@orkestrel/study 0.0.2 → 0.0.3

package/dist/src/server/index.js

@@ -1,15 +1,17 @@
 import { createRequire, isBuiltin, registerHooks, stripTypeScriptTypes } from "node:module";
-import { STUDY_CAUSES, STUDY_LAYERS, STUDY_ROLES, StudyControl, StudyDeadline, StudyError, StudySeries, buildStudyAgentDispatch, buildStudyAgentParts, buildStudySchedule, computeStudyScores, failStudyTicket, failureToStudyError, isStudyAgentGauge, isStudyBounds, isStudyCause, isStudyDefinition, isStudyDigest, isStudyError, isStudyGoal, isStudyJudgment, isStudyName, isStudyProduct, isStudyProfile, isStudyRole, isStudyRubric, isStudyScenario, isStudyStop, isStudyTimestamp, isStudyUsage, matchesStudyKeys, parseStudyDefinition, parseStudyGrading, parseStudyLabeling, parseStudyProfile, parseStudyReading, parseStudyRubric, parseStudyScenario, projectStudyAgentRequest, readStudyFailure, studyStopToJSON, translateStudyAgentError, validateStudyAgentUsage, validateStudyInputs } from "../core/index.js";
-import { arrayOf, attempt, canonicalStringify, cloneJSONValue, holds, isArray, isError, isInstance, isInteger, isJSONValue, isNonEmptyString, isObject, isRecord, isString, parseJSON } from "@orkestrel/contract";
+import { STUDY_CAUSES, STUDY_LAYERS, STUDY_NAME, STUDY_ROLES, StudyControl, StudyDeadline, StudyError, StudyMeter, StudyScope, StudySeries, buildStudyAgentDispatch, buildStudyAgentParts, buildStudySchedule, computeStudyScores, failStudyTicket, failureToStudyError, isStudyAgentGauge, isStudyBounds, isStudyCause, isStudyDefinition, isStudyDigest, isStudyError, isStudyGoal, isStudyJudgment, isStudyName, isStudyProduct, isStudyProfile, isStudyRecord, isStudyRole, isStudyRubric, isStudyScenario, isStudyStop, isStudyTimestamp, isStudyUsage, matchesStudyKeys, parseStudyDefinition, parseStudyGrading, parseStudyLabeling, parseStudyProfile, parseStudyReading, parseStudyRubric, parseStudyScenario, projectStudyAgentRequest, readStudyFailure, studyStopToJSON, translateStudyAgentError, validateStudyAgentUsage, validateStudyInputs } from "../core/index.js";
+import { INTRINSICS, arrayOf, attempt, canonicalStringify, cloneJSONValue, holds, isArray, isError, isFunction, isInteger, isJSONValue, isNonEmptyString, isObject, isRecord, isString, parseJSON } from "@orkestrel/contract";
 import { createHash, randomUUID } from "node:crypto";
 import { basename, dirname, extname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
-import { closeSync, constants, existsSync, fstatSync, lstatSync, openSync, opendirSync, readFileSync, readSync, realpathSync } from "node:fs";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, opendirSync, readFileSync, readSync, realpathSync } from "node:fs";
+import { lstat, mkdir, mkdtemp, open, readdir, rm, writeFile } from "node:fs/promises";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { lstat, mkdir, mkdtemp, open, readdir, rm } from "node:fs/promises";
 import { execFile, execFileSync, fork, spawn } from "node:child_process";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { isToolCall } from "@orkestrel/tool";
 import { isBudgetError } from "@orkestrel/budget";
+import { Abort } from "@orkestrel/abort";
+import { MAX_TIMEOUT_MS } from "@orkestrel/timeout";
 //#region src/server/helpers.ts
 /** Reports whether a caught value is a Node error carrying the given system code.
 * @remarks Requires an `Error` from this realm. Structured cloning, such as a worker's `postMessage`,
@@ -92,6 +94,40 @@ var STUDY_RESERVED_NAME = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])$/i;
 /** Discloses the limits of neutral identifiers when public text remains visible. */
 var STUDY_PACKET_DISCLOSURE = "Identifiers omit treatment and model names. Input and product text may still reveal design details.";
 //#endregion
+//#region src/server/ollama/validators.ts
+/** Checks whether a value declares independent positive metadata allowances.
+* @param value - The untrusted metadata declaration.
+* @returns True if the declaration has positive safe calls and bytes and finite duration; false otherwise.
+*/
+function isStudyOllamaMetadata(value) {
+	return holds(() => isRecord(value) && typeof value.calls === "number" && Number.isSafeInteger(value.calls) && value.calls > 0 && typeof value.bytes === "number" && Number.isSafeInteger(value.bytes) && value.bytes > 0 && typeof value.duration === "number" && Number.isFinite(value.duration) && value.duration > 0);
+}
+/** Checks whether a value pins a served model name and SHA-256 digest.
+* @param value - The untrusted model pin.
+* @returns True if the value declares a nonempty name and lowercase SHA-256 digest; false otherwise.
+*/
+function isStudyOllamaModel(value) {
+	return holds(() => isRecord(value) && typeof value.name === "string" && value.name.length > 0 && typeof value.digest === "string" && /^[a-f0-9]{64}$/.test(value.digest));
+}
+/** Checks whether a value declares a complete finite model-generation policy.
+* @param value - The untrusted role policy.
+* @returns True if every policy member and output allowance is valid; false otherwise.
+*/
+function isStudyOllamaPolicy(value) {
+	return holds(() => isRecord(value) && typeof value.model === "string" && value.model.length > 0 && typeof value.think === "boolean" && typeof value.strict === "boolean" && typeof value.length === "boolean" && isRecord(value.options) && Object.values(value.options).every((entry) => typeof entry === "number" && Number.isFinite(entry)) && typeof value.options.num_predict === "number" && Number.isSafeInteger(value.options.num_predict) && value.options.num_predict > 0);
+}
+/** Checks whether a value declares exclusive exact or capture admission with a valid receipt.
+* @param value - The untrusted ordered step.
+* @returns True if identity, policy, admission shape and exact receipt are valid; false otherwise.
+*/
+function isStudyOllamaStep(value) {
+	return holds(() => {
+		if (!isRecord(value) || typeof value.ordinal !== "number" || !Number.isSafeInteger(value.ordinal) || value.ordinal <= 0 || typeof value.goal !== "string" || !STUDY_NAME.test(value.goal) || value.role !== "agent" && value.role !== "summary" && value.role !== "judge" || value.path !== (value.role === "judge" ? "/api/generate" : "/api/chat") || !isStudyOllamaPolicy(value.policy) || value.role === "judge" && value.policy.strict) return false;
+		if (value.admission === "capture") return typeof value.bytes === "number" && Number.isSafeInteger(value.bytes) && value.bytes > 0 && !Object.hasOwn(value, "body") && !Object.hasOwn(value, "input");
+		return value.admission === "exact" && typeof value.body === "string" && value.body.length > 0 && typeof value.input === "string" && value.input === hashStudyBytes(value.body) && !Object.hasOwn(value, "bytes");
+	});
+}
+//#endregion
 //#region src/server/stores/validators.ts
 /**
 * Checks whether a trial name is portable on all supported hosts.
@@ -125,7 +161,7 @@ function isStudyCustodyManifest(value) {
 			"schedule",
 			"bounds",
 			"host"
-		], ["qualification"]) || !isStudyCustodyName(value.id) || !isStudyTimestamp(value.created) || !isStudyDefinition(value.definition) || !isArray(value.scenarios) || !value.scenarios.every(isStudyScenario) || !isStudyBounds(value.bounds) || !isRecord(value.identity) || !matchesStudyKeys(value.identity, [
+		], ["qualification", "record"]) || !isStudyCustodyName(value.id) || !isStudyTimestamp(value.created) || !isStudyDefinition(value.definition) || !isArray(value.scenarios) || !value.scenarios.every(isStudyScenario) || !isStudyBounds(value.bounds) || value.record !== void 0 && !isStudyRecord(value.record) || !isRecord(value.identity) || !matchesStudyKeys(value.identity, [
 			"agent",
 			"subject",
 			"instrument",
@@ -268,7 +304,7 @@ function isStudyCustodyFile(value) {
 			"path",
 			"bytes",
 			"digest"
-		]) && typeof value.path === "string" && (value.path === "manifest.json" || /^trials\/[a-z0-9]+(?:-[a-z0-9]+)*\/(?:evidence.jsonl|attempt.json)$/.test(value.path)) && value.path.split("/").every((name) => !STUDY_RESERVED_NAME.test(name)) && typeof value.bytes === "number" && Number.isSafeInteger(value.bytes) && value.bytes >= 0 && isStudyDigest(value.digest);
+		]) && typeof value.path === "string" && (value.path === "manifest.json" || /^trials\/[a-z0-9]+(?:-[a-z0-9]+)*\/(?:evidence.jsonl|attempt.json|exchanges.jsonl)$/.test(value.path)) && value.path.split("/").every((name) => !STUDY_RESERVED_NAME.test(name)) && typeof value.bytes === "number" && Number.isSafeInteger(value.bytes) && value.bytes >= 0 && isStudyDigest(value.digest);
 	});
 }
 /**
@@ -289,6 +325,106 @@ function isStudyCustodySeal(value) {
 		]) && isStudyCustodyName(value.result) && isStudyDigest(value.id) && isArray(value.files) && value.files.length > 0 && value.files.every(isStudyCustodyFile) && new Set(value.files.map((entry) => entry.path)).size === value.files.length;
 	});
 }
+/** Checks whether encoded body bytes have their exact canonical base64 and SHA-256 identity.
+* @param value - The candidate byte envelope.
+* @returns True if decoded length and digest match; false otherwise.
+*/
+function isStudyExchangeBytes(value) {
+	return holds(() => {
+		if (!isRecord(value) || typeof value.body !== "string" || typeof value.size !== "number" || !Number.isSafeInteger(value.size) || value.size < 0 || !isStudyDigest(value.digest)) return false;
+		const bytes = Buffer.from(value.body, "base64");
+		return bytes.length === value.size && bytes.toString("base64") === value.body && hashStudyBytes(bytes) === value.digest;
+	});
+}
+/** Checks whether an exchange carries an admissible ordered HTTP identity.
+* @param value - The candidate identity.
+* @returns True if identity and stage fields are valid; false otherwise.
+*/
+function isStudyExchangeIdentity(value) {
+	return holds(() => {
+		if (!isRecord(value) || typeof value.ordinal !== "number" || !Number.isSafeInteger(value.ordinal) || value.ordinal <= 0 || !isStudyName(value.goal) || !isStudyRole(value.role) || value.method !== "GET" && value.method !== "POST") return false;
+		if (value.stage === "execution") return (value.role === "agent" || value.role === "summary" || value.role === "judge") && value.method === "POST" && value.path === (value.role === "judge" ? "/api/generate" : "/api/chat") && typeof value.step === "number" && Number.isSafeInteger(value.step) && value.step > 0;
+		if (Object.hasOwn(value, "step")) return false;
+		if (value.stage === "maintenance") return value.role === "maintenance" && value.method === "POST" && value.path === "/api/generate";
+		return (value.stage === "preflight" || value.stage === "postflight") && value.role === "metadata" && (value.path === "/api/version" || value.path === "/api/tags" ? value.method === "GET" : value.path === "/api/show" && value.method === "POST");
+	});
+}
+/** Checks whether a retained reply describes bounded successful application bytes and chunks.
+* @param value - The candidate reply.
+* @returns True if status, selected headers and chunk lengths are valid; false otherwise.
+*/
+function isStudyExchangeReply(value) {
+	return holds(() => isRecord(value) && isStudyExchangeBytes(value) && "status" in value && typeof value.status === "number" && Number.isSafeInteger(value.status) && value.status >= 200 && value.status <= 599 && "headers" in value && isArray(value.headers) && value.headers.every((header) => isArray(header) && header.length === 2 && (header[0] === "content-type" || header[0] === "content-encoding") && typeof header[1] === "string" && !/[\r\n]/.test(header[1])) && "chunks" in value && isArray(value.chunks) && value.chunks.every((size) => typeof size === "number" && Number.isSafeInteger(size) && size > 0) && value.chunks.reduce((total, size) => total + (typeof size === "number" ? size : 0), 0) === value.size);
+}
+/** Checks whether the opening row declares a finite ordered procedure and serving identities.
+* @param value - The candidate declaration.
+* @returns True if all declared populations are valid; false otherwise.
+*/
+function isStudyExchangeDeclaration(value) {
+	return holds(() => {
+		if (!isRecord(value) || !matchesStudyKeys(value, [
+			"phase",
+			"trial",
+			"version",
+			"models",
+			"metadata",
+			"procedure",
+			"maintenance"
+		]) || value.phase !== "declaration" || !isStudyCustodyName(value.trial) || !isNonEmptyString(value.version) || !isRecord(value.models) || Object.keys(value.models).length === 0 || !Object.values(value.models).every(isStudyOllamaModel) || !isStudyOllamaMetadata(value.metadata) || !isArray(value.procedure) || value.procedure.length === 0 || !value.procedure.every(isStudyOllamaStep) || !isArray(value.maintenance) || !value.maintenance.every(isStudyOllamaModel)) return false;
+		const models = Object.values(value.models).filter(isStudyOllamaModel);
+		return value.procedure.every((step, index) => step.ordinal === index + 1 && models.some((model) => model.name === step.policy.model)) && value.maintenance.every((model, index, entries) => entries.findIndex((entry) => entry.name === model.name) === index && models.some((entry) => entry.name === model.name && entry.digest === model.digest)) && models.every((model) => models.every((other) => model.name !== other.name || model.digest === other.digest));
+	});
+}
+/** Checks whether a sidecar row has exactly its declared fields and verified byte identities.
+* @param value - The candidate row.
+* @returns True if the row belongs to the closed sidecar grammar; false otherwise.
+*/
+function isStudyExchangeRow(value) {
+	return holds(() => {
+		if (!isRecord(value)) return false;
+		if (value.phase === "declaration") return isStudyExchangeDeclaration(value);
+		if (value.phase === "complete") return matchesStudyKeys(value, ["phase", "count"]) && typeof value.count === "number" && Number.isSafeInteger(value.count) && value.count > 0;
+		const identity = [
+			"phase",
+			"ordinal",
+			"goal",
+			"role",
+			"path",
+			"method",
+			"stage"
+		];
+		if (!isStudyExchangeIdentity(value)) return false;
+		if (value.phase === "attempt") return matchesStudyKeys(value, [
+			...identity,
+			"body",
+			"size",
+			"digest"
+		], ["step"]) && isStudyExchangeBytes(value);
+		if (value.phase === "response") return matchesStudyKeys(value, [
+			...identity,
+			"body",
+			"size",
+			"digest",
+			"status",
+			"headers",
+			"chunks"
+		], ["step"]) && isStudyExchangeReply(value) && value.status < 300;
+		return value.phase === "failure" && matchesStudyKeys(value, [...identity, "reason"], ["step", "response"]) && typeof value.reason === "string" && (value.response === void 0 || isStudyExchangeReply(value.response));
+	});
+}
+/** Checks whether a history has verified row shapes before its complete relational validation.
+* @param value - The candidate history.
+* @returns True if its envelopes and rows have valid types; false otherwise.
+*/
+function isStudyExchangeHistory(value) {
+	return holds(() => isRecord(value) && matchesStudyKeys(value, [
+		"seal",
+		"file",
+		"declaration",
+		"exchanges",
+		"completion"
+	]) && isStudyDigest(value.seal) && isStudyCustodyFile(value.file) && isStudyExchangeDeclaration(value.declaration) && isArray(value.exchanges) && value.exchanges.every((pair) => isRecord(pair) && matchesStudyKeys(pair, ["attempt", "response"]) && isStudyExchangeRow(pair.attempt) && pair.attempt.phase === "attempt" && isStudyExchangeRow(pair.response) && pair.response.phase === "response") && isStudyExchangeRow(value.completion) && value.completion.phase === "complete");
+}
 //#endregion
 //#region src/server/adapters/validators.ts
 /** Checks whether a factory returned the complete consumer adapter contract.
@@ -418,28 +554,249 @@ var ARTIFACT_VISITS = 32768;
 var ARTIFACT_DEPTH = 64;
 /** Bounds selected package roots before traversal begins. */
 var ARTIFACT_ROOTS = 128;
+/** Marks artifact errors across module formats and installations. */
+var ARTIFACT_ERROR_BRAND = Symbol.for("@orkestrel/study.ArtifactError");
+/** Lists the artifact refusal codes. */
+var ARTIFACT_ERROR_CODES = Object.freeze([
+	"ARTIFACT",
+	"TRAVERSAL",
+	"REDIRECT",
+	"ALIAS",
+	"NAME",
+	"DUPLICATE",
+	"OCCUPIED",
+	"OVERLAP",
+	"STALE",
+	"VOLUME",
+	"DRIFT",
+	"LIMIT"
+]);
 //#endregion
 //#region src/server/artifacts/errors.ts
 /** Reports an invalid or drifted artifact inventory. */
 var ArtifactError = class extends Error {
-	code = "ARTIFACT";
+	code;
 	/** Records the refused artifact boundary.
 	* @param message - The specific refusal.
+	* @param code - The refused boundary. Default: ARTIFACT.
 	*/
-	constructor(message) {
+	constructor(message, code = "ARTIFACT") {
 		super(message);
+		INTRINSICS.define(this, ARTIFACT_ERROR_BRAND, { value: this });
 		this.name = "ArtifactError";
+		this.code = code;
 	}
 };
 /** Narrows a caught value to an artifact refusal.
+* @remarks
+* Recognizes subclasses and other module copies by an own identity brand and valid members.
+* The brand is a recognition marker. A transparent proxy, a look-alike without the brand,
+* throwing accessors, and revoked proxies return false.
 * @param value - The caught value.
 * @returns True if the value is an artifact error; false otherwise.
 */
 function isArtifactError(value) {
-	return isInstance(value, ArtifactError);
+	return holds(() => {
+		if (!(value instanceof INTRINSICS.error) || INTRINSICS.prototype(value) === INTRINSICS.error.prototype) return false;
+		if (INTRINSICS.describe(value, ARTIFACT_ERROR_BRAND)?.value !== value) return false;
+		const code = INTRINSICS.reflect.read(value, "code");
+		const stack = INTRINSICS.reflect.read(value, "stack");
+		return ARTIFACT_ERROR_CODES.some((candidate) => candidate === code) && isString(INTRINSICS.reflect.read(value, "name")) && isString(INTRINSICS.reflect.read(value, "message")) && (stack === void 0 || isString(stack));
+	});
+}
+//#endregion
+//#region src/server/artifacts/validators.ts
+/** Checks whether a key names portable, non-credential members within a closure.
+* @param value - The untrusted slash-separated key.
+* @returns True if every segment is safe and contained; false otherwise.
+*/
+function isArtifactKey(value) {
+	return typeof value === "string" && value !== "" && !/[\\<>:"|?*]/u.test(value) && !Array.from(value).some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127) && value.split("/").every((name) => name !== "" && name !== "." && name !== ".." && !/[. ]$/.test(name) && !/^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(name) && !matchesArtifactCredential(name));
+}
+/** Checks the bounded loader selections retained in a publication.
+* @param value - The decoded selections.
+* @returns True if required selections and optional groups have their declared shapes; false otherwise.
+*/
+function isArtifactLoaderOptions(value) {
+	return holds(() => isRecord(value) && arrayOf(isString)(value.entries) && arrayOf(isString)(value.roots) && value.entries.length <= 8192 && value.roots.length <= 128 && (value.source === void 0 || isRecord(value.source) && isString(value.source.root) && isString(value.source.entry)) && (value.instrument === void 0 || isString(value.instrument)) && (value.excluded === void 0 || arrayOf(isString)(value.excluded)) && (value.assets === void 0 || arrayOf(isString)(value.assets) && value.assets.length <= 8192));
+}
+/** Checks the exact file identity and provenance of a closure member.
+* @param value - The decoded member.
+* @returns True if the member has a safe key, source, digest and bounded size; false otherwise.
+*/
+function isArtifactMember(value) {
+	return holds(() => isRecord(value) && isString(value.source) && isArtifactKey(value.key) && isStudyDigest(value.digest) && typeof value.size === "number" && Number.isSafeInteger(value.size) && value.size >= 0);
+}
+/** Checks a bounded materialization record before any path is used.
+* @param value - The decoded record.
+* @returns True if its selections and member records have the declared shapes; false otherwise.
+*/
+function isArtifactClosure(value) {
+	return holds(() => isRecord(value) && isString(value.destination) && isStudyDigest(value.digest) && isArtifactLoaderOptions(value.options) && isArray(value.members) && value.members.length > 0 && value.members.length <= 8192 && value.members.every(isArtifactMember));
 }
 //#endregion
 //#region src/server/artifacts/helpers.ts
+/** Checks whether a portable segment identifies credentials.
+* @param value - One untrusted path segment.
+* @returns True if the segment has a credential filename; false otherwise.
+*/
+function matchesArtifactCredential(value) {
+	return /^(?:\.env(?:\..*)?|\.npmrc|auth\.json|id_(?:rsa|dsa|ecdsa|ed25519))$/i.test(value) || /\.(?:key|pem|p12|pfx)$/i.test(value) || /(?:^|[._-])token(?:$|[._-])/i.test(value);
+}
+/** Resolves a portable member key without traversing outside its destination.
+* @param destination - The canonical absolute destination.
+* @param key - The slash-separated member key.
+* @returns The contained host path.
+* @throws ArtifactError - Thrown for traversal or an unsafe name.
+*/
+function resolveArtifactMember(destination, key) {
+	if (isAbsolute(key) || key.split("/").some((name) => name === ".." || name === ".") || /[\\:]/.test(key)) throw new ArtifactError("Artifact member traverses its boundary", "TRAVERSAL");
+	if (!isArtifactKey(key)) throw new ArtifactError("Artifact member name is unsafe", "NAME");
+	const path = resolve(destination, ...key.split("/"));
+	if (!containsArtifact(resolve(destination), path)) throw new ArtifactError("Artifact member traverses its boundary", "TRAVERSAL");
+	return path;
+}
+/** Checks every existing physical ancestor before using a canonical absolute path.
+* @param path - The existing absolute file or directory.
+* @returns Its physical filesystem metadata.
+* @throws ArtifactError - Thrown for traversal, unsafe names, aliases or redirects before reading bytes.
+*/
+function readArtifactPhysical(path) {
+	if (!isAbsolute(path) || resolve(path) !== path) throw new ArtifactError("Artifact path must be canonical and absolute", "TRAVERSAL");
+	const origin = parse(path).root;
+	const names = relative(origin, path).split(sep).filter(Boolean);
+	if (names.some((name) => !isArtifactKey(name))) throw new ArtifactError("Artifact physical path has an unsafe name", "NAME");
+	for (const [index] of names.entries()) {
+		const candidate = join(origin, ...names.slice(0, index + 1));
+		if (lstatSync(candidate, { bigint: true }).isSymbolicLink()) throw new ArtifactError("Artifact path is redirected", "REDIRECT");
+		const physical = realpathSync(candidate);
+		if (physical !== candidate) throw new ArtifactError("Artifact path has a physical alias or redirect", physical.toLowerCase() === candidate.toLowerCase() ? "ALIAS" : "REDIRECT");
+	}
+	return lstatSync(path, { bigint: true });
+}
+/** Finds the common physical parent that preserves every selected path's relative resolution.
+* @param paths - Existing absolute members or selected roots on one volume.
+* @returns Their common ancestor directory.
+* @throws ArtifactError - Thrown when selections span volumes or contain no files.
+*/
+function resolveArtifactBase(paths) {
+	const first = paths[0];
+	if (first === void 0) throw new ArtifactError("Artifact population is empty");
+	if (paths.some((path) => parse(path).root !== parse(first).root)) throw new ArtifactError("Artifact sources require one volume", "VOLUME");
+	const origin = parse(first).root;
+	const names = relative(origin, dirname(first)).split(sep).filter(Boolean);
+	const base = Array.from({ length: names.length + 1 }, (_entry, index) => join(origin, ...names.slice(0, index))).reverse().find((parent) => paths.every((path) => parent === path || containsArtifact(parent, path)));
+	if (base === void 0) throw new ArtifactError("Artifact sources have no common parent", "VOLUME");
+	return base;
+}
+/** Relocates an original path through a closure's retained physical forest.
+* @param closure - The verified closure record.
+* @param path - An original member or ancestor within its forest.
+* @returns The corresponding destination path.
+* @throws ArtifactError - Thrown when provenance or containment is inconsistent.
+*/
+function relocateArtifactPath(closure, path) {
+	const first = closure.members[0];
+	if (first === void 0) throw new ArtifactError("Artifact population is empty");
+	const origin = resolve(first.source, ...first.key.split("/").map(() => ".."));
+	if (path !== origin && !containsArtifact(origin, path)) throw new ArtifactError("Artifact relocation traverses its forest", "TRAVERSAL");
+	if (closure.members.some((member) => resolveArtifactMember(origin, member.key) !== member.source)) throw new ArtifactError("Artifact member provenance is inconsistent", "TRAVERSAL");
+	return path === origin ? closure.destination : resolveArtifactMember(closure.destination, relative(origin, path).split(sep).join("/"));
+}
+/** Computes a destination-independent digest of members and relative package identities.
+* @param members - Complete copied membership, with source provenance excluded from identity.
+* @param packages - Package identities with relocated roots.
+* @param destination - The common destination directory.
+* @returns The portable SHA-256 identity.
+*/
+function computeArtifactClosureDigest(members, packages, destination) {
+	return hashStudyBytes(encodeStudyJSON({
+		members: members.map(({ key, digest, size }) => ({
+			key,
+			digest,
+			size
+		})).toSorted((left, right) => left.key < right.key ? -1 : left.key > right.key ? 1 : 0),
+		packages: packages.map((entry) => ({
+			...entry,
+			root: relative(destination, entry.root).split(sep).join("/")
+		})).toSorted((left, right) => left.root < right.root ? -1 : left.root > right.root ? 1 : 0)
+	}));
+}
+/** Verifies complete copied membership, path safety, exact bytes, and portable identity.
+* @param closure - The materialization record to verify independently.
+* @param published - If true, permits the root publication marker; if false, refuses every extra file. Default: false.
+* @returns Nothing when the entire forest matches.
+* @throws ArtifactError - Thrown for malformed records, changed membership, bytes, or physical paths.
+*/
+function verifyArtifactClosure(closure, published = false) {
+	if (!isArtifactClosure(closure)) throw new ArtifactError("Artifact closure record is invalid", "NAME");
+	if (!readArtifactPhysical(closure.destination).isDirectory()) throw new ArtifactError("Artifact closure requires a directory", "DRIFT");
+	const keys = new Set(closure.members.map((member) => member.key));
+	if (keys.size !== closure.members.length) throw new ArtifactError("Artifact member key is duplicated", "DUPLICATE");
+	if (new Set(closure.members.map((member) => member.key.toLowerCase())).size !== closure.members.length) throw new ArtifactError("Artifact member keys have a case alias", "ALIAS");
+	const directories = [{
+		path: closure.destination,
+		depth: 0
+	}];
+	const visited = [];
+	const files = [];
+	for (const directory of directories) {
+		if (directory.depth > 64) throw new ArtifactError("Artifact directory depth limit exceeded", "LIMIT");
+		const handle = opendirSync(directory.path);
+		try {
+			for (const entry of iterateArtifactEntries(handle)) {
+				const path = join(directory.path, entry.name);
+				visited.push(path);
+				if (visited.length > 32768) throw new ArtifactError("Artifact traversal limit exceeded", "LIMIT");
+				const stat = readArtifactPhysical(path);
+				if (stat.isDirectory()) {
+					if (!closure.members.some((member) => containsArtifact(path, resolveArtifactMember(closure.destination, member.key)))) throw new ArtifactError("Artifact closure membership drifted", "DRIFT");
+					directories.push({
+						path,
+						depth: directory.depth + 1
+					});
+					continue;
+				}
+				if (!stat.isFile()) throw new ArtifactError("Artifact closure contains a non-file", "DRIFT");
+				if (published && path === join(closure.destination, "closure.json")) continue;
+				const key = relative(closure.destination, path).split(sep).join("/");
+				if (!keys.has(key)) throw new ArtifactError("Artifact closure membership drifted", "DRIFT");
+				files.push({
+					path,
+					identity: `${stat.dev}:${stat.ino}`,
+					size: Number(stat.size)
+				});
+				if (files.length > 8192) throw new ArtifactError("Artifact closure exceeds its capture allowance", "LIMIT");
+			}
+		} finally {
+			handle.closeSync();
+		}
+	}
+	if (files.length !== closure.members.length) throw new ArtifactError("Artifact closure membership drifted", "DRIFT");
+	if (files.reduce((sum, file) => sum + file.size, 0) > 134217728) throw new ArtifactError("Artifact closure exceeds its capture allowance", "LIMIT");
+	if (new Set(files.map((file) => file.identity)).size !== files.length) throw new ArtifactError("Artifact members have a physical alias", "ALIAS");
+	for (const member of closure.members) {
+		const file = readArtifact(resolveArtifactMember(closure.destination, member.key));
+		if (file.digest !== member.digest || file.size !== member.size) throw new ArtifactError("Artifact closure bytes drifted", "DRIFT");
+	}
+	if ([
+		...closure.options.entries,
+		...closure.options.assets ?? [],
+		...closure.options.excluded ?? [],
+		...closure.options.source === void 0 ? [] : [closure.options.source.entry]
+	].some((path) => !files.some((file) => file.path === path)) || closure.options.roots.some((root) => root !== closure.destination && !containsArtifact(closure.destination, root)) || closure.options.source !== void 0 && closure.options.source.root !== closure.destination && !containsArtifact(closure.destination, closure.options.source.root)) throw new ArtifactError("Artifact closure selection traverses its population", "TRAVERSAL");
+	const packages = closure.options.roots.map((root) => {
+		const manifest = readArtifact(join(root, "package.json"));
+		const value = parseJSON(Buffer.from(manifest.source).toString("utf8"));
+		if (!isRecord(value) || typeof value.name !== "string" || typeof value.version !== "string") throw new ArtifactError("Artifact closure manifest is invalid", "DRIFT");
+		return {
+			root,
+			name: value.name,
+			version: value.version
+		};
+	});
+	if (computeArtifactClosureDigest(closure.members, packages, closure.destination) !== closure.digest) throw new ArtifactError("Artifact closure identity drifted", "DRIFT");
+}
 /** Fills a buffer from an open descriptor, one positioned read at a time.
