@danceiny/gotry 0.0.1-rc.8 → 0.2.0-rc.27

package/dist/scripts/benchmark-environment-bridge-tests.js

@@ -0,0 +1,1452 @@
+import assert from 'node:assert/strict';
+import { chmodSync, lstatSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Context } from '@deepseek-ai/cordis';
+import { apply } from '../src/index.js';
+import { BRIDGE_ERROR_CONTRACT, BENCHMARK_TOOL_RESULT_SCHEMA_VERSION, registerBenchmarkEnvironmentBridge, } from '../src/benchmark-environment-bridge.js';
+import { installBenchmarkToolIsolation } from '../src/benchmark-tool-isolation.js';
+import { BENCHMARK_BRIDGE_CALL_FAILED, BENCHMARK_BRIDGE_CALL_REQUIRED, BENCHMARK_BRIDGE_RETRY_CALL_NOT_ALLOWED, BENCHMARK_BRIDGE_OUTPUT_TRUNCATED, BENCHMARK_BRIDGE_RUNNER_FAILED, BENCHMARK_BRIDGE_SPAWN_FAILED, BENCHMARK_BRIDGE_TIMED_OUT, BENCHMARK_CONFORMANCE_STATE_UNAVAILABLE, BENCHMARK_TERMINAL_INVALID, MAX_CONFORMANCE_RETRIES, benchmarkChildFailureForConformanceCode, createBenchmarkAgentConformance, installBenchmarkAgentConformance, parseBenchmarkTerminal, terminalSchemaOutline, validateTerminalBodySchema, validateTerminalBodyValue, validateTerminalOutputConfig, } from '../src/benchmark-agent-conformance.js';
+import { BENCHMARK_CHILD_DIAGNOSTIC_MAX_BYTES, BENCHMARK_CHILD_DIAGNOSTIC_SCHEMA, appendBoundedChildDiagnostic, classifyBenchmarkChildFailure, classifyBenchmarkTurnEnd, createBenchmarkDiagnosticArbiter, parseBenchmarkChildDiagnostic, } from '../src/benchmark-headless-child-diagnostics.js';
+// Round 6 RED tests: terminal facts must be classified from the structured
+// turn/end envelope, without consulting stderr or reflecting its body.
+{
+    const exactFamilies = [
+        [['AUTH', 'INVALID_CREDENTIAL', 'MISSING_CREDENTIAL'], 'child_model_auth'],
+        [['QUOTA', 'RATE_LIMIT'], 'child_model_capacity'],
+        [['SERVER'], 'child_model_server'],
+        [['TRANSPORT', 'TIMEOUT'], 'child_model_transport'],
+        [['EMPTY_RESPONSE', 'STREAM_CLOSED', 'MALFORMED_RESPONSE', 'INVALID_RESPONSE'], 'child_model_stream'],
+        [['INVALID_REQUEST', 'CONTEXT_WINDOW_EXCEEDED', 'NO_ADAPTER', 'UNKNOWN_MODEL', 'UNSUPPORTED_OPTION'], 'child_model_request'],
+        [['ABORTED'], 'child_aborted'],
+    ];
+    for (const [codes, expected] of exactFamilies) {
+        for (const code of codes)
+            assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code } }), expected);
+    }
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'RATE_LIMIT', message: 'sentinel' } }), 'child_model_capacity');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'AUTH', message: 'sentinel' } }), 'child_model_auth');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'MISSING_CREDENTIAL', message: 'sentinel' } }), 'child_model_auth');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'QUOTA', message: 'sentinel' } }), 'child_model_capacity');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'SERVER', message: 'sentinel' } }), 'child_model_server');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'TRANSPORT', message: 'api-key sentinel' } }), 'child_model_transport');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'OTHER', status: 401, message: 'key sentinel' } }), 'child_model_auth');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'OTHER', status: 403, message: 'key sentinel' } }), 'child_model_auth');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'OTHER', status: 429, message: 'quota sentinel' } }), 'child_model_capacity');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'OTHER', status: 503, message: 'server sentinel' } }), 'child_model_server');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'OTHER', status: 500, message: 'server sentinel' } }), 'child_model_server');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'OTHER', status: 599, message: 'server sentinel' } }), 'child_model_server');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'PI_AI_ERROR', message: 'opaque' } }), 'child_runtime_error');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'INVALID_RESPONSE', message: 'opaque' } }), 'child_model_stream');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'UNSUPPORTED_OPTION', message: 'opaque' } }), 'child_model_request');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'OTHER', status: 503.5, message: 'opaque' } }), 'child_runtime_error');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'OTHER', status: 99, message: 'opaque' } }), 'child_runtime_error');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'OTHER', status: 600, message: 'opaque' } }), 'child_runtime_error');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'rate_limit', message: 'opaque' } }), 'child_runtime_error');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'UNKNOWN', message: 'opaque' } }), 'child_runtime_error');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'error', error: { code: 'UNKNOWN', message: 'message sentinel', requestId: 'request sentinel', path: 'path sentinel', prompt: 'prompt sentinel', key: 'key sentinel' } }), 'child_runtime_error');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'blocked' }), 'child_blocked');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'max-tokens' }), 'child_max_tokens');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'aborted' }), 'child_aborted');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'interrupted' }), 'child_interrupted');
+    assert.equal(classifyBenchmarkTurnEnd({ kind: 'completed' }), undefined);
+    const writes = [];
+    const arbiter = createBenchmarkDiagnosticArbiter(code => writes.push(code));
+    arbiter.offer('session-a', 'child_conformance_failure');
+    arbiter.offer('session-a', 'child_runtime_error');
+    arbiter.offer('session-a', 'child_bridge_failure');
+    arbiter.offer('session-b', 'child_model_server');
+    arbiter.flush('session-a');
+    arbiter.flush('session-a');
+    arbiter.flush('session-b');
+    arbiter.flush('session-b');
+    assert.deepEqual(writes, ['child_bridge_failure', 'child_model_server']);
+}
+assert.equal(MAX_CONFORMANCE_RETRIES, 1);
+// Round 12(#215):terminal body schema 是 closed 结构合同。既有信封/协议用例沿用
+// 一个宽松但 closed 的 fixture(全部键可选),schema 严格性由 Round 12 专段的
+// ChinaTravel-like closed schema 覆盖。
+const OK_BODY_SCHEMA = {
+    type: 'object',
+    properties: {
+        ok: { type: 'boolean' },
+        status: { type: 'string' },
+        x: { type: 'string' },
+    },
+    required: [],
+    additionalProperties: false,
+};
+const projection = {
+    toolName: 'gotry_benchmark_environment',
+    allowedTools: ['lookup'],
+    terminal: { tag: 'done', max_bytes: 1024, body_schema: OK_BODY_SCHEMA },
+};
+assert.equal(validateTerminalOutputConfig(projection.terminal), true);
+for (const invalid of [
+    null,
+    { tag: 'done' },
+    { tag: '1bad', max_bytes: 1024 },
+    { tag: 'done', max_bytes: 0 },
+    { tag: 'done', max_bytes: 1024 * 1024 + 1 },
+    { tag: 'done', max_bytes: 1024, extra: true },
+    { tag: 'done', max_bytes: 1024 },
+    { tag: 'done', max_bytes: 1024, body_schema: { type: 'object', properties: {}, required: [], additionalProperties: true } },
+])
+    assert.equal(validateTerminalOutputConfig(invalid), false);
+assert.deepEqual(parseBenchmarkTerminal(' \n<done>{"ok":true}</done>\n', projection.terminal), { ok: true, value: { ok: true } });
+for (const invalid of [
+    'prose <done>{"ok":true}</done>',
+    '<done>{"ok":true}</done> trailing',
+    '<done>```json\n{"ok":true}\n```</done>',
+    '<done>{"ok":true}</done><done>{"ok":true}</done>',
+    '<done>{"value":"</done><done>"}</done>',
+    '<wrong>{"ok":true}</wrong>',
+    '<done>[{"ok":true}]</done>',
+    '<done>true</done>',
+    '<done>{"ok":</done>',
+])
+    assert.equal(parseBenchmarkTerminal(invalid, projection.terminal).ok, false);
+assert.equal(parseBenchmarkTerminal(`<done>{"x":"${'y'.repeat(1024)}"}</done>`, projection.terminal).ok, false);
+// Reasoning-model compatibility (Round 9): remove complete <think> blocks before
+// applying the unchanged strict terminal-envelope validation. Ordinary prose and
+// unclosed thinking blocks remain fail-closed.
+for (const [raw, expectOk] of [
+    ['<think>plan it</think><done>{"ok":true}</done>', true],
+    ['<think>a</think>\n<THINK>b</THINK>\n<done>{"ok":true}</done>', true],
+    ['<done>{"ok":true}</done><think>after</think>', true],
+    ['<think>unclosed<done>{"ok":true}</done>', false],
+    ['prose<think>x</think><done>{"ok":true}</done>', false],
+]) {
+    assert.equal(parseBenchmarkTerminal(raw, projection.terminal).ok, expectOk, raw);
+}
+// Round 12 RED tests (issue #215): exact terminal schema projection. The bridge
+// config carries a data-value-free closed body schema; the same structure contract
+// is projected into the system prompt and the single terminal correction; the
+// terminal body is fail-closed validated against it — no autofix, no coercion.
+{
+    const travelSchema = {
+        type: 'object',
+        properties: {
+            people_number: { type: 'integer' },
+            start_city: { type: 'string' },
+            target_city: { type: 'string' },
+            itinerary: {
+                type: 'array',
+                items: {
+                    type: 'object',
+                    properties: {
+                        day: { type: 'integer' },
+                        activities: {
+                            type: 'array',
+                            items: {
+                                type: 'object',
+                                properties: {
+                                    type: { type: 'string' },
+                                    start_time: { type: 'string' },
+                                    cost: { type: 'number' },
+                                    transports: {
+                                        type: 'array',
+                                        items: {
+                                            type: 'object',
+                                            properties: { start: { type: 'string' }, mode: { type: 'string' } },
+                                            required: ['start', 'mode'],
+                                            additionalProperties: false,
+                                        },
+                                    },
+                                },
+                                required: ['type', 'start_time', 'cost', 'transports'],
+                                additionalProperties: false,
+                            },
+                        },
+                    },
+                    required: ['day', 'activities'],
+                    additionalProperties: false,
+                },
+            },
+        },
+        required: ['people_number', 'start_city', 'target_city', 'itinerary'],
+        additionalProperties: false,
+    };
+    const travelConfig = { tag: 'done', max_bytes: 65_536, body_schema: travelSchema };
+    assert.equal(validateTerminalOutputConfig(travelConfig), true, 'ChinaTravel-like closed schema is a valid terminal config');
+    const legalBody = {
+        people_number: 2,
+        start_city: 'Dubai',
+        target_city: 'Chengdu',
+        itinerary: [{ day: 1, activities: [{ type: 'attraction', start_time: '09:00', cost: 0, transports: [{ start: 'hotel', mode: 'walk' }] }] }],
+    };
+    // Schema dialect: structural keywords only; data-bearing annotation faces are rejected.
+    assert.equal(validateTerminalBodySchema(travelSchema), true);
+    const mutate = (fn) => {
+        const copy = JSON.parse(JSON.stringify(travelSchema));
+        fn(copy);
+        return copy;
+    };
+    for (const [label, schema] of [
+        ['extra root key', mutate(s => { s.description = 'the plan'; })],
+        ['enum on scalar', mutate(s => { s.properties.people_number.enum = [2]; })],
+        ['const on scalar', mutate(s => { s.properties.start_city.const = 'Dubai'; })],
+        ['default on scalar', mutate(s => { s.properties.target_city.default = 'Chengdu'; })],
+        ['examples key', mutate(s => { s.properties.itinerary.examples = []; })],
+        ['pattern on scalar', mutate(s => { s.properties.start_city.pattern = '^[A-Z]'; })],
+        ['open object', mutate(s => { s.additionalProperties = true; })],
+        ['missing additionalProperties', mutate(s => { delete s.additionalProperties; })],
+        ['array without items', mutate(s => { s.properties.itinerary = { type: 'array' }; })],
+        ['object without required', mutate(s => { delete s.required; })],
+        ['unknown type', mutate(s => { s.properties.people_number.type = 'float'; })],
+        ['allOf composition', mutate(s => { s.allOf = []; })],
+    ]) {
+        assert.equal(validateTerminalBodySchema(schema), false, `schema dialect rejects: ${label}`);
+    }
+    // Value validation: legal ChinaTravel-like hierarchy passes; the five Round 11
+    // failure classes stay rejected without any autofix.
