diff --git a/CLAUDE.md b/CLAUDE.md
index 3a6e311c..bcdc072a 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -282,7 +282,23 @@ same reason - default setup cannot load a pack.
   the workspace) so the free pre-flight covers the part the caller wrote.
   A workflow that declares no variables takes no arguments at all - those were
   dropped in silence, since `Workflow.run` only substitutes when a `variables`
-  block exists
+  block exists. A valid `POST /api/validate` answer also carries `plan`
+  (`dw/plan.py`): the fingerprint of the work, step and list counts,
+  `downloads_required` and a cost `estimate` with its `basis` - the number an
+  agent quotes, with `basis` saying whether it was measured for this list
+  (`catalog`/`per_entry`) or extrapolated over one the caller resized
+  (`derived`); `plan: null` when it could not be built, never a changed
+  verdict. `acknowledged_cost` on `POST /api/jobs` / `rerun` takes `true`
+  (recorded) or the plan's `{fingerprint, minutes, downloads}` (checked - 409
+  with the current plan when the fingerprint or the required downloads
+  changed; `minutes` never compared), and the job records `acknowledged:
+  none | boolean | bound`. `cached_steps` is the worker's answer to a
+  `probe_cache` command (`Workflow.cache_hits`, which shares
+  `_prepare_definition` / `_cache_lookup` with `run` so the two cannot drift).
+  The web UI reads the fields only: the editor lists the plan under a valid
+  verdict (`describePlan`, `ui/src/lib/plan.ts`), and a job queued `bound`
+  says so on the job page and in the jobs list; the UI itself sends no
+  acknowledgement
 - **A failed run still reports what it wrote** — the worker carries its partial
   manifest on the error and cancelled messages as well as on success, and the
   "Previous result not found" error names the steps that ran even after
@@ -319,8 +335,10 @@ same reason - default setup cannot load a pack.
   job page sections results under `final/` / `intermediate/` headings (or
   whatever the step named) (`sectionBySubfolder`, `ui/src/lib/results.ts`),
   unchanged for a run that chose none. `file_base_name` may not contain a
-  separator -
-  it is a name, not a path.
+  separator - it is a name, not a path - and it *replaces* the derived
+  `<workflow id>-<step name>.<index>` base rather than prefixing it (#100), so
+  two steps in one subfolder that set the same one collide onto
+  `output_file_path`'s `-2` counter.
   Every `workflows/templates/**` file with two or more saving steps
   marks each one `final`/`intermediate` (`tests/test_template_subfolders.py` pins the rule;
   `dw/workflows/` builtins stay unmarked - a role is the parent's to assign). That moved
diff --git a/docs/ACCELERATION.md b/docs/ACCELERATION.md
index ef6801ea..6c907d21 100644
--- a/docs/ACCELERATION.md
+++ b/docs/ACCELERATION.md
@@ -296,6 +296,24 @@ Three older per-component knobs, set in the pipeline `configuration` beside
 
 **Example:** [flux-dev.json](../workflows/models/flux-dev.json) (`"offload": "model"`), [z-image.json](../workflows/models/z-image.json) (`"offload": "sequential"`), [video-with-audio.json](../workflows/templates/minimax/video-with-audio.json) (`group_offload` per component), [reference-to-video.json](../workflows/templates/minimax/reference-to-video.json) (`group_offload` for the transformer, `on_demand` for the VAEs)
 
+## Reading Memory While Offloading
+
+A workflow that offloads keeps its weights in host memory by design, so the
+card can sit near-empty through a generation and the VRAM figures alone say
+nothing about what a run holds or fails to release. `get_memory` (MCP) and
+`GET /api/memory` report both: `gpu_*` is the card, `host_memory_rss_mb` is
+what the worker process holds and `host_memory_peak_rss_mb` the most it has
+ever held, beside the machine's `host_memory_total_mb` /
+`host_memory_available_mb`.
+
+`host_pinned_reserved_mb` / `host_pinned_allocated_mb`, where the platform
+reports them, are torch's pinned-host cache - the staging buffers group
+offloading moves weights through. They are part of `host_memory_rss_mb` and
+invisible in every `gpu_*` figure, so a worker that has released every model
+and still holds gigabytes is usually holding these; they are returned when
+the worker switches to a different workflow (#98). A host field is absent,
+rather than null, on a platform that cannot measure it.
+
 ## TF32 and cuDNN
 
 Device-level settings, read once at startup from `~/.diffusers_helper/settings.json`:
diff --git a/docs/MCP.md b/docs/MCP.md
index a54b4c64..7a68fb04 100644
--- a/docs/MCP.md
+++ b/docs/MCP.md
@@ -211,10 +211,10 @@ when no single workflow covers it.
 | Tool | Arguments | Purpose |
 | --- | --- | --- |
 | `list_guides()` | — | List the documentation the engine serves: each guide's name, what it covers, and its section headings. The index is the routing table - match a request's shape against a heading rather than guessing |
-| `get_guide(name, section=None)` | `name`, `section` | Get one guide whole, or one section of it. Prefer a section: a guide runs to thousands of lines. Section names match loosely, so a heading copied approximately still resolves |
-| `list_workflows(shape=None, traits=None, configures=None, include_models=False)` | `shape`, `traits`, `configures`, `include_models` | List stored workflows. Always the server's compact view: each entry carries `summary`, `shape`, `traits`, `cost`, `kinds`, `variable_names`, `lists`, and `configures` only when set - `get_workflow` has the full description and definition. `lists`, present for a list-driven workflow, names the fields an entry of each list takes, the steps over it and the default's length; `cost` may carry `per_entry`, the measured cost of one entry so a run over a different-length list can be priced from it. `shape` keeps one of `image`, `image-set`, `image-edit`, `shot`, `sequence`, `audio`, `text`, `utility`; `traits` is comma-separated and every one listed must match (`has-audio`, `chained`, `image-conditioned`, `identity-referenced`, `needs-input-media`, `composes-workflows`); an unknown value in either is a 400 listing the vocabulary. Templates only by default - `configures=<template>` lists the checkpoint configs tuned for one, `include_models=true` lists them all. The first call to make for a request an existing workflow might cover |
+| `get_guide(name, section=None)` | `name`, `section` | Get one section of a guide - name it: a guide runs to thousands of lines, and WORKFLOW_GUIDE.md whole is ~19.6k tokens, more in one call than the whole tool surface costs to connect. Called with no `section` the answer is the guide's index: its opening, its first section, and `sections`/`withheld` naming the rest, with a `note` saying how to fetch one. Section names match loosely, so a heading copied approximately still resolves |
+| `list_workflows(shape=None, traits=None, configures=None, include_models=False)` | `shape`, `traits`, `configures`, `include_models` | List stored workflows. Called with no filter at all each entry is cut to its `summary` and `shape` (`view: "summary"`, with a `note`), because the whole catalog in full detail is ~6.8k tokens for a question that is really "which shape do I want"; pass `shape` and the entries come back whole. Filtered, it is the server's compact view: each entry carries `summary`, `shape`, `traits`, `cost`, `kinds`, `variable_names`, `lists`, and `configures` only when set - `get_workflow` has the full description and definition. `lists`, present for a list-driven workflow, names the fields an entry of each list takes, the steps over it and the default's length; `cost` may carry `per_entry`, the measured cost of one entry so a run over a different-length list can be priced from it. `shape` keeps one of `image`, `image-set`, `image-edit`, `shot`, `sequence`, `audio`, `text`, `utility`; `traits` is comma-separated and every one listed must match (`has-audio`, `chained`, `image-conditioned`, `identity-referenced`, `needs-input-media`, `composes-workflows`); an unknown value in either is a 400 listing the vocabulary. Templates only by default - `configures=<template>` lists the checkpoint configs tuned for one, `include_models=true` lists them all. The first call to make for a request an existing workflow might cover |
 | `get_workflow(name, variables_only=False)` | `name` | Get one stored workflow's full JSON definition. `variables_only=true` answers with just its variables and their defaults (long strings cut to 200 characters, the cut ones named in `truncated`, including strings inside a list default, named like `shots[0].prompt`) — the cheap way to confirm what a variable defaults to |
-| `get_schema()` | — | Get the JSON schema every workflow definition must satisfy |
+| `get_schema(section=None)` | `section` | Get the JSON schema every workflow definition must satisfy. Whole it is ~8.6k tokens, so name the part you need: `section` takes `steps`, `pipelines`, `tasks`, `result`, `variables` or `configuration` and answers `{section, sections, elsewhere, schema}` - `elsewhere` says which section holds each definition the fragment still `$ref`s. An unknown section is a 404 naming the ones there are |
 | `list_pipelines()` | — | List every diffusers pipeline class this installation provides |
 | `get_pipeline_signature(name)` | `name` | Get a pipeline's real call arguments |
 | `list_classes(kind)` | `kind` | List class names of one kind: pipelines, models, schedulers, or quantization |
@@ -249,7 +249,7 @@ The session starts in `default` and stays there unless it is told otherwise.
 
 | Tool | Arguments | Purpose |
 | --- | --- | --- |
-| `validate_workflow(workflow=None, name=None, workspace=None, arguments=None)` | exactly one of `workflow` (inline definition) or `name` (a stored workflow, as `list_workflows` reports it), optional `workspace`, optional `arguments` | Check a workflow against the schema and against real pipeline signatures. Free and instant. Validating by name uses the workflow file's own directory as the base directory, so it sees what a run would. Returns every schema violation in `errors`, each with the JSON path it sits at, so a draft is fixed in one pass, and a `previous_result:` that names no earlier step is one of them. `warnings` covers what still runs but is probably wrong - a signature mismatch, and, for a list-driven variable, an entry key no step reads, at the entry's path. `workspace` names the workspace for this one call without switching the session to it - use it to pin a job whose `output:` or `asset:` references live in a workspace other than the session's. Pass the same `arguments` you will pass to `run_workflow` and they are checked too - an undeclared or renamed variable name, a value that will not coerce to the declared type, and an `asset:`, `prompt:` or `output:` reference that names nothing this workspace can reach, each reported at `arguments.<name>`. `checked_arguments` lists what was covered, so a `valid: true` about the stored defaults cannot be mistaken for one about your values. `run_workflow` makes the same check and refuses a bad argument rather than queuing a job that fails on its first step |
+| `validate_workflow(workflow=None, name=None, workspace=None, arguments=None)` | exactly one of `workflow` (inline definition) or `name` (a stored workflow, as `list_workflows` reports it), optional `workspace`, optional `arguments` | Check a workflow against the schema and against real pipeline signatures. Free and instant. Validating by name uses the workflow file's own directory as the base directory, so it sees what a run would. Returns every schema violation in `errors`, each with the JSON path it sits at, so a draft is fixed in one pass, and a `previous_result:` that names no earlier step is one of them. `warnings` covers what still runs but is probably wrong - a signature mismatch, and, for a list-driven variable, an entry key no step reads, at the entry's path. `workspace` names the workspace for this one call without switching the session to it - use it to pin a job whose `output:` or `asset:` references live in a workspace other than the session's. Pass the same `arguments` you will pass to `run_workflow` and they are checked too - an undeclared or renamed variable name, a value that will not coerce to the declared type, and an `asset:`, `prompt:` or `output:` reference that names nothing this workspace can reach, each reported at `arguments.<name>`. `checked_arguments` lists what was covered, so a `valid: true` about the stored defaults cannot be mistaken for one about your values. `run_workflow` makes the same check and refuses a bad argument rather than queuing a job that fails on its first step. A valid answer carries `plan` - the fingerprint, step count, list lengths, `downloads_required` and `estimate` (with `basis`) for the arguments given; quote from it |
 | `list_workspaces()` | — | The server's workspaces and which one this session is using. Each has its own workflows, assets and outputs; the prompt library is shared by all of them |
 | `use_workspace(name)` | `name` | Work in that workspace for the rest of the session - every later call reads and writes there. This is how to keep your work out of another agent's namespace rather than sharing the default one. Checked against the server, so a typo fails here rather than scoping every later call to nothing |
 | `create_workspace(name, use=False)` | `name`, `use` | Create a workspace. Pass use=true to switch this session to it as well; otherwise the session stays where it was and the result says so |
@@ -282,14 +282,14 @@ references written in the same session.
 
 | Tool | Arguments | Purpose |
 | --- | --- | --- |
-| `run_workflow(workflow_path=None, inline_workflow=None, arguments=None, acknowledged_cost=False, workspace=None)` | exactly one of `workflow_path` (a catalog name from `list_workflows`, with or without `.json`, or a path to a workflow file on the server) or `inline_workflow`, optional `arguments`, `acknowledged_cost`, `workspace` | Queue a workflow for generation. Returns as soon as the job is queued. `workspace` names the workspace for this one call without switching the session to it - use it to pin a job whose `output:` or `asset:` references live in a workspace other than the session's |
+| `run_workflow(workflow_path=None, inline_workflow=None, arguments=None, acknowledged_cost=False, workspace=None)` | exactly one of `workflow_path` (a catalog name from `list_workflows`, with or without `.json`, or a path to a workflow file on the server) or `inline_workflow`, optional `arguments`, `acknowledged_cost`, `workspace` | Queue a workflow for generation. Returns as soon as the job is queued. `workspace` names the workspace for this one call without switching the session to it - use it to pin a job whose `output:` or `asset:` references live in a workspace other than the session's - `acknowledged_cost` is `true` or the bound `{fingerprint, minutes, downloads}` from the validate plan; a 409 means the plan changed and the message carries the new estimate |
 | `get_job(job_id)` | `job_id` | Get a job's status, warnings, output manifest, error and traceback; each manifest entry's `subfolder` is the in-run subfolder the step declared - by convention `final` for the deliverable, `intermediate` for scratch, `''` for none. A running job also carries `progress` (below) |
 | `get_job_workflow(job_id)` | `job_id` | The workflow the job actually ran. `realized: true` means every mutable input is pinned (arguments, seed, prompts, `output:latest`); `false` means the job predates run tracking and this is the definition as submitted. Pass it to `save_workflow` to keep it under a name |
 | `export_job(job_id, overwrite=False)` | `job_id`, `overwrite` | Gather one finished job into `<workspace>/exports/<job id>/` on the server: the realized workflow, the run's manifest, the job row, a README, and copies of the assets, earlier-run inputs and outputs. Returns the directory, a zip URL, the file list with sizes and the total. The three JSON files are in the zip, not repeated here - get_job_workflow and get_job serve them individually. **The directory is on the machine running the server**, like `download_output`'s destination - fetch the zip URL and unpack it into `exports/` under the session's working directory (a deliverable, not a temp file); the archive already unpacks into one folder named after the job id |
 | `get_job_events(job_id, after=-1, limit=200)` | `job_id`, `after`, `limit` | Get a page of a job's progress events |
 | `wait_for_job(job_id, timeout_seconds=20)` | `job_id`, `timeout_seconds` | Block until a job reaches a terminal status, or `timeout_seconds` elapses. **One call blocks for at most 55 seconds** — a larger `timeout_seconds` is clamped, not honoured, because no MCP client holds a tool call open for a generation's real runtime, so budget one call per ~55s of the job. Every reply carries `waited_seconds`, `timeout_requested_seconds`, `timeout_applied_seconds` and `timeout_capped`, so a capped return is distinguishable from an elapsed one. Use instead of hand-polling `get_job`/`get_job_events` in a loop; if it returns `still_running: true`, call it again. Returns a slim job - status, warnings, error, and the manifest once finished - without the arguments; `get_job` has those. A running job also carries `progress` (below) |
 | `cancel_job(job_id)` | `job_id` | Ask a queued or running job to stop |
-| `rerun_job(job_id, acknowledged_cost=False, new_seed=False)` | `job_id`, `acknowledged_cost`, `new_seed` | Queue a fresh job from a previous job's stored specification. Costs GPU time, so it passes the same gate as `run_workflow`. `new_seed=true` draws a fresh seed into the workflow's seed variable — without it a seeded workflow's rerun repeats its arguments exactly and the step cache serves the whole run from the earlier one's files (`reused: true`), generating nothing. `get_job_workflow`'s `seed_variable` says whether there is one |
+| `rerun_job(job_id, acknowledged_cost=False, new_seed=False)` | `job_id`, `acknowledged_cost`, `new_seed` | Queue a fresh job from a previous job's stored specification. Costs GPU time, so it passes the same gate as `run_workflow`. `new_seed=true` draws a fresh seed into the workflow's seed variable — without it a seeded workflow's rerun repeats its arguments exactly and the step cache serves the whole run from the earlier one's files (`reused: true`), generating nothing. `get_job_workflow`'s `seed_variable` says whether there is one - `acknowledged_cost` is `true` or the bound `{fingerprint, minutes, downloads}` from the validate plan; a 409 means the plan changed and the message carries the new estimate |
 | `move_job(job_id, direction)` | `job_id`, `direction` (`up`\|`down`\|`front`\|`back`) | Reorder a queued job |
 
 ### Models
@@ -333,6 +333,15 @@ job id from `list_jobs` would buy a way around it. `cancel_job` and
 `cancel_download` are deliberately *not* gated: they end a cost rather than
 starting one, and gating them would make the safe direction the harder one.
 
+The acknowledgement can be bound to what was quoted. `validate_workflow`
+answers with a `plan`; pass `acknowledged_cost={"fingerprint":
+plan.fingerprint, "minutes": plan.estimate.minutes, "downloads": [...]}` and
+the server refuses with 409 if the run's shape changed between the quote and
+the call - a longer list, a stored prompt edited meanwhile, weights that now
+have to be downloaded - naming the new plan so the agent re-quotes. Bare
+`true` still works and is for a `plan` that came back null; the job records
+which form it got (`acknowledged: none | boolean | bound`).
+
 Passing the flag does not make a tool wait. The five that start work return
 as soon as it is queued or started, the same way queuing a job from the web UI
 does not block the browser tab; `delete_model` and `delete_workspace` are
@@ -343,8 +352,11 @@ The intended loop:
 1. `validate_workflow` — free, checks schema and pipeline signatures, no GPU
    time spent. Pass the `arguments` you intend to run with: without them the
    verdict covers the stored definition and its stock defaults, not the
-   values you wrote
-2. `run_workflow` with `acknowledged_cost=true` — pass a name straight from
+   values you wrote, and its `plan` is the number to say out loud:
+   `estimate.minutes` with its `basis`, plus each `downloads_required`
+   entry as a line item of its own
+2. `run_workflow` with `acknowledged_cost` bound to the plan (`{fingerprint,
+   minutes, downloads}`), or `true` when there was no plan — pass a name straight from
    `list_workflows` as `workflow_path`; queues the job and returns
    immediately with a `job_id`
 3. `wait_for_job(job_id)` to block for a bounded interval instead of
@@ -454,4 +466,4 @@ default) for any server an MCP client can reach.
 | A config change seems to have no effect | A running session holds the old config. Start a new session |
 | It worked, then broke after rebuilding the venv | Re-run `pip install -e ".[server,mcp]"`. If the repo moved or was renamed, re-register the server with the new absolute path |
 | A tool call times out | Usually a model loading into VRAM/RAM for the first time; retry, or raise `--timeout` |
-| `run_workflow` or `rerun_job` refuses with a cost message | Not an error — it is the `acknowledged_cost` gate. Confirm with the user and call again with `acknowledged_cost=true` |
+| `run_workflow` or `rerun_job` refuses with a cost message | Not an error — it is the `acknowledged_cost` gate. Confirm with the user and call again with `acknowledged_cost` bound to the plan (or `true`); a 409 "shape changed" answer means the run grew since the quote - re-validate, re-quote, pass the new plan |
diff --git a/docs/SERVER.md b/docs/SERVER.md
index 80de09dc..eb90c2a0 100644
--- a/docs/SERVER.md
+++ b/docs/SERVER.md
@@ -69,7 +69,11 @@ load entirely.
   and three views — form, split, and raw JSON — edit the same definition.
   The split view puts the form beside the JSON with both sides editable;
   changes apply when a side loses focus. Validate, save, and run from the
-  same screen. A Monaco editor with the workflow JSON schema backs the
+  same screen; a valid verdict is followed by the run's plan - the step
+  and list counts, the minutes from the workflow's `cost` block with its
+  basis, how many steps the step cache would serve, and the weights this
+  server would download first (`describePlan`, `ui/src/lib/plan.ts`,
+  reading `POST /api/validate`'s `plan`). A Monaco editor with the workflow JSON schema backs the
   JSON views. A fourth view, **flow**, renders the workflow's data-flow
   graph read-only: one box per step, arrows for each `previous_result`
   reference labeled with the argument it feeds, entry-point steps marked
@@ -142,7 +146,7 @@ from another machine:
 
 | Route | What it does |
 | --- | --- |
-| `POST /api/jobs` | Queue a run: `{"workflow_path": ...}` or an inline `{"workflow": {...}, "base_dir": ...}`, plus `arguments` for variable overrides. `workflow_path` accepts a stored workflow name as listed by `/api/workflows` (with or without `.json`, nested names included), or a relative/absolute path that still resolves under `--workflow-dir` - confined the same way the `/api/workflows` CRUD routes are; a path that names a real file outside that directory is rejected with 400, not opened. Answers with argument warnings from signature checking. |
+| `POST /api/jobs` | Queue a run: `{"workflow_path": ...}` or an inline `{"workflow": {...}, "base_dir": ...}`, plus `arguments` for variable overrides. `workflow_path` accepts a stored workflow name as listed by `/api/workflows` (with or without `.json`, nested names included), or a relative/absolute path that still resolves under `--workflow-dir` - confined the same way the `/api/workflows` CRUD routes are; a path that names a real file outside that directory is rejected with 400, not opened. Answers with argument warnings from signature checking. Takes an optional `acknowledged_cost`: `true` is recorded as `acknowledged: boolean`; the object `{fingerprint, minutes, downloads}` from a validate answer's `plan` is `bound` - the server re-plans the run for the arguments given and answers **409** when the fingerprint differs or a repo in `downloads_required` is not in `downloads` (a download that has since vanished is not a refusal); the body is `{"detail": {message, reason: "fingerprint" \| "downloads" \| "unplannable", acknowledged, plan}}` with the current plan, so the caller re-quotes from it. `minutes` is recorded, never compared. Nothing is required: the web UI and every caller that sends nothing are `acknowledged: none`, and every job answer and history row carries `acknowledged` (and `acknowledged_cost` when bound). `POST /api/jobs/{id}/rerun` takes the same field and checks against the stored spec; a fresh seed does not change a fingerprint. |
 | `GET /api/jobs?workspace=&status=&limit=` | Queue + history summaries, oldest first, with `total` beside them. `status` narrows to one state or a comma-separated set (`queued`, `running`, `succeeded`, `failed`, `cancelled`; anything else is a 400); `limit` keeps the newest N, and `total` still reports how many matched, so a bounded answer cannot be mistaken for a complete one. No parameters means every job, which is what the web UI polls |
 | `GET /api/jobs/{id}` | Full detail: spec, events, manifest, error. A manifest entry for a step served from the step cache carries `reused: true`. Every entry carries `subfolder` - the in-run subfolder the step's `result.subfolder` chose, `''` for none. A `for_each` step appears in the manifest as its members (`shot@wide_open`, `shot@closeup`), because the manifest records what ran; the run's `workflow.json` keeps the `for_each` form, because it records what was asked |
 | `GET /api/jobs/{id}/workflow` | The workflow the job ran: `{id, definition, realized, seed_variable}`. `seed_variable` names the variable a `new_seed` rerun would draw into (null when the workflow has none), read from the workflow as written rather than the realized copy, whose seed is pinned. `realized: true` is the copy the run itself wrote (`workflow.json` in its run directory), with arguments, seed, prompts and `output:latest` pinned; `false` falls back to the submitted definition, which is what a job from before run tracking has. 404 means neither is readable - the job itself still is |
@@ -241,11 +245,18 @@ The editor's forms come from these; they are just as usable from scripts:
 - `GET /api/tasks` — the task commands and processors
 - `GET /api/tasks/{command}` — a task's argument schema, read from its
   registered implementation's real signature
-- `GET /api/schema` — the workflow JSON schema
+- `GET /api/schema` — the workflow JSON schema. `?section=` answers one
+  part of it - `steps`, `pipelines`, `tasks`, `result`, `variables` or
+  `configuration` - as `{section, sections, elsewhere, schema}`, where
+  `elsewhere` names the section holding each definition the fragment still
+  `$ref`s; the no-argument call is the whole schema, unchanged
 - `GET /api/guides` — the documentation that bears on choosing a
   capability: each guide's name, what it covers, and its section headings
-- `GET /api/guides/{name}?section=` — one guide whole, or one section of
-  it; section names match loosely. Served by the engine so an MCP client
+- `GET /api/guides/{name}?section=` — one section of a guide; section names
+  match loosely. Without a `section` the answer is the guide's index - its
+  opening, its first section, and `sections`/`withheld` naming the rest -
+  rather than the whole file, which for WORKFLOW_GUIDE.md is ~19.6k tokens
+  in one call (#101). Served by the engine so an MCP client
   at another version reads the guides for the server it is driving, not
   its own. A checkout serves the repo's `docs/`; an install the copy
   `build_dist.sh` puts under `dw/docs/`
@@ -268,6 +279,33 @@ The editor's forms come from these; they are just as usable from scripts:
   was covered, since without arguments the verdict is about the stored
   defaults only.
 
+  A valid answer also carries `plan`, what the run will execute for those
+  arguments: `fingerprint` (`sha256:…` over the realized, expanded
+  definition with the seed and the documentation keys removed and
+  `output:…/latest/…` left unpinned - the same work hashes the same, a
+  longer list or an edited stored prompt does not); `steps`, the expanded
+  member count; `list_entries`, `{variable: length}` for each `for_each`
+  over a list variable; `cached_steps`, how many of those steps the
+  worker's step cache would serve (`0` for an unseeded workflow, `null`
+  when the worker is busy or did not answer - a workflow with no `seed`
+  also gets a warning saying so, since `0` alone does not distinguish a
+  disabled cache from an empty one);
+  `downloads_required`, each `model_name` the hub cache does not hold as
+  `{repo, gb}` (`gb` from the hub, `null` when it could not be asked -
+  `?sizes=false` skips the hub) and each `from_single_file` URL as
+  `{repo: null, url, gb: null}`; and `estimate`, `{minutes, basis,
+  device, measured_on, partial}` from the workflow's own `cost` block -
+  `basis` is `catalog` (the stored total, for a run whose lists are the
+  ones it was measured with), `per_entry` (re-priced from a measured
+  per-entry rate, when the entry carries `per_entry`), `derived` (the
+  stored total extrapolated linearly over a list whose length the caller
+  changed - an estimate, not a measurement), `other_device` (no entry for
+  the serving backend; the first entry's figure, which is a warning rather
+  than a quote) or `unknown` (no cost block, or more than one list changed
+  so there is nothing honest to extrapolate along); a composed child's
+  cost is added and `partial` is true when a child has none. `plan` is `null` when
+  it could not be built; an invalid answer carries no `plan` key.
+
 ## Files and models
 
 - `GET /api/workflows` — the stored workflow names, plus a `details` entry
diff --git a/docs/TASKS.md b/docs/TASKS.md
index cef619f2..df1c74bb 100644
--- a/docs/TASKS.md
+++ b/docs/TASKS.md
@@ -429,8 +429,8 @@ returns frames without it, and this puts it back:
 
 | Argument | Required | Description |
 | -------- | -------- | ----------- |
-| `video` | Yes | The frames - a frame list, a frame array or tensor, or an audio+video pair whose own soundtrack is replaced |
-| `audio` | Yes | The soundtrack - a waveform, the earlier step whose video carried one, or the path or URL of an audio or video file; the last two bring their sample rate along |
+| `video` | Yes | The frames - a frame list, a frame array or tensor, or an audio+video pair whose own soundtrack is replaced; their own rate is carried through to the output, so `result.fps` is only needed to override it (frames that carry none are written at 8 fps) |
+| `audio` | Yes | The soundtrack - a waveform, the earlier step whose video carried one, or the path or URL of an audio or video file; the last two bring their sample rate along. A mono track is fine: an mp4 audio stream takes stereo and nothing else, so saving duplicates the one channel into two and warns that it did |
 | `sample_rate` | No | Sample rate of the waveform. Required unless `audio` carries one; given here it wins |
 
 **Example:** [assemble-and-score.json](../workflows/templates/assemble-and-score.json)
diff --git a/docs/WORKFLOW_GUIDE.md b/docs/WORKFLOW_GUIDE.md
index 7a11624a..83093038 100644
--- a/docs/WORKFLOW_GUIDE.md
+++ b/docs/WORKFLOW_GUIDE.md
@@ -438,9 +438,13 @@ same way it will run. `release_pipeline` on a `for_each`
 step releases after the *last* member. Each entry is a full generation, so
 quote the cost before running a list-driven workflow: the listing's `lists`
 block names the fields an entry takes and the steps over it, and its `cost`
-carries `per_entry` once one entry has been measured — quote
-`minutes - per_entry.minutes × per_entry.entries + per_entry.minutes × N` for
-N entries, and without `per_entry` quote the total as the default list's. An
+carries `per_entry` once one entry has been measured. `validate_workflow`
+with your `arguments` answers with a `plan` whose `estimate` already does
+that arithmetic (`basis: per_entry`); without `per_entry` it extrapolates
+the stored total linearly over your list (`basis: derived` - an estimate
+rather than a measurement) and reports the stored total unchanged only
+when your list is the one it was measured with (`basis: catalog`) - quote
+the plan's figure and say which basis it has. An
 entry key no step reads is a validation warning at the entry's path, so a
 misspelt field is caught before the run. Then
 `validate_workflow` with the
@@ -479,7 +483,16 @@ the entry an item needs.
 3. `save_workflow` — validates again on the way in and returns the catalog
    metadata the saved draft will carry.
 4. `run_workflow` with `acknowledged_cost=true`, after telling the user what it
-   costs. Without the acknowledgement the call is refused. A workflow you wrote
+   costs. Without the acknowledgement the call is refused. The figure to tell
+   them is the `plan` on the validate answer - `estimate.minutes` with its
+   `basis`, and every `downloads_required` entry named as its own line item,
+   since weights not on this box are minutes and gigabytes the cost block
+   never counted. Then pass that plan back:
+   `acknowledged_cost={"fingerprint": plan.fingerprint, "minutes":
+   plan.estimate.minutes, "downloads": [...]}` - the server refuses with 409
+   if the run's shape changed since the quote, and the refusal carries the
+   new plan to quote from. `true` is for a plan that was null. When `basis`
+   is `unknown`: a workflow you wrote
    or copied carries no `cost` of its own, but the pipeline inside it usually
    does: `list_workflows(include_models=true)` finds the `models/` entry that
    loads the same checkpoint, and its per-image figure times the number of
@@ -556,7 +569,11 @@ underscore; `..`, a backslash and a leading `.` are refused - so every
 subfolder written is one a later workflow can name:
 `output:dialogue-short/latest/final/episode.mp4`. A bad value is a
 validation error at its JSON path. `file_base_name` is a name, not a path:
-a separator there is refused, and `subfolder` is the way to place a file.
+a separator there is refused, and `subfolder` is the way to place a file. It
+replaces the name the engine would derive from the workflow and step rather
+than prefixing it, so `"file_base_name": "episode"` in a `final` subfolder
+writes `final/episode-0.0.mp4` - name each step that sets one differently, or
+the second collides and picks up a `-2`.
 
 ### Composing a stored workflow
 
@@ -604,16 +621,23 @@ never derived — leave it absent until a run has been measured.
 "result": {
     "content_type": "image/jpeg",
     "save": true,
-    "file_base_name": "custom_prefix",
+    "file_base_name": "episode",
     "subfolder": "final"
 }
 ```
 
 Supported content types: `image/jpeg`, `image/png`, `image/webp`, `image/gif`, `video/mp4`, `audio/wav`, `audio/flac`, `audio/mpeg` (mp3), `audio/ogg`, `audio/opus`, `audio/aiff`, `application/json`, `text/plain` (plus the common aliases `audio/x-wav`, `audio/mp3`, `audio/vorbis`).
 
-`subfolder` places the step's files in a subfolder of the run directory - see *Saying which output is the deliverable* above. `file_base_name` may not contain a path separator.
+`subfolder` places the step's files in a subfolder of the run directory - see *Saying which output is the deliverable* above. `file_base_name` is the base name the step's files are written under, replacing the name derived from the workflow and step; it may not contain a path separator.
 
-For video, add `"fps": 8`. For audio, add `"sample_rate": 44100` when the waveform doesn't
+For video, `"fps"` is the rate the file is written at. It is rarely needed:
+frames that know their own rate carry it - a video read from a file or an
+`asset:`, a `concat_videos`/`dissolve_videos` join, an interpolation - and
+the engine writes them at it. Frames that bring no rate (most generations)
+fall back to 8, so a workflow that assembles from bare frames should say
+what they run at. A declared `fps` always wins over the carried one and
+warns when the two differ, which is how a deliberate slow motion is written.
+For audio, add `"sample_rate": 44100` when the waveform doesn't
 already carry a rate of its own (a declared rate always wins). Setting `embed_metadata: true`
 on an image result embeds the step's model name and arguments as generation metadata -
 PNG info chunks for `image/png`, EXIF `UserComment` (via `piexif`) for `image/jpeg` and
@@ -644,12 +668,14 @@ Audio is written through soundfile, so both lossless and compressed containers w
 `audio/opus` writes an Opus stream in an ogg container, and only encodes at sample rates
 of 8000, 12000, 16000, 24000 or 48000.
 
-Output files are saved as `{output_dir}/{file_base_name}{workflow_id}-{step_name}.{step_index}-{result_index}.{artifact_index}.{ext}`,
-where `step_index` is the step's position in the workflow, `result_index` counts the
-argument-combination iterations the step ran (see cartesian product, above), and
-`artifact_index` counts multiple artifacts within one result (`num_images_per_prompt > 1`,
-or a dict result saved key by key). `file_base_name`, when set, is prepended to the
-default name rather than replacing it.
+Output files are saved as `{output_dir}/{base_name}-{result_index}.{artifact_index}.{ext}`,
+where `base_name` is `{workflow_id}-{step_name}.{step_index}` unless the step's result sets
+`file_base_name`, which replaces it entirely. `step_index` is the step's position in the
+workflow, `result_index` counts the argument-combination iterations the step ran (see
+cartesian product, above), and `artifact_index` counts multiple artifacts within one result
+(`num_images_per_prompt > 1`, or a dict result saved key by key). The derived name is what
+makes two steps' files distinct, so when you replace it on more than one step in the same
+subfolder, give each a different name - otherwise the second one gets a `-2` counter.
 
 ## Pipeline Configuration
 
@@ -1603,7 +1629,12 @@ interpolator - returns frames without it. Two tasks carry the pieces across:
 
 `audio` takes either a waveform or the earlier step whose video carried the soundtrack,
 which brings its sample rate along; here it is an earlier step's waveform, so
-`sample_rate` is given explicitly.
+`sample_rate` is given explicitly. The frames keep the rate they arrived
+with - `video` given a file or an `asset:` carries that file's fps through
+to the saved mp4 - so `result.fps` is only needed for frames that bring no
+rate of their own. A mono track needs no preparation: an mp4 audio stream
+takes stereo and nothing else, so saving duplicates the single channel into
+two and emits a warning saying it did.
 
 Which shape a pipeline argument wants is the pipeline's business, and the two LTX-2
 paths differ: a keyframe condition is mapped from 0-255, so it takes the `video_frames`
diff --git a/docs/proposals/acknowledged-cost-binding.md b/docs/proposals/acknowledged-cost-binding.md
index ff0a41af..d794da88 100644
--- a/docs/proposals/acknowledged-cost-binding.md
+++ b/docs/proposals/acknowledged-cost-binding.md
@@ -1,9 +1,11 @@
 # Proposal: bind `acknowledged_cost` to an estimate, not just to a boolean
 
-Status: **design only** - written in answer to issue #85 (forum feedback),
-after reading the gate and every path by which a run's size is decided.
-No code changes yet. Written by the implementer agent (model `opus`,
-provider `anthropic`).
+Status: **implemented** (stage 1 at b37f033, stage 2 on `cost-binding`).
+Design:
+docs/superpowers/specs/2026-09-12-acknowledged-cost-binding-design.md.
+Written in answer to issue #85 (forum feedback),
+after reading the gate and every path by which a run's size is decided, by
+the implementer agent (model `opus`, provider `anthropic`).
 
 ## The question asked
 
@@ -17,11 +19,17 @@ It is a boolean, checked in the MCP layer only:
 
 - `dw_mcp/diagnose.py:45` - `run_workflow` raises `COST_REFUSAL` unless
   `acknowledged_cost` is truthy; `rerun_job` the same at `:248`.
-- `dw_mcp/models.py` / `dw_mcp/workspaces.py` - `download_model`,
-  `delete_model`, `update_diffusers`, `delete_workspace` the same.
+- `dw_mcp/models.py` / `dw_mcp/workspaces.py` / `dw_mcp/prompts.py` -
+  `download_model`, `delete_model`, `update_diffusers`, `delete_workspace`,
+  `enhance_prompt` the same.
 - `POST /api/jobs` does **not** require it. The gate is an agent-behaviour
   gate - "say the number out loud to a human before you spend it" - not a
   resource guard, and the HTTP API and the web UI queue work without it.
+  The one HTTP route that carries an acknowledgement is
+  `DELETE /api/workspaces/{name}` (`acknowledged=true`, `app.py:1415`), and
+  it does so because the server is the only party that knows what the
+  deletion would remove - the same reason the check below has to live
+  server-side.
 
 Nothing is bound. The flag records that *something* was consented to, not
 what. The figure the agent quoted comes from the catalog's `cost` block
@@ -41,7 +49,9 @@ was honest when it was made:
    this - and is advisory, unenforced, and set on no template yet.
 2. **Cartesian product.** Several `previous_result:` references in one step
    multiply (4 images x 3 masks = 12 iterations), and the multiplicands can
-   come from arguments.
+   come from arguments. Only some of them are knowable before the run: a
+   multiplicand that is `num_images_per_prompt` is, one that is "however
+   many frames the previous step produced" is not.
 3. **Plain numeric arguments.** `num_images_per_prompt`, `num_frames`,
    `num_inference_steps` scale the run roughly linearly and are ordinary
    variables.
@@ -55,6 +65,11 @@ was honest when it was made:
    step cache; the rerun of a "finished instantly" job is a full generation.
 7. **Sub-workflows.** A `composes-workflows` step's real cost is the child's.
 
+And one that goes the other way: a seeded workflow whose steps are in the
+step cache costs nothing, which is why "Run again" finishes instantly. An
+estimate that ignores the cache over-quotes the common case, and the
+`new_seed` rerun in case 6 is exactly the flip from cached to full.
+
 So the premise in #85 holds: the flag stays `true` while the work grows, and
 nothing at queue time compares what will run against what was acknowledged.
 
@@ -87,23 +102,43 @@ Beside `valid`/`errors`/`warnings`, on a valid answer:
 "plan": {
   "fingerprint": "sha256:9f13…",
   "steps": 14,
-  "iterations": 14,
+  "cached_steps": 0,
   "list_entries": {"shots": 12},
   "downloads_required": [{"repo": "MiniMaxAI/MiniMax-H3", "gb": 41.2}],
-  "estimate": {"minutes": 38.0, "basis": "per_entry", "confidence": "measured"}
+  "estimate": {"minutes": 38.0, "basis": "per_entry", "device": "cuda"}
 }
 ```
 
 - `fingerprint` is a SHA-256 over the plan-shaping inputs: the realized
-  workflow (`realize.py`'s document, minus the seed), the expanded step
-  names, and the iteration count per step. It changes when the *work*
-  changes and not when something cosmetic does.
+  workflow (`realize.py`'s document) with the seed removed and each
+  `output:.../latest/...` reference left *unpinned*, plus the expanded step
+  names. It changes when the *work* changes and not when something cosmetic
+  does. The seed is excluded because a fresh seed is the same work; `latest`
+  is left unpinned because a run finishing between the validate call and
+  the queue call would otherwise change the fingerprint of identical work,
+  and the human-in-the-loop gap is exactly where that happens. Inlined
+  prompt text stays in: a prompt edited in between is a different run.
+- No `iterations` field: the Cartesian count is static only when every
+  multiplicand is an argument (case 2), and a number that is sometimes a
+  guess is worse than none. `list_entries` is always exact.
+- `cached_steps` is how many steps the step cache would answer for this
+  workflow id and seed - the same check `Workflow.run` makes, made early -
+  and the estimate is over the remaining steps only. A `new_seed` rerun
+  reports zero.
 - `estimate.basis` is one of `per_entry` (fixed + per-entry x N),
   `catalog` (the stored `cost.minutes`, defaults only), or `unknown`
   (an inline workflow with no cost block) - the honesty is in the field,
-  not in a fabricated number.
+  not in a fabricated number. `cost` is measured per device, so `device`
+  names the entry used; when the catalog has no entry for the accelerator
+  that is serving, `basis` is `other_device` and `minutes` is the nearest
+  entry's, which is a warning and not a quote. A `composes-workflows` step
+  contributes its child's catalog cost.
 - `downloads_required` closes case 4 on its own, and is useful with or
-  without the rest of this proposal.
+  without the rest of this proposal. Which repos are missing is a local
+  question (`scan_models` against the `from_pretrained` targets the
+  realized workflow names); `gb` needs a hub call
+  (`model_info(files_metadata=True)`) and is `null` when the hub is
+  unreachable rather than a reason for validate to fail.
 
 ### 2. `acknowledged_cost` accepts what was acknowledged
 
@@ -120,12 +155,21 @@ estimate exceeds the acknowledged minutes by more than a tolerance (25%,
 settable), naming both figures and what changed. The agent's recovery is to
 re-quote to the user - which is the behaviour the gate was for.
 
+The check has to be the server's: `dw_mcp` is an `httpx` client of the
+HTTP API (`DwClient`), so the only alternative is for the MCP tool to call
+validate and then jobs and compare in between, which is a second round trip
+with a race in it. That means `POST /api/jobs` grows an *optional*
+`acknowledged_cost` field either way - the object is the only form it acts
+on; a bare `true` it merely records. `rerun_job` computes its plan from the
+stored job's arguments, with the seed swapped when `new_seed` is set.
+
 ### 3. Bare `true` stays legal, and says so
 
 An unbound `true` keeps working - the web UI, the CLI-equivalent callers and
 every existing script depend on it, and a hard requirement would be a
 breaking change to every MCP consumer. But the job records which kind of
-acknowledgement it got (`acknowledged: "boolean" | "bound"`), so "was this
+acknowledgement it got (`acknowledged: "none" | "boolean" | "bound"` -
+`none` is the web UI and every HTTP caller that sends nothing), so "was this
 run consented to at its actual size?" is answerable after the fact, and the
 skills can teach the bound form as the normal one.
 
@@ -159,19 +203,33 @@ skills can teach the bound form as the normal one.
   `plan` from `validate_workflow`.
 - Docs: SERVER.md, MCP.md, WORKFLOW_GUIDE.md's authoring section, and the
   three plugin skills' cost step.
-- Tests: fingerprint stability against cosmetic edits, change under a longer
-  list, the 409, the tolerance, and the boolean path unchanged.
+- Tests: fingerprint stability against cosmetic edits, against a new seed,
+  and against a new `latest` run landing between validate and queue; change
+  under a longer list and under an edited stored prompt; `cached_steps`
+  against a warm step cache; `downloads_required` with the hub unreachable;
+  the 409, the tolerance, and the boolean path unchanged.
 
 Roughly a two-stage piece of work: stage 1 the plan on validate (useful on
 its own), stage 2 the binding and the 409.
 