 * @param descriptor - The open file descriptor to read.
 * @param target - The buffer to fill.
@@ -470,6 +827,7 @@ function* iterateArtifactEntries(handle) {
 */
 function readArtifact(path, maximum = ARTIFACT_FILE_BYTES) {
 	if (!Number.isSafeInteger(maximum) || maximum < 0 || !isAbsolute(path) || resolve(path) !== path || realpathSync(path) !== path || !lstatSync(path).isFile()) throw new ArtifactError(`Artifact requires a canonical regular file and byte budget: ${path}`);
+	readArtifactPhysical(path);
 	const descriptor = openSync(path, "r");
 	try {
 		const before = fstatSync(descriptor);
@@ -600,7 +958,7 @@ var Resolution = class {
 //#region src/server/artifacts/ArtifactLoader.ts
 /** Captures built ESM and a separate strip-only consumer adapter in a fresh worker.
 * @remarks
-* Loads trusted code, not a hostile-code sandbox. Native process APIs, eval and external
+* Loads trusted code without sandboxing untrusted code. Native process APIs, eval and external
 * services are not replayed. One inventory may load per process; terminate it afterwards.
 */
 var ArtifactLoader = class ArtifactLoader {
@@ -609,6 +967,7 @@ var ArtifactLoader = class ArtifactLoader {
 	#inventory;
 	#sources = [];
 	#token;
+	#references = /* @__PURE__ */ new Map();
 	/** Captures selections without reading or executing selected modules.
 	* @param options - Canonical built selections and optional consumer source selection.
 	*/
@@ -618,8 +977,12 @@ var ArtifactLoader = class ArtifactLoader {
 			...options,
 			entries: [...options.entries],
 			roots: [...options.roots],
-			...options.source === void 0 ? {} : { source: { ...options.source } },
-			...options.excluded === void 0 ? {} : { excluded: [...options.excluded] }
+			...options.source === void 0 ? {} : { source: {
+				root: options.source.root,
+				entry: options.source.entry
+			} },
+			...options.excluded === void 0 ? {} : { excluded: [...options.excluded] },
+			...options.assets === void 0 ? {} : { assets: [...options.assets] }
 		};
 	}
 	/** Reads and identifies admitted files without evaluating selected modules.
@@ -679,9 +1042,14 @@ var ArtifactLoader = class ArtifactLoader {
 				path,
 				digest,
 				size
-			})))
+			}))),
+			...this.#options.assets === void 0 ? {} : { assets: Object.freeze([...this.#options.assets].sort()) }
 		};
 		this.#sources = sources;
+		this.#references = new Map(sources.map((file) => {
+			const stat = readArtifactPhysical(file.path);
+			return [file.path, `${stat.dev}:${stat.ino}:${stat.mtimeNs}:${stat.ctimeNs}`];
+		}));
 		this.#inventory = Object.freeze({
 			digest: hashStudyBytes(JSON.stringify(evidence)),
 			...evidence
@@ -711,7 +1079,7 @@ var ArtifactLoader = class ArtifactLoader {
 			const token = randomUUID();
 			const resolution = new Resolution({
 				token,
-				files: this.#sources,
+				files: this.#sources.filter((file) => this.#options.roots.some((root) => file.path === join(root, "package.json") || containsArtifact(join(root, "dist"), file.path)) || this.#options.source !== void 0 && containsArtifact(this.#options.source.root, file.path)),
 				...inventory.source === void 0 ? {} : { source: inventory.source },
 				...inventory.instrument === void 0 ? {} : { instrument: inventory.instrument },
 				...this.#options.excluded === void 0 ? {} : { excluded: this.#options.excluded }
@@ -729,6 +1097,123 @@ var ArtifactLoader = class ArtifactLoader {
 		this.verify();
 		return namespace;
 	}
+	/** Copies the inspected physical forest into an exclusive absent destination.
+	* @param destination - The canonical absent absolute directory under an existing physical parent.
+	* @returns The independently verified copied membership and relocated selections.
+	* @throws ArtifactError - Thrown at the refused path, stale-source, volume, or drift boundary.
+	*/
+	async materialize(destination) {
+		if (new Set(this.#options.roots).size !== this.#options.roots.length) throw new ArtifactError("Artifact package root is duplicated", "DUPLICATE");
+		if (!isAbsolute(destination) || resolve(destination) !== destination) throw new ArtifactError("Artifact destination must be canonical and absolute", "TRAVERSAL");
+		const boundaries = [
+			...this.#options.roots,
+			...this.#options.source === void 0 ? [] : [this.#options.source.root],
+			...this.#options.assets ?? []
+		];
+		if (boundaries.some((path) => parse(path).root !== parse(destination).root)) throw new ArtifactError("Artifact closure requires one volume", "VOLUME");
+		if (boundaries.some((path) => path === destination || containsArtifact(path, destination) || containsArtifact(destination, path))) throw new ArtifactError("Artifact destination overlaps a source", "OVERLAP");
+		const parent = readArtifactPhysical(dirname(destination));
+		resolveArtifactMember(dirname(destination), relative(dirname(destination), destination));
+		if (!parent.isDirectory()) throw new ArtifactError("Artifact destination parent must be a directory", "REDIRECT");
+		try {
+			lstatSync(destination);
+			throw new ArtifactError("Artifact destination must be absent", "OCCUPIED");
+		} catch (error) {
+			if (!matchesSystemError(error, "ENOENT")) throw error;
+		}
+		const inspected = this.#inventory !== void 0;
+		try {
+			for (const path of boundaries) readArtifactPhysical(path);
+			this.inspect();
+			for (const file of this.#sources) {
+				const stat = readArtifactPhysical(file.path);
+				if (stat.dev !== parent.dev) throw new ArtifactError("Artifact closure requires one volume", "VOLUME");
+				if (`${stat.dev}:${stat.ino}:${stat.mtimeNs}:${stat.ctimeNs}` !== this.#references.get(file.path)) throw new ArtifactError("Artifact source reference is stale", "STALE");
+			}
+		} catch (error) {
+			if (inspected && !(isArtifactError(error) && [
+				"REDIRECT",
+				"ALIAS",
+				"NAME",
+				"VOLUME"
+			].includes(error.code))) throw new ArtifactError("Artifact source inspection is stale", "STALE");
+			throw error;
+		}
+		const base = resolveArtifactBase([
+			...this.#sources.map((file) => file.path),
+			...this.#options.roots,
+			...this.#options.source === void 0 ? [] : [this.#options.source.root]
+		]);
+		const members = Object.freeze(this.#sources.map((file) => Object.freeze({
+			source: file.path,
+			key: relative(base, file.path).split(sep).join("/"),
+			digest: file.digest,
+			size: file.size
+		})));
+		if (new Set(members.map((member) => member.key)).size !== members.length) throw new ArtifactError("Artifact member key is duplicated", "DUPLICATE");
+		if (new Set(members.map((member) => member.key.toLowerCase())).size !== members.length) throw new ArtifactError("Artifact member keys have a case alias", "ALIAS");
+		if (members.some((member) => member.key.split("/").length - 1 > 64)) throw new ArtifactError("Artifact closure directory depth limit exceeded", "LIMIT");
+		if (new Set(members.flatMap((member) => member.key.split("/").slice(0, -1).map((_name, index, names) => names.slice(0, index + 1).join("/")))).size + members.length > 32768) throw new ArtifactError("Artifact closure traversal limit exceeded", "LIMIT");
+		for (const member of members) resolveArtifactMember(destination, member.key);
+		const identities = this.#sources.map((file) => {
+			const stat = readArtifactPhysical(file.path);
+			return `${stat.dev}:${stat.ino}`;
+		});
+		if (new Set(identities).size !== identities.length) throw new ArtifactError("Artifact members have a physical alias", "ALIAS");
+		const relocation = {
+			destination,
+			digest: "",
+			options: this.#options,
+			members
+		};
+		const options = Object.freeze({
+			entries: Object.freeze(this.#options.entries.map((path) => relocateArtifactPath(relocation, path))),
+			roots: Object.freeze(this.#options.roots.map((path) => relocateArtifactPath(relocation, path))),
+			...this.#options.source === void 0 ? {} : { source: Object.freeze({
+				root: relocateArtifactPath(relocation, this.#options.source.root),
+				entry: relocateArtifactPath(relocation, this.#options.source.entry)
+			}) },
+			...this.#options.instrument === void 0 ? {} : { instrument: relocateArtifactPath(relocation, this.#options.instrument) },
+			...this.#options.excluded === void 0 ? {} : { excluded: Object.freeze(this.#options.excluded.map((path) => relocateArtifactPath(relocation, path))) },
+			...this.#options.assets === void 0 ? {} : { assets: Object.freeze(this.#options.assets.map((path) => relocateArtifactPath(relocation, path))) }
+		});
+		const packages = this.inspect().packages.map((entry) => ({
+			...entry,
+			root: relocateArtifactPath(relocation, entry.root)
+		}));
+		const closure = Object.freeze({
+			destination,
+			digest: computeArtifactClosureDigest(members, packages, destination),
+			options,
+			members
+		});
+		mkdirSync(destination);
+		for (const file of this.#sources) {
+			const target = relocateArtifactPath(closure, file.path);
+			this.#directory(closure.destination, dirname(target));
+			await writeFile(target, file.source, { flag: "wx" });
+		}
+		try {
+			this.verify();
+		} catch {
+			throw new ArtifactError("Artifact source drifted during copying", "DRIFT");
+		}
+		verifyArtifactClosure(closure);
+		return closure;
+	}
+	#directory(destination, target) {
+		const names = relative(destination, target).split(sep).filter(Boolean);
+		readArtifactPhysical(destination);
+		for (const [index] of names.entries()) {
+			const path = join(destination, ...names.slice(0, index + 1));
+			try {
+				mkdirSync(path);
+			} catch (error) {
+				if (!matchesSystemError(error, "EEXIST")) throw error;
+			}
+			if (!readArtifactPhysical(path).isDirectory()) throw new ArtifactError("Artifact destination ancestor is redirected", "REDIRECT");
+		}
+	}
 	#capture() {
 		const sources = [];
 		const tally = this.#options.roots.reduce((counted, root) => {
@@ -741,10 +1226,20 @@ var ArtifactLoader = class ArtifactLoader {
 		const source = this.#options.source;
 		if (source !== void 0) {
 			if (this.#options.roots.some((root) => join(root, "dist") === source.root || containsArtifact(join(root, "dist"), source.root) || containsArtifact(source.root, join(root, "dist")))) throw new ArtifactError("Artifact source and built inventories must not overlap");
-			this.#walk(source.root, sources, true, 0, tally);
-		}
+			const counted = this.#walk(source.root, sources, true, 0, tally);
+			this.#assets(sources, counted);
+		} else this.#assets(sources, tally);
 		return sources;
 	}
+	#assets(sources, tally) {
+		const assets = this.#options.assets ?? [];
+		if (assets.length > 8192) throw new ArtifactError("Artifact asset count limit exceeded", "LIMIT");
+		if (new Set(assets).size !== assets.length) throw new ArtifactError("Artifact asset key is duplicated", "DUPLICATE");
+		assets.reduce((counted, path) => {
+			readArtifactPhysical(path);
+			return sources.some((file) => file.path === path) ? counted : this.#append(path, sources, counted);
+		}, tally);
+	}
 	#append(path, sources, tally) {
 		if (sources.length >= 8192) throw new ArtifactError("Artifact file count limit exceeded");
 		const file = readArtifact(path, ARTIFACT_BYTES - tally.bytes);
@@ -766,7 +1261,7 @@ var ArtifactLoader = class ArtifactLoader {
 				});
 				if (visited.visits > 32768) throw new ArtifactError("Artifact traversal limit exceeded");
 				const path = join(directory, entry.name);
-				if (entry.isSymbolicLink()) throw new ArtifactError(`Artifact links are unsupported: ${path}`);
+				if (entry.isSymbolicLink()) throw new ArtifactError(`Artifact links are unsupported: ${path}`, "REDIRECT");
 				if (entry.isDirectory()) return this.#walk(path, sources, source, depth + 1, visited);
 				return (source ? [
 					".ts",
@@ -1017,7 +1512,7 @@ async function writeStudyBytes(path, bytes) {
 */
 async function scanStudyExecution(directory, manifest) {
 	await checkStudyDirectory(directory);
-	const files = await scanStudyTree(directory, "", new Set(manifest.schedule.map((trial) => trial.id)), manifest.bounds.series.bytes);
+	const files = await scanStudyTree(directory, "", new Set(manifest.schedule.map((trial) => trial.id)), manifest.bounds.series.bytes, manifest.record !== void 0);
 	return Object.freeze([...files].sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0));
 }
 /**
@@ -1029,7 +1524,7 @@ async function scanStudyExecution(directory, manifest) {
 * @returns The admitted files in read order: this directory's files, then each admitted subdirectory's, last listed first
 * @throws StudyError - Thrown when the tree holds a link, an unknown directory or file, or a file beyond the remaining allowance
 */
-async function scanStudyTree(directory, prefix, known, allowance) {
+async function scanStudyTree(directory, prefix, known, allowance, recording = false) {
 	const files = [];
 	const directories = [];
 	for (const entry of await readdir(join(directory, ...prefix.split("/").filter(Boolean)), { withFileTypes: true })) {
@@ -1041,7 +1536,7 @@ async function scanStudyTree(directory, prefix, known, allowance) {
 			continue;
 		}
 		const names = path.split("/");
-		if (!entry.isFile() || !(path === "manifest.json" || names.length === 3 && names[0] === "trials" && known.has(names[1] ?? "") && (names[2] === "attempt.json" || names[2] === "evidence.jsonl"))) throw new StudyError("CUSTODY", "Execution contains an unknown file");
+		if (!entry.isFile() || !(path === "manifest.json" || names.length === 3 && names[0] === "trials" && known.has(names[1] ?? "") && (names[2] === "attempt.json" || names[2] === "evidence.jsonl" || recording && names[2] === "exchanges.jsonl"))) throw new StudyError("CUSTODY", "Execution contains an unknown file");
 		const bytes = await readStudyBytes(join(directory, ...names), files.reduce((left, file) => left - file.bytes, allowance));
 		files.push(Object.freeze({
 			path,
@@ -1053,7 +1548,7 @@ async function scanStudyTree(directory, prefix, known, allowance) {
 	const steps = [];
 	for (const child of [...directories].reverse()) {
 		const before = steps.at(-1)?.left ?? remaining;
-		const found = await scanStudyTree(directory, child, known, before);
+		const found = await scanStudyTree(directory, child, known, before, recording);
 		steps.push({
 			found,
 			left: found.reduce((left, file) => left - file.bytes, before)
@@ -1191,7 +1686,12 @@ async function readStudyResult(directory) {
 	const sealBytes = await readStudyBytes(join(absolute, "seal.json"), STUDY_CUSTODY_BYTES);
 	if (files.reduce((total, file) => total + file.bytes, sealBytes.byteLength) > manifest.bounds.series.bytes) throw new StudyError("CUSTODY", "Seal and execution exceed the series allowance");
 	const seal = decodeStudyJSON(sealBytes);
-	if (!isStudyCustodySeal(seal) || seal.result !== manifest.id || seal.id !== computeStudySealId(manifest.id, files) || canonicalStringify(seal.files) !== canonicalStringify(files) || attempts.length !== manifest.schedule.length || files.length !== 1 + manifest.schedule.length * 2) throw new StudyError("CUSTODY", "Execution seal does not match the complete byte inventory");
+	if (!isStudyCustodySeal(seal) || seal.result !== manifest.id || seal.id !== computeStudySealId(manifest.id, files) || canonicalStringify(seal.files) !== canonicalStringify(files) || attempts.length !== manifest.schedule.length || files.length !== 1 + manifest.schedule.length * (manifest.record === void 0 ? 2 : 3)) throw new StudyError("CUSTODY", "Execution seal does not match the complete byte inventory");
+	if (manifest.record !== void 0) for (const trial of manifest.schedule) {
+		const file = files.find((entry) => entry.path === `trials/${trial.id}/exchanges.jsonl`);
+		if (file === void 0) throw new StudyError("CUSTODY", "Recorded trial is missing its exchange sidecar");
+		await readStudyTrialExchanges(absolute, manifest, trial.id, file);
+	}
 	return Object.freeze({
 		status: "sealed",
 		directory: absolute,
@@ -1200,6 +1700,228 @@ async function readStudyResult(directory) {
 		seal
 	});
 }
+/** Projects the declaration onto its complete ordered HTTP identity population.
+* @param declaration - The validated opening row.
+* @returns Maintenance, preflight, model and postflight identities in declaration order.
+*/
+function buildStudyExchangeSequence(declaration) {
+	const first = declaration.procedure[0];
+	const last = declaration.procedure.at(-1);
+	if (first === void 0 || last === void 0) throw new StudyError("CUSTODY", "Exchange procedure is empty");
+	const models = Object.values(declaration.models).filter((model, index, entries) => entries.findIndex((entry) => entry.name === model.name) === index);
+	const maintenance = declaration.maintenance.map((_model, index) => ({
+		ordinal: index + 1,
+		goal: first.goal,
+		role: "maintenance",
+		path: "/api/generate",
+		method: "POST",
+		stage: "maintenance"
+	}));
+	const preflight = [
+		"/api/version",
+		"/api/tags",
+		...models.map(() => "/api/show")
+	].map((path, index) => ({
+		ordinal: maintenance.length + index + 1,
+		goal: first.goal,
+		role: "metadata",
+		path: path === "/api/version" ? "/api/version" : path === "/api/tags" ? "/api/tags" : "/api/show",
+		method: path === "/api/show" ? "POST" : "GET",
+		stage: "preflight"
+	}));
+	const execution = declaration.procedure.map((step, index) => ({
+		ordinal: maintenance.length + preflight.length + index + 1,
+		goal: step.goal,
+		role: step.role,
+		path: step.path,
+		method: "POST",
+		stage: "execution",
+		step: step.ordinal
+	}));
+	const postflight = preflight.map((identity, index) => ({
+		...identity,
+		ordinal: maintenance.length + preflight.length + execution.length + index + 1,
+		goal: last.goal,
+		stage: "postflight"
+	}));
+	return [
+		...maintenance,
+		...preflight,
+		...execution,
+		...postflight
+	];
+}
+/** Projects only the repeated identity fields of a retained HTTP exchange.
+* @param identity - The row whose body and lifecycle fields are omitted.
+* @returns The identity repeated by its attempt and terminal.
+*/
+function projectStudyExchangeIdentity(identity) {
+	return {
+		ordinal: identity.ordinal,
+		goal: identity.goal,
+		role: identity.role,
+		path: identity.path,
+		method: identity.method,
+		stage: identity.stage,
+		...identity.step === void 0 ? {} : { step: identity.step }
+	};
+}
+/** Validates the exact declaration order and request bytes of an admitted exchange.
+* @param declaration - The complete opening procedure.
+* @param request - The admitted request to join.
+* @returns Nothing after identity, exact-body or capture-length validation.
+*/
+function validateStudyExchangeRequest(declaration, request) {
+	const expected = buildStudyExchangeSequence(declaration)[request.ordinal - 1];
+	if (expected === void 0 || canonicalStringify(expected) !== canonicalStringify(projectStudyExchangeIdentity(request))) throw new StudyError("CUSTODY", "Exchange differs from its declared order");
+	const bytes = Buffer.from(request.body, "base64");
+	if (request.stage === "execution") {
+		const step = declaration.procedure.find((entry) => entry.ordinal === request.step);
+		if (step === void 0 || (step.admission === "exact" ? !bytes.equals(Buffer.from(step.body)) || request.digest !== step.input : bytes.length !== step.bytes)) throw new StudyError("CUSTODY", "Exchange request differs from its declared admission");
+		return;
+	}
+	if (request.stage === "maintenance") {
+		const model = declaration.maintenance[request.ordinal - 1];
+		const body = parseJSON(bytes.toString("utf8"));
+		if (model === void 0 || !isRecord(body) || body.model !== model.name || body.keep_alive !== 0) throw new StudyError("CUSTODY", "Maintenance request differs from its declaration");
+		return;
+	}
+	const models = Object.values(declaration.models).filter((model, index, entries) => entries.findIndex((entry) => entry.name === model.name) === index);
+	const population = models.length + 2;
+	const model = models[request.ordinal - declaration.maintenance.length - (request.stage === "postflight" ? population + declaration.procedure.length : 0) - 1 - 2];
+	const body = request.path === "/api/show" && model !== void 0 ? JSON.stringify({ model: model.name }) : "";
+	if (!bytes.equals(Buffer.from(body))) throw new StudyError("CUSTODY", "Metadata request differs from its declaration");
+}
+/** Validates a serialized journal prefix or its complete successful population.
+* @param rows - The owned rows in physical append order.
+* @param complete - If true, requires successful completion; if false, admits an unfinished prefix.
+* @returns Nothing when every row joins its preceding attempt and declared sequence.
+*/
+function validateStudyExchangeRows(rows, complete = true) {
+	const declaration = rows[0];
+	if (declaration?.phase !== "declaration" || !rows.every(isStudyExchangeRow)) throw new StudyError("CUSTODY", "Exchange declaration or row is invalid");
+	const attempts = rows.filter((row) => row.phase === "attempt");
+	for (const [index, row] of rows.entries()) {
+		if (index === 0) continue;
+		const previous = rows[index - 1];
+		if (row.phase === "attempt") {
+			if (previous?.phase !== "declaration" && previous?.phase !== "response") throw new StudyError("CUSTODY", "Exchange attempt overlaps an unfinished attempt");
+			if (row.ordinal !== rows.slice(0, index).filter((entry) => entry.phase === "attempt").length + 1) throw new StudyError("CUSTODY", "Exchange ordinals are not contiguous");
+			validateStudyExchangeRequest(declaration, row);
+		} else if (row.phase === "response" || row.phase === "failure") {
+			if (previous?.phase !== "attempt" || canonicalStringify(projectStudyExchangeIdentity(previous)) !== canonicalStringify(projectStudyExchangeIdentity(row))) throw new StudyError("CUSTODY", "Exchange terminal has no matching attempt");
+		} else if (row.phase === "complete") {
+			if (index !== rows.length - 1 || previous?.phase !== "response" || row.count !== attempts.length || row.count !== buildStudyExchangeSequence(declaration).length || rows.some((entry) => entry.phase === "failure")) throw new StudyError("CUSTODY", "Exchange completion is partial or failed");
+		} else throw new StudyError("CUSTODY", "Exchange declaration repeats");
+	}
+	if (complete && rows.at(-1)?.phase !== "complete") throw new StudyError("CUSTODY", "Exchange history has no successful completion");
+}
+/** Reads strict complete LF-framed exchange rows with verified bodies and declaration joins.
+* @param bytes - The bounded retained sidecar bytes.
+* @param complete - If true, requires completion; if false, admits a verified unfinished prefix.
+* @returns Owned rows in physical order.
+*/
+function readStudyExchangeRows(bytes, complete = true) {
+	try {
+		const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+		if (!text.endsWith("\n")) throw new StudyError("CUSTODY", "Exchange sidecar ends with a partial record");
+		const rows = text.split(/\r\n|\n/).slice(0, -1).map((line) => {
+			const row = parseJSON(line);
+			if (!isStudyExchangeRow(row)) throw new StudyError("CUSTODY", "Exchange sidecar contains an invalid row");
+			return row;
+		});
+		validateStudyExchangeRows(rows, complete);
+		return rows;
+	} catch (error) {
+		throw new StudyError("CUSTODY", error instanceof Error ? error.message : "Invalid exchange bytes");
+	}
+}
+/** Validates complete history envelopes again before a replay may perform dependent work.
+* @param history - The strict-reader result, treated as untrusted at this boundary.
+* @returns Nothing after complete row, file and declaration verification.
+*/
+function validateStudyExchangeHistory(history) {
+	if (!isStudyExchangeHistory(history) || history.file.path !== `trials/${history.declaration.trial}/exchanges.jsonl`) throw new StudyError("CUSTODY", "Replay requires a verified sealed exchange history");
+	const rows = [
+		history.declaration,
+		...history.exchanges.flatMap((pair) => [pair.attempt, pair.response]),
+		history.completion
+	];
+	validateStudyExchangeRows(rows);
+	const bytes = Buffer.from(rows.map((row) => JSON.stringify(row) + "\n").join(""));
+	if (history.file.bytes !== bytes.length || history.file.digest !== hashStudyBytes(bytes)) throw new StudyError("CUSTODY", "Replay history differs from its retained file identity");
+}
+/** Joins recorded exchanges to exactly one dispatch and wire evidence identity per ordinal.
+* @param rows - The complete successful sidecar rows.
+* @param evidence - The validated trial evidence rows.
+* @returns Nothing when all retained exchange identities have exact evidence counterparts.
+*/
+function validateStudyExchangeEvidence(rows, evidence) {
+	const attempts = rows.filter((row) => row.phase === "attempt");
+	for (const event of ["dispatch", "wire"]) {
+		const joined = evidence.filter((row) => row.event === event && isRecord(row.value) && row.value.ordinal !== void 0);
+		if (joined.length !== attempts.length || !joined.every((row, index) => {
+			const request = attempts[index];
+			return request !== void 0 && isRecord(row.value) && row.value.ordinal === request.ordinal && row.goal === request.goal && row.value.role === request.role && row.value.path === request.path;
+		})) throw new StudyError("CUSTODY", "Exchange sidecar and evidence ordinals do not join exactly");
+	}
+}
+/** Reads and joins a complete trial sidecar before or after sealing.
+* @param directory - The result directory.
+* @param manifest - The verified manifest declaring recording and bounds.
+* @param trial - The exact scheduled trial id.
+* @param file - The inventory identity read for this sidecar.
+* @returns Complete rows after byte, declaration and evidence joins.
+*/
+async function readStudyTrialExchanges(directory, manifest, trial, file) {
+	if (manifest.record === void 0 || file.path !== `trials/${trial}/exchanges.jsonl`) throw new StudyError("CUSTODY", "Sidecar has no recording declaration");
+	const bytes = await readStudyBytes(join(directory, "execution", "trials", trial, "exchanges.jsonl"), manifest.record.bytes);
+	if (bytes.length !== file.bytes || hashStudyBytes(bytes) !== file.digest) throw new StudyError("CUSTODY", "Exchange sidecar changed during reading");
+	const rows = readStudyExchangeRows(bytes);
+	const declaration = rows[0];
+	const scheduled = manifest.schedule.find((entry) => entry.id === trial);
+	const scenario = manifest.scenarios.find((entry) => entry.id === scheduled?.scenario);
+	if (declaration?.phase !== "declaration" || declaration.trial !== trial || scenario === void 0 || !declaration.procedure.every((step) => scenario.goals.some((goal) => goal.id === step.goal))) throw new StudyError("CUSTODY", "Exchange declaration differs from its trial");
+	const evidenceBytes = await readStudyBytes(join(directory, "execution", "trials", trial, "evidence.jsonl"), manifest.bounds.trial.bytes);
+	validateStudyEvidenceBytes(evidenceBytes, manifest, trial);
+	validateStudyExchangeEvidence(rows, new TextDecoder("utf-8", { fatal: true }).decode(evidenceBytes).split(/\r\n|\n/).slice(0, -1).map((line) => {
+		const row = parseJSON(line);
+		if (!isStudyCustodyEvidence(row)) throw new StudyError("CUSTODY", "Invalid exchange evidence");
+		return row;
+	}));
+	return rows;
+}
+/** Reads a sealed trial's exact complete exchange history after reverifying its entire result.
+* @param result - The sealed execution selected for replay.
+* @param trial - The scheduled trial id.
+* @returns Complete ordered request and response pairs with their verified file and seal identities.
+*/
+async function readStudyExchanges(result, trial) {
+	const reading = await readStudyResult(result.directory);
+	if (reading.status !== "sealed" || reading.seal.id !== result.seal.id) throw new StudyError("CUSTODY", "Replay result is unsealed or changed");
+	const file = reading.seal.files.find((entry) => entry.path === `trials/${trial}/exchanges.jsonl`);
+	if (file === void 0) throw new StudyError("CUSTODY", "Recorded trial is missing its exchange sidecar");
+	const rows = await readStudyTrialExchanges(reading.directory, reading.manifest, trial, file);
+	const declaration = rows[0];
+	const completion = rows.at(-1);
+	if (declaration?.phase !== "declaration" || completion?.phase !== "complete") throw new StudyError("CUSTODY", "Exchange boundaries are missing");
+	const exchanges = rows.flatMap((row, index) => {
+		const response = rows[index + 1];
+		return row.phase === "attempt" && response?.phase === "response" ? [{
+			attempt: row,
+			response
+		}] : [];
+	});
+	const history = {
+		seal: reading.seal.id,
+		file,
+		declaration,
+		exchanges,
+		completion
+	};
+	validateStudyExchangeHistory(history);
+	return history;
+}
 //#endregion
 //#region src/server/stores/StudyEvidenceSink.ts
 /** Retains admitted evidence in order and closes admission before terminal records. */
@@ -1287,6 +2009,93 @@ var StudyEvidenceSink = class {
 	}
 };
 //#endregion
+//#region src/server/stores/StudyExchangeSink.ts
+/** Retains ordered exchange rows under a parent-reserved serialized byte allowance. */
+var StudyExchangeSink = class {
+	#options;
+	#writes = /* @__PURE__ */ new Set();
+	#rows = [];
+	#bytes = 0;
+	#fault;
+	#closing;
+	/** Owns the descriptor and restores a verified prefix without rewriting it.
