diff --git a/.github/workflows/deepseek-ci.yml b/.github/workflows/deepseek-ci.yml
index 4247b4a84..84faa872f 100644
--- a/.github/workflows/deepseek-ci.yml
+++ b/.github/workflows/deepseek-ci.yml
@@ -11,6 +11,9 @@ name: 'DeepSeek CI (peer Omni ↔ OpenRouter HTTPS + opt-in web-wrapper)'
 # The DeepSeek web-wrapper is intentionally a separate, explicit third-peer path
 # (see the deepseek-webwrapper job) and stays disabled until a real, non-simulated
 # invocation exists. Never caches/uploads/commits session cookies or tokens.
+#
+# Review job runs only on non-fork, non-draft PRs and uses a distinct comment
+# marker to avoid double-counting free-tier quota against gemini-after-peers.
 
 on:
   pull_request:
@@ -31,7 +34,10 @@ permissions: {}
 
 jobs:
   review:
-    if: github.event_name == 'pull_request'
+    if: |
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.fork == false &&
+      github.event.pull_request.draft == false
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -71,8 +77,11 @@ jobs:
           fi
           DIFF=$(gh api "repos/${REPO}/pulls/${TARGET_PR}" -H "Accept: application/vnd.github.v3.diff" 2>/dev/null \
             | head -c 24000 || true)
+          # Random delimiter prevents PR-diff lines that equal a fixed token from
+          # terminating the multiline GITHUB_OUTPUT early (step-output injection).
+          DELIM="DSCR_$(openssl rand -hex 8)"
           {
-            echo "prompt<<EOF"
+            echo "prompt<<${DELIM}"
             cat <<PROMPT
           You are the free-tier DeepSeek-CI peer reviewer for termux-monorepo. Concise. ONE response.
           Target PR #${TARGET_PR}.
@@ -80,7 +89,7 @@ jobs:
           Diff (truncated):
           ${DIFF}
           PROMPT
-            echo "EOF"
+            echo "${DELIM}"
           } >> "$GITHUB_OUTPUT"
 
       - name: OmniRoute review (peer)
@@ -118,6 +127,7 @@ jobs:
       github.event_name == 'workflow_dispatch' &&
       (inputs.enable_deepseek_webwrapper == true || vars.DEEPSEEK_WEBWRAPPER_ENABLED == '1')
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:
@@ -126,12 +136,12 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js (PoW WASM solver)
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           node-version: '20'
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b4117511b8a72f1f5 # v5.3.0
         with:
           python-version: '3.11'
 
diff --git a/.gitignore b/.gitignore
index b53a51f11..cca2916cf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -124,13 +124,13 @@ cli-synthegration/workspace/provenance/
 cli-synthegration/codex/
 
 # === DeepSeek web-wrapper opt-in CI smoke test (transient; $RUNNER_TEMP only) ===
+# Only ignore runtime session state — never ignore tracked sources such as
+# deepcli/pow_solver.js (required for PoW). Bare patterns like pow_solver.js
+# or session.json would hide legitimate tracked files if re-added.
 deepseek-webwrapper-home/
 deepseek_output.json
 deepcli/session.json
-deepcli/pow_solver.js
-session.json
-cookies_2.json
-pow_solver.js
+deepcli/cookies_2.json
 
 # === Build artifacts and caches ===
 workspace/maxc/target/
diff --git a/deepcli/package.json b/deepcli/package.json
new file mode 100644
index 000000000..bf15a907e
--- /dev/null
+++ b/deepcli/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "deepcli-pow-solver",
+  "private": true,
+  "type": "module",
+  "description": "ESM context so pow_solver.js (import syntax) runs under Node 20 without .mjs rename"
+}