+    assert.equal(validateTerminalBodyValue(legalBody, travelSchema), true, 'legal ChinaTravel-like hierarchy passes');
+    assert.equal(parseBenchmarkTerminal(`<done>${JSON.stringify(legalBody)}</done>`, travelConfig).ok, true, 'legal body parses through the terminal gate');
+    for (const [label, body] of [
+        ['extra root key (Round 11 budget/total_cost case)', { ...legalBody, budget: { total_cost: 1 } }],
+        ['itinerary item written as direct activity (missing day)', { ...legalBody, itinerary: [{ type: 'attraction', start_time: '09:00', cost: 0, transports: [] }] }],
+        ['missing activities array', { ...legalBody, itinerary: [{ day: 1 }] }],
+        ['wrong type (string day)', { ...legalBody, itinerary: [{ day: '1', activities: [] }] }],
+        ['nested extra field', { ...legalBody, itinerary: [{ day: 1, activities: [{ type: 'attraction', start_time: '09:00', cost: 0, transports: [], unexpected: 1 }] }] }],
+    ]) {
+        assert.equal(validateTerminalBodyValue(body, travelSchema), false, `value validation rejects: ${label}`);
+        assert.equal(parseBenchmarkTerminal(`<done>${JSON.stringify(body)}</done>`, travelConfig).ok, false, `terminal gate rejects: ${label}`);
+    }
+    // Envelope byte limit still fails closed for a schema-valid but oversized body.
+    assert.equal(parseBenchmarkTerminal(`<done>${' '.repeat(2000)}${JSON.stringify({ ok: true })}</done>`, projection.terminal).ok, false, 'schema-valid body over max_bytes still rejects');
+    // Single-source projection: the outline is deterministic and appears verbatim in
+    // both the system section and the one terminal correction.
+    const outline = terminalSchemaOutline(travelSchema);
+    assert.equal(outline, terminalSchemaOutline(JSON.parse(JSON.stringify(travelSchema))), 'outline is deterministic');
+    assert.equal(outline, 'object{people_number:integer,start_city:string,target_city:string,itinerary:array<object{day:integer,activities:array<object{type:string,start_time:string,cost:number,transports:array<object{start:string,mode:string}>}>}>}', 'outline renders the exact structural contract');
+    assert.match(outline, /object\{/, 'outline renders object nodes');
+    assert.ok(!outline.includes('optional') && !outline.includes('?'), 'all keys required render without optional markers');
+}
+function turnStart(turn = 1) {
+    return { type: 'turn/start', data: { turn } };
+}
+function turnEnd(turn = 1) {
+    return { type: 'turn/end', data: { turn, reason: { kind: 'completed' } } };
+}
+function toolCall(callId = 'call-1', options = {}) {
+    const { turn = 1, step = 1, action = 'call', tool = 'lookup' } = options;
+    return {
+        type: 'tool/call',
+        data: {
+            turn,
+            step,
+            callId,
+            name: projection.toolName,
+            arguments: JSON.stringify({ action, tool, arguments: {} }),
+        },
+    };
+}
+function toolResult(callId = 'call-1', options = {}) {
+    const { turn = 1, step = 1, ok = true, isError = false, error = 'runner_failed', outcome, payload } = options;
+    // 0.2.0-rc.2 线型:toolCallId/isError 在 message 顶层,content 是单个文本载荷块。
+    return {
+        type: 'tool/result',
+        data: {
+            turn,
+            step,
+            message: {
+                source: { kind: 'tool', callId },
+                toolCallId: callId,
+                isError,
+                content: [{ type: 'text', text: JSON.stringify(payload ?? (outcome ? { ok: true, outcome } : ok ? { ok: true, result: {} } : { ok: false, error })) }],
+            },
+        },
+    };
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(toolCall());
+    state.observe(toolResult('call-1', { outcome: { schema_version: 'gotry_benchmark_tool_result_v1', status: 'miss', code: 'NOT_FOUND', recovery: 'revise_arguments' } }));
+    assert.deepEqual(state.stopping(1), { kind: 'steer', mode: 'terminal' }, 'domain outcome alone permits tagged terminal');
+    state.observe(assistant('<done>{"status":"miss"}</done>', { step: 2 }));
+    assert.deepEqual(state.stopping(1), { kind: 'accept' }, 'domain-only tagged terminal is accepted');
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(toolCall());
+    state.observe(toolResult('call-1', { outcome: { schema_version: 'gotry_benchmark_tool_result_v1', status: 'miss', code: 'NOT_FOUND', recovery: 'revise_arguments' } }));
+    state.observe(toolCall('call-2', { step: 2 }));
+    state.observe(toolResult('call-2'));
+    state.observe(assistant('<done>{"status":"succeeded"}</done>', { step: 3 }));
+    assert.deepEqual(state.stopping(1), { kind: 'accept' }, 'domain outcome followed by concrete result accepts');
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(toolCall());
+    state.observe(toolResult('call-1', { outcome: { schema_version: 'gotry_benchmark_tool_result_v1', status: 'miss', code: 'NOT_FOUND', recovery: 'revise_arguments' } }));
+    state.observe(toolCall('call-2', { step: 2 }));
+    state.observe(toolResult('call-2', { ok: false, error: 'runner_failed' }));
+    assert.deepEqual(state.stopping(1), { kind: 'reject', code: BENCHMARK_BRIDGE_RUNNER_FAILED }, 'infra failure overrides domain-only outcome');
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(toolCall());
+    state.observe(toolResult('call-1', { payload: { ok: true, result: {}, outcome: { status: 'miss' } } }));
+    state.observe(assistant('<done>{"status":"succeeded"}</done>'));
+    assert.deepEqual(state.stopping(1), { kind: 'reject', code: BENCHMARK_BRIDGE_CALL_FAILED }, 'ambiguous ok wrapper with result and outcome fails closed');
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(toolCall());
+    state.observe(toolResult('call-1', { payload: { ok: true, outcome: {} } }));
+    state.observe(assistant('<done>{"status":"miss"}</done>'));
+    assert.deepEqual(state.stopping(1), { kind: 'reject', code: BENCHMARK_BRIDGE_CALL_FAILED }, 'malformed inner domain outcome fails closed');
+}
+function assistant(text, options = {}) {
+    const { turn = 1, step = 2, interrupted = false } = options;
+    return {
+        type: 'assistant/message',
+        data: {
+            turn,
+            step,
+            message: { content: [{ type: 'text', text }] },
+            ...(interrupted ? { interrupted: true } : {}),
+        },
+    };
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(assistant('I would run the CLI.', { step: 1 }));
+    assert.deepEqual(state.stopping(1), { kind: 'steer', mode: 'call' }, 'no-call first stop gets one correction');
+    assert.equal(state.guardBridgeExecution(), undefined, 'call correction still permits the first real bridge dispatch');
+    state.observe(toolCall('call-a', { step: 2 }));
+    state.observe(toolResult('call-a', { step: 2 }));
+    state.observe(assistant('<done>{"status":"succeeded"}</done>', { step: 3 }));
+    assert.deepEqual(state.stopping(1), { kind: 'accept' }, 'call correction may converge to one successful terminal');
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(assistant('<done>{"status":"succeeded"}</done>', { step: 1 }));
+    assert.deepEqual(state.stopping(1), { kind: 'steer', mode: 'call' }, 'valid terminal without a call still needs a call');
+    state.observe(assistant('<done>{"status":"succeeded"}</done>', { step: 2 }));
+    assert.deepEqual(state.stopping(1), { kind: 'reject', code: BENCHMARK_BRIDGE_CALL_REQUIRED });
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(toolCall());
+    state.observe(toolResult());
+    state.observe(assistant('bad terminal'));
+    assert.deepEqual(state.stopping(1), { kind: 'steer', mode: 'terminal' }, 'bad terminal gets one format-only correction');
+    assert.equal(state.guardBridgeExecution(), BENCHMARK_BRIDGE_RETRY_CALL_NOT_ALLOWED);
+    state.observe(assistant('<done>{"status":"succeeded"}</done>', { step: 3 }));
+    assert.deepEqual(state.stopping(1), { kind: 'accept' }, 'format-only correction can reuse the successful result');
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(toolCall());
+    state.observe(toolResult());
+    state.observe(assistant('bad terminal'));
+    assert.deepEqual(state.stopping(1), { kind: 'steer', mode: 'terminal' });
+    state.observe(toolCall('call-2', { step: 3 }));
+    assert.deepEqual(state.stopping(1), { kind: 'reject', code: BENCHMARK_BRIDGE_RETRY_CALL_NOT_ALLOWED });
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(toolCall());
+    state.observe(toolResult());
+    state.observe(assistant('bad terminal'));
+    assert.deepEqual(state.stopping(1), { kind: 'steer', mode: 'terminal' });
+    state.observe(assistant('still bad', { step: 3 }));
+    assert.deepEqual(state.stopping(1), { kind: 'reject', code: BENCHMARK_TERMINAL_INVALID });
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(toolCall());
+    state.observe(toolResult('call-1', { ok: false }));
+    assert.deepEqual(state.stopping(1), { kind: 'reject', code: BENCHMARK_BRIDGE_RUNNER_FAILED }, 'structured runner failure is not retried');
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(toolCall());
+    state.observe(toolResult('call-1', { ok: false, error: 'output_truncated' }));
+    assert.deepEqual(state.stopping(1), { kind: 'reject', code: BENCHMARK_BRIDGE_OUTPUT_TRUNCATED }, 'structured runner truncation has a distinct reason');
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(toolCall('failed', { step: 1 }));
+    state.observe(toolResult('failed', { step: 1, ok: false }));
+    state.observe(toolCall('successful', { step: 2 }));
+    state.observe(toolResult('successful', { step: 2 }));
+    state.observe(assistant('<done>{"status":"succeeded"}</done>', { step: 3 }));
+    assert.deepEqual(state.stopping(1), { kind: 'accept' }, 'a model-owned later success can recover from an earlier failed call without a conformance retry');
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(toolCall('successful', { step: 1 }));
+    state.observe(toolResult('successful', { step: 1 }));
+    state.observe(toolCall('failed', { step: 2 }));
+    state.observe(toolResult('failed', { step: 2, ok: false }));
+    state.observe(assistant('<done>{"status":"succeeded"}</done>', { step: 3 }));
+    assert.deepEqual(state.stopping(1), { kind: 'accept' }, 'a later failed optional call does not erase an already paired successful result');
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(toolCall('successful', { step: 1 }));
+    state.observe(toolResult('successful', { step: 1 }));
+    state.observe(assistant('<done>{"status":"succeeded"}</done>', { step: 2 }));
+    state.observe(toolCall('domain', { step: 3 }));
+    state.observe(toolResult('domain', { step: 3, outcome: { schema_version: 'gotry_benchmark_tool_result_v1', status: 'miss', code: 'NOT_FOUND', recovery: 'revise_arguments' } }));
+    assert.deepEqual(state.stopping(1), { kind: 'steer', mode: 'terminal' }, 'a terminal before the latest domain response is stale');
+    state.observe(assistant('<done>{"status":"succeeded"}</done>', { step: 4 }));
+    assert.deepEqual(state.stopping(1), { kind: 'accept' }, 'a fresh terminal after the latest domain response may reuse the earlier concrete result');
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(toolCall('successful', { step: 1 }));
+    state.observe(toolResult('successful', { step: 1 }));
+    state.observe(assistant('<done>{"status":"succeeded"}</done>', { step: 2 }));
+    state.observe(toolCall('failed', { step: 3 }));
+    state.observe(toolResult('failed', { step: 3, ok: false }));
+    assert.deepEqual(state.stopping(1), { kind: 'steer', mode: 'terminal' }, 'a terminal before a later optional failure is stale');
+    state.observe(assistant('<done>{"status":"succeeded"}</done>', { step: 4 }));
+    assert.deepEqual(state.stopping(1), { kind: 'accept' }, 'a fresh terminal may still converge after an optional failure when a concrete result exists');
+}
+{
+    const state = createBenchmarkAgentConformance(projection);
+    state.observe(turnStart());
+    state.observe(toolCall('discovery', { action: 'tools' }));
+    state.observe(toolResult('discovery'));
+    state.observe(assistant('<done>{"status":"succeeded"}</done>'));
+    assert.deepEqual(state.stopping(1), { kind: 'steer', mode: 'call' }, 'action tools does not satisfy the call gate');
+    state.observe(turnEnd());
+    assert.deepEqual(state.stopping(1), { kind: 'reject', code: BENCHMARK_CONFORMANCE_STATE_UNAVAILABLE });
+    state.observe(turnStart(2));
+    assert.deepEqual(state.stopping(1), { kind: 'reject', code: BENCHMARK_CONFORMANCE_STATE_UNAVAILABLE }, 'turn state cannot leak across turns');
+}
+{
+    const rootListeners = new Map();
+    const scopedListeners = new Map();
+    const guards = [];
+    const steers = [];
+    const runtimeWrites = [];
+    const runEffect = (action) => {
+        const disposers = [];
+        const value = action();
+        if (value && typeof value.next === 'function') {
+            let item = value.next();
+            while (!item.done) {
+                if (typeof item.value === 'function')
+                    disposers.push(item.value);
+                item = value.next();
+            }
+        }
+        return () => { for (const dispose of disposers.reverse())
+            dispose(); };
+    };
+    const add = (target, name, listener) => {
+        const list = target.get(name) ?? [];
+        list.push(listener);
+        target.set(name, list);
+        return () => target.set(name, list.filter(candidate => candidate !== listener));
+    };
+    const session = {};
+    const agent = {
+        session,
+        steer(message) { steers.push(message); },
+        ctx: {
+            tools: { guard(check) { guards.push(check); return () => { }; } },
+            effect: runEffect,
+            on(name, listener) { return add(scopedListeners, name, listener); },
+        },
+    };
+    const ctx = {
+        on(name, listener) { return add(rootListeners, name, listener); },
+    };
+    installBenchmarkAgentConformance(ctx, projection, code => runtimeWrites.push(code));
+    rootListeners.get('agent/created')[0]({ agent });
+    rootListeners.get('session/event')[0](session, turnStart());
+    rootListeners.get('session/event')[0](session, { type: 'llm/retry', data: { turn: 1, reason: { kind: 'error', error: { code: 'RATE_LIMIT' } } } });
+    rootListeners.get('session/event')[0](session, { type: 'agent/request-error', data: { turn: 1, error: { code: 'SERVER' } } });
+    rootListeners.get('session/event')[0](session, assistant('prose only', { step: 1 }));
+    rootListeners.get('agent/turn-stopping')[0]({ agent, turn: 1 });
+    assert.equal(steers.length, 1, 'runtime wiring steers exactly once at the stop boundary');
+    assert.equal(steers[0].role, 'user');
+    assert.equal(Object.isFrozen(steers[0]), true, 'correction uses the official immutable DSH user message');
+    assert.equal(Object.isFrozen(steers[0].content), true, 'correction content is deeply frozen');
+    assert.equal(guards[0]({ name: projection.toolName }), undefined, 'call correction leaves bridge execution available');
+    const assembled = await scopedListeners.get('system-prompt/assemble')[0]({}, {}, async () => ({ sections: [], tools: [] }));
+    assert.match(assembled.sections[0].text, /agent_env\.cli/);
+    assert.match(assembled.sections[0].text, /\"action\":\"call\"/);
+    assert.match(assembled.sections[0].text, /<done>/);
+    assert.equal(assembled.sections[0].text.includes('/tmp/'), false);
+    // Round 12(#215):system section 与 terminal 纠正投影同一份结构合同(单一来源)。
+    const round12Outline = terminalSchemaOutline(OK_BODY_SCHEMA);
+    assert.ok(assembled.sections[0].text.includes(`matching exactly ${round12Outline}`), 'system section projects the terminal body schema outline');
+    // Intermediate retry/request errors never write; only final completed observes recovery.