+	* @param options - The exclusive descriptor, byte bound and optional retained rows.
+	*/
+	constructor(options) {
+		if (!Number.isSafeInteger(options.record.bytes) || options.record.bytes <= 0) throw new StudyError("CONFIG", "Invalid exchange byte allowance");
+		this.#options = {
+			...options,
+			record: { ...options.record }
+		};
+		if (options.retained !== void 0) {
+			const rows = structuredClone(options.retained);
+			validateStudyExchangeRows(rows, false);
+			this.#rows = rows;
+			this.#bytes = rows.reduce((total, row) => total + Buffer.byteLength(JSON.stringify(row) + "\n"), 0);
+			if (this.#bytes > this.#options.record.bytes) throw new StudyError("CAPACITY", "Retained exchange prefix exceeds its allowance");
+		}
+	}
+	/** Holds the next contiguous one-based HTTP ordinal, including the retained prefix. */
+	get next() {
+		return this.#rows.filter((row) => row.phase === "attempt").length + 1;
+	}
+	/** Appends one owned row after validating order and reserving its complete serialized size.
+	* @param row - The next declaration, attempt, terminal or completion.
+	* @returns Completion after synchronized retention; callers await each append before proceeding.
+	*/
+	append(row) {
+		try {
+			if (this.#closing !== void 0 || this.#writes.size !== 0) throw new StudyError("CUSTODY", "Exchange append requires drained open admission");
+			const text = JSON.stringify(row) + "\n";
+			const owned = parseJSON(text);
+			if (!isStudyExchangeRow(owned)) throw new StudyError("CUSTODY", "Invalid exchange row");
+			if (this.#fault !== void 0 && owned.phase !== "failure") throw this.#fault.error;
+			const rows = [...this.#rows, owned];
+			validateStudyExchangeRows(rows, false);
+			const bytes = Buffer.from(text);
+			const reservation = owned.phase === "attempt" ? Buffer.byteLength(JSON.stringify({
+				...owned,
+				phase: "failure",
+				reason: "Exchange failed",
+				body: void 0,
+				digest: void 0,
+				size: void 0
+			}) + "\n") + 1024 : 0;
+			if (this.#bytes + bytes.length + reservation > this.#options.record.bytes) throw new StudyError("CAPACITY", "Serialized exchange bytes exceed the trial allowance");
+			this.#rows = rows;
+			this.#bytes += bytes.length;
+			const pending = this.#write(bytes);
+			this.#writes.add(pending);
+			pending.then(() => this.#writes.delete(pending), () => this.#writes.delete(pending));
+			return pending;
+		} catch (error) {
+			this.#fault ??= { error };
+			return Promise.reject(error);
+		}
+	}
+	/** Closes admission, drains accepted writes and synchronizes the owned descriptor.
+	* @returns Completion after descriptor release, with a retained refusal propagated.
+	*/
+	close() {
+		this.#closing ??= Promise.allSettled([...this.#writes]).then(async () => {
+			await this.#options.file.sync();
+			if (this.#fault !== void 0) throw this.#fault.error;
+		}).finally(async () => {
+			await this.#options.file.close();
+		});
+		return this.#closing;
+	}
+	async #write(bytes) {
+		try {
+			await this.#options.file.writeFile(bytes);
+			await this.#options.file.sync();
+		} catch (error) {
+			this.#fault ??= { error };
+			throw error;
+		}
+	}
+};
+//#endregion
 //#region src/server/stores/StudyResultStore.ts
 /** Owns append-only execution bytes and seals only a complete terminal population. */
 var StudyResultStore = class {
@@ -1294,6 +2103,7 @@ var StudyResultStore = class {
 	#manifest;
 	#trials = /* @__PURE__ */ new Map();
 	#starting = /* @__PURE__ */ new Set();
+	#exchanges = /* @__PURE__ */ new Map();
 	#phase = "new";
 	#bytes = 0;
 	/**
@@ -1331,6 +2141,21 @@ var StudyResultStore = class {
 			throw error;
 		}
 	}
+	/** Reserves a trial's entire exchange allowance before any worker starts.
+	* @param trial - The exact scheduled trial whose manifest declares recording.
+	* @returns Its exclusive sidecar destination, without creating the trial directory.
+	*/
+	async exchanges(trial) {
+		const scheduled = this.#manifest.schedule.find((entry) => entry.id === trial.id);
+		if (this.#phase !== "ready" || !isStudyCustodyTrial(trial) || scheduled === void 0 || this.#manifest.record === void 0 || canonicalStringify(scheduled) !== canonicalStringify(trial) || this.#exchanges.has(trial.id) || this.#trials.has(trial.id) || this.#starting.has(trial.id)) throw new StudyError("CUSTODY", "Trial sidecar cannot be reserved");
+		this.#reserve(this.#manifest.record.bytes);
+		const destination = Object.freeze({
+			path: join(this.#directory, "execution", "trials", scheduled.id, "exchanges.jsonl"),
+			record: Object.freeze({ ...this.#manifest.record })
+		});
+		this.#exchanges.set(scheduled.id, destination);
+		return destination;
+	}
 	/**
 	* Exclusively creates the evidence sink for an exact scheduled trial.
 	* @param trial - The scheduled trajectory
@@ -1341,7 +2166,7 @@ var StudyResultStore = class {
 		if (this.#phase !== "ready" || !isStudyCustodyTrial(trial) || this.#trials.has(trial.id) || this.#starting.has(trial.id)) throw new StudyError("CUSTODY", "Trial cannot start in the current state");
 		const scheduled = this.#manifest.schedule.find((entry) => entry.id === trial.id);
 		const scenario = this.#manifest.scenarios.find((entry) => entry.id === trial.scenario);
-		if (scheduled === void 0 || scenario === void 0 || canonicalStringify(scheduled) !== canonicalStringify(trial)) throw new StudyError("CUSTODY", "Trial differs from the execution schedule");
+		if (scheduled === void 0 || scenario === void 0 || this.#manifest.record !== void 0 && !this.#exchanges.has(trial.id) || canonicalStringify(scheduled) !== canonicalStringify(trial)) throw new StudyError("CUSTODY", "Trial differs from the execution schedule");
 		this.#starting.add(scheduled.id);
 		try {
 			const directory = join(this.#directory, "execution", "trials", scheduled.id);
@@ -1403,8 +2228,15 @@ var StudyResultStore = class {
 			const reading = await readStudyResult(this.#directory);
 			if (reading.status !== "interrupted" || reading.manifest === void 0 || reading.attempts.length !== this.#manifest.schedule.length || canonicalStringify(reading.manifest) !== canonicalStringify(this.#manifest)) throw new StudyError("CUSTODY", "Execution changed before sealing");
 			const files = await scanStudyExecution(join(this.#directory, "execution"), this.#manifest);
-			if (files.length !== 1 + this.#manifest.schedule.length * 2) throw new StudyError("CUSTODY", "Execution inventory is incomplete");
-			for (const trial of this.#manifest.schedule) validateStudyEvidenceBytes(await readStudyBytes(join(this.#directory, "execution", "trials", trial.id, "evidence.jsonl"), this.#manifest.bounds.trial.bytes), this.#manifest, trial.id);
+			if (files.length !== 1 + this.#manifest.schedule.length * (this.#manifest.record === void 0 ? 2 : 3)) throw new StudyError("CUSTODY", "Execution inventory is incomplete");
+			for (const trial of this.#manifest.schedule) {
+				if (this.#manifest.record !== void 0) {
+					const file = files.find((entry) => entry.path === `trials/${trial.id}/exchanges.jsonl`);
+					if (file === void 0 || !this.#exchanges.has(trial.id)) throw new StudyError("CUSTODY", "Recorded trial has no reserved complete sidecar");
+					await readStudyTrialExchanges(this.#directory, this.#manifest, trial.id, file);
+				}
+				validateStudyEvidenceBytes(await readStudyBytes(join(this.#directory, "execution", "trials", trial.id, "evidence.jsonl"), this.#manifest.bounds.trial.bytes), this.#manifest, trial.id);
+			}
 			const seal = Object.freeze({
 				result: this.#manifest.id,
 				id: computeStudySealId(this.#manifest.id, files),
@@ -1601,81 +2433,189 @@ var STUDY_COMMAND_DURATION = 864e5;
 /** Names the trusted command's independent offline predicate. */
 var STUDY_COMMAND_GRADER = "consumer-adapter";
 /** Defines the complete public CLI reference shared by help and grammar diagnostics. */
-var STUDY_COMMAND_HELP = `study check <study> [--profile <name>]
-study execute <study> [--profile <name>] [--out <path>] [--expected <sha256>]
+var STUDY_COMMAND_HELP = `study check <study> [--profile <name>] [--closure <directory>]
+study freeze <study> --profile <name> --to <directory>
+study execute <study> [--profile <name>] [--out <path>] [--expected <sha256>] [--closure <directory>] [--replay <result> --prefix <JSON trial counts> --offline <true|false>]
 study grade <result> --rubric <path>
 study label <result> --grading <sha256> --labels <path>
 study report <result> --grading <sha256>
 study --help
 study --version
 
-Profiles default to local. Flags require values and may appear only once.
+Profiles default to local; freeze requires --profile. Flags require values and may appear only once.
 Results default to tmp/studies/<result>; scratch also uses tmp/studies.
 A result is its id under tmp/studies, a root-relative path, or an absolute path.
 Relative paths, including --out, must stay inside the consumer working directory.
 Output directories must be new; existing results are never overwritten.
 --expected pins the fingerprint returned by check. --grading selects an exact grading.
 --rubric selects independent criteria. --labels imports caller-supplied semantic labels.
+--closure selects retained artifacts. Replay requires explicit prefix counts and offline behavior.
 Success writes one JSON document; next contains suggested argv, never executed automatically.
-check, grade, label and report have a fixed allowance of 60 seconds.
+check, freeze, grade, label and report have a fixed allowance of 60 seconds.
 execute checks first, then uses the declared series duration plus 15 seconds for cleanup.
 Exit codes: 0 success, 64 invalid input, 124 deadline, 130 interruption, 1 operational failure.
 `;
 //#endregion
-//#region src/server/commands/helpers.ts
-/** Reads one declaration file and refuses a missing or linked path with its root-relative path.
-* @param root - The consumer root used to describe a missing or linked declaration.
-* @param path - The already resolved and contained declaration path.
-* @returns The exact declaration bytes under the custody metadata allowance.
-* @throws StudyError - Thrown with code `CONFIG` when the path is missing or linked; other custody refusals retain their codes.
-* @example Read declaration bytes
-* ```ts
-* import { readStudyDeclarationBytes } from '@orkestrel/study/server'
-*
-* declare const root: string
-* declare const path: string
-* await readStudyDeclarationBytes(root, path)
-* ```
+//#region src/server/processes/validators.ts
+/** Checks whether a worker destination has an absolute sidecar path and finite reservation.
+* @param value - The decoded destination.
+* @returns True if its path, allowance and optional retained identity are valid; false otherwise.
 */
-async function readStudyDeclarationBytes(root, path) {
-	try {
-		const absolute = resolve(path);
-		const origin = parse(absolute).root;
-		const names = relative(origin, absolute).split(sep).filter(Boolean);
-		for (const [index] of names.entries()) {
-			const candidate = join(origin, ...names.slice(0, index + 1));
-			const stat = await lstat(candidate);
-			if (stat.isSymbolicLink()) throw new StudyError("CONFIG", `Declaration path is linked: ${relative(root, candidate).split(sep).join("/")}`);
-			if (!stat.isDirectory()) break;
-		}
-		return await readStudyBytes(path, STUDY_CUSTODY_BYTES);
-	} catch (error) {
-		if (matchesSystemError(error, "ENOENT")) throw new StudyError("CONFIG", `Declaration is missing: ${relative(root, path).split(sep).join("/")}`);
-		throw error;
-	}
+function isStudyExchangeDestination(value) {
+	return holds(() => isRecord(value) && matchesStudyKeys(value, ["path", "record"], ["retained"]) && typeof value.path === "string" && isAbsolute(value.path) && basename(value.path) === "exchanges.jsonl" && isStudyRecord(value.record) && (value.retained === void 0 || isStudyCustodyFile(value.retained)));
 }
-/** Reads a study declaration, its driver's scenarios, and its rubric as the command resolves them.
-* @param root - The consumer root containing the studies directory.
-* @param study - The selected study name.
-* @param signal - Optional cancellation checked between scenario reads.
-* @returns The parsed declaration, driver bundle, ordered scenarios, fixtures, and selected rubric.
-* @throws StudyError - Thrown when declarations are missing, invalid, or incompatible.
-* @example Read a study declaration
-* ```ts
-* import type { StudyDeclaration } from '@orkestrel/study/server'
-* import { readStudyDeclaration } from '@orkestrel/study/server'
-*
-* declare const root: string
-* const declaration: StudyDeclaration = await readStudyDeclaration(root, 'assessment')
-* ```
+/** Checks whether replay explicitly selects a sealed directory and per-trial prefix counts.
+* @param value - The decoded replay selection.
+* @returns True if result, offline and every prefix are declared; false otherwise.
 */
-async function readStudyDeclaration(root, study, signal) {
-	const directory = resolveStudyPath(join(root, "studies"), study);
-	const definition = parseStudyDefinition(decodeStudyJSON(await readStudyDeclarationBytes(root, resolveStudyPath(directory, "study.json"))));
-	if (definition.name !== study) throw new StudyError("CONFIG", "Study name differs from its selected directory");
-	const bundle = resolveStudyPath(join(root, "studies"), definition.driver);
-	const steps = [];
-	for (const id of definition.scenarios) {
+function isStudyReplaySelection(value) {
+	return holds(() => isRecord(value) && matchesStudyKeys(value, [
+		"result",
+		"prefix",
+		"offline"
+	]) && typeof value.result === "string" && value.result.length > 0 && typeof value.offline === "boolean" && isRecord(value.prefix) && Object.keys(value.prefix).length > 0 && Object.entries(value.prefix).every(([trial, count]) => isStudyCustodyName(trial) && typeof count === "number" && Number.isSafeInteger(count) && count > 0));
+}
+/** Checks the complete transport envelope before domain handling.
+* @param value - Native IPC decoded value.
+* @returns True if the envelope is bounded in shape and JSON-compatible; false otherwise.
+*/
+function isStudyFrame(value) {
+	return holds(() => isRecord(value) && Object.keys(value).length === 3 && Object.hasOwn(value, "id") && Object.hasOwn(value, "operation") && Object.hasOwn(value, "value") && typeof value.id === "number" && Number.isSafeInteger(value.id) && value.id >= 0 && typeof value.operation === "string" && [
+		"open",
+		"goal",
+		"close",
+		"admit",
+		"finish",
+		"fail",
+		"evidence",
+		"reply",
+		"error",
+		"abort"
+	].includes(value.operation) && isJSONValue(value.value));
+}
+/** Checks operational failure attribution arriving over IPC.
+* @param value - Decoded failure value.
+* @returns True if the failure carries a known cause, an optional role, and an optional stop that satisfies `isStudyStop` on a `capacity` or `deadline` cause; false otherwise.
+*/
+function isStudyProcessFailure(value) {
+	return holds(() => isRecord(value) && typeof value.message === "string" && isStudyCause(value.cause) && (value.role === void 0 || isStudyRole(value.role)) && (value.stop === void 0 || (value.cause === "capacity" || value.cause === "deadline") && isStudyStop(value.stop)));
+}
+/** Checks a request's declared role and finite cost ceilings.
+* @param value - Decoded charge.
+* @returns True if all charge leaves are valid; false otherwise.
+*/
+function isStudyCharge(value) {
+	return holds(() => isRecord(value) && isStudyRole(value.role) && typeof value.tokens === "number" && Number.isSafeInteger(value.tokens) && value.tokens >= 0 && typeof value.bytes === "number" && Number.isSafeInteger(value.bytes) && value.bytes >= 0);
+}
+/** Checks append-only public evidence.
+* @param value - Decoded evidence.
+* @returns True if event, goal and payload are valid; false otherwise.
+*/
+function isStudyEvidence(value) {
+	return holds(() => isRecord(value) && isStudyName(value.event) && isStudyName(value.goal) && isJSONValue(value.value));
+}
+/** Checks a fresh trial's declared identifiers.
+* @param value - Decoded trial.
+* @returns True if every identifier and repetition is valid; false otherwise.
+*/
+function isStudyTrial(value) {
+	return holds(() => isRecord(value) && isStudyName(value.id) && isStudyName(value.scenario) && isStudyName(value.arm) && typeof value.repetition === "number" && Number.isSafeInteger(value.repetition) && value.repetition >= 0);
+}
+/** Checks the exact digest fields carried by the execution declaration.
+* @param value - Decoded identity.
+* @returns True if all required identities are digests; false otherwise.
+*/
+function isStudyIdentity(value) {
+	return holds(() => isRecord(value) && isStudyDigest(value.agent) && isStudyDigest(value.subject) && (value.provider === void 0 || isStudyDigest(value.provider)) && isStudyDigest(value.instrument) && isStudyDigest(value.fixtures) && isStudyDigest(value.profile));
+}
+//#endregion
+//#region src/server/commands/validators.ts
+/** Checks a closure publication before using its command inputs.
+* @param value - The decoded closure.json value.
+* @returns True if relocation, selectors, and both identities are declared; false otherwise.
+*/
+function isStudyClosure(value) {
+	return holds(() => isRecord(value) && isArtifactClosure(value.closure) && isString(value.root) && isString(value.entry) && isStudyName(value.target) && isStudyName(value.profile) && isStudyIdentity(value.source) && isStudyIdentity(value.identity) && isStudyDigest(value.fingerprint));
+}
+//#endregion
+//#region src/server/commands/helpers.ts
+/** Reads and independently verifies an exclusively published closure.
+* @param directory - The canonical closure destination.
+* @returns The verified publication and its copied physical forest.
+* @throws StudyError - Thrown when publication or its command inputs are invalid.
+*/
+function readStudyClosure(directory) {
+	const marker = readArtifact(join(directory, "closure.json"), STUDY_CUSTODY_BYTES);
+	const value = decodeStudyJSON(marker.source);
+	if (!isStudyClosure(value) || value.closure.destination !== directory) throw new StudyError("CONFIG", "Study closure publication is invalid");
+	verifyArtifactClosure(value.closure, true);
+	if (value.root !== directory && !containsArtifact(directory, value.root) || !value.closure.members.some((member) => resolve(directory, ...member.key.split("/")) === value.entry)) throw new StudyError("CONFIG", "Study closure command inputs leave the copied forest");
+	if (readArtifact(join(directory, "closure.json"), 16777216).digest !== marker.digest) throw new StudyError("FAULT", "Study closure publication changed while reading");
+	return value;
+}
+/** Resolves a profile path through a retained physical relocation when selected.
+* @param root - The active consumer root.
+* @param path - The profile's absolute or consumer-relative selection.
+* @param closure - The optional verified physical forest.
+* @returns The active canonical selection.
+*/
+function resolveStudyClosurePath(root, path, closure) {
+	const absolute = resolve(root, path);
+	return closure === void 0 || absolute === closure.destination || containsArtifact(closure.destination, absolute) ? absolute : relocateArtifactPath(closure, absolute);
+}
+/** Reads one declaration file and refuses a missing or linked path with its root-relative path.
+* @param root - The consumer root used to describe a missing or linked declaration.
+* @param path - The already resolved and contained declaration path.
+* @returns The exact declaration bytes under the custody metadata allowance.
+* @throws StudyError - Thrown with code `CONFIG` when the path is missing or linked; other custody refusals retain their codes.
+* @example Read declaration bytes
+* ```ts
+* import { readStudyDeclarationBytes } from '@orkestrel/study/server'
+*
+* declare const root: string
+* declare const path: string
+* await readStudyDeclarationBytes(root, path)
+* ```
+*/
+async function readStudyDeclarationBytes(root, path) {
+	try {
+		const absolute = resolve(path);
+		const origin = parse(absolute).root;
+		const names = relative(origin, absolute).split(sep).filter(Boolean);
+		for (const [index] of names.entries()) {
+			const candidate = join(origin, ...names.slice(0, index + 1));
+			const stat = await lstat(candidate);
+			if (stat.isSymbolicLink()) throw new StudyError("CONFIG", `Declaration path is linked: ${relative(root, candidate).split(sep).join("/")}`);
+			if (!stat.isDirectory()) break;
+		}
+		return await readStudyBytes(path, STUDY_CUSTODY_BYTES);
+	} catch (error) {
+		if (matchesSystemError(error, "ENOENT")) throw new StudyError("CONFIG", `Declaration is missing: ${relative(root, path).split(sep).join("/")}`);
+		throw error;
+	}
+}
+/** Reads a study declaration, its driver's scenarios, and its rubric as the command resolves them.
+* @param root - The consumer root containing the studies directory.
+* @param study - The selected study name.
+* @param signal - Optional cancellation checked between scenario reads.
+* @returns The parsed declaration, driver bundle, ordered scenarios, fixtures, and selected rubric.
+* @throws StudyError - Thrown when declarations are missing, invalid, or incompatible.
+* @example Read a study declaration
+* ```ts
+* import type { StudyDeclaration } from '@orkestrel/study/server'
+* import { readStudyDeclaration } from '@orkestrel/study/server'
+*
+* declare const root: string
+* const declaration: StudyDeclaration = await readStudyDeclaration(root, 'assessment')
+* ```
+*/
+async function readStudyDeclaration(root, study, signal) {
+	const directory = resolveStudyPath(join(root, "studies"), study);
+	const definition = parseStudyDefinition(decodeStudyJSON(await readStudyDeclarationBytes(root, resolveStudyPath(directory, "study.json"))));
+	if (definition.name !== study) throw new StudyError("CONFIG", "Study name differs from its selected directory");
+	const bundle = resolveStudyPath(join(root, "studies"), definition.driver);
+	const steps = [];
+	for (const id of definition.scenarios) {
 		signal?.throwIfAborted();
 		const path = `scenarios/${id}.json`;
 		const bytes = await readStudyDeclarationBytes(root, resolveStudyPath(bundle, path));
@@ -1720,22 +2660,25 @@ function resolveStudyPath(directory, path) {
 * Resolves the execution profile's caller-selected built artifact paths.
 * @param root - The repository root
 * @param profile - The validated source profile
+* @param closure - The optional verified physical forest used to relocate executable selections
 * @returns The reproducible resolved execution profile
 * @example
 * ```ts
 * resolveStudyProfile(root, profile)
 * ```
 */
-function resolveStudyProfile(root, profile) {
+function resolveStudyProfile(root, profile, closure) {
+	const daemon = profile.provider?.daemon;
+	if (daemon !== void 0 && (!isAbsolute(daemon.executable) || realpathSync(daemon.executable) !== daemon.executable)) throw new StudyError("CONFIG", "Daemon executable must name its canonical absolute path");
 	return {
 		...profile,
 		qualification: profile.qualification === void 0 ? void 0 : resolve(root, profile.qualification),
-		agent: resolve(root, profile.agent),
-		subject: resolve(root, profile.subject),
-		roots: profile.roots.map((path) => resolve(root, path)),
+		agent: resolveStudyClosurePath(root, profile.agent, closure),
+		subject: resolveStudyClosurePath(root, profile.subject, closure),
+		roots: profile.roots.map((path) => resolveStudyClosurePath(root, path, closure)),
 		provider: profile.provider === void 0 ? void 0 : {
 			...profile.provider,
-			entry: resolve(root, profile.provider.entry)
+			entry: resolveStudyClosurePath(root, profile.provider.entry, closure)
 		}
 	};
 }
@@ -1997,20 +2940,25 @@ function computeStudyReport(result, rubric, grading) {
 function parseStudyArguments(arguments_) {
 	const command = arguments_[0];
 	const target = arguments_[1];
-	const usage = "study check <study> [--profile <name>]\nstudy execute <study> [--profile <name>] [--out <path>] [--expected <sha256>]\nstudy grade <result> --rubric <path>\nstudy label <result> --grading <sha256> --labels <path>\nstudy report <result> --grading <sha256>\nstudy --help\nstudy --version\n\nProfiles default to local. Flags require values and may appear only once.\nResults default to tmp/studies/<result>; scratch also uses tmp/studies.\nA result is its id under tmp/studies, a root-relative path, or an absolute path.\nRelative paths, including --out, must stay inside the consumer working directory.\nOutput directories must be new; existing results are never overwritten.\n--expected pins the fingerprint returned by check. --grading selects an exact grading.\n--rubric selects independent criteria. --labels imports caller-supplied semantic labels.\nSuccess writes one JSON document; next contains suggested argv, never executed automatically.\ncheck, grade, label and report have a fixed allowance of 60 seconds.\nexecute checks first, then uses the declared series duration plus 15 seconds for cleanup.\nExit codes: 0 success, 64 invalid input, 124 deadline, 130 interruption, 1 operational failure.\n".split("\n").find((line) => line.startsWith("study " + command + " ")) ?? "Expected study check, execute, grade, label, or report; use study --help.";
+	const usage = "study check <study> [--profile <name>] [--closure <directory>]\nstudy freeze <study> --profile <name> --to <directory>\nstudy execute <study> [--profile <name>] [--out <path>] [--expected <sha256>] [--closure <directory>] [--replay <result> --prefix <JSON trial counts> --offline <true|false>]\nstudy grade <result> --rubric <path>\nstudy label <result> --grading <sha256> --labels <path>\nstudy report <result> --grading <sha256>\nstudy --help\nstudy --version\n\nProfiles default to local; freeze requires --profile. Flags require values and may appear only once.\nResults default to tmp/studies/<result>; scratch also uses tmp/studies.\nA result is its id under tmp/studies, a root-relative path, or an absolute path.\nRelative paths, including --out, must stay inside the consumer working directory.\nOutput directories must be new; existing results are never overwritten.\n--expected pins the fingerprint returned by check. --grading selects an exact grading.\n--rubric selects independent criteria. --labels imports caller-supplied semantic labels.\n--closure selects retained artifacts. Replay requires explicit prefix counts and offline behavior.\nSuccess writes one JSON document; next contains suggested argv, never executed automatically.\ncheck, freeze, grade, label and report have a fixed allowance of 60 seconds.\nexecute checks first, then uses the declared series duration plus 15 seconds for cleanup.\nExit codes: 0 success, 64 invalid input, 124 deadline, 130 interruption, 1 operational failure.\n".split("\n").find((line) => line.startsWith("study " + command + " ")) ?? "Expected study check, freeze, execute, grade, label, or report; use study --help.";
 	if (![
 		"check",
+		"freeze",
 		"execute",
 		"grade",
 		"label",
 		"report"
 	].includes(command ?? "")) throw new StudyError("CONFIG", "Unknown or missing command " + JSON.stringify(command ?? "<command>") + ". " + usage);
-	if (target === void 0 || target === "" || target.startsWith("-")) throw new StudyError("CONFIG", "Missing <" + (command === "check" || command === "execute" ? "study" : "result") + "> before " + JSON.stringify(target ?? "<end>") + ". " + usage);
-	const allowed = command === "check" ? ["--profile"] : command === "execute" ? [
+	if (target === void 0 || target === "" || target.startsWith("-")) throw new StudyError("CONFIG", "Missing <" + (command === "check" || command === "execute" || command === "freeze" ? "study" : "result") + "> before " + JSON.stringify(target ?? "<end>") + ". " + usage);
+	const allowed = command === "check" ? ["--profile", "--closure"] : command === "execute" ? [
 		"--profile",
 		"--out",
-		"--expected"
-	] : command === "grade" ? ["--rubric"] : command === "label" ? ["--grading", "--labels"] : ["--grading"];
+		"--expected",
+		"--closure",
+		"--replay",
+		"--prefix",
+		"--offline"
+	] : command === "freeze" ? ["--profile", "--to"] : command === "grade" ? ["--rubric"] : command === "label" ? ["--grading", "--labels"] : ["--grading"];
 	const tokens = arguments_.slice(2);
 	const pairs = [...tokens.entries()].flatMap(([index, flag]) => index % 2 === 0 ? [{
 		flag,
@@ -2023,24 +2971,50 @@ function parseStudyArguments(arguments_) {
 		if (value === void 0 || value === "" || value.startsWith("-")) throw new StudyError("CONFIG", flag + " requires a value before " + JSON.stringify(value ?? "<end>") + ". " + usage);
 	}
 	const flags = new Map(pairs.flatMap(({ flag, value }) => flag === void 0 || value === void 0 ? [] : [[flag, value]]));
-	if (command === "check" || command === "execute") {
+	if (command === "check" || command === "execute" || command === "freeze") {
 		if (!isStudyCustodyName(target)) throw new StudyError("CONFIG", "Invalid study token " + JSON.stringify(target) + "; use a portable study name. " + usage);
 		const profile = flags.get("--profile") ?? "local";
 		const out = flags.get("--out");
 		const expected = flags.get("--expected");
 		if (!isStudyCustodyName(profile)) throw new StudyError("CONFIG", "--profile " + JSON.stringify(profile) + " must be a portable name. " + usage);
+		if (command === "freeze") {
+			if (!flags.has("--profile")) throw new StudyError("CONFIG", "Missing --profile. " + usage);
+			const destination = flags.get("--to");
+			if (destination === void 0) throw new StudyError("CONFIG", "Missing --to. " + usage);
+			if (!isAbsolute(destination)) resolveStudyPath(resolve("."), destination);
+			return {
+				command,
+				target,
+				profile,
+				destination
+			};
+		}
 		if (out !== void 0 && !isAbsolute(out)) try {
 			resolveStudyPath(resolve("."), out);
 		} catch {
 			throw new StudyError("CONFIG", "--out " + JSON.stringify(out) + " must be a portable contained path and cannot escape the consumer root. " + usage);
 		}
 		if (expected !== void 0 && !isStudyDigest(expected)) throw new StudyError("CONFIG", "--expected " + JSON.stringify(expected) + " must be a SHA-256 fingerprint. " + usage);
+		const closure = flags.get("--closure");
+		if (closure !== void 0 && !isAbsolute(closure)) resolveStudyPath(resolve("."), closure);
+		const result = flags.get("--replay");
+		const prefix = flags.get("--prefix");
+		const offline = flags.get("--offline");
+		if (result === void 0 && (prefix !== void 0 || offline !== void 0)) throw new StudyError("CONFIG", "--prefix and --offline require --replay. " + usage);
+		const replay = result === void 0 ? void 0 : parseJSON(prefix ?? "");
+		if (result !== void 0 && (!isRecord(replay) || Object.keys(replay).length === 0 || !Object.entries(replay).every(([trial, count]) => isStudyCustodyName(trial) && typeof count === "number" && Number.isSafeInteger(count) && count > 0) || offline !== "true" && offline !== "false")) throw new StudyError("CONFIG", "--replay requires --prefix trial counts and --offline true or false. " + usage);
 		return {
 			command,
 			target,
 			profile,
 			out,
-			expected
+			expected,
+			...closure === void 0 ? {} : { closure },
+			...result === void 0 || !isRecord(replay) ? {} : { replay: {
+				result,
+				prefix: Object.fromEntries(Object.entries(replay).map(([trial, count]) => [trial, Number(count)])),
+				offline: offline === "true"
+			} }
 		};
 	}
 	if (command === "grade") {
@@ -2091,338 +3065,734 @@ var STUDY_COMMAND_OPERATION = "study-command";
 /** Caps pure domain work independently of its event loop. */
 var STUDY_TASK_DURATION = 6e4;
 //#endregion
-//#region src/server/processes/helpers.ts
-/** Projects optional domain fields into the JSON wire representation.
