diff --git a/services/draupnir-slicer/Dockerfile b/services/draupnir-slicer/Dockerfile
index e1e0196..2ae7e36 100644
--- a/services/draupnir-slicer/Dockerfile
+++ b/services/draupnir-slicer/Dockerfile
@@ -11,6 +11,11 @@
 # mean pinning permanently to a stale build — the exact trap brokkr-smithy-dev
 # rejected when choosing Orca over an old PrusaSlicer tag. A container keeps
 # the slicer current AND leaves the host untouched.
+# ⚠ RUNTIME TRAP, verified not inferred: OrcaSlicer writes result.json into the
+# WORKING DIRECTORY on every invocation — including --help, which is as
+# read-only as a call gets. An empty dir gained a result.json from --help alone.
+# Always invoke from inside the run's own artifact directory. The orca-slice
+# wrapper beside this file carries the same warning.
 FROM ubuntu:24.04
 ARG ORCA_VERSION=2.4.2
 ARG ORCA_URL=https://github.com/OrcaSlicer/OrcaSlicer/releases/download/v2.4.2/OrcaSlicer_Linux_AppImage_Ubuntu2404_V2.4.2.AppImage
diff --git a/services/draupnir-slicer/orca-slice b/services/draupnir-slicer/orca-slice
new file mode 100755
index 0000000..a0e76d3
--- /dev/null
+++ b/services/draupnir-slicer/orca-slice
@@ -0,0 +1,21 @@
+#!/bin/sh
+# Draupnir sliceability check — OrcaSlicer 2.4.2, containerised.
+#
+# Containerised because irv-ml1 (Debian 12, glibc 2.36) CANNOT run the only
+# AppImage OrcaSlicer ships (Ubuntu 24.04, needs GLIBC_2.38 / GLIBCXX_3.4.32).
+# Verified by ldd, not assumed. See services/draupnir-slicer/Dockerfile.
+#
+# ⚠ ORCASLICER WRITES result.json INTO THE WORKING DIRECTORY on EVERY
+# invocation — including --help, which is as read-only as a call gets. Verified
+# here, not inferred: an empty dir gained result.json from --help alone. Call
+# this from inside the run's own artifact dir or it litters wherever you were.
+# Found by brokkr-smithy-dev on --info; I had verified only --help and called
+# it done. Usage text proves the binary starts, not that it behaves.
+#
+# $PWD is mounted at the same path inside the container, so relative paths and
+# the result.json land where you expect. /mnt/smithy/draupnir is mounted too so
+# artifact paths work unchanged.
+exec docker run --rm \
+  -v /mnt/smithy/draupnir:/mnt/smithy/draupnir \
+  -v "$PWD:$PWD" -w "$PWD" \
+  draupnir/orca-slicer:2.4.2 "$@"