@foldrun/core 0.4.0 → 0.5.0

package/src/runner.ts

@@ -9,11 +9,15 @@ import matter from "gray-matter";
 import { spawn } from "node:child_process";
 import {
   knownPrice, executeStep, extractJson, stepCeiling, stepCeilingFor, type EventExtra } from "./step-exec.ts";
+import { cascadeLimits, toolOwners } from "./limits.ts";
+import { resolveAgentPath } from "./confine.ts";
+import { browserPodLine, podLossDecision, RERAN_ON_FULL } from "./browser-pod.ts";
 import { eventUrl } from "./webhook.ts";
 import { runStepInContainer, sizeLimits, killRunSandboxes, type StepTiming } from "./run-container.ts";
 import { hostSafeEnv } from "./host-env.ts";
 import { validateSchema, describeSchemaErrors, looksLikeSchema } from "./json-schema.ts";
 import { EGRESS_ENV, MODEL_KEY_NAME, addGrant, hostOf, placeholderNames, proxyModelEnv, unsubstitute, type EgressGrant } from "./egress.ts";
+import { explainRefusal, isRefusalStatus, refusalFromLine, supplyNote, type SupplyState } from "./refusal.ts";
 import { platform } from "./platform.ts";
 import { healthKey } from "./secret-health.ts";
 import { TEST_WRITES_DIR, restoreDivertedDirs, snapshotDivertedDirs, testHeadline, testModeEnv, withholdSecrets } from "./test-mode.ts";
@@ -25,7 +29,10 @@ const isolatedRun = () => {
   return mode === "container" || (!!mode && mode in platform.isolation);
 };
 import { gatherConsults, buildConsultTools } from "./agent-tools.ts";
-import { TOOL_MAP, BUILTIN_TOOLS, ownToolNames, toolRefs, legacyUseNames, legacyUseError } from "./tool-names.ts";
+import { DELEGATE_TOOL, gatherSubagents, subagentPrompt, subagentTools, type SubagentSpec } from "./subagents.ts";
+import { ASK_TOOL, applyOperatorEvent, askPromptLine, askTimeoutSec, buildAskTool } from "./operator.ts";
+import { sendPlainNotification } from "./notify.ts";
+import { TOOL_MAP, BUILTIN_TOOLS, ownToolNames, toolRefs, legacyUseNames, legacyUseError, retiredToolNames, retiredToolError } from "./tool-names.ts";
 import { refNames } from "./refs.ts";
 import {
   accountDir,
@@ -41,9 +48,11 @@ import {
   listRuns,
   syncBundleFor,
   parseToolDef,
+  type ToolDef,
   parseFlow,
   readFlow,
   markerPresent,
+  whenRowsPath,
   parseApis,
   resolveModel,
   parseProvider,
@@ -55,6 +64,7 @@ import {
   readRun,
   writeRun,
   runSummary,
+  verdictOf,
   type FlowStep,
   type McpSpec,
   type RunRecord,
@@ -77,12 +87,19 @@ import { startTranslator, translatorSpecFor, type TranslatorSpec } from "./trans
 import { providerPreset } from "./providers.ts";
 import { buildScriptTools, parseScripts, type ExecutionContext } from "./script-tools.ts";
 import { libraryDir, libraryTools, libraryMemoryIndex } from "./library.ts";
-import { mergeRuntimes, parseRuntime, prepareRuntime, type RuntimeSpec } from "./runtime.ts";
+import { fingerprint, mergeRuntimes, parseRuntime, prepareRuntime, type PreparedRuntime, type RuntimeSpec } from "./runtime.ts";
 import { materializeFiles, harvestFiles } from "./storage.ts";
 import { chooseExecutor, ensureImage } from "./container.ts";
 import { stampBundle } from "./okf.ts";
 import type { McpServerConfig } from "@anthropic-ai/claude-agent-sdk";
+import { readBrowseSettings, readSearchSettings, resolveSearch, searchSettingsEnv, webConfig, browseSessionProblems } from "./providers.ts";
+import { NEWER_ACTIONS, resolveActionApi } from "./web-actions.ts";
+import { resolveLanguage, languageName, type LanguageChoice } from "./language.ts";
+import { resolveRegion, deriveLocale, localeProse, regionName, type RegionChoice, type LocaleFacts } from "./locale.ts";
 import { trimChars } from "./paths.ts";
+import { resolveClock, localDate, type ClockChoice } from "./clock.ts";
+
+export { localDate } from "./clock.ts";
 
 // An MCP tool definition becomes an SDK server config. ${SECRET} placeholders
 // in env and headers resolve server-side, so a credential reaches the server
@@ -274,6 +291,29 @@ export function discoverSkills(agentDir: string, subdir = "skills"): DiscoveredS
  * Returns null rather than throwing on unparseable YAML: a broken shared file
  * must not take down every agent under it.
  */
+/**
+ * AGENTS.md without the block a coding tool reads.
+ *
+ * AGENTS.md is two things in a foldrun folder: the account's (or
+ * workspace's) own context, which every running agent is given, and — the
+ * convention Next.js set — the file a coding agent (Claude Code, Cursor,
+ * Codex) reads before it edits the folder. The CLI writes a short managed
+ * block for the second reader between these markers; it is about editing
+ * the files, not about doing the work, so no running agent is shown it.
+ */
+export const AGENT_RULES_START = "<!-- BEGIN:foldrun-agent-rules -->";
+export const AGENT_RULES_END = "<!-- END:foldrun-agent-rules -->";
+export function withoutAgentRules(body: string): string {
+  let out = body;
+  for (;;) {
+    const start = out.indexOf(AGENT_RULES_START);
+    if (start === -1) return out;
+    const end = out.indexOf(AGENT_RULES_END, start);
+    if (end === -1) return out;
+    out = out.slice(0, start) + out.slice(end + AGENT_RULES_END.length);
+  }
+}
+
 export function readAgentsMd(dir: string): { data: Record<string, unknown>; body: string } | null {
   // Convert a pre-rename `mdagent_version:` before parsing. One name in the
   // code, one on disk — the reader no longer knows two spellings, so a file
@@ -284,7 +324,7 @@ export function readAgentsMd(dir: string): { data: Record<string, unknown>; body
     if (!fs.existsSync(file)) continue;
     try {
       const parsed = matter(fs.readFileSync(file, "utf8"));
-      return { data: parsed.data as Record<string, unknown>, body: parsed.content.trim() };
+      return { data: parsed.data as Record<string, unknown>, body: withoutAgentRules(parsed.content).trim() };
     } catch {
       return null;
     }
@@ -303,6 +343,57 @@ const workspaceRootOf = (agentDir: string) => path.join(agentDir, "..", "..");
  * writing instructions means *as well as*, because an account rule nobody can
  * silently drop is the point of having one.
  */
+/** An agent's own `runtime:` block, else its workspace's (AGENTS.md, the
+ *  Linux Foundation standard name; project.md stays accepted so nothing
+ *  that already exists breaks). */
+function ownRuntime(front: Record<string, unknown>, agentDir: string, tenant: string): RuntimeSpec | null {
+  return parseRuntime(front.runtime) ?? parseRuntime(workspaceFrontmatter(agentDir, tenant).runtime);
+}
+
+/** What one granted script tool's program needs. */
+function toolRuntime(def: ToolDef): RuntimeSpec | null {
+  return def.kind === "script" ? parseRuntime((def.spec as { runtime?: unknown }).runtime) : null;
+}
+
+/**
+ * The runtime one agent's steps are built with: its own declaration (else its
+ * workspace's), merged with every script tool it grants. The runner builds
+ * exactly this for a step; the platform builds it ahead of time when the
+ * workspace is deployed, so a package that will not install is reported at
+ * deploy and a scheduled step finds its environment ready. One function, so
+ * the two can never disagree about what an agent needs.
+ */
+export function agentRuntimeSpec(tenant: string, workspace: string, agentDir: string): RuntimeSpec | null {
+  const file = path.join(agentDir, "agent.md");
+  if (!fs.existsSync(file)) return null;
+  const front = safeMatter(fs.readFileSync(file, "utf8")).data;
+  const available = { ...libraryTools(tenant), ...workspaceTools(tenant, workspace) };
+  const tools = ownToolNames(front)
+    .map((name) => available[name])
+    .filter((def): def is ToolDef => Boolean(def))
+    .map(toolRuntime);
+  return mergeRuntimes(ownRuntime(front, agentDir, tenant), ...tools);
+}
+
+/** Every distinct runtime a workspace's agents need, with who needs it. */
+export function workspaceRuntimePlan(
+  tenant: string,
+  workspace: string,
+): { fingerprint: string; spec: RuntimeSpec; agents: string[] }[] {
+  const byFp = new Map<string, { fingerprint: string; spec: RuntimeSpec; agents: string[] }>();
+  const agentsRoot = path.join(workspaceDir(tenant, workspace), "agents");
+  if (!fs.existsSync(agentsRoot)) return [];
+  for (const name of fs.readdirSync(agentsRoot).sort()) {
+    const spec = agentRuntimeSpec(tenant, workspace, path.join(agentsRoot, name));
+    if (!spec) continue;
+    const fp = fingerprint(spec);
+    const entry = byFp.get(fp) ?? { fingerprint: fp, spec, agents: [] };
+    entry.agents.push(name);
+    byFp.set(fp, entry);
+  }
+  return [...byFp.values()];
+}
+
 function workspaceFrontmatter(agentDir: string, tenant: string): Record<string, unknown> {
   return {
     ...(readAgentsMd(accountDir(tenant))?.data ?? {}),
@@ -311,31 +402,69 @@ function workspaceFrontmatter(agentDir: string, tenant: string): Record<string,
 }
 
 /**
- * The calendar an agent works to. `timezone:` in AGENTS.md, nearest-wins like
- * every other key there; a flow's cron already means its own timezone, this
- * makes "today" mean it too. Unset is UTC — what the pods run — which for a
- * Sydney desk made an article dated today "one day in the future" until 10am.
- * An unknown name falls back to UTC rather than failing every step.
+ * The calendar a set of frontmatter asks for, with no cascade around it —
+ * one merged record in, one zone out. The full cascade lives in
+ * `agentClock` below and in clock.ts; this is what the account-level parts
+ * of the platform (a wallet's month, a budget window) call.
  */
 export function resolveTimezone(front: Record<string, unknown>): string {
-  const tz = typeof front.timezone === "string" ? front.timezone.trim() : "";
-  const chosen = tz || process.env.FOLDRUN_TIMEZONE?.trim() || "UTC";
-  try {
-    new Intl.DateTimeFormat("en-CA", { timeZone: chosen });
-    return chosen;
-  } catch {
-    return "UTC";
-  }
+  return resolveClock([{ level: "workspace", value: front.timezone }]).timezone;
+}
+
+/**
+ * The clock this step works to: agent, then flow, then workspace, then
+ * account, then FOLDRUN_TIMEZONE, then UTC. Nearest wins, and a value that
+ * is not a zone falls through to the next level with a line to say so —
+ * see clock.ts for why this exists at all.
+ */
+export function agentClock(
+  agentDir: string,
+  tenant: string,
+  agentFront: Record<string, unknown>,
+  flowTimezone?: string | null,
+): ClockChoice {
+  return resolveClock([
+    { level: "agent", value: agentFront.timezone },
+    { level: "flow", value: flowTimezone },
+    { level: "workspace", value: readAgentsMd(workspaceRootOf(agentDir))?.data?.timezone },
+    { level: "account", value: readAgentsMd(accountDir(tenant))?.data?.timezone },
+  ]);
 }
 
-/** YYYY-MM-DD in a timezone — the date the workspace believes it is. */
-export function localDate(timeZone: string, now = new Date()): string {
-  return new Intl.DateTimeFormat("en-CA", {
-    timeZone,
-    year: "numeric",
-    month: "2-digit",
-    day: "2-digit",
-  }).format(now);
+/**
+ * The language this step works in: agent, then workspace, then account, then
+ * FOLDRUN_LANGUAGE, then English. The flow level is not read yet — a flow's
+ * timezone: travels through three signatures to get here, and this will
+ * take the same road when a flow needs it.
+ */
+export function agentLanguage(agentDir: string, tenant: string, agentFront: Record<string, unknown>): LanguageChoice {
+  return resolveLanguage([
+    { level: "agent", value: agentFront.language },
+    { level: "workspace", value: readAgentsMd(workspaceRootOf(agentDir))?.data?.language },
+    { level: "account", value: readAgentsMd(accountDir(tenant))?.data?.language },
+  ]);
+}
+
+/**
+ * The country this step works for, on the same road as the language, then
+ * FOLDRUN_REGION, then whatever the language tag carried (`en-AU` says AU).
+ * Everything a country changes — currency, units, calendar, weekend, text
+ * direction — is derived from it in locale.ts; the three overrides
+ * (`currency:`, `calendar:`, `units:`) are read at the nearest level that
+ * wrote them.
+ */
+export function agentRegion(agentDir: string, tenant: string, agentFront: Record<string, unknown>, languageTag: string): RegionChoice {
+  return resolveRegion([
+    { level: "agent", value: agentFront.region },
+    { level: "workspace", value: readAgentsMd(workspaceRootOf(agentDir))?.data?.region },
+    { level: "account", value: readAgentsMd(accountDir(tenant))?.data?.region },
+  ], languageTag);
+}
+
+export function agentLocaleOverrides(agentDir: string, tenant: string, agentFront: Record<string, unknown>): { currency?: unknown; calendar?: unknown; units?: unknown } {
+  const levels = [agentFront, readAgentsMd(workspaceRootOf(agentDir))?.data ?? {}, readAgentsMd(accountDir(tenant))?.data ?? {}];
+  const pick = (k: string) => levels.map((l) => l[k]).find((v) => v !== undefined && v !== null && v !== "");
+  return { currency: pick("currency"), calendar: pick("calendar"), units: pick("units") };
 }
 