-* @param value - An owned domain value with optional undefined fields.
-* @returns A JSON-compatible snapshot.
-* @example Project a wire value
-* ```ts
-* import { valueToWire } from '@orkestrel/study/server'
-*
-* valueToWire({ state: 'ready', failure: undefined }) // { state: 'ready' }
-* ```
+//#region src/server/ollama/helpers.ts
+/**
+* Declares the pinned serving identities the Ollama transport verifies, keyed by the label their inventory evidence carries.
+* @param provider - Declared serving identities
+* @returns The model pin, plus the judge pin when the provider declares both the judge name and its digest
 */
-function valueToWire(value) {
-	const parsed = JSON.parse(JSON.stringify(value));
-	if (!isJSONValue(parsed)) throw new StudyError("FAULT", "Invalid study wire value");
-	return parsed;
+function buildStudyOllamaModels(provider) {
+	return {
+		model: {
+			name: provider.model,
+			digest: provider.digest.model
+		},
+		...provider.judge === void 0 || provider.digest.judge === void 0 ? {} : { judge: {
+			name: provider.judge,
+			digest: provider.digest.judge
+		} }
+	};
 }
-/** Creates attributable protocol infrastructure failure.
-* @param message - The refused operation or broken boundary.
-* @returns A domain failure that never awards task credit.
+/**
+* Builds the provider options one role's declared wire policy determines.
+* @remarks
+* The policy's `options` object keeps its identity and key order. A strict policy adds `truncate`
+* and `shift` as `false`; any other policy omits both keys. The `length` allowance is read by the
+* transport and projects nothing.
+* @param policy - The role's declared wire policy
+* @returns The model, think flag, options object, and the strict native fields when declared
 */
-function createStudyProcessFailure(message) {
+function buildStudyOllamaOptions(policy) {
 	return {
-		cause: "infrastructure",
-		message,
-		role: void 0,
-		stop: void 0
+		model: policy.model,
+		options: policy.options,
+		think: policy.think,
+		...policy.strict ? {
+			truncate: false,
+			shift: false
+		} : {}
 	};
 }
-/** Binds the canonical fully resolved execution profile carried over IPC.
-* @param profile - The resolved execution settings, with optional absent leaves.
-* @returns The SHA256 digest of the canonical JSON wire representation.
+/**
+* Validates declared role policies against the pinned inventory before any dispatch.
+* @param roles - The declared wire policy of each model role
+* @param models - The pinned served identities
+* @returns Nothing when every policy names a pinned model and a positive output allowance
+* @throws StudyError - Thrown with code `CONFIG` when a policy names an unpinned model, declares no positive safe-integer `num_predict`, or makes the raw judge wire strict
 */
-function computeStudyProfileDigest(profile) {
-	const encoded = canonicalStringify(valueToWire(profile));
-	if (encoded === void 0) throw new StudyError("CONFIG", "Study profile is not JSON-compatible");
-	return hashStudyBytes(encoded);
+function validateStudyOllamaRoles(roles, models) {
+	const names = Object.values(models).map((model) => model.name);
+	for (const [role, policy] of Object.entries(roles)) {
+		if (policy === void 0) continue;
+		if (!names.includes(policy.model)) throw new StudyError("CONFIG", "Ollama role policy names a model the inventory does not pin");
+		const output = policy.options.num_predict;
+		if (output === void 0 || !Number.isSafeInteger(output) || output <= 0) throw new StudyError("CONFIG", "Ollama role policy declares no positive num_predict allowance");
+		if (role === "judge" && policy.strict) throw new StudyError("CONFIG", "Ollama strict fields apply only to chat roles");
+	}
 }
-/** Collects the executable entries a profile selects, each canonical path once.
-* @param profile - The resolved execution profile.
-* @returns The agent, subject, and provider entries without repeating a shared entry.
-* @remarks The declared roles stay separate in the profile; only capture and loading deduplicate.
+/** Encodes exact application bytes with their decoded size and SHA-256 identity.
+* @param bytes - The request or response application bytes.
+* @returns Canonical base64 and the independent byte receipt.
 */
-function collectStudyEntries(profile) {
-	return [.../* @__PURE__ */ new Set([
-		profile.agent,
-		profile.subject,
-		...profile.provider === void 0 ? [] : [profile.provider.entry]
-	])];
+function buildStudyOllamaBytes(bytes) {
+	return {
+		body: Buffer.from(bytes).toString("base64"),
+		digest: hashStudyBytes(bytes),
+		size: bytes.byteLength
+	};
 }
-/** Computes the instrument identity binding trusted runtime bytes to the adapter inventory.
-* @param entry - The SHA-256 identity of the trusted runtime entry bytes.
-* @param inventory - The captured adapter inventory digest.
-* @returns The identity that validation, grading, and trial children must share.
+/** Validates independent metadata bounds and the complete optional recording group.
+* @param options - The owned transport configuration.
+* @returns Nothing when declarations are executable.
+* @throws StudyError - Thrown with CONFIG for invalid bounds, groups, identities or ordered policies.
 */
-function computeStudyInstrumentDigest(entry, inventory) {
-	return hashStudyBytes(JSON.stringify([entry, inventory]));
+function validateStudyOllamaRecording(options) {
+	if (!isStudyOllamaMetadata(options.metadata)) throw new StudyError("CONFIG", "Invalid independent metadata budget");
+	if (!Object.values(options.models).every(isStudyOllamaModel)) throw new StudyError("CONFIG", "Invalid pinned model identity");
+	const declared = [
+		options.version,
+		options.procedure,
+		options.exchanges
+	].filter((value) => value !== void 0).length;
+	if (declared === 0) return;
+	if (declared !== 3 || typeof options.version !== "string" || options.version.length === 0 || !Array.isArray(options.procedure) || options.exchanges === void 0 || !Number.isSafeInteger(options.exchanges.next) || options.exchanges.next < 1) throw new StudyError("CONFIG", "Recording requires version, procedure and an exchange sink");
+	for (const [index, step] of options.procedure.entries()) {
+		if (!isStudyOllamaStep(step) || step.ordinal !== index + 1 || canonicalStringify(step.policy) !== canonicalStringify(options.roles[step.role])) throw new StudyError("CONFIG", "Invalid ordered model-step declaration");
+		if (step.admission === "exact") readStudyOllamaRequest(options, step.role, new URL(step.path, options.url), {
+			method: "POST",
+			body: step.body
+		});
+	}
 }
-/** Resolves the actual host package from its trusted executable entry.
-* @param entry - The runtime's own executable, never a consumer-supplied module.
-* @returns The canonical study package root.
+/** Admits one model request against its next exact or capture declaration.
+* @param step - The next model step, absent after the procedure ends.
+* @param goal - The bound goal identity.
+* @param request - The independently validated request policy and byte length.
+* @param body - The owned encoded request body.
+* @returns Nothing when identity, policy and bytes match the declaration.
+* @throws StudyError - Thrown with FAULT before sending any mismatched request.
 */
-function resolveStudyInstrument(entry) {
-	const root = collectStudyAncestors(dirname(realpathSync(entry))).find((directory) => {
-		const manifest = join(directory, "package.json");
-		if (!existsSync(manifest)) return false;
-		const value = JSON.parse(readFileSync(manifest, "utf8"));
-		return isRecord(value) && value.name === "@orkestrel/study";
-	});
-	if (root === void 0) throw new StudyError("CONFIG", "Cannot locate the study runtime package");
-	return root;
+function validateStudyOllamaStep(step, goal, request, body) {
+	if (step === void 0 || step.goal !== goal || step.role !== request.role || step.path !== request.path || typeof body !== "string" || (step.admission === "exact" ? !Buffer.from(step.body).equals(Buffer.from(body)) : step.bytes !== request.bytes)) throw new StudyError("FAULT", "Request differs from the declared model step");
 }
-/** Reads the version of the study package that owns an executable entry.
-* @param entry - The installed runtime's executable entry.
-* @returns The non-empty version declared by the owning study package.
-* @throws StudyError - Thrown when no study package owns the entry or its version is absent or empty.
-* @example Read the installed version
-* ```ts
-* import { readStudyVersion } from '@orkestrel/study/server'
-*
-* declare const entry: string
-* readStudyVersion(entry)
-* ```
+/**
+* Reads exact outbound Ollama facts and refuses a request outside its declared policy.
+* @remarks
+* The refusal happens before admission, so a refused request is never accounted.
+* @param options - The admitted origin, pinned inventory, and declared role policies
+* @param role - The responsible request role
+* @param input - The requested URL
+* @param init - The native fetch settings
+* @returns The validated dispatch facts
+* @throws StudyError - Thrown with code `CONFIG` when the endpoint, model, options, flags, or strict fields differ from the declaration, or the role declares no policy
 */
-function readStudyVersion(entry) {
-	const value = JSON.parse(readFileSync(join(resolveStudyInstrument(entry), "package.json"), "utf8"));
-	if (!isRecord(value) || typeof value.version !== "string" || value.version.length === 0) throw new StudyError("CONFIG", "Study runtime package declares no version");
-	return value.version;
-}
-/** Collects a directory and each of its ancestors up to the filesystem root, nearest first.
-* @param directory - The absolute directory to start from.
-* @returns The directory followed by every parent directory, ending at the root.
-*/
-function collectStudyAncestors(directory) {
-	const parent = dirname(directory);
-	return parent === directory ? [directory] : [directory, ...collectStudyAncestors(parent)];
+function readStudyOllamaRequest(options, role, input, init) {
+	if (input instanceof Request) throw new StudyError("CONFIG", "Ollama transport requires explicit URL requests");
+	const url = new URL(input);
+	const path = role === "metadata" ? init?.method === "POST" ? "/api/show" : url.pathname === "/api/version" ? "/api/version" : "/api/tags" : role === "judge" ? "/api/generate" : "/api/chat";
+	if (url.origin !== new URL(options.url).origin || url.pathname !== path || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "") throw new StudyError("CONFIG", "Ollama transport endpoint differs from the admitted origin and path");
+	if (role === "metadata") {
+		if (path === "/api/show") {
+			if (typeof init?.body !== "string") throw new StudyError("CONFIG", "Invalid model metadata request");
+			const body = JSON.parse(init.body);
+			if (!isRecord(body) || Object.keys(body).length !== 1 || typeof body.model !== "string" || !Object.values(options.models).some((model) => model.name === body.model)) throw new StudyError("CONFIG", "Invalid model metadata identity");
+			return {
+				role,
+				path,
+				model: body.model,
+				output: 0,
+				bytes: new TextEncoder().encode(init.body).byteLength,
+				options: {},
+				strict: false,
+				length: false
+			};
+		}
+		if (init?.method !== "GET" || init.body !== void 0) throw new StudyError("CONFIG", "Invalid inventory request");
+		return {
+			role,
+			path,
+			model: void 0,
+			output: 0,
+			bytes: 0,
+			options: {},
+			strict: false,
+			length: false
+		};
+	}
+	if (init?.method !== "POST" || typeof init.body !== "string") throw new StudyError("CONFIG", "Ollama transport requires an encoded JSON POST");
+	const policy = role === "tool" || role === "maintenance" ? void 0 : options.roles[role];
+	if (policy === void 0) throw new StudyError("CONFIG", "Ollama transport role has no declared wire policy");
+	const output = policy.options.num_predict;
+	if (output === void 0 || !Number.isSafeInteger(output) || output <= 0) throw new StudyError("CONFIG", "Ollama role policy declares no positive num_predict allowance");
+	const body = JSON.parse(init.body);
+	if (!isRecord(body) || body.model !== policy.model || !isRecord(body.options) || canonicalStringify(body.options) !== canonicalStringify(policy.options) || body.stream !== (role !== "judge")) throw new StudyError("CONFIG", "Ollama transport model or effective options differ from the declared policy");
+	if (role === "judge" ? body.raw !== true || body.logprobs !== true : typeof body.think !== "boolean" || body.think === true && !policy.think) throw new StudyError("CONFIG", "Ollama transport flags differ from the declared policy");
+	const strict = policy.strict && role !== "judge";
+	if (strict && (body.truncate !== false || body.shift !== false)) throw new StudyError("CONFIG", "Ollama transport must disable native truncation and shifting");
+	return {
+		role,
+		path,
+		model: policy.model,
+		output,
+		bytes: new TextEncoder().encode(init.body).byteLength,
+		options: { ...policy.options },
+		strict,
+		length: policy.length
+	};
 }
-/** Refuses a profile that omits the actual host runtime's declared dependency bytes.
-* @param instrument - The canonical package owning the trusted runtime entry.
-* @param roots - Explicitly admitted package roots, including the instrument.
+/**
+* Reads the declared model context ceiling without claiming daemon allocation.
+* @param value - The parsed Ollama show response
+* @param context - The requested total context
+* @returns The unambiguous model context ceiling
+* @throws StudyError - Thrown with code `FAULT` when context metadata is missing, or `CAPACITY` when it is ambiguous or below the requested context
 */
-function validateStudyRuntime(instrument, roots) {
-	const pending = [instrument];
-	const visited = /* @__PURE__ */ new Set();
-	while (pending.length > 0) {
-		const root = pending.pop();
-		if (root === void 0 || visited.has(root)) continue;
-		visited.add(root);
-		if (!roots.includes(root)) throw new StudyError("CONFIG", `Profile roots omit a runtime dependency: ${root}`);
-		const manifest = join(root, "package.json");
-		const value = JSON.parse(readFileSync(manifest, "utf8"));
-		if (!isRecord(value) || value.dependencies === void 0) continue;
-		if (!isRecord(value.dependencies)) throw new StudyError("CONFIG", "Runtime dependency declarations are invalid");
-		const resolver = createRequire(manifest);
-		for (const dependency of Object.keys(value.dependencies)) pending.push(dirname(realpathSync(resolver.resolve(`${dependency}/package.json`))));
+function readStudyOllamaSupport(value, context) {
+	if (!isRecord(value) || !isRecord(value.model_info) || typeof value.model_info["general.architecture"] !== "string") throw new StudyError("FAULT", "Missing model context metadata");
+	const architecture = value.model_info["general.architecture"];
+	const keys = Object.keys(value.model_info).filter((key) => key.endsWith(".context_length"));
+	const ceiling = value.model_info[`${architecture}.context_length`];
+	if (keys.length !== 1 || typeof ceiling !== "number" || !Number.isSafeInteger(ceiling) || ceiling < context) {
+		const message = "Model context metadata does not support the requested context";
+		throw new StudyError("CAPACITY", message, {
+			cause: "capacity",
+			message,
+			role: void 0,
+			stop: {
+				layer: "model",
+				id: "context_length",
+				max: keys.length === 1 && Number.isSafeInteger(ceiling) ? parseStudyReading(ceiling) : void 0,
+				consumed: context
+			}
+		});
 	}
+	return ceiling;
 }
-/** Releases inherited output handles a bounded time after native exit.
-* @param child - A newly spawned child, subscribed before native exit.
-* @remarks A descendant that outlives an exited root is outside discoverable-tree cleanup; this only stops the parent from waiting on its pipes.
+/**
+* Reads a native Ollama error member as the attributable failure it names, without usage.
+* @remarks
+* No token usage is read from the member.
+* The failure is `CAPACITY` when the member, a string or an object, names the exact structured
+* type `exceed_context_size_error` with a finite positive integer `n_prompt_tokens` above `n_ctx`,
+* a `code` of 400 if supplied, and a status of 400 if supplied. Every other member, a malformed
+* one included, is `FAULT` with its readable reason.
+* @param value - The parsed HTTP error body or wire row
+* @param role - The responsibility whose request was dispatched; the failure retains it
+* @param status - The HTTP status of the carrying response; undefined for a row of a stream that answered 200
+* @returns Undefined when the value carries no `error` member; otherwise the attributable failure
 */
-function drainStudyChild(child) {
-	const closed = new AbortController();
-	child.once("exit", () => {
-		setTimeout$1(STUDY_DRAIN_DURATION, void 0, { signal: closed.signal }).then(() => {
-			child.stdout?.destroy();
-			child.stderr?.destroy();
-		}, () => void 0);
+function readStudyOllamaFailure(value, role, status) {
+	if (!isRecord(value) || !("error" in value)) return void 0;
+	const field = value.error;
+	const decoded = typeof field === "string" ? parseJSON(field) : field;
+	const structured = isRecord(decoded) ? isRecord(decoded.error) ? decoded.error : decoded : void 0;
+	const native = structured?.message;
+	const text = typeof native === "string" && native.trim() !== "" ? native : typeof field === "string" ? field : "";
+	const label = structured?.type;
+	const type = typeof label === "string" && label !== "" ? label : void 0;
+	const origin = status === void 0 ? "Ollama error" : `Ollama HTTP ${status} error`;
+	const prompt = structured?.n_prompt_tokens;
+	const limit = structured?.n_ctx;
+	const capacity = type === "exceed_context_size_error" && isInteger(prompt) && prompt > 0 && isInteger(limit) && limit > 0 && prompt > limit && (structured?.code === void 0 || structured?.code === 400) && (status === void 0 || status === 400);
+	const reason = text.trim() === "" && type === void 0 ? `Malformed ${origin}` : `${origin}${type === void 0 ? "" : ` (${type})`}${text.trim() === "" ? "" : `: ${text}`}`;
+	return new StudyError(capacity ? "CAPACITY" : "FAULT", reason, {
+		cause: capacity ? "capacity" : "infrastructure",
+		message: reason,
+		role,
+		stop: capacity ? {
+			layer: "model",
+			id: "num_ctx",
+			max: parseStudyReading(limit),
+			consumed: parseStudyReading(prompt)
+		} : void 0
 	});
-	child.once("close", () => closed.abort());
 }
-/** Terminates the recorded native process tree under a finite cleanup allowance.
-* @param child - The exclusively owned child process.
+/**
+* Reads one Ollama response row without inventing absent usage.
+* @param value - The parsed wire row
+* @param request - The admitted dispatch
+* @returns The terminal facts, or undefined for a nonterminal row
+* @throws StudyError - Thrown with the recognized provider failure when the row carries an `error` member, before any other row check; `FAULT` for a malformed row, model, message, finish reason, or usage
 */
-function terminateStudyChild(child) {
-	if (child.pid === void 0 || child.exitCode !== null || child.signalCode !== null) return;
-	try {
-		if (process.platform === "win32") execFileSync("taskkill", [
-			"/PID",
-			String(child.pid),
-			"/T",
-			"/F"
-		], {
-			windowsHide: true,
-			timeout: 2e3,
-			stdio: "ignore"
-		});
-		else {
-			const rows = execFileSync("ps", ["-eo", "pid=,ppid="], {
-				timeout: 2e3,
-				encoding: "utf8",
-				maxBuffer: 1048576
-			}).trim().split(/\r\n|\n/).map((row) => row.trim().split(/\s+/).map(Number));
-			const descendants = /* @__PURE__ */ new Set([child.pid]);
-			rows.forEach(() => {
-				for (const [pid, parent] of rows) if (pid !== void 0 && parent !== void 0 && descendants.has(parent)) descendants.add(pid);
-			});
-			for (const pid of [...descendants].reverse()) try {
-				process.kill(pid, "SIGKILL");
-			} catch (error) {
-				if (!matchesSystemError(error, "ESRCH")) throw error;
-			}
-		}
-	} catch (error) {
-		try {
-			process.kill(child.pid, 0);
-		} catch (status) {
-			if (matchesSystemError(status, "ESRCH")) return;
-			throw status;
-		}
-		if (child.exitCode === null && child.signalCode === null) {
-			child.kill("SIGKILL");
-			throw error;
+function readStudyOllamaTerminal(value, request) {
+	const failure = readStudyOllamaFailure(value, request.role);
+	if (failure !== void 0) throw failure;
+	if (!isRecord(value) || typeof value.done !== "boolean") throw new StudyError("FAULT", "Malformed Ollama response row");
+	if (value.model !== request.model) throw new StudyError("FAULT", "Ollama response model differs from the dispatched model");
+	if (request.role !== "judge") {
+		if (!isRecord(value.message) || typeof value.message.content !== "string" || value.message.thinking !== void 0 && typeof value.message.thinking !== "string") throw new StudyError("FAULT", "Malformed Ollama message");
+		if (value.message.tool_calls !== void 0) {
+			if (!isArray(value.message.tool_calls)) throw new StudyError("FAULT", "Malformed Ollama tool calls");
+			for (const call of value.message.tool_calls) if (!isRecord(call) || !isRecord(call.function) || typeof call.function.name !== "string" || !isRecord(call.function.arguments)) throw new StudyError("FAULT", "Malformed Ollama tool call");
 		}
 	}
+	if (!value.done) return void 0;
+	if (typeof value.done_reason !== "string" || value.done_reason.length === 0) throw new StudyError("FAULT", "Missing Ollama finish reason");
+	for (const key of ["prompt_eval_count", "eval_count"]) if (value[key] !== void 0 && (typeof value[key] !== "number" || !Number.isSafeInteger(value[key]) || value[key] < 0)) throw new StudyError("FAULT", "Malformed Ollama usage", {
+		cause: "infrastructure",
+		message: "Malformed Ollama usage",
+		role: request.role,
+		stop: void 0
+	});
+	return {
+		prompt: typeof value.prompt_eval_count === "number" ? value.prompt_eval_count : void 0,
+		completion: typeof value.eval_count === "number" ? value.eval_count : void 0,
+		reason: value.done_reason
+	};
 }
-//#endregion
-//#region src/server/processes/StudyArtifactLoader.ts
-/** Binds consumer instrumentation separately from selected executable identities. */
-var StudyArtifactLoader = class {
-	#options;
-	#loader;
-	#instrument;
-	#identity;
-	#entry;
-	/** Owns resolved built and consumer source selections.
-	* @param options - The trusted host, adapter, and profile.
-	*/
-	constructor(options) {
-		this.#options = structuredClone(options);
-		if (![
-			options.entry,
-			options.root,
-			options.adapter,
-			...collectStudyEntries(options.profile),
-			...options.profile.roots
-		].every(isAbsolute)) throw new StudyError("CONFIG", "Study artifact paths must be absolute");
-	}
-	/** Inventories bytes without importing selected code.
-	* @returns Bound executable and instrumentation identities.
-	*/
-	async inspect() {
-		if (this.#identity !== void 0) {
-			this.verify();
-			return this.#identity;
-		}
-		const profile = this.#options.profile;
-		const instrument = resolveStudyInstrument(this.#options.entry);
-		const roots = [.../* @__PURE__ */ new Set([...profile.roots, instrument])];
-		validateStudyRuntime(instrument, roots);
-		const source = {
-			root: dirname(this.#options.adapter),
-			entry: this.#options.adapter
-		};
-		this.#instrument = new ArtifactLoader({
-			entries: [],
-			roots,
-			source,
-			instrument
-		});
-		const entry = hashStudyBytes(await readStudyBytes(this.#options.entry, STUDY_CUSTODY_BYTES));
-		this.#entry = entry;
-		this.#loader = new ArtifactLoader({
-			entries: collectStudyEntries(profile),
-			roots,
-			source,
-			instrument
+/**
+* Checks terminal policy after the actual wire cost has been retained.
+* @param terminal - The valid terminal facts
+* @param room - The reserved context and safety margin
+* @param request - The admitted dispatch and its declared finish policy; every refusal retains its role
+* @returns Nothing when the completion satisfies the declared policy
+* @throws StudyError - Thrown with code `CAPACITY` when the actual prompt exceeds its room, generation exceeds its allowance, or an undeclared `length` finish or capped generation occurs; `FAULT` for another unsupported finish reason
+*/
+function validateStudyOllamaCompletion(terminal, room, request) {
+	const { prompt, completion, reason } = terminal;
+	const { role } = request;
+	const capped = {
+		layer: "model",
+		id: "num_predict",
+		max: request.output,
+		consumed: completion
+	};
+	const ceiling = room.context - request.output - room.safety;
+	if (prompt !== void 0 && prompt > ceiling) {
+		const message = "Actual prompt exceeded reserved context capacity";
+		throw new StudyError("CAPACITY", message, {
+			cause: "capacity",
+			message,
+			role,
+			stop: {
+				layer: "window",
+				id: "Context room",
+				max: ceiling,
+				consumed: prompt
+			}
 		});
-		const inventory = this.#loader.inspect();
-		this.#identity = Object.freeze({
-			agent: inventory.digest,
-			subject: inventory.digest,
-			provider: profile.provider === void 0 ? void 0 : inventory.digest,
-			instrument: computeStudyInstrumentDigest(entry, this.#instrument.inspect().digest)
+	}
+	if (completion !== void 0 && completion > request.output) {
+		const message = "Actual generation exceeded the output allowance";
+		throw new StudyError("CAPACITY", message, {
+			cause: "capacity",
+			message,
+			role,
+			stop: capped
 		});
-		this.verify();
-		return this.#identity;
 	}
-	/** Loads the adapter from the trial inventory.
-	* @returns The complete consumer adapter.
-	*/
-	async adapter() {
-		await this.inspect();
-		if (this.#loader === void 0) throw new StudyError("CONFIG", "Artifact inspection is required");
-		return readStudyAdapter(await this.#loader.load(this.#options.adapter));
+	if (!request.length && (reason === "length" || completion !== void 0 && completion >= request.output)) {
+		const message = "Substantive generation reached its output cap";
+		throw new StudyError("CAPACITY", message, {
+			cause: "capacity",
+			message,
+			role,
+			stop: capped
+		});
 	}
-	/** Loads admitted built namespaces inside the trial child.
-	* @returns The agent, subject and optional provider; a shared entry loads once and keeps each role.
-	*/
-	async load() {
-		await this.inspect();
-		if (this.#loader === void 0) throw new StudyError("CONFIG", "Artifact inspection is required");
-		const profile = this.#options.profile;
-		const loaded = [];
-		for (const entry of collectStudyEntries(profile)) loaded.push([entry, await this.#loader.load(entry)]);
-		const namespaces = new Map(loaded);
-		this.verify();
-		const provider = profile.provider;
-		return Object.freeze({
-			agent: namespaces.get(profile.agent),
-			subject: namespaces.get(profile.subject),
-			provider: provider === void 0 ? void 0 : namespaces.get(provider.entry)
+	if (reason !== "stop" && !(request.length && reason === "length")) {
+		const message = "Unsupported Ollama finish reason";
+		throw new StudyError("FAULT", message, {
+			cause: "infrastructure",
+			message,
+			role,
+			stop: void 0
 		});
 	}
-	/** Refuses instrument and inventory drift after inspection. */
-	verify() {
-		if (this.#loader === void 0 || this.#instrument === void 0) throw new StudyError("CONFIG", "Artifact inspection is required");
-		if (hashStudyBytes(readFileSync(this.#options.entry)) !== this.#entry) throw new StudyError("FAULT", "Study instrument bytes drifted");
-		this.#loader.verify();
-		this.#instrument.verify();
+}
+/**
+* Verifies that each pinned name resolves to one inventory entry with its pinned digest.
+* @param value - The parsed inventory response
+* @param models - The pinned served identities
+* @returns Nothing for a matching inventory
+* @throws StudyError - Thrown with code `FAULT` when the inventory is unsupported or a pinned identity does not match
+*/
+function validateStudyOllamaInventory(value, models) {
+	if (!isObject(value) || !("models" in value) || !isArray(value.models)) throw new StudyError("FAULT", "Unsupported Ollama inventory");
+	const served = value.models;
+	for (const { name, digest } of Object.values(models)) {
+		const matches = served.filter((model) => isRecord(model) && model.name === name);
+		const model = matches[0];
+		if (matches.length !== 1 || !isRecord(model) || typeof model.digest !== "string" || model.digest.replace(/^sha256:/, "") !== digest.replace(/^sha256:/, "")) throw new StudyError("FAULT", "Serving inventory does not match the required model digest");
 	}
-};
+}
+/**
+* Reads the pinned serving digest of an admitted request's model.
+* @param models - The pinned served identities
+* @param request - The admitted dispatch
+* @returns The pinned digest, or undefined for an inventory request or an unpinned model
+*/
+function readStudyOllamaDigest(models, request) {
+	if (request.model === void 0) return void 0;
+	return Object.values(models).find((model) => model.name === request.model)?.digest;
+}
+/**
+* Reads daemon timing from a terminal row without letting an observation fail the request.
