diff --git a/CLAUDE.md b/CLAUDE.md
index 68e19a1..fa2ff48 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -16,13 +16,13 @@ cargo test --offline --test e2e push_workflow_succeeds   # one e2e test
 cargo run -- -C tests/fixtures/repo --host -n   # try the CLI against the fixture repo
 ```
 
-- `tests/e2e.rs` runs the built binary (through `bin()`, which adds `--no-history`) with `--host --no-cache-server` against `tests/fixtures/repo` (needs `bash`, `node` and `git` on PATH, no Docker). Assertions grep stdout, so changing log/summary line formats (`"<wf> / <job>: <result>"`, masking `***`) can break them.
+- `tests/e2e.rs` runs the built binary (through `bin()`, which adds `--no-history`) with `--host --no-cache-server` against `tests/fixtures/repo` (needs `bash`, `node` and `git` on PATH, no Docker). Assertions grep stdout, so changing log/summary line formats (`"<wf> / <job>: <result>"`, the closing `🏁`/`❌ N workflows, M jobs: …` line, masking `***`) can break them.
 - The e2e test binary bakes in absolute paths via `CARGO_BIN_EXE_runthrough` / `CARGO_MANIFEST_DIR`. If it fails with `run runthrough: ... NotFound` after the repo directory was moved or renamed, `touch tests/e2e.rs` (or `cargo clean`) to force a rebuild.
 - Exit codes: `0` all jobs succeeded/skipped, `1` a job failed, `2` an internal error (`anyhow` error from `run()`).
 
 ## Architecture
 
-Pipeline: `main.rs` (CLI + config assembly) → `workflow.rs` (load YAML) → `filters.rs` (`on.<event>` branch/tag/path/type filters) → `planner.rs` (stages, matrix) → `runner.rs` (execute) using `expr.rs`, `actions.rs`, `backend.rs`, `commands.rs`, `matchers.rs`, `context.rs`, `servers.rs`; `info.rs` serves the exit-early modes (`--graph`, `--man-page`, `--list-options`, `--bug-report`) and `--watch`'s fingerprint; `history.rs` and `dashboard.rs` record runs and serve `--dashboard`; `markers.rs` formats the job and step status lines the runner logs and `history.rs` parses back.
+Pipeline: `main.rs` (CLI + config assembly) → `workflow.rs` (load YAML) → `filters.rs` (`on.<event>` branch/tag/path/type filters) → `planner.rs` (stages, matrix) → `runner.rs` (execute) using `expr.rs`, `actions.rs`, `backend.rs`, `commands.rs`, `matchers.rs`, `context.rs`, `servers.rs`; `info.rs` serves the exit-early modes (`--graph`, `--man-page`, `--list-options`, `--bug-report`, `--install-hook`) and `--watch`'s fingerprint; `history.rs` and `dashboard.rs` record runs and serve `--dashboard`; `markers.rs` formats the job and step status lines the runner logs and `history.rs` parses back.
 
 - **`main.rs`** parses CLI (clap derive; flag names follow act, see `docs/act-parity.md`), discovers workflows (`workflow_paths`: `-W`, or `.github/workflows` plus `.runthrough/workflows`; recursively unless `--no-recurse`), filters by event and its `on.<event>` filters (an explicit `-j` or a single workflow file bypasses both), handles `-l`/`-n`/`-g`/`--validate`, merges `.secrets`/`.vars`/`.env`/`.input` files with CLI flags (flags win), and builds `runner::Config`. Arguments from `.actrc` files are spliced in before the real ones (`actrc_args`). `Cli` is `pub` so `info.rs` and `servers.rs` read it directly.
 - **`workflow.rs`** validates every workflow (`schema_errors`: required keys and value types; `strict_check` adds unknown keys under `--strict`), then deserializes it with `serde_yaml`; many fields stay as raw `serde_yaml::Value` because they may contain `${{ }}` and are evaluated later. `yaml_to_json` / `yaml_scalar_to_string` bridge YAML into the JSON values the expression engine uses.
@@ -38,13 +38,13 @@ Pipeline: `main.rs` (CLI + config assembly) → `workflow.rs` (load YAML) → `f
   - `exec_with` is the single point that spawns step processes: it creates fresh `GITHUB_OUTPUT`/`ENV`/`PATH`/`STATE`/`STEP_SUMMARY` files under `files/<seq>/`, injects env (runner → job → step), parses workflow commands from output, and applies masking. `Target::Backend` runs in the job's backend; `Target::Container` runs a Docker action or `docker://` step as a sibling container started from the host (`run_container_step`), with env passed as `-e`.
   - `Logger` prints through `emit`, which ignores stdout write errors so a closed pipe never skips cleanup.
   - `resolve_platform` maps `runs-on` labels to an image or the host (`-self-hosted` sentinel; `ubuntu*`/`linux` → `DEFAULT_IMAGE`; `self-hosted` and `macos*` on macOS → host).
-  - `actions/checkout` is special-cased (`checkout`) unless `--no-skip-checkout`: the own repo is copied (no-op with `--bind`), another `repository` is shallow-cloned.
+  - `actions/checkout` is special-cased (`checkout`) unless `--no-skip-checkout`: the own repo is copied (no-op with `--bind`; only the HEAD commit with `--committed`, which also reads the repository's workflows, called ones included, from that commit exported by `actions::export_head` into `Config.committed`), another `repository` is shallow-cloned.
 - **`backend.rs`**: `Backend::Host` or `Backend::Container`, driven through a CLI chosen by `Engine` (`docker`, or Apple's `container` via `--engine container`); no container API crate. Engine differences are handled here, as `Engine` methods the runner asks (`quiet_args`, `host_gateway_arg`, `has_network_aliases`, `has_health_checks`, `has_host_network`, `needs_temp_volume`, `is_remote`): Apple `container` gets `--progress none`, has no `--network-alias` (the runner writes service IPs into the job container's `/etc/hosts`) and no health checks (`take_health` strips `--health-*` and `wait_healthy` polls the command with `exec`); `host_address` is `host.docker.internal` for Docker and the network's `ipv4Gateway` for Apple. The job scratch dir is bind-mounted at the **same absolute path** in the container, so host and container paths are interchangeable throughout the runner. Exceptions are the job's volumes (`JobRun.job_volumes`, mounted over those paths): RUNNER_TEMP for Docker jobs, and, where Docker shares host files through a VM (`Engine::shares_files_through_vm`, i.e. Docker Desktop outside Linux) and without `--bind` or the engine socket (whose jobs hand workspace paths to the engine), the workspace; the host does not see writes there, and `sync_in` copies checkouts into it. With a remote Docker (`engine_is_remote`: `DOCKER_HOST=ssh://`/`tcp://`, or `RUNTHROUGH_REMOTE_ENGINE=1` to force it locally) `Config.copy_mode` replaces the mounts with per-job volumes at those same paths; `JobRun::sync_in` and `exec_with` keep them in sync via `docker cp` (temp/ and files/<seq> before each step, files/<seq> back after, checkout results and cached actions once).
 - **`actions.rs`**: parses `uses:` (`Local`, `Remote`, `Docker`), loads `action.yml`, and `fetch_remote` git-clones into the action cache (`$XDG_CACHE_HOME/runthrough/actions` or `~/.cache/...`), serialized by a global mutex; `--offline` only uses the cache.
 - **`commands.rs`**: parsing of `GITHUB_ENV`-style files (including heredoc delimiters), `::command::` lines, and secret masking.
 - **`matchers.rs`**: problem matchers (`::add-matcher::`). `JobRun.matchers` is the job-wide list (shared with forks); `exec_with` feeds each output line to a per-step copy and logs matches as annotations.
 - **`context.rs`**: `RepoInfo::detect` shells out to `git` to fill the `github` context (repo slug from `--remote-name`, sha, ref, default branch); `host` (`--github-instance`) drives the server/API URLs. `event_ref_and_sha` then overrides ref/sha from the event payload the way GitHub does (`refs/pull/N/merge`, release tags, push `ref`/`after`, …), and `GITHUB_*_URL` from the caller's environment win.
-- **`history.rs`**: `Recorder` (in `Config.history`, unless `--no-history` or `--insecure-secrets`) writes each run to `<cache>/runs/<id>/`: `meta.json` from `main.rs` (masked argv, repo, event, jobs by stage, and `config`: env/vars/inputs masked, secret names, platforms), every `Logger::line` after masking into `log.jsonl`, and `result.json` at the end. `Summary` / `Job::feed` rebuild jobs and steps from the log's status lines (`⭐`, `✅`/`❌`/`⚠️`/`🛑`, `⏭️`, `🚀`/`🏁`), formatted and parsed by `markers.rs`, whose tests check each line parses back.
+- **`history.rs`**: `Recorder` (in `Config.history`, unless `--no-history` or `--insecure-secrets`) writes each run to `<cache>/runs/<id>/`: `meta.json` from `main.rs` (masked argv, repo, event, jobs by stage, and `config`: env/vars/inputs masked, secret names, platforms), every `Logger::line` after masking into `log.jsonl`, and `result.json` at the end. `Summary` / `Job::feed` rebuild jobs and steps from the log's status lines (`⭐`, `✅`/`❌`/`⚠️`/`🛑`, `⏭️`, `🚀`/`🏁`, `ℹ️` notes on what a local run does not reproduce) and keeps step summaries recorded beside them, formatted and parsed by `markers.rs`, whose tests check each line parses back.
 - **`dashboard.rs`**: `--dashboard` serves `dashboard.html` (one self-contained page, no build step) and a JSON API (`/api/runs`, `/api/runs/<id>`, `/api/runs/<id>/job?workflow=&job=`) through `servers::serve`.
 - **`servers.rs`**: std-only HTTP/1.1 servers jobs reach through `ACTIONS_CACHE_URL` (`@actions/cache` v1 API, on by default, entries persisted in `index.json`) and `ACTIONS_RESULTS_URL` (`@actions/artifact` v2 Twirp API plus Azure-blob-style block uploads, with `--artifact-server-path`; the toolkit sends proto field names such as `workflow_run_backend_id`) plus `ACTIONS_RUNTIME_URL` (the v1 API of the v3 actions, files under `v3/<run>/`, gzipped chunks stored with a `.gz__` suffix). `ACTIONS_RUNTIME_TOKEN` is a JWT signed with a per-run key (`RuntimeAuth`, or the caller's own token) whose `scp` claim carries the run/job IDs the toolkit parses; the artifact API refuses calls without it, except the signed block URLs. The cache API lives under a random per-run prefix (`cache_token`), lowercases keys, and garbage-collects entries (`CacheStore::gc`) on start and after each upload. They bind `127.0.0.1`, or `0.0.0.0` for Apple containers (reached via the vmnet gateway); a failure to start the cache server only disables it.
 
diff --git a/README.md b/README.md
index 6aaf288..2b66c2e 100644
--- a/README.md
+++ b/README.md
@@ -26,8 +26,14 @@ runthrough --watch              # rerun whenever a file changes
 runthrough --graph              # draw the job graph
 runthrough --dashboard          # browse recorded runs at http://127.0.0.1:7766
 runthrough --validate --strict  # check the workflows, then exit
+runthrough --committed          # rehearse the HEAD commit, leaving uncommitted changes out
+runthrough --install-hook       # add a git pre-push hook that runs the push workflows first
 ```
 
+A run ends with one line for all of its workflows: jobs by result, the time it took and, when it was recorded, its dashboard URL. With `--watch`, each rerun also says which jobs changed result since the last one.
+
+`--install-hook` writes `.git/hooks/pre-push` (or the hook in `core.hooksPath`), never over an existing hook. It runs `runthrough --committed --quiet push`, so the commit being pushed is rehearsed rather than the working tree (its checkout and the workflows themselves come from HEAD), and a failed job stops the push, as does pushing a commit other than HEAD, which the hook does not rehearse; `git push --no-verify` skips it once. Add flags such as `--host` to the hook's `runthrough` line.
+
 Workflows are read from `.github/workflows` and, laid out the same way, `.runthrough/workflows` (for workflows meant only for local runs); `-W` reads a single file or directory instead.
 
