@edgehero/pi-dispatch 4.3.1 → 5.1.0

package/src/run-history.mjs

@@ -1,18 +1,37 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
+import { CANARY_LOADS, recordedPackageCanary } from "./package-canary-record.mjs";
+import { LOADED_LINE_CUT, recordedLoaded } from "./loaded-record.mjs";
+import { cleanTouch, touchScopeOf } from "./touch-state.mjs";
+import { ANSWER_ID_RE, ANSWER_RUN_RE } from "./answerer.mjs";
+import { MODEL_WHY, providerFailureOf } from "./model-failover-protocol.mjs";
+import { forkArchiveFact, recordedFork } from "./fork-job.mjs";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import * as nodeFs from "node:fs";
 import { scrubCredentials } from "./redact.mjs";
 import { basename, join } from "node:path";
 import { resolveBackendName } from "./backend-registry.mjs";
+import { reservedInOf } from "./dollar-budget.mjs";
 import { isForgeKind, targetSeparator } from "./forges.mjs";
 import { MODEL_REF_PATTERN as USAGE_ID_PATTERN } from "./model-ref.mjs";
+import { modelListProblem } from "./model-ref.mjs";
+import { MODEL_ROLE_RE } from "./model-roles.mjs";
 import { isProjectId } from "./project-id.mjs";
 import { HOST_CPUS_MAX, HOST_MEMORY_MAX_MIB, HOST_SLOTS_MAX, recordedJobSize } from "./job-size.mjs";
 import { waitArmed } from "./wait-for.mjs";
-import { scheduledForMillis } from "./repeat-slot.mjs";
+import { secretProfileNeeded } from "./capabilities.mjs";
+import { cronRunPrefixes, scheduledForMillis } from "./bullmq-internals.mjs";
 import { EARLIER_MAX, recordedEarlier } from "./run-earlier.mjs";
+import { recordReasonOf } from "./record-reason.mjs";
+import { WATCH_ID_RE } from "./watch-contract.mjs";
+import { recordedWatchDecision } from "./watch-record.mjs";
 
 export { EARLIER_MAX, recordedEarlier };
 
+/** Host-authored replay lineage only, never a path or the original task text. */
+export function recordedCanary(value) {
+	if (!value || typeof value !== "object" || typeof value.sourceJobId !== "string" || !/^[A-Za-z0-9._:-]{1,200}$/.test(value.sourceJobId) || typeof value.role !== "string" || !MODEL_ROLE_RE.test(value.role) || value.role === "inherit" || modelListProblem([value.candidate]) !== null) return null;
+	return { sourceJobId: value.sourceJobId, role: value.role, candidate: value.candidate };
+}
+
 /**
  * Durable per-run history.
  *
@@ -26,7 +45,7 @@ export { EARLIER_MAX, recordedEarlier };
  * with a fake and no disk. `makeLogSink` streams a job's raw output to a per-job `.log` and recovers the
  * turn count from a bounded tail; `makeRecordWriter` serialises a finished run to a JSON sidecar;
  * `makeFindPreviousRun` reads a scheduler's most recent prior sidecar back; `makeLogReaper` sweeps aged
- * `.log`/`.json` files at boot and on the retention timer (issue #292).
+ * `.log`/`.json` files at boot and on the retention timer (issue #292), and the writer's leftover temporary files.
  */
 
 /**
@@ -126,6 +145,17 @@ function decisiveExitLine(text) {
 	return last;
 }
 
+/** File-result receipt. Only the log sink's authenticated branch may hand this to the collector. */
+export function parseExitAnswerDraftDigest(text) {
+	const line = decisiveExitLine(text);
+	return line?.code === 0 && /^[a-f0-9]{64}$/.test(line?.answerDraftDigest ?? "") ? line.answerDraftDigest : null;
+}
+
+export function parseExitQuestionRefDigest(text) {
+	const line = decisiveExitLine(text);
+	return line?.code === 0 && line.reason === "awaiting-input" && /^[a-f0-9]{64}$/.test(line?.questionRefDigest ?? "") ? line.questionRefDigest : null;
+}
+
 /**
  * Recover the agent's turn count from buffered container stdout, or `null` if it is not reported.
  *
@@ -172,6 +202,7 @@ export function parseExitTurns(text) {
  * Live from the first image that declares `mcp`: an image built before the worker named them prints the same line.
  */
 export const MCP_RUNNER_REASONS = Object.freeze(["mcp-unavailable", "mcp-config-invalid", "mcp-config-mismatch", "mcp-secret-missing", "mcp-command-missing", "mcp-shadowed"]);
+export const ANSWER_DRAFT_RUNNER_REASONS = Object.freeze(["answer-draft-refused"]);
 /**
  * The runner's exit-2 refusals of a job armed with `run.awaitInput` (issue #625), each before the prompt: another
  * extension registers the tool a parked run ends on (`await-input-shadowed`), or the job has no session file to park
@@ -179,7 +210,24 @@ export const MCP_RUNNER_REASONS = Object.freeze(["mcp-unavailable", "mcp-config-
  * `run.resume` and refuses that with no store). Named for MCP_RUNNER_REASONS' reason: the operator's fix is not a budget.
  */
 export const AWAIT_INPUT_RUNNER_REASONS = Object.freeze(["await-input-shadowed", "await-input-without-session"]);
-export const RUNNER_POLICY_REASONS = new Set(["provider-auth-refused", "cost-cap", "model-not-allowed", "cost-cap-unenforceable", "model-policy-unenforceable", ...MCP_RUNNER_REASONS, ...AWAIT_INPUT_RUNNER_REASONS]);
+/**
+ * The runner's exit-2 refusal of a job armed with `run.progress` (issue #644), before the prompt: another extension
+ * registers `report_progress`, the job tool whose calls the worker reads as phases. Named for MCP_RUNNER_REASONS' reason.
+ */
+export const PROGRESS_RUNNER_REASONS = Object.freeze(["report-progress-shadowed"]);
+/**
+ * The runner's exit-2 refusal of a job whose `run.excludeExtensionTools` names a tool no staged package or overlay extension registered (issue #800), before the prompt, on a job
+ * the worker marked strict. Named for MCP_RUNNER_REASONS' reason: the operator's fix is a name, a stage or the extension, and not a budget.
+ */
+export const EXCLUDE_RUNNER_REASONS = Object.freeze(["exclude-tool-not-loaded"]);
+/**
+ * The runner's exit-2 refusals of a job armed with `run.steer` (issue #646), before the prompt: PI_STEER is set but
+ * `/inbox` is not a readable directory (`steer-inbox-missing`), or no exit key arrived to sign the delivery acks with
+ * (`steer-no-exit-key`). Both are a worker regression or a hand-run container, since the worker arms steering only
+ * with the mount and a key; named for MCP_RUNNER_REASONS' reason, the operator's fix is not a budget.
+ */
+export const STEER_RUNNER_REASONS = Object.freeze(["steer-inbox-missing", "steer-no-exit-key"]);
+export const RUNNER_POLICY_REASONS = new Set(["provider-auth-refused", "cost-cap", "model-not-allowed", "model-roles-invalid", "model-roles-shadowed", "cost-cap-unenforceable", "model-policy-unenforceable", ...MCP_RUNNER_REASONS, ...EXCLUDE_RUNNER_REASONS, ...ANSWER_DRAFT_RUNNER_REASONS, ...AWAIT_INPUT_RUNNER_REASONS, ...PROGRESS_RUNNER_REASONS, ...STEER_RUNNER_REASONS, "question-group-refused", "question-group-unanswered", "approval-config-invalid", "approval-without-session", "approval-shadowed", "approval-decision-invalid"]);
 
 /**
  * The runner's reasons that ride a COMPLETED exit (`code: 0`) and that the worker acts on, closed (issue #625). One so
@@ -190,7 +238,7 @@ export const RUNNER_POLICY_REASONS = new Set(["provider-auth-refused", "cost-cap
  * only inside its exit-0 branch, so the worst a forged line can do on a real exit 0 is mark a completed run parked: the
  * worker then posts one fixed sentence and writes a marker beside a transcript the job already promoted.
  */
-export const RUNNER_COMPLETED_REASONS = new Set(["awaiting-input"]);
+export const RUNNER_COMPLETED_REASONS = new Set(["awaiting-input", "awaiting-approval"]);
 
 /**
  * The reason off the decisive exit line (`decisiveExitLine`), or `null`: a member of `RUNNER_POLICY_REASONS`
@@ -212,12 +260,27 @@ export function parseExitReason(text) {
 	return parsed?.code === 2 && RUNNER_POLICY_REASONS.has(parsed?.reason) ? parsed.reason : null;
 }
 
+/** Only authenticated runner metadata, never the model's summary. The worker still checks the declared action. */
+export function parseExitApproval(text) {
+	const line = decisiveExitLine(text);
+	const value = line?.approval;
+	if (line?.code !== 0 || line.reason !== "awaiting-approval" || !value || typeof value.action !== "string" || !/^[a-z][a-z0-9-]*(?::[a-z][a-z0-9-]*)?$/.test(value.action) || value.action.length > 80 || typeof value.toolCallId !== "string" || !/^[A-Za-z0-9_.:|/-]{1,256}$/.test(value.toolCallId)) return null;
+	return { action: value.action, toolCallId: value.toolCallId };
+}
+
+/** The audit contains host-validated identifiers only; rebuild it so tool arguments cannot add text. */
+export function approvalRecordOf(value) {
+	if (!value || !/^[0-9a-f]{64}$/.test(value.requestId ?? "") || typeof value.action !== "string" || !/^[a-z][a-z0-9-]*(?::[a-z][a-z0-9-]*)?$/.test(value.action) || value.action.length > 80) return null;
+	if (value.decision !== undefined && (!["approved", "declined", "question"].includes(value.decision) || !["forge", "operator", "panel", "system"].includes(value.actorKind) || !/^(?:[0-9a-f]{64}|expiry|revocation)$/.test(value.actorId ?? "") || !Number.isSafeInteger(value.decidedAt) || value.decidedAt < 0)) return null;
+	return { requestId: value.requestId, action: value.action, ...(value.decision !== undefined ? { decision: value.decision, actorKind: value.actorKind, actorId: value.actorId, decidedAt: value.decidedAt } : {}) };
+}
+
 /**
  * The cost guard's refusal rules a `cost-cap` exit line may name as its `why` (issue #507): the runner's
  * `COST_REFUSALS` (`image/runner/src/outcome.mjs`), restated because the shipped worker cannot import the runner, and
  * pinned to it by a test that reads that source. CLOSED, because the value reaches the PII-free record.
  */
-export const COST_CAP_WHYS = Object.freeze(["unboundable", "external", "over-cap"]);
+export const COST_CAP_WHYS = Object.freeze(["unboundable", "external", "over-cap", "final-payload"]);
 