+    rootListeners.get('session/event')[0](session, turnEnd());
+    assert.deepEqual(runtimeWrites, []);
+    // A final structured model error writes exactly once, despite duplicate end/dispose.
+    rootListeners.get('session/event')[0](session, turnStart(2));
+    rootListeners.get('session/event')[0](session, { type: 'turn/end', data: { turn: 2, reason: { kind: 'error', error: { code: 'SERVER', message: 'sentinel' } } } });
+    rootListeners.get('session/event')[0](session, { type: 'turn/end', data: { turn: 2, reason: { kind: 'error', error: { code: 'UNKNOWN_MODEL' } } } });
+    assert.deepEqual(runtimeWrites, ['child_model_server']);
+    rootListeners.get('session/disposed')[0](session);
+    // A malformed stopping payload with a valid session is arbited above a later generic error.
+    const session2 = {};
+    const agent2 = { session: session2, steer() { }, ctx: agent.ctx };
+    rootListeners.get('agent/created')[0]({ agent: agent2 });
+    rootListeners.get('session/event')[0](session2, turnStart());
+    assert.throws(() => rootListeners.get('agent/turn-stopping')[0]({ agent: agent2 }), new RegExp(BENCHMARK_CONFORMANCE_STATE_UNAVAILABLE));
+    rootListeners.get('session/event')[0](session2, { type: 'turn/end', data: { turn: 1, reason: { kind: 'error', error: { code: 'UNKNOWN' } } } });
+    assert.deepEqual(runtimeWrites, ['child_model_server', 'child_conformance_failure']);
+    rootListeners.get('session/disposed')[0](session2);
+    const session3 = {};
+    const agent3 = { session: session3, steer() { }, ctx: agent.ctx };
+    rootListeners.get('agent/created')[0]({ agent: agent3 });
+    rootListeners.get('session/event')[0](session3, turnStart());
+    rootListeners.get('session/event')[0](session3, { type: 'turn/end', data: { turn: 1, reason: { kind: 'error', error: { code: 'TIMEOUT' } } } });
+    assert.deepEqual(runtimeWrites, ['child_model_server', 'child_conformance_failure', 'child_model_transport'], 'session diagnostics remain isolated');
+    rootListeners.get('session/disposed')[0](session3);
+}
+function fakeHandle(outcome) {
+    const stdout = outcome.stdout ?? '';
+    const stderr = outcome.stderr ?? '';
+    const reader = {
+        readFrom: (_offset) => {
+            if (outcome.readFailure)
+                throw new Error('collected output reading failed');
+            return { text: stdout, nextOffset: Buffer.byteLength(stdout), lossy: outcome.lossy ?? false };
+        },
+    };
+    const errorReader = {
+        readFrom: (_offset) => {
+            if (outcome.readFailure)
+                throw new Error('collected output reading failed');
+            return { text: stderr, nextOffset: Buffer.byteLength(stderr), lossy: false };
+        },
+    };
+    let rejectDone;
+    const done = outcome.spawnReject
+        ? Promise.reject(new Error('spawn rejected'))
+        : outcome.waitForAbort
+            ? new Promise((_resolve, reject) => { rejectDone = reject; })
+            : Promise.resolve({ exitCode: outcome.exitCode ?? 0, signal: outcome.signal ?? null });
+    return {
+        stdin: undefined,
+        stdout: undefined,
+        stderr: undefined,
+        collected: { stdout: reader, stderr: errorReader },
+        done,
+        terminate() { if (outcome.waitForAbort)
+            rejectDone?.(new Error('timed out')); },
+        waitForExit: async () => true,
+    };
+}
+function okEnvelope(result) {
+    return JSON.stringify({ schema_version: BENCHMARK_TOOL_RESULT_SCHEMA_VERSION, status: 'ok', result });
+}
+function lookupInputSchema() {
+    return {
+        type: 'object',
+        properties: {
+            city: { type: 'string', enum: ['Dubai', 'Abu Dhabi'], description: 'Declared city name.' },
+            payload: { type: 'string' },
+            notes: { type: 'string' },
+            executable: { type: 'string' },
+            cwd: { type: 'string' },
+            argv: { type: 'array', items: { type: 'string' } },
+        },
+        required: ['city'],
+        additionalProperties: false,
+    };
+}
+function bridgeCall(tool, argumentsValue) {
+    return { action: 'call', tool, arguments: argumentsValue };
+}
+async function assertRealCordisWaterfallOrdering() {
+    const ctx = new Context();
+    const bridge = {
+        name: 'gotry_benchmark_environment',
+        description: 'benchmark bridge',
+        parameters: { oneOf: [{ type: 'object', properties: { action: { const: 'tools' } }, required: ['action'], additionalProperties: false }] },
+    };
+    const exactSchema = structuredClone(bridge);
+    let addPreStepTool = false;
+    const rootTools = {
+        get(name) { return name === bridge.name ? bridge : undefined; },
+        schemas(agent) {
+            return agent && addPreStepTool ? [exactSchema, { name: 'non_bridge' }] : [exactSchema];
+        },
+    };
+    ctx.provide('tools', rootTools);
+    ctx.provide('agents', { list: () => [] });
+    const bus = ctx;
+    bus.on('system-prompt/assemble', async (_assembly, _context, next) => {
+        const result = await next();
+        return { ...result, tools: [...result.tools, { name: 'non_bridge' }] };
+    });
+    bus.on('agent/pre-step', async (_payload, next) => {
+        const result = await next();
+        addPreStepTool = true;
+        return result;
+    });
+    installBenchmarkToolIsolation(ctx);
+    const scopedEffect = (action, label) => ctx.effect(action, label);
+    const scopedTools = {
+        guard: () => ctx.effect(() => () => undefined),
+        presentAs: () => ctx.effect(() => () => undefined),
+        restrict: () => ctx.effect(() => () => undefined),
+    };
+    const agent = { ctx: { tools: scopedTools, effect: scopedEffect, on: bus.on } };
+    bus.emit('agent/created', { agent });
+    await assert.rejects(bus.waterfall('system-prompt/assemble', { tools: [] }, { agent, scope: agent }, async () => ({ tools: [exactSchema] })), /BENCHMARK_TOOL_SURFACE_VIOLATION/, 'prepend assembly guard observes an earlier listener post-next mutation');
+    await assert.rejects(bus.waterfall('agent/pre-step', { agent }, async () => ({ kind: 'enter' })), /BENCHMARK_TOOL_SURFACE_VIOLATION/, 'prepend pre-step guard observes an earlier listener post-next scope mutation');
+    await ctx.fiber.dispose();
+}
+await assertRealCordisWaterfallOrdering();
+const root = mkdtempSync(join(tmpdir(), 'gotry-benchmark-bridge-test-'));
+const ambientSentinelNames = [
+    'GOTRY_BENCHMARK_BRIDGE_PARENT_SENTINEL',
+    'GOTRY_LLM_MODEL',
+    'DATABASE_URL',
+    'SSH_AUTH_SOCK',
+    'AWS_PROFILE',
+    'HTTPS_PROXY',
+];
+const ambientSentinels = new Map(ambientSentinelNames.map(name => [name, process.env[name]]));
+try {
+    delete process.env.GOTRY_LLM_MODEL;
+    const timedOutDiagnostic = '\n' + JSON.stringify({
+        schema_version: BENCHMARK_CHILD_DIAGNOSTIC_SCHEMA,
+        code: 'child_bridge_timed_out',
+    }) + '\n';
+    assert.equal(parseBenchmarkChildDiagnostic(timedOutDiagnostic), 'child_bridge_timed_out', 'strict control record parses to its allowlisted reason code');
+    assert.equal(classifyBenchmarkChildFailure({ code: 1, diagnostic: timedOutDiagnostic }), 'child_bridge_timed_out', 'structured control data maps to a stable bridge timeout code');
+    assert.equal(classifyBenchmarkChildFailure({ code: 1, diagnostic: `provider text contains child_bridge_timed_out and ${BENCHMARK_BRIDGE_TIMED_OUT}` }), 'child_nonzero_exit', 'free text cannot impersonate a structured bridge reason');
+    assert.equal(parseBenchmarkChildDiagnostic(JSON.stringify({ schema_version: BENCHMARK_CHILD_DIAGNOSTIC_SCHEMA, code: 'child_bridge_timed_out', extra: 'rejected' })), undefined, 'control records with extra keys fail closed');
+    assert.equal(benchmarkChildFailureForConformanceCode(BENCHMARK_BRIDGE_RUNNER_FAILED), 'child_bridge_runner_failed', 'runner failure maps to a stable structured child reason');
+    assert.equal(benchmarkChildFailureForConformanceCode(BENCHMARK_BRIDGE_SPAWN_FAILED), 'child_bridge_spawn_failed', 'spawn failure maps to a stable structured child reason');
+    assert.equal(benchmarkChildFailureForConformanceCode(BENCHMARK_BRIDGE_OUTPUT_TRUNCATED), 'child_bridge_output_truncated', 'runner output truncation maps to a stable structured child reason');
+    assert.equal(classifyBenchmarkChildFailure({ code: 0, outputTruncated: true }), 'child_output_truncated', 'truncated terminal output takes precedence over control data');
+    assert.equal(classifyBenchmarkChildFailure({ code: null, signal: 'SIGTERM', diagnostic: timedOutDiagnostic }), 'child_signaled', 'outer child signal takes precedence over an inner bridge diagnostic');
+    assert.equal(classifyBenchmarkChildFailure({ code: 0, diagnostic: '' }), 'child_lifecycle_failure', 'unexpected zero-exit diagnostic path remains a stable lifecycle failure');
+    const noisyPrefix = Buffer.alloc(BENCHMARK_CHILD_DIAGNOSTIC_MAX_BYTES + 10, 'x');
+    const boundedControl = appendBoundedChildDiagnostic(appendBoundedChildDiagnostic(Buffer.alloc(0), noisyPrefix), timedOutDiagnostic);
+    assert.equal(boundedControl.length, BENCHMARK_CHILD_DIAGNOSTIC_MAX_BYTES, 'control capture is bounded');
+    assert.equal(parseBenchmarkChildDiagnostic(boundedControl.toString('utf8')), 'child_bridge_timed_out', 'rolling tail preserves a final structured reason after bounded noise');
+    const configPath = join(root, 'bridge.json');
+    writeFileSync(configPath, JSON.stringify({
+        schema_version: 'gotry_benchmark_environment_bridge_v4',
+        enabled: true,
+        executable: process.execPath,
+        cwd: root,
+        argv_prefix: ['-m', 'agent_env.cli', '--lang', 'en'],
+        tools: [
+            { name: 'lookup', description: 'Lookup one declared city.', input_schema: lookupInputSchema(), output_keys: ['city', 'nested'], domain_outcomes: [{ status: 'miss', code: 'NOT_FOUND', recovery: 'revise_arguments' }, { status: 'error', code: 'AMBIGUOUS', recovery: 'choose_alternative' }] },
+            { name: 'constructor', description: 'Construct one declared city.', input_schema: lookupInputSchema(), output_keys: ['legacy'], domain_outcomes: [{ status: 'error', code: 'INVALID', recovery: 'retry_same' }] },
+            { name: 'toString', description: 'Stringify one declared city.', input_schema: lookupInputSchema(), output_keys: ['city', 'nested'], domain_outcomes: [] },
+        ],
+        timeout_ms: 20,
+        max_output_bytes: 4_096,
+        terminal_output: { tag: 'done', max_bytes: 4_096, body_schema: OK_BODY_SCHEMA },
+        isolation: {
+            mode: 'host-enforced',
+            writes: 'forbidden',
+            network: 'denied',
+        },
+    }));
+    const registered = [];
+    let visibleBridge;
+    let shadowedAgent;
+    const scopedExtraSchemas = new Map();
+    const spawnSpecs = [];
+    const agentCreatedListeners = [];
+    const eventNames = [];
+    const promptVariables = [];
+    const assemblyListeners = [];
+    const preStepListeners = [];
+    const disposedListeners = [];
+    const eventOptions = new Map();
+    const runEffect = (action) => {
+        const yielded = [];
+        const value = action();
+        if (value && typeof value.next === 'function') {
+            let step = value.next();
+            while (!step.done) {
+                if (typeof step.value === 'function')
+                    yielded.push(step.value);
+                step = value.next();
+            }
+        }
+        let active = true;
+        return async () => {
+            if (!active)
+                return;
+            active = false;
+            for (const dispose of yielded.reverse())
+                await dispose();
+        };
+    };
+    let disposeRootIsolation;
+    let timeoutSignal;