-## Open questions for approval
-
-1. Is the bound form worth it at all, given that a human is already in the
-   loop on every acknowledgement? (Doing nothing is a legitimate answer;
-   stage 1 alone is another.)
-2. Tolerance: 25% of the acknowledged minutes, or a fingerprint-only check
-   with no numeric comparison at all? A numeric one needs `per_entry` on the
-   templates to be meaningful, and today no template carries it.
-3. Should `POST /api/jobs` grow the gate for HTTP callers too, or stay an
-   MCP-layer concept? (The web UI would have to send something.)
+## Decisions taken (2026-09-13)
+
+The three questions the proposal left open were settled by building it:
+
+1. **The bound form was built.** Both stages shipped (b37f033, d447f7d): the
+   plan on validate, and an `acknowledged_cost` object that `POST /api/jobs`
+   and `/rerun` check. The human-in-the-loop argument for doing nothing was
+   real, but cases 1, 4 and 6 above are exactly where the human consented to
+   one size and got another, and the check costs a free pre-flight.
+2. **Fingerprint-only; no numeric tolerance.** `minutes` is carried and
+   recorded but never compared. A tolerance needs `per_entry` measured on the
+   list-driven templates, and neither carries one yet; until they do, every
+   list-driven estimate has `basis: catalog` - the default list's total - and
+   a 25% band around it would be a band around the wrong number. The
+   `downloads` list is the one non-fingerprint thing compared, because a repo
+   that appeared since the quote is a cost the fingerprint cannot see.
+3. **HTTP takes it, never requires it.** The web UI and every existing caller
+   send nothing and are recorded as `acknowledged: none`; `true` is
+   `boolean`; only the object is checked. The gate stays the MCP layer's -
+   the server's part is to refuse a *bound* acknowledgement that no longer
+   matches, which only the server can judge.
diff --git a/docs/proposals/mcp-context-cost.md b/docs/proposals/mcp-context-cost.md
new file mode 100644
index 00000000..b974b081
--- /dev/null
+++ b/docs/proposals/mcp-context-cost.md
@@ -0,0 +1,188 @@
+# Proposal: what the `dw` MCP surface costs an agent's context, and what to trim
+
+Status: **measured, not started** - the numbers below are real measurements
+taken 2026-09-13 against `dw.serve 0.4.0-beta.3` on `lem` and against the
+tool surface `build_server` produces. Nothing here is implemented. Written
+for issue #101 by the implementer agent, model `opus` via provider
+`anthropic`.
+
+## Method
+
+Token figures are **chars / 4**, the usual English-prose approximation.
+JSON packs slightly denser than prose, so treat every number as ±15% and
+as a *floor* rather than a ceiling. Comparisons between the numbers are
+sound even where the absolute scale is approximate, because every figure
+was taken the same way.
+
+- Tool schemas: `build_server(...).list_tools()`, each tool serialized as
+  `{name, description, inputSchema}` compactly - what a client renders into
+  the model's context on connect.
+- Server instructions: `MCPServer(instructions=...)`, also paid on connect.
+- Results: the `dw_mcp` handlers called directly against `lem`'s HTTP API,
+  which returns exactly the dict the SDK serializes into the tool result.
+- Skills: byte size on disk of each `SKILL.md`, and of the frontmatter
+  `description` that is paid every session whether or not it is invoked.
+
+## 1. Connect cost - paid by every session, before any call
+
+| | chars | ~tokens |
+|---|---|---|
+| 55 tool schemas (name + description + inputSchema) | 42,419 | ~10,600 |
+| — of which descriptions | 28,242 | ~7,060 |
+| — of which input schemas | 10,621 | ~2,655 |
+| server `instructions` | 3,998 | ~1,000 |
+| `dw` plugin + 3 skill frontmatter descriptions | ~1,500 | ~375 |
+| **total** | **~47,900** | **~11,975** |
+
+About **12k tokens**, ~6% of a 200k window. The ten fattest tools are 60%
+of it:
+
+| ~tokens | tool | desc chars |
+|---|---|---|
+| 662 | `validate_workflow` | 2,062 |
+| 561 | `wait_for_job` | 1,949 |
+| 495 | `run_workflow` | 1,245 |
+| 470 | `get_memory` | 1,730 |
+| 463 | `list_workflows` | 1,365 |
+| 444 | `download_output` | 1,309 |
+| 349 | `list_gallery` | 1,012 |
+| 348 | `get_gallery_metadata` | 1,020 |
+| 324 | `keep_output` | 785 |
+| 318 | `export_job` | 1,008 |
+
+The 20 smallest tools together are ~1,600 tokens - the long tail is not the
+bill. Descriptions are 67% of the connect cost; input schemas are cheap and
+mostly unavoidable.
+
+## 2. Skills
+
+| file | KB | ~tokens (body, on invoke) |
+|---|---|---|
+| `minimax-h3/SKILL.md` | 12.3 | ~3,070 |
+| `ltx-2.5/SKILL.md` | 12.2 | ~3,060 |
+| `minimax-music3/SKILL.md` | 10.6 | ~2,640 |
+
+Frontmatter descriptions total ~1,150 chars (~290 tokens) - that is the only
+part paid unconditionally. A body is paid once, when the family is actually
+in play, and both video skills already sit against the 12 KiB harness cap.
+**This is not where the money is.** The loop logs (`logs/*.log`) are agent
+summaries, not transcripts, so invocation counts could not be recovered from
+them; if that matters, the driver would have to log tool/skill use.
+
+## 3. Result sizes - the actual bill
+
+| ~tokens | call |
+|---|---|
+| **19,600** | `get_guide("workflows")` - **no section** |
+| **16,000** | `get_guide("tasks")` - no section |
+| **8,650** | `get_schema()` |
+| **6,840** | `list_workflows()` - no shape |
+| 5,160 | `get_guide("workflows", "Authoring a workflow from an agent")` |
+| 3,030 | `list_workflows(shape="shot")` |
+| 2,300 | `list_pipelines()` |
+| 1,560 | `list_jobs(limit=20)` |
+| 1,450 | `list_gallery(limit=50)` |
+| 1,090 | `get_job_events(job)` |
+| 850 | `list_guides()` |
+| 750 | `get_workflow(name)` |
+| 260 | `get_job(job)` |
+| 145 | `get_workflow(name, variables_only=True)` |
+| 80 | `validate_workflow(name=...)` |
+| 21 | `get_memory()` |
+
+Other shapes: `image` 770, `image-set` 560, `image-edit` 1,040, `sequence`
+1,040, `audio` 300, `text` 200, `utility` 460. `shot` at 3,030 is four times
+the median shape because that is where the templates cluster.
+
+### Per-cycle arithmetic
+
+A tester cycle that authors something new and runs it:
+
+```
+connect                                    ~12,000
+list_guides + one guide section             ~6,000
+get_schema                                  ~8,650
+list_workflows(shape) + get_workflow         ~3,800
+one skill body                              ~3,000
+validate + run                                 ~300
+wait_for_job x 11 (a 10-minute job, 55s cap) ~3,300
+get_job_events + list_gallery                ~2,500
+                                            -------
+                                            ~39,550
+```
+
+...before a single line of the agent's own reasoning, and before any repeat
+call. That is ~20% of a 200k window, and **the connect cost is under a third
+of it**.
+
+## The finding
+
+**The tool schemas are not the problem. Single unbounded results are.**
+
+One `get_guide` call with `section` omitted costs 19.6k tokens - more than
+the entire 55-tool surface, in one call, and an agent can make that mistake
+twice before noticing. `get_schema` has no way to ask for less at all. These
+two are worth more than every description trim combined.
+
+Two things also argue against aggressive description trimming: the long
+descriptions are load-bearing (they encode rules that closed real tickets -
+`get_memory`'s three response shapes from #80, `wait_for_job`'s lead-in
+silence, `list_workflows`' curated-vs-derived cost distinction), and they
+are paid once per session while a fat result is paid per call.
+
+## Recommendations
+
+Ordered by tokens saved per unit of risk. Items 1-3 change a result shape
+and so are the part of #101 that needs approval before anything ships.
+
+**1. `get_guide` without `section` should not return the whole document.**
+Return the guide's section index plus its first section, with an explicit
+note naming what was withheld and how to ask for it. Saves ~14k tokens on
+the mistake, costs nothing when the agent does the right thing (which the
+description already asks for). Result-shape change → approval. Cheaper
+variant if that is too blunt: keep the whole document but cap it at a
+configurable size and truncate with the same note.
+
+**2. Give `get_schema` a `section` argument** (`steps`, `pipelines`,
+`tasks`, `result`, `variables`, `configuration`). An additive optional
+parameter; the no-argument call keeps returning everything, so nothing
+breaks. An agent authoring a task step pays ~1-2k instead of 8.65k. Saves
+~6-7k per authoring session.
+
+**3. `list_workflows()` with no `shape` should summarise rather than
+expand.** 6.84k tokens for the full catalog against 3.03k for the fattest
+single shape. Either drop `details` when no shape is given, or return
+per-shape counts plus names only. Result-shape change → approval. Saves
+~4k on the call the MCP instructions already discourage.
+
+**4. Move measured, model-specific narrative out of tool descriptions into
+the skills and guides** - `wait_for_job`'s H3 629 s video-reference lead-in
+and the block-cache gap arithmetic, `get_memory`'s pinned-host-cache
+explanation. Keep every *rule* in the description (what `live: false` means,
+that silence is not a hang, that the cap is 55 s); move the *numbers and
+worked examples* to the `minimax-h3` skill, which loads exactly when H3 is
+in play, and to a guide section. Realistic trim on the top five: ~8,350
+chars → ~4,000, saving ~1.1k tokens of connect cost. Description-only, no
+schema change - but it can reintroduce a closed ticket if done carelessly,
+so it wants the tester re-running the cases those paragraphs came from.
+
+**5. Do not touch the skills.** ~290 tokens unconditional, bodies paid only
+when relevant, and two of the three are already against the 12 KiB cap.
+
+**6. Not a `dw` change, but the biggest single lever: check whether the
+loop's `claude` sessions defer MCP tool schemas.** This harness supports
+fetching tool schemas on demand rather than rendering all 55 on connect -
+in the session this assessment was written in, every `mcp__dw__*` tool is
+deferred and costs a name until it is used. If the tester's
+`--strict-mcp-config` sessions are *not* getting that treatment, turning it
+on removes the entire ~10.6k connect cost with no change to `dw` at all,
+and makes items 4-5 not worth doing. Worth confirming from the driver side
+before spending engineering on description trims.
+
+## What I would ship
+
+Items 1 and 2 - they are where the tokens are, and item 2 breaks nothing.
+Item 3 if the summary shape is agreed. Item 4 only if item 6 comes back
+negative. The connect cost on its own (~12k, ~6% of the window) does not
+justify a risky rewrite of descriptions that were each written to fix a
+misreading.
diff --git a/docs/superpowers/plans/2026-09-13-acknowledged-cost-stage-1-plan.md b/docs/superpowers/plans/2026-09-13-acknowledged-cost-stage-1-plan.md
new file mode 100644
index 00000000..7346e25d
--- /dev/null
+++ b/docs/superpowers/plans/2026-09-13-acknowledged-cost-stage-1-plan.md
@@ -0,0 +1,1470 @@
+# Acknowledged-cost binding, stage 1: the plan on validate
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** `POST /api/validate` (and MCP `validate_workflow`) answers with a `plan` - a fingerprint of the work the run will execute for the arguments given, the step count, the list lengths, the model repos it would have to download first, and a cost estimate whose basis is named - so an agent quotes what will run rather than the catalog's defaults-only `cost`.
+
+**Architecture:** A new pure module `dw/plan.py` builds the plan from the `Workflow` the route already constructed: it realizes the definition with the caller's arguments (`realize_workflow`, gaining a `pin_outputs=False` switch so a `latest` landing between validate and run does not change the fingerprint), expands `for_each` through `Workflow.expanded_definition`, scrubs the seed and the documentation keys, and hashes the rest. The estimate reads the workflow's own `cost` block (and each composed child's); downloads are the `model_name`s `scan_models` does not find. The route attaches the plan best-effort and never lets it change the verdict. MCP surfaces it and the skills/docs teach quoting from it.
+
+**Tech Stack:** Python 3.12, FastAPI (`dw/server/app.py`), pytest, `huggingface_hub` (`scan_cache_dir`, `model_info`).
+
+**Spec:** [docs/superpowers/specs/2026-09-12-acknowledged-cost-binding-design.md](../specs/2026-09-12-acknowledged-cost-binding-design.md) - stage 1 sections 1-5. Stage 2 (the bound acknowledgement and the 409) is a separate plan.
+
+## Global Constraints
+
+- Model knowledge stays out of engine code: no repo name, no per-model minute figure anywhere in `dw/`. Every number comes from a workflow's `cost` block.
+- `dw/plan.py` imports nothing from `dw.server` or `dw.worker`.
+- Plan construction is best effort at the API: a failure is logged and answered as `plan: null`; the validate verdict is the schema's, never the planner's. An invalid answer carries no `plan` key at all.
+- Every path the planner reads goes through the resolvers the run uses (`realize_workflow`, `resolve_sub_workflow` + `validate_workflow_path`, `scan_models`). It opens no file by a path it computed itself.
+- Fixtures declare their own `cost` blocks and their own `model_name` strings; no test names a real model.
+- The hub is never a reason for validate to fail: `model_info` errors, timeouts and missing tokens give `gb: null`, logged at `debug` only.
+- `plugins/dw/skills/*/SKILL.md` must each stay under `12 * 1024` bytes (`tests/test_plugin_skills.py::SKILL_SIZE_LIMIT`). `ltx-2.5` is at 12182 and `minimax-h3` at 12239 - the cost-step rewrite must not add net bytes there.
+- Work happens in the `cost-plan` worktree (`.claude/worktrees/cost-plan`, branch `cost-plan`, already merged with `develop` at 1af85ac). Run tests from there with `python -m pytest`.
+- Commit messages follow the repo's shape: `feat(engine): #85 - ...`, `docs(mcp): #85 - ...`, one sentence in the imperative, ending with `Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>`.
+
+## File structure
+
+| File | Responsibility |
+|---|---|
+| `dw/realize.py` (modify) | `realize_workflow(pin_outputs=...)`; `read_sub_workflow()` factored out of `_digest` so the planner reads a child by the run's own resolution |
+| `dw/plan.py` (new) | `build_plan(candidate, arguments, ...)` and its four parts: `fingerprint`, `estimate`, `downloads_required`, `list_entries` |
+| `dw/server/app.py` (modify) | `plan` on the valid answer of `POST /api/validate`; `?sizes=` query parameter |
+| `dw_mcp/server.py`, `dw_mcp/diagnose.py` (modify) | docstring and `COST_REFUSAL` teach quoting from the plan |
+| `docs/SERVER.md`, `docs/MCP.md`, `docs/WORKFLOW_GUIDE.md`, `CLAUDE.md` (modify) | the `plan` block and the quoting rule |
+| `plugins/dw/skills/{ltx-2.5,minimax-h3,minimax-music3}/SKILL.md` (modify) | the "quote cost" step |
+| `tests/test_realize.py`, `tests/test_plan.py` (new), `tests/test_server.py`, `tests/test_mcp_server.py` | coverage |
+
+---
+
+### Task 1: `realize_workflow(pin_outputs=False)` and `read_sub_workflow`
+
+**Files:**
+- Modify: `dw/realize.py` (`realize_workflow` signature at line 44, `_pin` at ~140, `_pin_output` at ~172, `_digest` at ~220)
+- Test: `tests/test_realize.py`
+
+**Interfaces:**
+- Produces: `realize_workflow(definition, arguments, seed, base_dir=None, prompt_dir=None, output_root=None, workflow_dir=None, pin_outputs=True) -> (realized, annotations)`. With `pin_outputs=False`, every `output:.../latest/...` reference is returned exactly as written; prompt inlining and the seed pin are unchanged.
+- Produces: `read_sub_workflow(path, base_dir, workflow_dir) -> bytes | None` - the file a sub-workflow step's `path` resolves to, read through `resolve_sub_workflow` and `validate_workflow_path` exactly as `_digest` did, `None` when it cannot be read (logged at debug).
+
+- [ ] **Step 1: Write the failing tests**
+
+Append to `tests/test_realize.py` (the module already has `definition()`, `prompt_library` and `output_root` fixtures - `output_root` yields `(root, run_id)` with one run of `ltx2/Gyre` holding `still.png`):
+
+```python
+class TestUnpinnedOutputs:
+    def test_pin_outputs_false_leaves_latest_as_written(self, output_root):
+        root, _ = output_root
+        spec = definition()
+        spec["steps"][0]["pipeline"]["arguments"]["image"] = (
+            "output:ltx2/Gyre/latest/still.png"
+        )
+        realized, _ = realize_workflow(
+            spec, {}, 7, output_root=root, pin_outputs=False
+        )
+        assert (
+            realized["steps"][0]["pipeline"]["arguments"]["image"]
+            == "output:ltx2/Gyre/latest/still.png"
+        )
+
+    def test_pin_outputs_false_still_inlines_prompts(self, prompt_library):
+        spec = definition()
+        spec["variables"]["prompt"] = "prompt:scenic/dusk"
+        realized, annotations = realize_workflow(
+            spec, {}, 7, prompt_dir=prompt_library, pin_outputs=False
+        )
+        assert realized["variables"]["prompt"] == "a harbour at dusk"
+        assert annotations["prompts"] == ["scenic/dusk"]
+
+    def test_the_default_still_pins(self, output_root):
+        root, run_id = output_root
+        spec = definition()
+        spec["steps"][0]["pipeline"]["arguments"]["image"] = (
+            "output:ltx2/Gyre/latest/still.png"
+        )
+        realized, _ = realize_workflow(spec, {}, 7, output_root=root)
+        assert (
+            realized["steps"][0]["pipeline"]["arguments"]["image"]
+            == f"output:ltx2/Gyre/{run_id}/still.png"
+        )
+
+
+class TestReadSubWorkflow:
+    def test_reads_a_child_beside_the_parent(self, tmp_path):
+        from dw.realize import read_sub_workflow
+
+        child = {"id": "child", "steps": []}
+        (tmp_path / "child.json").write_text(json.dumps(child))
+        raw = read_sub_workflow("child.json", str(tmp_path), str(tmp_path))
+        assert json.loads(raw) == child
+
+    def test_a_missing_child_reads_as_none(self, tmp_path):
+        from dw.realize import read_sub_workflow
+
+        assert read_sub_workflow("nope.json", str(tmp_path), str(tmp_path)) is None
+
+    def test_a_child_outside_the_confinement_reads_as_none(self, tmp_path):
+        from dw.realize import read_sub_workflow
+
+        outside = tmp_path / "outside"
+        outside.mkdir()
+        (outside / "child.json").write_text(json.dumps({"id": "c", "steps": []}))
+        confined = tmp_path / "confined"
+        confined.mkdir()
+        assert (
+            read_sub_workflow("../outside/child.json", str(confined), str(confined))
+            is None
+        )
+```
+
+- [ ] **Step 2: Run the tests to verify they fail**
+
+Run: `python -m pytest tests/test_realize.py -k "Unpinned or ReadSub" -v`
+Expected: FAIL - `TypeError: ... unexpected keyword argument 'pin_outputs'` and `ImportError: cannot import name 'read_sub_workflow'`.
+
+- [ ] **Step 3: Implement**
+
+In `dw/realize.py`:
+
+Change the signature and docstring of `realize_workflow`:
+
+```python
+def realize_workflow(
+    definition,
+    arguments,
+    seed,
+    base_dir=None,
+    prompt_dir=None,
+    output_root=None,
+    workflow_dir=None,
+    pin_outputs=True,
+):
+```
+
+Add to the `Args:` block:
+
+```
+        pin_outputs: Whether an 'output:.../latest/...' reference is rewritten
+            to the run it resolves to. The run leaves this True; the planner
+            (dw/plan.py) passes False so a run finishing between a validate
+            call and the queue call does not change the fingerprint of
+            identical work.
+```
+
+Change the `_pin` call to `realized = _pin(realized, annotations, base_dir, prompt_dir, output_root, pin_outputs)` and `_pin` to:
+
+```python
+def _pin(value, annotations, base_dir, prompt_dir, output_root, pin_outputs=True):
+    """Rebuild a value with prompt references inlined and, when
+    `pin_outputs`, output references pinned."""
+
+    def transform(string):
+        if string.startswith(PROMPT_PREFIX):
+            return _inline_prompt(string, annotations, prompt_dir, base_dir)
+        if pin_outputs and is_output_reference(string):
+            return _pin_output(string, output_root)
+        return string
+
+    return _map_strings(value, transform)
+```
+
+Replace `_digest` with a public reader plus the digest over it:
+
+```python
+def read_sub_workflow(path, base_dir, workflow_dir):
+    """The bytes of the sub-workflow file a step's `path` names, or None
+    when it cannot be read.
+
+    Resolved the way `Workflow.create_step_action` resolves it - beside the
+    referencing file, then across the workflow search path, then through
+    `validate_workflow_path` confined to the root it came from - so a path
+    this run could not have loaded is not one realization (or the planner)
+    reads either, and a catalog name the run composed is read rather than
+    recorded as unreadable (#90).
+    """
+    try:
+        candidate, root = resolve_sub_workflow(path, base_dir or ".", workflow_dir)
+        validated = validate_workflow_path(candidate, root)
+        with open(validated, "rb") as file:
+            return file.read()
+    except (SecurityError, OSError, ValueError, SubWorkflowNotFound) as e:
+        logger.debug(f"Sub-workflow {path} could not be read: {e}")
+        return None
+
+
+def _digest(path, base_dir, workflow_dir):
+    """The SHA-256 of a sub-workflow file, or None when it cannot be read."""
+    raw = read_sub_workflow(path, base_dir, workflow_dir)
+    return hashlib.sha256(raw).hexdigest() if raw is not None else None
+```
+
+- [ ] **Step 4: Run the tests to verify they pass**
+
+Run: `python -m pytest tests/test_realize.py -v`
+Expected: all PASS, the pre-existing digest tests included.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add dw/realize.py tests/test_realize.py
+git commit -m "feat(engine): #85 - realize_workflow can leave 'latest' unpinned, and a sub-workflow is read by one resolver
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>"
+```
+
+---
+
+### Task 2: `dw/plan.py` - realization, expansion, `steps`, `list_entries`, the fingerprint
+
+**Files:**
+- Create: `dw/plan.py`
+- Test: `tests/test_plan.py` (new)
+
+**Interfaces:**
+- Consumes: `realize_workflow(..., pin_outputs=False)` from Task 1; `Workflow.expanded_definition()` (`dw/workflow.py:393`), `Workflow(definition, output_dir, file_spec, workflow_dir)`.
+- Produces:
+
+```python
+def build_plan(
+    candidate,            # a dw.workflow.Workflow, as the route constructed it
+    arguments,            # the caller's dict, already past argument_errors
+    *,
+    device,               # "cuda" | "mps" | "cpu" - the serving backend
+    prompt_dir=None,
+    cache_dir=None,
+    lookup_sizes=True,
+    cache_probe=None,     # stage 2; ignored here, cached_steps is always None
+):
+    """What a run of `candidate` with `arguments` will execute and cost."""
+```
+
+returning
+
+```python
+{
+    "fingerprint": "sha256:<64 hex>",
+    "steps": int,
+    "list_entries": {variable: int},
+    "cached_steps": None,
+    "downloads_required": [...],   # Task 4; [] until then
+    "estimate": {...},             # Task 3; placeholder until then
+}
+```
+
+and the helpers Tasks 3-4 fill in: `fingerprint(expanded, definition) -> str`, `list_entries(definition_as_written, realized) -> dict`.
+
+- [ ] **Step 1: Write the failing tests**
+
+Create `tests/test_plan.py`:
+
+```python
+"""The plan a validate call answers with: what a run will execute for the
+arguments given, fingerprinted so an acknowledgement can be bound to it."""
+
+import copy
+import json
+import os
+
+import pytest
+
+from dw.plan import build_plan
+from dw.runs import new_run_id
+from dw.workflow import workflow_from_definition
+
+
+def definition():
+    """A list-driven workflow with a stored prompt and an output reference,
+    so every mutable input the fingerprint must ignore or honour is here."""
+    return {
+        "id": "plan_test",
+        "description": "docs only",
+        "summary": "docs only",
+        "seed": "variable:seed",
+        "cost": [{"device": "cuda", "name": "card", "vram_gb": 8, "minutes": 10}],
+        "variables": {
+            "seed": 1,
+            "prompt": "prompt:scenic/dusk",
+            "frames": 25,
+            "shots": [{"name": "a", "prompt": "one"}, {"name": "b", "prompt": "two"}],
+        },
+        "steps": [
+            {
+                "name": "still",
+                "pipeline": {
+                    "configuration": {"component_type": "{Fake}"},
+                    "from_pretrained_arguments": {"model_name": "org/still-model"},
+                    "arguments": {
+                        "prompt": "variable:prompt",
+                        "image": "output:ltx2/Gyre/latest/still.png",
+                        "num_frames": "variable:frames",
+                    },
+                },
+            },
+            {
+                "name": "shot",
+                "for_each": "variable:shots",
+                "task": {"command": "x", "arguments": {"prompt": "item:prompt"}},
+            },
+        ],
+    }
+
+
+@pytest.fixture
+def prompt_library(tmp_path):
+    library = tmp_path / "prompts"
+    (library / "scenic").mkdir(parents=True)
+    (library / "scenic" / "dusk.json").write_text(json.dumps({"text": "a harbour at dusk"}))
+    return library
+
+
+@pytest.fixture
+def output_root(tmp_path):
+    root = tmp_path / "outputs"
+    run = root / "ltx2" / "Gyre" / new_run_id({"a": 1})
+    run.mkdir(parents=True)
+    (run / "still.png").write_bytes(b"png")
+    return root
+
+
+@pytest.fixture
+def plan(tmp_path, prompt_library, output_root, monkeypatch):
+    """build_plan over the fixture, with the hub cache empty and the hub
+    unreachable, so downloads never touch the network in these tests."""
+    import dw.plan
+
+    monkeypatch.setattr(dw.plan, "scan_models", lambda cache_dir=None: {"repos": []})
+    monkeypatch.setattr(
+        dw.plan, "model_info", lambda *a, **k: (_ for _ in ()).throw(RuntimeError("offline"))
+    )
+
+    def make(spec=None, arguments=None, **overrides):
+        spec = definition() if spec is None else spec
+        candidate = workflow_from_definition(
+            copy.deepcopy(spec), str(output_root), str(tmp_path), str(tmp_path)
+        )
+        kwargs = dict(device="cuda", prompt_dir=str(prompt_library), lookup_sizes=False)
+        kwargs.update(overrides)
+        return build_plan(candidate, arguments or {}, **kwargs)
+
+    return make
+
+
+class TestShape:
+    def test_the_documented_keys(self, plan):
+        answer = plan()
+        assert set(answer) == {
+            "fingerprint", "steps", "list_entries", "cached_steps",
+            "downloads_required", "estimate",
+        }
+        assert answer["fingerprint"].startswith("sha256:")
+        assert len(answer["fingerprint"]) == len("sha256:") + 64
+        assert answer["cached_steps"] is None
+
+    def test_steps_counts_the_expanded_members(self, plan):
+        assert plan()["steps"] == 3  # still, shot@a, shot@b
+
+    def test_list_entries_is_the_callers_list_length(self, plan):
+        shots = [{"name": n, "prompt": n} for n in "abcde"]
+        answer = plan(arguments={"shots": shots})
+        assert answer["list_entries"] == {"shots": 5}
+        assert answer["steps"] == 6
+
+    def test_a_literal_for_each_list_is_not_an_entry(self, plan):
+        spec = definition()
+        spec["steps"][1]["for_each"] = [{"name": "x"}, {"name": "y"}]
+        del spec["variables"]["shots"]
+        assert plan(spec)["list_entries"] == {}
+
+
+class TestFingerprintIsStableAcross:
+    def test_a_different_top_level_seed(self, plan):
+        assert plan()["fingerprint"] == plan(arguments={"seed": 99})["fingerprint"]
+
+    def test_a_different_step_seed(self, plan):
+        spec = definition()
+        spec["steps"][0]["seed"] = 5
+        spec["steps"][0]["pipeline"]["seed"] = 5
+        other = copy.deepcopy(spec)
+        other["steps"][0]["seed"] = 6
+        other["steps"][0]["pipeline"]["seed"] = 6
+        assert plan(spec)["fingerprint"] == plan(other)["fingerprint"]
+
+    def test_key_order(self, plan):
+        spec = definition()
+        reordered = {k: spec[k] for k in reversed(list(spec))}
+        assert plan(spec)["fingerprint"] == plan(reordered)["fingerprint"]
+
+    def test_description_summary_and_cost_edits(self, plan):
+        spec = definition()
+        spec["description"] = "rewritten"
+        spec["summary"] = "rewritten"
+        spec["cost"][0]["minutes"] = 99
+        spec["configures"] = "templates/x"
+        assert plan(spec)["fingerprint"] == plan()["fingerprint"]
+
+    def test_a_new_run_landing_under_latest(self, plan, output_root):
+        before = plan()["fingerprint"]
+        newer = output_root / "ltx2" / "Gyre" / new_run_id({"b": 2})
+        newer.mkdir(parents=True)
+        (newer / "still.png").write_bytes(b"png2")
+        assert plan()["fingerprint"] == before
+
+    def test_argument_order(self, plan):
+        a = plan(arguments={"frames": 9, "seed": 3})["fingerprint"]
+        b = plan(arguments={"seed": 3, "frames": 9})["fingerprint"]
+        assert a == b
+
+
+class TestFingerprintChangesWith:
+    def test_a_longer_list(self, plan):
+        longer = [{"name": n, "prompt": n} for n in "abc"]
+        assert plan()["fingerprint"] != plan(arguments={"shots": longer})["fingerprint"]
+
+    def test_a_changed_stored_prompt(self, plan, prompt_library):
+        before = plan()["fingerprint"]
+        (prompt_library / "scenic" / "dusk.json").write_text(
+            json.dumps({"text": "a harbour at dawn"})
+        )
+        assert plan()["fingerprint"] != before
+
+    def test_a_changed_numeric_argument(self, plan):
+        assert plan()["fingerprint"] != plan(arguments={"frames": 121})["fingerprint"]
+
+    def test_a_different_asset_name(self, plan):
+        spec = definition()
+        spec["steps"][0]["pipeline"]["arguments"]["image"] = "asset:a.png"
+        other = copy.deepcopy(spec)
+        other["steps"][0]["pipeline"]["arguments"]["image"] = "asset:b.png"
+        assert plan(spec)["fingerprint"] != plan(other)["fingerprint"]
+
+    def test_a_step_added_removed_or_renamed(self, plan):
+        base = plan()["fingerprint"]
+        renamed = definition()
+        renamed["steps"][0]["name"] = "frame"
+        removed = definition()
+        del removed["steps"][1]
+        added = definition()
+        added["steps"].append({"name": "extra", "task": {"command": "x", "arguments": {}}})
+        assert len({base, plan(renamed)["fingerprint"], plan(removed)["fingerprint"],
+                    plan(added)["fingerprint"]}) == 4
+```
+
+- [ ] **Step 2: Run the tests to verify they fail**
+
+Run: `python -m pytest tests/test_plan.py -v`
+Expected: FAIL - `ModuleNotFoundError: No module named 'dw.plan'`.
+
+- [ ] **Step 3: Implement `dw/plan.py`**
+
+```python
+"""The plan a validate call answers with: what a run of a workflow with a
+caller's arguments will actually execute, what it will have to download
+first, and what the workflow's own cost block says it will take - with a
+fingerprint over the work, so an acknowledgement can be bound to it and a
+run whose shape changed after consent refused (#85, stage 2).
+
+Everything here is derived from the same resolvers the run uses -
+`realize_workflow` folds the arguments and inlines the prompts, and
+`Workflow.expanded_definition` substitutes and expands `for_each` - so the
+plan describes the run and not an approximation of it. Nothing here knows a
+model: every minute comes from a `cost` block and every repo name from a
+`from_pretrained_arguments`.
+"""
+
+import copy
+import hashlib
+import json
+import logging
+import os
+
+from huggingface_hub import model_info
+
+from .hub_cache import scan_models
+from .realize import BUILTIN_PREFIX, VARIABLE_PREFIX, read_sub_workflow, realize_workflow
+from .security import validate_url
+from .workflow import Workflow
+
+logger = logging.getLogger("dw")
+
+FINGERPRINT_PREFIX = "sha256:"
+# Top-level keys that document a workflow rather than shape its work
+DOCUMENTATION_KEYS = ("cost", "description", "summary", "configures")
+FOR_EACH_KEY = "for_each"
+SIZE_LOOKUP_TIMEOUT = 5.0
+GIB = 1024**3
+
+
+def build_plan(
+    candidate,
+    arguments,
+    *,
+    device,
+    prompt_dir=None,
+    cache_dir=None,
+    lookup_sizes=True,
+    cache_probe=None,
+):
+    """What a run of `candidate` with `arguments` will execute and cost.
+
+    Args:
+        candidate: The Workflow the route built - it carries the file spec
+            (so base_dir), the output root and the confinement a run has.
+        arguments: The caller's arguments, already past `argument_errors`;
+            an undeclared name or an uncoercible value raises here.
+        device: The backend that is serving - 'cuda', 'mps' or 'cpu'.
+        prompt_dir: The prompt library, for inlining.
+        cache_dir: The hub cache to check downloads against; None for the
+            default.
+        lookup_sizes: Whether to ask the hub how large a missing repo is.
+        cache_probe: Stage 2's step-cache probe; unused, `cached_steps` is
+            always None until then.
+    """
+    definition = candidate.workflow_definition
+    base_dir = (
+        os.path.dirname(os.path.abspath(candidate.file_spec))
+        if candidate.file_spec
+        else None
+    )
+    realized, _ = realize_workflow(
+        definition,
+        arguments,
+        seed=0,
+        base_dir=base_dir,
+        prompt_dir=prompt_dir,
+        output_root=candidate.output_dir,
+        workflow_dir=candidate.workflow_dir,
+        pin_outputs=False,
+    )
+    # Arguments are already folded into the realized variables, so the
+    # expansion takes none; it substitutes and expands exactly as the run
+    expanded = Workflow(
+        realized, candidate.output_dir, candidate.file_spec, candidate.workflow_dir
+    ).expanded_definition()
+    entries = list_entries(definition, realized)
+    return {
+        "fingerprint": fingerprint(expanded, definition),
+        "steps": len(expanded.get("steps") or []),
+        "list_entries": entries,
+        "cached_steps": None,
+        "downloads_required": [],
+        "estimate": None,
+    }
+
+
+def list_entries(definition, realized):
+    """{variable: length} for every `for_each` that names a list variable,
+    read from the folded variables - a literal list is not an argument and
+    is not listed."""
+    variables = realized.get("variables") or {}
+    entries = {}
+    for step in definition.get("steps") or []:
+        if not isinstance(step, dict):
+            continue
+        reference = step.get(FOR_EACH_KEY)
+        if isinstance(reference, str) and reference.startswith(VARIABLE_PREFIX):
+            name = reference.removeprefix(VARIABLE_PREFIX)
+            value = variables.get(name)
+            if isinstance(value, list):
+                entries[name] = len(value)
+    return entries
+
+
+def fingerprint(expanded, definition):
+    """SHA-256 over the expanded definition with everything that is not
+    work removed: the seed wherever it sits, and the documentation keys.
+
+    `definition` is the workflow as written, consulted for whether the
+    top-level seed named a variable - if it did, that variable's folded
+    value is the seed too and is blanked at its source.
+    """
+    doc = copy.deepcopy(expanded)
+    doc.pop("seed", None)
+    for key in DOCUMENTATION_KEYS:
+        doc.pop(key, None)
+    written_seed = definition.get("seed")
+    if isinstance(written_seed, str) and written_seed.startswith(VARIABLE_PREFIX):
+        name = written_seed.removeprefix(VARIABLE_PREFIX)
+        variables = doc.get("variables")
+        if isinstance(variables, dict) and name in variables:
+            variables[name] = None
+    for step in doc.get("steps") or []:
+        if isinstance(step, dict):
+            step.pop("seed", None)
+            pipeline = step.get("pipeline")
+            if isinstance(pipeline, dict):
+                pipeline.pop("seed", None)
+    # default=repr: a realized 'constant:' can be any Python value, and the
+    # fingerprint only needs it to be stable, not round-trippable
+    serialized = json.dumps(
+        doc, sort_keys=True, separators=(",", ":"), ensure_ascii=False, default=repr
+    )
+    return FINGERPRINT_PREFIX + hashlib.sha256(serialized.encode("utf-8")).hexdigest()
+```
+
+- [ ] **Step 4: Run the tests to verify they pass**
+
+Run: `python -m pytest tests/test_plan.py -v`
+Expected: PASS. If `test_a_different_step_seed` fails on schema grounds, the fixture's step-level `seed` is not schema-checked here (nothing validates in `build_plan`), so check the scrub order instead.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add dw/plan.py tests/test_plan.py
+git commit -m "feat(engine): #85 - a plan fingerprints the work a run will execute for the caller's arguments
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>"
+```
+
+---
+
+### Task 3: the estimate
+
+**Files:**
+- Modify: `dw/plan.py`
+- Test: `tests/test_plan.py`
+
+**Interfaces:**
+- Consumes: `read_sub_workflow(path, base_dir, workflow_dir)` from Task 1; `list_entries` from Task 2.
+- Produces: `estimate(definition, expanded, list_entries, device, base_dir, workflow_dir) -> dict` with keys `minutes` (float | None), `basis` (`"per_entry" | "catalog" | "other_device" | "unknown"`), `device`, `measured_on` (str | None), `partial` (bool). `build_plan` fills `"estimate"` with it.
+
+- [ ] **Step 1: Write the failing tests**
+
+Append to `tests/test_plan.py`:
+
+```python
+def cost(device="cuda", minutes=10, per_entry=None, name="card"):
+    entry = {"device": device, "name": name, "vram_gb": 8, "minutes": minutes}
+    if per_entry:
+        entry["per_entry"] = per_entry
+    return entry
+
+
+class TestEstimate:
+    def test_no_cost_block_is_unknown(self, plan):
+        spec = definition()
+        del spec["cost"]
+        assert plan(spec)["estimate"] == {
+            "minutes": None, "basis": "unknown", "device": "cuda",
+            "measured_on": None, "partial": False,
+        }
+
+    def test_an_empty_cost_list_is_unknown(self, plan):
+        spec = definition()
+        spec["cost"] = []
+        assert plan(spec)["estimate"]["basis"] == "unknown"
+
+    def test_the_serving_devices_entry_is_the_catalog_figure(self, plan):
+        spec = definition()
+        spec["cost"] = [cost("mps", 40, name="M2"), cost("cuda", 10, name="4090")]
+        assert plan(spec)["estimate"] == {
+            "minutes": 10.0, "basis": "catalog", "device": "cuda",
+            "measured_on": "4090", "partial": False,
+        }
+
+    def test_another_devices_entry_is_reported_as_such(self, plan):
+        spec = definition()
+        spec["cost"] = [cost("mps", 40, name="M2")]
+        assert plan(spec)["estimate"] == {
+            "minutes": 40.0, "basis": "other_device", "device": "cuda",
+            "measured_on": "M2", "partial": False,
+        }
+
+    def test_per_entry_scales_by_the_callers_list(self, plan):
+        spec = definition()
+        # 10 minutes for the 2-entry default, of which 3 per entry: 4 fixed
+        spec["cost"] = [cost("cuda", 10, {"variable": "shots", "minutes": 3, "entries": 2})]
+        shots = [{"name": n, "prompt": n} for n in "abcde"]
+        answer = plan(spec, arguments={"shots": shots})["estimate"]
+        assert answer["minutes"] == 4 + 3 * 5
+        assert answer["basis"] == "per_entry"
+
+    def test_per_entry_floors_at_zero(self, plan):
+        spec = definition()
+        spec["cost"] = [cost("cuda", 1, {"variable": "shots", "minutes": 3, "entries": 2})]
+        assert plan(spec)["estimate"]["minutes"] == 0.0
+
+    def test_per_entry_naming_no_list_falls_back_to_catalog(self, plan):
+        spec = definition()
+        spec["cost"] = [cost("cuda", 10, {"variable": "other", "minutes": 3, "entries": 2})]
+        answer = plan(spec)["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (10.0, "catalog")
+
+    def test_other_device_beats_per_entry(self, plan):
+        spec = definition()
+        spec["cost"] = [cost("mps", 10, {"variable": "shots", "minutes": 3, "entries": 2})]
+        answer = plan(spec)["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (10.0, "other_device")
+
+    def test_minutes_is_rounded_to_one_decimal(self, plan):
+        spec = definition()
+        spec["cost"] = [cost("cuda", 10.04)]
+        assert plan(spec)["estimate"]["minutes"] == 10.0
+
+
+def composing(child_path):
+    return {
+        "id": "parent",
+        "cost": [cost("cuda", 2)],
+        "steps": [
+            {"name": "own", "task": {"command": "x", "arguments": {}}},
+            {"name": "child", "workflow": {"path": child_path, "arguments": {}}},
+        ],
+    }
+
+
+class TestSubWorkflowEstimate:
+    def test_a_childs_catalog_cost_is_added(self, plan, tmp_path):
+        child = {"id": "child", "cost": [cost("cuda", 5)], "steps": []}
+        (tmp_path / "child.json").write_text(json.dumps(child))
+        answer = plan(composing("child.json"))["estimate"]
+        assert (answer["minutes"], answer["partial"]) == (7.0, False)
+
+    def test_a_child_without_a_cost_makes_the_estimate_partial(self, plan, tmp_path):
+        (tmp_path / "child.json").write_text(json.dumps({"id": "child", "steps": []}))
+        answer = plan(composing("child.json"))["estimate"]
+        assert (answer["minutes"], answer["partial"]) == (2.0, True)
+
+    def test_an_unreadable_child_makes_the_estimate_partial(self, plan):
+        answer = plan(composing("missing.json"))["estimate"]
+        assert (answer["minutes"], answer["partial"]) == (2.0, True)
+
+    def test_a_builtin_adds_nothing_and_is_not_partial(self, plan):
+        answer = plan(composing("builtin:text-to-image.json"))["estimate"]
+        assert (answer["minutes"], answer["partial"]) == (2.0, False)
+
+    def test_a_child_measured_on_another_device_is_still_added(self, plan, tmp_path):
+        child = {"id": "child", "cost": [cost("mps", 5)], "steps": []}
+        (tmp_path / "child.json").write_text(json.dumps(child))
+        answer = plan(composing("child.json"))["estimate"]
+        assert answer["minutes"] == 7.0
+        # the parent's own basis is what is reported
+        assert answer["basis"] == "catalog"
+```
+
+- [ ] **Step 2: Run the tests to verify they fail**
+
+Run: `python -m pytest tests/test_plan.py -k "Estimate" -v`
+Expected: FAIL - `estimate` is `None`.
+
+- [ ] **Step 3: Implement**
+
+In `dw/plan.py`, replace `"estimate": None` in `build_plan` with
+
+```python
+        "estimate": estimate(
+            definition, expanded, entries, device, base_dir, candidate.workflow_dir
+        ),
+```
+
+and add:
+
+```python
+UNKNOWN = "unknown"
+CATALOG = "catalog"
+PER_ENTRY = "per_entry"
+OTHER_DEVICE = "other_device"
+
+
+def estimate(definition, expanded, list_entries, device, base_dir, workflow_dir):
+    """Minutes from the workflow's own cost block, scaled by the caller's
+    list when the block was measured per entry, plus each composed child's.
+
+    `basis` names where the figure came from - the honesty is in the field,
+    not in a fabricated number: 'unknown' is no cost block at all,
+    'other_device' a figure measured on a backend other than the one
+    serving (reported so the agent has something to scale, flagged so it
+    is not quoted as a measurement), 'catalog' the stored total, and
+    'per_entry' that total re-priced for the list actually passed.
+    """
+    own = _price(definition.get("cost"), device, list_entries)
+    minutes = own["minutes"]
+    partial = False
+    for step in expanded.get("steps") or []:
+        reference = step.get("workflow") if isinstance(step, dict) else None
+        path = reference.get("path") if isinstance(reference, dict) else None
+        if not isinstance(path, str) or path.startswith(BUILTIN_PREFIX):
+            continue
+        # A builtin is the parent's to price; a local child prices itself
+        raw = read_sub_workflow(path, base_dir, workflow_dir)
+        child_cost = None
+        if raw is not None:
+            try:
+                child_cost = json.loads(raw).get("cost")
+            except (ValueError, AttributeError):
+                child_cost = None
+        child = _price(child_cost, device, {})
+        if child["minutes"] is None:
+            partial = True
+        elif minutes is not None:
+            minutes += child["minutes"]
+        else:
+            minutes = child["minutes"]
+    return {
+        "minutes": round(minutes, 1) if minutes is not None else None,
+        "basis": own["basis"],
+        "device": device,
+        "measured_on": own["measured_on"],
+        "partial": partial,
+    }
+
+
+def _price(cost, device, list_entries):
+    """One cost list priced for `device` and `list_entries`, as
+    {minutes, basis, measured_on}."""
+    entries = [entry for entry in (cost or []) if isinstance(entry, dict)]
+    if not entries:
+        return {"minutes": None, "basis": UNKNOWN, "measured_on": None}
+    chosen = next((entry for entry in entries if entry.get("device") == device), None)
+    basis = CATALOG
+    if chosen is None:
+        chosen = entries[0]
+        basis = OTHER_DEVICE
+    minutes = float(chosen.get("minutes", 0))
+    per = chosen.get("per_entry")
+    if basis == CATALOG and isinstance(per, dict) and per.get("variable") in list_entries:
+        count = list_entries[per["variable"]]
+        each = float(per.get("minutes", 0))
+        measured_with = int(per.get("entries", 0))
+        minutes = max(0.0, (minutes - each * measured_with) + each * count)
+        basis = PER_ENTRY
+    return {"minutes": minutes, "basis": basis, "measured_on": chosen.get("name")}
+```
+
+- [ ] **Step 4: Run the tests to verify they pass**
+
+Run: `python -m pytest tests/test_plan.py -v`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add dw/plan.py tests/test_plan.py
+git commit -m "feat(engine): #85 - the plan prices a run from its cost block, per entry when measured, plus each composed child
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>"
+```
+
+---
+
+### Task 4: `downloads_required`
+
+**Files:**
+- Modify: `dw/plan.py`
+- Test: `tests/test_plan.py`
+
+**Interfaces:**
+- Consumes: `scan_models(cache_dir)` (`dw/hub_cache.py:37`, returns `{"repos": [{"repo_id": ...}, ...], ...}`), `validate_url` (`dw/security.py:327`, raises on a non-http(s) URL), `huggingface_hub.model_info(repo_id, files_metadata=True, timeout=...)`.
+- Produces: `downloads_required(expanded, base_dir, workflow_dir, cache_dir, lookup_sizes) -> list[dict]`; each `{"repo": str, "gb": float | None}` or `{"repo": None, "url": str, "gb": None}`.
+
+- [ ] **Step 1: Write the failing tests**
+
+Append to `tests/test_plan.py`:
+
+```python
+class TestDownloadsRequired:
+    def test_a_repo_not_in_the_cache_is_required(self, plan):
+        assert plan()["downloads_required"] == [{"repo": "org/still-model", "gb": None}]
+
+    def test_a_cached_repo_is_not(self, plan, monkeypatch):
+        import dw.plan
+
+        monkeypatch.setattr(
+            dw.plan, "scan_models",
+            lambda cache_dir=None: {"repos": [{"repo_id": "org/still-model"}]},
+        )
+        assert plan()["downloads_required"] == []
+
+    def test_cache_dir_reaches_scan_models(self, plan, monkeypatch):
+        import dw.plan
+
+        seen = []
+        monkeypatch.setattr(
+            dw.plan, "scan_models", lambda cache_dir=None: seen.append(cache_dir) or {"repos": []}
+        )
+        plan(cache_dir="/somewhere")
+        assert seen == ["/somewhere"]
+
+    def test_a_local_directory_is_not_a_download(self, plan, tmp_path):
+        local = tmp_path / "weights"
+        local.mkdir()
+        spec = definition()
+        spec["steps"][0]["pipeline"]["from_pretrained_arguments"]["model_name"] = str(local)
+        assert plan(spec)["downloads_required"] == []
+
+    def test_a_single_file_url_is_listed_without_a_size(self, plan):
+        spec = definition()
+        spec["steps"][0]["pipeline"]["from_pretrained_arguments"] = {
+            "from_single_file": "https://example.test/x.safetensors"
+        }
+        assert plan(spec)["downloads_required"] == [
+            {"repo": None, "url": "https://example.test/x.safetensors", "gb": None}
+        ]
+
+    def test_a_single_file_local_path_is_not_listed(self, plan):
+        spec = definition()
+        spec["steps"][0]["pipeline"]["from_pretrained_arguments"] = {
+            "from_single_file": "checkpoints/x.safetensors"
+        }
+        assert plan(spec)["downloads_required"] == []
+
+    def test_components_and_children_are_scanned_and_deduplicated(self, plan, tmp_path):
+        spec = definition()
+        spec["steps"][0]["pipeline"]["components"] = {
+            "vae": {"from_pretrained_arguments": {"model_name": "org/vae"}}
+        }
+        child = {
+            "id": "child",
+            "steps": [{"name": "c", "pipeline": {
+                "configuration": {"component_type": "{Fake}"},
+                "from_pretrained_arguments": {"model_name": "org/still-model"},
+                "arguments": {},
+            }}],
+        }
+        (tmp_path / "child.json").write_text(json.dumps(child))
+        spec["steps"].append({"name": "sub", "workflow": {"path": "child.json", "arguments": {}}})
+        assert [d["repo"] for d in plan(spec)["downloads_required"]] == [
+            "org/still-model", "org/vae",
+        ]
+
+    def test_sizes_come_from_the_hub_in_gib(self, plan, monkeypatch):
+        import dw.plan
+
+        class Sibling:
+            def __init__(self, size):
+                self.size = size
+
+        class Info:
+            siblings = [Sibling(2 * 1024**3), Sibling(None), Sibling(512 * 1024**2)]
+
+        calls = []
+
+        def fake_model_info(name, **kwargs):
+            calls.append((name, kwargs))
+            return Info()
+
+        monkeypatch.setattr(dw.plan, "model_info", fake_model_info)
+        answer = plan(lookup_sizes=True)["downloads_required"]
+        assert answer == [{"repo": "org/still-model", "gb": 2.5}]
+        assert calls[0][0] == "org/still-model"
+        assert calls[0][1]["files_metadata"] is True
+        assert calls[0][1]["timeout"] == 5.0
+
+    def test_a_hub_failure_is_a_null_size(self, plan, monkeypatch):
+        import dw.plan
+
+        def boom(*a, **k):
+            raise RuntimeError("offline")
+
+        monkeypatch.setattr(dw.plan, "model_info", boom)
+        assert plan(lookup_sizes=True)["downloads_required"] == [
+            {"repo": "org/still-model", "gb": None}
+        ]
+
+    def test_lookup_sizes_false_never_calls_the_hub(self, plan, monkeypatch):
+        import dw.plan
+
+        def boom(*a, **k):
+            raise AssertionError("must not be called")
+
+        monkeypatch.setattr(dw.plan, "model_info", boom)
+        plan(lookup_sizes=False)
+```
+
+- [ ] **Step 2: Run the tests to verify they fail**
+
+Run: `python -m pytest tests/test_plan.py -k Downloads -v`
+Expected: FAIL - `downloads_required` is `[]`.
+
+- [ ] **Step 3: Implement**
+
+In `build_plan`, replace `"downloads_required": []` with
+
+```python
+        "downloads_required": downloads_required(
+            expanded, base_dir, candidate.workflow_dir, cache_dir, lookup_sizes
+        ),
+```
+
+and add:
+
+```python
+FROM_PRETRAINED_KEY = "from_pretrained_arguments"
+MODEL_NAME_KEY = "model_name"
+SINGLE_FILE_KEY = "from_single_file"
+
+
+def downloads_required(expanded, base_dir, workflow_dir, cache_dir, lookup_sizes):
+    """The hub repos and checkpoint URLs the run would fetch before its
+    first step: every `model_name` in the expanded definition (and in each
+    composed child) that `scan_models` does not find, plus every
+    `from_single_file` that is a URL. Sizes come from the hub when asked
+    and are None whenever it does not answer - an offline box is a state,
+    not an error, so nothing here raises or logs above debug.
+    """
+    names = []
+    urls = []
+    _collect_sources(expanded, names, urls)
+    for step in expanded.get("steps") or []:
+        reference = step.get("workflow") if isinstance(step, dict) else None
+        path = reference.get("path") if isinstance(reference, dict) else None
+        if not isinstance(path, str) or path.startswith(BUILTIN_PREFIX):
+            continue
+        raw = read_sub_workflow(path, base_dir, workflow_dir)
+        if raw is None:
+            continue
+        try:
+            _collect_sources(json.loads(raw), names, urls)
+        except ValueError:
+            continue
+    present = {repo.get("repo_id") for repo in scan_models(cache_dir).get("repos", [])}
+    required = []
+    for name in names:
+        if name in present or os.path.isdir(name):
+            continue
+        required.append({"repo": name, "gb": _size_gb(name) if lookup_sizes else None})
+    for url in urls:
+        required.append({"repo": None, "url": url, "gb": None})
+    return required
+
+
+def _collect_sources(tree, names, urls):
+    """Every from_pretrained source in a tree, first-seen order, deduplicated."""
+    if isinstance(tree, dict):
+        source = tree.get(FROM_PRETRAINED_KEY)
+        if isinstance(source, dict):
+            name = source.get(MODEL_NAME_KEY)
+            if isinstance(name, str) and name not in names:
+                names.append(name)
+            single = source.get(SINGLE_FILE_KEY)
+            if isinstance(single, str) and _is_url(single) and single not in urls:
+                urls.append(single)
+        for value in tree.values():
+            _collect_sources(value, names, urls)
+    elif isinstance(tree, list):
+        for value in tree:
+            _collect_sources(value, names, urls)
+
+
+def _is_url(value):
+    if not value.startswith(("http://", "https://")):
+        return False
+    try:
+        validate_url(value)
+        return True
+    except Exception:
+        return False
+
+
+def _size_gb(name):
+    """A repo's size in GiB to one decimal, or None when the hub does not
+    say - unreachable, gated without a token, or a file with no size."""
+    try:
+        info = model_info(name, files_metadata=True, timeout=SIZE_LOOKUP_TIMEOUT)
+        total = sum(s.size for s in (info.siblings or []) if getattr(s, "size", None))
+    except Exception as e:
+        logger.debug(f"No size for {name}: {e}")
+        return None
+    return round(total / GIB, 1) if total else None
+```
+
+- [ ] **Step 4: Run the tests to verify they pass**
+
+Run: `python -m pytest tests/test_plan.py -v`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add dw/plan.py tests/test_plan.py
+git commit -m "feat(engine): #85 - the plan names the weights a run would download first
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>"
+```
+
+---
+
+### Task 5: `plan` on `POST /api/validate`
+
+**Files:**
+- Modify: `dw/server/app.py` (the `validate_workflow` route at ~1256-1366; imports near line 53-66)
+- Test: `tests/test_server.py`
+
+**Interfaces:**
+- Consumes: `build_plan(candidate, arguments, device=, prompt_dir=, lookup_sizes=)` from Tasks 2-4; `get_device`, `get_device_type` from `dw/__init__.py`.
+- Produces: on a valid answer, `answer["plan"]` is the plan or `None`; the route takes `sizes: bool = Query(True)`.
+
+- [ ] **Step 1: Write the failing tests**
+
+Append to `tests/test_server.py` (the module has `server`, `success_script`, `valid_workflow`, `video_workflow(job_id, with_cost=True)`):
+
+```python
+class TestValidatePlan:
+    def test_a_valid_answer_carries_a_plan(self, server, monkeypatch):
+        import dw.plan
+
+        monkeypatch.setattr(dw.plan, "scan_models", lambda cache_dir=None: {"repos": []})
+        with server(success_script) as client:
+            result = client.post(
+                "/api/validate?sizes=false",
+                json={"workflow": video_workflow("planned", with_cost=True)},
+            ).json()
+        assert result["valid"] is True
+        plan = result["plan"]
+        assert set(plan) == {
+            "fingerprint", "steps", "list_entries", "cached_steps",
+            "downloads_required", "estimate",
+        }
+        assert plan["steps"] == 1
+        assert plan["estimate"]["basis"] in {"catalog", "other_device"}
+        assert plan["estimate"]["minutes"] == 2.0
+        assert plan["downloads_required"] == [{"repo": "m", "gb": None}]
+
+    def test_an_invalid_answer_carries_no_plan(self, server):
+        with server(success_script) as client:
+            result = client.post(
+                "/api/validate", json={"workflow": {"id": "broken", "steps": "no"}}
+            ).json()
+        assert result["valid"] is False
+        assert "plan" not in result
+
+    def test_a_planner_failure_is_a_null_plan_not_a_verdict(self, server, monkeypatch):
+        import dw.server.app as app_module
+
+        def boom(*a, **k):
+            raise RuntimeError("planner broke")
+
+        monkeypatch.setattr(app_module, "build_plan", boom)
+        with server(success_script) as client:
+            result = client.post(
+                "/api/validate", json={"workflow": valid_workflow("v")}
+            ).json()
+        assert result["valid"] is True
+        assert result["plan"] is None
+
+    def test_sizes_reaches_the_planner(self, server, monkeypatch):
+        import dw.server.app as app_module
+
+        seen = []
+
+        def spy(candidate, arguments, **kwargs):
+            seen.append(kwargs["lookup_sizes"])
+            return {"fingerprint": "sha256:0", "steps": 0, "list_entries": {},
+                    "cached_steps": None, "downloads_required": [], "estimate": None}
+
+        monkeypatch.setattr(app_module, "build_plan", spy)
+        with server(success_script) as client:
+            client.post("/api/validate", json={"workflow": valid_workflow("v")})
+            client.post("/api/validate?sizes=false", json={"workflow": valid_workflow("v")})
+        assert seen == [True, False]
+
+    def test_the_plan_sees_the_callers_arguments(self, server, monkeypatch):
+        import dw.plan
+
+        monkeypatch.setattr(dw.plan, "scan_models", lambda cache_dir=None: {"repos": []})
+        with server(success_script) as client:
+            body = {"workflow": valid_workflow("v")}
+            one = client.post("/api/validate?sizes=false", json=body).json()["plan"]
+            body["arguments"] = {"prompt": "something else"}
+            two = client.post("/api/validate?sizes=false", json=body).json()["plan"]
+        assert one["fingerprint"] != two["fingerprint"]
+```
+
+- [ ] **Step 2: Run the tests to verify they fail**
+
+Run: `python -m pytest tests/test_server.py -k ValidatePlan -v`
+Expected: FAIL - `KeyError: 'plan'` / `AttributeError: module has no attribute 'build_plan'`.
+
+- [ ] **Step 3: Implement**
+
+In `dw/server/app.py`, beside the other `..` imports (line ~53-66), add:
+
+```python
+from ..plan import build_plan
+```
+
+Change the route signature:
+
+```python
+    @app.post("/api/validate")
+    def validate_workflow(
+        request: JobRequest,
+        ws: Workspace = Depends(selected_workspace),
+        sizes: bool = Query(
+            True,
+            description="Ask the hub how large each missing model is; false "
+            "skips the network for a faster answer",
+        ),
+    ):
+```
+
+(`Query` is not yet imported: line 24 is `from fastapi import Depends, FastAPI, HTTPException, Request` - add `Query` to it.)
+
+Extend the docstring's last sentence with: `A valid answer also carries a plan: the fingerprint of the work these arguments produce, the step count, the list lengths, the model repos not in the cache, and an estimate from the workflow's cost block.`
+
+After the `answer = {...}` block and the `checked_arguments` conditional, before `return answer`:
+
+```python
+        # What the run will execute for these arguments, fingerprinted so
+        # an acknowledgement can be bound to it (#85). Best effort: the
+        # verdict above is the schema's and the planner may not change it
+        try:
+            from .. import get_device, get_device_type
+
+            answer["plan"] = build_plan(
+                candidate,
+                request.arguments,
+                device=get_device_type(get_device()),
+                prompt_dir=workspace.prompts,
+                lookup_sizes=sizes,
+            )
+        except Exception:
+            logger.exception("Plan could not be built")
+            answer["plan"] = None
+        return answer
+```
+
+(`get_device`/`get_device_type` are imported inside functions elsewhere in this file - lines ~2687 and ~2720 - because `dw/__init__` does device detection at import; follow that.)
+
+- [ ] **Step 4: Run the tests to verify they pass**
+
+Run: `python -m pytest tests/test_server.py -k "ValidatePlan or validate" -v`
+Expected: PASS, the pre-existing validate tests included.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add dw/server/app.py tests/test_server.py
+git commit -m "feat(server): #85 - a valid pre-flight answers with the run's plan
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>"
+```
+
+---
+
+### Task 6: MCP surface and the refusal message
+
+**Files:**
+- Modify: `dw_mcp/server.py` (`validate_workflow` docstring at ~648-688), `dw_mcp/diagnose.py` (`COST_REFUSAL` at line 25)
+- Test: `tests/test_mcp_server.py`, `tests/test_mcp_diagnose.py`
+
+**Interfaces:**
+- Consumes: the `plan` field from Task 5, unchanged through `authoring.validate_workflow` (it returns the server's JSON as-is, so no client change).
+- Produces: nothing new in code; the docstring and the refusal are the deliverable.
+
+- [ ] **Step 1: Write the failing tests**
+
+Append to `tests/test_mcp_server.py` (check how the module reaches the tool functions - it builds the server with `create_server`/`build_server` and reads tools by name; mirror the nearest docstring test around line 865):
+
+```python
+async def test_validate_workflow_teaches_quoting_from_the_plan():
+    tools = await tools_of(server_over(ok({})))
+    doc = tools["validate_workflow"].description
+    assert "plan" in doc
+    assert "downloads_required" in doc
+    assert "estimate" in doc
+    assert "basis" in doc
+```
+
+(`tools_of`, `server_over` and `ok` are the module's existing helpers - line ~144 - and the file's async tests run under the existing pytest-asyncio configuration; copy the decorator, if any, from `test_read_only_tools_are_annotated_read_only`.)
+
+Append to `tests/test_mcp_diagnose.py`:
+
+```python
+def test_the_refusal_says_to_quote_the_plan():
+    from dw_mcp.diagnose import COST_REFUSAL
+
+    assert "plan" in COST_REFUSAL
+    assert "validate_workflow" in COST_REFUSAL
+```
+
+- [ ] **Step 2: Run the tests to verify they fail**
+
+Run: `python -m pytest tests/test_mcp_server.py tests/test_mcp_diagnose.py -k "plan" -v`
+Expected: FAIL on the `plan` / `downloads_required` assertions.
+
+- [ ] **Step 3: Implement**
+
+`dw_mcp/diagnose.py`:
+
+```python
+COST_REFUSAL = (
+    "Running a workflow occupies the GPU for minutes and the engine runs one "
+    "job at a time. Call `validate_workflow` with the arguments you will run "
+    "with (free): its `plan` says what will execute - `estimate.minutes` with "
+    "its `basis`, and any weights in `downloads_required` this box has to "
+    "fetch first. Tell the user that number, get their go-ahead, then call "
+    "again with acknowledged_cost=true."
+)
+```
+
+`dw_mcp/server.py`, append a paragraph to the `validate_workflow` docstring (before the closing `"""`):
+
+```
+        A valid answer carries `plan`: what will execute for these
+        arguments. Quote `plan.estimate.minutes` with its `basis` -
+        `per_entry` or `catalog` is a measured figure re-priced for your
+        list, `other_device` a figure from another accelerator (say so),
+        `unknown` no figure at all - and name each `downloads_required`
+        entry as its own line item ("and 41 GB of weights this box does not
+        have"); `gb` is null when the hub could not be asked. `steps` and
+        `list_entries` say how many members the list actually produced.
+        `plan` is null when it could not be built; the verdict stands.
+```
+
+- [ ] **Step 4: Run the tests to verify they pass**
+
+Run: `python -m pytest tests/test_mcp_server.py tests/test_mcp_diagnose.py -v`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add dw_mcp/server.py dw_mcp/diagnose.py tests/test_mcp_server.py tests/test_mcp_diagnose.py
+git commit -m "docs(mcp): #85 - the number to say out loud is the plan's, not the listing's
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>"
+```
+
+---
+
+### Task 7: docs, skills and the release note
+
+**Files:**
+- Modify: `docs/SERVER.md` (~252-269), `docs/MCP.md` (`## The cost gate`, ~312-347, and the `validate_workflow` row of the tool table), `docs/WORKFLOW_GUIDE.md` (~439-445 and step 4 of "The loop" ~481-487), `CLAUDE.md` (the `POST /api/validate` line under Critical Gotchas), `plugins/dw/skills/{ltx-2.5,minimax-h3,minimax-music3}/SKILL.md` (the "Run and judge" step 2), `docs/proposals/acknowledged-cost-binding.md` (status line)
+- Test: `tests/test_plugin_skills.py`, `tests/test_docs_links.py` (existing)
+
+**Interfaces:**
+- Consumes: the plan shape from Tasks 2-5. No code.
+
+- [ ] **Step 1: Check the skills' byte headroom**
+
+Run: `wc -c plugins/dw/skills/*/SKILL.md`
+Expected: `ltx-2.5` 12182, `minimax-h3` 12239, `minimax-music3` 10505; cap 12288. The two tight ones must not grow.
+
+- [ ] **Step 2: Docs**
+
+`docs/SERVER.md`, after the `POST /api/validate` bullet's last sentence (`...about the stored defaults only.`), add a paragraph inside the same bullet:
+
+```
+  A valid answer also carries `plan`, what the run will execute for those
+  arguments: `fingerprint` (`sha256:…` over the realized, expanded
+  definition with the seed and the documentation keys removed and
+  `output:…/latest/…` left unpinned - the same work hashes the same, a
+  longer list or an edited stored prompt does not); `steps`, the expanded
+  member count; `list_entries`, `{variable: length}` for each `for_each`
+  over a list variable; `cached_steps`, reserved (`null`);
+  `downloads_required`, each `model_name` the hub cache does not hold as
+  `{repo, gb}` (`gb` from the hub, `null` when it could not be asked -
+  `?sizes=false` skips the hub) and each `from_single_file` URL as
+  `{repo: null, url, gb: null}`; and `estimate`, `{minutes, basis,
+  device, measured_on, partial}` from the workflow's own `cost` block -
+  `basis` is `catalog` (the stored total), `per_entry` (re-priced for the
+  list passed, when the entry carries `per_entry`), `other_device` (no
+  entry for the serving backend; the first entry's figure, which is a
+  warning rather than a quote) or `unknown`; a composed child's cost is
+  added and `partial` is true when a child has none. `plan` is `null` when
+  it could not be built; an invalid answer carries no `plan` key.
+```
+
+`docs/MCP.md`:
+- In the tool table, `validate_workflow` row: append to its description ` A valid answer carries `plan` - the fingerprint, step count, list lengths, `downloads_required` and `estimate` (with `basis`) for the arguments given; quote from it`.
+- In "The intended loop", step 1: after `not the values you wrote` add `, and its `plan` is the number to say out loud: `estimate.minutes` with its `basis`, plus each `downloads_required` entry as a line item of its own`.
+
+`docs/WORKFLOW_GUIDE.md`:
+- Around line 439-445 (`quote the cost before running a list-driven workflow...`): replace `quote \`minutes - per_entry.minutes × per_entry.entries + per_entry.minutes × N\` for N entries, and without \`per_entry\` quote the total as the default list's.` with `\`validate_workflow\` with your \`arguments\` answers with a \`plan\` whose \`estimate\` already does that arithmetic (\`basis: per_entry\`), and without \`per_entry\` reports the default list's total (\`basis: catalog\`) - quote the plan's figure and say which basis it has.`
+- Step 4 of "The loop" (`run_workflow with acknowledged_cost=true, after telling the user what it costs...`): after `Without the acknowledgement the call is refused.` insert `The figure to tell them is the \`plan\` on the validate answer - \`estimate.minutes\` with its \`basis\`, and every \`downloads_required\` entry named as its own line item, since weights not on this box are minutes and gigabytes the cost block never counted.` Keep the rest of the step (the `models/` lookup for a workflow with no cost of its own) as the fallback for `basis: unknown`.
+
+`CLAUDE.md`, the Critical Gotchas bullet that begins `**A caller's \`arguments\` are checked before anything is queued**`: append one sentence: `A valid \`POST /api/validate\` answer also carries \`plan\` (\`dw/plan.py\`): the fingerprint of the work, step and list counts, \`downloads_required\` and a cost \`estimate\` with its \`basis\` - the number an agent quotes; \`plan: null\` when it could not be built, never a changed verdict.`
+
+`docs/proposals/acknowledged-cost-binding.md`, first line under the title: change `Status: **design only**` to `Status: **stage 1 implemented** (the plan on validate); stage 2 (binding, the 409) not started. Design: docs/superpowers/specs/2026-09-12-acknowledged-cost-binding-design.md.` and keep the rest of that paragraph.
+
+- [ ] **Step 3: Skills**
+
+Each "Run and judge" step 2 currently opens `Quote the listing's \`cost\``. Rewrite the opening clause only, keeping every model-specific number that follows it (those are pinned by `tests/test_plugin_skills.py`):
+
+`plugins/dw/skills/ltx-2.5/SKILL.md` step 2, replace
+```
+2. Quote the listing's `cost` - the run's whole wall clock, model loading
+   included. Only `templates/ltx2/text-to-video` and `templates/ltx2/two-stage`
+   declare one; for the other six say so and give the shape of the spend
+```
+with
+```
+2. Quote `plan.estimate` from the validate answer (whole wall clock, loading
+   included) and name any `downloads_required`. Only `text-to-video` and
+   `two-stage` carry a `cost`; for the other six say so and give the shape
+```
+(Net change is negative; re-run `wc -c` and confirm under 12288.)
+
+`plugins/dw/skills/minimax-h3/SKILL.md` step 2, replace
+```
+2. Quote the listing's `cost` (warm minutes on the card it was measured on;
+   a first load is longer). When it declares none, say so and give the shape
+```
+with
+```
+2. Quote `plan.estimate` from the validate answer (warm minutes; a first
+   load, and any `downloads_required`, is longer). When `basis` is
+   `unknown`, say so and give the shape
+```
+Then trim elsewhere in that file if `wc -c` exceeds 12288 - the "Run and judge" step 1 `first - free, and it catches arguments the pipeline does not accept.` can lose `does not accept` → `rejects` (-9 bytes) and similar; keep every number.
+
+`plugins/dw/skills/minimax-music3/SKILL.md` step 2, replace
+```
+2. Quote the listing's `cost` (warm minutes on the card it was measured on;
+   a first load is longer). When the listing declares none, say so and give
+```
+with
+```
+2. Quote `plan.estimate` from the validate answer (warm minutes on the card it
+   was measured on; a first load is longer). When `basis` is `unknown`, say so and give
+```
+
+- [ ] **Step 4: Run the doc and skill tests**
+
+Run: `python -m pytest tests/test_plugin_skills.py tests/test_docs_links.py -v && wc -c plugins/dw/skills/*/SKILL.md`
+Expected: PASS; every skill under 12288 bytes.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add docs/SERVER.md docs/MCP.md docs/WORKFLOW_GUIDE.md CLAUDE.md plugins/dw/skills docs/proposals/acknowledged-cost-binding.md
+git commit -m "docs: #85 - the plan on validate, and the skills quote from it rather than the listing
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>"
+```
+
+---
+
+### Task 8: whole-suite verification
+
+**Files:** none new.
+
+- [ ] **Step 1: Run the full suite**
+
+Run: `python -m pytest -q -x --ignore=tests/test_integration.py 2>&1 | tail -5`
+Expected: all pass (the tree was 3850 passing at ae4bf9b; expect that plus the new tests). `test_integration.py` needs a GPU and is skipped by marker in CI - run it only if it runs on this box today.
+
+- [ ] **Step 2: Run the UI tests if any `.ts` changed** (none should have): skip.
+
+- [ ] **Step 3: Check the branch is clean and fully committed**
+
+Run: `git status --short && git log --oneline develop..HEAD`
+Expected: clean; seven commits after the merge commit.
+
+---
+
+## Self-review
+
+**Spec coverage (stage 1, sections 1-5):**
+- 1.1 realization/expansion, `steps`, `list_entries` - Task 2. Note the deviation: `build_plan` takes the route's `Workflow` rather than `(definition, base_dir, output_root, workflow_dir)`, because expansion has to go through `Workflow.expanded_definition` (realization does not substitute `variable:` references, and `for_each` needs the substituted list) and the `Workflow` already carries the confinement the run has. The spec's constraint on `dw.server`/`dw.worker` imports holds.
+- 1.2 fingerprint and its table - Task 2, every cell a test.
+- 1.3 estimate rules 1-5 - Task 3, including sub-workflows, `partial`, builtin.
+- 1.4 downloads, sizes, `lookup_sizes` - Task 4.
+- 1.5 `cached_steps: null` - Task 2.
+- 2 the route, `?sizes=`, `plan: null`, no `plan` on invalid - Task 5.
+- 3 MCP docstring, `COST_REFUSAL` - Task 6; `get_guide`'s section is WORKFLOW_GUIDE.md - Task 7.
+- 4 docs and skills - Task 7.
+- 5 tests - Tasks 1-6.
+- Release note items - the proposal's status line in Task 7; the release note itself is owed with the other 2026-09-12 items and is not part of this plan.
+
+**Type consistency:** `build_plan(candidate, arguments, *, device, prompt_dir, cache_dir, lookup_sizes, cache_probe)` is used identically in Tasks 2-5; `estimate(...)` and `downloads_required(...)` signatures match between their definition and their call in `build_plan`; `read_sub_workflow(path, base_dir, workflow_dir)` matches Task 1.
diff --git a/docs/superpowers/plans/2026-09-13-acknowledged-cost-stage-2-plan.md b/docs/superpowers/plans/2026-09-13-acknowledged-cost-stage-2-plan.md
new file mode 100644
index 00000000..f5bebfac
--- /dev/null
+++ b/docs/superpowers/plans/2026-09-13-acknowledged-cost-stage-2-plan.md
@@ -0,0 +1,1550 @@
+# Acknowledged-cost binding, stage 2: the bound acknowledgement, the 409 and the cache probe
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** A caller may bind its `acknowledged_cost` to the plan it validated (`{fingerprint, minutes, downloads}`); `POST /api/jobs` and `/rerun` refuse with 409 when the run's shape no longer matches; every job records which form of acknowledgement it got; and the plan's `cached_steps` is answered exactly by the worker's step cache.
+
+**Architecture:** The step-cache probe is a refactor of `Workflow.run`: the substitute-expand-seed preparation and the per-step "is this a hit" lookup are lifted into methods both the run loop and a new `Workflow.cache_hits(arguments)` call, so the probe cannot drift from the run. The worker answers a `probe_cache` command with that list; `JobManager.probe_cache` asks it the way `memory_status` does (never blocking behind a running job); `build_plan` takes the answer through `cache_probe`. The route classifies the acknowledgement once (`none | boolean | bound`), re-plans for a bound one and raises 409 with the current plan in the body, records the form on the job and in `jobs.sqlite`. MCP widens the argument, forwards the object, and renders the 409 with the new estimate.
+
+**Tech Stack:** Python 3.12, FastAPI, pydantic, sqlite3, `multiprocessing.Queue` worker protocol, pytest.
+
+**Spec:** [docs/superpowers/specs/2026-09-12-acknowledged-cost-binding-design.md](../specs/2026-09-12-acknowledged-cost-binding-design.md) sections 6-11. Stage 1 landed at b37f033 ([stage 1 plan](2026-09-13-acknowledged-cost-stage-1-plan.md)).
+
+## Global Constraints
+
+- `dw/plan.py` still imports nothing from `dw.server` or `dw.worker`; it reaches the worker only through the `cache_probe` callable it is handed.
+- The bare-boolean and absent acknowledgement paths are byte-for-byte unchanged in behaviour: no new refusal, no new round trip to the worker on `POST /api/jobs`.
+- `minutes` is recorded, never compared (spec non-goal).
+- The 409 is pre-flight only; nothing meters or aborts a running job.
+- No model name or minute figure in engine code or in a test fixture.
+- Skills stay under `12 * 1024` bytes each (`minimax-h3` is at 12266; `ltx-2.5` at 12180).
+- Worktree `.claude/worktrees/cost-binding`, branch `cost-binding` off `develop` b37f033. Tests with `python -m pytest`.
+- Commits: `feat(engine|server|mcp): #85 - ...` / `docs: #85 - ...`, ending `Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>`.
+
+### Deviations from the spec, decided here
+
+- **Probe command shape.** Spec §10 sends the worker a realized, expanded definition plus a seed. Instead the command carries the same fields an `execute` command does (`workflow_path` | `workflow`+`base_dir`, `workflow_dir`, `arguments`, `output_dir`, `asset_dir`), and the worker loads the workflow with its existing `_load_workflow` and calls `Workflow.cache_hits(arguments)`. Preparation then runs the run's own code path (`realize_args` on the steps included - the cache key holds realized values), which is the whole point of the refactor.
+- **No worker → `[]`, not `None`.** The step cache lives in the worker process; a worker that is not running holds none, so zero cached steps is the true answer. Busy worker or a timeout → `None` (unknown), as the spec says.
+- **`rerun` does not inherit a stored bound acknowledgement.** The request's own `acknowledged_cost` decides the form and whether a check runs; the original's object is kept in the spec (so history says what was consented to) and `rerun` copies it forward for the record only. An inherited check would fire on a caller that sent `true`, which is exactly the path that must not change.
+- **The 409 body's plan carries `cached_steps: null`.** The check does not probe the worker - it costs a round trip and the fingerprint does not depend on it.
+
+## File structure
+
+| File | Responsibility |
+|---|---|
+| `dw/workflow.py` (modify) | `_prepare_definition()` and `_cache_lookup()` lifted out of `run()`; new `cache_hits(arguments)` |
+| `dw/worker.py` (modify) | `probe_cache` command → `_handle_probe_cache` |
+| `dw/server/jobs.py` (modify) | `JobManager.probe_cache()`, `rerun_spec()`, `submit(acknowledged=, acknowledged_cost=)`, `Job.acknowledged`, sqlite column, `RERUN_SPEC_KEYS` |
+| `dw/plan.py` (modify) | `cache_probe` honoured; `cached_steps` |
+| `dw/server/app.py` (modify) | `AcknowledgedCost`, the field on both requests, `_acknowledgement_form`, `_check_bound_acknowledgement`, the probe on validate |
+| `dw_mcp/diagnose.py`, `dw_mcp/server.py`, `dw_mcp/client.py` (modify) | `bool \| dict`, forwarding, 409 rendering, `COST_REFUSAL` |
+| docs + skills (modify) | the bound form |
+| tests: `test_workflow_step_cache.py`, `test_worker_execute.py`, `test_server.py`, `test_plan.py`, `test_mcp_diagnose.py`, `test_mcp_client.py`, `test_plugin_skills.py` | coverage |
+
+---
+
+### Task 1: `Workflow.cache_hits()` by refactoring `run()`
+
+**Files:**
+- Modify: `dw/workflow.py` (`run()` lines ~700-760 preparation, ~880-950 cache lookup)
+- Test: `tests/test_workflow_step_cache.py`
+
+**Interfaces:**
+- Produces: `Workflow._prepare_definition(workflow_def, arguments, base_dir) -> (workflow_def, default_seed)` - variables realized/folded/resolved/substituted, `for_each` expanded, the seed read and coerced to `int` (or `None` when the workflow names none). Raises exactly what the run raised at that point.
+- Produces: `Workflow._cache_lookup(workflow_id, steps, index, step_data, step_seed, hits_this_run, cache_enabled) -> (cached_result | None, step_data_snapshot | None)` - the whole `is_cacheable` / snapshot / `step_cache.get` block. `parent_saves_this` computed inside from `self._final_save_owned_by_parent`.
+- Produces: `Workflow.cache_hits(arguments) -> list[str]` - the step names the step cache would serve for this workflow, seed and arguments, in step order; `[]` for an unseeded workflow. Executes nothing, emits nothing, opens no run directory.
+
+- [ ] **Step 1: Write the failing tests**
+
+Append to `tests/test_workflow_step_cache.py` (the module has `step_cache`, `build_test_workflow_and_call_count_spy()`, whose workflow has one step `generate`, seed 42, variable `prompt`):
+
+```python
+class TestCacheHits:
+    def test_a_cold_cache_reports_no_hits(self):
+        step_cache.clear()
+        workflow, _ = build_test_workflow_and_call_count_spy()
+        try:
+            assert workflow.cache_hits({}) == []
+        finally:
+            for p in workflow._test_patcher:
+                p.stop()
+
+    def test_after_a_run_the_probe_names_what_the_next_run_reuses(self):
+        step_cache.clear()
+        workflow, call_count = build_test_workflow_and_call_count_spy()
+        try:
+            workflow.run({})
+            probe = workflow.cache_hits({})
+            workflow.run({})
+            reused = [entry["step"] for entry in workflow.manifest if entry.get("reused")]
+            assert probe == ["generate"]
+            assert probe == reused
+            assert call_count() == 1, "the probe executed nothing"
+        finally:
+            for p in workflow._test_patcher:
+                p.stop()
+
+    def test_a_changed_argument_is_a_miss(self):
+        step_cache.clear()
+        workflow, _ = build_test_workflow_and_call_count_spy()
+        try:
+            workflow.run({"prompt": "a cat"})
+            assert workflow.cache_hits({"prompt": "a dog"}) == []
+        finally:
+            for p in workflow._test_patcher:
+                p.stop()
+
+    def test_an_unseeded_workflow_has_no_hits(self):
+        step_cache.clear()
+        workflow, _ = build_test_workflow_and_call_count_spy()
+        del workflow.workflow_definition["seed"]
+        try:
+            workflow.run({})
+            assert workflow.cache_hits({}) == []
+        finally:
+            for p in workflow._test_patcher:
+                p.stop()
+
+    def test_the_probe_writes_nothing(self, tmp_path):
+        step_cache.clear()
+        workflow, _ = build_test_workflow_and_call_count_spy()
+        workflow.output_dir = str(tmp_path)
+        try:
+            workflow.cache_hits({})
+            assert list(tmp_path.iterdir()) == []
+        finally:
+            for p in workflow._test_patcher:
+                p.stop()
+```
+
+- [ ] **Step 2: Run the tests to verify they fail**
+
+Run: `python -m pytest tests/test_workflow_step_cache.py -k CacheHits -v`
+Expected: FAIL - `AttributeError: 'Workflow' object has no attribute 'cache_hits'`.
+
+- [ ] **Step 3: Refactor `run()` and add `cache_hits()`**
+
+In `dw/workflow.py`, inside `class Workflow`, add two methods (place them just above `run`):
+
+```python
+    def _prepare_definition(self, workflow_def, arguments, base_dir):
+        """The definition as a run works from it: constants realized,
+        arguments folded into the variables, list entries' own references
+        resolved, variable values realized (assets loaded), every
+        'variable:' substituted, every for_each expanded, and the seed read
+        and coerced. Returns (workflow_def, default_seed) - the seed is
+        None when the workflow names none, and the caller decides what
+        that means (run() draws one; cache_hits() reports no hits).
+
+        Shared by run() and cache_hits() so the probe prepares exactly what
+        the run prepares - the step cache keys on the realized step, and a
+        probe that prepared it differently would answer for a run that
+        never happens.
+        """
+        workflow_id = workflow_def["id"]
+        variables = workflow_def.get("variables", None)
+        if variables is not None:
+            logger.debug(f"Setting variables for workflow: {workflow_id}")
+            # a constant is the value a variable declares, so it resolves before
+            # anything is converted to the type of that declaration
+            realize_constants(variables)
+            # first set variable values base don the arguments passed to the workflow
+            # these may come form the command line or form a parent workflow
+            set_variables(arguments, variables)
+            # an entry of a list-valued variable may name another
+            # variable; resolve those before anything inside it is
+            # realized, so a reference type in an entry is a type name
+            variables = resolve_variable_values(variables)
+            # realize the variables, initialiting downloads of images etc
+            realize_args(variables, base_dir)
+            ## then replace any variable references in the workflow definition with the actual values
+            # replace_variables returns a new structure rather than mutating in
+            # place, so the result must be captured here
+            workflow_def = replace_variables(workflow_def, variables)
+
+        # One ordinary step per entry of every for_each list, before the
+        # seed, the run id and the realized workflow are computed, so
+        # each covers what actually runs. A ForEachError here fails the
+        # run before anything loads
+        workflow_def = expand_for_each(workflow_def)
+
+        # Set up random seed for reproducibility. Resolved lazily - as a
+        # dict.get default, torch.seed() would run on every call and reseed
+        # the global RNG even when the workflow names an explicit seed
+        default_seed = workflow_def.get("seed")
+        # The schema lets 'seed' be a string so it can hold a 'variable:'
+        # reference, which the substitution above has already resolved -
+        # but a variable overridden from the command line arrives as a
+        # string whenever the workflow declared no integer default to
+        # coerce against, and manual_seed would fail deep inside the run
+        if isinstance(default_seed, str):
+            try:
+                default_seed = int(default_seed)
+            except ValueError:
+                raise ValueError(
+                    f"Workflow {workflow_id} seed must be an integer, "
+                    f"got {default_seed!r}"
+                )
+            workflow_def["seed"] = default_seed
+        return workflow_def, default_seed
+
+    def _cache_lookup(
+        self, workflow_id, steps, index, step_data, step_seed, hits_this_run, cache_enabled
+    ):
+        """Whether the step cache serves step `index`, as
+        (cached_result or None, the step_data snapshot the entry is keyed
+        on or None). Shared by run() and cache_hits() - see
+        _prepare_definition for why.
+        """
+        # What later steps still read, which decides both whether this
+        # step's result has to be kept alive after the step and whether a
+        # cached entry that kept none can serve this run
+        remaining_refs = referenced_result_names(steps[index + 1 :])
+        result_needed = index == len(steps) - 1 or any(
+            reference_resolves_to(ref, step_data["name"]) for ref in remaining_refs
+        )
+        # create_step_action (and the pipeline load it triggers) mutates
+        # step_data in place - injecting a "generator" key - so the cache
+        # must key off a snapshot taken before that happens, and that same
+        # snapshot must be reused for the put() later. A sub-workflow step
+        # is never cacheable: its files roll up from the child's own
+        # manifest, which a hit does not rebuild.
+        is_cacheable = "workflow" not in step_data and cache_enabled
+        # The last step of a composed child whose parent does the saving
+        # (#92) - its files are the parent step's, written once, under the
+        # parent's name and subfolder
+        parent_saves_this = self._final_save_owned_by_parent and index == len(steps) - 1
+        step_data_snapshot = None
+        if is_cacheable:
+            try:
+                step_data_snapshot = copy.deepcopy(step_data)
+                if parent_saves_this:
+                    # Keyed apart from the same step run standalone: this
+                    # entry's result was never saved here, so a standalone
+                    # hit on it would report no files
+                    step_data_snapshot["__saved_by_parent__"] = True
+            except Exception as ex:
+                # A realized argument that cannot be deep-copied (an open
+                # handle, a live model object) just means this step is not
+                # cacheable - never a failed run
+                logger.debug(
+                    f"Step '{step_data['name']}' arguments are not copyable "
+                    f"({ex}) - skipping the step cache for it"
+                )
+                is_cacheable = False
+        if not is_cacheable:
+            return None, None
+        cached_result = step_cache.get(
+            workflow_id,
+            step_data_snapshot,
+            step_seed,
+            hits_this_run,
+            # The root, not this run's directory: a hit reports the earlier
+            # run's files and writes nothing new, so keying on a directory
+            # that is new every run would mean the cache could never hit
+            # again. What the root still guards is a run redirected
+            # somewhere else, where the earlier files are not what the
+            # caller asked for
+            self.output_dir,
+            needs_result=result_needed,
+        )
+        return cached_result, step_data_snapshot
+
+    def cache_hits(self, arguments):
+        """The steps the step cache would serve for a run with `arguments`,
+        in step order - what the plan reports as cached_steps (#85).
+
+        Prepares the definition exactly as run() does and asks the cache the
+        question run() asks, step by step with the hits so far, and executes
+        nothing: no run directory, no events, no pipeline. An unseeded
+        workflow has no cache, so it answers [] without asking.
+        """
+        output_root_token = activate_output_root(self.output_dir)
+        try:
+            workflow_def = copy.deepcopy(self.workflow_definition)
+            workflow_id = workflow_def["id"]
+            base_dir = (
+                os.path.dirname(os.path.abspath(self.file_spec))
+                if self.file_spec
+                else None
+            )
+            workflow_def, default_seed = self._prepare_definition(
+                workflow_def, arguments or {}, base_dir
+            )
+            if default_seed is None or not self._cache_enabled_by_parent:
+                return []
+            steps = workflow_def.get("steps", [])
+            realize_args(steps, base_dir)
+            hits_this_run = set()
+            hits = []
+            for index, step_data in enumerate(steps):
+                step_seed = step_data.get("seed", default_seed)
+                cached_result, _ = self._cache_lookup(
+                    workflow_id, steps, index, step_data, step_seed, hits_this_run, True
+                )
+                if cached_result is not None:
+                    hits_this_run.add(step_data["name"])
+                    hits.append(step_data["name"])
+            return hits
+        finally:
+            deactivate_output_root(output_root_token)
+```
+
+Then in `run()`:
+
+- Replace the block from `# Handle variable substitution if variables are defined` through the `workflow_def["seed"] = default_seed` line that follows the `int(default_seed)` coercion (lines ~710-752, ending just before `# A workflow that names no seed gets a fresh one every run`) with:
+
+```python
+            workflow_def, default_seed = self._prepare_definition(
+                workflow_def, arguments, base_dir
+            )
+```
+
+  Keep everything from `cache_enabled_this_run = (...)` onward unchanged (the random draw, `workflow_def["seed"] = default_seed`, `resolved_seed`).
+
+- In the step loop, replace the block from `# What later steps still read, ...` (`remaining_refs = ...`) through the `cached_result = (step_cache.get(...) if is_cacheable else None)` expression with:
+
+```python
+                cached_result, step_data_snapshot = self._cache_lookup(
+                    workflow_id,
+                    steps,
+                    i,
+                    step_data,
+                    step_seed,
+                    hits_this_run,
+                    cache_enabled_this_run,
+                )
+                is_cacheable = step_data_snapshot is not None
+```
+
+  `is_cacheable` and `step_data_snapshot` are read further down by the `step_cache.put` block - confirm with `grep -n "is_cacheable\|step_data_snapshot" dw/workflow.py` that every remaining use is after this point and still bound. `result_needed` is also used later (for `release_unreferenced_results` / retaining); if `grep -n result_needed dw/workflow.py` shows a use after the lookup, recompute it in the loop right after the lookup with the same two lines used inside `_cache_lookup` rather than returning it (keep the method's return a pair).
+
+- [ ] **Step 4: Run the step-cache suites**
+
+Run: `python -m pytest tests/test_workflow_step_cache.py tests/test_step_cache.py tests/test_jobs_reused.py tests/test_worker_execute.py -v`
+Expected: all PASS, the five new ones included.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add dw/workflow.py tests/test_workflow_step_cache.py
+git commit -m "feat(engine): #85 - a workflow can say which steps the cache would serve, by the run's own preparation
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>"
+```
+
+---
+
+### Task 2: the worker's `probe_cache` command and `JobManager.probe_cache`
+
+**Files:**
+- Modify: `dw/worker.py` (dispatch at ~127-150; handlers at ~368-390), `dw/server/jobs.py` (`memory_status` at ~1154 is the model)
+- Test: `tests/test_worker_execute.py`, `tests/test_server.py`
+
+**Interfaces:**
+- Consumes: `Workflow.cache_hits(arguments)` from Task 1; the worker's `_load_workflow(command, output_dir)`.
+- Produces: worker command `{"type": "probe_cache", "arguments", "output_dir", "workflow_path" | "workflow" + "base_dir", "workflow_dir", "asset_dir"?}` answered by `{"type": "probe_cache", "cached": [names]}` or `{"type": "probe_cache", "cached": None, "error": str}`.
+- Produces: `JobManager.probe_cache(command, timeout=5) -> list[str] | None` where `command` is that dict minus `type`. `None` when a job is running, the worker lock is busy, the worker did not answer, or answered with an error; `[]` when no worker is running.
+
+- [ ] **Step 1: Write the failing tests**
+
+Append to `tests/test_worker_execute.py`:
+
+```python
+class ProbableWorkflow(StubWorkflow):
+    def __init__(self, hits):
+        super().__init__()
+        self.hits = hits
+        self.probed_with = None
+
+    def cache_hits(self, arguments):
+        self.probed_with = arguments
+        return list(self.hits)
+
+
+def test_probe_cache_answers_with_the_workflows_hits():
+    worker = _make_worker()
+    workflow = ProbableWorkflow(["gen"])
+    command = {
+        "type": "probe_cache",
+        "workflow_path": "x.json",
+        "arguments": {"prompt": "p"},
+        "output_dir": "/tmp",
+    }
+    with patch("dw.worker.workflow_from_file", return_value=workflow):
+        worker._handle_probe_cache(command)
+    assert _drain(worker.result_queue) == [{"type": "probe_cache", "cached": ["gen"]}]
+    assert workflow.probed_with == {"prompt": "p"}
+
+
+def test_probe_cache_reports_a_failure_as_unknown_not_as_a_crash():
+    worker = _make_worker()
+    with patch("dw.worker.workflow_from_file", side_effect=ValueError("bad file")):
+        worker._handle_probe_cache(
+            {"type": "probe_cache", "workflow_path": "x.json", "arguments": {}, "output_dir": "/tmp"}
+        )
+    [answer] = _drain(worker.result_queue)
+    assert answer["type"] == "probe_cache"
+    assert answer["cached"] is None
+    assert "bad file" in answer["error"]
+
+
+def test_probe_cache_activates_the_jobs_asset_dir(tmp_path):
+    worker = _make_worker()
+    seen = {}
+
+    class AssetAwareWorkflow(ProbableWorkflow):
+        def cache_hits(self, arguments):
+            from dw.assets import current_asset_dir
+
+            seen["asset_dir"] = current_asset_dir()
+            return []
+
+    with patch("dw.worker.workflow_from_file", return_value=AssetAwareWorkflow([])):
+        worker._handle_probe_cache(
+            {
+                "type": "probe_cache",
+                "workflow_path": "x.json",
+                "arguments": {},
+                "output_dir": "/tmp",
+                "asset_dir": str(tmp_path),
+            }
+        )
+    assert seen["asset_dir"] == str(tmp_path)
+```
+
+(Check `dw/assets.py` for the accessor name that returns the active asset root - `grep -n "^def " dw/assets.py`; if it is not `current_asset_dir`, use the one that is.)
+
+In `tests/test_server.py`, extend `ScriptedWorkerManager.send_command` with a `probe_cache` branch, and add a knob:
+
+```python
+        elif command["type"] == "probe_cache":
+            self._results.put(
+                {"type": "probe_cache", "cached": list(self.cached_steps)}
+            )
+```
+
+and in `__init__`: `self.cached_steps = []`. Then append tests:
+
+```python
+class TestProbeCache:
+    def test_asks_the_worker_and_returns_its_answer(self, server):
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            manager.worker_manager.ensure_worker()
+            manager.worker_manager.cached_steps = ["gen"]
+            assert manager.probe_cache(
+                {"workflow_path": "x.json", "arguments": {}, "output_dir": "/tmp"}
+            ) == ["gen"]
+            sent = manager.worker_manager.commands[-1]
+            assert sent["type"] == "probe_cache"
+            assert sent["workflow_path"] == "x.json"
+
+    def test_no_worker_means_an_empty_cache(self, server):
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            assert manager.worker_manager.worker_active is False
+            assert manager.probe_cache({"workflow_path": "x.json", "arguments": {}, "output_dir": "/tmp"}) == []
+            assert manager.worker_manager.commands == []
+
+    def test_a_running_job_means_unknown(self, server):
+        with server(hanging_script) as client:
+            response = client.post("/api/jobs", json={"workflow": valid_workflow()})
+            job_id = response.json()["id"]
+            wait_for_status(client, job_id, ("running",))
+            manager = client.app.state.job_manager
+            assert manager.probe_cache({"workflow_path": "x.json", "arguments": {}, "output_dir": "/tmp"}) is None
+            client.post(f"/api/jobs/{job_id}/cancel")
+
+    def test_an_unanswered_probe_is_unknown(self, server):
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            manager.worker_manager.ensure_worker()
+            manager.worker_manager.send_command = lambda command: None  # swallow it
+            assert manager.probe_cache(
+                {"workflow_path": "x.json", "arguments": {}, "output_dir": "/tmp"}, timeout=0.05
+            ) is None
+```
+
+- [ ] **Step 2: Run the tests to verify they fail**
+
+Run: `python -m pytest tests/test_worker_execute.py -k probe -v; python -m pytest tests/test_server.py -k ProbeCache -v`
+Expected: FAIL - no `_handle_probe_cache`, no `probe_cache`.
+
+- [ ] **Step 3: Implement**
+
+`dw/worker.py`, in the main dispatch after the `memory_status` branch:
+
+```python
+                    elif command_type == "probe_cache":
+                        self._handle_probe_cache(command)
+```
+
+and beside `_handle_memory_status`:
+
+```python
+    def _handle_probe_cache(self, command: Dict[str, Any]):
+        """Which steps the step cache would serve for a run of this command
+        - the plan's cached_steps (#85). Same fields as an execute command;
+        loads the workflow, executes nothing. A failure answers
+        cached: null with the reason rather than an error message, since
+        an unknown answer is a valid plan and a crashed probe is not.
+        """
+        try:
+            workflow, _ = self._load_workflow(command, command["output_dir"])
+            asset_token = (
+                activate_asset_dir(command["asset_dir"])
+                if command.get("asset_dir")
+                else None
+            )
+            try:
+                cached = workflow.cache_hits(command.get("arguments") or {})
+            finally:
+                if asset_token is not None:
+                    deactivate_asset_dir(asset_token)
+            self.result_queue.put({"type": "probe_cache", "cached": cached})
+        except Exception as e:
+            logger.debug(f"Cache probe failed: {e}")
+            self.result_queue.put(
+                {"type": "probe_cache", "cached": None, "error": str(e)}
+            )
+```
+
+`dw/server/jobs.py`, beside `memory_status`:
+
+```python
+    def probe_cache(self, command, timeout=5):
+        """Which steps the worker's step cache would serve for `command` (the
+        fields an execute command carries, minus its type), or None when the
+        answer cannot be had right now - a job is running, the worker is
+        busy, or it did not answer in time. Never blocks a request behind a
+        running job, for the same reason memory_status does not.
+
+        No worker running is a definite answer, not an unknown one: the
+        cache lives in the worker process, so a worker that is not running
+        holds nothing.
+        """
+        if self._current_job_id is not None:
+            return None
+        if not self.worker_manager.worker_active:
+            return []
+        if not self._worker_lock.acquire(timeout=2):
+            return None
+        try:
+            self.worker_manager.send_command({"type": "probe_cache", **command})
+            result = self.worker_manager.get_result(timeout=timeout)
+        except (RuntimeError, queue.Empty) as e:
+            logger.debug(f"Worker did not answer the cache probe: {e}")
+            return None
+        finally:
+            self._worker_lock.release()
+        if result.get("type") != "probe_cache":
+            return None
+        cached = result.get("cached")
+        return list(cached) if isinstance(cached, list) else None
+```
+
+- [ ] **Step 4: Run the tests**
+
+Run: `python -m pytest tests/test_worker_execute.py tests/test_server.py -k "probe or Probe" -v`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add dw/worker.py dw/server/jobs.py tests/test_worker_execute.py tests/test_server.py
+git commit -m "feat(server): #85 - the worker answers a cache probe, and the manager asks without blocking behind a job
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>"
+```
+
+---
+
+### Task 3: `cached_steps` in the plan and on validate
+
+**Files:**
+- Modify: `dw/plan.py` (`build_plan`), `dw/server/app.py` (validate route)
+- Test: `tests/test_plan.py`, `tests/test_server.py`
+
+**Interfaces:**
+- Consumes: `JobManager.probe_cache(command)` from Task 2.
+- Produces: `build_plan(..., cache_probe=None)` where `cache_probe` is `Callable[[dict], list[str] | None]` taking the run's arguments. `cached_steps` is `len(answer)` on a list, `None` on `None` or with no probe, and `0` with no probe made when the workflow is unseeded.
+- Produces: `_probe_command_for(candidate, request, workspace)` in the route: the execute-shaped dict for this validate request.
+
+- [ ] **Step 1: Write the failing tests**
+
+Append to `tests/test_plan.py`:
+
+```python
+class TestCachedSteps:
+    def test_no_probe_is_unknown(self, plan):
+        assert plan()["cached_steps"] is None
+
+    def test_the_probe_is_asked_with_the_arguments_and_counted(self, plan):
+        seen = []
+
+        def probe(arguments):
+            seen.append(arguments)
+            return ["still", "shot@a"]
+
+        answer = plan(arguments={"frames": 9}, cache_probe=probe)
+        assert answer["cached_steps"] == 2
+        assert seen == [{"frames": 9}]
+
+    def test_a_probe_that_cannot_answer_is_unknown(self, plan):
+        assert plan(cache_probe=lambda arguments: None)["cached_steps"] is None
+
+    def test_an_unseeded_workflow_is_zero_without_asking(self, plan):
+        def probe(arguments):
+            raise AssertionError("must not be asked")
+
+        spec = definition()
+        del spec["seed"]
+        del spec["variables"]["seed"]
+        assert plan(spec, cache_probe=probe)["cached_steps"] == 0
+
+    def test_a_seed_variable_left_null_is_unseeded(self, plan):
+        def probe(arguments):
+            raise AssertionError("must not be asked")
+
+        spec = definition()
+        spec["variables"]["seed"] = None
+        assert plan(spec, cache_probe=probe)["cached_steps"] == 0
+```
+
+Append to `tests/test_server.py` inside `TestValidatePlan`:
+
+```python
+    def test_cached_steps_comes_from_the_worker(self, server, monkeypatch):
+        import dw.plan
+
+        monkeypatch.setattr(dw.plan, "scan_models", lambda cache_dir=None: {"repos": []})
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            manager.worker_manager.ensure_worker()
+            manager.worker_manager.cached_steps = ["gen"]
+            seeded = valid_workflow("seeded")
+            seeded["seed"] = 7
+            result = client.post(
+                "/api/validate?sizes=false", json={"workflow": seeded, "arguments": {"prompt": "x"}}
+            ).json()
+        assert result["plan"]["cached_steps"] == 1
+        probe = [c for c in manager.worker_manager.commands if c["type"] == "probe_cache"]
+        assert len(probe) == 1
+        assert probe[0]["arguments"] == {"prompt": "x"}
+        assert probe[0]["workflow"] == seeded
+        assert probe[0]["output_dir"] == manager.output_dir
+
+    def test_an_unseeded_workflow_does_not_probe(self, server, monkeypatch):
+        import dw.plan
+
+        monkeypatch.setattr(dw.plan, "scan_models", lambda cache_dir=None: {"repos": []})
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            manager.worker_manager.ensure_worker()
+            result = client.post(
+                "/api/validate?sizes=false", json={"workflow": valid_workflow("v")}
+            ).json()
+        assert result["plan"]["cached_steps"] == 0
+        assert all(c["type"] != "probe_cache" for c in manager.worker_manager.commands)
+```
+
+- [ ] **Step 2: Run the tests to verify they fail**
+
+Run: `python -m pytest tests/test_plan.py -k CachedSteps -v; python -m pytest tests/test_server.py -k "cached_steps or unseeded" -v`
+Expected: FAIL.
+
+- [ ] **Step 3: Implement**
+
+`dw/plan.py`: in `build_plan`, replace `"cached_steps": None,` with `"cached_steps": cached_steps(definition, realized, arguments, cache_probe),` and add:
+
+```python
+def cached_steps(definition, realized, arguments, cache_probe):
+    """How many steps the step cache would answer for this run: 0 without
+    asking when the workflow is unseeded (the cache is off then), None
+    when there is no probe or the probe cannot answer, else the count."""
+    if not _is_seeded(definition, realized):
+        return 0
+    if cache_probe is None:
+        return None
+    answer = cache_probe(arguments or {})
+    return len(answer) if isinstance(answer, list) else None
+
+
+def _is_seeded(definition, realized):
+    """Whether a run of this workflow has a seed before it draws one - read
+    from the definition as written, since realization pins a seed of its
+    own into the copy."""
+    seed = definition.get("seed")
+    if isinstance(seed, str) and seed.startswith(VARIABLE_PREFIX):
+        name = seed.removeprefix(VARIABLE_PREFIX)
+        return (realized.get("variables") or {}).get(name) is not None
+    return seed is not None
+```
+
+Update the `cache_probe` line of `build_plan`'s docstring to: `cache_probe: A callable taking the run's arguments and answering the step names the worker's cache would serve, or None when it cannot say.`
+
+`dw/server/app.py`: in the validate route, before the `build_plan` call, build the probe:
+
+```python
+            command = _probe_command_for(candidate, request, workspace, source_root)
+            answer["plan"] = build_plan(
+                candidate,
+                request.arguments,
+                device=get_device_type(get_device()),
+                prompt_dir=workspace.prompts,
+                lookup_sizes=sizes,
+                cache_probe=lambda arguments: manager.probe_cache(
+                    {**command, "arguments": arguments}
+                ),
+            )
+```
+
+`source_root` is the confinement the candidate was built with - set `source_root = source.root if source else workspace.workflows` in the file branch and `source_root = workspace.workflows` in the inline branch, right where each `candidate` is constructed. Add the helper beside `_argument_reference_errors`:
+
+```python
+    def _probe_command_for(candidate, request, workspace, workflow_dir):
+        """The execute-shaped command a cache probe of this validate request
+        needs - the same fields _run_job sends, so the worker loads the
+        workflow exactly as a job would."""
+        command = {
+            "arguments": request.arguments,
+            "output_dir": workspace.outputs,
+            "workflow_dir": workflow_dir,
+        }
+        if workspace.assets:
+            command["asset_dir"] = workspace.assets
+        if request.workflow_path is not None:
+            command["workflow_path"] = candidate.file_spec
+        else:
+            command["workflow"] = request.workflow
+            command["base_dir"] = os.path.dirname(candidate.file_spec)
+        return command
+```
+
+- [ ] **Step 4: Run the tests**
+
+Run: `python -m pytest tests/test_plan.py tests/test_server.py -k "CachedSteps or ValidatePlan" -v`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add dw/plan.py dw/server/app.py tests/test_plan.py tests/test_server.py
+git commit -m "feat(server): #85 - the plan says how many steps the worker's cache would serve
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>"
+```
+
+---
+
+### Task 4: the acknowledgement on the job and in history
+
+**Files:**
+- Modify: `dw/server/jobs.py` (`RERUN_SPEC_KEYS` ~46, `_ensure_schema` ~85-126, `record` ~130, `recent_summaries` ~165, `get`/`_to_detail` ~205/303, `Job.__init__`/`summary`/`detail` ~332-520, `submit` ~558, `rerun` ~761)
+- Test: `tests/test_server.py`
+
+**Interfaces:**
+- Produces: `ACK_NONE = "none"`, `ACK_BOOLEAN = "boolean"`, `ACK_BOUND = "bound"` in `dw/server/jobs.py`.
+- Produces: `JobManager.submit(..., acknowledged=ACK_NONE, acknowledged_cost=None)`; `JobManager.rerun(job_id, new_seed=False, acknowledged=ACK_NONE, acknowledged_cost=None)`; `JobManager.rerun_spec(job_id) -> (spec, arguments) | None` (the first half of `rerun`, so a route can plan before it queues).
+- Produces: `Job.acknowledged: str`; `summary()` and `detail()` carry `acknowledged`, `detail()` carries `acknowledged_cost` (the object or `None`); history rows the same; `jobs.sqlite` column `acknowledged TEXT` (rows before it read as `none`), the object inside the stored `spec`.
+
+- [ ] **Step 1: Write the failing tests**
+
+Append to `tests/test_server.py`:
+
+```python
+class TestAcknowledgementRecord:
+    def test_a_submit_records_none_by_default(self, server):
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            job = manager.submit(workflow=valid_workflow(), arguments={})
+            assert job.acknowledged == "none"
+            assert manager.describe(job)["acknowledged"] == "none"
+            assert manager.describe(job)["acknowledged_cost"] is None
+
+    def test_a_bound_submit_records_the_object(self, server):
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            bound = {"fingerprint": "sha256:abc", "minutes": 3.0, "downloads": []}
+            job = manager.submit(
+                workflow=valid_workflow(), arguments={}, acknowledged="bound", acknowledged_cost=bound
+            )
+            detail = manager.describe(job)
+            assert detail["acknowledged"] == "bound"
+            assert detail["acknowledged_cost"] == bound
+            assert job.summary()["acknowledged"] == "bound"
+
+    def test_history_keeps_the_form_and_the_object(self, server, tmp_path):
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            bound = {"fingerprint": "sha256:abc", "minutes": 3.0, "downloads": ["org/x"]}
+            job = manager.submit(
+                workflow=valid_workflow(), arguments={}, acknowledged="bound", acknowledged_cost=bound
+            )
+            wait_for_status(client, job.id, TERMINAL_STATES)
+            row = manager.history.get(job.id)
+            assert row["acknowledged"] == "bound"
+            assert row["spec"]["acknowledged_cost"] == bound
+            listed = [s for s in manager.history.recent_summaries() if s["id"] == job.id]
+            assert listed[0]["acknowledged"] == "bound"
+
+    def test_a_database_without_the_column_is_migrated(self, tmp_path):
+        import sqlite3
+
+        from dw.server.jobs import JobHistory
+
+        path = tmp_path / "old.sqlite"
+        with sqlite3.connect(path) as connection:
+            connection.execute(
+                "CREATE TABLE jobs (id TEXT PRIMARY KEY, workflow TEXT, status TEXT,"
+                " created_at REAL, started_at REAL, finished_at REAL, arguments TEXT,"
+                " spec TEXT, manifest TEXT, warnings TEXT, error TEXT)"
+            )
+            connection.execute(
+                "INSERT INTO jobs (id, workflow, status, created_at, spec) VALUES"
+                " ('old1', 'w', 'succeeded', 1.0, '{}')"
+            )
+        history = JobHistory(str(path))
+        assert history.get("old1")["acknowledged"] == "none"
+
+    def test_a_rerun_carries_the_original_object_for_the_record(self, server):
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            bound = {"fingerprint": "sha256:abc", "minutes": 3.0, "downloads": []}
+            job = manager.submit(
+                workflow=valid_workflow(), arguments={}, acknowledged="bound", acknowledged_cost=bound
+            )
+            wait_for_status(client, job.id, TERMINAL_STATES)
+            rerun = manager.rerun(job.id)
+            assert rerun.acknowledged == "none"
+            assert rerun.spec["acknowledged_cost"] == bound
+```
+
+(Check the history class name with `grep -n "^class" dw/server/jobs.py` - use whatever the sqlite class is called if not `JobHistory`.)
+
+- [ ] **Step 2: Run the tests to verify they fail**
+
+Run: `python -m pytest tests/test_server.py -k AcknowledgementRecord -v`
+Expected: FAIL.
+
+- [ ] **Step 3: Implement**
+
+`dw/server/jobs.py`:
+
+Constants near `TERMINAL_STATES`:
+
+```python
+# Which form of cost acknowledgement a job was queued with (#85): none (the
+# web UI and every HTTP caller that sends nothing), a bare boolean, or one
+# bound to the plan that was validated
+ACK_NONE = "none"
+ACK_BOOLEAN = "boolean"
+ACK_BOUND = "bound"
+```
+
+`RERUN_SPEC_KEYS`: append `"acknowledged_cost",` with the comment `# what the original run was consented to, kept for the record - a rerun's own request decides its form`.
+
+Schema migration, after the `run_dir` block:
+
+```python
+            # Which form of cost acknowledgement queued the job. Rows before
+            # the column are 'none' - nothing recorded is nothing recorded
+            if "acknowledged" not in columns:
+                connection.execute(
+                    "ALTER TABLE jobs ADD COLUMN acknowledged TEXT DEFAULT 'none'"
+                )
+```
+
+`record`: add `acknowledged` to the column list and `job.acknowledged` to the values (17 placeholders). `recent_summaries`: add `acknowledged` to the SELECT and `"acknowledged": row[9] or ACK_NONE` to each summary. `get`: add `acknowledged` to the SELECT; `_to_detail`: `"acknowledged": row[15] or ACK_NONE, "acknowledged_cost": (parse(row[7], {}) or {}).get("acknowledged_cost")` - reuse the parsed spec rather than parsing twice.
+
+`Job.__init__`: `self.acknowledged = spec.get("acknowledged") or ACK_NONE`. `summary()`: add `"acknowledged": self.acknowledged`. `detail()`: add `"acknowledged_cost": self.spec.get("acknowledged_cost")`.
+
+`submit` signature gains `acknowledged=ACK_NONE, acknowledged_cost=None`; after `spec["catalog_name"] = catalog_name` add:
+
+```python
+        # The acknowledgement form travels with the job so history can say
+        # whether this run was consented to at its actual size (#85)
+        spec["acknowledged"] = acknowledged
+        if acknowledged_cost is not None:
+            spec["acknowledged_cost"] = acknowledged_cost
+```
+
+Docstring line: `` `acknowledged` is the form of cost acknowledgement the caller gave (none/boolean/bound) and `acknowledged_cost` the bound object, both recorded, neither checked here - the route checks. ``
+
+Split `rerun`: everything up to and including the `arguments = historical["arguments"]` branch becomes
+
+```python
+    def rerun_spec(self, job_id):
+        """The spec and arguments a rerun of `job_id` would submit, or None
+        for an unknown job - split from rerun() so a route can plan the run
+        before queuing it (#85)."""
+```
+
+returning `(spec, arguments)`; `rerun(self, job_id, new_seed=False, acknowledged=ACK_NONE, acknowledged_cost=None)` calls it, keeps the seed and workspace logic, and passes to `submit`: `acknowledged=acknowledged, acknowledged_cost=acknowledged_cost if acknowledged_cost is not None else spec.get("acknowledged_cost")`.
+
+- [ ] **Step 4: Run the tests**
+
+Run: `python -m pytest tests/test_server.py tests/test_jobs_listing.py tests/test_jobs_reused.py -v -k "Acknowledgement or rerun or history or listing"`
+Expected: PASS; then `python -m pytest tests/test_server.py -q` all green.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add dw/server/jobs.py tests/test_server.py
+git commit -m "feat(server): #85 - a job records which form of cost acknowledgement queued it
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>"
+```
+
+---
+
+### Task 5: the bound form and the 409 on `POST /api/jobs` and `/rerun`
+
+**Files:**
+- Modify: `dw/server/app.py` (`JobRequest` ~116, `RerunRequest` ~947, `submit_job` ~810, `rerun_job` ~956)
+- Test: `tests/test_server.py`
+
+**Interfaces:**
+- Consumes: `build_plan`, `JobManager.rerun_spec`, `submit(acknowledged=, acknowledged_cost=)`, `rerun(acknowledged=, acknowledged_cost=)`, `ACK_*`.
+- Produces: `AcknowledgedCost(BaseModel)` with `fingerprint: str`, `minutes: float | None = None`, `downloads: list[str] = []`; `acknowledged_cost: bool | AcknowledgedCost | None = None` on both request models; `_acknowledgement_form(value) -> str`; `_check_bound_acknowledgement(candidate, arguments, acknowledged, workspace)` raising `HTTPException(409, detail={...})`.
+- The 409 `detail` is `{"message": str, "reason": "fingerprint" | "downloads" | "unplannable", "acknowledged": {...}, "plan": {...} | None}`. (`message`, not `detail`, so `DwClient._format_detail` already renders it.)
+
+- [ ] **Step 1: Write the failing tests**
+
+Append to `tests/test_server.py`:
+
+```python
+def plan_for(client, workflow, arguments=None):
+    body = {"workflow": workflow}
+    if arguments:
+        body["arguments"] = arguments
+    answer = client.post("/api/validate?sizes=false", json=body).json()
+    assert answer["valid"], answer
+    return answer["plan"]
+
+
+def bound(plan):
+    return {
+        "fingerprint": plan["fingerprint"],
+        "minutes": plan["estimate"]["minutes"],
+        "downloads": [d["repo"] for d in plan["downloads_required"] if d["repo"]],
+    }
+
+
+@pytest.fixture
+def no_hub(monkeypatch):
+    import dw.plan
+
+    monkeypatch.setattr(dw.plan, "scan_models", lambda cache_dir=None: {"repos": []})
+
+
+def list_workflow(job_id="listed"):
+    return {
+        "id": job_id,
+        "seed": "variable:seed",
+        "variables": {"seed": 1, "shots": [{"name": "a", "prompt": "a"}]},
+        "steps": [
+            {
+                "name": "shot",
+                "for_each": "variable:shots",
+                "pipeline": {
+                    "configuration": {"component_type": "{Fake}", "no_generator": True},
+                    "from_pretrained_arguments": {"model_name": "m"},
+                    "arguments": {"prompt": "item:prompt"},
+                },
+            }
+        ],
+    }
+
+
+class TestBoundAcknowledgement:
+    def test_a_matching_fingerprint_queues(self, server, no_hub):
+        with server(success_script) as client:
+            plan = plan_for(client, list_workflow())
+            response = client.post(
+                "/api/jobs", json={"workflow": list_workflow(), "acknowledged_cost": bound(plan)}
+            )
+            assert response.status_code == 201, response.json()
+            assert response.json()["acknowledged"] == "bound"
+            assert response.json()["acknowledged_cost"] == bound(plan)
+
+    def test_a_longer_list_than_acknowledged_is_refused(self, server, no_hub):
+        with server(success_script) as client:
+            plan = plan_for(client, list_workflow())
+            longer = {"shots": [{"name": n, "prompt": n} for n in "abc"]}
+            response = client.post(
+                "/api/jobs",
+                json={"workflow": list_workflow(), "arguments": longer, "acknowledged_cost": bound(plan)},
+            )
+            assert response.status_code == 409
+            detail = response.json()["detail"]
+            assert detail["reason"] == "fingerprint"
+            assert detail["acknowledged"]["fingerprint"] == plan["fingerprint"]
+            assert detail["plan"]["list_entries"] == {"shots": 3}
+            assert detail["plan"]["fingerprint"] != plan["fingerprint"]
+            assert "differ" in detail["message"]
+            assert client.app.state.job_manager.worker_manager.commands == []
+
+    def test_a_new_seed_is_the_same_work(self, server, no_hub):
+        with server(success_script) as client:
+            plan = plan_for(client, list_workflow())
+            response = client.post(
+                "/api/jobs",
+                json={"workflow": list_workflow(), "arguments": {"seed": 99}, "acknowledged_cost": bound(plan)},
+            )
+            assert response.status_code == 201
+
+    def test_a_download_not_acknowledged_is_refused(self, server, no_hub):
+        with server(success_script) as client:
+            plan = plan_for(client, list_workflow())
+            acknowledgement = bound(plan)
+            acknowledgement["downloads"] = []  # the caller left the repo out
+            response = client.post(
+                "/api/jobs", json={"workflow": list_workflow(), "acknowledged_cost": acknowledgement}
+            )
+            assert response.status_code == 409
+            detail = response.json()["detail"]
+            assert detail["reason"] == "downloads"
+            assert "m" in detail["message"]
+
+    def test_a_download_that_vanished_is_not_a_refusal(self, server, no_hub, monkeypatch):
+        with server(success_script) as client:
+            plan = plan_for(client, list_workflow())
+            assert bound(plan)["downloads"] == ["m"]
+            import dw.plan
+
+            monkeypatch.setattr(
+                dw.plan, "scan_models", lambda cache_dir=None: {"repos": [{"repo_id": "m"}]}
+            )
+            response = client.post(
+                "/api/jobs", json={"workflow": list_workflow(), "acknowledged_cost": bound(plan)}
+            )
+            assert response.status_code == 201
+
+    def test_an_unplannable_run_is_refused_not_passed(self, server, no_hub, monkeypatch):
+        import dw.server.app as app_module
+
+        with server(success_script) as client:
+            plan = plan_for(client, list_workflow())
+
+            def boom(*a, **k):
+                raise RuntimeError("no plan")
+
+            monkeypatch.setattr(app_module, "build_plan", boom)
+            response = client.post(
+                "/api/jobs", json={"workflow": list_workflow(), "acknowledged_cost": bound(plan)}
+            )
+            assert response.status_code == 409
+            assert response.json()["detail"]["reason"] == "unplannable"
+            assert response.json()["detail"]["plan"] is None
+
+    def test_true_and_absent_queue_without_planning(self, server, no_hub, monkeypatch):
+        import dw.server.app as app_module
+
+        def boom(*a, **k):
+            raise AssertionError("the boolean path must not plan")
+
+        monkeypatch.setattr(app_module, "build_plan", boom)
+        with server(success_script) as client:
+            plain = client.post("/api/jobs", json={"workflow": valid_workflow("p")})
+            flagged = client.post(
+                "/api/jobs", json={"workflow": valid_workflow("f"), "acknowledged_cost": True}
+            )
+            off = client.post(
+                "/api/jobs", json={"workflow": valid_workflow("o"), "acknowledged_cost": False}
+            )
+        assert plain.json()["acknowledged"] == "none"
+        assert flagged.json()["acknowledged"] == "boolean"
+        assert off.json()["acknowledged"] == "none"
+
+    def test_a_bound_form_without_a_fingerprint_is_a_422(self, server):
+        with server(success_script) as client:
+            response = client.post(
+                "/api/jobs", json={"workflow": valid_workflow(), "acknowledged_cost": {"minutes": 3}}
+            )
+            assert response.status_code == 422
+
+    def test_a_stored_prompt_edited_after_validation_is_refused(self, server, no_hub, tmp_path):
+        (tmp_path / "prompts" / "p.json").write_text(json.dumps({"text": "before"}))
+        workflow = valid_workflow("prompted")
+        workflow["variables"]["prompt"] = "prompt:p"
+        with server(success_script) as client:
+            plan = plan_for(client, workflow)
+            (tmp_path / "prompts" / "p.json").write_text(json.dumps({"text": "after"}))
+            response = client.post(
+                "/api/jobs", json={"workflow": workflow, "acknowledged_cost": bound(plan)}
+            )
+            assert response.status_code == 409
+            assert response.json()["detail"]["reason"] == "fingerprint"
+
+
+class TestBoundRerun:
+    def test_a_rerun_with_the_original_plan_queues_even_with_a_new_seed(self, server, no_hub):
+        with server(success_script) as client:
+            plan = plan_for(client, list_workflow())
+            first = client.post(
+                "/api/jobs", json={"workflow": list_workflow(), "acknowledged_cost": bound(plan)}
+            ).json()
+            wait_for_status(client, first["id"], TERMINAL_STATES)
+            response = client.post(
+                f"/api/jobs/{first['id']}/rerun",
+                json={"new_seed": True, "acknowledged_cost": bound(plan)},
+            )
+            assert response.status_code == 201
+            assert response.json()["acknowledged"] == "bound"
+
+    def test_a_rerun_bound_to_a_stale_plan_is_refused(self, server, no_hub):
+        with server(success_script) as client:
+            first = client.post("/api/jobs", json={"workflow": list_workflow()}).json()
+            wait_for_status(client, first["id"], TERMINAL_STATES)
+            other = plan_for(client, valid_workflow("other"))
+            response = client.post(
+                f"/api/jobs/{first['id']}/rerun", json={"acknowledged_cost": bound(other)}
+            )
+            assert response.status_code == 409
+            assert response.json()["detail"]["reason"] == "fingerprint"
+
+    def test_a_rerun_with_true_is_unchanged(self, server, no_hub):
+        with server(success_script) as client:
+            first = client.post("/api/jobs", json={"workflow": list_workflow()}).json()
+            wait_for_status(client, first["id"], TERMINAL_STATES)
+            response = client.post(f"/api/jobs/{first['id']}/rerun", json={"acknowledged_cost": True})
+            assert response.status_code == 201
+            assert response.json()["acknowledged"] == "boolean"
+
+    def test_an_unknown_job_is_still_404(self, server):
+        with server(success_script) as client:
+            response = client.post(
+                "/api/jobs/nope/rerun", json={"acknowledged_cost": {"fingerprint": "sha256:0"}}
+            )
+            assert response.status_code == 404
+```
+
+- [ ] **Step 2: Run the tests to verify they fail**
+
+Run: `python -m pytest tests/test_server.py -k "BoundAcknowledgement or BoundRerun" -v`
+Expected: FAIL (`acknowledged_cost` is dropped as an unknown field, so most answer 201 without `acknowledged`, or `acknowledged: none`).
+
+- [ ] **Step 3: Implement**
+
+`dw/server/app.py`:
+
+Imports: add `ACK_BOOLEAN, ACK_BOUND, ACK_NONE` to the `from .jobs import ...` line (find it with `grep -n "from .jobs import" dw/server/app.py`); add `from typing import Union` if `Union` is not already imported (check the existing `Optional` import line).
+
+Above `class JobRequest`:
+
+```python
+class AcknowledgedCost(BaseModel):
+    """A cost acknowledgement bound to the plan a validate call answered
+    with (#85): the server refuses to queue a run whose plan no longer
+    matches it. `minutes` is recorded, never compared."""
+
+    fingerprint: str = Field(description="plan.fingerprint from POST /api/validate")
+    minutes: Optional[float] = Field(
+        default=None, description="plan.estimate.minutes, recorded on the job"
+    )
+    downloads: List[str] = Field(
+        default_factory=list,
+        description="The repos in plan.downloads_required that were acknowledged",
+    )
+
+
+ACKNOWLEDGED_COST_FIELD = Field(
+    default=None,
+    description="Cost acknowledgement: true (recorded), or an object "
+    "{fingerprint, minutes, downloads} bound to the plan validate answered "
+    "with - then the run is refused with 409 if its plan changed",
+)
+```
+
+(`List` - check `from typing import` at the top; add it if only `Dict, Any, Optional` are imported.)
+
+`JobRequest` gains `acknowledged_cost: Optional[Union[bool, AcknowledgedCost]] = ACKNOWLEDGED_COST_FIELD`. `RerunRequest` (inside `create_app`) gains the same line.
+
+Helpers inside `create_app`, beside `_argument_reference_errors`:
+
+```python
+    def _acknowledgement_form(value):
+        """none | boolean | bound - classified once, here, so the check and
+        the record agree."""
+        if isinstance(value, AcknowledgedCost):
+            return ACK_BOUND
+        return ACK_BOOLEAN if value is True else ACK_NONE
+
+    def _check_bound_acknowledgement(candidate, arguments, acknowledged, workspace):
+        """Refuse with 409 when the run `candidate` + `arguments` will
+        execute is not the one `acknowledged` was bound to: a different
+        fingerprint, or a download the caller did not acknowledge. The body
+        carries the current plan so the agent re-quotes from it without a
+        second validate call. A plan that cannot be built is a refusal too -
+        never a silent pass (#85).
+        """
+        record = acknowledged.model_dump()
+        try:
+            from .. import get_device, get_device_type
+
+            current = build_plan(
+                candidate,
+                arguments,
+                device=get_device_type(get_device()),
+                prompt_dir=workspace.prompts,
+                lookup_sizes=False,
+            )
+        except Exception:
+            logger.exception("Plan could not be built for a bound acknowledgement")
+            raise HTTPException(
+                status_code=409,
+                detail={
+                    "message": "The run could not be planned, so a bound "
+                    "acknowledgement cannot be checked; acknowledge with true "
+                    "or validate again",
+                    "reason": "unplannable",
+                    "acknowledged": record,
+                    "plan": None,
+                },
+            )
+        if current["fingerprint"] != acknowledged.fingerprint:
+            raise HTTPException(
+                status_code=409,
+                detail={
+                    "message": "The run's shape changed since it was acknowledged: "
+                    "the workflow or its arguments differ from what was validated",
+                    "reason": "fingerprint",
+                    "acknowledged": record,
+                    "plan": current,
+                },
+            )
+        missing = [
+            entry["repo"]
+            for entry in current["downloads_required"]
+            if entry.get("repo") and entry["repo"] not in acknowledged.downloads
+        ]
+        if missing:
+            raise HTTPException(
+                status_code=409,
+                detail={
+                    "message": "The run's shape changed since it was acknowledged: "
+                    f"it now has to download {', '.join(missing)} first",
+                    "reason": "downloads",
+                    "acknowledged": record,
+                    "plan": current,
+                },
+            )
+
+    def _candidate_for(workflow_path, workflow, base_dir, output_dir, workflow_dir):
+        """The Workflow a job spec names, built as the worker will build it."""
+        if workflow_path is not None:
+            return workflow_from_file(workflow_path, output_dir, workflow_dir)
+        return workflow_from_definition(
+            copy.deepcopy(workflow), output_dir, base_dir, workflow_dir
+        )
+```
+
+In `submit_job`, after the `reference_problems` check and before `manager.submit(...)`:
+
+```python
+            form = _acknowledgement_form(request.acknowledged_cost)
+            if form == ACK_BOUND:
+                confinement = source.root if source else workspace.workflows
+                candidate = _candidate_for(
+                    resolved, request.workflow, request.base_dir,
+                    workspace.outputs, confinement,
+                )
+                _check_bound_acknowledgement(
+                    candidate, request.arguments, request.acknowledged_cost, workspace
+                )
+```
+
+and pass to `manager.submit`: `acknowledged=form, acknowledged_cost=(request.acknowledged_cost.model_dump() if form == ACK_BOUND else None)`. The `except HTTPException: raise` already precedes the catch-all, so the 409 passes through.
+
+In `rerun_job`:
+
+```python
+        form = _acknowledgement_form(body.acknowledged_cost)
+        if form == ACK_BOUND:
+            prepared = manager.rerun_spec(job_id)
+            if prepared is None:
+                raise HTTPException(status_code=404, detail="Unknown job")
+            spec, arguments = prepared
+            try:
+                candidate = _candidate_for(
+                    spec.get("workflow_path"), spec.get("workflow"), spec.get("base_dir"),
+                    spec.get("output_dir") or manager.output_dir, spec.get("workflow_dir"),
+                )
+            except Exception as e:
+                raise HTTPException(status_code=400, detail=str(e))
+            _check_bound_acknowledgement(
+                candidate, arguments, body.acknowledged_cost,
+                _workspace_for(spec.get("workspace")),
+            )
+        try:
+            job = manager.rerun(
+                job_id,
+                new_seed=body.new_seed,
+                acknowledged=form,
+                acknowledged_cost=(
+                    body.acknowledged_cost.model_dump() if form == ACK_BOUND else None
+                ),
+            )
+        except HTTPException:
+            raise
+        except Exception as e:
+            raise HTTPException(status_code=400, detail=str(e))
+```
+
+(`_workspace_for(None)` is the default workspace - see its first line.) Update the route docstring: `Pass acknowledged_cost as on POST /api/jobs; a bound one is checked against the stored spec's plan - the fresh seed of new_seed does not change a fingerprint.`
+
+- [ ] **Step 4: Run the tests**
+
+Run: `python -m pytest tests/test_server.py -v -k "Bound or ValidatePlan or Acknowledgement"` then `python -m pytest tests/test_server.py -q`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add dw/server/app.py tests/test_server.py
+git commit -m "feat(server): #85 - a bound acknowledgement is checked against the run's plan, and a changed plan is a 409
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>"
+```
+
+---
+
+### Task 6: MCP - the bound form over the tools, and the 409 rendered with the new estimate
+
+**Files:**
+- Modify: `dw_mcp/diagnose.py` (`COST_REFUSAL` ~25, `run_workflow` ~33, `rerun_job` ~248), `dw_mcp/server.py` (`run_workflow` ~794, `rerun_job` ~907), `dw_mcp/client.py` (`_format_detail` ~325)
+- Test: `tests/test_mcp_diagnose.py`, `tests/test_mcp_client.py`, `tests/test_mcp_server.py`
+
+**Interfaces:**
+- Consumes: the 409 body shape from Task 5.
+- Produces: `diagnose.run_workflow(..., acknowledged_cost: bool | dict)`; `diagnose.rerun_job(..., acknowledged_cost: bool | dict)`; a dict is forwarded verbatim as the body's `acknowledged_cost`; a dict without `fingerprint` raises `DwApiError` before any request. `DwClient._format_detail` appends the plan's estimate and downloads when a dict detail carries `plan`.
+
+- [ ] **Step 1: Write the failing tests**
+
+Append to `tests/test_mcp_diagnose.py`:
+
+```python
+BOUND = {"fingerprint": "sha256:abc", "minutes": 4.0, "downloads": ["org/x"]}
+
+
+def test_run_forwards_a_bound_acknowledgement_verbatim():
+    import json
+
+    client, seen = submitting()
+    diagnose.run_workflow(client, workflow_path="w.json", acknowledged_cost=BOUND)
+    assert json.loads(seen[0]["body"])["acknowledged_cost"] == BOUND
+
+
+def test_run_does_not_send_a_bare_true():
+    """The boolean path is the MCP layer's gate, not the server's - the body
+    stays what it was."""
+    import json
+
+    client, seen = submitting()
+    diagnose.run_workflow(client, workflow_path="w.json", acknowledged_cost=True)
+    assert "acknowledged_cost" not in json.loads(seen[0]["body"])
+
+
+def test_run_refuses_a_bound_form_without_a_fingerprint():
+    client, seen = submitting()
+    with pytest.raises(DwApiError, match="fingerprint"):
+        diagnose.run_workflow(client, workflow_path="w.json", acknowledged_cost={"minutes": 4})
+    assert seen == []
+
+
+def test_run_refuses_an_empty_dict_as_unacknowledged():
+    client, seen = submitting()
+    with pytest.raises(DwApiError, match="acknowledged_cost"):
+        diagnose.run_workflow(client, workflow_path="w.json", acknowledged_cost={})
+    assert seen == []
+
+
+def test_a_409_surfaces_with_the_new_estimate():
+    client, _seen = scripted(
+        {
+            ("POST", "/api/jobs"): (
+                409,
+                {
+                    "detail": {
+                        "message": "The run's shape changed since it was acknowledged: the workflow or its arguments differ from what was validated",
+                        "reason": "fingerprint",
+                        "acknowledged": BOUND,
+                        "plan": {
+                            "fingerprint": "sha256:def",
+                            "steps": 6,
+                            "list_entries": {"shots": 5},
+                            "cached_steps": None,
+                            "downloads_required": [{"repo": "org/y", "gb": 3.5}],
+                            "estimate": {"minutes": 19.0, "basis": "per_entry", "device": "cuda", "measured_on": "card", "partial": False},
+                        },
+                    }
+                },
+            )
+        }
+    )
+    with pytest.raises(DwApiError) as caught:
+        diagnose.run_workflow(client, workflow_path="w.json", acknowledged_cost=BOUND)
+    message = str(caught.value)
+    assert "shape changed" in message
+    assert "19.0" in message and "per_entry" in message
+    assert "org/y" in message
+    assert "sha256:def" in message
+
+
+def test_rerun_forwards_a_bound_acknowledgement():
+    import json
+
+    client, seen = scripted({("POST", "/api/jobs/job-1/rerun"): (201, SUBMITTED)})
+    diagnose.rerun_job(client, "job-1", acknowledged_cost=BOUND, new_seed=True)
+    body = json.loads(seen[0]["body"])
+    assert body["acknowledged_cost"] == BOUND and body["new_seed"] is True
+```
+
+Append to `tests/test_mcp_diagnose.py` as well (the refusal text):
+
+```python
+def test_the_refusal_teaches_the_bound_form():
+    from dw_mcp.diagnose import COST_REFUSAL
+
+    assert "fingerprint" in COST_REFUSAL
+```
+
+- [ ] **Step 2: Run the tests to verify they fail**
+
+Run: `python -m pytest tests/test_mcp_diagnose.py -k "bound or 409 or forwards or teaches or empty_dict" -v`
+Expected: FAIL.
+
+- [ ] **Step 3: Implement**
+
+`dw_mcp/diagnose.py`:
+
+```python
+COST_REFUSAL = (
+    "Running a workflow occupies the GPU for minutes and the engine runs one "
+    "job at a time. Call `validate_workflow` with the arguments you will run "
+    "with (free): its `plan` says what will execute - `estimate.minutes` with "
+    "its `basis`, and any weights in `downloads_required` this box has to "
+    "fetch first. Tell the user that number, get their go-ahead, then call "
+    "again with acknowledged_cost bound to the plan: {\"fingerprint\": "
+    "plan.fingerprint, \"minutes\": plan.estimate.minutes, \"downloads\": "
+    "[each downloads_required repo]} - the server then refuses (409) if the "
+    "run's shape changed since. Pass true instead only when `plan` was null."
+)
+
+
+def _acknowledgement_body(acknowledged_cost):
+    """What a bound acknowledgement adds to a request body: the dict itself,
+    verbatim, so the server compares what the agent quoted. A dict without
+    a fingerprint is a mistake caught here, before anything is queued; a
+    bare true adds nothing - the boolean gate is this layer's, not the
+    server's."""
+    if isinstance(acknowledged_cost, dict):
+        if not acknowledged_cost.get("fingerprint"):
+            raise DwApiError(
+                "A bound acknowledged_cost needs `fingerprint` - the "
+                "plan.fingerprint the validate answer carried. Validate again "
+                "and pass {fingerprint, minutes, downloads} from its plan."
+            )
+        return {"acknowledged_cost": acknowledged_cost}
+    return {}
+```
+
+In `run_workflow`, change the gate to `if not acknowledged_cost:` (unchanged - an empty dict is falsy and refuses) and after `payload = {"arguments": arguments or {}}` add `payload.update(_acknowledgement_body(acknowledged_cost))`. In `rerun_job` the body becomes `{"new_seed": new_seed, **_acknowledgement_body(acknowledged_cost)}`. Update both docstrings' gate sentence: `acknowledged_cost is true or, better, the plan it was quoted from: {fingerprint, minutes, downloads} - see COST_REFUSAL`.
+
+`dw_mcp/server.py`: both tool signatures become `acknowledged_cost: bool | dict = False`. Append to `run_workflow`'s docstring: `Bind the acknowledgement to what you quoted: pass {"fingerprint": plan.fingerprint, "minutes": plan.estimate.minutes, "downloads": [...repos from plan.downloads_required]} from the validate answer, and the server refuses with 409 - naming the new plan - if the run's shape changed since; bare true is for a plan that was null.` Append to `rerun_job`'s: `acknowledged_cost takes the same bound form as run_workflow; a fresh seed never changes the fingerprint, so the original plan still binds a new_seed rerun.`
+
+`dw_mcp/client.py`, `_format_detail`, inside the `if isinstance(detail, dict) and "message" in detail:` branch, before `return formatted`:
+
+```python
+            plan = detail.get("plan")
+            if isinstance(plan, dict):
+                # A 409 from the cost gate: say what the run costs now, so a
+                # client that only sees the message can re-quote from it
+                estimate = plan.get("estimate") or {}
+                formatted += (
+                    f" It now estimates {estimate.get('minutes')} minutes "
+                    f"(basis {estimate.get('basis')})"
+                )
+                downloads = [
+                    entry.get("repo") or entry.get("url")
+                    for entry in plan.get("downloads_required") or []
+                ]
+                if downloads:
+                    formatted += f", and would download {', '.join(downloads)} first"
+                formatted += f"; new fingerprint {plan.get('fingerprint')}."
+```
+
+- [ ] **Step 4: Run the MCP suites**
+
+Run: `python -m pytest tests/test_mcp_diagnose.py tests/test_mcp_client.py tests/test_mcp_server.py -q`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add dw_mcp/diagnose.py dw_mcp/server.py dw_mcp/client.py tests/test_mcp_diagnose.py
+git commit -m "feat(mcp): #85 - acknowledged_cost binds to the plan that was quoted, and a 409 re-quotes
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>"
+```
+
+---
+
+### Task 7: docs, skills, proposal status
+
+**Files:**
+- Modify: `docs/SERVER.md` (`POST /api/jobs` bullet - find with `grep -n "POST /api/jobs" docs/SERVER.md`; the validate `plan` paragraph's `cached_steps, reserved (null)`), `docs/MCP.md` (`## The cost gate`, the `run_workflow`/`rerun_job` table rows, the troubleshooting row `run_workflow or rerun_job refuses with a cost message`), `docs/WORKFLOW_GUIDE.md` ("The loop" step 4), `CLAUDE.md` (the `plan` sentence added in stage 1), `plugins/dw/skills/*/SKILL.md` (step 2 of "Run and judge"), `docs/proposals/acknowledged-cost-binding.md` (status line)
+- Test: `tests/test_plugin_skills.py`, `tests/test_docs_links.py`
+
+- [ ] **Step 1: Docs**
+
+`docs/SERVER.md`:
+- In the validate `plan` paragraph replace `` `cached_steps`, reserved (`null`) `` with `` `cached_steps`, how many of those steps the worker's step cache would serve (`0` for an unseeded workflow, `null` when the worker is busy or did not answer) ``.
+- To the `POST /api/jobs` bullet append: `` Takes an optional `acknowledged_cost`: `true` is recorded as `acknowledged: boolean`; the object `{fingerprint, minutes, downloads}` from a validate answer's `plan` is `bound` - the server re-plans the run for the arguments given and answers **409** when the fingerprint differs or a repo in `downloads_required` is not in `downloads` (a download that has since vanished is not a refusal); the body is `{"detail": {message, reason: "fingerprint" | "downloads" | "unplannable", acknowledged, plan}}` with the current plan, so the caller re-quotes from it. `minutes` is recorded, never compared. Nothing is required: the web UI and every caller that sends nothing are `acknowledged: none`, and every job answer and history row carries `acknowledged` (and `acknowledged_cost` when bound). `POST /api/jobs/{id}/rerun` takes the same field and checks against the stored spec; a fresh seed does not change a fingerprint. ``
+
+`docs/MCP.md`:
+- `## The cost gate`: after the paragraph ending `and gating them would make the safe direction the harder one.` add: `` The acknowledgement can be bound to what was quoted. `validate_workflow` answers with a `plan`; pass `acknowledged_cost={"fingerprint": plan.fingerprint, "minutes": plan.estimate.minutes, "downloads": [...]}` and the server refuses with 409 if the run's shape changed between the quote and the call - a longer list, a stored prompt edited meanwhile, weights that now have to be downloaded - naming the new plan so the agent re-quotes. Bare `true` still works and is for a `plan` that came back null; the job records which form it got (`acknowledged: none | boolean | bound`). ``
+- Step 2 of "The intended loop": replace `` `run_workflow` with `acknowledged_cost=true` `` with `` `run_workflow` with `acknowledged_cost` bound to the plan (`{fingerprint, minutes, downloads}`), or `true` when there was no plan ``.
+- Tool table rows for `run_workflow` and `rerun_job`: `acknowledged_cost=False` → `acknowledged_cost=False` stays in the signature column; append to each description ` - `acknowledged_cost` is `true` or the bound `{fingerprint, minutes, downloads}` from the validate plan; a 409 means the plan changed and the message carries the new estimate`.
+- Troubleshooting row: append `; a 409 "shape changed" answer means the run grew since the quote - re-validate, re-quote, pass the new plan`.
+
+`docs/WORKFLOW_GUIDE.md`, "The loop" step 4: after `never counted.` add ` Then pass that plan back: `acknowledged_cost={"fingerprint": plan.fingerprint, "minutes": plan.estimate.minutes, "downloads": [...]}` - the server refuses with 409 if the run's shape changed since the quote, and the refusal carries the new plan to quote from. `true` is for a plan that was null.`
+
+`CLAUDE.md`: extend the stage-1 sentence: after `never a changed verdict` add `; `acknowledged_cost` on `POST /api/jobs` / `rerun` takes `true` (recorded) or the plan's `{fingerprint, minutes, downloads}` (checked - 409 with the current plan when the fingerprint or the required downloads changed; `minutes` never compared), and the job records `acknowledged: none | boolean | bound`. `cached_steps` is the worker's answer to a `probe_cache` command (`Workflow.cache_hits`, which shares `_prepare_definition` / `_cache_lookup` with `run` so the two cannot drift)`.
+
+`docs/proposals/acknowledged-cost-binding.md`: status line → `Status: **implemented** (stage 1 b37f033, stage 2 on `cost-binding`). Design: docs/superpowers/specs/2026-09-12-acknowledged-cost-binding-design.md.`
+
+- [ ] **Step 2: Skills**
+
+Each "Run and judge" step 2 ends with a sentence about `run_workflow with acknowledged_cost=true`. Replace, in all three, `` `run_workflow` with `acknowledged_cost=true` `` with `` `run_workflow` with `acknowledged_cost` set to the plan's `{fingerprint, minutes, downloads}` ``. That is +36 bytes each. `minimax-h3` has 22 bytes of headroom and `ltx-2.5` 108, so trim `minimax-h3` first: in its step 2, `(warm minutes; a first\n   load, and any \`downloads_required\`, is longer)` → `(warm minutes; a first load\n   or a \`downloads_required\` is longer)` (−14) and in step 1 `does not accept.` → `rejects.` (−8) — recount with `wc -c` and keep trimming words (not numbers) until under 12288.
+
+- [ ] **Step 3: Run the doc and skill tests**
+
+Run: `python -m pytest tests/test_plugin_skills.py tests/test_docs_links.py -q && wc -c plugins/dw/skills/*/SKILL.md`
+Expected: PASS; every skill under 12288.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add docs CLAUDE.md plugins/dw/skills
+git commit -m "docs: #85 - the bound acknowledgement, the 409 and cached_steps
+
+Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>"
+```
+
+---
+
+### Task 8: whole-suite verification
+
+- [ ] **Step 1:** `python -m pytest -q -x --ignore=tests/test_integration.py -p no:cacheprovider 2>&1 | tail -3` - expect all green (3893 + the new tests).
+- [ ] **Step 2:** `git status --short && git log --oneline develop..HEAD` - clean, eight commits (plan + seven tasks).
+
+---
+
+## Self-review
+
+**Spec coverage:** §6 (models, classification table) - Task 5. §7 (the check, `unplannable`, fingerprint, downloads, body shape) - Task 5; body uses `message` rather than nested `detail.detail` so the existing client formatter renders it, noted in Interfaces. §8 (`Job.acknowledged`, sqlite, `describe`, `RERUN_SPEC_KEYS`) - Task 4. §9 (MCP widening, forwarding, 409 rendering, `COST_REFUSAL`) - Task 6. §10 (probe command, the `run` refactor, `JobManager.probe_cache`, `build_plan(cache_probe=)`, unseeded → 0 with no probe, no scaling by `cached_steps`) - Tasks 1-3, with the command-shape deviation stated up top. §11 tests - each task. Docs - Task 7. Release-note items - the proposal status line; the note itself stays owed with stage 1's.
+
+**Type consistency:** `cache_hits(arguments) -> list[str]` (Task 1) is what `_handle_probe_cache` calls (Task 2); `probe_cache(command, timeout)` (Task 2) is what the validate closure calls (Task 3) with `{**command, "arguments": arguments}`; `cache_probe(arguments)` (Task 3) matches `cached_steps()`'s call; `rerun_spec` / `submit(acknowledged=, acknowledged_cost=)` / `rerun(acknowledged=, acknowledged_cost=)` (Task 4) match the route (Task 5); the 409 body keys (`message`, `reason`, `acknowledged`, `plan`) match the client test and formatter (Task 6).
diff --git a/docs/superpowers/specs/2026-09-12-acknowledged-cost-binding-design.md b/docs/superpowers/specs/2026-09-12-acknowledged-cost-binding-design.md
new file mode 100644
index 00000000..6cf5f3d0
--- /dev/null
+++ b/docs/superpowers/specs/2026-09-12-acknowledged-cost-binding-design.md
@@ -0,0 +1,428 @@
+# Acknowledged-cost binding: design
+
+Date: 2026-09-12. Proposal: [docs/proposals/acknowledged-cost-binding.md](../../proposals/acknowledged-cost-binding.md),
+answering issue #85. Branch: `cost-plan`, off `develop` at 2d87005.
+
+## Goal
+
+The free pre-flight (`POST /api/validate`, MCP `validate_workflow`) answers
+with a *plan*: what the run will actually execute for the arguments given,
+what it will have to download first, and a cost estimate whose basis is
+named. An agent quotes that instead of the catalog's defaults-only `cost`.
+Then a caller may bind its acknowledgement to that plan, and the server
+refuses to queue a run whose shape no longer matches what was acknowledged.
+
+Two stages, each shippable alone:
+
+- **Stage 1** - `plan` on the validate answer, surfaced over MCP, taught by
+  the skills.
+- **Stage 2** - the bound `acknowledged_cost` form, the 409, the job record,
+  and the worker-side step-cache probe.
+
+## Non-goals
+
+- A numeric budget check. `minutes` is recorded, never compared; a tolerance
+  needs `per_entry` measured on the templates, and none carries it yet.
+- Requiring an acknowledgement over HTTP. The web UI and every HTTP caller
+  keep queuing without one; the gate stays an agent-behaviour gate.
+- Run-time metering or aborting a run that overruns its estimate.
+- Pricing the Cartesian product of `previous_result:` references. The count
+  is static only when every multiplicand is an argument, and a number that
+  is sometimes a guess is worse than none.
+- Changing what `list_workflows` reports.
+
+## Global constraints
+
+- Model knowledge stays out of engine code: no repo name, no per-model
+  minute figure. Every number comes from a workflow's `cost` block.
+- `dw/plan.py` imports nothing from `dw.server` or `dw.worker`, and touches
+  the worker only through a callable the caller hands it (stage 2).
+- Plan construction is best effort at the API: a failure is logged and
+  answered as `plan: null`; the validate verdict is the schema's, never the
+  planner's.
+- Every path the planner reads goes through the resolvers the run uses
+  (`realize_workflow`, the sub-workflow digest's confinement, `scan_models`).
+  It opens no file by a path it computed itself.
+- The bare-boolean and absent acknowledgement paths are byte-for-byte
+  unchanged in behaviour.
+- Nothing here names a model in a test either: fixtures declare their own
+  `cost` blocks and their own `model_name` strings.
+
+---
+
+# Stage 1: the plan on validate
+
+## 1. `dw/plan.py`
+
+```python
+def build_plan(
+    definition,
+    arguments,
+    *,
+    base_dir=None,
+    prompt_dir=None,
+    output_root=None,
+    workflow_dir=None,
+    device,
+    cache_dir=None,
+    cache_probe=None,       # stage 2
+    lookup_sizes=True,
+):
+    """What a run of `definition` with `arguments` will execute and cost."""
+```
+
+Returns:
+
+```json
+{
+  "fingerprint": "sha256:<64 hex>",
+  "steps": 14,
+  "list_entries": {"shots": 12},
+  "cached_steps": null,
+  "downloads_required": [
+    {"repo": "org/model", "gb": 41.2},
+    {"repo": null, "url": "https://…/x.safetensors", "gb": null}
+  ],
+  "estimate": {
+    "minutes": 38.0,
+    "basis": "per_entry",
+    "device": "cuda",
+    "measured_on": "RTX 4090",
+    "partial": false
+  }
+}
+```
+
+### 1.1 Realization and expansion
+
+- `realized, _ = realize_workflow(definition, arguments, seed=0, base_dir=…,
+  prompt_dir=…, output_root=…, workflow_dir=…, pin_outputs=False)`.
+  `pin_outputs` is a new keyword on `realize_workflow`, default `True`,
+  which `Workflow.run` never sets; with `False`, `_pin_output` returns the
+  reference as written. Prompt inlining still happens.
+- `expanded = expand_for_each(realized)` - the member list a run executes.
+  `steps` is `len(expanded["steps"])`.
+- `list_entries` is `{variable: len(value)}` for each `for_each` in the
+  *unexpanded* realized definition whose value is `variable:<name>`, read
+  from the folded `variables` block. A literal list is not an argument and
+  is not listed.
+- `realize_workflow` raises on an undeclared argument or an uncoercible
+  value; the API calls `build_plan` only after `argument_errors` passed,
+  so this is not reached there. `build_plan` lets it propagate.
+
+### 1.2 Fingerprint
+
+SHA-256 of `json.dumps(doc, sort_keys=True, separators=(",", ":"),
+ensure_ascii=False)` where `doc` is `expanded` after:
+
+1. the top-level `seed` removed;
+2. if the definition *as written* had `seed: "variable:<name>"`, the folded
+   value of `variables.<name>` removed (the key stays, its `default` is
+   deleted) - otherwise the seed survives in the variables block;
+3. any `seed` key at a step or a step's `pipeline` removed. A step seed that
+   was `variable:<the seed variable>` was substituted by realization, which
+   is why rule 2 removes the value at its source as well;
+4. `cost`, `description`, `summary` and `configures` removed at the top level
+   - documentation, not work.
+
+Presented as `"sha256:" + hexdigest`. The expanded step names are inside the
+document, so the member set is covered without a second input.
+
+What must hold (tests):
+
+| Same fingerprint | Different fingerprint |
+|---|---|
+| a different seed (top level or step) | a longer or shorter `for_each` list |
+| key order in the JSON file | a stored prompt whose text changed |
+| whitespace, `description`, `cost` edits | a changed `num_frames`/`num_inference_steps` |
+| a new run landing under `output:…/latest/…` | a different asset name |
+| the same arguments given in a different order | a step added, removed or renamed |
+
+### 1.3 Estimate
+
+Input: the workflow's `cost` list (schema: `[{device, name?, vram_gb,
+minutes, per_entry?}]`) and `device`, the backend that is serving
+(`get_device_type(get_device())` - `cuda`, `mps` or `cpu`, never an
+index).
+
+1. No `cost` list, or an empty one → `{"minutes": null, "basis":
+   "unknown", "device": device, "measured_on": null, "partial": false}`.
+2. Pick the first entry whose `device` equals the serving backend. None →
+   the first entry in the list, and `basis` is `other_device`; its
+   `minutes` is reported so the agent has a figure to scale, and
+   `measured_on` says what it was measured on.
+3. With an entry chosen: if it carries `per_entry` and
+   `per_entry.variable` is a key of `list_entries`, `minutes = max(0,
+   (entry.minutes - per.minutes * per.entries) + per.minutes * N)` with
+   `N = list_entries[variable]`, `basis: per_entry`. Otherwise
+   `minutes = entry.minutes`, `basis: catalog` (or `other_device` from
+   step 2 - `other_device` wins over `per_entry`, since scaling a figure
+   from the wrong card compounds the error).
+4. **Sub-workflows.** For every expanded step whose `workflow` is
+   `{"path": …}` and not `builtin:`, load the child through the same
+   resolution `_record_sub_workflows` uses (relative to `base_dir`,
+   confined to `workflow_dir`) and apply rules 1-3 to *its* `cost` with the
+   parent's `device`; the child's `for_each` is not re-priced
+   (`list_entries` is the parent's). Add its minutes; if the child had no
+   cost, or was unreadable, set `partial: true`. A builtin adds nothing and
+   sets nothing - it is the parent's to price.
+5. `minutes` is rounded to one decimal.
+
+`measured_on` is the entry's `name`, or `null`.
+
+### 1.4 Downloads required
+
+- Collect every `from_pretrained_arguments.model_name` string anywhere in
+  `expanded` (pipelines, components, and inside a sub-workflow loaded in
+  1.3), plus every `from_pretrained_arguments.from_single_file` value that
+  is a URL (`validate_url` accepts it). Deduplicate, preserve first-seen
+  order.
+- `present = {repo["repo_id"] for repo in scan_models(cache_dir)["repos"]}`.
+  A `model_name` in `present` is dropped. A `model_name` that is a local
+  directory (`os.path.isdir` after the run's own resolution) is dropped -
+  it is not on the hub.
+- Each remaining hub name → `{"repo": name, "gb": size}`; each URL →
+  `{"repo": null, "url": url, "gb": null}`.
+- `size`: when `lookup_sizes` is true, `huggingface_hub.model_info(name,
+  files_metadata=True)` under a 5-second timeout, `sum(s.size for s in
+  info.siblings if s.size)` in GiB to one decimal. Any exception, a
+  missing token for a gated repo, or a missing `size` → `null`. The
+  planner never raises here and never logs above `debug` - an offline box
+  is a state, not an error.
+- `lookup_sizes=False` skips the hub entirely; the API passes it through
+  from `?sizes=false` on validate, for a caller that wants the answer fast.
+
+### 1.5 `cached_steps`
+
+Stage 1 answers `null` always. The field exists from the start so the
+answer's shape does not change in stage 2.
+
+## 2. `POST /api/validate`
+
+After the existing `answer = {"valid": True, …}` is built:
+
+```python
+try:
+    answer["plan"] = build_plan(definition, request.arguments, base_dir=…,
+        prompt_dir=…, output_root=workspace.outputs, workflow_dir=…,
+        device=get_device_type(get_device()), lookup_sizes=request_sizes)
+except Exception:
+    logger.exception("Plan could not be built")
+    answer["plan"] = None
+```
+
+- `definition` here is the definition already resolved (from the file or
+  the inline body); `base_dir`/`workflow_dir` are exactly what the
+  `candidate` was constructed with, so the plan sees the paths the run will.
+- The `cost` list comes from the definition itself (`definition.get("cost")`)
+  - the same place the listing reads it - so an inline workflow that carries
+  a `cost` block is priced too.
+- `sizes` is a new optional query parameter, default `true`.
+- An invalid answer carries no `plan` key at all.
+
+## 3. MCP
+
+- `dw_mcp/authoring.py: validate_workflow` returns the server's answer
+  unchanged; `plan` rides along.
+- `dw_mcp/server.py`: the `validate_workflow` docstring gains a paragraph:
+  quote `plan.estimate.minutes` with its `basis`, name each
+  `downloads_required` entry as a separate line item ("and 41 GB of weights
+  this box does not have"), treat `basis: unknown`/`other_device` as "no
+  measured figure". `COST_REFUSAL` (`diagnose.py`) says the same in one
+  sentence: the number to say out loud is the plan's, not the listing's.
+- `get_guide`'s authoring section (WORKFLOW_GUIDE.md) gains the same rule.
+
+## 4. Docs and skills
+
+- `docs/SERVER.md`: the validate answer's `plan` block, field by field.
+- `docs/MCP.md`: the quoting rule.
+- `docs/WORKFLOW_GUIDE.md` "Authoring a workflow from an agent": the
+  quoting rule; `CLAUDE.md`'s type-system list is unchanged (nothing here is
+  a reference convention).
+- `plugins/dw/skills/{minimax-h3,minimax-music3,ltx-2.5}/SKILL.md`: the
+  "quote cost" step reads "validate with the arguments you will run, quote
+  `plan.estimate`, and name any `downloads_required`" instead of "quote the
+  listing's `cost`". `tests/test_plugin_skills.py` keeps pinning the numbers
+  the skills state; the rule change adds no number.
+
+## 5. Tests (stage 1)
+
+`tests/test_plan.py` (pure, no server):
+
+- fingerprint invariants - every cell of the table in 1.2, each as its own
+  test, using a fixture workflow with a `for_each` over a list variable, a
+  `prompt:` reference into a tmp prompt library, and an `output:…/latest/…`
+  reference into a tmp output root with two runs.
+- estimate: `unknown`, `catalog`, `per_entry` arithmetic (including the
+  floor at 0), `other_device` beating `per_entry`, sub-workflow summing,
+  `partial` on a cost-less child, builtin ignored.
+- downloads: a stub `scan_models` (monkeypatched) with one of two repos
+  present; a local-directory `model_name` dropped; a URL listed; `model_info`
+  raising → `gb: null`; `lookup_sizes=False` never calls it.
+- `realize_workflow(pin_outputs=False)` leaves `latest` as written.
+
+`tests/test_server.py`:
+
+- `plan` present with the documented keys on a valid answer; absent on an
+  invalid one; `null` when `build_plan` raises (monkeypatched); `?sizes=false`
+  reaches the planner.
+
+---
+
+# Stage 2: binding, the 409 and the cache probe
+
+## 6. The bound acknowledgement
+
+`JobRequest` and `RerunRequest` gain:
+
+```python
+acknowledged_cost: bool | AcknowledgedCost | None = None
+```
+
+```python
+class AcknowledgedCost(BaseModel):
+    fingerprint: str                    # "sha256:…" from plan.fingerprint
+    minutes: float | None = None        # plan.estimate.minutes, recorded only
+    downloads: list[str] = []           # plan.downloads_required[*].repo, non-null ones
+```
+
+The form is classified once, in the route:
+
+| Value | `acknowledged` |
+|---|---|
+| absent, `null`, `false` | `none` |
+| `true` | `boolean` |
+| object | `bound` |
+
+The server never refuses for `none` or `boolean`; refusing without an
+acknowledgement remains `dw_mcp`'s job, exactly as today.
+
+## 7. The check
+
+For `bound` only, after the existing argument and reference checks and
+before `manager.submit`:
+
+1. `current = build_plan(...)` with the same inputs validate would use for
+   this request (for rerun: the stored job's definition and arguments, with
+   the fresh seed folded when `new_seed` - which cannot change the
+   fingerprint, by 1.2).
+2. If `build_plan` raises: **409** with detail "the run could not be planned,
+   so a bound acknowledgement cannot be checked; acknowledge with `true`
+   or validate again" - never a silent pass.
+3. If `current["fingerprint"] != acknowledged.fingerprint`: **409**.
+4. If any `repo` in `current["downloads_required"]` (non-null) is not in
+   `acknowledged.downloads`: **409**. A download that has since vanished
+   from the requirement is not a refusal.
+
+The 409 body:
+
+```json
+{
+  "detail": "The run's shape changed since it was acknowledged: …",
+  "reason": "fingerprint" | "downloads" | "unplannable",
+  "acknowledged": {"fingerprint": "…", "minutes": 38.0, "downloads": [...]},
+  "plan": { …current plan… }
+}
+```
+
+`detail` is one sentence naming the reason: for `fingerprint`, "the
+workflow or its arguments differ from what was validated"; for
+`downloads`, the repos now required and not acknowledged. `plan` is the
+whole current plan so the agent re-quotes from the body without a second
+validate call. FastAPI's `HTTPException(status_code=409, detail=…)` takes
+only `detail`; the route raises with `detail` as this whole object, which
+FastAPI serializes as `{"detail": {...}}` - the MCP layer and the docs
+describe that shape.
+
+## 8. Recording
+
+- `Job` gains `acknowledged: str` (`none`/`boolean`/`bound`) and, when
+  bound, the object under `spec["acknowledged_cost"]` so `rerun` carries it
+  forward and can re-check it (`RERUN_SPEC_KEYS` gains the key).
+- `jobs.sqlite` gains `acknowledged TEXT` by `ALTER TABLE`, the same
+  pattern as `run_id`; rows before the column read back as `none`.
+- `manager.describe(job)` (so `GET /api/jobs/{id}`, `GET /api/jobs`, MCP
+  `get_job`/`list_jobs`) carries `acknowledged`, and `acknowledged_cost`
+  when bound.
+
+## 9. MCP
+
+- `run_workflow` / `rerun_job` (`dw_mcp/server.py`) widen `acknowledged_cost`
+  to `bool | dict`. `diagnose.py` treats a non-empty dict as acknowledged
+  and forwards it verbatim in the body; a dict missing `fingerprint` is a
+  `DwApiError` before any request is made.
+- A 409 from the server surfaces as `DwApiError` whose message is the
+  body's `detail.detail` sentence followed by the new estimate
+  (`plan.estimate.minutes`, `basis`) and the new downloads, so a client that
+  only sees the message can still re-quote.
+- `COST_REFUSAL` teaches the bound form as the normal one: validate with the
+  arguments, quote the plan, pass `{"fingerprint": plan.fingerprint,
+  "minutes": plan.estimate.minutes, "downloads": [...]}`. Bare `true` is
+  the fallback for `plan: null`.
+
+## 10. The step-cache probe
+
+The step cache is the worker's singleton and `Workflow.run` probes it with
+a snapshot taken after substitution and reference resolution
+(`workflow.py`, the `step_cache.get` call), so an exact answer has to come
+from the worker.
+
+- New worker command `{"type": "probe_cache", "definition": <realized,
+  expanded>, "seed": int, "output_dir": str}` answered by
+  `{"type": "probe_cache", "cached": [step names]}`.
+- The worker's handler walks the steps exactly as `Workflow.run` does up to
+  and including the `step_cache.get` call, with `hits_this_run` threaded
+  through, and executes nothing. This is a refactor of `Workflow.run`: the
+  "is this step a hit" computation is lifted into a method
+  (`Workflow.cache_hit(step_data, step_seed, hits_this_run)` or a
+  module-level helper) that both the run loop and the probe call, so the
+  two cannot drift.
+- `JobManager.probe_cache(definition, seed, output_dir, timeout=5)` has the
+  same shape as `memory_status`: busy worker, no worker or a timeout answer
+  `None`, never block a request behind a running job.
+- `build_plan(cache_probe=manager.probe_cache)`: when given, `cached_steps`
+  is `len(cached)` on an answer and `null` on `None`. The seed handed to the
+  probe is the run's real seed (the folded seed variable's value, else
+  `definition["seed"]`, else `null` → the workflow is unseeded, the cache is
+  off, `cached_steps: 0` with no probe made).
+- The estimate is not scaled by `cached_steps` in this stage: the plan
+  states both and the agent says "N of M steps are cached". Scaling needs
+  per-step timing the catalog does not hold.
+
+## 11. Tests (stage 2)
+
+`tests/test_server.py`:
+
+- 409 `fingerprint` on a longer list than acknowledged; on changed
+  arguments; on a changed stored prompt.
+- 409 `downloads` on a repo newly required (stub `scan_models`); no 409 when
+  a download vanished.
+- no 409 on a new seed, on `rerun(new_seed=True)`, on a `latest` that
+  advanced.
+- `boolean` and `none` paths queue exactly as before; `acknowledged`
+  recorded correctly for all three; sqlite migration on a database created
+  without the column.
+- 409 `unplannable` when `build_plan` raises under a bound acknowledgement.
+- 409 body carries `plan`.
+
+`tests/test_worker.py` / `tests/test_step_cache.py`:
+
+- `probe_cache` against a warm cache reports the hit set the next run
+  actually reuses (run once, probe, run again, compare `reused` in the
+  manifest to the probe's answer); against a cold cache reports none;
+  `JobManager.probe_cache` answers `None` when the worker is busy.
+
+`tests/test_mcp*.py`:
+
+- dict forwarded verbatim; dict without `fingerprint` refused client-side;
+  409 surfaces as `DwApiError` with the estimate in the message; `true`
+  still works.
+
+## Release notes
+
+- New: `POST /api/validate` answers with `plan`; `?sizes=false`.
+- New: `acknowledged_cost` accepts `{fingerprint, minutes, downloads}`;
+  `POST /api/jobs` and `/rerun` answer 409 when the plan changed. `true`
+  unchanged.
+- New: jobs record `acknowledged`.
+- The skills now quote from the plan rather than the listing.
diff --git a/dw/arguments.py b/dw/arguments.py
index aedfbd6e..8824fd80 100644
--- a/dw/arguments.py
+++ b/dw/arguments.py
@@ -951,6 +951,22 @@ def fetch_image(img_spec, base_dir=None):
         raise
 
