bundleBinding.id, profile: bundleBinding.profile });
+					return { outcome: "policy", reason, exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+				}
+				// DETERMINATE: exit 2, an empty, oversized or malformed output, a bad name or value. `name` and `line`
+				// ride the log only, for the reason above; the comment says which rule, in our words.
+				const why = BUNDLE_FAILURES[bundleRead?.failure] ?? "did not return a usable environment";
+				await comment(job, `Refused: this job's project has a secret bundle, and its resolver ${why}. The job would have started without the project's environment, and an agent that gets a 401 writes a plausible report and exits 0. Run the bundle's resolver by hand against its reference to see why: this comment carries neither the reference, nor the resolver's path, nor a byte of what it printed. Not run.`);
+				log("refused_secret_bundle_unresolved", { kind: job.kind ?? null, bundle: bundleBinding.id, failure: bundleRead?.failure ?? null, name: bundleRead?.name ?? null, line: bundleRead?.line ?? null, code: bundleRead?.code ?? null, stderrBytes: bundleRead?.stderrBytes ?? 0 });
+				return { outcome: "policy", reason: "secret-unresolved", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+			}
+			// THE MERGE: the trigger's own run.secrets win a clash (secret-bundles.mjs `mergeBundleSecrets`), and the
+			// shadowed names are recorded. The values join `secrets`, so every path that already treats a run.secrets
+			// value as a secret treats these alike: buildContainerEnv injects them, the redaction covers every
+			// non-NON_SECRET_ENV_KEYS name (run-container.mjs), and a checkpoint refuses to store any of them.
+			const merged = mergeBundleSecrets(bundleRead.vars, secrets);
+			// Issue #704 part 3: which received variables the bundle binds to a host (`endpoints`) and which go in plain; a
+			// variable a run.secrets value shadowed is in neither unless `endpoints` names it (below). Said to every
+			// venue (`bundleKeys` on the call bag); only a venue whose layer holds credentials reads it, and it judges the
+			// split first, now with the values (`bundleGate`): a value its gateway would refuse is a refusal here, before
+			// spend, never a create that fails as infrastructure and is retried into the same answer.
+			const received = Object.fromEntries(Object.entries(bundleRead.vars).filter(([name]) => !merged.shadowed.includes(name)));
+			const post = await askBundleGate({ endpoints, vars: received, shadowed: merged.shadowed });
+			if (post.refused) return post.refused;
+			// Review round 1, M2: a declared endpoint name a run.secrets value shadowed stays on that host's provider, now with
+			// the trigger's value (the one that wins), so it resolves at the host the reviewed file binds the name to.
+			bundleKeys = {
+				endpoints: Object.fromEntries([...Object.keys(received), ...merged.shadowed].filter((name) => Object.hasOwn(endpoints, name)).map((name) => [name, endpoints[name]])),
+				plain: Object.keys(received).filter((name) => !Object.hasOwn(endpoints, name)).sort(),
+			};
+			secrets = merged.secrets;
+			bundleFacts.bundle = { id: bundleBinding.id, variables: Object.keys(bundleRead.vars).sort(), shadowed: merged.shadowed };
+			// On a venue whose own layer holds the credentials, the record says how many reached the agent as placeholders
+			// and how many as values (INT-RUN-HISTORY-FILE-CONTRACT), the venue's own counts.
+			if (backendFor(resolveBackendName(job, blessedBackends[0]))?.credentialCustody === "layer" && Number.isSafeInteger(post.judged?.placeholders) && Number.isSafeInteger(post.judged?.plain)) {
+				bundleFacts.bundle.placeholders = post.judged.placeholders;
+				bundleFacts.bundle.plain = post.judged.plain;
+				bundleFacts.bundle.placeholderNames = post.judged.placeholderNames;
+			}
+			log("secret_bundle_applied", { kind: job.kind ?? null, bundle: bundleBinding.id, count: bundleFacts.bundle.variables.length, shadowed: merged.shadowed.length });
+			return null;
+		};
+		const bundleHeadCheck = bundleBinding !== null && job.target?.type === "pull_request" && bundleBinding.forkReviews !== true;
+		if (bundleBinding !== null && !bundleHeadCheck) {
+			const refused = await readBundle();
+			if (refused !== null) return refused;
+		}
+
+
+		const secondaryCollision = Object.keys(secrets ?? {}).find(name => secondaryCredentialNames.has(name));
+		if (secondaryCollision !== undefined) {
+			log("refused_watch_provider_credential_override", { name: secondaryCollision });
+			return { outcome: "policy", reason: "secret-name-reserved", budgetReserved: false, provider: job.provider ?? null, model: job.model ?? null };
+		}
 
 		if (wantsForgeToken) {
 			token = await mintToken(job);
@@ -1161,12 +1950,59 @@ export async function runJob(job, deps) {
 			}
 		}
 
+		// PROJECT SECRET BUNDLES, the fork check (issue #704). AFTER the mint, because it needs the job's own token, and
+		// BEFORE branch protection, the clone, the token-cap read and every reserve, so a refusal of the read that follows
+		// still spends nothing but the minted token (CONST-BUDGET-BEFORE-TOKENS: every free refusal stays above the mint,
+		// and so does the read of every job that needs no fork check). A refusal past the mint leaves that token to
+		// expire, exactly as the unprotected-branch refusal below does: it is scoped to this job's repository and
+		// short-lived (CONST-TOKEN-SCOPED-PER-JOB), and no path in this project revokes one, so this adds no second rule.
+		//
+		// A job on a pull request whose head lives in another repository reads a stranger's text (CONST-TRIGGER-AUTHOR-GATE
+		// admits a collaborator's review of a fork), and must not hold every project secret while it does, so it runs
+		// WITHOUT the bundle (`bundleSkipped: "fork"`) unless the bundle opted in with `forkReviews: true`. Answered by the
+		// forge's own `resolvePullRequestHead`, the seam run.resume's fork gate already uses: the head repository must
+		// EQUAL the job's, case-insensitively on GitHub and Forgejo, whose repository names are (GitLab and Azure answer by
+		// project or repository id and report the job's own name back, so their comparison is exact). A webhook's
+		// `head.repo` is attacker-supplied, and an `issue_comment` on a pull request carries no head at all, so the
+		// payload cannot answer. A DETERMINATE forge answer (401, 403, 404: the token cannot see the pull request, or it
+		// is gone) cannot become a yes by retrying, so the job runs without the bundle (`bundleSkipped:
+		// "head-unverified"`); a network fault, a 5xx or a timeout RETRIES (InfraRetry), so a blip neither grants a bundle
+		// nor drops one.
+		if (bundleHeadCheck) {
+			let head = null;
+			let unverified = false;
+			if (typeof resolvePullRequestHead === "function") {
+				try {
+					head = (await resolvePullRequestHead(job, token)) ?? {};
+				} catch (error) {
+					const status = headReadStatus(error);
+					// A GitHub rate limit answers 403 (or 429) with `x-ratelimit-remaining: 0` or a `retry-after`: not a
+					// determinate "you cannot see this pull request", so it RETRIES like any other transient answer.
+					const rateLimited = headReadRateLimited(error);
+					log("secret_bundle_head_unreadable", { kind: job.kind ?? null, status, rateLimited });
+					if (rateLimited || (status !== 401 && status !== 403 && status !== 404)) throw new InfraRetry("the pull request's head could not be read to decide whether it is a fork", { reason: "container-never-started", provider: job.provider ?? null, model: job.model ?? null });
+					unverified = true;
+				}
+			}
+			const fold = job.kind === "github" || job.kind === "forgejo" ? (v) => v.toLowerCase() : (v) => v;
+			const same = !unverified && typeof head?.headRepo === "string" && typeof job.repo === "string" && fold(head.headRepo) === fold(job.repo);
+			if (!same) {
+				bundleFacts.bundleSkipped = unverified ? "head-unverified" : "fork";
+				log("secret_bundle_skipped", { kind: job.kind ?? null, bundle: bundleBinding.id, reason: bundleFacts.bundleSkipped });
+				bundleBinding = null;
+			}
+		}
+		if (bundleHeadCheck) {
+			const refused = await readBundle();
+			if (refused !== null) return refused;
+		}
+
 		if (isForgeBacked) {
 			// REQ-BRANCH-PROTECTION-PRECONDITION. The agent's token can merge, so branch protection is the
 			// only technical barrier to a self-merge. Refuse before spending anything. Forge-backed jobs
 			// only: a local job has no remote branch to protect.
 			if (!(await isDefaultBranchProtected(job, token))) {
-				await comment(job, "Refused: the default branch is not protected. See SECURITY.md.");
+				await comment(job, REFUSAL_COMMENTS["unprotected-branch"]);
 				log("refused_unprotected", { repo: job.repo });
 				// exitCode/turns/tokens null: refused pre-container, so no container exit, turn, or token count exists.
 				return { outcome: "policy", reason: "unprotected-branch", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
@@ -1176,7 +2012,10 @@ export async function runJob(job, deps) {
 		// `podmanStore` (issue #429) only where the venue's job user carried one: the podman store the container ran in.
 		// `portfolio` (issue #505) only for a job the gate above confirmed: prepare then writes /job/portfolio.json, after
 		// asking the live file once more. Absent otherwise, so every other job's prepare call is unchanged.
-		prepared = await prepareWorkspace(job, token, { piVersion, jobUser: { user: jobUser?.user ?? null, home: jobUser?.home ?? null }, ...(typeof jobUser?.store === "string" ? { podmanStore: jobUser.store } : {}), ...(portfolio ? { portfolio: true } : {}), ...(jobSize ? { size: jobSize } : {}), ...(mcpChecked.document ? { mcp: mcpChecked.document } : {}) }); // resolves SHA, clones, materialises .pi/, writes prompt
+		// The existing read-only event file carries accepted human text. Environment/exec metadata stays id-only,
+		// including on gateways that log their exec argv. Keep the queued command for the operator's forge trail.
+		const stagedJob = job.approvalDecision ? { ...job, trigger: { ...job.trigger, comment: { ...job.trigger?.comment, body: job.approvalDecision.text ?? "" } } } : job;
+		prepared = await prepareWorkspace(stagedJob, token, { piVersion, jobUser: { user: jobUser?.user ?? null, home: jobUser?.home ?? null }, ...(typeof jobUser?.store === "string" ? { podmanStore: jobUser.store } : {}), ...(portfolio ? { portfolio: true } : {}), ...(jobSize ? { size: jobSize } : {}), ...(mcpChecked.document ? { mcp: mcpChecked.document } : {}), ...(job.watch ? { watchSecrets: secrets } : {}), ...(isRecovery ? { pin: { sha: manifest.workspace.baseSha, from: workspaceCheckpointer.baseSourceUrl(runId) } } : forkSource ? { pin: { sha: forkSource.manifest.baseSha, from: forkStore.baseSourceUrl(job.fork.fromJob) } } : {}) }); // resolves SHA, clones, materialises .pi/, writes prompt
 
