@@ -38,15 +38,23 @@ State crosses invocations through:
 Pushes to `cklin/dependabot-automation` run a read-only preview using the pushed
 commit, not `main`. The `dry-run` job summary lists selected PRs, their heads,
 planned actions and reasons, native auto-merge disarming, and retry run IDs.
-Discovery and evaluation use the same decision logic as live processing.
-
-The preview token has only contents, pull-request, and Actions read permissions.
-It does not change PRs, rerun CI, collect investigation artifacts, mint App tokens,
-or invoke Copilot. Live jobs are excluded from push events and still load trusted
-code from `main` for their existing triggers. The preview does not validate merge
-authorization or Copilot repair outcomes.
-
-This preparation is kept in a separate commit so it can be dropped after testing.
+Discovery and evaluation use the same decision logic as live processing. Failed
+PRs get preview evidence and a `copilot-preview` job, including retry-eligible PRs:
+the retry is bypassed only for this experiment, not performed or consumed.
+
+The planning job has only contents, pull-request, and Actions read permissions.
+Preview workers have only contents read and Copilot inference permissions, and
+use the same isolated container launcher as live investigations. Their evidence
+is marked `preview: true`, so Copilot knows no retry or review hold was applied.
+Copilot may edit and test its disposable checkout; a validated response and
+proposed file contents are reported in job summaries and `preview-repair-*`
+artifacts, never published to PRs.
+
+No preview job changes PRs, reruns CI, or mints App tokens. Live jobs are excluded
+from push events and still load trusted code from `main` for their existing
+triggers. Preview runs consume Copilot credits and do not validate merge
+authorization. This preparation is isolated in temporary commits so it can be
+dropped after testing.
 
 ## Lifecycle
 
@@ -90,7 +98,8 @@ to diagnose the blocker. Other merge API errors fail the run.
 | File                  | Responsibility                                                                                |
 | --------------------- | --------------------------------------------------------------------------------------------- |
 | `controller.cjs`      | Workflow commands, eligibility, transitions, and trusted GitHub writes.                       |
-| `dry-run.cjs`         | Read-only branch-push preview and job summary, using the controller's shared planner.         |
+| `dry-run.cjs`         | Prepare read-only preview evidence and report validated Copilot results without publication.  |
+| `run-worker.sh`       | Shared isolated container launcher for live investigations and Copilot previews.              |
 | `evidence.cjs`        | Collect PR text, patches, failed-job logs, and their index.                                   |
 | `repair-protocol.cjs` | Validate result shape, allowed repair paths, and size limits. Shared by worker and publisher. |
 | `worker.cjs`          | Invoke Copilot and collect actual checkout changes, not model-supplied file contents.         |
 
@@ -16,7 +16,7 @@ const {
 const { writeInvestigation } = require("./evidence.cjs");
 const { allowedFile, validateResult } = require("./repair-protocol.cjs");
 const { collectFiles, run } = require("./worker.cjs");
-const { dryRun } = require("./dry-run.cjs");
+const { dryRun, reportPreview } = require("./dry-run.cjs");
 
 const head = "a".repeat(40);
 const repo = { owner: "github", repo: "vscode-codeql" };
@@ -80,6 +80,34 @@ function workerWorkspace(t) {
   return { work, task, output };
 }
 
+function summaryFixture() {
+  return {
+    content: [],
+    written: false,
+    addHeading(text) {
+      this.content.push(text);
+      return this;
+    },
+    addRaw(text) {
+      this.content.push(text);
+      return this;
+    },
+    addTable(rows) {
+      this.content.push(
+        ...rows.flat().filter((cell) => typeof cell === "string"),
+      );
+      return this;
+    },
+    addList(items) {
+      this.content.push(...items);
+      return this;
+    },
+    async write() {
+      this.written = true;
+    },
+  };
+}
+
 function harness({ workspace } = {}) {
   const state = {
     pr: candidate(),
@@ -343,57 +371,146 @@ test("planning propagates unavailable CI instead of reporting a decision", async
   assert.deepEqual(state.outputs, {});
 });
 