 
+def _with_frame_rate(frames, location):
+    """The loaded frames carrying the rate their file declares.
+
+    `load_video` reads frames and drops the rate, so a step that paired a
+    24 fps file with a soundtrack wrote it back at 8 - three times long,
+    silently (#104). The rate is read from the container without decoding
+    anything, and a file that will not say stays a plain list.
+    """
+    from .tasks.video_utils import FrameList, file_fps
+
+    if not isinstance(frames, list):
+        return frames
+    fps = file_fps(location)
+    return FrameList(frames, fps) if fps else frames
+
+
 def fetch_video(video_spec, base_dir=None):
     """
     Load video from file path or URL with security validation.
@@ -1013,7 +1029,7 @@ def fetch_video(video_spec, base_dir=None):
             video_spec.startswith("http://") or video_spec.startswith("https://")
         ):
             validated_url = validate_url(video_spec)
-            return load_video(validated_url)
+            return _with_frame_rate(load_video(validated_url), validated_url)
         else:
             # Treat as file path, relative to the workflow file
             validated_path = validate_path(
@@ -1023,7 +1039,7 @@ def fetch_video(video_spec, base_dir=None):
             ext = os.path.splitext(validated_path)[1].lower()
             if ext not in ALLOWED_VIDEO_EXTENSIONS:
                 raise SecurityError(f"Video file extension not allowed: {ext}")
-            return load_video(validated_path)
+            return _with_frame_rate(load_video(validated_path), validated_path)
 
