@tangle-network/agent-eval 0.144.6 → 0.144.7

package/dist/trace-repair/index.js

@@ -0,0 +1,3878 @@
+import { c as ValidationError, n as CaptureIntegrityError } from "../errors-D-LKuDhb.js";
+import { r as contentHash } from "../verdict-cache-BCcOh0kF.js";
+import { E as pairedBootstrap } from "../statistics-ByxzSiOM.js";
+import { d as runPrimeExchange, f as assertEqualDeclarativeTerms, n as buildPrimePrompt, t as analystUsageReceiptFromPrimeUsage } from "../prime-protocol-BfSalTfR.js";
+import { o as parseRecordedReturncode, r as deriveFailureSignature, t as wrapActionForExec } from "../exec-BLtYZdWo.js";
+import { createHash } from "node:crypto";
+import { spawn } from "node:child_process";
+import { constants } from "node:os";
+//#region src/trace-repair/mini-swe-scaffold.ts
+/**
+* The mini-swe-agent scaffold as the Terminal-Bench-2 trajectory corpus
+* recorded it: one bash block per turn, one observation per command, and a
+* sentinel command that ends the run.
+*
+* Every template here is byte-verified against
+* `yoonholee/terminalbench-trajectories` (agent = `mini-swe-agent`, 6663 rows,
+* one distinct system prompt across all of them). A continuation that renders
+* different bytes puts the model in a different distribution than the prefix
+* it inherits, so these strings are pinned, not configurable.
+*/
+/** Whole-line marker that ends a run. The first output line must equal it and the command must exit 0. */
+const SUBMIT_SENTINEL = "COMPLETE_TASK_AND_SUBMIT_FINAL_OUTPUT";
+/** Outputs at or above this length are elided head+tail instead of shown whole. */
+const OUTPUT_ELISION_THRESHOLD = 1e4;
+/** Characters kept from each end of an elided output. */
+const OUTPUT_ELISION_WINDOW = 5e3;
+const MINI_SWE_SYSTEM_MESSAGE = `You are a helpful assistant that can interact with a computer.
+
+Your response must contain exactly ONE bash code block with ONE command (or commands connected with && or ||).
+Include a THOUGHT section before your command where you explain your reasoning process.
+Format your response as shown in <format_example>.
+
+<format_example>
+Your reasoning and analysis here. Explain why you want to perform the action.
+
+\`\`\`bash
+your_command_here
+\`\`\`
+</format_example>
+
+Failure to follow these rules will cause your response to be rejected.
+`;
+/** The second message of every recorded run: task plus workflow rules. */
+function renderInstanceMessage(input) {
+	return `Please solve this issue: ${input.task}
+
+You can execute bash commands and edit files to implement the necessary changes.
+
+## Recommended Workflow
+
+This workflows should be done step-by-step so that you can iterate on your changes and any possible problems.
+
+1. Analyze the codebase by finding and reading relevant files
+2. Create a script to reproduce the issue
+3. Edit the source code to resolve the issue
+4. Verify your fix works by running your script again
+5. Test edge cases to ensure your fix is robust
+6. Submit your changes and finish your work by issuing the following command: \`echo ${SUBMIT_SENTINEL}\`.
+   Do not combine it with any other command. <important>After this command, you cannot continue working on this task.</important>
+
+## Important Rules
+
+1. Every response must contain exactly one action
+2. The action must be enclosed in triple backticks
+3. Directory or environment variable changes are not persistent. Every action is executed in a new subshell.
+   However, you can prefix any action with \`MY_ENV_VAR=MY_VALUE cd /path/to/working/dir && ...\` or write/load environment variables from files
+
+<system_information>
+${input.systemInformation}
+</system_information>
+
+## Formatting your response
+
+Here is an example of a correct response:
+
+<example_response>
+THOUGHT: I need to understand the structure of the repository first. Let me check what files are in the current directory to get a better understanding of the codebase.
+
+\`\`\`bash
+ls -la
+\`\`\`
+</example_response>
+
+## Useful command examples
+
+### Create a new file:
+
+\`\`\`bash
+cat <<'EOF' > newfile.py
+import numpy as np
+hello = "world"
+print(hello)
+EOF
+\`\`\`
+
+### Edit files with sed:\`\`\`bash
+# Replace all occurrences
+sed -i 's/old_string/new_string/g' filename.py
+
+# Replace only first occurrence
+sed -i 's/old_string/new_string/' filename.py
+
+# Replace first occurrence on line 1
+sed -i '1s/old_string/new_string/' filename.py
+
+# Replace all occurrences in lines 1-10
+sed -i '1,10s/old_string/new_string/g' filename.py
+\`\`\`
+
+### View file content:
+
+\`\`\`bash
+# View specific lines with numbers
+nl -ba filename.py | sed -n '10,20p'
+\`\`\`
+
+### Any other command you want to run
+
+\`\`\`bash
+anything
+\`\`\`
+`;
+}
+const BASH_BLOCK = /```bash\n(.*?)\n```/gs;
+/**
+* Exactly one fenced bash block is an action; zero or many is a format error.
+* The scaffold trims the command, so a block padded with blank lines executes
+* the same command as an unpadded one.
+*/
+function parseAction(assistantMessage) {
+	const blocks = [...assistantMessage.matchAll(BASH_BLOCK)].map((match) => match[1] ?? "");
+	if (blocks.length !== 1) return {
+		kind: "format-error",
+		actionCount: blocks.length
+	};
+	return {
+		kind: "action",
+		command: (blocks[0] ?? "").trim()
+	};
+}
+/**
+* The observation the agent reads after a command. Short outputs are shown
+* whole; long ones keep the first and last `OUTPUT_ELISION_WINDOW` characters
+* with the dropped count between them.
+*/
+function renderObservation(output) {
+	const head = output.exceptionInfo ? `<exception>${output.exceptionInfo}</exception>\n` : "";
+	const returncode = `<returncode>${output.returncode}</returncode>\n`;
+	if (output.output.length < 1e4) return `${head}${returncode}<output>\n${output.output}</output>`;
+	const elided = output.output.length - OUTPUT_ELISION_THRESHOLD;
+	return `${head}${returncode}<warning>\nThe output of your last command was too long.
+Please try a different command that produces less output.
+If you're looking at a file you can try use head, tail or sed to view a smaller number of lines selectively.
+If you're using grep or find and it produced too much output, you can use a more selective search pattern.
+If you really need to see something from the full command's output, you can redirect output to a file and then search in that file.
+</warning><output_head>\n${output.output.slice(0, OUTPUT_ELISION_WINDOW)}\n</output_head>\n<elided_chars>\n${elided} characters elided\n</elided_chars>\n<output_tail>\n${output.output.slice(-5e3)}\n</output_tail>`;
+}
+/** The observation after the environment killed a command for exceeding its timeout. */
+function renderTimeoutObservation(command, partialOutput) {
+	return `The last command <command>${command}</command> timed out and has been killed.\nThe output of the command was:\n <output>\n${partialOutput}\n</output>\nPlease try another command and make sure to avoid those requiring interactive input.`;
+}
+/** Substring `renderTimeoutObservation` always writes, whatever the command was. */
+const TIMEOUT_OBSERVATION_MARKER = "timed out and has been killed";
+/**
+* True when the recording shows the environment killed this step at its
+* wall-clock bound.
+*
+* Such a step carries no returncode, so no replay can confirm or contradict
+* it. Callers use this to bound the replay of that step cheaply rather than to
+* decide agreement.
+*/
+function isRecordedTimeout(observation) {
+	return observation?.includes(TIMEOUT_OBSERVATION_MARKER) === true;
+}
+/** The observation after a turn that did not contain exactly one bash block. */
+function renderFormatErrorObservation(actionCount) {
+	return `Please always provide EXACTLY ONE action in triple backticks, found ${actionCount} actions.\nIf you want to end the task, please issue the following command: \`echo ${SUBMIT_SENTINEL}\`\nwithout any other command.
+Else, please format your response exactly as follows:
+
+<response_example>
+Here are some thoughts about why you want to perform the action.
+
+\`\`\`bash
+<action>
+\`\`\`
+</response_example>
+
+Note: In rare cases, if you need to reference a similar format in your command, you might have
+to proceed in two steps, first writing TRIPLEBACKTICKSBASH, then replacing them with \`\`\`bash.`;
+}
+/**
+* The submission text when this output ends the run, `null` otherwise.
+* A non-zero exit does not submit even when the sentinel is echoed, so an
+* agent cannot end the run through a command that failed.
+*/
+function submissionOf(output) {
+	if (output.returncode !== 0) return null;
+	const lines = output.output.replace(/^\s+/, "").split(/(?<=\n)/);
+	const first = lines[0];
+	if (first === void 0 || first.trim() !== "COMPLETE_TASK_AND_SUBMIT_FINAL_OUTPUT") return null;
+	return lines.slice(1).join("");
+}
+//#endregion
+//#region src/trace-repair/action-budget.ts
+/**
+* The action budget an intervention must fit inside.
+*
+* The analyst answers with one action, applied at step k, drawn from the same
+* action space the scaffold had: one shell command or one edit, at most 4 KB.
+* An answer that buys a bigger action than the scaffold could take is not a
+* counterfactual about the recorded run, so the budget is enforced before any
+* container is opened and a violation never reaches the reproduction gate.
+*
+* "One action" is decided by counting top-level statements, not lines. A
+* command list joined by `&&`, `||` or a pipe is one statement, because that
+* is one thing the shell runs and one thing the scaffold could have typed.
+* Two statements separated by a newline or `;` are two actions and are
+* rejected. Heredoc bodies, comments and compound blocks (`if`, `for`,
+* `while`, `until`, `case`, `{ … }`) are inside a statement, never separators.
+*/
+/** The scaffold's own per-action budget, pre-registered for the campaign. */
+const SCAFFOLD_INTERVENTION_BUDGET = Object.freeze({
+	maxBytes: 4096,
+	maxStatements: 1,
+	maxHeredocs: 1
+});
+/**
+* Actions whose only effect is to consume a turn. They are rejected before a
+* container opens: an intervention that changes nothing is measurably
+* identical to the no-op control, and paying rollouts to rediscover that
+* wastes the corpus.
+*/
+const NO_OP_ACTIONS = Object.freeze([
+	":",
+	"true",
+	"/bin/true",
+	"exit",
+	"exit 0"
+]);
+const BLOCK_OPENERS = /* @__PURE__ */ new Set([
+	"if",
+	"for",
+	"while",
+	"until",
+	"case",
+	"select",
+	"do",
+	"then"
+]);
+const BLOCK_CLOSERS = /* @__PURE__ */ new Set([
+	"fi",
+	"done",
+	"esac"
+]);
+/**
+* Split a shell script into top-level statements and count its heredocs.
+*
+* The scan tracks quoting, escapes, command substitution, brace and paren
+* grouping, comments, compound-block keywords, and heredoc bodies. Anything
+* it cannot resolve stays inside the current statement, so an unparseable
+* action reads as one oversized statement and is rejected on bytes rather
+* than silently accepted as one clean action.
+*/
+function scanShellAction(script) {
+	const state = {
+		statements: [],
+		current: "",
+		heredocs: 0
+	};
+	let index = 0;
+	let parenDepth = 0;
+	let braceDepth = 0;
+	let blockDepth = 0;
+	let inSingle = false;
+	let inDouble = false;
+	let inBacktick = false;
+	let pendingHeredocs = [];
+	let word = "";
+	let atStatementStart = true;
+	const flushWord = () => {
+		if (word.length === 0) return;
+		if (BLOCK_OPENERS.has(word)) blockDepth += 1;
+		else if (BLOCK_CLOSERS.has(word)) blockDepth = Math.max(0, blockDepth - 1);
+		word = "";
+	};
+	const endStatement = () => {
+		flushWord();
+		const text = state.current.trim();
+		if (text.length > 0 && !isCommentOnly(text)) state.statements.push(text);
+		state.current = "";
+		atStatementStart = true;
+	};
+	while (index < script.length) {
+		const char = script[index];
+		if (inSingle) {
+			state.current += char;
+			if (char === "'") inSingle = false;
+			index += 1;
+			continue;
+		}
+		if (char === "\\" && index + 1 < script.length) {
+			const next = script[index + 1];
+			if (next === "\n" && !inDouble) {
+				state.current += char + next;
+				index += 2;
+				continue;
+			}
+			state.current += char + next;
+			index += 2;
+			continue;
+		}
+		if (inDouble) {
+			state.current += char;
+			if (char === "\"") inDouble = false;
+			index += 1;
+			continue;
+		}
+		if (char === "'") {
+			flushWord();
+			inSingle = true;
+			state.current += char;
+			index += 1;
+			atStatementStart = false;
+			continue;
+		}
+		if (char === "\"") {
+			flushWord();
+			inDouble = true;
+			state.current += char;
+			index += 1;
+			atStatementStart = false;
+			continue;
+		}
+		if (char === "`") {
+			inBacktick = !inBacktick;
+			state.current += char;
+			index += 1;
+			atStatementStart = false;
+			continue;
+		}
+		if (char === "#" && (atStatementStart || /\s/.test(script[index - 1] ?? " "))) {
+			const end = script.indexOf("\n", index);
+			const stop = end === -1 ? script.length : end;
+			state.current += script.slice(index, stop);
+			index = stop;
+			continue;
+		}
+		if (char === "<" && script[index + 1] === "<" && script[index + 2] !== "<" && script[index - 1] !== "<") {
+			const mark = readHeredocMark(script, index);
+			if (mark) {
+				pendingHeredocs.push(mark.mark);
+				state.heredocs += 1;
+				state.current += script.slice(index, mark.nextIndex);
+				index = mark.nextIndex;
+				atStatementStart = false;
+				continue;
+			}
+		}
+		if (char === "(") {
+			flushWord();
+			parenDepth += 1;
+			state.current += char;
+			index += 1;
+			atStatementStart = true;
+			continue;
+		}
+		if (char === ")") {
+			flushWord();
+			parenDepth = Math.max(0, parenDepth - 1);
+			state.current += char;
+			index += 1;
+			atStatementStart = false;
+			continue;
+		}
+		if (char === "{") {
+			flushWord();
+			braceDepth += 1;
+			state.current += char;
+			index += 1;
+			atStatementStart = true;
+			continue;
+		}
+		if (char === "}") {
+			flushWord();
+			braceDepth = Math.max(0, braceDepth - 1);
+			state.current += char;
+			index += 1;
+			atStatementStart = false;
+			continue;
+		}
+		if (char === "\n") {
+			flushWord();
+			if (pendingHeredocs.length > 0) {
+				const consumed = consumeHeredocBodies(script, index + 1, pendingHeredocs);
+				state.current += script.slice(index, consumed);
+				pendingHeredocs = [];
+				index = consumed;
+				continue;
+			}
+			if (parenDepth > 0 || braceDepth > 0 || blockDepth > 0 || inBacktick || endsWithContinuation(state.current)) {
+				state.current += char;
+				index += 1;
+				atStatementStart = true;
+				continue;
+			}
+			endStatement();
+			index += 1;
+			continue;
+		}
+		if (char === ";") {
+			flushWord();
+			if (parenDepth > 0 || braceDepth > 0 || blockDepth > 0 || inBacktick) {
+				state.current += char;
+				index += 1;
+				atStatementStart = true;
+				continue;
+			}
+			endStatement();
+			index += 1;
+			continue;
+		}
+		if (/\s/.test(char)) {
+			flushWord();
+			state.current += char;
+			index += 1;
+			continue;
+		}
+		if (char === "&" || char === "|") {
+			flushWord();
+			state.current += char;
+			index += 1;
+			atStatementStart = true;
+			continue;
+		}
+		word += char;
+		state.current += char;
+		atStatementStart = false;
+		index += 1;
+	}
+	endStatement();
+	return {
+		statements: state.statements,
+		heredocs: state.heredocs
+	};
+}
+function isCommentOnly(text) {
+	return text.split("\n").every((line) => line.trim().length === 0 || line.trim().startsWith("#"));
+}
+function endsWithContinuation(current) {
+	const trimmed = current.trimEnd();
+	return /(&&|\|\||\||&|\\)$/.test(trimmed);
+}
+function readHeredocMark(script, index) {
+	let cursor = index + 2;
+	let stripTabs = false;
+	if (script[cursor] === "-") {
+		stripTabs = true;
+		cursor += 1;
+	}
+	while (script[cursor] === " " || script[cursor] === "	") cursor += 1;
+	const quote = script[cursor];
+	if (quote === "'" || quote === "\"") {
+		const close = script.indexOf(quote, cursor + 1);
+		if (close === -1) return null;
+		return {
+			mark: {
+				delimiter: script.slice(cursor + 1, close),
+				stripTabs,
+				quoted: true
+			},
+			nextIndex: close + 1
+		};
+	}
+	const match = /^[A-Za-z_][A-Za-z0-9_]*/.exec(script.slice(cursor));
+	if (!match) return null;
+	return {
+		mark: {
+			delimiter: match[0],
+			stripTabs,
+			quoted: false
+		},
+		nextIndex: cursor + match[0].length
+	};
+}
+/** Consume every pending heredoc body; returns the offset just past the last
+*  terminator, or the end of the script when a terminator never arrives. */
+function consumeHeredocBodies(script, from, marks) {
+	let cursor = from;
+	for (const mark of marks) {
+		let closed = false;
+		while (cursor < script.length) {
+			const lineEnd = script.indexOf("\n", cursor);
+			const stop = lineEnd === -1 ? script.length : lineEnd;
+			const line = script.slice(cursor, stop);
+			const candidate = mark.stripTabs ? line.replace(/^\t+/, "") : line;
+			cursor = lineEnd === -1 ? script.length : lineEnd + 1;
+			if (candidate === mark.delimiter) {
+				closed = true;
+				break;
+			}
+		}
+		if (!closed) return script.length;
+	}
+	return cursor;
+}
+/** Payload shape of an action: `edit` when it authors file content through a
+*  heredoc, `shell` otherwise. */
+function classifyActionPayload(action) {
+	return scanShellAction(action).heredocs > 0 ? "edit" : "shell";
+}
+/**
+* Measure an action against the budget.
+*
+* The budget bounds what the scaffold can execute: one top-level statement,
+* one authored file, a byte cap, and neither a no-op nor a submit. Every
+* rejection here is one of those.
+*
+* `declaredKind` is what the analyst called its own action. It is recorded
+* beside the measured payload and never rejected on, because the scaffold runs
+* the action identically either way — so rejecting the label scores an arm on
+* how it described a repair rather than on the repair. A reader who wants the
+* mismatch counts `declared` against `payload`.
+*/
+function checkInterventionBudget(action, declaredKind, budget = SCAFFOLD_INTERVENTION_BUDGET) {
+	assertBudget(budget);
+	const scan = scanShellAction(action);
+	const payload = scan.heredocs > 0 ? "edit" : "shell";
+	const measurement = {
+		bytes: Buffer.byteLength(action, "utf8"),
+		statements: scan.statements.length,
+		heredocs: scan.heredocs,
+		payload,
+		declared: declaredKind
+	};
+	const reject = (violation, detail) => ({
+		admissible: false,
+		violation,
+		detail,
+		measurement
+	});
+	if (action.trim().length === 0) return reject("empty", "the intervention is empty");
+	if (measurement.bytes > budget.maxBytes) return reject("over-byte-cap", `${measurement.bytes} bytes exceeds the ${budget.maxBytes}-byte action budget`);
+	if (measurement.statements > budget.maxStatements) return reject("multiple-statements", `${measurement.statements} top-level statements exceeds the ${budget.maxStatements} the scaffold takes per action`);
+	if (measurement.heredocs > budget.maxHeredocs) return reject("multiple-heredocs", `${measurement.heredocs} heredocs exceeds the ${budget.maxHeredocs} one edit may author`);
+	if (action.includes("COMPLETE_TASK_AND_SUBMIT_FINAL_OUTPUT")) return reject("submit-instead-of-repair", "the action submits the run instead of repairing it");
+	if (NO_OP_ACTIONS.includes(action.trim())) return reject("no-op-action", `"${action.trim()}" changes nothing`);
+	return {
+		admissible: true,
+		measurement
+	};
+}
+function assertBudget(budget) {
+	for (const field of [
+		"maxBytes",
+		"maxStatements",
+		"maxHeredocs"
+	]) {
+		const value = budget[field];
+		if (!Number.isInteger(value) || value <= 0) throw new ValidationError(`intervention budget ${field} must be a positive integer, got ${value}`);
+	}
+}
+/**
+* Whitespace-insensitive comparison used to reject an intervention that is
+* the recorded action again. Trailing whitespace and blank lines are the only
+* differences a re-proposal can carry without changing what runs.