 Flags follow act's names (`--matrix`, `--reuse`, `--json`, `--input-file`, …); `runthrough --help` lists them and [docs/act-parity.md](docs/act-parity.md) tracks parity with act. Day-to-day operation and troubleshooting are in [RUNBOOK.md](RUNBOOK.md).
@@ -47,7 +53,7 @@ Flags win over files. Arguments from `.actrc` files are read before the command
 
 ### Dashboard
 
-Every run is recorded (with secrets masked) under `~/.cache/runthrough/runs`, and `runthrough --dashboard` serves a local web UI over them in the style of GitHub's Actions tab: the runs list (optionally grouped by repository or date), a run's job graph by stage with its matrix legs and annotations, and each job's steps with their logs, refreshed while a run is in progress. A failed job's page has **Copy for LLM**, which copies the job's context, its steps and the last 200 lines of each failed step as Markdown to paste into an LLM. **Resources** lists the ports runthrough listens on and the Docker containers, networks and volumes it created, with the run each belongs to; ones whose run has ended are marked left behind, with a command to remove them. `--dashboard-addr` / `--dashboard-port` change where it listens; `--no-history` skips recording a run, and runs with `--insecure-secrets` are never recorded. The newest 100 runs are kept.
+Every run is recorded (with secrets masked) under `~/.cache/runthrough/runs`, and `runthrough --dashboard` serves a local web UI over them in the style of GitHub's Actions tab: the runs list (optionally grouped by repository or date), a run's job graph by stage with its matrix legs and annotations, and each job's steps with their logs, refreshed while a run is in progress. A run's summary page shows the jobs' step summaries (`GITHUB_STEP_SUMMARY`, as Markdown) and, as annotations, what the run did not reproduce locally; **Copy rehearsal note** copies the jobs and their results as Markdown for a pull request. A failed job's page has **Copy for LLM**, which copies the job's context, its steps and the last 200 lines of each failed step as Markdown to paste into an LLM. **Resources** lists the ports runthrough listens on and the Docker containers, networks and volumes it created, with the run each belongs to; ones whose run has ended are marked left behind, with a command to remove them. `--dashboard-addr` / `--dashboard-port` change where it listens; `--no-history` skips recording a run, and runs with `--insecure-secrets` are never recorded. The newest 100 runs are kept.
 
 ### Exit codes
 
@@ -72,7 +78,7 @@ Steps see `RUNTHROUGH=true` and `ACT=true` (also in the `env` context, so workfl
 
 ## Not supported
 
-The cache service v2 API (`ACTIONS_CACHE_SERVICE_V2`). `permissions` and `jobs.<id>.snapshot` are validated but have no local effect; `environment` is reported (name and `url`) without environment secrets or protection rules. `concurrency` groups span one `runthrough` invocation, and a job cancelled by `cancel-in-progress` stops before its next step.
+A job using one of these logs a note (`ℹ️`) when it starts. The cache service v2 API (`ACTIONS_CACHE_SERVICE_V2`). `permissions` and `jobs.<id>.snapshot` are validated but have no local effect; `environment` is reported (name and `url`) without environment secrets or protection rules. `concurrency` groups span one `runthrough` invocation, and a job cancelled by `cancel-in-progress` stops before its next step.
 
 ## Platforms
 
diff --git a/docs/favicon.svg b/docs/favicon.svg
new file mode 100644
index 0000000..2f52d9b
--- /dev/null
+++ b/docs/favicon.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><rect width="32" height="32" rx="6" fill="#101214"/><circle cx="16" cy="11" r="4.5" fill="#ffd678"/><path d="M2.5 20.5 29.5 18l.5 6.5-27 2.5z" fill="#f3c21c"/></svg>
diff --git a/docs/index.html b/docs/index.html
index ae008f2..28065eb 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -5,6 +5,15 @@
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="description" content="runthrough runs your GitHub Actions workflows locally: an act-style runner written in Rust.">
 <title>runthrough</title>
+<link rel="icon" href="favicon.svg" type="image/svg+xml">
+<meta property="og:type" content="website">
+<meta property="og:title" content="runthrough: the full rehearsal before you push">
+<meta property="og:description" content="Run your GitHub Actions workflows locally, in Docker, Apple container or on the host. An act-style runner in one Rust binary.">
+<meta property="og:image" content="https://simota.github.io/runthrough/og.png">
+<meta property="og:image:width" content="1200">
+<meta property="og:image:height" content="630">
+<meta property="og:image:alt" content="RUNTHROUGH on a strip of yellow spike tape over a dark stage: the full rehearsal before you push.">
+<meta name="twitter:card" content="summary_large_image">
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Big+Shoulders+Stencil+Display:wght@700;900&family=Instrument+Sans:wght@400;500;600&family=JetBrains+Mono:wght@400;600&display=swap">
 <style>
@@ -295,6 +304,7 @@ <h2>Call it from the wings</h2>
       <div class="cue"><span class="n">Q6</span><code>runthrough --graph</code><p>Draw the job graph.</p></div>
       <div class="cue"><span class="n">Q7</span><code>runthrough --validate --strict</code><p>Check the workflows, including unknown keys, then exit.</p></div>
       <div class="cue"><span class="n">Q8</span><code>runthrough --dashboard</code><p>Browse recorded runs at <code>127.0.0.1:7766</code>.</p></div>
+      <div class="cue"><span class="n">Q9</span><code>runthrough --install-hook</code><p>Rehearse before every push: a pre-push hook runs the <code>push</code> workflows on the commit being pushed.</p></div>
     </div>
   </div>
 </section>
@@ -422,7 +432,7 @@ <h4>Stage 2</h4>
     <div class="section-head">
       <span class="tape">Understudies</span>
       <h2>What stays different from GitHub</h2>
-      <p>A local rehearsal can't do everything the real stage does. These are the known gaps.</p>
+      <p>A local rehearsal can't do everything the real stage does. These are the known gaps, and a run says so when a job uses one of them.</p>
     </div>
     <div class="gaps">
       <div><strong>Cache service v2</strong>The <code>ACTIONS_CACHE_SERVICE_V2</code> API is not served. The v1 API is.</div>
@@ -438,7 +448,7 @@ <h2>What stays different from GitHub</h2>
     <div class="section-head">
       <span class="tape">Curtain call</span>
       <h2>Exit codes you can script</h2>
-      <p>Use runthrough as a pre-push hook or in your own scripts. Secrets come from <code>-s</code> or <code>.secrets</code>, variables from <code>--var</code> or <code>.vars</code>.</p>
+      <p><code>runthrough --install-hook</code> makes it a pre-push hook; use it in your own scripts too. Secrets come from <code>-s</code> or <code>.secrets</code>, variables from <code>--var</code> or <code>.vars</code>.</p>
     </div>
     <div class="exits">
       <div class="exit"><b>0</b><p>Every job succeeded or was skipped.</p></div>
@@ -449,7 +459,7 @@ <h2>Exit codes you can script</h2>
 </section>
 
 <footer class="wrap foot">
-  <span>runthrough 0.1.0 · MIT license</span>
+  <span>runthrough · MIT license</span>
   <a href="https://github.com/simota/runthrough">github.com/simota/runthrough</a>
 </footer>
 
diff --git a/docs/og.html b/docs/og.html
new file mode 100644
index 0000000..98886d6
--- /dev/null
+++ b/docs/og.html
@@ -0,0 +1,31 @@
+<!doctype html>
+<!-- Source of og.png, the share image (1200×630). Render it again after an edit:
+     chrome --headless --screenshot=docs/og.png --window-size=1200,630 docs/og.html -->
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>runthrough share image</title>
+<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Big+Shoulders+Stencil+Display:wght@900&family=Instrument+Sans:wght@500&family=JetBrains+Mono:wght@600&display=block">
+<style>
+html, body { margin: 0; width: 1200px; height: 630px; overflow: hidden; }
+body {
+  background: radial-gradient(circle at 70% 18%, rgba(255, 214, 120, .38), transparent 42%), #101214;
+  color: #d8dde2; font-family: "Instrument Sans", "Helvetica Neue", Arial, sans-serif;
+  display: grid; align-content: center; gap: 36px; padding: 0 96px; box-sizing: border-box;
+}
+.tape {
+  justify-self: start; background: #f3c21c; color: #1a1a17; transform: rotate(-2deg);
+  font: 900 150px/1 "Big Shoulders Stencil Display", "Arial Narrow", Impact, sans-serif;
+  letter-spacing: .02em; text-transform: uppercase; padding: 22px 48px 14px;
+  clip-path: polygon(1% 0, 99% 4%, 100% 50%, 98% 100%, 0 96%, 0 45%);
+}
+p { margin: 0; font-size: 46px; font-weight: 500; }
+code { font: 600 28px/1 "JetBrains Mono", monospace; color: #7d858e; }
+</style>
+</head>
+<body>
+  <div class="tape">runthrough</div>
+  <p>The full rehearsal before you push.</p>
+  <code>$ runthrough   # GitHub Actions, run locally</code>
+</body>
+</html>
diff --git a/docs/og.png b/docs/og.png
new file mode 100644
index 0000000..7c2cb8e
Binary files /dev/null and b/docs/og.png differ
diff --git a/src/actions.rs b/src/actions.rs
index f20b8d3..35516dd 100644
--- a/src/actions.rs
+++ b/src/actions.rs
@@ -368,16 +368,29 @@ pub fn list_repo_files(root: &Path, exclude_ignored: bool) -> Vec<PathBuf> {
 