+    const outcomes = [{ stdout: okEnvelope([{ city: 'Dubai' }]) }];
+    process.env.GOTRY_BENCHMARK_BRIDGE_PARENT_SENTINEL = 'must-not-cross-boundary';
+    process.env.DATABASE_URL = 'postgres://secret';
+    process.env.SSH_AUTH_SOCK = '/tmp/secret.sock';
+    process.env.AWS_PROFILE = 'secret-profile';
+    process.env.HTTPS_PROXY = 'https://secret-proxy';
+    const ctx = {
+        tools: {
+            register(tool) {
+                registered.push(tool);
+                return () => { };
+            },
+            get(name, agent) { return name === 'gotry_benchmark_environment' ? (agent !== undefined && agent === shadowedAgent ? { name } : registered.find(tool => tool.name === name)) : undefined; },
+            schemas(agent) {
+                const project = (tool) => ({ name: tool.name, description: tool.description, parameters: structuredClone(tool.parameters) });
+                const schemas = registered.map(project);
+                if (agent === undefined)
+                    return schemas;
+                return [...schemas.filter(schema => schema.name === 'gotry_benchmark_environment'), ...(scopedExtraSchemas.get(agent) ?? [])];
+            },
+        },
+        systemPrompt: { variable(name) { promptVariables.push(name); } },
+        on(event, listener, options) {
+            eventNames.push(event);
+            eventOptions.set(event, options);
+            if (event === 'agent/created')
+                agentCreatedListeners.push(listener);
+            if (event === 'agent/disposed')
+                disposedListeners.push(listener);
+            if (event === 'system-prompt/assemble')
+                assemblyListeners.push(listener);
+            if (event === 'agent/pre-step')
+                preStepListeners.push(listener);
+            return () => { };
+        },
+        effect(action, label) {
+            const dispose = runEffect(action);
+            if (label === 'benchmark-environment-tool-isolation')
+                disposeRootIsolation = dispose;
+            return dispose;
+        },
+        get(name) {
+            if (name === 'subprocess')
+                return this.subprocess;
+            if (name === 'agents')
+                return this.agents;
+        },
+        subprocess: {
+            spawn(spec) {
+                spawnSpecs.push(spec);
+                const outcome = outcomes.shift() ?? { stdout: okEnvelope({}) };
+                if (outcome.spawnError)
+                    throw new Error('fake spawn failed');
+                if (outcome.waitForAbort) {
+                    timeoutSignal = spec.signal;
+                    const handle = fakeHandle(outcome);
+                    spec.signal?.addEventListener('abort', () => handle.terminate?.(), { once: true });
+                    return handle;
+                }
+                return fakeHandle(outcome);
+            },
+        },
+        agents: { list() { return []; } },
+    };
+    const coldStartListeners = [];
+    const coldStartRoot = { name: 'gotry_benchmark_environment' };
+    assert.throws(() => installBenchmarkToolIsolation({
+        tools: { get(name) { return name === 'gotry_benchmark_environment' ? coldStartRoot : undefined; }, schemas() { return [{ name: 'gotry_benchmark_environment' }]; } },
+        agents: { list() { return [{ id: 'already-live' }]; } },
+        on(event) { coldStartListeners.push(event); return () => { }; },
+    }), /cold-start|live-agent/i, 'installing benchmark isolation with an existing agent fails hard');
+    assert.deepEqual(coldStartListeners, [], 'cold-start rejection does not register an isolation listener');
+    const processListenersBeforeBenchmark = {
+        uncaughtException: process.listenerCount('uncaughtException'),
+        unhandledRejection: process.listenerCount('unhandledRejection'),
+    };
+    apply(ctx, {
+        stateRoot: root,
+        timeoutMs: 20,
+        hbcliBin: '',
+        sessionAccess: 'off',
+        benchmarkEnvironmentConfigPath: configPath,
+    });
+    assert.ok(registered.some(tool => tool.name === 'gotry_benchmark_environment'), 'an explicit valid owner-local config registers the benchmark environment bridge');
+    assert.deepEqual(registered.map(tool => tool.name), ['gotry_benchmark_environment'], 'benchmark mode boots only the single bridge tool instead of the product tool catalog');
+    assert.deepEqual(promptVariables, [], 'benchmark mode does not install product prompt variables');
+    assert.equal(eventNames.includes('tools/pre-execute'), false, 'benchmark mode does not install the product session-consent hook');
+    assert.deepEqual({
+        uncaughtException: process.listenerCount('uncaughtException'),
+        unhandledRejection: process.listenerCount('unhandledRejection'),
+    }, processListenersBeforeBenchmark, 'benchmark mode does not install product process incident guards');
+    assert.deepEqual([...eventNames].sort(), [
+        'agent/created',
+        'agent/created',
+        'agent/disposed',
+        'agent/disposed',
+        'agent/pre-step',
+        'agent/turn-stopping',
+        'session/disposed',
+        'session/disposed',
+        'session/event',
+        'session/event',
+        'system-prompt/assemble',
+        'tools/execute',
+        'tools/post-execute',
+    ], 'benchmark root listeners come only from budget, isolation, and conformance when model override is unset');
+    visibleBridge = registered.find(tool => tool.name === 'gotry_benchmark_environment');
+    const restrictions = [];
+    const guards = [];
+    const presentations = [];
+    const cleanupCounts = { restrict: 0, guard: 0, presentAs: 0, assembly: 0 };
+    const firstScopedAssemblyListeners = [];
+    const scopedTools = {
+        restrict(filter) { restrictions.push(filter); return () => { cleanupCounts.restrict += 1; }; },
+        guard(check) { guards.push(check); return () => { cleanupCounts.guard += 1; }; },
+        presentAs(mode) { presentations.push(mode); return () => { cleanupCounts.presentAs += 1; }; },
+    };
+    assert.equal(agentCreatedListeners.length, 2, 'opt-in bridge installs exactly isolation and conformance agent listeners');
+    const isolatedAgentEffects = [];
+    const isolatedAgent = { session: {}, steer(_message) { }, ctx: {
+            tools: scopedTools,
+            effect: (action) => {
+                const dispose = runEffect(action);
+                isolatedAgentEffects.push(dispose);
+                return dispose;
+            },
+            on: (event, listener, options) => {
+                assert.equal(event, 'system-prompt/assemble');
+                assert.deepEqual(options, { prepend: true });
+                firstScopedAssemblyListeners.push(listener);
+                return () => { cleanupCounts.assembly += 1; };
+            },
+        } };
+    for (const listener of agentCreatedListeners)
+        listener({ agent: isolatedAgent });
+    assert.deepEqual(restrictions, [{ allow: ['gotry_benchmark_environment'] }], 'agent scope allows only the bridge tool');
+    assert.deepEqual(presentations, ['native'], 'agent scope forces native tool presentation');
+    assert.ok(eventNames.includes('agent/pre-step'), 'isolation observes pre-step before each request');
+    assert.deepEqual(eventOptions.get('agent/pre-step'), { prepend: true }, 'pre-step isolation wraps every previously registered listener');
+    assert.ok(eventNames.includes('agent/disposed'), 'isolation cleans up on agent disposal');
+    assert.ok(assemblyListeners.length > 0, 'isolation validates final assembled tool surface');
+    assert.equal(firstScopedAssemblyListeners.length, 2, 'agent owns one isolation assembly listener and one conformance section listener');
+    assert.deepEqual(eventOptions.get('system-prompt/assemble'), { prepend: true }, 'assembly isolation wraps every previously registered listener');
+    assert.equal(disposedListeners.length, 2, 'isolation and conformance each own one agent/disposed listener');
+    assert.ok(disposeRootIsolation, 'root isolation effect exposes plugin-lifecycle cleanup');
+    const exactSchema = {
+        name: visibleBridge.name,
+        description: visibleBridge.description,
+        parameters: structuredClone(visibleBridge.parameters),
+    };
+    const assemble = assemblyListeners[0];
+    const nextExact = async () => ({ tools: [exactSchema] });
+    assert.deepEqual(await assemble({ tools: [] }, { agent: isolatedAgent, scope: isolatedAgent }, nextExact), { tools: [exactSchema] }, 'legal final assembly passes unchanged');
+    await assert.rejects(async () => await assemble({ tools: [] }, { agent: isolatedAgent, scope: isolatedAgent }, async () => ({ tools: [exactSchema, { name: 'own_side_effect' }] })), /BENCHMARK_TOOL_SURFACE_VIOLATION/);
+    await assert.rejects(async () => await assemble({ tools: [] }, { agent: isolatedAgent, scope: isolatedAgent }, async () => ({ tools: [{ ...exactSchema, description: `${exactSchema.description ?? ''} tampered` }] })), /BENCHMARK_TOOL_SURFACE_VIOLATION/, 'final assembly rejects same-name schema mutation');
+    const diagnosticAssembly = { tools: [{ name: 'diagnostic_tool' }] };
+    assert.equal(await assemble({ tools: [] }, { scope: { id: 'diagnostic-scope' } }, async () => diagnosticAssembly), diagnosticAssembly, 'non-agent diagnostic assembly passes through');
+    await assert.rejects(async () => await assemble({ tools: [] }, { agent: isolatedAgent, scope: { id: 'wrong-scope' } }, nextExact), /BENCHMARK_TOOL_SURFACE_VIOLATION/, 'agent assembly requires the same agent and scope');
+    const preStep = preStepListeners[0];
+    assert.deepEqual(await preStep({ agent: isolatedAgent }, async () => ({ decision: 'continue' })), { decision: 'continue' }, 'legal pre-step decision passes unchanged');
+    scopedExtraSchemas.set(isolatedAgent, [{ name: 'own_side_effect' }]);
+    await assert.rejects(async () => await preStep({ agent: isolatedAgent }, async () => ({ decision: 'continue' })), /BENCHMARK_TOOL_SURFACE_VIOLATION/, 'downstream pre-step scope expansion fails closed');
+    scopedExtraSchemas.delete(isolatedAgent);
+    shadowedAgent = isolatedAgent;
+    await assert.rejects(async () => await assemble({ tools: [] }, { agent: isolatedAgent, scope: isolatedAgent }, nextExact), /BENCHMARK_TOOL_SURFACE_VIOLATION/, 'same-name scoped shadow fails final assembly identity check');
+    shadowedAgent = undefined;
+    assert.equal(guards.length, 2, 'agent scope installs exact isolation and conformance guards');
+    const guard = guards[0];
+    const originalAgent = { ctx: { tools: { get: (name) => name === 'gotry_benchmark_environment' ? visibleBridge : undefined } } };
+    const shadowAgent = { ctx: { tools: { get: (name) => name === 'gotry_benchmark_environment' ? { name } : undefined } } };
+    shadowedAgent = shadowAgent;
+    assert.equal(guard({ name: 'gotry_benchmark_environment', args: {}, agent: originalAgent }), undefined, 'original bridge definition is allowed');
+    assert.equal(guard({ name: 'gotry_benchmark_environment', args: {}, agent: shadowAgent }), 'BENCHMARK_TOOL_NOT_ALLOWED', 'same-name shadow definition is denied');
+    assert.equal(guard({ name: 'gotry_benchmark_environment', args: { path: '/private/secret' }, agent: isolatedAgent }), undefined, 'bridge tool is allowed');
+    const denied = guard({ name: 'other_tool', args: { path: '/private/secret', token: 'secret' } });
+    assert.equal(denied, 'BENCHMARK_TOOL_NOT_ALLOWED', 'non-bridge tools are denied without argument/path echo');
+    assert.equal(denied?.includes('/private/secret'), false);
+    assert.equal(denied?.includes('secret'), false);
+    assert.equal(guard({ name: 'other_tool', args: { different: true } }), denied, 'denial reason is stable');