+*/
+function normalizeActionForComparison(action) {
+	return action.split("\n").map((line) => line.trimEnd()).filter((line, index, lines) => line.length > 0 || index > 0 && index < lines.length - 1).join("\n").trim();
+}
+//#endregion
+//#region src/trace-repair/admission-records.ts
+/**
+* The vocabulary of the TB-Repair admission pre-pass: what a corpus row is,
+* which failure population it belongs to, why it can leave the funnel, and the
+* denominator chain those exclusions add up to.
+*
+* Pure data and pure functions. The gate that spends containers on these types
+* lives in `admission.ts`, and the artifact that publishes them lives in
+* `admission-report.ts`.
+*/
+/** A campaign scored rows the pre-pass did not admit, or dropped rows it did. */
+var AdmissionDenominatorError = class extends CaptureIntegrityError {};
+/** A row handed to the pre-pass carried a field only an analyst could produce. */
+var AdmissionIndependenceError = class extends CaptureIntegrityError {};
+const ADMISSION_ROW_KEYS = [
+	"rowId",
+	"taskName",
+	"recordedModel",
+	"recordedCommands",
+	"finalReturncode"
+];
+/**
+* Reject rows that carry anything beyond the recording.
+*
+* The check is a closed key list rather than a list of known analyst field
+* names, because the failure to catch is "some new analyst output leaked into
+* the gate", and only a closed shape catches the fields nobody thought of.
+*/
+function assertAnalystIndependent(rows) {
+	const allowed = new Set(ADMISSION_ROW_KEYS);
+	for (const row of rows) {
+		const extra = Object.keys(row).filter((key) => !allowed.has(key));
+		if (extra.length > 0) throw new AdmissionIndependenceError(`admission row ${String(row.rowId)} carries analyst-side fields: ${extra.sort().join(", ")}`);
+	}
+}
+const ADMISSION_STRATA = [
+	"clean-exit",
+	"command-error",
+	"signal-kill"
+];
+/** `null` when the recording holds no parseable final return code. */
+function stratumOf(finalReturncode) {
+	if (finalReturncode === null || !Number.isInteger(finalReturncode)) return null;
+	if (finalReturncode === 0) return "clean-exit";
+	return finalReturncode < 0 ? "signal-kill" : "command-error";
+}
+const ADMISSION_EXCLUSION_ORDER = [
+	"no-recorded-commands",
+	"unparseable-final-returncode",
+	"stratum-not-admitted",
+	"task-oracle-uncertified",
+	"task-oracle-nondeterministic",
+	"prefix-replay-error",
+	"prefix-replay-empty",
+	"prefix-replay-truncated",
+	"prefix-divergence-above-threshold",
+	"end-state-oracle-error",
+	"end-state-tests-pass",
+	"no-fix-control-error",
+	"no-fix-control-rescued",
+	"no-op-control-error",
+	"no-op-control-rescued"
+];
+/** Reasons decided from the recording alone, before a row can be stratified. */
+const PRE_STRATUM_REASONS = ["no-recorded-commands", "unparseable-final-returncode"];
+function isPreStratumReason(reason) {
+	return PRE_STRATUM_REASONS.includes(reason);
+}
+/** One line of prose per reason, for the rendered chain. */
+const ADMISSION_EXCLUSION_MEANING = Object.freeze({
+	"no-recorded-commands": "the recording holds no command to substitute",
+	"unparseable-final-returncode": "the last observation carries no return code",
+	"stratum-not-admitted": "the row belongs to a population this campaign excluded",
+	"task-oracle-uncertified": "the task grader has no determinism certification on file",
+	"task-oracle-nondeterministic": "the task grader returns different verdicts on byte-identical state",
+	"prefix-replay-error": "the replay boundary failed, so divergence is unmeasured",
+	"prefix-replay-empty": "the replay executed no recorded step",
+	"prefix-replay-truncated": "the replay stopped short of the recorded end state",
+	"prefix-divergence-above-threshold": "replaying the prefix did not reproduce the recording",
+	"end-state-oracle-error": "the task grader failed, so the end state is unjudged",
+	"end-state-tests-pass": "the task tests pass on the recorded end state, so nothing failed",
+	"no-fix-control-error": "a no-fix rollout failed to run, so the control is unmeasured",
+	"no-fix-control-rescued": "the continuation policy passes the task with no intervention",
+	"no-op-control-error": "a no-op rollout failed to run, so the control is unmeasured",
+	"no-op-control-rescued": "an inert action plus continuation passes the task"
+});
+/**
+* Build the funnel every campaign report publishes.
+*
+* Each stage names the reason, the rows that reached it, the rows it removed,
+* and the rows that survived, so `input = admitted + sum(excluded)` can be read
+* off the table instead of trusted.
+*/
+function buildDenominatorChain(verdicts, admitStrata) {
+	const reasonTotals = emptyReasonTotals();
+	for (const verdict of verdicts) if (verdict.excludedBy !== null) reasonTotals[verdict.excludedBy] += 1;
+	const stratumReasons = ADMISSION_EXCLUSION_ORDER.filter((reason) => !isPreStratumReason(reason));
+	const artifact = {
+		version: 1,
+		overall: chainOf("all", verdicts, ADMISSION_EXCLUSION_ORDER),
+		byStratum: ADMISSION_STRATA.filter((stratum) => verdicts.some((verdict) => verdict.stratum === stratum)).map((stratum) => chainOf(stratum, verdicts.filter((verdict) => verdict.stratum === stratum), stratumReasons)),
+		reasonTotals,
+		unstratified: verdicts.filter((verdict) => verdict.stratum === null).length,
+		admitStrata: [...admitStrata]
+	};
+	assertChainReconciles(artifact);
+	return artifact;
+}
+function chainOf(scope, verdicts, reasons) {
+	let remaining = verdicts.length;
+	const stages = [];
+	for (const reason of reasons) {
+		const excluded = verdicts.filter((verdict) => verdict.excludedBy === reason).length;
+		const entering = remaining;
+		remaining -= excluded;
+		stages.push({
+			reason,
+			entering,
+			excluded,
+			remaining
+		});
+	}
+	return {
+		scope,
+		input: verdicts.length,
+		stages,
+		admitted: verdicts.filter((verdict) => verdict.admitted).length
+	};
+}
+function emptyReasonTotals() {
+	const totals = {};
+	for (const reason of ADMISSION_EXCLUSION_ORDER) totals[reason] = 0;
+	return totals;
+}
+/** A chain that does not add up is a broken denominator, so this throws. */
+function assertChainReconciles(artifact) {
+	for (const chain of [artifact.overall, ...artifact.byStratum]) {
+		const excluded = chain.stages.reduce((total, stage) => total + stage.excluded, 0);
+		if (chain.input !== chain.admitted + excluded) throw new AdmissionDenominatorError(`denominator chain (${chain.scope}) does not reconcile: input ${chain.input} != admitted ${chain.admitted} + excluded ${excluded}`);
+		const last = chain.stages[chain.stages.length - 1];
+		if (last && last.remaining !== chain.admitted) throw new AdmissionDenominatorError(`denominator chain (${chain.scope}) ends at ${last.remaining} rows but reports ${chain.admitted} admitted`);
+	}
+	const stratumInputs = artifact.byStratum.reduce((total, chain) => total + chain.input, 0);
+	if (stratumInputs + artifact.unstratified !== artifact.overall.input) throw new AdmissionDenominatorError(`stratum inputs ${stratumInputs} plus ${artifact.unstratified} unstratified do not cover ${artifact.overall.input} input rows`);
+}
+//#endregion
+//#region src/trace-repair/continuation-policy.ts
+/** A rollout ran outside the pinned policy, so its evidence cannot be used. */
+var ContinuationPolicyViolationError = class extends CaptureIntegrityError {};
+/** Two arms did not run the same policy, so their difference is not the intervention. */
+var ContinuationSymmetryError = class extends CaptureIntegrityError {};
+/**
+* Everything the policy fixes except the two a campaign must choose.
+*
+* `commandTimeoutSeconds` is 30 because the recorded runs used the scaffold's
+* own 30-second environment timeout; a longer limit would let the continuation
+* finish commands the recorded agent could not.
+*/
+const CONTINUATION_POLICY_DEFAULTS = {
+	id: "tb-repair-continuation-v1",
+	stepBudget: 20,
+	temperature: 0,
+	maxTokens: 4096,
+	commandTimeoutSeconds: 30,
+	maxConsecutiveFormatErrors: 3,
+	networkMode: "none",
+	scaffold: "mini-swe-agent"
+};
+function definePinnedContinuationPolicy(input) {
+	const policy = {
+		...CONTINUATION_POLICY_DEFAULTS,
+		...input
+	};
+	if (!policy.model.trim()) throw new ValidationError("continuation policy requires a model id");
+	if (!Number.isInteger(policy.seed)) throw new ValidationError(`continuation policy seed must be an integer, got ${policy.seed}`);
+	requirePositiveInteger$1(policy.stepBudget, "stepBudget");
+	requirePositiveInteger$1(policy.maxTokens, "maxTokens");
+	requirePositiveInteger$1(policy.commandTimeoutSeconds, "commandTimeoutSeconds");
+	requirePositiveInteger$1(policy.maxConsecutiveFormatErrors, "maxConsecutiveFormatErrors");
+	if (!Number.isFinite(policy.temperature) || policy.temperature < 0) throw new ValidationError(`continuation policy temperature must be a non-negative number, got ${policy.temperature}`);
+	return Object.freeze(policy);
+}
+function requirePositiveInteger$1(value, field) {
+	if (!Number.isInteger(value) || value <= 0) throw new ValidationError(`continuation policy ${field} must be a positive integer, got ${value}`);
+}
+/**
+* Hash over the policy and the scaffold text it renders. A changed template
+* changes the digest, so rollouts recorded before and after an edit cannot be
+* pooled by accident.
+*/
+function continuationPolicyDigest(policy) {
+	return contentHash({
+		policy: { ...policy },
+		systemMessage: MINI_SWE_SYSTEM_MESSAGE,
+		instanceMessage: renderInstanceMessage({
+			task: "<task>",
+			systemInformation: "<system>"
+		}),
+		formatErrorObservation: renderFormatErrorObservation(0),
+		timeoutObservation: renderTimeoutObservation("<command>", "<output>"),
+		observation: renderObservation({
+			returncode: 0,
+			output: ""
+		})
+	});
+}
+/**
+* Per-rollout seed. It reads the policy seed, the row, and the rollout index —
+* deliberately not the arm, so paired rollouts across arms draw identically.
+*/
+function continuationSeed(policySeed, rowId, rolloutIndex) {
+	const input = `${policySeed}:${rowId}:${rolloutIndex}`;
+	let hash = 2166136261;
+	for (let i = 0; i < input.length; i += 1) {
+		hash ^= input.charCodeAt(i);
+		hash = Math.imul(hash, 16777619) >>> 0;
+	}
+	return hash >>> 1;
+}
+/**
+* Run the scaffold forward for `rollouts` independent continuations.
+*
+* Each rollout gets its own environment from the factory, because a rollout
+* mutates the container it runs in and the next one must start from the same
+* state, not from the previous rollout's leftovers.
+*/
+async function runContinuation(options) {
+	const { policy, arm, rowId, prefix, rollouts, model, environments } = options;
+	const clock = options.clock ?? Date.now;
+	requirePositiveInteger$1(rollouts, "rollouts");
+	assertPrefix(prefix);
+	const policyDigest = continuationPolicyDigest(policy);
+	const records = [];
+	for (let index = 0; index < rollouts; index += 1) records.push(await runOneRollout({
+		policy,
+		policyDigest,
+		arm,
+		rowId,
+		index,
+		prefix,
+		model,
+		environments,
+		clock
+	}));
+	return records;
+}
+function assertPrefix(prefix) {
+	if (prefix.length < 2) throw new ValidationError("continuation prefix needs the system and task messages");
+	if (prefix[0]?.role !== "system" || prefix[1]?.role !== "user") throw new ValidationError("continuation prefix must start with a system then a user message");
+	if (prefix[prefix.length - 1]?.role !== "user") throw new ValidationError("continuation prefix must end on a user message; an assistant turn with no observation means the replay left an action unanswered");
+}
+async function runOneRollout(input) {
+	const { policy, arm, rowId, index, clock } = input;
+	const seed = continuationSeed(policy.seed, rowId, index);
+	const startedMs = clock();
+	const environment = await input.environments.create({
+		rowId,
+		arm,
+		rolloutIndex: index
+	});
+	try {
+		const description = await environment.describe();
+		if (description.networkMode !== policy.networkMode) throw new ContinuationPolicyViolationError(`continuation requires network mode "${policy.networkMode}", container ${environment.containerRef} reports "${description.networkMode}"`);
+		const messages = [...input.prefix];
+		const steps = [];
+		let exitStatus = "step-budget-exhausted";
+		let submission = null;
+		let terminalError;
+		let consecutiveFormatErrors = 0;
+		for (let step = 1; step <= policy.stepBudget; step += 1) {
+			const callStartedMs = clock();
+			let response;
+			try {
+				response = await input.model({
+					model: policy.model,
+					messages: [...messages],
+					seed,
+					temperature: policy.temperature,
+					maxTokens: policy.maxTokens
+				});
+			} catch (error) {
+				exitStatus = "model-error";
+				terminalError = errorMessage(error);
+				break;
+			}
+			const call = {
+				servedModel: response.servedModel,
+				seed,
+				latencyMs: clock() - callStartedMs,
+				usage: response.usage,
+				costUsd: response.costUsd,
+				finishReason: response.finishReason ?? null,
+				contentChars: response.content.length
+			};
+			messages.push({
+				role: "assistant",
+				content: response.content
+			});
+			const parsed = parseAction(response.content);
+			if (parsed.kind === "format-error") {
+				consecutiveFormatErrors += 1;
+				const observation = renderFormatErrorObservation(parsed.actionCount);
+				messages.push({
+					role: "user",
+					content: observation
+				});
+				steps.push({
+					step,
+					assistantMessage: response.content,
+					action: null,
+					observation,
+					execution: null,
+					model: call
+				});
+				if (consecutiveFormatErrors >= policy.maxConsecutiveFormatErrors) {
+					exitStatus = "repeated-format-error";
+					break;
+				}
+				continue;
+			}
+			consecutiveFormatErrors = 0;
+			const execStartedMs = clock();
+			let execution;
+			try {
+				execution = await environment.exec(parsed.command, { timeoutSeconds: policy.commandTimeoutSeconds });
+			} catch (error) {
+				exitStatus = "environment-error";
+				terminalError = errorMessage(error);
+				steps.push({
+					step,
+					assistantMessage: response.content,
+					action: parsed.command,
+					observation: null,
+					execution: null,
+					model: call,
+					error: errorMessage(error)
+				});
+				break;
+			}
+			const execRecord = {
+				command: parsed.command,
+				returncode: execution.returncode,
+				timedOut: execution.timedOut,
+				outputChars: execution.output.length,
+				durationMs: clock() - execStartedMs
+			};
+			if (execution.timedOut) {
+				const observation = renderTimeoutObservation(parsed.command, execution.output);
+				messages.push({
+					role: "user",
+					content: observation
+				});
+				steps.push({
+					step,
+					assistantMessage: response.content,
+					action: parsed.command,
+					observation,
+					execution: execRecord,
+					model: call
+				});
+				continue;
+			}
+			const submitted = submissionOf(execution);
+			if (submitted !== null) {
+				exitStatus = "submitted";
+				submission = submitted;
+				steps.push({
+					step,
+					assistantMessage: response.content,
+					action: parsed.command,
+					observation: null,
+					execution: execRecord,
+					model: call
+				});
+				break;
+			}
+			const observation = renderObservation(execution);
+			messages.push({
+				role: "user",
+				content: observation
+			});
+			steps.push({
+				step,
+				assistantMessage: response.content,
+				action: parsed.command,
+				observation,
+				execution: execRecord,
+				model: call
+			});
+		}
+		const endedMs = clock();
+		const rollout = {
+			rolloutId: `${rowId}:${arm}:${index}`,
+			arm,
+			rowId,
+			index,
+			seed,
+			policyDigest: input.policyDigest,
+			environmentId: input.environments.id,
+			containerRef: environment.containerRef,
+			environment: description,
+			steps,
+			exitStatus,
+			submission,
+			usage: totalUsage(steps),
+			costProvenance: totalCost(steps),
+			wallMs: endedMs - startedMs,
+			startedAt: new Date(startedMs).toISOString(),
+			endedAt: new Date(endedMs).toISOString()
+		};
+		return terminalError === void 0 ? rollout : {
+			...rollout,
+			terminalError
+		};
+	} finally {
+		await environment.dispose();
+	}
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/**
+* Sum only what the provider reported. A call with no usage raises
+* `callsWithUsage` short of `calls` and clears `captured`, so a partially
+* reported rollout can never read as a fully measured one.
+*/
+function totalUsage(steps) {
+	let input = 0;
+	let output = 0;
+	let reasoning = 0;
+	let cached = 0;
+	let cacheWrite = 0;
+	let sawReasoning = false;
+	let sawCached = false;
+	let sawCacheWrite = false;
+	let callsWithUsage = 0;
+	for (const step of steps) {
+		const usage = step.model.usage;
+		if (!usage) continue;
+		callsWithUsage += 1;
+		input += usage.input;
+		output += usage.output;
+		if (usage.reasoning !== void 0) {
+			reasoning += usage.reasoning;
+			sawReasoning = true;
+		}
+		if (usage.cached !== void 0) {
+			cached += usage.cached;
+			sawCached = true;
+		}
+		if (usage.cacheWrite !== void 0) {
+			cacheWrite += usage.cacheWrite;
+			sawCacheWrite = true;
+		}
+	}
+	const totals = {
+		calls: steps.length,
+		callsWithUsage,
+		captured: steps.length > 0 && callsWithUsage === steps.length,
+		input,
+		output
+	};
+	if (sawReasoning) totals.reasoning = reasoning;
+	if (sawCached) totals.cached = cached;
+	if (sawCacheWrite) totals.cacheWrite = cacheWrite;
+	return totals;
+}
+/**
+* One unpriced call makes the rollout's cost unknown. Summing the rest would
+* report a number smaller than what was spent.
+*/
+function totalCost(steps) {
+	if (steps.length === 0) return {
+		kind: "uncaptured",
+		usd: null
+	};
+	let usd = 0;
+	for (const step of steps) {
+		if (step.model.costUsd === null) return {
+			kind: "uncaptured",
+			usd: null
+		};
+		usd += step.model.costUsd;
+	}
+	return {
+		kind: "observed",
+		usd
+	};
+}
+/**
+* Prove the arms ran the same policy. Rollouts paired by row and index must
+* carry the same policy digest and the same seed; anything else means the
+* measured difference includes a policy change, not only the intervention.
+*/
+function assertArmSymmetry(rollouts) {
+	const digests = new Set(rollouts.map((rollout) => rollout.policyDigest));
+	if (digests.size > 1) throw new ContinuationSymmetryError(`arms ran different policies: ${[...digests].sort().join(", ")}`);
+	const seeds = /* @__PURE__ */ new Map();
+	for (const rollout of rollouts) {
+		const key = `${rollout.rowId}:${rollout.index}`;
+		const seen = seeds.get(key);
+		if (!seen) {
+			seeds.set(key, {
+				seed: rollout.seed,
+				arm: rollout.arm
+			});
+			continue;
+		}
+		if (seen.seed !== rollout.seed) throw new ContinuationSymmetryError(`paired rollouts ${key} drew different seeds: ${seen.arm}=${seen.seed}, ${rollout.arm}=${rollout.seed}`);
+	}
+}
+//#endregion
+//#region src/trace-repair/control-policy.ts
+/**
+* The control policy admission screens under, declared rather than assumed.
+*
+* Admission conditions 3 and 4 ask whether a row is rescued by continuing from
+* the recorded end state with no intervention, and by continuing after an
+* action that changes nothing. Both are questions about a policy, and neither
+* is answerable without knowing what that policy is allowed to do.
+*
+* One number decides whether the question can be answered at all. Condition 2
+* has already graded the recorded end state and found it failing. A control
+* rollout that makes no model call executes no command, so the container it
+* grades holds those same bytes — the ones already graded as failing. Under
+* such a policy a control pass is not a rescue; it is the task's own grader
+* answering differently about identical state. The condition cannot fire for
+* the reason it exists, and every row walks through it.
+*
+* So the policy is a required, hashed parameter that lands on every admission
+* decision, and a configuration whose control cannot reach the outcome it
+* screens for is refused where it is configured rather than passed silently.
