@@ -189,12 +189,44 @@ bun packages/plugin/scripts/two-pass-activation-runs/container-launcher.ts \
   .cortexkit/internal-docs/investigations/two-pass-credential-bridge/evidence
 ```
 
-`paid-credential-run.json` names `apikey:anthropic:ufukaltinokgmail` and
-`apikey:cline-pass`, not code defaults. Its jobs are deliberately empty until
-approved route/catalog, tariff, prompts, container image and model inputs are
-provided. A filled config uses the same command with its path plus an explicit
-enrollment-file path as the third argument. Paid configs **must** specify
-`network: "bridge"` and a nonempty exact grant list; missing network or grants
+`paid-credential-run.json` is now a **preparation plan, not an executable
+campaign**. It inventories every matrix row plus the cache check, names the two
+exact grants, records current sources and proposed grader/budget inputs, and
+explicitly excludes only the two dropped Sonnet fallback rows. Other unresolved
+jobs stay visible and prevent dispatch with `credential_unresolved_jobs`.
+`preparationOnly: true` also refuses with `credential_campaign_driver_required`,
+even if all unresolved rows are excluded: the credential probe cannot load a
+corpus, run the replay schedule/graders, or share a ledger across containers.
+Its `@corpus:` / `@persisted-measurement:` prompt references must never be sent
+as literal model prompts. Selected-candidate images, real read-tool/origin
+evidence, billing gaps and prior-spend reconciliation are still outstanding.
+
+Run the static, provider-free preparation check from the repository root:
+
+```sh
+bun packages/plugin/scripts/two-pass-activation-runs/paid-preflight.ts \
+  --mock-preflight packages/plugin/scripts/two-pass-activation-runs/paid-credential-run.json \
+  <private-preflight-result.json>
+```
+
+Run it on Linux or in a capped offline container with the private corpus mounted
+read-only. It uses the native corpus/profile preflight and existing token
+counter, emits only case ids/sizes/counts, and exits **1 while anything is
+unresolved**. Static profile acceptance is not an effective host-profile report
+or live authorization. Grading estimates use recorded-output proxies and full
+output allowances; the proposed retry ceiling is conditional on caps a future
+campaign driver must enforce. Actual unknown charges remain null, not zero.
+The temporary `corpus-readonly` path must be restaged from the authorized bundle
+before reproducing the check; the private data is never committed.
+
+For separately prepared credential probes, the launcher accepts config, evidence
+directory and explicit enrollment-file path. Network mode must be
+`network: "bridge"` for non-mock jobs. Paid jobs require an exact listed grant;
+grant-free jobs require provider `opencode` on an OpenCode lane, an explicit zero
+tariff with a nonempty `source`, and `checkedAt` equal to today's UTC date.
+They receive no secret stdin payload or credential environment and never open
+the vault. OpenCode uses its literal `public` API marker for free access; that
+marker is not a user credential or a grant. Missing network or paid grants
 refuse with `paid_network_bridge_required` or `real_grant_list_required`.