 /**
@@ -345,6 +474,65 @@ export function localDate(timeZone: string, now = new Date()): string {
  * template as "context every agent here shares" — and never read. Only the
  * frontmatter was, so the instructions people actually wrote reached no model.
  */
+/**
+ * The sub-agents a step may delegate to (`subagents:`), as the SDK will get
+ * them: each resolved through agentContext exactly as its own step would be
+ * (grants only — no runtime; it runs inside its parent's), then cut to what
+ * the parent holds. Problems are lines on the step, never a failed step.
+ */
+export function buildSubagentSpecs(o: {
+  names: unknown;
+  self: string;
+  workspaceRoot: string;
+  tenant: string;
+  tags?: string[];
+  runId?: string;
+  flowTimezone?: string | null;
+  parentAllowed: string[];
+  push: (type: "info" | "error", text: string) => void;
+}): SubagentSpec[] {
+  const out: SubagentSpec[] = [];
+  const { found, missing } = gatherSubagents(o.workspaceRoot, o.names);
+  for (const m of missing) o.push("error", `subagents: "${m}" is not an agent in this workspace — not delegated to`);
+  for (const sub of found) {
+    if (sub.name === o.self) {
+      o.push("error", `subagents: "${sub.name}" is this agent itself — an agent does not delegate to itself`);
+      continue;
+    }
+    try {
+      const tags = o.tags ?? [];
+      const own = agentContext(sub.dir, o.tenant, tags, { runId: o.runId, agent: sub.name }, o.flowTimezone, true);
+      const description = typeof own.front.description === "string" ? own.front.description.trim() : "";
+      if (!description) {
+        o.push("error", `subagents: "${sub.name}" has no description — the model picks a sub-agent by it; not delegated to`);
+        continue;
+      }
+      const tools = subagentTools(own.allowed, o.parentAllowed);
+      if (!tools.length) {
+        o.push("error", `subagents: "${sub.name}" holds none of its tools inside this step — it can only answer from its prompt (use agents: for that)`);
+      }
+      const body = withoutAgentRules(matter(fs.readFileSync(path.join(sub.dir, "agent.md"), "utf8")).content);
+      out.push({
+        name: sub.name,
+        description,
+        prompt: subagentPrompt({
+          body: resolveDocLinks(body, o.workspaceRoot),
+          name: sub.name,
+          parent: o.self,
+          workspace: path.basename(o.workspaceRoot),
+          shared: sharedInstructions(sub.dir, o.tenant),
+        }),
+        tools,
+        disallowedTools: refNames(own.front.disallowedTools),
+        model: own.front.model ? resolveModel(own.front.model) : "inherit",
+      });
+    } catch (err) {
+      o.push("error", `subagents: "${sub.name}" could not be read — ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return out;
+}
+
 export function sharedInstructions(agentDir: string, tenant: string): string | null {
   const sections = [
     ["Everyone in this account", readAgentsMd(accountDir(tenant))?.body],
@@ -433,7 +621,9 @@ export function resolveDocLinks(text: string, workspaceRoot: string): string {
   // instruction names needs to say WHERE without naming a file. Added
   // first, so a document that happens to share a folder's name still wins.
   for (const dir of [STORAGE_DIR, "state", "knowledge", "memory", "skills", "outputs"]) {
-    if (fs.existsSync(path.join(workspaceRoot, dir))) map.set(norm(dir), `../../${dir}/`);
+    // storage/ and state/ by the one spelling that works in every tool,
+    // the shell included; the rest as they always were.
+    if (fs.existsSync(path.join(workspaceRoot, dir))) map.set(norm(dir), dir === STORAGE_DIR || dir === "state" ? `workspace/${dir}/` : `../../${dir}/`);
   }
   for (const kind of ["knowledge", "memory"] as const) {
     const dir = path.join(workspaceRoot, kind);
@@ -472,7 +662,7 @@ export function resolveDocLinks(text: string, workspaceRoot: string): string {
         continue;
       }
       const fwd = entry.split(path.sep).join("/");
-      const rel = `../../state/${fwd}`;
+      const rel = `workspace/state/${fwd}`;
       map.set(norm(`state/${fwd}`), rel);
       map.set(norm(fwd), rel);
     }
@@ -488,7 +678,7 @@ export function resolveDocLinks(text: string, workspaceRoot: string): string {
         "utf8",
       ),
     ) as { files?: { path: string }[] };
-    for (const f of index.files ?? []) map.set(norm(`${STORAGE_DIR}/${f.path}`), `../../${STORAGE_DIR}/${f.path}`);
+    for (const f of index.files ?? []) map.set(norm(`${STORAGE_DIR}/${f.path}`), `workspace/${STORAGE_DIR}/${f.path}`);
   } catch {
     // no file store index is normal
   }
@@ -503,8 +693,8 @@ export function resolveDocLinks(text: string, workspaceRoot: string): string {
       }
       const fwd = entry.split(path.sep).join("/");
       if (fwd.startsWith(".store/")) continue;
-      map.set(norm(`${STORAGE_DIR}/${fwd}`), `../../${STORAGE_DIR}/${fwd}`);
-      map.set(norm(fwd), `../../${STORAGE_DIR}/${fwd}`);
+      map.set(norm(`${STORAGE_DIR}/${fwd}`), `workspace/${STORAGE_DIR}/${fwd}`);
+      map.set(norm(fwd), `workspace/${STORAGE_DIR}/${fwd}`);
     }
   }
   // `[` excluded from the name: with it allowed, a run of `[[` makes the
@@ -522,6 +712,12 @@ function agentContext(
   tags: string[] = [],
   /** Who is running, so scripts can stamp what they write with its provenance. */
   identity: { runId?: string; agent?: string } = {},
+  /** The flow's own `timezone:`, when this step belongs to one. Between the
+   *  agent's frontmatter and the workspace's AGENTS.md in the cascade. */
+  flowTimezone?: string | null,
+  /** Only what the agent is granted — no runtime prepared. For a sub-agent,
+   *  whose tools are cut to its parent's and run in the parent's runtime. */
+  grantsOnly = false,
 ) {
   // agentDir is <data>/<tenant>/projects/<workspace>/agents/<agent>, so the
   // workspace a secret should resolve against is two levels up.
@@ -536,13 +732,37 @@ function agentContext(
   // than implied: told to read `../../knowledge/index.md`, the model asked for
   // `/knowledge/index.md` twice before working it out. Two denials and a turn,
   // for want of one sentence.
+  // The language this step works in, resolved before the prompt is built:
+  // its sentence goes in here, the env the tools read is set below, and the
+  // step prints any level that wrote something unreadable.
+  const language = agentLanguage(agentDir, tenant, front);
+  const region = agentRegion(agentDir, tenant, front, language.language);
+  // The clock is resolved further down for the env; the locale needs its
+  // zone now so "today" in a Jalali or Hijri calendar is today where the
+  // step works, not in UTC.
+  const localeZone = agentClock(agentDir, tenant, front, flowTimezone).timezone;
+  const locale: LocaleFacts = deriveLocale(language.language, region.region, agentLocaleOverrides(agentDir, tenant, front), localeZone);
+  // Said only when someone set it: an agent that never mentions a language
+  // or a region reads exactly the prompt it always did.
+  const languageSet = language.from !== "default" && language.from !== "env";
+  const regionSet = region.from !== "none" && region.from !== "env" && region.from !== "language";
+  if (languageSet || regionSet) {
+    parts.push(
+      `# Locale\n\n${localeProse(locale, languageName(language.language), regionName(region.region))} ` +
+        `Write in ${languageName(language.language)} unless the step you are given says otherwise; ` +
+        `use these currency, units and calendar conventions in anything you produce. ` +
+        `Your tools already know: a search asks in it and for this country, the browser reports it, a fetch requests it.`,
+    );
+  }
   parts.push(
     `# Where you are\n\n` +
       `Your working directory is \`agents/${path.basename(agentDir)}/\` inside the ` +
       `\`${workspace}\` workspace. Every path in this prompt is relative to it — ` +
-      `\`outputs/\` is yours, and \`../../\` is the workspace root, so the workspace's ` +
-      `own knowledge is at \`../../knowledge/\`. Absolute paths are outside the ` +
-      `workspace and will be refused.\n\n` +
+      `\`outputs/\` is yours, and \`workspace/\` is the workspace root, in every tool ` +
+      `and in the shell: the shared file store is \`workspace/storage/\`, what runs ` +
+      `carry forward is \`workspace/state/\`. (\`../../\` reaches the same root and ` +
+      `still works, so a path like \`../../knowledge/\` below is \`workspace/knowledge/\`.) ` +
+      `Absolute paths are outside the workspace and will be refused.\n\n` +
       // A flow's whole point is that a later step works on what an earlier one
       // produced, and each agent writes to its own outputs/. A run showed what
       // omitting this costs: the checker looked in its own empty outputs/ and
@@ -563,10 +783,18 @@ function agentContext(
       // adoptLegacyFilesDir's "move files/ to storage/" is a no-op by the time
       // the run ends — a deliverable written where this text pointed was
       // harvested from nowhere and silently never appeared.
-      `\`../../storage/\` is the workspace file store: anything you leave there is kept ` +
+      `\`workspace/storage/\` is the workspace file store: anything you leave there is kept ` +
       `after the run and shown on the Storage page for people to download. Write ` +
-      `deliverables people asked for — CSVs, reports, PDFs, images — to \`../../storage/\`; ` +
-      `use \`outputs/\` for working text the next step reads.`,
+      `deliverables people asked for — CSVs, reports, PDFs, images — to \`workspace/storage/\`; ` +
+      `use \`outputs/\` for working text the next step reads. ` +
+      // A Glob PATTERN that climbs (`../../storage/draft/*.md`) always answered
+      // "No files found", even when the file was there. On blog-desk that made
+      // every loop pass look like a first pass: the illustrator never saw the
+      // fact-check report, re-picked the cover, and 2 of 3 publish runs failed
+      // (run-munef2am-439a, 2026-09-30). checkPaths now splits such a pattern
+      // into Glob's `path` and the rest; the advice stays, as the plain form.
+      `To look for files there, open a known file with Read by its exact path, or ` +
+      `Glob with \`path: "workspace/storage/..."\` and a pattern like \`*.md\`.`,
   );
 
