@tangle-network/agent-runtime 0.281.0 → 0.282.0

package/dist/{shared-box-CZFdugL1.js → search-method-CbUyhdz5.js}

@@ -1,12 +1,19 @@
-import { Ba as promptOptionsFromAgentTurnInput, Ht as InMemorySpawnJournal, Ia as armDeadlineTimer, Ji as unknownExecutionBindingReceipt, Ki as runtimeOwnedPendingExecutorMaterialization, Li as knownExecutionBindingReceipt, M as withDriverExecutor, Mt as createExecutorRegistry, Ot as captureReusableExecutorConfig, Pa as awaitAbortable, Pi as authoredProfileDigest, Qn as observedModelMatchesDeclared, Ri as knownMaterializationReceipt, Sa as sleep, Ui as runtimeOwnedExecutorExecutionBinding, Va as providerMessageText, Vt as InMemoryResultBlobStore, Wi as runtimeOwnedExecutorMaterialization, Xi as executableAgentProfileSnapshot, Yi as unknownMaterializationReceipt, aa as createSandboxUsageLedger, ar as sandboxClientAsProvider, ca as mapSandboxEvent, ea as projectSandboxOutcome, er as LEAF_CONTINUATION_TASK, ia as createSandboxToolPartState, jt as createExecutor, la as mapSandboxToolEvent, oi as harnessInvocation, or as unavailablePauseMs, r as createSupervisor, ra as canonicalStreamEventFromSandboxEvent, sa as isSandboxTerminalEvent, sr as unavailableSignalOfFailure, ta as readSandboxOutcome, za as promptFromAgentTurnInput } from "./supervisor-UXgaPisu.js";
-import { m as ValidationError, p as SessionMismatchError, r as BackendTransportError } from "./errors-DodWX-cb.js";
+import { Ba as promptOptionsFromAgentTurnInput, Br as createOpenInferenceFileExporter, Gr as padSpanId, Ht as InMemorySpawnJournal, Ia as armDeadlineTimer, Ji as unknownExecutionBindingReceipt, K as openSlotGroup, Ki as runtimeOwnedPendingExecutorMaterialization, Kr as padTraceId, Li as knownExecutionBindingReceipt, M as withDriverExecutor, Mt as createExecutorRegistry, Ot as captureReusableExecutorConfig, Pa as awaitAbortable, Pi as authoredProfileDigest, Qn as observedModelMatchesDeclared, Ri as knownMaterializationReceipt, Sa as sleep, Ui as runtimeOwnedExecutorExecutionBinding, Ur as generateSpanId, Va as providerMessageText, Vr as createOtelExporter, Vt as InMemoryResultBlobStore, Wi as runtimeOwnedExecutorMaterialization, Xi as executableAgentProfileSnapshot, Yi as unknownMaterializationReceipt, aa as createSandboxUsageLedger, ar as sandboxClientAsProvider, ca as mapSandboxEvent, ea as projectSandboxOutcome, er as LEAF_CONTINUATION_TASK, ia as createSandboxToolPartState, jt as createExecutor, la as mapSandboxToolEvent, oi as harnessInvocation, or as unavailablePauseMs, qr as toOtelAttributes, r as createSupervisor, ra as canonicalStreamEventFromSandboxEvent, sa as isSandboxTerminalEvent, sr as unavailableSignalOfFailure, ta as readSandboxOutcome, za as promptFromAgentTurnInput } from "./supervisor-UXgaPisu.js";
+import { i as ConfigError, m as ValidationError, p as SessionMismatchError, r as BackendTransportError } from "./errors-DodWX-cb.js";
 import { a as concreteProfileModel, c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, s as profileBridgeWireModel, t as assertExecutableAgentProfile } from "./model-policy-BbSCSak0.js";
-import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, renderInputPartsAsText } from "@tangle-network/agent-interface";
-import { costForTokenPricing, makeProposalFinding, scoreKnowledgeReadiness } from "@tangle-network/agent-eval";
+import { C as canonicalCandidateDigest$1, D as immutableCandidateValue } from "./workspace-archive-C9lgf77y.js";
+import { agentProfileSchema, applyAgentProfileDiff, canonicalAgentProfileDigest, canonicalCandidateDigest, diffAgentProfiles, renderInputPartsAsText, sha256DigestSchema } from "@tangle-network/agent-interface";
+import { CostAccountingIncompleteError, CostCeilingReachedError, canonicalJson, costForTokenPricing, costForUsage, makeProposalFinding, scoreKnowledgeReadiness } from "@tangle-network/agent-eval";
 import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
 import { randomBytes, randomUUID } from "node:crypto";
+import { mkdirSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { materializeProfile } from "@tangle-network/agent-profile-materialize";
+import { ATTR, branchSpan } from "@tangle-network/agent-trace-contract";
+import { redact } from "@tangle-network/agent-eval/traces";
 import { assertProposalFindings } from "@tangle-network/agent-eval/analyst";
+import { SearchRecorder, aide, asha, campaignCellSearchResult, campaignScenarioIdentity, campaignSplitDigestFromIdentities, createRunCostLedger, fsCampaignStorage, isProposedCandidate, openSearchLedger, renderSearchSummary, resolveRunDir, runCampaign, runSearch, searchClaimReserveUsd, searchNodeId, searchProposalExecution, searchProposerView, searchReceiptAccounting } from "@tangle-network/agent-eval/campaign";
+import { defineEvaluationClaim, summarizeEvaluationUnits } from "@tangle-network/agent-eval/experiment";
 import { harnessSystemPromptIntents as harnessSystemPromptIntents$1 } from "@tangle-network/agent-interface/harness-capabilities";
 //#region src/sessions.ts
 /**
@@ -1181,6 +1188,15 @@ const strategyAuthorMethod = [
 	"   comment at the top of the module — the holdout verdict will be read against it."
 ].join("\n");
 //#endregion
+//#region src/improvement/improve-result.ts
+function copyImproveCost(cost) {
+	return {
+		totalCostUsd: cost.totalCostUsd,
+		accountingComplete: cost.accountingComplete,
+		incompleteReasons: [...cost.incompleteReasons]
+	};
+}
+//#endregion
 //#region src/runtime/profile-chat-client.ts
 /** Profile-exact adapter for packages that consume agent-eval's ChatClient contract.