 /**
  * The `why` off the decisive exit line (`decisiveExitLine`), or `null`: a member of `COST_CAP_WHYS`, and only when that
@@ -228,6 +291,36 @@ export const COST_CAP_WHYS = Object.freeze(["unboundable", "external", "over-cap
  * only beside a `cost-cap` reason, where it becomes the record's `why`: the worst a forged line can do is name the
  * wrong rule of the three.
  */
+/** Bounded refusal diagnostics: hashes and closed reasons only, never agent-authored names. */
+export const MODEL_ROLE_REFUSAL_REASONS = Object.freeze(["unknown-role", "model-not-allowed", "unknown-agent", "invalid-arguments", "aborted"]);
+export function modelRolesTelemetryOf(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value) || !Array.isArray(value.refusals) || value.refusals.length > 8) return null;
+	const refusals = [];
+	for (const row of value.refusals) {
+		if (row === null || typeof row !== "object" || typeof row.agentHash !== "string" || !/^[a-f0-9]{64}$/.test(row.agentHash) || !MODEL_ROLE_REFUSAL_REASONS.includes(row.reason)) return null;
+		refusals.push({ agentHash: row.agentHash, reason: row.reason });
+	}
+	return { refusals };
+}
+export function parseExitModelRoles(text) {
+	return modelRolesTelemetryOf(decisiveExitLine(text)?.modelRoles);
+}
+
+export function parseExitProviderFailure(text) {
+	const parsed = decisiveExitLine(text);
+	return parsed?.code === 1 ? providerFailureOf(parsed.providerFailure) : null;
+}
+
+export function parseExitReplaySafe(text) {
+	const parsed = decisiveExitLine(text);
+	return typeof parsed?.replaySafe === "boolean" ? parsed.replaySafe : null;
+}
+
+export function parseExitToolsStarted(text) {
+	const parsed = decisiveExitLine(text);
+	return typeof parsed?.toolsStarted === "boolean" ? parsed.toolsStarted : null;
+}
+
 export function parseExitWhy(text) {
 	const parsed = decisiveExitLine(text);
 	if (parsed === null) return null;
@@ -409,6 +502,306 @@ export function parseExitOomKilled(text) {
 	return parsed?.by === EXIT_BY_SUPERVISOR && parsed?.code === 137 && parsed?.reason === EXIT_OOM_KILLED && used !== null && used.oomKills !== null && used.oomKills > 0;
 }
 
