diff --git a/CONTEXT.md b/CONTEXT.md
index c28cca6..236f28f 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -69,7 +69,7 @@ One invocation of the factory on a single issue that is not a **Spec**, from lau
 A factory-owned checkout, on an **Issue branch** for a **Run** or detached for an **Architecture review**. Acquisition accounts for partial local effects, removing only attempt-owned clean artifacts on failure and retaining and naming work or uncertain artifacts. Failed-acquisition retention survives later Architecture review attempts. Successful acquisition carries checkout and registration identity through its lifetime; ordinary synchronization, observations and Failed run preservation share acquired-instance checks before and after every Git subprocess attempt, including retries, acting only on that acquired checkout and selected Issue branch and refusing changed or uncertain ownership. Failed run preservation retains work when ownership has changed or is uncertain and finishes after Command interruption without clearing it; ordinary synchronization remains interruptible. Confirmed Self-merge branch deletion uses the captured Launch repository independently of checkout validity. Cleanup checks stage-specific disposal authority before and after every destructive Git attempt, including retries: acquired identity and the captured cleanup head for checkout removal, removed-path absence and an unused expected head for local branch removal, then ref absence and the exact original local subsection for branch configuration removal. Only successful, verified transitions advance disposal; partial failures retain and name every remaining or uncertain resource. Live cleanup finishes after Command interruption without clearing it; stale disposal stays interruptible. Stale Architecture review scratch is disposable only with evidence of successful detached acquisition and unchanged ownership; unmarked or uncertain checkouts are retained.
 
 **Claim**:
-The mark that the factory has taken an issue: thirdshift labels the issue `in-progress`, in place of `ready-for-agent` if it has that, when a **Run** or a **Spec run** starts on it, whether started on its **Issue URL** or by an **Architect run**, a **Pickup run** or a **Security run**. A **Ticket**'s Run in a Spec run and a **Base fix** make none. Ending a Claim finishes even after Command interruption. A Claim is released, `ready-for-agent` put back, only when the Run ends with nothing on `origin` to take over: no **Issue branch** and no pull request. Otherwise it stays while the issue is open, whether its pull request is ready for review or the Run failed, until the **Day shift** relabels it, and thirdshift takes the label off once the issue is closed.
+The mark that the factory has taken an issue: thirdshift labels the issue `in-progress`, in place of `ready-for-agent` if it has that, when a **Run** or a **Spec run** starts on it, whether started on its **Issue URL** or by an **Architect run**, a **Pickup run** or a **Security run**. A **Ticket**'s Run in a Spec run and a **Base fix** make none. Ending a Claim finishes even after Command interruption. A failed Security fix keeps its Claim even with nothing on `origin`, so it stays with the Day shift. For other Runs, a Claim is released, `ready-for-agent` put back, only when the Run ends with nothing on `origin` to take over: no **Issue branch** and no pull request. Otherwise it stays while the issue is open, whether its pull request is ready for review or the Run failed, until the **Day shift** relabels it, and thirdshift takes the label off once the issue is closed.
 _Avoid_: lock (a lock is per machine and ends with its process), assignment
 
 **Spec run**:
@@ -109,7 +109,7 @@ A **Pickup run**'s removal of `in-progress` from every closed issue in the repos
 _Avoid_: cleanup, garbage collection
 
 **Ready issue**:
-An open issue a **Pickup run** may take: labelled `ready-for-agent`, with no label that makes an **Unready Ticket** and no **Claim**, not a sub-issue, not a **Base fix**'s issue, with no open blocker, never started (no **Issue branch** and no pull request), not a **Spec** whose **Tickets** are all closed, and left untouched long enough that whoever is shaping it has finished. On a Spec, the label says its Tickets are published. A `ready-for-agent` Ticket inside a Spec is not one: it is reached through its Spec, when the Spec is itself a Ready issue.
+An open issue a **Pickup run** may take: labelled `ready-for-agent`, with no label that makes an **Unready Ticket** and no **Claim**, not a sub-issue, not a **Base fix**'s or a **Security run**'s fix issue, with no open blocker, never started (no **Issue branch** and no pull request), not a **Spec** whose **Tickets** are all closed, and left untouched long enough that whoever is shaping it has finished. On a Spec, the label says its Tickets are published. A `ready-for-agent` Ticket inside a Spec is not one: it is reached through its Spec, when the Spec is itself a Ready issue.
 _Avoid_: queued issue, backlog item
 
 **Architecture review**:
@@ -156,7 +156,7 @@ A **Run** asked to end with its pull request merged rather than left for review,
 _Avoid_: auto-merge (GitHub's own feature, which thirdshift does not use)
 
 **Run notification**:
-A message thirdshift sends when a **Run**, a **Spec run**, an **Architect run** or a **Security run** ends, whatever its outcome (ready, merged, failed or interrupted; for an Architect run that dispatched nothing, plan published, idea filed, idea already filed or review failed), to the address given with the email flag or the default in the **User config**. Each sends one only when asked to, by the flag or by the User config; a Spec run's notification lists each **Ticket**'s outcome, and a Ticket's **Run** never sends one of its own. After an **Inherited failure** it carries, beside the cause, what the Run says on stderr: where the checks fail on the **Base branch**, and the offer of a **Base fix** if nobody decided against one. An Architect run's notification tells how its **Architecture review** ended, naming the plan or idea issue, and how the Spec run or Run it dispatched ended, which sends none of its own; a skipped one sends none. A **Pickup run** that took a **Ready issue** sends the one the Spec run or Run it dispatched would have sent, which sends none of its own; a skipped one sends none. A **Security run**'s notification lists each **Security finding**'s severity, title and private link, never its write-up, since the message passes through a third party; a skipped one sends none. Failing to send one never changes the outcome.
+A message thirdshift sends when a **Run**, a **Spec run**, an **Architect run** or a **Security run** ends, whatever its outcome (ready, merged, failed or interrupted; for an Architect run that dispatched nothing, plan published, idea filed, idea already filed or review failed), to the address given with the email flag or the default in the **User config**. Each sends one only when asked to, by the flag or by the User config; a Spec run's notification lists each **Ticket**'s outcome, and a Ticket's **Run** never sends one of its own. After an **Inherited failure** it carries, beside the cause, what the Run says on stderr: where the checks fail on the **Base branch**, and the offer of a **Base fix** if nobody decided against one. An Architect run's notification tells how its **Architecture review** ended, naming the plan or idea issue, and how the Spec run or Run it dispatched ended, which sends none of its own; a skipped one sends none. A **Pickup run** that took a **Ready issue** sends the one the Spec run or Run it dispatched would have sent, which sends none of its own; a skipped one sends none. A **Security run**'s notification lists each **Security finding**'s severity, title and private link, never its write-up, since the message passes through a third party. When a Run leaves a reproduced finding unfixed and nobody decided against fixing, it offers both the command and the User config setting that allow fixing; a skipped one sends none. Failing to send one never changes the outcome.
 _Avoid_: completion email, alert
 
 **User config**:
diff --git a/README.md b/README.md
index f0e8099..2da9e45 100644
--- a/README.md
+++ b/README.md
@@ -41,7 +41,7 @@ The **Claim** is the mark that the factory has taken an issue, so the issue list
 
 How the Run or the Spec run ends decides what becomes of its Claim:
 
-- **Released**, when it fails with nothing on `origin` to take over: no Issue branch for the issue there and no pull request from one, open, merged or closed, or for a Spec run, no Spec branch and no Spec PR. That is a session that fails before it changes anything, as on a usage limit or an expired login, a Ctrl-C before any work, or a worktree that can't be created, on an issue that was never started before. A retry that fails that way on an issue an earlier Run left an Issue branch or a pull request for keeps its Claim. The issue's labels go back as they were before the Claim: `in-progress` comes off, and `ready-for-agent` goes back if the issue had it, and only then. So an outage costs a retry and doesn't strand the issue. stderr says `releasing the Claim on #<n>: labelling it ready-for-agent, in place of in-progress`, or `releasing the Claim on #<n>: removing in-progress`. A Failed run whose push failed is released too, since nothing of it reached `origin`: its work is only in the worktree it kept, which stops the next Run on that machine at the pre-flight checks until you push or delete the local Issue branch.
+- **Released**, except for a failed Security fix, when it fails with nothing on `origin` to take over: no Issue branch for the issue there and no pull request from one, open, merged or closed, or for a Spec run, no Spec branch and no Spec PR. That is a session that fails before it changes anything, as on a usage limit or an expired login, a Ctrl-C before any work, or a worktree that can't be created, on an issue that was never started before. A retry that fails that way on an issue an earlier Run left an Issue branch or a pull request for keeps its Claim. The issue's labels go back as they were before the Claim: `in-progress` comes off, and `ready-for-agent` goes back if the issue had it, and only then. So an outage costs a retry and doesn't strand the issue. stderr says `releasing the Claim on #<n>: labelling it ready-for-agent, in place of in-progress`, or `releasing the Claim on #<n>: removing in-progress`. A Failed run whose push failed is released too, since nothing of it reached `origin`: its work is only in the worktree it kept, which stops the next Run on that machine at the pre-flight checks until you push or delete the local Issue branch.
 - **Kept**, on any other ending that leaves the issue open: a pull request ready for review, or a [Failed run](#failed-runs) that pushed its Issue branch or left a pull request. The issue stays `in-progress` until you relabel it, so a failure waits for you.
 - **Removed**, in a Merge run, once the Self-merge has left the issue closed, whether thirdshift closed it or GitHub did: `in-progress` comes off, after `removing in-progress from issue #<n>` on stderr.
 