 * Every call still enters Runtime through createExecutor -> streamAgentTurn, and every
@@ -1552,7 +1568,7 @@ var ObservationError = class extends Error {
 	}
 };
 function validateUsage(usage) {
-	if (!Number.isSafeInteger(usage.input) || usage.input < 0 || !Number.isSafeInteger(usage.output) || usage.output < 0 || typeof usage.known !== "boolean") throw new TypeError("observation usage requires nonnegative safe integer subtotals and explicit known status");
+	if (!Number.isSafeInteger(usage.input) || usage.input < 0 || !Number.isSafeInteger(usage.output) || usage.output < 0 || typeof usage.known !== "boolean" || usage.costUsd !== void 0 && !(Number.isFinite(usage.costUsd) && usage.costUsd >= 0)) throw new TypeError("observation usage requires nonnegative safe integer subtotals, explicit known status, and a finite nonnegative costUsd when present");
 }
 /** Compact the trace into the lines the observer reasons over — tool calls,
 *  errors, and statuses, in order. Keeps the model call bounded + grounded. */
@@ -1672,7 +1688,8 @@ async function analyzeWithProfile(input, opts) {
 	const usage = {
 		input: inputTokens ?? 0,
 		output: outputTokens ?? 0,
-		known: res.usage?.captured !== false && typeof inputTokens === "number" && typeof outputTokens === "number"
+		known: res.usage?.captured !== false && typeof inputTokens === "number" && typeof outputTokens === "number",
+		...typeof res.costUsd === "number" ? { costUsd: res.costUsd } : {}
 	};
 	validateUsage(usage);
 	try {
@@ -1839,7 +1856,18 @@ async function runShot(surface, _task, handle, tools, messages, opts, profileOve
 			input: turn.usage.input,
 			output: turn.usage.output
 		},
-		...turn.usage.tokensKnown === false ? { tokensKnown: false } : {}
+		...turn.usage.tokensKnown === false ? { tokensKnown: false } : {},
+		...billedSpend(turn.usage.usdKnown === false ? void 0 : turn.usage.costUsd)
+	};
+}
+/** Provider-billed dollars of one call, or unknown when it billed none: never a fabricated 0. */
+function billedSpend(costUsd) {
+	return typeof costUsd === "number" && Number.isFinite(costUsd) && costUsd >= 0 ? {
+		usd: costUsd,
+		usdKnown: true
+	} : {
+		usd: 0,
+		usdKnown: false
 	};
 }
 /** The firewall's input shape: the trajectory as compacted text — calls, results,
@@ -1896,7 +1924,8 @@ async function consultAnalyst(task, messages, instruction, opts) {
 			input: input ?? 0,
 			output: output ?? 0
 		},
-		...tokensKnown ? {} : { tokensKnown: false }
+		...tokensKnown ? {} : { tokensKnown: false },
+		...billedSpend(res.costUsd)
 	};
 }
 async function analyze(task, messages, opts) {
@@ -1927,7 +1956,8 @@ async function analyze(task, messages, opts) {
 			input: obs.usage.input,
 			output: obs.usage.output
 		},
-		...obs.usage.known ? {} : { tokensKnown: false }
+		...obs.usage.known ? {} : { tokensKnown: false },
+		...billedSpend(obs.usage.costUsd)
 	};
 }
 async function renderCorpusReadback(opts) {
@@ -2007,8 +2037,8 @@ function shotExecutor(surface, opts) {
 						iterations: shot.completions,
 						tokens: shot.tokens,
 						...shot.tokensKnown === false ? { tokensKnown: false } : {},
-						usd: 0,
-						usdKnown: false,
+						usd: shot.usd,
+						usdKnown: shot.usdKnown,
 						ms: 0
 					}
 				};
@@ -2030,7 +2060,7 @@ function analystExecutor(opts) {
 		runtime: "agentic-analyst",
 		async execute(task) {
 			const t = task;
-			const { steer, tokens, tokensKnown } = t.rawInstruction ? await consultAnalyst(t.task, t.messages, t.rawInstruction, opts) : await analyze(t.task, t.messages, opts);
+			const { steer, tokens, tokensKnown, usd, usdKnown } = t.rawInstruction ? await consultAnalyst(t.task, t.messages, t.rawInstruction, opts) : await analyze(t.task, t.messages, opts);
 			artifact = {
 				outRef: `analyst:${steer.length}`,
 				out: steer,
@@ -2038,8 +2068,8 @@ function analystExecutor(opts) {
 					iterations: 1,
 					tokens,
 					...tokensKnown === false ? { tokensKnown: false } : {},
-					usd: 0,
-					usdKnown: false,
+					usd,
+					usdKnown,
 					ms: 0
 				}
 			};
@@ -2870,6 +2900,561 @@ function structuralRollout(config = {}) {
 	});
 }
 //#endregion
+//#region src/improvement/rollout-policy.ts
+/** The profile extensions namespace the policy persists under. */
+const ROLLOUT_POLICY_EXTENSION = "structural-rollout";
+const isBoundedInt = (v, min) => typeof v === "number" && Number.isInteger(v) && v >= min;
+/** Parse a serialized policy surface. Returns `undefined` for non-strings,
+* malformed JSON, or values outside the policy invariants. Unknown fields are
+* dropped; supported optional fields are preserved. */
+function parseRolloutPolicy(surface) {
+	if (typeof surface !== "string" || surface.trim().length === 0) return void 0;
+	let raw;
+	try {
+		raw = JSON.parse(surface);
+	} catch {
+		return;
+	}
+	return normalizeRolloutPolicy(raw);
+}
+/** Normalize an untyped policy bag (a parsed surface or a profile extension) into
+*  a full `StructuralRolloutPolicy`, defaults merged. Returns `undefined` when any
+*  present dial violates the policy invariants (mirrors `resolvePolicy`: integer
+*  k ≥ 1, repairRounds ≥ 0, testgen ≥ 0) — a corrupt config must read as "not
+*  configured", never as a fabricated recipe. */
+function normalizeRolloutPolicy(raw) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return void 0;
+	const bag = raw;
+	const k = bag.k ?? defaultStructuralRolloutPolicy.k;
+	const repairRounds = bag.repairRounds ?? defaultStructuralRolloutPolicy.repairRounds;
+	const testgen = bag.testgen ?? defaultStructuralRolloutPolicy.testgen;
+	if (!isBoundedInt(k, 1) || !isBoundedInt(repairRounds, 0) || !isBoundedInt(testgen, 0)) return;
+	return {
+		k,
+		repairRounds,
+		testgen,
+		...typeof bag.diverse === "boolean" ? { diverse: bag.diverse } : {}
+	};
+}
+/** Stable serialization with fixed field order. */
+function serializeRolloutPolicy(policy) {
+	return JSON.stringify({
+		k: policy.k,
+		repairRounds: policy.repairRounds,
+		testgen: policy.testgen,
+		...policy.diverse !== void 0 ? { diverse: policy.diverse } : {}
+	});
+}
+/** Read the persisted policy off the profile. `undefined` when the profile does
+*  not opt into structural rollout. */
+function structuralRolloutPolicyFromProfile(profile) {
+	const bag = profile.extensions?.[ROLLOUT_POLICY_EXTENSION];
+	if (bag === void 0) return void 0;
+	return normalizeRolloutPolicy(bag);
+}
+/** Persist a detached policy under the profile extension without mutating the input. */
+function applyRolloutPolicyToProfile(profile, policy) {
+	const candidate = structuredClone(profile);
+	const bag = {
+		k: policy.k,
+		repairRounds: policy.repairRounds,
+		testgen: policy.testgen,
+		...policy.diverse !== void 0 ? { diverse: policy.diverse } : {}
+	};
+	return {
+		...candidate,
+		extensions: {
+			...candidate.extensions,
+			[ROLLOUT_POLICY_EXTENSION]: bag
+		}
+	};
+}
+//#endregion
+//#region src/improvement/profile-surface.ts
+/** Extract the baseline optimized by a method and retain its structured value
+* so external optimizers can inspect it for private fields before serialization. */
+function prepareProfileSurface(profile, surface, skills, profileComponents) {
+	switch (surface) {
+		case "prompt": return {
+			surface: profile.prompt?.systemPrompt ?? "",
+			value: profile.prompt?.systemPrompt ?? ""
+		};
+		case "skills": {
+			const value = inlineSkill(profile, skills).content;
+			return {
+				surface: value,
+				value
+			};
+		}
+		case "tools": {
+			const value = profile.tools ?? {};
+			return {
+				surface: canonicalJson(value),
+				value
+			};
+		}
+		case "mcp": {
+			const value = profile.mcp ?? {};
+			return {
+				surface: canonicalJson(value),
+				value
+			};
+		}
+		case "hooks": {
+			const value = profile.hooks ?? {};
+			return {
+				surface: canonicalJson(value),
+				value
+			};
+		}
+		case "subagents": {
+			const value = profile.subagents ?? {};
+			return {
+				surface: canonicalJson(value),
+				value
+			};
+		}