 Mock configs can never select bridge networking. The launcher
 logs the selected network once per job. The proxy records each upstream host
 
@@ -2,7 +2,7 @@ import { cpSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, re
 import { join } from "node:path";
 import { networkInterfaces } from "node:os";
 import { createHash } from "node:crypto";
-import { readHandoff, assertNoMaterial, secretForms, type Handoff } from "./credential-protocol";
+import { readJobHandoff, assertNoMaterial, secretForms, type Handoff } from "./credential-protocol";
 import type { ContainerJob } from "./container-config";
 import { callMeter, redact } from "./activation-driver";
 import { hostAdapter } from "./host-adapters";
@@ -69,23 +69,24 @@ export async function runContainerChild(job: ContainerJob, mock: boolean) {
         } finally { environ.fill(0); }
     };
     const profile: Profile = { id: "credential-transport", family: "credential-transport", modelRoute: `${job.providerId ?? "mock"}/${job.modelId}`,
-        priceClass: "paid", tariff: job.tariff ?? { inputUSDPerMillion: 1, outputUSDPerMillion: 1, source: "Synthetic mock tariff, not provider pricing" },
+        priceClass: job.priceClass ?? "paid", tariff: job.tariff ?? { inputUSDPerMillion: 1, outputUSDPerMillion: 1, source: "Synthetic mock tariff, not provider pricing" },
         configurationSource: "explicit container job", variantSource: "explicit container job",
         entry: buildTurnOneAuthorizationRequest({ lane: job.lane === "anthropic-cache" ? "omp" : job.lane,
             carrier: job.lane === "omp" ? "pi-historian-rpc" : "hidden-completion", provider: job.providerId ?? "mock", modelId: job.modelId,
             variant: null, temperature: null, thinkingLevel: null }, { system: "credential-transport", formatInstruction: "credential-transport", toolSurface: [], checkToolSurface: [] }).requestedIdentity };
     try {
-        handoff = await readHandoff(process.stdin, job.grant);
-        process.stdin.destroy();
-        key = handoff.material; handoff.material = "";
+        try { handoff = await readJobHandoff(process.stdin, job.grant); }
+        finally { process.stdin.destroy(); }
+        if (handoff) { key = handoff.material; handoff.material = ""; }
         assertNoMaterial("reader_environ", readFileSync(`/proc/${process.pid}/environ`), key);
         for (const [name, path] of Object.entries(env)) mkdirSync(name === "OPENCODE_DB" ? join(path, "..") : path, { recursive: true, mode: 0o700 });
         if (existsSync(join(install, "host-sdk"))) cpSync(join(install, "host-sdk"), env.XDG_CONFIG_HOME, { recursive: true });
         let endpoint = job.providerURL;
         if (mock) {
             provider = mockProvider(() => "Mock credential transport acknowledged.", undefined, (observed) => {
                 const expectedHeader = job.lane === "anthropic-cache" ? "x-api-key" : "authorization";
-                headers.push({ expectedHeader, matched: observed.get(expectedHeader) === (expectedHeader === "authorization" ? `Bearer ${key}` : key),
+                headers.push({ expectedHeader, matched: job.grant ? observed.get(expectedHeader) === (expectedHeader === "authorization" ? `Bearer ${key}` : key)
+                    : observed.get("authorization") === "Bearer public" && !observed.has("x-api-key"),
                     authorizationMatched: observed.get("authorization") === `Bearer ${key}`, apiKeyMatched: observed.get("x-api-key") === key,
                     presentHeaders: ["authorization", "x-api-key"].filter((name) => observed.has(name)) });
             });
@@ -133,17 +134,18 @@ export async function runContainerChild(job: ContainerJob, mock: boolean) {
         } else {
             const adapter = hostAdapter(job.lane, { sourceRoot: install, mockProviderURL: endpoint,
                 modelId: job.modelId, providerId: job.providerId ?? "mock", providerPackage: job.providerPackage,
-                piApi: job.piApi, piAuth: job.grant.kind === "api_key" ? "apiKey" : "oauth",
-                outputCeiling: job.outputCeiling, providerKeyEnv: "TWO_PASS_PROVIDER_API_KEY",
+                piApi: job.piApi, piAuth: job.grant?.kind === "api_key" ? "apiKey" : "oauth",