+    assert.throws(() => agentCreatedListeners[0]({ agent: { ctx: { tools: { restrict(filter) { void filter; }, guard(check) { void check; } } } } }), /presentAs/, 'missing scoped presentAs fails hard');
+    assert.throws(() => agentCreatedListeners[0]({ agent: { ctx: { tools: scopedTools } } }), /effect/, 'missing scoped effect fails hard');
+    assert.throws(() => agentCreatedListeners[0]({ agent: { ctx: { tools: scopedTools, effect: (action) => runEffect(action) } } }), /event bus/, 'missing scoped event bus fails hard');
+    assert.throws(() => agentCreatedListeners[0]({ agent: { ctx: { tools: { guard: guards[0] } } } }), /restrict/, 'missing scoped restrict fails hard');
+    assert.throws(() => agentCreatedListeners[0]({ agent: { ctx: { tools: { restrict(filter) { void filter; } } } } }), /guard/, 'missing scoped guard fails hard');
+    assert.throws(() => installBenchmarkToolIsolation({
+        tools: { get(name) { return name === 'gotry_benchmark_environment' ? { name: 'gotry_benchmark_environment' } : undefined; }, schemas() { return [{ name: 'gotry_benchmark_environment' }]; } },
+        agents: { list() { return []; } },
+        on() { return () => { }; },
+    }), /effect/, 'missing ctx.effect fails hard');
+    await disposedListeners[0]({ agent: isolatedAgent });
+    assert.deepEqual(cleanupCounts, { restrict: 1, guard: 1, presentAs: 1, assembly: 1 }, 'agent disposal releases every scoped isolation effect exactly once');
+    await disposedListeners[1]({ agent: isolatedAgent });
+    await isolatedAgentEffects[1]();
+    assert.deepEqual(cleanupCounts, { restrict: 1, guard: 2, presentAs: 1, assembly: 2 }, 'agent-scope disposal also releases conformance guard and prompt section');
+    const secondCleanup = { restrict: 0, guard: 0, presentAs: 0, assembly: 0 };
+    const secondGuards = [];
+    const secondScopedAssemblyListeners = [];
+    const secondTools = {
+        restrict() { return () => { secondCleanup.restrict += 1; }; },
+        guard(check) { secondGuards.push(check); return () => { secondCleanup.guard += 1; }; },
+        presentAs() { return () => { secondCleanup.presentAs += 1; }; },
+    };
+    const secondAgentEffects = [];
+    const secondAgent = { session: {}, steer(_message) { }, ctx: {
+            tools: secondTools,
+            effect: (action) => {
+                const dispose = runEffect(action);
+                secondAgentEffects.push(dispose);
+                return dispose;
+            },
+            on: (_event, listener) => {
+                secondScopedAssemblyListeners.push(listener);
+                return () => { secondCleanup.assembly += 1; };
+            },
+        } };
+    for (const listener of agentCreatedListeners)
+        listener({ agent: secondAgent });
+    let inFlightNextCalls = 0;
+    await assert.rejects(async () => await secondScopedAssemblyListeners[0]({}, { agent: secondAgent, scope: secondAgent }, async () => {
+        inFlightNextCalls += 1;
+        await disposeRootIsolation();
+        return { tools: [exactSchema] };
+    }), /BENCHMARK_TOOL_SURFACE_VIOLATION/, 'plugin unload during assembly fails closed before returning a model-visible result');
+    assert.equal(inFlightNextCalls, 1, 'in-flight quarantine test reaches the controlled unload point');
+    assert.deepEqual(secondCleanup, { restrict: 0, guard: 0, presentAs: 0, assembly: 0 }, 'plugin unload keeps a live agent quarantined');
+    let quarantineNextCalls = 0;
+    await assert.rejects(async () => await secondScopedAssemblyListeners[0]({}, { agent: secondAgent, scope: secondAgent }, async () => {
+        quarantineNextCalls += 1;
+        return { tools: [exactSchema] };
+    }), /BENCHMARK_TOOL_SURFACE_VIOLATION/, 'plugin-unloaded live agent rejects assembly before model request');
+    assert.equal(quarantineNextCalls, 0, 'quarantine does not enter the remaining assembly chain');
+    assert.equal(secondGuards[0]({ name: 'other_tool', agent: secondAgent }), 'BENCHMARK_TOOL_NOT_ALLOWED', 'quarantined agent still denies non-bridge dispatch after plugin unload');
+    assert.equal(secondGuards[0]({ name: 'gotry_benchmark_environment', agent: secondAgent }), 'BENCHMARK_TOOL_NOT_ALLOWED', 'quarantined agent also denies bridge dispatch after plugin unload');
+    assert.deepEqual(cleanupCounts, { restrict: 1, guard: 2, presentAs: 1, assembly: 2 }, 'plugin unload does not double-dispose an already removed agent');
+    assert.throws(() => agentCreatedListeners[0]({ agent: secondAgent }), /BENCHMARK_TOOL_SURFACE_VIOLATION/, 'agent creation during plugin stop fails closed');
+    for (const dispose of secondAgentEffects)
+        await dispose();
+    assert.deepEqual(secondCleanup, { restrict: 1, guard: 2, presentAs: 1, assembly: 2 }, 'agent disposal releases its quarantined isolation and conformance effects');
+    const bridge = registered.find(tool => tool.name === 'gotry_benchmark_environment');
+    assert.ok(bridge.execute, 'registered bridge exposes execute');
+    const parameters = bridge.parameters;
+    assert.equal(parameters.type, 'object', 'flat bridge uses an object root for model-facing parameters');
+    assert.equal(parameters.oneOf, undefined, 'model-facing wire has no top-level oneOf');
+    assert.deepEqual(parameters.required, ['action'], 'action is the only universally required wire field');
+    assert.equal(parameters.additionalProperties, false);
+    assert.deepEqual(parameters.properties?.action?.enum, ['tools', 'call', 'errors']);
+    assert.deepEqual(parameters.properties?.tool?.enum, ['lookup', 'constructor', 'toString'], 'tool enum exposes frozen descriptor names');
+    assert.equal(parameters.properties?.arguments?.type, 'object', 'arguments remains a generic object on the open wire');
+    assert.equal(parameters.properties?.arguments?.additionalProperties, true);
+    assert.equal(Object.isFrozen(bridge.parameters), true, 'registered raw parameters are frozen');
+    assert.equal(Object.isFrozen(parameters.properties?.tool?.enum), true, 'descriptor-derived tool enum is frozen');
+    assert.throws(() => { parameters.properties?.tool?.enum.push('escape'); }, TypeError);
+    const beforeProtocolRejected = spawnSpecs.length;
+    await assert.rejects(() => bridge.execute({ query: bridgeCall('lookup', { city: 'Dubai' }) }, null), /invalid arguments/, 'legacy nested query envelope is rejected by the flat protocol');
+    await assert.rejects(() => bridge.execute({}, null), /invalid arguments/, 'empty object is rejected by the flat protocol');
+    await assert.rejects(() => bridge.execute({ action: 'tools', tool: 'lookup' }, null), /invalid arguments/, 'mixed action/tool fields are rejected by the flat protocol');
+    await assert.rejects(() => bridge.execute({ action: 'tools', arguments: {} }, null), /invalid arguments/, 'tools rejects mixed arguments');
+    await assert.rejects(() => bridge.execute({ action: 'errors', tool: 'lookup' }, null), /invalid arguments/, 'errors rejects mixed tool fields');
+    await assert.rejects(() => bridge.execute({ action: 'errors', arguments: {} }, null), /invalid arguments/, 'errors rejects mixed arguments');
+    await assert.rejects(() => bridge.execute({ ...bridgeCall('lookup', { city: 'Dubai' }), extra: true }, null), /invalid arguments/, 'extra top-level fields are rejected by the flat protocol');
+    await assert.rejects(() => bridge.execute({ action: 'call' }, null), /invalid arguments/, 'call without tool or arguments is rejected');
+    await assert.rejects(() => bridge.execute({ action: 'call', tool: 'lookup' }, null), /invalid arguments/, 'call without arguments is rejected');
+    await assert.rejects(() => bridge.execute({ action: 'call', arguments: { city: 'Dubai' } }, null), /invalid arguments/, 'call without tool is rejected');
+    await assert.rejects(() => bridge.execute(bridgeCall('lookup', { city: 'Sharjah' }), null), /invalid arguments/, 'invalid descriptor argument values are rejected by the flat protocol');
+    await assert.rejects(() => bridge.execute({ action: 'call', tool: 'lookup', arguments: {} }, null), /invalid arguments/, 'missing required descriptor arguments are rejected by the flat protocol');
+    for (const tool of ['lookup', 'constructor', 'toString']) {
+        await assert.rejects(() => bridge.execute(bridgeCall(tool, { city: 'Sharjah' }), null), /invalid arguments/, `${tool} rejects invalid descriptor arguments`);
+    }
+    assert.equal(spawnSpecs.length, beforeProtocolRejected, 'flat protocol rejections happen before spawn');
+    const args = { city: 'Dubai', payload: '$(touch /tmp/nope)' };
+    const result = await bridge.execute(bridgeCall('lookup', args), null);
+    assert.deepEqual(spawnSpecs[0]?.argv, [
+        process.execPath, '-m', 'agent_env.cli', '--lang', 'en', 'call', 'lookup', JSON.stringify(args),
+    ], 'call uses only the configured executable/prefix and fixed lookup subcommand argv');
+    assert.equal(spawnSpecs[0]?.cwd, root, 'call uses configured cwd');
+    assert.equal(spawnSpecs[0]?.stdio.stdin, 'ignore', 'call never exposes stdin');
+    assert.equal(spawnSpecs[0]?.stdio.stdout.maxBytes, 4_096, 'stdout cap comes from config');
+    assert.equal(spawnSpecs[0]?.stdio.stderr.maxBytes, 4_096, 'stderr cap comes from config');
+    assert.ok((spawnSpecs[0]?.graceMs ?? 0) > 0 && (spawnSpecs[0]?.graceMs ?? Infinity) <= 1_000, 'graceMs is bounded');
+    assert.equal(spawnSpecs[0]?.env?.GOTRY_BENCHMARK_BRIDGE_PARENT_SENTINEL, undefined, 'parent sentinel is not inherited');
+    for (const key of ['DATABASE_URL', 'SSH_AUTH_SOCK', 'AWS_PROFILE', 'HTTPS_PROXY', 'GOTRY_BENCHMARK_BRIDGE_PARENT_SENTINEL']) {
+        assert.equal(spawnSpecs[0]?.env?.[key], undefined, `${key} is tombstoned in bridge subprocess env`);
+    }
+    assert.equal(spawnSpecs[0]?.env?.PYTHONDONTWRITEBYTECODE, '1');
+    assert.equal(spawnSpecs[0]?.env?.PYTHONNOUSERSITE, '1');
+    assert.deepEqual(result, { ok: true, result: [{ city: 'Dubai' }] }, 'one-line JSON stdout becomes structured result');
+    outcomes.push({ stdout: okEnvelope({ city: 'Dubai' }) });
+    const unmappedResult = await bridge.execute(bridgeCall('toString', { city: 'Dubai' }), null);
+    assert.deepEqual(unmappedResult, { ok: true, result: { city: 'Dubai' } }, 'allowed tool without a positive mapping retains the recursive denylist only');
+    outcomes.push({ stdout: okEnvelope({ legacy: 'value' }) });
+    const legacyResult = await bridge.execute(bridgeCall('constructor', { city: 'Dubai' }), null);
+    assert.deepEqual(legacyResult, { ok: true, result: { legacy: 'value' } }, 'mapped constructor accepts its declared positive key');
+    outcomes.push({ stdout: okEnvelope({ city: 'Dubai' }) });
+    const constructorUnexpected = await bridge.execute(bridgeCall('constructor', { city: 'Dubai' }), null);
+    assert.deepEqual(constructorUnexpected, { ok: false, error: 'forbidden_output' }, 'mapped constructor rejects undeclared positive keys');
+    outcomes.push({ stdout: okEnvelope({ nested: { city: 'Dubai' } }) });
+    const nestedAllowedResult = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(nestedAllowedResult, { ok: true, result: { nested: { city: 'Dubai' } } }, 'configured positive output allowlist accepts declared nested keys');
+    outcomes.push({ stdout: okEnvelope({ city: 'Dubai', unexpected: 'secret' }) });
+    const unexpectedResult = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(unexpectedResult, { ok: false, error: 'forbidden_output' }, 'configured positive output allowlist rejects unexpected keys without reflecting them');
+    outcomes.push({ stdout: okEnvelope([{ city: 'Dubai', nested: { unexpected: 'secret' } }]) });