+		case "agent-profile":
+			if (profileComponents) {
+				if (profileComponents.encoding !== void 0 && profileComponents.encoding !== "components" && profileComponents.encoding !== "json") throw new ConfigError("improve(): profileComponents.encoding must be components or json");
+				const value = profileComponents.read(profile);
+				const components = componentSurface(value, "profileComponents.read");
+				return {
+					surface: profileComponents.encoding === "json" ? canonicalJson(components.components) : components,
+					value
+				};
+			}
+			return {
+				surface: canonicalJson(profile),
+				value: profile
+			};
+		case "memory": {
+			const value = profileInstructions(profile);
+			return {
+				surface: value,
+				value
+			};
+		}
+		case "rollout-policy": {
+			const policy = structuralRolloutPolicyFromProfile(profile);
+			return {
+				surface: policy ? serializeRolloutPolicy(policy) : "",
+				value: policy ?? null
+			};
+		}
+		case "code": throw new ConfigError("improve(): code requires the isolated baseline created from opts.code.repoRoot");
+	}
+}
+function isCodeSurface(surface) {
+	return typeof surface === "object" && surface !== null && surface.kind === "code";
+}
+function isComponentSurface(surface) {
+	return typeof surface === "object" && surface !== null && surface.kind === "components";
+}
+function componentSurface(components, source) {
+	const entries = validateComponents(components, source);
+	return immutableCandidateValue({
+		kind: "components",
+		components: Object.fromEntries(entries)
+	});
+}
+function validateComponents(components, source) {
+	if (typeof components !== "object" || components === null || Array.isArray(components)) throw new ConfigError(`improve(): ${source} must return a component record`);
+	const entries = Object.entries(components);
+	if (entries.length === 0) throw new ConfigError(`improve(): ${source} must return at least one component`);
+	for (const [name, value] of entries) if (!name || name.trim() !== name || typeof value !== "string") throw new ConfigError(`improve(): ${source} must return trimmed component names with string values`);
+	return entries;
+}
+/** Parse a JSON winner surface with a typed, contextual error. */
+function parseWinnerJson(winner, surface) {
+	try {
+		return JSON.parse(winner);
+	} catch (cause) {
+		throw new ConfigError(`improve(): the '${surface}' candidate is not valid JSON, so it cannot form a profile candidate: ${cause.message}`);
+	}
+}
+function assertCandidateSurfaceKind(surface, baseline, winner) {
+	if (surface === "code") {
+		if (isCodeSurface(winner)) return;
+		throw new ConfigError(`improve(): the '${surface}' candidate returned an incompatible surface value`);
+	}
+	if (typeof baseline === "string") {
+		if (typeof winner === "string") return;
+		throw new ConfigError(`improve(): the '${surface}' candidate changed from a text surface to an incompatible surface value`);
+	}
+	if (!isComponentSurface(baseline) || !isComponentSurface(winner)) throw new ConfigError(`improve(): the '${surface}' candidate returned an incompatible surface value`);
+	validateComponents(winner.components, `the '${surface}' candidate`);
+	const baselineNames = Object.keys(baseline.components).sort();
+	const winnerNames = Object.keys(winner.components).sort();
+	if (baselineNames.length !== winnerNames.length || baselineNames.some((name, index) => name !== winnerNames[index])) throw new ConfigError(`improve(): the '${surface}' candidate must preserve the exact component names`);
+}
+/** Materialize a detached profile candidate without changing the baseline. */
+function materializeImprovementProfileCandidate(profile, surface, winner, skills, profileComponents) {
+	let candidate;
+	if (isComponentSurface(winner)) {
+		if (surface !== "agent-profile" || !profileComponents) throw new ConfigError(`improve(): the '${surface}' candidate has no profile component mapping`);
+		const winnerComponents = immutableCandidateValue({ ...winner.components });
+		const validated = parseMaterializedProfile(profileComponents.apply(profile, winnerComponents), surface);
+		const materializedComponents = Object.fromEntries(validateComponents(profileComponents.read(validated), "profileComponents.read after apply"));
+		const names = Object.keys(winnerComponents);
+		if (names.length !== Object.keys(materializedComponents).length || names.some((name) => materializedComponents[name] !== winnerComponents[name])) throw new ConfigError("improve(): profileComponents.apply must round-trip every winning component exactly");
+		return validated;
+	}
+	if (typeof winner !== "string") throw new ConfigError(`improve(): the '${surface}' candidate cannot form an AgentProfile`);
+	switch (surface) {
+		case "prompt":
+			candidate = {
+				...profile,
+				prompt: {
+					...profile.prompt,
+					systemPrompt: winner
+				}
+			};
+			break;
+		case "skills": {
+			const selectedSkill = inlineSkill(profile, skills);
+			candidate = {
+				...profile,
+				resources: {
+					...profile.resources,
+					skills: profile.resources?.skills?.map((resource) => resource === selectedSkill ? {
+						...resource,
+						content: winner
+					} : resource)
+				}
+			};
+			break;
+		}
+		case "tools":
+			candidate = {
+				...profile,
+				tools: parseWinnerJson(winner, surface)
+			};
+			break;
+		case "mcp":
+			candidate = {
+				...profile,
+				mcp: parseWinnerJson(winner, surface)
+			};
+			break;
+		case "hooks":
+			candidate = {
+				...profile,
+				hooks: parseWinnerJson(winner, surface)
+			};
+			break;
+		case "subagents":
+			candidate = {
+				...profile,
+				subagents: parseWinnerJson(winner, surface)
+			};
+			break;
+		case "agent-profile":
+			candidate = parseWinnerJson(winner, surface);
+			break;
+		case "memory":
+			candidate = {
+				...profile,
+				resources: {
+					...profile.resources,
+					instructions: replaceProfileInstructions(profile, winner)
+				}
+			};
+			break;
+		case "rollout-policy": {
+			const policy = normalizeRolloutPolicy(parseWinnerJson(winner, surface));
+			if (!policy) throw new ConfigError(`improve(): the shipped 'rollout-policy' winner is not a valid StructuralRolloutPolicy (integer k >= 1, repairRounds >= 0, testgen >= 0), so it cannot be applied: ${winner}`);
+			candidate = applyRolloutPolicyToProfile(profile, policy);
+			break;
+		}
+	}
+	return parseMaterializedProfile(candidate, surface);
+}
+function parseMaterializedProfile(candidate, surface) {
+	const parsed = agentProfileSchema.safeParse(candidate);
+	if (!parsed.success) throw new ConfigError(`improve(): the '${surface}' candidate does not produce a valid AgentProfile: ${parsed.error.message}`);
+	return immutableCandidateValue(parsed.data);
+}
+function createProfileCandidateMaterializer(profile, surface, baselineSurface, skills, profileComponents) {
+	const decode = (candidate) => {
+		if (profileComponents?.encoding !== "json") return candidate;
+		if (typeof candidate !== "string") throw new ConfigError("improve(): JSON profile components require a text surface");
+		return componentSurface(parseWinnerJson(candidate, surface), "JSON profile components");
+	};
+	const decodedBaseline = decode(baselineSurface);
+	const baselineDigest = canonicalCandidateDigest$1(baselineSurface);
+	if (profileComponents) {
+		if (canonicalAgentProfileDigest(materializeImprovementProfileCandidate(profile, surface, decodedBaseline, skills, profileComponents)) !== canonicalAgentProfileDigest(profile)) throw new ConfigError("improve(): profileComponents.apply(profile, profileComponents.read(profile)) must reproduce the complete baseline profile exactly");
+	}
+	const candidates = /* @__PURE__ */ new Map([[baselineDigest, profile]]);
+	return (candidateSurface) => {
+		assertCandidateSurfaceKind(surface, baselineSurface, candidateSurface);
+		const decodedCandidate = decode(candidateSurface);
+		assertCandidateSurfaceKind(surface, decodedBaseline, decodedCandidate);
+		const digest = canonicalCandidateDigest$1(candidateSurface);