     except SecurityError:
         raise
diff --git a/dw/plan.py b/dw/plan.py
new file mode 100644
index 00000000..54b7777d
--- /dev/null
+++ b/dw/plan.py
@@ -0,0 +1,435 @@
+"""The plan a validate call answers with: what a run of a workflow with a
+caller's arguments will actually execute, what it will have to download
+first, and what the workflow's own cost block says it will take - with a
+fingerprint over the work, so an acknowledgement can be bound to it and a
+run whose shape changed after consent refused (#85, stage 2).
+
+Everything here is derived from the same resolvers the run uses -
+`realize_workflow` folds the arguments and inlines the prompts, and
+`Workflow.expanded_definition` substitutes and expands `for_each` - so the
+plan describes the run and not an approximation of it. Nothing here knows a
+model: every minute comes from a `cost` block and every repo name from a
+`from_pretrained_arguments`.
+"""
+
+import copy
+import hashlib
+import json
+import logging
+import os
+
+from huggingface_hub import model_info
+from huggingface_hub.utils import HFValidationError, validate_repo_id
+
+from .hub_cache import scan_models
+from .realize import (
+    BUILTIN_PREFIX,
+    VARIABLE_PREFIX,
+    read_sub_workflow,
+    realize_workflow,
+)
+from .security import validate_url
+from .workflow import Workflow
+
+logger = logging.getLogger("dw")
+
+FINGERPRINT_PREFIX = "sha256:"
+# Top-level keys that document a workflow rather than shape its work
+DOCUMENTATION_KEYS = ("cost", "description", "summary", "configures")
+FOR_EACH_KEY = "for_each"
+SIZE_LOOKUP_TIMEOUT = 5.0
+GIB = 1024**3
+
+
+def build_plan(
+    candidate,
+    arguments,
+    *,
+    device,
+    prompt_dir=None,
+    cache_dir=None,
+    lookup_sizes=True,
+    cache_probe=None,
+):
+    """What a run of `candidate` with `arguments` will execute and cost.
+
+    Args:
+        candidate: The Workflow the route built - it carries the file spec
+            (so base_dir), the output root and the confinement a run has.
+        arguments: The caller's arguments, already past `argument_errors`;
+            an undeclared name or an uncoercible value raises here.
+        device: The backend that is serving - 'cuda', 'mps' or 'cpu'.
+        prompt_dir: The prompt library, for inlining.
+        cache_dir: The hub cache to check downloads against; None for the
+            default.
+        lookup_sizes: Whether to ask the hub how large a missing repo is.
+        cache_probe: A callable taking the run's arguments and answering the
+            step names the worker's cache would serve, or None when it
+            cannot say; without one `cached_steps` is None.
+    """
+    definition = candidate.workflow_definition
+    base_dir = (
+        os.path.dirname(os.path.abspath(candidate.file_spec))
+        if candidate.file_spec
+        else None
+    )
+    realized, annotations = realize_workflow(
+        definition,
+        arguments,
+        seed=0,
+        base_dir=base_dir,
+        prompt_dir=prompt_dir,
+        output_root=candidate.output_dir,
+        workflow_dir=candidate.workflow_dir,
+        pin_outputs=False,
+    )
+    # Arguments are already folded into the realized variables, so the
+    # expansion takes none; it substitutes and expands exactly as the run
+    expanded = Workflow(
+        realized, candidate.output_dir, candidate.file_spec, candidate.workflow_dir
+    ).expanded_definition()
+    entries = list_entries(definition, realized)
+    measured_entries = list_entries(definition, definition)
+    return {
+        "fingerprint": fingerprint(expanded, definition, annotations),
+        "steps": len(expanded.get("steps") or []),
+        "list_entries": entries,
+        "cached_steps": cached_steps(definition, realized, arguments, cache_probe),
+        "downloads_required": downloads_required(
+            expanded, base_dir, candidate.workflow_dir, cache_dir, lookup_sizes
+        ),
+        "estimate": estimate(
+            definition,
+            expanded,
+            entries,
+            device,
+            base_dir,
+            candidate.workflow_dir,
+            measured_entries=measured_entries,
+        ),
+    }
+
+
+def list_entries(definition, realized):
+    """{variable: length} for every `for_each` that names a list variable,
+    read from `realized`'s folded variables - a literal list is not an
+    argument and is not listed.
+
+    Passing `definition` as both arguments answers the lengths the
+    workflow's *stored defaults* carry, which is the list a catalog `cost`
+    figure was measured against (`estimate`).
+    """
+    variables = realized.get("variables") or {}
+    entries = {}
+    for step in definition.get("steps") or []:
+        if not isinstance(step, dict):
+            continue
+        reference = step.get(FOR_EACH_KEY)
+        if isinstance(reference, str) and reference.startswith(VARIABLE_PREFIX):
+            name = reference.removeprefix(VARIABLE_PREFIX)
+            value = variables.get(name)
+            if isinstance(value, list):
+                entries[name] = len(value)
+    return entries
+
+
+def cached_steps(definition, realized, arguments, cache_probe):
+    """How many steps the step cache would answer for this run: 0 without
+    asking when the workflow is unseeded (the cache is off then), None
+    when there is no probe or the probe cannot answer, else the count."""
+    if not _is_seeded(definition, arguments):
+        return 0
+    if cache_probe is None:
+        return None
+    answer = cache_probe(arguments or {})
+    return len(answer) if isinstance(answer, list) else None
+
+
+def unseeded_cache_warnings(definition, arguments=None):
+    """Say once, where a caller is already looking, that an unseeded workflow
+    gets no step cache at all.
+
+    `cached_steps: 0` is indistinguishable from 'probed, nothing hit' out
+    there, and the difference is the one that matters: without a `seed` the
+    cache is off, so nothing is ever reused however many times the same
+    workflow runs (#107).
+    """
+    if _is_seeded(definition, arguments):
+        return []
+    return [
+        "This workflow sets no 'seed', so the step cache is disabled and "
+        "'cached_steps' is 0 without being probed - every step regenerates "
+        "on every run. Set a top-level 'seed' to make a repeat run reuse "
+        "what it already produced"
+    ]
+
+
+def _is_seeded(definition, arguments):
+    """Whether a run of this workflow has a seed before it draws one - read
+    from the definition as written and the caller's arguments, since
+    realization pins a seed of its own into the copy."""
+    seed = definition.get("seed")
+    if isinstance(seed, str) and seed.startswith(VARIABLE_PREFIX):
+        name = seed.removeprefix(VARIABLE_PREFIX)
+        if name in (arguments or {}):
+            return arguments[name] is not None
+        return (definition.get("variables") or {}).get(name) is not None
+    return seed is not None
+
+
+def fingerprint(expanded, definition, annotations=None):
+    """SHA-256 over the expanded definition with everything that is not
+    work removed: the seed wherever it sits, and the documentation keys.
+
+    `definition` is the workflow as written, consulted for whether the
+    top-level seed named a variable - if it did, that variable's folded
+    value is the seed too and is blanked at its source. `annotations` is
+    what realization recorded beside the copy; its sub-workflow digests go
+    into the hash, since a composed child edited between the quote and the
+    call is different work the parent's text cannot show.
+    """
+    doc = copy.deepcopy(expanded)
+    if annotations and annotations.get("sub_workflows"):
+        doc["__sub_workflows__"] = dict(annotations["sub_workflows"])
+    doc.pop("seed", None)
+    for key in DOCUMENTATION_KEYS:
+        doc.pop(key, None)
+    written_seed = definition.get("seed")
+    if isinstance(written_seed, str) and written_seed.startswith(VARIABLE_PREFIX):
+        name = written_seed.removeprefix(VARIABLE_PREFIX)
+        variables = doc.get("variables")
+        if isinstance(variables, dict) and name in variables:
+            variables[name] = None
+    for step in doc.get("steps") or []:
+        if isinstance(step, dict):
+            step.pop("seed", None)
+            pipeline = step.get("pipeline")
+            if isinstance(pipeline, dict):
+                pipeline.pop("seed", None)
+    # default=repr: a realized 'constant:' can be any Python value, and the
+    # fingerprint only needs it to be stable, not round-trippable
+    serialized = json.dumps(
+        doc, sort_keys=True, separators=(",", ":"), ensure_ascii=False, default=repr
+    )
+    return FINGERPRINT_PREFIX + hashlib.sha256(serialized.encode("utf-8")).hexdigest()
+
+
+UNKNOWN = "unknown"
+CATALOG = "catalog"
+PER_ENTRY = "per_entry"
+DERIVED = "derived"
+OTHER_DEVICE = "other_device"
+
+
+def estimate(
+    definition,
+    expanded,
+    list_entries,
+    device,
+    base_dir,
+    workflow_dir,
+    measured_entries=None,
+):
+    """Minutes from the workflow's own cost block, re-priced for the
+    caller's list, plus each composed child's.
+
+    `basis` names where the figure came from - the honesty is in the field,
+    not in a fabricated number: 'unknown' is no cost block at all (or a
+    list this figure cannot honestly be re-priced for), 'other_device' a
+    figure measured on a backend other than the one serving (reported so
+    the agent has something to scale, flagged so it is not quoted as a
+    measurement), 'catalog' the stored total for a run whose lists are the
+    ones it was measured with, 'per_entry' that total re-priced from a
+    measured per-entry rate, and 'derived' re-priced by extrapolating the
+    stored total linearly over a list whose length the caller changed
+    (#85) - an estimate, not a measurement, and the only alternative to
+    quoting a 5-shot figure for a 10-shot run.
+
+    `measured_entries` is what the stored defaults carry, which is the
+    list the catalog figure was measured against; without it a catalog
+    figure is taken at face value.
+    """
+    own = _price(definition.get("cost"), device, list_entries, measured_entries or {})
+    minutes = own["minutes"]
+    partial = False
+    for path in _sub_workflow_paths(expanded):
+        # A builtin is the parent's to price; a local child prices itself
+        raw = read_sub_workflow(path, base_dir, workflow_dir)
+        child_cost = None
+        if raw is not None:
+            try:
+                child_cost = json.loads(raw).get("cost")
+            except (ValueError, AttributeError):
+                child_cost = None
+        child = _price(child_cost, device, {}, {})
+        if child["minutes"] is None:
+            partial = True
+        elif minutes is not None:
+            minutes += child["minutes"]
+        else:
+            minutes = child["minutes"]
+    return {
+        "minutes": round(minutes, 1) if minutes is not None else None,
+        "basis": own["basis"],
+        "device": device,
+        "measured_on": own["measured_on"],
+        "partial": partial,
+    }
+
+
+def _sub_workflow_paths(expanded):
+    """The local (non-builtin) sub-workflow path of every composing step."""
+    for step in expanded.get("steps") or []:
+        reference = step.get("workflow") if isinstance(step, dict) else None
+        path = reference.get("path") if isinstance(reference, dict) else None
+        if isinstance(path, str) and not path.startswith(BUILTIN_PREFIX):
+            yield path
+
+
+def _price(cost, device, list_entries, measured_entries):
+    """One cost list priced for `device` and `list_entries`, as
+    {minutes, basis, measured_on}.
+
+    `measured_entries` is the list length the figure was measured with -
+    the workflow's stored defaults. When the caller's list differs and the
+    entry carries no measured `per_entry` rate, the total is extrapolated
+    linearly over it and reported as 'derived'; when more than one list
+    changed there is nothing honest to extrapolate along, so the figure is
+    withheld rather than quoted for the wrong list.
+    """
+    entries = [entry for entry in (cost or []) if isinstance(entry, dict)]
+    if not entries:
+        return {"minutes": None, "basis": UNKNOWN, "measured_on": None}
+    chosen = next((entry for entry in entries if entry.get("device") == device), None)
+    basis = CATALOG
+    if chosen is None:
+        chosen = entries[0]
+        basis = OTHER_DEVICE
+    minutes = float(chosen.get("minutes", 0))
+    per = chosen.get("per_entry")
+    if (
+        basis == CATALOG
+        and isinstance(per, dict)
+        and per.get("variable") in list_entries
+    ):
+        count = list_entries[per["variable"]]
+        each = float(per.get("minutes", 0))
+        measured_with = int(per.get("entries", 0))
+        minutes = max(0.0, (minutes - each * measured_with) + each * count)
+        basis = PER_ENTRY
+    elif basis == CATALOG:
+        minutes, basis = _repriced(minutes, list_entries, measured_entries)
+    return {"minutes": minutes, "basis": basis, "measured_on": chosen.get("name")}
+
+
+def _repriced(minutes, list_entries, measured_entries):
+    """A catalog total re-priced for a list the caller lengthened or
+    shortened, as (minutes, basis).
+
+    Linear in the entry count: the figure was measured over
+    `measured_entries` entries and the run does `list_entries` of them, so
+    a 42-minute 5-shot figure quotes 84 for 10 shots rather than 42. It
+    over-counts fixed setup at the long end and under-counts it at the
+    short end - which is why it is labelled `derived` rather than
+    `catalog`, and why a template that measures a real `per_entry` rate
+    beats it.
+    """
+    changed = [
+        (count, measured_entries[name])
+        for name, count in list_entries.items()
+        if name in measured_entries and count != measured_entries[name]
+    ]
+    if not changed:
+        return minutes, CATALOG
+    if len(changed) > 1:
+        return None, UNKNOWN
+    count, measured_with = changed[0]
+    if measured_with <= 0:
+        return None, UNKNOWN
+    return minutes * count / measured_with, DERIVED
+
+
+FROM_PRETRAINED_KEY = "from_pretrained_arguments"
+MODEL_NAME_KEY = "model_name"
+SINGLE_FILE_KEY = "from_single_file"
+
+
+def downloads_required(expanded, base_dir, workflow_dir, cache_dir, lookup_sizes):
+    """The hub repos and checkpoint URLs the run would fetch before its
+    first step: every `model_name` in the expanded definition (and in each
+    composed child) that `scan_models` does not find, plus every
+    `from_single_file` that is a URL. Sizes come from the hub when asked
+    and are None whenever it does not answer - an offline box is a state,
+    not an error, so nothing here raises or logs above debug.
+    """
+    names = []
+    urls = []
+    _collect_sources(expanded, names, urls)
+    for path in _sub_workflow_paths(expanded):
+        raw = read_sub_workflow(path, base_dir, workflow_dir)
+        if raw is None:
+            continue
+        try:
+            _collect_sources(json.loads(raw), names, urls)
+        except ValueError:
+            continue
+    present = {repo.get("repo_id") for repo in scan_models(cache_dir).get("repos", [])}
+    required = []
+    for name in names:
+        # A name not shaped like a hub id is a local checkout - decided by
+        # shape, never by touching the disk: the name came from the request
+        # body, and a free pre-flight must not be a directory-existence oracle
+        if name in present or not _is_repo_id(name):
+            continue
+        required.append({"repo": name, "gb": _size_gb(name) if lookup_sizes else None})
+    for url in urls:
+        required.append({"repo": None, "url": url, "gb": None})
+    return required
+
+
+def _collect_sources(tree, names, urls):
+    """Every from_pretrained source in a tree, first-seen order, deduplicated."""
+    if isinstance(tree, dict):
+        source = tree.get(FROM_PRETRAINED_KEY)
+        if isinstance(source, dict):
+            name = source.get(MODEL_NAME_KEY)
+            if isinstance(name, str) and name not in names:
+                names.append(name)
+            single = source.get(SINGLE_FILE_KEY)
+            if isinstance(single, str) and _is_url(single) and single not in urls:
+                urls.append(single)
+        for value in tree.values():
+            _collect_sources(value, names, urls)
+    elif isinstance(tree, list):
+        for value in tree:
+            _collect_sources(value, names, urls)
+
+
+def _is_repo_id(name):
+    try:
+        validate_repo_id(name)
+        return True
+    except HFValidationError:
+        return False
+
+
+def _is_url(value):
+    if not value.startswith(("http://", "https://")):
+        return False
+    try:
+        validate_url(value)
+        return True
+    except Exception:
+        return False
+
+
+def _size_gb(name):
+    """A repo's size in GiB to one decimal, or None when the hub does not
+    say - unreachable, gated without a token, or a file with no size."""
+    try:
+        info = model_info(name, files_metadata=True, timeout=SIZE_LOOKUP_TIMEOUT)
+        total = sum(s.size for s in (info.siblings or []) if getattr(s, "size", None))
+    except Exception as e:
+        logger.debug(f"No size for {name}: {e}")
+        return None
+    return round(total / GIB, 1) if total else None
diff --git a/dw/realize.py b/dw/realize.py
index eb980019..c970aad2 100644
--- a/dw/realize.py
+++ b/dw/realize.py
@@ -48,6 +48,7 @@ def realize_workflow(
     prompt_dir=None,
     output_root=None,
     workflow_dir=None,
+    pin_outputs=True,
 ):
     """A copy of `definition` with every mutable input pinned.
 