+* @param extract - The admitted extractor
+* @param record - The validated terminal row
+* @returns The raw timing, or undefined when absent or the extractor throws
+*/
+function readStudyOllamaTiming(extract, record) {
+	try {
+		return extract(record);
+	} catch {
+		return;
+	}
+}
+/**
+* Builds the JSON evidence form of a timing observation with raw nanoseconds and counts.
+* @param timing - The extracted timing
+* @returns Null when no terminal timing was observed; otherwise every unreported member as null
+*/
+function buildStudyOllamaTiming(timing) {
+	if (timing === void 0) return null;
+	return {
+		durations: {
+			total: timing.durations.total ?? null,
+			load: timing.durations.load ?? null,
+			prompt: timing.durations.prompt ?? null,
+			decode: timing.durations.decode ?? null
+		},
+		counts: {
+			prompt: timing.counts.prompt ?? null,
+			decode: timing.counts.decode ?? null,
+			cached: timing.counts.cached ?? null
+		},
+		invalid: [...timing.invalid]
+	};
+}
+/**
+* Builds a reading of the raw prompt text an encoded request body carries, as sent.
+* @param body - The encoded request body
+* @returns The prompt's UTF-16 code units and UTF-8 bytes, labeled with its encoding, or undefined when there is no string prompt; these are readings of the actual text, not token allocations
+*/
+function buildStudyOllamaRaw(body) {
+	if (typeof body !== "string") return void 0;
+	const parsed = attempt(() => JSON.parse(body));
+	if (!parsed.success || !isRecord(parsed.value) || typeof parsed.value.prompt !== "string") return void 0;
+	return {
+		encoding: "utf-8",
+		units: parsed.value.prompt.length,
+		bytes: new TextEncoder().encode(parsed.value.prompt).byteLength
+	};
+}
 //#endregion
-//#region src/server/processes/validators.ts
-/** Checks the complete transport envelope before domain handling.
-* @param value - Native IPC decoded value.
-* @returns True if the envelope is bounded in shape and JSON-compatible; false otherwise.
+//#region src/server/processes/helpers.ts
+/** Reads the executing profile's explicit recording declarations before a worker starts.
+* @param profile - The validated executing profile.
+* @param trial - The scheduled trial identity.
+* @returns A validated opening row, with no inferred metadata or replay allowance.
 */
-function isStudyFrame(value) {
-	return holds(() => isRecord(value) && Object.keys(value).length === 3 && Object.hasOwn(value, "id") && Object.hasOwn(value, "operation") && Object.hasOwn(value, "value") && typeof value.id === "number" && Number.isSafeInteger(value.id) && value.id >= 0 && typeof value.operation === "string" && [
-		"open",
-		"goal",
-		"close",
-		"admit",
-		"finish",
-		"fail",
-		"evidence",
-		"reply",
-		"error",
-		"abort"
-	].includes(value.operation) && isJSONValue(value.value));
+function readStudyRecordingDeclaration(profile, trial) {
+	if (profile.provider === void 0 || profile.settings === void 0) throw new StudyError("CONFIG", "Recording requires provider and explicit wire declarations");
+	const declaration = {
+		phase: "declaration",
+		trial: trial.id,
+		version: profile.settings.version,
+		metadata: profile.settings.metadata,
+		procedure: profile.settings.procedure,
+		models: buildStudyOllamaModels(profile.provider),
+		maintenance: []
+	};
+	if (!isStudyExchangeDeclaration(declaration)) throw new StudyError("CONFIG", "Recording requires valid version, metadata and ordered procedure settings");
+	return declaration;
 }
-/** Checks operational failure attribution arriving over IPC.
-* @param value - Decoded failure value.
-* @returns True if the failure carries a known cause, an optional role, and an optional stop that satisfies `isStudyStop` on a `capacity` or `deadline` cause; false otherwise.
+/** Validates parent preparation output without permitting a destination or allowance substitution.
+* @param original - The parent-reserved destination, or undefined without recording.
+* @param prepared - The callback's retained destination.
+* @returns The validated destination for the worker.
 */
-function isStudyProcessFailure(value) {
-	return holds(() => isRecord(value) && typeof value.message === "string" && isStudyCause(value.cause) && (value.role === void 0 || isStudyRole(value.role)) && (value.stop === void 0 || (value.cause === "capacity" || value.cause === "deadline") && isStudyStop(value.stop)));
+function readStudyPreparedDestination(original, prepared) {
+	if (original === void 0 ? prepared !== void 0 : !isStudyExchangeDestination(prepared) || prepared.path !== original.path || canonicalStringify(prepared.record) !== canonicalStringify(original.record)) throw new StudyError("CUSTODY", "Trial preparation changed its reserved destination");
+	return prepared;
 }
-/** Checks a request's declared role and finite cost ceilings.
-* @param value - Decoded charge.
-* @returns True if all charge leaves are valid; false otherwise.
+/** Rechecks the sealed source and this trial's prefix under the executing profile declaration.
+* @param selection - The explicit sealed source and offline behavior.
+* @param profile - The executing profile, whose bounds remain authoritative.
+* @param trial - The trial whose history must be present.
+* @returns Complete verified history before any dependent sender or worker starts.
 */
-function isStudyCharge(value) {
-	return holds(() => isRecord(value) && isStudyRole(value.role) && typeof value.tokens === "number" && Number.isSafeInteger(value.tokens) && value.tokens >= 0 && typeof value.bytes === "number" && Number.isSafeInteger(value.bytes) && value.bytes >= 0);
+async function readStudyReplayHistory(selection, profile, trial) {
+	if (!isStudyReplaySelection(selection)) throw new StudyError("CONFIG", "Invalid replay selection");
+	const result = await readStudyResult(selection.result);
+	if (result.status !== "sealed") throw new StudyError("CUSTODY", "Replay requires a sealed result");
+	const history = await readStudyExchanges(result, trial.id);
+	const prefix = selection.prefix[trial.id];
+	if (prefix === void 0 || prefix > history.exchanges.length || selection.offline && prefix !== history.exchanges.length) throw new StudyError("CONFIG", "Replay prefix does not cover its declared trial");
+	const { metadata: _metadata, maintenance: _maintenance, ...current } = readStudyRecordingDeclaration(profile, trial);
+	const { metadata: _recordedMetadata, maintenance: _recordedMaintenance, ...recorded } = history.declaration;
+	if (canonicalStringify(current) !== canonicalStringify(recorded)) throw new StudyError("CONFIG", "Replay declaration differs from recorded execution");
+	return history;
 }
-/** Checks append-only public evidence.
-* @param value - Decoded evidence.
-* @returns True if event, goal and payload are valid; false otherwise.
+/** Projects optional domain fields into the JSON wire representation.
+* @param value - An owned domain value with optional undefined fields.
+* @returns A JSON-compatible snapshot.
+* @example Project a wire value
+* ```ts
+* import { valueToWire } from '@orkestrel/study/server'
+*
+* valueToWire({ state: 'ready', failure: undefined }) // { state: 'ready' }
+* ```
 */
-function isStudyEvidence(value) {
-	return holds(() => isRecord(value) && isStudyName(value.event) && isStudyName(value.goal) && isJSONValue(value.value));
+function valueToWire(value) {
+	const parsed = JSON.parse(JSON.stringify(value));
+	if (!isJSONValue(parsed)) throw new StudyError("FAULT", "Invalid study wire value");
+	return parsed;
 }
-/** Checks a fresh trial's declared identifiers.
-* @param value - Decoded trial.
-* @returns True if every identifier and repetition is valid; false otherwise.
+/** Creates attributable protocol infrastructure failure.
+* @param message - The refused operation or broken boundary.
+* @returns A domain failure that never awards task credit.
 */
-function isStudyTrial(value) {
-	return holds(() => isRecord(value) && isStudyName(value.id) && isStudyName(value.scenario) && isStudyName(value.arm) && typeof value.repetition === "number" && Number.isSafeInteger(value.repetition) && value.repetition >= 0);
+function createStudyProcessFailure(message) {
+	return {
+		cause: "infrastructure",
+		message,
+		role: void 0,
+		stop: void 0
+	};
 }
-/** Checks the exact digest fields carried by the execution declaration.
-* @param value - Decoded identity.
-* @returns True if all required identities are digests; false otherwise.
+/** Binds the canonical fully resolved execution profile carried over IPC.
+* @param profile - The resolved execution settings, with optional absent leaves.
+* @returns The SHA256 digest of the canonical JSON wire representation.
 */
-function isStudyIdentity(value) {
-	return holds(() => isRecord(value) && isStudyDigest(value.agent) && isStudyDigest(value.subject) && (value.provider === void 0 || isStudyDigest(value.provider)) && isStudyDigest(value.instrument) && isStudyDigest(value.fixtures) && isStudyDigest(value.profile));
+function computeStudyProfileDigest(profile) {
+	const encoded = canonicalStringify(valueToWire(profile));
+	if (encoded === void 0) throw new StudyError("CONFIG", "Study profile is not JSON-compatible");
+	return hashStudyBytes(encoded);
 }
-//#endregion
-//#region src/server/processes/StudyChannel.ts
-/** Correlates bounded IPC work and rejects every outstanding request on transport failure. */
-var StudyChannel = class {
-	#options;
-	#control = new StudyControl();
+/** Collects the executable entries a profile selects, each canonical path once.
+* @param profile - The resolved execution profile.
+* @returns The agent, subject, and provider entries without repeating a shared entry.
+* @remarks The declared roles stay separate in the profile; only capture and loading deduplicate.
+*/
+function collectStudyEntries(profile) {
+	return [.../* @__PURE__ */ new Set([
+		profile.agent,
+		profile.subject,
+		...profile.provider === void 0 ? [] : [profile.provider.entry]
+	])];
+}
+/** Computes the instrument identity binding trusted runtime bytes to the adapter inventory.
+* @param entry - The SHA-256 identity of the trusted runtime entry bytes.
+* @param inventory - The captured adapter inventory digest.
+* @returns The identity that validation, grading, and trial children must share.
+*/
+function computeStudyInstrumentDigest(entry, inventory) {
+	return hashStudyBytes(JSON.stringify([entry, inventory]));
+}
+/** Resolves the actual host package from its trusted executable entry.
+* @param entry - The runtime's own executable, never a consumer-supplied module.
+* @returns The canonical study package root.
+*/
+function resolveStudyInstrument(entry) {
+	const root = collectStudyAncestors(dirname(realpathSync(entry))).find((directory) => {
+		const manifest = join(directory, "package.json");
+		if (!existsSync(manifest)) return false;
+		const value = JSON.parse(readFileSync(manifest, "utf8"));
+		return isRecord(value) && value.name === "@orkestrel/study";
+	});
+	if (root === void 0) throw new StudyError("CONFIG", "Cannot locate the study runtime package");
+	return root;
+}
+/** Reads the version of the study package that owns an executable entry.
+* @param entry - The installed runtime's executable entry.
+* @returns The non-empty version declared by the owning study package.
+* @throws StudyError - Thrown when no study package owns the entry or its version is absent or empty.
+* @example Read the installed version
+* ```ts
+* import { readStudyVersion } from '@orkestrel/study/server'
+*
+* declare const entry: string
+* readStudyVersion(entry)
+* ```
+*/
+function readStudyVersion(entry) {
+	const value = JSON.parse(readFileSync(join(resolveStudyInstrument(entry), "package.json"), "utf8"));
+	if (!isRecord(value) || typeof value.version !== "string" || value.version.length === 0) throw new StudyError("CONFIG", "Study runtime package declares no version");
+	return value.version;
+}
+/** Collects a directory and each of its ancestors up to the filesystem root, nearest first.
+* @param directory - The absolute directory to start from.
+* @returns The directory followed by every parent directory, ending at the root.
+*/
+function collectStudyAncestors(directory) {
+	const parent = dirname(directory);
+	return parent === directory ? [directory] : [directory, ...collectStudyAncestors(parent)];
+}
+/** Refuses a profile that omits the actual host runtime's declared dependency bytes.
+* @param instrument - The canonical package owning the trusted runtime entry.
+* @param roots - Explicitly admitted package roots, including the instrument.
+*/
+function validateStudyRuntime(instrument, roots) {
+	const pending = [instrument];
+	const visited = /* @__PURE__ */ new Set();
+	while (pending.length > 0) {
+		const root = pending.pop();
+		if (root === void 0 || visited.has(root)) continue;
+		visited.add(root);
+		if (!roots.includes(root)) throw new StudyError("CONFIG", `Profile roots omit a runtime dependency: ${root}`);
+		const manifest = join(root, "package.json");
+		const value = JSON.parse(readFileSync(manifest, "utf8"));
+		if (!isRecord(value) || value.dependencies === void 0) continue;
+		if (!isRecord(value.dependencies)) throw new StudyError("CONFIG", "Runtime dependency declarations are invalid");
+		const resolver = createRequire(manifest);
+		for (const dependency of Object.keys(value.dependencies)) pending.push(dirname(realpathSync(resolver.resolve(`${dependency}/package.json`))));
+	}
+}
+/** Releases inherited output handles a bounded time after native exit.
+* @param child - A newly spawned child, subscribed before native exit.
+* @remarks A descendant that outlives an exited root is outside discoverable-tree cleanup; this only stops the parent from waiting on its pipes.
+*/
+function drainStudyChild(child) {
+	const closed = new AbortController();
+	child.once("exit", () => {
+		setTimeout$1(STUDY_DRAIN_DURATION, void 0, { signal: closed.signal }).then(() => {
+			child.stdout?.destroy();
+			child.stderr?.destroy();
+		}, () => void 0);
+	});
+	child.once("close", () => closed.abort());
+}
+/** Terminates the recorded native process tree under a finite cleanup allowance.
+* @param child - The exclusively owned child process.
+*/
+function terminateStudyChild(child) {
+	if (child.pid === void 0 || child.exitCode !== null || child.signalCode !== null) return;
+	try {
+		if (process.platform === "win32") execFileSync("taskkill", [
+			"/PID",
+			String(child.pid),
+			"/T",
+			"/F"
+		], {
+			windowsHide: true,
+			timeout: 2e3,
+			stdio: "ignore"
+		});
+		else {
+			const rows = execFileSync("ps", ["-eo", "pid=,ppid="], {
+				timeout: 2e3,
+				encoding: "utf8",
+				maxBuffer: 1048576
+			}).trim().split(/\r\n|\n/).map((row) => row.trim().split(/\s+/).map(Number));
+			const descendants = /* @__PURE__ */ new Set([child.pid]);
+			rows.forEach(() => {
+				for (const [pid, parent] of rows) if (pid !== void 0 && parent !== void 0 && descendants.has(parent)) descendants.add(pid);
+			});
+			for (const pid of [...descendants].reverse()) try {
+				process.kill(pid, "SIGKILL");
+			} catch (error) {
+				if (!matchesSystemError(error, "ESRCH")) throw error;
+			}
+		}
+	} catch (error) {
+		try {
+			process.kill(child.pid, 0);
+		} catch (status) {
+			if (matchesSystemError(status, "ESRCH")) return;
+			throw status;
+		}
+		if (child.exitCode === null && child.signalCode === null) {
+			child.kill("SIGKILL");
+			throw error;
+		}
+	}
+}
+//#endregion
+//#region src/server/processes/StudyArtifactLoader.ts
+/** Binds consumer instrumentation separately from selected executable identities. */
+var StudyArtifactLoader = class {
+	#options;
+	#loader;
+	#instrument;
+	#identity;
+	#entry;
+	/** Owns resolved built and consumer source selections.
+	* @param options - The trusted host, adapter, and profile.
+	*/
+	constructor(options) {
+		this.#options = structuredClone(options);
+		if (![
+			options.entry,
+			options.root,
+			options.adapter,
+			...collectStudyEntries(options.profile),
+			...options.profile.roots
+		].every(isAbsolute)) throw new StudyError("CONFIG", "Study artifact paths must be absolute");
+	}
+	/** Inventories bytes without importing selected code.
+	* @returns Bound executable and instrumentation identities.
+	*/
+	async inspect() {
+		const closure = this.#options.closure;
+		if (closure !== void 0) verifyArtifactClosure(closure.closure, true);
+		if (this.#identity !== void 0) {
+			this.verify();
+			return this.#identity;
+		}
+		const profile = this.#options.profile;
+		const instrument = resolveStudyInstrument(this.#options.entry);
+		const roots = [.../* @__PURE__ */ new Set([...profile.roots, instrument])];
+		validateStudyRuntime(instrument, roots);
+		const source = {
+			root: dirname(this.#options.adapter),
+			entry: this.#options.adapter
+		};
+		this.#instrument = new ArtifactLoader({
+			entries: [],
+			roots,
+			source,
+			instrument
+		});
+		const entry = hashStudyBytes(await readStudyBytes(this.#options.entry, STUDY_CUSTODY_BYTES));
+		this.#entry = entry;
+		this.#loader = new ArtifactLoader(closure === void 0 ? {
+			entries: collectStudyEntries(profile),
+			roots,
+			source,
+			instrument
+		} : closure.closure.options);
+		const inventory = this.#loader.inspect();
+		this.#identity = Object.freeze({
+			agent: inventory.digest,
+			subject: inventory.digest,
+			provider: profile.provider === void 0 ? void 0 : inventory.digest,
+			instrument: computeStudyInstrumentDigest(entry, this.#instrument.inspect().digest)
+		});
+		this.verify();
+		return this.#identity;
+	}
+	/** Loads the adapter from the trial inventory.
+	* @returns The complete consumer adapter.
+	*/
+	async adapter() {
+		await this.inspect();
+		if (this.#loader === void 0) throw new StudyError("CONFIG", "Artifact inspection is required");
+		return readStudyAdapter(await this.#loader.load(this.#options.adapter));
+	}
+	/** Loads admitted built namespaces inside the trial child.
+	* @returns The agent, subject and optional provider; a shared entry loads once and keeps each role.
+	*/
+	async load() {
+		await this.inspect();
+		if (this.#loader === void 0) throw new StudyError("CONFIG", "Artifact inspection is required");
+		const profile = this.#options.profile;
+		const loaded = [];
+		for (const entry of collectStudyEntries(profile)) loaded.push([entry, await this.#loader.load(entry)]);
+		const namespaces = new Map(loaded);
+		this.verify();
+		const provider = profile.provider;
+		return Object.freeze({
+			agent: namespaces.get(profile.agent),
+			subject: namespaces.get(profile.subject),
+			provider: provider === void 0 ? void 0 : namespaces.get(provider.entry)
+		});
+	}
+	/** Refuses instrument and inventory drift after inspection. */
+	verify() {
+		if (this.#loader === void 0 || this.#instrument === void 0) throw new StudyError("CONFIG", "Artifact inspection is required");
+		if (hashStudyBytes(readFileSync(this.#options.entry)) !== this.#entry) throw new StudyError("FAULT", "Study instrument bytes drifted");
+		this.#loader.verify();
+		this.#instrument.verify();
+		if (this.#options.closure !== void 0) verifyArtifactClosure(this.#options.closure.closure, true);
+	}
+};
+//#endregion
+//#region src/server/processes/StudyChannel.ts
+/** Correlates bounded IPC work and rejects every outstanding request on transport failure. */
+var StudyChannel = class {
+	#options;
+	#control = new StudyControl();
 	#pending = /* @__PURE__ */ new Map();
 	#next = 0;
 	#received = 0;
@@ -2620,6 +3990,8 @@ var StudyProcessSession = class {
 			this.#options.root,
 			this.#options.directory
 		].every(isAbsolute)) throw new StudyError("CONFIG", "Study process paths must be absolute");
+		const destination = this.#options.exchanges?.[this.#options.trial.id];
+		if (this.#options.profile.record === void 0 ? destination !== void 0 : !isStudyExchangeDestination(destination) || destination.record.bytes !== this.#options.profile.record.bytes) throw new StudyError("CONFIG", "Session recording differs from its reserved allowance");
 		const directory = await mkdtemp(join(this.#options.directory, "trial-"));
 		if (this.#control.failure !== void 0) throw failureToStudyError(this.#control.failure);
 		const child = fork(this.#options.entry, [STUDY_WORKER_OPERATION], {
@@ -2826,11 +4198,16 @@ var StudyProcessSession = class {
 /** Opens one fresh native child for each scheduled trial. */
 var StudyProcessDriver = class {
 	#options;
+	#prepare;
 	/** Owns immutable resolved launch settings.
 	* @param options - Built entry, admitted identities and exclusive scratch parent.
 	*/
 	constructor(options) {
-		this.#options = structuredClone(options);
+		const { prepare, ...configuration } = options;
+		if (prepare !== void 0 && typeof prepare !== "function") throw new StudyError("CONFIG", "Trial preparation must be callable");
+		if (options.replay?.offline === true && prepare !== void 0) throw new StudyError("CONFIG", "Offline replay cannot prepare external resources");
+		this.#options = structuredClone(configuration);
+		this.#prepare = prepare;
 	}
 	/** Opens isolated child state and waits for its verified readiness.
 	* @param trial - The public scheduled trial.
@@ -2838,10 +4215,19 @@ var StudyProcessDriver = class {
 	* @returns A ready process-backed session.
 	*/
 	async open(trial, signal) {
+		signal.throwIfAborted();
+		const owned = structuredClone(trial);
+		const destination = this.#options.exchanges?.[owned.id];
+		if (this.#options.profile.record !== void 0 && (!isStudyExchangeDestination(destination) || destination.record.bytes !== this.#options.profile.record.bytes)) throw new StudyError("CONFIG", "Recorded trial requires its reserved destination");
+		if (this.#options.profile.record === void 0 && destination !== void 0) throw new StudyError("CONFIG", "Unrecorded trial cannot receive a sidecar");
+		if (this.#options.replay !== void 0) await readStudyReplayHistory(this.#options.replay, this.#options.profile, owned);
+		const prepared = this.#prepare === void 0 ? destination : readStudyPreparedDestination(destination, await this.#prepare(structuredClone(owned), signal, structuredClone(destination)));
+		signal.throwIfAborted();
 		const session = new StudyProcessSession({
 			...this.#options,
-			trial,
-			signal
+			trial: owned,
+			signal,
+			...prepared === void 0 ? {} : { exchanges: { [owned.id]: prepared } }
 		});
 		try {
 			await session.start();
@@ -2853,17 +4239,263 @@ var StudyProcessDriver = class {
 	}
 };
 //#endregion
-//#region src/server/processes/StudyTaskChild.ts
-/** Supervises one forked adapter child until it closes with one verified response. */
-var StudyTaskChild = class {
+//#region src/server/commands/StudyDaemonTrial.ts
+/** Records one trial's daemon maintenance before handing its verified prefix to a worker.
+* @example
+* ```ts
+* const trial = new StudyDaemonTrial(options)
+* await trial.execute(daemon)
+* ```
+*/
+var StudyDaemonTrial = class {
 	#options;
-	#duration;
-	#signal;
-	#failure;
-	#result;
-	#logs = 0;
-	#executed = false;
-	/** Binds one adapter evaluation to its owned route, validated deadline and caller cancellation.
+	#pending = /* @__PURE__ */ new Map();
+	#sink;
+	/** Owns the declaration and reserved destination for one preparation.
+	* @param options - The immutable trial declaration, destination, and cancellation.
+	*/
+	constructor(options) {
+		this.#options = {
+			...options,
+			declaration: structuredClone(options.declaration),
+			destination: structuredClone(options.destination)
+		};
+	}
+	/** Unloads declared models, drains the journal, and returns its exact retained identity.
+	* @remarks The daemon's unload sender must call this instance's fetch method. Startup metadata must forward without recording.
+	* @param daemon - The verified execution-owned daemon.
+	* @returns The original destination with its closed maintenance prefix identity.
+	*/
+	async execute(daemon) {
+		if (this.#sink !== void 0) throw new StudyError("FAULT", "Daemon preparation cannot repeat");
+		const file = await open(this.#options.destination.path, "wx");
+		this.#sink = new StudyExchangeSink({
+			file,
+			record: this.#options.destination.record
+		});
+		try {
+			await this.#sink.append(this.#options.declaration);
+			await daemon.unload();
+			await this.#finish();
+		} catch (error) {
+			await this.#finish(error);
+			throw error;
+		} finally {
+			await this.#sink.close();
+		}
+		const bytes = await readStudyBytes(this.#options.destination.path, this.#options.destination.record.bytes);
+		return {
+			...this.#options.destination,
+			retained: {
+				path: `trials/${this.#options.declaration.trial}/exchanges.jsonl`,
+				bytes: bytes.length,
+				digest: hashStudyBytes(bytes)
+			}
+		};
+	}
+	/** Retains each request before sending and preserves the sender's native response chunks.
+	* @param input - The daemon's exact HTTP input.
+	* @param init - The daemon's method, body, redirect policy, and cancellation.
+	* @returns An unread response carrying the same body bytes for daemon validation.
+	*/
+	async fetch(input, init) {
+		const sink = this.#sink;
+		if (sink === void 0) throw new StudyError("FAULT", "Daemon journal is not open");
+		await this.#finish();
+		const request = new Request(input, {
+			...init,
+			signal: AbortSignal.any([this.#options.signal, ...init?.signal === void 0 || init.signal === null ? [] : [init.signal]])
+		});
+		const first = this.#options.declaration.procedure[0];
+		if (first === void 0 || new URL(request.url).pathname !== "/api/generate" || request.method !== "POST") throw new StudyError("FAULT", "Unexpected maintenance request");
+		const identity = {
+			ordinal: sink.next,
+			goal: first.goal,
+			role: "maintenance",
+			path: "/api/generate",
+			method: "POST",
+			stage: "maintenance"
+		};
+		await sink.append({
+			...identity,
+			phase: "attempt",
+			...buildStudyOllamaBytes(Buffer.from(await request.clone().arrayBuffer()))
+		});
+		const chunks = [];
+		try {
+			const response = await globalThis.fetch(request);
+			const headers = [...response.headers].filter(([name]) => name === "content-type" || name === "content-encoding");
+			const reader = response.body?.getReader();
+			try {
+				if (reader !== void 0) for (;;) {
+					const step = await reader.read();
+					if (step.done) break;
+					if (chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0) + step.value.byteLength > this.#options.declaration.metadata.bytes) throw new StudyError("CAPACITY", "Maintenance reply exceeds its declared byte allowance");
+					if (step.value.byteLength > 0) chunks.push(Buffer.from(step.value));
+				}
+			} finally {
+				await reader?.cancel().catch(() => void 0);
+				reader?.releaseLock();
+			}
+			const bytes = Buffer.concat(chunks);
+			this.#pending.set(identity, {
+				status: response.status,
+				headers,
+				chunks: chunks.map((chunk) => chunk.byteLength),
+				...buildStudyOllamaBytes(bytes)
+			});
+			return new Response(response.body === null ? null : bytes, {
+				status: response.status,
+				statusText: response.statusText,
+				headers: response.headers
+			});
+		} catch (error) {
+			await sink.append({
+				...identity,
+				phase: "failure",
+				reason: error instanceof Error ? error.message : "Maintenance request failed"
+			});
+			throw error;
+		}
+	}
+	async #finish(error) {
+		for (const [identity, reply] of this.#pending) try {
+			await this.#sink?.append(error === void 0 ? {
+				...identity,
+				...reply,
+				phase: "response"
+			} : {
+				...identity,
+				phase: "failure",
+				reason: error instanceof Error ? error.message : "Maintenance refused",
+				response: reply
+			});
+		} finally {
+			this.#pending.delete(identity);
+		}
+	}
+};
+//#endregion
+//#region src/server/commands/StudyDaemonSession.ts
+/** Owns the declared daemon and its serial trial preparation through permanent cleanup.
+* @example
+* ```ts
+* const session = new StudyDaemonSession(options)
+* try { await session.start() } finally { await session.stop() }
+* ```
+*/
+var StudyDaemonSession = class {
+	#options;
+	#daemon;
+	#stopped = false;
+	#trials = /* @__PURE__ */ new Set();
+	/** Captures resolved declarations without loading the daemon runtime.
+	* @param options - The execution profile, scenarios, workspace, and cancellation.
+	*/
+	constructor(options) {
+		const provider = options.profile.provider;
+		const daemon = provider?.daemon;
+		if (provider === void 0 || daemon === void 0) throw new StudyError("CONFIG", "Execution has no declared daemon");
+		if (options.profile.record !== void 0 && options.profile.settings?.version !== daemon.version) throw new StudyError("CONFIG", "Daemon and recording versions differ");
+		this.#options = {
+			...options,
+			profile: structuredClone(options.profile),
+			scenarios: structuredClone(options.scenarios)
+		};
+	}
+	/** Starts the daemon and returns its verified execution provenance.
+	* @returns The executable, endpoint, owned pid, and model receipt.
+	*/
+	async start() {
+		this.#options.signal.throwIfAborted();
+		const { createOllamaDaemon } = await import("@orkestrel/ollama/server");
+		if (this.#stopped) throw new StudyError("FAULT", "Daemon session has stopped");
+		const provider = this.#options.profile.provider;
+		const daemon = provider?.daemon;
+		if (provider === void 0 || daemon === void 0) throw new StudyError("CONFIG", "Execution has no declared daemon");
+		this.#daemon ??= createOllamaDaemon({
+			executable: {
+				path: daemon.executable,
+				digest: daemon.digest,
+				version: daemon.version
+			},
+			url: provider.url,
+			models: daemon.models,
+			workspace: this.#options.workspace,
+			...daemon.environment === void 0 ? {} : { environment: daemon.environment },
+			signal: this.#options.signal,
+			readiness: this.#options.profile.bounds.request.duration,
+			metadata: {
+				timeout: this.#options.profile.bounds.request.duration,
+				bytes: this.#options.profile.bounds.request.bytes
+			},
+			fetch: (input, init) => this.#send(input, init)
+		});
+		return this.#daemon.start();
+	}
+	/** Unloads the declared population before opening one trial worker.
+	* @param trial - The scheduled trial.
+	* @param signal - The trial's cancellation.
+	* @param destination - The optional reserved recording destination.
+	* @returns The unchanged destination with its verified maintenance prefix when recording.