   // Shared context before anything derived — an account or workspace rule is
@@ -720,7 +948,7 @@ function agentContext(
   // for it. The difference is that state is small enough that inlining would
   // usually be free — that is a threshold worth adding once there is a real
   // file to size it against, not before.
-  const state = listDir(path.join(agentDir, "..", "..", "state"), "../../state/");
+  const state = listDir(path.join(agentDir, "..", "..", "state"), "workspace/state/");
   if (state.length) {
     parts.push(
       `# State — what you carry between runs\n\n` +
@@ -758,16 +986,29 @@ function agentContext(
   // below. The tool is the unit of code, so its dependencies live in tool.md
   // and travel with it; the agent should not have to repeat them.
   const toolRuntimes: RuntimeSpec[] = [];
+  // The secrets a granted script tool's file lists (`secrets: [RESEND_API_KEY,
+  // EMAIL_FROM]`): granting the tool grants them, the way an API tool's
+  // referenced credentials always travelled with it. Before, only the
+  // agent's own `secrets:` counted, so an agent that granted desk_email and
+  // declared nothing failed with "RESEND_API_KEY is not set" (strata-desk,
+  // 1 Oct). `proxied` / `materialised` say how, not what, and add nothing.
+  const toolSecrets: string[] = [];
+  // Does any granted tool act outside the workspace (`outward: true`)? The
+  // retry policy reads it: see launchStep.
+  let outward = false;
   const grantOwnTool = (name: string) => {
     const def = available[name];
     if (!def) {
       missingTools.push(name);
       return;
     }
+    if (def.outward) outward = true;
     if (def.kind === "http") apis.push(def.spec);
     else if (def.kind === "script") {
       scriptSpecs.push(...parseScripts([def.spec]));
-      const rt = parseRuntime((def.spec as { runtime?: unknown }).runtime);
+      const listed = (def.spec as { secrets?: unknown }).secrets;
+      if (Array.isArray(listed)) toolSecrets.push(...listed.map(String).filter((n) => /^[A-Z][A-Z0-9_]*$/.test(n)));
+      const rt = toolRuntime(def);
       if (rt) toolRuntimes.push(rt);
     }
     else {
@@ -812,7 +1053,65 @@ function agentContext(
   //
   // Declared-and-absent is still an error; referenced-and-absent is the API
   // tool's own missingSecrets, reported where the tool is described.
-  const declared: string[] = Array.isArray(front.secrets) ? front.secrets.map(String) : [];
+  // `web: {search: …, fetch: …}` name who answers; resolved here, early,
+  // because three later things hang off the answer — the secret the step
+  // must hold, the env the tool reads, and the egress grant for the host.
+  // `web.search` carries the account engine's settings (engines, categories,
+  // safesearch, …) beside the provider name, read off first the way
+  // browse's are, so the provider resolver sees only its own part.
+  const web = webConfig(front as Record<string, unknown>, workspaceFrontmatter(agentDir, tenant));
+  const searchRead = readSearchSettings(web.raw.search);
+  const searchChoice = resolveSearch(searchRead.rest, "search");
+  if (searchRead.error) searchChoice.error = searchChoice.error ?? searchRead.error;
+  const fetchChoice = resolveSearch(web.raw.fetch, "fetch");
+  // A remote browser's key is materialised, not proxied: CDP is a websocket
+  // and the wrapper opens the session itself, the way it seeds a cookie.
+  // `web.browse` carries two things in one key: how the browser presents
+  // itself (engine, user agent, device, locale, timezone) and, optionally,
+  // which remote vendor renders the page. Settings are read off first so the
+  // vendor resolver sees only the vendor part, and a block of settings alone
+  // means the account's own browser with those defaults. Nearest wins: the
+  // agent's block, else the workspace's, else the account's — the shape
+  // `provider:` already uses.
+  const browseRead = readBrowseSettings(web.raw.browse);
+  const browseSettings = browseRead.settings;
+  const browseChoice = resolveSearch(browseRead.rest, "browse");
+  if (browseRead.error) browseChoice.error = browseChoice.error ?? browseRead.error;
+  // What the vendor's own session is asked for, checked against what that
+  // vendor offers; a problem is on the record and the session is not sent.
+  const sessionProblems = browseChoice.error ? [] : browseSessionProblems(browseSettings, browseChoice.provider);
+  const browseSession = browseChoice.shape === "direct" && browseChoice.provider && !sessionProblems.length ? browseSettings.vendor_session : undefined;
+  // crawl, map, extract, answer, monitor: a provider each, or foldrun's own.
+  // Same three consequences as a search API — the secret the step holds, the
+  // env the web tool reads, the one host the key may reach.
+  const actionChoices = NEWER_ACTIONS.map((action) => ({ action, ...resolveActionApi(action, web.raw[action]) }));
+  const builtins = [
+    ...(searchChoice.provider && searchChoice.shape !== "direct" && !searchChoice.error ? ["search=WebSearch"] : []),
+    ...(fetchChoice.provider && fetchChoice.shape !== "direct" && !fetchChoice.error ? ["fetch=WebFetch"] : []),
+  ];
+  const webBuiltin: Record<string, string> = builtins.length ? { FOLDRUN_WEB_BUILTIN: builtins.join(",") } : {};
+  // A direct search API is paid for with the customer's own key, stored
+  // under a fixed vault name (EXA_API_KEY, BRAVE_SEARCH_API_KEY, …). Naming
+  // the API in frontmatter is declaring that secret — nobody should have to
+  // write it twice, and a run that forgot the second line would search
+  // nothing and say so only at the provider.
+  const declared: string[] = [
+    ...(Array.isArray(front.secrets) ? front.secrets.map(String) : []),
+    ...toolSecrets,
+    ...actionChoices.flatMap((c) => (c.provider ? [c.secret] : [])),
+    // Your own proxy for a vendor's session: its URL is a secret, declared by
+    // naming it, like a provider's key.
+    ...(browseSession && typeof browseSession.proxy === "object" && browseSession.proxy.own ? [browseSession.proxy.own] : []),
+    ...[searchChoice, fetchChoice, browseChoice].flatMap((c) => {
+      if (c.shape !== "direct" || !c.secret) return [];
+      // Jina's reader answers without a key. Declaring an absent optional
+      // key would fail the step for a credential it never needed.
+      if (c.secretOptional && !getSecret(tenant, c.secret, workspace)) return [];
+      return [c.secret];
+    }),
+  ];
+  // One name once, however many places asked for it.
+  declared.splice(0, declared.length, ...new Set(declared));
   const referenced = [...new Set(apis.flatMap(secretsUsedByApi))];
   const {
     env: secretEnv,
@@ -927,24 +1226,17 @@ function agentContext(
   // Runtime: an agent's own `runtime:` block, else its workspace's. Built once
   // per declaration and cached, so scripts get their dependencies without
   // polluting the host.
-  let runtimeSpec = parseRuntime(front.runtime);
-  if (!runtimeSpec) {
-    // AGENTS.md is the Linux Foundation standard name (60k+ repos, same
-    // nearest-wins cascade we already use); project.md stays accepted so
-    // nothing that already exists breaks.
-    runtimeSpec = parseRuntime(workspaceFrontmatter(agentDir, tenant).runtime);
-  }
   // Plus whatever the tools this agent granted declared for themselves.
-  runtimeSpec = mergeRuntimes(runtimeSpec, ...toolRuntimes);
+  let runtimeSpec = mergeRuntimes(ownRuntime(front, agentDir, tenant), ...toolRuntimes);
   // Execution: a container per run when Docker is available (real isolation),
   // otherwise the host venv path so local development still works.
   const executor = chooseExecutor();
   const runtimeLog: string[] = [];
   let runtimeError: string | null = null;
   let exec: ExecutionContext | null = null;
-  let runtime = { interpreters: {} as Record<string, string>, env: {} as Record<string, string>, log: [] as string[], error: null as string | null };
+  let runtime: PreparedRuntime = { interpreters: {}, env: {}, log: [], error: null };
 
-  if (executor === "docker") {
+  if (executor === "docker" && !grantsOnly) {
     const image = ensureImage(runtimeSpec);
     runtimeLog.push(...image.log);
     runtimeError = image.error;
@@ -961,23 +1253,103 @@ function agentContext(
         network: parseApis(front.apis).length > 0 || ownToolNames(front).length > 0,
       };
     }
+  } else if (isolatedRun() || grantsOnly) {
+    // (A sub-agent's grants are all that is asked of it: it runs inside its
+    // parent's step and runtime.)
+    // The sandbox builds it (run-container.ts, beside pip's network and the
+    // mounted cache); building it here as well was pure waste, and on a
+    // worker image without python it was worse than waste — it logged
+    // "python3 is not available on this host" as an error on every Python
+    // step, above a sandbox build that had succeeded, and sent every reader
+    // of the trace after the wrong machine.
   } else {
     runtime = prepareRuntime(tenant, runtimeSpec);
     runtimeLog.push(...runtime.log);
     runtimeError = runtime.error;
   }
 
-  // What day it is, in the workspace's own timezone. Not a secret, so it
-  // travels beside secretEnv rather than inside it — a value in there is
-  // redacted from every log line that quotes it.
-  const timezone = resolveTimezone(workspaceFrontmatter(agentDir, tenant));
+  // What day it is, in the calendar this step works to — the agent's own
+  // `timezone:`, else its flow's, else the workspace's, else the account's.
+  // Not a secret, so it travels beside secretEnv rather than inside it — a
+  // value in there is redacted from every log line that quotes it.
+  const clock = agentClock(agentDir, tenant, front, flowTimezone);
+  const timezone = clock.timezone;
   const clockEnv = {
-    TZ: timezone,
+    // The language the agent works in — what the search asks in, the locale
+    // the browser reports, the Accept-Language a fetch sends. Not a secret.
+    FOLDRUN_LANGUAGE: language.language,
+    // The country and what follows from it — web search's gl, a script's
+    // currency. Unset where nobody said, so nothing is invented.
+    ...(region.region ? { FOLDRUN_REGION: region.region } : {}),
+    ...(locale.currency ? { FOLDRUN_CURRENCY: locale.currency } : {}),
+    FOLDRUN_UNITS: locale.units,
+    FOLDRUN_CALENDAR: locale.calendar,
+    ...(locale.dateLocal ? { FOLDRUN_DATE_LOCAL: locale.dateLocal } : {}),
+    FOLDRUN_RTL: locale.direction === "rtl" ? "1" : "0",
+    // TZ is the form the sandbox's shell and Node both read; for a fixed
+    // offset that is not the same string Intl was given (see clock.ts).
+    TZ: clock.tz,
     FOLDRUN_DATE: localDate(timezone),
     // Where the account's own search engine answers, when the install runs
     // one — the `websearch` library tool reads it. Not a secret; rides with
     // the clock so it reaches scripts, the sandbox and verify alike.
     ...(process.env.FOLDRUN_SEARCH_URL ? { FOLDRUN_SEARCH_URL: process.env.FOLDRUN_SEARCH_URL } : {}),
+    // Whose index our web search asks when the agent named a search API.
+    // Unset means the account's own engine. The name, never the key.
+    ...(searchChoice.shape === "direct" && searchChoice.provider
+      ? { FOLDRUN_WEB_SEARCH_VIA: searchChoice.provider, FOLDRUN_WEB_SEARCH_SECRET: searchChoice.secret ?? "" }
+      : {}),
+    // The `web.search` block's SearXNG settings, as defaults the tool reads.
+    ...searchSettingsEnv(searchRead.settings),
+    ...(fetchChoice.shape === "direct" && fetchChoice.provider
+      ? { FOLDRUN_WEB_FETCH_VIA: fetchChoice.provider, FOLDRUN_WEB_FETCH_SECRET: fetchChoice.secret ?? "" }
+      : {}),
+    ...Object.fromEntries(actionChoices.flatMap((c) => (c.provider
+      ? [[`FOLDRUN_WEB_${c.action.toUpperCase()}_VIA`, c.provider], [`FOLDRUN_WEB_${c.action.toUpperCase()}_SECRET`, c.secret]]
+      : []))),
+    // Which actions the web tool may take (`web: {actions: [...]}`); unset is all.
+    ...(web.actions ? { FOLDRUN_WEB_ACTIONS: web.actions.join(",") } : {}),
+    // A model provider's own search or fetch, which the web tool hands over to.
+    ...webBuiltin,
+    // A remote browser: the wrapper connects over CDP to this vendor with
+    // the named key, and the platform leaves the account's pod alone.
+    ...(browseChoice.shape === "direct" && browseChoice.provider
+      ? { FOLDRUN_BROWSER_VENDOR: browseChoice.provider, FOLDRUN_BROWSER_SECRET: browseChoice.secret ?? "" }
+      : {}),
+    // The vendor session's settings (`web.browse.vendor_session:`), as JSON
+    // the tool maps onto that vendor's own option names. Under both names
+    // for one release: a web tool from before the rename reads the old one.
+    ...(browseSession ? { FOLDRUN_BROWSER_VENDOR_SESSION: JSON.stringify(browseSession), FOLDRUN_BROWSER_SESSION: JSON.stringify(browseSession) } : {}),
+    // The `web.browse` block, as defaults the tool reads when the call did
+    // not say otherwise. Env rather than arguments because the tool is a
+    // script the model calls: a default nobody typed should not have to be
+    // typed by the model either.
+    ...(browseSettings.engine ? { FOLDRUN_BROWSER_ENGINE: browseSettings.engine } : {}),
+    ...(browseSettings.user_agent ? { FOLDRUN_BROWSER_USER_AGENT: browseSettings.user_agent } : {}),
+    ...(browseSettings.device ? { FOLDRUN_BROWSER_DEVICE: browseSettings.device } : {}),
+    ...(browseSettings.locale ? { FOLDRUN_BROWSER_LOCALE: browseSettings.locale } : {}),
+    ...(browseSettings.timezone ? { FOLDRUN_BROWSER_TIMEZONE: browseSettings.timezone } : {}),
+    ...(browseSettings.cookies ? { FOLDRUN_BROWSER_COOKIES: browseSettings.cookies } : {}),
+    ...(browseSettings.cookie_domain ? { FOLDRUN_BROWSER_COOKIE_DOMAIN: browseSettings.cookie_domain } : {}),
+    ...(browseSettings.storage ? { FOLDRUN_BROWSER_STORAGE: browseSettings.storage } : {}),
+    ...(browseSettings.storage_origin ? { FOLDRUN_BROWSER_STORAGE_ORIGIN: browseSettings.storage_origin } : {}),
+    // The named identities, as one JSON map the tool picks from by name.
+    ...(browseSettings.identities ? { FOLDRUN_BROWSER_IDENTITIES: JSON.stringify(browseSettings.identities) } : {}),
+    // Only the non-default travels: a window, on a virtual screen if need be.
+    ...(browseSettings.headless === false ? { FOLDRUN_BROWSER_HEADLESS: "0" } : {}),
+    ...(browseSettings.version ? { FOLDRUN_BROWSER_VERSION: browseSettings.version } : {}),
+    ...(browseSettings.live ? { FOLDRUN_BROWSER_LIVE: "1" } : {}),
+    // What the agent may do, from its file: a lock the call cannot widen.
+    ...(browseSettings.allowed_domains ? { FOLDRUN_BROWSER_ALLOWED_DOMAINS: browseSettings.allowed_domains.join(",") } : {}),
+    ...(browseSettings.deny ? { FOLDRUN_BROWSER_DENY: browseSettings.deny.join(",") } : {}),
+    ...(browseSettings.boundaries ? { FOLDRUN_BROWSER_BOUNDARIES: "1" } : {}),
+    ...(browseSettings.init ? { FOLDRUN_BROWSER_INIT: browseSettings.init.join(",") } : {}),
+    ...(browseSettings.extensions ? { FOLDRUN_BROWSER_EXTENSIONS: browseSettings.extensions.join(",") } : {}),
+    ...(browseSettings.webgpu ? { FOLDRUN_BROWSER_WEBGPU: "1" } : {}),
+    ...(browseSettings.ignore_https_errors ? { FOLDRUN_BROWSER_IGNORE_HTTPS_ERRORS: "1" } : {}),
+    ...(browseSettings.state_key ? { FOLDRUN_BROWSER_STATE_KEY: browseSettings.state_key } : {}),
+    ...(browseSettings.video ? { FOLDRUN_BROWSER_VIDEO: "1" } : {}),
+    ...(browseSettings.live_view === false ? { FOLDRUN_BROWSER_LIVE_VIEW: "0" } : {}),
   };
 