 /// Copy the local repository into `dest` (emulates `actions/checkout`).
 /// Tracked and untracked files are copied, plus `.git`; ignored files only
-/// when `use_gitignore` is false. Objects come from `objects`.
+/// when `use_gitignore` is false. With `committed`, only `.git` is copied and
+/// the HEAD commit's files are checked out of it, so uncommitted and untracked
+/// changes stay behind. Objects come from `objects`.
 pub fn copy_repo(
     src: &Path,
     dest: &Path,
     use_gitignore: bool,
+    committed: bool,
     objects: &ObjectSnapshot,
 ) -> Result<()> {
-    let files = list_repo_files(src, use_gitignore);
-    let mut plan: Vec<(PathBuf, Place)> = files.into_iter().map(|f| (f, Place::Copy)).collect();
     let git_dir = src.join(".git");
+    if committed && !git_dir.is_dir() {
+        bail!(
+            "--committed needs the repository's .git directory ({} is not one; worktrees and submodules are not supported)",
+            git_dir.display()
+        );
+    }
+    let files = if committed {
+        Vec::new()
+    } else {
+        list_repo_files(src, use_gitignore)
+    };
+    let mut plan: Vec<(PathBuf, Place)> = files.into_iter().map(|f| (f, Place::Copy)).collect();
     if git_dir.is_dir() {
         let (shared, own): (Vec<PathBuf>, Vec<PathBuf>) = walkdir::WalkDir::new(&git_dir)
             .into_iter()
@@ -415,7 +428,76 @@ pub fn copy_repo(
                 }
             }
         }
-    })
+    })?;
+    if committed {
+        let out = Command::new("git")
+            .arg("-C")
+            .arg(dest)
+            .args(["reset", "--quiet", "--hard", "HEAD"])
+            .output()?;
+        if !out.status.success() {
+            bail!(
+                "--committed: checking out the HEAD commit failed (no commit yet?): {}",
+                String::from_utf8_lossy(&out.stderr).trim()
+            );
+        }
+    }
+    Ok(())
+}
+
+/// The files of `root`'s HEAD commit, exported into a new temporary directory
+/// (`git archive`), for `--committed` to read workflows as the commit has them.
+pub fn export_head(root: &Path) -> Result<tempfile::TempDir> {
+    let dir = tempfile::Builder::new()
+        .prefix("runthrough-head")
+        .tempdir()?;
+    let mut git = Command::new("git")
+        .arg("-C")
+        .arg(root)
+        .args(["archive", "--format=tar", "HEAD"])
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()
+        .context("running git archive")?;
+    let tar = Command::new("tar")
+        .arg("-xf")
+        .arg("-")
+        .arg("-C")
+        .arg(dir.path())
+        .stdin(git.stdout.take().expect("piped stdout"))
+        .status()
+        .context("running tar")?;
+    let out = git.wait_with_output()?;
+    if !out.status.success() {
+        bail!(
+            "--committed needs a HEAD commit in {}: {}",
+            root.display(),
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    if !tar.success() {
+        bail!("extracting the HEAD commit of {} failed", root.display());
+    }
+    Ok(dir)
+}
+
+/// How many changes `git status` shows in `root` (uncommitted, untracked);
+/// none when git cannot tell.
+pub fn uncommitted_changes(root: &Path) -> usize {
+    Command::new("git")
+        .arg("-C")
+        .arg(root)
+        .args(["status", "--porcelain"])
+        .output()
+        .ok()
+        .filter(|o| o.status.success())
+        // One line per change; a path with a newline is quoted by git.
+        .map_or(0, |o| {
+            o.stdout
+                .split(|b| *b == b'\n')
+                .filter(|l| !l.is_empty())
+                .count()
+        })
 }
 
 /// `f` for every item, on a few threads: copying file by file is bound by
@@ -531,7 +613,7 @@ mod tests {
 
         let objects = ObjectSnapshot::default();
         let first = tempfile::tempdir().unwrap();
-        copy_repo(src.path(), first.path(), true, &objects).unwrap();
+        copy_repo(src.path(), first.path(), true, false, &objects).unwrap();
         for n in 0..200 {
             let f = first.path().join(format!("d{}/f{n}.txt", n % 7));
             assert_eq!(std::fs::read_to_string(f).unwrap(), format!("{n}"));
@@ -545,7 +627,7 @@ mod tests {
         git(src.path(), &["add", "late.txt"]);
         git(src.path(), &["commit", "--quiet", "-m", "late"]);
         let second = tempfile::tempdir().unwrap();
-        copy_repo(src.path(), second.path(), true, &objects).unwrap();
+        copy_repo(src.path(), second.path(), true, false, &objects).unwrap();
         assert_eq!(git(second.path(), &["log", "--format=%s"]), "late\nc");
         git(second.path(), &["fsck", "--no-progress"]);
 
@@ -568,6 +650,46 @@ mod tests {
         }
     }
 
+    #[test]
+    fn committed_copy_leaves_uncommitted_changes_behind() {
+        let src = tempfile::tempdir().unwrap();
+        let git = |args: &[&str]| {
+            let out = Command::new("git")
+                .arg("-C")
+                .arg(src.path())
+                .args(["-c", "user.name=t", "-c", "user.email=t@t"])
+                .args(args)
+                .output()
+                .unwrap();
+            assert!(out.status.success(), "git {args:?}: {out:?}");
+        };
+        git(&["init", "--quiet"]);
+        let objects = ObjectSnapshot::default();
+        let empty = tempfile::tempdir().unwrap();
+        assert!(copy_repo(src.path(), empty.path(), true, true, &objects).is_err());
+
+        std::fs::write(src.path().join("a.txt"), "committed").unwrap();
+        git(&["add", "a.txt"]);
+        git(&["commit", "--quiet", "-m", "c"]);
+        std::fs::write(src.path().join("a.txt"), "edited").unwrap();
+        std::fs::write(src.path().join("new.txt"), "untracked").unwrap();
+        assert_eq!(uncommitted_changes(src.path()), 2);
+
+        let dest = tempfile::tempdir().unwrap();
+        copy_repo(
+            src.path(),
+            dest.path(),
+            true,
+            true,
+            &ObjectSnapshot::default(),
+        )
+        .unwrap();
+        let a = std::fs::read_to_string(dest.path().join("a.txt")).unwrap();
+        assert_eq!(a, "committed");
+        assert!(!dest.path().join("new.txt").exists());
+        assert_eq!(uncommitted_changes(dest.path()), 0);
+    }
+
     #[test]
     fn only_content_addressed_git_files_are_shared() {
         for rel in [
diff --git a/src/dashboard.html b/src/dashboard.html
index 40b599a..522eac9 100644
--- a/src/dashboard.html
+++ b/src/dashboard.html
@@ -3,7 +3,8 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>RunThrough</title>
+<title>runthrough</title>
+<link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><rect width='32' height='32' rx='6' fill='%23101214'/><circle cx='16' cy='11' r='4.5' fill='%23ffd678'/><path d='M2.5 20.5 29.5 18l.5 6.5-27 2.5z' fill='%23f3c21c'/></svg>">
 <style>
 :root {
   --ground: #F4F5F8; --surface: #FFFFFF; --line: #E1E4EA; --line-strong: #CDD2DB;
@@ -113,6 +114,13 @@
 .kv code { overflow-wrap: anywhere; }
 .cell { display: grid; min-width: 0; }
 .empty { padding: 32px 16px; text-align: center; color: var(--muted); }
+.md { padding: 4px 16px 12px; overflow-wrap: anywhere; }
+.md h3, .md h4, .md h5, .md h6 { margin: 16px 0 8px; font-size: 15px; line-height: 22px; }
+.md p, .md ul, .md ol, .md pre, .md .md-table { margin: 8px 0; }
+.md pre { background: var(--ground); padding: 10px 12px; border-radius: 6px; overflow-x: auto; }
+.md-table { overflow-x: auto; }
+.md table { border-collapse: collapse; }
+.md th, .md td { border: 1px solid var(--line); padding: 6px 10px; text-align: left; }
 .sr { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); }
 /* Where the sidebar and the main column no longer fit side by side (220 + 16 +
    560 + the page's padding and scrollbar), the job list follows the page's
@@ -128,7 +136,7 @@
 </head>
 <body>
 <header>
-  <a class="brand" href="#/"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="#fff" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="3" width="18" height="18" rx="4"/><path d="M10 8.5v7l5.5-3.5z"/></svg>RunThrough</a>
+  <a class="brand" href="#/"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="#fff" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="3" width="18" height="18" rx="4"/><path d="M10 8.5v7l5.5-3.5z"/></svg>runthrough</a>
   <nav id="crumbs" aria-label="Breadcrumb"></nav>
   <div class="tools"><span class="live" id="live" hidden><span class="dot"></span><span>live</span></span><a id="nav-resources" href="#/resources">Resources</a></div>
 </header>
@@ -145,6 +153,7 @@
   skipped: ['var(--neutral)', '<circle cx="12" cy="12" r="9"/><path d="m6 18 12-12"/>', 'Skipped'],
   cancelled: ['var(--neutral)', '<circle cx="12" cy="12" r="9"/><path d="m6 18 12-12"/>', 'Cancelled'],
   interrupted: ['var(--neutral)', '<circle cx="12" cy="12" r="9"/><path d="M12 8v5M12 16h.01"/>', 'Interrupted'],
+  info: ['var(--accent)', '<circle cx="12" cy="12" r="9"/><path d="M12 11v5M12 8h.01"/>', 'Not reproduced locally'],
 };
 const LABEL = { success: 'Success', failure: 'Failure', warning: 'Continued on error', running: 'In progress', queued: 'Queued', skipped: 'Skipped', cancelled: 'Cancelled', interrupted: 'Interrupted' };
 const COLOR = { success: 'var(--success)', failure: 'var(--failure)', running: 'var(--running)', warning: 'var(--running)' };
@@ -201,7 +210,7 @@
   const nav = document.getElementById('crumbs');
   parts[parts.length - 1].setAttribute('aria-current', 'page');
   nav.replaceChildren(...parts.flatMap((p, i) => [i ? h('span', { 'aria-hidden': 'true' }, '/') : null, p]).filter(Boolean));
-  document.title = [...parts.slice(1).reverse().map(p => p.textContent), parts.length > 1 ? null : parts[0].textContent, 'RunThrough'].filter(Boolean).join(' · ');
+  document.title = [...parts.slice(1).reverse().map(p => p.textContent), parts.length > 1 ? null : parts[0].textContent, 'runthrough'].filter(Boolean).join(' · ');
 }
 /** Say `text` to assistive technology; the page itself is not a live region, since every poll redraws it. */
 function announce(text) {
@@ -377,6 +386,21 @@
     if (j.status === 'failure') notes.push(['failure', j, j.error || 'Job failed']);
     for (const s of j.steps) if (s.status === 'warning') notes.push(['warning', j, `Step “${s.name}” failed and continued (continue-on-error).`]);
   }
+  // What the run did not reproduce locally, once per note however many jobs said it.
+  const understudies = new Map();
+  for (const j of run.jobs) for (const t of j.notes || []) {
+    const u = understudies.get(t) || { j, n: 0 };
+    u.n++;
+    understudies.set(t, u);
+  }
+  for (const [t, u] of understudies) notes.push(['info', u.j, u.n > 1 ? `${t} (and ${u.n - 1} more job${u.n > 2 ? 's' : ''})` : t]);
+  // Step summaries, one card per job as on GitHub's run page.
+  const summaries = new Map();
+  for (const s of run.summaries || []) {
+    const k = s.workflow + '\n' + s.job;
+    const prev = summaries.get(k);
+    summaries.set(k, prev ? { ...prev, markdown: prev.markdown + '\n\n' + s.markdown } : s);
+  }
   const cmd = shellQuote(m.argv);
   return [
     h('div', { class: 'title' }, h('div', { class: 'who' }, icon(run.status, 28),
@@ -389,13 +413,73 @@
       h('div', {}, h('small', {}, 'Repository'), h('b', { class: 'ellipsis', title: m.repository || m.root }, m.repository || m.root)),
       h('div', {}, h('small', {}, 'Commit'), h('b', { class: 'mono' }, shortSha(m.sha) || '—'))),
     h('div', { class: 'cmd' }, h('code', {}, '$ ' + cmd),
-      copyButton('Copy command', () => cmd)),
+      copyButton('Copy command', () => cmd),
+      run.finished ? copyButton('Copy rehearsal note', () => rehearsalNote(run), { title: 'Copy what ran locally and how it went as Markdown, for a pull request' }) : null),
     h('div', { class: 'cols' }, side, h('div', { class: 'main' }, config ? configCard(m.config) : [...graphs,
       notes.length ? h('section', { class: 'card', 'aria-label': 'Annotations' }, h('h2', {}, 'Annotations'),
-        notes.map(([k, j, text]) => h('div', { class: 'note' }, icon(k, 18), h('div', {}, h('a', { href: legHref(m.id, j.workflow, j.job), style: 'font-weight:600' }, j.job), h('div', { class: 'sub' }, text))))) : null])),
+        notes.map(([k, j, text]) => h('div', { class: 'note' }, icon(k, 18), h('div', {}, h('a', { href: legHref(m.id, j.workflow, j.job), style: 'font-weight:600' }, j.job), h('div', { class: 'sub' }, text))))) : null,
+      ...[...summaries.values()].map(s => h('section', { class: 'card', 'aria-label': 'Summary of ' + s.job },
+        h('h2', {}, h('a', { href: legHref(m.id, s.workflow, s.job) }, s.job), ' ', h('span', { class: 'sub', style: 'font-weight:400' }, 'summary')),
+        h('div', { class: 'md' }, markdown(s.markdown))))])),
   ];
 }
 
