[supsup]

Changes

• Add versioned watched jobs for HTTP(S) website references and atomic ZIP bundles containing job.json, local HTML and relative assets.
• Reuse Main's capture grammar for PNG/GIF, frames, timing, viewport/DPR, element crop, scale and bundle preparation scripts.
• Bound job execution in a subprocess and ZIP preparation by bytes and entry counts.
• Retain one atomic, source-bound terminal decision so concurrent attempts and restarts reuse the selected result.
• Preserve ordinary HTML-to-PNG drops and no-replacement publication; document file-origin and trusted-network limits in docs/watch-jobs.md and SECURITY.md.

Verification

• 22 focused watcher/schema/recovery tests passed.
• Full aggregate JVM and real-Chrome suite: 505 tests, zero failures/errors/skips across 56 fresh JUnit XML files, under the shipped runtime/browser plus pinned JDK25, init and nonroot user.
• Full browser-free suite: 439 tests, zero failures/errors/skips, in the pinned Linux JDK25 image with init and a nonroot user. Counts read from all 46 JUnit XML files.
• Actual watched URL/ZIP GIFs, PNG, invalid schema/scheme/ranges, missing selector, failed URL, corrupt/traversal ZIP, deadline then subsequent progress, collision, two-worker recovery and recovery after publication passed in the built runtime image.
• Independent Pillow decode: 64x50, four distinct decoded frames at 100 ms each; relative SVG pixels rendered in every frame. PNG is 160x100.
• Independent source audit identified the publication/recovery race and fixture ownership issue; both were addressed before the successful runtime smoke.

CI status

JDK21 unit, JDK25 unit, native-image smoke and the complete Linux Docker/worker smoke passed at bd832d3. The existing full Docker smoke reaches the same non-owner sidecar-read failure under Docker Desktop on both the candidate and the old runtime image; Linux CI provides the passing permission lane.

Chrome CI ran all66 tests and failed two existing CleanupReportingTest cases. Exact main f7dab4f already fails those same two cases: main baseline run, candidate run. Their production sources, tests, Dockerfile and workflow are unchanged by this branch. A missing reaper in the Chrome build-stage test environment is a hypothesis; baseline repair ownership is being coordinated. The local init/nonroot aggregate above passed all505 cases.

Independent exact-tip code review is requested. Landing awaits that verdict and CI resolution. The running dogfood container has not been replaced.