+*/
+/** The declared control cannot produce the outcome the criteria screen for. */
+var UncalibratedControlError = class extends CaptureIntegrityError {};
+const CONTROL_SCREENING_MODES = ["enforced", "declared-inert"];
+/**
+* A control rollout changes the graded state only by executing something, and
+* it executes only what a model call asks for. At a zero budget it grades the
+* bytes it was handed.
+*/
+function controlCanRescue(stepBudget) {
+	return stepBudget > 0;
+}
+function defineControlPolicy(input) {
+	if (!input.id.trim()) throw new ValidationError("control policy requires an id");
+	if (!input.scaffold.trim()) throw new ValidationError("control policy requires a scaffold name");
+	if (!Number.isInteger(input.stepBudget) || input.stepBudget < 0) throw new ValidationError(`control policy stepBudget must be a non-negative integer, got ${input.stepBudget}`);
+	if (!Number.isInteger(input.commandTimeoutSeconds) || input.commandTimeoutSeconds <= 0) throw new ValidationError(`control policy commandTimeoutSeconds must be a positive integer, got ${input.commandTimeoutSeconds}`);
+	if (input.stepBudget === 0 && input.model !== null) throw new ValidationError(`control policy ${input.id} declares model ${input.model} at a zero step budget; a policy that makes no model call must record model: null`);
+	if (input.stepBudget > 0 && !input.model?.trim()) throw new ValidationError(`control policy ${input.id} allows ${input.stepBudget} model call(s) but names no model`);
+	const declaration = {
+		id: input.id,
+		stepBudget: input.stepBudget,
+		scaffold: input.scaffold,
+		model: input.model,
+		commandTimeoutSeconds: input.commandTimeoutSeconds
+	};
+	return Object.freeze({
+		...declaration,
+		digest: contentHash(declaration),
+		canRescue: controlCanRescue(input.stepBudget)
+	});
+}
+/**
+* Refuse a configuration whose control and screening mode contradict.
+*
+* Both directions are faults, and both are silent without this. A screening
+* control that cannot act passes every row through a condition it can never
+* fire. A control declared inert that can in fact act hides a real screen
+* behind a label that says nothing was screened.
+*/
+function assertControlCalibrated(policy, screening) {
+	if (!CONTROL_SCREENING_MODES.includes(screening)) throw new ValidationError(`unknown control screening mode: ${screening}`);
+	const canRescue = controlCanRescue(policy.stepBudget);
+	if (screening === "enforced" && !canRescue) throw new UncalibratedControlError(`control policy ${policy.id} (digest ${policy.digest}) allows ${policy.stepBudget} model call(s) per rollout, so a control rollout executes no command and grades the same bytes the end-state check already graded as failing. Under it conditions 3 and 4 can only fire on a grader that disagrees with itself, so they screen nothing. Give the control a step budget of at least 1, or set controlScreening to 'declared-inert' and read a control pass as the oracle flip it is.`);
+	if (screening === "declared-inert" && canRescue) throw new UncalibratedControlError(`control policy ${policy.id} (digest ${policy.digest}) allows ${policy.stepBudget} model call(s) per rollout, so it can rescue a row, but the criteria declare it inert. Set controlScreening to 'enforced' so a control pass is recorded as a rescue.`);
+}
+//#endregion
+//#region src/trace-repair/admission.ts
+const ADMISSION_CONFIG_DEFAULTS = Object.freeze({
+	maxPrefixDivergence: .1,
+	controlRollouts: 3,
+	admitStrata: Object.freeze(["clean-exit", "command-error"]),
+	inertAction: "true",
+	controlScreening: "enforced",
+	concurrency: 1
+});
+function resolveAdmissionConfig(input = {}) {
+	const config = {
+		...ADMISSION_CONFIG_DEFAULTS,
+		...input
+	};
+	if (!Number.isFinite(config.maxPrefixDivergence)) throw new ValidationError(`admission maxPrefixDivergence must be a number, got ${config.maxPrefixDivergence}`);
+	if (config.maxPrefixDivergence < 0 || config.maxPrefixDivergence > 1) throw new ValidationError(`admission maxPrefixDivergence must be a share between 0 and 1, got ${config.maxPrefixDivergence}`);
+	requirePositiveInteger(config.controlRollouts, "controlRollouts");
+	requirePositiveInteger(config.concurrency, "concurrency");
+	if (config.admitStrata.length === 0) throw new ValidationError("admission admitStrata must name at least one stratum");
+	for (const stratum of config.admitStrata) if (!ADMISSION_STRATA.includes(stratum)) throw new ValidationError(`admission admitStrata holds an unknown stratum: ${stratum}`);
+	if (config.inertAction.trim().length === 0) throw new ValidationError("admission inertAction must be a non-empty command");
+	if (!CONTROL_SCREENING_MODES.includes(config.controlScreening)) throw new ValidationError(`admission controlScreening must be one of ${CONTROL_SCREENING_MODES.join(", ")}, got ${config.controlScreening}`);
+	return Object.freeze({
+		...config,
+		admitStrata: Object.freeze([...config.admitStrata])
+	});
+}
+function requirePositiveInteger(value, field) {
+	if (!Number.isInteger(value) || value <= 0) throw new ValidationError(`admission ${field} must be a positive integer, got ${value}`);
+}
+/**
+* The recorded command the no-op control replaces, drawn per rollout.
+*
+* The draw reads the policy seed, the row, and the rollout index, so it is
+* reproducible from the artifact and cannot depend on when the pre-pass ran.
+*/
+function noOpInjectionStep(policySeed, rowId, rolloutIndex, recordedCommands) {
+	requirePositiveInteger(recordedCommands, "recordedCommands");
+	const input = `no-op:${policySeed}:${rowId}:${rolloutIndex}`;
+	let hash = 2166136261;
+	for (let i = 0; i < input.length; i += 1) {
+		hash ^= input.charCodeAt(i);
+		hash = Math.imul(hash, 16777619) >>> 0;
+	}
+	return (hash >>> 1) % recordedCommands + 1;
+}
+/**
+* Run the pre-pass over every row and publish the denominator it produced.
+*
+* Nothing here reads an analyst output. The report is frozen, and a campaign
+* proves it measured this denominator by passing the report back to
+* `assertDenominatorIntact`.
+*/
+async function runAdmission(options) {
+	const { rows, policy, replayer, oracle, controls, taskOracles } = options;
+	const config = resolveAdmissionConfig(options.config);
+	const clock = options.clock ?? Date.now;
+	assertAnalystIndependent(rows);
+	assertUniqueRowIds(rows);
+	const policyDigest = continuationPolicyDigest(policy);
+	assertControlCalibrated({
+		id: policy.id,
+		digest: policyDigest,
+		stepBudget: policy.stepBudget
+	}, config.controlScreening);
+	const verdicts = await mapOrdered(rows, config.concurrency, (row) => admitRow$1({
+		row,
+		policy,
+		policyDigest,
+		replayer,
+		oracle,
+		controls,
+		taskOracles,
+		config
+	}));
+	const strata = groupAdmittedByStratum(verdicts);
+	const provenance = {
+		replayerId: replayer.id,
+		oracleId: oracle.id,
+		controlRunnerId: controls.id,
+		policyId: policy.id,
+		policyModel: policy.model,
+		policySeed: policy.seed,
+		policyDigest,
+		policyStepBudget: policy.stepBudget,
+		controlScreening: config.controlScreening,
+		certifiedTasks: Object.freeze(Object.fromEntries([...taskOracles].map(([task, verdict]) => [task, verdict.flipRate])))
+	};
+	return Object.freeze({
+		config,
+		provenance,
+		rows: Object.freeze(verdicts),
+		strata,
+		chain: buildDenominatorChain(verdicts, config.admitStrata),
+		controlCost: summarizeControlCost(verdicts),
+		digest: contentHash({
+			config,
+			provenance,
+			admitted: ADMISSION_STRATA.map((stratum) => ({
+				stratum,
+				rowIds: strata[stratum]
+			}))
+		}),
+		generatedAt: new Date(clock()).toISOString()
+	});
+}
+function assertUniqueRowIds(rows) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const row of rows) {
+		if (typeof row.rowId !== "string" || row.rowId.length === 0) throw new ValidationError("admission row requires a non-empty rowId");
+		if (seen.has(row.rowId)) throw new ValidationError(`admission received rowId ${row.rowId} twice`);
+		seen.add(row.rowId);
+	}
+}
+async function admitRow$1(input) {
+	const { row, config } = input;
+	const checks = [];
+	const rollouts = [];
+	const summaries = [];
+	const certification = input.taskOracles.get(row.taskName) ?? null;
+	const base = {
+		rowId: row.rowId,
+		taskName: row.taskName,
+		recordedModel: row.recordedModel,
+		recordedCommands: row.recordedCommands,
+		finalReturncode: row.finalReturncode,
+		controlPolicyDigest: input.policyDigest,
+		controlScreening: config.controlScreening,
+		oracleFlipRate: certification === null ? null : certification.flipRate
+	};
+	const finish = (stratum, reason, errorDetail = null) => ({
+		...base,
+		stratum,
+		admitted: reason === null,
+		excludedBy: reason,
+		errorDetail,
+		checks,
+		rollouts: summaries
+	});
+	if (!Number.isInteger(row.recordedCommands) || row.recordedCommands < 1) return finish(null, "no-recorded-commands");
+	const stratum = stratumOf(row.finalReturncode);
+	if (stratum === null) return finish(null, "unparseable-final-returncode");
+	checks.push({
+		check: "stratum",
+		stratum
+	});
+	if (!config.admitStrata.includes(stratum)) return finish(stratum, "stratum-not-admitted");
+	if (certification === null) return finish(stratum, "task-oracle-uncertified");
+	checks.push({
+		check: "task-oracle",
+		stable: certification.stable,
+		flipRate: certification.flipRate,
+		replicates: certification.replicates
+	});
+	if (!certification.stable) return finish(stratum, "task-oracle-nondeterministic", certification.detail);
+	const replay = await input.replayer.replay(row);
+	if (!replay.succeeded) return finish(stratum, "prefix-replay-error", replay.error);
+	const { prefixExecuted, prefixDivergences } = replay.value;
+	if (!Number.isInteger(prefixExecuted) || prefixExecuted < 1) return finish(stratum, "prefix-replay-empty");
+	if (prefixExecuted < row.recordedCommands) return finish(stratum, "prefix-replay-truncated");
+	const divergenceRatio = prefixDivergences.length / prefixExecuted;
+	checks.push({
+		check: "prefix-replay",
+		prefixExecuted,
+		divergences: prefixDivergences.length,
+		divergenceRatio
+	});
+	if (divergenceRatio > config.maxPrefixDivergence) return finish(stratum, "prefix-divergence-above-threshold");
+	const endState = await input.oracle.grade(row);
+	if (!endState.succeeded) return finish(stratum, "end-state-oracle-error", endState.error);
+	checks.push({
+		check: "end-state-tests",
+		passed: endState.value.passed,
+		reward: endState.value.reward
+	});
+	if (endState.value.passed) return finish(stratum, "end-state-tests-pass");
+	for (const arm of CONTROL_ARMS) {
+		const control = await runControlArm({
+			...input,
+			arm
+		});
+		checks.push(control.record);
+		rollouts.push(...control.rollouts);
+		summaries.push(...control.summaries);
+		if (control.outcome === "error") return finish(stratum, CONTROL_EXCLUSIONS[arm].error, control.error);
+		if (control.outcome === "rescued") return finish(stratum, CONTROL_EXCLUSIONS[arm].rescued);
+	}
+	assertArmSymmetry(rollouts);
+	return finish(stratum, null);
+}
+const CONTROL_ARMS = ["no-fix-control", "no-op-control"];
+const CONTROL_EXCLUSIONS = Object.freeze({
+	"no-fix-control": {
+		error: "no-fix-control-error",
+		rescued: "no-fix-control-rescued"
+	},
+	"no-op-control": {
+		error: "no-op-control-error",
+		rescued: "no-op-control-rescued"
+	}
+});
+/**
+* Run one control arm until it is decided.
+*
+* A rollout that passes decides the arm at once, so the remaining rollouts go
+* unpaid. A boundary failure decides it too, and as an error: counting an
+* unmeasured rollout as a failure would admit a row nobody verified.
+*/
+async function runControlArm(input) {
+	const { row, arm, config, policy } = input;
+	const rollouts = [];
+	const summaries = [];
+	const injections = [];
+	let passes = 0;
+	let error = null;
+	for (let index = 0; index < config.controlRollouts; index += 1) {
+		const injection = arm === "no-op-control" ? {
+			step: noOpInjectionStep(policy.seed, row.rowId, index, row.recordedCommands),
+			action: config.inertAction
+		} : null;
+		if (injection) injections.push(injection);
+		const result = await input.controls.run({
+			row,
+			arm,
+			rolloutIndex: index,
+			injection
+		});
+		if (!result.succeeded) {
+			error = result.error;
+			break;
+		}
+		const { rollout, tests } = result.value;
+		assertRolloutMatchesRequest(rollout, {
+			row,
+			arm,
+			index
+		});
+		rollouts.push(rollout);
+		summaries.push({
+			arm,
+			index: rollout.index,
+			seed: rollout.seed,
+			policyDigest: rollout.policyDigest,
+			exitStatus: rollout.exitStatus,
+			testsPassed: tests.passed,
+			costUsd: rollout.costProvenance.usd
+		});
+		if (tests.passed) {
+			passes += 1;
+			break;
+		}
+	}
+	const record = {
+		check: "control",
+		arm,
+		rolloutsRun: rollouts.length,
+		passes,
+		injections
+	};
+	if (error !== null) return {
+		outcome: "error",
+		error,
+		record,
+		rollouts,
+		summaries
+	};
+	if (passes > 0) return {
+		outcome: "rescued",
+		error: null,
+		record,
+		rollouts,
+		summaries
+	};
+	return {
+		outcome: "failed-every-rollout",
+		error: null,
+		record,
+		rollouts,
+		summaries
+	};
+}
+function assertRolloutMatchesRequest(rollout, request) {
+	if (rollout.arm !== request.arm) throw new AdmissionDenominatorError(`control runner returned a ${rollout.arm} rollout for the ${request.arm} arm`);
+	if (rollout.rowId !== request.row.rowId) throw new AdmissionDenominatorError(`control runner returned a rollout for row ${rollout.rowId} while deciding ${request.row.rowId}`);
+	if (rollout.index !== request.index) throw new AdmissionDenominatorError(`control runner returned rollout index ${rollout.index} for requested index ${request.index}`);
+}
+/**
+* Model cost of every control rollout that ran.
+*
+* One unpriced rollout makes the total uncaptured, because summing the priced
+* ones reports less than the pre-pass spent. Zero rollouts is an observed zero:
+* nothing ran, so nothing is missing.
+*/
+function summarizeControlCost(verdicts) {
+	let usd = 0;
+	for (const verdict of verdicts) for (const rollout of verdict.rollouts) {
+		if (rollout.costUsd === null) return {
+			kind: "uncaptured",
+			usd: null
+		};
+		usd += rollout.costUsd;
+	}
+	return {
+		kind: "observed",
+		usd
+	};
+}
+function groupAdmittedByStratum(verdicts) {
+	const grouped = {
+		"clean-exit": [],
+		"command-error": [],
+		"signal-kill": []
+	};
+	for (const verdict of verdicts) {
+		if (!verdict.admitted || verdict.stratum === null) continue;
+		grouped[verdict.stratum].push(verdict.rowId);
+	}
+	return Object.freeze({
+		"clean-exit": Object.freeze(grouped["clean-exit"]),
+		"command-error": Object.freeze(grouped["command-error"]),
+		"signal-kill": Object.freeze(grouped["signal-kill"])
+	});
+}
+/** Bounded worker pool that keeps results in input order. */
+async function mapOrdered(items, concurrency, fn) {
+	const results = new Array(items.length);
+	let next = 0;
+	const workerCount = Math.max(1, Math.min(concurrency, items.length));
+	const workers = Array.from({ length: workerCount }, async () => {
+		for (;;) {
+			const index = next;
+			next += 1;
+			if (index >= items.length) return;
+			const item = items[index];
+			if (item === void 0) return;
+			results[index] = await fn(item);
+		}
+	});
+	await Promise.all(workers);
+	return results;
+}
+/** Admitted row ids in one stratum. No call returns them pooled. */
+function admittedRowIds(report, stratum) {
+	return report.strata[stratum];
+}
+function admittedCount(report) {
+	return ADMISSION_STRATA.reduce((total, stratum) => total + report.strata[stratum].length, 0);
+}
+/**
+* Prove a campaign measured the denominator admission published.
+*
+* Three ways a denominator moves after the fact, each rejected here: scoring a
+* row that was never admitted, scoring a row that was never sampled, and
+* dropping a sampled row instead of scoring it. The third is the one an analyst
+* can cause on its own — declining a row it cannot solve — so a sampled row
+* with no outcome is an error, not a smaller `n`.
+*/
+function assertDenominatorIntact(input) {
+	const { report, strata, sampled, scored } = input;
+	for (const stratum of strata) if (!ADMISSION_STRATA.includes(stratum)) throw new ValidationError(`unknown stratum in denominator check: ${stratum}`);
+	assertNoDuplicates(sampled, "sampled");
+	assertNoDuplicates(scored, "scored");
+	const eligible = new Set(strata.flatMap((stratum) => [...report.strata[stratum]]));
+	const notAdmitted = sampled.filter((rowId) => !eligible.has(rowId));
+	if (notAdmitted.length > 0) throw new AdmissionDenominatorError(`${notAdmitted.length} sampled row(s) are not admitted in strata ${strata.join(", ")}: ${preview(notAdmitted)}`);
+	const sampledSet = new Set(sampled);
+	const unsampled = scored.filter((rowId) => !sampledSet.has(rowId));
+	if (unsampled.length > 0) throw new AdmissionDenominatorError(`${unsampled.length} scored row(s) were never sampled: ${preview(unsampled)}`);
+	const scoredSet = new Set(scored);
+	const dropped = sampled.filter((rowId) => !scoredSet.has(rowId));
+	if (dropped.length > 0) throw new AdmissionDenominatorError(`denominator shrank by ${dropped.length} row(s): sampled but never scored: ${preview(dropped)}`);
+}
+/** A row counted twice raises `n` without measuring anything twice. */
+function assertNoDuplicates(rowIds, field) {
+	const seen = /* @__PURE__ */ new Set();
+	const duplicates = rowIds.filter((rowId) => {
+		if (seen.has(rowId)) return true;
+		seen.add(rowId);
+		return false;
+	});
+	if (duplicates.length > 0) throw new AdmissionDenominatorError(`${field} lists ${duplicates.length} duplicate row id(s): ${preview([...new Set(duplicates)])}`);
+}
+function preview(rowIds) {
+	const shown = rowIds.slice(0, 5).join(", ");
+	return rowIds.length > 5 ? `${shown}, +${rowIds.length - 5} more` : shown;
+}
+//#endregion
+//#region src/trace-repair/admission-contract.ts
+/**
+* Admission: the executed checks a row must pass before an analyst is allowed
+* to see it, and the brand that proves it did.
+*
+* Every check is analyst-independent. None of them reads a finding, a label,
+* or a k, and all of them are anchored at the recorded end state — the point
+* the agent actually stopped at — so the same evidence admits a row no matter
+* which step an analyst later blames:
+*
+*   oracle-determinism the task's own suite returns one verdict on identical
+*                      bytes, so its answer is about the state
+*   prefix-fidelity    the recorded trajectory replays with at most 10 % of
+*                      its steps diverging from their recorded returncode
+*   end-state-fails    the held-out suite fails on the recorded end state
+*   no-fix-control     3 of 3 continuations from the end state fail
+*   no-op-control      3 of 3 continuations from the end state, after an
+*                      action that changes nothing, fail
+*
+* The two controls are what make `Delta-repair` a difference rather than a
+* rate, and what stops a row where the agent was one free step from success
+* from counting as a repair the analyst caused. They only do that under a
+* control that can act: `control-policy.ts` holds the declaration, and the
+* criteria name which reading of a control pass applies.
+*
+* The determinism check sits in front of all of it. Every downstream check
+* reads the same suite, so a suite whose verdict is not a function of the state
+* makes each of them a coin flip rather than a measurement.
+*
+* This module owns the CONTRACT, not the execution. `runAdmission` in
+* `./admission` executes the checks against real containers and hands the
+* measured evidence to `admitRow`, which decides and brands. Splitting it that
+* way keeps the decision auditable from the recorded numbers alone: a reviewer
+* can re-derive every admission from the evidence file without re-running a
+* container.
+*/
+const TB_REPAIR_ADMISSION_CRITERIA = Object.freeze({
+	maxPrefixDivergenceRatio: .1,
+	controlRollouts: 3,
+	controlScreening: "enforced"
+});
+/**
+* Decide admission from executed evidence.