+/** A safe subset of Markdown (headings, lists, tables, code, emphasis, http links) as nodes: text never goes through innerHTML. */
+function markdown(md) {
+  const lines = md.replace(/\r\n?/g, '\n').split('\n');
+  const isSep = l => /^\s*\|?\s*:?-{3,}:?\s*(\|\s*:?-{3,}:?\s*)*\|?\s*$/.test(l);
+  const cells = l => l.trim().replace(/^\|/, '').replace(/\|$/, '').split('|').map(c => c.trim());
+  const block = /^(#{1,6}\s|\s*(`{3,}|~{3,})|\s*([-*+]|\d+[.)])\s)/;
+  const item = /^\s*(?:[-*+]|\d+[.)])\s+(.*)$/;
+  const out = [];
+  let m;
+  for (let i = 0; i < lines.length;) {
+    const l = lines[i];
+    if (!l.trim()) { i++; continue; }
+    if ((m = /^\s*(`{3,}|~{3,})/.exec(l))) {
+      const code = [];
+      for (i++; i < lines.length && !lines[i].trim().startsWith(m[1]); i++) code.push(lines[i]);
+      i++;
+      out.push(h('pre', {}, h('code', {}, code.join('\n'))));
+    } else if ((m = /^(#{1,6})\s+(.*)$/.exec(l))) {
+      // The card's title is the h2: the summary's own headings go below it.
+      out.push(h('h' + Math.min(6, m[1].length + 2), {}, inline(m[2])));
+      i++;
+    } else if (l.includes('|') && isSep(lines[i + 1] || '')) {
+      const head = cells(l), rows = [];
+      for (i += 2; i < lines.length && lines[i].includes('|'); i++) rows.push(cells(lines[i]));
+      out.push(h('div', { class: 'md-table' }, h('table', {},
+        h('thead', {}, h('tr', {}, head.map(c => h('th', {}, inline(c))))),
+        h('tbody', {}, rows.map(r => h('tr', {}, r.map(c => h('td', {}, inline(c)))))))));
+    } else if (item.test(l)) {
+      const ordered = /^\s*\d/.test(l), items = [];
+      for (; i < lines.length && (m = item.exec(lines[i])); i++) items.push(h('li', {}, inline(m[1])));
+      out.push(h(ordered ? 'ol' : 'ul', {}, items));
+    } else {
+      const para = [l.trim()];
+      for (i++; i < lines.length && lines[i].trim() && !block.test(lines[i]); i++) para.push(lines[i].trim());
+      out.push(h('p', {}, inline(para.join(' '))));
+    }
+  }
+  return out;
+}
+/** Inline Markdown: `code`, **strong**, *em* and [links](http…); anything else stays text. */
+function inline(text) {
+  const re = /(`+)(.+?)\1|\*\*(.+?)\*\*|\*([^*\s][^*]*)\*|\[([^\]]+)\]\(([^)\s]+)\)/g;
+  const out = [];
+  let last = 0, m;
+  while ((m = re.exec(text))) {
+    out.push(text.slice(last, m.index));
+    if (m[1]) out.push(h('code', {}, m[2]));
+    else if (m[3]) out.push(h('strong', {}, inline(m[3])));
+    else if (m[4]) out.push(h('em', {}, inline(m[4])));
+    else out.push(/^https?:\/\//i.test(m[6]) ? h('a', { href: m[6], rel: 'noopener noreferrer', target: '_blank' }, inline(m[5])) : m[0]);
+    last = re.lastIndex;
+  }
+  out.push(text.slice(last));
+  return out;
+}
+
 // What the run was given (-e/.env, --var, --input, -s, -P), as recorded with
 // values masked; secrets come by name only. Every group shows, set or not; runs
 // recorded before have no record of it.
@@ -461,7 +545,7 @@
   const plain = l => l.replace(/\x1b\[[0-9;?]*[A-Za-z]/g, '');
   const fence = lines => { const t = lines.join('\n'); const f = '`'.repeat(Math.max(3, ...(t.match(/`+/g) || []).map(s => s.length + 1))); return `${f}text\n${t}\n${f}`; };
   const out = [
-    'A GitHub Actions job failed when run locally with RunThrough (an act-style runner). Find the cause and suggest a fix.',
+    'A GitHub Actions job failed when run locally with runthrough (an act-style runner). Find the cause and suggest a fix.',
     '',
     '## Job',
     `- Workflow: ${job.workflow}${file ? ` (${file})` : ''}`,
@@ -482,6 +566,21 @@
   }
   return out.join('\n') + '\n';
 }
+/** A finished run as Markdown for a pull request: what ran locally, on what, and how it went. */
+function rehearsalNote(run) {
+  const m = run.meta;
+  const what = m.committed ? `commit ${shortSha(m.sha)}` : `the working tree at ${shortSha(m.sha) || 'no commit'} (uncommitted changes included)`;
+  const understudies = [...new Set(run.jobs.flatMap(j => j.notes || []))];
+  const cell = t => String(t).replace(/\|/g, '\\|');
+  return [
+    `Ran locally with runthrough${m.version ? ' ' + m.version : ''}: \`${m.event}\` on ${what}, ${m.engine}, ${dur(elapsed(run))}.`,
+    '',
+    '| Job | Result | Duration |',
+    '|---|---|---|',
+    ...run.jobs.map(j => `| ${cell(j.workflow + ' / ' + j.job)} | ${LABEL[j.status] || j.status} | ${dur(j.secs)} |`),
+    ...(understudies.length ? ['', 'Not reproduced locally:', ...understudies.map(t => `- ${t}`)] : []),
+  ].join('\n') + '\n';
+}
 /** Copy to the clipboard, also where the page is not a secure context (no `navigator.clipboard`). */
 async function copyText(text) {
   if (navigator.clipboard && window.isSecureContext) return navigator.clipboard.writeText(text);
@@ -599,8 +698,8 @@
   const mono = t => h('span', { class: 'mono ellipsis', title: t }, t);
   return [
     h('div', { class: 'title' }, h('div', {}, h('h1', {}, 'Resources'),
-      h('div', { class: 'sub' }, 'Ports, containers, networks and volumes RunThrough is using on this machine.'))),
-    res.error ? h('div', { class: 'banner', role: 'alert' }, icon('failure', 18), h('div', {}, h('b', {}, 'Docker could not be listed. '), 'RunThrough lists Docker resources only, so Apple container resources do not show here. ', h('span', { class: 'mono' }, res.error))) : null,
+      h('div', { class: 'sub' }, 'Ports, containers, networks and volumes runthrough is using on this machine.'))),
+    res.error ? h('div', { class: 'banner', role: 'alert' }, icon('failure', 18), h('div', {}, h('b', {}, 'Docker could not be listed. '), 'runthrough lists Docker resources only, so Apple container resources do not show here. ', h('span', { class: 'mono' }, res.error))) : null,
     stale ? h('div', { class: 'cmd' }, h('code', {}, '$ ' + stale),
       copyButton('Copy cleanup command', () => stale)) : null,
     table('Ports', 'minmax(0,1fr) minmax(0,4fr) minmax(0,2fr)', ['Port', 'Used by', 'Run'],
@@ -608,9 +707,9 @@
     table('Containers', 'minmax(0,3fr) minmax(0,2fr) minmax(0,2fr) minmax(0,2fr)', ['Name', 'Image', 'State', 'Run'],
       res.containers && containers.map(c => [mono(c.name), mono(c.image),
         h('span', { style: `color:${c.state === 'running' ? 'var(--success)' : 'var(--muted)'}` }, c.status || c.state), runCell(c)]),
-      'No RunThrough containers.'),
-    table('Networks', 'minmax(0,5fr) minmax(0,2fr)', ['Name', 'Run'], res.networks && networks.map(n => [mono(n.name), runCell(n)]), 'No RunThrough networks.'),
-    table('Volumes', 'minmax(0,5fr) minmax(0,2fr)', ['Name', 'Run'], res.volumes && volumes.map(v => [mono(v.name), runCell(v)]), 'No RunThrough volumes.'),
+      'No runthrough containers.'),
+    table('Networks', 'minmax(0,5fr) minmax(0,2fr)', ['Name', 'Run'], res.networks && networks.map(n => [mono(n.name), runCell(n)]), 'No runthrough networks.'),
+    table('Volumes', 'minmax(0,5fr) minmax(0,2fr)', ['Name', 'Run'], res.volumes && volumes.map(v => [mono(v.name), runCell(v)]), 'No runthrough volumes.'),
   ];
 }
 
diff --git a/src/history.rs b/src/history.rs
index f871fad..87b8b2b 100644
--- a/src/history.rs
+++ b/src/history.rs
@@ -65,6 +65,15 @@ impl Recorder {
         let _ = self.log.lock().unwrap().write_all(line.as_bytes());
     }
 
+    /// The run's ID, as the dashboard's URLs name it.
+    pub fn id(&self) -> String {
+        self.dir
+            .file_name()
+            .unwrap_or_default()
+            .to_string_lossy()
+            .into_owned()
+    }
+
     pub fn finish(&self, ok: bool) {
         // The whole log is on disk before the result marks the run finished.
         let _ = self.log.lock().unwrap().flush();
@@ -252,8 +261,9 @@ impl Store {
         tail.update(&dir.join("log.jsonl"));
         let jobs = tail.summary.jobs(&[]);
         let run_names = tail.summary.run_names.clone();
+        let summaries = tail.summary.summaries.clone();
         Some(
-            json!({"meta": meta, "status": status, "finished": finished, "jobs": jobs, "run_names": run_names}),
+            json!({"meta": meta, "status": status, "finished": finished, "jobs": jobs, "run_names": run_names, "summaries": summaries}),
         )
     }
 
@@ -297,6 +307,8 @@ pub struct Summary {
     jobs: Vec<Job>,
     results: Vec<(String, String, String)>,
     run_names: Vec<Value>,
+    /// Step summaries (`GITHUB_STEP_SUMMARY`), in the order steps wrote them.
+    summaries: Vec<Value>,
     /// Without it each step keeps only its line count and last line.
     keep_lines: bool,
 }
@@ -307,6 +319,7 @@ impl Summary {
             jobs: vec![],
             results: vec![],
             run_names: vec![],
+            summaries: vec![],
             keep_lines,
         }
     }
@@ -323,6 +336,11 @@ impl Summary {
             self.results.push((wf.into(), job.into(), result.into()));
             return;
         }
+        if let Some(markdown) = r["summary"].as_str() {
+            self.summaries
+                .push(json!({"workflow": wf, "job": job, "markdown": markdown}));
+            return;
+        }
         let Some(msg) = r["msg"].as_str() else {
             return;
         };
@@ -389,6 +407,8 @@ struct Job {
     secs: Option<f64>,
     error: Option<String>,
     steps: Vec<Step>,
+    /// What the run did not reproduce locally (`markers::note`), each once.
+    notes: Vec<String>,
     keep_lines: bool,
 }
 