+	*/
+	async prepare(trial, signal, destination) {
+		signal.throwIfAborted();
+		const daemon = this.#daemon;
+		if (daemon === void 0) throw new StudyError("FAULT", "Daemon startup is required");
+		if (this.#trials.size !== 0) throw new StudyError("FAULT", "Daemon preparations cannot overlap");
+		if (destination === void 0) {
+			if (this.#options.profile.record !== void 0) throw new StudyError("CUSTODY", "Daemon maintenance requires its reserved sidecar");
+			await daemon.unload();
+			return;
+		}
+		const declaration = readStudyRecordingDeclaration(this.#options.profile, trial);
+		const models = this.#options.profile.provider?.daemon?.models;
+		const first = this.#options.scenarios.find((scenario) => scenario.id === trial.scenario)?.goals[0];
+		if (models === void 0 || first?.id !== declaration.procedure[0]?.goal) throw new StudyError("CONFIG", "Maintenance must join the first declared goal");
+		const preparation = new StudyDaemonTrial({
+			destination,
+			declaration: {
+				...declaration,
+				maintenance: models
+			},
+			signal
+		});
+		this.#trials.add(preparation);
+		try {
+			return await preparation.execute(daemon);
+		} finally {
+			this.#trials.delete(preparation);
+		}
+	}
+	/** Stops and joins the owned tree and refuses an unconfirmed cleanup.
+	* @returns Completion after daemon and emitter teardown.
+	*/
+	async stop() {
+		this.#stopped = true;
+		const daemon = this.#daemon;
+		if (daemon === void 0) return;
+		const confirmed = await daemon.stop();
+		await daemon.destroy();
+		if (!confirmed) throw new StudyError("FAULT", "Daemon cleanup was not confirmed");
+	}
+	#send(input, init) {
+		for (const trial of this.#trials) return trial.fetch(input, init);
+		return globalThis.fetch(input, init);
+	}
+};
+//#endregion
+//#region src/server/processes/StudyTaskChild.ts
+/** Supervises one forked adapter child until it closes with one verified response. */
+var StudyTaskChild = class {
+	#options;
+	#duration;
+	#signal;
+	#failure;
+	#result;
+	#logs = 0;
+	#executed = false;
+	/** Binds one adapter evaluation to its owned route, validated deadline and caller cancellation.
 	* @param options - The owning task's snapshotted entry, root and selection.
 	* @param duration - The validated deadline in milliseconds.
 	* @param signal - Caller cancellation.
@@ -3019,32 +4651,109 @@ var StudyCommand = class {
 		signal.throwIfAborted();
 		if (request.command === "check") return this.#check(await this.#prepare(request, signal));
 		if (request.command === "execute") return this.#execution(request, signal);
+		if (request.command === "freeze") return this.#freeze(request, signal);
 		if (request.command === "grade") return this.#grade(request, signal);
 		if (request.command === "label") return this.#label(request, signal);
 		if (request.command === "report") return this.#report(request, signal);
 		throw new StudyError("CONFIG", "Unsupported study operation");
 	}
-	async #prepare(request, signal) {
-		const { bundle, definition, scenarios, fixtures, rubric } = await readStudyDeclaration(this.#root, request.target, signal);
-		const profileBytes = await readStudyDeclarationBytes(this.#root, resolveStudyPath(bundle, `profiles/${request.profile}.json`));
+	async #freeze(request, signal) {
+		const selection = {
+			command: "check",
+			target: request.target,
+			profile: request.profile,
+			out: void 0,
+			expected: void 0
+		};
+		const original = await this.#prepare(selection, signal);
+		const instrument = resolveStudyInstrument(this.#entry);
+		const directory = resolveStudyPath(join(this.#root, "studies"), request.target);
+		const assets = [.../* @__PURE__ */ new Set([
+			this.#entry,
+			join(directory, "study.json"),
+			resolveStudyPath(directory, original.definition.rubric),
+			resolveStudyPath(original.bundle, `profiles/${request.profile}.json`),
+			...original.definition.scenarios.map((id) => resolveStudyPath(original.bundle, `scenarios/${id}.json`))
+		])];
+		const loader = new ArtifactLoader({
+			entries: [.../* @__PURE__ */ new Set([
+				original.profile.agent,
+				original.profile.subject,
+				...original.profile.provider === void 0 ? [] : [original.profile.provider.entry]
+			])],
+			roots: [.../* @__PURE__ */ new Set([...original.profile.roots, instrument])],
+			source: {
+				root: original.bundle,
+				entry: join(original.bundle, "index.ts")
+			},
+			instrument,
+			assets
+		});
+		loader.inspect();
+		signal.throwIfAborted();
+		const closure = await loader.materialize(request.destination);
+		const candidate = {
+			closure,
+			root: relocateArtifactPath(closure, this.#root),
+			entry: relocateArtifactPath(closure, this.#entry),
+			target: request.target,
+			profile: request.profile,
+			source: original.identity,
+			identity: original.identity,
+			fingerprint: computeStudyCommandFingerprint(original.identity, original.profile.bounds, original.definition)
+		};
+		const checked = await this.#prepare(selection, signal, candidate);
+		if (checked.source !== original.source || checked.identity.fixtures !== original.identity.fixtures || hashStudyBytes(encodeStudyJSON(checked.definition)) !== hashStudyBytes(encodeStudyJSON(original.definition)) || hashStudyBytes(encodeStudyJSON(checked.rubric)) !== hashStudyBytes(encodeStudyJSON(original.rubric))) throw new StudyError("FAULT", "Study declarations changed during freezing");
+		const publication = {
+			...candidate,
+			identity: checked.identity,
+			fingerprint: computeStudyCommandFingerprint(checked.identity, checked.profile.bounds, checked.definition)
+		};
+		original.artifacts.verify();
+		loader.verify();
+		checked.artifacts.verify();
+		verifyArtifactClosure(closure);
+		signal.throwIfAborted();
+		await writeFile(join(closure.destination, "closure.json"), encodeStudyJSON(publication), { flag: "wx" });
+		return valueToWire({
+			command: "freeze",
+			path: closure.destination,
+			digest: closure.digest,
+			fingerprint: publication.fingerprint
+		});
+	}
+	#closure(request) {
+		if (request.closure === void 0) throw new StudyError("CONFIG", "Study closure selection is absent");
+		const closure = readStudyClosure(resolve(this.#root, request.closure));
+		if (closure.target !== request.target || closure.profile !== request.profile) throw new StudyError("CONFIG", "Study closure selectors differ from the checked selection");
+		return closure;
+	}
+	async #prepare(request, signal, retained) {
+		const closure = retained ?? (request.closure === void 0 ? void 0 : this.#closure(request));
+		const root = closure?.root ?? this.#root;
+		const entry = closure?.entry ?? this.#entry;
+		const { bundle, definition, scenarios, fixtures, rubric } = await readStudyDeclaration(root, request.target, signal);
+		const profileBytes = await readStudyDeclarationBytes(root, resolveStudyPath(bundle, `profiles/${request.profile}.json`));
 		const source = parseStudyProfile(decodeStudyJSON(profileBytes));
 		if (source.name !== request.profile) throw new StudyError("CONFIG", "Profile name differs from its selected file");
 		if (source.bounds.series.duration > 864e5) throw new StudyError("CONFIG", "Series duration exceeds the 24-hour host ceiling");
-		const profile = resolveStudyProfile(this.#root, source);
+		const profile = resolveStudyProfile(root, source, closure?.closure);
 		validateStudyInputs(definition, scenarios, rubric, profile);
 		signal.throwIfAborted();
 		const artifacts = new StudyArtifactLoader({
-			root: this.#root,
-			entry: this.#entry,
+			root,
+			entry,
 			profile,
-			adapter: join(bundle, "index.ts")
+			adapter: join(bundle, "index.ts"),
+			...closure === void 0 ? {} : { closure }
 		});
 		const selected = await artifacts.inspect();
 		const validation = await new StudyTask({
-			root: this.#root,
-			entry: this.#entry,
+			root,
+			entry,
 			adapter: join(bundle, "index.ts"),
-			roots: profile.roots
+			roots: profile.roots,
+			...closure === void 0 ? {} : { closure }
 		}).execute({
 			operation: "validate",
 			input: {
@@ -3056,7 +4765,7 @@ var StudyCommand = class {
 		}, signal);
 		if (validation.value !== true || validation.instrument !== selected.instrument) throw new StudyError("FAULT", "Adapter validation identity differs");
 		artifacts.verify();
-		return {
+		const preparation = {
 			bundle,
 			definition,
 			scenarios: Object.freeze(scenarios),
@@ -3068,8 +4777,11 @@ var StudyCommand = class {
 				profile: computeStudyProfileDigest(profile)
 			},
 			artifacts,
-			source: hashStudyBytes(profileBytes)
+			source: hashStudyBytes(profileBytes),
+			...closure === void 0 ? {} : { closure }
 		};
+		if (request.closure !== void 0 && closure !== void 0 && (computeStudyCommandFingerprint(preparation.identity, profile.bounds, definition) !== closure.fingerprint || hashStudyBytes(encodeStudyJSON(preparation.identity)) !== hashStudyBytes(encodeStudyJSON(closure.identity)))) throw new StudyError("FAULT", `Study closure checked identity differs: ${Object.entries(preparation.identity).filter(([name, digest]) => Object.entries(closure.identity).some(([key, expected]) => key === name && digest !== expected)).map(([name]) => name).join(", ")}`);
+		return preparation;
 	}
 	#check(preparation) {
 		const fingerprint = computeStudyCommandFingerprint(preparation.identity, preparation.profile.bounds, preparation.definition);
@@ -3082,6 +4794,10 @@ var StudyCommand = class {
 			bounds: preparation.profile.bounds,
 			identity: preparation.identity,
 			provenance: { profile: preparation.source },
+			...preparation.closure === void 0 ? {} : { closure: {
+				digest: preparation.closure.closure.digest,
+				source: preparation.closure.source
+			} },
 			fingerprint,
 			next: [
 				"execute",
@@ -3089,12 +4805,14 @@ var StudyCommand = class {
 				"--profile",
 				preparation.profile.name,
 				"--expected",
-				fingerprint
+				fingerprint,
+				...preparation.closure === void 0 ? [] : ["--closure", preparation.closure.closure.destination]
 			],
 			schedule: buildStudySchedule(preparation.definition, preparation.scenarios)
 		});
 	}
 	async #execution(request, signal) {
+		const replay = request.replay === void 0 ? void 0 : await this.#replay(request, signal);
 		const preparation = await this.#prepare(request, signal);
 		const fingerprint = computeStudyCommandFingerprint(preparation.identity, preparation.profile.bounds, preparation.definition);
 		if (request.expected !== void 0 && request.expected !== fingerprint) throw new StudyError("CONFIG", "Validated execution changed after the supervisor check");
@@ -3105,61 +4823,80 @@ var StudyCommand = class {
 		const parent = await this.#temporary();
 		signal.throwIfAborted();
 		const directory = request.out === void 0 ? join(parent, id) : this.#file(request.out);
-		const manifest = {
-			id,
-			created: (/* @__PURE__ */ new Date()).toISOString(),
-			definition: preparation.definition,
-			scenarios: preparation.scenarios,
-			identity: preparation.identity,
-			schedule: buildStudySchedule(preparation.definition, preparation.scenarios),
-			bounds: preparation.profile.bounds,
-			qualification,
-			host: {
-				node: process.version,
-				platform: process.platform,
-				architecture: process.arch,
-				profile: preparation.source,
-				roots: JSON.stringify(preparation.profile.roots)
-			}
-		};
-		const store = new StudyResultStore({
-			directory,
-			manifest
-		});
-		await store.create();
 		const scratch = await mkdtemp(join(parent, "scratch-"));
 		try {
-			const driver = new StudyProcessDriver({
-				root: this.#root,
-				entry: this.#entry,
+			const daemon = preparation.profile.provider?.daemon === void 0 || replay?.offline === true ? void 0 : new StudyDaemonSession({
 				profile: preparation.profile,
-				identity: preparation.identity,
-				driver: preparation.definition.driver,
-				adapter: join(preparation.bundle, "index.ts"),
-				directory: scratch
-			});
-			const attempts = await new StudySeries({
-				manifest,
-				driver,
-				store,
+				scenarios: preparation.scenarios,
+				workspace: scratch,
 				signal
-			}).execute();
-			preparation.artifacts.verify();
-			const seal = await store.seal();
-			return valueToWire({
-				command: "execute",
-				status: attempts.some((attempt) => attempt.failure !== void 0) ? "operational-failure" : "completed",
-				result: id,
-				path: directory,
-				seal: seal.id,
-				fingerprint,
-				next: [
-					"grade",
-					directory,
-					"--rubric",
-					resolveStudyPath(resolveStudyPath(join(this.#root, "studies"), preparation.definition.name), preparation.definition.rubric)
-				]
 			});
+			try {
+				const startup = await daemon?.start();
+				const manifest = {
+					id,
+					created: (/* @__PURE__ */ new Date()).toISOString(),
+					definition: preparation.definition,
+					scenarios: preparation.scenarios,
+					identity: preparation.identity,
+					schedule: buildStudySchedule(preparation.definition, preparation.scenarios),
+					bounds: preparation.profile.bounds,
+					...preparation.profile.record === void 0 ? {} : { record: preparation.profile.record },
+					qualification,
+					host: {
+						node: process.version,
+						platform: process.platform,
+						architecture: process.arch,
+						profile: preparation.source,
+						roots: JSON.stringify(preparation.profile.roots),
+						...startup === void 0 ? {} : { daemon: JSON.stringify(startup) }
+					}
+				};
+				const store = new StudyResultStore({
+					directory,
+					manifest
+				});
+				await store.create();
+				const destinations = preparation.profile.record === void 0 ? void 0 : Object.fromEntries(await Promise.all(manifest.schedule.map(async (trial) => [trial.id, await store.exchanges(trial)])));
+				const driver = new StudyProcessDriver({
+					root: preparation.closure?.root ?? this.#root,
+					entry: preparation.closure?.entry ?? this.#entry,
+					profile: preparation.profile,
+					identity: preparation.identity,
+					driver: preparation.definition.driver,
+					adapter: join(preparation.bundle, "index.ts"),
+					directory: scratch,
+					...preparation.closure === void 0 ? {} : { closure: preparation.closure },
+					...destinations === void 0 ? {} : { exchanges: destinations },
+					...replay === void 0 ? {} : { replay },
+					...daemon === void 0 ? {} : { prepare: daemon.prepare.bind(daemon) }
+				});
+				const attempts = await new StudySeries({
+					manifest,
+					driver,
+					store,
+					signal
+				}).execute();
+				await daemon?.stop();
+				preparation.artifacts.verify();
+				const seal = await store.seal();
+				return valueToWire({
+					command: "execute",
+					status: attempts.some((attempt) => attempt.failure !== void 0) ? "operational-failure" : "completed",
+					result: id,
+					path: directory,
+					seal: seal.id,
+					fingerprint,
+					next: [
+						"grade",
+						directory,
+						"--rubric",
+						resolveStudyPath(resolveStudyPath(join(this.#root, "studies"), preparation.definition.name), preparation.definition.rubric)
+					]
+				});
+			} finally {
+				await daemon?.stop();
+			}
 		} finally {
 			await rm(scratch, {
 				recursive: true,
@@ -3168,6 +4905,44 @@ var StudyCommand = class {
 			});
 		}
 	}
+	async #replay(request, signal) {
+		if (!isStudyReplaySelection(request.replay)) throw new StudyError("CONFIG", "Replay requires an explicit sealed source, prefixes and offline behavior");
+		const selection = {
+			...structuredClone(request.replay),
+			result: this.#file(request.replay.result)
+		};
+		const source = await readStudyResult(selection.result);
+		if (source.status !== "sealed") throw new StudyError("CUSTODY", "Replay source is not sealed");
+		const closure = request.closure === void 0 ? void 0 : this.#closure(request);
+		const root = closure?.root ?? this.#root;
+		const entry = closure?.entry ?? this.#entry;
+		const { bundle, definition, scenarios, fixtures } = await readStudyDeclaration(root, request.target, signal);
+		const bytes = await readStudyDeclarationBytes(root, resolveStudyPath(bundle, `profiles/${request.profile}.json`));
+		const profile = resolveStudyProfile(root, parseStudyProfile(decodeStudyJSON(bytes)), closure?.closure);
+		const schedule = buildStudySchedule(definition, scenarios);
+		if (canonicalStringify(definition) !== canonicalStringify(source.manifest.definition) || canonicalStringify(scenarios) !== canonicalStringify(source.manifest.scenarios) || canonicalStringify(schedule) !== canonicalStringify(source.manifest.schedule) || computeStudyFixtureDigest(definition, fixtures) !== source.manifest.identity.fixtures || Object.keys(selection.prefix).length !== schedule.length || !schedule.every((trial) => Object.hasOwn(selection.prefix, trial.id))) throw new StudyError("CONFIG", "Replay declaration or scheduled membership changed");
+		for (const trial of schedule) {
+			signal.throwIfAborted();
+			await readStudyReplayHistory(selection, profile, trial);
+		}
+		const artifacts = new StudyArtifactLoader({
+			root,
+			entry,
+			profile,
+			adapter: join(bundle, "index.ts"),
+			...closure === void 0 ? {} : { closure }
+		});
+		const selected = await artifacts.inspect();
+		const identity = {
+			...selected,
+			fixtures: computeStudyFixtureDigest(definition, fixtures),
+			profile: computeStudyProfileDigest(profile)
+		};
+		if (selected.agent !== source.manifest.identity.agent || selected.subject !== source.manifest.identity.subject || selected.instrument !== source.manifest.identity.instrument || selected.provider !== source.manifest.identity.provider) throw new StudyError("CONFIG", "Replay artifact declaration changed");
+		if (request.expected !== void 0 && request.expected !== computeStudyCommandFingerprint(identity, profile.bounds, definition)) throw new StudyError("CONFIG", "Replay execution bounds or declaration changed after check");
+		artifacts.verify();
+		return selection;
+	}
 	async #grade(request, signal) {
 		const result = await this.#result(request.target);
 		const bytes = await readStudyBytes(this.#file(request.rubric), STUDY_CUSTODY_BYTES);
@@ -3487,6 +5262,138 @@ var StudyRemoteMeter = class {
 	}
 };
 //#endregion
+//#region src/server/ollama/StudyOllamaReplay.ts
+/** Answers declared HTTP prefixes from complete ordered recorded application bytes. */
+var StudyOllamaReplay = class {
+	#options;
+	#readers = /* @__PURE__ */ new Set();
+	#pending = /* @__PURE__ */ new Set();
+	#started = performance.now();
+	#cursor;
+	#bytes = 0;
+	#calls = 0;
+	#fault;
+	#closed = false;
+	#procedure;
+	/** Owns and revalidates the complete selected history before any sender can be reached.
+	* @param options - Verified history, explicit prefix, executing origin and independent bounds.
+	*/
+	constructor(options) {
+		const { signal, fetch, ...configuration } = options;
+		const owned = structuredClone(configuration);
+		validateStudyExchangeHistory(owned.history);
+		const url = new URL(owned.url);
+		if (!["http:", "https:"].includes(url.protocol) || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "" || url.pathname !== "/" || !Number.isSafeInteger(owned.prefix) || owned.prefix <= 0 || owned.prefix > owned.history.exchanges.length || fetch === void 0 && owned.prefix !== owned.history.exchanges.length || fetch !== void 0 && typeof fetch !== "function" || !isStudyOllamaMetadata(owned.limit)) throw new StudyError("CONFIG", "Replay requires an explicit valid origin, prefix and current bounds");
+		if (owned.prefix < owned.history.declaration.maintenance.length) throw new StudyError("CONFIG", "Replay prefix omits recorded maintenance");
+		signal.throwIfAborted();
+		this.#options = {
+			...owned,
+			signal,
+			...fetch === void 0 ? {} : { fetch }
+		};
+		this.#cursor = owned.history.declaration.maintenance.length;
+		this.#procedure = owned.history.declaration.procedure.map((step) => {
+			const pair = owned.history.exchanges.find((entry) => entry.attempt.step === step.ordinal && entry.attempt.ordinal <= owned.prefix);
+			if (pair === void 0) return step;
+			const { admission: _admission, ...identity } = step;
+			const { bytes: _bytes, ...exact } = identity;
+			return {
+				...exact,
+				admission: "exact",
+				body: new TextDecoder("utf-8", { fatal: true }).decode(Buffer.from(pair.attempt.body, "base64")),
+				input: pair.attempt.digest
+			};
+		});
+	}
+	/** Holds exact recorded bodies for model requests inside the declared prefix. */
+	get procedure() {
+		return structuredClone(this.#procedure);
+	}
+	/** Supplies recorded native responses, forwarding only after the exact declared prefix.
+	* @param role - The validated Study responsibility.
+	* @param input - The executing origin and exact route.
+	* @param init - The method, encoded body and bounded signal.
+	* @returns The recorded response or the explicit live collaborator's response.
+	*/
+	fetch = (role, input, init) => {
+		if (this.#closed || this.#fault !== void 0 || this.#pending.size !== 0 || this.#readers.size !== 0) {
+			const error = this.#fault?.error ?? new StudyError("FAULT", "Replay request is closed, concurrent or follows an unread response");
+			this.#fault ??= { error };
+			return Promise.reject(error);
+		}
+		const pending = this.#fetch(role, input, init).catch((error) => {
+			this.#fault ??= { error };
+			throw error;
+		});
+		this.#pending.add(pending);
+		pending.then(() => this.#pending.delete(pending), () => this.#pending.delete(pending));
+		return pending;
+	};
+	/** Refuses a mismatch, an unread response or an incompletely consumed prefix. */
+	check() {
+		if (this.#fault !== void 0) throw this.#fault.error;
+		this.#options.signal.throwIfAborted();
+		if (this.#cursor < this.#options.prefix || this.#readers.size !== 0 || this.#pending.size !== 0) throw new StudyError("FAULT", "Replay prefix is incomplete or still being read");
+	}
+	/** Closes admission and cancels retained replay responses.
+	* @returns Completion after pending sends and owned readers settle.
+	*/
+	async close() {
+		this.#closed = true;
+		await Promise.allSettled([...this.#readers].map((reader) => reader.cancel()));
+		this.#readers.clear();
+		await Promise.allSettled([...this.#pending]);
+	}
+	async #fetch(role, input, init) {
+		this.#options.signal.throwIfAborted();
+		init.signal?.throwIfAborted();
+		if (this.#cursor >= this.#options.prefix) {
+			if (this.#options.fetch === void 0) throw new StudyError("FAULT", "Offline replay has no later sender");
+			return this.#options.fetch(role, input, init);
+		}
+		const pair = this.#options.history.exchanges[this.#cursor];
+		const url = new URL(input);
+		const request = new Request(url, init);
+		const body = Buffer.from(await request.arrayBuffer());
+		if (pair === void 0 || url.origin !== new URL(this.#options.url).origin || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "" || url.pathname !== pair.attempt.path || request.method !== pair.attempt.method || role !== pair.attempt.role || !body.equals(Buffer.from(pair.attempt.body, "base64"))) throw new StudyError("FAULT", "Replay request differs from the next recorded exchange");
+		this.#calls += 1;
+		this.#bytes += body.length + pair.response.size;
+		if (this.#calls > this.#options.limit.calls || this.#bytes > this.#options.limit.bytes) throw new StudyError("CAPACITY", "Replay exceeds the executing allowance");
+		if (performance.now() - this.#started >= this.#options.limit.duration) throw new StudyError("DEADLINE", "Replay exceeds the executing duration");
+		this.#cursor += 1;
+		const bytes = Buffer.from(pair.response.body, "base64");
+		const source = pair.response.chunks.map((size, index, sizes) => {
+			const offset = sizes.slice(0, index).reduce((total, length) => total + length, 0);
+			return bytes.subarray(offset, offset + size);
+		}).values();
+		const stream = new ReadableStream({
+			pull: (controller) => {
+				if (this.#options.signal.aborted || init.signal?.aborted || this.#closed) {
+					const error = this.#options.signal.reason ?? init.signal?.reason ?? new StudyError("FAULT", "Replay response was closed");
+					this.#fault ??= { error };
+					this.#readers.delete(stream);
+					controller.error(error);
+					return;
+				}
+				const chunk = source.next();
+				if (chunk.done) {
+					controller.close();
+					this.#readers.delete(stream);
+				} else controller.enqueue(chunk.value);
+			},
+			cancel: () => {
+				this.#readers.delete(stream);
+				this.#fault ??= { error: new StudyError("FAULT", "Replay response was abandoned") };
+			}
+		}, { highWaterMark: 0 });
+		this.#readers.add(stream);
+		return new Response(stream, {
+			status: pair.response.status,
+			headers: pair.response.headers.filter(([name]) => name !== "content-encoding").map(([name, value]) => [name, value])
+		});
+	}
+};
+//#endregion
 //#region src/server/processes/StudyWorker.ts
 /** Executes one verified trial behind parent-authorized admission and custody. */
 var StudyWorker = class {
@@ -3499,6 +5406,9 @@ var StudyWorker = class {
 	#closing = false;
 	#duration = 1e3;
 	#executed = false;
+	#exchanges;
+	#replay;
+	#maintenance = [];
 	#evidence = /* @__PURE__ */ new Set();
 	/** Serves the inherited IPC channel until its parent disconnects.
 	* @returns Completion after channel and acquired session cleanup.