+		const existing = candidates.get(digest);
+		if (existing) return existing;
+		const candidate = materializeImprovementProfileCandidate(profile, surface, immutableCandidateValue(decodedCandidate), skills, profileComponents);
+		candidates.set(digest, candidate);
+		return candidate;
+	};
+}
+function inlineSkill(profile, options) {
+	const resourceName = options?.resourceName.trim();
+	if (!resourceName) throw new ConfigError("improve(): surface 'skills' requires opts.skills.resourceName for one inline profile skill");
+	assertFailClosedResources(profile, "skills");
+	const matches = (profile.resources?.skills ?? []).filter((resource) => resource.name === resourceName);
+	if (matches.length !== 1 || matches[0]?.kind !== "inline") throw new ConfigError(`improve(): skill '${resourceName}' must identify exactly one inline profile resource`);
+	return matches[0];
+}
+function profileInstructions(profile) {
+	assertFailClosedResources(profile, "memory");
+	const instructions = profile.resources?.instructions;
+	if (instructions === void 0) return "";
+	if (typeof instructions === "string") return instructions;
+	if (instructions.kind === "inline") return instructions.content;
+	throw new ConfigError("improve(): surface 'memory' requires inline profile instructions so candidate bytes are exact");
+}
+function replaceProfileInstructions(profile, content) {
+	const instructions = profile.resources?.instructions;
+	if (typeof instructions !== "object") return content;
+	if (instructions.kind !== "inline") throw new ConfigError("improve(): surface 'memory' requires inline profile instructions so candidate bytes are exact");
+	return {
+		...instructions,
+		content
+	};
+}
+function assertFailClosedResources(profile, surface) {
+	if (profile.resources?.failOnError !== true) throw new ConfigError(`improve(): surface '${surface}' requires profile.resources.failOnError: true`);
+}
+//#endregion
+//#region src/improvement/candidate-validation.ts
+/** One spelling of the execution-identity rule for optimization, training, and the harness. */
+function parseExecutionRef(value, label) {
+	const parsed = sha256DigestSchema.safeParse(value);
+	if (!parsed.success) throw new ConfigError(`${label}: executionRef must be a lowercase sha256:<64 hex> digest`);
+	return parsed.data;
+}
+/** Validate the callback itself before any optimizer, trainer, or candidate work starts. */
+function assertCandidateValidator(validator) {
+	if (validator !== void 0 && typeof validator !== "function") throw new ConfigError("validateCandidate must be a function when present");
+}
+/** A validator accepts synchronously by returning void, or rejects by throwing. */
+function validateProfileCandidate(validator, input) {
+	assertCandidateValidator(validator);
+	const result = validator?.(Object.freeze(input));
+	if (result !== void 0) {
+		Promise.resolve(result).catch(() => {});
+		throw new ConfigError("candidate validators must return void synchronously or throw");
+	}
+}
+/**
+* Refuse exact held-out content digests already declared in this profile's training lineage.
+* Both training and trainer-visible validation rows are exposure. This is an exact
+* provenance check, not fuzzy decontamination or proof that undeclared training was fresh.
+*/
+function assertProfileTrainingIsHeldOut(profile, heldOutDigests) {
+	const training = profile.metadata?.training;
+	if (!training) return;
+	for (const receipt of [training.receipt, ...training.ancestors]) if (receipt.dataset.tasks.some((task) => heldOutDigests.has(task.contentDigest))) throw new ConfigError("known training exposure overlaps held-out evaluation");
+}
+/**
+* JSON paths of credential and private values in candidate content, found by
+* the redaction core, which names each value it would change. A candidate that
+* leaves Runtime (an external optimizer, a search ledger) is refused on any.
+*/
+function privateValuePaths(values) {
+	return [...new Set(values.flatMap((value) => redact(value).report.findings.map((finding) => jsonPathOf(finding.path))))];
+}
+/** `/remote/url` or `/tools/0/env` as `$.remote.url` or `$.tools[0].env`. */
+function jsonPathOf(pointer) {
+	return pointer.split("/").slice(1).map((segment) => segment.replaceAll("~1", "/").replaceAll("~0", "~")).reduce((path, segment) => /^\d+$/.test(segment) ? `${path}[${segment}]` : `${path}.${segment}`, "$");
+}
+//#endregion
+//#region src/improvement/method-identity.ts
+function buildMethodEvaluationIdentity(input) {
+	const optimizationReps = input.optimizationRunOptions?.reps ?? 1;
+	const finalTestReps = input.reps ?? 1;
+	const scenarioPartitions = immutableCandidateValue({
+		train: input.trainScenarios.map(campaignScenarioIdentity),
+		selection: input.selectionScenarios.map(campaignScenarioIdentity),
+		finalTest: input.testScenarios.map(campaignScenarioIdentity),
+		optimizationReps,
+		finalTestReps
+	});
+	const developmentSplitDigest = canonicalCandidateDigest$1({
+		train: campaignSplitDigestFromIdentities(scenarioPartitions.train, optimizationReps),
+		selection: campaignSplitDigestFromIdentities(scenarioPartitions.selection, optimizationReps)
+	});
+	const finalTestSplitDigest = campaignSplitDigestFromIdentities(scenarioPartitions.finalTest, finalTestReps);
+	const judgeDescriptors = input.judges.map(judgeDescriptor);
+	return {
+		evaluationRef: canonicalCandidateDigest$1({
+			executionRef: input.executionRef,
+			baselineProfileDigest: input.baselineProfileDigest,
+			coordinate: profileCoordinate(input.surface, input.baselineSurface, input.skills),
+			candidateValidation: input.validateCandidate ? Function.prototype.toString.call(input.validateCandidate) : null,
+			developmentSplitDigest,
+			finalTestSplitDigest,
+			findings: input.findings,
+			judges: judgeDescriptors,
+			run: {
+				seed: input.seed ?? 42,
+				finalReps: input.reps ?? 1,
+				optimizationReps,
+				costCeiling: input.costCeiling ?? null,
+				resumable: input.optimizationRunOptions?.resumable ?? true,
+				maxConcurrency: input.optimizationRunOptions?.maxConcurrency ?? 2,
+				abortOnCellError: input.optimizationRunOptions?.abortOnCellError ?? false,
+				dispatchTimeoutMs: input.optimizationRunOptions?.dispatchTimeoutMs ?? null,
+				dispatchShutdownTimeoutMs: input.optimizationRunOptions?.dispatchShutdownTimeoutMs ?? 5e3,
+				tracing: input.optimizationRunOptions?.tracing ?? "on",
+				expectUsage: input.optimizationRunOptions?.expectUsage ?? "warn",
+				captureSource: input.optimizationRunOptions?.captureSource ?? null,
+				captureSourceVersionHash: input.optimizationRunOptions?.captureSourceVersionHash ?? null
+			}
+		}),
+		developmentSplitDigest,
+		finalTestSplitDigest,
+		scenarioPartitions,
+		judgeDescriptors
+	};
+}
+function profileCoordinate(surface, baselineSurface, skills) {
+	return {
+		surface,
+		resourceName: surface === "skills" ? skills?.resourceName.trim() ?? null : null,
+		componentNames: typeof baselineSurface === "object" && baselineSurface !== null && baselineSurface.kind === "components" ? Object.keys(baselineSurface.components).sort() : []
+	};
+}
+function judgeDescriptor(judge) {
+	return {
+		name: judge.name,
+		dimensions: judge.dimensions.map((dimension) => ({ ...dimension })),
+		declaredVersion: judge.judgeVersion ?? null,
+		scoreImplementation: Function.prototype.toString.call(judge.score),
+		appliesToImplementation: judge.appliesTo ? Function.prototype.toString.call(judge.appliesTo) : null
+	};
+}
+//#endregion
+//#region src/improvement/profile-improvement.ts
+/**
+* What every profile improvement prepares before any optimizer or search runs:
+* the exact surface and its baseline, the evaluation identity, identified
+* judges, the identities a search ledger records, and one materializer that
+* admits a candidate only after the held-out and caller checks. `improve()`
+* with an external method and with `searchMethod` share it, so a candidate is
+* materialized and admitted the same way on both paths.