@@ -403,6 +423,7 @@ impl Job {
             secs: None,
             error: None,
             steps: vec![],
+            notes: vec![],
             keep_lines,
         }
     }
@@ -515,6 +536,11 @@ impl Job {
             self.push(name, "running", t);
             return;
         }
+        if let Some(note) = markers::parse_note(msg) {
+            if !self.notes.iter().any(|n| n == note) {
+                self.notes.push(note.to_string());
+            }
+        }
         if let Some(name) = markers::parse_step_skipped(msg) {
             self.push(name, "skipped", t);
             return;
@@ -574,7 +600,7 @@ impl Job {
         json!({
             "workflow": self.workflow, "job": self.job, "id": id, "status": status,
             "started": self.started, "secs": self.secs, "runs_on": self.runs_on,
-            "error": self.error, "steps": steps,
+            "error": self.error, "steps": steps, "notes": self.notes,
         })
     }
 }
@@ -595,6 +621,36 @@ mod tests {
         s.jobs(&[])
     }
 
+    #[test]
+    fn keeps_step_summaries_and_notes() {
+        let mut s = Summary::new(false);
+        for r in [
+            rec("build", &markers::job_start("host")),
+            rec(
+                "build",
+                &markers::note("permissions are not enforced locally"),
+            ),
+            rec(
+                "build",
+                &markers::note("permissions are not enforced locally"),
+            ),
+            json!({"t": 1.0, "wf": "demo", "job": "build", "summary": "## Tests\n| ok |"}),
+            rec("build", &markers::job_end("success", 1.0)),
+        ] {
+            s.feed(&r);
+        }
+        assert_eq!(
+            s.summaries,
+            [json!({"workflow": "demo", "job": "build", "markdown": "## Tests\n| ok |"})]
+        );
+        let jobs = s.jobs(&[]);
+        assert_eq!(
+            jobs[0]["notes"],
+            json!(["permissions are not enforced locally"])
+        );
+        assert_eq!(jobs[0]["status"], "success");
+    }
+
     #[test]
     fn rebuilds_steps_and_results_from_markers() {
         let log = vec![
diff --git a/src/info.rs b/src/info.rs
index 2bbd00c..5029f6a 100644
--- a/src/info.rs
+++ b/src/info.rs
@@ -1,5 +1,5 @@
-//! Informational output: man page, option list, bug report, job graph, and the
-//! repository fingerprint `--watch` polls.
+//! Informational output: man page, option list, bug report, job graph, the
+//! repository fingerprint `--watch` polls, and the pre-push hook `--install-hook` writes.
 
 use crate::backend::Engine;
 use crate::workflow::Workflow;
@@ -134,6 +134,69 @@ pub fn bug_report(engine: &Engine, cache: &Path) -> String {
     out
 }
 
+/// The pre-push hook: rehearse the commit being pushed, and block the push
+/// when a job fails, runthrough cannot run, or a ref other than HEAD is
+/// pushed (only HEAD is rehearsed), saying how to push anyway.
+const PRE_PUSH: &str = r#"#!/bin/sh
+# Installed by `runthrough --install-hook`: every `git push` first runs the
+# workflows its `push` triggers, on the HEAD commit. Add flags (e.g. --host)
+# to the runthrough line below; skip the hook once with `git push --no-verify`.
+head=$(git rev-parse HEAD 2>/dev/null)
+others=
+while read -r local_ref local_sha remote_ref remote_sha; do
+  # Deleting a remote ref pushes no commit.
+  if [ "$local_sha" != "$head" ] && [ -n "$(echo "$local_sha" | tr -d 0)" ]; then
+    others="$others $local_ref"
+  fi
+done
+if [ -n "$others" ]; then
+  echo "runthrough: only HEAD ($head) is rehearsed, so pushing$others was stopped; check it out and push again (push anyway: git push --no-verify)" >&2
+  exit 1
+fi
+runthrough --committed --quiet push
+status=$?
+if [ "$status" -eq 1 ]; then
+  echo "runthrough: a job failed, so the push was stopped (push anyway: git push --no-verify)" >&2
+elif [ "$status" -ne 0 ]; then
+  echo "runthrough could not run the workflows (exit $status), so the push was stopped (push anyway: git push --no-verify)" >&2
+fi
+exit "$status"
+"#;
+
+/// Write the pre-push hook into the hooks directory git uses for `root`
+/// (`core.hooksPath` included); an existing hook is never replaced.
+pub fn install_hook(root: &Path) -> anyhow::Result<std::path::PathBuf> {
+    let out = Command::new("git")
+        .arg("-C")
+        .arg(root)
+        .args(["rev-parse", "--git-path", "hooks/pre-push"])
+        .output()?;
+    if !out.status.success() {
+        anyhow::bail!(
+            "{} is not a git repository: {}",
+            root.display(),
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    let hook = root.join(String::from_utf8_lossy(&out.stdout).trim());
+    if hook.exists() {
+        anyhow::bail!(
+            "{} already exists; add `runthrough --committed --quiet push` to it, or remove it and run --install-hook again",
+            hook.display()
+        );
+    }
+    if let Some(dir) = hook.parent() {
+        std::fs::create_dir_all(dir)?;
+    }
+    std::fs::write(&hook, PRE_PUSH)?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        std::fs::set_permissions(&hook, std::fs::Permissions::from_mode(0o755))?;
+    }
+    Ok(hook)
+}
+
 /// Box-and-arrow drawing of a workflow's stages.
 pub fn graph(wf: &Workflow, stages: &[Vec<String>]) -> String {
     let mut out = format!("{} ({})\n", wf.display_name(), wf.path.display());
@@ -187,3 +250,112 @@ pub fn fingerprint(root: &Path) -> u64 {
     }
     h.finish()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn install_hook_writes_once() {
+        let repo = tempfile::tempdir().unwrap();
+        assert!(install_hook(repo.path()).is_err(), "not a repository");
+        assert!(Command::new("git")
+            .arg("-C")
+            .arg(repo.path())
+            .args(["init", "--quiet"])
+            .status()
+            .unwrap()
+            .success());
+        let hook = install_hook(repo.path()).unwrap();
+        assert_eq!(hook, repo.path().join(".git/hooks/pre-push"));
+        let script = std::fs::read_to_string(&hook).unwrap();
+        assert!(script.contains("runthrough --committed --quiet push"));
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            assert_eq!(
+                std::fs::metadata(&hook).unwrap().permissions().mode() & 0o111,
+                0o111
+            );
+        }
+        // Only HEAD is rehearsed: pushing another commit is stopped before
+        // runthrough runs; deleting a remote ref pushes nothing.
+        let git = |args: &[&str]| {
+            assert!(Command::new("git")
+                .arg("-C")
+                .arg(repo.path())
+                .args(["-c", "user.name=t", "-c", "user.email=t@t"])
+                .args(args)
+                .status()
+                .unwrap()
+                .success());
+        };
+        git(&["commit", "--quiet", "--allow-empty", "-m", "a"]);
+        git(&["commit", "--quiet", "--allow-empty", "-m", "b"]);
+        let rev = |r: &str| {
+            let out = Command::new("git")
+                .arg("-C")
+                .arg(repo.path())
+                .args(["rev-parse", r])
+                .output()
+                .unwrap();
+            String::from_utf8_lossy(&out.stdout).trim().to_string()
+        };
+        let bin = tempfile::tempdir().unwrap();
+        let fake = bin.path().join("runthrough");
+        std::fs::write(&fake, "#!/bin/sh\necho rehearsed\n").unwrap();
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(&fake, std::fs::Permissions::from_mode(0o755)).unwrap();
+        }
+        let push = |line: String| {
+            use std::io::Write;
+            let path = format!(
+                "{}:{}",
+                bin.path().display(),
+                std::env::var("PATH").unwrap_or_default()
+            );
+            let mut child = Command::new("sh")
+                .arg(&hook)
+                .current_dir(repo.path())
+                .env("PATH", path)
+                .stdin(std::process::Stdio::piped())
+                .stdout(std::process::Stdio::piped())
+                .stderr(std::process::Stdio::piped())
+                .spawn()
+                .unwrap();
+            child
+                .stdin
+                .take()
+                .unwrap()
+                .write_all(line.as_bytes())
+                .unwrap();
+            let out = child.wait_with_output().unwrap();
+            (
+                out.status.code(),
+                String::from_utf8_lossy(&out.stdout).into_owned()
+                    + &String::from_utf8_lossy(&out.stderr),
+            )
+        };
+        let zero = "0".repeat(40);
+        let (head, older) = (rev("HEAD"), rev("HEAD~1"));
+        let (code, out) = push(format!("refs/heads/main {head} refs/heads/main {zero}\n"));
+        assert_eq!((code, out.trim()), (Some(0), "rehearsed"));
+        let (code, out) = push(format!(
+            "refs/heads/main {head} refs/heads/main {zero}\nHEAD~1 {older} refs/heads/old {zero}\n"
+        ));
+        assert_eq!(code, Some(1), "{out}");
+        assert!(
+            out.contains("pushing HEAD~1 was stopped") && !out.contains("rehearsed\n"),
+            "{out}"
+        );
+        let (code, out) = push(format!("(delete) {zero} refs/heads/old {older}\n"));
+        assert_eq!((code, out.trim()), (Some(0), "rehearsed"));
+
+        std::fs::write(&hook, "mine").unwrap();
+        let err = install_hook(repo.path()).unwrap_err().to_string();
+        assert!(err.contains("already exists"), "{err}");
+        assert_eq!(std::fs::read_to_string(&hook).unwrap(), "mine");
+    }
+}
diff --git a/src/main.rs b/src/main.rs
index 5677690..9291f5f 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -129,6 +129,10 @@ pub struct Cli {
     /// Copy only files git does not ignore into the workspace (false copies ignored files too)
     #[arg(long, default_value_t = true, action = clap::ArgAction::Set)]
     use_gitignore: bool,
+    /// Run the HEAD commit's workflows and check out its files instead of the working tree,
+    /// so the run sees what a push would (uncommitted and untracked changes are left out)
+    #[arg(long, conflicts_with = "bind")]
+    committed: bool,
     /// Run the real actions/checkout instead of copying the local repository
     #[arg(long)]
     no_skip_checkout: bool,
@@ -241,6 +245,9 @@ pub struct Cli {
     /// Print system information for a bug report, then exit
     #[arg(long)]
     bug_report: bool,
+    /// Install a git pre-push hook that runs the push workflows on the commit being pushed, then exit
+    #[arg(long)]
+    install_hook: bool,
     /// Print a man page, then exit
     #[arg(long)]
     man_page: bool,
@@ -397,13 +404,30 @@ fn main() {
         print!("{}", info::bug_report(&cli.engine, &cache_base()));
         return;
     }
+    if cli.install_hook {
+        match info::install_hook(&cli.directory) {
+            Ok(hook) => println!(
+                "installed {}: each git push first runs `runthrough --committed --quiet push` (skip it once with git push --no-verify)",
+                hook.display()
+            ),
+            Err(e) => {
+                eprintln!("error: {e:#}");
+                std::process::exit(2);
+            }
+        }
+        return;
+    }
     if cli.dashboard {
         if let Err(e) = dashboard::serve(cache_base(), &cli.dashboard_addr, cli.dashboard_port) {
             eprintln!("error: {e:#}");
             std::process::exit(2);
         }
     }
-    let result = if cli.watch { watch(&cli) } else { run(&cli) };
+    let result = if cli.watch {
+        watch(&cli)
+    } else {
+        run(&cli).map(|o| o.ok)
+    };
     match result {
         Ok(true) => {}
         Ok(false) => std::process::exit(1),
@@ -417,11 +441,18 @@ fn main() {
 /// Run once, then again every time the repository's files change.
 fn watch(cli: &Cli) -> Result<bool> {
     let root = cli.directory.canonicalize()?;
+    let mut last: Option<Outcome> = None;
     loop {
         // Taken before the run, so a change made while it runs triggers the next one.
         let before = info::fingerprint(&root);
-        if let Err(e) = run(cli) {
-            eprintln!("error: {e:#}");
+        match run(cli) {
+            Ok(outcome) => {
+                if let Some(line) = last.as_ref().and_then(|l| outcome.since(l)) {
+                    println!("{line}");
+                }
+                last = Some(outcome);
+            }
+            Err(e) => eprintln!("error: {e:#}"),
         }
         eprintln!(
             "👀 watching {} for changes (Ctrl-C to stop)",
@@ -445,15 +476,36 @@ fn watch_delay(check: std::time::Duration) -> std::time::Duration {
 