@@ -64,6 +65,11 @@ def realize_workflow(
         output_root: The output directory `output:` names resolve against.
         workflow_dir: The root a sub-workflow path is confined to, as
             `Workflow` confines it; None for an unconfined CLI run.
+        pin_outputs: Whether an 'output:.../latest/...' reference is rewritten
+            to the run it resolves to. The run leaves this True; the planner
+            (dw/plan.py) passes False so a run finishing between a validate
+            call and the queue call does not change the fingerprint of
+            identical work.
 
     Returns:
         (realized, annotations) - the pinned copy, and
@@ -92,7 +98,9 @@ def realize_workflow(
         seed_variable = definition_seed.removeprefix(VARIABLE_PREFIX)
         if isinstance(variables, dict) and seed_variable in variables:
             variables[seed_variable] = seed
-    realized = _pin(realized, annotations, base_dir, prompt_dir, output_root)
+    realized = _pin(
+        realized, annotations, base_dir, prompt_dir, output_root, pin_outputs
+    )
     _record_sub_workflows(realized.get("steps"), annotations, base_dir, workflow_dir)
     return realized, annotations
 
@@ -129,13 +137,14 @@ def _map_strings(value, transform):
     return value
 
 
-def _pin(value, annotations, base_dir, prompt_dir, output_root):
-    """Rebuild a value with prompt and output references pinned."""
+def _pin(value, annotations, base_dir, prompt_dir, output_root, pin_outputs=True):
+    """Rebuild a value with prompt references inlined and, when
+    `pin_outputs`, output references pinned."""
 
     def transform(string):
         if string.startswith(PROMPT_PREFIX):
             return _inline_prompt(string, annotations, prompt_dir, base_dir)
-        if is_output_reference(string):
+        if pin_outputs and is_output_reference(string):
             return _pin_output(string, output_root)
         return string
 
@@ -208,21 +217,28 @@ def scan(value):
         scan(step)
 
 
-def _digest(path, base_dir, workflow_dir):
-    """The SHA-256 of a sub-workflow file, or None when it cannot be read.
+def read_sub_workflow(path, base_dir, workflow_dir):
+    """The bytes of the sub-workflow file a step's `path` names, or None
+    when it cannot be read.
 
     Resolved the way `Workflow.create_step_action` resolves it - beside the
     referencing file, then across the workflow search path, then through
     `validate_workflow_path` confined to the root it came from - so a path
-    this run could not have loaded is not one realization reads either, and
-    a catalog name the run composed is digested rather than recorded as
-    unreadable (#90).
+    this run could not have loaded is not one realization (or the planner)
+    reads either, and a catalog name the run composed is read rather than
+    recorded as unreadable (#90).
     """
     try:
         candidate, root = resolve_sub_workflow(path, base_dir or ".", workflow_dir)
         validated = validate_workflow_path(candidate, root)
         with open(validated, "rb") as file:
-            return hashlib.sha256(file.read()).hexdigest()
+            return file.read()
     except (SecurityError, OSError, ValueError, SubWorkflowNotFound) as e:
-        logger.debug(f"No digest for sub-workflow {path}: {e}")
+        logger.debug(f"Sub-workflow {path} could not be read: {e}")
         return None
+
+
+def _digest(path, base_dir, workflow_dir):
+    """The SHA-256 of a sub-workflow file, or None when it cannot be read."""
+    raw = read_sub_workflow(path, base_dir, workflow_dir)
+    return hashlib.sha256(raw).hexdigest() if raw is not None else None
diff --git a/dw/result.py b/dw/result.py
index 4db86cd4..c6a53331 100644
--- a/dw/result.py
+++ b/dw/result.py
@@ -379,16 +379,19 @@ def save(self, output_dir, default_base_name):
             self.saved_files = []
             return self.saved_files
 
-        # Determine base filename with validation
+        # Determine base filename with validation. A file_base_name *replaces*
+        # the derived name - it is set to get a name the caller can predict, and
+        # gluing it onto the name it was meant to replace made it neither (#100).
+        # What the derived name guaranteed - a distinct name per step - is then
+        # the caller's to keep; output_file_path's counter catches a collision.
         file_base_name = validated_base_name
         if "file_base_name" in self.result_definition:
-            custom_base = validate_file_base_name(
+            file_base_name = validate_file_base_name(
                 validate_string_input(
                     self.result_definition["file_base_name"],
                     max_length=MAX_BASE_NAME_LENGTH,
                 )
             )
-            file_base_name = custom_base + validated_base_name
 
         # Get file extension for content type
         extension = guess_extension(content_type)
@@ -985,16 +988,51 @@ def as_audio_track(audio):
     encode_video wants a float torch tensor on the CPU shaped (channels, samples) -
     pipelines hand back bfloat16 tensors that are still on the GPU, or numpy arrays.
 
+    A mono track is duplicated into two channels, because the mp4 audio stream
+    takes nothing else: diffusers' _write_audio refuses any other channel count
+    with a raw tensor shape, and a mono voice track paired onto a picture is the
+    ordinary case, not an edge one (#106). Duplicating one channel is lossless,
+    but it is a change to what was handed in, so it warns.
+
     Args:
         audio: Waveform as a torch tensor or numpy array
 
     Returns:
-        Float CPU torch tensor holding the waveform
+        Float CPU torch tensor holding the waveform, with at least 2 channels
     """
     if not isinstance(audio, torch.Tensor):
         audio = torch.from_numpy(numpy.asarray(audio))
 
-    return audio.detach().float().cpu()
+    audio = audio.detach().float().cpu()
+    return _as_stereo(audio)
+
+
+def _as_stereo(audio):
+    """Duplicate a mono waveform into two channels, leaving anything else alone.
+
+    Orientation is read the way encode_video reads it: (samples,) and (1, samples)
+    are mono, and so is (samples, 1) - a lone channel laid out samples-first.
+    A 2-channel waveform in either orientation is already what the encoder takes
+    and is handed back untouched, so a short stereo track is never mistaken for
+    many channels of one sample.
+    """
+    if audio.ndim == 2:
+        if audio.shape[0] == 2 or audio.shape[1] == 2:
+            return audio
+        if audio.shape[0] == 1:
+            audio = audio[0]
+        elif audio.shape[1] == 1:
+            audio = audio[:, 0]
+        else:
+            return audio
+    elif audio.ndim != 1:
+        return audio
+
+    emit_warning(
+        f"Duplicating a mono audio track of {audio.shape[0]} samples into two "
+        f"channels - an mp4 audio stream takes stereo and nothing else"
+    )
+    return audio.unsqueeze(0).repeat(2, 1)
 
 
 def write_audio(output_path, waveform, sample_rate, **write_arguments):
diff --git a/dw/schema.py b/dw/schema.py
index 1b50a662..7f79ec48 100644
--- a/dw/schema.py
+++ b/dw/schema.py
@@ -93,3 +93,125 @@ def load_schema(schema_name):
     )
     with open(file_spec, "r") as file:
         return json.load(file)
+
+
+# The parts of the workflow schema that can be asked for on their own, and
+# what each holds. Whole, the schema is ~36 KB - ~8.6k tokens in one call,
+# spent by an agent that needed the shape of a `result` block (#101). A
+# section answers that question at a tenth the size; the no-argument call
+# is unchanged, so nothing that reads the whole schema is affected.
+SCHEMA_SECTIONS = {
+    "variables": {
+        "properties": [
+            "id",
+            "description",
+            "summary",
+            "shape",
+            "traits",
+            "configures",
+            "cost",
+            "variables",
+            "seed",
+        ],
+        "defs": [],
+    },
+    "steps": {"properties": ["steps"], "defs": ["step", "workflow_reference"]},
+    "pipelines": {
+        "properties": [],
+        "defs": ["pipeline", "pipeline_reference", "chain", "arguments", "image"],
+    },
+    "tasks": {"properties": [], "defs": ["task"]},
+    "result": {"properties": [], "defs": ["result"]},
+    "configuration": {
+        "properties": [],
+        "defs": [
+            "pipeline_configuration",
+            "pipeline_component",
+            "shared_components",
+            "reused_components",
+            "quantization_config",
+            "scheduler",
+            "lora",
+            "controlnet",
+            "ip_adapter",
+            "from_pretrained_arguments",
+            "group_offload",
+            "compile_config",
+            "enable_layerwise_casting",
+        ],
+    },
+}
+
+DEFS_KEY = "$defs"
+DEFS_REF_PREFIX = f"#/{DEFS_KEY}/"
+
+
+class SchemaSectionError(LookupError):
+    """A section name the schema has no part for. The message names the
+    ones it does, so a route can hand it back as a 404 detail."""
+
+
+def _referenced_defs(node, found):
+    """Every '#/$defs/x' name reachable from a subtree, into `found`."""
+    if isinstance(node, dict):
+        ref = node.get("$ref")
+        if isinstance(ref, str) and ref.startswith(DEFS_REF_PREFIX):
+            found.add(ref[len(DEFS_REF_PREFIX) :])
+        for value in node.values():
+            _referenced_defs(value, found)
+    elif isinstance(node, list):
+        for value in node:
+            _referenced_defs(value, found)
+    return found
+
+
+def schema_section(schema, section):
+    """One part of the workflow schema, plus where the rest of it is.
+
+    The fragment carries only the definitions this section owns; a `$ref`
+    to a definition another section owns is left standing and named in
+    `elsewhere` ({definition: section}), because expanding it transitively
+    would pull most of the schema back in and there would be no section
+    left to speak of. `sections` lists every section name.
+
+    Raises:
+        SchemaSectionError: If `section` is not one of SCHEMA_SECTIONS.
+    """
+    if section not in SCHEMA_SECTIONS:
+        raise SchemaSectionError(
+            f"No schema section '{section}'. The sections are: "
+            f"{', '.join(sorted(SCHEMA_SECTIONS))}."
+        )
+    wanted = SCHEMA_SECTIONS[section]
+    defs = schema.get(DEFS_KEY, {})
+    fragment = {
+        key: schema[key]
+        for key in ("$schema", "$id", "type", "description")
+        if key in schema
+    }
+    properties = {
+        name: schema["properties"][name]
+        for name in wanted["properties"]
+        if name in schema.get("properties", {})
+    }
+    if properties:
+        fragment["properties"] = properties
+        required = [name for name in schema.get("required", []) if name in properties]
+        if required:
+            fragment["required"] = required
+    held = {name: defs[name] for name in wanted["defs"] if name in defs}
+    if held:
+        fragment[DEFS_KEY] = held
+    owner = {
+        name: other for other, part in SCHEMA_SECTIONS.items() for name in part["defs"]
+    }
+    referenced = _referenced_defs(fragment, set())
+    elsewhere = {
+        name: owner[name] for name in sorted(referenced - set(held)) if name in owner
+    }
+    return {
+        "section": section,
+        "sections": sorted(SCHEMA_SECTIONS),
+        "elsewhere": elsewhere,
+        "schema": fragment,
+    }
diff --git a/dw/server/app.py b/dw/server/app.py
index 19611e35..3e3ebc41 100644
--- a/dw/server/app.py
+++ b/dw/server/app.py
@@ -19,9 +19,9 @@
 from contextlib import asynccontextmanager
 from datetime import datetime
 from urllib.parse import quote, urlparse
-from typing import Any, Dict, Optional
+from typing import Any, Dict, List, Optional, Union
 
-from fastapi import Depends, FastAPI, HTTPException, Request
+from fastapi import Depends, FastAPI, HTTPException, Query, Request
 from fastapi.concurrency import run_in_threadpool
 from fastapi.responses import StreamingResponse, JSONResponse, Response, FileResponse
 from fastapi.staticfiles import StaticFiles
@@ -50,7 +50,13 @@
     workflow_argument_warnings,
 )
 from ..for_each import entry_field_warnings
-from ..schema import load_schema, validate_data, format_validation_errors
+from ..schema import (
+    load_schema,
+    schema_section,
+    validate_data,
+    format_validation_errors,
+    SchemaSectionError,
+)
 from ..prompts import (
     PROMPT_PREFIX,
     RESERVED_TEXT_PREFIXES,
@@ -64,6 +70,7 @@
 from ..result import read_embedded_metadata
 from ..media_info import probe_media
 from ..hub_cache import scan_models, delete_model, DownloadManager
+from ..plan import build_plan, unseeded_cache_warnings
 from ..runs import is_output_reference, resolve_output_reference, split_run_path
 from ..workspace import (
     ASSETS_SUBDIR,
@@ -95,6 +102,9 @@
     writable_source,
 )
 from .jobs import (
+    ACK_BOOLEAN,
+    ACK_BOUND,
+    ACK_NONE,
     JobManager,
     MAX_PERSISTED_EVENTS,
     QUEUED,
@@ -113,6 +123,29 @@
 SSE_POLL_SECONDS = 1.0
 
 
+class AcknowledgedCost(BaseModel):
+    """A cost acknowledgement bound to the plan a validate call answered
+    with (#85): the server refuses to queue a run whose plan no longer
+    matches it. `minutes` is recorded, never compared."""
+
+    fingerprint: str = Field(description="plan.fingerprint from POST /api/validate")
+    minutes: Optional[float] = Field(
+        default=None, description="plan.estimate.minutes, recorded on the job"
+    )
+    downloads: List[str] = Field(
+        default_factory=list,
+        description="The repos in plan.downloads_required that were acknowledged",
+    )
+
+
+ACKNOWLEDGED_COST_FIELD = Field(
+    default=None,
+    description="Cost acknowledgement: true (recorded), or an object "
+    "{fingerprint, minutes, downloads} bound to the plan validate answered "
+    "with - then the run is refused with 409 if its plan changed",
+)
+
+
 class JobRequest(BaseModel):
     workflow_path: Optional[str] = Field(
         default=None, description="Path to a workflow JSON file on the server"
@@ -131,6 +164,7 @@ class JobRequest(BaseModel):
         default=None,
         description="Which workspace to run or resolve in; the default when omitted",
     )
+    acknowledged_cost: Optional[Union[bool, AcknowledgedCost]] = ACKNOWLEDGED_COST_FIELD
 
 
 # What each workflow produces and takes, for listing cards - cached by mtime
@@ -806,6 +840,99 @@ def _sources_for(ws):
 
     # ------------------------------------------------------------------ jobs
 
+    def _acknowledgement_form(value):
+        """none | boolean | bound - classified once, here, so the check and
+        the record agree (#85)."""
+        if isinstance(value, AcknowledgedCost):
+            return ACK_BOUND
+        return ACK_BOOLEAN if value is True else ACK_NONE
+
+    def _check_bound_acknowledgement(candidate, arguments, acknowledged, workspace):
+        """Refuse with 409 when the run `candidate` + `arguments` will
+        execute is not the one `acknowledged` was bound to: a different
+        fingerprint, or a download the caller did not acknowledge. The body
+        carries the current plan so the agent re-quotes from it without a
+        second validate call. A plan that cannot be built is a refusal too -
+        never a silent pass (#85).
+        """
+        record = acknowledged.model_dump()
+
+        def refuse(message, reason, plan):
+            raise HTTPException(
+                status_code=409,
+                detail={
+                    "message": message,
+                    "reason": reason,
+                    "acknowledged": record,
+                    "plan": plan,
+                },
+            )
+
+        try:
+            from .. import get_device, get_device_type
+
+            current = build_plan(
+                candidate,
+                arguments,
+                device=get_device_type(get_device()),
+                prompt_dir=workspace.prompts,
+                lookup_sizes=False,
+            )
+        except Exception:
+            logger.exception("Plan could not be built for a bound acknowledgement")
+            refuse(
+                "The run could not be planned, so a bound acknowledgement "
+                "cannot be checked; acknowledge with true or validate again",
+                "unplannable",
+                None,
+            )
+        if current["fingerprint"] != acknowledged.fingerprint:
+            refuse(
+                "The run's shape changed since it was acknowledged: the "
+                "workflow or its arguments differ from what was validated.",
+                "fingerprint",
+                current,
+            )
+        missing = [
+            entry["repo"]
+            for entry in current["downloads_required"]
+            if entry.get("repo") and entry["repo"] not in acknowledged.downloads
+        ]
+        if missing:
+            refuse(
+                "The run's shape changed since it was acknowledged: it now "
+                f"has to download {', '.join(missing)} first",
+                "downloads",
+                current,
+            )
+
+    def _candidate_for(
+        workflow_path, workflow, base_dir, output_dir, workflow_dir, arguments
+    ):
+        """The Workflow a job spec names, built and checked as submit() will
+        build and check it - schema first, then the caller's arguments -
+        so a bound acknowledgement never turns the caller's 400 into a 409
+        telling them to acknowledge with true and find out.
+
+        Raises what submit() raises (ValueError, SecurityError, ...), which
+        the routes already answer as 400.
+        """
+        if workflow_path is not None:
+            candidate = workflow_from_file(workflow_path, output_dir, workflow_dir)
+        else:
+            candidate = workflow_from_definition(
+                copy.deepcopy(workflow), output_dir, base_dir, workflow_dir
+            )
+        candidate.validate()
+        problems = argument_errors(candidate.workflow_definition, arguments)
+        if problems:
+            raise ValueError(
+                "; ".join(
+                    f"{problem['path']}: {problem['message']}" for problem in problems
+                )
+            )
+        return candidate
+
     @app.post("/api/jobs", status_code=201)
     def submit_job(request: JobRequest, ws: Workspace = Depends(selected_workspace)):
         """Queue a workflow. The workspace it runs in comes from the body or,
@@ -834,6 +961,22 @@ def submit_job(request: JobRequest, ws: Workspace = Depends(selected_workspace))
                         for problem in reference_problems
                     )
                 )
+            # A bound acknowledgement is checked against the plan this
+            # request would run - before anything is queued, since a refusal
+            # is free here and costs a job id anywhere later (#85)
+            form = _acknowledgement_form(request.acknowledged_cost)
+            if form == ACK_BOUND:
+                candidate = _candidate_for(
+                    resolved,
+                    request.workflow,
+                    request.base_dir,
+                    workspace.outputs,
+                    source.root if source else workspace.workflows,
+                    request.arguments,
+                )
+                _check_bound_acknowledgement(
+                    candidate, request.arguments, request.acknowledged_cost, workspace
+                )
             job = manager.submit(
                 workflow_path=resolved,
                 workflow=request.workflow,
@@ -855,6 +998,12 @@ def submit_job(request: JobRequest, ws: Workspace = Depends(selected_workspace))
                 # for, so 'Basic', 'Basic.json' and an absolute path
                 # inside the source all record the one catalog name
                 catalog_name=catalog_name_for(resolved, source),
+                acknowledged=form,
+                acknowledged_cost=(
+                    request.acknowledged_cost.model_dump()
+                    if form == ACK_BOUND
+                    else None
+                ),
             )
         except HTTPException:
             raise
@@ -951,12 +1100,50 @@ class RerunRequest(BaseModel):
             "the step cache serves from the earlier run - the same seed and "
             "inputs would produce the same files.",
         )
+        acknowledged_cost: Optional[Union[bool, AcknowledgedCost]] = (
+            ACKNOWLEDGED_COST_FIELD
+        )
 
     @app.post("/api/jobs/{job_id}/rerun", status_code=201)
     def rerun_job(job_id: str, body: RerunRequest = RerunRequest()):
-        """Queue a fresh job from a previous job's stored spec."""
+        """Queue a fresh job from a previous job's stored spec. Takes
+        `acknowledged_cost` as POST /api/jobs does; a bound one is checked
+        against the stored spec's plan - the fresh seed of `new_seed` does
+        not change a fingerprint."""
+        form = _acknowledgement_form(body.acknowledged_cost)
+        if form == ACK_BOUND:
+            prepared = manager.rerun_spec(job_id)
+            if prepared is None:
+                raise HTTPException(status_code=404, detail="Unknown job")
+            spec, arguments = prepared
+            try:
+                candidate = _candidate_for(
+                    spec.get("workflow_path"),
+                    spec.get("workflow"),
+                    spec.get("base_dir"),
+                    spec.get("output_dir") or manager.output_dir,
+                    spec.get("workflow_dir"),
+                    arguments,
+                )
+            except Exception as e:
+                raise HTTPException(status_code=400, detail=str(e))
+            _check_bound_acknowledgement(
+                candidate,
+                arguments,
+                body.acknowledged_cost,
+                _workspace_for(spec.get("workspace")),
+            )
         try:
-            job = manager.rerun(job_id, new_seed=body.new_seed)
+            job = manager.rerun(
+                job_id,
+                new_seed=body.new_seed,
+                acknowledged=form,
+                acknowledged_cost=(
+                    body.acknowledged_cost.model_dump() if form == ACK_BOUND else None
+                ),
+            )
+        except HTTPException:
+            raise
         except Exception as e:
             raise HTTPException(status_code=400, detail=str(e))
         if job is None:
@@ -1156,9 +1343,22 @@ def class_description(name: str, target: str = "init"):
             raise HTTPException(status_code=404, detail=f"Could not load {name}: {e}")
 
     @app.get("/api/schema")
-    def workflow_schema():
-        """The workflow JSON schema, for schema-aware JSON editing."""
-        return JSONResponse(load_schema("workflow"))
+    def workflow_schema(section: Optional[str] = None):
+        """The workflow JSON schema, for schema-aware JSON editing.
+
+        `?section=` answers one part of it - `steps`, `pipelines`, `tasks`,
+        `result`, `variables` or `configuration` - as
+        `{section, sections, elsewhere, schema}`, for a reader that wants
+        the shape of a result block and not 36 KB of quantization configs
+        (#101). Additive: the no-argument call is the whole schema, as it
+        was. An unknown section is a 404 naming the ones that exist."""
+        schema = load_schema("workflow")
+        if section is None:
+            return JSONResponse(schema)
+        try:
+            return JSONResponse(schema_section(schema, section))
+        except SchemaSectionError as e:
+            raise HTTPException(status_code=404, detail=str(e))
 
     # ------------------------------------------------------------ guides
 
@@ -1253,15 +1453,43 @@ def _string_leaves(value, path):
                     errors.append({"path": path, "message": str(e)})
         return errors
 
+    def _probe_command_for(candidate, request, workspace, workflow_dir):
+        """The execute-shaped command a cache probe of this validate request
+        needs - the same fields _run_job sends, so the worker loads the
+        workflow exactly as a job would."""
+        command = {
+            "arguments": request.arguments,
+            "output_dir": workspace.outputs,
+            "workflow_dir": workflow_dir,
+        }
+        if workspace.assets:
+            command["asset_dir"] = workspace.assets
+        if request.workflow_path is not None:
+            command["workflow_path"] = candidate.file_spec
+        else:
+            command["workflow"] = request.workflow
+            command["base_dir"] = os.path.dirname(candidate.file_spec)
+        return command
+
     @app.post("/api/validate")
     def validate_workflow(
-        request: JobRequest, ws: Workspace = Depends(selected_workspace)
+        request: JobRequest,
+        ws: Workspace = Depends(selected_workspace),
+        sizes: bool = Query(
+            True,
+            description="Ask the hub how large each missing model is; false "
+            "skips the network for a faster answer",
+        ),
     ):
         """Schema-validate a workflow and check its pipeline arguments
         against real signatures, without queuing anything. Give either an
         inline workflow or a workflow_path - a path on the server or a
         stored workflow name from /api/workflows. The workspace it resolves
-        in comes from the body or the query string, body first."""
+        in comes from the body or the query string, body first. A valid
+        answer also carries a plan: the fingerprint of the work these
+        arguments produce, the step count, the list lengths, the model
+        repos not in the cache, and an estimate from the workflow's cost
+        block."""
         if (request.workflow is None) == (request.workflow_path is None):
             raise HTTPException(
                 status_code=400,
@@ -1276,21 +1504,19 @@ def validate_workflow(
                 resolved, source = resolve_workflow_reference(
                     request.workflow_path, sources
                 )
-                candidate = workflow_from_file(
-                    resolved,
-                    workspace.outputs,
-                    # Confined to the source it came from, not to the
-                    # writable root - an example is read where it lives
-                    source.root if source else workspace.workflows,
-                )
+                # Confined to the source it came from, not to the writable
+                # root - an example is read where it lives
+                source_root = source.root if source else workspace.workflows
+                candidate = workflow_from_file(resolved, workspace.outputs, source_root)
                 definition = candidate.workflow_definition
             else:
                 definition = request.workflow
+                source_root = workspace.workflows
                 candidate = workflow_from_definition(
                     copy.deepcopy(request.workflow),
                     workspace.outputs,
                     request.base_dir,
-                    workspace.workflows,
+                    source_root,
                 )
         except HTTPException:
             raise
@@ -1354,6 +1580,9 @@ def validate_workflow(
             "errors": [],
             "warnings": workflow_argument_warnings(definition)
             + entry_field_warnings(definition, request.arguments)
+            # Why `plan.cached_steps` is 0 for a workflow with no seed - the
+            # cache is off, not empty
+            + unseeded_cache_warnings(definition, request.arguments)
             # An argument a sub-workflow step passes to a workflow that
             # declares no variable for it - dropped in silence at run time
             + candidate.sub_workflow_warnings(),
@@ -1362,6 +1591,26 @@ def validate_workflow(
             # Naming what was checked is the difference between 'the stored
             # definition is valid' and 'the values you are about to pass are'
             answer["checked_arguments"] = sorted(request.arguments)
+        # What the run will execute for these arguments, fingerprinted so
+        # an acknowledgement can be bound to it (#85). Best effort: the
+        # verdict above is the schema's and the planner may not change it
+        try:
+            from .. import get_device, get_device_type
+
+            command = _probe_command_for(candidate, request, workspace, source_root)
+            answer["plan"] = build_plan(
+                candidate,
+                request.arguments,
+                device=get_device_type(get_device()),
+                prompt_dir=workspace.prompts,
+                lookup_sizes=sizes,
+                cache_probe=lambda arguments: manager.probe_cache(
+                    {**command, "arguments": arguments}
+                ),
+            )
+        except Exception:
+            logger.exception("Plan could not be built")
+            answer["plan"] = None
         return answer
 
     # ------------------------------------------------------------ workspaces
diff --git a/dw/server/guides.py b/dw/server/guides.py
index 040f8759..69a799c6 100644
--- a/dw/server/guides.py
+++ b/dw/server/guides.py
@@ -164,10 +164,19 @@ def list_guides():
 
 
 def get_guide(name, section=None):
-    """One guide, whole or one section of it."""
+    """One guide, or one section of it.
+
+    Without a `section` the answer is the *index*: the guide's preamble,
+    its first section, and the headings of the rest - not the whole file.
+    A full WORKFLOW_GUIDE.md is ~19.6k tokens and TASKS.md ~16k, which is
+    more in one call than the entire 55-tool MCP surface costs to connect,
+    and an agent can make that call twice before noticing (#101). Every
+    withheld section is named in `sections` and fetched by name, so
+    nothing is unreachable - only unspent by accident.
+    """
     text = read_guide(name)
     if section is None:
-        return {"name": name, "section": None, "content": text}
+        return _index(name, text)
 
     found = _extract_section(text, section)
     if found is None:
@@ -177,3 +186,41 @@ def get_guide(name, section=None):
         )
     heading, content = found
     return {"name": name, "section": heading, "content": content}
+
+
+def _index(name, text):
+    """The guide's opening plus the headings of what was not sent.
+
+    `content` is everything before the first heading followed by the first
+    section - the part that says what the guide is for - so an agent that
+    reads only this still knows which section it wants.
+    """
+    matches = list(SECTION_PATTERN.finditer(text))
+    headings = [match.group(1) for match in matches]
+    if not matches:
+        return {
+            "name": name,
+            "section": None,
+            "content": text,
+            "sections": headings,
+            "withheld": [],
+        }
+    end = matches[1].start() if len(matches) > 1 else len(text)
+    content = text[:end].rstrip() + "\n"
+    withheld = headings[1:]
+    answer = {
+        "name": name,
+        "section": None,
+        "content": content,
+        "sections": headings,
+        "withheld": withheld,
+    }
+    if withheld:
+        answer["note"] = (
+            f"This is the '{name}' guide's opening and its first section. "
+            f"{len(withheld)} further section(s) - {len(text) - len(content)} "
+            f"characters - were not sent: read one with "
+            f"get_guide('{name}', section='<heading>'). `sections` lists "
+            f"every heading in order."
+        )
+    return answer
diff --git a/dw/server/jobs.py b/dw/server/jobs.py
index c659c5dd..7341ff39 100644
--- a/dw/server/jobs.py
+++ b/dw/server/jobs.py
@@ -42,6 +42,13 @@
 CANCELLED = "cancelled"
 TERMINAL_STATES = (SUCCEEDED, FAILED, CANCELLED)
 
+# Which form of cost acknowledgement a job was queued with (#85): none (the
+# web UI and every HTTP caller that sends nothing), a bare boolean, or one
+# bound to the plan that was validated
+ACK_NONE = "none"
+ACK_BOOLEAN = "boolean"
+ACK_BOUND = "bound"
+
 # The spec fields a rerun needs - shared by persistence and live rerun
 RERUN_SPEC_KEYS = (
     "workflow_path",
@@ -55,6 +62,9 @@
     # so a rerun is attributed to the same catalog entry
     "catalog_name",
     "workflow_dir",
+    # what the original run was consented to, kept for the record - a
+    # rerun's own request decides its form
+    "acknowledged_cost",
 )
 
 # Finished jobs kept in memory for SSE replay grace; older ones live in
@@ -123,6 +133,12 @@ def __init__(self, db_path):
                 connection.execute("ALTER TABLE jobs ADD COLUMN run_id TEXT")
             if "run_dir" not in columns:
                 connection.execute("ALTER TABLE jobs ADD COLUMN run_dir TEXT")
+            # Which form of cost acknowledgement queued the job. Rows before
+            # the column are 'none' - nothing recorded is nothing recorded
+            if "acknowledged" not in columns:
+                connection.execute(
+                    "ALTER TABLE jobs ADD COLUMN acknowledged TEXT DEFAULT 'none'"
+                )
 
     def _connect(self):
         return sqlite3.connect(self.db_path, timeout=5)
@@ -134,8 +150,9 @@ def record(self, job):
             connection.execute(
                 "INSERT OR REPLACE INTO jobs (id, workflow, status, created_at,"
                 " started_at, finished_at, arguments, spec, manifest, warnings,"
-                " error, events, workspace, workflow_name, run_id, run_dir) VALUES"
-                " (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
+                " error, events, workspace, workflow_name, run_id, run_dir,"
+                " acknowledged) VALUES"
+                " (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
                 (
                     job.id,
                     job.workflow_name,
@@ -153,6 +170,7 @@ def record(self, job):
                     job.catalog_name,
                     job.run_id,
                     job.run_dir,
+                    job.acknowledged,
                 ),
             )
 
@@ -168,7 +186,7 @@ def recent_summaries(self, limit=200, workspace=None, statuses=None):
         """
         query = (
             "SELECT id, workflow, status, created_at, started_at, finished_at,"
-            " workspace, workflow_name, run_id FROM jobs"
+            " workspace, workflow_name, run_id, acknowledged FROM jobs"
         )
         params = []
         clauses = []
@@ -197,6 +215,7 @@ def recent_summaries(self, limit=200, workspace=None, statuses=None):
                 "workspace": row[6] or DEFAULT_WORKSPACE_NAME,
                 "workflow_name": row[7],
                 "run_id": row[8],
+                "acknowledged": row[9] or ACK_NONE,
                 "historical": True,
             }
             for row in rows
@@ -207,7 +226,7 @@ def get(self, job_id):
             row = connection.execute(
                 "SELECT id, workflow, status, created_at, started_at, finished_at,"
                 " arguments, spec, manifest, warnings, error, workspace,"
-                " workflow_name, run_id, run_dir FROM jobs WHERE id = ?",
+                " workflow_name, run_id, run_dir, acknowledged FROM jobs WHERE id = ?",
                 (job_id,),
             ).fetchone()
         return self._to_detail(row) if row else None
@@ -307,6 +326,7 @@ def parse(text, fallback):
             except (TypeError, ValueError):
                 return fallback
 
+        spec = parse(row[7], {})
         return {
             "id": row[0],
             "workflow": row[1],
@@ -315,7 +335,7 @@ def parse(text, fallback):
             "started_at": row[4],
             "finished_at": row[5],
             "arguments": parse(row[6], {}),
-            "spec": parse(row[7], {}),
+            "spec": spec,
             "manifest": parse(row[8], []),
             "warnings": parse(row[9], []),
             "error": row[10],
@@ -323,6 +343,8 @@ def parse(text, fallback):
             "workflow_name": row[12],
             "run_id": row[13],
             "run_dir": row[14],
+            "acknowledged": row[15] or ACK_NONE,
+            "acknowledged_cost": (spec or {}).get("acknowledged_cost"),
             "traceback": None,
             "event_count": 0,
             "historical": True,
@@ -352,6 +374,8 @@ def __init__(self, spec):
         # never got that far
         self.run_id = None
         self.run_dir = None
+        # Which form of cost acknowledgement queued this job (#85)
+        self.acknowledged = spec.get("acknowledged") or ACK_NONE
         self.events = []
         # The running summary a poll reads - see _note_progress. Kept as the
         # events arrive rather than derived from the log on request, because
@@ -500,6 +524,7 @@ def summary(self):
             # so it defaults the same way history's column does
             "workspace": self.spec.get("workspace") or DEFAULT_WORKSPACE_NAME,
             "run_id": self.run_id,
+            "acknowledged": self.acknowledged,
         }
 
     def detail(self):
@@ -512,6 +537,7 @@ def detail(self):
             "traceback": self.traceback,
             "event_count": len(self.events),
             "run_dir": self.run_dir,
+            "acknowledged_cost": self.spec.get("acknowledged_cost"),
             "progress": self.progress(),
         }
 
@@ -566,6 +592,8 @@ def submit(
         asset_dir=None,
         workspace=None,
         catalog_name=None,
+        acknowledged=ACK_NONE,
+        acknowledged_cost=None,
     ):
         """Validate a job request and queue it. Raises ValueError on a bad
         request so the HTTP layer can answer 400 before anything runs.
@@ -583,6 +611,10 @@ def submit(
 
         `catalog_name` is the listing name the caller resolved `workflow_path`
         from, kept for history; None for an inline definition.
+
+        `acknowledged` is the form of cost acknowledgement the caller gave
+        (none/boolean/bound) and `acknowledged_cost` the bound object - both
+        recorded, neither checked here; the route checks (#85).
         """
         arguments = arguments or {}
         if (workflow_path is None) == (workflow is None):
@@ -633,6 +665,11 @@ def submit(
         # rerun all agree without re-deriving them
         spec["workspace"] = workspace
         spec["catalog_name"] = catalog_name
+        # The acknowledgement form travels with the job so history can say
+        # whether this run was consented to at its actual size (#85)
+        spec["acknowledged"] = acknowledged
+        if acknowledged_cost is not None:
+            spec["acknowledged_cost"] = acknowledged_cost
         spec["output_dir"] = job_output_dir
         if asset_dir:
             spec["asset_dir"] = asset_dir
@@ -758,7 +795,27 @@ def seed_variable(self, job_id):
         name = seed.removeprefix(VARIABLE_PREFIX)
         return name if name in (definition.get("variables") or {}) else None
 
-    def rerun(self, job_id, new_seed=False):
+    def rerun_spec(self, job_id):
+        """The spec and arguments a rerun of `job_id` would submit, as
+        (spec, arguments), or None for an unknown job - split from rerun()
+        so a route can plan the run before queuing it (#85)."""
+        job = self.jobs.get(job_id)
+        if job is not None:
+            spec = {key: job.spec[key] for key in RERUN_SPEC_KEYS if key in job.spec}
+            return spec, job.spec.get("arguments", {})
+        historical = self.history.get(job_id)
+        if historical is None:
+            return None
+        spec = {
+            key: historical["spec"][key]
+            for key in RERUN_SPEC_KEYS
+            if key in historical["spec"]
+        }
+        return spec, historical["arguments"]
+
+    def rerun(
+        self, job_id, new_seed=False, acknowledged=ACK_NONE, acknowledged_cost=None
+    ):
         """Queue a fresh job from a previous job's spec.
 