+*
+* Pure: it opens no container and calls no model. Every threshold it applies
+* is in `criteria`, and every number it reads is in `evidence`, so an
+* admission decision is reproducible from the recorded evidence alone.
+*
+* It throws, rather than rejecting, when the criteria and the declared control
+* contradict. A contradiction there is a property of the configuration and not
+* of the row, so it must stop the run instead of producing one verdict per row
+* that reads as if a check had been applied.
+*/
+function admitRow(evidence, criteria = TB_REPAIR_ADMISSION_CRITERIA) {
+	assertCriteria(criteria);
+	assertControlCalibrated(evidence.controlPolicy, criteria.controlScreening);
+	if (evidence.oracleDeterminism.taskName !== evidence.taskName) throw new ValidationError(`row ${evidence.rowId} is from task ${evidence.taskName} but carries the oracle certification for ${evidence.oracleDeterminism.taskName}`);
+	const screening = {
+		controlPolicy: evidence.controlPolicy,
+		controlScreening: criteria.controlScreening,
+		controlPolicyDigest: evidence.controlPolicy.digest,
+		taskName: evidence.oracleDeterminism.taskName,
+		oracleStable: evidence.oracleDeterminism.stable,
+		oracleFlipRate: evidence.oracleDeterminism.flipRate
+	};
+	const reject = (rejection, detail) => ({
+		admitted: false,
+		rowId: evidence.rowId,
+		screening,
+		rejection,
+		detail
+	});
+	const oracle = evidence.oracleDeterminism;
+	if (!oracle.stable) return reject("task-oracle-nondeterministic", `task ${oracle.taskName} graded byte-identical state inconsistently: flip rate ${(oracle.flipRate * 100).toFixed(1)} % over ${oracle.replicates} replicates (${oracle.detail}). Every check below reads that suite, so none of them measures state.`);
+	if (evidence.steps.length === 0) return reject("empty-trajectory", "the row records no steps");
+	const { stepsReplayed, divergences } = evidence.prefixFidelity;
+	if (stepsReplayed <= 0) return reject("empty-trajectory", "no recorded step was replayed");
+	const prefixDivergenceRatio = divergences / stepsReplayed;
+	if (prefixDivergenceRatio > criteria.maxPrefixDivergenceRatio) return reject("prefix-divergence-too-high", `${divergences}/${stepsReplayed} replayed steps diverged (${(prefixDivergenceRatio * 100).toFixed(1)} %), above the ${(criteria.maxPrefixDivergenceRatio * 100).toFixed(1)} % ceiling`);
+	if (evidence.endStatePassed) return reject("end-state-already-passes", "the held-out suite passes on the recorded end state, so the row records no failure to repair");
+	for (const [name, arm, rescued] of [[
+		"no-fix control",
+		evidence.noFixControl,
+		"no-fix-control-passed"
+	], [
+		"no-op control",
+		evidence.noOpControl,
+		"no-op-control-passed"
+	]]) {
+		if (arm.rollouts !== criteria.controlRollouts) return reject("control-rollouts-short", `${name} ran ${arm.rollouts} rollouts, the criteria pre-register ${criteria.controlRollouts}`);
+		if (arm.policyDigest !== evidence.controlPolicy.digest) return reject("control-policy-mismatch", `${name} reported policy ${arm.policyDigest} but the criteria screen under ${evidence.controlPolicy.id} (${evidence.controlPolicy.digest}); the arm did not run the declared control`);
+		if (arm.passes !== 0) return criteria.controlScreening === "enforced" ? reject(rescued, `${name} passed ${arm.passes}/${arm.rollouts}; the row is repairable by continuing alone`) : reject("control-passed-on-identical-state", `${name} passed ${arm.passes}/${arm.rollouts} under ${evidence.controlPolicy.id}, which executes no command, so it graded the same bytes the end-state check graded as failing. The task's certification reports flip rate ${(oracle.flipRate * 100).toFixed(1)} %; this row is a further flip, not a rescue.`);
+	}
+	return {
+		admitted: true,
+		screening,
+		row: {
+			rowId: evidence.rowId,
+			taskName: evidence.taskName,
+			image: evidence.image,
+			cwd: evidence.cwd,
+			taskStatement: evidence.taskStatement,
+			steps: evidence.steps,
+			criteria,
+			prefixDivergenceRatio,
+			suiteDigest: evidence.suiteDigest,
+			controlPolicy: evidence.controlPolicy,
+			controlScreening: criteria.controlScreening,
+			policyDigest: evidence.controlPolicy.digest,
+			controlRate: evidence.noFixControl.passes / evidence.noFixControl.rollouts,
+			controlRollouts: evidence.noFixControl.rollouts
+		}
+	};
+}
+function assertCriteria(criteria) {
+	const { maxPrefixDivergenceRatio, controlRollouts } = criteria;
+	if (!(maxPrefixDivergenceRatio >= 0 && maxPrefixDivergenceRatio <= 1)) throw new ValidationError(`admission maxPrefixDivergenceRatio must be within [0,1], got ${maxPrefixDivergenceRatio}`);
+	if (!Number.isInteger(controlRollouts) || controlRollouts <= 0) throw new ValidationError(`admission controlRollouts must be a positive integer, got ${controlRollouts}`);
+}
+//#endregion
+//#region src/trace-repair/admission-report.ts
+/** Plain JSON. `JSON.stringify` of this object is the machine-readable artifact. */
+function admissionArtifact(report) {
+	assertChainReconciles(report.chain);
+	return {
+		version: 1,
+		kind: "tb-repair-admission",
+		generatedAt: report.generatedAt,
+		digest: report.digest,
+		config: report.config,
+		provenance: report.provenance,
+		chain: report.chain,
+		admitted: {
+			"clean-exit": report.strata["clean-exit"],
+			"command-error": report.strata["command-error"],
+			"signal-kill": report.strata["signal-kill"]
+		},
+		controlCost: {
+			kind: report.controlCost.kind,
+			usd: report.controlCost.usd
+		},
+		rows: report.rows
+	};
+}
+/** Markdown for the campaign report. Every number here is also in the artifact. */
+function renderAdmissionReport(artifact, options = {}) {
+	const lines = [];
+	lines.push("# TB-Repair admission", "");
+	lines.push(`${artifact.chain.overall.admitted} of ${artifact.chain.overall.input} rows admitted. Digest \`${artifact.digest}\`.`, "");
+	lines.push(...provenanceSection(artifact));
+	lines.push(...chainSection(artifact.chain.overall, "Denominator chain"));
+	for (const chain of artifact.chain.byStratum) lines.push(...chainSection(chain, `Denominator chain — ${chain.scope}`));
+	lines.push(...stratumSection(artifact));
+	lines.push(...reasonSection(artifact.chain.reasonTotals));
+	const rowLimit = options.rowLimit ?? 0;
+	if (rowLimit > 0) lines.push(...rowSection(artifact.rows, rowLimit));
+	return `${lines.join("\n").trimEnd()}\n`;
+}
+function provenanceSection(artifact) {
+	const { provenance, config, controlCost } = artifact;
+	const cost = controlCost.usd === null ? "uncaptured" : `$${controlCost.usd.toFixed(4)}`;
+	return [
+		"## Provenance",
+		"",
+		"| field | value |",
+		"| --- | --- |",
+		`| generated | ${artifact.generatedAt} |`,
+		`| prefix replayer | \`${provenance.replayerId}\` |`,
+		`| end-state oracle | \`${provenance.oracleId}\` |`,
+		`| control runner | \`${provenance.controlRunnerId}\` |`,
+		`| continuation policy | \`${provenance.policyId}\` |`,
+		`| policy model | \`${provenance.policyModel}\` |`,
+		`| policy seed | ${provenance.policySeed} |`,
+		`| policy digest | \`${provenance.policyDigest}\` |`,
+		`| policy step budget | ${provenance.policyStepBudget} model call(s) per control rollout |`,
+		`| control screening | \`${provenance.controlScreening}\` |`,
+		`| certified task oracles | ${formatCertifiedTasks(provenance.certifiedTasks)} |`,
+		`| max prefix divergence | ${formatShare(config.maxPrefixDivergence)} |`,
+		`| control rollouts per arm | ${config.controlRollouts} |`,
+		`| inert action | \`${config.inertAction}\` |`,
+		`| strata admitted | ${config.admitStrata.join(", ")} |`,
+		`| control model cost | ${cost} (${controlCost.kind}) |`,
+		""
+	];
+}
+function formatCertifiedTasks(certified) {
+	const entries = Object.entries(certified).sort(([a], [b]) => a.localeCompare(b));
+	if (entries.length === 0) return "none";
+	return entries.map(([task, flipRate]) => `${task} (flip ${formatShare(flipRate)})`).join(", ");
+}
+function chainSection(chain, heading) {
+	const lines = [
+		`## ${heading}`,
+		"",
+		"| stage | exclusion reason | entering | excluded | remaining |",
+		"| --- | --- | --- | --- | --- |"
+	];
+	chain.stages.forEach((stage, index) => {
+		lines.push(`| ${index + 1} | \`${stage.reason}\` | ${stage.entering} | ${stage.excluded} | ${stage.remaining} |`);
+	});
+	const excluded = chain.input - chain.admitted;
+	lines.push("", `Input ${chain.input} = admitted ${chain.admitted} + excluded ${excluded}. Admission rate ${formatShare(rate(chain.admitted, chain.input))}.`, "");
+	return lines;
+}
+function stratumSection(artifact) {
+	const lines = [
+		"## Strata",
+		"",
+		"| stratum | admitted rows | in this campaign |",
+		"| --- | --- | --- |"
+	];
+	for (const stratum of ADMISSION_STRATA) {
+		const admitted = artifact.admitted[stratum].length;
+		const eligible = artifact.chain.admitStrata.includes(stratum) ? "yes" : "no";
+		lines.push(`| ${stratum} | ${admitted} | ${eligible} |`);
+	}
+	lines.push("", "Sample within a stratum. A command-level repair cannot address a signal kill, so pooling that population with the others averages an addressable class with an unaddressable one.", "");
+	return lines;
+}
+function reasonSection(totals) {
+	const lines = [
+		"## Exclusions",
+		"",
+		"| reason | rows | what it means |",
+		"| --- | --- | --- |"
+	];
+	for (const reason of ADMISSION_EXCLUSION_ORDER) lines.push(`| \`${reason}\` | ${totals[reason]} | ${ADMISSION_EXCLUSION_MEANING[reason]} |`);
+	lines.push("");
+	return lines;
+}
+function rowSection(rows, limit) {
+	const lines = [
+		"## Rows",
+		"",
+		"| row | task | stratum | final rc | admitted | excluded by |",
+		"| --- | --- | --- | --- | --- | --- |"
+	];
+	for (const row of rows.slice(0, limit)) lines.push(`| \`${row.rowId}\` | ${row.taskName} | ${row.stratum ?? "—"} | ${row.finalReturncode ?? "—"} | ${row.admitted ? "yes" : "no"} | ${row.excludedBy === null ? "—" : `\`${row.excludedBy}\``} |`);
+	if (rows.length > limit) lines.push("", `${rows.length - limit} further rows in the artifact.`);
+	lines.push("");
+	return lines;
+}
+function rate(part, total) {
+	return total === 0 ? 0 : part / total;
+}
+function formatShare(share) {
+	return `${(share * 100).toFixed(2)}%`;
+}
+//#endregion
+//#region src/trace-repair/blinding.ts
+/**
+* What the analyst is shown.
+*
+* A blinded trajectory prefix: the task the agent was given and the actions
+* and observations it produced, and nothing about how the run was judged. No
+* held-out suite, no suite digest, no control rates, no end-state result, no
+* label.
+*
+* The blinding is by construction rather than by redaction. The returned
+* object is assembled field by field from an admitted row, so a field added to
+* `AdmittedRow` later cannot leak into an analyst prompt by default — it has
+* to be copied here on purpose.
+*
+* Requiring an `AdmittedRow` is the other half of the guarantee: a row cannot
+* be shown to an analyst before the four admission checks have executed and
+* passed.
+*/
+function blindTrajectory(row, options = {}) {
+	const through = options.throughStep ?? row.steps.length;
+	if (!Number.isInteger(through) || through < 1 || through > row.steps.length) throw new ValidationError(`blindTrajectory throughStep must be within [1, ${row.steps.length}], got ${through}`);
+	const steps = row.steps.slice(0, through).map((step) => ({
+		step_id: step.step_id,
+		action: step.action,
+		observation: step.observation
+	}));
+	return {
+		rowId: row.rowId,
+		taskStatement: row.taskStatement,
+		steps,
+		recordedSteps: row.steps.length,
+		maxK: through
+	};
+}
+/**
+* Fields an analyst prompt must never carry. Exported so a consumer that
+* builds its own prompt can assert against the same list this module honours.
+*/
+const BLINDED_FIELDS = Object.freeze([
+	"criteria",
+	"controlPolicy",
+	"controlRate",
+	"controlRollouts",
+	"controlScreening",
+	"suiteDigest",
+	"policyDigest",
+	"prefixDivergenceRatio",
+	"image",
+	"cwd"
+]);
+//#endregion
+//#region src/trace-repair/repair-prompt.ts
+/**
+* The one question every repair arm answers.
+*
+* Arms differ in what EXECUTES the question — a single chat completion, an
+* agent harness, a DSPy program — and in nothing else. One prompt module is
+* what makes a comparison between them an ablation of the execution path
+* rather than a comparison of two prompts.
+*
+* The execution environment is stated, not hinted. The recorded scaffold runs
+* every action in a fresh `/bin/sh` and takes exactly one top-level statement,
+* so an arm that is not told that writes bash-only syntax and dies at
+* execution for a reason that has nothing to do with whether it localized the
+* failure. Stating the shell leaks no label: the held-out suite, the control
+* rates and the end-state verdict all stay out, and the prompt is built from a
+* `BlindedTrajectoryPrefix`, which cannot carry them.
+*
+* The action caps in the prose are read from the budget the grader enforces,
+* so the instruction and the rejection can never drift apart.
+*/
+const REPAIR_QUESTION = "This coding agent ran and did not finish the task. Name the ONE recorded step whose action you would replace, and give the single shell action to run instead of it.";
+/**
+* The task definition. Parameterised by the budget so the stated caps are the
+* enforced caps.
+*/
+function repairTaskPolicy(budget = SCAFFOLD_INTERVENTION_BUDGET) {
+	return Object.freeze([
+		"You are given a task statement and the complete recorded trajectory of an agent that attempted it and failed.",
+		"Your answer is executed. The action you return is run inside the real task container, at the point in the trajectory you name, and the task's held-out test suite is then run against the resulting state. You are scored on whether the suite passes, never on how your explanation reads.",
+		"",
+		"HOW YOUR ACTION IS EXECUTED — read this before writing it:",
+		"- The action runs in a FRESH `/bin/sh`, which is dash on this image, not bash. C-style `for ((i=0;i<n;i++))`, `[[ ]]`, arrays, and `local` are bash-only and will fail with a syntax error.",
+		`- The scaffold accepts exactly ${budget.maxStatements === 1 ? "ONE top-level statement" : `${budget.maxStatements} top-level statements`}. Wrap multiple commands in a single \`{ ...; }\` block or chain them with \`&&\`.`,
+		`- The action is at most ${budget.maxBytes} bytes, and must not be a no-op such as \`true\`, \`:\` or an empty string.`,
+		"- It runs from the task working directory, as root, with the network available.",
+		"- Prefer writing a complete correct file with a heredoc over patching in place; you cannot see the result of your own action, so it must work on the first attempt.",
+		"Name the step whose action you would replace as `k`, using the step_id shown in the trajectory. Choosing the last step means \"instead of the last thing the agent did, do this\". You are not repairing the agent's reasoning; you are producing the state the suite requires.",
+		"Return no finding only when no single replacement action could plausibly make the suite pass."
+	]);
+}
+/** The reply grammar, stated to an arm that answers in one JSON object. */
+const REPAIR_CONTRACT_LINES = Object.freeze([
+	"OUTPUT CONTRACT — reply with ONE fenced JSON object and nothing else:",
+	"```json",
+	"{\"answer\": \"<one sentence on what went wrong>\", \"findings\": [{\"k\": <int>, \"failure_claim\": \"<what went wrong at step k>\", \"intervention\": {\"kind\": \"shell\", \"action\": \"<the single shell action to run instead>\"}}]}",
+	"```",
+	"Rules:",
+	"- `findings` carries AT MOST ONE object. Never more.",
+	"- `k` is an integer step_id present in the trajectory below.",
+	"- `failure_claim` is a non-empty string. It is recorded and never scored, so spend your effort on the action.",
+	"- `intervention.kind` is the string \"shell\", or \"edit\" when the action authors a file with a heredoc.",
+	"- `intervention.action` is the exact shell text to execute. It is not a description and not a diff.",
+	"- Return `\"findings\": []` only to say that no single action could repair this run."
+]);
+/** The same grammar restated for the bounded repair turn, which never carries
+*  the trajectory again. */
+const REPAIR_REPAIR_CONTRACT_LINES = Object.freeze([
+	"Your previous reply did not satisfy the output contract. Resend the answer, and nothing else, as ONE fenced JSON object:",
+	"```json",
+	"{\"answer\": \"<one sentence>\", \"findings\": [{\"k\": <int>, \"failure_claim\": \"<string>\", \"intervention\": {\"kind\": \"shell\", \"action\": \"<shell text>\"}}]}",
+	"```",
+	"`findings` carries at most one object. Do not restate the trajectory."
+]);
+/** The trajectory as an arm sees it: actions, observations, nothing about grading. */
+function renderRepairTrajectory(prefix) {
+	return prefix.steps.map((step) => [
+		`--- step_id ${step.step_id} ---`,
+		"ACTION:",
+		step.action,
+		"OBSERVATION:",
+		step.observation === null ? "(no observation recorded)" : step.observation
+	].join("\n")).join("\n\n");
+}
+function repairTrajectoryHeader(prefix) {
+	return `RECORDED TRAJECTORY (${prefix.steps.length} steps; valid k is any step_id below, the last is ${prefix.maxK}):`;
+}
+/** The task definition an arm receives: the policy plus the statement the
+*  recorded agent was given. */
+function repairTaskDefinition(prefix, budget = SCAFFOLD_INTERVENTION_BUDGET) {
+	return [
+		...repairTaskPolicy(budget),
+		"",
+		"TASK STATEMENT GIVEN TO THE AGENT:",
+		prefix.taskStatement
+	].join("\n");
+}
+/**
+* Digest of the question and task policy every arm shares.
+*
+* This is the part of the prompt that is equal by construction across arms:
+* the question, the execution rules, and the budget the caps are read from.
+* An arm's own contract text — its output grammar, its typed-signature
+* instructions — is deliberately outside it, because arms differ there.
+*/
+function repairQuestionSha256(budget = SCAFFOLD_INTERVENTION_BUDGET) {
+	return createHash("sha256").update(JSON.stringify({
+		kind: "tb-repair-analyst-question",
+		question: REPAIR_QUESTION,
+		taskPolicy: repairTaskPolicy(budget),
+		budget
+	})).digest("hex");
+}
+/**
+* Digest of the composed question one arm answered.
+*
+* Covers the shared question and the arm's own declared contract text, so two
+* arms that ask materially different composed questions — a JSON grammar
+* versus a typed SUBMIT signature — stamp different digests, and two arms
+* that ask the identical composed question share one.
+*/
+function repairArmPromptSha256(budget, contract) {
+	return createHash("sha256").update(JSON.stringify({
+		kind: "tb-repair-analyst-prompt",
+		question: REPAIR_QUESTION,
+		taskPolicy: repairTaskPolicy(budget),
+		budget,
+		contract
+	})).digest("hex");
+}
+//#endregion
+//#region src/trace-repair/analyst-arm.ts
+/**
+* What an analyst arm is, and what every arm owes the comparison.
+*
+* An arm is one way of EXECUTING the repair question: a single chat
+* completion, an agent harness, a DSPy program. The question, the reply
+* grammar, the action budget and the bounded repair turn belong to the
+* comparison, not to the arm — so they live here and every arm inherits them.
+*
+* Three rules this module makes structural rather than customary:
+*
+*   one contract      an arm returns `RepairFinding` or an honest decline,
+*                     and nothing else parses. An arm that produced neither
+*                     fails loud with a typed reason; nothing is defaulted.
+*   one budget        `askRepairArm` measures every action against the
+*                     scaffold budget and records the measurement. The grader
+*                     remains the single authority that rejects, so a
+*                     violation is reported here and refused there — never
+*                     silently trimmed to fit.