 		// A determinate prepare refusal -- sha-gone (the default branch advanced past the resolved tip),
 		// or a `pi-*` materialiser cap breach (the repo's .pi/ is too large to place in /job, issue #60)
@@ -1189,6 +2028,27 @@ export async function runJob(job, deps) {
 		if (prepared?.outcome === "policy") {
 			return { ...prepared, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false };
 		}
+		// Issue #796: the candidate goes under this job's own directory, before any reservation: a version that cannot be installed spends nothing. After the prepare, because that
+		// is what makes the directory, and on a forge job that is after the mint. The `finally` below removes the directory whichever way this goes.
+		if (canaryPlan) {
+			let installed;
+			try {
+				installed = await deps.packageCanary.install(job, prepared.jobDir, canaryPlan);
+			} catch {
+				throw new InfraRetry("the canary's candidate could not be installed", { reason: "container-never-started", budgetReserved: false, provider: job.provider ?? null, model: job.model ?? null });
+			}
+			if (installed.refused) {
+				log("refused_package_canary", { reason: installed.refused });
+				return { outcome: "policy", reason: installed.refused, exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false };
+			}
+			prepared = { ...prepared, packageCanary: installed };
+		}
+
+
+		if (deps.approvalRequest && (prepared.session?.key !== deps.approvalRequest.sessionKey || prepared.session?.resume !== true)) {
+			await comment(job, APPROVAL_COMMENTS["approval-session-unavailable"]);
+			return { outcome: "policy", reason: "approval-session-unavailable", exitCode: null, turns: null, tokens: null, budgetReserved: false };
+		}
 
 		// THE RESOLVED FOLDER'S PROJECT (issue #504 part B). The pickup decided the project, and so the share a job reserves
 		// against, from the folder AS NAMED; the container mounts the folder prepare RESOLVED. A link or a case variant
@@ -1196,15 +2056,115 @@ export async function runJob(job, deps) {
 		// Refused here, after prepare and before the token-cap read and every reserve: free, determinate, never retried. A
 		// resolved folder in no project is not refused, because the named spelling is the operator's own membership
 		// (a symlinked member is listed by the path the triggers use, docs/projects.md).
-		if (job.kind === "local" && typeof folderProject === "function" && typeof prepared?.workspace === "string") {
+		if (job.kind === "local" && !job.questionGrouping && typeof folderProject === "function" && typeof prepared?.workspace === "string") {
 			const resolvedProject = folderProject(prepared.workspace);
 			if (resolvedProject !== null && resolvedProject !== pickupProject) {
-				await comment(job, "Refused: this job's folder now leads into another project's folder, so no container was started and nothing was spent. Not run.");
+				await comment(job, REFUSAL_COMMENTS["local-folder-project-changed"]);
 				log("refused_local_folder_project_changed", { pickup: pickupProject, resolved: resolvedProject });
 				return { outcome: "policy", reason: LOCAL_FOLDER_PROJECT_CHANGED, exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
 			}
 		}
 
+		// The archive's base is copied before agent-written git state exists. Never mount the archive itself.
+		if (forkStore && sourceRunId && (job.resume === true || job.fork !== undefined) && sessionKeyFor(job) && prepared.sha && !isRecovery) {
+			let primed;
+			try { primed = await forkStore.primeBase({ runId: sourceRunId, workspace: prepared.workspace, baseSha: prepared.sha }); } catch { primed = { refused: "fork-source-unavailable" }; }
+			sourcePrimed = primed?.ok === true;
+			archiveFacts.value = forkArchiveFact({ reason: sourcePrimed ? "not-completed" : primed?.refused ?? primed?.skipped });
+			if (!sourcePrimed) log("fork_source_skipped", { reason: primed?.refused ?? primed?.skipped ?? "base-unavailable" });
+		}
+		// Issue #645: A BASE WITH `.pi/extensions/` IS NOT RECOVERABLE. A merge-gated extension may import a file outside
+		// `.pi/` (`../lib/x.js`) or a bare package resolved from the workspace's `node_modules`, and in a recovered run
+		// those come from the restored tree, which the agent wrote. The trust reset puts `.pi/` back but cannot enumerate
+		// what an extension imports, so the only sound answer is not to recover such a run at all. Decided here, at arm
+		// time, from the fresh clone's own `.git` (the worker's, before any container), so the run is simply not armed:
+		// no ledger claim, no checkpoints, no pointer, and it runs exactly as it did before #645, the record saying
+		// `recoverSkipped: "workspace-extensions"`. A base that could not be read is not armed either, fail closed, and
+		// says `base-unprimed`. The recovery side asks again before it restores (defence in depth).
+		if (armed && !isRecovery) {
+			let unsafe;
+			try {
+				unsafe = await baseHasExtensions({ workspace: prepared.workspace, baseSha: prepared.sha });
+			} catch {
+				unsafe = null;
+			}
+			if (unsafe !== false) {
+				armed = false;
+				durable.armed = false;
+				durable.recoverSkipped = unsafe === true ? "workspace-extensions" : "base-unprimed";
+				log("recover_not_armed", { reason: durable.recoverSkipped });
+			}
+		}
+
+		// Issue #645: A RECOVERY JOB'S WORKSPACE. The preparer cloned the checkpoint's base commit from the checkpoint store
+		// (`pin`), so the checkout is exactly the tree the checkpoint is a diff against; the restore applies the crashed
+		// run's work on top. All of it local and free, before the token-cap read and every reserve.
+		if (isRecovery) {
+			const baseSha = manifest.workspace.baseSha;
+			// The arm-time rule, again, on the base the store just handed over: a checkpoint of such a base can only exist
+			// from a worker that armed it before this rule, and is refused rather than restored. Unreadable: retried.
+			let unsafe;
+			try {
+				unsafe = await baseHasExtensions({ workspace: prepared.workspace, baseSha });
+			} catch {
+				unsafe = null;
+			}
+			if (unsafe === true) {
+				await comment(job, RECOVERY_COMMENTS["recovery-unsafe-extensions"]);
+				log("refused_recovery_unsafe_extensions", { n: durable.recovery });
+				return { outcome: "policy", reason: "recovery-unsafe-extensions", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+			}
+			if (unsafe !== false) throw new InfraRetry("whether the recovered base holds .pi/extensions could not be read", { reason: "container-never-started", provider: job.provider ?? null, model: job.model ?? null });
+			const restored = await workspaceCheckpointer.restore({ runId, manifest, intoWorkspace: prepared.workspace });
+			if (restored?.refused) {
+				// Determinate: the store refused its own checkpoint (tampered, another run's, a base that does not match).
+				await comment(job, RECOVERY_COMMENTS["recovery-checkpoint-absent"]);
+				log("refused_recovery_checkpoint_absent", { n: durable.recovery, why: "restore-refused", detail: String(restored.refused).slice(0, 40) });
+				return { outcome: "policy", reason: "recovery-checkpoint-absent", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
+			}
+			if (!restored || restored.skipped || !Number.isSafeInteger(restored.written)) {
+				log("recovery_restore_skipped", { reason: typeof restored?.skipped === "string" ? restored.skipped.slice(0, 40) : "error" });
+				throw new InfraRetry("the checkpoint could not be restored", { reason: "container-never-started", provider: job.provider ?? null, model: job.model ?? null });
+			}
+			// THE TRUST PATHS: what pi loads as the repository's own code and instructions (`.pi/`, `.agents/`, the root
+			// AGENTS/CLAUDE files) goes back to the base commit's content, since the restored tree was written by the agent.
+			// A reset that failed means the recovery would start on the agent's configuration, so it does not start.
+			try {
+				await resetTrustPaths({ workspace: prepared.workspace, baseSha });
+			} catch (error) {
+				log("recovery_trust_reset_failed", { code: typeof error?.code === "string" ? error.code : "error" });
+				throw new InfraRetry("the recovered workspace's trust paths could not be reset", { reason: "container-never-started", provider: job.provider ?? null, model: job.model ?? null });
+			}
+			// THE CONVERSATION: the checkpoint's transcript, staged where every job's transcript file is. A resume job's is a
+			// session with its key (promoted on completion as before); any other job's is its live file.
+			const staged = typeof stageRecovered === "function" ? await stageRecovered({ jobDir: prepared.jobDir, transcriptPath, piVersion, job, resolved: prepared.recoveryResolved ?? {} }) : null;
+			if (!staged || typeof staged.hostDir !== "string") {
+				throw new InfraRetry("the checkpoint's transcript could not be staged", { reason: "container-never-started", provider: job.provider ?? null, model: job.model ?? null });
+			}
+			prepared = staged.key ? { ...prepared, session: staged } : { ...prepared, live: { hostDir: staged.hostDir } };
+			durable.recovered = { from: manifest.kind, n: durable.recovery, fromAttempt: manifest.attempt, checkpointSeq: manifest.seq, orphans: null, replayed: null, interrupted: null, notStarted: null };
+		}
+
+		if (forkSource) {
+			const baseSha = forkSource.manifest.baseSha;
+			const unsafe = await baseHasExtensions({ workspace: prepared.workspace, baseSha });
+			if (unsafe === true) return await forkRefusal("fork-unsafe-extensions");
+			if (unsafe !== false) throw new InfraRetry("the fork base could not be inspected", { reason: "container-never-started", budgetReserved: false });
+			const restored = await forkStore.restorePoint({ runId: job.fork.fromJob, sourceDigest: job.fork.sourceDigest, entryId: job.fork.fromEntry, position: job.fork.position, intoWorkspace: prepared.workspace });
+			if (restored?.unavailable || restored?.skipped) throw new InfraRetry("the fork workspace could not be restored just now", { reason: "container-never-started", budgetReserved: false });
+			if (!restored?.ok) return await forkRefusal(restored?.refused ?? "fork-workspace-unavailable");
+			await resetTrustPaths({ workspace: prepared.workspace, baseSha });
+			const staged = await stageRecovered?.({ jobDir: prepared.jobDir, transcriptPath: forkSource.transcriptPath, piVersion, job: { ...job, resume: true } });
+			if (!staged?.key) throw new InfraRetry("the fork transcript could not be staged", { reason: "container-never-started", budgetReserved: false });
+			prepared = { ...prepared, session: staged };
+			await comment(job, `Fork of run \`${job.fork.fromJob}\`, ${job.fork.position} entry \`${job.fork.fromEntry}\`, using \`${job.provider}/${job.model}\` on \`${forkBranch(job)}\`. The original attempt is preserved.`);
+		}
+		try { await (deps.stageModelRoleInputs ?? stageModelRoleInputs)(job, prepared); } catch (error) {
+			if (!error?.piDispatchConfig) throw new InfraRetry("the trusted agent snapshot could not be staged", { reason: "container-never-started", provider: job.provider, model: job.model, budgetReserved: false });
+			log("refused_model_agents_invalid", {});
+			await comment(job, MODEL_AGENTS_INVALID_COMMENT);
+			return { outcome: "policy", reason: "model-agents-invalid", exitCode: null, turns: null, tokens: null, provider: job.provider, model: job.model, budgetReserved: false };
+		}
 		// Daily TOKEN cap (issue #25): the deliberate check-AFTER control. Token cost is only known
 		// post-run, so this cannot check-and-increment before the spend the way the job-count cap does
 		// (CONST-BUDGET-BEFORE-TOKENS). It is a read-only GET of prior jobs' recorded spend -- it consumes
@@ -1235,10 +2195,23 @@ export async function runJob(job, deps) {
 		// ledger's day counted, an EXPIRE that faults leaves its key without a TTL): `reserveBudget` does not say which of
 		// its windows landed, so giving them back could DECR a window that never rose. That is the pre-existing
 		// mid-reserve posture of one ledger, unchanged.
+		// Issue #645: an armed run's job-count slot is the RUN's, claimed once in its budget ledger. "new": this attempt
+		// reserves the ledgers below, exactly as every job did before. "carried": an earlier attempt (a retry's first try,
+		// or the attempt a recovery continues) reserved it and is still counted in it, so nothing is reserved again. A
+		// ledger that did not answer leaves the question open, so nothing is reserved and the attempt is retried.
+		if (armed) {
+			const claim = await runBudgetLedger.claimSlot(runId);
+			if (claim !== "new" && claim !== "carried") {
+				log("run_budget_claim_failed", { code: typeof claim?.error === "string" ? claim.error : "unknown" });
+				throw new InfraRetry("the run's budget ledger could not be read", { reason: "container-never-started", provider: job.provider ?? null, model: job.model ?? null });
+			}
+			slotCarried = claim === "carried";
+			slotOwnedByRun = true;
+		}
 		globalLedger = { scope: null, keyPrefix: null, caps, softHoldPct, reason: null };
 		let counted;
 		try {
-			counted = await reserveLedgers(redis, [...(scopedLedgers ?? []), globalLedger], held, { now });
+			counted = slotCarried ? { allowed: true } : await reserveLedgers(redis, [...(scopedLedgers ?? []), globalLedger], held, { now });
 		} catch (error) {
 			// Valkey failed mid-walk. No container can have started, and `held` lists exactly the reservations that
 			// landed, so they go back (last first, never throwing) before the error escapes; otherwise a repo and a
@@ -1283,6 +2256,29 @@ export async function runJob(job, deps) {
 			return { outcome: "policy", reason: counted.refusedBy.reason, exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: false }; // return => not retried
 		}
 