 /// Load every workflow; files that fail are reported and skipped (as act does),
 /// and the run fails only when none loads. The flag says whether any failed.
-fn load_workflows(cli: &Cli, wf_paths: &[PathBuf]) -> Result<(Vec<workflow::Workflow>, bool)> {
+/// With `head` (`--committed`: the repository at `root` as its HEAD commit
+/// has it), files under `root` are read from there, keeping their names.
+fn load_workflows(
+    cli: &Cli,
+    wf_paths: &[PathBuf],
+    root: &Path,
+    head: Option<&Path>,
+) -> Result<(Vec<workflow::Workflow>, bool)> {
     let mut workflows = Vec::new();
     let mut errors = Vec::new();
     let mut files = Vec::new();
     for p in wf_paths {
-        files.extend(workflow::discover(p, !cli.no_recurse)?);
+        let (from, to) = match (head, p.strip_prefix(root)) {
+            (Some(head), Ok(rel)) => (head.join(rel), p.clone()),
+            _ => (p.clone(), p.clone()),
+        };
+        // A missing default directory is reported below as no workflow files.
+        if cli.workflows.is_none() && !from.is_dir() {
+            continue;
+        }
+        for f in workflow::discover(&from, !cli.no_recurse)? {
+            let name = match f.strip_prefix(&from) {
+                Ok(rel) if !rel.as_os_str().is_empty() => to.join(rel),
+                _ => to.clone(),
+            };
+            files.push((f, name));
+        }
     }
-    for f in files {
-        match workflow::Workflow::load(&f).and_then(|wf| {
+    for (f, name) in files {
+        match workflow::Workflow::load_as(&f, &name).and_then(|wf| {
             if cli.strict {
                 workflow::strict_check(&f)?;
             }
@@ -468,6 +520,12 @@ fn load_workflows(cli: &Cli, wf_paths: &[PathBuf]) -> Result<(Vec<workflow::Work
             bail!("{}", errors.join("\n"));
         }
         let dirs: Vec<_> = wf_paths.iter().map(|p| p.display().to_string()).collect();
+        if cli.workflows.is_none() {
+            bail!(
+                "no workflow files found in {} (runthrough reads .github/workflows, and .runthrough/workflows for workflows run only locally)",
+                dirs.join(", ")
+            );
+        }
         bail!("no workflow files found in {}", dirs.join(", "));
     }
     for e in &errors {
@@ -476,6 +534,36 @@ fn load_workflows(cli: &Cli, wf_paths: &[PathBuf]) -> Result<(Vec<workflow::Work
     Ok((workflows, !errors.is_empty()))
 }
 
+/// What to try when `event` triggers nothing: up to three events the workflows
+/// do declare, most workflows first, each with its command; and, when some
+/// workflow declares `event` but its filters rejected the payload, how to skip them.
+fn trigger_cues(workflows: &[workflow::Workflow], event: &str) -> Vec<String> {
+    let mut counts: IndexMap<String, usize> = IndexMap::new();
+    for wf in workflows {
+        // A reusable workflow only runs through its caller.
+        for e in wf.events().into_iter().filter(|e| e != "workflow_call") {
+            *counts.entry(e).or_default() += 1;
+        }
+    }
+    let filtered = counts.shift_remove(event).is_some();
+    let mut events: Vec<(String, usize)> = counts.into_iter().collect();
+    events.sort_by(|a, b| b.1.cmp(&a.1).then_with(|| a.0.cmp(&b.0)));
+    let mut cues: Vec<String> = events
+        .into_iter()
+        .take(3)
+        .map(|(e, n)| {
+            let workflows = if n == 1 { "workflow" } else { "workflows" };
+            format!("{e}: {n} {workflows} → runthrough {e}")
+        })
+        .collect();
+    if filtered {
+        cues.push(format!(
+            "-W <file> or -j <job> runs a workflow without its on.{event} filters"
+        ));
+    }
+    cues
+}
+
 /// Where to read workflows from: `-W` alone, or by default `.github/workflows`
 /// plus `.runthrough/workflows` (laid out the same way, for workflows meant
 /// only for local runs). A missing default directory is skipped unless both are.
@@ -492,20 +580,61 @@ fn workflow_paths(cli: &Cli, root: &Path) -> Vec<PathBuf> {
     }
 }
 
-fn run(cli: &Cli) -> Result<bool> {
+/// How a run ended: whether every job succeeded or was skipped, each job's
+/// result as `wf / job`, and the wall time.
+struct Outcome {
+    ok: bool,
+    jobs: Vec<(String, runner::JobResult)>,
+    secs: f64,
+}
+
+impl Outcome {
+    /// A run that ran no job (list, plan, validate, nothing triggered).
+    fn no_jobs(ok: bool) -> Outcome {
+        Outcome {
+            ok,
+            jobs: Vec::new(),
+            secs: 0.0,
+        }
+    }
+
+    /// The `--watch` line comparing this run with `last`; none when either ran no job.
+    fn since(&self, last: &Outcome) -> Option<String> {
+        if self.jobs.is_empty() || last.jobs.is_empty() {
+            return None;
+        }
+        let changed: Vec<(String, &str, &str)> = self
+            .jobs
+            .iter()
+            .filter_map(|(job, now)| {
+                let (_, before) = last.jobs.iter().find(|(j, _)| j == job)?;
+                (before != now).then(|| (job.clone(), before.as_str(), now.as_str()))
+            })
+            .collect();
+        Some(markers::since_last(&changed, self.secs, last.secs))
+    }
+}
+
+fn run(cli: &Cli) -> Result<Outcome> {
+    let started = std::time::Instant::now();
     let root = cli
         .directory
         .canonicalize()
         .with_context(|| format!("{}", cli.directory.display()))?;
+    let head = cli
+        .committed
+        .then(|| actions::export_head(&root))
+        .transpose()?;
     let wf_paths = workflow_paths(cli, &root);
-    let (workflows, load_failed) = load_workflows(cli, &wf_paths)?;
+    let (workflows, load_failed) =
+        load_workflows(cli, &wf_paths, &root, head.as_ref().map(|d| d.path()))?;
 
     if cli.validate {
         for wf in &workflows {
             planner::stages(wf, None).with_context(|| format!("{}", wf.path.display()))?;
             println!("✅ {}", wf.path.display());
         }
-        return Ok(!load_failed);
+        return Ok(Outcome::no_jobs(!load_failed));
     }
 
     if cli.list {
@@ -529,7 +658,7 @@ fn run(cli: &Cli) -> Result<bool> {
                 }
             }
         }
-        return Ok(true);
+        return Ok(Outcome::no_jobs(true));
     }
 
     let event_name = if cli.detect_event {
@@ -573,7 +702,10 @@ fn run(cli: &Cli) -> Result<bool> {
             Some(j) => bail!("job '{j}' not found in any workflow"),
             None => {
                 println!("no workflows triggered by '{event_name}'");
-                return Ok(true);
+                for cue in trigger_cues(&workflows, &event_name) {
+                    println!("  {cue}");
+                }
+                return Ok(Outcome::no_jobs(true));
             }
         }
     }
@@ -585,7 +717,7 @@ fn run(cli: &Cli) -> Result<bool> {
                 info::graph(wf, &planner::stages(wf, cli.job.as_deref())?)
             );
         }
-        return Ok(true);
+        return Ok(Outcome::no_jobs(true));
     }
 
     if cli.dryrun {
@@ -595,7 +727,7 @@ fn run(cli: &Cli) -> Result<bool> {
                 println!("  stage {i}: {}", stage.join(", "));
             }
         }
-        return Ok(true);
+        return Ok(Outcome::no_jobs(true));
     }
 
     let given = Given::read(cli, &root)?;
@@ -634,6 +766,7 @@ fn run(cli: &Cli) -> Result<bool> {
         copy_mode: !cli.host && cli.engine.is_remote(),
         bind: cli.bind,
         use_gitignore: cli.use_gitignore,
+        committed: head.as_ref().map(|d| d.path().to_path_buf()),
         skip_checkout: !cli.no_skip_checkout,
         // Offline mode keeps present images; missing ones are still pulled.
         pull: cli.pull && !cli.action_offline_mode,
@@ -676,7 +809,7 @@ fn run(cli: &Cli) -> Result<bool> {
     };
     // Workflows triggered by the same event run side by side, as in act;
     // --concurrent-jobs still bounds the jobs across all of them.
-    let results: Vec<Result<bool>> = std::thread::scope(|s| {
+    let results: Vec<Result<(bool, runner::JobResults)>> = std::thread::scope(|s| {
         let handles: Vec<_> = selected
             .iter()
             .map(|wf| {
@@ -687,23 +820,83 @@ fn run(cli: &Cli) -> Result<bool> {
             .collect();
         handles
             .into_iter()
-            .map(|h| h.join().unwrap_or_else(|_| Ok(false)))
+            .map(|h| h.join().unwrap_or_else(|_| Ok((false, Vec::new()))))
             .collect()
     });
     let mut ok = !load_failed;
     let mut error = None;
-    for r in results {
+    let mut jobs = Vec::new();
+    for (wf, r) in selected.iter().zip(results) {
         match r {
-            Ok(r) => ok &= r,
+            Ok((r, results)) => {
+                ok &= r;
+                jobs.extend(
+                    results
+                        .into_iter()
+                        .map(|(id, result)| (format!("{} / {id}", wf.display_name()), result)),
+                );
+            }
             Err(e) => error = error.or(Some(e)),
         }
     }
     if let Some(h) = &cfg.shared.history {
         h.finish(ok && error.is_none());
     }
-    match error {
-        Some(e) => Err(e),
-        None => Ok(ok),
+    if let Some(e) = error {
+        return Err(e);
+    }
+    let outcome = Outcome {
+        ok,
+        jobs,
+        secs: started.elapsed().as_secs_f64(),
+    };
+    print_curtain(cli, selected.len(), &outcome, cfg.shared.history.as_deref());
+    Ok(outcome)
+}
+
+/// The run's closing line (`markers::curtain`), or one JSON object with `--json`.
+fn print_curtain(
+    cli: &Cli,
+    workflows: usize,
+    outcome: &Outcome,
+    history: Option<&history::Recorder>,
+) {
+    let url = history.filter(|_| cli.dashboard_port != 0).map(|h| {
+        format!(
+            "http://{}:{}/#/run/{}",
+            cli.dashboard_addr,
+            cli.dashboard_port,
+            h.id()
+        )
+    });
+    let results: Vec<&str> = outcome.jobs.iter().map(|(_, r)| r.as_str()).collect();
+    if cli.json {
+        let now = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .map(|d| d.as_secs_f64())
+            .unwrap_or(0.0);
+        println!(
+            "{}",
+            serde_json::json!({
+                "time": now,
+                "ok": outcome.ok,
+                "workflows": workflows,
+                "jobs": outcome.jobs.iter().map(|(j, r)| serde_json::json!({"job": j, "result": r})).collect::<Vec<_>>(),
+                "secs": outcome.secs,
+                "url": url,
+            })
+        );
+    } else {
+        println!(
+            "{}",
+            markers::curtain(
+                outcome.ok,
+                workflows,
+                &results,
+                outcome.secs,
+                url.as_deref()
+            )
+        );
     }
 }
 