   // Scripts declared as tools — callable by name, no bash required.
@@ -1022,7 +1394,7 @@ function agentContext(
   parts.push(
     "Write deliverables for people to workspace/storage/ (kept and downloadable); write working text for later steps to outputs/; " +
       "what the next run needs goes to workspace/state/. Paths are relative to your agent directory, or start with workspace/ " +
-      "for the workspace root (../../storage/ and workspace/storage/ are the same place). There is no /tmp for you: a " +
+      "for the workspace root (workspace/storage/ and the older ../../storage/ are the same place). There is no /tmp for you: a " +
       "directory a tool made outside the workspace, such as a checkout, is reached only through that tool.",
   );
 
@@ -1049,9 +1421,37 @@ function agentContext(
   const disabled: string[] = [];
   const unknownTools: string[] = [];
   const shadowed: string[] = [];
+  // `web: {search: …, fetch: …}` name who answers. Unset means ours — the
+  // account's own engine, and our own fetch, both inside the run's sandbox
+  // and both on the run record. A model provider's name adds the SDK's
+  // server-side tool beside ours, which the run's endpoint executes: point
+  // the run at z.ai and z.ai's index answers the search. The web tool hands
+  // the action over to it (FOLDRUN_WEB_BUILTIN).
+  const providerWebTools: string[] = [];
+  if (browseChoice.error) providerWarnings.push(browseChoice.error);
+  providerWarnings.push(
+    ...sessionProblems,
+    ...web.problems,
+    ...actionChoices.flatMap((c) => (c.error ? [c.error] : [])),
+  );
+  for (const [choice, builtin] of [
+    [searchChoice, "WebSearch"],
+    [fetchChoice, "WebFetch"],
+  ] as const) {
+    if (choice.error) {
+      providerWarnings.push(choice.error);
+    } else if (choice.provider && choice.shape !== "direct") {
+      // A provider's server-side tool replaces ours. A direct search API
+      // does not: our tool stays, and reads FOLDRUN_WEB_SEARCH_VIA to know
+      // whose index to ask — through the egress proxy, with the customer's
+      // own key, on the run record.
+      providerWebTools.push(builtin);
+    }
+  }
   let wantSearch = false;
   let wantHistory = false;
   let wantDesks = false;
+  let wantAsk = false;
 
   for (const ref of toolRefs(front)) {
     const toolName = ref.name;
@@ -1059,6 +1459,14 @@ function agentContext(
       disabled.push(toolName);
       continue;
     }
+    // `web` is our own tool, granted with the rest of them above. A model
+    // provider answering search or fetch on its own side (`web: {search:
+    // zai}`) adds that provider's tool beside it; the web tool's search then
+    // names it (FOLDRUN_WEB_BUILTIN) rather than asking our engine.
+    if (toolName === "web" && !ref.linked) {
+      allowed.push(...providerWebTools);
+      continue;
+    }
 
     // Resolution order: built-in group, exact SDK name, then your own tools.
     // Built-ins win a bare name, because their names are a small fixed set —
@@ -1070,11 +1478,12 @@ function agentContext(
     } else if (TOOL_MAP[toolName]) {
       allowed.push(...TOOL_MAP[toolName]);
       if (available[toolName]) shadowed.push(toolName);
-    } else if (toolName === "search" || toolName === "history" || toolName === "desks") {
+    } else if (toolName === "search" || toolName === "history" || toolName === "desks" || toolName === "ask") {
       // The platform's own groups, served in-process — built below, once
       // the roots and the records are known.
       if (toolName === "search") wantSearch = true;
       else if (toolName === "history") wantHistory = true;
+      else if (toolName === "ask") wantAsk = true;
       else wantDesks = true;
       if (available[toolName]) shadowed.push(toolName);
     } else if (BUILTIN_TOOLS.has(toolName)) {
@@ -1099,8 +1508,8 @@ function agentContext(
         { label: "memory/", dir: path.join(agentDir, "memory") },
         { label: "../../knowledge/", dir: path.join(wsRoot, "knowledge") },
         { label: "../../memory/", dir: path.join(wsRoot, "memory") },
-        { label: "../../state/", dir: path.join(wsRoot, "state") },
-        { label: `../../${STORAGE_DIR}/`, dir: path.join(wsRoot, STORAGE_DIR) },
+        { label: "workspace/state/", dir: path.join(wsRoot, "state") },
+        { label: `workspace/${STORAGE_DIR}/`, dir: path.join(wsRoot, STORAGE_DIR) },
         { label: "outputs/", dir: path.join(agentDir, "outputs") },
         { label: "[library] knowledge/", dir: libraryDir(tenant, "knowledge") },
         { label: "[library] memory/", dir: libraryDir(tenant, "memory") },
@@ -1122,6 +1531,14 @@ function agentContext(
   const historyTools = wantHistory ? buildHistoryTools(historyDigest) : { server: null, toolNames: [], promptLines: [] };
   const deskTools = wantDesks ? buildDeskTools(deskDigest) : { server: null, toolNames: [], promptLines: [] };
   allowed.push(...searchTools.toolNames, ...historyTools.toolNames, ...deskTools.toolNames);
+  // tools: [ask] — ask_person. Its server is built where the step runs (it
+  // needs the step's emit, and in a pod the proxy's address); here only the
+  // grant, the wait and the prompt's line.
+  const ask = wantAsk ? { timeoutSec: askTimeoutSec(front) } : null;
+  if (ask) {
+    allowed.push(ASK_TOOL);
+    parts.push(`# Asking a person\n\n${askPromptLine(ask.timeoutSec)}`);
+  }
   if (searchTools.promptLines.length || historyTools.promptLines.length || deskTools.promptLines.length) {
     parts.push(`# Finding things\n\n${[...searchTools.promptLines, ...historyTools.promptLines, ...deskTools.promptLines].join("\n")}`);
   }
@@ -1142,12 +1559,16 @@ function agentContext(
   return {
     front,
     clockEnv,
+    /** The zone, where it came from, and anything unreadable on the way —
+     *  reported by the step, not here, so it lands in the run's trace. */
+    clock,
     systemPrompt: parts.join("\n\n"),
     allowed: finalAllowed,
     disabled,
     unknownTools,
     shadowed,
     legacyUse,
+    retiredTools: retiredToolNames(front),
     mcpServers,
     mcpNames,
     apiTools,
@@ -1157,19 +1578,21 @@ function agentContext(
     // than using the servers built here.
     apiSpecs: apis,
     scriptSpecs,
+    outward: outward || scriptSpecs.some((sc) => sc.outward),
     searchRoots,
     historyDigest,
     deskDigest,
     searchTools,
     historyTools,
     deskTools,
+    ask,
     // `spec` is the MERGED declaration — the agent's own block or its
     // workspace's, plus every granted tool's. The isolated path builds its
     // runtime from this; passing the agent's frontmatter alone silently drops
     // what the tools declared, and a tool whose program needs a package it
     // asked for by name fails inside the container with "cannot find" while
     // the host path, which uses this same merged spec, works fine.
-    runtime: { log: runtimeLog, error: runtimeError, executor, spec: runtimeSpec },
+    runtime: { log: runtimeLog, error: runtimeError, executor, spec: runtimeSpec, dispose: runtime.dispose },
     secretEnv: { ...runtime.env, ...secretEnv },
     formatWarning: checkFormatVersion(workspaceFrontmatter(agentDir, tenant).foldrun_version).warning,
     providerEnv,
@@ -1177,8 +1600,19 @@ function agentContext(
     providerSecrets,
     providerWarnings,
     fallbackEnv,
-    translator,
-    fallbackTranslator,
+    region,
+    // Who answers web search and fetch, resolved once up top. The step
+    // needs them again to grant a direct API's key to its host.
+    searchChoice,
+    fetchChoice,
+    actionChoices,
+    web,
+    language,
+    // Stamped with the step's own zone: when one of these refuses, the
+    // reset time it reports is told in the calendar the step works to,
+    // not in the pod's UTC.
+    translator: translator && { ...translator, timezone },
+    fallbackTranslator: fallbackTranslator && { ...fallbackTranslator, timezone },
     apiWarnings,
     secretScopes,
     missingTools,
@@ -1208,28 +1642,36 @@ function agentContext(
  * Never fails a step: a link is bookkeeping, and a run that did its work must
  * not be marked failed because a URL could not be minted.
  */
-function publishPublicDir(
+async function publishPublicDir(
   tenant: string,
   workspace: string,
   push: (type: "info" | "error", text: string) => void,
-) {
+): Promise<void> {
   try {
-    const { added } = platform.syncPublicShares(tenant, workspace);
+    const { added } = await platform.syncPublicShares(tenant, workspace);
     if (added.length) push("info", `shared: ${added.join(", ")}`);
   } catch (err) {
     push("error", `shares: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 
-function repriced(
+export function repriced(
   catalog: Catalog | null,
   model: string,
   usage: { inputTokens: number; outputTokens: number } | null,
   sdkCost: number | null,
   push: (type: "info" | "error", text: string) => void,
+  /** The step's turns each priced at its own model — set when a sub-agent
+   *  ran on a different model (ExecOutcome.turnsCostUsd). The lump `usage`
+   *  priced at the step's model would bill those turns at the wrong rate. */
+  turnsCostUsd?: number | null,
 ): number | null {
   const known = usage ? catalogCost(catalog, model, usage) : null;
   if (known === null) return sdkCost;
+  if (typeof turnsCostUsd === "number") {
+    push("info", `cost from each model turn at its own model's rate: $${turnsCostUsd.toFixed(6)} (sub-agents ran on other models)`);
+    return turnsCostUsd;
+  }
   if (sdkCost !== null && Math.abs(known - sdkCost) > 0.000001) {
     push("info", `cost repriced from the gateway's catalogue: $${known.toFixed(6)} (sdk said $${sdkCost.toFixed(6)})`);
   }
@@ -1248,7 +1690,8 @@ function repriced(
  */
 export function recordAttempt(
   step: StepRecord,
-  n: number,
+  /** The step's attempt (`attempts`) these rows belong to. */
+  attempt: number,
   status: "completed" | "failed",
   startedAt: string,
   eventsBefore: number,
@@ -1261,24 +1704,74 @@ export function recordAttempt(
     .slice(eventsBefore)
     .filter((e) => e.type === "error")
     .at(-1)?.text;
+  // Re-attached: the same attempt, so its rows — the last one, and the lost
+  // slim go before it — are replaced, not repeated.
+  const kept = [...tries];
+  const attemptOf = (t: StepAttempt) => t.attempt ?? t.n;
+  if (reattach && kept.length && attemptOf(kept.at(-1)!) === attempt) {
+    kept.pop();
+    if (kept.length && attemptOf(kept.at(-1)!) === attempt && kept.at(-1)!.status === "lost") kept.pop();
+  }
+  // Tries are numbered in the order they ran: a full re-run after a lost
+  // slim go is the next try, not the same number again (live, 2026-10-01,
+  // both rows read n: 1). `attempt` says which attempt a row belongs to
+  // when its number no longer does.
+  let next = (kept.at(-1)?.n ?? 0) + 1;
+  const numbered = () => {
+    const n = next++;
+    return n === attempt ? { n } : { n, attempt };
+  };
+  // A slim go the browser pod was lost under, before this attempt re-ran
+  // on the full image: its own row, first (runStep set it aside).
+  const lost: StepAttempt[] = step.podLostTry ? [{ ...numbered(), ...step.podLostTry, startedAt }] : [];
   const row: StepAttempt = {
-    n,
+    ...numbered(),
     status,
     costUsd: step.costUsd,
     tokens: step.tokens ?? null,
     computeSecs: step.computeSecs ?? null,
-    startedAt,
+    startedAt: step.podLostTry?.finishedAt ?? startedAt,
     finishedAt: step.finishedAt ?? new Date().toISOString(),
     ...(status === "failed" && lastError ? { error: lastError.slice(0, 500) } : {}),
+    ...(step.image?.variant ? { image: step.image.variant } : {}),
+    ...(step.browserPod ? { browserPod: browserPodLine(step.browserPod) } : {}),
   };
-  const kept = reattach && tries.at(-1)?.n === n ? tries.slice(0, -1) : tries;
-  step.tries = [...kept, row];
+  delete step.podLostTry;
+  step.tries = [...kept, ...lost, row];
   const totals = sumAttempts(step.tries);
   step.costUsd = totals.costUsd;
   step.tokens = totals.tokens;
   step.computeSecs = totals.computeSecs;
 }
 