@@ -3520,6 +5430,7 @@ var StudyWorker = class {
 				label: STUDY_PROCESS_LABEL
 			}).wait(this.#session.close()).catch(() => void 0);
 			this.#session = void 0;
+			await Promise.allSettled([this.#exchanges?.close(), this.#replay?.close()]);
 			this.#channel.close();
 			this.#control.close();
 		}
@@ -3531,7 +5442,7 @@ var StudyWorker = class {
 			if (operation === "close") {
 				if (this.#closing) throw new StudyError("FAULT", "Worker cleanup repeated");
 				this.#closing = true;
-				this.#control.fail({
+				if (this.#meters.size !== 0 || this.#control.failure !== void 0) this.#control.fail({
 					cause: "interrupted",
 					message: "Worker cleanup requested",
 					role: void 0,
@@ -3542,6 +5453,12 @@ var StudyWorker = class {
 					label: STUDY_PROCESS_LABEL
 				}).wait(this.#session.close());
 				this.#session = void 0;
+				try {
+					this.#replay?.check();
+				} finally {
+					await this.#replay?.close();
+					await this.#exchanges?.close();
+				}
 				this.#artifacts?.verify();
 				return true;
 			}
@@ -3556,11 +5473,58 @@ var StudyWorker = class {
 		this.#opening = true;
 		if (!isRecord(value) || typeof value.entry !== "string" || typeof value.root !== "string" || typeof value.directory !== "string" || typeof value.driver !== "string" || typeof value.adapter !== "string" || !isStudyProfile(value.profile) || !isStudyIdentity(value.identity) || !isStudyTrial(value.trial)) throw new StudyError("CONFIG", "Worker opening declaration is invalid or driver is unsupported");
 		this.#duration = value.profile.bounds.request.duration;
+		if (value.closure !== void 0 && !isStudyClosure(value.closure)) throw new StudyError("CONFIG", "Worker closure selection is malformed");
+		if (value.replay !== void 0) {
+			if (!isStudyReplaySelection(value.replay) || value.profile.provider === void 0) throw new StudyError("CONFIG", "Worker replay selection is invalid");
+			const history = await readStudyReplayHistory(value.replay, value.profile, value.trial);
+			const prefix = value.replay.prefix[value.trial.id];
+			if (prefix === void 0) throw new StudyError("CONFIG", "Worker replay prefix is absent");
+			this.#replay = new StudyOllamaReplay({
+				history,
+				prefix,
+				url: value.profile.provider.url,
+				limit: readStudyRecordingDeclaration(value.profile, value.trial).metadata,
+				signal: this.#control.signal,
+				...value.replay.offline ? {} : { fetch: this.#forward.bind(this) }
+			});
+		}
+		const destination = isRecord(value.exchanges) ? value.exchanges[value.trial.id] : void 0;
+		if (value.profile.record === void 0 && destination !== void 0) throw new StudyError("CONFIG", "Unrecorded worker received a sidecar");
+		if (value.profile.record !== void 0) {
+			if (!isStudyExchangeDestination(destination) || destination.record.bytes !== value.profile.record.bytes) throw new StudyError("CONFIG", "Recorded worker has no matching reserved sidecar");
+			const declaration = readStudyRecordingDeclaration(value.profile, value.trial);
+			const retained = destination.retained === void 0 ? void 0 : await readStudyBytes(destination.path, destination.record.bytes);
+			if (retained !== void 0 && (hashStudyBytes(retained) !== destination.retained?.digest || retained.length !== destination.retained.bytes || destination.retained.path !== `trials/${value.trial.id}/exchanges.jsonl`)) throw new StudyError("CUSTODY", "Maintenance prefix changed before worker opening");
+			const rows = retained === void 0 ? void 0 : readStudyExchangeRows(retained, false);
+			if (rows !== void 0 && (rows[0]?.phase !== "declaration" || rows[0].trial !== value.trial.id || rows.some((row) => row.phase !== "declaration" && (row.phase !== "attempt" && row.phase !== "response" || row.stage !== "maintenance")) || rows.at(-1)?.phase !== "response")) throw new StudyError("CUSTODY", "Retained prefix is not completed maintenance");
+			if (rows !== void 0 && rows[0]?.phase === "declaration") {
+				const { maintenance: _retainedMaintenance, ...opening } = rows[0];
+				const { maintenance: _maintenance, ...expected } = declaration;
+				if (canonicalStringify(opening) !== canonicalStringify(expected) || rows.filter((row) => row.phase === "response").length !== rows[0].maintenance.length) throw new StudyError("CUSTODY", "Retained maintenance declaration differs from the executing profile");
+			}
+			const file = await open(destination.path, rows === void 0 ? "wx" : "a");
+			try {
+				this.#exchanges = new StudyExchangeSink({
+					file,
+					record: destination.record,
+					...rows === void 0 ? {} : { retained: rows }
+				});
+			} catch (error) {
+				await file.close();
+				throw error;
+			}
+			if (rows === void 0) await this.#exchanges.append({
+				...declaration,
+				procedure: this.#replay?.procedure ?? declaration.procedure
+			});
+			else this.#maintenance = rows;
+		}
 		this.#artifacts = new StudyArtifactLoader({
 			entry: value.entry,
 			root: value.root,
 			profile: value.profile,
-			adapter: value.adapter
+			adapter: value.adapter,
+			...value.closure === void 0 ? {} : { closure: value.closure }
 		});
 		const identity = await this.#artifacts.inspect();
 		if (identity.agent !== value.identity.agent || identity.subject !== value.identity.subject || identity.provider !== value.identity.provider || identity.instrument !== value.identity.instrument || computeStudyProfileDigest(value.profile) !== value.identity.profile) throw new StudyError("FAULT", "Worker artifact identity differs from parent declaration");
@@ -3568,7 +5532,9 @@ var StudyWorker = class {
 		const driver = (await this.#artifacts.adapter()).driver({
 			...modules,
 			profile: value.profile,
-			directory: value.directory
+			directory: value.directory,
+			...this.#exchanges === void 0 ? {} : { exchanges: this.#exchanges },
+			...this.#replay === void 0 ? {} : { replay: this.#replay }
 		});
 		this.#session = await driver.open(value.trial, this.#control.signal);
 		if (this.#control.failure !== void 0) throw failureToStudyError(this.#control.failure);
@@ -3585,6 +5551,16 @@ var StudyWorker = class {
 		});
 		this.#meters.add(meter);
 		try {
+			for (const row of this.#maintenance) if (row.phase === "attempt" || row.phase === "response") await this.#append(valueToWire({
+				event: row.phase === "attempt" ? "dispatch" : "wire",
+				goal: value.id,
+				value: {
+					ordinal: row.ordinal,
+					role: row.role,
+					path: row.path
+				}
+			}));
+			this.#maintenance = [];
 			const product = await this.#control.wait(this.#session.execute(value, {
 				signal: this.#control.signal,
 				meter,
@@ -3620,6 +5596,12 @@ var StudyWorker = class {
 			meter.abort(value.id, value.failure);
 		}
 	}
+	#forward(_role, input, init) {
+		return globalThis.fetch(input, {
+			...init,
+			signal: AbortSignal.any([this.#control.signal, ...init.signal === void 0 || init.signal === null ? [] : [init.signal]])
+		});
+	}
 };
 //#endregion
 //#region src/server/processes/StudyTaskWorker.ts
@@ -3642,6 +5624,9 @@ var StudyTaskWorker = class {
 	}
 	async #execute(value) {
 		if (!isRecord(value) || Buffer.byteLength(JSON.stringify(value)) > 16777216 || typeof value.adapter !== "string" || typeof value.entry !== "string" || !arrayOf(isString)(value.roots) || !isRecord(value.input)) throw new StudyError("CONFIG", "Adapter request is malformed");
+		if (value.closure !== void 0 && !isStudyClosure(value.closure)) throw new StudyError("CONFIG", "Adapter closure selection is malformed");
+		const closure = value.closure;
+		if (closure !== void 0) verifyArtifactClosure(closure.closure, true);
 		const runtime = resolveStudyInstrument(value.entry);
 		const roots = [.../* @__PURE__ */ new Set([...value.roots, runtime])];
 		validateStudyRuntime(runtime, roots);
@@ -3661,6 +5646,7 @@ var StudyTaskWorker = class {
 		if (profile === void 0 && value.operation !== "grade") throw new StudyError("CONFIG", "Unknown adapter operation");
 		const output = profile === void 0 ? this.#grade(adapter, value.input) : this.#validate(adapter, value.input, profile);
 		loader.verify();
+		if (closure !== void 0) verifyArtifactClosure(closure.closure, true);
 		return valueToWire({
 			instrument,
 			value: output
@@ -3816,7 +5802,8 @@ var StudyLauncher = class {
 				"check",
 				request.target,
 				"--profile",
-				request.profile
+				request.profile,
+				...request.closure === void 0 ? [] : ["--closure", request.closure]
 			];
 			const reading = await this.#launch(entry, check, STUDY_LAUNCH_DURATION, false);
 			if (reading.code !== 0) {
@@ -3834,6 +5821,15 @@ var StudyLauncher = class {
 				"--profile",
 				request.profile,
 				...request.out === void 0 ? [] : ["--out", request.out],
+				...request.closure === void 0 ? [] : ["--closure", request.closure],
+				...request.replay === void 0 ? [] : [
+					"--replay",
+					request.replay.result,
+					"--prefix",
+					JSON.stringify(request.replay.prefix),
+					"--offline",
+					String(request.replay.offline)
+				],
 				"--expected",
 				value.fingerprint
 			];
@@ -4447,7 +6443,7 @@ var StudyAgentScriptGoal = class {
 		return this.#plan;
 	}
 	/** Takes the next declared response and advances past it.
-	* @returns The response; undefined once the sequence is exhausted, which it then stays.
+	* @returns The response; undefined after the sequence is exhausted, which it then stays.
 	*/
 	take() {
 		const response = this.#plan.responses[this.#cursor];
@@ -4584,433 +6580,77 @@ var StudyAgentScript = class {
 				};
 				bounded.throwIfAborted();
 				ticket.finish({
-					role: "agent",
-					calls: 1,
-					tokens: void 0,
-					bytes,
-					duration: Math.ceil(performance.now() - started)
-				});
-				if (response.abort === true) {
-					await plan.context.evidence.append({
-						event: "workload",
-						goal: plan.goal,
-						value: { aborted: true }
-					});
-					plan.workload.abort(/* @__PURE__ */ new Error("Declared workload cancellation"));
-				}
-				return result;
-			} catch (error) {
-				if (isBudgetError(error)) this.#cut(ticket, bytes, started);
-				else failStudyTicket(ticket, error, "agent");
-				throw error;
-			} finally {
-				if (isBudgetError(signal.reason)) this.#cut(ticket, bytes, started);
-				else failStudyTicket(ticket, signal.reason ?? new StudyError("FAULT", "Scripted response was abandoned before completion"), "agent");
-			}
-		} finally {
-			this.#serving.delete(response);
-		}
-	}
-	#cut(ticket, bytes, started) {
-		if (ticket.settled || ticket.signal.aborted) return;
-		ticket.finish({
-			role: "agent",
-			calls: 1,
-			tokens: void 0,
-			bytes,
-			duration: Math.ceil(performance.now() - started)
-		});
-	}
-	async #admit(plan, response) {
-		try {
-			return await plan.context.meter.admit({
-				role: "agent",
-				tokens: response.tokens ?? 1,
-				bytes: response.bytes ?? this.#bytes
-			});
-		} catch (error) {
-			await plan.context.evidence.append({
-				event: "admission",
-				goal: plan.goal,
-				value: {
-					role: "agent",
-					refused: true
-				}
-			});
-			throw error;
-		}
-	}
-};
-//#endregion
-//#region src/server/ollama/helpers.ts
-/**
-* Declares the pinned serving identities the Ollama transport verifies, keyed by the label their inventory evidence carries.
-* @param provider - Declared serving identities
-* @returns The model pin, plus the judge pin when the provider declares both the judge name and its digest
-*/
-function buildStudyOllamaModels(provider) {
-	return {
-		model: {
-			name: provider.model,
-			digest: provider.digest.model
-		},
-		...provider.judge === void 0 || provider.digest.judge === void 0 ? {} : { judge: {
-			name: provider.judge,
-			digest: provider.digest.judge
-		} }
-	};
-}
-/**
-* Builds the provider options one role's declared wire policy determines.
-* @remarks
-* The policy's `options` object keeps its identity and key order. A strict policy adds `truncate`
-* and `shift` as `false`; any other policy omits both keys. The `length` allowance is read by the
-* transport and projects nothing.
-* @param policy - The role's declared wire policy
-* @returns The model, think flag, options object, and the strict native fields when declared
-*/
-function buildStudyOllamaOptions(policy) {
-	return {
-		model: policy.model,
-		options: policy.options,
-		think: policy.think,
-		...policy.strict ? {
-			truncate: false,
-			shift: false
-		} : {}
-	};
-}
-/**
-* Validates declared role policies against the pinned inventory before any dispatch.
-* @param roles - The declared wire policy of each model role
-* @param models - The pinned served identities
-* @returns Nothing when every policy names a pinned model and a positive output allowance
-* @throws StudyError - Thrown with code `CONFIG` when a policy names an unpinned model, declares no positive safe-integer `num_predict`, or makes the raw judge wire strict
-*/
-function validateStudyOllamaRoles(roles, models) {
-	const names = Object.values(models).map((model) => model.name);
-	for (const [role, policy] of Object.entries(roles)) {
-		if (policy === void 0) continue;
-		if (!names.includes(policy.model)) throw new StudyError("CONFIG", "Ollama role policy names a model the inventory does not pin");
-		const output = policy.options.num_predict;
-		if (output === void 0 || !Number.isSafeInteger(output) || output <= 0) throw new StudyError("CONFIG", "Ollama role policy declares no positive num_predict allowance");
-		if (role === "judge" && policy.strict) throw new StudyError("CONFIG", "Ollama strict fields apply only to chat roles");
-	}
-}
-/**
-* Reads exact outbound Ollama facts and refuses a request outside its declared policy.
-* @remarks
-* The refusal happens before admission, so a refused request is never accounted.
-* @param options - The admitted origin, pinned inventory, and declared role policies
-* @param role - The responsible request role
-* @param input - The requested URL
-* @param init - The native fetch settings
-* @returns The validated dispatch facts
-* @throws StudyError - Thrown with code `CONFIG` when the endpoint, model, options, flags, or strict fields differ from the declaration, or the role declares no policy
-*/
-function readStudyOllamaRequest(options, role, input, init) {
-	if (input instanceof Request) throw new StudyError("CONFIG", "Ollama transport requires explicit URL requests");
-	const url = new URL(input);
-	const path = role === "metadata" ? init?.method === "POST" ? "/api/show" : "/api/tags" : role === "judge" ? "/api/generate" : "/api/chat";
-	if (url.origin !== new URL(options.url).origin || url.pathname !== path || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "") throw new StudyError("CONFIG", "Ollama transport endpoint differs from the admitted origin and path");
-	if (role === "metadata") {
-		if (path === "/api/show") {
-			if (typeof init?.body !== "string") throw new StudyError("CONFIG", "Invalid model metadata request");
-			const body = JSON.parse(init.body);
-			if (!isRecord(body) || Object.keys(body).length !== 1 || typeof body.model !== "string" || !Object.values(options.models).some((model) => model.name === body.model)) throw new StudyError("CONFIG", "Invalid model metadata identity");
-			return {
-				role,
-				path,
-				model: body.model,
-				output: 0,
-				bytes: new TextEncoder().encode(init.body).byteLength,
-				options: {},
-				strict: false,
-				length: false
-			};
-		}
-		if (init?.method !== "GET" || init.body !== void 0) throw new StudyError("CONFIG", "Invalid inventory request");
-		return {
-			role,
-			path,
-			model: void 0,
-			output: 0,
-			bytes: 0,
-			options: {},
-			strict: false,
-			length: false
-		};
-	}
-	if (init?.method !== "POST" || typeof init.body !== "string") throw new StudyError("CONFIG", "Ollama transport requires an encoded JSON POST");
-	const policy = role === "tool" ? void 0 : options.roles[role];
-	if (policy === void 0) throw new StudyError("CONFIG", "Ollama transport role has no declared wire policy");
-	const output = policy.options.num_predict;
-	if (output === void 0 || !Number.isSafeInteger(output) || output <= 0) throw new StudyError("CONFIG", "Ollama role policy declares no positive num_predict allowance");
-	const body = JSON.parse(init.body);
-	if (!isRecord(body) || body.model !== policy.model || !isRecord(body.options) || canonicalStringify(body.options) !== canonicalStringify(policy.options) || body.stream !== (role !== "judge")) throw new StudyError("CONFIG", "Ollama transport model or effective options differ from the declared policy");
-	if (role === "judge" ? body.raw !== true || body.logprobs !== true : typeof body.think !== "boolean" || body.think === true && !policy.think) throw new StudyError("CONFIG", "Ollama transport flags differ from the declared policy");
-	const strict = policy.strict && role !== "judge";
-	if (strict && (body.truncate !== false || body.shift !== false)) throw new StudyError("CONFIG", "Ollama transport must disable native truncation and shifting");
-	return {
-		role,
-		path,
-		model: policy.model,
-		output,
-		bytes: new TextEncoder().encode(init.body).byteLength,
-		options: { ...policy.options },
-		strict,
-		length: policy.length
-	};
-}
-/**
-* Reads the declared model context ceiling without claiming daemon allocation.
-* @param value - The parsed Ollama show response
-* @param context - The requested total context
-* @returns The unambiguous model context ceiling
-* @throws StudyError - Thrown with code `FAULT` when context metadata is missing, or `CAPACITY` when it is ambiguous or below the requested context
-*/
-function readStudyOllamaSupport(value, context) {
-	if (!isRecord(value) || !isRecord(value.model_info) || typeof value.model_info["general.architecture"] !== "string") throw new StudyError("FAULT", "Missing model context metadata");
-	const architecture = value.model_info["general.architecture"];
-	const keys = Object.keys(value.model_info).filter((key) => key.endsWith(".context_length"));
-	const ceiling = value.model_info[`${architecture}.context_length`];
-	if (keys.length !== 1 || typeof ceiling !== "number" || !Number.isSafeInteger(ceiling) || ceiling < context) {
-		const message = "Model context metadata does not support the requested context";
-		throw new StudyError("CAPACITY", message, {
-			cause: "capacity",
-			message,
-			role: void 0,
-			stop: {
-				layer: "model",
-				id: "context_length",
-				max: keys.length === 1 && Number.isSafeInteger(ceiling) ? parseStudyReading(ceiling) : void 0,
-				consumed: context
-			}
-		});
-	}
-	return ceiling;
-}
-/**
-* Reads a native Ollama error member as the attributable failure it names, without usage.
-* @remarks
-* No token usage is read from the member.
-* The failure is `CAPACITY` when the member, a string or an object, names the exact structured
-* type `exceed_context_size_error` with a finite positive integer `n_prompt_tokens` above `n_ctx`,
-* a `code` of 400 if supplied, and a status of 400 if supplied. Every other member, a malformed
-* one included, is `FAULT` with its readable reason.
-* @param value - The parsed HTTP error body or wire row
-* @param role - The responsibility whose request was dispatched; the failure retains it
-* @param status - The HTTP status of the carrying response; undefined for a row of a stream that answered 200
-* @returns Undefined when the value carries no `error` member; otherwise the attributable failure
-*/
-function readStudyOllamaFailure(value, role, status) {
-	if (!isRecord(value) || !("error" in value)) return void 0;
-	const field = value.error;
-	const decoded = typeof field === "string" ? parseJSON(field) : field;
-	const structured = isRecord(decoded) ? isRecord(decoded.error) ? decoded.error : decoded : void 0;
-	const native = structured?.message;
-	const text = typeof native === "string" && native.trim() !== "" ? native : typeof field === "string" ? field : "";
-	const label = structured?.type;
-	const type = typeof label === "string" && label !== "" ? label : void 0;
-	const origin = status === void 0 ? "Ollama error" : `Ollama HTTP ${status} error`;
-	const prompt = structured?.n_prompt_tokens;
-	const limit = structured?.n_ctx;
-	const capacity = type === "exceed_context_size_error" && isInteger(prompt) && prompt > 0 && isInteger(limit) && limit > 0 && prompt > limit && (structured?.code === void 0 || structured?.code === 400) && (status === void 0 || status === 400);
-	const reason = text.trim() === "" && type === void 0 ? `Malformed ${origin}` : `${origin}${type === void 0 ? "" : ` (${type})`}${text.trim() === "" ? "" : `: ${text}`}`;
-	return new StudyError(capacity ? "CAPACITY" : "FAULT", reason, {
-		cause: capacity ? "capacity" : "infrastructure",
-		message: reason,
-		role,
-		stop: capacity ? {
-			layer: "model",
-			id: "num_ctx",
-			max: parseStudyReading(limit),
-			consumed: parseStudyReading(prompt)
-		} : void 0
-	});
-}
-/**
-* Reads one Ollama response row without inventing absent usage.
-* @param value - The parsed wire row
-* @param request - The admitted dispatch
-* @returns The terminal facts, or undefined for a nonterminal row
-* @throws StudyError - Thrown with the recognized provider failure when the row carries an `error` member, before any other row check; `FAULT` for a malformed row, model, message, finish reason, or usage
-*/
-function readStudyOllamaTerminal(value, request) {
-	const failure = readStudyOllamaFailure(value, request.role);
-	if (failure !== void 0) throw failure;
-	if (!isRecord(value) || typeof value.done !== "boolean") throw new StudyError("FAULT", "Malformed Ollama response row");
-	if (value.model !== request.model) throw new StudyError("FAULT", "Ollama response model differs from the dispatched model");
-	if (request.role !== "judge") {
-		if (!isRecord(value.message) || typeof value.message.content !== "string" || value.message.thinking !== void 0 && typeof value.message.thinking !== "string") throw new StudyError("FAULT", "Malformed Ollama message");
-		if (value.message.tool_calls !== void 0) {
-			if (!isArray(value.message.tool_calls)) throw new StudyError("FAULT", "Malformed Ollama tool calls");
-			for (const call of value.message.tool_calls) if (!isRecord(call) || !isRecord(call.function) || typeof call.function.name !== "string" || !isRecord(call.function.arguments)) throw new StudyError("FAULT", "Malformed Ollama tool call");
-		}
-	}
-	if (!value.done) return void 0;
-	if (typeof value.done_reason !== "string" || value.done_reason.length === 0) throw new StudyError("FAULT", "Missing Ollama finish reason");
-	for (const key of ["prompt_eval_count", "eval_count"]) if (value[key] !== void 0 && (typeof value[key] !== "number" || !Number.isSafeInteger(value[key]) || value[key] < 0)) throw new StudyError("FAULT", "Malformed Ollama usage", {
-		cause: "infrastructure",
-		message: "Malformed Ollama usage",
-		role: request.role,
-		stop: void 0
-	});
-	return {
-		prompt: typeof value.prompt_eval_count === "number" ? value.prompt_eval_count : void 0,
-		completion: typeof value.eval_count === "number" ? value.eval_count : void 0,
-		reason: value.done_reason
-	};
-}
-/**
-* Checks terminal policy after the actual wire cost has been retained.
-* @param terminal - The valid terminal facts
-* @param room - The reserved context and safety margin
-* @param request - The admitted dispatch and its declared finish policy; every refusal retains its role
-* @returns Nothing when the completion satisfies the declared policy
-* @throws StudyError - Thrown with code `CAPACITY` when the actual prompt exceeds its room, generation exceeds its allowance, or an undeclared `length` finish or capped generation occurs; `FAULT` for another unsupported finish reason
-*/
-function validateStudyOllamaCompletion(terminal, room, request) {
-	const { prompt, completion, reason } = terminal;
-	const { role } = request;
-	const capped = {
-		layer: "model",
-		id: "num_predict",
-		max: request.output,
-		consumed: completion
-	};
-	const ceiling = room.context - request.output - room.safety;
-	if (prompt !== void 0 && prompt > ceiling) {
-		const message = "Actual prompt exceeded reserved context capacity";
-		throw new StudyError("CAPACITY", message, {
-			cause: "capacity",
-			message,
-			role,
-			stop: {
-				layer: "window",
-				id: "Context room",
-				max: ceiling,
-				consumed: prompt
+					role: "agent",
+					calls: 1,
+					tokens: void 0,
+					bytes,
+					duration: Math.ceil(performance.now() - started)
+				});
+				if (response.abort === true) {
+					await plan.context.evidence.append({
+						event: "workload",
+						goal: plan.goal,
+						value: { aborted: true }
+					});
+					plan.workload.abort(/* @__PURE__ */ new Error("Declared workload cancellation"));
+				}
+				return result;
+			} catch (error) {
+				if (isBudgetError(error)) this.#cut(ticket, bytes, started);
+				else failStudyTicket(ticket, error, "agent");
+				throw error;
+			} finally {
+				if (isBudgetError(signal.reason)) this.#cut(ticket, bytes, started);
+				else failStudyTicket(ticket, signal.reason ?? new StudyError("FAULT", "Scripted response was abandoned before completion"), "agent");
 			}
-		});
-	}
-	if (completion !== void 0 && completion > request.output) {
-		const message = "Actual generation exceeded the output allowance";
-		throw new StudyError("CAPACITY", message, {
-			cause: "capacity",
-			message,
-			role,
-			stop: capped
-		});
-	}
-	if (!request.length && (reason === "length" || completion !== void 0 && completion >= request.output)) {
-		const message = "Substantive generation reached its output cap";
-		throw new StudyError("CAPACITY", message, {
-			cause: "capacity",
-			message,
-			role,
-			stop: capped
-		});
+		} finally {
+			this.#serving.delete(response);
+		}
 	}
-	if (reason !== "stop" && !(request.length && reason === "length")) {
-		const message = "Unsupported Ollama finish reason";
-		throw new StudyError("FAULT", message, {
-			cause: "infrastructure",
-			message,
-			role,
-			stop: void 0
+	#cut(ticket, bytes, started) {
+		if (ticket.settled || ticket.signal.aborted) return;
+		ticket.finish({
+			role: "agent",
+			calls: 1,
+			tokens: void 0,
+			bytes,
+			duration: Math.ceil(performance.now() - started)
 		});
 	}
-}
-/**
-* Verifies that each pinned name resolves to one inventory entry with its pinned digest.
-* @param value - The parsed inventory response
-* @param models - The pinned served identities
-* @returns Nothing for a matching inventory
-* @throws StudyError - Thrown with code `FAULT` when the inventory is unsupported or a pinned identity does not match
-*/
-function validateStudyOllamaInventory(value, models) {
-	if (!isObject(value) || !("models" in value) || !isArray(value.models)) throw new StudyError("FAULT", "Unsupported Ollama inventory");
-	const served = value.models;
-	for (const { name, digest } of Object.values(models)) {
-		const matches = served.filter((model) => isRecord(model) && model.name === name);
-		const model = matches[0];
-		if (matches.length !== 1 || !isRecord(model) || typeof model.digest !== "string" || model.digest.replace(/^sha256:/, "") !== digest.replace(/^sha256:/, "")) throw new StudyError("FAULT", "Serving inventory does not match the required model digest");
-	}
-}
-/**
-* Reads the pinned serving digest of an admitted request's model.
-* @param models - The pinned served identities
-* @param request - The admitted dispatch
-* @returns The pinned digest, or undefined for an inventory request or an unpinned model
-*/
-function readStudyOllamaDigest(models, request) {
-	if (request.model === void 0) return void 0;
-	return Object.values(models).find((model) => model.name === request.model)?.digest;
-}
-/**
-* Reads daemon timing from a terminal row without letting an observation fail the request.
-* @param extract - The admitted extractor
-* @param record - The validated terminal row
-* @returns The raw timing, or undefined when absent or the extractor throws
-*/
-function readStudyOllamaTiming(extract, record) {
-	try {
-		return extract(record);
-	} catch {
-		return;
+	async #admit(plan, response) {
+		try {
+			return await plan.context.meter.admit({
+				role: "agent",
+				tokens: response.tokens ?? 1,
+				bytes: response.bytes ?? this.#bytes
+			});
+		} catch (error) {
+			await plan.context.evidence.append({
+				event: "admission",
+				goal: plan.goal,
+				value: {
+					role: "agent",
+					refused: true
+				}
+			});
+			throw error;
+		}
 	}
-}
-/**
-* Builds the JSON evidence form of a timing observation with raw nanoseconds and counts.
-* @param timing - The extracted timing
-* @returns Null when no terminal timing was observed; otherwise every unreported member as null
-*/
-function buildStudyOllamaTiming(timing) {
-	if (timing === void 0) return null;
-	return {
-		durations: {
-			total: timing.durations.total ?? null,
-			load: timing.durations.load ?? null,
-			prompt: timing.durations.prompt ?? null,
-			decode: timing.durations.decode ?? null
-		},
-		counts: {
-			prompt: timing.counts.prompt ?? null,
-			decode: timing.counts.decode ?? null,
-			cached: timing.counts.cached ?? null
-		},
-		invalid: [...timing.invalid]
-	};
-}
-/**
-* Builds a reading of the raw prompt text an encoded request body carries, as sent.
-* @param body - The encoded request body
-* @returns The prompt's UTF-16 code units and UTF-8 bytes, labeled with its encoding, or undefined when there is no string prompt; these are readings of the actual text, not token allocations
-*/
-function buildStudyOllamaRaw(body) {
-	if (typeof body !== "string") return void 0;
-	const parsed = attempt(() => JSON.parse(body));
-	if (!parsed.success || !isRecord(parsed.value) || typeof parsed.value.prompt !== "string") return void 0;
-	return {
-		encoding: "utf-8",
-		units: parsed.value.prompt.length,
-		bytes: new TextEncoder().encode(parsed.value.prompt).byteLength
-	};
-}
+};
 //#endregion
 //#region src/server/ollama/cloners.ts
 /**
 * Builds a frozen owned copy of transport configuration that later caller mutation cannot reach.
 * @remarks
 * Every caller member is read once, outer fields before nested data. Every nested data object is
-* copied and frozen; the caller's objects are never frozen. The cancellation signal and timing
-* extractor keep their live identity.
+* copied and frozen; the caller's objects are never frozen. The cancellation signal, timing
+* extractor, and fetch collaborator keep their live identity.
 * @param options - The caller's transport configuration
 * @returns The owned configuration, not yet validated
 */
 function buildStudyOllamaTransportOptions(options) {
-	const { url, room, limit, models, roles, signal, observe, timing } = options;
+	const { url, room, limit, models, roles, signal, observe, timing, fetch, metadata, version, procedure, exchanges } = options;
+	if (Object.hasOwn(roles, "maintenance")) throw new StudyError("CONFIG", "Maintenance cannot declare a generation policy");
 	const owned = Object.fromEntries(Object.entries(models).map(([label, { name, digest }]) => [label, Object.freeze({
 		name,
 		digest
@@ -5047,7 +6687,23 @@ function buildStudyOllamaTransportOptions(options) {
 		roles: Object.freeze(policies),
 		signal,
 		observe,
-		timing
+		timing,
+		metadata: Object.freeze({ ...metadata }),
+		...version === void 0 ? {} : { version },
+		...procedure === void 0 ? {} : { procedure: Object.freeze(procedure.map((step) => {
+			const { policy, ...identity } = step;
+			if (identity.admission === "exact" && Object.hasOwn(step, "bytes") || identity.admission === "capture" && (Object.hasOwn(step, "body") || Object.hasOwn(step, "input"))) throw new StudyError("CONFIG", "Conflicting model-step admission declarations");
+			const { options: wire, ...settings } = policy;
+			return Object.freeze({
+				...identity,
+				policy: Object.freeze({
+					...settings,
+					options: Object.freeze({ ...wire })
+				})
+			});
+		})) },
+		...exchanges === void 0 ? {} : { exchanges },
+		...fetch === void 0 ? {} : { fetch }
 	});
 }
 /**
@@ -5081,6 +6737,10 @@ function buildStudyOllamaSnapshot(input, init, dispatch) {
 //#region src/server/ollama/StudyOllamaExchange.ts
 /** Tracks one owned HTTP response through its counted bytes, decoded rows, terminal and settlement. */
 var StudyOllamaExchange = class {
+	slot;
+	identity;
+	headers;
+	ceiling;
 	activity;
 	request;
 	ticket;
@@ -5097,10 +6757,16 @@ var StudyOllamaExchange = class {
 	#terminal;
 	#timing;
 	#settled = false;
+	#chunks = [];
+	#recorded = false;
 	/** Binds the facts of one dispatched request and its open response.
 	* @param wire - The request, accounting boundary, reader and identities; its byte count starts the tally.
 	*/
 	constructor(wire) {
+		this.slot = wire.slot;
+		this.identity = wire.identity;
+		this.headers = wire.headers;
+		this.ceiling = wire.ceiling;
 		this.activity = wire.activity;
 		this.request = wire.request;
 		this.ticket = wire.ticket;
@@ -5134,6 +6800,29 @@ var StudyOllamaExchange = class {
 	get settled() {
 		return this.#settled;
 	}
+	/** Reports whether a sidecar terminal has already been admitted. */
+	get recorded() {
+		return this.#recorded;
+	}
+	/** Holds the exact bounded bytes and native chunk lengths observed so far. */
+	get reply() {
+		return {
+			status: this.status,
+			headers: this.headers,
+			...buildStudyOllamaBytes(Buffer.concat(this.#chunks)),
+			chunks: this.#chunks.map((chunk) => chunk.byteLength)
+		};
+	}
+	/** Retains one bounded chunk before decoding changes its representation.
+	* @param chunk - The native response bytes already counted under the ceiling.
+	*/
+	retain(chunk) {
+		if (this.identity !== void 0 && chunk.byteLength > 0) this.#chunks = [...this.#chunks, Buffer.from(chunk)];
+	}
+	/** Marks a sidecar terminal admitted so failure cleanup cannot append another. */
+	record() {
+		this.#recorded = true;
+	}
 	/** Adds a response chunk's bytes to the tally and refuses a tally beyond the allowance.
 	* @param length - The chunk's byte length.
 	* @param limit - The response byte allowance.