+    const nestedUnexpectedResult = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(nestedUnexpectedResult, { ok: false, error: 'forbidden_output' }, 'configured positive output allowlist recurses through arrays and objects');
+    for (const forbidden of [
+        'gold', 'goldAnswer', 'oracle', 'expected', 'expected_answer', 'answer', 'label',
+        'score', 'reward', 'ground_truth', 'groundTruth', 'hidden_query', 'hidden-query',
+        'loader_metadata', 'loaderMetadata', 'reference', 'gоld',
+    ]) {
+        outcomes.push({ stdout: okEnvelope({ nested: { [forbidden]: 'secret' } }) });
+        const forbiddenResult = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+        assert.deepEqual(forbiddenResult, { ok: false, error: 'forbidden_output' }, `recursive no-oracle key ${forbidden} is rejected without reflecting its name`);
+    }
+    outcomes.push({ stdout: okEnvelope('the hidden answer') });
+    const primitiveOutput = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(primitiveOutput, { ok: false, error: 'invalid_output' }, 'primitive result strings cannot bypass the structured visible-output boundary');
+    outcomes.push({ stdout: okEnvelope(['PRIVATE_ARRAY_VALUE']) });
+    const primitiveArrayOutput = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(primitiveArrayOutput, { ok: false, error: 'forbidden_output' }, 'top-level primitive arrays cannot bypass the positive output-key boundary');
+    assert.equal(JSON.stringify(primitiveArrayOutput).includes('PRIVATE_ARRAY_VALUE'), false, 'rejected primitive array values are not reflected');
+    outcomes.push({ stdout: okEnvelope([["PRIVATE_NESTED_ARRAY_VALUE"]]) });
+    const nestedPrimitiveArrayOutput = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(nestedPrimitiveArrayOutput, { ok: false, error: 'forbidden_output' }, 'nested primitive arrays without a declared-key ancestor fail closed');
+    assert.equal(JSON.stringify(nestedPrimitiveArrayOutput).includes('PRIVATE_NESTED_ARRAY_VALUE'), false, 'rejected nested primitive array values are not reflected');
+    outcomes.push({ stdout: okEnvelope([{ city: 'Dubai' }, 'PRIVATE_MIXED_ARRAY_VALUE']) });
+    const mixedArrayOutput = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(mixedArrayOutput, { ok: false, error: 'forbidden_output' }, 'a valid record cannot mask an unkeyed primitive sibling');
+    assert.equal(JSON.stringify(mixedArrayOutput).includes('PRIVATE_MIXED_ARRAY_VALUE'), false, 'rejected mixed-array primitive values are not reflected');
+    outcomes.push({ stdout: okEnvelope([]) });
+    const emptyArrayOutput = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(emptyArrayOutput, { ok: true, result: [] }, 'an empty top-level result array is an explicit non-reflecting collection');
+    outcomes.push({ stdout: okEnvelope([{ city: 'Dubai' }]) });
+    const recordArrayOutput = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(recordArrayOutput, { ok: true, result: [{ city: 'Dubai' }] }, 'top-level arrays of records remain valid when every leaf is covered by a declared key');
+    outcomes.push({ stdout: okEnvelope({ city: ['Dubai'] }) });
+    const keyedPrimitiveArrayOutput = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(keyedPrimitiveArrayOutput, { ok: true, result: { city: ['Dubai'] } }, 'primitive arrays remain valid below a declared output key');
+    const beforeOversized = spawnSpecs.length;
+    const oversized = await bridge.execute(bridgeCall('lookup', { city: 'Dubai', notes: 'x'.repeat(65_537) }), null);
+    assert.deepEqual(oversized, { ok: false, error: 'invalid_arguments', reason: 'serialization_limit' });
+    assert.equal(spawnSpecs.length, beforeOversized, 'oversized serialized arguments are rejected before spawn');
+    const beforeDeep = spawnSpecs.length;
+    let deep = {};
+    for (let index = 0; index < 13; index++)
+        deep = { next: deep };
+    await assert.rejects(() => bridge.execute(bridgeCall('lookup', { city: 'Dubai', ...deep }), null), /invalid arguments/);
+    assert.equal(spawnSpecs.length, beforeDeep, 'schema-invalid deep arguments are rejected before spawn');
+    const beforeOverride = spawnSpecs.length;
+    const overrideResult = await bridge.execute(bridgeCall('lookup', {
+        city: 'Dubai', executable: '/tmp/evil', cwd: '/tmp/evil', argv: ['--unsafe'],
+    }), null);
+    assert.deepEqual(spawnSpecs[beforeOverride]?.argv, [
+        process.execPath, '-m', 'agent_env.cli', '--lang', 'en', 'call', 'lookup', JSON.stringify({
+            city: 'Dubai', executable: '/tmp/evil', cwd: '/tmp/evil', argv: ['--unsafe'],
+        }),
+    ], 'model executable/cwd/argv fields remain data and cannot override config');
+    assert.equal(overrideResult.ok, true, 'override-shaped arguments still use the configured bridge');
+    outcomes.push({ stdout: okEnvelope({ city: 'Dubai' }), lossy: true });
+    const truncated = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(truncated, { ok: false, error: 'output_truncated' }, 'lossy stdout is rejected without parsing partial output');
+    outcomes.push({ stdout: okEnvelope({ city: 'Dubai' }), stderr: 'private runner diagnostic', exitCode: 17, signal: 'SIGTERM' });
+    const failed = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(failed, { ok: false, error: 'runner_failed', exit_code: 17, signal: 'SIGTERM' }, 'nonzero runner result is structured without stderr echo');
+    // The bridge protocol/infrastructure failure vocabulary is distinct from
+    // per-tool domain outcomes and remains discoverable through action=errors.
+    const errorsTable = await bridge.execute({ action: 'errors' }, null);
+    assert.ok(errorsTable.ok === true && errorsTable.errors, 'bridge failure contract is discoverable');
+    for (const code of ['invalid_action', 'disallowed_tool', 'invalid_arguments', 'timed_out', 'output_truncated', 'invalid_json', 'invalid_output', 'runner_failed', 'spawn_failed', 'forbidden_output']) {
+        const row = errorsTable.errors?.[code];
+        assert.ok(row && typeof row.recoverable === 'boolean' && row.remedy.length > 0, `failure contract contains ${code} with recovery guidance`);
+    }
+    assert.equal(errorsTable.errors?.invalid_arguments?.recoverable, true, 'invalid caller arguments are recoverable');
+    assert.equal(errorsTable.errors?.forbidden_output?.recoverable, false, 'policy-boundary output is not recoverable');
+    assert.deepEqual(errorsTable, { ok: true, errors: BRIDGE_ERROR_CONTRACT }, 'errors action returns the exact closed failure contract');
+    const toolsTable = await bridge.execute({ action: 'tools' }, null);
+    assert.deepEqual(toolsTable, {
+        ok: true,
+        tools: [
+            { name: 'lookup', description: 'Lookup one declared city.', input_schema: lookupInputSchema(), output_keys: ['city', 'nested'], domain_outcomes: [{ status: 'miss', code: 'NOT_FOUND', recovery: 'revise_arguments' }, { status: 'error', code: 'AMBIGUOUS', recovery: 'choose_alternative' }] },
+            { name: 'constructor', description: 'Construct one declared city.', input_schema: lookupInputSchema(), output_keys: ['legacy'], domain_outcomes: [{ status: 'error', code: 'INVALID', recovery: 'retry_same' }] },
+            { name: 'toString', description: 'Stringify one declared city.', input_schema: lookupInputSchema(), output_keys: ['city', 'nested'], domain_outcomes: [] },
+        ],
+    }, 'tools action returns every exact frozen descriptor, including its input schema');
+    for (const stdout of ['not-json', '{"result":1}{"result":2}']) {
+        outcomes.push({ stdout });
+        const malformed = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+        assert.deepEqual(malformed, { ok: false, error: 'invalid_json' }, 'malformed or multi-value JSON is rejected');
+    }
+    outcomes.push({ stdout: JSON.stringify({ schema_version: BENCHMARK_TOOL_RESULT_SCHEMA_VERSION, status: 'miss', code: 'NOT_FOUND', recovery: 'revise_arguments' }) });
+    const miss = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(miss, { ok: true, outcome: { schema_version: BENCHMARK_TOOL_RESULT_SCHEMA_VERSION, status: 'miss', code: 'NOT_FOUND', recovery: 'revise_arguments' } }, 'exit-zero domain miss is a successful typed outcome');
+    outcomes.push({ stdout: JSON.stringify({ schema_version: BENCHMARK_TOOL_RESULT_SCHEMA_VERSION, status: 'error', code: 'AMBIGUOUS', recovery: 'choose_alternative' }) });
+    const domainError = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(domainError, { ok: true, outcome: { schema_version: BENCHMARK_TOOL_RESULT_SCHEMA_VERSION, status: 'error', code: 'AMBIGUOUS', recovery: 'choose_alternative' } }, 'declared exit-zero domain error is transport success');
+    for (const invalidEnvelope of [
+        { schema_version: 'legacy', status: 'miss', code: 'NOT_FOUND', recovery: 'revise_arguments' },
+        { schema_version: BENCHMARK_TOOL_RESULT_SCHEMA_VERSION, status: 'miss', code: 'UNKNOWN', recovery: 'revise_arguments' },
+        { schema_version: BENCHMARK_TOOL_RESULT_SCHEMA_VERSION, status: 'miss', code: 'NOT_FOUND', recovery: 'retry_same' },
+        { schema_version: BENCHMARK_TOOL_RESULT_SCHEMA_VERSION, status: 'error', code: 'AMBIGUOUS', recovery: 'choose_alternative', message: 'private free text' },
+    ]) {
+        outcomes.push({ stdout: JSON.stringify(invalidEnvelope) });
+        assert.deepEqual(await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null), { ok: false, error: 'invalid_output' }, 'undeclared or non-exact domain envelope fails closed');
+    }
+    outcomes.push({ stdout: JSON.stringify({ result: { city: 'Dubai' } }) });
+    assert.deepEqual(await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null), { ok: false, error: 'invalid_output' }, 'legacy versionless result envelope is rejected');
+    outcomes.push({ stdout: JSON.stringify({ schema_version: BENCHMARK_TOOL_RESULT_SCHEMA_VERSION, status: 'miss', code: 'NOT_FOUND', recovery: 'revise_arguments' }), exitCode: 23 });
+    assert.deepEqual(await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null), { ok: false, error: 'runner_failed', exit_code: 23, signal: null }, 'nonzero exit remains infrastructure failure even when stdout resembles a domain envelope');
+    outcomes.push({ spawnError: true });
+    const spawnFailed = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(spawnFailed, { ok: false, error: 'spawn_failed' }, 'spawn infrastructure failure is structured');
+    outcomes.push({ spawnReject: true });
+    const asyncSpawnFailed = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(asyncSpawnFailed, { ok: false, error: 'spawn_failed' }, 'public done rejection is classified as spawn/provider failure');
+    outcomes.push({ stdout: okEnvelope({ city: 'Dubai' }), readFailure: true });
+    const postSuccessCollectFailed = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(postSuccessCollectFailed, { ok: false, error: 'runner_failed', exit_code: 0, signal: null }, 'collected output reading failure after a resolved done is runner_failed, not spawn_failed');
+    outcomes.push({ waitForAbort: true });
+    const timedOut = await bridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null);
+    assert.deepEqual(timedOut, { ok: false, error: 'timed_out' }, 'deadline abort is surfaced as timed_out');
+    assert.equal(timeoutSignal?.aborted, true, 'timeout abort signal is fired');
+    const beforeInvalidArgs = spawnSpecs.length;
+    await assert.rejects(() => bridge.execute(bridgeCall('lookup', ['not', 'plain']), null), /invalid arguments/);
+    assert.equal(spawnSpecs.length, beforeInvalidArgs, 'non-object arguments are rejected before spawn');
+    for (const [label, argumentsValue] of [
+        ['missing required city', {}],
+        ['wrong city type', { city: 7 }],