@@ -885,6 +1078,11 @@ fn start_history(
     meta.insert("ref_name".into(), serde_json::json!(repo.ref_name));
     meta.insert("sha".into(), serde_json::json!(repo.sha));
     meta.insert("event".into(), serde_json::json!(event_name));
+    meta.insert(
+        "version".into(),
+        serde_json::json!(env!("CARGO_PKG_VERSION")),
+    );
+    meta.insert("committed".into(), serde_json::json!(cli.committed));
     meta.insert(
         "engine".into(),
         serde_json::json!(if cli.host {
@@ -923,6 +1121,38 @@ mod tests {
     use super::*;
     use std::time::Duration;
 
+    #[test]
+    fn trigger_cues_name_declared_events() {
+        let dir = tempfile::tempdir().unwrap();
+        let load = |name: &str, on: &str| {
+            let path = dir.path().join(name);
+            std::fs::write(
+                &path,
+                format!("on: {on}\njobs:\n  a:\n    runs-on: x\n    steps: [{{run: a}}]\n"),
+            )
+            .unwrap();
+            workflow::Workflow::load_as(&path, &path).unwrap()
+        };
+        let workflows = [
+            load("a.yml", "[pull_request, push]"),
+            load("b.yml", "pull_request"),
+            load("c.yml", "workflow_call"),
+            load("d.yml", "[release, schedule, label]"),
+        ];
+        assert_eq!(
+            trigger_cues(&workflows, "issues"),
+            [
+                "pull_request: 2 workflows → runthrough pull_request",
+                "label: 1 workflow → runthrough label",
+                "push: 1 workflow → runthrough push",
+            ]
+        );
+        assert_eq!(
+            trigger_cues(&workflows, "push").last().unwrap(),
+            "-W <file> or -j <job> runs a workflow without its on.push filters"
+        );
+    }
+
     #[test]
     fn watch_checks_take_at_most_a_tenth_of_the_time() {
         assert_eq!(
diff --git a/src/markers.rs b/src/markers.rs
index a215c23..964e501 100644
--- a/src/markers.rs
+++ b/src/markers.rs
@@ -4,6 +4,7 @@
 const JOB_START: &str = "🚀 start job on ";
 const JOB_SKIPPED: &str = "⏭️  job skipped";
 const STEP_START: &str = "⭐ ";
+const NOTE: &str = "ℹ️  ";
 const STEP_SKIPPED: &str = "⏭️  ";
 /// Prefixes of a step's end line, by its status.
 const STEP_ENDS: [(&str, &str); 4] = [
@@ -55,6 +56,15 @@ pub fn parse_step_start(msg: &str) -> Option<&str> {
     msg.strip_prefix(STEP_START)
 }
 
+/// `ℹ️  <text>`: something this job uses that a local run does not reproduce.
+pub fn note(text: &str) -> String {
+    format!("{NOTE}{text}")
+}
+
+pub fn parse_note(msg: &str) -> Option<&str> {
+    msg.strip_prefix(NOTE)
+}
+
 /// `⏭️  <name>`: a step was skipped.
 pub fn step_skipped(name: &str) -> String {
     format!("{STEP_SKIPPED}{name}")
@@ -91,6 +101,59 @@ pub fn parse_step_end(msg: &str) -> Option<(&str, &'static str, Option<f64>)> {
     Some((name, status, secs))
 }
 
+/// The line that closes a run: workflows and jobs by result, the wall time and,
+/// when the run was recorded, where the dashboard shows it. `🏁` when the run
+/// succeeds (`ok`, as its exit code says), else `❌`. Not a job line: `history`
+/// never sees it.
+pub fn curtain(
+    ok: bool,
+    workflows: usize,
+    results: &[&str],
+    secs: f64,
+    url: Option<&str>,
+) -> String {
+    let plural = |n: usize, what: &str| format!("{n} {what}{}", if n == 1 { "" } else { "s" });
+    let counts: Vec<String> = [
+        ("success", "succeeded"),
+        ("failure", "failed"),
+        ("cancelled", "cancelled"),
+        ("skipped", "skipped"),
+    ]
+    .iter()
+    .filter_map(|(result, label)| {
+        let n = results.iter().filter(|r| *r == result).count();
+        (n > 0).then(|| format!("{n} {label}"))
+    })
+    .collect();
+    let mut line = format!(
+        "{} {}, {}",
+        if ok { "🏁" } else { "❌" },
+        plural(workflows, "workflow"),
+        plural(results.len(), "job")
+    );
+    if !counts.is_empty() {
+        line.push_str(&format!(": {}", counts.join(", ")));
+    }
+    line.push_str(&format!(" in {secs:.1}s"));
+    if let Some(url) = url {
+        line.push_str(&format!(" · {url}"));
+    }
+    line
+}
+
+/// What changed since the previous `--watch` run: each job (`wf / job`) whose
+/// result changed, or that nothing did and how long the two runs took.
+pub fn since_last(changed: &[(String, &str, &str)], secs: f64, last_secs: f64) -> String {
+    if changed.is_empty() {
+        return format!("🔁 no change since the last run ({secs:.1}s, was {last_secs:.1}s)");
+    }
+    let changes: Vec<String> = changed
+        .iter()
+        .map(|(job, before, after)| format!("{job}: {before} → {after}"))
+        .collect();
+    format!("🔁 since the last run: {}", changes.join("; "))
+}
+
 /// `name (1.2s)` → (`name`, 1.2); `name` → (`name`, None).
 fn split_secs(s: &str) -> (&str, Option<f64>) {
     if let Some(rest) = s.strip_suffix("s)") {
@@ -140,5 +203,54 @@ mod tests {
         assert_eq!(parse_job_skipped(&job_skipped(": why")), Some(": why"));
         assert_eq!(parse_step_start(&step_start("Run a")), Some("Run a"));
         assert_eq!(parse_step_skipped(&step_skipped("Run a")), Some("Run a"));
+        assert_eq!(parse_note(&note("x is not y")), Some("x is not y"));
+    }
+
+    #[test]
+    fn curtain_counts_jobs_by_result() {
+        assert_eq!(
+            curtain(true, 1, &["success"], 2.04, None),
+            "🏁 1 workflow, 1 job: 1 succeeded in 2.0s"
+        );
+        assert_eq!(
+            curtain(
+                false,
+                2,
+                &["success", "failure", "skipped", "success"],
+                12.25,
+                Some("http://127.0.0.1:7766/#/run/1-2")
+            ),
+            "❌ 2 workflows, 4 jobs: 2 succeeded, 1 failed, 1 skipped in 12.2s · http://127.0.0.1:7766/#/run/1-2"
+        );
+        // A workflow that failed to load fails the run, whatever its jobs did.
+        assert!(curtain(false, 1, &["success"], 1.0, None).starts_with("❌ "));
+        assert_eq!(
+            curtain(true, 0, &[], 0.0, None),
+            "🏁 0 workflows, 0 jobs in 0.0s"
+        );
+        // Never mistaken for a job's end line by the dashboard.
+        assert_eq!(
+            parse_job_end(&curtain(true, 1, &["success"], 1.0, None)),
+            None
+        );
+    }
+
+    #[test]
+    fn since_last_names_changed_jobs() {
+        assert_eq!(
+            since_last(&[], 3.0, 4.25),
+            "🔁 no change since the last run (3.0s, was 4.2s)"
+        );
+        assert_eq!(
+            since_last(
+                &[
+                    ("ci / test".into(), "failure", "success"),
+                    ("ci / lint".into(), "success", "failure")
+                ],
+                1.0,
+                1.0
+            ),
+            "🔁 since the last run: ci / test: failure → success; ci / lint: success → failure"
+        );
     }
 }
diff --git a/src/runner.rs b/src/runner.rs
index c7a452d..0e301ec 100644
--- a/src/runner.rs
+++ b/src/runner.rs
@@ -44,6 +44,10 @@ pub struct Config {
     pub copy_mode: bool,
     pub bind: bool,
     pub use_gitignore: bool,
+    /// `--committed`: the HEAD commit's files (`actions::export_head`).
+    /// Checkouts take the HEAD commit instead of the working tree, and
+    /// workflows the repository calls are read from here.
+    pub committed: Option<PathBuf>,
     /// Emulate actions/checkout by copying the local repository.
     pub skip_checkout: bool,
     pub pull: bool,
@@ -530,8 +534,11 @@ impl JobOutcome {
     }
 }
 
-/// Run every planned job; returns `true` when nothing failed.
-pub fn run_workflow(wf: &Workflow, cfg: &Config, only: Option<&str>) -> Result<bool> {
+/// Each job's result by job ID, in the order the jobs finished their stage.
+pub type JobResults = Vec<(String, JobResult)>;
+
+/// Run every planned job; returns `true` when nothing failed, and each job's result.
+pub fn run_workflow(wf: &Workflow, cfg: &Config, only: Option<&str>) -> Result<(bool, JobResults)> {
     if cfg.event_name == "workflow_dispatch" {
         let ctx = base_ctx(wf, cfg, &json!({}), &Map::new());
         check_dispatch_inputs(wf, &ctx.contexts["inputs"])
@@ -559,10 +566,11 @@ pub fn run_workflow(wf: &Workflow, cfg: &Config, only: Option<&str>) -> Result<b
     let log = Logger::new(&wf.display_name(), "concurrency", cfg);
     let Some(done) = with_concurrency(cfg, spec, &log, |cfg| run_jobs(wf, cfg, only, &Map::new()))
     else {
-        return Ok(false);
+        return Ok((false, Vec::new()));
     };
     let done = done?;
     let mut ok = true;
+    let mut results = Vec::new();
     for (id, out) in &done {
         let icon = match out.result {
             JobResult::Success => "✅",
@@ -584,8 +592,26 @@ pub fn run_workflow(wf: &Workflow, cfg: &Config, only: Option<&str>) -> Result<b
                 out.result
             ));
         }
+        results.push((id.clone(), out.result));
     }
-    Ok(ok)
+    Ok((ok, results))
+}
+
+/// What this job uses that a local run does not reproduce, as README's
+/// "Not supported" lists it: said once at the job's start, so a passing job is
+/// not taken for one GitHub would pass.
+fn understudy_notes(wf: &Workflow, job: &Job) -> Vec<&'static str> {
+    let mut notes = Vec::new();
+    if !wf.permissions.is_null() || !job.permissions.is_null() {
+        notes.push("permissions are not enforced locally");
+    }
+    if !job.environment.is_null() {
+        notes.push("environment secrets and protection rules are not applied locally");
+    }
+    if !wf.concurrency.is_null() || !job.concurrency.is_null() {
+        notes.push("concurrency groups span this runthrough invocation only");
+    }
+    notes
 }
 