         Every root the original ran against (workflow_dir/output_dir/
@@ -773,21 +830,15 @@ def rerun(self, job_id, new_seed=False):
         cache doing its job - the same seed and the same inputs would produce
         the same pixels - so the way to actually get another image is to
         change the seed, and this is that.
+
+        `acknowledged` and `acknowledged_cost` are this request's own; the
+        original's bound object rides along in the spec for the record when
+        the request brought none.
         """
-        job = self.jobs.get(job_id)
-        if job is not None:
-            spec = {key: job.spec[key] for key in RERUN_SPEC_KEYS if key in job.spec}
-            arguments = job.spec.get("arguments", {})
-        else:
-            historical = self.history.get(job_id)
-            if historical is None:
-                return None
-            spec = {
-                key: historical["spec"][key]
-                for key in RERUN_SPEC_KEYS
-                if key in historical["spec"]
-            }
-            arguments = historical["arguments"]
+        prepared = self.rerun_spec(job_id)
+        if prepared is None:
+            return None
+        spec, arguments = prepared
 
         if new_seed:
             variable = self.seed_variable(job_id)
@@ -820,6 +871,12 @@ def rerun(self, job_id, new_seed=False):
             asset_dir=spec.get("asset_dir"),
             workspace=workspace,
             catalog_name=spec.get("catalog_name"),
+            acknowledged=acknowledged,
+            acknowledged_cost=(
+                acknowledged_cost
+                if acknowledged_cost is not None
+                else spec.get("acknowledged_cost")
+            ),
         )
 
     def queue_position(self, job_id):
@@ -1151,6 +1208,52 @@ def _cached_memory(self, reason):
             "age_seconds": age,
         }
 
+    def probe_cache(self, command, timeout=5):
+        """Which steps the worker's step cache would serve for `command` (the
+        fields an execute command carries, minus its type), or None when the
+        answer cannot be had right now - a job is running, the worker is
+        busy, or it did not answer in time. Never blocks a request behind a
+        running job, for the same reason memory_status does not.
+
+        No worker running is a definite answer, not an unknown one: the
+        cache lives in the worker process, so a worker that is not running
+        holds nothing.
+        """
+        if self._current_job_id is not None:
+            return None
+        if not self.worker_manager.worker_active:
+            return []
+        if not self._worker_lock.acquire(timeout=2):
+            return None
+        # A probe that timed out still answers eventually, onto the same
+        # queue the next probe reads - so each carries an id and a reader
+        # discards every reply that is not its own, rather than reporting
+        # the previous workflow's hit list as this plan's
+        probe_id = uuid.uuid4().hex
+        deadline = time.monotonic() + timeout
+        try:
+            self.worker_manager.send_command(
+                {"type": "probe_cache", "probe_id": probe_id, **command}
+            )
+            while True:
+                remaining = deadline - time.monotonic()
+                if remaining <= 0:
+                    return None
+                result = self.worker_manager.get_result(timeout=remaining)
+                if (
+                    result.get("type") == "probe_cache"
+                    and result.get("probe_id") == probe_id
+                ):
+                    break
+                logger.debug(f"Discarding a stale worker message: {result.get('type')}")
+        except (RuntimeError, queue.Empty) as e:
+            logger.debug(f"Worker did not answer the cache probe: {e}")
+            return None
+        finally:
+            self._worker_lock.release()
+        cached = result.get("cached")
+        return list(cached) if isinstance(cached, list) else None
+
     def memory_status(self, timeout=5):
         """Live memory stats when the worker is idle; the run's last report
         while it is busy. The lock acquire is bounded: the runner holds
diff --git a/dw/tasks/pair_audio.py b/dw/tasks/pair_audio.py
index 8e19848f..0b41cb2a 100644
--- a/dw/tasks/pair_audio.py
+++ b/dw/tasks/pair_audio.py
@@ -28,16 +28,24 @@ def pair_audio(video, audio, sample_rate=None):
 
     Args:
         video: The frames - a frame list, a frame array or tensor, or an
-            AudioVideo whose own soundtrack is replaced by this one
+            AudioVideo whose own soundtrack is replaced by this one; the
+            frames' own rate is carried through to the output, so set
+            `result.fps` only to override it (a loaded file brings its rate
+            along; frames that carry none are written at 8 fps)
         audio: The soundtrack - a waveform, an AudioVideo (or any object
             carrying '.audio') to take it from, or the path or URL of an
-            audio or video file; the last two bring their sample rate along
+            audio or video file; the last two bring their sample rate along.
+            A mono track is fine - saving as mp4 duplicates it into the two
+            channels the audio stream takes, and warns that it did
         sample_rate: Sample rate of the waveform. Required unless `audio`
             carries one; given here it wins, for a track whose rate was
             reported wrong
 
     Returns:
-        One AudioVideo holding the frames and the track
+        One AudioVideo holding the frames and the track, at the rate the
+        frames carry - a file loaded for the `video` argument brings its
+        own, so the saved mp4 plays at the rate that went in and
+        `result.fps` is only needed to write it at a different one (#104)
 
     Raises:
         ValueError: If no waveform was given, or if no sample rate can be
diff --git a/dw/tasks/video_utils.py b/dw/tasks/video_utils.py
index 9626b143..ecbf3eb5 100644
--- a/dw/tasks/video_utils.py
+++ b/dw/tasks/video_utils.py
@@ -205,6 +205,43 @@ def _to_pil(frame):
     raise TypeError(f"Cannot convert a {type(frame).__name__} to an image")
 
 
+class FrameList(list):
+    """The frames of a video file, carrying the rate the file plays at.
+
+    `load_video` answers a plain list of images, which is what every
+    pipeline argument and every task wants - and which says nothing about
+    how fast those frames are meant to run. A step handed a 24 fps file
+    then wrote it back at `result.fps`'s default of 8, three times long,
+    with its soundtrack finishing a third of the way in and nothing said
+    about it (#104, the file-loading half of #84). A list subclass keeps
+    every consumer working unchanged while `getattr(video, "fps", None)` -
+    the question AudioVideo, concat_videos and interpolate_frames already
+    ask - gets a real answer.
+    """
+
+    def __init__(self, frames, fps=None):
+        super().__init__(frames)
+        self.fps = fps
+
+
+def file_fps(path):
+    """The rate a video file declares, or None - a container that will not
+    open, carries no video stream or states no rate is a rate we do not
+    know, never an error: the caller is loading frames it has already read.
+    """
+    try:
+        import av
+
+        with av.open(path) as container:
+            stream = container.streams.video[0] if container.streams.video else None
+            return (
+                float(stream.average_rate) if stream and stream.average_rate else None
+            )
+    except Exception as e:
+        logger.debug(f"No frame rate for {path}: {e}")
+        return None
+
+
 def load_audio_video(location, base_dir=None):
     """Load a video file - frames and the audio muxed with them - as an AudioVideo.
 
diff --git a/dw/worker.py b/dw/worker.py
index 35cd25a7..8e0533a5 100644
--- a/dw/worker.py
+++ b/dw/worker.py
@@ -141,6 +141,8 @@ def run(self):
                         self._handle_clear_memory()
                     elif command_type == "memory_status":
                         self._handle_memory_status()
+                    elif command_type == "probe_cache":
+                        self._handle_probe_cache(command)
                     else:
                         self.result_queue.put(
                             {
@@ -387,6 +389,42 @@ def _handle_memory_status(self):
         memory_info = self._get_memory_info()
         self.result_queue.put({"type": "memory_status", "info": memory_info})
 
+    def _handle_probe_cache(self, command: Dict[str, Any]):
+        """Which steps the step cache would serve for a run of this command
+        - the plan's cached_steps (#85). Same fields as an execute command;
+        loads the workflow, executes nothing. A failure answers
+        cached: null with the reason rather than an error message, since
+        an unknown answer is a valid plan and a crashed probe is not. The
+        command's probe_id is echoed so a reply that arrives after its
+        caller gave up is not read as the answer to the next probe.
+        """
+        probe_id = command.get("probe_id")
+        try:
+            workflow, _ = self._load_workflow(command, command["output_dir"])
+            asset_token = (
+                activate_asset_dir(command["asset_dir"])
+                if command.get("asset_dir")
+                else None
+            )
+            try:
+                cached = workflow.cache_hits(command.get("arguments") or {})
+            finally:
+                if asset_token is not None:
+                    deactivate_asset_dir(asset_token)
+            self.result_queue.put(
+                {"type": "probe_cache", "probe_id": probe_id, "cached": cached}
+            )
+        except Exception as e:
+            logger.debug(f"Cache probe failed: {e}")
+            self.result_queue.put(
+                {
+                    "type": "probe_cache",
+                    "probe_id": probe_id,
+                    "cached": None,
+                    "error": str(e),
+                }
+            )
+
     def _evict_untouched_pipelines(self, context):
         """Drop cached pipelines this run no longer touched.
 
diff --git a/dw/workflow.py b/dw/workflow.py
index 3c559509..f1df0684 100644
--- a/dw/workflow.py
+++ b/dw/workflow.py
@@ -75,6 +75,7 @@
 )
 from .workflow_sources import (
     builtin_root,
+    catalog_root,
     resolve_sub_workflow,
     SubWorkflowNotFound,
 )
@@ -188,16 +189,10 @@ def catalog_root_dir(file_spec):
     workflow_dir of its own (an unconfined CLI run) - the same "last
     'workflows' segment" rule workflow_output_subfolder uses for output
     naming, but returning the directory itself rather than what sits under
-    it.
+    it. It is `catalog_root` asked for a file rather than a directory, so
+    the resolver (dw/workflow_sources.py) confines to exactly this root.
     """
-    directory = os.path.dirname(os.path.abspath(file_spec))
-    parts = os.path.normpath(directory).split(os.sep)
-    try:
-        index = len(parts) - 1 - parts[::-1].index("workflows")
-    except ValueError:
-        return directory
-
-    return os.sep.join(parts[: index + 1])
+    return catalog_root(os.path.dirname(os.path.abspath(file_spec)))
 
 
 def pipeline_cache_key(pipeline_definition):
@@ -647,6 +642,186 @@ def validate(self):
             raise Exception(message)
         logger.debug(f"Workflow {self.name} validated successfully")
 
+    def _prepare_definition(self, workflow_def, arguments, base_dir):
+        """The definition as a run works from it: constants realized,
+        arguments folded into the variables, list entries' own references
+        resolved, variable values realized (assets loaded), every
+        'variable:' substituted, every for_each expanded, and the seed read
+        and coerced. Returns (workflow_def, default_seed) - the seed is
+        None when the workflow names none, and the caller decides what
+        that means (run() draws one; cache_hits() reports no hits).
+
+        Shared by run() and cache_hits() so the probe prepares exactly what
+        the run prepares - the step cache keys on the realized step, and a
+        probe that prepared it differently would answer for a run that
+        never happens.
+        """
+        workflow_id = workflow_def["id"]
+        variables = workflow_def.get("variables", None)
+        if variables is not None:
+            logger.debug(f"Setting variables for workflow: {workflow_id}")
+            # a constant is the value a variable declares, so it resolves before
+            # anything is converted to the type of that declaration
+            realize_constants(variables)
+            # first set variable values base don the arguments passed to the workflow
+            # these may come form the command line or form a parent workflow
+            set_variables(arguments, variables)
+            # an entry of a list-valued variable may name another
+            # variable; resolve those before anything inside it is
+            # realized, so a reference type in an entry is a type name
+            variables = resolve_variable_values(variables)
+            # realize the variables, initializing downloads of images etc
+            realize_args(variables, base_dir)
+            ## then replace any variable references in the workflow definition with the actual values
+            # replace_variables returns a new structure rather than mutating in
+            # place, so the result must be captured here
+            workflow_def = replace_variables(workflow_def, variables)
+
+        # One ordinary step per entry of every for_each list, before the
+        # seed, the run id and the realized workflow are computed, so
+        # each covers what actually runs. A ForEachError here fails the
+        # run before anything loads
+        workflow_def = expand_for_each(workflow_def)
+
+        # Set up random seed for reproducibility. Resolved lazily - as a
+        # dict.get default, torch.seed() would run on every call and reseed
+        # the global RNG even when the workflow names an explicit seed
+        default_seed = workflow_def.get("seed")
+        # The schema lets 'seed' be a string so it can hold a 'variable:'
+        # reference, which the substitution above has already resolved -
+        # but a variable overridden from the command line arrives as a
+        # string whenever the workflow declared no integer default to
+        # coerce against, and manual_seed would fail deep inside the run
+        if isinstance(default_seed, str):
+            try:
+                default_seed = int(default_seed)
+            except ValueError:
+                raise ValueError(
+                    f"Workflow {workflow_id} seed must be an integer, "
+                    f"got {default_seed!r}"
+                )
+            workflow_def["seed"] = default_seed
+        return workflow_def, default_seed
+
+    def _cache_lookup(
+        self,
+        workflow_id,
+        steps,
+        index,
+        step_data,
+        step_seed,
+        hits_this_run,
+        cache_enabled,
+    ):
+        """Whether the step cache serves step `index`, as (cached_result or
+        None, the step_data snapshot the entry is keyed on or None, whether
+        a later step still reads this one's result, the names later steps
+        still reference). Shared by run() and cache_hits() - see
+        _prepare_definition for why.
+        """
+        # What later steps still read, which decides both whether this
+        # step's result has to be kept alive after the step (release_unreferenced_results
+        # at the bottom of the run loop) and whether a cached entry that
+        # kept none can serve this run
+        remaining_refs = referenced_result_names(steps[index + 1 :])
+        result_needed = index == len(steps) - 1 or any(
+            reference_resolves_to(ref, step_data["name"]) for ref in remaining_refs
+        )
+        # create_step_action (and the pipeline load it triggers) mutates
+        # step_data in place - injecting a "generator" key - so the cache
+        # must key off a snapshot taken before that happens, and that same
+        # snapshot must be reused for the put() later. Caching off the live,
+        # later-mutated step_data would make every step's dict keys diverge
+        # from a freshly deep-copied future run's step_data, so get() would
+        # never match again after the first run.
+        # A sub-workflow step is never cacheable: its files roll up from the
+        # child's own manifest, which a hit does not rebuild.
+        is_cacheable = "workflow" not in step_data and cache_enabled
+        # The last step of a composed child whose parent does the saving
+        # (#92) - its files are the parent step's, written once, under the
+        # parent's name and subfolder
+        parent_saves_this = self._final_save_owned_by_parent and index == len(steps) - 1
+        step_data_snapshot = None
+        if is_cacheable:
+            try:
+                step_data_snapshot = copy.deepcopy(step_data)
+                if parent_saves_this:
+                    # Keyed apart from the same step run standalone: this
+                    # entry's result was never saved here, so a standalone
+                    # hit on it would report no files
+                    step_data_snapshot["__saved_by_parent__"] = True
+            except Exception as ex:
+                # A realized argument that cannot be deep-copied (an open
+                # handle, a live model object) just means this step is not
+                # cacheable - never a failed run
+                logger.debug(
+                    f"Step '{step_data['name']}' arguments are not copyable "
+                    f"({ex}) - skipping the step cache for it"
+                )
+                is_cacheable = False
+        if not is_cacheable:
+            return None, None, result_needed, remaining_refs
+        cached_result = step_cache.get(
+            workflow_id,
+            step_data_snapshot,
+            step_seed,
+            hits_this_run,
+            # The root, not this run's directory: a hit reports the earlier
+            # run's files and writes nothing new, so keying on a directory
+            # that is new every run would mean the cache could never hit
+            # again. What the root still guards is a run redirected
+            # somewhere else, where the earlier files are not what the
+            # caller asked for
+            self.output_dir,
+            needs_result=result_needed,
+        )
+        return cached_result, step_data_snapshot, result_needed, remaining_refs
+
+    def cache_hits(self, arguments):
+        """The steps the step cache would serve for a run with `arguments`,
+        in step order - what the plan reports as cached_steps (#85).
+
+        Prepares the definition exactly as run() does and asks the cache the
+        question run() asks, step by step with the hits so far, and executes
+        nothing: no run directory, no events, no pipeline. An unseeded
+        workflow has no cache, so it answers [] without asking.
+        """
+        output_root_token = activate_output_root(self.output_dir)
+        try:
+            workflow_def = copy.deepcopy(self.workflow_definition)
+            workflow_id = workflow_def["id"]
+            base_dir = (
+                os.path.dirname(os.path.abspath(self.file_spec))
+                if self.file_spec
+                else None
+            )
+            workflow_def, default_seed = self._prepare_definition(
+                workflow_def, arguments or {}, base_dir
+            )
+            if default_seed is None or not self._cache_enabled_by_parent:
+                return []
+            steps = workflow_def.get("steps", [])
+            realize_args(steps, base_dir)
+            hits_this_run = set()
+            hits = []
+            for index, step_data in enumerate(steps):
+                step_seed = step_data.get("seed", default_seed)
+                cached_result, _, _, _ = self._cache_lookup(
+                    workflow_id,
+                    steps,
+                    index,
+                    step_data,
+                    step_seed,
+                    hits_this_run,
+                    True,
+                )
+                if cached_result is not None:
+                    hits_this_run.add(step_data["name"])
+                    hits.append(step_data["name"])
+            return hits
+        finally:
+            deactivate_output_root(output_root_token)
+
     def run(
         self, arguments, previous_pipelines=None, context=None, prior_step_keys=None
     ):
@@ -706,51 +881,9 @@ def run(
                 else None
             )
 
-            # Handle variable substitution if variables are defined
-            variables = workflow_def.get("variables", None)
-            if variables is not None:
-                logger.debug(f"Setting variables for workflow: {workflow_id}")
-                # a constant is the value a variable declares, so it resolves before
-                # anything is converted to the type of that declaration
-                realize_constants(variables)
-                # first set variable values base don the arguments passed to the workflow
-                # these may come form the command line or form a parent workflow
-                set_variables(arguments, variables)
-                # an entry of a list-valued variable may name another
-                # variable; resolve those before anything inside it is
-                # realized, so a reference type in an entry is a type name
-                variables = resolve_variable_values(variables)
-                # realize the variables, initialiting downloads of images etc
-                realize_args(variables, base_dir)
-                ## then replace any variable references in the workflow definition with the actual values
-                # replace_variables returns a new structure rather than mutating in
-                # place, so the result must be captured here
-                workflow_def = replace_variables(workflow_def, variables)
-
-            # One ordinary step per entry of every for_each list, before the
-            # seed, the run id and the realized workflow are computed, so
-            # each covers what actually runs. A ForEachError here fails the
-            # run before anything loads
-            workflow_def = expand_for_each(workflow_def)
-
-            # Set up random seed for reproducibility. Resolved lazily - as a
-            # dict.get default, torch.seed() would run on every call and reseed
-            # the global RNG even when the workflow names an explicit seed
-            default_seed = workflow_def.get("seed")
-            # The schema lets 'seed' be a string so it can hold a 'variable:'
-            # reference, which the substitution above has already resolved -
-            # but a variable overridden from the command line arrives as a
-            # string whenever the workflow declared no integer default to
-            # coerce against, and manual_seed would fail deep inside the run
-            if isinstance(default_seed, str):
-                try:
-                    default_seed = int(default_seed)
-                except ValueError:
-                    raise ValueError(
-                        f"Workflow {workflow_id} seed must be an integer, "
-                        f"got {default_seed!r}"
-                    )
-                workflow_def["seed"] = default_seed
+            workflow_def, default_seed = self._prepare_definition(
+                workflow_def, arguments, base_dir
+            )
             # A workflow that names no seed gets a fresh one every run, so no
             # step's cache entry can ever match again - skip the cache
             # wholesale rather than deep-copying every step's realized images
@@ -884,69 +1017,22 @@ def run(
 
                 step = Step(step_data, step_seed, self.workflow_definition)
 
-                # What later steps still read, which decides both whether
-                # this step's result has to be kept alive after the step
-                # (below, and release_unreferenced_results at the bottom of
-                # the loop) and whether a cached entry that kept none can
-                # serve this run
-                remaining_refs = referenced_result_names(steps[i + 1 :])
-                result_needed = i == len(steps) - 1 or any(
-                    reference_resolves_to(ref, step_data["name"])
-                    for ref in remaining_refs
-                )
-
-                # create_step_action (and the pipeline load it triggers)
-                # mutates step_data in place - injecting a "generator" key -
-                # so the cache must key off a snapshot taken before that
-                # happens, and that same snapshot must be reused for the
-                # put() below. Caching off the live, later-mutated step_data
-                # would make every step's dict keys diverge from a freshly
-                # deep-copied future run's step_data, so get() would never
-                # match again after the first run.
-                # A sub-workflow step is never cacheable: its files roll up
-                # from the child's own manifest, which a hit does not rebuild.
-                is_cacheable = "workflow" not in step_data and cache_enabled_this_run
-                # The last step of a composed child whose parent does the
-                # saving (#92) - its files are the parent step's, written
-                # once, under the parent's name and subfolder
-                parent_saves_this = (
-                    self._final_save_owned_by_parent and i == len(steps) - 1
-                )
-                step_data_snapshot = None
-                if is_cacheable:
-                    try:
-                        step_data_snapshot = copy.deepcopy(step_data)
-                        if parent_saves_this:
-                            # Keyed apart from the same step run standalone:
-                            # this entry's result was never saved here, so a
-                            # standalone hit on it would report no files
-                            step_data_snapshot["__saved_by_parent__"] = True
-                    except Exception as ex:
-                        # A realized argument that cannot be deep-copied (an
-                        # open handle, a live model object) just means this
-                        # step is not cacheable - never a failed run
-                        logger.debug(
-                            f"Step '{step.name}' arguments are not copyable "
-                            f"({ex}) - skipping the step cache for it"
-                        )
-                        is_cacheable = False
-                cached_result = (
-                    step_cache.get(
+                cached_result, step_data_snapshot, result_needed, remaining_refs = (
+                    self._cache_lookup(
                         workflow_id,
-                        step_data_snapshot,
+                        steps,
+                        i,
+                        step_data,
                         step_seed,
                         hits_this_run,
-                        # The root, not this run's directory: a hit reports
-                        # the earlier run's files and writes nothing new, so
-                        # keying on a directory that is new every run would
-                        # mean the cache could never hit again. What the root
-                        # still guards is a run redirected somewhere else,
-                        # where the earlier files are not what the caller asked for
-                        self.output_dir,
-                        needs_result=result_needed,
+                        cache_enabled_this_run,
                     )
-                    if is_cacheable
-                    else None
+                )
+                is_cacheable = step_data_snapshot is not None
+                # The last step of a composed child whose parent does the
+                # saving (#92) - its files are written once, by the parent
+                parent_saves_this = (
+                    self._final_save_owned_by_parent and i == len(steps) - 1
                 )
 
                 # A hit skips the step's work, never its bookkeeping:
@@ -1374,7 +1460,7 @@ def create_step_action(
                 # An unconfined run (no workflow_dir - a bare CLI
                 # invocation) used to rely on the '..' regex alone to stop a
                 # relative reference from leaving the file's own directory;
-                # normalising the path removes that guard, so confine it to
+                # normalizing the path removes that guard, so confine it to
                 # the catalog root instead - the referencing file's nearest
                 # ancestor literally named 'workflows', which still lets it
                 # climb to a sibling folder like models/ but not out of the
@@ -1398,7 +1484,7 @@ def create_step_action(
                 logger.error(f"Security validation failed for sub-workflow {path}: {e}")
                 raise
 
-            # this is where the arguments in the paretn script are passed to the child workflow
+            # this is where the arguments in the parent script are passed to the child workflow
             # they will already be populated with values from previous steps or parent variables
             workflow.workflow_definition["argument_template"] = workflow_reference.get(
                 "arguments", {}
diff --git a/dw/workflow_schema.json b/dw/workflow_schema.json
index 3ba5338a..37884d58 100644
--- a/dw/workflow_schema.json
+++ b/dw/workflow_schema.json
@@ -1111,7 +1111,7 @@
                     "default": true
                 },
                 "file_base_name": {
-                    "description": "The base name for saving result and metadata files. A name, not a path - it may not contain a separator; to place a step's files in a subfolder of the run directory set 'subfolder'. The file extension is determined by context and content_type.",
+                    "description": "The base name for saving result and metadata files. It replaces the name the engine would derive from the workflow and step - it is not a prefix on one - so a caller that sets it can predict the file name. That derived name is what makes two steps' files distinct, so give each step that sets one a different value, or the second collides and gets a '-2' counter. A name, not a path - it may not contain a separator; to place a step's files in a subfolder of the run directory set 'subfolder'. The file extension is determined by context and content_type.",
                     "type": "string"
                 },
                 "subfolder": {
diff --git a/dw/workflow_sources.py b/dw/workflow_sources.py
index 9646bbdd..62309d37 100644
--- a/dw/workflow_sources.py
+++ b/dw/workflow_sources.py
@@ -39,6 +39,25 @@ def builtin_root():
     return os.path.join(os.path.dirname(os.path.abspath(__file__)), "workflows")
 
 
+def catalog_root(directory):
+    """The nearest ancestor of `directory` literally named 'workflows', else
+    the directory itself.
+
+    The root a run with no workflow_dir of its own confines a relative
+    sub-workflow reference to, so a template under templates/ can still climb
+    to a sibling models/ without leaving the catalog. `catalog_root_dir`
+    (dw/workflow.py) is this rule asked for a file rather than a directory.
+    """
+    directory = os.path.normpath(os.path.abspath(directory))
+    parts = directory.split(os.sep)
+    try:
+        index = len(parts) - 1 - parts[::-1].index("workflows")
+    except ValueError:
+        return directory
+
+    return os.sep.join(parts[: index + 1])
+
+
 class WorkflowSource:
     """One root on the search path."""
 
@@ -223,7 +242,10 @@ def resolve_sub_workflow(path, base_dir, confine_to):
     An absolute path is taken as written and confined to whichever root
     holds it, so the sandbox still refuses one that belongs to no source.
 
-    Raises SubWorkflowNotFound, naming every candidate it looked at.
+    A relative path that climbs out of the root it will be handed back with is
+    a PathTraversalError rather than a SubWorkflowNotFound - a refusal, not a
+    name that was absent. Otherwise raises SubWorkflowNotFound, naming every
+    candidate it looked at.
     """
     roots = []
     if confine_to:
@@ -245,8 +267,26 @@ def resolve_sub_workflow(path, base_dir, confine_to):
         return candidate, confine_to
 
     if base_dir:
+        # The root this candidate would be handed back with: the caller's
+        # confinement when it named one, else the catalog root the run itself
+        # would confine to. Containment is checked before the stat, so a name
+        # that climbs out of the catalog is never even looked at - which is
+        # what the callers' own validate_workflow_path caught a step too late,
+        # leaving this `os.path.isfile` the dw/path-injection query's only
+        # unguarded sink. A climb out is refused rather than reported as
+        # absent, the distinction the search path below keeps: the
+        # PathTraversalError propagates to the caller
+        root = confine_to or catalog_root(base_dir)
         for name in _candidate_names(path):
-            candidate = os.path.normpath(os.path.join(base_dir, name))
+            # normpath first: validate_path refuses a '..' outright, so a
+            # climb that stays inside the root has to be collapsed before it
+            # is judged. Its return value is what gets stat'ed - and being
+            # the validator's own, it is contained by construction
+            candidate = validate_path(
+                os.path.normpath(os.path.join(base_dir, name)),
+                root,
+                allow_create=True,
+            )
             tried.append(candidate)
             if os.path.isfile(candidate):
                 return candidate, confine_to
diff --git a/dw_mcp/CLAUDE.md b/dw_mcp/CLAUDE.md
index b186c6c5..329d9315 100644
--- a/dw_mcp/CLAUDE.md
+++ b/dw_mcp/CLAUDE.md
@@ -44,7 +44,12 @@ them testable without an MCP session. It is a top-level package rather than
 and pulls in torch, which a pure HTTP client has no use for — a test guards
 that boundary. Seven tools require `acknowledged_cost=True`
 (`run_workflow`, `rerun_job`, `enhance_prompt`, `download_model`,
-`delete_model`, `update_diffusers`, `delete_workspace`); the three job-queuing tools return as
+`delete_model`, `update_diffusers`, `delete_workspace`); `run_workflow` and
+`rerun_job` also take the acknowledgement *bound* to the plan
+`validate_workflow` answered with - `{fingerprint, minutes, downloads}`,
+forwarded verbatim, which the server refuses with 409 when the run's shape
+changed since (`_acknowledgement_body` in `diagnose.py`; the 409 is rendered
+with the new estimate by `DwClient._format_detail`). The three job-queuing tools return as
 soon as the job is queued, since a generation outlasts any client's tool-call
 timeout. Authoring has two halves: `get_schema` describes a workflow and
 `get_prompt_schema` a stored prompt, which a workflow reaches by
diff --git a/dw_mcp/catalog.py b/dw_mcp/catalog.py
index a3c8b76c..7b6d50c1 100644
--- a/dw_mcp/catalog.py
+++ b/dw_mcp/catalog.py
@@ -15,6 +15,12 @@ def list_workflows(
     only unless `include_models` or `configures` asks for the model configs
     of one template. `get_workflow` has the full definition.
 
+    Called with no filter at all, each entry is cut to its summary and
+    shape (`view: "summary"`), because the whole catalog in full detail is
+    ~6.8k tokens for a question that is really "which shape do I want"
+    (#101). Pass `shape` - which the instructions ask for anyway - and the
+    entries come back whole.
+
     `cost_basis` in the answer says what a `cost` is: `curated` means a
     maintainer measured it once, on the devices the entry names, and wrote
     it into the workflow. Nothing derives one from this server's own job
@@ -34,7 +40,45 @@ def list_workflows(
         params["configures"] = configures
     if include_models:
         params["include_models"] = "true"
-    return client.get_json("/api/workflows", params=params)
+    answer = client.get_json("/api/workflows", params=params)
+    if not (shape or traits or configures or include_models):
+        return _summarised(answer)
+    return answer
+
+
+# What a summarised entry keeps: enough to choose a shape to ask about,
+# nothing that reading one needs
+SUMMARY_FIELDS = ("summary", "shape")
+
+
+def _summarised(answer):
+    """The unfiltered listing, each entry cut to its summary and shape.
+
+    The whole catalog in full compact detail is ~6.8k tokens - variables,
+    traits, cost and list fields for every workflow on the server, when
+    the question the call answers is "which of these is the shape I
+    want" (#101). Asking with a `shape` still gets the full entries, and
+    the note says so, so nothing is unreachable.
+    """
+    details = answer.get("details")
+    if not isinstance(details, dict):
+        return answer
+    summarised = {
+        name: {key: detail.get(key) for key in SUMMARY_FIELDS if key in detail}
+        for name, detail in details.items()
+        if isinstance(detail, dict)
+    }
+    return {
+        **answer,
+        "details": summarised,
+        "view": "summary",
+        "note": (
+            "Summarised because no `shape` was given: each entry is its "
+            "summary and shape only. Call list_workflows(shape=...) for "
+            "the full entries - variables, traits, cost and list fields - "
+            "of the shape you want."
+        ),
+    }
 
 
 def get_workflow(client, name, variables_only=False):
@@ -52,9 +96,15 @@ def get_workflow(client, name, variables_only=False):
     return client.get_json(api_path("api", "workflows", name))
 
 
-def get_schema(client):
-    """The workflow JSON schema every definition is validated against."""
-    return client.get_json("/api/schema")
+def get_schema(client, section=None):
+    """The workflow JSON schema every definition is validated against.
+
+    Whole it is ~8.6k tokens, so name the part you need: `section` takes
+    `steps`, `pipelines`, `tasks`, `result`, `variables` or
+    `configuration` and answers that fragment plus `elsewhere`, which says
+    which section holds each definition it still references."""
+    params = {"section": section} if section else None
+    return client.get_json("/api/schema", params=params)
 
 
 def list_pipelines(client):
diff --git a/dw_mcp/client.py b/dw_mcp/client.py
index 7fe20c1c..725a9166 100644
--- a/dw_mcp/client.py
+++ b/dw_mcp/client.py
@@ -1,6 +1,7 @@
 """HTTP access to a running dw.serve, and the single place an API failure
 becomes a message a non-developer can act on."""
 
+import json
 import os
 import tempfile
 from urllib.parse import quote
@@ -343,6 +344,50 @@ def _format_detail(self, detail):
             entries = detail.get("entries")
             if isinstance(entries, list) and entries:
                 formatted += f" Also holds: {', '.join(str(e) for e in entries)}."
+            plan = detail.get("plan")
+            if isinstance(plan, dict):
+                # A 409 from the cost gate: say what the run costs now, so a
+                # client that only sees the message can re-quote from it
+                estimate = plan.get("estimate") or {}
+                if estimate.get("minutes") is None:
+                    formatted += (
+                        f" It now has no measured estimate (basis "
+                        f"{estimate.get('basis')})"
+                    )
+                else:
+                    formatted += (
+                        f" It now estimates {estimate.get('minutes')} minutes "
+                        f"(basis {estimate.get('basis')})"
+                    )
+                downloads = [
+                    entry.get("repo") or entry.get("url")
+                    for entry in plan.get("downloads_required") or []
+                ]
+                if downloads:
+                    formatted += f", and would download {', '.join(downloads)} first"
+                # The shape to resend, not just the new fingerprint: a
+                # client reading only the message can re-acknowledge from it
+                minutes = estimate.get("minutes")
+                repos = [
+                    entry.get("repo")
+                    for entry in plan.get("downloads_required") or []
+                    if entry.get("repo")
+                ]
+                # json.dumps for the whole object, not an f-string per field:
+                # an inline workflow has no measured estimate, so `minutes` is
+                # None far more often than not, and Python's repr of it is not
+                # JSON a client could paste back (#107)
+                formatted += (
+                    ". Re-acknowledge with "
+                    + json.dumps(
+                        {
+                            "fingerprint": plan.get("fingerprint"),
+                            "minutes": minutes,
+                            "downloads": repos,
+                        }
+                    )
+                    + "."
+                )
             return formatted
         if isinstance(detail, list):
             messages = []
diff --git a/dw_mcp/diagnose.py b/dw_mcp/diagnose.py
index 2c4c7c48..0153bf19 100644
--- a/dw_mcp/diagnose.py
+++ b/dw_mcp/diagnose.py
@@ -24,12 +24,44 @@
 
 COST_REFUSAL = (
     "Running a workflow occupies the GPU for minutes and the engine runs one "
-    "job at a time. Tell the user what is about to run, get their go-ahead, "
-    "then call again with acknowledged_cost=true. `validate_workflow` is free "
-    "and checks the definition first."
+    "job at a time. Call `validate_workflow` with the arguments you will run "
+    "with (free): its `plan` says what will execute - `estimate.minutes` with "
+    "its `basis`, and any weights in `downloads_required` this box has to "
+    "fetch first. Tell the user that number, get their go-ahead, then call "
+    'again with acknowledged_cost bound to the plan: {"fingerprint": '
+    'plan.fingerprint, "minutes": plan.estimate.minutes, "downloads": '
+    "[each non-null downloads_required repo]} - the server then refuses (409) if the "
+    "run's shape changed since. acknowledged_cost=true is for a `plan` that "
+    "was null."
 )
 
 
+def _acknowledgement_body(acknowledged_cost):
+    """What an acknowledgement adds to a request body: a bound one is the
+    dict itself, verbatim, so the server compares what the agent quoted; a
+    bare true is sent as true, so the job records `acknowledged: boolean`
+    rather than reading as one that never passed a gate at all (#85). A
+    dict without a fingerprint is a mistake caught here, before anything is
+    queued."""
+    if isinstance(acknowledged_cost, dict):
+        if not acknowledged_cost.get("fingerprint"):
+            raise DwApiError(
+                "A bound acknowledged_cost needs `fingerprint` - the "
+                "plan.fingerprint the validate answer carried. Validate again "
+                "and pass {fingerprint, minutes, downloads} from its plan."
+            )
+        # A from_single_file URL sits in downloads_required with repo: null;
+        # an agent copying the list verbatim should not earn a 422 for it
+        downloads = acknowledged_cost.get("downloads")
+        if isinstance(downloads, list):
+            acknowledged_cost = {
+                **acknowledged_cost,
+                "downloads": [repo for repo in downloads if repo],
+            }
+        return {"acknowledged_cost": acknowledged_cost}
+    return {"acknowledged_cost": bool(acknowledged_cost)}
+
+
 def run_workflow(
     client,
     workflow_path=None,
@@ -41,7 +73,12 @@ def run_workflow(
     """Queue a workflow. `workflow_path` is either a catalog name from
     `list_workflows` or a path to a workflow file on the server. Returns as
     soon as it is queued - it does not wait for the job to finish. Poll
-    `get_job_events` for progress."""
+    `get_job_events` for progress.
+
+    `acknowledged_cost` is true or, better, the plan it was quoted from:
+    {fingerprint, minutes, downloads} from `validate_workflow` - see
+    COST_REFUSAL. A bound one the server checks; a 409 means the run's
+    shape changed since the quote and the message carries the new plan."""
     if not acknowledged_cost:
         raise DwApiError(COST_REFUSAL)
     if (workflow_path is None) == (inline_workflow is None):
@@ -51,6 +88,7 @@ def run_workflow(
             "definition to run as-is)."
         )
     payload = {"arguments": arguments or {}}
+    payload.update(_acknowledgement_body(acknowledged_cost))
     if workflow_path is not None:
         payload["workflow_path"] = workflow_path
     else:
@@ -254,11 +292,16 @@ def rerun_job(client, job_id, acknowledged_cost=False, new_seed=False):
     it the arguments repeat exactly, and a seeded workflow's rerun is served
     whole from the step cache - the earlier run's files, republished in a
     fraction of a second, with `reused: true`. Ask for a new seed when the
-    point is a different image rather than the same one again."""
+    point is a different image rather than the same one again.
+
+    `acknowledged_cost` takes the same bound form as `run_workflow`; a
+    fresh seed never changes a fingerprint, so the original plan still
+    binds a new-seed rerun."""
     if not acknowledged_cost:
         raise DwApiError(COST_REFUSAL)
     return client.post_json(
-        api_path("api", "jobs", job_id, "rerun"), {"new_seed": new_seed}
+        api_path("api", "jobs", job_id, "rerun"),
+        {"new_seed": new_seed, **_acknowledgement_body(acknowledged_cost)},
     )
 
 
diff --git a/dw_mcp/guides.py b/dw_mcp/guides.py
index 8901c087..977e709f 100644
--- a/dw_mcp/guides.py
+++ b/dw_mcp/guides.py
@@ -23,7 +23,13 @@ def list_guides(client):
 
 
 def get_guide(client, name, section=None):
-    """One guide, whole or one section of it. A section name is matched
-    loosely on the server, so a heading copied approximately resolves."""
+    """One guide, or one section of it. A section name is matched loosely
+    on the server, so a heading copied approximately resolves.
+
+    Without a section the answer is the guide's index - its opening, its
+    first section, and `sections`/`withheld` naming the rest - not the
+    whole file: WORKFLOW_GUIDE.md whole is ~19.6k tokens, more in one call
+    than the entire tool surface costs to connect (#101). Name the section
+    you want."""
     params = {"section": section} if section is not None else None
     return client.get_json(api_path("api", "guides", name), params=params)
diff --git a/dw_mcp/server.py b/dw_mcp/server.py
index 2e0e1d82..979462b5 100644
--- a/dw_mcp/server.py
+++ b/dw_mcp/server.py
@@ -203,14 +203,20 @@ def get_workflow(name: str, variables_only: bool = False) -> dict:
         is named `shots[0].prompt`."""
         return catalog.get_workflow(client, name, variables_only=variables_only)
 
-    def get_schema() -> dict:
+    def get_schema(section: str | None = None) -> dict:
         """Get the JSON schema every workflow definition must satisfy - the
         authority on a workflow's structure: steps, pipelines, tasks,
         results, variables. Read it before authoring one from scratch, and
         note that schema validation runs before variable substitution, so a
         variable's default has to be the type its use expects (25, not
-        "25")."""
-        return catalog.get_schema(client)
+        "25").
+
+        Ask for the part you need: `section` takes `steps`, `pipelines`,
+        `tasks`, `result`, `variables` or `configuration` and answers that
+        fragment - a tenth the size - with `elsewhere` naming the section
+        that holds each definition it still references. The whole schema is
+        the no-argument call."""
+        return catalog.get_schema(client, section=section)
 
     def list_pipelines() -> dict:
         """List every diffusers pipeline class this installation provides.
@@ -274,12 +280,10 @@ def get_memory() -> dict:
         absent, rather than null, on a platform that cannot measure it.
 
         `host_pinned_reserved_mb` / `host_pinned_allocated_mb`, when
-        present, are torch's pinned-host cache - the staging buffers group
-        offloading moves weights through. They are part of
-        `host_memory_rss_mb` and invisible in every `gpu_*` figure, so a
-        worker that has released every model and still holds GB is usually
-        holding them (#98); they are returned when the worker switches to a
-        different workflow.
+        present, are torch's pinned-host cache and are part of
+        `host_memory_rss_mb` - see the `acceleration` guide, section
+        "Reading Memory While Offloading", for what that means for a worker
+        that has released every model and still holds gigabytes.
 
         `live: true` means `info` was measured now and is the worker's own
         memory - only these readings are comparable with each other.
@@ -326,7 +330,8 @@ def list_jobs(
         them - queued, running, succeeded, failed, cancelled. `workspace`
         lists one workspace's jobs; without it, a named workspace lists its
         own and the default workspace lists every job the server holds,
-        whichever workspace ran it."""
+        whichever workspace ran it. Each job carries `acknowledged` - `none`,
+        `boolean` or `bound` - which form of cost acknowledgement queued it."""
         return catalog.list_jobs(
             client, limit=limit, status=status, workspace=workspace
         )
@@ -394,11 +399,13 @@ def list_guides() -> dict:
         return guides.list_guides(client)
 
     def get_guide(name: str, section: str | None = None) -> dict:
-        """Get one guide from `list_guides`, whole or one section of it.
-        Prefer a section - a guide runs to thousands of lines, and the
-        headings in the listing are there so the right part can be asked
-        for by name. A section name is matched loosely, so a heading
-        copied approximately still resolves."""
+        """Get one guide from `list_guides`, or one section of it. Name the
+        section - a guide runs to thousands of lines, and the headings in
+        the listing are there so the right part can be asked for by name. A
+        section name is matched loosely, so a heading copied approximately
+        still resolves. Called without one, the answer is the guide's index
+        (its opening and first section, with `sections` and `withheld`
+        naming the rest), not the whole file."""
         return guides.get_guide(client, name, section=section)
 
     for fn in (
@@ -678,7 +685,20 @@ def validate_workflow(
         workflow it names is validated in turn under that path, a
         composition cycle is refused, and an argument passed down that the
         composed workflow declares no variable for comes back as a
-        warning."""
+        warning.
+
+        A valid answer carries `plan`: what will execute for these
+        arguments. Quote `plan.estimate.minutes` with its `basis` -
+        `per_entry` is a measured per-entry rate re-priced for your list,
+        `catalog` a measured total for a run whose lists are the ones it
+        was measured with, `derived` that total extrapolated over a list
+        you changed the length of (an estimate - say so), `other_device` a
+        figure from another accelerator (say so), `unknown` no figure at
+        all - and name each `downloads_required`
+        entry as its own line item ("and 41 GB of weights this box does not
+        have"); `gb` is null when the hub could not be asked. `steps` and
+        `list_entries` say how many members the list actually produced.
+        `plan` is null when it could not be built; the verdict stands."""
         return authoring.validate_workflow(
             client,
             workflow=workflow,
@@ -785,7 +805,7 @@ def run_workflow(
         workflow_path: str | None = None,
         inline_workflow: dict | None = None,
         arguments: dict | None = None,
-        acknowledged_cost: bool = False,
+        acknowledged_cost: bool | dict = False,
         workspace: str | None = None,
     ) -> dict:
         """Queue a workflow for generation. THIS COSTS GPU TIME: a run
@@ -801,7 +821,14 @@ def run_workflow(
         workflow serves many requests without being edited or copied.
         `workspace` names the workspace for this one call without switching
         the session to it - use it to pin a job whose `output:` or `asset:`
-        references live in a workspace other than the session's."""
+        references live in a workspace other than the session's.
+
+        Bind the acknowledgement to what you quoted: pass
+        {"fingerprint": plan.fingerprint, "minutes": plan.estimate.minutes,
+        "downloads": [...the non-null repos in plan.downloads_required]} from the
+        validate answer, and the server refuses with 409 - naming the new
+        plan - if the run's shape changed since; bare true is for a plan
+        that was null."""
         return diagnose.run_workflow(
             client,
             workflow_path=workflow_path,
@@ -820,7 +847,10 @@ def get_job(job_id: str) -> dict:
         the scratch work, and '' a step that said nothing. A step served
         from the step cache is marked `reused` and reports the earlier run's
         files. When a job failed, the error and traceback here are what to
-        read before changing anything."""
+        read before changing anything. `acknowledged` says which form of
+        cost acknowledgement queued the job (`none`, `boolean`, `bound`) and
+        `acknowledged_cost` is the bound `{fingerprint, minutes, downloads}`
+        when there was one."""
         return diagnose.get_job(client, job_id)
 
     def get_job_workflow(job_id: str) -> dict:
@@ -868,17 +898,12 @@ def wait_for_job(job_id: str, timeout_seconds: int = 20) -> dict:
         starts - which is how a slow run and a stuck one tell apart between
         two otherwise identical polls. A null `denoise_step` under
         `generating` is the pipeline's lead-in - encoding the prompt and
-        every reference - which emits nothing, and its length depends on
-        what it has to encode: on MiniMax H3 ~90 s for a prompt with an
-        image or audio reference, but ~10 min once a *video* reference is
-        among them (measured 629 s for one 5 s 960x544 clip on an RTX
-        3090). Wait it out rather than reading the silence as a hang.
-        Gaps between denoise steps are uneven too where a transformer
-        block cache is configured - most steps cheap, every few steps a
-        full one - so on H3 `seconds_since_event` of ~140 s with a number
-        in `denoise_step` is still healthy. The signal is whether
-        `denoise_step` has moved since a poll minutes ago, not silence
-        past a fixed threshold."""
+        every reference - which emits nothing and can run for many minutes
+        when a video reference is among them; gaps between denoise steps
+        are uneven too where a transformer block cache is configured. Both
+        are normal, and the model family's own skill carries the measured
+        figures. The signal is whether `denoise_step` has moved since a
+        poll minutes ago, not silence past a fixed threshold."""
         return diagnose.wait_for_job(client, job_id, timeout_seconds=timeout_seconds)
 
     # The cap is a number a caller paces against, so the description states
@@ -895,7 +920,7 @@ def cancel_job(job_id: str) -> dict:
         return diagnose.cancel_job(client, job_id)
 
     def rerun_job(
-        job_id: str, acknowledged_cost: bool = False, new_seed: bool = False
+        job_id: str, acknowledged_cost: bool | dict = False, new_seed: bool = False
     ) -> dict:
         """Queue a fresh job from a previous job's stored specification. THIS
         COSTS GPU TIME: a rerun is a run - it occupies the machine for
@@ -905,7 +930,11 @@ def rerun_job(
         Pass new_seed=true for a different image: a workflow that pins its
         seed reruns to the same pixels, and the step cache serves that whole
         run from the earlier one's files (marked `reused`) in a fraction of a
-        second rather than generating anything."""
+        second rather than generating anything.
+
+        `acknowledged_cost` takes the same bound form as run_workflow; a
+        fresh seed never changes the fingerprint, so the original plan still
+        binds a new_seed rerun."""
         return diagnose.rerun_job(
             client,
             job_id,
diff --git a/plugins/dw/skills/ltx-2.5/SKILL.md b/plugins/dw/skills/ltx-2.5/SKILL.md
index 5c896642..d97caf2f 100644
--- a/plugins/dw/skills/ltx-2.5/SKILL.md
+++ b/plugins/dw/skills/ltx-2.5/SKILL.md
@@ -125,13 +125,14 @@ AESTHETIC QUALITY (in addition to the above, without breaking the objective capt
 
 1. `validate_workflow` first - free, and it catches arguments the pipeline
    rejects.
-2. Quote the listing's `cost` - the run's whole wall clock, model loading
-   included. Only `templates/ltx2/text-to-video` and `templates/ltx2/two-stage`
-   declare one; for the other six say so and give the shape of the spend
+2. Quote `plan.estimate` from the validate answer (whole wall clock, loading
+   included) and name any `downloads_required`. Only `text-to-video` and
+   `two-stage` carry a `cost`; for the other six say so and give the shape
    instead - a 121-frame clip at 960x544 is under two minutes cold on a 24 GB
    card, of which a minute is loading, the two-stage flow about eight, and
    extend and chain multiply by their passes. Either way get the go-ahead
-   before `run_workflow` with `acknowledged_cost=true`.
+   before `run_workflow` with `acknowledged_cost` set to the plan's
+   `{fingerprint, minutes, downloads}`.
 3. `wait_for_job`, then `get_job` for the manifest. The write-out runs after
    the last step ends and names each file as it starts it - seconds for a
    121-frame clip since 2026-09-14, minutes before that (#97).
diff --git a/plugins/dw/skills/minimax-h3/SKILL.md b/plugins/dw/skills/minimax-h3/SKILL.md
index 1a7449b9..212e434b 100644
--- a/plugins/dw/skills/minimax-h3/SKILL.md
+++ b/plugins/dw/skills/minimax-h3/SKILL.md
@@ -155,26 +155,27 @@ inherits the portrait's composition.
 ## Run and judge
 
 1. `validate_workflow` first - free, and it catches arguments the pipeline
-   does not accept.
-2. Quote the listing's `cost` (warm minutes on the card it was measured on;
-   a first load is longer). When it declares none, say so and give the shape
-   instead: a 124-frame turbo clip is a few minutes on a 24 GB card, 345
+   rejects.
+2. Quote `plan.estimate` from the validate answer (warm minutes; a first
+   load or a `downloads_required` is longer). When `basis` is `unknown`,
+   say so and give the shape instead: a 124-frame turbo clip is a few minutes on a 24 GB card, 345
    frames three times that, an image reference twice a turbo clip, a video
    reference beside it 3.4x again, and a chain multiplies by its segments.
-   Get the user's go-ahead before `run_workflow` with `acknowledged_cost=true`.
+   Get the go-ahead, then `run_workflow` with `acknowledged_cost` = the
+   plan's `{fingerprint, minutes, downloads}`.
 3. `wait_for_job`, then `get_job` for the manifest. A cancelled H3 job runs
-   on to its next step boundary, minutes on this model. Silence is not a hang:
-   `denoise_step` is null through the reference encode (~90 s, ~10 min with a
-   video reference), and the block cache makes later steps uneven - two-minute
-   gaps are healthy. Each entry carries
+   on to its next step boundary, minutes on this model. Silence is no hang:
+   `denoise_step` is null through the reference encode (~90 s; 629 s for one
+   5 s 960x544 video reference on a 3090), and the block cache makes later
+   steps uneven - two-minute gaps are healthy. Each entry carries
    `subfolder`: `final` is the deliverable (`episode`, `music_video`,
    `voyage`), `intermediate` the scratch; keep that split in anything you
    compose.
 4. You cannot watch a video: no tool returns a frame from one. Hand the user
    the gallery `url` (`list_gallery`, or the manifest's file name) and ask them
    to look, and check what you can yourself - `get_job` for the manifest and
-   its warnings, `get_gallery_metadata` for duration, size and whether an audio
-   stream is present. `get_output_image` works only on image steps, which in
+   its warnings, `get_gallery_metadata` for duration, size and whether audio
+   is present. `get_output_image` works only on image steps, which in
    this family are the Z-Image portraits and boards of
    `templates/minimax/dialogue-short`, `templates/minimax/storyboard`,
    `templates/minimax/generated-subject-reference` and
@@ -189,8 +190,8 @@ inherits the portrait's composition.
    it, so the next run is by name rather than pasted JSON; `export_job` bundles
    the run — workflow, manifest, job row and media — for git. It is on the
    server: fetch its zip URL and unpack it into `exports/` under the session's
-   working directory, never a temp directory; the archive already unpacks into
-   a job-id folder, so do not make one first.
+   working directory, never a temp dir; the archive unpacks into a job-id
+   folder, so do not make one first.
 