+*   one repair turn   arms declare how many bounded retries a malformed reply
+*                     earns. `repairArmAsymmetries` refuses a set whose arms
+*                     disagree, because a second attempt is a second sample
+*                     the other arms never got.
+*
+* What arms are ALLOWED to differ in is declared, not hidden: `affordances`
+* names what an arm can do that another cannot — read the trajectory through
+* a code interpreter, take internal turns — and `repairArmAsymmetries` renders
+* those differences so a reader sees them beside the result instead of having
+* to infer them from two runners' source.
+*/
+/**
+* Ask one arm about one admitted row.
+*
+* Blinding, prompt identity and budget measurement happen here, once, for
+* every arm. An arm that wants a different question does not get one.
+*/
+async function askRepairArm(options) {
+	const { arm, row } = options;
+	assertDeclaration(arm.declaration);
+	const now = options.now ?? Date.now;
+	const startedMs = now();
+	const prefix = blindTrajectory(row, options.throughStep === void 0 ? {} : { throughStep: options.throughStep });
+	const reply = await arm.ask({
+		prefix,
+		...options.signal ? { signal: options.signal } : {}
+	});
+	assertReplyWithinDeclaration(arm.declaration, reply);
+	const budget = reply.status === "finding" ? checkInterventionBudget(reply.intervention.action, reply.intervention.kind, arm.declaration.budget) : null;
+	return {
+		rowId: row.rowId,
+		armId: arm.declaration.id,
+		promptSha256: repairArmPromptSha256(arm.declaration.budget, arm.declaration.promptContract),
+		reply,
+		budget,
+		wallMs: now() - startedMs
+	};
+}
+/**
+* The answer in the grammar the grader consumes.
+*
+* Null for a failure: a run that could not answer has no answer to grade, and
+* turning it into a decline would credit an arm with an honest null it never
+* produced.
+*/
+function repairArmResponse(answer) {
+	const { reply } = answer;
+	if (reply.status === "declined") return { kind: "no-decisive-failure" };
+	if (reply.status === "failed") return null;
+	return {
+		kind: "finding",
+		k: reply.k,
+		failureClaim: reply.failureClaim,
+		intervention: reply.intervention
+	};
+}
+/**
+* Refuse a set of arms that cannot be compared, and describe what still
+* differs between the ones that can.
+*
+* Two properties are hard: the arms measure actions against the same budget,
+* and a malformed reply earns the same number of retries everywhere. Both are
+* things that would move a score without moving the thing being measured.
+*
+* Certification is the third: a set where some arms run certified text and
+* others do not is refused outright. An optimisation applies to every arm or
+* to none — a mixed set measures the optimisation, then reports it as the
+* harness.
+*/
+function repairArmAsymmetries(arms, options = {}) {
+	if (arms.length === 0) throw new ValidationError("a repair-arm comparison needs at least one arm");
+	const declarations = arms.map((arm) => arm.declaration);
+	for (const declaration of declarations) assertDeclaration(declaration);
+	const { ids, repairTurns } = assertEqualDeclarativeTerms("repair arm", declarations.map((declaration) => ({
+		id: declaration.id,
+		repairTurns: declaration.repairTurns
+	})));
+	const budget = options.budget ?? declarations[0].budget;
+	const mismatched = declarations.find((declaration) => !sameBudget(declaration.budget, budget));
+	if (mismatched) throw new ValidationError(`arm '${mismatched.id}' measures actions against ${JSON.stringify(mismatched.budget)}, the comparison runs ${JSON.stringify(budget)}; one arm buying a bigger action than another is a difference in what was asked, not in what answered`);
+	const certified = declarations.filter((declaration) => declaration.certification.kind === "certified");
+	if (certified.length > 0 && certified.length !== declarations.length) throw new ValidationError(`${certified.length}/${declarations.length} arms run certified text (${certified.map((declaration) => declaration.id).join(", ")}); an optimisation applies to every arm or to none`);
+	return {
+		armIds: ids,
+		sharedAffordances: ALL_AFFORDANCES.filter((affordance) => declarations.every((declaration) => declaration.affordances.includes(affordance))),
+		asymmetries: declarations.map((declaration) => ({
+			armId: declaration.id,
+			extraAffordances: ALL_AFFORDANCES.filter((affordance) => declaration.affordances.includes(affordance) && declarations.some((other) => !other.affordances.includes(affordance))),
+			missingAffordances: ALL_AFFORDANCES.filter((affordance) => !declaration.affordances.includes(affordance) && declarations.some((other) => other.affordances.includes(affordance))),
+			certification: declaration.certification,
+			promptSha256: repairArmPromptSha256(declaration.budget, declaration.promptContract)
+		})),
+		noArmCertified: certified.length === 0,
+		budget,
+		repairTurns,
+		questionSha256: repairQuestionSha256(budget)
+	};
+}
+const ALL_AFFORDANCES = Object.freeze([
+	"inline-trajectory",
+	"trajectory-tools",
+	"code-interpreter",
+	"agent-loop"
+]);
+function sameBudget(a, b) {
+	return a.maxBytes === b.maxBytes && a.maxStatements === b.maxStatements && a.maxHeredocs === b.maxHeredocs;
+}
+function assertDeclaration(declaration) {
+	if (typeof declaration.id !== "string" || declaration.id.trim() !== declaration.id || !declaration.id) throw new ValidationError("a repair arm id must be a trimmed non-empty string");
+	if (typeof declaration.execution !== "string" || !declaration.execution.trim()) throw new ValidationError(`arm '${declaration.id}' must state what executes its answer`);
+	if (!Number.isInteger(declaration.repairTurns) || declaration.repairTurns < 0) throw new ValidationError(`arm '${declaration.id}' repairTurns must be a non-negative integer, got ${declaration.repairTurns}`);
+	if (declaration.certification.kind === "none" && (typeof declaration.certification.reason !== "string" || !declaration.certification.reason.trim())) throw new ValidationError(`arm '${declaration.id}' carries no certification and must say why in one sentence`);
+	if (!Array.isArray(declaration.promptContract) || declaration.promptContract.length === 0 || declaration.promptContract.some((line) => typeof line !== "string")) throw new ValidationError(`arm '${declaration.id}' must declare its contract text as a non-empty array of strings; the per-arm prompt digest is computed from it`);
+	for (const affordance of declaration.affordances) if (!ALL_AFFORDANCES.includes(affordance)) throw new ValidationError(`arm '${declaration.id}' declares unknown affordance '${affordance}'`);
+}
+/** An arm that reports more repair turns than it declared is not the arm the
+*  comparison admitted, so the answer never reaches a grader. */
+function assertReplyWithinDeclaration(declaration, reply) {
+	if (reply.repair.attempted && declaration.repairTurns === 0) throw new ValidationError(`arm '${declaration.id}' declares no bounded repair turn but took one`);
+	if (reply.status === "failed" && !reply.failure.trim()) throw new ValidationError(`arm '${declaration.id}' failed without stating why`);
+	if (reply.status === "finding" && !reply.intervention.action) throw new ValidationError(`arm '${declaration.id}' returned a finding with an empty intervention`);
+}
+//#endregion
+//#region src/trace-repair/analyst-response.ts
+/**
+* What an analyst is allowed to say about a blinded trajectory prefix.
+*
+* Exactly one of two answers:
+*
+*   a finding                {k, failureClaim, intervention}
+*   the literal string       no-decisive-failure
+*
+* Nothing else parses. A finding names one step, states what went wrong
+* there, and supplies one action to run instead. Declining is a real answer
+* with its own cell in the funnel, not a parse failure — an admitted row has
+* a failure by construction, but it need not have a single-action repair, and
+* an analyst that says so is answering the question it was asked.
+*/
+/** The literal an analyst returns when no single step carries the failure. */
+const NO_DECISIVE_FAILURE = "no-decisive-failure";
+/**
+* Read an analyst reply.
+*
+* Accepts the bare literal, or a JSON object carrying one finding. The reply
+* is untrusted text, so every field is checked and nothing is defaulted: a
+* missing `k` is a parse failure, never step 1.
+*/
+function parseAnalystResponse(reply) {
+	const trimmed = reply.trim();
+	if (trimmed.length === 0) return {
+		succeeded: false,
+		failure: "unreadable",
+		detail: "the reply is empty"
+	};
+	if (trimmed === "no-decisive-failure") return {
+		succeeded: true,
+		value: { kind: "no-decisive-failure" }
+	};
+	const json = extractJsonObject(trimmed);
+	if (!json) return {
+		succeeded: false,
+		failure: "unreadable",
+		detail: `expected the literal "${NO_DECISIVE_FAILURE}" or one JSON object`
+	};
+	if (json.count > 1) return {
+		succeeded: false,
+		failure: "not-a-single-answer",
+		detail: `the reply carries ${json.count} findings; exactly one is allowed`
+	};
+	const body = json.value;
+	if (body.no_decisive_failure === true || body.finding === "no-decisive-failure") return {
+		succeeded: true,
+		value: { kind: "no-decisive-failure" }
+	};
+	const k = body.k;
+	if (typeof k !== "number" || !Number.isInteger(k)) return {
+		succeeded: false,
+		failure: "missing-k",
+		detail: `k must be an integer, got ${describe$2(k)}`
+	};
+	const failureClaim = body.failure_claim ?? body.failureClaim;
+	if (typeof failureClaim !== "string" || failureClaim.trim().length === 0) return {
+		succeeded: false,
+		failure: "missing-failure-claim",
+		detail: "failure_claim must be a non-empty string"
+	};
+	const raw = body.intervention;
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return {
+		succeeded: false,
+		failure: "missing-intervention",
+		detail: "intervention must be an object with kind and action"
+	};
+	const intervention = raw;
+	const action = intervention.action;
+	if (typeof action !== "string") return {
+		succeeded: false,
+		failure: "missing-intervention",
+		detail: "intervention.action must be a string"
+	};
+	const kind = intervention.kind;
+	if (kind !== "shell" && kind !== "edit") return {
+		succeeded: false,
+		failure: "unknown-intervention-kind",
+		detail: `intervention.kind must be "shell" or "edit", got ${describe$2(kind)}`
+	};
+	return {
+		succeeded: true,
+		value: {
+			kind: "finding",
+			k,
+			failureClaim: failureClaim.trim(),
+			intervention: {
+				kind,
+				action
+			}
+		}
+	};
+}
+/** Build a finding directly, for callers that already hold typed fields. */
+function repairFinding(input) {
+	if (!Number.isInteger(input.k) || input.k < 1) throw new ValidationError(`repair finding k must be a positive integer, got ${input.k}`);
+	if (input.failureClaim.trim().length === 0) throw new ValidationError("repair finding requires a non-empty failure claim");
+	return {
+		kind: "finding",
+		k: input.k,
+		failureClaim: input.failureClaim.trim(),
+		intervention: input.intervention
+	};
+}
+function describe$2(value) {
+	if (value === null) return "null";
+	if (value === void 0) return "undefined";
+	return typeof value === "string" ? JSON.stringify(value) : String(value);
+}
+/**
+* Pull the single JSON object out of a reply, tolerating a fenced block and
+* surrounding prose. `count` reports how many top-level objects were found so
+* a reply hedging with several findings is rejected rather than silently
+* reduced to the first one.
+*/
+function extractJsonObject(reply) {
+	const fenced = [...reply.matchAll(/```(?:json)?\s*\n([\s\S]*?)```/g)].map((m) => m[1].trim());
+	const candidates = fenced.length > 0 ? fenced : [reply];
+	const parsed = [];
+	for (const candidate of candidates) for (const slice of topLevelObjectSlices(candidate)) try {
+		const value = JSON.parse(slice);
+		if (Array.isArray(value)) {
+			for (const item of value) if (isPlainObject(item)) parsed.push(item);
+		} else if (isPlainObject(value)) parsed.push(value);
+	} catch {}
+	if (parsed.length === 0) return null;
+	return {
+		value: parsed[0],
+		count: parsed.length
+	};
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Balanced `{…}` and `[…]` slices at the top level of a candidate string. */
+function topLevelObjectSlices(text) {
+	const slices = [];
+	let depth = 0;
+	let start = -1;
+	let inString = false;
+	let escaped = false;
+	for (let i = 0; i < text.length; i += 1) {
+		const char = text[i];
+		if (inString) {
+			if (escaped) escaped = false;
+			else if (char === "\\") escaped = true;
+			else if (char === "\"") inString = false;
+			continue;
+		}
+		if (char === "\"") {
+			inString = true;
+			continue;
+		}
+		if (char === "{" || char === "[") {
+			if (depth === 0) start = i;
+			depth += 1;
+			continue;
+		}
+		if (char === "}" || char === "]") {
+			depth -= 1;
+			if (depth === 0 && start >= 0) {
+				slices.push(text.slice(start, i + 1));
+				start = -1;
+			}
+			if (depth < 0) depth = 0;
+		}
+	}
+	return slices;
+}
+//#endregion
+//#region src/trace-repair/arm-completion.ts
+function createCompletionRepairArm(options) {
+	if (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs <= 0) throw new ValidationError(`repair arm '${options.id}' timeoutMs must be a positive safe integer, got ${options.timeoutMs}`);
+	const budget = options.budget ?? SCAFFOLD_INTERVENTION_BUDGET;
+	return {
+		declaration: {
+			id: options.id,
+			execution: options.execution,
+			certification: options.certification,
+			budget,
+			repairTurns: 1,
+			affordances: options.affordances,
+			promptContract: [...REPAIR_CONTRACT_LINES, ...REPAIR_REPAIR_CONTRACT_LINES]
+		},
+		async ask(request) {
+			const prompt = buildPrimePrompt({
+				question: REPAIR_QUESTION,
+				taskDefinition: repairTaskDefinition(request.prefix, budget),
+				contractLines: REPAIR_CONTRACT_LINES,
+				trajectoryHeader: repairTrajectoryHeader(request.prefix),
+				renderedTrajectory: renderRepairTrajectory(request.prefix)
+			});
+			const outcome = await runPrimeExchange({
+				contract: replyContract(request.prefix),
+				prompt,
+				transport: options.transport,
+				url: options.url,
+				model: options.model,
+				timeoutMs: options.timeoutMs,
+				repair: true,
+				...request.signal ? { signal: request.signal } : {}
+			});
+			const usage = armUsage(outcome.usage, options.pricing);
+			if (!outcome.ok) return {
+				status: "failed",
+				failure: `${outcome.failure.kind}: ${outcome.failure.message}`,
+				answer: null,
+				rejectedRows: [],
+				repair: outcome.repair,
+				usage
+			};
+			const row = outcome.rows[0];
+			if (row === void 0) return {
+				status: "declined",
+				answer: outcome.answer,
+				reportedRows: outcome.reportedRows,
+				rejectedRows: outcome.rejected,
+				repair: outcome.repair,
+				usage
+			};
+			return {
+				status: "finding",
+				k: row.k,
+				failureClaim: row.failureClaim,
+				intervention: {
+					kind: row.kind,
+					action: row.action
+				},
+				answer: outcome.answer,
+				reportedRows: outcome.reportedRows,
+				rejectedRows: outcome.rejected,
+				repair: outcome.repair,
+				usage
+			};
+		}
+	};
+}
+/**
+* Decode one reply row.
+*
+* Every field is checked and nothing is defaulted: a `k` outside the recorded
+* step ids is a rejected row rather than a clamped one, because an arm that
+* names a step the recording does not hold has not localized anything.
+*/
+function replyContract(prefix) {
+	const validSteps = prefix.steps.map((step) => step.step_id);
+	return {
+		rowsField: "findings",
+		contractLines: REPAIR_CONTRACT_LINES,
+		repairContractLines: REPAIR_REPAIR_CONTRACT_LINES,
+		maxRows: 1,
+		decodeRow(row, index) {
+			if (typeof row !== "object" || row === null || Array.isArray(row)) return {
+				ok: false,
+				reason: `row ${index} is not an object`
+			};
+			const record = row;
+			const k = record.k;
+			if (!Number.isInteger(k) || !validSteps.includes(k)) return {
+				ok: false,
+				reason: `k must be a recorded step_id in [${validSteps[0] ?? 1}, ${prefix.maxK}], got ${describe$1(k)}`
+			};
+			const claim = record.failure_claim ?? record.failureClaim;
+			if (typeof claim !== "string" || claim.trim().length === 0) return {
+				ok: false,
+				reason: "failure_claim must be a non-empty string"
+			};
+			const raw = record.intervention;
+			if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return {
+				ok: false,
+				reason: "intervention must be an object with kind and action"
+			};
+			const intervention = raw;
+			const action = intervention.action;
+			if (typeof action !== "string" || action.length === 0) return {
+				ok: false,
+				reason: "intervention.action must be a non-empty string"
+			};
+			const kind = intervention.kind;
+			if (kind !== "shell" && kind !== "edit") return {
+				ok: false,
+				reason: `intervention.kind must be "shell" or "edit", got ${describe$1(kind)}`
+			};
+			return {
+				ok: true,
+				row: {
+					k,
+					failureClaim: claim.trim(),
+					kind,
+					action
+				}
+			};
+		}
+	};
+}
+function armUsage(usage, pricing) {
+	const receipt = analystUsageReceiptFromPrimeUsage(usage, pricing);
+	return {
+		calls: usage.calls,
+		inputTokens: usage.inputTokens,
+		outputTokens: usage.outputTokens,
+		costUsd: receipt.cost.usd ?? receipt.knownCostUsd ?? null
+	};
+}
+function describe$1(value) {
+	if (value === null) return "null";
+	if (value === void 0) return "undefined";
+	return typeof value === "string" ? JSON.stringify(value) : String(value);
+}
+//#endregion
+//#region src/trace-repair/arm-dspy.ts
+/**
+* Token the bridge reads to select the typed repair signature.
+*
+* The wire protocol carries instructions as opaque text, so the task is named
+* inside them rather than by adding a field every unrelated caller would have
+* to set. The same mechanism selects the CodeTraceBench typed signature.
+*/
+const DSPY_REPAIR_TASK_TOKEN = "tb-repair-typed-";
+/** Signature the bridge reports for a repair analysis. */
+const DSPY_REPAIR_SIGNATURE = "tb-repair-typed-v1";
+/** The name the trajectory is bound to inside the program's environment. */
+const DSPY_REPAIR_TRAJECTORY_INPUT = "trajectory";
+/**
+* The repair contract restated for the typed signature.
+*
+* Transport differs from the chat-completion arms — typed SUBMIT instead of a
+* fenced JSON object — and the QUESTION does not. Both read from
+* `repairTaskPolicy`, so the execution rules an arm is held to cannot drift
+* between arms.
+*/
+function dspyRepairInstructions(budget = SCAFFOLD_INTERVENTION_BUDGET) {
+	return [
+		`TASK ${DSPY_REPAIR_TASK_TOKEN}${DSPY_REPAIR_SIGNATURE}`,
+		"",
+		...repairTaskPolicy(budget),
+		"",
+		`The recorded trajectory is already loaded into your environment as \`${DSPY_REPAIR_TRAJECTORY_INPUT}\`,`,
+		"a list of {step_id, action, observation} objects in recorded order. Read it with code",
+		"rather than re-fetching it, and do not claim to have inspected anything you did not read.",
+		"",
+		"SUBMIT at most ONE repair, shaped as:",
+		"- k: the step_id whose action you replace. It must be a step_id present in the trajectory.",
+		"- failure_claim: what went wrong at step k. Recorded, never scored.",
+		"- intervention_kind: \"edit\" when the action authors a file with a heredoc, \"shell\" otherwise.",
+		`- action: the EXACT shell text to run instead, at most ${budget.maxBytes} bytes and exactly`,
+		`  ${budget.maxStatements === 1 ? "one top-level statement" : `${budget.maxStatements} top-level statements`}. It is executed verbatim: not a description, not a diff, not a plan.`,
+		"SUBMIT an empty list only when no single replacement action could make the suite pass."