@@ -518,7 +518,7 @@ A Failed run:
 1. Commits any uncommitted work as `thirdshift: failed run (<reason>)`, with a timestamp and the hostname, and pushes the Issue branch, so nothing is lost. If the branch has no changes against the Base branch, nothing is pushed.
 2. Converts its open pull request, if any, back to a draft, so a pull request only claims to be ready when the factory stands behind it. The next successful Continuation marks it ready again. The exception is a Merge run's policy refusal: the pull request is ready, mergeable and green and only the Self-merge could not happen, so it stays ready for review, and no failure commit is pushed onto the head whose CI was watched.
 3. Cleans up as usual, prints the reason to stderr and exits non-zero. If the push failed, the worktree and local Issue branch are kept instead, and stderr names the branch, its head commit and the worktree path, so you can recover the work or push it by hand.
-4. Releases its [Claim](#when-the-claim-ends) if it left nothing on `origin`: no Issue branch and no pull request. Otherwise the issue stays `in-progress`.
+4. Releases its [Claim](#when-the-claim-ends), unless it is a failed Security fix, if it left nothing on `origin`: no Issue branch and no pull request. Otherwise the issue stays `in-progress`.
 
 Merges, never rebases or force-pushes: a branch worked on from several servers never loses history.
 
@@ -543,7 +543,7 @@ In a [Spec run](#spec-runs), a Ticket's Run says this on its own stderr, relayed
 
 A **Spec** is an issue with sub-issues, its **Tickets**. `thirdshift <Issue URL>` on a Spec is a **Spec run**: it works through the Tickets in the order their GitHub "blocked by" links allow, each Ticket's **Run** a **Merge run** into the **Spec branch**, then leaves one **Spec PR** from the Spec branch into the Base branch ready for review ([ADR-0006](docs/adr/0006-spec-runs-merge-tickets-into-a-spec-branch.md)). An issue with no sub-issues is an ordinary Run.
 
-A Spec run makes the [Claim](#the-claim) on the Spec, as a Run does on its issue: the Spec is labelled `in-progress`, in place of `ready-for-agent`. Its Tickets' Runs change no label on their Tickets. The Claim [ends](#when-the-claim-ends) as a Run's does: it is released if the Spec run fails with no Spec branch on `origin` and no Spec PR, removed once a Self-merge of the Spec PR has left the Spec closed, and kept otherwise. The Spec branch is pushed before the first Ticket starts, so a Spec run that got as far as its Tickets keeps its Claim.
+A Spec run makes the [Claim](#the-claim) on the Spec, as a Run does on its issue: the Spec is labelled `in-progress`, in place of `ready-for-agent`. Its Tickets' Runs change no label on their Tickets. The Claim [ends](#when-the-claim-ends) as a Run's does: it is released if the Spec run fails with no Spec branch on `origin` and no Spec PR, except for a failed Security fix, removed once a Self-merge of the Spec PR has left the Spec closed, and kept otherwise. The Spec branch is pushed before the first Ticket starts, so a Spec run that got as far as its Tickets keeps its Claim.
 
 The Spec PR opens as a draft as soon as the first Ticket lands, titled from the Spec, with `Closes #<spec>` and a Tickets checklist: one line per Ticket, ticked once it is done, with its pull request, or saying it is running, failed, blocked or unready. thirdshift rewrites the checklist between its `<!-- thirdshift:tickets -->` markers as each Ticket starts and ends, leaving the rest of the body as it is. Once every Ticket is done, the **Spec review** rewrites the body, and thirdshift puts the checklist back, appending it if the markers are gone, before marking the Spec PR ready.
 
@@ -753,13 +753,15 @@ A publishing session reads the private record and follows the reproduction's fix
 
 On a private repository, the finding's own issue is the fix's Ticket or Spec, keeping its write-up and proof-of-concept. A one-session fix needs no publishing session or second issue: thirdshift marks the finding's issue ready and dispatches it. For a bigger fix, the publishing session adds terse Tickets as that issue's native sub-issues, with their blocking links.
 
-`email`, optionally followed by an address, or `email.always` in the User config asks for one **Run notification** when the Security run ends, whether the audit succeeded, failed or was interrupted. `no-email` overrides the default. The notification says how the audit ended and lists each finding it recorded or matched to an existing private record: its severity when known, title and private link. It includes no finding write-up, trace or evidence, since it passes through Resend. Detailed failure causes stay in the local logs; the notification gives the audit's status and log paths. A recording failure still lists the records reached before it failed. A skipped Security run sends none. The usual address and Resend API key checks run before the skip checks or any work; a failed send is a warning and never changes the run's outcome.
+A failed fix keeps its **Claim**, even if it pushed nothing, and stays open for the **Day shift**. No later Security run or Pickup run retries it. Security runs pause while that fix's issue is open; closing the issue lets them go on.
+
+`email`, optionally followed by an address, or `email.always` in the User config asks for one **Run notification** when the Security run ends, whether the audit succeeded, failed or was interrupted. `no-email` overrides the default. The notification says how the audit ended and lists each finding it recorded or matched to an existing private record: its severity when known, title and private link. It includes no finding write-up, trace or evidence, since it passes through Resend. Detailed failure causes stay in the local logs; the notification gives the audit's status and log paths. A recording failure still lists the records reached before it failed. When a run leaves a reproduced finding unfixed and neither the command nor the User config decided against fixing, its notification and stderr offer both `thirdshift secure security-fix` and `fix = true` under `[security]`. With `no-security-fix`, or the setting turned off, it offers nothing. A skipped Security run sends none. The usual address and Resend API key checks run before the skip checks or any work; a failed send is a warning and never changes the run's outcome.
 
 A Security run chooses its Harness from the command's `harness` word, then `[security] harness` in the User config, then `harness.default`, then Claude Code. A blank or missing Security setting keeps that default. Model and Effort come from the chosen Harness's own `[harness.<name>]` section, with command words taking precedence. For example, `harness claude` overrides `[security] harness = "codex"` and uses `[harness.claude]`.
 
 Codex security sessions and their Resumes set `agents.max_concurrent_threads_per_session=8` and ask for fresh sub-agents with `fork_turns: "none"`, so the skill's verifiers stay independent.
 
-A Security run checks its gates in order: another **Pass** on the repository running on the machine, a **Ready issue**, a **Security finding** waiting for the **Day shift**, then an unchanged **Base branch** since the last completed Security audit. An unreproduced draft advisory with no severity waits; closing it, publishing it or assigning severity ends that wait. A reproduced finding waits while fixing is disabled until its record is closed or published, or its fix Ticket is closed. On a private repository, an open finding issue with `needs-triage` waits until that label is removed or the issue is closed. The audited commit comes from the skill's own `run-metadata.json` under the audit root, with no separate state file. A skip exits `0`, starts no session, keeps no Command log and sends no Run notification; its reason goes into the repository's **Activity log** only when it changes, with the usual `activity.quiet_skips` behavior. Before starting work, thirdshift checks the chosen Harness and that **Node.js** is on `PATH`, since the embedded skill's report validators require it.
+A Security run checks its gates in order: another **Pass** on the repository running on the machine, a **Ready issue**, a failed Security fix whose issue is still open, a **Security finding** waiting for the **Day shift**, then an unchanged **Base branch** since the last completed Security audit. An unreproduced draft advisory with no severity waits; closing it, publishing it or assigning severity ends that wait. A reproduced finding waits while fixing is disabled until its record is closed or published, or its fix Ticket is closed. On a private repository, an open finding issue with `needs-triage` waits until that label is removed or the issue is closed. The audited commit comes from the skill's own `run-metadata.json` under the audit root, with no separate state file. A skip exits `0`, starts no session, keeps no Command log and sends no Run notification; its reason goes into the repository's **Activity log** only when it changes, with the usual `activity.quiet_skips` behavior. Before starting work, thirdshift checks the chosen Harness and that **Node.js** is on `PATH`, since the embedded skill's report validators require it.
 
 The Security audit runs in a throwaway worktree detached at origin's Base branch head, leaving the Launch directory and local work untouched, including when `launch.pull` is set. Its Session prompt runs `thirdshift-security-audit` in full audit mode with the `quick` profile, auditing the whole repository except vendored and third-party code. It names a `SECURITY.md` or conventional threat-model document when present, reads compatible earlier runs and ends `incomplete` instead of asking for input.
 
@@ -767,6 +769,19 @@ Each audit keeps a new output directory under `<logs.dir>/<owner>/<repo>/audits/
 
 A finding's title becomes the advisory summary. Its description preserves its write-up, trace, evidence and validation plan, with the fingerprint and audited commit. thirdshift claims no severity, CWE or affected version range. It uses the package in the repository's manifest, or the `other` ecosystem when none is identified. Matching fingerprints in any advisory state are kept rather than recorded again. Rejected candidates stay in the local report and produce no advisory. Draft advisories require GitHub repository security manager or administrator access. On a private repository whose advisory endpoint is unavailable, the private record is an issue labelled `security-finding` and `needs-triage`. It is never replaced by a public finding issue.
 