+/**
+ * The tool names the run record's `progress.tools` counts by name (issue #644): pi's built-in tools and the two job tools
+ * pi-dispatch offers. A tool name is model-chosen (pi records an unknown name as the model sent it), so a name enters the
+ * record only as a count under one of these literals, compared and never copied; every other name counts as `other`.
+ */
+export const PROGRESS_RECORD_TOOLS = Object.freeze(["read", "bash", "edit", "write", "grep", "find", "ls", "await_human_input", "report_progress"]);
+// `replayed` (issue #645): the orphaned tool calls a recovered run's runner answered by running them again.
+// Issue #662: the reducer's `recoveryInterrupted` and `recoveryNotStarted` summary keys are deliberately NOT here. They feed
+// the processor's `recovered` fallback; listed here they would also land in `progress`, a second copy of those counts.
+const PROGRESS_COUNT_KEYS = Object.freeze(["turns", "steps", "failed", "interrupted", "replayed", "toolMs", "longestStepMs", "longestInterruptedMs", "phasesDeclared"]);
+
+/**
+ * The record's `progress` (issue #644, INT-RUN-HISTORY-FILE-CONTRACT), REBUILT from what run-progress.mjs `summary`
+ * returned: the closed count keys, `lastPhaseIndex` beside a declared phase, and `tools` under the closed names plus
+ * `other`, each a non-negative safe integer, zeros left out. Undefined (the key absent) when the reducer did not run for
+ * the job: the switch off, no transcript file, or an older worker. A non-object is absent too; a bad value is dropped,
+ * never copied.
+ */
+export function recordedProgress(p) {
+	if (p === null || typeof p !== "object" || Array.isArray(p)) return undefined;
+	const count = (v) => Number.isSafeInteger(v) && v > 0;
+	const out = {};
+	for (const key of PROGRESS_COUNT_KEYS) if (Object.hasOwn(p, key) && count(p[key])) out[key] = p[key];
+	if (out.phasesDeclared > 0 && Object.hasOwn(p, "lastPhaseIndex") && Number.isSafeInteger(p.lastPhaseIndex) && p.lastPhaseIndex >= 0) out.lastPhaseIndex = p.lastPhaseIndex;
+	const t = Object.hasOwn(p, "tools") ? p.tools : null;
+	if (t !== null && typeof t === "object" && !Array.isArray(t)) {
+		const tools = {};
+		for (const name of [...PROGRESS_RECORD_TOOLS, "other"]) if (Object.hasOwn(t, name) && count(t[name])) tools[name] = t[name];
+		if (Object.keys(tools).length > 0) out.tools = tools;
+	}
+	return out;
+}
+
+/** Where a recovered run's checkpoint came from (issue #645): workspace-checkpoint.mjs's manifest `kind`. */
+export const RECOVERED_FROM = Object.freeze(["live", "exit", "salvage"]);
+
+/**
+ * Why a job that armed `run.recover` ran without it (issue #645), the record's `recoverSkipped`. A fixed enum: `local`
+ * (recovery is for forge jobs in v1, so a local job runs as it always did), `no-run-id` (the job's queue id could not be
+ * derived from its data, so nothing could be keyed by it), `base-unprimed` (the checkpoint store could not take the
+ * fresh clone's base, or its tree could not be read, so no checkpoint of this run can be restored), `workspace-extensions` (the
+ * base commit holds `.pi/extensions/`, whose imports could load agent-written code in a recovered run).
+ */
+export const RECOVER_SKIPPED_REASONS = Object.freeze(["local", "no-run-id", "base-unprimed", "workspace-extensions"]);
+
+/**
+ * Why a job that armed `run.steer` ran without it (issue #646), the record's `steerSkipped`. A fixed enum:
+ * `venue-copies` (the job's venue copies files instead of binding them, so a message written after the start would never
+ * reach the container), `no-exit-key` (the image does not declare `exitAuth`, so no delivery ack could be verified and
+ * every message would be reported late while the agent may have read it), `no-transcript` (no transcript file could be
+ * staged, or this worker has no tail or relay wired, so nothing could read the acks), `no-inbox` (the inbox directory
+ * could not be made). The job still runs, as it would without `run.steer`.
+ */
+export const STEER_SKIPPED_REASONS = Object.freeze(["venue-copies", "no-exit-key", "no-transcript", "no-inbox"]);
+
+/**
+ * Why a run had no live transcript (and so no live progress) although this worker would read one (issue #712), the
+ * record's `liveSkipped`. A fixed enum, `run-container.mjs`'s own named skip (`live_transcript_skipped`): `venue-copies`
+ * (the venue copies the job's files and does not mirror the transcript over the exec's stderr), `no-capability` (it
+ * would, and the job image does not declare `transcriptStderr`), `no-exit-key` (the image declares no `exitAuth`, so the
+ * mirrored records could not be verified). Recorded so the console and the panel can say WHY a run's transcript is
+ * absent instead of listing the switch, the expiry and the start as the only causes. The job still runs.
+ */
+export const LIVE_SKIPPED_REASONS = Object.freeze(["venue-copies", "no-capability", "no-exit-key"]);
+
+/**
+ * Why a job whose project has a secret bundle ran without it (issue #704), the record's `bundleSkipped`. A fixed enum:
+ * `manual` (a run nobody's trigger made: `pi-dispatch run`, `/dispatch run`, `dispatch_run`), `chained` (an `/outbox`
+ * child), `opted-out` (its trigger sets `run.secretBundle: false`), `fork` (a pull request whose head is in another
+ * repository, on a bundle without `forkReviews`), `head-unverified` (the forge answered 401, 403 or 404 when asked for
+ * the pull request's head, so whether it is a fork could not be known and the job is treated as one). The job still
+ * runs, without the bundle.
+ */
+export const BUNDLE_SKIPPED_REASONS = Object.freeze(["manual", "chained", "opted-out", "fork", "head-unverified"]);
+
+/** The most variable names the record's `bundle` lists: the bundle's own cap (triggers.mjs `SECRET_BUNDLE_VARS_MAX`). */
+const BUNDLE_NAMES_MAX = 64;
+const BUNDLE_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const BUNDLE_ID = /^[A-Za-z0-9._-]{1,128}$/;
+
+/**
+ * The record's `bundle` (issue #704): `{ id, variables, shadowed, placeholders?, plain?, placeholderNames? }`, the bundle's id and the
+ * variable NAMES the job received from it and the ones the trigger's own run.secrets shadowed, sorted, and on an
+ * OpenShell venue two counts (below), or null on any violation. REBUILT,
+ * never the source's object, and NAMES ONLY: each is held to the environment-name charset, so no value, no
+ * reference and no free text can reach a record by this key. The names are the operator's own, from their own
+ * manager, the class the record already holds in `project` and the run.secrets names doctor prints; a record says
+ * exactly what a run held, which is the answer to "a grant now changes outside review".
+ */
+export function recordedBundle(b) {
+	if (b === null || typeof b !== "object" || Array.isArray(b)) return null;
+	if (typeof b.id !== "string" || !BUNDLE_ID.test(b.id)) return null;
+	const names = (list) => (Array.isArray(list) && list.length <= BUNDLE_NAMES_MAX && list.every((n) => typeof n === "string" && BUNDLE_VAR_NAME.test(n)) ? [...new Set(list)].sort() : null);
+	const variables = names(b.variables);
+	const shadowed = names(b.shadowed ?? []);
+	if (variables === null || shadowed === null) return null;
+	// Issue #704 part 3: on a venue whose own layer holds the credentials (both OpenShell venues), how many of the
+	// received variables the agent saw as placeholders and how many as values. A PAIR of integers, each 0 to the
+	// variable cap, or neither key: a record never says one without the other, and every other venue's record is
+	// byte-identical to before.
+	const count = (n) => Number.isSafeInteger(n) && n >= 0 && n <= BUNDLE_NAMES_MAX;
+	const placeholderNames = names(b.placeholderNames);
+	const named = placeholderNames !== null && placeholderNames.every((n) => variables.includes(n) && !shadowed.includes(n)) && placeholderNames.length <= b.placeholders;
+	const counted = count(b.placeholders) && count(b.plain) && b.placeholders + b.plain <= variables.length;
+	return { id: b.id, variables, shadowed, ...(counted ? { placeholders: b.placeholders, plain: b.plain, ...(named ? { placeholderNames } : {}) } : {}) };
+}
+
+/** The two OpenShell venues and the mode each runs in (backends.mjs `OPENSHELL_BACKENDS`, pinned by a test). */
+const OPENSHELL_VENUE_MODES = Object.freeze({ openshell: "copy", "openshell-bind": "bind" });
+/** The most rule hosts the record's `openshell` lists; `ruleHostCount` says how many there were in all. */
+export const OPENSHELL_RULE_HOSTS_MAX = 32;
+/** A rule host as the generated policy names it (openshell-policy.mjs `HOST_RE`, plus a leading `*.` for a dot entry). */
+const RULE_HOST = /^(?:\*\.)?(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/;
+/** The most providers and bound credentials an attempt can hold (backend-openshell.mjs `OPENSHELL_LIMITS`: 32 x 32). */
+const OPENSHELL_COUNT_MAX = 32 * 32;
+/** The most rule hosts `ruleHostCount` may claim: far above any allowlist, a bound on a number read back from a file. */
+const OPENSHELL_RULE_COUNT_MAX = 65_536;
+
+/**
+ * The record's `openshell` (issue #712): `{ mode, ruleHosts, ruleHostCount, providers, placeholders }`, what the
+ * attempt's sandbox policy admitted and bound, or null on any violation and on every other venue. REBUILT, never the
+ * source's object:
+ *   - `mode`: `copy` or `bind`, and it must be the mode of the venue the job resolved to, so a venue's record cannot
+ *     claim the other's;
+ *   - `ruleHosts`: the policy's endpoint hosts, deduplicated, sorted, held to the host-name charset (no port, no path,
+ *     no userinfo: a name that fails is dropped, never repaired), at most `OPENSHELL_RULE_HOSTS_MAX`;
+ *     `ruleHostCount` the number of valid hosts before that cap, so a view can say how many it does not list;
+ *   - `providers`: how many credential providers the sandbox was given (the job's own and one per bundle host);
+ *   - `placeholders`: how many credential keys those providers bound (the agent saw each as a placeholder).
+ * ADMISSIBLE because every host is OPERATOR CONFIG: the policy is generated from egress-allowlist.conf,
+ * model-endpoints.json and the fixed forge host (openshell-policy.mjs `networkPolicyFor`), and a bundle host must
+ * already be one of those endpoints. No payload, issue, branch or repository reaches a host (the repository is a path
+ * in the push rule, which is not read), so the record still holds no attacker-chosen string. Counts, never a key name
+ * or a value.
+ */
+export function recordedOpenshell(o, backend) {
+	if (o === null || typeof o !== "object" || Array.isArray(o)) return null;
+	if (!Object.hasOwn(OPENSHELL_VENUE_MODES, backend ?? "") || o.mode !== OPENSHELL_VENUE_MODES[backend]) return null;
+	if (!Array.isArray(o.ruleHosts)) return null;
+	const count = (n) => Number.isSafeInteger(n) && n >= 0 && n <= OPENSHELL_COUNT_MAX;
+	if (!count(o.providers) || !count(o.placeholders)) return null;
+	const hosts = [...new Set(o.ruleHosts.filter((h) => typeof h === "string" && RULE_HOST.test(h)))].sort();
+	// The adapter hands the whole list and no count; a record read back (the admin's rebuild) carries its own count, which
+	// is kept when it is an integer at least the hosts it lists, so a capped list does not shrink its total on a re-read.
+	const given = Number.isSafeInteger(o.ruleHostCount) && o.ruleHostCount >= 0 && o.ruleHostCount <= OPENSHELL_RULE_COUNT_MAX ? o.ruleHostCount : 0;
+	const listed = hosts.slice(0, OPENSHELL_RULE_HOSTS_MAX);
+	return { mode: o.mode, ruleHosts: listed, ruleHostCount: Math.max(hosts.length, given >= listed.length ? given : 0), providers: o.providers, placeholders: o.placeholders };
+}
+
+/** A secrets profile name as the triggers file admits it (triggers.mjs `validateSecretsProfile`), bounded here. */
+const SECRETS_PROFILE_NAME = /^[A-Za-z0-9._-]{1,128}$/;
+
+/**
+ * The record's `secretsProfile` (issue #712): the NAME of the resolver profile a job's `run.secrets` resolved through,
+ * its own `run.secretsProfile` or the implicit `default`, only for a job that armed secrets, else null. The rule is
+ * capabilities.mjs `secretProfileNeeded`, the one the router routes by (`secretsArmed` and `resolveSecrets` spelled
+ * receiver-safe; a test holds the three together), imported rather than secrets.mjs, which spawns and would pull the
+ * worker's runtime into every reader of this module (the admin bundle's import walks refuse it). Operator config,
+ * charset-checked at load and again here; never a path, a reference or a value. Whether the resolve worked is the
+ * record's `outcome`/`reason`.
+ */
+export function recordedSecretsProfile(data) {
+	const name = secretProfileNeeded(data);
+	return typeof name === "string" && SECRETS_PROFILE_NAME.test(name) ? name : null;
+}
+
+/**
+ * The record's `steered` (issue #646): `{ delivered, late, withdrawn }`, three non-negative safe integers counted off the
+ * run's inbox at its final outcome (inbox-settle.mjs), or null on any violation. Rebuilt, never the source's object.
+ */
+export function recordedSteered(s) {
+	if (s === null || typeof s !== "object" || Array.isArray(s)) return null;
+	const ok = (v) => Number.isSafeInteger(v) && v >= 0;
+	if (!ok(s.delivered) || !ok(s.late) || !ok(s.withdrawn)) return null;
+	return { delivered: s.delivered, late: s.late, withdrawn: s.withdrawn };
+}
+
+/** The most message ids an exit line's `steer.deliveredIds` may name: the inbox's own cap (steer-inbox.mjs). */
+export const STEER_DELIVERED_IDS_MAX = 16;
+
+/**
+ * The runner's inbox counts off an exit line (issue #646, the exit line's `steer`): `{ delivered, pending }`, each a
+ * non-negative safe integer or null, plus `deliveredIds` when the line names any: the ids the runner saw pi persist (32
+ * lowercase hex each, at most STEER_DELIVERED_IDS_MAX, deduplicated; a list that is not an array of such ids, or longer
+ * than the cap, is dropped WHOLE, never cut). Null when the value is not an object or carries nothing. The counts are
+ * advisory telemetry like `recovery`; the ids are acted on (run-container.mjs marks them delivered, review finding F3)
+ * only off a line the exit key SIGNED, which is the only kind runContainer hands on when a key was issued.
+ */
+export function steerCounts(s) {
+	if (s === null || typeof s !== "object" || Array.isArray(s)) return null;
+	const out = { delivered: Object.hasOwn(s, "delivered") && isCount(s.delivered) ? s.delivered : null, pending: Object.hasOwn(s, "pending") && isCount(s.pending) ? s.pending : null };
+	const ids = Object.hasOwn(s, "deliveredIds") ? s.deliveredIds : undefined;
+	if (Array.isArray(ids) && ids.length > 0 && ids.length <= STEER_DELIVERED_IDS_MAX && ids.every((id) => typeof id === "string" && /^[0-9a-f]{32}$/.test(id))) out.deliveredIds = [...new Set(ids)];
+	return out.delivered === null && out.pending === null && out.deliveredIds === undefined ? null : out;
+}
+
+/** The decisive exit line's `canaryLoad` (issue #796), `loaded` or `failed`, or null for anything else. Never throws. */
+export function parseExitCanaryLoad(text) {
+	const parsed = decisiveExitLine(text);
+	return CANARY_LOADS.includes(parsed?.canaryLoad) ? parsed.canaryLoad : null;
+}
+
+/**
+ * The decisive exit line's `loaded` as the runner wrote it (issue #800), `LOADED_LINE_CUT` when the line says the runner had
+ * one and no room for it (`loadedCut: true`), or null when it says neither, which is a line from an older image or from the
+ * supervisor. Handed on unread: every check is `rebuildLoaded`'s (loaded-record.mjs), which knows what the line is checked
+ * against, and the sink knows none of that. A value that is no object is still handed on, so it reads as a line that failed
+ * its checks and not as a line that said nothing. Never throws.
+ */
+export function parseExitLoaded(text) {
+	const line = decisiveExitLine(text);
+	return line?.loaded ?? (line?.loadedCut === true ? LOADED_LINE_CUT : null);
+}
+
+/** The decisive exit line's `steer` block (`steerCounts`), or null. Never throws. */
+export function parseExitSteer(text) {
+	const parsed = decisiveExitLine(text);
+	return parsed === null ? null : steerCounts(parsed?.steer);
+}
+
+/** The runner's recovery counts (issue #645, the exit line's `recovery`), in the record's order. */
+export const RECOVERY_COUNT_KEYS = Object.freeze(["orphans", "replayed", "interrupted", "notStarted"]);
+
+/** A recovery id is a queue job id: the charset `sanitizeJobId` keeps, plus the `:` a BullMQ id may hold. Never prose. */
+const RECOVERY_OF_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/;
+const isCount = (v) => Number.isSafeInteger(v) && v >= 0;
+
+/**
+ * The runner's `recovery` block off an exit line (issue #645): `{ orphans, replayed, interrupted, notStarted }`, each a
+ * non-negative safe integer or null, REBUILT over RECOVERY_COUNT_KEYS, or null when the value is not an object or carries
+ * no count at all. A present value that is not a count is null on its own (advisory telemetry from inside the container,
+ * like `resources`, which no decision reads). Never throws.
+ */
+export function recoveryCounts(r) {
+	if (r === null || typeof r !== "object" || Array.isArray(r)) return null;
+	const out = {};
+	for (const key of RECOVERY_COUNT_KEYS) out[key] = Object.hasOwn(r, key) && isCount(r[key]) ? r[key] : null;
+	return RECOVERY_COUNT_KEYS.some((key) => out[key] !== null) ? out : null;
+}
+
+/** The decisive exit line's `recovery` block (`recoveryCounts`), or null. Never throws. */
+export function parseExitRecovery(text) {
+	const parsed = decisiveExitLine(text);
+	return parsed === null ? null : recoveryCounts(parsed?.recovery);
+}
+
+/**
+ * Where a recovered run's counts came from (issue #662), the record's `recovered.countsFrom`: `exit-line` (the runner's
+ * exit line, signed where the image signs it) or `transcript` (the progress reducer's reading of the recovery marks in the
+ * session file, the fallback when no exit line came, as from a container that was killed). The transcript is
+ * agent-writable, so the exit line's counts win whenever it carries a `recovery` block, and transcript counts stay
+ * labelled as such.
+ */
+export const RECOVERY_COUNTS_FROM = Object.freeze(["exit-line", "transcript"]);
+
+/**
+ * The record's `recovered` (issue #645), REBUILT: `{ from, n, fromAttempt, checkpointSeq, orphans, replayed, interrupted,
+ * notStarted }`, `from` a member of RECOVERED_FROM and every other field a non-negative safe integer or null, plus
+ * `countsFrom` (RECOVERY_COUNTS_FROM, issue #662) when the source names a valid one; any other value is dropped. Null when
+ * `from` or `n` is not valid: a recovery whose source or number is unknown is not one this record can describe.
+ */
+export function recordedRecovered(r) {
+	if (r === null || typeof r !== "object" || Array.isArray(r)) return null;
+	if (!RECOVERED_FROM.includes(r.from) || !(Number.isSafeInteger(r.n) && r.n >= 1)) return null;
+	const int = (v) => (isCount(v) ? v : null);
+	const counts = recoveryCounts(r) ?? {};
+	const countsFrom = Object.hasOwn(r, "countsFrom") && RECOVERY_COUNTS_FROM.includes(r.countsFrom) ? { countsFrom: r.countsFrom } : {};
+	return { from: r.from, n: r.n, fromAttempt: int(r.fromAttempt), checkpointSeq: int(r.checkpointSeq), ...Object.fromEntries(RECOVERY_COUNT_KEYS.map((k) => [k, counts[k] ?? null])), ...countsFrom };
+}
+
+/**
+ * A recovery's counts off the progress reducer's summary (issue #662), the fallback for a missing exit line:
+ * `{ orphans, replayed, interrupted, notStarted }` with `orphans` the sum (each orphan takes exactly one branch,
+ * image/runner/src/recover.mjs), or null when the summary is absent or counts no mark at all. A zero is not taken from
+ * the transcript: it cannot tell "nothing was orphaned" from "killed before the runner resolved anything", and the
+ * record's null already says "not known".
+ */
+export function recoveryCountsFromProgress(p) {
+	if (p === null || typeof p !== "object" || Array.isArray(p)) return null;
+	const n = (v) => (isCount(v) ? v : 0);
+	const replayed = n(p.replayed);
+	const interrupted = n(p.recoveryInterrupted);
+	const notStarted = n(p.recoveryNotStarted);
+	const orphans = replayed + interrupted + notStarted;
+	if (orphans === 0 || !Number.isSafeInteger(orphans)) return null;
+	return { orphans, replayed, interrupted, notStarted };
+}
+
+/** The record's `checkpoints` (issue #645): `{ written, failed, skipped }`, three counts, or null on any violation. */
+export function recordedCheckpoints(c) {
+	if (c === null || typeof c !== "object" || Array.isArray(c)) return null;
+	if (!isCount(c.written) || !isCount(c.failed) || !isCount(c.skipped)) return null;
+	return { written: c.written, failed: c.failed, skipped: c.skipped };
+}
+
+/** The record's `recoveryOf` (issue #645): the base run's queue id when it matches RECOVERY_OF_RE, else null. */
+export function recordedRecoveryOf(id) {
+	return typeof id === "string" && RECOVERY_OF_RE.test(id) ? id : null;
+}
+
 /** The validating rebuild behind `parseExitResources` and the record's `resources`: null on any violation. */
 function rebuildResources(r) {
 	if (r === null || typeof r !== "object" || Array.isArray(r)) return null;
@@ -493,9 +886,9 @@ export function parseExitTokens(text) {
 	return null;
 }
 