+/** A question an agent asked mid-step goes where approvals go (the
+ *  workspace's notify:, `awaiting-approval` events), with the way to answer. */
+async function notifyQuestion(tenant: string, workspace: string, runId: string, agent: string, question: string, options?: string[]): Promise<void> {
+  const origin = (process.env.FOLDRUN_PUBLIC_URL ?? "").replace(/\/+$/, "");
+  const where = origin ? `${origin}/dashboard/${encodeURIComponent(workspace)}/runs/${encodeURIComponent(runId)}${tenant !== "default" ? `?tenant=${encodeURIComponent(tenant)}` : ""}` : `run ${runId}`;
+  await sendPlainNotification(tenant, workspace, {
+    event: "awaiting-approval",
+    headline: `${agent} is asking you something`,
+    detail: `${question}${options?.length ? `\n\nOptions: ${options.join(" · ")}` : ""}\n\nAnswer it on ${where}, or \`foldrun answer ${runId} "…"\`.`,
+    runId,
+  }).catch(() => false);
+}
+
+/** The local stand-in for a person: the terminal, when there is one. */
+async function terminalAsk(question: string, options?: string[]): Promise<string | null> {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return null;
+  const { createInterface } = await import("node:readline/promises");
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const list = options?.length ? `\n${options.map((o, i) => `  ${i + 1}. ${o}`).join("\n")}\n` : "";
+    const raw = (await rl.question(`\n  the agent asks: ${question}${list}\n  your answer: `)).trim();
+    const n = Number(raw);
+    return options?.length && Number.isInteger(n) && n >= 1 && n <= options.length ? options[n - 1] : raw || null;
+  } finally {
+    rl.close();
+  }
+}
+
 async function runStep(
   agentDir: string,
   tenant: string,
@@ -1305,6 +1798,13 @@ async function runStep(
    *  in-process model loop, so a stop lands mid-step and not at the next
    *  group. The isolated path needs none: stopRun destroys the sandbox. */
   stopRequested?: () => boolean,
+  /** The flow's `timezone:`, for the clock cascade. Undefined for a step
+   *  run outside any flow, which still gets agent → workspace → account. */
+  flowTimezone?: string | null,
+  /** The step's index in run.steps, carried on its egress lease so a
+   *  person's message to this step reaches this step's own inbox and not a
+   *  sibling's running in the same group. Undefined outside a flow. */
+  stepIndex?: number,
 ) {
   // Secret values are injected into scripts as environment variables and
   // substituted into API headers, so a model that reads one back — from a
@@ -1323,6 +1823,11 @@ async function runStep(
   // cover a script's own stdout.
   let redactions: [string, string][] = [];
   let fileDir: string | null = null;
+  let disposeRuntime: (() => void) | undefined;
+  // Can this step's tools act outside the workspace? Set once its context is
+  // read; the verdict at the end of this function reads it.
+  let canActOutward = false;
+  const eventsAtStart = step.events.length;
   const redact = (text: string) => {
     let out = text;
     for (const [value, name] of redactions) out = out.split(value).join(`[redacted:${name}]`);
@@ -1346,7 +1851,16 @@ async function runStep(
   };
 
   const push = (type: StepRecord["events"][number]["type"], text: string, extra?: EventExtra) => {
-    step.events.push({ t: new Date().toISOString(), type, text: redact(text), ...extra });
+    const t = new Date().toISOString();
+    step.events.push({ t, type, text: redact(text), ...extra });
+    // A person in the loop: the question, its answer, a message delivered —
+    // onto the step, so the run page, the API and history show them.
+    if (extra?.operator) {
+      applyOperatorEvent(step, extra.operator, t);
+      if (extra.operator.kind === "asked" && runId && !testRun) {
+        void notifyQuestion(tenant, path.basename(path.resolve(agentDir, "..", "..")), runId, step.agent, extra.operator.question, extra.operator.options);
+      }
+    }
     save();
   };
 
@@ -1366,7 +1880,9 @@ async function runStep(
       ? fs.readFileSync(stubFile, "utf8").split(/\n---\n/)
       : [`stub result from ${step.agent}`];
     const call = step.events.filter((e) => e.text.startsWith("stub call")).length;
-    push("info", `stub call ${call + 1}`);
+    // The ceiling it was given rides on the line, so the budget arithmetic
+    // around fan-out is testable without a model to stop.
+    push("info", `stub call ${call + 1}${stepBudgetUsd !== null ? ` (ceiling $${stepBudgetUsd.toFixed(2)})` : ""}`);
     step.status = "completed";
     // A stub answer may open with `cost: 0.25` — a pretend price, so the
     // parts of orchestration that watch money (budget:) are testable too.
@@ -1409,14 +1925,19 @@ async function runStep(
     // step: the generic HTTP tool still works without the typed ones.
     for (const w of await prefetchOpenApi(tenant, openApiSources(agentDir, tenant))) push("error", `openapi: ${w}`);
     const {
-      front, clockEnv, systemPrompt, allowed, disabled, apiTools, scriptTools,
+      front, clockEnv, clock, systemPrompt, allowed, disabled, apiTools, scriptTools,
       secretEnv, secretScopes, missingSecrets, missingTools, runtime,
-      unknownTools, shadowed, legacyUse, mcpServers, mcpNames,
+      unknownTools, shadowed, legacyUse, retiredTools, mcpServers, mcpNames,
       apiSpecs, scriptSpecs, brokenTools, size: agentSize,
       providerEnv, providerLabel, providerSecrets, providerWarnings, formatWarning,
+      searchChoice, fetchChoice, actionChoices, web, language, region,
       fallbackEnv, apiWarnings, searchRoots, historyDigest, deskDigest, searchTools, historyTools, deskTools,
+      ask,
       translator, fallbackTranslator,
-    } = agentContext(agentDir, tenant, tags, { runId, agent: step.agent });
+      outward,
+    } = agentContext(agentDir, tenant, tags, { runId, agent: step.agent }, flowTimezone);
+    disposeRuntime = runtime.dispose;
+    canActOutward = outward;
     // A retry that moved the step up a class (an evicted or OOM-killed
     // attempt) wins over the agent's own `size:` for the attempts after.
     const size = step.sizeUp ?? agentSize;
@@ -1442,15 +1963,24 @@ async function runStep(
       // Longest first, so a value containing another is replaced whole.
       .sort((a, b) => b[0].length - a[0].length);
 
+    // One line for the clock: which zone this step works to, and which level
+    // set it. "Why is this dated yesterday" should be answerable from the run.
+    push("info", `clock: ${clock.timezone} (${clock.source}) — today is ${clockEnv.FOLDRUN_DATE}`);
+    // And one more only when something written could not be read as a zone.
+    for (const problem of clock.problems) push("error", problem);
     if (providerLabel) push("info", `provider: ${providerLabel}`);
     for (const w of providerWarnings) push("error", w);
+    // A level that wrote a language nobody can read was skipped, not obeyed.
+    for (const l of language.lines) push("info", l);
+    for (const l of region.lines) push("info", l);
     for (const w of apiWarnings) push("error", `openapi: ${w}`);
     if (formatWarning) push("error", formatWarning);
     if (legacyUse.length) push("error", legacyUseError(legacyUse));
+    for (const t of retiredTools) push("error", retiredToolError(t));
     for (const t of unknownTools) {
       push(
         "error",
-        `tools: "${t}" is not a tool group (web, fetch, read, files, bash, search, history), an SDK tool name, or a tool in this workspace's library — nothing was granted for it`,
+        `tools: "${t}" is not a tool group (read, write, code, search, history, desks), an SDK tool name, or a tool in this workspace's library — nothing was granted for it`,
       );
     }
     for (const name of mcpNames) push("info", `mcp server connected: ${name}`);
@@ -1568,9 +2098,11 @@ async function runStep(
 
     // Expose the workspace's shared scripts/ as ./shared so every agent reaches
     // them by the same path, without each one carrying a copy.
-    // No symlinks into the agent directory — they would recurse into the
-    // workspace's own file listing. Shared paths are resolved by the script
-    // tool layer and described to the agent below.
+    // No permanent symlinks into the agent directory — they would recurse
+    // into the workspace's own file listing. Shared paths are resolved by the
+    // script tool layer and described to the agent below; the one link there
+    // is, `workspace` → the root for the shell, lives only for the length of
+    // a step (executeStep, confine.ts#linkWorkspace).
 
     // The confinement boundary: agents in a workspace are one team, but the
     // workspace is where isolation is enforced.
@@ -1660,14 +2192,39 @@ async function runStep(
     for (const m of missingConsults) {
       push("error", `agents: "${m}" is not an agent in this workspace — no consult tool granted`);
     }
-    const consultNames = consults.length ? [...mcpNames, "foldrun_agents"] : mcpNames;
+    const consultNames = [
+      ...mcpNames,
+      ...(consults.length ? ["foldrun_agents"] : []),
+      ...(ask ? ["foldrun_ask"] : []),
+    ];
+
+    // Colleagues this agent may DELEGATE to: each with its own context and
+    // its own tools — resolved exactly as its own step's would be, then cut
+    // to what THIS step holds (subagents.ts). Built host-side, like consults.
+    const subagents = buildSubagentSpecs({
+      names: front.subagents, self: step.agent, workspaceRoot, tenant, tags, runId, flowTimezone,
+      parentAllowed: [...allowed, ...consultNames.map((n) => `mcp__${n}`)], push,
+    });
+    if (subagents.length) {
+      // The delegation tool itself, granted only when there is someone to
+      // delegate to.
+      allowed.push(DELEGATE_TOOL);
+      for (const s of subagents) push("info", `subagent: ${s.name} — ${s.tools.length ? s.tools.join(", ") : "no tools"}`);
+    }
 