-test("dry-run orchestration reports investigation using only read APIs", async () => {
-  const { state, github } = harness();
-  state.pr.auto_merge = {};
-  state.runs[0].conclusion = "failure";
-  state.runs[0].run_attempt = 2;
-  const readOnlyGithub = {
-    rest: {
-      pulls: {
-        list: github.rest.pulls.list,
-        get: github.rest.pulls.get,
-        listCommits: github.rest.pulls.listCommits,
-      },
-      actions: {
-        listWorkflowRunsForRepo: github.rest.actions.listWorkflowRunsForRepo,
-      },
-    },
-    paginate: github.paginate,
-  };
-  const content = [];
-  let written = false;
-  const summary = {
-    addHeading(text) {
-      content.push(text);
-      return this;
-    },
-    addRaw(text) {
-      content.push(text);
-      return this;
-    },
-    addTable(rows) {
-      content.push(...rows.flat().filter((cell) => typeof cell === "string"));
-      return this;
-    },
-    async write() {
-      written = true;
-    },
-  };
-  await dryRun({
-    github: readOnlyGithub,
-    context: { repo },
-    core: { info() {}, setOutput() {}, summary },
-  });
-  assert(written);
-  const report = content.join("\n");
-  assert.match(report, /#42/);
-  assert(report.includes(head));
-  assert.match(report, /Add review hold, collect evidence, and invoke Copilot/);
-  assert.match(report, /Read-only preview/);
-  assert.match(report, /not validated/);
-  assert.deepEqual(state.calls, []);
-  assert.deepEqual(state.pr.labels, []);
+test("dry-run prepares only failed-PR previews without reruns or PR writes", async (t) => {
+  for (const [name, attempt] of [
+    ["passing", null],
+    ["retry bypass", 1],
+    ["investigation", 2],
+  ]) {
+    await t.test(name, async (t) => {
+      const workspace = temporaryWorkspace(t);
+      const { state, github } = harness({ workspace });
+      state.pr.auto_merge = {};
+      if (attempt !== null) {
+        state.runs[0].conclusion = "failure";
+        state.runs[0].run_attempt = attempt;
+      }
+      const originalPr = structuredClone(state.pr);
+      const readOnlyGithub = {
+        rest: {
+          pulls: {
+            list: github.rest.pulls.list,
+            get: github.rest.pulls.get,
+            listCommits: github.rest.pulls.listCommits,
+            listFiles: github.rest.pulls.listFiles,
+          },
+          actions: {
+            listWorkflowRunsForRepo:
+              github.rest.actions.listWorkflowRunsForRepo,
+            listJobsForWorkflowRun: github.rest.actions.listJobsForWorkflowRun,
+            downloadJobLogsForWorkflowRun:
+              github.rest.actions.downloadJobLogsForWorkflowRun,
+          },
+        },
+        paginate: github.paginate,
+      };
+      const summary = summaryFixture();
+      await dryRun({
+        github: readOnlyGithub,
+        context: { repo },
+        core: {
+          info() {},
+          setOutput: (name, value) => (state.outputs[name] = value),
+          summary,
+        },
+        workspace,
+      });
+      assert(summary.written);
+      const report = summary.content.join("\n");
+      assert.match(report, /#42/);
+      assert(report.includes(head));
+      const previews = JSON.parse(state.outputs.previews);
+      if (attempt === null) {
+        assert.deepEqual(previews, []);
+        assert.equal(state.outputs["has-previews"], false);
+        assert.deepEqual(fs.readdirSync(workspace), []);
+      } else {
+        assert.deepEqual(previews, [{ pr: 42, head }]);
+        assert.equal(state.outputs["has-previews"], true);
+        const directory = path.join(workspace, "investigations/42");
+        const evidence = JSON.parse(
+          fs.readFileSync(path.join(directory, "context.json"), "utf8"),
+        );
+        assert.equal(evidence.preview, true);
+        assert.equal(evidence.head, head);
+        assert.deepEqual(
+          evidence.runs.map((run) => run.id),
+          [1],
+        );
+        assert.equal(
+          fs.readFileSync(
+            path.join(directory, evidence.jobs[0].log.file),
+            "utf8",
+          ),
+          state.log,
+        );
+        assert.equal(state.runs[0].run_attempt, attempt);
+        if (attempt === 1) assert.match(report, /Yes \(retry bypassed\)/);
+      }
+      assert.deepEqual(state.calls, []);
+      assert.deepEqual(state.comments, []);
+      assert.deepEqual(state.pr, originalPr);
+    });
+  }
+});
+
+test("Copilot preview reports validated outcomes as text without publishing", async (t) => {
+  for (const outcome of ["patch", "needs-maintainer"]) {
+    await t.test(outcome, async (t) => {
+      const workspace = temporaryWorkspace(t);
+      fs.mkdirSync(path.join(workspace, "result"));
+      const files =
+        outcome === "patch"
+          ? [
+              { path: "extensions/ql-vscode/src/a.ts", content: "fixed" },
+              { path: "extensions/ql-vscode/src/deleted.ts", content: null },
+            ]
+          : [];
+      fs.writeFileSync(
+        path.join(workspace, "result/result.json"),
+        JSON.stringify({
+          outcome,
+          summary: 'Explanation with <img src="untrusted"> & evidence.',
+          files,
+        }),
+      );
+      const summary = summaryFixture();
+      await reportPreview({
+        core: { summary },
+        number: 42,
+        head,
+        workspace,
+      });
+      assert(summary.written);
+      const report = summary.content.join("\n");
+      assert.match(report, /PR #42/);
+      assert(report.includes(head));
+      assert(report.includes(outcome));
+      assert(!report.includes("<img"));
+      assert(report.includes('&lt;img src="untrusted"&gt; &amp; evidence.'));
+      for (const file of files) assert(report.includes(file.path));
+    });
+  }
+});
+
+test("Copilot preview rejects unsafe artifacts before writing its report", async (t) => {
+  const workspace = temporaryWorkspace(t);
+  fs.mkdirSync(path.join(workspace, "result"));
+  fs.writeFileSync(
+    path.join(workspace, "result/result.json"),
+    JSON.stringify({
+      outcome: "patch",
+      summary: "Unsafe repair",
+      files: [{ path: ".github/workflows/main.yml", content: "untrusted" }],
+    }),
+  );
+  const summary = summaryFixture();
+  await assert.rejects(
+    reportPreview({ core: { summary }, number: 42, head, workspace }),
+    /unsupported, or invalid file/,
+  );
+  assert.equal(summary.written, false);
+  assert.deepEqual(summary.content, []);
 });
 