+	].join("\n");
+}
+function createDspyRepairArm(options) {
+	assertDspyRepairEngine(options.engine);
+	const budget = options.budget ?? SCAFFOLD_INTERVENTION_BUDGET;
+	const instructions = dspyRepairInstructions(budget);
+	return {
+		declaration: {
+			id: options.id ?? "dspy-rlm",
+			execution: `DSPy RLM program (${options.engine.id} v${options.engine.version}) with a typed repair signature and a code environment`,
+			certification: {
+				kind: "none",
+				reason: "the GEPA-certified analyst text was earned on the CodeTraceBench incorrect-step contract, which asks for blocks of wrong steps rather than one executable repair; this arm runs instruction text authored for the repair contract and certified by nothing"
+			},
+			budget,
+			repairTurns: 1,
+			affordances: [
+				"inline-trajectory",
+				"code-interpreter",
+				"agent-loop"
+			],
+			promptContract: [instructions]
+		},
+		async ask(request) {
+			const steps = request.prefix.steps.map((step) => ({
+				step_id: step.step_id,
+				action: step.action,
+				observation: step.observation
+			}));
+			let result;
+			try {
+				result = await options.engine.analyze({
+					analystId: options.analystId,
+					question: [
+						REPAIR_QUESTION,
+						"",
+						`The trajectory has ${steps.length} recorded steps, step_ids ${steps.map((step) => step.step_id).join(", ")}.`
+					].join("\n"),
+					instructions,
+					tools: [],
+					taskInputs: {
+						[DSPY_REPAIR_TRAJECTORY_INPUT]: steps,
+						taskStatement: request.prefix.taskStatement
+					},
+					limits: options.limits,
+					costLedger: options.costLedger,
+					costPhase: options.costPhase,
+					...options.costTags ? { costTags: options.costTags } : {},
+					...request.signal ? { signal: request.signal } : {},
+					...options.log ? { log: options.log } : {}
+				});
+			} catch (error) {
+				return {
+					status: "failed",
+					failure: `engine threw: ${error instanceof Error ? error.message : String(error)}`,
+					answer: null,
+					rejectedRows: [],
+					repair: {
+						attempted: false,
+						succeeded: null
+					},
+					usage: engineUsage(null)
+				};
+			}
+			const payload = readRepairPayload(result.runtime, { validSteps: steps.map((step) => step.step_id) });
+			const usage = engineUsage(result.modelCalls);
+			if (!payload.ok) return {
+				status: "failed",
+				failure: payload.reason,
+				answer: result.answer,
+				rejectedRows: [],
+				repair: {
+					attempted: false,
+					succeeded: null
+				},
+				usage
+			};
+			const { rows, dropped, repair, reported, failure } = payload.value;
+			const repairTurn = {
+				attempted: repair !== null,
+				succeeded: repair === null ? null : failure === null
+			};
+			if (failure !== null) return {
+				status: "failed",
+				failure,
+				answer: result.answer,
+				rejectedRows: dropped,
+				repair: repairTurn,
+				usage
+			};
+			const row = rows[0];
+			if (row === void 0) return {
+				status: "declined",
+				answer: result.answer,
+				reportedRows: reported,
+				rejectedRows: dropped,
+				repair: repairTurn,
+				usage
+			};
+			return {
+				status: "finding",
+				k: row.k,
+				failureClaim: row.failureClaim,
+				intervention: {
+					kind: row.kind,
+					action: row.action
+				},
+				answer: result.answer,
+				reportedRows: reported,
+				rejectedRows: dropped,
+				repair: repairTurn,
+				usage
+			};
+		}
+	};
+}
+/**
+* Read the bridge's typed repair block.
+*
+* Structure is checked and fails loud: a missing block, a wrong signature, or
+* a row that does not carry an integer k and a non-empty action is a wiring
+* fault with a reason — never a default, and never an empty list that would
+* grade as a decline the program did not make. A structurally sound row whose
+* k is not a recorded step id is the model's mistake, and it is dropped with
+* its reason instead.
+*/
+function readRepairPayload(runtime, options) {
+	const block = runtime.repair;
+	if (!isRecord(block)) return {
+		ok: false,
+		reason: "the engine returned no runtime.repair block; the bridge did not run the typed repair signature"
+	};
+	if (block.signature !== "tb-repair-typed-v1") return {
+		ok: false,
+		reason: `runtime.repair.signature is ${describe(block.signature)}, expected "${DSPY_REPAIR_SIGNATURE}"`
+	};
+	if (!Number.isSafeInteger(block.reported) || block.reported < 0) return {
+		ok: false,
+		reason: `runtime.repair.reported must be a non-negative integer, got ${describe(block.reported)}`
+	};
+	if (!Array.isArray(block.rows)) return {
+		ok: false,
+		reason: "runtime.repair.rows must be an array"
+	};
+	const repair = block.repair;
+	if (repair !== null && typeof repair !== "string") return {
+		ok: false,
+		reason: `runtime.repair.repair must be a string or null, got ${describe(repair)}`
+	};
+	const rawFailure = block.failure;
+	if (rawFailure !== void 0 && rawFailure !== null && typeof rawFailure !== "string") return {
+		ok: false,
+		reason: `runtime.repair.failure must be a string or null, got ${describe(rawFailure)}`
+	};
+	const failure = typeof rawFailure === "string" ? rawFailure : null;
+	const dropped = [];
+	if (block.dropped !== void 0) {
+		if (!Array.isArray(block.dropped)) return {
+			ok: false,
+			reason: "runtime.repair.dropped must be an array"
+		};
+		for (const [index, raw] of block.dropped.entries()) {
+			if (!isRecord(raw) || typeof raw.reason !== "string") return {
+				ok: false,
+				reason: `runtime.repair.dropped[${index}] must carry a reason string`
+			};
+			dropped.push({
+				index: Number.isSafeInteger(raw.index) ? raw.index : index,
+				reason: raw.reason
+			});
+		}
+	}
+	const rows = [];
+	for (const [index, raw] of block.rows.entries()) {
+		const decoded = decodeRepairRow(raw);
+		if (!decoded.ok) return {
+			ok: false,
+			reason: `runtime.repair.rows[${index}]: ${decoded.reason}`
+		};
+		if (!options.validSteps.includes(decoded.row.k)) {
+			dropped.push({
+				index,
+				reason: `k must be a recorded step_id in [${options.validSteps[0] ?? 1}, ${options.validSteps[options.validSteps.length - 1] ?? 1}], got ${decoded.row.k}`
+			});
+			continue;
+		}
+		if (rows.length >= 1) {
+			dropped.push({
+				index,
+				reason: "exceeds the one-repair cap"
+			});
+			continue;
+		}
+		rows.push(decoded.row);
+	}
+	return {
+		ok: true,
+		value: {
+			signature: DSPY_REPAIR_SIGNATURE,
+			reported: block.reported,
+			rows,
+			dropped,
+			repair: repair ?? null,
+			failure
+		}
+	};
+}
+function decodeRepairRow(raw) {
+	if (!isRecord(raw)) return {
+		ok: false,
+		reason: "not an object"
+	};
+	const k = raw.k;
+	if (!Number.isInteger(k) || k < 1) return {
+		ok: false,
+		reason: `k must be a positive integer, got ${describe(k)}`
+	};
+	const claim = raw.failure_claim;
+	if (typeof claim !== "string" || claim.trim().length === 0) return {
+		ok: false,
+		reason: "failure_claim must be a non-empty string"
+	};
+	const intervention = raw.intervention;
+	if (!isRecord(intervention)) return {
+		ok: false,
+		reason: "intervention must be an object with kind and action"
+	};
+	const kind = intervention.kind;
+	if (kind !== "shell" && kind !== "edit") return {
+		ok: false,
+		reason: `intervention.kind must be "shell" or "edit", got ${describe(kind)}`
+	};
+	const action = intervention.action;
+	if (typeof action !== "string" || action.length === 0) return {
+		ok: false,
+		reason: "intervention.action must be a non-empty string"
+	};
+	return {
+		ok: true,
+		row: {
+			k,
+			failureClaim: claim.trim(),
+			kind,
+			action
+		}
+	};
+}
+/**
+* The engine reports model calls; token counts and cost live in the caller's
+* cost ledger, which meters the proxy the engine ran through. Reporting them
+* here as zero would state a measurement this arm did not make.
+*/
+function engineUsage(modelCalls) {
+	return {
+		calls: modelCalls,
+		inputTokens: null,
+		outputTokens: null,
+		costUsd: null
+	};
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function describe(value) {
+	if (value === null) return "null";
+	if (value === void 0) return "undefined";
+	return typeof value === "string" ? JSON.stringify(value) : String(value);
+}
+/** Thrown by callers that build a repair arm with a non-DSPy engine. */
+function assertDspyRepairEngine(engine) {
+	if (engine.id !== "dspy-rlm") throw new ValidationError(`the DSPy repair arm needs the dspy-rlm engine, got '${engine.id}'; another engine does not run the typed repair signature and would answer a different contract`);
+}
+//#endregion
+//#region src/trace-repair/continuation-records.ts
+/**
+* Project a full message list into corpus steps: the system and task messages
+* become their own steps, and every assistant turn carries the command it
+* requested plus the observation that answered it. A trailing assistant turn
+* with no answer keeps `obs: null`, which is how the corpus records a run that
+* ended on its last command.
+*/
+function toRecordedSteps(messages) {
+	const steps = [];
+	for (let i = 0; i < messages.length; i += 1) {
+		const message = messages[i];
+		if (!message) continue;
+		if (message.role === "assistant") {
+			const parsed = parseAction(message.content);
+			const next = messages[i + 1];
+			steps.push({
+				src: "agent",
+				msg: message.content,
+				tools: parsed.kind === "action" ? [{
+					fn: "bash_command",
+					cmd: parsed.command
+				}] : null,
+				obs: next && next.role === "user" ? next.content : null
+			});
+			continue;
+		}
+		if (message.role === "system") {
+			steps.push({
+				src: "system",
+				msg: message.content,
+				tools: null,
+				obs: null
+			});
+			continue;
+		}
+		const previous = messages[i - 1];
+		if (!previous || previous.role === "system") steps.push({
+			src: "user",
+			msg: message.content,
+			tools: null,
+			obs: null
+		});
+	}
+	return steps;
+}
+/** Corpus steps for the continuation alone, excluding the prefix it inherited. */
+function rolloutRecordedSteps(rollout) {
+	return rollout.steps.map((step) => ({
+		src: "agent",
+		msg: step.assistantMessage,
+		tools: step.action === null ? null : [{
+			fn: "bash_command",
+			cmd: step.action
+		}],
+		obs: step.observation
+	}));
+}
+/**
+* Hash over everything the policy determines: the actions taken, the
+* observations they produced, the seeds, the exit, and the usage.
+*
+* Wall-clock fields are excluded because they vary between identical runs;
+* two rollouts with the same digest did the same work, whatever they cost in
+* seconds. Use it to assert determinism, never to assert equal latency.
+*/
+function rolloutDigest(rollout) {
+	return contentHash({
+		arm: rollout.arm,
+		rowId: rollout.rowId,
+		index: rollout.index,
+		seed: rollout.seed,
+		policyDigest: rollout.policyDigest,
+		exitStatus: rollout.exitStatus,
+		submission: rollout.submission,
+		usage: rollout.usage,
+		costUsd: rollout.costProvenance.usd,
+		costKind: rollout.costProvenance.kind,
+		steps: rollout.steps.map((step) => ({
+			step: step.step,
+			assistantMessage: step.assistantMessage,
+			action: step.action,
+			observation: step.observation,
+			returncode: step.execution?.returncode ?? null,
+			timedOut: step.execution?.timedOut ?? null,
+			seed: step.model.seed,
+			servedModel: step.model.servedModel,
+			usage: step.model.usage,
+			costUsd: step.model.costUsd
+		}))
+	});
+}
+//#endregion
+//#region src/trace-repair/degenerate-strategies.ts
+const DEGENERATE_STRATEGIES = [
+	{
+		id: "point-at-any-nonzero-exit-step",
+		strategy: "Name the first step with a nonzero returncode, claim it failed, and let the reproduction gate confirm it.",
+		defeat: "Reproduction is a gate, not a tier that pays. The credit vector has no term for it, so a reproduced step with no working intervention scores exactly what an unreproduced one scores: nothing.",
+		defeatKind: "gate",
+		enforcedIn: "funnel.ts (repairCredit has no reproduction term)"
+	},
+	{
+		id: "propose-the-recorded-command-again",
+		strategy: "Return the action the agent already ran at step k, so the arm reproduces the recorded state and looks like a faithful replay.",
+		defeat: "The intervention is compared against the recorded action at k after whitespace normalisation and rejected before a container opens.",
+		defeatKind: "gate",
+		enforcedIn: "grade.ts (recorded-action-reproposed rejection)"
+	},
+	{
+		id: "propose-a-no-op",
+		strategy: "Return an action that changes nothing, so the arm inherits whatever the trajectory would have done anyway.",
+		defeat: "Literal no-ops are rejected at the budget check. A semantic no-op cannot be detected syntactically, so it runs and measures at the no-op control floor: its paired delta is zero.",
+		defeatKind: "measurement",
+		enforcedIn: "action-budget.ts (NO_OP_ACTIONS) and delta-repair.ts (paired delta)"
+	},
+	{
+		id: "submit-instead-of-repair",
+		strategy: "Return the submit sentinel so the run ends immediately and the arm terminates cleanly.",
+		defeat: "An action carrying the submit sentinel is rejected at the budget check. Ending the run is what the recorded agent already did and the tests already failed on it.",
+		defeatKind: "gate",
+		enforcedIn: "action-budget.ts (SUBMIT_SENTINEL rejection)"
+	},
+	{
+		id: "touch-the-test-suite",
+		strategy: "Write a passing suite, or a reward file, at the path the grader will read, so the oracle grades the trajectory's own artifact.",
+		defeat: "The oracle purges the suite root and uploads the held-out suite from outside the session at grade time, then verifies the bytes it reads back. A planted suite is overwritten; a session that refuses the overwrite raises a tamper error instead of returning a pass.",
+		defeatKind: "gate",
+		enforcedIn: "test-oracle.ts (purge, upload, read-back digest)"
+	},
+	{
+		id: "buy-a-bigger-action",
+		strategy: "Return a multi-command script or a whole-file rewrite that does far more than one scaffold turn could.",
+		defeat: "The budget counts top-level statements, heredocs and bytes. More than one action, more than one authored file, or more than 4 KB is rejected before a container opens.",
+		defeatKind: "gate",
+		enforcedIn: "action-budget.ts (checkInterventionBudget)"
+	},
+	{
+		id: "decline-every-hard-row",
+		strategy: "Answer no-decisive-failure on everything except the rows that are obviously repairable, so the reported rate is computed on an easy subset.",
+		defeat: "A declined row keeps its cell in the funnel and stays in the denominator with a paired delta of zero, because its intervention arm is definitionally its control arm. Declining cannot raise the headline; it can only dilute it.",
+		defeatKind: "measurement",
+		enforcedIn: "grade.ts (declined outcome) and delta-repair.ts (full admitted denominator)"
+	},
+	{
+		id: "repair-somewhere-other-than-k",
+		strategy: "Name a plausible-looking k, then submit an intervention that fixes the task from any state, so the answer scores without localising anything.",
+		defeat: "The intervention is executed at the k the analyst named, on the state produced by replaying steps 1..k-1. There is no separate localisation credit to win and no label the grader reads, so a wrong k is only penalised through the repair failing to work there.",
+		defeatKind: "measurement",
+		enforcedIn: "grade.ts (the intervention is applied at the named k only)"
+	}
+];
+function degenerateStrategy(id) {
+	const found = DEGENERATE_STRATEGIES.find((entry) => entry.id === id);
+	if (!found) throw new Error(`unknown degenerate strategy: ${id}`);
+	return found;
+}
+//#endregion
+//#region src/trace-repair/funnel.ts
+const CREDIT_TERMS = [
+	"executes",
+	"localFlip",
+	"repairRate"
+];
+const ZERO_CREDIT = Object.freeze({
+	executes: 0,
+	localFlip: 0,
+	repairRate: 0
+});
+/** What an answer earned. Every outcome but `measured` earns nothing. */
+function repairCredit(grade) {
+	if (grade.outcome !== "measured") return ZERO_CREDIT;
+	return {
+		executes: 1,
+		localFlip: grade.localFlip.passed ? 1 : 0,
+		repairRate: grade.repair.rollouts === 0 ? 0 : grade.repair.passes / grade.repair.rollouts
+	};
+}
+/** True once the answer is a well-formed, budget-admissible answer. A decline
+*  is well formed, so it parses. */
+function reachedT0(grade) {
+	return grade.outcome !== "rejected";
+}
+/** True once the recorded state at k came back. A decline never reaches the
+*  gate, because it names no k. */
+function reachedT1(grade) {
+	return grade.outcome === "did-not-execute" || grade.outcome === "measured";
+}
+/** True once the intervention ran at k and exited cleanly. */
+function reachedT2(grade) {
+	return grade.outcome === "measured";
+}
+function countFunnel(grades) {
+	let rejected = 0;
+	let declined = 0;
+	let t1 = 0;
+	let t2 = 0;
+	let t3 = 0;
+	let t4Any = 0;
+	let t4All = 0;
+	for (const grade of grades) {
+		if (grade.outcome === "rejected") rejected += 1;
+		if (grade.outcome === "declined") declined += 1;
+		if (reachedT1(grade)) t1 += 1;
+		if (reachedT2(grade)) t2 += 1;
+		if (grade.outcome === "measured") {
+			if (grade.localFlip.passed) t3 += 1;
+			if (grade.repair.passes > 0) t4Any += 1;
+			if (grade.repair.rollouts > 0 && grade.repair.passes === grade.repair.rollouts) t4All += 1;
+		}
+	}
+	return {
+		rows: grades.length,
+		rejected,
+		declined,
+		t0Parsed: grades.length - rejected,
+		t1Reproduced: t1,
+		t2Executed: t2,
+		t3LocalFlip: t3,
+		t4RepairFlipAny: t4Any,
+		t4RepairFlipAll: t4All
+	};
+}
+//#endregion
+//#region src/trace-repair/delta-repair.ts
+/**
+* The headline metric.
+*
+*   Delta-repair = P(tests pass | intervention) − P(tests pass | no-fix control)
+*
+* Paired per row, then bootstrapped over rows. Paired because the rows differ
+* enormously from each other and not at all between arms: the same trajectory,
+* the same image, the same held-out suite, the same continuation policy, and
+* one difference — the state the continuation starts from.
+*
+* Every admitted row stays in the denominator, including the ones an analyst
+* declined and the ones whose answer was rejected. Those rows contribute a
+* paired difference of exactly zero, because with no intervention to run their
+* arm IS their control arm. Declining is therefore free of error and free of
+* reward, which is what makes it an honest answer rather than a way to pick an
+* easy subset.
+*
+* The report never collapses to this one number. The funnel counts, the rates
+* on measured rows alone, the per-row table and the threats travel with it,
+* because a difference of means computed on a corpus that was admitted on the
+* control failing is conditional on that admission and the reader has to see
+* it to price it.