+		// Issue #645: THIS CONTAINER'S NUMBER in the run (`nextSeq`: attempt 1 is 1, its retry 2, a recovery's container the
+		// next), which addresses its dollar hold in the run's ledger and names its checkpoints' attempt. Before the dollar
+		// reserve, because a hold is recorded under it: without a number there is no record, and without a record there is
+		// no hold. A recovery then settles AT THE FLOOR every hold of the run's earlier containers still `held`: those
+		// containers are dead (the base-still-running gate above holds this job until none of the run's is alive here),
+		// and their real spend is unknown, so the reservation already in every window is what they are charged
+		// (`settleCrashed`, bookkeeping only, no window key moves). A settle that failed is logged and the run goes on: the
+		// holds stay `held` and in the windows at the floor, which is the safe side, and nothing releases an earlier
+		// container's hold but that container itself.
+		if (armed) {
+			const seq = await runBudgetLedger.nextSeq(runId);
+			if (!Number.isSafeInteger(seq) || seq < 1) {
+				log("run_budget_seq_failed", { code: typeof seq?.error === "string" ? seq.error : "unknown" });
+				throw new InfraRetry("the run's container number could not be taken", { reason: "container-never-started", provider: job.provider ?? null, model: job.model ?? null });
+			}
+			durable.seq = seq;
+			if (isRecovery) {
+				const crashed = await runBudgetLedger.settleCrashed(runId, seq);
+				if (Array.isArray(crashed?.settled)) log("run_budget_settled_crashed", { holds: crashed.settled.length });
+				else log("run_budget_settle_crashed_failed", { code: typeof crashed?.error === "string" ? crashed.error : "unknown" });
+			}
+		}
+
 		// DOLLAR windows (issue #501, part 3), after EVERY job-count reserve and before the container: the last gate
 		// before the spend line (CONST-BUDGET-BEFORE-TOKENS). Every free gate and every job-count ledger come first, so
 		// a refusal anywhere above never touches a dollar counter. The amount is the job's per-job cost cap, which the
@@ -1310,7 +2306,7 @@ export async function runJob(job, deps) {
 			// job carried a non-null cap), so an image that would ignore the 0 never gets here. A cap that is ALREADY 0
 			// (a malformed queued value reads as 0, `effectiveCostCapMicros`) has nothing to reserve either.
 			const refs = callableModelRefs(job);
-			const zero = job.maxCostMicros === 0 ? { zeroRated: true } : zeroRatedVerdict({ models: modelEndpoints?.models ?? null, endpoints: modelEndpoints?.endpoints ?? [], refs, builtinModel });
+			const zero = zeroRatedFor(job, { modelEndpoints, builtinModel });
 			if (zero.zeroRated) {
 				containerJob = { ...job, maxCostMicros: 0 };
 				dollars = dollarsRecord({ reservedMicros: 0, settledMicros: 0, basis: "unreserved" });
@@ -1370,20 +2366,134 @@ export async function runJob(job, deps) {
 					return { outcome: "policy", reason: refusalReason, exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: globalHeld(), dollars: stranded ? dollarsRecord({ reservedMicros: job.maxCostMicros, settledMicros: job.maxCostMicros, basis: "floor", modelBasis }) : dollarsRecord({ reservedMicros: job.maxCostMicros, settledMicros: 0, basis: "refunded", modelBasis }) }; // return => not retried
 				}
 				dollarHold = reservation.hold;
-				dollars = dollarsRecord({ reservedMicros: job.maxCostMicros, settledMicros: job.maxCostMicros, basis: "floor", modelBasis: modelPrefixes.size > 0 ? "floor" : null });
+				publishDollarHold({ amountMicros: dollarHold.amountMicros, at: new Date(now).getTime() });
+				// Issue #761: every key holds the whole reservation until a settle or a release moves it, so every deployment
+				// window the hold reserved in holds what this record states (`deploymentWindowsOf`). Each later path below
+				// replaces `dollars`, with the windows that hold what IT states.
+				dollars = dollarsRecord({ reservedMicros: job.maxCostMicros, settledMicros: job.maxCostMicros, basis: "floor", modelBasis: modelPrefixes.size > 0 ? "floor" : null, reservedIn: deploymentWindowsOf(dollarHold, { applied: 0, target: job.maxCostMicros, recorded: job.maxCostMicros, valkey: valkeyTag }) });
+				// Issue #645: an armed run never runs a container without a DURABLE record of its hold (run-budget-ledger.mjs's
+				// contract), so a recovery after a crash can see it and settle it exactly once. A record that did not land
+				// throws a never-started retry before any container; the catch gives the hold back directly (`holdRecorded`
+				// false: no one else can see it to settle or release it).
+				if (armed) {
+					const rec = await runBudgetLedger.recordHold(runId, durable.seq, dollarHold);
+					if (rec?.ok !== true) {
+						log("run_budget_hold_unrecorded", { code: typeof rec?.error === "string" ? rec.error : "unknown" });
+						throw new InfraRetry("the run's dollar hold could not be recorded", { reason: "container-never-started", provider: job.provider ?? null, model: job.model ?? null });
+					}
+					holdRecorded = true;
+				}
 			}
 		}
 
