diff --git a/plane/runs/check-lmdeploy.yaml b/plane/runs/check-lmdeploy.yaml
new file mode 100644
index 0000000..ce60f66
--- /dev/null
+++ b/plane/runs/check-lmdeploy.yaml
@@ -0,0 +1,44 @@
+# one-case check before the validation-46 measurement (task 8); a subset of runs/validation-46.yaml
+apiVersion: openultrasast.io/v1alpha1
+kind: Run
+metadata:
+  name: check-lmdeploy
+spec:
+  tasks:
+  - name: lmdeploy-media-url-ssrf-facts
+    task: repo-facts-lmdeploy-media-url-ssrf
+    outputs:
+    - facts.json
+    budget: &id001
+      usd: 0
+      calls: 0
+    serialize: repo-facts
+  - name: lmdeploy-media-url-ssrf-va
+    task: verify-a-lmdeploy-media-url-ssrf
+    inputs:
+      facts: lmdeploy-media-url-ssrf-facts/facts.json
+    outputs:
+    - units.jsonl
+    - summary.json
+    budget:
+      usd: 0.02
+      calls: 8
+  - name: lmdeploy-media-url-ssrf-vb
+    task: verify-b-lmdeploy-media-url-ssrf
+    inputs:
+      facts: lmdeploy-media-url-ssrf-facts/facts.json
+    outputs:
+    - units.jsonl
+    - summary.json
+    budget:
+      usd: 0.02
+      calls: 8
+  - name: lmdeploy-media-url-ssrf-agree
+    task: agree-lmdeploy-media-url-ssrf
+    inputs:
+      pass_a: lmdeploy-media-url-ssrf-va/units.jsonl
+      pass_b: lmdeploy-media-url-ssrf-vb/units.jsonl
+    outputs:
+    - agreed.json
+    - disputed.json
+    budget: *id001
diff --git a/plane/tasks/agree.yaml b/plane/tasks/agree.yaml
index 010b303..bd286d9 100644
--- a/plane/tasks/agree.yaml
+++ b/plane/tasks/agree.yaml
@@ -7,7 +7,7 @@ metadata:
   name: agree
   atespace: default
 spec:
-  image: "localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4"
+  image: "localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76"
   command: ["agree"]
   resources:
     requests:
diff --git a/plane/tasks/repo-facts.yaml b/plane/tasks/repo-facts.yaml
index d629b10..07c91cb 100644
--- a/plane/tasks/repo-facts.yaml
+++ b/plane/tasks/repo-facts.yaml
@@ -8,7 +8,7 @@ metadata:
   name: repo-facts
   atespace: default
 spec:
-  image: "localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4"
+  image: "localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76"
   command: ["repo-facts"]
   resources:
     requests:
diff --git a/plane/tasks/validation-46.yaml b/plane/tasks/validation-46.yaml
index 5de0bb7..e0cf8ab 100644
--- a/plane/tasks/validation-46.yaml
+++ b/plane/tasks/validation-46.yaml
@@ -5,7 +5,7 @@ metadata:
   name: repo-facts-budibase-mongo-template-nosqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -34,7 +34,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -65,7 +65,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -94,7 +94,7 @@ metadata:
   name: agree-budibase-mongo-template-nosqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -121,7 +121,7 @@ metadata:
   name: repo-facts-cct-studio-server-cmdi
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -150,7 +150,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -181,7 +181,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -210,7 +210,7 @@ metadata:
   name: agree-cct-studio-server-cmdi
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -237,7 +237,7 @@ metadata:
   name: repo-facts-contextforge-prompt-ssti
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -266,7 +266,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -297,7 +297,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -326,7 +326,7 @@ metadata:
   name: agree-contextforge-prompt-ssti
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -353,7 +353,7 @@ metadata:
   name: repo-facts-froxlor-admin-ip-second-order-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -382,7 +382,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -413,7 +413,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -442,7 +442,7 @@ metadata:
   name: agree-froxlor-admin-ip-second-order-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -469,7 +469,7 @@ metadata:
   name: repo-facts-fuxa-tdengine-escape-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -498,7 +498,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -529,7 +529,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -558,7 +558,7 @@ metadata:
   name: agree-fuxa-tdengine-escape-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -585,7 +585,7 @@ metadata:
   name: repo-facts-lmdeploy-media-url-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -614,7 +614,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -645,7 +645,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -674,7 +674,7 @@ metadata:
   name: agree-lmdeploy-media-url-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -701,7 +701,7 @@ metadata:
   name: repo-facts-medplum-external-auth-open-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -730,7 +730,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -761,7 +761,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -790,7 +790,7 @@ metadata:
   name: agree-medplum-external-auth-open-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -817,7 +817,7 @@ metadata:
   name: repo-facts-pgadmin-maintenance-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -846,7 +846,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -877,7 +877,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -906,7 +906,7 @@ metadata:
   name: agree-pgadmin-maintenance-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -933,7 +933,7 @@ metadata:
   name: repo-facts-qwed-sympy-eval
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -962,7 +962,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -993,7 +993,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1022,7 +1022,7 @@ metadata:
   name: agree-qwed-sympy-eval
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -1049,7 +1049,7 @@ metadata:
   name: repo-facts-reactpress-findall-column-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -1078,7 +1078,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1109,7 +1109,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1138,7 +1138,7 @@ metadata:
   name: agree-reactpress-findall-column-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -1165,7 +1165,7 @@ metadata:
   name: repo-facts-unleash-addon-webhook-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -1194,7 +1194,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1225,7 +1225,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1254,7 +1254,7 @@ metadata:
   name: agree-unleash-addon-webhook-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -1281,7 +1281,7 @@ metadata:
   name: repo-facts-winml-cli-serve-cors
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -1310,7 +1310,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1341,7 +1341,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1370,7 +1370,7 @@ metadata:
   name: agree-winml-cli-serve-cors
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -1397,7 +1397,7 @@ metadata:
   name: repo-facts-wp-directorist-avatar-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -1426,7 +1426,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1457,7 +1457,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1486,7 +1486,7 @@ metadata:
   name: agree-wp-directorist-avatar-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -1513,7 +1513,7 @@ metadata:
   name: repo-facts-wp-gopay-log-filter-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -1542,7 +1542,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1573,7 +1573,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1602,7 +1602,7 @@ metadata:
   name: agree-wp-gopay-log-filter-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -1629,7 +1629,7 @@ metadata:
   name: repo-facts-wp-groundhogg-confirm-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -1658,7 +1658,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1689,7 +1689,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1718,7 +1718,7 @@ metadata:
   name: agree-wp-groundhogg-confirm-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
diff --git a/plane/tasks/verify.yaml b/plane/tasks/verify.yaml
index 7752921..9ee583b 100644
--- a/plane/tasks/verify.yaml
+++ b/plane/tasks/verify.yaml
@@ -10,7 +10,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: "localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4"
+  image: "localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76"
   command: ["verify"]
   resources:
     requests:
diff --git a/src/openultrasast/plane/runner.py b/src/openultrasast/plane/runner.py
index 1ef5c25..85c7ae3 100644
--- a/src/openultrasast/plane/runner.py
+++ b/src/openultrasast/plane/runner.py
@@ -751,17 +751,15 @@ def _finish(session: _Session, env: Mapping[str, str], exit_code: int | None, su
 
 
 def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threading.Event, gate: StartGate) -> int:
-    """Materialise, wait for the start request, run the command once, deliver; on a resumed volume, only what the
-    marker says is left. A boot whose marker records a delivered run refuses every start request."""
+    """Wait for the start request, then materialise, run the command once and deliver; on a resumed volume, only
+    what the marker says is left. A boot whose marker records a delivered run refuses every start request.
+
+    Workspaces are prepared only after the start: Substrate's golden boot never gets one, so it touches no network,
+    and a started actor is RUNNING with its egress policy in force (a clone at boot failed on the live cluster
+    while the actor was still being restored, 2026-09-29)."""