+### Fencing
+
+**Fencing** is the factory finding and fixing vulnerabilities with nobody starting it: Security runs started on a schedule with fixing allowed. thirdshift never schedules itself ([ADR-0009](docs/adr/0009-the-operating-system-schedules-thirdshift.md)). This Linux crontab entry starts one every five minutes; use your own paths, with `claude` and `gh` already logged in and Git able to push:
+
+```cron
+PATH=/home/you/.local/bin:/usr/local/bin:/usr/bin:/bin
+*/5 * * * * cd /home/you/repos/widgets && thirdshift secure base main harness claude security-fix >> /home/you/thirdshift-secure.log 2>&1
+```
+
+Each pass yields to a **Ready issue**, so work the **Day shift** shaped goes first. It is skipped while another Pass on the repository is running, while a fix has failed and its issue stays open, while a finding waits for triage and no reproduced finding can be fixed, or while the Base branch is unchanged and no fix is waiting. A failed fix pauses Fencing for the Day shift until its issue is closed; it is never retried by a later Security run or Pickup run. Triaging a finding lets audits go on; fixing allowed can still take a reproduced finding ahead of a different finding waiting for triage.
+
+A skip exits `0` and sends no Run notification. Its reason appears in the **Activity log** once per change of reason. Set `activity.quiet_skips = true` in the [User config](#user-config) to keep those skips out of the scheduler's log. `merge` on the command, or `merge.always = true` in the User config, lets each fix's Run merge its pull request; otherwise it stays ready for review.
+
 ## Pickup runs
 