+		// Issue #642: ONE trail comment says who answered from the operator console and quotes what (console-answer.mjs:
+		// mentions neutralised, no control byte). Posted HERE, after every pre-spend gate and every reserve has passed and
+		// just before the container starts, so the issue never reads "answered" above a refusal that then dropped the
+		// answer (a `not-parked`, a missing session store, a cap); and still before the provider is called, so it spends
+		// nothing (CONST-BUDGET-BEFORE-TOKENS). The `comment` adapter posts as the deployment's own identity, which the
+		// receiver's self-guard drops as `self`, so the trail never starts a job. A `console` field whose name is not a
+		// console token's (a hand-built queue entry; enqueueForgeJob refuses one) posts nothing.
+		//
+		// ONCE PER JOB, not once per attempt: a forge job has `attempts: 2`, so an InfraRetry after this point re-runs every
+		// gate and would reach here again, and a console retry of a failed answer job is the same job id again. The claim
+		// is `SET console:trail:<jobId> 1 NX PX CONSOLE_TRAIL_CLAIM_MS` (the retention of a forge job's data, so the claim
+		// outlives every way the same id can come back), and only the attempt that set it posts. On a Valkey error the trail
+		// is SKIPPED and logged, never posted blind: at most once is the promise, because a duplicate trail reads on the forge
+		// as a second answer, while a missing one leaves the answer in the job and the audit log. Never throws: the trail is
+		// provenance, and a failed claim is no reason to refuse a job every gate has admitted.
+		if (job.parkedReply === true && job.console !== undefined) {
+			const by = consoleAnswerBy(job.console);
+			if (by === null) log("console_answer_by_invalid", { kind: job.kind ?? null });
+			else if (await claimConsoleTrail(redis, job, log)) await comment(job, answerTrailComment(by, job.trigger?.comment?.body, job.console?.draftRunId));
+		}
+
 		// The user the gate above decided is the user that runs: one answer, never two call sites that agree.
 		// Issue #545: an image that declares `exitAuth` is handed a per-job key on stdin and signs its exit line with it, and
 		// then only a signed line is read (run-container.mjs, run-history.mjs `authenticExitLines`). An image that does not
 		// declare it is read as before, under the #542 trust rule below alone.
 		const exitAuth = (img.capabilities ?? []).includes(EXIT_AUTH_CAPABILITY);
-		const { code, aborted, abortReason, turns, tokens, session, usage, context, detached, exitReason, exitWhy = null, exitLineCode = null, exitAuth: exitAuthResult = null, exitOomKilled = false, memoryLimit = null, resources: ranResources = null } = await runContainer({ job: containerJob, token, prepared, secrets, user: jobUser?.user ?? null, home: jobUser?.home ?? null, relabel: jobUser?.relabel === true, ...(modelEndpoints?.endpoints?.length > 0 ? { modelEndpoints } : {}), ...(exitAuth ? { exitAuth: true } : {}), ...(jobSize ? { size: jobSize } : {}), ...(Number.isSafeInteger(jobUser?.hostCpus) ? { hostCpus: jobUser.hostCpus } : {}), ...(Number.isSafeInteger(cpuBudgetCenti) ? { cpuBudgetCenti } : {}), ...(Array.isArray(jobUser?.unenforced) && jobUser.unenforced.length > 0 ? { unenforced: jobUser.unenforced } : {}) });
+		// Issue #686: an image whose runner can mirror its transcript over stderr. Handed as a fact; runContainer arms it only
+		// on a venue that copies (`transcript: "stdio"`) and only beside a key, so every other run is called as before.
+		const transcriptStderr = (img.capabilities ?? []).includes(TRANSCRIPT_STDERR_CAPABILITY);
+		// Issue #686, part 2: an image whose runner reads steer frames on stdin. Handed as a fact, like the one above;
+		// runContainer arms it only for a steer job on a venue that copies, so every other run is called as before.
+		const steerStdin = (img.capabilities ?? []).includes(STEER_STDIN_CAPABILITY);
+		// Issue #645: a FRESH armed run seeds the checkpoint store from its clone, now, before the container: the one moment
+		// the workspace's `.git` is still the worker's own (workspace-checkpoint.mjs `primeBase`). After every reserve, so a
+		// refused job never writes to the store. A recovery's base is already there. A base that could not be primed means
+		// no checkpoint of this run can ever be restored: the run goes on unprotected and the record says so.
+		let checkpointArgs = null;
+		const baseSha = isRecovery ? manifest.workspace.baseSha : prepared.sha;
+		if (armed) {
+			if (!isRecovery) {
+				const objectFormat = typeof baseSha === "string" && baseSha.length === 64 ? "sha256" : "sha1";
+				let primed = null;
+				try {
+					primed = await workspaceCheckpointer.primeBase({ runId, workspace: prepared.workspace, baseSha, objectFormat });
+				} catch {
+					primed = null;
+				}
+				if (primed?.ok !== true) {
+					durable.recoverSkipped = "base-unprimed";
+					log("recover_base_unprimed", { reason: typeof primed?.skipped === "string" ? primed.skipped.slice(0, 40) : "error" });
+				}
+			}
+			// The live checkpointer's open arguments (run-checkpoint.mjs): the run, this container's number, the base, and
+			// the values a snapshot must refuse to store (the job's token and its resolved secrets). `attempt` IS the
+			// container number: unique across retries and recoveries, which a BullMQ attempt count is not. `meta` is what the
+			// manifest records and a recovery judges above: never a string the job chose.
+			const secretValues = [token, ...Object.values(secrets ?? {})].filter((v) => typeof v === "string" && v !== "");
+			checkpointArgs = { runId, attempt: durable.seq, baseSha, branch: null, secretValues, meta: { piVersion, imageDigest: img.imageDigest ?? null, venue: resolveBackendName(job, blessedBackends[0]), provider: job.provider ?? null, model: job.model ?? null } };
+		}
+		if (job.watch?.stage === "decision") await deps.watchRuntime?.started(job);
+		if (subscriptionAuth.length > 0 && !(await validateSubscriptionAuth(subscriptionAuth))) throw new InfraRetry("subscription binding changed before container start", { reason: "container-never-started", budgetReserved: true });
+		// Issue #800: the commit the repository's part of this run came from, beside the image's facts. Noted here, the last
+		// thing before the container, and not at the prepare above: a refusal between the two loaded nothing, so it has nothing
+		// to point at, and its record stays byte-identical to what it was. Every way out from here keeps it, a retried attempt's too.
+		if (deps.canaryFacts) deps.canaryFacts.loaded = loadedWithBase(deps.canaryFacts.loaded, baseSha);
+		const { canaryLoad: canaryLoadOfRun = null, loaded: loadedOfRun = null, code, aborted, abortReason, turns, tokens, session, usage, context, detached, exitReason, approval: approvalMetadata = null, exitWhy = null, exitLineCode = null, exitAuth: exitAuthResult = null, exitOomKilled = false, memoryLimit = null, resources: ranResources = null, progress: ranProgress = null, checkpoint: ranCheckpoint = null, recovery: ranRecovery = null, lingering = false } = await runContainer({ job: containerJob, token, prepared, secrets, ...(subscriptionAuth.length ? { subscriptionAuth } : {}), ...(bundleKeys !== null ? { bundleKeys } : {}), user: jobUser?.user ?? null, home: jobUser?.home ?? null, relabel: jobUser?.relabel === true, ...(modelEndpoints?.endpoints?.length > 0 ? { modelEndpoints } : {}), ...(exitAuth ? { exitAuth: true } : {}), ...(transcriptStderr ? { transcriptStderr: true } : {}), ...(steerStdin ? { steerStdin: true } : {}), ...(jobSize ? { size: jobSize } : {}), ...(Number.isSafeInteger(jobUser?.hostCpus) ? { hostCpus: jobUser.hostCpus } : {}), ...(Number.isSafeInteger(cpuBudgetCenti) ? { cpuBudgetCenti } : {}), ...(Array.isArray(jobUser?.unenforced) && jobUser.unenforced.length > 0 ? { unenforced: jobUser.unenforced } : {}), ...(checkpointArgs !== null ? { recover: true, recovering: isRecovery, checkpoint: checkpointArgs } : {}) });
+		const answeredPark = prepared.session?.parkedSource;
+		// A phrase-prefixed comment uses ordinary routing, but resuming this exact parked transcript still
+		// answers its question. A held receipt also identifies an answer whose legacy source cannot be proved.
+		if (!deps.approvalRequest && session?.resumed === true && (job.parkedReply === true || typeof job.trigger?.comment?.body === "string" && (answeredPark || Number.isSafeInteger(job.replyReceivedAt)))) {
+			if (answeredPark) {
+				const receivedAt = Number.isSafeInteger(deps.replyReceivedAt) ? deps.replyReceivedAt : now.getTime();
+				await deps.recordTouch({ runId: answeredPark.runId, cause: "question-answer", at: Math.max(answeredPark.at, receivedAt), receivedAt: Math.max(answeredPark.at, receivedAt), answerSource: job.console?.draftRunId ? "draft" : job.console?.by === "panel" ? "panel" : job.console ? "console" : "forge", ...(job.console?.draftRunId ? { draftRunId: job.console.draftRunId } : {}), parkedAt: answeredPark.at, scopeId: touchScopeOf(job, hostName), project: pickupProject ?? undefined, nonce: sourceRunId });
+			} else {
+				deps.recordTouchGap();
+				log("touch_lineage_unavailable", { reason: "source-unavailable" });
+			}
+		}
+
 		containerRan = true;
+		watchPolicyRefused = code === EXIT_POLICY;
+		watchUsage = Number.isFinite(tokens?.cost) && tokens.cost >= 0 ? { costUsd: tokens.cost } : null;
+		answerUsage = { tokens };
+		if (sourcePrimed && !lingering && !detached && !aborted && code === EXIT_COMPLETED) {
+			const rootKey = sessionKeyFor(job).split(".")[0];
+			const transcriptPath = join(prepared.session?.hostDir ?? prepared.live?.hostDir ?? join(prepared.jobDir, "session"), "current.jsonl");
+			let pointSkipped = null;
+			// Dead-container snapshots also make the completed boundary available without live recovery.
+			if (typeof forkStore.capturePoint === "function") {
+				try {
+					const captured = await forkStore.capturePoint({ runId: sourceRunId, workspace: prepared.workspace, baseSha: prepared.sha, quiesced: "dead", kind: "exit", attempt: durable.seq ?? 0, transcriptPath, offset: lstatSync(transcriptPath).size, secretValues: [token, ...Object.values(secrets ?? {})].filter((v) => typeof v === "string" && v !== ""), meta: { piVersion, venue: resolveBackendName(job, blessedBackends[0]), provider: job.provider ?? null, model: job.model ?? null } });
+					if (!captured?.ok) {
+						pointSkipped = captured?.refused ?? captured?.skipped ?? "checkpoint-unavailable";
+						log("fork_checkpoint_skipped", { reason: pointSkipped });
+					}
+				} catch { pointSkipped = "checkpoint-unavailable"; log("fork_checkpoint_skipped", { reason: "unavailable" }); }
+			}
+			let saved;
+			try { saved = forkStore.publish({ runId: sourceRunId, sessionKey: rootKey, transcriptPath: join(prepared.session?.hostDir ?? prepared.live?.hostDir ?? join(prepared.jobDir, "session"), "current.jsonl"), baseSha: prepared.sha, venue: resolveBackendName(job, blessedBackends[0]), piVersion, attempt: durable.seq ?? 0 }); } catch { saved = { refused: "fork-source-unavailable" }; }
+			archiveFacts.value = forkArchiveFact({ saved: saved?.ok === true, reason: saved?.refused, pointSkipped });
+			log("fork_source_saved", saved?.ok ? { saved: true } : { saved: false, reason: saved?.refused ?? "unavailable" });
+		}
 		// Issue #596: what the container used, off its exit line, rebuilt by the sink (null from a runContainer that predates
 		// the field). Every result and every throw below carries it, so a retried attempt's record says what it used too.
 		resources = ranResources ?? null;
+		if (deps.canaryFacts && job.packageCanary !== undefined) deps.canaryFacts.load = canaryLoadOfRun ?? null;
+		if (deps.canaryFacts && loadedOfRun !== null) deps.canaryFacts.loaded = loadedWithBase(loadedWithImage(loadedOfRun, img), baseSha);
+		progress = ranProgress ?? null;
 		// Issue #596: CONFIRMED killed for memory. The image's supervisor (image/runner/src/supervise.mjs) outlives the runner,
 		// whose process tree it gives the highest OOM score, and when the runner dies of SIGKILL with the cgroup's
 		// `oom_kill` above 0 it writes the signed line `code: 137, reason: "oom-killed"` (parseExitOomKilled). All three
@@ -1394,6 +2504,79 @@ export async function runJob(job, deps) {
 		// `oom_kill` counts the HOST's OOM killer too (`peakReachedLimit`). A report below it stays infrastructure.
 		const oomReported = exitOomKilled === true && exitAuthResult === "verified" && code === EXIT_SIGKILL;
 		const oomKilled = oomReported && peakReachedLimit(resources?.memPeak ?? null, memoryLimit);
+		// Issue #645: what the runner says it did with the crashed attempt's orphaned tool calls (the exit line's `recovery`).
+		// Issue #662: a recovery whose own container was killed writes no exit line, so its counts come from the transcript
+		// instead (the reducer's recovery marks, this attempt's lines only), labelled `countsFrom: "transcript"`. The marks
+		// are in an agent-writable file, so the exit line's counts win whenever the exit line CARRIES a `recovery` block
+		// (`recoveryCounts` not null); an exit line without one (a verified line whose recovery step threw, say) falls back
+		// to the transcript like a missing line. Neither feeds any decision.
+		if (durable.recovered !== null) {
+			const counts = recoveryCounts(ranRecovery);
+			const fromTranscript = counts === null ? recoveryCountsFromProgress(progress) : null;
+			if (counts !== null) durable.recovered = { ...durable.recovered, ...counts, countsFrom: "exit-line" };
+			else if (fromTranscript !== null) durable.recovered = { ...durable.recovered, ...fromTranscript, countsFrom: "transcript" };
+		}
+		// A container the checkpointer stopped because it could not unpause it (`checkpointStopped`, code 137, not aborted)
+		// is an infrastructure exit like any other here: not the worker's abort, not an OOM (no supervisor report), so it
+		// reaches the unknown-exit arm below and recovers from the checkpoint that was committed before the pause.
+		// Issue #645: THE EXIT CHECKPOINT, then the checkpointer's close, before anything below can return or throw. Taken
+		// only on an exit this attempt may recover from: infrastructure (exit 1, an unknown code, a detached container),
+		// never a worker's abort, an OOM kill, a completed or policy exit (none of those recovers) nor a never-started one
+		// (nothing ran, and today's retry is cheaper). The container is dead, so nothing is paused. B1's handle is read
+		// defensively: absent, or without `exit`, means no exit checkpoint, never a failure. Neither call may throw out of here.
+		const neverStartedExit = isNeverStartedExit({ code, aborted, detached }, neverStartedExits(job));
+		const recoverable = armed && !aborted && !oomKilled && code !== EXIT_COMPLETED && code !== EXIT_POLICY && !neverStartedExit;
+		// Issue #686 part 3, review round 2 of #714: a venue whose box was not confirmed gone after the run (`lingering`,
+		// `openshell-bind`) takes NO exit checkpoint: the host tree may still be written, so a snapshot of it is not a state
+		// the run reached. A recovery then continues from the last committed checkpoint.
+		if (ranCheckpoint !== null && typeof ranCheckpoint === "object") {
+			if (recoverable && lingering !== true && typeof ranCheckpoint.exit === "function") {
+				const taken = await Promise.resolve().then(() => ranCheckpoint.exit({ kind: "exit" })).catch(() => ({ skipped: "error" }));
+				log("checkpoint_exit", taken && Number.isSafeInteger(taken.seq) ? { seq: taken.seq } : { skipped: typeof taken?.skipped === "string" ? taken.skipped.slice(0, 40) : "unknown" });
+			}
+			const closed = typeof ranCheckpoint.close === "function" ? await Promise.resolve().then(() => ranCheckpoint.close()).catch(() => null) : null;
+			// `close()` answers the counts; `stats()` (a function on B1's handle) is the fallback when close did not.
+			const stats = closed ?? (typeof ranCheckpoint.stats === "function" ? await Promise.resolve().then(() => ranCheckpoint.stats()).catch(() => null) : null);
+			const count = (v) => (Number.isSafeInteger(v) && v >= 0 ? v : null);
+			if (stats && count(stats.written) !== null && count(stats.failed) !== null && count(stats.skipped) !== null) durable.checkpoints = { written: stats.written, failed: stats.failed, skipped: stats.skipped };
+		}
+		// An infrastructure exit of an armed run: queue its continuation from the checkpoint instead of throwing a retry
+		// (CONST-RETRY-INFRA-ONLY holds: nothing is returned as success, and the queued recovery IS the retry, one that
+		// keeps the work). RETURNED, so BullMQ spends no second attempt that would start from scratch beside it. Not
+		// queued (no checkpoint, the cap, a claim already taken, Valkey) -> today's InfraRetry, unchanged.
+		// A RECOVERY job has one attempt, so a throw here would fail it with the generic failure comment and nothing else:
+		// when its container ran, ended infra and no further recovery was queued, it RETURNS `recovery-failed` with its own
+		// comment instead (the run's final outcome, so its checkpoint, pointer and ledger are cleaned up).
+		const notQueued = async (err) => {
+			if (!isRecovery) throw err;
+			await comment(job, RECOVERY_COMMENTS["recovery-failed"]);
+			return { outcome: "failed", reason: "recovery-failed", exitCode: code, turns, tokens, usage: usage ?? null, provider: job.provider ?? null, model: job.model ?? null, session: mergeSession(prepared, session), budgetReserved: true, ...(dollars ? { dollars } : {}), ...(resources ? { resources } : {}), ...(progress ? { progress } : {}) };
+		};
+		const recoverOrThrow = async (err) => {
+			if (!recoverable) return notQueued(err);
+			let pointer = null;
+			try {
+				pointer = await readCheckpointPointer({ runId });
+			} catch {
+				pointer = null;
+			}
+			if (pointer === null || pointer === undefined) {
+				log("recovery_not_enqueued", { cause: "infra", reason: "no-checkpoint" });
+				return notQueued(err);
+			}
+			let queued;
+			try {
+				queued = await enqueueRecovery({ job, cause: "infra", pointer });
+			} catch {
+				queued = { enqueued: false, reason: "error" };
+			}
+			if (queued?.enqueued !== true) {
+				log("recovery_not_enqueued", { cause: "infra", reason: typeof queued?.reason === "string" && /^[a-z0-9-]{1,40}$/.test(queued.reason) ? queued.reason : "unknown" });
+				return notQueued(err);
+			}
+			log("recovery_enqueued_after_exit", { cause: "infra", n: Number.isSafeInteger(queued.n) ? queued.n : null, exitCode: code });
+			return { outcome: "failed", reason: RECOVERY_ENQUEUED, exitCode: code, turns, tokens, usage: usage ?? null, provider: job.provider ?? null, model: job.model ?? null, session: mergeSession(prepared, session), budgetReserved: true, ...(dollars ? { dollars } : {}), ...(resources ? { resources } : {}), ...(progress ? { progress } : {}) };
+		};
 		// Numbers only (bytes), never a path or a project: the operator's trace of a kill read as the host's. Never on a run
 		// the worker stopped itself (a timeout, a cancel, a shutdown): that 137 is the worker's own, the abort decides it
 		// below, and a line naming the host's OOM killer would send the operator after a kill that never happened.
@@ -1418,7 +2601,7 @@ export async function runJob(job, deps) {
 		// completed, runner policy, a worker abort or cancel, exit 1, an unknown exit, and a detached container. A
 		// never-started exit is not settled: the catch refunds it whole, and `isNeverStartedExit` is the one answer both
 		// ask. Before any classification below, so every return and every throw carries the same `dollars`.
-		const neverStarted = isNeverStartedExit({ code, aborted, detached }, neverStartedExits(job));
+		const neverStarted = neverStartedExit;
 		if (dollarHold !== null && !neverStarted) {
 			// The exit line is trusted only when the container exited ON ITS OWN (the worker did not abort, cancel, time
 			// out or detach it, so the runner had the chance to write its genuine last line) AND that line's own `code` is
@@ -1428,10 +2611,19 @@ export async function runJob(job, deps) {
 			const { settledMicros, basis } = dollarSettlement({ tokens, usage: usage ?? null, reservedMicros, trusted });
 			// The deployment, the repo or folder and the project windows settle to the job's cost; each model window to its
 			// own row of the usage ledger (`modelDollarSettlement`), never to the job's total.
+			// Issue #645: a recorded hold is settled through the run's ledger first, `held` -> `settled`, and only the call
+			// that MOVED it adjusts a window key. Anything else ("not-held": someone already finished it; a ledger error)
+			// leaves the reservation in every window, the floor, which is the safe side and what the record then says.
+			let ledgerMoved = true;
+			if (holdRecorded) {
+				const moved = await runBudgetLedger.settle(runId, durable.seq);
+				ledgerMoved = moved === "moved";
+				if (!ledgerMoved) log("run_budget_settle_skipped", { result: typeof moved === "string" ? moved : typeof moved?.error === "string" ? moved.error : "unknown" });
+			}
 			const jobPart = holdPart(dollarHold, (prefix) => jobCostPrefixes.has(prefix));
-			const { applied, of } = await settleDollars(redis, jobPart, settledMicros, { log });
+			const { applied, of } = ledgerMoved ? await settleDollars(redis, jobPart, settledMicros, { log }) : { applied: 0, of: 1 };
 			let modelBasis = null;
-			for (const part of dollarHold.ledgers ?? []) {
+			for (const part of ledgerMoved ? (dollarHold.ledgers ?? []) : []) {
 				const ref = modelPrefixes.get(part.keyPrefix);
 				if (ref === undefined) continue;
 				const m = modelDollarSettlement({ ref, basis, tokens, usage: usage ?? null, reservedMicros, trusted });
@@ -1445,8 +2637,14 @@ export async function runJob(job, deps) {
 			// A fault that adjusted no key leaves the whole reservation in every window, which is a floor whatever the
 			// basis would have been, and the record says so. A partial one is logged (dollar_settle_error) and recorded
 			// as computed: the keys that were adjusted hold the settled amount.
-			dollars = applied === 0 && of > 0 && settledMicros !== reservedMicros ? dollarsRecord({ reservedMicros, settledMicros: reservedMicros, basis: "floor", modelBasis }) : dollarsRecord({ reservedMicros, settledMicros, basis, modelBasis });
+			if (!ledgerMoved && modelPrefixes.size > 0) modelBasis = "floor";
+			const kept = applied === 0 && of > 0 && (settledMicros !== reservedMicros || !ledgerMoved);
+			// Issue #761: the deployment windows whose keys hold what this record states, along the keys the settle walked
+			// (`jobPart`, the deployment's first): a key it moved holds the settled amount, one it did not the reservation.
+			const reservedIn = deploymentWindowsOf(jobPart, { applied, target: settledMicros, recorded: kept ? reservedMicros : settledMicros, valkey: valkeyTag });
+			dollars = kept ? dollarsRecord({ reservedMicros, settledMicros: reservedMicros, basis: "floor", modelBasis, reservedIn }) : dollarsRecord({ reservedMicros, settledMicros, basis, modelBasis, reservedIn });
 			dollarHold = null;
+			publishDollarHold(null);
 			log("dollar_settled", { reservedMicros: dollars.reservedMicros, settledMicros: dollars.settledMicros, basis: dollars.basis, ...(modelBasis !== null ? { modelBasis } : {}) });
 		} else if (dollars?.basis === "unreserved") {
 			// Nothing was held, so nothing is written. A metered cost above 0 here would mean the runner's cap of 0 let a
@@ -1460,7 +2658,7 @@ export async function runJob(job, deps) {
 		// mid-job). It DID start, so this is never refunded as never-started: it keeps its slot and retries as infrastructure,
 		// BEFORE the exit-code switch, where the same code would read as a free never-started exit.
 		if (detached === true) {
-			throw new InfraRetry(`the container outlived its docker run, exit ${code}`, { reason: "container-detached", exitCode: code, turns, tokens, usage, provider: job.provider ?? null, model: job.model ?? null, session: mergeSession(prepared, session), dollars, resources });
+			return await recoverOrThrow(new InfraRetry(`the container outlived its docker run, exit ${code}`, { reason: "container-detached", exitCode: code, turns, tokens, usage, provider: job.provider ?? null, model: job.model ?? null, session: mergeSession(prepared, session), dollars, resources }));
 		}
 