+*/
+function prepareProfileImprovement(profile, input) {
+	const { surface = "prompt", validateCandidate, skills, profileComponents, minimumLift = 0 } = input;
+	assertCandidateValidator(validateCandidate);
+	if (!Number.isFinite(minimumLift) || minimumLift < 0) throw new ConfigError("improve(): minimumLift must be a finite number greater than or equal to 0");
+	if (profileComponents && surface !== "agent-profile") throw new ConfigError("improve(): profileComponents is valid only with surface 'agent-profile'");
+	if (input.subject !== void 0 && (typeof input.subject !== "string" || !input.subject.trim() || input.subject !== input.subject.trim())) throw new ConfigError("improve(): subject must be a trimmed non-empty string");
+	const executionRef = parseExecutionRef(input.executionRef, "improve()");
+	const findings = immutableCandidateValue([...assertProposalFindings(input.findings ?? [], "improve() method findings")]);
+	const preparedSurface = prepareProfileSurface(profile, surface, skills, profileComponents);
+	const baselineSurface = preparedSurface.surface;
+	const baselineValue = immutableCandidateValue(preparedSurface.value);
+	const baselineProfileDigest = canonicalAgentProfileDigest(profile);
+	const identity = buildMethodEvaluationIdentity({
+		executionRef,
+		baselineProfileDigest,
+		baselineSurface,
+		surface,
+		skills,
+		validateCandidate,
+		findings,
+		trainScenarios: input.trainScenarios,
+		selectionScenarios: input.selectionScenarios,
+		testScenarios: input.testScenarios,
+		judges: input.judges,
+		seed: input.seed,
+		reps: input.reps,
+		costCeiling: input.costCeiling,
+		optimizationRunOptions: input.optimizationRunOptions
+	});
+	const judges = input.judges.map((judge, index) => Object.freeze({
+		...judge,
+		judgeVersion: canonicalCandidateDigest$1({
+			evaluationRef: identity.evaluationRef,
+			descriptor: identity.judgeDescriptors[index]
+		})
+	}));
+	const rawMaterializeProfile = createProfileCandidateMaterializer(profile, surface, baselineSurface, skills, profileComponents);
+	const baselineSurfaceDigest = canonicalCandidateDigest$1(baselineSurface);
+	const heldOutDigests = new Set(identity.scenarioPartitions.finalTest.map((task) => task.scenarioDigest));
+	const validatedCandidates = /* @__PURE__ */ new Set();
+	const validateMaterialized = (validator, candidate, candidateSurface, isBaseline) => {
+		const prepared = prepareProfileSurface(candidate, surface, skills, profileComponents);
+		validateProfileCandidate(validator, {
+			profile: candidate,
+			surface,
+			candidateSurface,
+			value: immutableCandidateValue(prepared.value),
+			isBaseline
+		});
+	};
+	const admitCandidate = (candidate, candidateSurface) => {
+		const candidateDigest = canonicalCandidateDigest$1(candidateSurface);
+		if (validatedCandidates.has(candidateDigest)) return;
+		assertProfileTrainingIsHeldOut(candidate, heldOutDigests);
+		validateMaterialized(validateCandidate, candidate, immutableCandidateValue(candidateSurface), candidateDigest === baselineSurfaceDigest);
+		validatedCandidates.add(candidateDigest);
+	};
+	const materializeProfile = (candidateSurface) => {
+		const candidate = rawMaterializeProfile(candidateSurface);
+		admitCandidate(candidate, candidateSurface);
+		return candidate;
+	};
+	materializeProfile(baselineSurface);
+	return {
+		profile,
+		surface,
+		executionRef,
+		findings,
+		minimumLift,
+		baselineSurface,
+		baselineValue,
+		baselineProfileDigest,
+		identity,
+		invocationId: `runtime-optimization:${randomUUID()}`,
+		judges,
+		searchIdentity: Object.freeze({
+			subject: input.subject ?? profile.name ?? "agent-profile",
+			agent: {
+				uri: "agent-runtime:improve-execution-ref",
+				revision: executionRef
+			},
+			judge: {
+				uri: "agent-runtime:improve-judges",
+				revision: canonicalCandidateDigest$1(identity.judgeDescriptors)
+			},
+			model: profileModel(profile)
+		}),
+		surfaceOf: (candidate) => prepareProfileSurface(candidate, surface, skills, profileComponents).surface,
+		materializeCandidate: rawMaterializeProfile,
+		admitCandidate,
+		materializeProfile,
+		validateMaterialized
+	};
+}
+/** The profile's model hint as a moving alias; each cell records what it resolved. */
+function profileModel(profile) {
+	const hint = profile.model?.default;
+	if (!hint) return {
+		provider: "unspecified",
+		alias: "unspecified",
+		unknown: "the profile names no model; each cell records the model it resolved"
+	};
+	return {
+		provider: profile.model?.provider ?? "unspecified",
+		alias: hint,
+		unknown: "the profile names a model hint, not a snapshot; each cell records the model it resolved"
+	};
+}
+//#endregion
 //#region src/runtime/shared-box.ts
 /**
 * Shared-box placement: many harness workers in one Sandbox box, each as its own process.
@@ -3818,6 +4403,1204 @@ function errorMessage(error) {
 	return "opencode reported an error";
 }
 //#endregion
-export { defaultAnalystInstruction as A, createSandboxPromptBackend as B, defineStrategy as C, sample as D, runAgentic as E, optimizerMethod as F, startOrResumeRuntimeSession as G, InMemoryRuntimeSessionStore as H, strategyAuthorMethod as I, touchSession as K, collectAgentTurn as L, renderReport as M, profileChatClient as N, sampleThenRefine as O, profileOptimizerModelCall as P, streamAgentTurn as R, breadthStrategy as S, refine as T, newRuntimeSession as U, normalizeBackendStreamEvent as V, nowIso as W, sandboxCheckRunner as _, sharedBoxPlacement as a, visibleCheckScore as b, canDisplace as c, defaultExtractCandidate as d, defaultStructuralRolloutPolicy as f, resolveEntrySymbol as g, officialChecksFromMeta as h, isTransientSandboxFailure as i, observe as j, ObservationError as k, compareCheckOutcomes as l, modelAuthoredChecks as m, DEFAULT_SHARED_BOX_WORKERS as n, sharedBoxRefusal as o, filterAuthoredAsserts as p, ROUTER_CLIENT_HEADER as r, sharedWorkerClientName as s, DEFAULT_SHARED_BOX_RESOURCES as t, composeCheckSources as u, selectBestIndex as v, depthStrategy as w, adaptiveRefine as x, structuralRollout as y, createIterableBackend as z };
+//#region src/improvement/search-executor.ts
+/**
+* The search kernel's executor port for cells Runtime runs.
+*
+* A lane is a pool of execution slots with one cost rule: a shared box, dedicated
+* environments, subscription seats, or the router. The kernel places each cell on a lane and
+* bounds each lane's running cells by its capacity. This executor adds what one search cannot
+* see or enforce on its own:
+*
+* - Fleet slots. A `WorkerSlots` allocator shared by concurrent searches bounds working cells
+*   across all of them. A cell waits for a slot, and the wait is its `queueMs`.
+* - Fleet dollars. On a hard lane a cell holds its enforced maximum as a `BudgetPool` ticket
+*   before it starts, waits while open tickets could return enough, and settles the ticket
+*   with its measured spend. Estimate lanes take no ticket: they cannot bound a cell, and an
+*   unknown cost would close a capped pool for every search that shares it.
+* - Hard caps. On a hard lane every paid call of the cell, the agent's and the judges', holds
+*   its maximum against the lane's `cellUsd` and is refused when it would pass it, so the
+*   kernel's hard reservation is a bound and not a hope.
