diff --git a/main.ts b/main.ts
index a94ec7b..0c71d98 100644
--- a/main.ts
+++ b/main.ts
@@ -1003,6 +1003,14 @@ app.get("/logs/:knot/:pipelineRkey/:workflow", (c) => {
         openStep(raw.slice("##[group]".length), 1 /* StepKindUser */);
       } else if (raw.startsWith("##[endgroup]")) {
         if (currentStepId !== 0) closeStep();
+      } else if (raw.startsWith("##[error]")) {
+        // Error lines emitted outside a group (step_id=0) land in the collapsed
+        // system step and are invisible. Wrap them in an ephemeral user step so
+        // they surface in the tangled UI.
+        const outsideGroup = currentStepId === 0;
+        if (outsideGroup) openStep("Error", 1 /* StepKindUser */);
+        sendData(raw);
+        if (outsideGroup) closeStep();
       } else {
         sendData(raw);
       }
diff --git a/marketRFP.ts b/marketRFP.ts
index c1ee5b4..20d5af2 100644
--- a/marketRFP.ts
+++ b/marketRFP.ts
@@ -215,6 +215,7 @@ write_files:
       User=agent
       Group=agent
       WorkingDirectory=/home/agent
+      Environment="BUNDLED_ACTIONS_DIR=/home/agent/bundled-actions"
       ExecStart=/usr/local/bin/policy_engine api --bind 127.0.0.1:8080
       Restart=always
       RestartSec=5
@@ -232,6 +233,13 @@ runcmd:
       curl -sfL 'https://github.com/publicdomainrelay/sshai/releases/download/latest/policy_engine_0.0.1-next_linux_amd64.tar.gz' | tar -xvz -C /usr/local/bin
       curl -sfL 'https://github.com/publicdomainrelay/atproto-reverse-proxy/releases/download/latest/atproto-reverse-proxy_linux_amd64.tar.gz' | tar -xvz -C /usr/local/bin
 
+      mkdir -pv /home/agent/
+      cd $(mktemp -d)
+      curl -L https://github.com/publicdomainrelay/sshai/archive/main.tar.gz | tar xz --wildcards --no-anchored 'src/policy_engine/bundled-actions/*' --strip-components=1
+      mv -v $(find . -name bundled-actions -type d) /home/agent/bundled-actions
+      chown -R agent:agent /home/agent/bundled-actions
+      cd -
+
       systemctl daemon-reload
       systemctl enable --now policy-engine.service
       systemctl enable --now fedproxy-client.service
@@ -427,13 +435,16 @@ async function waitForPolicyEngine(peUrl: string, timeoutMs: number): Promise<vo
 
   while (Date.now() < deadline) {
     try {
-      const res = await fetch(`${peUrl}/health`, { signal: AbortSignal.timeout(5000) });
+      const res = await fetch(`${peUrl}/health`, { signal: AbortSignal.timeout(200) });
       if (res.ok) {
         log("policy engine ready", { peUrl });
         return;
       }
-    } catch { /* not ready yet */ }
-    await new Promise((r) => setTimeout(r, 5000));
+      log("policy engine not yet ready", { res: res });
+    } catch (err) {
+      log("policy engine not yet ready", { err: String(err) });
+    }
+    await new Promise((r) => setTimeout(r, 200));
   }
   throw new Error(`Policy engine at ${peUrl} did not become ready within ${timeoutMs}ms`);
 }
@@ -634,7 +645,7 @@ export async function marketRFPSubmitWorkflow(
   log("VM registered SSH key", { serviceName, did: sshKeyEvent.did });
 
   // Step 11: Derive policy engine URL from service name + handle + fedproxy host
-  const peUrl = `https://${serviceName}.${config.handle}.${config.fedproxyHost}`;
+  const peUrl = `https://${serviceName}--${config.handle.replace(/\./g, "-")}.${config.fedproxyHost}`;
   log("policy engine URL", { peUrl });
 
   // Step 12: Poll until policy engine is ready
diff --git a/run.sh b/run.sh
index 5e4a475..f947c02 100644
--- a/run.sh
+++ b/run.sh
@@ -1 +1 @@
-SPINDLE_OWNER_DID="did:plc:5svqtrhheairglgiiyvutzik" SPINDLE_HOSTNAME="spindle-1780032922896.johnandersen777.bsky.social.fedproxy.com" COMPUTE_PROVIDER=market.rfp PORT="9090" deno run --allow-net --allow-env --allow-read --allow-write --watch main.ts 2>&1 | tee spindle.logs | grep --line-buffered -E '^\{' | jq --unbuffered -c . | while IFS='' read -r line; do echo '---' && printf '%s\n' "$line" | yq -P; done
+SPINDLE_OWNER_DID="did:plc:5svqtrhheairglgiiyvutzik" SPINDLE_HOSTNAME="spindle-1780032922896--johnandersen777-bsky-social.fedproxy.com" COMPUTE_PROVIDER=market.rfp PORT="9090" deno run --allow-net --allow-env --allow-read --allow-write --watch main.ts 2>&1 | tee spindle.logs | grep --line-buffered -E '^\{' | jq --unbuffered -c . | while IFS='' read -r line; do echo '---' && printf '%s\n' "$line" | yq -P; done