-/** The ten per-row counters, in the row's serialisation order. Absent is an honest zero; anything
- *  present must be a finite non-negative number or the whole block is refused. */
-const USAGE_ROW_NUMERIC_KEYS = ["calls", "input", "output", "cacheRead", "cacheWrite", "cacheWrite1h", "reasoning", "total", "cost", "unpriced"];
+/** The eleven per-row counters, in the row's serialisation order. Absent is an honest zero, which is how a record from
+ *  before `providerBilled` reads; anything present must be a finite non-negative number or the whole block is refused. */
+const USAGE_ROW_NUMERIC_KEYS = ["calls", "input", "output", "cacheRead", "cacheWrite", "cacheWrite1h", "reasoning", "total", "cost", "unpriced", "providerBilled"];
 
 /**
  * The runner's per-(provider,model) usage ledger off the exit line -- `{ v, piAi, truncated, models }`
@@ -567,7 +960,7 @@ function rebuildUsage(u) {
 			if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return null;
 			nums[key] = value;
 		}
-		// The explicit 12-key literal: an unknown key on the emitted row is dropped HERE, by never
+		// The explicit 13-key literal: an unknown key on the emitted row is dropped HERE, by never
 		// being read -- the buildRecord no-spread posture, applied one level down.
 		models.push({
 			provider,
@@ -582,11 +975,54 @@ function rebuildUsage(u) {
 			total: nums.total,
 			cost: nums.cost,
 			unpriced: nums.unpriced,
+			providerBilled: nums.providerBilled,
 		});
 	}
 	return { v: u.v, piAi, truncated, models };
 }
 