 `thirdshift pickup` starts a **Pickup run**: one pass, with no **Issue URL**, that takes the lowest-numbered **Ready issue** in the repository and runs it, so that an issue you have already marked ready needs no command typed for it. Start it from a clone of the repository, on the **Base branch**, or name the Base branch with `base <branch>`:
@@ -784,7 +799,7 @@ A Ready issue is an open issue that:
 - has none of the labels that make an **Unready Ticket**, `ready-for-human`, `needs-info`, `wontfix` and `needs-triage`, so a contradictory label errs on the side of not running;
 - carries no [Claim](#the-claim): it is not labelled `in-progress`;
 - is not a sub-issue. A sub-issue is a **Ticket** of a **Spec**, and is never run on its own, whatever the Spec's labels: it is reached through its Spec, when the Spec is itself a Ready issue, so its work always goes through the **Spec branch**. Labelling one Ticket never promotes its Spec, either;
-- is not labelled `base-fix`: the Run that opened a [Base fix](#base-fix)'s issue owns it;
+- is not labelled `base-fix` or `security-fix`: the Run that opened a [Base fix](#base-fix)'s issue, or the Security run that dispatched a fix, owns it. A failed Security fix is still passed over if GitHub prevented its Claim from being made;
 - has no open blocker, by GitHub's "blocked by" links, never the text of its body. Once every blocker is closed, it can be taken;
 - was never started: no **Issue branch** for it is on `origin`, and no pull request from one exists, open, merged or closed. So a Pickup run never does a [Continuation](#continuation), and an issue whose Run failed waits for you;
 - is not a **Spec** whose **Tickets** are all closed. With nothing started on it, such a Spec was done some other way, and the [Spec run](#spec-runs) it would be dispatched as stops with nothing to do, so a Pickup run passes it over rather than take it on every pass. Waiting never makes it a Ready issue, so this comes before the next condition, however lately the Spec was labelled: close it, or take its `ready-for-agent` off. A Spec with at least one open Ticket is taken;
@@ -905,7 +920,7 @@ The command's flags and the User config decide what a pass does with the issue i
 */30 * * * * cd ~/repos/widgets && thirdshift pickup base main no-merge >> ~/.thirdshift/logs/cron.log 2>&1
 ```
 
-An issue whose run failed [keeps its Claim](#when-the-claim-ends) and waits for the **Day shift**: it stays `in-progress`, with the Issue branch and any draft pull request the run left, no later pass takes it, and it counts towards the Claim limit until it is closed or you take the label off. To send it round again by hand, run `thirdshift <Issue URL>` from the clone, with the Base branch checked out, since that command takes no `base <branch>`: it picks up where the failed run stopped, as a [Continuation](#continuation) does. Labelling it `ready-for-agent` again doesn't do it: a Pickup run never takes an issue that was started. The one failure a later pass does retry is one that left nothing on `origin`, such as a usage limit or an expired login: its Claim is released, so the issue is a Ready issue again once it has settled.
+An issue whose run failed [keeps its Claim](#when-the-claim-ends) and waits for the **Day shift**: it stays `in-progress`, with the Issue branch and any draft pull request the run left, no later pass takes it, and it counts towards the Claim limit until it is closed or you take the label off. To send it round again by hand, run `thirdshift <Issue URL>` from the clone, with the Base branch checked out, since that command takes no `base <branch>`: it picks up where the failed run stopped, as a [Continuation](#continuation) does. Labelling it `ready-for-agent` again doesn't do it: a Pickup run never takes an issue that was started. For an ordinary Run, the one failure a later pass does retry is one that left nothing on `origin`, such as a usage limit or an expired login: its Claim is released, so the issue is a Ready issue again once it has settled. A failed Security fix is always left for the Day shift, even with nothing on `origin`.
 
 If you shape your issues with the upstream `to-spec` and `to-tickets`, from [mattpocock/skills](https://github.com/mattpocock/skills), unchanged: `ready-for-agent` on a **Spec** must mean its **Tickets** are published, every Ticket attached as a sub-issue and every "blocked by" link in place. Upstream, `to-spec` labels the Spec `ready-for-agent` when it publishes it, minutes or days before `to-tickets` attaches the Tickets, and a Spec with no Tickets yet looks exactly like a standalone Ticket, so a pass would start a plain Run on it. Label such a Spec `needs-triage` until its Tickets are attached, then swap that for `ready-for-agent`, as the copies of the two this repository's own Day shift uses, under `.agents/skills/`, do ([`docs/agents/triage-labels.md`](docs/agents/triage-labels.md)). The ten minutes an issue must be settled for are only a second line of defence: they cover Tickets attached within minutes of the label, not a Spec left labelled and without Tickets for longer.
 
diff --git a/src/base_fix.rs b/src/base_fix.rs
index 78d1e27..82ac205 100644
--- a/src/base_fix.rs
+++ b/src/base_fix.rs
@@ -61,11 +61,10 @@ const RETRY_WITH: &str = "Retry with";
 /// What starts the line of [`Advice`] naming the User config's `base.fix`.
 const OR_SET: &str = "Or set";
 
-/// A line of the advice a Run gives after its cause when Inherited failures
-/// fail it with no Base fix taken: each check where it fails on the Base
-/// branch, then, if nobody decided against a Base fix, how to allow one. It
-/// reads `<label>: <value>` on stderr, and the Run notification lays it out
-/// like its other lines.
+/// A line of advice shared by stderr and the Run notification. A Base fix's
+/// advice names the failing checks and how to allow fixing; a Security run's
+/// offers fixing when the operator left it undecided. Each line reads
+/// `<label>: <value>` on stderr; the notification lays it out like its other lines.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Advice {
     /// What the line starts with, saying what its value is.
diff --git a/src/claim.rs b/src/claim.rs
index 351eb0e..050e627 100644
--- a/src/claim.rs
+++ b/src/claim.rs
@@ -3,7 +3,8 @@
 //! Run or a Spec run is working on. It is made before the run's work, and
 //! ended once with how the run ended: removed once its Self-merge has left the
 //! issue closed, kept while its pull request waits for review, and released
-//! when the run failed with nothing on origin to take over.
+//! when the run failed with nothing on origin to take over, except a failed
+//! Security fix, which stays with the Day shift.
 //!
 //! What it reads and changes of GitHub and origin, whether the run is
 //! interrupted, and its progress lines all go through [`Outside`]:
@@ -63,7 +64,7 @@ impl Claim<'_> {
     ///   closed.
     /// - Ready for review: the Claim stays while the pull request waits.
     /// - Failed: the Claim is released if nothing of the run is on origin to
-    ///   take over.
+    ///   take over, except a Security fix, whose Claim stays.
     ///
     /// The run has ended as it has, so this never fails: a failure is a
     /// warning naming what to run by hand, and an interrupt doesn't stop it.
@@ -156,6 +157,8 @@ struct Claimed<'a> {
     added_in_progress: bool,
     /// Whether making it took `ready-for-agent` off the issue.
     removed_ready_for_agent: bool,
+    /// A failed Security fix stays with the Day shift even without a push.
+    security_fix: bool,
 }
 
 impl<'a> Claimed<'a> {
@@ -177,6 +180,7 @@ impl<'a> Claimed<'a> {
             issue,
             added_in_progress: edit.puts_on(IN_PROGRESS),
             removed_ready_for_agent: edit.takes_off(READY_FOR_AGENT),
+            security_fix: edit.labels().has(crate::security::fixing::SECURITY_FIX),
         };
         if !claimed.changed_any() {
             return Ok(claimed);
@@ -198,6 +202,7 @@ impl<'a> Claimed<'a> {
         match reached {
             Some(Goal::Merged) => self.remove_if_closed(outside),
             Some(Goal::ReadyForReview) => {}
+            None if self.security_fix => {}
             None => self.release_if_nothing_on_origin(outside),
         }
     }
diff --git a/src/github/advisories.rs b/src/github/advisories.rs
index 636e0ab..19d114e 100644
--- a/src/github/advisories.rs
+++ b/src/github/advisories.rs
@@ -17,12 +17,30 @@ const SECURITY_FINDING: Label = Label::new(
 
 pub(crate) const FIX_TICKET_MARKER: &str = "\n<!-- thirdshift:security-fix -->\nFix Ticket: ";
 
+const FIX_PENDING: &str = "Fix Run: pending";
+const FIX_FAILED: &str = "Fix Run: failed";
+const FIX_SUCCEEDED: &str = "Fix Run: succeeded";
+
 pub enum SecurityRecords {
     Advisories(Vec<Value>),
     Issues(Vec<Value>),
 }
 
 impl SecurityRecords {
+    /// The record layout belongs to its storage, not each rule that reads it.
+    fn entries(&self) -> (&[Value], &'static str, &'static str) {
+        match self {
+            Self::Advisories(records) => (records, "description", "draft"),
+            Self::Issues(records) => (records, "body", "open"),
+        }
+    }
+
+    fn values_mut(&mut self) -> &mut Vec<Value> {
+        match self {
+            Self::Advisories(records) | Self::Issues(records) => records,
+        }
+    }
+
     /// An unreproduced, untriaged finding still needs the Day shift's call.
     pub fn waiting_for_day_shift(&self, fixing: bool) -> bool {
         match self {
@@ -53,13 +71,33 @@ impl SecurityRecords {
         }
     }
 
+    /// A dispatched fix that failed and whose issue the Day shift has not closed.
+    pub fn failed_fix(&self) -> Result<Option<IssueUrl>> {
+        let (records, field, _) = self.entries();
+        for record in records {
+            if record["security_fix_closed"] == true {
+                continue;
+            }
+            if let Some((_, fix)) = record[field]
+                .as_str()
+                .and_then(|text| text.rsplit_once(FIX_TICKET_MARKER))
+                // The Pass lock rules out an active dispatch here. A pending
+                // ending is also a failed/incomplete fix until success is recorded.
+                && fix.lines().rev().find(|line| line.starts_with("Fix Run: "))
+                    .is_some_and(|line| line == FIX_PENDING || line == FIX_FAILED)
+            {
+                return Ok(Some(IssueUrl::parse(
+                    fix.lines().next().unwrap_or_default(),
+                )?));
+            }
+        }
+        Ok(None)
+    }
+
     /// Most severe reproduced finding still awaiting a fix, ties in record order.
     /// A recorded Ticket has already been dispatched; its Run owns that fix.
     pub fn next_fix(&self) -> Result<Option<(SecurityRecord, crate::security::RecordedFinding)>> {
-        let (records, description, state) = match self {
-            Self::Advisories(records) => (records, "description", "draft"),
-            Self::Issues(records) => (records, "body", "open"),
-        };
+        let (records, description, state) = self.entries();
         let mut next = None;
         for value in records {
             if !value["state"]
@@ -95,16 +133,11 @@ impl SecurityRecords {
     }
 
     pub fn remember(&mut self, record: Value) {
-        match self {
-            Self::Advisories(records) | Self::Issues(records) => records.push(record),