     // The last provider refusal this step saw, for the fallback decision —
     // watched on both paths, because a refusal reads the same from a pod
     // and from this process.
     let lastRefusal = "";
+    // And WHY it refused, in words, when anything on the way saw the
+    // headers that say so: the translator here, the egress proxy over
+    // there. Kept apart from `lastRefusal` — that one decides whether to
+    // fall back, this one is what a person reads afterwards.
+    let refusalWhy = "";
     const pushWatching: typeof push = (type, text, extra) => {
       if (type === "error" && isProviderRefusal(text)) lastRefusal = text;
+      const why = refusalFromLine(text);
+      if (why) refusalWhy = why;
       push(type, text, extra);
     };
     // The second supply: the block's own fallback when it declared one (a
@@ -1675,6 +2232,28 @@ async function runStep(
     // fallback), else the platform's, and only for a step riding the
     // platform credential.
     const secondSupply = fallbackEnv ?? (Object.keys(providerEnv).length === 0 ? platformFallbackEnv() : null);
+    // Where this step stands on a second supply, for the refusal sentence.
+    // It starts as the truth before anything has run and becomes
+    // "exhausted" the moment the fallback has had its turn — the owner is
+    // about to remove the OpenRouter fallback, so "none" becomes the normal
+    // reading and has to look like a decision on the page.
+    let supplyState: SupplyState = secondSupply ? "trying" : "none";
+    // The line a person reads when this step ends failed: the reason, if
+    // anything on the way learned one, else the status put into words, and
+    // in every case where the step could go next. Pushed last so it is the
+    // last error event — which is what runFailure, the desks' headlines and
+    // `foldrun report` read.
+    const sayWhy = (status: StepRecord["status"]) => {
+      if (status !== "failed" || !lastRefusal) return;
+      const said = Number(lastRefusal.match(/API Error: (\d{3})/)?.[1] ?? NaN);
+      const why =
+        refusalWhy ||
+        explainRefusal({
+          status: Number.isFinite(said) && isRefusalStatus(said) ? said : 402,
+          timezone: clock.timezone,
+        });
+      push("error", `${why}${supplyNote(supplyState)}`);
+    };
 
     // `schema:` — inline on the step, or a file under the workspace read
     // now, host-side, so both executors are handed the same document. A
@@ -1685,6 +2264,18 @@ async function runStep(
       throw new Error(`schema: ${step.schemaPath} — not a readable JSON or YAML schema under the workspace`);
     }
     if (step.maxTurns) push("info", `max_turns: ${step.maxTurns}`);
+    // `limits:` — account, workspace, agent, then this step's option;
+    // nearest wins per key. Enforced in the model loop's hook, on either
+    // path (step-exec.ts), so it is resolved here as plain values.
+    const stepLimits = cascadeLimits([
+      readAgentsMd(accountDir(tenant))?.data?.limits,
+      readAgentsMd(workspaceRootOf(agentDir))?.data?.limits,
+      front.limits,
+      step.limits,
+    ]);
+    const limitOwners = toolOwners(apiTools.owners, scriptSpecs);
+    const limitOpts = Object.keys(stepLimits).length ? { limits: stepLimits, toolOwners: limitOwners } : {};
+    if (limitOpts.limits) push("info", `limits: ${Object.entries(stepLimits).map(([k, n]) => `${k} ${n}`).join(", ")} — per step; a call past one is refused`);
 
     const isolation = process.env.FOLDRUN_RUN_ISOLATION;
     if (isolatedRun()) {
@@ -1708,7 +2299,18 @@ async function runStep(
       // before anything is copied in. Null where no proxy is configured
       // (the CLI, a compose install without FOLDRUN_EGRESS_URL), and then
       // everything below materialises exactly as it always did.
-      const grant: EgressGrant = { secrets: {} };
+      const grant: EgressGrant = { secrets: {}, timezone: clock.timezone };
+      // A direct search API's key: granted to that API's host and no other,
+      // exactly as an http tool's key is granted to its base URL's host. The
+      // script sends the placeholder; the worker fills it on the way out.
+      for (const choice of [searchChoice, fetchChoice]) {
+        if (choice.shape === "direct" && choice.secret && choice.host && choice.secret in liveSecrets) {
+          addGrant(grant, choice.secret, liveSecrets[choice.secret], choice.host);
+        }
+      }
+      for (const c of actionChoices) {
+        if (c.provider && c.secret in liveSecrets) addGrant(grant, c.secret, liveSecrets[c.secret], c.host);
+      }
       for (const api of apiSpecs) {
         const host = hostOf(api.base);
         if (!host) continue;
@@ -1726,13 +2328,16 @@ async function runStep(
           }
         }
       }
-      const lease = await platform.egress.lease({ tenant, runId: runId ?? "adhoc", grant, test: testRun });
+      const lease = await platform.egress.lease({ tenant, runId: runId ?? "adhoc", grant, test: testRun, ...(stepIndex !== undefined && stepIndex >= 0 ? { step: stepIndex } : {}) });
       // Which secrets must still be real inside the sandbox: a script tool
       // reads them from its environment, and unless it says `secrets:
       // proxied` it needs the value, not the name. bash is a script by
       // another route. The record says which way it went, and why.
       const materialisers = [
         ...scriptSpecs.filter((sc) => sc.secrets !== "proxied").map((sc) => sc.name),
+        // web proxies its keys — unless it may browse: a remote browser's key
+        // goes into a websocket, and cookie and login secrets into the page.
+        ...(scriptSpecs.some((sc) => sc.name === "web") && (!web.actions || web.actions.includes("browse")) ? ["web (browse)"] : []),
         ...(allowed.includes("Bash") ? ["bash"] : []),
       ];
       const materialise = !lease || materialisers.length > 0;
@@ -1810,7 +2415,7 @@ async function runStep(
         libraryRoot: libraryDir(tenant),
         galleryRoot: platform.galleryDir() ?? undefined,
         // Keys this step's dependency cache. Per-account by design — see
-        // run-container.ts#runtimeCacheDir for why it is not shared.
+        // run-container.ts#runtimeCacheMount for why it is not shared.
         tenant,
         input: {
           agentRel: path.relative(workspaceRoot, agentDir).replaceAll("\\", "/"),
@@ -1827,6 +2432,7 @@ async function runStep(
           // field. A tool's own `runtime:` is part of what this step needs.
           runtime: runtime.spec,
           consults,
+          ...(subagents.length ? { subagents } : {}),
           timeoutSec: step.timeout,
           budgetUsd: stepBudgetUsd,
           budgetNote: stepBudgetNote,
@@ -1835,7 +2441,12 @@ async function runStep(
           output: step.output,
           schema: resolvedSchema ?? undefined,
           maxTurns: step.maxTurns,
+          ...limitOpts,
           translator: keyName === MODEL_KEY_NAME ? primaryTranslator : secondTranslator,
+          // Outward steps keep a browser of their own: an executor that
+          // could browse from the slim image through the account's pod
+          // leaves them on the full one (browser-pod.ts).
+          ...(outward ? { outward: true } : {}),
           // The container sees the workspace at /workspace and the library
           // at /library; the roots are named host-side and moved here.
           search: searchRoots.map((r) => ({
@@ -1846,6 +2457,7 @@ async function runStep(
           })),
           history: historyDigest,
           desks: deskDigest,
+          ...(ask ? { ask } : {}),
         },
         env: Object.fromEntries(
           Object.entries({
@@ -1897,8 +2509,38 @@ async function runStep(
       // attempt holds its own sandbox, so the meter owes the sum.
       const firstArgs = isolatedArgs(platformModelEnv());
       await lease?.commit();
-      let outcome = await runIsolated(firstArgs);
+      let credentialUsed = platformModelCredential();
+      // The arguments of the attempt whose outcome is current — what a
+      // re-run on the full image repeats, on the same model supply.
+      let lastArgs: typeof firstArgs = firstArgs;
+      const runTracked = (a: typeof firstArgs) => {
+        lastArgs = a;
+        return runIsolated(a);
+      };
+      let outcome = await runTracked(firstArgs);
       step.sandbox = null; // whatever happens next starts its own
+      // A 401 from a token that rotated mid-step is not a broken key: the
+      // replacement is already on its way to the mounted file. Wait for it
+      // once, then fall into the same retry the busy case uses.
+      if (outcome.status === "failed" && isAuthRefusal(lastRefusal)) {
+        push("info", `the model credential was refused mid-step — waiting for the refreshed one`);
+        const rotated = await awaitRotatedCredential(credentialUsed);
+        if (rotated) {
+          push("info", "the credential rotated under this step; retrying on the new one");
+          credentialUsed = rotated;
+          lastRefusal = "";
+          const previous = outcome.timing;
+          // Build first: isolatedArgs is what re-grants the model key, and
+          // commit() is what publishes the grant to Redis, where the proxy
+          // reads it. Committing first sent the revoked token again — every
+          // rotation retry on 2026-09-22/23 401'd this way.
+          const retry = isolatedArgs(platformModelEnv());
+          await lease?.commit();
+          outcome = withEarlierTiming(await runTracked(retry), previous);
+        } else {
+          push("info", "the credential did not change — this is the key itself, not a rotation");
+        }
+      }
       for (let n = 1; n <= OVERLOAD_RETRIES && outcome.status === "failed" && isTransientOverload(lastRefusal); n++) {
         const wait = backoffMs(n, lastRefusal);
         push("info", `provider busy (${lastRefusal.slice(0, 60)}) — waiting ${(wait / 1000).toFixed(1)}s, attempt ${n} of ${OVERLOAD_RETRIES}`);
@@ -1909,7 +2551,7 @@ async function runStep(
         const previous = outcome.timing;
         const again = isolatedArgs(platformModelEnv());
         await lease?.commit();
-        outcome = await runIsolated(again);
+        outcome = await runTracked(again);
         outcome = withEarlierTiming(outcome, previous);
       }
       // The second supply, tried exactly once, and only when the primary
@@ -1937,22 +2579,66 @@ async function runStep(
           ),
         };
         await lease?.commit();
-        outcome = await runIsolated(fallbackArgs);
+        supplyState = "exhausted";
+        outcome = await runTracked(fallbackArgs);
         // Both attempts held sandboxes; the meter owes the sum. The first
         // try's pod ran, was billed for by the platform, and must not
         // vanish from the record because a second try replaced its outcome.
         outcome = withEarlierTiming(outcome, first);
       }
+      // Slim browsing (browser-pod.ts): the step ran on the slim image and
+      // the account's browser pod went away under it, past the web tool's
+      // reconnects. Reads only — run it again from the start on the full
+      // image, where a browser in the step is always there. Anything
+      // written — fail it, naming what, and leave retry:/on-fail:/a person
+      // to decide; a second go could send or charge twice.
+      step.image = outcome.image ?? null;
+      step.browserPod = outcome.browserPod ? { ...outcome.browserPod } : null;
+      if (outcome.status === "failed" && outcome.browserPod?.lost) {
+        const decision = podLossDecision(outcome.browserPod);
+        if (decision.rerun) {
+          push("info", decision.note);
+          const first = outcome;
+          // The slim go is a try of its own on the record — image slim,
+          // status lost, its own cost, tokens and sandbox seconds — so the
+          // run page and `foldrun report` show two tries, slim (lost) then
+          // full, and the step's totals are the sum of both rows
+          // (recordAttempt). Live, 2026-10-01, the step showed only the
+          // full re-run.
+          step.podLostTry = {
+            status: "lost",
+            costUsd: repriced(catalog, wireModel, first.usage ?? null, first.costUsd, push, first.turnsCostUsd),
+            tokens: first.usage ? { input: first.usage.inputTokens, output: first.usage.outputTokens } : null,
+            computeSecs: first.timing ? Math.round(first.timing.totalMs) / 1000 : null,
+            finishedAt: new Date().toISOString(),
+            error: decision.note.slice(0, 500),
+            image: "slim",
+            browserPod: browserPodLine(first.browserPod!),
+          };
+          const again = { ...lastArgs, input: { ...lastArgs.input, image: "full" as const }, resume: null };
+          await lease?.commit();
+          outcome = await runTracked(again);
+          step.image = outcome.image ?? { variant: "full", why: "re-run after the browser pod was lost" };
+          step.browserPod = { ...first.browserPod!, fallback: RERAN_ON_FULL };
+        } else {
+          push("error", decision.message);
+          step.browserPod = { ...outcome.browserPod, failure: decision.message };
+        }
+      }
       if (lease) {
         for (const line of await lease.drainLog()) {
-          if (typeof line === "string") push("info", line);
-          else push("info", line.text, { effect: line.effect });
+          // pushWatching, not push: a line the proxy wrote may carry the
+          // refusal mark, and that sentence is the whole reason the proxy
+          // reads response headers at all.
+          if (typeof line === "string") pushWatching("info", line);
+          else pushWatching("info", line.text, { effect: line.effect });
         }
         await lease.release();
       }
       // Nothing a test run left in storage/public/ reached storage/, so
       // there is nothing to publish — and a share link is an outward act.
-      if (!testRun) publishPublicDir(tenant, path.basename(workspaceRoot), push);
+      if (!testRun) await publishPublicDir(tenant, path.basename(workspaceRoot), push);
+      sayWhy(outcome.status);
       step.status = outcome.status;
       step.result = redactText(outcome.result);
       step.conclusion = redactText(outcome.conclusion);
@@ -1961,7 +2647,7 @@ async function runStep(
       // so — OOMKilled, Evicted — on the record, where the retry reads it.
       if (outcome.status === "failed" && outcome.reason) push("error", `sandbox ended: ${outcome.reason}`);
       if (outcome.data !== undefined) step.data = redactData(outcome.data);
-      step.costUsd = repriced(catalog, wireModel, outcome.usage ?? null, outcome.costUsd, push);
+      step.costUsd = repriced(catalog, wireModel, outcome.usage ?? null, outcome.costUsd, push, outcome.turnsCostUsd);
       step.tokens = outcome.usage
         ? { input: outcome.usage.inputTokens, output: outcome.usage.outputTokens }
         : null;
@@ -2011,6 +2697,9 @@ async function runStep(
         { ...hostSafeEnv(), ...stepSecrets, ...providerEnv },
         (type, text) => push(type, text),
       );
+      // On this machine nobody can write in and there is no proxy: the
+      // question goes to the terminal when there is one, else unanswered.
+      const askTools = ask ? buildAskTool({ channel: null, timeoutSec: ask.timeoutSec, emit: push, local: terminalAsk }) : null;
       // @file secrets become 0600 paths here (host run), cleaned up in the
       // finally — once, however many attempts follow.
       const mat = materializeFileSecrets(agentDir, stepSecrets);
@@ -2019,6 +2708,7 @@ async function runStep(
         agentDir,
         workspaceRoot,
         libraryRoot: libraryDir(tenant),
+        ...(subagents.length ? { subagents } : {}),
         prompt,
         model,
         effort,
@@ -2032,6 +2722,7 @@ async function runStep(
           ...(searchTools.server ? { foldrun_search: searchTools.server } : {}),
           ...(historyTools.server ? { foldrun_history: historyTools.server } : {}),
           ...(deskTools.server ? { foldrun_desks: deskTools.server } : {}),
+          ...(askTools ? { foldrun_ask: askTools.server } : {}),
           ...mcpServers,
         },
         // Declared secrets reach the agent's scripts as env vars; the model
@@ -2048,6 +2739,7 @@ async function runStep(
         output: step.output,
         schema: resolvedSchema ?? undefined,
         maxTurns: step.maxTurns,
+        ...limitOpts,
         stopRequested,
         // What the scripts saw, the verify sees: a flow can then check that
         // the proof a step left names THIS run, not one that came before —
@@ -2076,7 +2768,7 @@ async function runStep(
           return await attemptInProcess(t ? { ...modelEnv, ...t.env } : modelEnv);
         } finally {
           if (t) {
-            for (const line of t.drainLog()) push("info", line.startsWith("translator") ? line : `translator: ${line}`);
+            for (const line of t.drainLog()) pushWatching("info", line.startsWith("translator") ? line : `translator: ${line}`);
             await t.close();
           }
           if (before && runId) {
@@ -2085,7 +2777,22 @@ async function runStep(
           }
         }
       };
+      let credentialUsed = platformModelCredential();
       let outcome = await attemptThrough(providerEnv, translator);
+      // Same rule as the isolated path: a credential that rotated under the
+      // step is waited out and retried before anything else is considered.
+      if (outcome.status === "failed" && isAuthRefusal(lastRefusal)) {
+        push("info", `the model credential was refused mid-step — waiting for the refreshed one`);
+        const rotated = await awaitRotatedCredential(credentialUsed);
+        if (rotated) {
+          push("info", "the credential rotated under this step; retrying on the new one");
+          credentialUsed = rotated;
+          lastRefusal = "";
+          outcome = await attemptThrough(providerEnv, translator);
+        } else {
+          push("info", "the credential did not change — this is the key itself, not a rotation");
+        }
+      }
       // Same rule as the isolated path: a busy provider is waited out on
       // the supply it refused from, before any fallback is considered.
       for (let n = 1; n <= OVERLOAD_RETRIES && outcome.status === "failed" && isTransientOverload(lastRefusal); n++) {
@@ -2102,16 +2809,18 @@ async function runStep(
           "info",
           `primary model supply refused (${lastRefusal.slice(0, 80)}) — retrying this step on the fallback provider`,
         );
+        supplyState = "exhausted";
         outcome = await attemptThrough(secondSupply, fallbackEnv && secondSupply === fallbackEnv ? fallbackTranslator : null);
       }
-      if (!testRun) publishPublicDir(tenant, path.basename(workspaceRoot), push);
+      if (!testRun) await publishPublicDir(tenant, path.basename(workspaceRoot), push);
+      sayWhy(outcome.status);
       step.status = outcome.status;
       step.result = redactText(outcome.result);
       step.conclusion = redactText(outcome.conclusion);
       if (outcome.data !== undefined) step.data = redactData(outcome.data);
       // A consult's spend belongs to the step that asked.
       const consultCost = consultTools.drainCost();
-      const stepCost = repriced(catalog, wireModel, outcome.usage, outcome.costUsd, push);
+      const stepCost = repriced(catalog, wireModel, outcome.usage, outcome.costUsd, push, outcome.turnsCostUsd);
       step.costUsd = stepCost === null && consultCost === 0 ? null : (stepCost ?? 0) + consultCost;
       step.tokens = outcome.usage
         ? { input: outcome.usage.inputTokens, output: outcome.usage.outputTokens }
@@ -2128,9 +2837,33 @@ async function runStep(
     } catch {
       // best-effort — a leftover scratch file is swept with the run's outputs
     }
+    try {
+      // A private runtime build (see prepareRuntime) is this step's alone.
+      disposeRuntime?.();
+    } catch {
+      // best-effort — it is in the tmpdir
+    }
   }
   step.finishedAt = new Date().toISOString();
   save();
+  return { actedThenFailedCheck: canActOutward && actedThenFailedCheck(step.events.slice(eventsAtStart)) };
+}
+
+/**
+ * Did this attempt call its tools and then fail only on the check after —
+ * `verify:`, `output: json`, a schema? For a step whose tools act outward
+ * that is the one failure a retry must not answer: the email went, the post
+ * is up, and the check failing says nothing about whether they happened. A
+ * second attempt sends them again. Read off the attempt's own events, which
+ * both executors write the same way (step-exec.ts): every event a failed
+ * check writes carries `check: true`. It used to read only the LAST error's
+ * wording, and a failed shell verify or judge writes its detail after its
+ * headline — so the step was retried and the email went twice. The wording
+ * is still honoured, for a driver image older than the tag.
+ */
+export function actedThenFailedCheck(events: { type: string; text: string; check?: boolean }[]): boolean {
+  if (!events.some((e) => e.type === "tool")) return false;
+  return events.some((e) => e.type === "error" && (e.check === true || /^(verify `|output: json — |schema: the value does not fit)/.test(e.text)));
 }
 