@@ -5222,7 +6911,15 @@ var StudyOllamaGoal = class {
 var StudyOllamaTransport = class {
 	#options;
 	#abort = new AbortController();
+	#sends = /* @__PURE__ */ new Set();
 	#wires = /* @__PURE__ */ new Set();
+	#requests = /* @__PURE__ */ new Set();
+	#verifications = /* @__PURE__ */ new Set();
+	#metadataControl;
+	#metadataScope;
+	#metadataMeter;
+	#passes = 0;
+	#step = 0;
 	#goal;
 	#fault;
 	#count = 0;
@@ -5232,8 +6929,31 @@ var StudyOllamaTransport = class {
 	*/
 	constructor(options) {
 		const owned = buildStudyOllamaTransportOptions(options);
+		if (owned.fetch !== void 0 && !isFunction(owned.fetch)) throw new StudyError("CONFIG", "Ollama fetch collaborator must be callable");
 		validateStudyOllamaRoles(owned.roles, owned.models);
+		validateStudyOllamaRecording(owned);
 		this.#options = owned;
+		this.#metadataControl = new StudyControl(owned.signal);
+		const duration = Math.min(MAX_TIMEOUT_MS, Math.ceil(owned.metadata.duration));
+		this.#metadataScope = new StudyScope({
+			limit: {
+				...owned.metadata,
+				duration: MAX_TIMEOUT_MS,
+				tokens: 1
+			},
+			control: this.#metadataControl,
+			label: "Metadata"
+		});
+		this.#metadataMeter = new StudyMeter({
+			request: {
+				duration: Math.min(duration, owned.limit.duration),
+				calls: 1,
+				tokens: 1,
+				bytes: owned.metadata.bytes
+			},
+			scopes: [this.#metadataScope],
+			control: this.#metadataControl
+		});
 	}
 	/** Binds subsequent wire requests to one live goal until `clear` or `close` ends it.
 	* @param activity - The goal's accounting boundary.
@@ -5271,7 +6991,14 @@ var StudyOllamaTransport = class {
 	* @throws StudyError - Thrown with code `FAULT` when no goal is bound; the transport retains this refusal as its failure, as it retains every verification failure.
 	*/
 	async verify() {
+		const verification = Symbol("verification");
 		try {
+			this.check();
+			if (this.#requests.size !== 0 || this.#verifications.size !== 0) throw new StudyError("FAULT", "Verification cannot overlap an admitted request");
+			if (this.#goal === void 0) throw new StudyError("FAULT", "Model dispatch outside an active goal");
+			if (this.#options.procedure !== void 0 && (this.#passes > 1 || this.#passes === 1 && this.#step !== this.#options.procedure.length)) throw new StudyError("FAULT", "Postflight requires the complete model procedure");
+			this.#verifications.add(verification);
+			if (this.#options.version !== void 0) await (await this.fetch("metadata", new URL("/api/version", this.#options.url), { method: "GET" })).text();
 			validateStudyOllamaInventory(await (await this.fetch("metadata", new URL("/api/tags", this.#options.url), { method: "GET" })).json(), this.#options.models);
 			const goal = this.#goal;
 			if (goal === void 0) throw new StudyError("FAULT", "Inventory has no goal attribution");
@@ -5298,9 +7025,20 @@ var StudyOllamaTransport = class {
 				goal: activity.goal,
 				value: Object.fromEntries(Object.entries(this.#options.models).map(([label, model]) => [label, model.digest]))
 			});
+			this.check();
+			this.#passes += 1;
+			if (this.#options.exchanges !== void 0 && this.#passes === 2) {
+				if (this.#requests.size !== 0 || this.#sends.size !== 0 || this.#wires.size !== 0) throw new StudyError("FAULT", "Cannot complete while an exchange is pending");
+				await this.#options.exchanges.append({
+					phase: "complete",
+					count: this.#options.exchanges.next - 1
+				});
+			}
 		} catch (error) {
 			this.fail(error);
 			throw error;
+		} finally {
+			this.#verifications.delete(verification);
 		}
 	}
 	/** Dispatches exactly one admitted request with bounded streaming reads.
@@ -5317,52 +7055,22 @@ var StudyOllamaTransport = class {
 		const goal = this.#goal;
 		if (goal === void 0) throw new StudyError("FAULT", "Model dispatch outside an active goal");
 		const activity = goal.activity;
+		const slot = Symbol("request");
 		try {
+			if (this.#requests.size !== 0) throw new StudyError("FAULT", "A previous Ollama request is still in flight");
+			if (this.#verifications.size !== 0 && role !== "metadata") throw new StudyError("FAULT", "Model dispatch cannot overlap verification");
+			this.#requests.add(slot);
 			const snapshot = buildStudyOllamaSnapshot(input, init, original);
 			const settings = snapshot.init;
 			const request = readStudyOllamaRequest(this.#options, role, snapshot.url, settings);
-			const limit = this.#options.limit;
-			if (request.bytes >= limit.bytes) {
-				const message = "Encoded request consumes the response byte allowance";
-				throw new StudyError("CAPACITY", message, {
-					cause: "capacity",
-					message,
-					role: void 0,
-					stop: {
-						layer: "scope",
-						id: "Wire bytes",
-						max: limit.bytes,
-						consumed: request.bytes
-					}
-				});
+			if (this.#options.procedure !== void 0 && role !== "metadata") {
+				if (this.#passes !== 1) throw new StudyError("FAULT", "Model dispatch requires completed preflight and open execution");
+				validateStudyOllamaStep(this.#options.procedure[this.#step], activity.goal, request, settings?.body);
 			}
-			const ticket = await activity.context.meter.admit({
-				role,
-				tokens: role === "metadata" ? 0 : this.#options.room.context - this.#options.room.safety,
-				bytes: limit.bytes
-			});
-			const id = ++this.#count;
-			const started = performance.now();
-			const signal = AbortSignal.any([
-				this.#options.signal,
-				this.#abort.signal,
-				activity.context.signal,
-				activity.context.meter.signal,
-				ticket.signal,
-				AbortSignal.timeout(limit.duration),
-				...settings?.signal === void 0 || settings.signal === null ? [] : [settings.signal]
-			]);
-			const wire = await this.#send(role, goal, ticket, request, snapshot, signal, id, started);
-			this.#wires.add(wire);
-			if (wire.status < 200 || wire.status > 299) return await this.#refuse(wire);
-			return new Response(new ReadableStream({
-				pull: (controller) => this.#pull(wire, controller),
-				cancel: (reason) => isBudgetError(reason) ? this.#cut(wire, reason) : this.#failWire(wire, reason === void 0 ? new StudyError("FAULT", "Ollama response cancelled before its end") : reason)
-			}), {
-				status: wire.status,
-				headers: { "content-type": role === "judge" || role === "metadata" ? "application/json" : "application/x-ndjson" }
-			});
+			if (this.#options.exchanges !== void 0 && role === "metadata" && this.#verifications.size === 0) throw new StudyError("FAULT", "Recorded metadata requires a verification pass");
+			return await this.#request(slot, role, goal, request, snapshot);
 		} catch (error) {
+			this.#requests.delete(slot);
 			this.fail(error);
 			throw error;
 		}
@@ -5372,8 +7080,87 @@ var StudyOllamaTransport = class {
 	*/
 	async close() {
 		this.#abort.abort(new StudyError("FAULT", "Ollama transport closed"));
+		await Promise.all([...this.#sends].map((sending) => sending.catch((error) => this.fail(error))));
 		await Promise.all([...this.#wires].map((wire) => this.#failWire(wire, this.#abort.signal.reason)));
 		this.#goal = void 0;
+		this.#metadataMeter.close();
+		this.#metadataScope.close();
+		this.#metadataControl.close();
+	}
+	async #request(slot, role, goal, request, snapshot) {
+		const activity = goal.activity;
+		const settings = snapshot.init;
+		const metadata = role === "metadata";
+		const available = this.#options.metadata.bytes - this.#metadataMeter.usage.reduce((total, usage) => total + (usage.bytes ?? this.#options.metadata.bytes), 0);
+		const remaining = this.#remaining;
+		if (metadata && remaining <= 0) throw new StudyError("DEADLINE", "Metadata duration allowance exhausted", {
+			cause: "deadline",
+			message: "Metadata duration allowance exhausted",
+			role,
+			stop: {
+				layer: "scope",
+				id: "Metadata duration",
+				max: this.#options.metadata.duration,
+				consumed: this.#options.metadata.duration - remaining
+			}
+		});
+		const limit = {
+			duration: metadata ? Math.min(this.#options.limit.duration, Math.ceil(remaining)) : this.#options.limit.duration,
+			bytes: metadata ? Math.min(this.#options.limit.bytes, available) : this.#options.limit.bytes
+		};
+		if (request.bytes >= limit.bytes) {
+			const message = "Encoded request consumes the response byte allowance";
+			throw new StudyError("CAPACITY", message, {
+				cause: "capacity",
+				message,
+				role,
+				stop: {
+					layer: "scope",
+					id: "Wire bytes",
+					max: limit.bytes,
+					consumed: request.bytes
+				}
+			});
+		}
+		const ticket = await (metadata ? this.#metadataMeter : activity.context.meter).admit({
+			role,
+			tokens: role === "metadata" ? 0 : this.#options.room.context - this.#options.room.safety,
+			bytes: limit.bytes
+		});
+		const id = this.#options.exchanges?.next ?? ++this.#count;
+		const started = performance.now();
+		const signal = AbortSignal.any([
+			this.#options.signal,
+			this.#abort.signal,
+			activity.context.signal,
+			...metadata ? [this.#metadataMeter.signal] : [activity.context.meter.signal],
+			ticket.signal,
+			AbortSignal.timeout(limit.duration),
+			...settings?.signal === void 0 || settings.signal === null ? [] : [settings.signal]
+		]);
+		const identity = this.#options.exchanges === void 0 ? void 0 : {
+			ordinal: id,
+			goal: activity.goal,
+			role,
+			path: role === "metadata" ? request.path === "/api/version" ? "/api/version" : request.path === "/api/tags" ? "/api/tags" : "/api/show" : role === "judge" ? "/api/generate" : "/api/chat",
+			method: settings?.method === "GET" ? "GET" : "POST",
+			stage: role === "metadata" ? this.#passes === 0 ? "preflight" : "postflight" : "execution",
+			...role === "metadata" ? {} : { step: this.#step + 1 }
+		};
+		const sending = this.#send(role, goal, ticket, request, snapshot, signal, id, started, slot, identity, limit.bytes);
+		this.#sends.add(sending);
+		const wire = await sending.finally(() => this.#sends.delete(sending));
+		if (wire.status < 200 || wire.status > 299) return await this.#refuse(wire);
+		return new Response(new ReadableStream({
+			pull: (controller) => this.#pull(wire, controller),
+			cancel: (reason) => isBudgetError(reason) ? this.#cut(wire, reason) : this.#failWire(wire, reason === void 0 ? new StudyError("FAULT", "Ollama response cancelled before its end") : reason)
+		}), {
+			status: wire.status,
+			headers: { "content-type": role === "judge" || role === "metadata" ? "application/json" : "application/x-ndjson" }
+		});
+	}
+	get #remaining() {
+		return this.#options.metadata.duration - this.#metadataMeter.usage.reduce((total, usage) => total + usage.duration, 0);
 	}
 	async #refuse(wire) {
 		const failure = await this.#diagnose(wire);
@@ -5386,10 +7173,11 @@ var StudyOllamaTransport = class {
 		try {
 			for (;;) {
 				wire.signal.throwIfAborted();
-				const chunk = await wire.reader.read();
+				const chunk = await this.#read(wire);
 				wire.signal.throwIfAborted();
 				if (chunk.done) break;
-				wire.count(chunk.value.byteLength, this.#options.limit.bytes);
+				wire.count(chunk.value.byteLength, wire.ceiling);
+				wire.retain(chunk.value);
 				parts.push(decoder.decode(chunk.value, { stream: true }));
 			}
 			const body = parseJSON(parts.join("") + decoder.decode());
@@ -5407,10 +7195,11 @@ var StudyOllamaTransport = class {
 	async #pull(wire, controller) {
 		try {
 			wire.signal.throwIfAborted();
-			const chunk = await wire.reader.read();
+			const chunk = await this.#read(wire);
 			wire.signal.throwIfAborted();
 			if (!chunk.done) {
-				wire.count(chunk.value.byteLength, this.#options.limit.bytes);
+				wire.count(chunk.value.byteLength, wire.ceiling);
+				wire.retain(chunk.value);
 				wire.decode(chunk.value);
 				if (wire.request.role !== "metadata" && wire.request.role !== "judge") this.#rows(wire, false);
 				controller.enqueue(chunk.value);
@@ -5420,19 +7209,48 @@ var StudyOllamaTransport = class {
 			if (wire.request.role === "metadata") {
 				const value = JSON.parse(wire.text);
 				if (wire.request.path === "/api/tags") validateStudyOllamaInventory(value, this.#options.models);
-				else readStudyOllamaSupport(value, this.#options.room.context);
+				else if (wire.request.path === "/api/version") {
+					if (!isRecord(value) || value.version !== this.#options.version) throw new StudyError("FAULT", "Serving version differs from the declared version");
+				} else readStudyOllamaSupport(value, this.#options.room.context);
 			} else if (wire.request.role === "judge") this.#observe(wire, JSON.parse(wire.text));
 			else this.#rows(wire, true);
 			if (wire.request.role !== "metadata" && wire.terminal === void 0) throw new StudyError("FAULT", "Ollama response has no terminal row");
 			await this.#finish(wire);
+			if (wire.request.role === "metadata" && this.#remaining < 0) {
+				const message = "Metadata duration allowance exhausted";
+				throw new StudyError("DEADLINE", message, {
+					cause: "deadline",
+					message,
+					role: "metadata",
+					stop: {
+						layer: "scope",
+						id: "Metadata duration",
+						max: this.#options.metadata.duration,
+						consumed: this.#options.metadata.duration - this.#remaining
+					}
+				});
+			}
 			if (wire.terminal !== void 0) await this.#judge(wire, wire.terminal);
+			if (wire.identity !== void 0) {
+				this.check();
+				await this.#options.exchanges?.append({
+					phase: "response",
+					...wire.identity,
+					...wire.reply
+				});
+				wire.record();
+				if (wire.identity.step !== void 0) this.#step += 1;
+			}
+			this.#requests.delete(wire.slot);
 			controller.close();
 		} catch (error) {
 			this.fail(error);
 			try {
+				if (wire.settled) await this.#recordFailure(wire, error);
 				if (isBudgetError(error)) await this.#cut(wire, error);
 				else await this.#failWire(wire, error);
 			} finally {
+				this.#requests.delete(wire.slot);
 				controller.error(error);
 			}
 		}
@@ -5472,10 +7290,16 @@ var StudyOllamaTransport = class {
 	#time(row) {
 		return this.#options.observe && isRecord(row) ? readStudyOllamaTiming(this.#options.timing, row) : void 0;
 	}
-	async #send(role, goal, ticket, request, snapshot, signal, id, started) {
+	async #send(role, goal, ticket, request, snapshot, signal, id, started, slot, identity, ceiling) {
 		const { url, init: settings, dispatch } = snapshot;
 		try {
+			this.check();
 			signal.throwIfAborted();
+			if (identity !== void 0) await this.#options.exchanges?.append({
+				phase: "attempt",
+				...identity,
+				...buildStudyOllamaBytes(new TextEncoder().encode(typeof settings?.body === "string" ? settings.body : ""))
+			});
 			await goal.activity.context.evidence.append({
 				event: "dispatch",
 				goal: goal.activity.goal,
@@ -5485,18 +7309,28 @@ var StudyOllamaTransport = class {
 					model: request.model ?? null,
 					options: { ...request.options },
 					bytes: request.bytes,
+					...identity === void 0 ? {} : { ordinal: identity.ordinal },
 					...this.#options.observe ? this.#dispatch(goal, request, id, settings, dispatch) : {}
 				}
 			});
 			signal.throwIfAborted();
+			this.check();
 			const sent = performance.now();
-			const response = await globalThis.fetch(url, {
+			const response = this.#options.fetch === void 0 ? await globalThis.fetch(url, {
 				...settings,
 				signal,
 				redirect: "error"
-			});
+			}) : await this.#fetch(this.#options.fetch, role, url, settings, signal);
+			if (signal.aborted) {
+				response.body?.cancel(signal.reason).catch(() => void 0);
+				signal.throwIfAborted();
+			}
 			if (response.body === null) throw new StudyError("FAULT", `Ollama HTTP response refused: ${response.status}`);
-			return new StudyOllamaExchange({
+			const wire = new StudyOllamaExchange({
+				slot,
+				identity,
+				ceiling,
+				headers: [...response.headers.entries()].filter(([name]) => name === "content-type" || name === "content-encoding"),
 				activity: goal.activity,
 				request,
 				ticket,
@@ -5510,23 +7344,88 @@ var StudyOllamaTransport = class {
 				dispatch,
 				bytes: request.bytes
 			});
+			this.#wires.add(wire);
+			return wire;
 		} catch (error) {
-			if (!ticket.signal.aborted) {
-				if (isBudgetError(error)) ticket.finish({
-					role,
-					calls: 1,
-					tokens: void 0,
-					bytes: void 0,
-					duration: Math.ceil(performance.now() - started)
-				});
-				else ticket.fail({
-					...readStudyFailure(error),
-					role
-				});
+			try {
+				if (identity !== void 0 && this.#options.exchanges !== void 0 && this.#options.exchanges.next > identity.ordinal) {
+					this.#fault ??= { error };
+					await this.#options.exchanges.append({
+						phase: "failure",
+						...identity,
+						reason: readStudyFailure(error).message.slice(0, 256)
+					});
+				}
+			} finally {
+				if (!ticket.settled && !ticket.signal.aborted) {
+					if (isBudgetError(error)) ticket.finish({
+						role,
+						calls: 1,
+						tokens: void 0,
+						bytes: void 0,
+						duration: Math.ceil(performance.now() - started)
+					});
+					else ticket.fail({
+						...readStudyFailure(error),
+						role
+					});
+				}
 			}
 			throw error;
 		}
 	}
+	#read(wire) {
+		const listeners = new Abort();
+		return new Promise((resolve, reject) => {
+			wire.signal.addEventListener("abort", () => reject(wire.signal.reason), {
+				once: true,
+				signal: listeners.signal
+			});
+			wire.signal.throwIfAborted();
+			wire.reader.read().then(resolve, reject);
+		}).finally(() => listeners.abort());
+	}
+	async #recordFailure(wire, error) {
+		if (wire.identity === void 0 || wire.recorded) return;
+		this.#fault ??= { error };
+		const reason = readStudyFailure(error).message;
+		try {
+			await this.#options.exchanges?.append({
+				phase: "failure",
+				...wire.identity,
+				reason: reason.slice(0, 256),
+				response: wire.reply
+			});
+		} catch (failure) {
+			if (!isStudyError(failure) || failure.code !== "CAPACITY") throw failure;
+			await this.#options.exchanges?.append({
+				phase: "failure",
+				...wire.identity,
+				reason: `The reply was not retained because it exceeded the sidecar allowance; ${reason.slice(0, 128)}`
+			});
+		}
+		wire.record();
+	}
+	#fetch(fetch, role, url, settings, signal) {
+		const listeners = new Abort();
+		return new Promise((resolve, reject) => {
+			signal.addEventListener("abort", () => reject(signal.reason), {
+				once: true,
+				signal: listeners.signal
+			});
+			signal.throwIfAborted();
+			fetch(role, url, {
+				...settings,
+				signal,
+				redirect: "error"
+			}).then((response) => {
+				if (signal.aborted) {
+					response.body?.cancel(signal.reason).catch(() => void 0);
+					reject(signal.reason);
+				} else resolve(response);
+			}, reject);
+		}).finally(() => listeners.abort());
+	}
 	#dispatch(goal, request, id, init, dispatch) {
 		const previous = this.#previous;
 		const model = request.role !== "metadata";
@@ -5574,6 +7473,7 @@ var StudyOllamaTransport = class {
 				prompt: terminal?.prompt ?? null,
 				completion: terminal?.completion ?? null,
 				bytes: wire.bytes,
+				...wire.identity === void 0 ? {} : { ordinal: wire.identity.ordinal },
 				...observation
 			}
 		});
@@ -5597,6 +7497,7 @@ var StudyOllamaTransport = class {
 		const observation = this.#options.observe ? this.#timeline(wire) : {};
 		const stop = readStudyFailure(error).stop;
 		try {
+			await this.#recordFailure(wire, error);
 			await wire.activity.context.evidence.append({
 				event: "cut",
 				goal: wire.activity.goal,
@@ -5628,6 +7529,7 @@ var StudyOllamaTransport = class {
 			});
 			throw failure;
 		} finally {
+			this.#requests.delete(wire.slot);
 			this.#wires.delete(wire);
 			await wire.reader.cancel(error).catch(() => void 0);
 			wire.reader.releaseLock();
@@ -5644,6 +7546,7 @@ var StudyOllamaTransport = class {
 				...failure,
 				role: wire.request.role
 			});
+			await this.#recordFailure(wire, error);
 			await wire.activity.context.evidence.append({
 				event: "failure",
 				goal: wire.activity.goal,
@@ -5657,6 +7560,7 @@ var StudyOllamaTransport = class {
 				}
 			});
 		} finally {
+			this.#requests.delete(wire.slot);
 			this.#wires.delete(wire);
 			await wire.reader.cancel(error).catch(() => void 0);
 			wire.reader.releaseLock();
@@ -5664,6 +7568,6 @@ var StudyOllamaTransport = class {
 	}
 };
 //#endregion
-export { ARTIFACT_BYTES, ARTIFACT_DEPTH, ARTIFACT_FILES, ARTIFACT_FILE_BYTES, ARTIFACT_ROOTS, ARTIFACT_VISITS, ArtifactError, ArtifactLoader, Resolution, STUDY_COMMAND_DURATION, STUDY_COMMAND_GRADER, STUDY_COMMAND_HELP, STUDY_COMMAND_OPERATION, STUDY_CUSTODY_BYTES, STUDY_DRAIN_DURATION, STUDY_FRAME_BYTES, STUDY_LAUNCH_BYTES, STUDY_LAUNCH_CLEANUP, STUDY_LAUNCH_DURATION, STUDY_LOG_BYTES, STUDY_PACKET_DISCLOSURE, STUDY_PENDING_LIMIT, STUDY_PROCESS_LABEL, STUDY_RESERVED_NAME, STUDY_TASK_DURATION, STUDY_TASK_OPERATION, STUDY_WORKER_OPERATION, StudyAgentScript, StudyAgentSummary, StudyAgentTrace, StudyArtifactLoader, StudyCLI, StudyChannel, StudyCommand, StudyEvidenceSink, StudyGradingStore, StudyLauncher, StudyOllamaTransport, StudyProcessDriver, StudyProcessGoal, StudyProcessSession, StudyRemoteMeter, StudyRemoteTicket, StudyResultStore, StudyTask, StudyTaskWorker, StudyWorker, buildStudyAgentReadings, buildStudyAgentRevision, buildStudyAgentToolDenial, buildStudyAgentToolResult, buildStudyOllamaModels, buildStudyOllamaOptions, buildStudyOllamaRaw, buildStudyOllamaSnapshot, buildStudyOllamaTiming, buildStudyOllamaTransportOptions, buildStudyPacket, buildStudyPacketLinks, buildStudyReference, checkStudyDirectory, collectStudyAncestors, collectStudyEntries, collectStudyEvidence, computeStudyAttributions, computeStudyCommandFingerprint, computeStudyFixtureDigest, computeStudyInstrumentDigest, computeStudyPacketDigest, computeStudyPartition, computeStudyProfileDigest, computeStudyReport, computeStudySealId, containsArtifact, createStudyProcessFailure, decodeStudyJSON, drainStudyChild, encodeStudyJSON, gradeStudyEvidence, hashStudyBytes, isArtifactError, isStudyAdapter, isStudyAgentResponse, isStudyCharge, isStudyCustodyAttempt, isStudyCustodyEvidence, isStudyCustodyFailure, isStudyCustodyFile, isStudyCustodyManifest, isStudyCustodyName, isStudyCustodyObservation, isStudyCustodySeal, isStudyCustodyTrial, isStudyEvidence, isStudyFrame, isStudyIdentity, isStudyProcessFailure, isStudyTrial, iterateArtifactEntries, matchesSystemError, parseStudyArguments, readArtifact, readArtifactBytes, readStudyAdapter, readStudyAgentMessages, readStudyAgentResult, readStudyAgentToolCall, readStudyBytes, readStudyDeclaration, readStudyDeclarationBytes, readStudyHandle, readStudyOllamaDigest, readStudyOllamaFailure, readStudyOllamaRequest, readStudyOllamaSupport, readStudyOllamaTerminal, readStudyOllamaTiming, readStudyResult, readStudyVersion, resolveStudyAgentContent, resolveStudyInstrument, resolveStudyPath, resolveStudyProfile, scanStudyExecution, scanStudyTree, terminateStudyChild, translateStudyPacketLabeling, validateStudyEvidenceBytes, validateStudyOllamaCompletion, validateStudyOllamaInventory, validateStudyOllamaRoles, validateStudyRuntime, valueToWire, writeStudyBytes };
+export { ARTIFACT_BYTES, ARTIFACT_DEPTH, ARTIFACT_ERROR_BRAND, ARTIFACT_ERROR_CODES, ARTIFACT_FILES, ARTIFACT_FILE_BYTES, ARTIFACT_ROOTS, ARTIFACT_VISITS, ArtifactError, ArtifactLoader, Resolution, STUDY_COMMAND_DURATION, STUDY_COMMAND_GRADER, STUDY_COMMAND_HELP, STUDY_COMMAND_OPERATION, STUDY_CUSTODY_BYTES, STUDY_DRAIN_DURATION, STUDY_FRAME_BYTES, STUDY_LAUNCH_BYTES, STUDY_LAUNCH_CLEANUP, STUDY_LAUNCH_DURATION, STUDY_LOG_BYTES, STUDY_PACKET_DISCLOSURE, STUDY_PENDING_LIMIT, STUDY_PROCESS_LABEL, STUDY_RESERVED_NAME, STUDY_TASK_DURATION, STUDY_TASK_OPERATION, STUDY_WORKER_OPERATION, StudyAgentScript, StudyAgentSummary, StudyAgentTrace, StudyArtifactLoader, StudyCLI, StudyChannel, StudyCommand, StudyDaemonSession, StudyDaemonTrial, StudyEvidenceSink, StudyExchangeSink, StudyGradingStore, StudyLauncher, StudyOllamaReplay, StudyOllamaTransport, StudyProcessDriver, StudyProcessGoal, StudyProcessSession, StudyRemoteMeter, StudyRemoteTicket, StudyResultStore, StudyTask, StudyTaskWorker, StudyWorker, buildStudyAgentReadings, buildStudyAgentRevision, buildStudyAgentToolDenial, buildStudyAgentToolResult, buildStudyExchangeSequence, buildStudyOllamaBytes, buildStudyOllamaModels, buildStudyOllamaOptions, buildStudyOllamaRaw, buildStudyOllamaSnapshot, buildStudyOllamaTiming, buildStudyOllamaTransportOptions, buildStudyPacket, buildStudyPacketLinks, buildStudyReference, checkStudyDirectory, collectStudyAncestors, collectStudyEntries, collectStudyEvidence, computeArtifactClosureDigest, computeStudyAttributions, computeStudyCommandFingerprint, computeStudyFixtureDigest, computeStudyInstrumentDigest, computeStudyPacketDigest, computeStudyPartition, computeStudyProfileDigest, computeStudyReport, computeStudySealId, containsArtifact, createStudyProcessFailure, decodeStudyJSON, drainStudyChild, encodeStudyJSON, gradeStudyEvidence, hashStudyBytes, isArtifactClosure, isArtifactError, isArtifactKey, isArtifactLoaderOptions, isArtifactMember, isStudyAdapter, isStudyAgentResponse, isStudyCharge, isStudyClosure, isStudyCustodyAttempt, isStudyCustodyEvidence, isStudyCustodyFailure, isStudyCustodyFile, isStudyCustodyManifest, isStudyCustodyName, isStudyCustodyObservation, isStudyCustodySeal, isStudyCustodyTrial, isStudyEvidence, isStudyExchangeBytes, isStudyExchangeDeclaration, isStudyExchangeDestination, isStudyExchangeHistory, isStudyExchangeIdentity, isStudyExchangeReply, isStudyExchangeRow, isStudyFrame, isStudyIdentity, isStudyOllamaMetadata, isStudyOllamaModel, isStudyOllamaPolicy, isStudyOllamaStep, isStudyProcessFailure, isStudyReplaySelection, isStudyTrial, iterateArtifactEntries, matchesArtifactCredential, matchesSystemError, parseStudyArguments, projectStudyExchangeIdentity, readArtifact, readArtifactBytes, readArtifactPhysical, readStudyAdapter, readStudyAgentMessages, readStudyAgentResult, readStudyAgentToolCall, readStudyBytes, readStudyClosure, readStudyDeclaration, readStudyDeclarationBytes, readStudyExchangeRows, readStudyExchanges, readStudyHandle, readStudyOllamaDigest, readStudyOllamaFailure, readStudyOllamaRequest, readStudyOllamaSupport, readStudyOllamaTerminal, readStudyOllamaTiming, readStudyPreparedDestination, readStudyRecordingDeclaration, readStudyReplayHistory, readStudyResult, readStudyTrialExchanges, readStudyVersion, relocateArtifactPath, resolveArtifactBase, resolveArtifactMember, resolveStudyAgentContent, resolveStudyClosurePath, resolveStudyInstrument, resolveStudyPath, resolveStudyProfile, scanStudyExecution, scanStudyTree, terminateStudyChild, translateStudyPacketLabeling, validateStudyEvidenceBytes, validateStudyExchangeEvidence, validateStudyExchangeHistory, validateStudyExchangeRequest, validateStudyExchangeRows, validateStudyOllamaCompletion, validateStudyOllamaInventory, validateStudyOllamaRecording, validateStudyOllamaRoles, validateStudyOllamaStep, validateStudyRuntime, valueToWire, verifyArtifactClosure, writeStudyBytes };
 
 //# sourceMappingURL=index.js.map