-        }
+        self.values_mut().push(record);
     }
 
     pub fn finding(&self, draft: &DraftAdvisory) -> Option<&Value> {
-        let (records, field) = match self {
-            Self::Advisories(records) => (records, "description"),
-            Self::Issues(records) => (records, "body"),
-        };
+        let (records, field, _) = self.entries();
         let marker = format!("Fingerprint: `{}`", draft.fingerprint);
         records.iter().find(|record| {
             record[field]
@@ -237,6 +270,32 @@ impl GitHub {
         repo: &str,
         record: &SecurityRecord,
         issue: &IssueUrl,
+    ) -> Result<()> {
+        self.write_security_fix(repo, record, issue, FIX_PENDING)
+    }
+
+    /// Record the dispatch's ending, preserving any private edits made during it.
+    pub fn record_security_fix_ending(
+        &self,
+        repo: &str,
+        record: &SecurityRecord,
+        issue: &IssueUrl,
+        succeeded: bool,
+    ) -> Result<()> {
+        self.write_security_fix(
+            repo,
+            record,
+            issue,
+            if succeeded { FIX_SUCCEEDED } else { FIX_FAILED },
+        )
+    }
+
+    fn write_security_fix(
+        &self,
+        repo: &str,
+        record: &SecurityRecord,
+        issue: &IssueUrl,
+        ending: &str,
     ) -> Result<()> {
         let (path, field) = match record {
             SecurityRecord::Advisory { id, .. } => (
@@ -256,14 +315,30 @@ impl GitHub {
         }
         let current: Value =
             serde_json::from_slice(&output.stdout).context("private record is invalid JSON")?;
-        if current[field].as_str() != Some(record.description()) {
-            bail!("the private record changed while publishing its fix; leaving it unchanged");
-        }
-        let description = format!(
-            "{}{FIX_TICKET_MARKER}{}\n",
-            record.description().trim_end(),
-            issue.url
-        );
+        let current = current[field]
+            .as_str()
+            .context("the private record has no description")?;
+        let description = if ending == FIX_PENDING {
+            if current != record.description() {
+                bail!("the private record changed while publishing its fix; leaving it unchanged");
+            }
+            // Persist before dispatch: a later write failure cannot reopen Fencing.
+            format!(
+                "{}{FIX_TICKET_MARKER}{}\n{ending}\n",
+                current.trim_end(),
+                issue.url
+            )
+        } else {
+            let link = current
+                .rsplit_once(FIX_TICKET_MARKER)
+                .and_then(|(_, fix)| fix.lines().next());
+            if link != Some(issue.url.as_str()) {
+                bail!(
+                    "the private record's fix Ticket changed during its Run; leaving it unchanged"
+                );
+            }
+            format!("{}\n{ending}\n", current.trim_end())
+        };
         let body = serde_json::to_vec(&json!({field: description}))?;
         let output = self.output_with_input(
             &["api", "--method", "PATCH", &path, "--input", "-"],
@@ -317,11 +392,8 @@ impl GitHub {
             Err(error) => Err(error),
         };
         let mut records = records?;
-        let (values, field) = match &mut records {
-            SecurityRecords::Advisories(values) => (values, "description"),
-            SecurityRecords::Issues(values) => (values, "body"),
-        };
-        for record in values {
+        let (_, field, _) = records.entries();
+        for record in records.values_mut() {
             if let Some((_, link)) = record[field]
                 .as_str()
                 .and_then(|text| text.rsplit_once(FIX_TICKET_MARKER))
diff --git a/src/main.rs b/src/main.rs
index aaeef62..e388f6e 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -146,7 +146,8 @@ labels and creating the label if the repository lacks it. A Ticket's Run in a Sp
 Base fix make none, and an issue already in-progress is left as it is. A Run whose Claim
 can't be made stops there, naming the cause. The Claim is released, the issue's labels put
 back as they were, when the Run or the Spec run fails with nothing on origin to take over:
-no Issue branch or Spec branch and no pull request. It is removed once a Self-merge has left
+no Issue branch or Spec branch and no pull request. A failed Security fix keeps its Claim
+even with nothing on origin, for the Day shift. It is removed once a Self-merge has left
 the issue closed, and otherwise stays: a failure to release or remove it is a warning naming
 the command to run by hand.
 
@@ -247,7 +248,8 @@ pickup starts a Pickup run from the clone, with no Issue URL: one pass, which ta
 lowest-numbered Ready issue in the repository and dispatches it as thirdshift <Issue URL>
 would: a Spec run on a Spec, a Run otherwise. A Ready issue is an open issue labelled
 ready-for-agent that has none of ready-for-human, needs-info, wontfix and needs-triage, is
-not in-progress, is not a sub-issue, is not labelled base-fix, has no open blocker, and was
+not in-progress, is not a sub-issue, is not labelled base-fix or security-fix, has no open
+blocker, and was
 never started: no Issue branch for it is on origin, and no pull request from one exists,
 open, merged or closed. A Spec whose Tickets are all closed is not one either: a Spec run
 would find nothing to do. It must also be settled: ten minutes have passed since
@@ -317,14 +319,22 @@ only a warning and never changes the run's outcome.
 
 security-fix allows a Security run to fix one reproduced finding: the most severe first,
 ties in private-record order, before auditing or after an audit reproduces a finding.
-The publishing session creates one terse Ticket that says what the fix changes and links
-the private record; thirdshift checks it, swaps needs-triage for ready-for-agent, adds
-security-fix and dispatches its Run. The Security run ends as that Run ends, including
-merge when requested. Fixing is off by default. [security] fix = true also allows it;
+The publishing session follows the reproduction's fix size: one terse Ticket, or a Spec
+with Tickets. Every new issue says what the fix changes and links the private record.
+On a private repository the finding's own issue is the fix's Ticket or Spec; a single
+fix needs no publishing session. thirdshift checks the issues, swaps the top issue's
+needs-triage for ready-for-agent, adds security-fix to every fix issue and dispatches its
+Run or Spec run. The Security run ends as that run ends, including merge when requested.
+Fixing is off by default. [security] fix = true also allows it;
 no-security-fix overrides the setting. Both words, with or without dashes, are accepted
 on Run, Spec run, Architect run, Pickup run and Security run commands, and passed to their
 Runs. Without permission, a reproduced finding waits until its record is closed or
-published, or its fix Ticket is closed.
+published, or its fix Ticket is closed. A failed fix keeps its Claim even without a push,
+and Security runs pause while its issue is open. Pickup never retries a Security fix,
+even if its Claim could not be made. Closing the issue lets Security runs go on.
+When neither the command nor the User config decided against fixing, a run that left a
+reproduced finding unfixed offers security-fix and fix under [security] on stderr and in
+its notification. The README's Fencing section shows the scheduled command.
 
 The User config, ~/.thirdshift/config.toml, sets defaults for every Run on this machine;
 thirdshift setup asks for your defaults and writes one listing every setting, to edit.
diff --git a/src/pass.rs b/src/pass.rs
index f86f57b..03cb252 100644
--- a/src/pass.rs
+++ b/src/pass.rs
@@ -135,6 +135,13 @@ pub trait Outside {
         url: &str,
     ) -> (Result<IssueUrl>, Option<PathBuf>);
     fn link_security_fix(&mut self, record: &SecurityRecord, issue: &IssueUrl) -> Result<()>;
+    /// Record the dispatch's ending in its private record, even after interruption.
+    fn record_security_fix_ending(
+        &mut self,
+        record: &SecurityRecord,
+        issue: &IssueUrl,
+        succeeded: bool,
+    ) -> Result<()>;
     /// Run `dispatch` to its end, on the Harness the pass checked.
     fn dispatch(&mut self, dispatch: Dispatch) -> Ended;
 }
@@ -323,6 +330,20 @@ impl Outside for LaunchAndGitHub<'_> {
     fn link_security_fix(&mut self, record: &SecurityRecord, issue: &IssueUrl) -> Result<()> {
         GitHub::new().link_security_fix(&self.repo.slug(), record, issue)
     }
+
+    fn record_security_fix_ending(
+        &mut self,
+        record: &SecurityRecord,
+        issue: &IssueUrl,
+        succeeded: bool,
+    ) -> Result<()> {
+        GitHub::new().completion().record_security_fix_ending(
+            &self.repo.slug(),
+            record,
+            issue,
+            succeeded,
+        )
+    }
 }
 
 #[cfg(test)]
@@ -387,6 +408,10 @@ mod in_memory {
         UpdateSecurityRecord(String),
         PublishSecurityFix(String),
         LinkSecurityFix(u64),
+        SecurityFixEnding {
+            issue: u64,
+            succeeded: bool,
+        },
         DispatchSecurityFix {
             issue: u64,
             is_spec: bool,
@@ -842,6 +867,19 @@ mod in_memory {
             self.calls.push(Call::LinkSecurityFix(issue.number));
             Ok(())
         }
+
+        fn record_security_fix_ending(
+            &mut self,
+            _record: &SecurityRecord,
+            issue: &IssueUrl,
+            succeeded: bool,
+        ) -> Result<()> {
+            self.calls.push(Call::SecurityFixEnding {
+                issue: issue.number,
+                succeeded,
+            });
+            Ok(())
+        }
     }
 
     /// Issue `number` in `acme/widgets` as a listing gives it, labelled
diff --git a/src/ready.rs b/src/ready.rs
index fbfe516..fb17d02 100644
--- a/src/ready.rs
+++ b/src/ready.rs
@@ -93,6 +93,8 @@ enum Reason {
     Ticket(IssueUrl),
     /// It is a Base fix issue, which the Run that opened it owns.
     BaseFix,
+    /// It belongs to a Security run, even if Claim creation failed.
+    SecurityFix,
     /// It is blocked by these open issues.
     Blocked(Vec<u64>),
     /// It was started, as this shows.
@@ -175,6 +177,7 @@ impl<'a, R: Reads, P: FnMut(String)> Search<'a, R, P> {
         let why = match reason {
             Reason::Unready(label) => format!("labelled {label}"),
             Reason::Claimed => format!("labelled {}", claim::IN_PROGRESS),
+            Reason::SecurityFix => "a Security fix: its Security run owns it".to_string(),
             Reason::Ticket(spec) => {
                 let listed = self.candidates.iter().position(|candidate| {
                     candidate.issue.number == spec.number && candidate.issue.in_same_repo(spec)
@@ -223,8 +226,8 @@ impl<'a, R: Reads, P: FnMut(String)> Search<'a, R, P> {
 /// Where `candidate`, an open issue labelled `ready-for-agent`, stands at
 /// `now`, reading what its listing doesn't give through `reads`. It is a
 /// Ready issue when it has no label that makes an Unready Ticket and no
-/// Claim, is not a sub-issue, has no `base-fix` label and no open blocker,
-/// was never started, is not a Spec whose Tickets are all closed, and is
+/// Claim, is not a sub-issue, has no `base-fix` or `security-fix` label and no
