2.27.1

20261025120000_reprice_investigation_attempt.sql adds reprice_investigation_attempt(_investigation_id, _model_type, _image_count), which re-books only the current attempt of an investigation against the model that answered it. It returns only what that attempt still holds (its newest investigation spend, less refunds that already point at it, bounded by what the reference nets), writes that refund against the spend (settles_entry_id), charges the account that paid the attempt for the new model, and moves the row's model_type to that model, all in one transaction under the settlement lock. Because the row and the attempt's newest charge always name the same model, a worker that dies after repricing leaves a row the stale-row reclaim can run and reprice correctly. When the new charge cannot be covered (42501), the refund rolls back. It returns NULL when the attempt booked no charge. That includes a paid investigation re-run on a free persona: its newest spend is the earlier run's, so the function only reprices a spend booked for the model the row is queued against. Before this, the worker repriced with reprice_ai_credits(), which refunds everything ever charged against the reference. A fallback on a re-queued investigation would therefore have erased earlier runs' settled charges and could have moved what was left between Party Quest members. The same migration re-issues settle_investigation_credits() (20260918120000) with that same rule: the spend it settles must be for the model the row is charged for. Otherwise a paid investigation re-run on a free persona settled the earlier run's charge with the free run's token counts and refunded part of it. This bug predates #737. The function is service role only, and reprice_ai_credits() is unchanged for the coach and narrative routes. supabase/tests/investigation_reprice_attempt.sql covers the single run, the re-queued run, the payer, the free run, a paid run re-queued on a free persona, a reclaimed row that falls back again, settling a free re-run, and the rollback, and rls.sql pins the grants. (#737)

scripts/worker-deploy.test.mjs pins the worker image's entrypoint: no USER line in the runner stage, the socket hand-off, and the setpriv drop to node. New worker tests cover the fallback ranking (price cap, other providers first, plan tier, configured providers, DeepSeek with documents or images, inactive personas, the three-model cap) and the processor's chain (reprice to the model that answered, the attempt record, no search on a free substitute, each failure reason, the time budget on the picked model and its substitutes, the shutdown grace, a stalled fallback lookup, DeepSeek's no-search prompt, the abort reaching the provider request, and repricing through reprice_investigation_attempt() without the worker naming a payer). Web tests check that the card never renders error. (#737)

docs/ai-investigations.md describes the fallback rule, the per-attempt repricing and the plain-language failure copy. docs/schema.md lists the new migration and its pgTAP coverage. docs/ops/deployments.md explains why the worker image starts as root and how an EACCES /.fly/api failure shows up. (#737)