 		// A WORKER-initiated stop (30-min timeout via cancelJob, graceful-shutdown docker stop, or an
@@ -1475,11 +2673,11 @@ export async function runJob(job, deps) {
 		// `abortReason` itself never reaches the record -- buildRecord copies named fields only.
 		// exitCode/turns/tokens carry the container's own exit, turn count, and usage totals; budgetReserved true post-reserve.
 		if (aborted) {
-			const reason = abortReason === "operator-cancel" ? "operator-cancel" : "worker-abort";
+			const reason = ["operator-cancel", "agent-cancel"].includes(abortReason) ? abortReason : "worker-abort";
 			// Awaited bare like every determinate refusal above: the adapter never throws by contract, and
 			// the one swallowed comment in this file (the catch's) justifies itself by its position.
 			await comment(job, TERMINAL_COMMENTS[reason]);
-			return { outcome: "policy", reason, exitCode: code, turns, tokens, provider: job.provider ?? null, model: job.model ?? null, session: mergeSession(prepared, session), budgetReserved: true, ...(dollars ? { dollars } : {}), ...(resources ? { resources } : {}) };
+			return { outcome: "policy", reason, exitCode: code, turns, tokens, provider: job.provider ?? null, model: job.model ?? null, session: mergeSession(prepared, session), budgetReserved: true, ...(dollars ? { dollars } : {}), ...(resources ? { resources } : {}), ...(progress ? { progress } : {}) };
 		}
 