+/// open blocker, was never started, is not a Spec whose Tickets are all closed, and is
 /// settled: [`SETTLE`] has passed since it was last labelled
 /// `ready-for-agent` and since a sub-issue or a "blocked by" link of its was
 /// last added or removed.
@@ -240,6 +243,9 @@ fn standing_of(
     if claim::is_on(&candidate.labels) {
         return passed_over(Reason::Claimed);
     }
+    if candidate.labels.has(crate::security::fixing::SECURITY_FIX) {
+        return passed_over(Reason::SecurityFix);
+    }
     let read = reads.candidate(&candidate.issue)?;
     if let Some(spec) = read.parent {
         return passed_over(Reason::Ticket(spec));
diff --git a/src/run_ending.rs b/src/run_ending.rs
index 2683120..6222f36 100644
--- a/src/run_ending.rs
+++ b/src/run_ending.rs
@@ -59,6 +59,7 @@ pub fn read(ending: &Ending) -> Result<Account<'_>, &Skip> {
             };
             Ok(Account {
                 security_findings: Some(&audited.findings),
+                advice: &audited.advice,
                 ..account
             })
         }
@@ -291,18 +292,17 @@ impl Shown {
             steps.push(format!("{BASE_FIX}{report}"));
         }
         match &account.ended {
-            // Also on stderr, so the outcome shows even when stdout is
-            // captured.
+            // Also on stderr, so the outcome shows even when stdout is captured.
             Ok(line) => steps.push(line.clone()),
-            Err(cause) => {
-                steps.push(cause.full().to_string());
-                steps.extend(account.advice.iter().map(Advice::to_string));
-                if let Some(log) = account.log {
-                    steps.push(format!("{SESSION_LOG}{}", log.display()));
-                }
-                if let Some(log) = logs::command_log_path() {
-                    steps.push(format!("{COMMAND_LOG}{}", log.display()));
-                }
+            Err(cause) => steps.push(cause.full().to_string()),
+        }
+        steps.extend(account.advice.iter().map(Advice::to_string));
+        if account.ended.is_err() {
+            if let Some(log) = account.log {
+                steps.push(format!("{SESSION_LOG}{}", log.display()));
+            }
+            if let Some(log) = logs::command_log_path() {
+                steps.push(format!("{COMMAND_LOG}{}", log.display()));
             }
         }
         Shown {
diff --git a/src/security.rs b/src/security.rs
index 62fc642..4b2f48e 100644
--- a/src/security.rs
+++ b/src/security.rs
@@ -7,6 +7,7 @@ use anyhow::{Context, Result};
 use serde_json::Value;
 
 use crate::asks::Flags;
+use crate::base_fix::Advice;
 use crate::config::UserConfig;
 use crate::failed_run::FailedRun;
 use crate::github::ListedIssue;
@@ -39,6 +40,7 @@ pub enum Outcome {
 pub struct Ended {
     pub outcome: Result<Recorded, FailedRun>,
     pub findings: Vec<RecordedFinding>,
+    pub advice: Vec<Advice>,
 }
 
 impl From<anyhow::Error> for Ended {
@@ -46,10 +48,30 @@ impl From<anyhow::Error> for Ended {
         Self {
             outcome: Err(error.into()),
             findings: Vec::new(),
+            advice: Vec::new(),
         }
     }
 }
 
+/// Preserve the typed command, quoting its words so the offered command can be run.
+fn command_with_fixing() -> String {
+    let words = std::env::args()
+        .skip(1)
+        .map(|word| {
+            if word
+                .chars()
+                .all(|c| c.is_ascii_alphanumeric() || "-_/.:@=".contains(c))
+                && !word.is_empty()
+            {
+                word
+            } else {
+                format!("'{}'", word.replace('\'', "'\\''"))
+            }
+        })
+        .collect::<Vec<_>>();
+    format!("thirdshift {} security-fix", words.join(" "))
+}
+
 /// Only the metadata allowed in a Run notification; no private write-up.
 #[derive(Debug, PartialEq, Eq)]
 pub struct RecordedFinding {
@@ -79,6 +101,7 @@ pub enum Skipped {
     AlreadyRunning(AlreadyRunning),
     ReadyIssue(ListedIssue),
     FindingWaiting,
+    FailedFix(crate::issue::IssueUrl),
     UnchangedBase(String),
 }
 
@@ -91,6 +114,11 @@ impl fmt::Display for Skipped {
                 "Ready issue #{} \"{}\" goes first: {}",
                 listed.issue.number, listed.title, listed.issue.url
             ),
+            Self::FailedFix(ticket) => write!(
+                f,
+                "failed Security fix #{} is still open for the Day shift: {}",
+                ticket.number, ticket.url
+            ),
             Self::FindingWaiting => f.write_str("a Security finding is waiting for the Day shift"),
             Self::UnchangedBase(base) => write!(
                 f,
@@ -133,6 +161,8 @@ pub fn run(
         }
         Err(error) => return Outcome::Audited(error.into()),
     };
+    let offer_command =
+        (flags.security_fix.is_none() && config.security_fix.is_none()).then(command_with_fixing);
     run_through(
         &mut LaunchAndGitHub {
             launch: &directory,
@@ -145,10 +175,17 @@ pub fn run(
         &repo,
         base.name(),
         flags.security_fix_allowed(config),
+        offer_command.as_deref(),
     )
 }
 
-fn run_through(outside: &mut impl Outside, repo: &Repo, base: &str, fixing: bool) -> Outcome {
+fn run_through(
+    outside: &mut impl Outside,
+    repo: &Repo,
+    base: &str,
+    fixing: bool,
+    offer_command: Option<&str>,
+) -> Outcome {
     match outside.ready_issue() {
         Ok(Some(ready)) => {
             let skipped = Skipped::ReadyIssue(ready.listed);
@@ -162,6 +199,15 @@ fn run_through(outside: &mut impl Outside, repo: &Repo, base: &str, fixing: bool
         Ok(records) => records,
         Err(error) => return Outcome::Audited(error.into()),
     };
+    match records.failed_fix() {
+        Ok(Some(ticket)) => {
+            let skipped = Skipped::FailedFix(ticket);
+            outside.skipped(Pass::Security, &skipped);
+            return Outcome::Skipped(skipped);
+        }
+        Ok(None) => {}
+        Err(error) => return Outcome::Audited(error.into()),
+    }
     if fixing {
         match records.next_fix() {
             Ok(Some((record, metadata))) => return fix(outside, repo, base, record, metadata),
@@ -183,7 +229,7 @@ fn run_through(outside: &mut impl Outside, repo: &Repo, base: &str, fixing: bool
         Ok(false) => {}
         Err(error) => return Outcome::Audited(error.into()),
     }
-    let audited = audit_and_record(outside, repo, base);
+    let audited = audit_and_record(outside, repo, base, offer_command);
     if fixing && audited.outcome.is_ok() {
         match outside
             .security_records()
@@ -226,11 +272,32 @@ fn fix(
         log = session_log;
         let issue = published?;
         outside.link_security_fix(&record, &issue)?;
-        Ok(outside.dispatch(crate::pass::Dispatch::SecurityFix {
+        let mut ended = outside.dispatch(crate::pass::Dispatch::SecurityFix {
             issue: &issue,
             is_spec: record.fix_size()? == reproduction::FixSize::Spec,
             base,
-        }))
+        });
+        if let Err(error) =
+            outside.record_security_fix_ending(&record, &issue, ended.outcome.is_ok())
+        {
+            ended.outcome = Err(match ended.outcome {
+                Err(mut failed) => {
+                    let cause =
+                        format!("could not record the failed Security fix's ending: {error:#}");
+                    failed.error = std::mem::replace(&mut failed.error, error).context(cause);
+                    failed
+                }
+                Ok(reached) => FailedRun {
+                    log: reached.log,
+                    pr_url: Some(reached.pr_url),
+                    ticket_lines: reached.ticket_lines,
+                    ..error
+                        .context("could not record the successful Security fix's ending")
+                        .into()
+                },
+            });
+        }
+        Ok(ended)
     })();
     Outcome::Fixed {
         ended: ended.unwrap_or_else(|error| crate::run::Ended {
@@ -245,7 +312,13 @@ fn fix(
     }
 }
 
-fn audit_and_record(outside: &mut impl Outside, repo: &Repo, base: &str) -> Ended {
+fn audit_and_record(
+    outside: &mut impl Outside,
+    repo: &Repo,
+    base: &str,
+    offer_command: Option<&str>,
+) -> Ended {
+    let mut advice = Vec::new();
     let mut findings = Vec::new();
     let mut log = None;
     let recorded = (|| -> Result<Recorded> {
@@ -301,6 +374,21 @@ fn audit_and_record(outside: &mut impl Outside, repo: &Repo, base: &str) -> Ende
             }
             let reproduced = reproduced?;
             outside.update_security_record(record, &reproduced)?;
+            if reproduced.severity().is_some()
+                && let Some(command) = offer_command
+            {
+                advice = vec![
+                    Advice {
+                        label: "Allow fixing",
+                        value: command.to_string(),
+                    },
+                    Advice {
+                        label: "Or set",
+                        value: "fix = true under [security] in ~/.thirdshift/config.toml"
+                            .to_string(),
+                    },
+                ];
+            }
             for finding in findings.iter_mut().filter(|finding| finding.url == *url) {
                 finding.severity = reproduced
                     .severity()
@@ -319,6 +407,7 @@ fn audit_and_record(outside: &mut impl Outside, repo: &Repo, base: &str) -> Ende
             ..error.into()
         }),
         findings,
+        advice,
     }
 }
 
@@ -346,7 +435,7 @@ mod tests {
             if ready {
                 outside = outside.ready(7, false);
             }
-            let outcome = run_through(&mut outside, &widgets(), "main", true);
+            let outcome = run_through(&mut outside, &widgets(), "main", true, None);
             if ready {
                 assert!(matches!(outcome, Outcome::Skipped(Skipped::ReadyIssue(_))));
                 assert!(matches!(
@@ -385,7 +474,7 @@ mod tests {
                 "ghsa_id": "GHSA-test", "summary": "Unchecked input size"
             })])
             .harness_failing();
-        let outcome = run_through(&mut outside, &widgets(), "main", false);
+        let outcome = run_through(&mut outside, &widgets(), "main", false, None);
         assert!(matches!(outcome, Outcome::Skipped(_)));
         assert_eq!(
             outside.calls,
@@ -410,7 +499,7 @@ mod tests {
             let mut outside = InMemory::default().advisories(vec![serde_json::json!({
                 "state": state, "severity": severity
             })]);
-            let outcome = run_through(&mut outside, &widgets(), "main", false);
+            let outcome = run_through(&mut outside, &widgets(), "main", false, None);
             assert_eq!(
                 matches!(outcome, Outcome::Skipped(_)),
                 waits,
@@ -436,7 +525,7 @@ mod tests {
                 "state": state,
                 "labels": labels.iter().map(|name| serde_json::json!({"name":name})).collect::<Vec<_>>()
             })]);
-            let outcome = run_through(&mut outside, &widgets(), "main", false);
+            let outcome = run_through(&mut outside, &widgets(), "main", false, None);
             assert_eq!(
                 matches!(outcome, Outcome::Skipped(_)),
                 waits,
@@ -452,7 +541,7 @@ mod tests {
     #[test]