+        ['undeclared country', { city: 'Dubai', country: 'AE' }],
+    ]) {
+        await assert.rejects(() => bridge.execute(bridgeCall('lookup', argumentsValue), null), /invalid arguments/, `${label} is rejected by the descriptor-derived runtime validator`);
+    }
+    assert.equal(spawnSpecs.length, beforeInvalidArgs, 'required, type, and closed-object argument failures all happen before spawn');
+    await assert.rejects(() => bridge.execute({ action: 'inspect' }, null), /invalid arguments/);
+    const beforeRejected = spawnSpecs.length;
+    await assert.rejects(() => bridge.execute(bridgeCall('delete_all', {}), null), /invalid arguments/);
+    assert.equal(spawnSpecs.length, beforeRejected, 'disallowed tool is rejected before spawn');
+    const spacedConfigPath = join(root, ' benchmark-environment-config.json ');
+    writeFileSync(spacedConfigPath, readFileSync(configPath));
+    const spacedTools = [];
+    const spacedCtx = {
+        tools: {
+            register(tool) { spacedTools.push(tool); return () => { }; },
+            get(name) { return spacedTools.find(tool => tool.name === name); },
+            schemas() { return spacedTools.map(tool => ({ name: tool.name })); },
+        },
+        agents: { list() { return []; } },
+        systemPrompt: { variable() { } },
+        on() { return () => { }; },
+        effect() { return () => { }; },
+        get(name) {
+            if (name === 'subprocess')
+                return { spawn: (_spec) => fakeHandle({ stdout: '{}' }) };
+            if (name === 'agents')
+                return { list() { return []; } };
+            return undefined;
+        },
+    };
+    apply(spacedCtx, {
+        stateRoot: root, timeoutMs: 20, hbcliBin: '', sessionAccess: 'off', benchmarkEnvironmentConfigPath: spacedConfigPath,
+    });
+    assert.deepEqual(spacedTools.map(tool => tool.name), ['gotry_benchmark_environment'], 'benchmark bridge loads a valid raw path with whitespace basename');
+    const disabled = [];
+    const disabledVariables = [];
+    const disabledCtx = {
+        tools: { register(tool) { disabled.push(tool); return () => { }; } },
+        systemPrompt: { variable(name) { disabledVariables.push(name); } },
+    };
+    apply(disabledCtx, {
+        stateRoot: root, timeoutMs: 1_000, hbcliBin: '', sessionAccess: 'off', benchmarkEnvironmentConfigPath: '',
+    });
+    assert.equal(disabled.some(tool => tool.name === 'gotry_benchmark_environment'), false, 'empty config path keeps bridge default-off');
+    assert.ok(disabled.length > 1, 'normal product mode keeps the full GoTry tool catalog');
+    assert.deepEqual(disabledVariables, ['current_date', 'time_anchor_card', 'motivation_brief', 'channel_routing_card'], 'normal product mode keeps its prompt variables');
+    const whitespace = [];
+    const whitespaceCtx = {
+        tools: { register(tool) { whitespace.push(tool); return () => { }; } },
+        systemPrompt: { variable() { } },
+    };
+    apply(whitespaceCtx, {
+        stateRoot: root, timeoutMs: 1_000, hbcliBin: '', sessionAccess: 'off', benchmarkEnvironmentConfigPath: '   \t  ',
+    });
+    assert.equal(whitespace.some(tool => tool.name === 'gotry_benchmark_environment'), false, 'whitespace config path keeps benchmark mode default-off');
+    assert.ok(whitespace.length > 1, 'whitespace path preserves the ordinary product tool catalog');
+    const originalModelOverride = process.env.GOTRY_LLM_MODEL;
+    process.env.GOTRY_LLM_MODEL = 'round7-model-preserved';
+    try {
+        const modelTools = [];
+        let modelRequest;
+        const modelEvents = [];
+        const modelCtx = {
+            tools: {
+                register(tool) { modelTools.push(tool); return () => { }; },
+                get(name) { return modelTools.find(tool => tool.name === name); },
+                schemas() { return modelTools.map(tool => ({ name: tool.name })); },
+            },
+            agents: { list() { return []; } },
+            systemPrompt: { variable() { } },
+            on(event, listener) {
+                modelEvents.push(event);
+                if (event === 'agent/request')
+                    modelRequest = listener;
+                return () => { };
+            },
+            effect() { return () => { }; },
+            get(name) {
+                if (name === 'subprocess')
+                    return { spawn: (_spec) => fakeHandle({ stdout: '{}' }) };
+                if (name === 'agents')
+                    return { list() { return []; } };
+                return undefined;
+            },
+        };
+        apply(modelCtx, {
+            stateRoot: root, timeoutMs: 20, hbcliBin: '', sessionAccess: 'off', benchmarkEnvironmentConfigPath: configPath,
+        });
+        assert.deepEqual(modelTools.map(tool => tool.name), ['gotry_benchmark_environment'], 'benchmark model override does not re-enable product tools');
+        assert.ok(modelEvents.includes('agent/request'), 'benchmark mode preserves the model override hook');
+        assert.ok(modelRequest);
+        assert.deepEqual(await modelRequest({}, async () => ({ provider: 'persisted', model: 'old', reasoningEffort: 'high', marker: 'kept' })), { provider: 'deepseek-official', model: 'round7-model-preserved', marker: 'kept' }, 'benchmark model override remains effective and replaces the persisted model only');
+    }
+    finally {
+        if (originalModelOverride === undefined)
+            delete process.env.GOTRY_LLM_MODEL;
+        else
+            process.env.GOTRY_LLM_MODEL = originalModelOverride;
+    }
+    const validConfig = {
+        schema_version: 'gotry_benchmark_environment_bridge_v4',
+        enabled: true,
+        executable: process.execPath,
+        cwd: root,
+        argv_prefix: ['-m', 'agent_env.cli', '--lang', 'en'],
+        tools: [{
+                name: 'lookup',
+                description: 'Lookup one declared city.',
+                input_schema: {
+                    type: 'object',
+                    properties: {
+                        city: { type: 'string', enum: ['Dubai', 'Abu Dhabi'], description: 'Declared city name.' },
+                    },
+                    required: ['city'],
+                    additionalProperties: false,
+                },
+                output_keys: ['city'],
+                domain_outcomes: [{ status: 'miss', code: 'NOT_FOUND', recovery: 'revise_arguments' }],
+            }],
+        timeout_ms: 20,
+        max_output_bytes: 4_096,
+        terminal_output: { tag: 'done', max_bytes: 4_096, body_schema: OK_BODY_SCHEMA },
+        isolation: { mode: 'host-enforced', writes: 'forbidden', network: 'denied' },
+    };
+    const clonedConfig = () => JSON.parse(JSON.stringify(validConfig));
+    const configWithTool = (mutate) => {
+        const config = clonedConfig();
+        mutate(config.tools[0]);
+        return config;
+    };
+    const nestedInputSchema = (objectLevels) => {
+        let child = { type: 'string' };
+        for (let index = 0; index < objectLevels; index += 1) {
+            child = {
+                type: 'object',
+                properties: { next: child },
+                required: ['next'],
+                additionalProperties: false,
+            };
+        }
+        return child;
+    };
+    const flatInputSchema = (count) => ({
+        type: 'object',
+        properties: Object.fromEntries(Array.from({ length: count }, (_, index) => [`p${index}`, { type: 'string' }])),
+        required: [],
+        additionalProperties: false,
+    });
+    const totalEnumInputSchema = (groups) => ({
+        type: 'object',
+        properties: Object.fromEntries(Array.from({ length: groups }, (_, group) => [
+            `e${group}`,
+            { type: 'string', enum: Array.from({ length: 64 }, (_, index) => `v${group}_${index}`) },
+        ])),
+        required: [],
+        additionalProperties: false,
+    });
+    const byteSizedInputSchema = (targetBytes) => {
+        const properties = Object.fromEntries(Array.from({ length: 64 }, (_, index) => [
+            `b${index}`,
+            { type: 'string', description: '' },
+        ]));
+        const schema = { type: 'object', properties, required: [], additionalProperties: false };
+        let remaining = targetBytes - Buffer.byteLength(JSON.stringify(schema), 'utf8');
+        assert.ok(remaining >= 0 && remaining <= 64 * 512, 'byte-boundary fixture has enough bounded description capacity');
+        for (const property of Object.values(properties)) {
+            const added = Math.min(512, remaining);
+            property.description = 'x'.repeat(added);
+            remaining -= added;
+        }
+        assert.equal(remaining, 0, 'byte-boundary fixture reaches the requested serialized size');
+        assert.equal(Buffer.byteLength(JSON.stringify(schema), 'utf8'), targetBytes);
+        return schema;
+    };
+    const frozenProjection = registerBenchmarkEnvironmentBridge(configPath, () => { }, {
+        spawn: (_spec) => fakeHandle({ stdout: '{"result":{}}' }),
+    });
+    assert.equal(Object.isFrozen(frozenProjection), true, 'bridge projection is frozen');
+    assert.equal(Object.isFrozen(frozenProjection.allowedTools), true, 'projected allowlist is frozen');
+    assert.equal(Object.isFrozen(frozenProjection.terminal), true, 'projected terminal contract is frozen');
+    assert.throws(() => { frozenProjection.allowedTools.push('escape'); }, TypeError);
+    assert.throws(() => { frozenProjection.terminal.tag = 'escape'; }, TypeError);
+    const bridgeRegistrationFor = (config, withSubprocess = true) => {
+        const path = join(root, `config-${Math.random().toString(36).slice(2)}.json`);
+        writeFileSync(path, JSON.stringify(config));
+        const tools = [];
+        const freshCtx = {
+            tools: { register(tool) { tools.push(tool); return () => { }; }, get(name) { return tools.find(tool => tool.name === name); }, schemas() { return tools.map(tool => ({ name: tool.name })); } },
+            systemPrompt: { variable() { } },
+            on() { return () => { }; },
+            effect(action) { return runEffect(action); },
+            agents: { list() { return []; } },
+            get(name) {
+                if (name === 'subprocess')
+                    return this.subprocess;
+                if (name === 'agents')
+                    return this.agents;
+            },
+            ...(withSubprocess ? { subprocess: { spawn: (_spec) => fakeHandle({ stdout: '{"result":{}}' }) } } : {}),
+        };
+        apply(freshCtx, {
+            stateRoot: root, timeoutMs: 20, hbcliBin: '', sessionAccess: 'off', benchmarkEnvironmentConfigPath: path,
+        });
+        return tools.some(tool => tool.name === 'gotry_benchmark_environment');
+    };
+    assert.throws(() => bridgeRegistrationFor({ ...validConfig, unknown: true }), /benchmark environment bridge configuration unavailable/, 'unknown top-level config key fails hard');
+    assert.throws(() => bridgeRegistrationFor({
+        ...validConfig,
+        tools: [{ ...validConfig.tools[0], input_schema: { type: 'object' } }],
+    }), /benchmark environment bridge configuration unavailable/, 'v3 rejects an open annotation-only input schema');
+    assert.throws(() => bridgeRegistrationFor({ ...validConfig, schema_version: 'gotry_benchmark_environment_bridge_v1' }), /benchmark environment bridge configuration unavailable/, 'v1 config cannot silently omit the Round 3 terminal semantics');
+    assert.throws(() => bridgeRegistrationFor({ ...validConfig, schema_version: 'gotry_benchmark_environment_bridge_v3' }), /benchmark environment bridge configuration unavailable/, 'v3 config cannot silently omit the Round 12 terminal body schema (#215)');