 // Block until a human approves or rejects the pending steps. Polls the run
@@ -2231,6 +2964,59 @@ function platformFallbackEnv(): Record<string, string> | null {
   return out;
 }
 
+/**
+ * A 401 the token refresh caused, rather than a key that is simply wrong.
+ *
+ * The refresher on the box turns the long-lived grant into an 8h access
+ * token every four hours, and Anthropic revokes the old one the instant the
+ * new one is minted. The platform reads the credential per step from the
+ * mounted file, which fixed the boot-time copy — but not this: a step
+ * already talking to the API when the rotation lands gets a hard 401
+ * mid-turn, and the replacement does not appear in the mounted file until
+ * the kubelet syncs it, about a minute later.
+ *
+ * That window is narrow and it is not rare. Every 401 on this account in
+ * three weeks of runs fell inside it: 02:07:22 and 02:07:24 against a 02:07
+ * refresh, 22:08:12, 22:08:17, 22:08:30 and 22:09:03 against 22:08. The
+ * desks that lost a run nightly were simply the ones scheduled on the hour
+ * the refresher shares.
+ *
+ * So: on a 401, wait for the file to hold a DIFFERENT credential, then let
+ * the caller retry with it. A token that never changes inside the window is
+ * a key that is actually invalid — no waiting fixes that, and the caller
+ * falls through to the second supply exactly as before. Moving the timer
+ * cannot fix this; a run that takes forty minutes spans any minute chosen.
+ */
+const CREDENTIAL_ROTATION_WAIT_MS = 90_000;
+const CREDENTIAL_POLL_MS = 2_000;
+
+function isAuthRefusal(text: string): boolean {
+  return /API Error: 401|access token has (been revoked|expired)/i.test(text);
+}
+
+/**
+ * Wait, briefly, for the mounted credential to become one we have not
+ * already been refused on. Returns the new value, or null when the window
+ * passes without a change — which is the answer that means "this key is
+ * wrong", not "this key is stale".
+ */
+export async function awaitRotatedCredential(
+  before: string | undefined,
+  now: () => number = Date.now,
+  read: () => string | undefined = () => platformModelCredential(),
+  waitMs = CREDENTIAL_ROTATION_WAIT_MS,
+  pollMs = CREDENTIAL_POLL_MS,
+): Promise<string | null> {
+  if (!before) return null;
+  const until = now() + waitMs;
+  for (;;) {
+    const current = read();
+    if (current && current !== before) return current;
+    if (now() >= until) return null;
+    await sleep(pollMs);
+  }
+}
+
 /** A model-call failure the fallback can answer: the primary refusing over
  *  credit, quota or auth — never a failure of the work itself, which would
  *  fail identically anywhere. */
@@ -2241,7 +3027,19 @@ function isProviderRefusal(text: string): boolean {
   // fallback it could only time out on again. A refusal the fallback can
   // answer is about the ACCOUNT; anything about the work or the sandbox is
   // not, however similar the vocabulary.
-  return /API Error: (401|402|403|429|5\d\d)|credits?\b|quota|billing|insufficient|overloaded/i.test(text);
+  // A subscription's own ceiling is the same kind of refusal, worded
+  // differently: Claude Code on a Max plan answers "You've hit your weekly
+  // limit · resets 5am" with no status code and none of the money words.
+  // On 2026-09-21 every opus-tier step on the account failed on exactly that
+  // sentence while sonnet steps beside them ran fine — the plan has a
+  // separate weekly cap for Opus — and nothing here recognised it, so a
+  // second supply could not have answered even if one had been configured.
+  // It is not transient (isTransientOverload is right to ignore it: the
+  // window is a week), it is the account's supply being exhausted, which is
+  // precisely what the fallback provider is for.
+  return /API Error: (401|402|403|429|5\d\d)|credits?\b|quota|billing|insufficient|overloaded|(weekly|daily|monthly|usage) limit|rate.?limit(ed)?\b.*resets?\b|limit\b.*\bresets?\b/i.test(
+    text,
+  );
 }
 
 /** How many times a busy provider is given another moment, and the longest
@@ -2297,7 +3095,47 @@ export function backoffMs(attempt: number, text = "", random: () => number = Mat
   return Math.round(base * (0.5 + random() * 0.5));
 }
 