 		// Issue #596: a runner the kernel killed for memory, CONFIRMED (`oomKilled` above). After the abort branch, so a
@@ -1495,21 +2693,34 @@ export async function runJob(job, deps) {
 			// The project and the size go to the log and the record, never to the comment (the TERMINAL_COMMENTS rule).
 			log("oom_killed", { jobId: job.id ?? null });
 			await comment(job, TERMINAL_COMMENTS[EXIT_OOM_KILLED]);
-			return { outcome: "policy", reason: EXIT_OOM_KILLED, exitCode: code, turns, tokens, usage: usage ?? null, provider: job.provider ?? null, model: job.model ?? null, session: mergeSession(prepared, session), budgetReserved: true, ...(dollars ? { dollars } : {}), ...(resources ? { resources } : {}) };
+			return { outcome: "policy", reason: EXIT_OOM_KILLED, exitCode: code, turns, tokens, usage: usage ?? null, provider: job.provider ?? null, model: job.model ?? null, session: mergeSession(prepared, session), budgetReserved: true, ...(dollars ? { dollars } : {}), ...(resources ? { resources } : {}), ...(progress ? { progress } : {}) };
+		}
+		// Issue #686 part 3, review round 2 of #714 (CONST-RETRY-INFRA-ONLY): a box not confirmed gone after the run. Exit 2
+		// keeps its own reason below, and a worker's abort stays the abort. A COMPLETED run is not thrown away as a retry,
+		// and a FOLDER job is not retried while the first sandbox may still write the folder: both RETURN the venue's named
+		// result, never retried, spend kept and settled above. The completed run's work stays where the agent put it (a
+		// pushed branch, a folder's edits), but nothing more is done with its result: no session promotion, no chained
+		// child, no completion comment, since the tree it would read may still change. Any other exit of a forge job is
+		// infrastructure as before (its retry gets a fresh clone; its recovery the last committed checkpoint).
+		if (lingering === true && !aborted && code !== EXIT_POLICY && (code === EXIT_COMPLETED || job.kind === "local")) {
+			log("venue_box_lingering", { exitCode: code, kind: job.kind ?? null });
+			await comment(job, OPENSHELL_BIND_LINGERING.comment);
+			return { outcome: "policy", reason: OPENSHELL_BIND_LINGERING.reason, exitCode: code, turns, tokens, usage: usage ?? null, provider: job.provider ?? null, model: job.model ?? null, session: mergeSession(prepared, session), budgetReserved: true, ...(dollars ? { dollars } : {}), ...(resources ? { resources } : {}), ...(progress ? { progress } : {}) };
 		}
 