     session: _Session | None = None
     try:
         session = _prepare(env)
-        if session.prepared.exists():
-            log.info("workspaces were prepared on an earlier boot; keeping them")
-        else:
-            cache_dir = env.get("OUSAST_CASE_CACHE")
-            materialise(session.task, session.workspaces, Path(cache_dir) if cache_dir else None, load_pins(env.get("OUSAST_GIT_PINS", "")))
-            session.prepared.touch()
         done = _read_marker(session.marker)
         if done is not None and done.get("delivered"):
             gate.refuse(f"task {session.task.metadata.name} already ran and was delivered ({done.get('status')})")
@@ -773,7 +771,7 @@ def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threa
         if env.get("AX_RUNNER_AUTOSTART") == "1":
             start: Start | None = gate.autostart()
         else:
-            log.info("workspaces ready; waiting for the start request on %s", START_PATH)
+            log.info("waiting for the start request on %s", START_PATH)
             start = gate.wait(stop)
         if start is None:
             return 0
@@ -785,6 +783,13 @@ def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threa
             return _exit_of(_finish(session, env, done.get("exit"), kept))
         if stop.is_set():
             return 0
+        try:
+            _materialise_once(session, env)
+        except RunnerError as exc:
+            log.error("runner failed: %s", exc)
+            failed = _failed(f"runner failed: {exc}", read_summary(session.output_dir))
+            write_summary(session.output_dir, failed)
+            return _exit_of(_finish(session, env, None, failed))
         log.info("workspaces ready; running task %s: %s", session.task.metadata.name, list(session.task.command))
         grace = float(env.get("OUSAST_TERM_GRACE") or TERM_GRACE)
         code, summary = run_command(session.task, session.output_dir, env, stop, grace, start.credentials)
@@ -809,6 +814,15 @@ def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threa
         return _exit_of(_finish(session, env, None, summary))
 
 
+def _materialise_once(session: _Session, env: Mapping[str, str]) -> None:
+    if session.prepared.exists():
+        log.info("workspaces were prepared on an earlier boot; keeping them")
+        return
+    cache_dir = env.get("OUSAST_CASE_CACHE")
+    materialise(session.task, session.workspaces, Path(cache_dir) if cache_dir else None, load_pins(env.get("OUSAST_GIT_PINS", "")))
+    session.prepared.touch()
+
+
 def _read_marker(path: Path) -> dict[str, Any] | None:
     try:
         loaded = json.loads(path.read_text(encoding="utf-8"))
diff --git a/tests/test_plane_increment.py b/tests/test_plane_increment.py
index d59c46a..c37f6ad 100644
--- a/tests/test_plane_increment.py
+++ b/tests/test_plane_increment.py
@@ -38,7 +38,10 @@ def test_every_manifest_under_plane_loads() -> None:
     manifests = load_manifests(paths)
     assert set(manifests.models) == {"deepseek-flash"}
     assert set(TEMPLATES) <= set(manifests.tasks)
-    assert len(manifests.workspaces) == 30 and set(manifests.runs) == {"validation-46"}
+    assert len(manifests.workspaces) == 30 and "validation-46" in manifests.runs
+    full = {t.name for t in manifests.runs["validation-46"].tasks}
+    for name, other in manifests.runs.items():  # check Runs (e.g. check-lmdeploy) are subsets of the measurement
+        assert {t.name for t in other.tasks} <= full, name
 
 
 def test_model_prices_are_the_endpoint_prices() -> None:
diff --git a/tests/test_plane_runner.py b/tests/test_plane_runner.py
index 06953c6..645f5fd 100644
--- a/tests/test_plane_runner.py
+++ b/tests/test_plane_runner.py
@@ -758,3 +758,16 @@ def test_the_golden_boot_never_runs_the_command(env: dict[str, str], receiver: R
             proc.wait()
     assert len(counter.read_text().splitlines()) == 1
     assert files_containing(tmp_path, SECRET) == [], "no log, workspace, output or state file holds the credential"
+
+
+def test_workspaces_are_prepared_only_after_the_start_request(env: dict[str, str], receiver: Receiver, tmp_path: Path) -> None:
+    """Substrate's golden boot never gets a start, so it must touch no workspace (and no network): a clone at boot
+    failed on the live cluster while the actor was still being restored (2026-09-29)."""
+    thread, environ, codes = main_in_thread(tmp_path, OUSAST_ARTIFACT_URL=receiver.url)
+    time.sleep(0.5)
+    written = [p for p in (tmp_path / "ws").rglob("*") if p.is_file()] if (tmp_path / "ws").exists() else []
+    assert written == [], "nothing is materialised before the start request"
+    assert post_start(environ["AX_RUNNER_BOUND_PORT"], {"run": "run-1", "task": "stub"})[0] == 202
+    thread.join(timeout=30)
+    assert codes == [0]
+    assert [p for p in (tmp_path / "ws").rglob("*") if p.is_file()], "the start materialises the workspace"