     fn checks_prerequisites_then_audits_without_pulling() {
         let mut outside = InMemory::default();
-        let outcome = run_through(&mut outside, &widgets(), "main", false);
+        let outcome = run_through(&mut outside, &widgets(), "main", false, None);
         assert!(matches!(
             outcome,
             Outcome::Audited(Ended { outcome: Ok(_), .. })
@@ -479,7 +568,7 @@ mod tests {
             .node_failing()
             .harness_failing();
         assert!(matches!(
-            run_through(&mut outside, &widgets(), "main", false),
+            run_through(&mut outside, &widgets(), "main", false, None),
             Outcome::Skipped(Skipped::ReadyIssue(_))
         ));
         assert!(matches!(
@@ -505,7 +594,7 @@ mod tests {
                     if unchanged {
                         outside = outside.unchanged_base();
                     }
-                    let outcome = run_through(&mut outside, &widgets(), "main", false);
+                    let outcome = run_through(&mut outside, &widgets(), "main", false, None);
                     let expected = if ready {
                         "Ready issue #7"
                     } else if waiting {
@@ -535,6 +624,55 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_failed_fix_yields_to_ready_work_but_precedes_waiting_and_audit_history() {
+        for private in [false, true] {
+            for ready in [false, true] {
+                for closed in [false, true] {
+                    for fixing in [false, true] {
+                        let body = "Private record\n<!-- thirdshift:security-fix -->\nFix Ticket: https://github.com/acme/widgets/issues/8\nFix Run: failed\n";
+                        let values = vec![
+                            serde_json::json!({
+                                "state": if private { "open" } else { "draft" },
+                                "severity": null, "description": body, "body": body,
+                                "security_fix_closed": closed,
+                            }),
+                            serde_json::json!({
+                                "state": if private { "open" } else { "draft" },
+                                "severity": null, "labels": [{"name":"needs-triage"}],
+                            }),
+                        ];
+                        let mut outside = if private {
+                            InMemory::default().finding_issues(values)
+                        } else {
+                            InMemory::default().advisories(values)
+                        }
+                        .unchanged_base();
+                        if ready {
+                            outside = outside.ready(7, false);
+                        }
+                        let Outcome::Skipped(skipped) =
+                            run_through(&mut outside, &widgets(), "main", fixing, None)
+                        else {
+                            panic!("Security run should skip");
+                        };
+                        let expected = if ready {
+                            "Ready issue #7"
+                        } else if !closed {
+                            "failed Security fix #8 is still open"
+                        } else {
+                            "a Security finding is waiting for the Day shift"
+                        };
+                        assert!(skipped.to_string().starts_with(expected), "{skipped}");
+                        assert!(!outside.calls.contains(&Call::HarnessCheck));
+                        assert!(!outside.calls.contains(&Call::AuditHistory));
+                        assert_eq!(outside.calls.contains(&Call::AdvisoryList), !ready);
+                    }
+                }
+            }
+        }
+    }
+
     #[test]
     fn each_failed_prerequisite_prevents_later_operations() {
         for (mut outside, expected) in [
@@ -559,7 +697,7 @@ mod tests {
             ),
         ] {
             assert!(matches!(
-                run_through(&mut outside, &widgets(), "main", false),
+                run_through(&mut outside, &widgets(), "main", false, None),
                 Outcome::Audited(Ended {
                     outcome: Err(_),
                     ..
@@ -577,7 +715,7 @@ mod tests {
         let Outcome::Audited(Ended {
             outcome: Err(failed),
             ..
-        }) = run_through(&mut outside, &widgets(), "main", false)
+        }) = run_through(&mut outside, &widgets(), "main", false, None)
         else {
             panic!("audit should fail");
         };
@@ -619,7 +757,7 @@ mod tests {
         let Outcome::Audited(Ended {
             outcome: Ok(recorded),
             ..
-        }) = run_through(&mut outside, &widgets(), "main", false)
+        }) = run_through(&mut outside, &widgets(), "main", false, None)
         else {
             panic!("audit should succeed");
         };
diff --git a/tests/command_surface.rs b/tests/command_surface.rs
index 305b100..5cde6a7 100644
--- a/tests/command_surface.rs
+++ b/tests/command_surface.rs
@@ -224,7 +224,7 @@ fn help_documents_pickup_the_ready_issue_the_dispatch_the_skips_and_the_run_noti
         "A Ready issue is an open issue labelled ready-for-agent",
         "none of ready-for-human, needs-info, wontfix and needs-triage",
         "is not in-progress",
-        "is not a sub-issue, is not labelled base-fix, has no open blocker",
+        "is not a sub-issue, is not labelled base-fix or security-fix, has no open blocker",
         "was never started: no Issue branch for it is on origin, and no pull request from one exists, open, merged or closed",
         "A Spec whose Tickets are all closed is not one either: a Spec run would find nothing to do",
         "It must also be settled: ten minutes have passed since ready-for-agent was applied to it, and since a sub-issue or a \"blocked by\" link of its was last added or removed",
diff --git a/tests/security_run.rs b/tests/security_run.rs
index 35532e3..b62864a 100644
--- a/tests/security_run.rs
+++ b/tests/security_run.rs
@@ -760,6 +760,282 @@ fn the_security_run_ends_as_a_failed_fix_and_sends_one_private_metadata_notifica
     assert!(!body.contains("bounded_fixture"));
 }
 
+#[test]
+fn a_failed_fix_keeps_its_claim_and_pauses_security_and_pickup_until_closed() {
+    for private in [false, true] {
+        for pushed in [false, true] {
+            let scenario = with_reproduced_findings(&["critical"]);
+            let issue = if private { 7 } else { 8 };
+            if private {
+                let mut state = scenario.gh_state();
+                state["private"] = json!(true);
+                state["bodies"]["7"] = state["advisories"][0]["description"].clone();
+                state["labels"]["7"] = json!(["security-finding", "needs-triage"]);
+                scenario.write_gh_state(&state);
+            } else {
+                scenario.agent_does_in_session(1, &publish_fix("GHSA-finding-0"));
+            }
+            scenario.agent_does_for(
+                issue,
+                &format!(
+                    "{}exit 1\n",
+                    if pushed { implement_fix() } else { "" }
+                        .replace("issue-8", &format!("issue-{issue}"))
+                        .replace("#8", &format!("#{issue}"))
+                ),
+            );
+            let failed = scenario.run(&["secure", "security-fix"]);
+            assert_eq!(failed.code, Some(1), "{}", failed.stderr);
+            assert_eq!(
+                scenario.issue_labels(issue),
+                if private {
+                    vec!["security-finding", "security-fix", "in-progress"]
+                } else {
+                    vec!["security-fix", "in-progress"]
+                }
+            );
+            // Even contradictory ready labelling cannot make Pickup retry a Claim.
+            scenario.issue_labelled(
+                issue,
+                if private {
+                    &[
+                        "security-finding",
+                        "security-fix",
+                        "in-progress",
+                        "ready-for-agent",
+                    ]
+                } else {
+                    &["security-fix", "in-progress", "ready-for-agent"]
+                },
+            );
+            let reason = format!("failed Security fix #{issue} is still open");
+            let resend = ResendStandIn::replying(200, r#"{"id":"sent"}"#);
+            for args in [
+                vec!["secure", "security-fix", "email", "day@example.com"],
+                vec!["secure", "no-security-fix", "email", "day@example.com"],
+                vec!["pickup"],
+            ] {
+                let skipped = scenario.run_with_env(&args, &resend_env(&resend));
+                assert_eq!(skipped.code, Some(0), "{}", skipped.stderr);
+                assert!(skipped.stdout.is_empty());
+                if args[0] == "secure" {
+                    assert!(skipped.stderr.contains(&reason), "{}", skipped.stderr);
+                }
+            }
+            let fix_sessions = if private { 1 } else { 2 };
+            assert_eq!(scenario.claude_calls().len(), fix_sessions);
+            assert!(resend.requests().is_empty());
+            assert_eq!(
+                scenario
+                    .entries("home/.thirdshift/logs/acme/widgets/commands/secure")
+                    .len(),
+                1
+            );
+            let activity = fs::read_to_string(
+                scenario.path("home/.thirdshift/logs/acme/widgets/activity.log"),
+            )
+            .unwrap();
+            assert!(
+                activity
+                    .matches(&format!("Security run skipped: {reason}"))
+                    .count()
+                    == 1,
+                "{activity}"
+            );
+            let mut state = scenario.gh_state();
+            state["issues"][issue.to_string()] = json!("CLOSED");
+            scenario.write_gh_state(&state);
+            scenario.agent_does(&audit_script("[]"));
+            let after = scenario.run(&["secure", "security-fix"]);
+            assert_eq!(after.code, Some(0), "{}", after.stderr);
+            assert!(
+                after
+                    .stderr
+                    .contains("Security audit recorded 0 new finding(s)"),
+                "{}",
+                after.stderr
+            );
+            assert_eq!(scenario.claude_calls().len(), fix_sessions + 1);
+        }
+    }
+}
+
+#[test]
+fn a_failed_spec_fix_keeps_its_claim_and_pauses_security_and_pickup_until_closed() {
+    for private in [false, true] {
+        let scenario = with_reproduced_findings(&["high"]);
+        let mut state = scenario.gh_state();
+        let evidence = state["advisories"][0]["description"]
+            .as_str()
+            .unwrap()
+            .replace("high single", "high spec")
+            .replace("Fix size: single", "Fix size: spec");
+        let (spec, ticket) = if private { (7, 8) } else { (8, 9) };
+        if private {
+            state["private"] = json!(true);
+            state["bodies"]["7"] = json!(evidence);
+            state["labels"]["7"] = json!(["security-finding", "needs-triage"]);
+            scenario.agent_does_for_in_session(7, 1, r#"
+gh issue create --title 'Bound storage input' --body 'Bound storage input. Private record: https://github.com/acme/widgets/issues/7' --label ready-for-agent
