Auto-recovery after idle + a synthetic uptime canary
A stretch of zero traffic could leave a browser session alive at the health check but stale at the actual submit, so the first real job after a quiet spell could fail. Two fixes: a failed submit now releases its lease immediately so a retry lands on a healthy box instead of burning the delivery budget, and a synthetic job runs through the whole pipe on a schedule and pages us if it doesn't complete — so we're the first to hit a bad state, not you. Refunds always covered the failures; now they mostly don't happen.