+/**
+ * The run record's version (issue #761, INT-RUN-HISTORY-FILE-CONTRACT): `v`, the LAST key `buildRecord` writes. It
+ * rises only when an EXISTING field changes its meaning, unit or type. A new field never raises it: every addition is
+ * additive and nullable or a conditional key, which every reader already skips when it does not know it, so a version
+ * for one would only make older readers drop records they can read. A record written before `v` existed reads as 1.
+ */
+export const RUN_RECORD_VERSION = 1;
+
+/**
+ * The stable core: the fields that keep their meaning in EVERY version, so a reader that meets a record from a newer
+ * pi-dispatch can still say which job and attempt it is about, how it ended, when, where and for which project it ran.
+ * Everything else in such a record may mean something this build does not know, so a fold that adds up anything beyond
+ * these (money, slot time, sizes) skips the record and says how many it skipped. A change to one of these cannot be
+ * expressed by `v`, since every older reader reads the core of any version: it would need a record of another name.
+ *
+ * One historical exception the core cannot repair: `attempt` counted from 0 in every release before v2.0.0 (BullMQ's
+ * `attemptsMade` as it was), and those records carry no `v`. A reader comparing attempts against such a record sees
+ * another attempt, which fails toward the queue's own verdict.
+ */
+export const RECORD_CORE_FIELDS = Object.freeze(["jobId", "attempt", "outcome", "startedAt", "endedAt", "host", "kind", "project"]);
+
+/**
+ * A record's version: 1 when it carries no `v` (every record before issue #761), the value itself when it is a positive
+ * safe integer, and null for anything else (not a record, or a `v` no release writes). Pure; never throws.
+ */
+export function recordVersionOf(record) {
+	if (record === null || typeof record !== "object" || Array.isArray(record)) return null;
+	if (!Object.hasOwn(record, "v") || record.v === undefined) return 1;
+	return Number.isSafeInteger(record.v) && record.v >= 1 ? record.v : null;
+}
+
+/**
+ * Whether this build can read every field of `record`: its version is 1 up to `supported` (this build's own,
+ * `RUN_RECORD_VERSION`, unless a test passes another). A record that is not readable still has its core
+ * (`RECORD_CORE_FIELDS`); a malformed `v` is not readable either, since no release wrote it and nothing says what its
+ * other fields mean.
+ */
+export function recordReadable(record, { supported = RUN_RECORD_VERSION } = {}) {
+	const version = recordVersionOf(record);
+	return version !== null && version <= supported;
+}
+
 /**
  * Build the durable run record from the full BullMQ job wrapper and the run's outcome.
  *
@@ -596,24 +1032,50 @@ function rebuildUsage(u) {
  * path stay out of the record -- for local jobs only the folder's `basename` is kept, because the full
  * path embeds the operator's OS account name.
  *
- * `reason` is a fixed enum passthrough (worker-abort | over-budget | dollar-cap | allocation-cap | envelope-mismatch | portfolio-no-envelope | portfolio-snapshot-oversize | unprotected-branch |
- * runner-policy | provider-auth-refused | job-image-missing | egress-proxy-missing | ...), never free-form or payload text. `exitCode`, `turns`, and `budgetReserved`
+ * `reason` is a token of the fixed enum (worker-abort | over-budget | dollar-cap | allocation-cap | envelope-mismatch | portfolio-no-envelope | portfolio-snapshot-oversize | unprotected-branch |
+ * runner-policy | provider-auth-refused | job-image-missing | egress-proxy-missing | container-infra-exit | ...), never free-form or payload text,
+ * and it comes through ONE door, `recordReasonOf` (record-reason.mjs), rather than as `source.reason` copied: an InfraRetry
+ * built without a token carries its whole message as its reason, and a forge host's message names an API path, a
+ * repository and a library's own words. So an error whose reason is no token records `worker-error` (a failure is never
+ * reasonless), and a result's records null. `exitCode`, `turns`, and `budgetReserved`
  * default to `null` when the outcome does not carry them, so the record shape is stable whether or not
  * the source reports those fields.
  */
-export function buildRecord({ job, result, error, startedAt, endedAt, host = null, defaultBackend = null, project = null, size = null, capacity = null, earlier = null }) {
+export function buildRecord({ job, result, error, startedAt, endedAt, host = null, defaultBackend = null, project = null, size = null, capacity = null, earlier = null, maxTurns = null, touchTracking = false }) {
 	const data = job.data ?? {};
+	const fork = recordedFork(data.fork, sourceModel(result, error));
 	const kind = data.kind ?? job.name;
 	const source = result ?? error ?? {};
+	const progress = recordedProgress(source.progress);
+	const recoveryOf = recordedRecoveryOf(data.recoveryOf);
+	const recovered = recordedRecovered(source.recovered);
+	const checkpoints = recordedCheckpoints(source.checkpoints);
+	// Issue #646: only for a job that armed `run.steer`, so no other record can carry either key.
+	const steered = data.steer === true ? recordedSteered(source.steered) : null;
+	const steerSkipped = data.steer === true && STEER_SKIPPED_REASONS.includes(source.steerSkipped) ? source.steerSkipped : null;
+	// Issue #712: on every job, since any job's transcript can be skipped; absent on every venue that streams it.
+	const liveSkipped = LIVE_SKIPPED_REASONS.includes(source.liveSkipped) ? source.liveSkipped : null;
+	// Issue #712: the OpenShell venues' policy facts, held to the venue the job resolved to, and the secrets profile.
+	const backend = resolveBackendName(data, defaultBackend);
+	const openshell = recordedOpenshell(source.openshell, backend);
+	const secretsProfile = recordedSecretsProfile(data);
+	// Issue #704: only for a job whose project has a secret bundle, so no other record can carry either key.
+	const bundle = recordedBundle(source.bundle);
+	if (bundle !== null && !Object.hasOwn(OPENSHELL_VENUE_MODES, backend)) delete bundle.placeholderNames;
+	const bundleSkipped = bundle === null && BUNDLE_SKIPPED_REASONS.includes(source.bundleSkipped) ? source.bundleSkipped : null;
+	const loaded = recordedLoaded(source.loaded);
+	const jobCreatedAt = jobCreatedAtOf(job);
 	return {
 		jobId: job.id,
-		kind: kind ?? null,
+		// Internal references can refuse before they resolve to a local execution envelope. Keep the public
+		// forge/local vocabulary intact; purpose below identifies this analysis without inventing a forge kind.
+		kind: kind === "question-grouping" || kind === "answer-draft" ? null : kind ?? null,
 		target: targetFor(kind, data),
 		flow: data.flow ?? null,
 		startedAt: startedAt ?? null,
 		endedAt: endedAt ?? null,
 		outcome: result ? (result.outcome ?? null) : "failed",
-		reason: source.reason ?? null,
+		reason: recordReasonOf({ result, error }),
 		exitCode: source.exitCode ?? null,
 		turns: source.turns ?? null,
 		// Token accounting (INT-RUN-HISTORY-FILE-CONTRACT): additive and nullable, an explicit literal, no
@@ -630,6 +1092,11 @@ export function buildRecord({ job, result, error, startedAt, endedAt, host = nul
 		usage: source.usage ?? null,
 		provider: source.provider ?? null,
 		model: source.model ?? null,
+		...(typeof source.modelRole === "string" && /^[a-z][a-z0-9_-]{0,31}$/.test(source.modelRole) ? { modelRole: source.modelRole } : {}),
+		...(recordedCanary(data.canary) ? { canary: recordedCanary(data.canary) } : {}),
+		...(MODEL_WHY.includes(source.modelWhy) ? { modelWhy: source.modelWhy } : {}),
+		...(providerFailureOf(source.providerFailure) ? { providerFailure: providerFailureOf(source.providerFailure) } : {}),
+		...(modelRolesTelemetryOf(source.modelRoles) ? { modelRoles: modelRolesTelemetryOf(source.modelRoles) } : {}),
 		budgetReserved: source.budgetReserved ?? null,
 		// The ATTEMPT NUMBER, 1-based: the first run of a job is 1, its retry 2 (ledger item, issue #464 round). Every
 		// record is written while the job is still processing, where BullMQ's `attemptsMade` counts the attempts FINISHED
@@ -710,14 +1177,18 @@ export function buildRecord({ job, result, error, startedAt, endedAt, host = nul
 		// operator-authored config checked against a charset at load, never payload. `null` only where no
 		// default was passed (a dependency-injection seam; `recordRun` in start.mjs always passes one) or
 		// where the job data carries an explicit null, which no producer writes and the blessed gate refuses.
-		backend: resolveBackendName(data, defaultBackend),
+		backend,
 		// The dollar reservation's outcome (issue #501, INT-RUN-HISTORY-FILE-CONTRACT). Additive, nullable, an explicit
 		// literal REBUILT here (never the source's object), TAIL position after `backend` on the same contract: field order
 		// is the serialisation order. `{ reservedMicros, settledMicros, basis, modelBasis }`: two integers of micro-dollars,
 		// one fixed token (`metered` | `floor` | `refunded` | `unreserved`), and `modelBasis`, how the per-model windows
 		// settled (`metered` | `floor` | `refunded`, null when the job held none). Null when no dollar window applied to the job (no dollar setting, or a
-		// refusal before the reservation step), which is every record of a deployment that sets none.
+		// refusal before the reservation step), which is every record of a deployment that sets none. Issue #761: then
+		// `reservedIn`, `{ day?, week?, month?, valkey }`, only where the job's settled amount is in a deployment window
+		// (`deploymentWindowsOf`), for doctor's reset check; absent otherwise.
 		dollars: dollarsOf(source.dollars),
+		...(recordedWatchDecision(data.watch?.decision ?? source.decision) ? { decision: recordedWatchDecision(data.watch?.decision ?? source.decision) } : {}),
+		...(approvalRecordOf(source.approval) ? { approval: approvalRecordOf(source.approval) } : {}),
 		// The refusal's detail (PR #558, the end-of-round check of #501 and #502): which rule of the reason refused the job, the same fixed token
 		// the worker's log line carries, e.g. `overlay-link` under `model-unknown`, so the drill-in can tell the
 		// deployment's file from the job's model. Additive, nullable, an explicit literal, TAIL position after `dollars`
@@ -745,6 +1216,8 @@ export function buildRecord({ job, result, error, startedAt, endedAt, host = nul
 		// carried it: an older image, one whose supervisor died too, or a venue that hides the cgroup. Produced inside the
 		// job's container, so a job can inflate every number: advisory (docs/insights.md).
 		resources: rebuildResources(source.resources),
+		// Issue #796: a canary's candidate and what the runner said of it. An exact name and version, validated, and a closed word: no attacker-chosen string. Absent on every other run.
+		...(recordedPackageCanary(data.packageCanary, source.canaryLoad) ? { packageCanary: recordedPackageCanary(data.packageCanary, source.canaryLoad) } : {}),
 		// The size the job was given (issue #596, INT-RUN-HISTORY-FILE-CONTRACT): `{ memMiB, cpuCenti, source }`, resolved
 		// at the pickup gate from the limits snapshot and passed in beside `project` (start.mjs `recordRun`), so the record
 		// says what the job was promised next to what it used (`resources`). Additive, nullable, an explicit literal REBUILT
@@ -791,6 +1264,84 @@ export function buildRecord({ job, result, error, startedAt, endedAt, host = nul
 		// retry like any other (its earlier attempt's record is carried in `earlier`), so it is false there. A boolean,
 		// TAIL position after `earlier`, so the capacity report can say how many runs that is.
 		stalledRepick: Number.isInteger(job.stalledCounter) && job.stalledCounter > 0 && !(Number.isInteger(job.attemptsMade) && job.attemptsMade > 0),
+		// Where the run got to (issue #644, INT-RUN-HISTORY-FILE-CONTRACT): the turns, steps, failed and interrupted steps,
+		// tool time, the phase count and last phase index, and the steps per tool under a closed set of names, from the
+		// worker's own reading of the transcript (run-progress.mjs). REBUILT here (`recordedProgress`), TAIL position after
+		// `stalledRepick`. Integers and closed keys only: no phase name, note or tool name the model chose can reach it,
+		// so the record stays PII-free by construction. Read from a file the agent can write, so advisory, like
+		// `resources`. A CONDITIONAL key, unlike its neighbours: present only when the reducer ran for this job (the
+		// switch on and a transcript file present), so every record of a run without it is byte-identical to before.
+		...(progress !== undefined ? { progress } : {}),
+		// Durable runs (issue #645, INT-RUN-HISTORY-FILE-CONTRACT), TAIL position after `progress`, each a CONDITIONAL key
+		// like it, so a record of a job that never armed `run.recover` is byte-identical to before. Integers and fixed
+		// enums only, every one REBUILT here, never the source's object:
+		//   - `recoveryOf`: the base run's queue id, off this job's own data (a recovery job, `<runId>.r<n>`, writes its
+		//     own record beside the base's). The id class the record's own `jobId` already is, charset-checked;
+		//   - `recovered`: where the checkpoint came from (`live` | `exit` | `salvage`), the recovery number, the crashed
+		//     attempt's container number and checkpoint seq, and the runner's orphan counts;
+		//   - `recoverSkipped`: why an armed job ran without recovery (RECOVER_SKIPPED_REASONS);
+		//   - `checkpoints`: how many checkpoints this attempt wrote, failed and skipped.
+		...(recoveryOf !== null ? { recoveryOf } : {}),
+		...(recovered !== null ? { recovered } : {}),
+		...(RECOVER_SKIPPED_REASONS.includes(source.recoverSkipped) ? { recoverSkipped: source.recoverSkipped } : {}),
+		...(checkpoints !== null ? { checkpoints } : {}),
+		...(fork !== null ? { fork } : {}),
+		...(source.forkSource && typeof source.forkSource.saved === "boolean" ? { forkSource: forkArchiveFact(source.forkSource) } : {}),
+		// Steering (issue #646, INT-RUN-HISTORY-FILE-CONTRACT), TAIL position after the durable-run keys, CONDITIONAL like
+		// them and only for a job whose data says `steer: true`, so every other record is byte-identical to before:
+		//   - `steered`: how many of the run's messages were delivered (a verified ack), late (the run ended first) and
+		//     withdrawn, counted off the inbox at the final outcome. Three integers, REBUILT (`recordedSteered`);
+		//   - `steerSkipped`: why an armed job ran without steering (STEER_SKIPPED_REASONS), a fixed enum.
+		...(steered !== null ? { steered } : {}),
+		...(steerSkipped !== null ? { steerSkipped } : {}),
+		// Project secret bundles (issue #704, INT-RUN-HISTORY-FILE-CONTRACT), TAIL position after the steering keys,
+		// CONDITIONAL like them, so a record of a job whose project has no bundle is byte-identical to before:
+		//   - `bundle`: `{ id, variables, shadowed }`, NAMES only, REBUILT (`recordedBundle`), and on an OpenShell venue
+		//     `placeholders` and `plain`, two counts (issue #704 part 3);
+		//   - `bundleSkipped`: why the job ran without its project's bundle (BUNDLE_SKIPPED_REASONS), a fixed enum.
+		...(bundle !== null ? { bundle } : {}),
+		...(bundleSkipped !== null ? { bundleSkipped } : {}),
+		// The live transcript (issue #712, INT-RUN-HISTORY-FILE-CONTRACT), TAIL position after the bundle keys, CONDITIONAL
+		// like them, so a record of a run whose transcript streamed (or that no reader asked for) is byte-identical:
+		//   - `liveSkipped`: why the run had no live transcript (LIVE_SKIPPED_REASONS), a fixed enum.
+		...(liveSkipped !== null ? { liveSkipped } : {}),
+		// OpenShell run facts and the secrets profile (issue #712, INT-RUN-HISTORY-FILE-CONTRACT), TAIL position after
+		// `liveSkipped`, CONDITIONAL like it, so a record of any other venue, or of a job that armed no secrets, is
+		// byte-identical to before:
+		//   - `openshell`: `{ mode, ruleHosts, ruleHostCount, providers, placeholders }`, REBUILT (`recordedOpenshell`),
+		//     host names that are operator config and counts, on the two OpenShell venues only;
+		//   - `secretsProfile`: the profile NAME `run.secrets` resolved through (`recordedSecretsProfile`).
+		...(openshell !== null ? { openshell } : {}),
+		...(secretsProfile !== null ? { secretsProfile } : {}),
+		// Effective turn budget captured at pickup, not the settings as they stand when the run ends (#747).
+		...(Number.isSafeInteger(maxTurns) && maxTurns > 0 ? { maxTurns } : {}),
+		// Both an unresolved internal reference's refusal and its resolved classifier run stay out of workload
+		// rates. Keep their ordinary history and spend: analysis must not improve the rate by adding idle runs.
+		...(kind === "question-grouping" || data.purpose === "zero-touch-grouping" && data.questionGrouping ? { purpose: "zero-touch-grouping" } : {}),
+		...(data.purpose === "answer-draft" && ANSWER_RUN_RE.test(data.answerDraft?.runId ?? "") && ANSWER_ID_RE.test(data.answerDraft?.ruleId ?? "") ? { purpose: "answer-draft", answerDraft: { sourceRunId: data.answerDraft.runId, ruleId: data.answerDraft.ruleId } } : {}),
+		...(touchTracking ? { touchTrackingVersion: 1, touchScopeId: touchScopeOf(data, host) } : {}),
+		...(Array.isArray(source.touches) ? { touches: source.touches.slice(0, 16).map(cleanTouch).filter(Boolean) } : {}),
+		...(source.touchLineageSkipped === "source-unavailable" ? { touchLineageSkipped: "source-unavailable" } : {}),
+		// What the run loaded (issue #800, INT-RUN-HISTORY-FILE-CONTRACT): REBUILT (`recordedLoaded`), a display no decision
+		// reads. CONDITIONAL, TAIL position after the touch keys, so a refusal before the image was known, and every older
+		// record, is byte-identical to what it was. Names only from what the deployment staged and configured, and counts
+		// for what a repository holds. A repository extension can still forge what the line alone says, each held to a
+		// closed shape (loaded-record.mjs says which and what is left).
+		...(loaded !== null ? { loaded } : {}),
+		// When the job under this id was created (issue #811, INT-RUN-HISTORY-FILE-CONTRACT): BullMQ's `job.timestamp`, the
+		// add's moment, kept across every retry, stall and deferral of the job, as an ISO string. An id comes back after a
+		// lost queue and a hand redelivery, while an older job's touch events stay in the touch index, so the Zero touch
+		// view counts an event against this run only from this time on (less the clock skew), and never from an older job
+		// under the same id. Not `queuedAt` (null on a retry, a stall and a `run.waitFor` job, and the moment the job became
+		// ELIGIBLE, which a delay moves later), and not the record's `startedAt` (a touch during an earlier, stalled
+		// attempt is this run's and predates it). CONDITIONAL, the last key before `v`: absent when the job carries no
+		// representable timestamp, and a reader then applies no bound. Additive, so `v` stays 1. A number's rendering,
+		// so PII-free.
+		...(jobCreatedAt !== null ? { jobCreatedAt } : {}),
+		// The record's version (issue #761, `RUN_RECORD_VERSION`), the LAST key on every record and after every conditional
+		// key, so it stays last whatever a record carries and every earlier position is untouched. Unconditional: a reader
+		// asks one key, and a missing one reads as 1.
+		v: RUN_RECORD_VERSION,
 	};
 }
 