 		switch (code) {
 			case EXIT_COMPLETED: {
+				watchCompleted = true;
 				// The SOLE chain-collection point. Read the completed parent's /outbox and enqueue children
 				// BEFORE the `finally` deletes jobDir -- the await resolves inside this case, so the read
 				// finishes before control leaves to cleanup. NOT reached on any other branch (policy, abort,
 				// over-budget, infra): an InfraRetry job is retried, so chaining there would double-enqueue.
 				// collectChain never throws; chainEnqueued/chainRefused are additive telemetry only.
-				const chain = await collectChain({ job, prepared });
+				const chain = job.answerDraft ? { enqueued: 0, refused: 0 } : await collectChain({ job, prepared });
 				// Issue #505: the plan, after the chain and on this branch only, for the reason the chain is here: a policy or
 				// infra exit collects nothing, and a retried job must not apply what its failed attempt wrote. `portfolio` is
 				// the pickup's decision; the collector asks the live file again, and both must agree. Never throws.
-				const plan = await collectPlan({ job, prepared, portfolio });
+				const plan = job.answerDraft ? null : await collectPlan({ job, prepared, portfolio });
 				// COMPLETED-ONLY PROMOTION, and the exclusivity is the point rather than an optimisation.
 				// A policy or infra exit leaves the canonical transcript byte-identical to what it was
 				// before this run, so a retry starts from exactly what the first attempt did -- promote on
@@ -1522,22 +2733,69 @@ export async function runJob(job, deps) {
 				// exitReason is RUNNER_COMPLETED_REASONS-filtered and read only here, on code 0, so it cannot move a job
 				// between retry classes. Only a job armed with run.awaitInput may park: a line that says so on any other
 				// job is ignored, since that runner was never offered the tool.
-				const parked = exitReason === "awaiting-input" && job.awaitInput === true;
-				const promoted = prepared.session ? promoteSession(prepared.session, { piVersion, context, parked }) : null;
-				// The window closes AFTER the promotion (an answer that gets in must find the `parked` mark and the transcript)
-				// and BEFORE the comment and the marker: the marker is what routes a phrase-free reply on an issue, and the
-				// comment is what tells a pull request's author to reply, so no answer they invite can meet the old key. Every
-				// park takes this path, a resumed run that parks again included. Guarded although the seam never throws: a
-				// fault here must not cost the person the comment that says how to continue.
-				if (parked) await Promise.resolve().then(releaseParkedWindow).catch(() => {});
-				if (parked) await comment(job, parkedComment(job.target));
-				// The forge marker the receiver routes a phrase-free reply on: set on a park, cleared when a run on a key that
-				// could park ends without parking. Never throws, and decides nothing: the sidecar promotion just wrote does.
-				if (parked) await parkedLabel(job, true);
+				const approvalParked = exitReason === "awaiting-approval" && Array.isArray(job.gates) && job.gates.includes(approvalMetadata?.action);
+				const parked = (exitReason === "awaiting-input" || approvalParked) && job.awaitInput === true;
+				const promoted = prepared.session ? promoteSession(prepared.session, { piVersion, context, parked, ...(sourceRunId ? { parkedSource: { runId: sourceRunId } } : {}) }) : null;
+				if (parked && !approvalParked && promoted?.promoted === true && deps.questionCaptureEnabled?.() === true && deps.questionGroupStore && sourceRunId) {
+					try {
+						const context = typeof prepared.questionRedact === "function"
+							? (deps.readQuestionContext ?? readQuestionContext)({ path: join(prepared.session.hostDir, "current.jsonl"), redact: prepared.questionRedact })
+							: { status: "source-unavailable" };
+						const captured = await deps.questionGroupStore.capture({ runId: sourceRunId, scopeId: touchScopeOf(job, hostName), project: pickupProject ?? null, repo: job.repo ?? null, at: deps.touchNow?.() ?? Number(now), text: context.text ?? null, sourceStatus: context.status === "ready" ? null : context.status, contextTruncated: context.truncated === true, redact: (text) => text, ...(Number.isSafeInteger(job.trigger?.matched?.index) ? { triggerIndex: job.trigger.matched.index } : {}) });
+						if (!captured?.ok || captured.status !== "unassigned") log("question_capture_partial", { status: captured?.status ?? "source-unavailable" });
+					} catch { log("question_source_unavailable", {}); }
+				}
+
+				if (deps.approvalRequest) {
+					const ended = await deps.approvalRuntime.finish({ requestId: deps.approvalRequest.requestId, jobId: deps.approvalJobId });
+					if (!ended.ok) return { outcome: "policy", reason: "approval-finish-unavailable", exitCode: code, turns, tokens, budgetReserved: true, session: mergeSession(prepared, session, promoted) };
+				}
+				let approvalFacts = null;
+				if (approvalParked) {
+					// A failed publication must not re-run a paid container. Keep the saved transcript and name the repair.
+					const fingerprint = promoted?.promoted === true && deps.approvalSessionCheck?.fingerprint ? deps.approvalSessionCheck.fingerprint({ sessionKey: prepared.session.key, ...approvalMetadata }) : null;
+					const approvalSession = fingerprint?.ok ? { ...prepared.session, digest: fingerprint.digest } : prepared.session;
+					const published = promoted?.promoted === true && isParked(job) ? await deps.approvalRuntime.afterPark({ job: { ...job, id: deps.queueJobId ?? sourceRunId }, session: approvalSession, metadata: approvalMetadata, rawJob: deps.rawApprovalJob ?? job }) : { refused: "approval-session-not-saved" };
+					if (!published.ok) {
+						// Issue #761: `{ newer: true }`, the live triggers file was written by a newer pi-dispatch, so the declaration
+						// this park would be armed under cannot be judged here. NOT deferred, unlike the free gates: the container has
+						// run and been paid for, and a deferral would run it again. No request is published, so nothing can decide or
+						// resume this park on this build; recorded as the declaration that could not be read, exactly as an
+						// unreadable file is, never as a store fault, and said in its own sentence, which names the upgrade.
+						if (published.newer === true) log("approval_park_newer_release", {});
+						await comment(job, published.newer === true ? APPROVAL_PARK_NEWER_COMMENT : APPROVAL_COMMENTS["approval-state-unavailable"]);
+						return { outcome: "policy", reason: published.newer === true ? "approval-policy-unavailable" : (published.refused ?? "approval-state-unavailable"), exitCode: code, turns, tokens, budgetReserved: true, session: mergeSession(prepared, session, promoted) };
+					}
+					approvalFacts = published.audit;
+				}
+				// THE PARK SEQUENCE (issue #638 reordered it): promote, marker ON, release the window, take the held replies,
+				// then the comment. Every step closes a gap the one before it leaves open:
+				//   - the marker AFTER the promotion (a reply it routes must find the `parked` mark and the transcript) and
+				//     BEFORE the release: a phrase-free reply in between routes as a parked reply, meets the window this run
+				//     still holds, and is HELD (the keeper still registers the run), so no reply slips past both;
+				//   - the release before the take, so the taken reply is enqueued WITH the window (held-settle.mjs) and becomes
+				//     the one job every later answer is coalesced against, never a second resumed run beside it;
+				//   - the comment LAST, because it invites an answer: with a reply taken it says the run continues
+				//     (HELD_TAKEN_COMMENT) instead of asking for one.
+				// The marker stays on when a reply was taken; the resumed run clears it when it ends without parking, as any
+				// run on the key does. Every park takes this path, a resumed run that parks again included. Each seam never
+				// throws and is guarded anyway: a fault must not cost the person the comment that says how to continue. The
+				// marker: set on a park, cleared when a run on a key that could park ends without parking; it decides nothing,
+				// the sidecar the promotion just wrote does.
+				if (parked) await parkedLabel(job, true, approvalParked);
 				else if (job.awaitInput === true || job.parkedReply === true) await parkedLabel(job, false);
+				if (parked) await Promise.resolve().then(releaseParkedWindow).catch(() => {});
+				const taken = parked ? await Promise.resolve().then(takeHeldReplies).catch(() => null) : null;
+				if (parked && !approvalParked && promoted?.promoted === true && deps.answerDraftRuntime && sourceRunId) {
+					await deps.answerDraftRuntime.afterPark({ job, prepared, runId: sourceRunId, project: pickupProject, startedAt: now.getTime(), taken: Boolean(taken?.taken || Number(taken?.resumed) > 0) }).catch(() => log("answer_draft_enqueue_unavailable", {}));
+				}
+				// `taken` "other": a reply that got in between the release and the take already is the resumed job, so the
+				// comment says the run continues there too, never "Reply here" (review round 2).
+				if (parked) await comment(job, approvalParked ? APPROVAL_COMMENTS["awaiting-approval"] : taken?.taken === "here" || taken?.taken === "other" || Number(taken?.resumed) > 0 ? HELD_TAKEN_COMMENT : parkedComment(job.target));
 				return {
 					outcome: "completed",
-					...(parked ? { reason: "awaiting-input" } : {}),
+					...(parked ? { reason: approvalParked ? "awaiting-approval" : "awaiting-input" } : {}),
+					...(approvalFacts ? { approval: approvalFacts } : {}),
 					exitCode: code,
 					turns,
 					tokens,
@@ -1556,6 +2814,7 @@ export async function runJob(job, deps) {
 					// record's `plan` is null otherwise, and every other result is unchanged.
 					...(plan ? { plan } : {}),
 					...(resources ? { resources } : {}),
+					...(progress ? { progress } : {}),
 				};
 			}
 			case EXIT_POLICY: {
@@ -1582,7 +2841,7 @@ export async function runJob(job, deps) {
 				// `why`. parseExitWhy keeps only a member of the closed COST_CAP_WHYS off a `cost-cap` line that said code 2,
 				// and it rides only beside a `cost-cap` reason, so a forged line can at worst name the wrong rule of three.
 				const why = reason === "cost-cap" && COST_CAP_WHYS.includes(exitWhy) ? { why: exitWhy } : {};
-				return { outcome: "policy", reason, exitCode: code, turns, tokens, usage: usage ?? null, provider: job.provider ?? null, model: job.model ?? null, session: mergeSession(prepared, session), budgetReserved: true, ...(dollars ? { dollars } : {}), ...why, ...(resources ? { resources } : {}) };
+				return { outcome: "policy", reason, exitCode: code, turns, tokens, usage: usage ?? null, provider: job.provider ?? null, model: job.model ?? null, session: mergeSession(prepared, session), budgetReserved: true, ...(dollars ? { dollars } : {}), ...why, ...(resources ? { resources } : {}), ...(progress ? { progress } : {}) };
 			}
 			case EXIT_INFRA:
 				// NO comment on any infra throw, here or in the catch: an InfraRetry may be retried and
@@ -1590,7 +2849,7 @@ export async function runJob(job, deps) {
 				// the whole infra class lives at the terminal seam -- start.mjs's failed listener, guarded on
 				// BullMQ's own finishedOn -- which also catches the stall-kill and wait-gate paths this
 				// function never sees (issue #288).
-				throw new InfraRetry(`infra failure, container exit ${code}`, { exitCode: code, turns, tokens, usage, provider: job.provider ?? null, model: job.model ?? null, session: mergeSession(prepared, session), dollars, resources });
+				return await recoverOrThrow(new InfraRetry(`infra failure, container exit ${code}`, { reason: CONTAINER_INFRA_EXIT, exitCode: code, turns, tokens, usage, provider: job.provider ?? null, model: job.model ?? null, session: mergeSession(prepared, session), dollars, resources }));
 			default:
 				// THE RUNTIME NEVER HANDED CONTROL TO THE RUNNER, in whatever integers this venue spells that
 				// (issue #227). For docker it is 125 (`docker run` itself failed), 126 (the entrypoint exists
@@ -1608,7 +2867,7 @@ export async function runJob(job, deps) {
 					// No `dollars` here: the hold is still standing, and the catch refunds it whole with the job-count slots.
 					throw new InfraRetry(`the runtime could not start the container, exit ${code}`, { reason: "container-never-started", exitCode: code, turns, tokens, usage, provider: job.provider ?? null, model: job.model ?? null, session: mergeSession(prepared, session), resources });
 				}
-				throw new InfraRetry(`unknown container exit ${code}`, { exitCode: code, turns, tokens, usage, provider: job.provider ?? null, model: job.model ?? null, session: mergeSession(prepared, session), dollars, resources });
+				return await recoverOrThrow(new InfraRetry(`unknown container exit ${code}`, { reason: CONTAINER_EXIT_UNKNOWN, exitCode: code, turns, tokens, usage, provider: job.provider ?? null, model: job.model ?? null, session: mergeSession(prepared, session), dollars, resources }));
 		}
 	} catch (e) {
 		// A CONFIG-tagged throw is a determinate policy refusal wearing an exception, and issue #310 is the
@@ -1642,14 +2901,26 @@ export async function runJob(job, deps) {
 			const hold = dollarHold;
 			dollarHold = null;
 			if ((e?.piDispatchConfig === true && !containerRan) || isNeverStartedRetry(e)) {
-				const { applied, of } = await releaseDollars(redis, hold, { log });
+				// Issue #645: a RECORDED hold is given back only by the call that moves it `held` -> `released` in the run's
+				// ledger; any other answer means someone else finished it or the ledger cannot say, and giving it back again
+				// could refund money twice, so it stays at the floor. An unrecorded hold (its record failed) is given back
+				// directly, as every hold was before: no one else can see it.
+				const releasable = !holdRecorded || (await runBudgetLedger.release(runId, durable.seq)) === "moved";
+				if (!releasable) log("run_budget_release_skipped", { seq: durable.seq });
+				const { applied, of } = releasable ? await releaseDollars(redis, hold, { log }) : { applied: 0, of: 1 };
 				const heldModel = (hold.ledgers ?? []).some((l) => modelPrefixesOf(modelDollars).has(l.keyPrefix));
-				dollars = dollarsRecord({ reservedMicros: hold.amountMicros, settledMicros: applied === of ? 0 : hold.amountMicros, basis: applied === of ? "refunded" : "floor", modelBasis: heldModel ? (applied === of ? "refunded" : "floor") : null });
+				// Issue #761: along the whole hold, which the release walked: a key it gave back holds 0 of this job's money, so
+				// a release that stopped part-way (the record then states the whole reservation) leaves those windows out.
+				const reservedIn = deploymentWindowsOf(hold, { applied, target: 0, recorded: applied === of ? 0 : hold.amountMicros, valkey: valkeyTag });
+				dollars = dollarsRecord({ reservedMicros: hold.amountMicros, settledMicros: applied === of ? 0 : hold.amountMicros, basis: applied === of ? "refunded" : "floor", modelBasis: heldModel ? (applied === of ? "refunded" : "floor") : null, reservedIn });
 			} else {
 				log("dollar_hold_unsettled", { reservedMicros: hold.amountMicros, error: e instanceof InfraRetry ? "infra-retry" : (e?.name ?? "error") });
 				const heldModel = (hold.ledgers ?? []).some((l) => modelPrefixesOf(modelDollars).has(l.keyPrefix));
-				dollars = dollarsRecord({ reservedMicros: hold.amountMicros, settledMicros: hold.amountMicros, basis: "floor", modelBasis: heldModel ? "floor" : null });
+				// Issue #761: nothing moved a key, so each holds the whole reservation, which is what this record states.
+				dollars = dollarsRecord({ reservedMicros: hold.amountMicros, settledMicros: hold.amountMicros, basis: "floor", modelBasis: heldModel ? "floor" : null, reservedIn: deploymentWindowsOf(hold, { applied: 0, target: hold.amountMicros, recorded: hold.amountMicros, valkey: valkeyTag }) });
 			}
+			// A failed give-back becomes a settled floor, not a running job's reservation.
+			publishDollarHold(null);
 		}
 		// The record reads `dollars` off the error on every throw path (buildRecord), so a retried or failed attempt says
 		// what its windows were charged.
@@ -1660,6 +2931,14 @@ export async function runJob(job, deps) {
 				// a frozen error keeps its own fields; the log lines above are the record of the hold
 			}
 		}
+		// Issue #644: the same for the run's progress, so a retried or failed attempt's record says where it got to.
+		if (progress !== null && e !== null && typeof e === "object" && e.progress === undefined) {
+			try {
+				e.progress = progress;
+			} catch {
+				// a frozen error keeps its own fields; progress is display only
+			}
+		}
 