 ## Sources
 
diff --git a/plugins/dw/skills/minimax-music3/SKILL.md b/plugins/dw/skills/minimax-music3/SKILL.md
index 76f5547f..0bb56537 100644
--- a/plugins/dw/skills/minimax-music3/SKILL.md
+++ b/plugins/dw/skills/minimax-music3/SKILL.md
@@ -128,12 +128,13 @@ Control" section.
 
 1. `validate_workflow` first - free, and it catches arguments the pipeline
    does not accept.
-2. Quote the listing's `cost` (warm minutes on the card it was measured on;
-   a first load is longer). When the listing declares none, say so and give
+2. Quote `plan.estimate` from the validate answer (warm minutes on the card it
+   was measured on; a first load is longer). When `basis` is `unknown`, say so and give
    the shape of the spend: the autoregressive stage runs at 25 frames per
    second of audio and dominates, so time scales with the length the model
    actually sings, not the ceiling. Get the user's go-ahead before
-   `run_workflow` with `acknowledged_cost=true`.
+   `run_workflow` with `acknowledged_cost` set to the plan's
+   `{fingerprint, minutes, downloads}`.
 3. `wait_for_job`, then `get_job` for the manifest. Each manifest entry
    carries `subfolder`: `templates/minimax/music-video` puts the cut in
    `final` and the song, the singer's portrait and each shot in
diff --git a/tests/test_jobs_listing.py b/tests/test_jobs_listing.py
index 61708df4..4c888d8d 100644
--- a/tests/test_jobs_listing.py
+++ b/tests/test_jobs_listing.py
@@ -39,6 +39,7 @@ class Row:
         events = []
         run_id = None
         run_dir = None
+        acknowledged = "none"
 
     row = Row()
     row.status = status
diff --git a/tests/test_mcp_catalog.py b/tests/test_mcp_catalog.py
index 4e36b9ff..f576abff 100644
--- a/tests/test_mcp_catalog.py
+++ b/tests/test_mcp_catalog.py
@@ -120,7 +120,44 @@ def test_list_gallery_sends_a_subfolder_only_when_given():
 def test_a_pass_through_tool_returns_the_body_unchanged():
     client, _seen = recording_client({"workflows": ["a"], "details": {}})
 
-    assert catalog.list_workflows(client) == {"workflows": ["a"], "details": {}}
+    assert catalog.list_workflows(client)["workflows"] == ["a"]
+
+
+FULL_ENTRY = {
+    "summary": "a cut sequence",
+    "shape": "sequence",
+    "traits": ["has-audio"],
+    "cost": [{"device": "cuda", "minutes": 42}],
+    "kinds": ["video/mp4"],
+    "variable_names": ["shots", "seed"],
+    "lists": {"shots": ["name", "prompt"]},
+}
+
+
+def test_an_unfiltered_listing_is_summarised():
+    """The whole catalog in full detail is ~6.8k tokens for a question
+    that is really 'which shape do I want' (#101)."""
+    client, _seen = recording_client(
+        {"workflows": ["a"], "details": {"a": dict(FULL_ENTRY)}}
+    )
+
+    answer = catalog.list_workflows(client)
+
+    assert answer["details"]["a"] == {"summary": "a cut sequence", "shape": "sequence"}
+    assert answer["view"] == "summary"
+    assert "shape" in answer["note"]
+    assert answer["workflows"] == ["a"]
+
+
+def test_a_listing_asked_for_by_shape_comes_back_whole():
+    client, _seen = recording_client(
+        {"workflows": ["a"], "details": {"a": dict(FULL_ENTRY)}}
+    )
+
+    answer = catalog.list_workflows(client, shape="sequence")
+
+    assert answer["details"]["a"] == FULL_ENTRY
+    assert "note" not in answer
 
 
 def test_list_workflows_always_asks_for_the_compact_view():
diff --git a/tests/test_mcp_client.py b/tests/test_mcp_client.py
index 9c60b286..51236e39 100644
--- a/tests/test_mcp_client.py
+++ b/tests/test_mcp_client.py
@@ -423,3 +423,48 @@ def handler(request):
 
     client_with(handler).get_json("/api/health")
     assert seen["auth"] is None
+
+
+def _cost_gate_message(minutes):
+    """The 409 the cost gate raises, formatted the way an MCP caller reads it."""
+
+    def handler(request):
+        return httpx.Response(
+            409,
+            json={
+                "detail": {
+                    "message": "The plan changed since it was acknowledged.",
+                    "plan": {
+                        "fingerprint": "sha256:abc",
+                        "estimate": {"minutes": minutes, "basis": "none"},
+                        "downloads_required": [{"repo": "org/model"}],
+                    },
+                }
+            },
+        )
+
+    with pytest.raises(DwApiError) as caught:
+        client_with(handler).get_json("/api/jobs")
+    return str(caught.value)
+
+
+def test_reacknowledge_object_is_json_not_a_python_repr():
+    # An inline workflow has no measured estimate, so this is the common 409,
+    # and the sentence invites the reader to resend what it prints (#107)
+    import json
+
+    message = _cost_gate_message(None)
+    payload = message.split("Re-acknowledge with ", 1)[1].rstrip(".")
+    assert json.loads(payload) == {
+        "fingerprint": "sha256:abc",
+        "minutes": None,
+        "downloads": ["org/model"],
+    }
+    assert "None" not in payload
+
+
+def test_reacknowledge_object_carries_a_measured_estimate():
+    import json
+
+    payload = _cost_gate_message(12.5).split("Re-acknowledge with ", 1)[1].rstrip(".")
+    assert json.loads(payload)["minutes"] == 12.5
diff --git a/tests/test_mcp_diagnose.py b/tests/test_mcp_diagnose.py
index 230fad9b..9cc759a2 100644
--- a/tests/test_mcp_diagnose.py
+++ b/tests/test_mcp_diagnose.py
@@ -504,3 +504,167 @@ def test_run_sends_the_session_workspace_when_none_is_named():
     diagnose.run_workflow(client, workflow_path="w", acknowledged_cost=True)
 
     assert seen[0]["params"]["workspace"] == "music-video"
+
+
+def test_the_refusal_says_to_quote_the_plan():
+    from dw_mcp.diagnose import COST_REFUSAL
+
+    assert "plan" in COST_REFUSAL
+    assert "validate_workflow" in COST_REFUSAL
+
+
+BOUND = {"fingerprint": "sha256:abc", "minutes": 4.0, "downloads": ["org/x"]}
+
+
+def test_run_forwards_a_bound_acknowledgement_verbatim():
+    import json
+
+    client, seen = submitting()
+    diagnose.run_workflow(client, workflow_path="w.json", acknowledged_cost=BOUND)
+    assert json.loads(seen[0]["body"])["acknowledged_cost"] == BOUND
+
+
+def test_run_sends_a_bare_true_so_the_job_records_the_form():
+    """The boolean gate is this layer's, but the server still has to record
+    which form queued the job - it read `none` for a bare true while the
+    body omitted it (#85)."""
+    import json
+
+    client, seen = submitting()
+    diagnose.run_workflow(client, workflow_path="w.json", acknowledged_cost=True)
+    assert json.loads(seen[0]["body"])["acknowledged_cost"] is True
+
+
+def test_rerun_sends_a_bare_true_so_the_job_records_the_form():
+    import json
+
+    client, seen = scripted(
+        {("POST", "/api/jobs/job-1/rerun"): (201, {"id": "job-2", "status": "queued"})}
+    )
+    diagnose.rerun_job(client, "job-1", acknowledged_cost=True)
+    assert json.loads(seen[0]["body"])["acknowledged_cost"] is True
+
+
+def test_run_refuses_a_bound_form_without_a_fingerprint():
+    client, seen = submitting()
+    with pytest.raises(DwApiError, match="fingerprint"):
+        diagnose.run_workflow(
+            client, workflow_path="w.json", acknowledged_cost={"minutes": 4}
+        )
+    assert seen == []
+
+
+def test_run_refuses_an_empty_dict_as_unacknowledged():
+    client, seen = submitting()
+    with pytest.raises(DwApiError, match="acknowledged_cost"):
+        diagnose.run_workflow(client, workflow_path="w.json", acknowledged_cost={})
+    assert seen == []
+
+
+def test_a_409_surfaces_with_the_new_estimate():
+    client, _seen = scripted(
+        {
+            ("POST", "/api/jobs"): (
+                409,
+                {
+                    "detail": {
+                        "message": "The run's shape changed since it was "
+                        "acknowledged: the workflow or its arguments differ "
+                        "from what was validated",
+                        "reason": "fingerprint",
+                        "acknowledged": BOUND,
+                        "plan": {
+                            "fingerprint": "sha256:def",
+                            "steps": 6,
+                            "list_entries": {"shots": 5},
+                            "cached_steps": None,
+                            "downloads_required": [{"repo": "org/y", "gb": 3.5}],
+                            "estimate": {
+                                "minutes": 19.0,
+                                "basis": "per_entry",
+                                "device": "cuda",
+                                "measured_on": "card",
+                                "partial": False,
+                            },
+                        },
+                    }
+                },
+            )
+        }
+    )
+    with pytest.raises(DwApiError) as caught:
+        diagnose.run_workflow(client, workflow_path="w.json", acknowledged_cost=BOUND)
+    message = str(caught.value)
+    assert "shape changed" in message
+    assert "19.0" in message and "per_entry" in message
+    assert "org/y" in message
+    # The shape to resend, not just the new fingerprint (#85)
+    assert '"fingerprint": "sha256:def"' in message
+    assert '"minutes": 19.0' in message
+    assert '"downloads": ["org/y"]' in message
+    assert "sha256:def" in message
+
+
+def test_rerun_forwards_a_bound_acknowledgement():
+    import json
+
+    client, seen = scripted({("POST", "/api/jobs/job-1/rerun"): (201, SUBMITTED)})
+    diagnose.rerun_job(client, "job-1", acknowledged_cost=BOUND, new_seed=True)
+    body = json.loads(seen[0]["body"])
+    assert body["acknowledged_cost"] == BOUND and body["new_seed"] is True
+
+
+def test_the_refusal_teaches_the_bound_form():
+    from dw_mcp.diagnose import COST_REFUSAL
+
+    assert "fingerprint" in COST_REFUSAL
+
+
+def test_a_null_download_entry_is_dropped_before_sending():
+    """A `from_single_file` URL sits in downloads_required with repo: null;
+    an agent copying the list verbatim must not earn a 422 for it."""
+    import json
+
+    client, seen = submitting()
+    diagnose.run_workflow(
+        client,
+        workflow_path="w.json",
+        acknowledged_cost={"fingerprint": "sha256:abc", "downloads": ["org/x", None]},
+    )
+    assert json.loads(seen[0]["body"])["acknowledged_cost"]["downloads"] == ["org/x"]
+
+
+def test_a_409_without_a_measured_estimate_says_so():
+    client, _seen = scripted(
+        {
+            ("POST", "/api/jobs"): (
+                409,
+                {
+                    "detail": {
+                        "message": "The run's shape changed since it was acknowledged",
+                        "reason": "fingerprint",
+                        "acknowledged": BOUND,
+                        "plan": {
+                            "fingerprint": "sha256:def",
+                            "steps": 1,
+                            "list_entries": {},
+                            "cached_steps": None,
+                            "downloads_required": [],
+                            "estimate": {
+                                "minutes": None,
+                                "basis": "unknown",
+                                "device": "cuda",
+                                "measured_on": None,
+                                "partial": False,
+                            },
+                        },
+                    }
+                },
+            )
+        }
+    )
+    with pytest.raises(DwApiError) as caught:
+        diagnose.run_workflow(client, workflow_path="w.json", acknowledged_cost=BOUND)
+    message = str(caught.value)
+    assert "None minutes" not in message
+    assert "no measured estimate" in message
diff --git a/tests/test_mcp_server.py b/tests/test_mcp_server.py
index 3abb72c3..cce69812 100644
--- a/tests/test_mcp_server.py
+++ b/tests/test_mcp_server.py
@@ -624,19 +624,50 @@ async def test_wait_for_job_names_the_cap_it_applies():
 
 
 @pytest.mark.asyncio
-async def test_wait_for_job_scales_the_lead_in_to_the_references():
+async def test_wait_for_job_says_silence_is_not_a_hang():
     """#95: the description is the documented way to tell a slow run from a
-    hung one, and a consumer following its ~90 s figure would have been
-    entitled to cancel a healthy video-reference run at the 3 minute mark -
-    that lead-in measured 629 s. It has to name the video reference and its
-    own order of magnitude, and say that the denoise steps are uneven once
-    they start, or the silence between them reads as a stall too."""
+    hung one, and a consumer that reads the reference encode's silence as a
+    stall cancels a healthy run. The *rules* stay here - a video reference
+    makes the lead-in long, the denoise gaps are uneven, judge by whether
+    `denoise_step` moved - while the family's measured figures moved to the
+    model skill, which loads exactly when that model is in play (#101)."""
     tools = await tools_of(server_over(ok({})))
 
     description = tools["wait_for_job"].description
-    assert "video" in description
-    assert "90 s" in description and "10 min" in description
-    assert "140 s" in description
+    assert "video" in description and "minutes" in description
+    assert "uneven" in description
+    assert "denoise_step` has moved" in description
+
+
+def test_the_h3_skill_carries_the_measured_lead_in():
+    """The other half of that move: the numbers are not lost, they are in
+    the skill that loads when H3 is in play (#101)."""
+    import os
+
+    path = os.path.join(
+        os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+        "plugins",
+        "dw",
+        "skills",
+        "minimax-h3",
+        "SKILL.md",
+    )
+    with open(path) as handle:
+        text = handle.read()
+
+    assert "629 s" in text and "90 s" in text
+
+
+@pytest.mark.asyncio
+async def test_get_memory_points_at_the_guide_for_the_pinned_cache():
+    """The pinned-host-cache explanation moved to the `acceleration` guide;
+    the field names stay in the description, so a reader still knows what
+    they are looking at (#101)."""
+    tools = await tools_of(server_over(ok({})))
+
+    description = tools["get_memory"].description
+    assert "host_pinned_reserved_mb" in description
+    assert "acceleration" in description
 
 
 @pytest.mark.asyncio
@@ -763,6 +794,7 @@ def refusing(request):
     "download_output": (media, "download_output"),
     "get_gallery_metadata": (catalog, "get_gallery_metadata"),
     "get_workflow": (catalog, "get_workflow"),
+    "get_schema": (catalog, "get_schema"),
     "delete_output": (media, "delete_output"),
 }
 
@@ -925,3 +957,16 @@ async def test_the_instructions_name_the_vocabulary():
     server = server_over(ok({}))
     for word in ("image-set", "sequence", "has-audio", "list_workflows(shape="):
         assert word in server.instructions
+
+
+@pytest.mark.asyncio
+async def test_validate_workflow_teaches_quoting_from_the_plan():
+    """The number an agent says out loud is the plan's - priced for the
+    arguments it will run with, naming the weights this box lacks - not the
+    listing's defaults-only cost (#85)."""
+    tools = await tools_of(server_over(ok({})))
+    doc = tools["validate_workflow"].description
+    assert "plan" in doc
+    assert "downloads_required" in doc
+    assert "estimate" in doc
+    assert "basis" in doc
diff --git a/tests/test_pair_audio.py b/tests/test_pair_audio.py
index 0a431de8..6cf1e824 100644
--- a/tests/test_pair_audio.py
+++ b/tests/test_pair_audio.py
@@ -103,3 +103,15 @@ def test_registered_as_a_task_command():
     from dw.tasks.task import _COMMAND_REGISTRY
 
     assert "pair_audio" in _COMMAND_REGISTRY
+
+
+def test_get_task_says_what_the_frame_rate_does():
+    """#104's fix is only useful where an author authoring a task step looks,
+    and that is `get_task` - which reads the implementation's own docstring."""
+    from dw.introspection import describe_task
+
+    described = describe_task("pair_audio")
+    video = next(p for p in described["parameters"] if p["name"] == "video")
+    assert "result.fps" in video["description"]
+    audio = next(p for p in described["parameters"] if p["name"] == "audio")
+    assert "mono" in audio["description"]
diff --git a/tests/test_plan.py b/tests/test_plan.py
new file mode 100644
index 00000000..4a853706
--- /dev/null
+++ b/tests/test_plan.py
@@ -0,0 +1,597 @@
+"""The plan a validate call answers with: what a run will execute for the
+arguments given, fingerprinted so an acknowledgement can be bound to it."""
+
+import copy
+import json
+
+import pytest
+
+from dw.plan import build_plan, unseeded_cache_warnings
+from dw.runs import new_run_id
+from dw.workflow import workflow_from_definition
+
+
+def definition():
+    """A list-driven workflow with a stored prompt and an output reference,
+    so every mutable input the fingerprint must ignore or honour is here."""
+    return {
+        "id": "plan_test",
+        "description": "docs only",
+        "summary": "docs only",
+        "seed": "variable:seed",
+        "cost": [{"device": "cuda", "name": "card", "vram_gb": 8, "minutes": 10}],
+        "variables": {
+            "seed": 1,
+            "prompt": "prompt:scenic/dusk",
+            "frames": 25,
+            "shots": [{"name": "a", "prompt": "one"}, {"name": "b", "prompt": "two"}],
+        },
+        "steps": [
+            {
+                "name": "still",
+                "pipeline": {
+                    "configuration": {"component_type": "{Fake}"},
+                    "from_pretrained_arguments": {"model_name": "org/still-model"},
+                    "arguments": {
+                        "prompt": "variable:prompt",
+                        "image": "output:ltx2/Gyre/latest/still.png",
+                        "num_frames": "variable:frames",
+                    },
+                },
+            },
+            {
+                "name": "shot",
+                "for_each": "variable:shots",
+                "task": {"command": "x", "arguments": {"prompt": "item:prompt"}},
+            },
+        ],
+    }
+
+
+@pytest.fixture
+def prompt_library(tmp_path):
+    library = tmp_path / "prompts"
+    (library / "scenic").mkdir(parents=True)
+    (library / "scenic" / "dusk.json").write_text(
+        json.dumps({"text": "a harbour at dusk"})
+    )
+    return library
+
+
+@pytest.fixture
+def output_root(tmp_path):
+    root = tmp_path / "outputs"
+    run = root / "ltx2" / "Gyre" / new_run_id({"a": 1})
+    run.mkdir(parents=True)
+    (run / "still.png").write_bytes(b"png")
+    return root
+
+
+@pytest.fixture
+def plan(tmp_path, prompt_library, output_root, monkeypatch):
+    """build_plan over the fixture, with the hub cache empty and the hub
+    unreachable, so downloads never touch the network in these tests."""
+    import dw.plan
+
+    def offline(*a, **k):
+        raise RuntimeError("offline")
+
+    monkeypatch.setattr(dw.plan, "scan_models", lambda cache_dir=None: {"repos": []})
+    monkeypatch.setattr(dw.plan, "model_info", offline)
+
+    def make(spec=None, arguments=None, **overrides):
+        spec = definition() if spec is None else spec
+        candidate = workflow_from_definition(
+            copy.deepcopy(spec), str(output_root), str(tmp_path), str(tmp_path)
+        )
+        kwargs = dict(device="cuda", prompt_dir=str(prompt_library), lookup_sizes=False)
+        kwargs.update(overrides)
+        return build_plan(candidate, arguments or {}, **kwargs)
+
+    return make
+
+
+PLAN_KEYS = {
+    "fingerprint",
+    "steps",
+    "list_entries",
+    "cached_steps",
+    "downloads_required",
+    "estimate",
+}
+
+
+class TestShape:
+    def test_the_documented_keys(self, plan):
+        answer = plan()
+        assert set(answer) == PLAN_KEYS
+        assert answer["fingerprint"].startswith("sha256:")
+        assert len(answer["fingerprint"]) == len("sha256:") + 64
+        assert answer["cached_steps"] is None
+
+    def test_steps_counts_the_expanded_members(self, plan):
+        assert plan()["steps"] == 3  # still, shot@a, shot@b
+
+    def test_list_entries_is_the_callers_list_length(self, plan):
+        shots = [{"name": n, "prompt": n} for n in "abcde"]
+        answer = plan(arguments={"shots": shots})
+        assert answer["list_entries"] == {"shots": 5}
+        assert answer["steps"] == 6
+
+    def test_a_literal_for_each_list_is_not_an_entry(self, plan):
+        spec = definition()
+        spec["steps"][1]["for_each"] = [
+            {"name": "x", "prompt": "x"},
+            {"name": "y", "prompt": "y"},
+        ]
+        del spec["variables"]["shots"]
+        assert plan(spec)["list_entries"] == {}
+
+
+class TestFingerprintIsStableAcross:
+    def test_a_different_top_level_seed(self, plan):
+        assert plan()["fingerprint"] == plan(arguments={"seed": 99})["fingerprint"]
+
+    def test_a_different_step_seed(self, plan):
+        spec = definition()
+        spec["steps"][0]["seed"] = 5
+        spec["steps"][0]["pipeline"]["seed"] = 5
+        other = copy.deepcopy(spec)
+        other["steps"][0]["seed"] = 6
+        other["steps"][0]["pipeline"]["seed"] = 6
+        assert plan(spec)["fingerprint"] == plan(other)["fingerprint"]
+
+    def test_key_order(self, plan):
+        spec = definition()
+        reordered = {k: spec[k] for k in reversed(list(spec))}
+        assert plan(spec)["fingerprint"] == plan(reordered)["fingerprint"]
+
+    def test_description_summary_and_cost_edits(self, plan):
+        spec = definition()
+        spec["description"] = "rewritten"
+        spec["summary"] = "rewritten"
+        spec["cost"][0]["minutes"] = 99
+        spec["configures"] = "templates/x"
+        assert plan(spec)["fingerprint"] == plan()["fingerprint"]
+
+    def test_a_new_run_landing_under_latest(self, plan, output_root):
+        before = plan()["fingerprint"]
+        newer = output_root / "ltx2" / "Gyre" / new_run_id({"b": 2})
+        newer.mkdir(parents=True)
+        (newer / "still.png").write_bytes(b"png2")
+        assert plan()["fingerprint"] == before
+
+    def test_argument_order(self, plan):
+        a = plan(arguments={"frames": 9, "seed": 3})["fingerprint"]
+        b = plan(arguments={"seed": 3, "frames": 9})["fingerprint"]
+        assert a == b
+
+
+class TestFingerprintChangesWith:
+    def test_an_edited_composed_child(self, plan, tmp_path):
+        child = {"id": "child", "steps": []}
+        (tmp_path / "child.json").write_text(json.dumps(child))
+        spec = composing("child.json")
+        before = plan(spec)["fingerprint"]
+        child["steps"].append({"name": "x", "task": {"command": "x", "arguments": {}}})
+        (tmp_path / "child.json").write_text(json.dumps(child))
+        assert plan(spec)["fingerprint"] != before
+
+    def test_a_longer_list(self, plan):
+        longer = [{"name": n, "prompt": n} for n in "abc"]
+        assert plan()["fingerprint"] != plan(arguments={"shots": longer})["fingerprint"]
+
+    def test_a_changed_stored_prompt(self, plan, prompt_library):
+        before = plan()["fingerprint"]
+        (prompt_library / "scenic" / "dusk.json").write_text(
+            json.dumps({"text": "a harbour at dawn"})
+        )
+        assert plan()["fingerprint"] != before
+
+    def test_a_changed_numeric_argument(self, plan):
+        assert plan()["fingerprint"] != plan(arguments={"frames": 121})["fingerprint"]
+
+    def test_a_different_asset_name(self, plan):
+        spec = definition()
+        spec["steps"][0]["pipeline"]["arguments"]["image"] = "asset:a.png"
+        other = copy.deepcopy(spec)
+        other["steps"][0]["pipeline"]["arguments"]["image"] = "asset:b.png"
+        assert plan(spec)["fingerprint"] != plan(other)["fingerprint"]
+
+    def test_a_step_added_removed_or_renamed(self, plan):
+        base = plan()["fingerprint"]
+        renamed = definition()
+        renamed["steps"][0]["name"] = "frame"
+        removed = definition()
+        del removed["steps"][1]
+        added = definition()
+        added["steps"].append(
+            {"name": "extra", "task": {"command": "x", "arguments": {}}}
+        )
+        prints = {
+            base,
+            plan(renamed)["fingerprint"],
+            plan(removed)["fingerprint"],
+            plan(added)["fingerprint"],
+        }
+        assert len(prints) == 4
+
+
+def cost(device="cuda", minutes=10, per_entry=None, name="card"):
+    entry = {"device": device, "name": name, "vram_gb": 8, "minutes": minutes}
+    if per_entry:
+        entry["per_entry"] = per_entry
+    return entry
+
+
+class TestEstimate:
+    def test_no_cost_block_is_unknown(self, plan):
+        spec = definition()
+        del spec["cost"]
+        assert plan(spec)["estimate"] == {
+            "minutes": None,
+            "basis": "unknown",
+            "device": "cuda",
+            "measured_on": None,
+            "partial": False,
+        }
+
+    def test_an_empty_cost_list_is_unknown(self, plan):
+        spec = definition()
+        spec["cost"] = []
+        assert plan(spec)["estimate"]["basis"] == "unknown"
+
+    def test_the_serving_devices_entry_is_the_catalog_figure(self, plan):
+        spec = definition()
+        spec["cost"] = [cost("mps", 40, name="M2"), cost("cuda", 10, name="4090")]
+        assert plan(spec)["estimate"] == {
+            "minutes": 10.0,
+            "basis": "catalog",
+            "device": "cuda",
+            "measured_on": "4090",
+            "partial": False,
+        }
+
+    def test_another_devices_entry_is_reported_as_such(self, plan):
+        spec = definition()
+        spec["cost"] = [cost("mps", 40, name="M2")]
+        assert plan(spec)["estimate"] == {
+            "minutes": 40.0,
+            "basis": "other_device",
+            "device": "cuda",
+            "measured_on": "M2",
+            "partial": False,
+        }
+
+    def test_per_entry_scales_by_the_callers_list(self, plan):
+        spec = definition()
+        # 10 minutes for the 2-entry default, of which 3 per entry: 4 fixed
+        spec["cost"] = [
+            cost("cuda", 10, {"variable": "shots", "minutes": 3, "entries": 2})
+        ]
+        shots = [{"name": n, "prompt": n} for n in "abcde"]
+        answer = plan(spec, arguments={"shots": shots})["estimate"]
+        assert answer["minutes"] == 4 + 3 * 5
+        assert answer["basis"] == "per_entry"
+
+    def test_per_entry_floors_at_zero(self, plan):
+        spec = definition()
+        spec["cost"] = [
+            cost("cuda", 1, {"variable": "shots", "minutes": 3, "entries": 2})
+        ]
+        # 1 - 3 * 2 + 3 * 1 is negative: a shorter list than was measured
+        one = [{"name": "a", "prompt": "a"}]
+        assert plan(spec, arguments={"shots": one})["estimate"]["minutes"] == 0.0
+
+    def test_per_entry_naming_no_list_falls_back_to_catalog(self, plan):
+        spec = definition()
+        spec["cost"] = [
+            cost("cuda", 10, {"variable": "other", "minutes": 3, "entries": 2})
+        ]
+        answer = plan(spec)["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (10.0, "catalog")
+
+    def test_other_device_beats_per_entry(self, plan):
+        spec = definition()
+        spec["cost"] = [
+            cost("mps", 10, {"variable": "shots", "minutes": 3, "entries": 2})
+        ]
+        answer = plan(spec)["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (10.0, "other_device")
+
+    def test_a_longer_list_re_prices_the_catalog_figure(self, plan):
+        """The failure #85 was re-opened for: 10 minutes measured on the
+        2-shot default was quoted verbatim for a 10-shot run. Linear over
+        the entry count, and labelled `derived` so it is not read as a
+        measurement."""
+        spec = definition()
+        shots = [{"name": f"s{n}", "prompt": "x"} for n in range(10)]
+        answer = plan(spec, arguments={"shots": shots})["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (50.0, "derived")
+
+    def test_a_shorter_list_re_prices_downward(self, plan):
+        spec = definition()
+        one = [{"name": "a", "prompt": "a"}]
+        answer = plan(spec, arguments={"shots": one})["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (5.0, "derived")
+
+    def test_the_stored_list_is_still_the_catalog_figure(self, plan):
+        """The figure was measured with these defaults, so nothing is
+        extrapolated when the caller does not change them."""
+        answer = plan(definition())["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (10.0, "catalog")
+
+    def test_a_measured_per_entry_rate_beats_the_extrapolation(self, plan):
+        spec = definition()
+        spec["cost"] = [
+            cost("cuda", 10, {"variable": "shots", "minutes": 3, "entries": 2})
+        ]
+        shots = [{"name": f"s{n}", "prompt": "x"} for n in range(10)]
+        answer = plan(spec, arguments={"shots": shots})["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (34.0, "per_entry")
+
+    def test_two_changed_lists_withhold_the_figure(self, plan):
+        """Nothing honest to extrapolate along, so the number is withheld
+        rather than quoted for one of the two lists."""
+        spec = definition()
+        spec["variables"]["angles"] = [{"name": "wide"}]
+        spec["steps"].append(
+            {
+                "name": "angle",
+                "for_each": "variable:angles",
+                "task": {"command": "x", "arguments": {"name": "item:name"}},
+            }
+        )
+        arguments = {
+            "shots": [{"name": f"s{n}", "prompt": "x"} for n in range(4)],
+            "angles": [{"name": "wide"}, {"name": "tight"}],
+        }
+        answer = plan(spec, arguments=arguments)["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (None, "unknown")
+
+    def test_another_devices_figure_is_not_extrapolated(self, plan):
+        """`other_device` already says the figure is not this machine's -
+        re-pricing it would dress a guess as arithmetic."""
+        spec = definition()
+        spec["cost"] = [cost("mps", 40, name="M2")]
+        shots = [{"name": f"s{n}", "prompt": "x"} for n in range(10)]
+        answer = plan(spec, arguments={"shots": shots})["estimate"]
+        assert (answer["minutes"], answer["basis"]) == (40.0, "other_device")
+
+    def test_minutes_is_rounded_to_one_decimal(self, plan):
+        spec = definition()
+        spec["cost"] = [cost("cuda", 10.04)]
+        assert plan(spec)["estimate"]["minutes"] == 10.0
+
+
+def composing(child_path):
+    return {
+        "id": "parent",
+        "cost": [cost("cuda", 2)],
+        "steps": [
+            {"name": "own", "task": {"command": "x", "arguments": {}}},
+            {"name": "child", "workflow": {"path": child_path, "arguments": {}}},
+        ],
+    }
+
+
+class TestSubWorkflowEstimate:
+    def test_a_childs_catalog_cost_is_added(self, plan, tmp_path):
+        child = {"id": "child", "cost": [cost("cuda", 5)], "steps": []}
+        (tmp_path / "child.json").write_text(json.dumps(child))
+        answer = plan(composing("child.json"))["estimate"]
+        assert (answer["minutes"], answer["partial"]) == (7.0, False)
+
+    def test_a_child_without_a_cost_makes_the_estimate_partial(self, plan, tmp_path):
+        (tmp_path / "child.json").write_text(json.dumps({"id": "child", "steps": []}))
+        answer = plan(composing("child.json"))["estimate"]
+        assert (answer["minutes"], answer["partial"]) == (2.0, True)
+
+    def test_an_unreadable_child_makes_the_estimate_partial(self, plan):
+        answer = plan(composing("missing.json"))["estimate"]
+        assert (answer["minutes"], answer["partial"]) == (2.0, True)
+
+    def test_a_builtin_adds_nothing_and_is_not_partial(self, plan):
+        answer = plan(composing("builtin:text-to-image.json"))["estimate"]
+        assert (answer["minutes"], answer["partial"]) == (2.0, False)
+
+    def test_a_child_measured_on_another_device_is_still_added(self, plan, tmp_path):
+        child = {"id": "child", "cost": [cost("mps", 5)], "steps": []}
+        (tmp_path / "child.json").write_text(json.dumps(child))
+        answer = plan(composing("child.json"))["estimate"]
+        assert answer["minutes"] == 7.0
+        # the parent's own basis is what is reported
+        assert answer["basis"] == "catalog"
+
+
+class TestDownloadsRequired:
+    def test_a_repo_not_in_the_cache_is_required(self, plan):
+        assert plan()["downloads_required"] == [{"repo": "org/still-model", "gb": None}]
+
+    def test_a_cached_repo_is_not(self, plan, monkeypatch):
+        import dw.plan
+
+        monkeypatch.setattr(
+            dw.plan,
+            "scan_models",
+            lambda cache_dir=None: {"repos": [{"repo_id": "org/still-model"}]},
+        )
+        assert plan()["downloads_required"] == []
+
+    def test_cache_dir_reaches_scan_models(self, plan, monkeypatch):
+        import dw.plan
+
+        seen = []
+
+        def spy(cache_dir=None):
+            seen.append(cache_dir)
+            return {"repos": []}
+
+        monkeypatch.setattr(dw.plan, "scan_models", spy)
+        plan(cache_dir="/somewhere")
+        assert seen == ["/somewhere"]
+
+    def test_a_local_path_is_not_a_download_and_is_not_probed(
+        self, plan, tmp_path, monkeypatch
+    ):
+        """A model_name that is not shaped like a hub id is a local checkout
+        and never a download - decided by shape, never by touching the disk,
+        since the free pre-flight takes the name from the request body and
+        must not become a directory-existence oracle."""
+        import os
+
+        probed = []
+        real_isdir = os.path.isdir
+        monkeypatch.setattr(
+            os.path, "isdir", lambda path: probed.append(path) or real_isdir(path)
+        )
+        names = (str(tmp_path / "weights"), "/Users/someone/.ssh", "./weights")
+        for local in names:
+            spec = definition()
+            spec["steps"][0]["pipeline"]["from_pretrained_arguments"][
+                "model_name"
+            ] = local
+            assert plan(spec)["downloads_required"] == [], local
+        assert not set(names) & set(probed)
+
+    def test_a_single_file_url_is_listed_without_a_size(self, plan):
+        spec = definition()
+        spec["steps"][0]["pipeline"]["from_pretrained_arguments"] = {
+            "from_single_file": "https://example.test/x.safetensors"
+        }
+        assert plan(spec)["downloads_required"] == [
+            {"repo": None, "url": "https://example.test/x.safetensors", "gb": None}
+        ]
+
+    def test_a_single_file_local_path_is_not_listed(self, plan):
+        spec = definition()
+        spec["steps"][0]["pipeline"]["from_pretrained_arguments"] = {
+            "from_single_file": "checkpoints/x.safetensors"
+        }
+        assert plan(spec)["downloads_required"] == []
+
+    def test_components_and_children_are_scanned_and_deduplicated(self, plan, tmp_path):
+        spec = definition()
+        spec["steps"][0]["pipeline"]["components"] = {
+            "vae": {"from_pretrained_arguments": {"model_name": "org/vae"}}
+        }
+        child = {
+            "id": "child",
+            "steps": [
+                {
+                    "name": "c",
+                    "pipeline": {
+                        "configuration": {"component_type": "{Fake}"},
+                        "from_pretrained_arguments": {"model_name": "org/still-model"},
+                        "arguments": {},
+                    },
+                }
+            ],
+        }
+        (tmp_path / "child.json").write_text(json.dumps(child))
+        spec["steps"].append(
+            {"name": "sub", "workflow": {"path": "child.json", "arguments": {}}}
+        )
+        assert [d["repo"] for d in plan(spec)["downloads_required"]] == [
+            "org/still-model",
+            "org/vae",
+        ]
+
+    def test_sizes_come_from_the_hub_in_gib(self, plan, monkeypatch):
+        import dw.plan
+
+        class Sibling:
+            def __init__(self, size):
+                self.size = size
+
+        class Info:
+            siblings = [Sibling(2 * 1024**3), Sibling(None), Sibling(512 * 1024**2)]
+
+        calls = []
+
+        def fake_model_info(name, **kwargs):
+            calls.append((name, kwargs))
+            return Info()
+
+        monkeypatch.setattr(dw.plan, "model_info", fake_model_info)
+        answer = plan(lookup_sizes=True)["downloads_required"]
+        assert answer == [{"repo": "org/still-model", "gb": 2.5}]
+        assert calls[0][0] == "org/still-model"
+        assert calls[0][1]["files_metadata"] is True
+        assert calls[0][1]["timeout"] == 5.0
+
+    def test_a_hub_failure_is_a_null_size(self, plan, monkeypatch):
+        import dw.plan
+
+        def boom(*a, **k):
+            raise RuntimeError("offline")
+
+        monkeypatch.setattr(dw.plan, "model_info", boom)
+        assert plan(lookup_sizes=True)["downloads_required"] == [
+            {"repo": "org/still-model", "gb": None}
+        ]
+
+    def test_lookup_sizes_false_never_calls_the_hub(self, plan, monkeypatch):
+        import dw.plan
+
+        def boom(*a, **k):
+            raise AssertionError("must not be called")
+
+        monkeypatch.setattr(dw.plan, "model_info", boom)
+        plan(lookup_sizes=False)
+
+
+class TestCachedSteps:
+    def test_no_probe_is_unknown(self, plan):
+        assert plan()["cached_steps"] is None
+
+    def test_the_probe_is_asked_with_the_arguments_and_counted(self, plan):
+        seen = []
+
+        def probe(arguments):
+            seen.append(arguments)
+            return ["still", "shot@a"]
+
+        answer = plan(arguments={"frames": 9}, cache_probe=probe)
+        assert answer["cached_steps"] == 2
+        assert seen == [{"frames": 9}]
+
+    def test_a_probe_that_cannot_answer_is_unknown(self, plan):
+        assert plan(cache_probe=lambda arguments: None)["cached_steps"] is None
+
+    def test_an_unseeded_workflow_is_zero_without_asking(self, plan):
+        def probe(arguments):
+            raise AssertionError("must not be asked")
+
+        spec = definition()
+        del spec["seed"]
+        del spec["variables"]["seed"]
+        assert plan(spec, cache_probe=probe)["cached_steps"] == 0
+
+    def test_a_seed_variable_left_null_is_unseeded(self, plan):
+        def probe(arguments):
+            raise AssertionError("must not be asked")
+
+        spec = definition()
+        spec["variables"]["seed"] = None
+        assert plan(spec, cache_probe=probe)["cached_steps"] == 0
+
+
+class TestUnseededCacheWarning:
+    """`cached_steps: 0` reads as 'probed, nothing hit' from outside; the
+    warning is what says the cache is off entirely (#107)."""
+
+    def test_a_seeded_workflow_says_nothing(self):
+        assert unseeded_cache_warnings(definition()) == []
+
+    def test_an_unseeded_workflow_explains_the_zero(self):
+        spec = definition()
+        del spec["seed"]
+        del spec["variables"]["seed"]
+        (warning,) = unseeded_cache_warnings(spec)
+        assert "seed" in warning and "cached_steps" in warning
+
+    def test_a_seed_passed_as_an_argument_counts(self):
+        spec = definition()
+        spec["variables"]["seed"] = None
+        assert unseeded_cache_warnings(spec, {"seed": 7}) == []
diff --git a/tests/test_realize.py b/tests/test_realize.py
index db76cf38..6740d8f9 100644
--- a/tests/test_realize.py
+++ b/tests/test_realize.py
@@ -242,3 +242,103 @@ def test_finds_every_matching_string_deduplicated_in_first_seen_order(self):
             "asset:iris.png",
             "asset:mask.png",
         ]
+
+
+class TestUnpinnedOutputs:
+    def test_pin_outputs_false_leaves_latest_as_written(self, output_root):
+        root, _ = output_root
+        spec = definition()
+        spec["steps"][0]["pipeline"]["arguments"][
+            "image"
+        ] = "output:ltx2/Gyre/latest/still.png"
+        realized, _ = realize_workflow(spec, {}, 7, output_root=root, pin_outputs=False)
+        assert (
+            realized["steps"][0]["pipeline"]["arguments"]["image"]
+            == "output:ltx2/Gyre/latest/still.png"
+        )
+
+    def test_pin_outputs_false_still_inlines_prompts(self, prompt_library):
+        spec = definition()
+        spec["variables"]["prompt"] = "prompt:scenic/dusk"
+        realized, annotations = realize_workflow(
+            spec, {}, 7, prompt_dir=prompt_library, pin_outputs=False
+        )
+        assert realized["variables"]["prompt"] == "a harbour at dusk"
+        assert annotations["prompts"] == ["scenic/dusk"]
+
+    def test_the_default_still_pins(self, output_root):
+        root, run_id = output_root
+        spec = definition()
+        spec["steps"][0]["pipeline"]["arguments"][
+            "image"
+        ] = "output:ltx2/Gyre/latest/still.png"
+        realized, _ = realize_workflow(spec, {}, 7, output_root=root)
+        assert (
+            realized["steps"][0]["pipeline"]["arguments"]["image"]
+            == f"output:ltx2/Gyre/{run_id}/still.png"
+        )
+
+
+class TestReadSubWorkflow:
+    def test_reads_a_child_beside_the_parent(self, tmp_path):
+        from dw.realize import read_sub_workflow
+
+        child = {"id": "child", "steps": []}
+        (tmp_path / "child.json").write_text(json.dumps(child))
+        raw = read_sub_workflow("child.json", str(tmp_path), str(tmp_path))
+        assert json.loads(raw) == child
+
+    def test_a_missing_child_reads_as_none(self, tmp_path):
+        from dw.realize import read_sub_workflow
+
+        assert read_sub_workflow("nope.json", str(tmp_path), str(tmp_path)) is None
+
+    def test_a_child_outside_the_confinement_reads_as_none(self, tmp_path):
+        from dw.realize import read_sub_workflow
+
+        outside = tmp_path / "outside"
+        outside.mkdir()
+        (outside / "child.json").write_text(json.dumps({"id": "c", "steps": []}))
+        confined = tmp_path / "confined"
+        confined.mkdir()
+        assert (
+            read_sub_workflow("../outside/child.json", str(confined), str(confined))
+            is None
+        )
+
+    def test_a_child_climbing_out_of_the_catalog_reads_as_none_unconfined(
+        self, tmp_path
+    ):
+        """An unconfined run (no workflow_dir - a bare CLI run) still confines
+        a relative reference to the catalog root, so the read refuses the same
+        climb the run does rather than reaching outside it - the read the
+        unguarded stat used to allow."""
+        from dw.realize import read_sub_workflow
+
+        catalog = tmp_path / "workflows"
+        (catalog / "templates").mkdir(parents=True)
+        (tmp_path / "Outside.json").write_text(json.dumps({"id": "c", "steps": []}))
+
+        assert (
+            read_sub_workflow("../../Outside.json", str(catalog / "templates"), None)
+            is None
+        )
+
+    def test_a_child_climbing_to_a_sibling_catalog_folder_still_reads(self, tmp_path):
+        """The confinement is the catalog root, not the referencing file's own
+        directory - '../models/x.json' from templates/ is the form every
+        template uses, and stays readable."""
+        from dw.realize import read_sub_workflow
+
+        catalog = tmp_path / "workflows"
+        (catalog / "templates").mkdir(parents=True)
+        (catalog / "models").mkdir()
+        (catalog / "models" / "Child.json").write_text(
+            json.dumps({"id": "c", "steps": []})
+        )
+
+        raw = read_sub_workflow(
+            "../models/Child.json", str(catalog / "templates"), None
+        )
+
+        assert json.loads(raw) == {"id": "c", "steps": []}
diff --git a/tests/test_result.py b/tests/test_result.py
index 227a79e5..b4002f44 100644
--- a/tests/test_result.py
+++ b/tests/test_result.py
@@ -168,19 +168,40 @@ def test_save_no_content_type(self):
             assert len(files) == 0
 
     def test_save_with_custom_base_name(self):
+        """A file_base_name replaces the derived name rather than prefixing
+        it - the whole point of setting one is a name the caller can predict
+        without reading it back out of the manifest (#100)."""
         with tempfile.TemporaryDirectory() as temp_dir:
             result_def = {
                 "content_type": "application/json",
                 "save": True,
-                "file_base_name": "custom_",
+                "file_base_name": "ep5-episode",
             }
             result = Result(result_def)
             result.add_result({"data": "test"})
 
-            result.save(temp_dir, "output")
+            result.save(temp_dir, "qa-ep5-episode-episode.0")
 
-            output_file = os.path.join(temp_dir, "custom_output-0.json")
+            output_file = os.path.join(temp_dir, "ep5-episode-0.json")
             assert os.path.exists(output_file)
+            assert os.listdir(temp_dir) == ["ep5-episode-0.json"]
+
+    def test_two_steps_sharing_a_base_name_do_not_overwrite_each_other(self):
+        """Replacing the derived name drops what made it unique per step, so
+        the existing de-duplication is what keeps a second step's file (#100)."""
+        with tempfile.TemporaryDirectory() as temp_dir:
+            for step in ("a", "b"):
+                result = Result(
+                    {
+                        "content_type": "application/json",
+                        "save": True,
+                        "file_base_name": "shared",
+                    }
+                )
+                result.add_result({"step": step})
+                result.save(temp_dir, f"wf-{step}.0")
+
+            assert sorted(os.listdir(temp_dir)) == ["shared-0-2.json", "shared-0.json"]
 
     def test_a_traversing_file_base_name_cannot_escape_the_output_directory(self):
         """Every part of a result's file name comes from the workflow - a
@@ -1271,3 +1292,47 @@ def test_the_file_is_named_as_it_starts_and_costed_as_it_finishes(self):
         assert logs[1]["message"].startswith("wrote test-0.0.txt in ")
         assert logs[0]["file"] == logs[1]["file"] == "test-0.0.txt"
         assert isinstance(logs[1]["seconds"], float)
+
+
+class TestMonoAudioForMuxing:
+    """A mono soundtrack upmixed to stereo at the encode (#106).
+
+    diffusers' _write_audio refuses anything but 2 channels, so a mono voice
+    track - the ordinary case for dialogue - died at the encode with a raw
+    tensor-shape ValueError after the run had already paid for itself.
+    """
+
+    def test_channels_first_mono_is_duplicated(self):
+        track = as_audio_track(torch.arange(100, dtype=torch.float32)[None, :])
+        assert track.shape == (2, 100)
+        assert torch.equal(track[0], track[1])
+
+    def test_flat_mono_is_duplicated(self):
+        track = as_audio_track(numpy.zeros(100, dtype=numpy.float32))
+        assert track.shape == (2, 100)
+
+    def test_samples_first_mono_is_duplicated(self):
+        track = as_audio_track(numpy.zeros((100, 1), dtype=numpy.float32))
+        assert track.shape == (2, 100)
+
+    def test_stereo_is_left_alone(self):
+        track = as_audio_track(torch.zeros((2, 100)))
+        assert track.shape == (2, 100)
+
+    def test_samples_first_stereo_is_left_alone(self):
+        # encode_video transposes this shape itself - upmixing must not
+        # mistake 2 channels laid out samples-first for 100-channel audio
+        track = as_audio_track(torch.zeros((100, 2)))
+        assert track.shape == (100, 2)
+
+    def test_upmix_warns(self, monkeypatch):
+        import dw.result as result_module
+
+        warnings = []
+        monkeypatch.setattr(
+            result_module,
+            "emit_warning",
+            lambda message, **data: warnings.append(message),
+        )
+        as_audio_track(torch.zeros((1, 100)))
+        assert warnings and "mono" in warnings[0].lower()
diff --git a/tests/test_schema.py b/tests/test_schema.py
index 1303a56d..35a85be3 100644
--- a/tests/test_schema.py
+++ b/tests/test_schema.py
@@ -1,6 +1,9 @@
 import pytest
 from dw.schema import (
     MAX_VALIDATION_ERRORS,
+    SCHEMA_SECTIONS,
+    SchemaSectionError,
+    schema_section,
     format_validation_errors,
     load_schema,
     validate_data,
@@ -457,3 +460,50 @@ def test_a_workflow_with_a_subfolder_validates(self):
             ],
         }
         assert validate_data_all(definition, load_schema("workflow")) == []
+
+
+class TestSections:
+    """One part of the schema at a time - the whole thing is ~8.6k tokens
+    in a single call, spent by an agent that wanted the shape of a result
+    block (#101)."""
+
+    @pytest.fixture
+    def schema(self):
+        return load_schema("workflow")
+
+    def test_every_definition_belongs_to_a_section(self, schema):
+        """An orphan definition would be unreachable by section - findable
+        only in the whole schema, which is the call sections exist to
+        avoid."""
+        owned = {name for part in SCHEMA_SECTIONS.values() for name in part["defs"]}
+        assert set(schema["$defs"]) - owned == set()
+
+    def test_a_section_is_a_fraction_of_the_whole(self, schema):
+        import json
+
+        whole = len(json.dumps(schema))
+        answer = schema_section(schema, "result")
+        assert len(json.dumps(answer["schema"])) < whole / 5
+
+    def test_a_section_carries_its_own_definitions(self, schema):
+        answer = schema_section(schema, "tasks")
+        assert list(answer["schema"]["$defs"]) == ["task"]
+
+    def test_a_reference_it_does_not_hold_says_where_it_lives(self, schema):
+        answer = schema_section(schema, "steps")
+        assert answer["elsewhere"]["result"] == "result"
+        assert answer["elsewhere"]["task"] == "tasks"
+
+    def test_variables_carries_the_top_level_properties(self, schema):
+        answer = schema_section(schema, "variables")
+        assert "variables" in answer["schema"]["properties"]
+        assert "seed" in answer["schema"]["properties"]
+        assert "steps" not in answer["schema"]["properties"]
+
+    def test_every_section_answers(self, schema):
+        for name in SCHEMA_SECTIONS:
+            assert schema_section(schema, name)["section"] == name
+
+    def test_an_unknown_section_names_the_ones_there_are(self, schema):
+        with pytest.raises(SchemaSectionError, match="steps"):
+            schema_section(schema, "pipline")
diff --git a/tests/test_server.py b/tests/test_server.py
index 74604d72..c32d2cdb 100644
--- a/tests/test_server.py
+++ b/tests/test_server.py
@@ -68,6 +68,8 @@ def __init__(self, script=None):
         self.worker_active = False
         self.worker_process = None
         self._results = queue.Queue()
+        # What a probe_cache command answers with
+        self.cached_steps = []
 
     def ensure_worker(self, log_level="INFO"):
         self.worker_active = True
@@ -83,6 +85,14 @@ def send_command(self, command):
             self._results.put(
                 {"type": "memory_status", "info": {"gpu_available": True}}
             )
+        elif command["type"] == "probe_cache":
+            self._results.put(
+                {
+                    "type": "probe_cache",
+                    "probe_id": command.get("probe_id"),
+                    "cached": list(self.cached_steps),
+                }
+            )
 
     def get_result(self, timeout=None):
         return self._results.get(timeout=timeout if timeout is not None else 10)
@@ -869,6 +879,21 @@ def test_validate_endpoint_flags_signature_typos(server):
         assert result["valid"] is False and result["error"]
 