@@ -816,9 +1367,16 @@ export function newerRecord(a, b) {
 /**
  * What a retry's record carries forward from the record it is about to replace: that record's own `earlier`, then its
  * own slot interval when it held a slot (`capacity` an object), each rebuilt; null when there is nothing.
+ *
+ * A record from a NEWER pi-dispatch (`recordReadable` false: a stalled job a newer host ran, picked up here) is read
+ * by its core alone (`RECORD_CORE_FIELDS`): its own interval from `host`, `startedAt` and `endedAt`, sizes unknown, and
+ * no `earlier` chain or `capacity`, whose meaning may have changed. Without `capacity` there is no telling whether it
+ * held a slot, and the interval is kept anyway: a refusal before a slot is recorded as starting and ending at the moment
+ * it refused, so it adds next to no slot time, while dropping the interval would lose the whole run of one that did.
  */
 export function earlierFrom(previous) {
 	if (previous === null || typeof previous !== "object" || Array.isArray(previous)) return null;
+	if (!recordReadable(previous)) return recordedEarlier([{ host: previous.host, startedAt: previous.startedAt, endedAt: previous.endedAt }]);
 	const carried = Array.isArray(previous.earlier) ? previous.earlier : [];
 	const own = previous.capacity !== null && typeof previous.capacity === "object" && !Array.isArray(previous.capacity) ? [{ host: previous.host, startedAt: previous.startedAt, endedAt: previous.endedAt, memMiB: previous.size?.memMiB, cpuCenti: previous.size?.cpuCenti }] : [];
 	return recordedEarlier([...carried, ...own]);
@@ -849,6 +1407,15 @@ export function queuedAtOf(job) {
 	return at <= 8.64e15 ? new Date(at).toISOString() : null;
 }
 
+/**
+ * When a job was created, as an ISO string, or null: its `timestamp` when that is a non-negative safe integer a Date can
+ * hold (8.64e15 is the last), else null. The record's `jobCreatedAt` (issue #811).
+ */
+export function jobCreatedAtOf(job) {
+	const timestamp = job?.timestamp;
+	return Number.isSafeInteger(timestamp) && timestamp >= 0 && timestamp <= 8.64e15 ? new Date(timestamp).toISOString() : null;
+}
+
 /** A record's non-negative safe integer, else null. */
 const recordInt = (v) => (Number.isSafeInteger(v) && v >= 0 ? v : null);
 /** A record's budget dimension: an integer, `"off"` (the budget's `Infinity`, or the word itself), else null. */
@@ -924,11 +1491,17 @@ const DOLLAR_BASES = new Set(["metered", "floor", "refunded", "unreserved"]);
 // How the job's MODEL windows settled (issue #502 part 6); anything else, null included, records null.
 const MODEL_BASES = new Set(["metered", "floor", "refunded"]);
 
-/** The record's `dollars`, rebuilt from named fields only, or null when the source carries none or a malformed one. */
+/**
+ * The record's `dollars`, rebuilt from named fields only, or null when the source carries none or a malformed one.
+ * `reservedIn` (issue #761: which deployment windows the settled amount is in, and the Valkey's endpoint tag) is kept
+ * only as `reservedInOf` rebuilds it, dates and a hash, and is absent otherwise, so the record stays PII-free and a
+ * record of a job that reserved in no deployment window keeps the shape it had.
+ */
 function dollarsOf(d) {
 	if (d === null || typeof d !== "object") return null;
 	if (!Number.isSafeInteger(d.reservedMicros) || d.reservedMicros < 0 || !Number.isSafeInteger(d.settledMicros) || d.settledMicros < 0 || !DOLLAR_BASES.has(d.basis)) return null;
-	return { reservedMicros: d.reservedMicros, settledMicros: d.settledMicros, basis: d.basis, modelBasis: MODEL_BASES.has(d.modelBasis) ? d.modelBasis : null };
+	const reservedIn = reservedInOf(d.reservedIn);
+	return { reservedMicros: d.reservedMicros, settledMicros: d.settledMicros, basis: d.basis, modelBasis: MODEL_BASES.has(d.modelBasis) ? d.modelBasis : null, ...(reservedIn ? { reservedIn } : {}) };
 }
 
 /**
@@ -952,6 +1525,7 @@ function dollarsOf(d) {
  * starts carrying a title.
  */
 export function targetFor(kind, data) {
+	if (kind === "watch") return typeof data.watch?.ruleId === "string" && WATCH_ID_RE.test(data.watch.ruleId) ? `watch:${data.watch.ruleId}` : null;
 	if (kind === "local") return `local:${basename(data.folder ?? "")}`;
 	if (isForgeKind(kind)) return `${data.repo}${targetSeparator(kind, data.target?.type)}${data.target?.number}`;
 	return null;
@@ -1034,7 +1608,7 @@ export function makeLogSink({ logsDir, enabled, fs = nodeFs, log = () => {} }) {
 	// `exitKey` (issue #545): the key this job's runner signs its exit line with, or null when none was issued (an image
 	// that does not declare `exitAuth`, or a caller that predates the field). With a key, the exit-line fields are read
 	// from the AUTHENTICATED lines only, and none at all reads exactly like a container that wrote no exit line.
-	return function openJobLog(jobId, { exitKey = null } = {}) {
+	return function openJobLog(jobId, { exitKey = null, suppressCapture = false } = {}) {
 		let tail = "";
 		let stream = null;
 