+* - Adoption. A finished attempt is written under its run id before the kernel sees it, so a
+*   kernel that restarts adopts the attempt instead of running it again. The run id is stable
+*   across restarts; an agent that runs remote work keys it by `ctx.search.runId`, so a lost
+*   response is fetched again rather than executed again.
+* - Accounting. Every paid call is tagged with its search and attempt, and an attempt's cost is
+*   every call tagged with its run id, including calls a process that ended made for it. A
+*   reopened search settles those interrupted calls first: from the provider through the lane's
+*   `recoverReceipt`, else with an unknown cost, never as free.
+* - Environment faults. A `SearchEnvironmentFault`, or a platform failure a repeated request
+*   can change, settles `errored` and retryable, and the kernel runs a fresh attempt.
+* - Traces. Each attempt is one trace whose root span carries `agent.branch.id` = the node id.
+*   The spans the attempt's exporter wrote and dropped go into the cell's `traceRef`.
+*/
+function laneReceipts(options) {
+	return options.recoverReceipt ? { recoverReceipt: options.recoverReceipt } : {};
+}
+const acceptEveryProfile = () => void 0;
+function laneName(name, fallback) {
+	const resolved = name ?? fallback;
+	if (!/^[A-Za-z0-9._-]{1,64}$/u.test(resolved)) throw new ConfigError(`search lane name '${resolved}' must be 1-64 of [A-Za-z0-9._-]`);
+	return resolved;
+}
+function positiveInteger(value, name) {
+	if (!Number.isSafeInteger(value) || value < 1) throw new ConfigError(`${name} must be a positive integer`);
+	return value;
+}
+function dollars(value, name) {
+	if (!Number.isFinite(value) || value < 0) throw new ConfigError(`${name} must be a finite non-negative number of dollars`);
+	return value;
+}
+/**
+* Cells as workers packed into shared Sandbox boxes, `workersPerBox` to a box.
+*
+* Capacity is `boxes × workersPerBox`. The workers of one box share its router key, which caps
+* no single worker, so the lane holds an estimate (`cellUsd` is the prior until 20 cells settle).
+* A profile the placement refuses (a repository writer, a replaced system prompt, MCP servers,
+* hooks, subagents, tool grants) needs another lane. The agent reaches the box through
+* `lane.placement.providerFor({ nodeId: ctx.search.runId })`, which names the attempt to the
+* router on every call.
+*/
+function sharedBoxLane(options) {
+	const { name, boxes, cellUsd, recoverReceipt, ...placementOptions } = options;
+	const placement = sharedBoxPlacement(placementOptions);
+	const workersPerBox = placementOptions.workersPerBox ?? 8;
+	return Object.freeze({
+		name: laneName(name, "shared-box"),
+		kind: "shared-box",
+		capacity: positiveInteger(boxes, "sharedBoxLane(): boxes") * workersPerBox,
+		costCap: "estimate",
+		cellUsd: dollars(cellUsd, "sharedBoxLane(): cellUsd"),
+		refusal: (profile) => placement.refusal(profile),
+		...laneReceipts({ recoverReceipt }),
+		placement
+	});
+}
+/**
+* Cells that each run in their own environment, `capacity` at once. The lane cannot bound a
+* cell's dollars, so it holds an estimate: `cellUsd` until 20 cells settle, then 1.5 × the p99
+* of its settled cells.
+*/
+function dedicatedLane(options) {
+	return Object.freeze({
+		name: laneName(options.name, "dedicated"),
+		kind: "dedicated",
+		capacity: positiveInteger(options.capacity, "dedicatedLane(): capacity"),
+		costCap: "estimate",
+		cellUsd: dollars(options.cellUsd, "dedicatedLane(): cellUsd"),
+		refusal: acceptEveryProfile,
+		...laneReceipts(options)
+	});
+}
+/**
+* Cells on subscription seats, one cell a seat. A seat charges no dollar per call, so its own
+* work costs $0 and reports no tokens. `cellUsd` bounds the cell's priced calls, such as its
+* judges; every one of them must declare a maximum, and the lane refuses a call past it.
+*/
+function subscriptionLane(options) {
+	return Object.freeze({
+		name: laneName(options.name, "subscription"),
+		kind: "subscription",
+		capacity: positiveInteger(options.seats, "subscriptionLane(): seats"),
+		costCap: "hard",
+		cellUsd: dollars(options.cellUsd ?? 0, "subscriptionLane(): cellUsd"),
+		refusal: acceptEveryProfile,
+		...laneReceipts(options)
+	});
+}
+/**
+* Cells whose model calls are priced router calls, `capacity` at once. Every paid call of a
+* cell must declare its maximum charge, and the lane refuses a call that would take the cell
+* past `cellUsd`, so `cellUsd` is each cell's hard maximum.
+*/
+function routerLane(options) {
+	return Object.freeze({
+		name: laneName(options.name, "router"),
+		kind: "router",
+		capacity: positiveInteger(options.capacity, "routerLane(): capacity"),
+		costCap: "hard",
+		cellUsd: dollars(options.cellUsd, "routerLane(): cellUsd"),
+		refusal: acceptEveryProfile,
+		...laneReceipts(options)
+	});
+}
+/** Check a lane list: at least one lane, unique names, a hard lane's cap known. */
+function assertSearchLanes(lanes, context) {
+	if (!Array.isArray(lanes) || lanes.length === 0) throw new ConfigError(`${context}: lanes needs at least one lane`);
+	const names = /* @__PURE__ */ new Set();
+	for (const lane of lanes) {
+		if (!lane || typeof lane.refusal !== "function" || typeof lane.kind !== "string") throw new ConfigError(`${context}: every lane comes from sharedBoxLane, dedicatedLane, subscriptionLane or routerLane`);
+		if (names.has(lane.name)) throw new ConfigError(`${context}: lane '${lane.name}' appears twice`);
+		names.add(lane.name);
+	}
+}
+/**
+* The environment, not the candidate, ended the attempt: a box that died, a platform that
+* refused the run, a quota. The attempt settles `errored` and retryable, and the kernel runs a
+* fresh attempt up to its `maxAttempts`. Throw anything else for the agent's own failure.