 
+def test_validate_explains_why_an_unseeded_workflow_caches_nothing(server):
+    """`cached_steps: 0` on an unseeded workflow means the cache is off, not
+    that it was probed and missed - which is not readable from the number
+    alone (#107)."""
+    with server(success_script) as client:
+        workflow = valid_workflow()
+        result = client.post("/api/validate", json={"workflow": workflow}).json()
+        assert result["valid"] is True
+        assert any("seed" in w and "cached_steps" in w for w in result["warnings"])
+
+        workflow["seed"] = 1
+        result = client.post("/api/validate", json={"workflow": workflow}).json()
+        assert not any("cached_steps" in w for w in result["warnings"])
+
+
 def test_submission_carries_argument_warnings(server):
     with server(success_script) as client:
         workflow = valid_workflow()
@@ -2979,6 +3004,7 @@ class FinishedJob:
         error = None
         run_id = None
         run_dir = None
+        acknowledged = "none"
         spec = {"arguments": {}, "workflow_path": "w.json"}
 
     job = FinishedJob()
@@ -3598,3 +3624,566 @@ def test_an_old_history_database_gains_the_column(tmp_path):
         history_path=str(db),
     )
     assert manager.get("old1")["workflow_name"] is None
+
+
+EMPTY_PLAN = {
+    "fingerprint": "sha256:0",
+    "steps": 0,
+    "list_entries": {},
+    "cached_steps": None,
+    "downloads_required": [],
+    "estimate": None,
+}
+
+
+class TestValidatePlan:
+    """A valid pre-flight answers with the run's plan (#85): what these
+    arguments will execute, fingerprinted, priced and with the weights the
+    box lacks named. Best effort - the verdict is never the planner's."""
+
+    def test_a_valid_answer_carries_a_plan(self, server, monkeypatch):
+        import dw.plan
+
+        monkeypatch.setattr(
+            dw.plan, "scan_models", lambda cache_dir=None: {"repos": []}
+        )
+        with server(success_script) as client:
+            result = client.post(
+                "/api/validate?sizes=false",
+                json={"workflow": video_workflow("planned", with_cost=True)},
+            ).json()
+        assert result["valid"] is True
+        plan = result["plan"]
+        assert set(plan) == set(EMPTY_PLAN)
+        assert plan["steps"] == 1
+        assert plan["estimate"]["basis"] in {"catalog", "other_device"}
+        assert plan["estimate"]["minutes"] == 2.0
+        assert plan["downloads_required"] == [{"repo": "m", "gb": None}]
+
+    def test_an_invalid_answer_carries_no_plan(self, server):
+        with server(success_script) as client:
+            result = client.post(
+                "/api/validate", json={"workflow": {"id": "broken", "steps": "no"}}
+            ).json()
+        assert result["valid"] is False
+        assert "plan" not in result
+
+    def test_a_planner_failure_is_a_null_plan_not_a_verdict(self, server, monkeypatch):
+        import dw.server.app as app_module
+
+        def boom(*a, **k):
+            raise RuntimeError("planner broke")
+
+        monkeypatch.setattr(app_module, "build_plan", boom)
+        with server(success_script) as client:
+            result = client.post(
+                "/api/validate", json={"workflow": valid_workflow("v")}
+            ).json()
+        assert result["valid"] is True
+        assert result["plan"] is None
+
+    def test_sizes_reaches_the_planner(self, server, monkeypatch):
+        import dw.server.app as app_module
+
+        seen = []
+
+        def spy(candidate, arguments, **kwargs):
+            seen.append(kwargs["lookup_sizes"])
+            return dict(EMPTY_PLAN)
+
+        monkeypatch.setattr(app_module, "build_plan", spy)
+        with server(success_script) as client:
+            client.post("/api/validate", json={"workflow": valid_workflow("v")})
+            client.post(
+                "/api/validate?sizes=false", json={"workflow": valid_workflow("v")}
+            )
+        assert seen == [True, False]
+
+    def test_cached_steps_comes_from_the_worker(self, server, monkeypatch):
+        import dw.plan
+
+        monkeypatch.setattr(
+            dw.plan, "scan_models", lambda cache_dir=None: {"repos": []}
+        )
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            manager.worker_manager.ensure_worker()
+            manager.worker_manager.cached_steps = ["gen"]
+            seeded = valid_workflow("seeded")
+            seeded["seed"] = 7
+            result = client.post(
+                "/api/validate?sizes=false",
+                json={"workflow": seeded, "arguments": {"prompt": "x"}},
+            ).json()
+        assert result["plan"]["cached_steps"] == 1
+        probe = [
+            c for c in manager.worker_manager.commands if c["type"] == "probe_cache"
+        ]
+        assert len(probe) == 1
+        assert probe[0]["arguments"] == {"prompt": "x"}
+        assert probe[0]["workflow"] == seeded
+        assert probe[0]["output_dir"] == manager.output_dir
+
+    def test_an_unseeded_workflow_does_not_probe(self, server, monkeypatch):
+        import dw.plan
+
+        monkeypatch.setattr(
+            dw.plan, "scan_models", lambda cache_dir=None: {"repos": []}
+        )
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            manager.worker_manager.ensure_worker()
+            result = client.post(
+                "/api/validate?sizes=false", json={"workflow": valid_workflow("v")}
+            ).json()
+        assert result["plan"]["cached_steps"] == 0
+        assert all(c["type"] != "probe_cache" for c in manager.worker_manager.commands)
+
+    def test_the_plan_sees_the_callers_arguments(self, server, monkeypatch):
+        import dw.plan
+
+        monkeypatch.setattr(
+            dw.plan, "scan_models", lambda cache_dir=None: {"repos": []}
+        )
+        with server(success_script) as client:
+            body = {"workflow": valid_workflow("v")}
+            one = client.post("/api/validate?sizes=false", json=body).json()["plan"]
+            body["arguments"] = {"prompt": "something else"}
+            two = client.post("/api/validate?sizes=false", json=body).json()["plan"]
+        assert one["fingerprint"] != two["fingerprint"]
+
+
+PROBE = {"workflow_path": "x.json", "arguments": {}, "output_dir": "/tmp"}
+
+
+class TestProbeCache:
+    def test_asks_the_worker_and_returns_its_answer(self, server):
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            manager.worker_manager.ensure_worker()
+            manager.worker_manager.cached_steps = ["gen"]
+            assert manager.probe_cache(PROBE) == ["gen"]
+            sent = manager.worker_manager.commands[-1]
+            assert sent["type"] == "probe_cache"
+            assert sent["workflow_path"] == "x.json"
+
+    def test_no_worker_means_an_empty_cache(self, server):
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            assert manager.worker_manager.worker_active is False
+            assert manager.probe_cache(PROBE) == []
+            assert manager.worker_manager.commands == []
+
+    def test_a_running_job_means_unknown(self, server):
+        with server(hanging_script) as client:
+            response = client.post("/api/jobs", json={"workflow": valid_workflow()})
+            job_id = response.json()["id"]
+            wait_for_status(client, job_id, ("running",))
+            manager = client.app.state.job_manager
+            assert manager.probe_cache(PROBE) is None
+            client.post(f"/api/jobs/{job_id}/cancel")
+
+    def test_a_late_reply_is_not_attributed_to_the_next_probe(self, server):
+        """A probe that timed out still answers eventually; the next probe
+        must not read that stale hit list as its own."""
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            worker = manager.worker_manager
+            worker.ensure_worker()
+            held = []
+            real_send = worker.send_command
+
+            def hold_then_answer(command):
+                # The first probe never answers in time; its reply lands
+                # just before the second probe is sent
+                if command["type"] == "probe_cache" and not held:
+                    held.append(command)
+                    return None
+                if held:
+                    late = held.pop()
+                    worker._results.put(
+                        {
+                            "type": "probe_cache",
+                            "probe_id": late["probe_id"],
+                            "cached": ["stale"],
+                        }
+                    )
+                worker.cached_steps = ["fresh"]
+                return real_send(command)
+
+            worker.send_command = hold_then_answer
+            assert manager.probe_cache(PROBE, timeout=0.05) is None
+            assert manager.probe_cache(PROBE) == ["fresh"]
+
+    def test_an_unanswered_probe_is_unknown(self, server):
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            manager.worker_manager.ensure_worker()
+            manager.worker_manager.send_command = lambda command: None
+            assert manager.probe_cache(PROBE, timeout=0.05) is None
+
+
+class TestAcknowledgementRecord:
+    """Every job says which form of cost acknowledgement queued it (#85), so
+    'was this run consented to at its actual size' is answerable later."""
+
+    def test_a_submit_records_none_by_default(self, server):
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            job = manager.submit(workflow=valid_workflow(), arguments={})
+            assert job.acknowledged == "none"
+            assert manager.describe(job)["acknowledged"] == "none"
+            assert manager.describe(job)["acknowledged_cost"] is None
+
+    def test_a_bound_submit_records_the_object(self, server):
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            bound = {"fingerprint": "sha256:abc", "minutes": 3.0, "downloads": []}
+            job = manager.submit(
+                workflow=valid_workflow(),
+                arguments={},
+                acknowledged="bound",
+                acknowledged_cost=bound,
+            )
+            detail = manager.describe(job)
+            assert detail["acknowledged"] == "bound"
+            assert detail["acknowledged_cost"] == bound
+            assert job.summary()["acknowledged"] == "bound"
+
+    def test_history_keeps_the_form_and_the_object(self, server):
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            bound = {
+                "fingerprint": "sha256:abc",
+                "minutes": 3.0,
+                "downloads": ["org/x"],
+            }
+            job = manager.submit(
+                workflow=valid_workflow(),
+                arguments={},
+                acknowledged="bound",
+                acknowledged_cost=bound,
+            )
+            wait_for_status(client, job.id, TERMINAL_STATES)
+            row = manager.history.get(job.id)
+            assert row["acknowledged"] == "bound"
+            assert row["acknowledged_cost"] == bound
+            assert row["spec"]["acknowledged_cost"] == bound
+            listed = [
+                s for s in manager.history.recent_summaries() if s["id"] == job.id
+            ]
+            assert listed[0]["acknowledged"] == "bound"
+
+    def test_a_database_without_the_column_is_migrated(self, tmp_path):
+        import sqlite3
+
+        from dw.server.jobs import JobHistory
+
+        path = tmp_path / "old.sqlite"
+        with sqlite3.connect(path) as connection:
+            connection.execute(
+                "CREATE TABLE jobs (id TEXT PRIMARY KEY, workflow TEXT, status TEXT,"
+                " created_at REAL, started_at REAL, finished_at REAL, arguments TEXT,"
+                " spec TEXT, manifest TEXT, warnings TEXT, error TEXT)"
+            )
+            connection.execute(
+                "INSERT INTO jobs (id, workflow, status, created_at, spec) VALUES"
+                " ('old1', 'w', 'succeeded', 1.0, '{}')"
+            )
+        history = JobHistory(str(path))
+        assert history.get("old1")["acknowledged"] == "none"
+        assert history.get("old1")["acknowledged_cost"] is None
+
+    def test_a_rerun_carries_the_original_object_for_the_record(self, server):
+        with server(success_script) as client:
+            manager = client.app.state.job_manager
+            bound = {"fingerprint": "sha256:abc", "minutes": 3.0, "downloads": []}
+            job = manager.submit(
+                workflow=valid_workflow(),
+                arguments={},
+                acknowledged="bound",
+                acknowledged_cost=bound,
+            )
+            wait_for_status(client, job.id, TERMINAL_STATES)
+            rerun = manager.rerun(job.id)
+            assert rerun.acknowledged == "none"
+            assert rerun.spec["acknowledged_cost"] == bound
+
+
+def plan_for(client, workflow, arguments=None):
+    body = {"workflow": workflow}
+    if arguments:
+        body["arguments"] = arguments
+    answer = client.post("/api/validate?sizes=false", json=body).json()
+    assert answer["valid"], answer
+    return answer["plan"]
+
+
+def bound(plan):
+    return {
+        "fingerprint": plan["fingerprint"],
+        "minutes": plan["estimate"]["minutes"],
+        "downloads": [d["repo"] for d in plan["downloads_required"] if d["repo"]],
+    }
+
+
+@pytest.fixture
+def no_hub(monkeypatch):
+    import dw.plan
+
+    monkeypatch.setattr(dw.plan, "scan_models", lambda cache_dir=None: {"repos": []})
+
+
+def list_workflow(job_id="listed"):
+    return {
+        "id": job_id,
+        "seed": "variable:seed",
+        "variables": {"seed": 1, "shots": [{"name": "a", "prompt": "a"}]},
+        "steps": [
+            {
+                "name": "shot",
+                "for_each": "variable:shots",
+                "pipeline": {
+                    "configuration": {"component_type": "{Fake}", "no_generator": True},
+                    "from_pretrained_arguments": {"model_name": "m"},
+                    "arguments": {"prompt": "item:prompt"},
+                },
+            }
+        ],
+    }
+
+
+class TestBoundAcknowledgement:
+    """A bound acknowledgement is checked against the run's current plan
+    before anything is queued (#85); true and absent are untouched."""
+
+    def test_a_matching_fingerprint_queues(self, server, no_hub):
+        with server(success_script) as client:
+            plan = plan_for(client, list_workflow())
+            response = client.post(
+                "/api/jobs",
+                json={"workflow": list_workflow(), "acknowledged_cost": bound(plan)},
+            )
+            assert response.status_code == 201, response.json()
+            assert response.json()["acknowledged"] == "bound"
+            assert response.json()["acknowledged_cost"] == bound(plan)
+
+    def test_a_longer_list_than_acknowledged_is_refused(self, server, no_hub):
+        with server(success_script) as client:
+            plan = plan_for(client, list_workflow())
+            longer = {"shots": [{"name": n, "prompt": n} for n in "abc"]}
+            response = client.post(
+                "/api/jobs",
+                json={
+                    "workflow": list_workflow(),
+                    "arguments": longer,
+                    "acknowledged_cost": bound(plan),
+                },
+            )
+            assert response.status_code == 409
+            detail = response.json()["detail"]
+            assert detail["reason"] == "fingerprint"
+            assert detail["acknowledged"]["fingerprint"] == plan["fingerprint"]
+            assert detail["plan"]["list_entries"] == {"shots": 3}
+            assert detail["plan"]["fingerprint"] != plan["fingerprint"]
+            assert "differ" in detail["message"]
+            assert client.app.state.job_manager.worker_manager.commands == []
+
+    def test_a_new_seed_is_the_same_work(self, server, no_hub):
+        with server(success_script) as client:
+            plan = plan_for(client, list_workflow())
+            response = client.post(
+                "/api/jobs",
+                json={
+                    "workflow": list_workflow(),
+                    "arguments": {"seed": 99},
+                    "acknowledged_cost": bound(plan),
+                },
+            )
+            assert response.status_code == 201
+
+    def test_a_download_not_acknowledged_is_refused(self, server, no_hub):
+        with server(success_script) as client:
+            plan = plan_for(client, list_workflow())
+            acknowledgement = bound(plan)
+            acknowledgement["downloads"] = []  # the caller left the repo out
+            response = client.post(
+                "/api/jobs",
+                json={
+                    "workflow": list_workflow(),
+                    "acknowledged_cost": acknowledgement,
+                },
+            )
+            assert response.status_code == 409
+            detail = response.json()["detail"]
+            assert detail["reason"] == "downloads"
+            assert "m" in detail["message"]
+
+    def test_a_download_that_vanished_is_not_a_refusal(
+        self, server, no_hub, monkeypatch
+    ):
+        with server(success_script) as client:
+            plan = plan_for(client, list_workflow())
+            assert bound(plan)["downloads"] == ["m"]
+            import dw.plan
+
+            monkeypatch.setattr(
+                dw.plan,
+                "scan_models",
+                lambda cache_dir=None: {"repos": [{"repo_id": "m"}]},
+            )
+            response = client.post(
+                "/api/jobs",
+                json={"workflow": list_workflow(), "acknowledged_cost": bound(plan)},
+            )
+            assert response.status_code == 201
+
+    def test_an_unplannable_run_is_refused_not_passed(
+        self, server, no_hub, monkeypatch
+    ):
+        import dw.server.app as app_module
+
+        with server(success_script) as client:
+            plan = plan_for(client, list_workflow())
+
+            def boom(*a, **k):
+                raise RuntimeError("no plan")
+
+            monkeypatch.setattr(app_module, "build_plan", boom)
+            response = client.post(
+                "/api/jobs",
+                json={"workflow": list_workflow(), "acknowledged_cost": bound(plan)},
+            )
+            assert response.status_code == 409
+            assert response.json()["detail"]["reason"] == "unplannable"
+            assert response.json()["detail"]["plan"] is None
+
+    def test_true_and_absent_queue_without_planning(self, server, no_hub, monkeypatch):
+        import dw.server.app as app_module
+
+        def boom(*a, **k):
+            raise AssertionError("the boolean path must not plan")
+
+        monkeypatch.setattr(app_module, "build_plan", boom)
+        with server(success_script) as client:
+            plain = client.post("/api/jobs", json={"workflow": valid_workflow("p")})
+            flagged = client.post(
+                "/api/jobs",
+                json={"workflow": valid_workflow("f"), "acknowledged_cost": True},
+            )
+            off = client.post(
+                "/api/jobs",
+                json={"workflow": valid_workflow("o"), "acknowledged_cost": False},
+            )
+        assert plain.json()["acknowledged"] == "none"
+        assert flagged.json()["acknowledged"] == "boolean"
+        assert off.json()["acknowledged"] == "none"
+
+    def test_a_bad_argument_is_still_a_400_under_a_bound_acknowledgement(
+        self, server, no_hub
+    ):
+        """The argument and schema checks come first, as they do on the
+        boolean path - a typo in an argument name is the caller's 400, not
+        a 409 telling them to acknowledge with true and try again."""
+        with server(success_script) as client:
+            plan = plan_for(client, list_workflow())
+            response = client.post(
+                "/api/jobs",
+                json={
+                    "workflow": list_workflow(),
+                    "arguments": {"shotz": []},
+                    "acknowledged_cost": bound(plan),
+                },
+            )
+            assert response.status_code == 400
+            assert "shotz" in response.json()["detail"]
+
+    def test_an_invalid_workflow_is_still_a_400_under_a_bound_acknowledgement(
+        self, server, no_hub
+    ):
+        with server(success_script) as client:
+            broken = {"id": "broken", "steps": "no"}
+            response = client.post(
+                "/api/jobs",
+                json={
+                    "workflow": broken,
+                    "acknowledged_cost": {"fingerprint": "sha256:0", "downloads": []},
+                },
+            )
+            assert response.status_code == 400
+
+    def test_a_bound_form_without_a_fingerprint_is_a_422(self, server):
+        with server(success_script) as client:
+            response = client.post(
+                "/api/jobs",
+                json={
+                    "workflow": valid_workflow(),
+                    "acknowledged_cost": {"minutes": 3},
+                },
+            )
+            assert response.status_code == 422
+
+    def test_a_stored_prompt_edited_after_validation_is_refused(
+        self, server, no_hub, tmp_path
+    ):
+        (tmp_path / "prompts" / "p.json").write_text(json.dumps({"text": "before"}))
+        workflow = valid_workflow("prompted")
+        workflow["variables"]["prompt"] = "prompt:p"
+        with server(success_script) as client:
+            plan = plan_for(client, workflow)
+            (tmp_path / "prompts" / "p.json").write_text(json.dumps({"text": "after"}))
+            response = client.post(
+                "/api/jobs",
+                json={"workflow": workflow, "acknowledged_cost": bound(plan)},
+            )
+            assert response.status_code == 409
+            assert response.json()["detail"]["reason"] == "fingerprint"
+
+
+class TestBoundRerun:
+    def test_a_rerun_with_the_original_plan_queues_even_with_a_new_seed(
+        self, server, no_hub
+    ):
+        with server(success_script) as client:
+            plan = plan_for(client, list_workflow())
+            first = client.post(
+                "/api/jobs",
+                json={"workflow": list_workflow(), "acknowledged_cost": bound(plan)},
+            ).json()
+            wait_for_status(client, first["id"], TERMINAL_STATES)
+            response = client.post(
+                f"/api/jobs/{first['id']}/rerun",
+                json={"new_seed": True, "acknowledged_cost": bound(plan)},
+            )
+            assert response.status_code == 201
+            assert response.json()["acknowledged"] == "bound"
+
+    def test_a_rerun_bound_to_a_stale_plan_is_refused(self, server, no_hub):
+        with server(success_script) as client:
+            first = client.post("/api/jobs", json={"workflow": list_workflow()}).json()
+            wait_for_status(client, first["id"], TERMINAL_STATES)
+            other = plan_for(client, valid_workflow("other"))
+            response = client.post(
+                f"/api/jobs/{first['id']}/rerun",
+                json={"acknowledged_cost": bound(other)},
+            )
+            assert response.status_code == 409
+            assert response.json()["detail"]["reason"] == "fingerprint"
+
+    def test_a_rerun_with_true_is_unchanged(self, server, no_hub):
+        with server(success_script) as client:
+            first = client.post("/api/jobs", json={"workflow": list_workflow()}).json()
+            wait_for_status(client, first["id"], TERMINAL_STATES)
+            response = client.post(
+                f"/api/jobs/{first['id']}/rerun", json={"acknowledged_cost": True}
+            )
+            assert response.status_code == 201
+            assert response.json()["acknowledged"] == "boolean"
+
+    def test_an_unknown_job_is_still_404(self, server):
+        with server(success_script) as client:
+            response = client.post(
+                "/api/jobs/nope/rerun",
+                json={"acknowledged_cost": {"fingerprint": "sha256:0"}},
+            )
+            assert response.status_code == 404
diff --git a/tests/test_server_guides.py b/tests/test_server_guides.py
index e07ee3e9..8d22dcea 100644
--- a/tests/test_server_guides.py
+++ b/tests/test_server_guides.py
@@ -95,10 +95,32 @@ def test_a_guide_missing_from_the_install_says_so(self, tmp_path, monkeypatch):
 
 
 class TestFetching:
-    def test_a_guide_comes_back_whole_by_default(self, checkout):
+    def test_no_section_answers_the_index_not_the_whole_file(self, checkout):
+        """A whole guide is ~19.6k tokens in one call - more than the entire
+        tool surface costs to connect - and the call that spends it is the
+        one an agent makes by accident (#101). The opening and the first
+        section come back; the rest is named, not sent."""
         guide = guides.get_guide("tasks")
 
-        assert guide == {"name": "tasks", "section": None, "content": TASKS_TEXT}
+        assert guide["section"] is None
+        assert (
+            guide["content"] == "# Tasks\n\n## Speech Generation\n\ngenerate_speech\n"
+        )
+        assert guide["sections"] == ["Speech Generation", "Frame Interpolation"]
+        assert guide["withheld"] == ["Frame Interpolation"]
+        assert "Frame Interpolation" in guide["sections"]
+        assert "section=" in guide["note"]
+
+    def test_a_guide_with_no_sections_comes_back_whole(self, checkout, tmp_path):
+        """Nothing to index, so there is nothing to withhold."""
+        (tmp_path / "checkout" / "docs" / "TASKS.md").write_text(
+            "# Tasks\n\nall of it\n"
+        )
+
+        guide = guides.get_guide("tasks")
+
+        assert guide["content"] == "# Tasks\n\nall of it\n"
+        assert guide["withheld"] == [] and "note" not in guide
 
     def test_one_section_comes_back_alone_with_its_heading(self, checkout):
         guide = guides.get_guide("tasks", section="Speech Generation")
@@ -221,10 +243,12 @@ def test_the_listing_is_the_index(self, client):
         assert tasks["sections"] == ["Speech Generation", "Frame Interpolation"]
         assert tasks["summary"].strip()
 
-    def test_a_whole_guide(self, client):
+    def test_no_section_answers_the_index(self, client):
         body = client.get("/api/guides/tasks").json()
 
-        assert body == {"name": "tasks", "section": None, "content": TASKS_TEXT}
+        assert body["section"] is None
+        assert body["withheld"] == ["Frame Interpolation"]
+        assert "Frame Interpolation" not in body["content"]
 
     def test_one_section_matched_loosely(self, client):
         body = client.get(
diff --git a/tests/test_video_utils.py b/tests/test_video_utils.py
index 4c7850bb..86b3684d 100644
--- a/tests/test_video_utils.py
+++ b/tests/test_video_utils.py
@@ -316,6 +316,43 @@ def test_the_files_own_frame_rate_comes_back_with_it(self, tmp_path):
 
         assert load_audio_video(path).fps == 24
 
+    def test_a_loaded_video_argument_carries_the_files_rate(self, tmp_path):
+        """The fps that reaches pair_audio: a `video` argument is loaded by
+        fetch_video, which used to hand on a bare frame list - so a 24 fps
+        file was written back at the 8 fps default, three times long, with
+        nothing said about it (#104)."""
+        from dw.arguments import fetch_video
+        from dw.tasks.video_utils import FrameList
+
+        path = self.write_video(tmp_path / "shot.mp4", fps=24, num_frames=24)
+
+        frames = fetch_video(path)
+
+        assert isinstance(frames, FrameList) and len(frames) == 24
+        assert frames.fps == 24
+
+    def test_a_file_that_states_no_rate_stays_a_plain_list(self, tmp_path):
+        """Not knowing the rate is a state, not an error - the frames are
+        already read by the time it is asked for."""
+        from dw.arguments import _with_frame_rate
+
+        assert _with_frame_rate(["a", "b"], str(tmp_path / "gone.mp4")) == ["a", "b"]
+
+    def test_the_rate_reaches_the_paired_video(self, tmp_path):
+        """End to end over the two functions #104 sits between."""
+        from dw.arguments import fetch_video
+        from dw.tasks.pair_audio import pair_audio
+
+        path = self.write_video(tmp_path / "shot.mp4", fps=24, num_frames=24)
+
+        paired = pair_audio(
+            video=fetch_video(path),
+            audio=numpy.zeros((2, 16000), dtype=numpy.float32),
+            sample_rate=16000,
+        )
+
+        assert paired.fps == 24
+
     def test_audio_is_fitted_to_the_frames_own_duration(self, tmp_path):
         """The codec pads the last block; joined shot after shot that padding
         would walk the sound off the picture."""
diff --git a/tests/test_worker_execute.py b/tests/test_worker_execute.py
index 1ff46154..4d218612 100644
--- a/tests/test_worker_execute.py
+++ b/tests/test_worker_execute.py
@@ -264,3 +264,74 @@ def record():
             _execute(worker, FailingWorkflow())
 
     assert alive_at_cleanup == [False]
+
+
+class ProbableWorkflow(StubWorkflow):
+    def __init__(self, hits):
+        super().__init__()
+        self.hits = hits
+        self.probed_with = None
+
+    def cache_hits(self, arguments):
+        self.probed_with = arguments
+        return list(self.hits)
+
+
+def test_probe_cache_answers_with_the_workflows_hits():
+    worker = _make_worker()
+    workflow = ProbableWorkflow(["gen"])
+    command = {
+        "type": "probe_cache",
+        "probe_id": "p-1",
+        "workflow_path": "x.json",
+        "arguments": {"prompt": "p"},
+        "output_dir": "/tmp",
+    }
+    with patch("dw.worker.workflow_from_file", return_value=workflow):
+        worker._handle_probe_cache(command)
+    assert _drain(worker.result_queue) == [
+        {"type": "probe_cache", "probe_id": "p-1", "cached": ["gen"]}
+    ]
+    assert workflow.probed_with == {"prompt": "p"}
+
+
+def test_probe_cache_reports_a_failure_as_unknown_not_as_a_crash():
+    worker = _make_worker()
+    with patch("dw.worker.workflow_from_file", side_effect=ValueError("bad file")):
+        worker._handle_probe_cache(
+            {
+                "type": "probe_cache",
+                "workflow_path": "x.json",
+                "arguments": {},
+                "output_dir": "/tmp",
+            }
+        )
+    [answer] = _drain(worker.result_queue)
+    assert answer["type"] == "probe_cache"
+    assert answer["probe_id"] is None  # echoed even when the command had none
+    assert answer["cached"] is None
+    assert "bad file" in answer["error"]
+
+
+def test_probe_cache_activates_the_jobs_asset_dir(tmp_path):
+    worker = _make_worker()
+    seen = {}
+
+    class AssetAwareWorkflow(ProbableWorkflow):
+        def cache_hits(self, arguments):
+            from dw.assets import get_asset_dir
+
+            seen["asset_dir"] = get_asset_dir()
+            return []
+
+    with patch("dw.worker.workflow_from_file", return_value=AssetAwareWorkflow([])):
+        worker._handle_probe_cache(
+            {
+                "type": "probe_cache",
+                "workflow_path": "x.json",
+                "arguments": {},
+                "output_dir": "/tmp",
+                "asset_dir": str(tmp_path),
+            }
+        )
+    assert seen["asset_dir"] == str(tmp_path)
diff --git a/tests/test_workflow_sources.py b/tests/test_workflow_sources.py
index 07bcc927..4eb478be 100644
--- a/tests/test_workflow_sources.py
+++ b/tests/test_workflow_sources.py
@@ -6,6 +6,7 @@
 
 import pytest
 
+from dw.security import SecurityError
 from dw.workflow_sources import (
     BUILTIN_ORIGIN,
     EXAMPLES_ORIGIN,
@@ -14,6 +15,7 @@
     find_workflow,
     listing,
     resolve_in_source,
+    resolve_sub_workflow,
     source_for_path,
     workflow_names,
     workflow_sources,
@@ -109,6 +111,57 @@ def test_a_path_knows_which_source_it_belongs_to(self, roots, tmp_path):
         assert source_for_path(sources, str(tmp_path / "elsewhere.json")) is None
 
 
+class TestSubWorkflowResolution:
+    """A composed step's relative path is confined to the root it is handed
+    back with, so a name that climbs out of the catalog is never resolved -
+    and never stat'ed, which the dw/path-injection query flagged here. The
+    '../models/x.json' form a template uses to reach a sibling catalog folder
+    still resolves."""
+
+    @pytest.fixture
+    def catalog(self, tmp_path):
+        """workflows/templates/ beside workflows/models/, and a decoy outside
+        the catalog that a climbing name reaches."""
+        root = tmp_path / "workflows"
+        (root / "templates").mkdir(parents=True)
+        (root / "models").mkdir()
+        (root / "models" / "Child.json").write_text(json.dumps({"id": "child"}))
+        outside = tmp_path / "Outside.json"
+        outside.write_text(json.dumps({"id": "outside"}))
+        return root, outside
+
+    def test_a_climb_inside_the_confinement_resolves(self, catalog):
+        root, _outside = catalog
+        candidate, confine_to = resolve_sub_workflow(
+            "../models/Child.json", str(root / "templates"), str(root)
+        )
+        assert os.path.basename(candidate) == "Child.json"
+        assert confine_to == str(root)
+
+    def test_a_climb_out_of_the_confinement_is_refused_not_resolved(self, catalog):
+        root, outside = catalog
+        assert os.path.isfile(outside), "the decoy has to exist to be reachable"
+        with pytest.raises(SecurityError):
+            resolve_sub_workflow(
+                "../../Outside.json", str(root / "templates"), str(root)
+            )
+
+    def test_an_unconfined_caller_still_confines_to_the_catalog(self, catalog):
+        """No confine_to (a bare CLI run) confines to the catalog root the
+        run itself would use - the nearest ancestor named 'workflows' - so
+        the climb out is refused rather than stat'ed."""
+        root, _outside = catalog
+        with pytest.raises(SecurityError):
+            resolve_sub_workflow("../../Outside.json", str(root / "templates"), None)
+
+    def test_an_unconfined_caller_may_climb_to_a_sibling_catalog_folder(self, catalog):
+        root, _outside = catalog
+        candidate, _confine_to = resolve_sub_workflow(
+            "../models/Child.json", str(root / "templates"), None
+        )
+        assert os.path.basename(candidate) == "Child.json"
+
+
 class TestNames:
     def test_names_are_relative_and_slash_separated(self, roots):
         _workspace, examples = roots
diff --git a/tests/test_workflow_step_cache.py b/tests/test_workflow_step_cache.py
index 7818672f..5c80250f 100644
--- a/tests/test_workflow_step_cache.py
+++ b/tests/test_workflow_step_cache.py
@@ -609,3 +609,66 @@ def test_adding_a_downstream_reference_misses_on_a_result_that_was_not_retained(
     counts = _run_with_per_step_counts(with_reference, {})
 
     assert counts.get("A") == 1
+
+
+class TestCacheHits:
+    """cache_hits() answers the plan's cached_steps (#85): what the next
+    run would reuse, by the run's own preparation, executing nothing."""
+
+    def test_a_cold_cache_reports_no_hits(self):
+        step_cache.clear()
+        workflow, _ = build_test_workflow_and_call_count_spy()
+        try:
+            assert workflow.cache_hits({}) == []
+        finally:
+            for p in workflow._test_patcher:
+                p.stop()
+
+    def test_after_a_run_the_probe_names_what_the_next_run_reuses(self):
+        step_cache.clear()
+        workflow, call_count = build_test_workflow_and_call_count_spy()
+        try:
+            workflow.run({})
+            probe = workflow.cache_hits({})
+            workflow.run({})
+            reused = [
+                entry["step"] for entry in workflow.manifest if entry.get("reused")
+            ]
+            assert probe == ["generate"]
+            assert probe == reused
+            assert call_count() == 1, "the probe executed nothing"
+        finally:
+            for p in workflow._test_patcher:
+                p.stop()
+
+    def test_a_changed_argument_is_a_miss(self):
+        step_cache.clear()
+        workflow, _ = build_test_workflow_and_call_count_spy()
+        try:
+            workflow.run({"prompt": "a cat"})
+            assert workflow.cache_hits({"prompt": "a dog"}) == []
+        finally:
+            for p in workflow._test_patcher:
+                p.stop()
+
+    def test_an_unseeded_workflow_has_no_hits(self):
+        step_cache.clear()
+        workflow, _ = build_test_workflow_and_call_count_spy()
+        del workflow.workflow_definition["seed"]
+        try:
+            workflow.run({})
+            assert workflow.cache_hits({}) == []
+        finally:
+            for p in workflow._test_patcher:
+                p.stop()
+
+    def test_the_probe_writes_nothing(self, tmp_path):
+        step_cache.clear()
+        workflow, _ = build_test_workflow_and_call_count_spy()
+        workflow.output_dir = str(tmp_path)
+        try:
+            workflow.cache_hits({})
+            assert list(tmp_path.iterdir()) == []
+        finally:
+            for p in workflow._test_patcher:
+                p.stop()
diff --git a/ui/src/lib/pages/EditorPage.svelte b/ui/src/lib/pages/EditorPage.svelte
index fb3f9752..a2cdc596 100644
--- a/ui/src/lib/pages/EditorPage.svelte
+++ b/ui/src/lib/pages/EditorPage.svelte
@@ -29,6 +29,7 @@
   import { loadPromptLibrary, promptLibrary } from '../promptlib.svelte'
   import { PROMPT_LIST_ID } from '../prompts'
   import { storageGet, storageSet } from '../storage'
+  import { describePlan } from '../plan'
   import StepEditor from '../editor/StepEditor.svelte'
   import JsonEditor from '../editor/JsonEditor.svelte'
   import VariablesForm from '../editor/VariablesForm.svelte'
@@ -646,6 +647,20 @@
     {:else}
       <div class="error">{validation.error}</div>
     {/if}
+    {#if validation.valid && validation.plan}
+      <!-- What a run of this definition, with these defaults, will do -
+           the figure to expect before pressing Run, and the weights it
+           would pull first, which the cost block never counts -->
+      <ul
+        class="plan"
+        aria-label="what a run will do"
+        title="from the workflow's own cost block and this server's model cache - a plan, not a promise"
+      >
+        {#each describePlan(validation.plan) as line, i (i)}
+          <li class:warn={line.tone === 'warn'}>{line.text}</li>
+        {/each}
+      </ul>
+    {/if}
   </div>
 {/if}
 
@@ -1033,6 +1048,22 @@
   .error {
     color: var(--bad);
   }
+  /* The plan under the verdict: figures the engine resolves, so mono, and
+     quiet - a warn line is the one that changes the number to expect */
+  .plan {
+    list-style: none;
+    margin: var(--space-2) 0 0;
+    padding: 0;
+    font-family: var(--font-mono);
+    font-size: var(--t-xs);
+    color: var(--muted);
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.2rem var(--space-3);
+  }
+  .plan .warn {
+    display: inline;
+  }
   .hint {
     font-size: 0.8rem;
   }
diff --git a/ui/src/lib/pages/EditorPage.test.ts b/ui/src/lib/pages/EditorPage.test.ts
index 52c15905..1962a8b7 100644
--- a/ui/src/lib/pages/EditorPage.test.ts
+++ b/ui/src/lib/pages/EditorPage.test.ts
@@ -20,6 +20,26 @@ vi.mock('../api', () => ({
       .fn()
       .mockResolvedValue({ workflows: [], workflow_dir: 'workflows' }),
     listPrompts: vi.fn().mockResolvedValue({ prompts: [], details: {} }),
+    validate: vi.fn().mockResolvedValue({
+      valid: true,
+      error: null,
+      errors: [],
+      warnings: [],
+      plan: {
+        fingerprint: 'sha256:abc',
+        steps: 3,
+        list_entries: { shots: 2 },
+        cached_steps: 0,
+        downloads_required: [{ repo: 'org/model', gb: 41.2 }],
+        estimate: {
+          minutes: 12,
+          basis: 'catalog',
+          device: 'cuda',
+          measured_on: 'card',
+          partial: false,
+        },
+      },
+    }),
   },
 }))
 
@@ -56,3 +76,23 @@ describe('EditorPage view switch', () => {
     )
   })
 })
+
+describe('EditorPage validation plan', () => {
+  it('shows what a run will do under a valid verdict', async () => {
+    render(EditorPage, { name: '' })
+    await waitFor(() =>
+      expect(screen.getByLabelText('workflow id')).toBeTruthy(),
+    )
+
+    await screen.getByRole('button', { name: /validate/i }).click()
+
+    await waitFor(() =>
+      expect(screen.getByLabelText('what a run will do')).toBeTruthy(),
+    )
+    const plan = screen.getByLabelText('what a run will do')
+    expect(plan.textContent).toContain('3 steps (shots: 2)')
+    expect(plan.textContent).toContain('~12 min on cuda')
+    expect(plan.textContent).toContain('0 of 3 steps cached')
+    expect(plan.textContent).toContain('needs download: org/model (41.2 GB)')
+  })
+})
diff --git a/ui/src/lib/pages/JobPage.svelte b/ui/src/lib/pages/JobPage.svelte
index ad91dc09..3544746d 100644
--- a/ui/src/lib/pages/JobPage.svelte
+++ b/ui/src/lib/pages/JobPage.svelte
@@ -315,6 +315,21 @@
         >seed {seed}</code
       >
     {/if}
+    {#if job.acknowledged === 'bound'}
+      <!-- Whoever queued this bound their go-ahead to a plan; the number
+           they quoted is what this run was consented to at -->
+      <code
+        class="muted seed"
+        title={`queued with a cost acknowledgement bound to the validated plan${
+          job.acknowledged_cost?.fingerprint
+            ? ` (${job.acknowledged_cost.fingerprint.slice(0, 15)}…)`
+            : ''
+        }`}
+        >{job.acknowledged_cost?.minutes != null
+          ? `acknowledged at ${job.acknowledged_cost.minutes} min`
+          : 'acknowledged'}</code
+      >
+    {/if}
     <span class="flex"></span>
     {#if running}
       <button
diff --git a/ui/src/lib/pages/JobPage.test.ts b/ui/src/lib/pages/JobPage.test.ts
index bf4282b3..78ebf910 100644
--- a/ui/src/lib/pages/JobPage.test.ts
+++ b/ui/src/lib/pages/JobPage.test.ts
@@ -285,3 +285,27 @@ it('explains a run that wrote nothing at all rather than showing no results', as
     'base result.save is false, so the step is kept in memory and never written',
   ])
 })
+
+it('says when the run was queued with an acknowledgement bound to its plan', async () => {
+  detail.job = {
+    ...job([]),
+    acknowledged: 'bound',
+    acknowledged_cost: {
+      fingerprint: 'sha256:abcdef0123456789',
+      minutes: 38,
+      downloads: [],
+    },
+  }
+  render(JobPage, { jobId: 'j1' })
+  const line = await waitFor(() => screen.getByText(/acknowledged/))
+  expect(line.textContent?.replace(/\s+/g, ' ').trim()).toBe(
+    'acknowledged at 38 min',
+  )
+})
+
+it('says nothing about an acknowledgement a run did not carry', async () => {
+  detail.job = { ...job([]), acknowledged: 'none' }
+  render(JobPage, { jobId: 'j1' })
+  await waitFor(() => expect(screen.getByText('j1')).toBeTruthy())
+  expect(screen.queryByText(/acknowledged/)).toBeNull()
+})
diff --git a/ui/src/lib/pages/JobsPage.svelte b/ui/src/lib/pages/JobsPage.svelte
index 921d38f3..7e31c0d3 100644
--- a/ui/src/lib/pages/JobsPage.svelte
+++ b/ui/src/lib/pages/JobsPage.svelte
@@ -127,6 +127,13 @@
           {#if (workspace.names?.length ?? 0) > 1}
             <span class="wschip muted" title="workspace">{job.workspace}</span>
           {/if}
+          {#if job.acknowledged === 'bound'}
+            <span
+              class="wschip muted"
+              title="queued with a cost acknowledgement bound to the validated plan"
+              >acknowledged</span
+            >
+          {/if}
           {#if job.queue_position !== undefined}
             <span class="qpos" title="position in the waiting queue"
               >#{job.queue_position + 1}</span
diff --git a/ui/src/lib/plan.test.ts b/ui/src/lib/plan.test.ts
new file mode 100644
index 00000000..5031300c
--- /dev/null
+++ b/ui/src/lib/plan.test.ts
@@ -0,0 +1,127 @@
+import { describe, expect, it } from 'vitest'
+import { describePlan } from './plan'
+import type { Plan } from './types'
+
+const base: Plan = {
+  fingerprint: 'sha256:abc',
+  steps: 8,
+  list_entries: { shots: 5 },
+  cached_steps: 0,
+  downloads_required: [{ repo: 'org/model', gb: 41.2 }],
+  estimate: {
+    minutes: 42,
+    basis: 'catalog',
+    device: 'cuda',
+    measured_on: 'RTX 3090',
+    partial: false,
+  },
+}
+
+describe('describePlan', () => {
+  it('reads the work, the figure with its basis, the cache and the downloads', () => {
+    const lines = describePlan(base)
+    expect(lines.map((line) => line.text)).toEqual([
+      '8 steps (shots: 5)',
+      '~42 min on cuda - measured on RTX 3090',
+      '0 of 8 steps cached',
+      'needs download: org/model (41.2 GB)',
+    ])
+    expect(lines.map((line) => line.tone)).toEqual([
+      'plain',
+      'plain',
+      'plain',
+      'warn',
+    ])
+  })
+
+  it('re-priced for the list passed says so', () => {
+    const [, figure] = describePlan({
+      ...base,
+      estimate: { ...base.estimate, basis: 'per_entry' },
+    })
+    expect(figure.text).toBe(
+      '~42 min on cuda - re-priced for 5 shots, measured on RTX 3090',
+    )
+  })
+
+  it('an extrapolated figure says it is an estimate, not a measurement', () => {
+    const [, figure] = describePlan({
+      ...base,
+      estimate: { ...base.estimate, basis: 'derived' },
+    })
+    expect(figure.text).toBe(
+      '~42 min on cuda - estimated for 5 shots, from a figure measured on RTX 3090',
+    )
+    expect(figure.tone).toBe('warn')
+  })
+
+  it('a figure from another accelerator is a warning, not a quote', () => {
+    const [, figure] = describePlan({
+      ...base,
+      estimate: { ...base.estimate, basis: 'other_device', device: 'mps' },
+    })
+    expect(figure.text).toBe(
+      'no figure for mps - 42 min was measured on RTX 3090',
+    )
+    expect(figure.tone).toBe('warn')
+  })
+
+  it('no cost block is said plainly', () => {
+    const [, figure] = describePlan({
+      ...base,
+      estimate: {
+        minutes: null,
+        basis: 'unknown',
+        device: 'cuda',
+        measured_on: null,
+        partial: false,
+      },
+    })
+    expect(figure.text).toBe('no measured cost')
+    expect(figure.tone).toBe('warn')
+  })
+
+  it('a partial figure names what it is missing', () => {
+    const [, figure] = describePlan({
+      ...base,
+      estimate: { ...base.estimate, partial: true },
+    })
+    expect(figure.text).toContain('plus a composed workflow with no cost')
+  })
+
+  it('an unknown cache answer and a single step read naturally', () => {
+    const lines = describePlan({
+      ...base,
+      steps: 1,
+      list_entries: {},
+      cached_steps: null,
+      downloads_required: [],
+    })
+    expect(lines.map((line) => line.text)).toEqual([
+      '1 step',
+      '~42 min on cuda - measured on RTX 3090',
+    ])
+  })
+
+  it('every cached step means a rerun generates nothing', () => {
+    const lines = describePlan({
+      ...base,
+      cached_steps: 8,
+      downloads_required: [],
+    })
+    expect(lines[2].text).toBe('all 8 steps cached - a run generates nothing')
+  })
+
+  it('a download without a size, and a checkpoint URL, are still named', () => {
+    const lines = describePlan({
+      ...base,
+      downloads_required: [
+        { repo: 'org/a', gb: null },
+        { repo: null, url: 'https://x.test/ckpt.safetensors', gb: null },
+      ],
+    })
+    expect(lines[3].text).toBe(
+      'needs download: org/a, https://x.test/ckpt.safetensors',
+    )
+  })
+})
diff --git a/ui/src/lib/plan.ts b/ui/src/lib/plan.ts
new file mode 100644
index 00000000..b9e619dd
--- /dev/null
+++ b/ui/src/lib/plan.ts
@@ -0,0 +1,85 @@
+import type { Plan } from './types'
+
+/** One line of a plan, read for a person: what it says and how loudly.
+ * `warn` marks a figure that is not a quote (no cost block, a figure from
+ * another accelerator) and weights the box has to fetch first - the two
+ * things that make "42 minutes" the wrong number to expect. */
+export interface PlanLine {
+  text: string
+  tone: 'plain' | 'warn'
+}
+
+const steps = (n: number) => `${n} step${n === 1 ? '' : 's'}`
+
+/** The plan a validate call answered with, as the lines the editor shows
+ * under the verdict: the work, the figure with its basis, what the step
+ * cache would serve, and what would be downloaded first. Pure, so the
+ * wording is testable without a component. */
+export function describePlan(plan: Plan): PlanLine[] {
+  const lines: PlanLine[] = []
+
+  const lists = Object.entries(plan.list_entries)
+    .map(([name, count]) => `${name}: ${count}`)
+    .join(', ')
+  lines.push({
+    text: lists ? `${steps(plan.steps)} (${lists})` : steps(plan.steps),
+    tone: 'plain',
+  })
+
+  lines.push(figure(plan))
+
+  if (plan.cached_steps !== null && plan.steps > 0) {
+    const cached = plan.cached_steps
+    lines.push({
+      text:
+        cached >= plan.steps
+          ? `all ${steps(plan.steps)} cached - a run generates nothing`
+          : `${cached} of ${steps(plan.steps)} cached`,
+      tone: 'plain',
+    })
+  }
+
+  const downloads = plan.downloads_required.map((entry) => {
+    const name = entry.repo ?? entry.url ?? '?'
+    return entry.gb === null ? name : `${name} (${entry.gb} GB)`
+  })
+  if (downloads.length) {
+    lines.push({
+      text: `needs download: ${downloads.join(', ')}`,
+      tone: 'warn',
+    })
+  }
+
+  return lines
+}
+
+function figure(plan: Plan): PlanLine {
+  const { minutes, basis, device, measured_on, partial } = plan.estimate
+  const card = measured_on ? `measured on ${measured_on}` : 'measured'
+  const missing = partial ? ', plus a composed workflow with no cost' : ''
+  if (basis === 'unknown' || minutes === null) {
+    return { text: 'no measured cost', tone: 'warn' }
+  }
+  if (basis === 'other_device') {
+    return {
+      text: `no figure for ${device} - ${minutes} min was ${card}${missing}`,
+      tone: 'warn',
+    }
+  }
+  const forList = Object.entries(plan.list_entries)
+    .map(([name, count]) => `${count} ${name}`)
+    .join(', ')
+  // `derived` is the stored total stretched over a list the caller
+  // resized - an estimate, so it is said to be one rather than quoted
+  if (basis === 'derived') {
+    return {
+      text: `~${minutes} min on ${device} - estimated for ${forList}, from a figure ${card}${missing}`,
+      tone: 'warn',
+    }
+  }
+  const scaled = basis === 'per_entry' ? `re-priced for ${forList}, ` : ''
+  return {
+    text: `~${minutes} min on ${device} - ${scaled}${card}${missing}`,
+    tone: 'plain',
+  }
+}
diff --git a/ui/src/lib/types.ts b/ui/src/lib/types.ts
index 8f370c18..a11be174 100644
--- a/ui/src/lib/types.ts
+++ b/ui/src/lib/types.ts
@@ -9,6 +9,10 @@ export interface JobSummary {
   queue_position?: number
   /** The workspace this job ran in - 'default' for the default one. */
   workspace: string
+  /** Which form of cost acknowledgement queued the job: none (the web UI
+   * and any caller that sent nothing), a bare boolean, or one bound to the
+   * plan a validate answered with. Absent on rows from older servers. */
+  acknowledged?: 'none' | 'boolean' | 'bound'
 }
 
 export interface ManifestEntry {
@@ -30,6 +34,14 @@ export interface JobDetail extends JobSummary {
   error: string | null
   traceback: string | null
   event_count: number
+  /** The plan the caller bound its acknowledgement to, when it did. */
+  acknowledged_cost?: AcknowledgedCost | null
+}
+
+export interface AcknowledgedCost {
+  fingerprint: string
+  minutes?: number | null
+  downloads?: string[]
 }
 
 export interface JobEvent {
@@ -207,6 +219,29 @@ export interface ValidationResult {
   /** Every schema violation with its JSON path; empty when valid. */
   errors: { path: string | null; message: string }[]
   warnings: string[]
+  /** What the run will execute for the definition validated - on a valid
+   * answer; null when the server could not build it, absent from older
+   * servers and from an invalid answer. */
+  plan?: Plan | null
+}
+
+/** A validate answer's plan: the work a run will do, priced from the
+ * workflow's own cost block, with the weights this box lacks named. */
+export interface Plan {
+  fingerprint: string
+  steps: number
+  list_entries: Record<string, number>
+  /** How many steps the worker's step cache would serve; null when the
+   * worker was busy or did not answer. */
+  cached_steps: number | null
+  downloads_required: { repo: string | null; url?: string; gb: number | null }[]
+  estimate: {
+    minutes: number | null
+    basis: 'per_entry' | 'catalog' | 'derived' | 'other_device' | 'unknown'
+    device: string
+    measured_on: string | null
+    partial: boolean
+  }
 }
 
 export interface GalleryFile {