 /// Print a log line. A closed stdout (`| head`) must not abort the run before
@@ -1021,6 +1047,11 @@ fn run_job(
     };
     let started = Instant::now();
     log.line(&markers::job_start(&run.backend.describe()));
+    if !cfg.quiet {
+        for note in understudy_notes(wf, job) {
+            log.line(&markers::note(note));
+        }
+    }
     let outcome = run.execute(job);
     run.cleanup();
     let outcome = outcome.unwrap_or_else(|e| {
@@ -1378,7 +1409,7 @@ fn run_reusable(
         chain.push(canonical(&wf.path));
         check_call_chain(&chain, &canonical(&path))?;
         log.line(&format!("📞 calling {uses}"));
-        let called = Workflow::load(&path)?;
+        let called = Workflow::load_as(&committed_source(cfg, &path), &path)?;
         check_call_args(&called, job, &uses)?;
 
         let mut inputs = Map::new();
@@ -1559,6 +1590,15 @@ fn repository_dir(cfg: &Config, owner: &str, repo: &str, git_ref: &str) -> Resul
     }
 }
 
+/// Where to read the file at `path`: with `--committed`, a file of the
+/// repository comes from its HEAD commit, so the rehearsal runs what is pushed.
+fn committed_source(cfg: &Config, path: &Path) -> PathBuf {
+    match (&cfg.committed, path.strip_prefix(&cfg.repo.root)) {
+        (Some(head), Ok(rel)) => head.join(rel),
+        _ => path.to_path_buf(),
+    }
+}
+
 /// `./.github/workflows/x.yml` or `owner/repo/path/x.yml@ref` → local file.
 fn resolve_workflow_ref(cfg: &Config, uses: &str) -> Result<PathBuf> {
     if uses.starts_with("./") {
@@ -1633,6 +1673,14 @@ impl Logger {
         }
     }
 
+    /// A step's `GITHUB_STEP_SUMMARY` (masked), for the dashboard's run summary.
+    fn summary(&self, markdown: &str) {
+        if let Some(h) = &self.history {
+            let markdown = commands::mask(markdown, &self.masks.lock().unwrap());
+            h.record(json!({"wf": self.workflow, "job": self.job, "summary": markdown}));
+        }
+    }
+
     /// A line a step printed; hidden with `--quiet`.
     fn output(&self, s: &str) {
         if !self.quiet {
@@ -3828,6 +3876,7 @@ impl<'a> JobRun<'a> {
             &self.cfg.repo.root,
             &dest,
             self.cfg.use_gitignore,
+            self.cfg.committed.is_some(),
             &self.cfg.objects,
         )?;
         // As in GitHub's checkout of a pushed branch, `origin/<branch>` is the
@@ -3851,11 +3900,32 @@ impl<'a> JobRun<'a> {
                 .status();
         }
         open_to_all(&dest);
-        self.log.line(&format!(
-            "  copied {} → {}",
-            self.cfg.repo.root.display(),
-            dest.display()
-        ));
+        let root = self.cfg.repo.root.display();
+        if self.cfg.committed.is_some() {
+            // The commit checked out, which an event payload's `after` may not be.
+            let head = std::process::Command::new("git")
+                .arg("-C")
+                .arg(&dest)
+                .args(["rev-parse", "--short", "HEAD"])
+                .output()
+                .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())
+                .unwrap_or_default();
+            self.log.line(&format!(
+                "  checked out commit {head} of {root} → {}",
+                dest.display()
+            ));
+        } else {
+            // Say what a working-tree rehearsal includes that a push would not.
+            let changes = match actions::uncommitted_changes(&self.cfg.repo.root) {
+                0 => String::new(),
+                1 => " (working tree, 1 uncommitted change; --committed leaves it out)".into(),
+                n => {
+                    format!(" (working tree, {n} uncommitted changes; --committed leaves them out)")
+                }
+            };
+            self.log
+                .line(&format!("  copied {root} → {}{changes}", dest.display()));
+        }
         self.sync_in(&dest, false)
     }
 
@@ -4079,6 +4149,7 @@ impl<'a> JobRun<'a> {
         }
         let summary = std::fs::read_to_string(file("summary"))?;
         if !summary.trim().is_empty() {
+            self.log.summary(&summary);
             self.log.line("  📝 step summary:");
             for l in summary.lines() {
                 self.log.line(&format!("  │ {l}"));
@@ -4219,6 +4290,30 @@ fn shell_argv(shell: Option<&str>, script: &Path) -> Vec<String> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn understudy_notes_name_what_runs_differently() {
+        let wf: Workflow = serde_yaml::from_str(
+            "on: push\npermissions: read-all\njobs:\n  a:\n    runs-on: x\n    environment: prod\n    concurrency: g\n    steps: [{run: a}]\n  b:\n    runs-on: x\n    steps: [{run: b}]\n",
+        )
+        .unwrap();
+        assert_eq!(
+            understudy_notes(&wf, &wf.jobs["a"]),
+            [
+                "permissions are not enforced locally",
+                "environment secrets and protection rules are not applied locally",
+                "concurrency groups span this runthrough invocation only",
+            ]
+        );
+        assert_eq!(
+            understudy_notes(&wf, &wf.jobs["b"]),
+            ["permissions are not enforced locally"]
+        );
+        let plain: Workflow =
+            serde_yaml::from_str("on: push\njobs:\n  b:\n    runs-on: x\n    steps: [{run: b}]\n")
+                .unwrap();
+        assert!(understudy_notes(&plain, &plain.jobs["b"]).is_empty());
+    }
+
     #[test]
     fn fixed_host_ports_come_from_mappings_only() {
         assert_eq!(fixed_host_ports("5432:5432"), vec![5432]);
diff --git a/src/workflow.rs b/src/workflow.rs
index f8f26cc..57c5516 100644
--- a/src/workflow.rs
+++ b/src/workflow.rs
@@ -19,6 +19,8 @@ pub struct Workflow {
     pub defaults: Option<Defaults>,
     #[serde(default)]
     pub concurrency: Yaml,
+    #[serde(default)]
+    pub permissions: Yaml,
     #[serde(rename = "cache-mode")]
     pub cache_mode: Option<String>,
     pub jobs: IndexMap<String, Job>,
@@ -74,6 +76,8 @@ pub struct Job {
     pub environment: Yaml,
     #[serde(default)]
     pub concurrency: Yaml,
+    #[serde(default)]
+    pub permissions: Yaml,
     #[serde(rename = "cache-mode")]
     pub cache_mode: Option<String>,
 }
@@ -171,9 +175,11 @@ impl Step {
 }
 
 impl Workflow {
-    pub fn load(path: &Path) -> Result<Workflow> {
-        let text =
-            std::fs::read_to_string(path).with_context(|| format!("reading {}", path.display()))?;
+    /// Load the workflow in `source` as the file at `path` (`--committed`
+    /// reads a repository's workflows from a copy of its HEAD commit).
+    pub fn load_as(source: &Path, path: &Path) -> Result<Workflow> {
+        let text = std::fs::read_to_string(source)
+            .with_context(|| format!("reading {}", path.display()))?;
         let doc: Yaml =
             serde_yaml::from_str(&text).with_context(|| format!("parsing {}", path.display()))?;
         let errors = schema_errors(&doc);
diff --git a/tests/e2e.rs b/tests/e2e.rs
index ef9861f..5ea8653 100644
--- a/tests/e2e.rs
+++ b/tests/e2e.rs
@@ -1642,3 +1642,110 @@ fn run_name_does_not_print_a_secret() {
     assert!(out.contains("| long=***"), "{out}");
     assert!(!out.contains("word123"), "{out}");
 }
+
+/// A run closes with one line for all its workflows; jobs that use something a
+/// local run does not reproduce say so when they start.
+#[test]
+fn run_ends_with_a_curtain_line_and_understudy_notes() {
+    let (code, out) = runthrough(&["push", "-j", "build"]);
+    assert_eq!(code, 0, "{out}");
+    let last = out.lines().last().unwrap_or_default();
+    assert!(
+        last.starts_with("🏁 1 workflow, 1 job: 1 succeeded in "),
+        "{out}"
+    );
+
+    let repo = TempRepo::new();
+    repo.workflow(
+        "w.yml",
+        "on: push\npermissions: read-all\njobs:\n  w:\n    runs-on: ubuntu-latest\n    environment: prod\n    steps:\n      - run: exit 1\n",
+    );
+    let out = repo.run(&["--host", "--no-cache-server"]);
+    assert!(
+        out.contains("ℹ️  permissions are not enforced locally"),
+        "{out}"
+    );
+    assert!(
+        out.contains("ℹ️  environment secrets and protection rules are not applied locally"),
+        "{out}"
+    );
+    assert!(
+        out.lines()
+            .last()
+            .unwrap_or_default()
+            .starts_with("❌ 1 workflow, 1 job: 1 failed in "),
+        "{out}"
+    );
+}
+
+/// `--committed` checks out the HEAD commit and runs the workflows it has;
+/// the default copy says what it adds.
+#[test]
+fn committed_rehearses_the_head_commit() {
+    let repo = TempRepo::new();
+    let caller = |extra: &str| {
+        format!("on: push\njobs:\n  w:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - run: echo \"file=$(cat a.txt)\"; test ! -e new.txt || echo \"new=$(cat new.txt)\"\n{extra}  c:\n    uses: ./.github/workflows/called.yml\n")
+    };
+    let called = |word: &str| {
+        format!("on: workflow_call\njobs:\n  c:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo called={word}\n")
+    };
+    repo.workflow("w.yml", &caller(""));
+    repo.workflow("called.yml", &called("committed"));
+    std::fs::write(repo.path().join("a.txt"), "committed").unwrap();
+    let git = |args: &[&str]| {
+        assert!(Command::new("git")
+            .arg("-C")
+            .arg(repo.path())
+            .args(["-c", "user.name=t", "-c", "user.email=t@t"])
+            .args(args)
+            .status()
+            .unwrap()
+            .success());
+    };
+    git(&["add", "."]);
+    git(&["commit", "--quiet", "-m", "c"]);
+    std::fs::write(repo.path().join("a.txt"), "edited").unwrap();
+    std::fs::write(repo.path().join("new.txt"), "untracked").unwrap();
+    repo.workflow("w.yml", &caller("      - run: echo wf=edited\n"));
+    repo.workflow("called.yml", &called("edited"));
+
+    let out = repo.run(&["--host", "--no-cache-server"]);
+    assert!(
+        out.contains("file=edited") && out.contains("new=untracked"),
+        "{out}"
+    );
+    assert!(
+        out.contains("wf=edited") && out.contains("called=edited"),
+        "{out}"
+    );
+    assert!(
+        out.contains("(working tree, 4 uncommitted changes; --committed leaves them out)"),
+        "{out}"
+    );
+    let out = repo.run(&["--host", "--no-cache-server", "--committed"]);
+    assert!(
+        out.contains("file=committed") && !out.contains("new=untracked"),
+        "{out}"
+    );
+    assert!(
+        out.contains("called=committed") && !out.contains("=edited"),
+        "{out}"
+    );
+    assert!(out.contains("checked out commit "), "{out}");
+}
+
+/// An event that triggers nothing names the events that would, with their commands.
+#[test]
+fn nothing_triggered_names_other_events() {
+    let repo = TempRepo::new();
+    repo.workflow(
+        "w.yml",
+        "on: pull_request\njobs:\n  w:\n    runs-on: ubuntu-latest\n    steps: [{run: 'true'}]\n",
+    );
+    let out = repo.run(&["--host", "--no-cache-server"]);
+    assert!(out.contains("no workflows triggered by 'push'"), "{out}");
+    assert!(
+        out.contains("  pull_request: 1 workflow → runthrough pull_request"),
+        "{out}"
+    );
+}