-function platformModelEnv(): Record<string, string | undefined> {
+/**
+ * The platform's model credential, read at the moment a step needs it.
+ *
+ * It used to come only from this process's environment, which meant the
+ * worker held whatever token it was started with. Refreshing an OAuth token
+ * REVOKES the old one, so a refresh without a restart left every run
+ * answering 401 — on 2026-09-18 that took every desk down for two hours, and
+ * nothing said so until a person read a failed run. The refresher's own
+ * comment had named the fix years of incidents earlier: stop shipping the
+ * token as an env var.
+ *
+ * So: when `FOLDRUN_MODEL_KEY_FILE` names a file (the Kubernetes secret,
+ * mounted rather than injected), it is read fresh every time. The kubelet
+ * updates a mounted secret in place within about a minute of it changing, so
+ * a refreshed token reaches the next step on its own, with no restart, no
+ * timing window, and nothing to skip while work is in flight.
+ *
+ * A missing or empty file falls back to the environment, which is what a
+ * local install, the CLI and every compose setup use.
+ */
+export function platformModelCredential(env: NodeJS.ProcessEnv = process.env): string | undefined {
+  const file = env.FOLDRUN_MODEL_KEY_FILE;
+  if (file) {
+    try {
+      const value = fs.readFileSync(file, "utf8").trim();
+      if (value) return value;
+    } catch {
+      // Unreadable is not the same as absent: say so once, then fall back,
+      // because a running platform that cannot read its credential file is a
+      // thing an operator needs to know about before the next step fails.
+      if (!credentialFileWarned) {
+        credentialFileWarned = true;
+        console.warn(`[model] FOLDRUN_MODEL_KEY_FILE=${file} could not be read; falling back to the environment`);
+      }
+    }
+  }
+  return env.CLAUDE_CODE_OAUTH_TOKEN || undefined;
+}
+let credentialFileWarned = false;
+
+export function platformModelEnv(): Record<string, string | undefined> {
   const {
     ANTHROPIC_API_KEY,
     ANTHROPIC_AUTH_TOKEN,
@@ -2316,7 +3154,9 @@ function platformModelEnv(): Record<string, string | undefined> {
     ANTHROPIC_API_KEY,
     ANTHROPIC_AUTH_TOKEN,
     ANTHROPIC_BASE_URL,
-    CLAUDE_CODE_OAUTH_TOKEN,
+    // The file wins when there is one: it is the live secret, and this
+    // process's copy is whatever it was handed at boot.
+    CLAUDE_CODE_OAUTH_TOKEN: platformModelCredential() ?? CLAUDE_CODE_OAUTH_TOKEN,
     ANTHROPIC_DEFAULT_HAIKU_MODEL,
     ANTHROPIC_DEFAULT_SONNET_MODEL,
     ANTHROPIC_DEFAULT_OPUS_MODEL,
@@ -2365,20 +3205,38 @@ function jsonItems(data: unknown, step: StepRecord, take: number): string[] {
 function csvItems(workspaceDir: string, step: StepRecord, take: number): string[] {
   const raw = step.eachPath ?? "";
   if (!raw) {
-    step.skipReason = "each: rows needs a path — `each: rows of ../../storage/x.csv`";
+    step.skipReason = "each: rows needs a path — `each: rows of workspace/storage/x.csv`";
     return [];
   }
-  const resolved = path.resolve(workspaceDir, "agents", step.agent, raw);
-  if (!resolved.startsWith(path.resolve(workspaceDir) + path.sep)) {
-    step.skipReason = `each: rows — ${raw} is outside this workspace`;
+  const read = csvDataRows(workspaceDir, step.agent, raw);
+  if ("problem" in read) {
+    step.skipReason = `each: rows — ${read.problem}`;
     return [];
   }
+  return read.data.slice(0, take).map((r) => `${read.header}\n${r}`);
+}
+
+/**
+ * The data rows of a CSV, path agent-relative like every path in a flow and
+ * confined to the workspace. Shared by `each: rows of`, which fans out over
+ * them, and `when: rows of`, which asks only whether there are any.
+ */
+function csvDataRows(
+  workspaceDir: string,
+  agent: string,
+  raw: string,
+): { header: string; data: string[] } | { problem: string } {
+  // `workspace/storage/x.csv` from the workspace root, anything else from
+  // the agent's folder (`../../storage/x.csv` is the same file).
+  const resolved = resolveAgentPath(workspaceDir, path.join(workspaceDir, "agents", agent), raw);
+  if (!resolved.startsWith(path.resolve(workspaceDir) + path.sep)) {
+    return { problem: `${raw} is outside this workspace` };
+  }
   let text: string;
   try {
     text = fs.readFileSync(resolved, "utf8");
   } catch {
-    step.skipReason = `each: rows — ${raw} does not exist (yet?)`;
-    return [];
+    return { problem: `${raw} does not exist (yet?)` };
   }
   // Minimal CSV: quoted fields with embedded commas/newlines survive.
   const rows: string[] = [];
@@ -2395,24 +3253,21 @@ function csvItems(workspaceDir: string, step: StepRecord, take: number): string[
   }
   if (row + field) rows.push(row + field);
   const [header, ...data] = rows.filter((r) => r.trim() !== "");
-  if (!header || data.length === 0) {
-    step.skipReason = `each: rows — ${raw} has no data rows`;
-    return [];
-  }
-  return data.slice(0, take).map((r) => `${header}\n${r}`);
+  if (!header || data.length === 0) return { problem: `${raw} has no data rows` };
+  return { header, data };
 }
 
 /**
  * `schema: <path>` — the file, read and parsed, or null. Agent-relative like
- * every other path in a flow (`../../schemas/lead.json`), confined to the
+ * every other path in a flow (`workspace/schemas/lead.json`), confined to the
  * workspace: a schema is the author's document, never something a step
  * can point outside.
  */
 export function readSchemaFile(workspaceRoot: string, rel: string): Record<string, unknown> | boolean | null {
   const root = path.resolve(workspaceRoot);
-  // Written agent-relative (`../../schemas/x.json`) or workspace-relative
-  // (`schemas/x.json`); both land on the same file.
-  const candidates = [path.resolve(root, rel.replace(/^(\.\.\/){2}/, "")), path.resolve(root, "agents", "x", rel)];
+  // Written `workspace/schemas/x.json`, agent-relative (`../../schemas/x.json`)
+  // or workspace-relative (`schemas/x.json`); all land on the same file.
+  const candidates = [path.resolve(root, rel.replace(/^((\.\.\/){2}|workspace\/)/, "")), path.resolve(root, "agents", "x", rel)];
   for (const abs of candidates) {
     if (abs !== root && !abs.startsWith(root + path.sep)) continue;
     if (!fs.existsSync(abs) || !fs.statSync(abs).isFile()) continue;
@@ -2472,6 +3327,7 @@ export function createFlowRun(
       schemaPath: s.schemaPath,
       parallel: s.parallel,
       maxTurns: s.maxTurns,
+      limits: s.limits,
       attempts: 0,
       status: "pending",
       events: [],
@@ -2627,6 +3483,18 @@ function driveRunInner(
   opts: { parkOnApproval?: boolean; effortOverride?: string | null },
 ): Promise<void> {
   const effortOverride = opts.effortOverride ?? null;
+  // The flow's own calendar. Read from the flow file rather than passed in,
+  // so every door into a run — the queue, an eval, the CLI, a rerun, a
+  // reconcile that picks an abandoned run back up — gets the same clock
+  // without each caller having to remember it. A run that belongs to no
+  // flow (an ad-hoc agent run) finds nothing here and cascades from the
+  // agent to the workspace, which is what it should do.
+  let flowTimezone: string | null = null;
+  try {
+    flowTimezone = readFlow(tenant, workspace, run.flow)?.timezone ?? null;
+  } catch {
+    // an unreadable flow file is reported where it is parsed for real
+  }
   const pDir = workspaceDir(tenant, workspace);
   const runRoot = pDir;
   /**
@@ -3067,6 +3935,21 @@ function driveRunInner(
         // group's result.
         for (const step of freshGroup) {
           if (step.status !== "pending" || !step.when) continue;
+          // `when: rows of <csv>` asks the data, not the prose: run only if
+          // the file has a data row. It is the condition a fan-out's
+          // followers need — an `each:` over an empty file skips itself but
+          // leaves nothing for a marker to be read from, so the steps after
+          // it used to run on nothing.
+          const rowsOf = whenRowsPath(step.when);
+          if (rowsOf !== null) {
+            const read = csvDataRows(pDir, step.agent, rowsOf);
+            if ("problem" in read) {
+              step.status = "skipped";
+              step.skipReason = `condition not met: when rows — ${read.problem}`;
+              step.events.push({ t: new Date().toISOString(), type: "info", text: `skipped — ${read.problem}` });
+            }
+            continue;
+          }
           // A marker at the start of a line, not a word anywhere in the
           // prose — see markerPresent. "There are no BLOCKED items" must
           // not open a gate keyed on BLOCKED.
@@ -3240,18 +4123,27 @@ function driveRunInner(
         // An agent's own `budget:` — the most it may spend in one run — is
         // read at launch, so a cap raised mid-run applies to the next step.
         const agentBudgets = new Map(listAgents(tenant, workspace).map((a) => [a.name, a.budget]));
+        // The ceiling each attempt now running was given. A step records its
+        // cost only when it ends, so while it runs its ceiling stands in for
+        // what it may yet spend — otherwise every fan-out copy of one agent
+        // saw none of its siblings' spend and got the agent's whole budget.
+        const reserved = new Map<StepRecord, number>();
         // The ceiling for one attempt of one step, read NOW: what is left of
         // the run's budget shared across the group, or the agent's own cap
-        // less what its steps have cost. Computed before every attempt, not
-        // once before the loop — a retry's share is what is left after the
-        // failed attempt spent, and the step's own figure already carries
-        // that spend (it is the sum of its tries).
+        // less what its steps have cost or hold in flight, shared with its
+        // steps in this group still waiting to start. Computed before every
+        // attempt, not once before the loop — a retry's share is what is left
+        // after the failed attempt spent, and the step's own figure already
+        // carries that spend (it is the sum of its tries).
         const ceilingFor = (step: StepRecord) =>
           stepCeilingFor(
             stepCeiling(run.budgetUsd, platform.runSpend(run), launching.length),
             agentBudgets.get(step.agent),
-            run.steps.filter((s) => s !== step && s.agent === step.agent).reduce((sum, s) => sum + (s.costUsd ?? 0), 0),
+            run.steps
+              .filter((s) => s.agent === step.agent)
+              .reduce((sum, s) => sum + (s.costUsd ?? 0) + (s !== step && s.status === "running" ? (reserved.get(s) ?? 0) : 0), 0),
             step.agent,
+            1 + launching.filter((s) => s !== step && s.agent === step.agent && s.status === "pending" && !reserved.has(s)).length,
           );
         // parallel: — the instances of one fan-out template share a pool.
         // Keyed by what the instances share (agent + instruction), since
@@ -3312,8 +4204,9 @@ function driveRunInner(
                 const eventsBefore = step.events.length;
                 step.attempts = attempt;
                 step.status = "running";
+                if (ceiling.ceilingUsd !== null) reserved.set(step, ceiling.ceilingUsd);
                 save();
-                await runStep(
+                const verdict = await runStep(
                   path.join(pDir, "agents", step.agent),
                   tenant,
                   step,
@@ -3333,17 +4226,49 @@ function driveRunInner(
                     save();
                     return run.stopRequested === true;
                   },
-                );
+                  flowTimezone,
+                  run.steps.indexOf(step),
+                ).finally(() => reserved.delete(step));
                 // runStep mutates step.status; read it through a widened local
                 // so TS doesn't keep the "running" narrowing from above.
                 const outcome: string = step.status;
                 recordAttempt(step, attempt, outcome === "completed" ? "completed" : "failed", attemptStartedAt, eventsBefore, reattach);
                 save();
-                if (outcome !== "failed" || attempt === attempts) break;
                 // A stop destroys the step's sandbox, which reads here as a
-                // failed attempt — and a failed attempt used to be retried in
-                // a fresh sandbox, so a stopped `retry: 2` step ran twice
-                // more. save() merges the flag from the record.
+                // failed attempt. stopRun writes "stopped by a person" onto
+                // this step in the record, and the save() above writes this
+                // process's copy over it — so the trail ended on the
+                // sandbox's own last words, "sandbox ended: Error (exit 143)",
+                // and a person's stop read as the platform killing a healthy
+                // step (abandon-desk, 2026-09-29: stopped from the CLI after
+                // ten minutes, then chased as an unexplained kill). Say so,
+                // whether or not a retry was left.
+                if (outcome === "failed" && run.stopRequested) {
+                  step.events.push({
+                    t: new Date().toISOString(),
+                    type: "info",
+                    text: "stopped by a person mid-step — its sandbox was destroyed, which is what ended this attempt; not retried",
+                  });
+                  save();
+                  break;
+                }
+                if (outcome !== "failed" || attempt === attempts) break;
+                // An outward step whose tools ran and whose check then failed
+                // is not retried: the check cannot say the send did not
+                // happen, and a retry would do it twice.
+                if (verdict?.actedThenFailedCheck) {
+                  step.events.push({
+                    t: new Date().toISOString(),
+                    type: "info",
+                    text: `not retried — this step's tools can act outside the workspace and ran before the check failed; another attempt could repeat what they did (${attempts - attempt} left unused)`,
+                  });
+                  save();
+                  break;
+                }
+                // A failed attempt used to be retried in a fresh sandbox even
+                // after a stop, so a stopped `retry: 2` step ran twice more.
+                // The check above ends the loop on a stop; this one covers a
+                // stop that lands while the outward check was being written.
                 save();
                 if (run.stopRequested) break;
                 // The retry policy. An attempt the cluster ended for want of
@@ -3435,7 +4360,7 @@ function driveRunInner(
           rescue.attempts = 1;
           rescue.status = "running";
           save();
-          await runStep(rescuerDir, tenant, rescue, ctx, save, modelOverride, tags, effortOverride, run.id, ctxData, null, undefined, run.test === true);
+          await runStep(rescuerDir, tenant, rescue, ctx, save, modelOverride, tags, effortOverride, run.id, ctxData, null, undefined, run.test === true, undefined, flowTimezone, run.steps.indexOf(rescue));
           // runStep mutates rescue.status; widen past TS's "running" narrowing.
           const rescueOutcome: string = rescue.status;
           if (rescueOutcome === "completed") {
@@ -3593,6 +4518,9 @@ function driveRunInner(
         // learn, and the runs list and the notification stop having to say
         // only "completed".
         run.summary = runSummary(run);
+        // Read before a test run's prefix goes on the summary, which would
+        // otherwise hide the word it leads with.
+        run.verdict = verdictOf(run.summary);
         // A test run's headline says so wherever the headline goes — the
         // runs list, the history tool, a later run's recall.
         if (run.test && run.summary) run.summary = testHeadline(run.summary);