 test("only open, non-draft, same-repository Dependabot PRs qualify", () => {
@@ -1099,6 +1216,56 @@ test("rechecks provenance, labels, CI, and head immediately before merging", asy
   }
 });
 
+test(
+  "container worker uses runner identity and writable home without elevated capabilities",
+  { skip: process.platform === "win32" },
+  (t) => {
+    const workspace = temporaryWorkspace(t);
+    const trusted = path.join(
+      workspace,
+      "trusted/.github/dependabot-automation",
+    );
+    fs.mkdirSync(trusted, { recursive: true });
+    for (const name of ["task", "dependency", "bin"]) {
+      fs.mkdirSync(path.join(workspace, name));
+    }
+    for (const name of ["prompt.txt", "worker.cjs", "repair-protocol.cjs"]) {
+      fs.copyFileSync(path.join(__dirname, name), path.join(trusted, name));
+    }
+    const callsFile = path.join(workspace, "docker-calls.jsonl");
+    fs.writeFileSync(
+      path.join(workspace, "bin/docker"),
+      '#!/usr/bin/env node\nconst fs = require("node:fs");\nfs.appendFileSync(process.env.DOCKER_CALLS, JSON.stringify(process.argv.slice(2)) + "\\n");\n',
+      { mode: 0o755 },
+    );
+    execFileSync("bash", [path.join(__dirname, "run-worker.sh")], {
+      cwd: workspace,
+      env: {
+        ...process.env,
+        PATH: `${path.join(workspace, "bin")}${path.delimiter}${process.env.PATH}`,
+        DOCKER_CALLS: callsFile,
+        GITHUB_TOKEN: "test-token",
+      },
+    });
+    const calls = fs
+      .readFileSync(callsFile, "utf8")
+      .trim()
+      .split("\n")
+      .map((line) => JSON.parse(line));
+    assert.equal(calls.length, 2);
+    assert(!calls[0].includes("GITHUB_TOKEN"));
+    const worker = calls[1];
+    assert.equal(
+      worker[worker.indexOf("--user") + 1],
+      `${process.getuid()}:${process.getgid()}`,
+    );
+    assert(worker.includes("HOME=/tmp"));
+    assert(worker.includes("GITHUB_TOKEN"));
+    assert(worker.includes("--cap-drop=ALL"));
+    assert(worker.includes("--security-opt=no-new-privileges"));
+  },
+);
+
 test("worker collects tracked edits, new tests, and deletions", (t) => {
   const work = temporaryWorkspace(t);
   const git = (...args) =>