+*/
+function deltaRepair(rowResults, options = {}) {
+	if (rowResults.length === 0) throw new ValidationError("deltaRepair needs at least one graded row");
+	const seen = /* @__PURE__ */ new Set();
+	for (const row of rowResults) {
+		if (seen.has(row.rowId)) throw new ValidationError(`deltaRepair received row ${row.rowId} twice`);
+		seen.add(row.rowId);
+	}
+	const funnel = countFunnel(rowResults.map((row) => row.grade));
+	const control = rowResults.map((row) => row.controlRate);
+	const intervention = rowResults.map((row) => row.interventionRate);
+	const deltaAll = interval(control, intervention, options);
+	const measured = rowResults.filter((row) => row.grade.outcome === "measured");
+	const measuredOnly = measured.length === 0 ? emptyInterval(options) : interval(measured.map((row) => row.controlRate), measured.map((row) => row.interventionRate), options);
+	return {
+		rows: rowResults.length,
+		funnel,
+		interventionRate: mean(intervention),
+		controlRate: mean(control),
+		deltaRepair: deltaAll,
+		measuredOnly,
+		measuredRows: measured.length,
+		rowResults,
+		threats: collectThreats(rowResults, funnel, deltaAll)
+	};
+}
+function interval(control, intervention, options) {
+	const result = pairedBootstrap([...control], [...intervention], {
+		statistic: "mean",
+		seed: options.seed,
+		resamples: options.resamples,
+		confidence: options.confidence
+	});
+	return {
+		n: result.n,
+		mean: result.mean,
+		median: result.median,
+		low: result.low,
+		high: result.high,
+		confidence: result.confidence,
+		resamples: result.resamples,
+		gateEligible: result.gateEligible
+	};
+}
+function emptyInterval(options) {
+	return {
+		n: 0,
+		mean: 0,
+		median: 0,
+		low: 0,
+		high: 0,
+		confidence: options.confidence ?? .95,
+		resamples: options.resamples ?? 2e3,
+		gateEligible: false
+	};
+}
+function collectThreats(rowResults, funnel, delta) {
+	const threats = [{
+		id: "control-position-asymmetry",
+		statement: "The no-fix control continues from the recorded end state, while the intervention arm continues from step k and has to redo the work the recording did after k inside the same step budget. The arms are matched on policy and budget, not on position.",
+		direction: "understates"
+	}];
+	const inert = rowResults.filter((row) => row.controlScreening === "declared-inert");
+	if (inert.length > 0) threats.push({
+		id: "control-cannot-rescue",
+		statement: `${inert.length}/${rowResults.length} rows were screened under a control that makes no model call, so its rollouts graded the same bytes the end-state check graded as failing. A control rate of zero on those rows is a restatement of the end-state check, not a measurement of what continuing alone can repair.`,
+		direction: "unknown"
+	});
+	if (inert.length === 0 && rowResults.every((row) => row.controlRate === 0)) threats.push({
+		id: "admission-conditions-on-control-failure",
+		statement: "Every row was admitted on its no-fix control failing every rollout, so the control rate is zero everywhere and Delta-repair equals the intervention rate. The estimate is conditional on that admission and does not describe rows the control can already repair.",
+		direction: "unknown"
+	});
+	if (!delta.gateEligible) threats.push({
+		id: "bootstrap-below-min-n",
+		statement: `The interval covers ${delta.n} paired rows, below the 20 where a percentile bootstrap holds its nominal error rate. Read it as descriptive spread; a promotion must not turn on it.`,
+		direction: "unknown"
+	});
+	const divergent = rowResults.filter((row) => measuredPrefixDivergences(row.grade) > 0).length;
+	if (divergent > 0) threats.push({
+		id: "prefix-divergence-present",
+		statement: `${divergent}/${rowResults.length} rows replayed at least one prefix step to a different exit code than the recording. The state the intervention landed on is close to the recorded one, not identical to it.`,
+		direction: "unknown"
+	});
+	const withFailures = rowResults.filter((row) => row.grade.outcome === "measured" && row.grade.repair.interventionFailures > 0).length;
+	if (withFailures > 0) threats.push({
+		id: "intervention-failures-present",
+		statement: `${withFailures} rows had at least one rollout where the intervention failed to run after it had already run cleanly in the local-flip session. Those rollouts count as non-passes.`,
+		direction: "understates"
+	});
+	if (delta.low === delta.high) threats.push({
+		id: "zero-variance-interval",
+		statement: "Every resample produced the same statistic, so the interval has zero width. That is an absence of variation in the data, not certainty about the effect.",
+		direction: "unknown"
+	});
+	if (funnel.declined + funnel.rejected > funnel.rows / 2) threats.push({
+		id: "declines-carry-the-denominator",
+		statement: `${funnel.declined} declined and ${funnel.rejected} rejected of ${funnel.rows} rows contribute a paired delta of zero. The headline is dominated by rows where no intervention ran.`,
+		direction: "understates"
+	});
+	return threats;
+}
+function measuredPrefixDivergences(grade) {
+	if (grade.outcome === "measured" || grade.outcome === "did-not-execute") return grade.execution.prefix.divergences;
+	if (grade.outcome === "not-reproduced" && grade.reproduction.basis !== "no-recorded-observation") return grade.reproduction.prefix.divergences;
+	return 0;
+}
+function mean(values) {
+	return values.reduce((sum, value) => sum + value, 0) / values.length;
+}
+/** Markdown report: provenance, the funnel, every per-row column, the
+*  distribution, and the threats. */
+function renderDeltaRepairReport(report) {
+	const lines = [];
+	const pct = (value) => `${(value * 100).toFixed(1)} %`;
+	lines.push("# Delta-repair");
+	lines.push("");
+	lines.push(`**${signed(report.deltaRepair.mean)}** paired mean over ${report.rows} admitted rows (${(report.deltaRepair.confidence * 100).toFixed(0)} % CI ${signed(report.deltaRepair.low)} … ${signed(report.deltaRepair.high)}, ${report.deltaRepair.resamples} resamples, gate-eligible: ${report.deltaRepair.gateEligible}).`);
+	lines.push("");
+	lines.push(`P(tests pass | intervention) = ${pct(report.interventionRate)}; P(tests pass | no-fix control) = ${pct(report.controlRate)}.`);
+	lines.push("");
+	lines.push("## Funnel");
+	lines.push("");
+	lines.push("| cell | rows | share |");
+	lines.push("| --- | --- | --- |");
+	const f = report.funnel;
+	const share = (value) => pct(f.rows === 0 ? 0 : value / f.rows);
+	for (const [label, value] of [
+		["admitted rows", f.rows],
+		["t0 parsed", f.t0Parsed],
+		["t1 reproduced (gate, pays nothing)", f.t1Reproduced],
+		["t2 intervention executes", f.t2Executed],
+		["t3 local flip", f.t3LocalFlip],
+		["t4 repair flip (any rollout)", f.t4RepairFlipAny],
+		["t4 repair flip (every rollout)", f.t4RepairFlipAll],
+		["no-decisive-failure", f.declined],
+		["rejected", f.rejected]
+	]) lines.push(`| ${label} | ${value} | ${share(value)} |`);
+	lines.push("");
+	lines.push("## Rows");
+	lines.push("");
+	lines.push("| row | outcome | k | reproduction basis | reproduced | intervention exit | local flip | repair passes | rollouts | intervention failures | prefix steps | prefix divergences | P(int) | P(ctl) | delta | wall ms |");
+	lines.push("| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |");
+	for (const row of report.rowResults) lines.push(`| ${rowCells(row).join(" | ")} |`);
+	lines.push("");
+	lines.push("## Measured rows only");
+	lines.push("");
+	lines.push(`${report.measuredRows} rows reached t2. Paired mean ${signed(report.measuredOnly.mean)} (CI ${signed(report.measuredOnly.low)} … ${signed(report.measuredOnly.high)}). Conditional on the analyst answering, so it is not the headline.`);
+	lines.push("");
+	lines.push("## Threats");
+	lines.push("");
+	for (const threat of report.threats) lines.push(`- **${threat.id}** (${threat.direction} the effect) — ${threat.statement}`);
+	lines.push("");
+	return lines.join("\n");
+}
+function rowCells(row) {
+	const grade = row.grade;
+	const reproduction = grade.outcome === "not-reproduced" || grade.outcome === "did-not-execute" || grade.outcome === "measured" ? grade.reproduction : null;
+	const execution = grade.outcome === "did-not-execute" || grade.outcome === "measured" ? grade.execution : null;
+	const repair = grade.outcome === "measured" ? grade.repair : null;
+	const prefix = execution?.prefix ?? (reproduction && reproduction.basis !== "no-recorded-observation" ? reproduction.prefix : null);
+	const rejection = grade.outcome === "rejected" ? `rejected: ${grade.rejection.reason}` : grade.outcome;
+	return [
+		row.rowId,
+		rejection,
+		grade.outcome === "rejected" || grade.outcome === "declined" ? "—" : String(grade.k),
+		reproduction ? reproduction.basis : "—",
+		reproduction ? String(reproduction.reproduced) : "—",
+		execution ? String(execution.exitCode) : "—",
+		grade.outcome === "measured" ? String(grade.localFlip.passed) : "—",
+		repair ? String(repair.passes) : "—",
+		repair ? String(repair.rollouts) : "0",
+		repair ? String(repair.interventionFailures) : "—",
+		prefix ? String(prefix.stepsReplayed) : "—",
+		prefix ? String(prefix.divergences) : "—",
+		row.interventionRate.toFixed(3),
+		row.controlRate.toFixed(3),
+		signed(row.delta),
+		String(row.wallMs)
+	];
+}
+function signed(value) {
+	const points = value * 100;
+	return `${points >= 0 ? "+" : ""}${points.toFixed(1)} pp`;
+}
+//#endregion
+//#region src/trace-repair/docker-environment.ts
+/**
+* Docker-backed continuation environment.
+*
+* The runner refuses any container whose network mode is not `none`, so this
+* builds containers that way and reports the mode it reads back from the
+* daemon rather than the mode it asked for. A container created elsewhere and
+* attached here is described the same way, so an environment that quietly kept
+* its network is rejected instead of producing evidence.
+*
+* Commands are bounded twice. `timeout` inside the container is the primary
+* bound, because killing the host-side `docker exec` client leaves the process
+* it started running in the container, where it would keep writing files under
+* later steps. The host-side kill is a backstop for a daemon that stops
+* answering. The container must therefore provide `timeout`; `describe()`
+* checks for it and refuses the container when it is absent.
+*/
+/**
+* Spawns a process, merges stdout and stderr the way the scaffold reads them,
+* and kills the whole process group on timeout so a killed command leaves no
+* children running in the container's namespace.
+*/
+const nodeProcessRunner = (request) => new Promise((resolve, reject) => {
+	const [command, ...args] = request.argv;
+	if (!command) {
+		reject(new ValidationError("process runner requires a command"));
+		return;
+	}
+	const child = spawn(command, args, {
+		detached: true,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	const chunks = [];
+	let timedOut = false;
+	child.stdout.setEncoding("utf8");
+	child.stderr.setEncoding("utf8");
+	child.stdout.on("data", (chunk) => chunks.push(chunk));
+	child.stderr.on("data", (chunk) => chunks.push(chunk));
+	const timer = request.timeoutSeconds === void 0 ? void 0 : setTimeout(() => {
+		timedOut = true;
+		if (child.pid === void 0) return;
+		try {
+			process.kill(-child.pid, "SIGKILL");
+		} catch (error) {
+			if (error.code !== "ESRCH") reject(error);
+		}
+	}, request.timeoutSeconds * 1e3);
+	child.on("error", (error) => {
+		if (timer) clearTimeout(timer);
+		reject(error);
+	});
+	child.on("close", (code, signal) => {
+		if (timer) clearTimeout(timer);
+		const output = chunks.join("");
+		if (code !== null) {
+			resolve({
+				output,
+				exitCode: code,
+				timedOut
+			});
+			return;
+		}
+		const signalNumber = signal === null ? void 0 : constants.signals[signal];
+		if (signalNumber === void 0) {
+			reject(new ValidationError(`process closed with no exit code and no known signal: ${signal}`));
+			return;
+		}
+		resolve({
+			output,
+			exitCode: -signalNumber,
+			timedOut
+		});
+	});
+});
+const DEFAULT_INTERPRETER = ["bash", "-lc"];
+const DEFAULT_EXECUTABLE = "docker";
+/** Seconds `timeout` waits after SIGTERM before sending SIGKILL. */
+const KILL_GRACE_SECONDS = 5;
+/** Extra seconds the host-side backstop waits after the in-container bound. */
+const BACKSTOP_SECONDS = 10;
+/** `timeout` reports this when it stopped the command. */
+const TIMEOUT_EXIT_CODE = 124;
+/**
+* Arguments that create a container the policy accepts. `--network none` is
+* not optional: a continuation with network access could install what the
+* recorded run could not, and the arms would no longer differ only by the
+* intervention.
+*/
+function dockerRunArgs(input) {
+	return [
+		input.executable ?? DEFAULT_EXECUTABLE,
+		"run",
+		"-d",
+		"--name",
+		input.name,
+		"--network",
+		"none",
+		"-w",
+		input.cwd,
+		"--rm",
+		input.image,
+		"sleep",
+		input.containerLifetime ?? "2h"
+	];
+}
+function createDockerContinuationEnvironment(options) {
+	if (!options.containerRef.trim()) throw new ValidationError("docker continuation environment requires a container reference");
+	const executable = options.executable ?? DEFAULT_EXECUTABLE;
+	const interpreter = options.interpreter ?? DEFAULT_INTERPRETER;
+	const envEntries = Object.entries(options.env ?? {});
+	return {
+		containerRef: options.containerRef,
+		async describe() {
+			const inspect = await options.runProcess({ argv: [
+				executable,
+				"inspect",
+				"--format",
+				"{{.HostConfig.NetworkMode}}	{{.Config.Image}}",
+				options.containerRef
+			] });
+			if (inspect.exitCode !== 0) throw new ValidationError(`docker inspect failed for ${options.containerRef} (exit ${inspect.exitCode}): ${inspect.output.trim()}`);
+			const [networkMode, image] = inspect.output.trim().split("	");
+			if (!networkMode) throw new ValidationError(`docker inspect returned no network mode for ${options.containerRef}`);
+			if ((await options.runProcess({ argv: [
+				executable,
+				"exec",
+				options.containerRef,
+				...interpreter,
+				"command -v timeout"
+			] })).exitCode !== 0) throw new ValidationError(`container ${options.containerRef} provides no \`timeout\`, so a long command cannot be bounded inside it`);
+			return image ? {
+				networkMode,
+				image
+			} : { networkMode };
+		},
+		async exec(command, execOptions) {
+			const argv = [
+				executable,
+				"exec",
+				"-w",
+				options.cwd
+			];
+			for (const [key, value] of envEntries) argv.push("-e", `${key}=${value}`);
+			argv.push(options.containerRef, "timeout", `--kill-after=${KILL_GRACE_SECONDS}s`, `${execOptions.timeoutSeconds}s`, ...interpreter, command);
+			const result = await options.runProcess({
+				argv,
+				timeoutSeconds: execOptions.timeoutSeconds + KILL_GRACE_SECONDS + BACKSTOP_SECONDS
+			});
+			const timedOut = result.timedOut || result.exitCode === TIMEOUT_EXIT_CODE;
+			return {
+				output: result.output,
+				returncode: result.exitCode,
+				timedOut
+			};
+		},
+		async dispose() {
+			if (!options.removeOnDispose) return;
+			await options.runProcess({ argv: [
+				executable,
+				"rm",
+				"-f",
+				options.containerRef
+			] });
+		}
+	};
+}
+//#endregion
+//#region src/trace-repair/grade.ts
+/**
+* Grade one analyst answer about one admitted row.
+*
+* The whole funnel runs here, in the order that spends the least before it
+* knows: parse and budget checks open no container, the reproduction gate
+* opens one, the local flip opens one more, and only then does the repair arm
+* pay for its rollouts.
+*
+* Two properties a reviewer should be able to check by reading this file:
+*
+* The intervention is applied at the k the analyst named, on the state
+* produced by replaying steps 1..k-1, and nowhere else. There is no search
+* over nearby steps, no credit for being close, and no label in scope — the
+* grader never receives one. A wrong k therefore scores zero the only honest
+* way it can: the repair has to work where the analyst said the failure was.
+*
+* The row must arrive branded by `admitRow`. That is the type-level form of
+* "admission runs before any analyst sees a row": there is no signature here
+* that accepts an unadmitted row.
+*/
+/** Rollouts of the repair arm disagreed with the controls about the policy. */
+var RepairArmSymmetryError = class extends CaptureIntegrityError {};
+const DEFAULT_STEP_TIMEOUT_MS = 3e5;
+const OUTPUT_EXCERPT_CHARS = 4e3;
+async function gradeRepairRow(options) {
+	const startedMs = Date.now();
+	const grade = await produceGrade(options);
+	return finish(options.row, grade, startedMs);
+}
+function finish(row, grade, startedMs) {
+	const credit = repairCredit(grade);
+	const interventionRate = grade.outcome === "measured" ? credit.repairRate : row.controlRate;
+	return {
+		rowId: row.rowId,
+		grade,
+		credit,
+		interventionRate,
+		controlRate: row.controlRate,
+		controlRollouts: row.controlRollouts,
+		controlScreening: row.controlScreening,
+		controlPolicyDigest: row.policyDigest,
+		repairRollouts: grade.outcome === "measured" ? grade.repair.rollouts : 0,
+		delta: interventionRate - row.controlRate,
+		wallMs: Date.now() - startedMs
+	};
+}
+async function produceGrade(options) {
+	const { row, response } = options;
+	if (response.kind === "no-decisive-failure") return { outcome: "declined" };
+	const target = targetStep(row, response);
+	if (!target.ok) return target.grade;
+	const budget = options.budget ?? SCAFFOLD_INTERVENTION_BUDGET;
+	const check = checkInterventionBudget(response.intervention.action, response.intervention.kind, budget);
+	if (!check.admissible) return {
+		outcome: "rejected",
+		rejection: {
+			source: "budget",
+			reason: check.violation,
+			detail: check.detail,
+			measurement: check.measurement
+		}
+	};
+	if (normalizeActionForComparison(response.intervention.action) === normalizeActionForComparison(target.step.action)) return {
+		outcome: "rejected",
+		rejection: {
+			source: "target",
+			reason: "recorded-action-reproposed",
+			detail: `the intervention is the action already recorded at step ${response.k}`
+		}
+	};
+	const reproduction = await runReproductionGate(options, response, target.step);
+	if (!reproduction.reproduced) return {
+		outcome: "not-reproduced",
+		k: response.k,
+		reproduction
+	};
+	const local = await runLocalFlip(options, response);
+	if (local.kind === "did-not-execute") return {
+		outcome: "did-not-execute",
+		k: response.k,
+		reproduction,
+		execution: local.execution
+	};
+	const repair = await runRepairArm(options, response);
+	return {
+		outcome: "measured",
+		k: response.k,
+		reproduction,
+		execution: local.execution,
+		localFlip: local.tests,
+		repair
+	};
+}
+function targetStep(row, finding) {
+	if (finding.k < 1 || finding.k > row.steps.length) return {
+		ok: false,
+		grade: {
+			outcome: "rejected",
+			rejection: {
+				source: "target",
+				reason: "k-out-of-range",
+				detail: `k=${finding.k} is outside [1, ${row.steps.length}]`
+			}
+		}
+	};
+	const step = row.steps[finding.k - 1];
+	if (step.step_id !== finding.k) throw new ValidationError(`trace-repair: row ${row.rowId} steps[${finding.k - 1}].step_id=${step.step_id} != ${finding.k}; an admitted row must carry 1-based contiguous step ids`);
+	return {
+		ok: true,
+		step
+	};
+}
+async function runReproductionGate(options, finding, target) {
+	const { row } = options;
+	if (target.observation === null) {
+		options.onProgress?.(`row ${row.rowId}: step ${finding.k} recorded no observation; the reproduction gate passes vacuously`);
+		return {
+			basis: "no-recorded-observation",
+			reproduced: true
+		};
+	}
+	const recordedReturncode = parseRecordedReturncode(target.observation);
+	if (recordedReturncode === null) throw new ValidationError(`trace-repair: row ${row.rowId} step ${finding.k} carries an observation with no <returncode>; the corpus row is malformed and must not have been admitted`);
+	const signature = deriveFailureSignature(target.observation);
+	const session = await options.sessions.open({
+		rowId: row.rowId,
+		image: row.image,
+		arm: "reproduce",
+		rolloutIndex: 0
+	});
+	try {
+		const prefix = await replayPrefix(session, options, finding.k);
+		const result = await session.exec(wrapActionForExec(target.action, row.cwd), options.stepTimeoutMs ?? DEFAULT_STEP_TIMEOUT_MS);
+		const output = `${result.stdout}\n${result.stderr}`;
+		const signatureObserved = signature === null ? null : output.includes(signature);
+		const reproduced = !result.timedOut && result.exitCode === recordedReturncode && signatureObserved !== false;
+		options.onProgress?.(`row ${row.rowId}: reproduction at step ${finding.k} exit=${result.exitCode} (recorded ${recordedReturncode}) reproduced=${reproduced}`);
+		return {
+			basis: signature === null ? "returncode-only" : "returncode+output-substring",
+			reproduced,
+			recordedReturncode,
+			observedExitCode: result.exitCode,
+			signature,
+			signatureObserved,
+			prefix
+		};
+	} finally {
+		await session.close();
+	}
+}
+async function runLocalFlip(options, finding) {
+	const { row } = options;
+	const session = await options.sessions.open({
+		rowId: row.rowId,
+		image: row.image,
+		arm: "local-flip",
+		rolloutIndex: 0
+	});
+	try {
+		const prefix = await replayPrefix(session, options, finding.k);
+		const startedMs = Date.now();
+		const result = await session.exec(wrapActionForExec(finding.intervention.action, row.cwd), options.stepTimeoutMs ?? DEFAULT_STEP_TIMEOUT_MS);
+		const output = `${result.stdout}\n${result.stderr}`.trim();
+		const execution = {
+			command: finding.intervention.action,
+			exitCode: result.exitCode,
+			timedOut: result.timedOut,
+			wallMs: Date.now() - startedMs,
+			output: excerpt(output),
+			prefix
+		};
+		if (result.timedOut || result.exitCode !== 0) {
+			options.onProgress?.(`row ${row.rowId}: the intervention did not run at step ${finding.k} (exit=${result.exitCode} timedOut=${result.timedOut})`);
+			return {
+				kind: "did-not-execute",
+				execution
+			};
+		}
+		const tests = await gradeTests(options, session, "local-flip", 0);
+		options.onProgress?.(`row ${row.rowId}: local flip=${tests.passed} after the intervention at step ${finding.k}`);
+		return {
+			kind: "measured",
+			execution,
+			tests
+		};
+	} finally {
+		await session.close();
+	}
+}
+async function runRepairArm(options, finding) {
+	const { row } = options;
+	const rollouts = options.repairRollouts ?? row.controlRollouts;
+	if (!Number.isInteger(rollouts) || rollouts <= 0) throw new ValidationError(`repairRollouts must be a positive integer, got ${rollouts}`);
+	const evidence = [];
+	let passes = 0;
+	let interventionFailures = 0;
+	let policyDigest = null;
+	for (let index = 0; index < rollouts; index += 1) {
+		const session = await options.sessions.open({
+			rowId: row.rowId,
+			image: row.image,
+			arm: "intervention",
+			rolloutIndex: index
+		});
+		try {
+			await replayPrefix(session, options, finding.k);
+			const result = await session.exec(wrapActionForExec(finding.intervention.action, row.cwd), options.stepTimeoutMs ?? DEFAULT_STEP_TIMEOUT_MS);
+			if (result.timedOut || result.exitCode !== 0) {
+				interventionFailures += 1;
+				evidence.push({
+					rolloutIndex: index,
+					status: "intervention-failed",
+					interventionExitCode: result.exitCode,
+					timedOut: result.timedOut
+				});
+				continue;
+			}
+			const continuation = await options.continuation({
+				rowId: row.rowId,
+				arm: "intervention",
+				rolloutIndex: index,
+				session,
+				steps: row.steps,
+				k: finding.k,
+				injected: {
+					action: finding.intervention.action,
+					returncode: result.exitCode,
+					output: `${result.stdout}\n${result.stderr}`.trim(),
+					timedOut: result.timedOut
+				},
+				taskStatement: row.taskStatement
+			});
+			assertPolicySymmetry(row, continuation, index);
+			policyDigest = continuation.policyDigest;
+			const tests = await gradeTests(options, session, "intervention", index);
+			if (tests.passed) passes += 1;
+			evidence.push({
+				rolloutIndex: index,
+				status: "completed",
+				interventionExitCode: result.exitCode,
+				continuation,
+				tests
+			});
+			options.onProgress?.(`row ${row.rowId}: repair rollout ${index} tests=${tests.passed} after ${continuation.steps} continuation steps (${continuation.exitStatus})`);
+		} finally {
+			await session.close();
+		}
+	}
+	return {
+		rollouts,
+		passes,
+		interventionFailures,
+		policyDigest,
+		rolloutEvidence: evidence
+	};
+}
+function assertPolicySymmetry(row, continuation, index) {
+	if (continuation.policyDigest !== row.policyDigest) throw new RepairArmSymmetryError(`row ${row.rowId} repair rollout ${index} ran policy ${continuation.policyDigest} but its controls ran ${row.policyDigest}; the difference between the arms would not be the intervention`);
+}
+async function gradeTests(options, session, arm, rolloutIndex) {
+	const outcome = await options.oracle.grade(session, {
+		rowId: options.row.rowId,
+		arm,
+		rolloutIndex
+	});
+	if (outcome.suiteDigest !== options.row.suiteDigest) throw new RepairArmSymmetryError(`row ${options.row.rowId} was admitted against suite ${options.row.suiteDigest} but the ${arm} arm graded against ${outcome.suiteDigest}; the arms did not answer the same question`);
+	return {
+		passed: outcome.passed,
+		exitCode: outcome.exitCode,
+		timedOut: outcome.timedOut,
+		suiteDigest: outcome.suiteDigest
+	};
+}
+/** Replay recorded steps 1..k-1 to rebuild the state the intervention lands
+*  on. Divergence is counted and reported, never repaired. */
+async function replayPrefix(session, options, k) {
+	const { row } = options;
+	const timeoutMs = options.stepTimeoutMs ?? DEFAULT_STEP_TIMEOUT_MS;
+	const recordedTimeoutMs = options.recordedTimeoutStepMs ?? timeoutMs;
+	const startedMs = Date.now();
+	let divergences = 0;
+	let stepsReplayed = 0;
+	for (const step of row.steps.slice(0, k - 1)) {
+		const bound = isRecordedTimeout(step.observation) ? recordedTimeoutMs : timeoutMs;
+		const result = await session.exec(wrapActionForExec(step.action, row.cwd), bound);
+		stepsReplayed += 1;
+		const recorded = parseRecordedReturncode(step.observation);
+		if (recorded !== null && recorded !== result.exitCode) divergences += 1;
+	}
+	return {
+		stepsReplayed,
+		divergences,
+		wallMs: Date.now() - startedMs
+	};
+}
+function excerpt(text) {
+	if (text.length <= OUTPUT_EXCERPT_CHARS) return text;
+	const half = Math.floor(OUTPUT_EXCERPT_CHARS / 2);
+	return `${text.slice(0, half)}\n… [${text.length - OUTPUT_EXCERPT_CHARS} chars elided] …\n${text.slice(-2e3)}`;
+}
+//#endregion
+//#region src/trace-repair/oracle-determinism.ts
+/**
+* Whether a task's own grader is a function of the container state.