+*/
+var SearchEnvironmentFault = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "SearchEnvironmentFault";
+	}
+};
+/** Whether an attempt's error is the environment's: a `SearchEnvironmentFault`, or a platform,
+*  gateway or network failure that a repeated request can change. */
+function isSearchEnvironmentFault(error) {
+	return error instanceof SearchEnvironmentFault || isTransientSandboxFailure(error);
+}
+const USD_TOLERANCE = 1e-9;
+/** The kernel's executor port over Runtime lanes. */
+function searchExecutor(options) {
+	assertSearchLanes(options.lanes, "searchExecutor()");
+	const lanes = new Map(options.lanes.map((lane) => [lane.name, lane]));
+	const placed = new Map(options.lanes.map((lane) => [lane.name, 0]));
+	const slots = options.workerSlots ? openSlotGroup(options.workerSlots) : null;
+	const attempts = attemptStore(options.storage, join(options.dir, "attempts"));
+	const tracing = searchTracing(options);
+	const laneOf = (work) => {
+		const lane = lanes.get(work.lane);
+		if (!lane) throw new Error(`search cell ${work.cellId} was placed on unknown lane '${work.lane}'`);
+		return lane;
+	};
+	return {
+		lanes: () => options.lanes,
+		place(cell) {
+			const profile = options.profileOf(cell.nodeId);
+			let chosen;
+			for (const lane of options.lanes) {
+				if (profile && lane.refusal(profile) !== void 0) continue;
+				if (chosen === void 0 || placed.get(lane.name) / lane.capacity < placed.get(chosen.name) / chosen.capacity) chosen = lane;
+			}
+			if (!chosen) throw new Error(`no search lane can run node ${cell.nodeId}; admission should have refused it`);
+			placed.set(chosen.name, placed.get(chosen.name) + 1);
+			return chosen.name;
+		},
+		async adopt(work) {
+			return attempts.read(work.runId);
+		},
+		async run(work) {
+			const lane = laneOf(work);
+			const queuedAt = Date.now();
+			let hold;
+			try {
+				hold = await holdFleet(lane, work, options.budgetPool, slots);
+			} catch (error) {
+				if (work.signal.aborted) return interrupted(work, lane, options.identity, error);
+				throw error;
+			}
+			const queueMs = Date.now() - queuedAt;
+			const trace = tracing.open(work, lane);
+			let result;
+			try {
+				const context = Object.freeze({
+					searchId: work.searchId,
+					cellId: work.cellId,
+					nodeId: work.nodeId,
+					taskId: work.taskId,
+					split: work.split,
+					stage: work.stage,
+					attempt: work.attempt,
+					runId: work.runId,
+					lane,
+					trace: trace.ids
+				});
+				const tags = searchCallTags(work.searchId, {
+					run: work.runId,
+					lane: lane.name
+				});
+				const measured = await options.runAttempt({
+					work,
+					lane,
+					context,
+					costLedger: attemptLedger(options.costLedger, lane, tags),
+					span: trace.span
+				});
+				result = {
+					...measured,
+					accounting: attemptAccounting(options.costLedger, lane, tags),
+					queueMs,
+					placement: {
+						lane: lane.name,
+						boxId: measured.placement?.boxId ?? null
+					},
+					traceRef: await trace.finish(measured)
+				};
+			} finally {
+				hold.release(result);
+			}
+			if (!work.signal.aborted) attempts.write(work.runId, result);
+			return result;
+		}
+	};
+}
+function interrupted(work, lane, identity, error) {
+	return {
+		outcome: {
+			status: "errored",
+			metrics: {},
+			error: {
+				code: "interrupted",
+				message: `search cell ${work.runId} was interrupted before it ran: ${error instanceof Error ? error.message : String(error)}`,
+				retryable: true
+			}
+		},
+		accounting: {
+			tokens: {
+				status: "known",
+				inputTokens: 0,
+				outputTokens: 0,
+				cachedTokens: 0
+			},
+			cost: {
+				status: "known",
+				usd: 0,
+				source: "free"
+			}
+		},
+		identity,
+		placement: {
+			lane: lane.name,
+			boxId: null
+		},
+		traceRef: { unknown: "the attempt never started" }
+	};
+}
+/** Take the attempt's fleet dollars, then its fleet slot. A cell waiting for budget holds no
+*  slot, so it cannot hold a slot the cells it waits on need. */
+async function holdFleet(lane, work, pool, slots) {
+	let ticket;
+	if (pool && lane.costCap === "hard" && lane.cellUsd > 0) {
+		const reserved = pool.reserve({
+			maxUsd: lane.cellUsd,
+			maxTokens: 0,
+			maxIterations: 0
+		}, {
+			label: work.runId,
+			stage: "admitted"
+		}, { wait: true });
+		if (!reserved.ok) throw new Error(`the fleet budget pool refused search cell ${work.runId} on lane ${lane.name}: ${reserved.reason}`);
+		ticket = reserved.ticket;
+		if (reserved.granted) try {
+			await abortable(reserved.granted, work.signal);
+		} catch (error) {
+			pool.reconcile(ticket, noSpend());
+			throw error;
+		}
+		pool.attribute(ticket, {
+			label: work.runId,
+			stage: "executing"
+		});
+	}
+	const permit = slots?.acquire(0);
+	if (permit) try {
+		await abortable(permit.ready, work.signal);
+	} catch (error) {
+		permit.release();
+		if (ticket) pool.reconcile(ticket, noSpend());
+		throw error;
+	}
+	return { release(result) {
+		permit?.release();
+		if (!ticket) return;
+		try {
+			pool.reconcile(ticket, result ? spendOf(result) : unknownSpend());
+		} catch {}
+	} };
+}
+function abortable(promise, signal) {
+	if (signal.aborted) return Promise.reject(signal.reason ?? /* @__PURE__ */ new Error("search cell aborted"));
+	return new Promise((resolve, reject) => {
+		const onAbort = () => reject(signal.reason ?? /* @__PURE__ */ new Error("search cell aborted"));
+		signal.addEventListener("abort", onAbort, { once: true });
+		promise.then((value) => {
+			signal.removeEventListener("abort", onAbort);
+			resolve(value);
+		}, (error) => {
+			signal.removeEventListener("abort", onAbort);
+			reject(error);
+		});
+	});
+}
+function noSpend() {
+	return {
+		iterations: 0,
+		tokens: {
+			input: 0,
+			output: 0
+		},
+		usd: 0,
+		ms: 0
+	};
+}
+function unknownSpend() {
+	return {
+		...noSpend(),
+		usdKnown: false,
+		tokensKnown: false
+	};
+}
+/** The attempt's spend as the budget pool reads it. Unknown dollars carry their proven floor. */
+function spendOf(result) {
+	const { cost, tokens } = result.accounting;
+	return {
+		iterations: 0,
+		tokens: tokens.status === "known" ? {
+			input: tokens.inputTokens,
+			output: tokens.outputTokens
+		} : {
+			input: 0,
+			output: 0
+		},
+		...tokens.status === "known" ? {} : { tokensKnown: false },
+		usd: cost.status === "known" ? cost.usd : cost.knownLowerBoundUsd,
+		...cost.status === "known" ? {} : { usdKnown: false },
+		ms: result.wallMs ?? 0
+	};
+}
+/** The dollar maximum a paid call declares, or null when it declares no priced one. */
+function chargeMaximumUsd(maximum) {
+	if (!maximum) return null;
+	if ("externallyEnforcedMaximumUsd" in maximum) return maximum.externallyEnforcedMaximumUsd;
+	if ("customTokenPricing" in maximum) return costForTokenPricing(maximum.customTokenPricing, maximum);
+	const priced = costForUsage(maximum.model, maximum);
+	return priced.costUnknown ? null : priced.costUsd;
+}
+const TAG_SEARCH = "searchId";
+const TAG_RUN = "searchRunId";
+const TAG_LANE = "searchLane";
+const TAG_OPERATION = "searchOperation";
+/** The cost-ledger tags of one search's calls: a cell attempt's, or a proposal operation's. */
+function searchCallTags(searchId, of) {
+	return "run" in of ? {
+		[TAG_SEARCH]: searchId,
+		[TAG_RUN]: of.run,
+		[TAG_LANE]: of.lane
+	} : {
+		[TAG_SEARCH]: searchId,
+		[TAG_OPERATION]: of.operation
+	};
+}
+/** The search ledger with `tags` added to every paid call. */
+function taggedLedger(ledger, tags) {
+	return ledgerView(ledger, (input) => ledger.runPaidCall({
+		...input,
+		tags: {
+			...input.tags,
+			...tags
+		}
+	}));
+}
+function ledgerView(ledger, runPaidCall) {
+	return new Proxy(ledger, { get(target, property) {
+		if (property === "runPaidCall") return runPaidCall;
+		const value = Reflect.get(target, property, target);
+		return typeof value === "function" ? value.bind(target) : value;
+	} });
+}
+/**
+* The search ledger seen by one attempt: every paid call carries the attempt's tags. On a hard
+* lane every call also holds its declared maximum against the lane's `cellUsd` until its
+* receipt replaces the hold with the charge, and a call that would pass the cap, or declares no
+* priced maximum, is refused. A charge the provider left unknown keeps its maximum held.