+                outputCeiling: job.outputCeiling, providerKeyEnv: job.grant ? "TWO_PASS_PROVIDER_API_KEY" : undefined,
+                grantFree: !job.grant,
                 paidProvider: !mock, foregroundOnly: mock, timeoutMs: 120_000,
                 onProviderAttempt(providerHost) { console.log(JSON.stringify({ providerAttempt: { providerHost } })); },
                 onProcessObserved: (pid) => observeProcess(pid),
                 magicContext: mock ? { enabled: false } : job.magicContext ?? {} });
             const entry = join(install, job.lane === "omp" ? "packages/pi-plugin/dist/index.js" : job.lane === "opencode-2" ? "packages/plugin/dist/v2/server.js" : "packages/plugin/dist/index.js");
-            const childEnv = { ...env, TWO_PASS_PROVIDER_API_KEY: key };
+            const childEnv = { ...env, ...(job.grant ? { TWO_PASS_PROVIDER_API_KEY: key } : {}) };
             host = await adapter.start({ installRoot: install, pluginEntrypoint: entry, env: childEnv, meter: callMeter(ledger, profile) });
-            observeProcess(host.pid, "TWO_PASS_PROVIDER_API_KEY", true);
-            childEnvironment = { pid: host.pid, allowedVariable: "TWO_PASS_PROVIDER_API_KEY", environContainsKey: true, argvClean: true };
+            observeProcess(host.pid, "TWO_PASS_PROVIDER_API_KEY", !!job.grant);
+            childEnvironment = { pid: host.pid, allowedVariable: job.grant ? "TWO_PASS_PROVIDER_API_KEY" : null, environContainsKey: !!job.grant, argvClean: true };
             result = await host.runSession(job.prompt);
         }
         if (mock && (!headers.length || headers.some((entry) => !entry.matched))) throw new Error("credential_provider_header_mismatch");
 
@@ -3,9 +3,13 @@ import type { HostLane } from "./host-adapters";
 import type { Profile } from "../two-pass-live-replay/artifact-schema";
 
 export interface ContainerJob {
+    id?: string;
+    status?: "ready" | "unresolved";
+    unresolvedReason?: string;
+    priceClass?: "free" | "paid";
     lane: HostLane | "anthropic-cache";
     image: string;
-    grant: GrantRequest;
+    grant?: GrantRequest;
     providerURL?: string;
     providerId?: string;
     providerPackage?: string;
@@ -16,7 +20,7 @@ export interface ContainerJob {
     magicContext?: Record<string, unknown>;
     cacheSystem?: string;
     cacheTurnTwo?: string;
-    tariff?: Profile["tariff"];
+    tariff?: Profile["tariff"] & { checkedAt?: string };
 }
 export interface ContainerRunConfig {
     version: 1;
@@ -25,29 +29,57 @@ export interface ContainerRunConfig {
     runMs: number;
     grants: GrantRequest[];
     jobs: ContainerJob[];
+    excludedJobIds?: string[];
+    preparationOnly?: boolean;
+}
+
+export function selectedJobs(config: ContainerRunConfig): ContainerJob[] {
+    const excluded = config.excludedJobIds ?? [];
+    if (new Set(excluded).size !== excluded.length || excluded.some((id) => !config.jobs.some((job) => job.id === id)))
+        throw new Error("credential_excluded_job_unknown");
+    const ids = config.jobs.map((job) => job.id).filter((id) => id !== undefined);
+    if (new Set(ids).size !== ids.length) throw new Error("credential_duplicate_job_id");
+    return config.jobs.filter((job) => !job.id || !excluded.includes(job.id));
 }
 
 export function validateRunConfig(config: ContainerRunConfig) {
     if (config.version !== 1 || typeof config.mock !== "boolean" || !Number.isSafeInteger(config.runMs) ||
         config.runMs < 1000 || config.runMs > 1_800_000) throw new Error("credential_run_config");
     if (config.mock && config.network !== "none") throw new Error("mock_network_must_be_none");
     if (!config.mock && config.network !== "bridge") throw new Error("paid_network_bridge_required");
-    if (!Array.isArray(config.grants) || !config.grants.length) throw new Error("real_grant_list_required");
+    if (!Array.isArray(config.grants)) throw new Error("real_grant_list_required");
     for (const grant of config.grants) validateGrant(grant);
     if (new Set(config.grants.map((grant) => grant.name)).size !== config.grants.length) throw new Error("duplicate_credential_grant");
     if (!config.jobs?.length) throw new Error("credential_jobs_required");