@@ -1042,7 +1616,7 @@ export function makeLogSink({ logsDir, enabled, fs = nodeFs, log = () => {} }) {
 			try {
 				tail += typeof chunk === "string" ? chunk : chunk.toString("utf8");
 				if (tail.length > TAIL_CAP_BYTES) tail = tail.slice(tail.length - TAIL_CAP_BYTES);
-				if (!enabled) return;
+				if (!enabled || suppressCapture) return;
 				if (stream === null) {
 					stream = fs.createWriteStream(join(logsDir, `${sanitizeJobId(jobId)}.log`), { flags: "a" });
 					// Attach before the first write so an EPIPE/ENOSPC/EACCES surfaces as a log line rather
@@ -1067,8 +1641,15 @@ export function makeLogSink({ logsDir, enabled, fs = nodeFs, log = () => {} }) {
 			const exitText = keyed ? authenticExitLines(tail, exitKey) : tail;
 			const exitAuth = exitText === "" ? "unverified" : "verified";
 			const exitReason = parseExitReason(exitText);
+			const approval = parseExitApproval(exitText);
+			const answerDraftDigest = keyed && exitAuth === "verified" ? parseExitAnswerDraftDigest(exitText) : null;
+			const questionRefDigest = keyed && exitAuth === "verified" ? parseExitQuestionRefDigest(exitText) : null;
 			const exitLineCode = parseExitCode(exitText);
 			const exitWhy = parseExitWhy(exitText);
+			const modelRoles = keyed && exitAuth === "verified" ? parseExitModelRoles(exitText) : null;
+			const providerFailure = keyed && exitAuth === "verified" ? parseExitProviderFailure(exitText) : null;
+			const toolsStarted = keyed && exitAuth === "verified" ? parseExitToolsStarted(exitText) : null;
+			const replaySafe = keyed && exitAuth === "verified" ? parseExitReplaySafe(exitText) : null;
 			const turns = parseExitTurns(exitText);
 			const tokens = parseExitTokens(exitText);
 			const session = parseExitSession(exitText);
@@ -1076,6 +1657,14 @@ export function makeLogSink({ logsDir, enabled, fs = nodeFs, log = () => {} }) {
 			const context = parseExitContext(exitText);
 			const resources = parseExitResources(exitText);
 			const oomKilled = parseExitOomKilled(exitText);
+			// Issue #645: a recovered run's runner counts, off the same decisive (and, with a key, signed) line.
+			const recovery = parseExitRecovery(exitText);
+			// Issue #646: a steer-armed runner's inbox counts, off the same line.
+			const steer = parseExitSteer(exitText);
+			const canaryLoad = parseExitCanaryLoad(exitText);
+			// Issue #800: never off an unsigned line, a read any tool's write could feed. The signature is necessary and not
+			// sufficient: what is on the line is judged by `rebuildLoaded`, because an extension shares the signer's process.
+			const loaded = keyed && exitAuth === "verified" ? parseExitLoaded(exitText) : null;
 			try {
 				if (stream !== null) {
 					const s = stream;
@@ -1102,13 +1691,44 @@ export function makeLogSink({ logsDir, enabled, fs = nodeFs, log = () => {} }) {
 			// `exitAuth` only when a key was issued, so a keyless close returns exactly the object it always did. `exitWhy`
 			// (issue #507) only when the line named one, for the same reason.
 			// `resources` (issue #596) only when the line carried a block, and `exitOomKilled` only when true, for the same reason.
-			return { turns, tokens, session, usage, context, exitReason, exitLineCode, ...(exitWhy !== null ? { exitWhy } : {}), ...(resources !== null ? { resources } : {}), ...(oomKilled ? { exitOomKilled: true } : {}), ...(keyed ? { exitAuth } : {}) };
+			// `recovery` (issue #645) only when the line carried one, for the same reason, and `steer` (issue #646) the same.
+			return { ...(canaryLoad !== null ? { canaryLoad } : {}), ...(loaded !== null ? { loaded } : {}), turns, tokens, session, usage, context, exitReason, exitLineCode, ...(answerDraftDigest ? { answerDraftDigest } : {}), ...(questionRefDigest ? { questionRefDigest } : {}), ...(modelRoles ? { modelRoles } : {}), ...(providerFailure ? { providerFailure } : {}), ...(toolsStarted !== null ? { toolsStarted } : {}), ...(replaySafe !== null ? { replaySafe } : {}), ...(approval ? { approval } : {}), ...(exitWhy !== null ? { exitWhy } : {}), ...(resources !== null ? { resources } : {}), ...(oomKilled ? { exitOomKilled: true } : {}), ...(recovery !== null ? { recovery } : {}), ...(steer !== null ? { steer } : {}), ...(keyed ? { exitAuth } : {}) };
 		}
 
 		return { write, close };
 	};
 }
 
+/**
+ * The name of a record's temporary file (`makeRecordWriter`): `<sanitized id>.json.<pid>.<12 hex>.tmp`, beside the
+ * record it becomes. It never ends in `.json`, so no reader of the history (each lists `*.json` or opens `<id>.json`)
+ * can take one for a record, and the reaper knows a crash's leftover by this pattern (`RECORD_TMP_MAX_AGE_MS`). A test
+ * holds the writer's own name, made with its real `random`, to it.
+ *
+ * It is not this writer's alone: it is the temporary-name shape the other atomic JSON writers use too
+ * (`<name>.<pid>.<12 hex>.tmp`: `writeOverlay`, the console tokens writer, the admin's pause windows writer and its
+ * `replaceFile`), so their temporary file matches it if one of their files is kept in `PI_LOGS_DIR`. That is harmless:
+ * the reaper removes only a temporary file older than `RECORD_TMP_MAX_AGE_MS`, and every writer of this shape is
+ * synchronous, so its temporary file lives for milliseconds. One an hour old was left by a process that died between
+ * its write and its rename, and nothing can still be using it.
+ */
+export const RECORD_TMP_RE = /^[A-Za-z0-9._-]+\.json\.\d+\.[0-9a-f]{12}\.tmp$/;
+
+/**
+ * How old a record's temporary file must be before the reaper removes it: one hour. A write lives for milliseconds
+ * (it is synchronous), so a file this old was left by a process that died between the write and the rename, and no
+ * write can still be using it. Its own age rather than the retention window, which may be days or forever (0).
+ */
+export const RECORD_TMP_MAX_AGE_MS = 60 * 60 * 1000;
+
+/**
+ * The in-place fallback's open flags (`makeRecordWriter`): today's `"w"` (`O_WRONLY | O_CREAT | O_TRUNC`, the same
+ * default mode) plus `O_NOFOLLOW`, so a symbolic link at the record's name fails the open with ELOOP instead of being
+ * written through. Windows has no `O_NOFOLLOW` (`?? 0`, as this repo's other `O_NOFOLLOW` opens read it): there it
+ * opens as before.
+ */
+const IN_PLACE_FLAGS = nodeFs.constants.O_WRONLY | nodeFs.constants.O_CREAT | nodeFs.constants.O_TRUNC | (nodeFs.constants.O_NOFOLLOW ?? 0);
+
 /**
  * The durable record writer: serialises a finished run's `buildRecord` output to a per-job JSON sidecar.
  *
@@ -1118,15 +1738,35 @@ export function makeLogSink({ logsDir, enabled, fs = nodeFs, log = () => {} }) {
  * mirroring `makeLogSink`.
  *
  * The write is SYNCHRONOUS by design: it must complete before `process.exit(0)` on shutdown
- * (`index.mjs:83`), and an async write loses that race. `fs.writeFileSync` truncates by default, so a
- * re-run of the same job id overwrites -- last write wins.
+ * (`index.mjs:83`), and an async write loses that race.
+ *
+ * WRITTEN BESIDE, THEN RENAMED OVER (issue #761). The bytes go to a temporary file of this write's own in the same
+ * folder (`RECORD_TMP_RE`, created exclusively with `wx`, so a name already taken is never written through), and a
+ * rename puts it in place. A rename within one folder replaces the name in one step, so a worker that dies mid-write, or
+ * a backup copy taken then, finds the previous record or the new one, never a cut one. The in-place write it replaced
+ * truncated the file first, so a death between the truncate and the last byte left a record no reader could parse, or
+ * none. There is no fsync: a power cut can still lose a write the disk had not flushed, as it always could. A re-run of
+ * the same job id still replaces the record: the last write wins, as before.
+ *
+ * The rename is retried once on EPERM, as `writeOverlay` does: on Windows an antivirus scanner or the indexer can hold
+ * the destination for a moment. If the temporary file cannot be written or still cannot be renamed, the record is
+ * written IN PLACE, the way it always was, and the temporary file is removed: the safer path never loses a record that
+ * the old one would have kept (a job id long enough that the longer temporary name is refused, a folder that takes no
+ * new file, a disk too full for a second copy). Only a write that takes the fallback keeps the old exposure to a crash
+ * mid-write, and it is logged as `run_record_in_place { jobId, reason }`, the reason an error code, so a host that lost
+ * the crash safety says so; `run_record_failed` is logged when nothing could be written for any other reason.
+ *
+ * The fallback opens the record's name with `O_NOFOLLOW` (`IN_PLACE_FLAGS`): a symbolic link planted at that name is
+ * never written through, so a folder that refuses the rename cannot be made to overwrite a file outside it. The rename
+ * replaces a link rather than following it, so the safe path never could. Such a write writes nothing and is logged as
+ * `run_record_in_place` with the reason `ELOOP`, the code the open refused it with.
  *
  * The failure log carries only `jobId` and `reason`; never the record object or its serialized JSON,
  * which embed target/flow fields (`no-pii-in-logs`). `sanitizeJobId` is applied only at the filename
- * boundary; the record body keeps the raw id. `fs` is injectable so the writer is testable with a fake
- * and no disk.
+ * boundary; the record body keeps the raw id. `fs` and `random` are injectable so the writer is testable with a
+ * fake and no disk, and a test can aim at the temporary name.
  */
-export function makeRecordWriter({ logsDir, fs = nodeFs, log = () => {} }) {
+export function makeRecordWriter({ logsDir, fs = nodeFs, log = () => {}, random = randomBytes }) {
 	try {
 		fs.mkdirSync(logsDir, { recursive: true });
 	} catch (err) {
@@ -1134,15 +1774,57 @@ export function makeRecordWriter({ logsDir, fs = nodeFs, log = () => {} }) {
 	}
 