 		if (e?.piDispatchConfig === true && !containerRan) {
 			// GUARDED, and the `held` list is the record of what actually happened. `releaseLedgers` is a loop of
@@ -1682,7 +2961,7 @@ export async function runJob(job, deps) {
 			// classification that has ALREADY released the budget, and the job would escape as whatever the
 			// comment threw, with the ledger refunded and the record saying something else entirely. The
 			// shipped adapter never throws; this makes that a property of the arm rather than of the wiring.
-			await comment(job, "Refused: this deployment is misconfigured, so the job could not be started. Ask the operator to run `pi-dispatch doctor`. Not run.").catch(() => {});
+			await comment(job, REFUSAL_COMMENTS["config-refused"]).catch(() => {});
 			log("refused_config", { kind: job.kind ?? null, refunded });
 			// budgetReserved reflects the LEDGER: whether the GLOBAL slot is still held after the refund (`globalHeld`).
 			return { outcome: "policy", reason: "config-refused", exitCode: null, turns: null, tokens: null, provider: job.provider ?? null, model: job.model ?? null, budgetReserved: globalHeld(), ...(dollars ? { dollars } : {}) }; // return => not retried
@@ -1693,10 +2972,13 @@ export async function runJob(job, deps) {
 		// here (exit-1 infra, unknown exit) means the container ran and legitimately spent its slot,
 		// so `reason` gates the release to the never-started case only. It releases only what `held` still
 		// lists and run once per invocation; a BullMQ retry reserves afresh, so this cannot double-release.
-		if (isNeverStartedRetry(e)) {
+		if (isNeverStartedRetry(e) && !slotOwnedByRun) {
 			// All-or-none (issues #242 and #499 part B): a never-started container follows EVERY job-count reserve, so
 			// every held ledger refunds together, last first, through the one helper -- and a scoped or project refusal
 			// returned above with the ledgers before it already given back.
+			// NOT for an armed run's slot (issue #645, `slotOwnedByRun`): the run's ledger says the slot is held, so the
+			// retry carries it instead of reserving; refunding it here would let that retry run on a slot nothing counts.
+			// The cost: a run whose every attempt never started keeps one slot counted, the safe side.
 			await refundLedgers("container-never-started");
 		}
 		// After the refund, so it says what the ledger holds: false when never-started gave the global slot back, true
@@ -1704,18 +2986,13 @@ export async function runJob(job, deps) {
 		if (e instanceof InfraRetry) e.budgetReserved = globalHeld();
 		throw e;
 	} finally {
+		if (prepared && job.watch) await collectWatch({ job, prepared, completed: watchCompleted, policyRefused: watchPolicyRefused, usage: watchUsage }).catch(() => {});
+		if (prepared && job.questionGrouping) await deps.questionGroupRuntime?.collect({ job, prepared, completed: watchCompleted }).catch(() => {});
+		if (prepared && job.answerDraft) await deps.answerDraftRuntime?.collect({ job, prepared, completed: watchCompleted, result: answerUsage }).catch(() => {});
 		if (prepared) await cleanup(prepared).catch(() => {});
 	}
 }
 
-/**
- * The reason a job retried for the podman venue's rootless network keeper carries (issue #458, PR #463 round 2): a
- * fixed token, as every run-record reason is, and the key the terminal comment is chosen by.
- */
-export const NETNS_KEEPER_NOT_HOLDING = "netns-keeper-not-holding";
-/** Issue #476: a job held on a young keeper that kept restarting, or stayed young past the hold's bound. */
-export const NETNS_KEEPER_CRASH_LOOP = "netns-keeper-crash-loop";
-
 /** Thrown for the retryable (infra) class only. The BullMQ processor lets this propagate to retry. */
 /**
  * The one `session` object the run record carries, from the host's intent and the container's report
@@ -1736,6 +3013,13 @@ export const NETNS_KEEPER_CRASH_LOOP = "netns-keeper-crash-loop";
 function mergeSession(prepared, fromRunner, promoted = null) {
 	const host = prepared?.session;
 	if (!host && !fromRunner) return null;
+	// Issue #643: a job that is not a resume job now runs on a live transcript file (`prepared.live`), which the runner
+	// opens empty and reports as `absent`. That is a fact about the live file, not about resuming, and this object
+	// describes resuming: such a job's record says `disabled`, exactly what the runner said for it before the live file
+	// existed, so its record is byte-identical to one written before the feature. Narrow on purpose, the live file and
+	// the runner's token exactly `absent`: any other report is carried as it always was, and resume jobs (`host`
+	// present) never reach this line.
+	if (!host && prepared?.live && fromRunner?.resumed === false && fromRunner.reason === "absent") return { resumed: false, reason: "disabled", bytes: null };
 	// A HOST GATE THAT REFUSED OUTRANKS THE RUNNER'S `absent`, and without this rule it never reached a
 	// record at all. A refused read stages a 0-byte file rather than nothing (session-store.mjs, where the
 	// reasoning is pi's EEXIST race), the container is handed that file either way, and pi opens it and
@@ -1777,6 +3061,25 @@ const SECRET_FAILURES = {
 	nul: "printed a value containing a NUL byte, which cannot survive the container's argv",
 };
 
+/**
+ * The bundle resolver's failures (issue #704, secret-bundles.mjs), our words, the `SECRET_FAILURES` rule: an unknown
+ * code degrades to the caller's generic sentence. None names a variable or a value: this text is posted publicly.
+ */
+const BUNDLE_FAILURES = {
+	exit: "refused the bundle's reference",
+	empty: "printed no variable",
+	overflow: "printed more than the bundle size cap allows",
+	nul: "printed output containing a NUL byte",
+	malformed: "printed output that is not in the format its profile declares",
+	quoted: "printed a quoted dotenv value, and the dotenv grammar takes no quotes (declare the profile as json instead)",
+	"not-string": "printed a JSON value that is not a string",
+	"bad-name": "printed a name that is not an environment variable name",
+	duplicate: "printed one variable twice",
+	"empty-value": "printed a variable with an empty value",
+	"value-too-large": "printed a value larger than one secret may be",
+	"too-many": "printed more variables than one bundle may carry",
+};
+
 /**
  * Is this throw the "the runner never ran" retry (issue #227), whichever path raised it: a never-started exit
  * (`isNeverStartedExit`), a spawn fault, or a pre-start gate? The catch's refunds (the job-count slots and, issue
@@ -1787,10 +3090,13 @@ function isNeverStartedRetry(e) {
 }
 
 export class InfraRetry extends Error {
-	constructor(message, { cause, reason, exitCode, turns, tokens, session, usage, provider, model, budgetReserved, dollars, resources } = {}) {
+	constructor(message, { cause, reason, exitCode, turns, tokens, session, usage, provider, model, budgetReserved, dollars, resources, loaded } = {}) {
 		super(message, cause ? { cause } : undefined);
 		this.name = "InfraRetry";
 		this.piDispatchRetry = true;
+		// The message default is never recorded or passed on as text: the record's door (`recordReasonOf`) records a
+		// reason that is no token as `worker-error`, and the failure hook flattens one to `infra`. A throw that knows its
+		// cause passes a token.
 		this.reason = reason ?? message;
 		this.exitCode = exitCode ?? null;
 		this.turns = turns ?? null;
@@ -1811,6 +3117,9 @@ export class InfraRetry extends Error {
 		this.dollars = dollars ?? null;
 		// Issue #596: what the container used, off its exit line, or null; set on a throw after a container ran.
 		this.resources = resources ?? null;
+		// Issue #800: what the run loaded, for a throw that REPLACES another (`runJob` sets it on the first), or that comes out
+		// of the run's wrapper before the processor noted it. Absent otherwise, so an error that holds none says so.
+		if (loaded !== undefined && loaded !== null) this.loaded = loaded;
 	}
 }
 
@@ -1841,4 +3150,72 @@ export class NetnsKeeperYoungHold extends InfraRetry {
 	}
 }
 
+/**
+ * A recovery job held while the run it continues still has a container running on this host (issue #645). An
+ * `InfraRetry` with `container-never-started`, so any path that does not know it still retries and refunds nothing it did
+ * not take; `makeProcessor` knows it by `recoveryWaitMs`, and moves the job to the delayed set for that long without
+ * spending an attempt (a recovery job has one), the move the two holds above make.
+ */
+/**
+ * A job whose project's secret bundle names a profile this host does not serve, on a multi-host worker's SHARED queue
+ * (issue #704 review). An `InfraRetry`, so any path that does not know it still retries; `makeProcessor` knows it by
+ * `bundleProfileHold`, and moves the job to the delayed set for the never-fits gate's recheck without spending an
+ * attempt, so a host that declares the profile can take it.
+ */
+export class SecretBundleProfileHold extends InfraRetry {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "SecretBundleProfileHold";
+		this.bundleProfileHold = true;
+	}
+}
+
+/**
+ * The HTTP status of a failed pull-request head read, or null: octokit's `status`, else the `returned <code>` the
+ * fetch-based forge hosts put in their InfraRetry message (status only, never the body). Read only to tell a
+ * determinate 401/403/404 from a fault worth retrying.
+ */
+function headReadStatus(error) {
+	if (Number.isInteger(error?.status)) return error.status;
+	const m = /\breturned (\d{3})\b/.exec(String(error?.message ?? ""));
+	return m ? Number(m[1]) : null;
+}
+
+/**
+ * Whether a failed head read is a RATE LIMIT (issue #704 review round 2): octokit's error carries the response headers,
+ * and GitHub's primary limit answers 403 with `x-ratelimit-remaining: 0`, its secondary limit 403 or 429 with a
+ * `retry-after`. A header is read by name only, never echoed. The fetch-based hosts surface no headers, and their
+ * 429 is already outside the determinate set.
+ */
+function headReadRateLimited(error) {
+	const headers = error?.response?.headers;
+	if (headers === null || typeof headers !== "object") return false;
+	const get = (name) => (typeof headers.get === "function" ? headers.get(name) : headers[name]);
+	const remaining = get("x-ratelimit-remaining");
+	return String(remaining ?? "") === "0" || (get("retry-after") !== undefined && get("retry-after") !== null);
+}
+
+/**
+ * A job this worker must not run because something it reads was written by a newer pi-dispatch: the triggers file a
+ * free gate reads live, or a checkpoint (`DES-STORE-VERSION-WHEN-NEEDED`). The processor's catch DEFERS it
+ * (`newer-release`) rather than count an attempt, so the job waits for a worker that can read it, spending nothing.
+ * `what` names the store, for the log line only.
+ */
+export class NewerReleaseHold extends InfraRetry {
+	constructor(what) {
+		super(`${what} was written by a newer pi-dispatch`, { budgetReserved: false });
+		this.name = "NewerReleaseHold";
+		this.newerRelease = true;
+		this.what = what;
+	}
+}
+
+export class RecoveryWaitHold extends InfraRetry {
+	constructor(message, { waitMs = RECOVERY_WAIT_MS, ...options } = {}) {
+		super(message, options);
+		this.name = "RecoveryWaitHold";
+		this.recoveryWaitMs = waitMs;
+	}
+}
+
 export { EXIT_COMPLETED, EXIT_INFRA, EXIT_POLICY };