+*
+* A repair benchmark uses the task's held-out suite as ground truth: the suite
+* says the state before the intervention fails and the state after it passes,
+* and the difference is the measurement. That reading needs the suite to answer
+* the same way twice on the same bytes. A suite that asserts on wall clock does
+* not: the same container passes or fails by chance, so a control arm can
+* "rescue" a row nothing touched, and an intervention arm can lose a repair it
+* made.
+*
+* The check is direct. Grade the same container N times with nothing written
+* between the runs, pool the replicates by the state they graded, and read the
+* minority share.
+*
+* It reads that share per ASSERTION, not per suite, wherever the suite reports
+* assertions. A pass/fail reward is a conjunction over many assertions, so a
+* suite whose timing assertions each flip independently can still return the
+* same reward on every replicate of a state that sits far from the threshold —
+* and then return a coin flip on the states a campaign actually grades, which
+* sit near it. Per-assertion counting sees the flip at the anchor; reward
+* counting does not. A state whose replicates carried no assertion report falls
+* back to the reward and records that it did, so a coarser measurement is
+* visible rather than assumed equivalent.
+*
+* Replicates are also run under machine contention, because unanimity on an
+* idle box proves nothing about a threshold the load never approached.
+* Replicates on one state pool across both loads, so a verdict that moves when
+* the machine gets busy reads as the flip it is.
+*/
+/** A task graded a repair by something other than the state under test. */
+var NondeterministicOracleError = class extends CaptureIntegrityError {};
+/** The unit a whole-suite verdict is counted under when nothing finer exists. */
+const SUITE_REWARD_UNIT = "suite-reward";
+/** Replicates one group needs before a flip is measurable at all. */
+const MIN_ORACLE_REPLICATES = 2;
+/**
+* Reduce measured replicates to a verdict.
+*
+* Pure: it opens no container. The tool that runs the replicates hands the
+* counts here, so the rule that decides stability is one rule and a reviewer
+* can re-derive any verdict from the recorded replicates.
+*/
+function oracleDeterminism(evidence) {
+	if (evidence.groups.length === 0) throw new ValidationError(`oracle determinism for ${evidence.taskName} received no replicate group`);
+	for (const group of evidence.groups) if (group.replicates.length < 2) throw new ValidationError(`oracle determinism for ${evidence.taskName} received ${group.replicates.length} ${group.load} replicate(s) on the ${group.state} state; 2 are needed before a flip can be observed`);
+	const byState = [];
+	for (const state of ["unsolved", "solved"]) {
+		const groups = evidence.groups.filter((group) => group.state === state);
+		if (groups.length === 0) continue;
+		byState.push(stateVerdict(state, groups));
+	}
+	const flipRate = byState.reduce((worst, state) => Math.max(worst, state.flipRate), 0);
+	const replicates = byState.reduce((total, state) => total + state.replicates, 0);
+	return {
+		taskName: evidence.taskName,
+		image: evidence.image,
+		suiteDigest: evidence.suiteDigest,
+		stable: flipRate === 0,
+		replicates,
+		flipRate,
+		byState,
+		measuredAt: evidence.measuredAt,
+		detail: byState.map(describeState).join("; ")
+	};
+}
+function stateVerdict(state, groups) {
+	const replicates = groups.flatMap((group) => [...group.replicates]);
+	const passes = replicates.filter((replicate) => replicate.passed).length;
+	const rates = groups.map((group) => group.replicates.filter((r) => r.passed).length / group.replicates.length);
+	const perAssertion = replicates.every((replicate) => replicate.assertions !== null);
+	const flipped = [];
+	const assertionSetUnstable = [];
+	if (perAssertion) {
+		const outcomes = /* @__PURE__ */ new Map();
+		for (const replicate of replicates) for (const assertion of replicate.assertions ?? []) {
+			const seen = outcomes.get(assertion.id);
+			if (seen) seen.push(assertion.passed);
+			else outcomes.set(assertion.id, [assertion.passed]);
+		}
+		for (const [id, results] of [...outcomes].sort(([a], [b]) => a.localeCompare(b))) {
+			if (results.length !== replicates.length) assertionSetUnstable.push(id);
+			const unitPasses = results.filter(Boolean).length;
+			const unitFails = results.length - unitPasses;
+			const minority = Math.min(unitPasses, unitFails);
+			const absent = replicates.length - results.length;
+			if (minority + absent > 0) flipped.push({
+				unit: id,
+				passes: unitPasses,
+				fails: unitFails + absent,
+				flipRate: (minority + absent) / replicates.length
+			});
+		}
+	} else {
+		const minority = Math.min(passes, replicates.length - passes);
+		if (minority > 0) flipped.push({
+			unit: SUITE_REWARD_UNIT,
+			passes,
+			fails: replicates.length - passes,
+			flipRate: minority / replicates.length
+		});
+	}
+	return {
+		state,
+		replicates: replicates.length,
+		passes,
+		fails: replicates.length - passes,
+		granularity: perAssertion ? "per-assertion" : "reward",
+		flipRate: flipped.reduce((worst, unit) => Math.max(worst, unit.flipRate), 0),
+		flipped,
+		assertionSetUnstable,
+		loadSensitive: new Set(rates).size > 1,
+		rewardsObserved: [...new Set(replicates.map((r) => r.reward ?? "NO_REWARD_FILE"))].sort()
+	};
+}
+function describeState(state) {
+	const base = `${state.state}: ${state.passes}/${state.replicates} suite pass, ${state.granularity} counting`;
+	if (state.flipped.length === 0) return `${base}, no flip`;
+	const worst = state.flipped.reduce((a, b) => b.flipRate > a.flipRate ? b : a);
+	return `${base}, ${state.flipped.length} unit(s) flipped, worst ${worst.unit} ${worst.passes}/${worst.passes + worst.fails} pass` + (state.loadSensitive ? " (load-sensitive)" : "");
+}
+function parseTaskOracleRegistry(document) {
+	if (typeof document !== "object" || document === null) throw new ValidationError("task oracle registry must be an object");
+	const { version, measurements } = document;
+	if (version !== 1) throw new ValidationError(`task oracle registry version must be 1, got ${String(version)}`);
+	if (!Array.isArray(measurements)) throw new ValidationError("task oracle registry needs a measurements array");
+	return taskOracleRegistry(measurements.map((evidence) => oracleDeterminism(evidence)));
+}
+function taskOracleRegistry(verdicts) {
+	const registry = /* @__PURE__ */ new Map();
+	for (const verdict of verdicts) {
+		if (registry.has(verdict.taskName)) throw new ValidationError(`task oracle registry received ${verdict.taskName} twice; a task has one certification`);
+		registry.set(verdict.taskName, verdict);
+	}
+	return registry;
+}
+/** Throws unless the task graded the same bytes the same way every replicate. */
+function assertDeterministicOracle(verdict) {
+	if (verdict.stable) return;
+	throw new NondeterministicOracleError(`task ${verdict.taskName} graded byte-identical state inconsistently: flip rate ${(verdict.flipRate * 100).toFixed(1)} % over ${verdict.replicates} replicates (${verdict.detail}). Its verdict is not a function of the state, so it cannot carry ground truth for an intervention study.`);
+}
+//#endregion
+//#region src/trace-repair/test-oracle.ts
+/**
+* The held-out suite, injected from outside the box at grade time.
+*
+* A repair is only measurable if the thing that decides pass or fail is out
+* of the trajectory's reach. Terminal-Bench gets that by uploading the suite
+* into the container at grade time, after the agent has stopped; a suite the
+* agent planted is overwritten before it is ever read. `injectedTestOracle`
+* reproduces that property and then proves it per call:
+*
+*   1. purge the suite root, so a planted extra file cannot survive
+*   2. upload every suite file from outside the session
+*   3. read the bytes back from inside and hash them
+*   4. refuse to grade when the read-back digest is not the uploaded digest
+*
+* Step 4 is why the property is asserted rather than assumed. A container
+* that silently drops the upload, or a filesystem trick that serves different
+* bytes to the reader, raises `TestSuiteTamperedError` instead of returning a
+* result. An oracle that cannot prove what it graded reports nothing.
+*/
+/** The suite the oracle read back is not the suite it uploaded. */
+var TestSuiteTamperedError = class extends CaptureIntegrityError {};
+/** The oracle could not place or run the suite, so it graded nothing. */
+var TestOracleError = class extends CaptureIntegrityError {};
+const DEFAULT_UPLOAD_TIMEOUT_MS = 6e4;
+const DEFAULT_COMMAND_TIMEOUT_MS = 9e5;
+/**
+* Content digest of the suite: sha256 over each path and its bytes, in path
+* order. Two suites with the same digest are the same suite.
+*/
+function testSuiteDigest(files) {
+	const hash = createHash("sha256");
+	for (const file of [...files].sort((a, b) => a.path.localeCompare(b.path))) {
+		hash.update(file.path);
+		hash.update("\0");
+		hash.update(Buffer.from(file.contents, "utf8"));
+		hash.update("\0");
+	}
+	return hash.digest("hex");
+}
+function injectedTestOracle(options) {
+	assertOracleOptions(options);
+	const uploadTimeoutMs = options.uploadTimeoutMs ?? DEFAULT_UPLOAD_TIMEOUT_MS;
+	const commandTimeoutMs = options.commandTimeoutMs ?? DEFAULT_COMMAND_TIMEOUT_MS;
+	const expectedDigest = testSuiteDigest(options.files);
+	return { async grade(session, context) {
+		const where = `${context.rowId}/${context.arm}#${context.rolloutIndex}`;
+		for (const directory of options.purge ?? []) await mustSucceed(session, `rm -rf ${shellQuote(directory)}`, uploadTimeoutMs, `purge ${directory} in ${where}`);
+		for (const file of options.files) {
+			const directory = parentDirectory(file.path);
+			if (directory) await mustSucceed(session, `mkdir -p ${shellQuote(directory)}`, uploadTimeoutMs, `mkdir ${directory} in ${where}`);
+			await mustSucceed(session, `printf %s ${shellQuote(Buffer.from(file.contents, "utf8").toString("base64"))} | base64 -d > ${shellQuote(file.path)}`, uploadTimeoutMs, `upload ${file.path} in ${where}`);
+			if (file.mode) await mustSucceed(session, `chmod ${file.mode} ${shellQuote(file.path)}`, uploadTimeoutMs, `chmod ${file.path} in ${where}`);
+		}
+		const readBack = [];
+		for (const file of options.files) {
+			const result = await mustSucceed(session, `base64 < ${shellQuote(file.path)} | tr -d '\\n'`, uploadTimeoutMs, `read back ${file.path} in ${where}`);
+			readBack.push({
+				path: file.path,
+				contents: Buffer.from(result.stdout.trim(), "base64").toString("utf8")
+			});
+		}
+		const observedDigest = testSuiteDigest(readBack);
+		if (observedDigest !== expectedDigest) throw new TestSuiteTamperedError(`test suite in ${where} does not match the suite uploaded from outside (expected ${expectedDigest}, read back ${observedDigest}); the graded result is discarded`);
+		const run = await session.exec(options.command, commandTimeoutMs);
+		return {
+			passed: run.exitCode === 0 && !run.timedOut,
+			exitCode: run.exitCode,
+			output: `${run.stdout}\n${run.stderr}`.trim(),
+			suiteDigest: observedDigest,
+			timedOut: run.timedOut
+		};
+	} };
+}
+/**
+* Run a setup command that must succeed. A failed upload is an oracle
+* failure, never a failed test: reporting it as a failing suite would turn a
+* broken container into evidence against the intervention.
+*/
+async function mustSucceed(session, command, timeoutMs, what) {
+	const result = await session.exec(command, timeoutMs);
+	if (result.timedOut) throw new TestOracleError(`test oracle timed out while it tried to ${what}`);
+	if (result.exitCode !== 0) throw new TestOracleError(`test oracle failed to ${what}: exit ${result.exitCode}\n${result.stderr.trim()}`);
+	return result;
+}
+function assertOracleOptions(options) {
+	if (options.files.length === 0) throw new ValidationError("injectedTestOracle requires at least one suite file");
+	const seen = /* @__PURE__ */ new Set();
+	for (const file of options.files) {
+		if (!file.path.startsWith("/")) throw new ValidationError(`suite file path must be absolute, got "${file.path}"`);
+		if (seen.has(file.path)) throw new ValidationError(`suite file ${file.path} is listed twice`);
+		seen.add(file.path);
+	}
+	if (options.command.trim().length === 0) throw new ValidationError("injectedTestOracle requires a suite command");
+	for (const directory of options.purge ?? []) if (!directory.startsWith("/") || directory.trim() === "/") throw new ValidationError(`purge path must be an absolute directory below the root, got "${directory}"`);
+}
+function parentDirectory(path) {
+	const index = path.lastIndexOf("/");
+	if (index <= 0) return null;
+	return path.slice(0, index);
+}
+function shellQuote(value) {
+	return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+//#endregion
+export { ADMISSION_CONFIG_DEFAULTS, ADMISSION_EXCLUSION_MEANING, ADMISSION_EXCLUSION_ORDER, ADMISSION_ROW_KEYS, ADMISSION_STRATA, AdmissionDenominatorError, AdmissionIndependenceError, BLINDED_FIELDS, CONTINUATION_POLICY_DEFAULTS, CONTROL_SCREENING_MODES, CREDIT_TERMS, ContinuationPolicyViolationError, ContinuationSymmetryError, DEGENERATE_STRATEGIES, DSPY_REPAIR_SIGNATURE, DSPY_REPAIR_TASK_TOKEN, DSPY_REPAIR_TRAJECTORY_INPUT, MINI_SWE_SYSTEM_MESSAGE, MIN_ORACLE_REPLICATES, NO_DECISIVE_FAILURE, NO_OP_ACTIONS, NondeterministicOracleError, OUTPUT_ELISION_THRESHOLD, OUTPUT_ELISION_WINDOW, REPAIR_CONTRACT_LINES, REPAIR_QUESTION, REPAIR_REPAIR_CONTRACT_LINES, RepairArmSymmetryError, SCAFFOLD_INTERVENTION_BUDGET, SUBMIT_SENTINEL, SUITE_REWARD_UNIT, TB_REPAIR_ADMISSION_CRITERIA, TestOracleError, TestSuiteTamperedError, UncalibratedControlError, admissionArtifact, admitRow, admittedCount, admittedRowIds, askRepairArm, assertAnalystIndependent, assertArmSymmetry, assertChainReconciles, assertControlCalibrated, assertDenominatorIntact, assertDeterministicOracle, assertDspyRepairEngine, blindTrajectory, buildDenominatorChain, checkInterventionBudget, classifyActionPayload, continuationPolicyDigest, continuationSeed, controlCanRescue, countFunnel, createCompletionRepairArm, createDockerContinuationEnvironment, createDspyRepairArm, defineControlPolicy, definePinnedContinuationPolicy, degenerateStrategy, deltaRepair, dockerRunArgs, dspyRepairInstructions, gradeRepairRow, injectedTestOracle, isPreStratumReason, isRecordedTimeout, noOpInjectionStep, nodeProcessRunner, normalizeActionForComparison, oracleDeterminism, parseAction, parseAnalystResponse, parseTaskOracleRegistry, reachedT0, reachedT1, reachedT2, readRepairPayload, renderAdmissionReport, renderDeltaRepairReport, renderFormatErrorObservation, renderInstanceMessage, renderObservation, renderRepairTrajectory, renderTimeoutObservation, repairArmAsymmetries, repairArmPromptSha256, repairArmResponse, repairCredit, repairFinding, repairQuestionSha256, repairTaskDefinition, repairTaskPolicy, repairTrajectoryHeader, resolveAdmissionConfig, rolloutDigest, rolloutRecordedSteps, runAdmission, runContinuation, scanShellAction, stratumOf, submissionOf, taskOracleRegistry, testSuiteDigest, toRecordedSteps, totalCost, totalUsage };
+
+//# sourceMappingURL=index.js.map