 	return function writeRecord(record) {
+		let path;
+		let data;
 		try {
 			// Custom: flat JSON sidecar per job over a DB/logging lib -- records are immutable, filename-keyed
 			// by jobId, no cross-record queries; DES-RUN-HISTORY-FLAT-FILES-NO-DB; specs/interfaces.md:11
 			// (there is deliberately no database).
-			const path = join(logsDir, `${sanitizeJobId(record.jobId)}.json`);
-			const data = `${JSON.stringify(record)}\n`;
-			fs.writeFileSync(path, data);
+			path = join(logsDir, `${sanitizeJobId(record.jobId)}.json`);
+			data = `${JSON.stringify(record)}\n`;
 		} catch (err) {
 			log("run_record_failed", { jobId: record?.jobId, reason: err?.message });
+			return;
+		}
+		let tmp = null;
+		const drop = () => {
+			try {
+				fs.unlinkSync(tmp);
+			} catch {
+				// already gone, or never made
+			}
+		};
+		let why = null;
+		try {
+			tmp = `${path}.${process.pid}.${random(6).toString("hex")}.tmp`;
+			fs.writeFileSync(tmp, data, { flag: "wx" });
+		} catch (err) {
+			// EEXIST: the name belongs to someone else (the exclusive create is what makes it this write's), so it is left
+			// alone. Any other failure after the create (a full disk) left a file of this write's own, which goes.
+			if (tmp !== null && err?.code !== "EEXIST") drop();
+			why = err?.code ?? "write-error";
+		}
+		if (why === null) {
+			try {
+				try {
+					fs.renameSync(tmp, path);
+				} catch (err) {
+					if (err?.code !== "EPERM") throw err;
+					fs.renameSync(tmp, path); // single retry: a Windows AV/indexer lock is transient
+				}
+				return;
+			} catch (err) {
+				drop();
+				why = err?.code ?? "rename-error";
+			}
+		}
+		try {
+			fs.writeFileSync(path, data, { flag: IN_PLACE_FLAGS });
+			log("run_record_in_place", { jobId: record.jobId, reason: why });
+		} catch (err) {
+			// A link at the record's name, refused by `O_NOFOLLOW`: nothing was written, and the log says why by its code.
+			if (err?.code === "ELOOP") log("run_record_in_place", { jobId: record.jobId, reason: "ELOOP" });
+			else log("run_record_failed", { jobId: record.jobId, reason: err?.message });
 		}
 	};
 }
@@ -1178,7 +1860,7 @@ export function makeFindPreviousRun({ logsDir, fs = nodeFs }) {
 		try {
 			if (typeof beforeMillis !== "number" || !Number.isFinite(beforeMillis)) return null;
 			const escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-			const pattern = new RegExp(`^(?:${escape(sanitizeJobId(`repeat:${schedulerId}:`))}|${escape(sanitizeJobId(`manual:${schedulerId}:`))})(\\d+)\\.json$`);
+			const pattern = new RegExp(`^(?:${cronRunPrefixes(schedulerId).map((prefix) => escape(sanitizeJobId(prefix))).join("|")})(\\d+)\\.json$`);
 			let best = null;
 			for (const name of fs.readdirSync(logsDir)) {
 				const m = pattern.exec(name);
@@ -1220,6 +1902,11 @@ export const UNREADABLE_RECORD = Object.freeze({ unreadable: true });
  *
  * The id inside is NOT checked here: `sanitizeJobId` maps `a:b` and `a_b` to one name, and `recordVerdict` refuses
  * the other job's record as `id-mismatch`, which is the one place that can also say so. NEVER throws.
+ *
+ * A record from a newer pi-dispatch (a `v` above `RUN_RECORD_VERSION`) is returned as it is, not refused: the worker's
+ * verdicts on it (`recordVerdict`, a recovery's settled check in processor.mjs) read only the stable core
+ * (`RECORD_CORE_FIELDS`), which keeps its meaning in every version, and `earlierFrom` reads no more than that core of
+ * one (issue #761).
  */
 export function makeReadRecord({ logsDir, fs = nodeFs }) {
 	return function readRecord(jobId) {
@@ -1253,9 +1940,9 @@ export function makeReadRecord({ logsDir, fs = nodeFs }) {
 export const RECORD_CLOCK_SKEW_MS = 5 * 60 * 1000;
 
 /**
- * Does this record say that THIS attempt of THIS job finished without failing? Returns `null` when it does,
- * `"absent"` when there is no record, and otherwise the reason it does not, from a fixed set:
- * `unreadable`, `id-mismatch`, `other-attempt`, `failed`, `older-than-job`. Pure; never throws.
+ * Why `record` is not THIS job's record of `attempt`, from a fixed set (`unreadable`, `id-mismatch`, `other-attempt`,
+ * `older-than-job`), or null when it is. The one rule for "this attempt's record" (`recordOfThisJob`, `recordVerdict`).
+ * Pure; never throws.
  *
  * `attempt` is the 1-based attempt number the record would carry, which is BullMQ's `attemptsMade + 1` while the
  * job is processing (see `buildRecord`) and `attemptsMade` after BullMQ failed it (its moveToFailed adds one
@@ -1263,19 +1950,63 @@ export const RECORD_CLOCK_SKEW_MS = 5 * 60 * 1000;
  *
  * `since` is the job's creation time in millis (BullMQ's `job.timestamp`). A job id can be used again once the
  * old job is gone (a fixed `--trigger` id, a redelivered webhook), while its record lives for the retention
- * window; a record that started before this job existed (less `RECORD_CLOCK_SKEW_MS`) belongs to the old one. A
- * missing or unparseable `startedAt` is not trusted for the same reason.
+ * window; a record from before this job existed (less `RECORD_CLOCK_SKEW_MS`) belongs to the old one. The record's
+ * time is its `startedAt`, or its `endedAt` when it has no start: the stall listener writes a crashed attempt's
+ * record with `startedAt: null` when it cannot tell that attempt's start (start.mjs `recoverStall`), and that record
+ * is this job's all the same, written after the job existed. A time that does not parse is not trusted. With no
+ * `since` (not a finite number) the age is not judged.
+ *
+ * Every field it reads is in the stable core (`RECORD_CORE_FIELDS`: `jobId`, `attempt`, `startedAt`, `endedAt`), so
+ * a record from a NEWER pi-dispatch is judged like any other (issue #761). Keep it to the core.
+ */
+function whyNotThisJob(record, { jobId, attempt, since }) {
+	if (record === UNREADABLE_RECORD || record === null || typeof record !== "object" || Array.isArray(record)) return "unreadable";
+	if (record.jobId !== jobId) return "id-mismatch";
+	if (!Number.isInteger(attempt) || record.attempt !== attempt) return "other-attempt";
+	if (Number.isFinite(since)) {
+		const at = Date.parse(record.startedAt ?? record.endedAt ?? "");
+		if (!Number.isFinite(at) || at < since - RECORD_CLOCK_SKEW_MS) return "older-than-job";
+	}
+	return null;
+}
+
+/**
+ * Is `record` THIS job's record of `attempt` (`whyNotThisJob` says what that takes: the id, the attempt, and not
+ * older than the job)? Whatever its outcome. Every place that asks whether a record is a job's own asks this, so a
+ * record an older job left under a reused id answers for nobody anywhere. Pure; never throws.
+ */
+export function recordOfThisJob(record, { jobId, attempt, since } = {}) {
+	try {
+		return whyNotThisJob(record, { jobId, attempt, since }) === null;
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * Does this record say that THIS attempt of THIS job finished without failing? Returns `null` when it does,
+ * `"absent"` when there is no record, and otherwise the reason it does not, from a fixed set:
+ * `unreadable`, `id-mismatch`, `other-attempt`, `failed`, `older-than-job`. Pure; never throws.
+ *
+ * Whose record it is goes by `whyNotThisJob`, the rule `recordOfThisJob` shares; the answers keep their order, so a
+ * record of another job or attempt is named as that before its outcome is looked at, and its age after, judged by its
+ * start alone.
  *
  * `failed` (an outcome of `failed`, or none) is refused on purpose: a record written by the catch path says the run
  * threw, and the queue's verdict (failed, or run again) is then the right one.
+ *
+ * Every field it reads is in the stable core (`RECORD_CORE_FIELDS`: `jobId`, `attempt`, `outcome`, `startedAt`,
+ * `endedAt`), so a record from a NEWER pi-dispatch is judged like any other (issue #761): a host that finished the run
+ * on a newer release still settles it for an older host that meets the stalled job. Keep it to the core.
  */
 export function recordVerdict(record, { jobId, attempt, since } = {}) {
 	try {
 		if (record === null || record === undefined) return "absent";
-		if (record === UNREADABLE_RECORD || typeof record !== "object" || Array.isArray(record)) return "unreadable";
-		if (record.jobId !== jobId) return "id-mismatch";
-		if (!Number.isInteger(attempt) || record.attempt !== attempt) return "other-attempt";
+		const whose = whyNotThisJob(record, { jobId, attempt, since });
+		if (whose === "unreadable" || whose === "id-mismatch" || whose === "other-attempt") return whose;
 		if (typeof record.outcome !== "string" || record.outcome === "failed") return "failed";
+		// A record that settles an attempt is judged by its START alone, as `CONST-RETRY-INFRA-ONLY` states the gate: the
+		// end fallback in `whyNotThisJob` is for the stall listener's own `failed` record, which never settles anything.
 		if (Number.isFinite(since)) {
 			const started = Date.parse(record.startedAt ?? "");
 			if (!Number.isFinite(started) || started < since - RECORD_CLOCK_SKEW_MS) return "older-than-job";
@@ -1340,23 +2071,33 @@ export function makeSettledRecord({ readRecord, readMirrored = null }) {
  * unlink failure is caught -- logged as `log_reaper_skipped` -- and boot continues. The per-file
  * try/catch is what keeps one bad entry from aborting the whole sweep.
  *
- * `retentionDays === 0` is the documented keep-forever sentinel: the sweep returns early and touches no
- * file. Age comes from the file's `mtimeMs`, never from any date parsed out of the filename -- the
+ * `retentionDays === 0` is the documented keep-forever sentinel: no `.log` or `.json` file is touched. Age comes
+ * from the file's `mtimeMs`, never from any date parsed out of the filename -- the
  * on-disk mtime is the authority. The `isFile()` guard skips a stray `foo.log/` directory so a
  * mis-shaped entry raises no EISDIR/EPERM. `fs` and `now` are injectable so the reaper is testable with
  * a fake and no disk.
+ *
+ * A record's TEMPORARY file (issue #761, `RECORD_TMP_RE`) that a crash left between the write and the rename is swept
+ * by its own age, `RECORD_TMP_MAX_AGE_MS`, and ALSO under keep-forever: the retention window is a promise about
+ * records, and this file is none (no reader reads it), so keeping it forever would only let crashes pile up. A `.tmp`
+ * of any other shape is never touched. One of this shape that another atomic writer left here matches too, and goes by
+ * the same rule, which is harmless: every writer of that shape is synchronous, so a temporary file an hour old belongs
+ * to a write that died (`RECORD_TMP_RE`).
  */
 export function makeLogReaper({ logsDir, retentionDays, fs = nodeFs, log = () => {}, now = () => Date.now() }) {
 	return function reapLogs() {
-		if (retentionDays === 0) return; // keep-forever sentinel: no sweep
+		const keepForever = retentionDays === 0; // keep-forever sentinel: no record or log is swept
 		try {
 			const names = fs.readdirSync(logsDir);
-			const cutoff = now() - retentionDays * 86400000;
+			const at = now();
+			const cutoff = at - retentionDays * 86400000;
+			const tmpCutoff = at - RECORD_TMP_MAX_AGE_MS;
 			for (const name of names) {
-				if (!name.endsWith(".log") && !name.endsWith(".json")) continue;
+				const tmp = RECORD_TMP_RE.test(name);
+				if (!tmp && (keepForever || (!name.endsWith(".log") && !name.endsWith(".json")))) continue;
 				try {
 					const st = fs.statSync(join(logsDir, name));
-					if (st.isFile() && st.mtimeMs < cutoff) {
+					if (st.isFile() && st.mtimeMs < (tmp ? tmpCutoff : cutoff)) {
 						fs.unlinkSync(join(logsDir, name));
 						log("reaped_log", { file: name });
 					}
@@ -1369,3 +2110,8 @@ export function makeLogReaper({ logsDir, retentionDays, fs = nodeFs, log = () =>
 		}
 	};
 }
+
+function sourceModel(result, error) {
+	const model = (result ?? error)?.model;
+	return typeof model === "string" && USAGE_ID_PATTERN.test(model.toLowerCase()) ? model : null;
+}