+    assert.throws(() => bridgeRegistrationFor({ ...validConfig, terminal_output: { ...validConfig.terminal_output, body_schema: { ...validConfig.terminal_output.body_schema, additionalProperties: true } } }), /benchmark environment bridge configuration unavailable/, 'non-closed terminal body schema fails the config load closed');
+    assert.throws(() => bridgeRegistrationFor({ ...validConfig, tools: [validConfig.tools[0], validConfig.tools[0]] }), /benchmark environment bridge configuration unavailable/, 'duplicate tool descriptor fails hard');
+    assert.throws(() => bridgeRegistrationFor(configWithTool(tool => { delete tool.output_keys; })), /benchmark environment bridge configuration unavailable/, 'missing output_keys fails hard');
+    assert.throws(() => bridgeRegistrationFor(configWithTool(tool => { tool.output_keys = []; })), /benchmark environment bridge configuration unavailable/, 'empty output allowlist fails closed at registration');
+    assert.throws(() => bridgeRegistrationFor(configWithTool(tool => { tool.output_keys = ['city', 'city']; })), /benchmark environment bridge configuration unavailable/, 'duplicate output key fails hard');
+    assert.throws(() => bridgeRegistrationFor(configWithTool(tool => { tool.output_keys = ['not a key']; })), /benchmark environment bridge configuration unavailable/, 'non-identifier output key fails hard');
+    assert.throws(() => bridgeRegistrationFor(configWithTool(tool => { delete tool.domain_outcomes; })), /benchmark environment bridge configuration unavailable/, 'missing domain_outcomes fails hard');
+    assert.throws(() => bridgeRegistrationFor(configWithTool(tool => { tool.domain_outcomes = [{ status: 'unknown', code: 'NOT_FOUND', recovery: 'none' }]; })), /benchmark environment bridge configuration unavailable/, 'unknown domain status fails hard');
+    assert.throws(() => bridgeRegistrationFor(configWithTool(tool => { tool.domain_outcomes = [{ status: 'miss', code: 'NOT_FOUND', recovery: 'free_text' }]; })), /benchmark environment bridge configuration unavailable/, 'free-text domain recovery fails hard');
+    assert.throws(() => bridgeRegistrationFor(configWithTool(tool => { tool.domain_outcomes = [{ status: 'miss', code: 'NOT_FOUND', recovery: 'none' }, { status: 'error', code: 'NOT_FOUND', recovery: 'none' }]; })), /benchmark environment bridge configuration unavailable/, 'duplicate domain code fails hard');
+    assert.throws(() => bridgeRegistrationFor(configWithTool(tool => { tool.name = 'lookup;rm'; })), /benchmark environment bridge configuration unavailable/, 'shell metacharacter tool identifier fails hard');
+    for (const [label, schema] of [
+        ['reference keyword', { type: 'object', properties: { city: { $ref: '#/city' } }, required: ['city'], additionalProperties: false }],
+        ['default keyword', { type: 'object', properties: { city: { type: 'string', default: 'Dubai' } }, required: ['city'], additionalProperties: false }],
+        ['examples keyword', { type: 'object', properties: { city: { type: 'string', examples: ['Dubai'] } }, required: ['city'], additionalProperties: false }],
+        ['unknown keyword', { type: 'object', properties: { city: { type: 'string', title: 'City' } }, required: ['city'], additionalProperties: false }],
+        ['open nested object', { type: 'object', properties: { nested: { type: 'object', properties: {}, required: [] } }, required: ['nested'], additionalProperties: false }],
+        ['array without items', { type: 'object', properties: { values: { type: 'array' } }, required: ['values'], additionalProperties: false }],
+        ['duplicate required', { type: 'object', properties: { city: { type: 'string' } }, required: ['city', 'city'], additionalProperties: false }],
+        ['unknown required', { type: 'object', properties: { city: { type: 'string' } }, required: ['country'], additionalProperties: false }],
+        ['type-mismatched enum', { type: 'object', properties: { city: { type: 'string', enum: ['Dubai', 7] } }, required: ['city'], additionalProperties: false }],
+        ['duplicate enum', { type: 'object', properties: { city: { type: 'string', enum: ['Dubai', 'Dubai'] } }, required: ['city'], additionalProperties: false }],
+    ]) {
+        assert.throws(() => bridgeRegistrationFor(configWithTool(tool => { tool.input_schema = schema; })), /benchmark environment bridge configuration unavailable/, `${label} fails closed`);
+    }
+    assert.equal(bridgeRegistrationFor(configWithTool(tool => { tool.input_schema = nestedInputSchema(8); })), true, 'schema depth eight is accepted');
+    assert.throws(() => bridgeRegistrationFor(configWithTool(tool => { tool.input_schema = nestedInputSchema(9); })), /benchmark environment bridge configuration unavailable/, 'schema depth nine is rejected');
+    assert.equal(bridgeRegistrationFor(configWithTool(tool => { tool.input_schema = flatInputSchema(255); })), true, 'the 256-node total boundary is accepted');
+    assert.throws(() => bridgeRegistrationFor(configWithTool(tool => { tool.input_schema = flatInputSchema(256); })), /benchmark environment bridge configuration unavailable/, 'the 256-node total boundary plus one is rejected');
+    assert.throws(() => bridgeRegistrationFor(configWithTool(tool => { tool.input_schema = flatInputSchema(257); })), /benchmark environment bridge configuration unavailable/, 'the property total bound rejects 257 properties');
+    assert.equal(bridgeRegistrationFor(configWithTool(tool => { tool.input_schema = totalEnumInputSchema(4); })), true, 'the 256-enum-value total boundary is accepted');
+    assert.throws(() => bridgeRegistrationFor(configWithTool(tool => { tool.input_schema = totalEnumInputSchema(5); })), /benchmark environment bridge configuration unavailable/, 'the enum-value total bound rejects values above 256');
+    assert.equal(bridgeRegistrationFor(configWithTool(tool => { tool.input_schema = byteSizedInputSchema(16 * 1024); })), true, 'the 16 KiB schema boundary is accepted');
+    assert.throws(() => bridgeRegistrationFor(configWithTool(tool => { tool.input_schema = byteSizedInputSchema(16 * 1024 + 1); })), /benchmark environment bridge configuration unavailable/, 'the schema byte boundary plus one is rejected');
+    assert.throws(() => bridgeRegistrationFor({ ...validConfig, argv_prefix: ['agent\n--unsafe'] }), /benchmark environment bridge configuration unavailable/, 'argv control separator fails hard');
+    assert.throws(() => bridgeRegistrationFor({ ...validConfig, isolation: { mode: 'host-enforced', writes: 'forbidden' } }), /benchmark environment bridge configuration unavailable/, 'incomplete isolation policy fails hard');
+    const { terminal_output: _terminalOutput, ...missingTerminalConfig } = validConfig;
+    assert.throws(() => bridgeRegistrationFor(missingTerminalConfig), /benchmark environment bridge configuration unavailable/, 'terminal output contract is required');
+    assert.throws(() => bridgeRegistrationFor({ ...validConfig, terminal_output: { tag: '1invalid', max_bytes: 4_096 } }), /benchmark environment bridge configuration unavailable/, 'terminal tag must be an identifier');
+    assert.throws(() => bridgeRegistrationFor({ ...validConfig, terminal_output: { tag: 'done', max_bytes: 0 } }), /benchmark environment bridge configuration unavailable/, 'terminal output lower bound fails hard');
+    assert.throws(() => bridgeRegistrationFor({ ...validConfig, terminal_output: { tag: 'done', max_bytes: 1024 * 1024 + 1 } }), /benchmark environment bridge configuration unavailable/, 'terminal output upper bound fails hard');
+    assert.throws(() => bridgeRegistrationFor({ ...validConfig, terminal_output: { tag: 'done', max_bytes: 4_096, extra: true } }), /benchmark environment bridge configuration unavailable/, 'terminal output rejects unknown keys');
+    assert.throws(() => bridgeRegistrationFor(validConfig, false), /benchmark environment bridge subprocess unavailable/, 'explicit opt-in without an active subprocess provider fails hard');
+    assert.equal(loadConfigRegistration(configPath, root), true, 'owner-local regular 0644 config remains valid');
+    assert.throws(() => loadConfigRegistration('bridge.json', root), /benchmark environment bridge configuration unavailable/, 'relative config path fails hard');
+    const symlinkPath = join(root, 'bridge-symlink.json');
+    symlinkSync(configPath, symlinkPath);
+    assert.equal(lstatSync(symlinkPath).isSymbolicLink(), true);
+    assert.throws(() => loadConfigRegistration(symlinkPath, root), /benchmark environment bridge configuration unavailable/, 'symlink config path fails hard');
+    const widePath = join(root, 'bridge-wide.json');
+    writeFileSync(widePath, JSON.stringify(validConfig));
+    chmodSync(widePath, 0o666);
+    assert.throws(() => loadConfigRegistration(widePath, root), /benchmark environment bridge configuration unavailable/, 'group/world writable config fails hard');
+    const strictConfigPath = join(root, 'strict-bridge.json');
+    writeFileSync(strictConfigPath, JSON.stringify(validConfig));
+    const strictTools = [];
+    const strictCtx = {
+        tools: { register(tool) { strictTools.push(tool); return () => { }; }, get(name) { return strictTools.find(tool => tool.name === name); }, schemas() { return strictTools.map(tool => ({ name: tool.name })); } },
+        systemPrompt: { variable() { } },
+        on() { return () => { }; },
+        effect(_action) { return () => { }; },
+        agents: { list() { return []; } },
+        get(name) {
+            if (name === 'subprocess')
+                return this.subprocess;
+            if (name === 'agents')
+                return this.agents;
+        },
+        subprocess: { spawn: (_spec) => fakeHandle({ stdout: okEnvelope({ city: 'Dubai' }) }) },
+    };
+    apply(strictCtx, {
+        stateRoot: root, timeoutMs: 20, hbcliBin: '', sessionAccess: 'off', benchmarkEnvironmentConfigPath: strictConfigPath,
+    });
+    const strictBridge = strictTools.find(tool => tool.name === 'gotry_benchmark_environment');
+    assert.ok(strictBridge?.execute, 'strict v3 config registers the bridge');
+    assert.deepEqual(await strictBridge.execute(bridgeCall('lookup', { city: 'Dubai' }), null), { ok: true, result: { city: 'Dubai' } }, 'strict v3 result envelope executes safe structured output');
+    console.log('BENCHMARK ENVIRONMENT BRIDGE TESTS: registration + TDD bridge contract assertions');
+}
+catch (error) {
+    console.error(error);
+    process.exitCode = 1;
+}
+finally {
+    for (const [name, value] of ambientSentinels) {
+        if (value === undefined)
+            delete process.env[name];
+        else
+            process.env[name] = value;
+    }
+    rmSync(root, { recursive: true, force: true });
+}
+function loadConfigRegistration(path, stateRoot) {
+    const tools = [];
+    const freshCtx = {
+        tools: { register(tool) { tools.push(tool); return () => { }; }, get(name) { return tools.find(tool => tool.name === name); }, schemas() { return tools.map(tool => ({ name: tool.name })); } },
+        systemPrompt: { variable() { } },
+        agents: { list() { return []; } },
+        on() { return () => { }; },
+        effect(_action) { return () => { }; },
+        get(name) {
+            if (name === 'subprocess')
+                return this.subprocess;
+            if (name === 'agents')
+                return this.agents;
+        },
+        subprocess: { spawn: (_spec) => fakeHandle({ stdout: '{"result":{}}' }) },
+    };
+    apply(freshCtx, {
+        stateRoot, timeoutMs: 20, hbcliBin: '', sessionAccess: 'off', benchmarkEnvironmentConfigPath: path,
+    });
+    return tools.some(tool => tool.name === 'gotry_benchmark_environment');
+}