+gh issue create --title 'Bound transport input' --body 'Bound transport input. Private record: https://github.com/acme/widgets/issues/7' --label ready-for-agent
+gh fake sub-issues 7 '[8,9]'
+printf '%s\n' 'Security fix Spec: https://github.com/acme/widgets/issues/7' > "$FAKE_CLAUDE_FINAL_MESSAGE"
+"#);
+        } else {
+            state["advisories"][0]["description"] = json!(evidence);
+            scenario.agent_does_in_session(
+                1,
+                &publish_spec("https://github.com/acme/widgets/security/advisories/GHSA-finding-0"),
+            );
+        }
+        state["blocked_by"][(ticket + 1).to_string()] = json!([ticket]);
+        scenario.write_gh_state(&state);
+        scenario.agent_does_for(ticket, "exit 1\n");
+        let failed = scenario.run(&["secure", "security-fix", "parallel", "1"]);
+        assert_eq!(failed.code, Some(1), "{}", failed.stderr);
+        assert!(
+            failed.stderr.contains("claude exited 1"),
+            "{}",
+            failed.stderr
+        );
+        assert_eq!(
+            scenario.issue_labels(spec),
+            if private {
+                vec!["security-finding", "security-fix", "in-progress"]
+            } else {
+                vec!["security-fix", "in-progress"]
+            }
+        );
+        let state = scenario.gh_state();
+        assert_eq!(state["issues"][spec.to_string()], "OPEN");
+        assert_eq!(state["issues"][ticket.to_string()], "OPEN");
+        let description = if private {
+            &state["bodies"]["7"]
+        } else {
+            &state["advisories"][0]["description"]
+        }
+        .as_str()
+        .unwrap();
+        assert!(description.starts_with(&evidence), "{description}");
+        assert!(
+            description.contains(&format!(
+                "Fix Ticket: https://github.com/acme/widgets/issues/{spec}"
+            )),
+            "{description}"
+        );
+        assert!(description.ends_with("Fix Run: failed\n"), "{description}");
+        assert_eq!(scenario.claude_calls().len(), 2);
+        let reason = format!("failed Security fix #{spec} is still open");
+        for permission in ["security-fix", "no-security-fix"] {
+            let skipped = scenario.run(&["secure", permission]);
+            assert_eq!(skipped.code, Some(0), "{}", skipped.stderr);
+            assert!(skipped.stderr.contains(&reason), "{}", skipped.stderr);
+        }
+        let pickup = scenario.run(&["pickup"]);
+        assert_eq!(pickup.code, Some(0), "{}", pickup.stderr);
+        assert!(
+            !pickup.stderr.contains("taking Ready issue"),
+            "{}",
+            pickup.stderr
+        );
+        assert_eq!(scenario.claude_calls().len(), 2);
+        let mut state = scenario.gh_state();
+        state["issues"][spec.to_string()] = json!("CLOSED");
+        scenario.write_gh_state(&state);
+        scenario.agent_does(&audit_script("[]"));
+        let after = scenario.run(&["secure", "security-fix"]);
+        assert_eq!(after.code, Some(0), "{}", after.stderr);
+        assert!(
+            after
+                .stderr
+                .contains("Security audit recorded 0 new finding(s)"),
+            "{}",
+            after.stderr
+        );
+        assert_eq!(scenario.claude_calls().len(), 3);
+    }
+}
+
+#[test]
+fn a_successful_fix_awaiting_review_does_not_pause_allowed_security_work() {
+    let scenario = with_reproduced_findings(&["high"]);
+    scenario.agent_does_in_session(1, &publish_fix("GHSA-finding-0"));
+    scenario.agent_does_for(8, implement_fix());
+    let fixed = scenario.run(&["secure", "security-fix"]);
+    assert_eq!(fixed.code, Some(0), "{}", fixed.stderr);
+    scenario.agent_does(&audit_script("[]"));
+    let audited = scenario.run(&["secure", "security-fix"]);
+    assert_eq!(audited.code, Some(0), "{}", audited.stderr);
+    assert!(
+        audited
+            .stderr
+            .contains("Security audit recorded 0 new finding(s)"),
+        "{}",
+        audited.stderr
+    );
+    assert_eq!(scenario.claude_calls().len(), 3);
+}
+
+#[test]
+fn an_undecided_run_offers_both_ways_to_allow_a_reproduced_fix() {
+    for (config, permission, reproduced, offers) in [
+        ("", None, true, true),
+        ("", Some("no-security-fix"), true, false),
+        ("[security]\nfix = false\n", None, true, false),
+        (
+            "[security]\nfix = true\n",
+            Some("no-security-fix"),
+            true,
+            false,
+        ),
+        ("", None, false, false),
+    ] {
+        let scenario = Scenario::new();
+        scenario.user_config_is(config);
+        scenario.agent_does_in_session(1, &audit_script(&json!([finding("offer")]).to_string()));
+        scenario.agent_does_in_session(
+            2,
+            &reproduction_script(if reproduced {
+                "reproduced high single"
+            } else {
+                "not reproduced"
+            }),
+        );
+        let resend = ResendStandIn::replying(200, r#"{"id":"sent"}"#);
+        let mut args = vec![
+            "secure",
+            "base",
+            "main",
+            "harness",
+            "claude",
+            "email",
+            "day@example.com",
+        ];
+        if let Some(permission) = permission {
+            args.push(permission);
+        }
+        let result = scenario.run_with_env(&args, &resend_env(&resend));
+        assert_eq!(result.code, Some(0), "{}", result.stderr);
+        let (_, body) = the_one_notification(&resend);
+        for text in [&result.stderr, &body] {
+            assert_eq!(
+                text.contains(
+                    "thirdshift secure base main harness claude email day@example.com security-fix"
+                ),
+                offers,
+                "{text}"
+            );
+            assert_eq!(
+                text.contains("fix = true under [security]"),
+                offers,
+                "{text}"
+            );
+            assert!(!text.contains("Private candidate write-up"), "{text}");
+        }
+        assert_eq!(scenario.claude_calls().len(), 2);
+    }
+}
+
 #[test]
 fn invalid_fix_tickets_are_not_marked_ready_or_dispatched() {
     for script in [
@@ -2796,3 +3072,145 @@ export FAKE_CLAUDE_PROMPT="$(node -e 'const fs = require("fs"); const calls = JS
         result.stderr
     );
 }
+
+#[test]
+fn review_failed_fix_before_claim_is_not_retried_by_pickup() {
+    let scenario = with_reproduced_findings(&["high"]);
+    scenario.agent_does_in_session(
+        1,
+        &format!(
+            "{}gh fake fails 'label create in-progress'\n",
+            publish_fix("GHSA-finding-0")
+        ),
+    );
+    scenario.agent_does_for(8, implement_fix());
+
+    let failed = scenario.run(&["secure", "security-fix"]);
+    assert_eq!(failed.code, Some(1), "{}", failed.stderr);
+    assert!(
+        failed.stderr.contains("could not make the Claim on #8"),
+        "{}",
+        failed.stderr
+    );
+
+    let mut state = scenario.gh_state();
+    state["failing"] = json!([]);
+    scenario.write_gh_state(&state);
+    scenario.issue_timeline(
+        8,
+        &[(support::TimelineEvent::Labelled("ready-for-agent"), 20)],
+    );
+
+    let pickup = scenario.run(&["pickup"]);
+    assert_eq!(pickup.code, Some(0), "{}", pickup.stderr);
+    assert!(
+        !pickup.stderr.contains("taking Ready issue #8"),
+        "Pickup retried a failed Security fix: {}",
+        pickup.stderr
+    );
+    assert_eq!(scenario.claude_calls().len(), 1);
+}
+
+#[test]
+fn review_failed_fix_marker_write_error_still_pauses_security() {
+    assert_a_failed_fix_record_outage_pauses_security("high");
+}
+
+#[test]
+fn a_failed_fix_still_pauses_after_its_failure_record_patch_is_rejected() {
+    assert_a_failed_fix_record_outage_pauses_security("critical");
+}
+
+#[test]
+fn a_failed_fix_preserves_private_edits_made_during_its_run_and_still_pauses() {
+    for private in [false, true] {
+        let scenario = with_reproduced_findings(&["high"]);
+        let issue = if private { 7 } else { 8 };
+        let mut state = scenario.gh_state();
+        let original = state["advisories"][0]["description"]
+            .as_str()
+            .unwrap()
+            .to_string();
+        if private {
+            state["private"] = json!(true);
+            state["bodies"]["7"] = json!(original);
+            state["labels"]["7"] = json!(["security-finding", "needs-triage"]);
+            scenario.write_gh_state(&state);
+        } else {
+            scenario.agent_does_in_session(1, &publish_fix("GHSA-finding-0"));
+        }
+        let description = format!(
+            "{original}\n<!-- thirdshift:security-fix -->\nFix Ticket: https://github.com/acme/widgets/issues/{issue}\nFix Run: pending\nDay shift note: keep the input contract.\n"
+        );
+        let (path, field) = if private {
+            ("issues/7", "body")
+        } else {
+            ("security-advisories/GHSA-finding-0", "description")
+        };
+        scenario.agent_does_for(issue, &format!(
+            "gh api --method PATCH repos/acme/widgets/{path} --input - <<'RECORD'\n{}\nRECORD\nexit 1\n",
+            json!({field: description})
+        ));
+        let failed = scenario.run(&["secure", "security-fix"]);
+        assert_eq!(failed.code, Some(1), "{}", failed.stderr);
+        let state = scenario.gh_state();
+        let description = if private {
+            &state["bodies"]["7"]
+        } else {
+            &state["advisories"][0]["description"]
+        }
+        .as_str()
+        .unwrap();
+        assert!(
+            description.contains("Day shift note: keep the input contract."),
+            "{description}"
+        );
+        let next = scenario.run(&["secure", "security-fix"]);
+        assert_eq!(next.code, Some(0), "{}", next.stderr);
+        assert!(
+            next.stderr
+                .contains(&format!("failed Security fix #{issue} is still open")),
+            "{}",
+            next.stderr
+        );
+        assert_eq!(scenario.claude_calls().len(), if private { 1 } else { 2 });
+    }
+}
+
+fn assert_a_failed_fix_record_outage_pauses_security(severity: &str) {
+    let scenario = with_reproduced_findings(&[severity]);
+    scenario.agent_does_in_session(1, &publish_fix("GHSA-finding-0"));
+    scenario.agent_does_for(
+        8,
+        "gh fake fails 'api --method PATCH repos/acme/widgets/security-advisories/GHSA-finding-0'\nexit 1\n",
+    );
+
+    let failed = scenario.run(&["secure", "security-fix"]);
+    assert_eq!(failed.code, Some(1), "{}", failed.stderr);
+    assert!(
+        failed
+            .stderr
+            .contains("could not record the failed Security fix's ending"),
+        "{}",
+        failed.stderr
+    );
+    assert_eq!(scenario.gh_state()["issues"]["8"], "OPEN");
+    assert_eq!(
+        scenario.issue_labels(8),
+        vec!["security-fix", "in-progress"]
+    );
+
+    let mut state = scenario.gh_state();
+    state["failing"] = json!([]);
+    scenario.write_gh_state(&state);
+    scenario.agent_does(&audit_script("[]"));
+
+    let next = scenario.run(&["secure", "security-fix"]);
+    assert_eq!(next.code, Some(0), "{}", next.stderr);
+    assert!(
+        next.stderr.contains("failed Security fix #8 is still open"),
+        "Security resumed with an open failed fix: {}",
+        next.stderr
+    );
+    assert_eq!(scenario.claude_calls().len(), 2);
+}