-    for (const job of config.jobs) {
-        validateGrant(job.grant);
-        if (!config.grants.some((grant) => grant.name === job.grant.name && grant.kind === job.grant.kind))
+    for (const job of config.jobs) if (job.status === "unresolved" && (!job.id || !job.unresolvedReason?.trim()))
+        throw new Error("credential_unresolved_job_reason_required");
+    const jobs = selectedJobs(config);
+    if (!jobs.length) throw new Error("credential_jobs_required");
+    if (!config.grants.length && jobs.some((job) => job.priceClass !== "free")) throw new Error("real_grant_list_required");
+    for (const job of jobs) {
+        if (job.status === "unresolved") throw new Error("credential_unresolved_jobs");
+        if (job.status && !["ready", "unresolved"].includes(job.status)) throw new Error("credential_job_status");
+        const free = job.priceClass === "free";
+        if (free && (job.grant || job.providerId !== "opencode" || !["opencode-1", "opencode-2"].includes(job.lane)))
+            throw new Error("credential_free_route_required");
+        if (!free) validateGrant(job.grant!);
+        if (job.grant && !config.grants.some((grant) => grant.name === job.grant!.name && grant.kind === job.grant!.kind))
             throw new Error("unlisted_credential_grant");
         if (!["opencode-1", "opencode-2", "omp", "anthropic-cache"].includes(job.lane) ||
             !/^[\w./:@-]+$/.test(job.image) || !job.modelId || !job.prompt ||
             !Number.isSafeInteger(job.outputCeiling) || job.outputCeiling < 1 || job.outputCeiling > 8192)
             throw new Error("credential_job_config");
-        if (!config.mock) {
+        if (!config.mock || free) {
             if (!job.tariff || !Number.isFinite(job.tariff.inputUSDPerMillion) || !Number.isFinite(job.tariff.outputUSDPerMillion) ||
-                job.tariff.inputUSDPerMillion <= 0 || job.tariff.outputUSDPerMillion <= 0 || !job.tariff.source)
+                job.tariff.inputUSDPerMillion < 0 || job.tariff.outputUSDPerMillion < 0 || !job.tariff.source?.trim())
                 throw new Error("paid_tariff_required");
+            if (free ? job.tariff.inputUSDPerMillion !== 0 || job.tariff.outputUSDPerMillion !== 0
+                : job.tariff.inputUSDPerMillion === 0 || job.tariff.outputUSDPerMillion === 0)
+                throw new Error("paid_tariff_required");
+            if (free && job.tariff.checkedAt !== new Date().toISOString().slice(0, 10))
+                throw new Error("credential_zero_tariff_fresh_source_required");
+        }
+        if (!config.mock) {
             if (!job.providerURL) throw new Error("paid_provider_route_required");
             const url = new URL(job.providerURL);
             if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash)
@@ -56,8 +88,10 @@ export function validateRunConfig(config: ContainerRunConfig) {
         if (job.lane === "anthropic-cache" && (job.modelId !== "claude-sonnet-5-5" || !job.cacheSystem || !job.cacheTurnTwo))
             throw new Error("cache_measurement_inputs_required");
     }
-    for (const grant of config.grants) if (!config.jobs.some((job) => job.grant.name === grant.name))
+    for (const grant of config.grants) if (!config.jobs.some((job) => job.grant?.name === grant.name))
         throw new Error("unused_credential_grant");
+    // The credential probe cannot execute corpus schedules or share a ledger across containers.
+    if (config.preparationOnly) throw new Error("credential_campaign_driver_required");
 }
 
 export function containerArgs(config: ContainerRunConfig, job: ContainerJob, name: string) {
@@ -73,6 +107,7 @@ export function containerArgs(config: ContainerRunConfig, job: ContainerJob, nam
 export function containerInvocation(config: ContainerRunConfig, job: ContainerJob, name: string, material: string) {
     const argv = containerArgs(config, job, name);
     const env = { PATH: process.env.PATH, HOME: process.env.HOME };
-    assertSpawnBoundary(argv, env, material);
+    if (job.grant) assertSpawnBoundary(argv, env, material);
+    else if (material) throw new Error("credential_free_material_refused");
     return { argv, env };
 }