+*/
+function attemptLedger(ledger, lane, tags) {
+	const tagged = taggedLedger(ledger, tags);
+	if (lane.costCap !== "hard") return tagged;
+	let heldUsd = 0;
+	const runPaidCall = async (input) => {
+		const maximumUsd = chargeMaximumUsd(input.maximumCharge);
+		if (maximumUsd === null) return {
+			succeeded: false,
+			error: new CostAccountingIncompleteError(`lane ${lane.name} caps each cell at $${lane.cellUsd}, so paid call '${input.actor}' during '${input.phase}' needs a priced maximumCharge`)
+		};
+		if (heldUsd + maximumUsd > lane.cellUsd + USD_TOLERANCE) return {
+			succeeded: false,
+			error: new CostCeilingReachedError(lane.cellUsd, heldUsd, maximumUsd, input.phase, input.actor)
+		};
+		heldUsd += maximumUsd;
+		const result = await tagged.runPaidCall(input);
+		const { receipt } = result;
+		if (receipt && !receipt.costUnknown) heldUsd += receipt.costUsd - maximumUsd;
+		return result;
+	};
+	return ledgerView(tagged, runPaidCall);
+}
+/**
+* An attempt's cost is every call tagged with its run id, a call a process that ended made for
+* it included; a call still pending makes the cost unknown with the settled calls as its floor.
+* A subscription seat reports no tokens, and its own work charges no dollar.
+*/
+function attemptAccounting(ledger, lane, tags) {
+	const receipts = ledger.list({ tags });
+	const accounting = searchReceiptAccounting(receipts);
+	const pending = ledger.listPending?.({ tags }) ?? [];
+	const floorUsd = accounting.cost.status === "known" ? accounting.cost.usd : accounting.cost.knownLowerBoundUsd;
+	const cost = pending.length > 0 ? {
+		status: "unknown",
+		knownLowerBoundUsd: floorUsd,
+		reason: `${pending.length} paid call(s) of the attempt had no receipt when it ended`
+	} : accounting.cost.status === "known" && accounting.cost.usd > 0 && receipts.some((receipt) => receipt.actualCostUsd === void 0) ? {
+		...accounting.cost,
+		source: "pricing-table"
+	} : accounting.cost;
+	return {
+		tokens: lane.kind === "subscription" ? {
+			status: "unknown",
+			reason: "a subscription seat reports no token usage"
+		} : accounting.tokens,
+		cost
+	};
+}
+/**
+* Settle every paid call of `searchId` that a process which ended left pending, before the
+* reopened search makes a new one: a capped ledger refuses new paid work while one is
+* unresolved. A cell's call is asked of its lane's provider through `recoverReceipt`; any other
+* call, or one the provider cannot answer, settles failed with an unknown cost.
+*/
+async function reconcileInterruptedSearchCalls(ledger, searchId, lanes) {
+	const interrupted = (ledger.listPending?.({ tags: { [TAG_SEARCH]: searchId } }) ?? []).filter((call) => call.state === "interrupted");
+	let recovered = 0;
+	for (const call of interrupted) {
+		const receipt = await lanes.find((candidate) => candidate.name === call.tags?.[TAG_LANE])?.recoverReceipt?.(call) ?? null;
+		if (receipt) {
+			ledger.reconcile(call.callId, receipt);
+			recovered += 1;
+		} else ledger.reconcile(call.callId, {
+			model: call.model,
+			inputTokens: 0,
+			outputTokens: 0,
+			costUnknown: true,
+			usageUnknown: true
+		}, { error: "the process that made this call ended before its receipt" });
+	}
+	return {
+		recovered,
+		unknown: interrupted.length - recovered
+	};
+}
+/** Finished attempts by run id: the record a restarted kernel adopts. */
+function attemptStore(storage, dir) {
+	const pathOf = (runId) => join(dir, `${runId.replace(/[^A-Za-z0-9_-]/gu, ".")}.json`);
+	storage.ensureDir(dir);
+	return {
+		read(runId) {
+			const text = storage.read(pathOf(runId));
+			if (text === void 0) return null;
+			const record = JSON.parse(text);
+			if (record.runId !== runId || !record.result) throw new Error(`attempt record ${pathOf(runId)} does not hold run ${runId}`);
+			return record.result;
+		},
+		write(runId, result) {
+			const text = `${JSON.stringify({
+				runId,
+				result
+			})}\n`;
+			const path = pathOf(runId);
+			if (storage.kind !== "filesystem") {
+				storage.write(path, text);
+				return;
+			}
+			mkdirSync(dirname(path), { recursive: true });
+			const temporary = `${path}.${process.pid}.tmp`;
+			writeFileSync(temporary, text);
+			renameSync(temporary, path);
+		}
+	};
+}
+const STATUS_OK = 1;
+const STATUS_ERROR = 2;
+const MAX_ATTRIBUTE_CHARS = 256;
+function searchTracing(options) {
+	const mode = options.trace;
+	const fileExporter = mode === void 0 && options.storage.kind === "filesystem" ? createOpenInferenceFileExporter(join(options.dir, "spans.otlp.jsonl")) : void 0;
+	const off = (reason) => ({
+		ids: null,
+		span: () => ({
+			setAttribute() {},
+			end() {}
+		}),
+		finish: async () => ({ unknown: reason })
+	});
+	return { open(work, lane) {
+		if (mode === "off") return off("tracing is off for this search");
+		const exporter = mode === void 0 ? fileExporter : createOtelExporter(mode.otlp);
+		if (!exporter) return off(mode === void 0 ? "the search storage is not the filesystem and no OTLP exporter was configured" : "the OTLP exporter has no endpoint");
+		return attemptTrace(work, lane, exporter, mode !== void 0);
+	} };
+}
+/**
+* One attempt's trace. Its ids derive from the run id, so an attempt run again after a restart
+* writes into the same trace. A shared file exporter writes each span synchronously, so the
+* attempt's written and dropped counts are the change in the exporter's own counts across each
+* of its spans; an attempt's own OTLP exporter is shut down at the end and read whole.
+*/
+function attemptTrace(work, lane, exporter, ownsExporter) {
+	const traceId = padTraceId(`search-cell:${work.runId}`);
+	const rootSpanId = padSpanId(`search-cell:${work.runId}`);
+	const startMs = Date.now();
+	let written = 0;
+	let dropped = 0;
+	const exportCounted = (span) => {
+		if (ownsExporter) {
+			exporter.exportSpan(span);
+			return;
+		}
+		const before = exporter.stats();
+		exporter.exportSpan(span);
+		const after = exporter.stats();
+		written += after.written - before.written;
+		dropped += after.dropped - before.dropped;
+	};
+	return {
+		ids: {
+			traceId,
+			spanId: rootSpanId
+		},
+		span(name, attributes = {}) {
+			const opened = Date.now();
+			const record = { ...attributes };
+			let ended = false;
+			return {
+				setAttribute(key, value) {
+					record[key] = value;
+				},
+				end(endAttributes = {}) {
+					if (ended) return;
+					ended = true;
+					exportCounted(otelSpan({
+						traceId,
+						spanId: generateSpanId(),
+						parentSpanId: rootSpanId,
+						name,
+						startMs: opened,
+						endMs: Date.now(),
+						attributes: {
+							...record,
+							...endAttributes
+						},
+						status: STATUS_OK
+					}));
+				}
+			};
+		},
+		async finish(result) {
+			const root = branchSpan({
+				traceId,
+				spanId: rootSpanId,
+				name: "search.cell",
+				startTime: new Date(startMs).toISOString(),
+				branchId: work.nodeId,
+				arm: lane.name,
+				attributes: {
+					"tangle.search.id": work.searchId,
+					"tangle.search.cell_id": work.cellId,
+					"tangle.search.run_id": work.runId,
+					"tangle.search.task_id": work.taskId,
+					"tangle.search.split": work.split,
+					"tangle.search.stage": work.stage,
+					"tangle.search.attempt": work.attempt,
+					"tangle.search.lane": lane.name,
+					"tangle.search.lane_kind": lane.kind,
+					"tangle.search.outcome": result.outcome.status,
+					..."score" in result.outcome ? { [ATTR.score]: result.outcome.score } : {}
+				}
+			});
+			exportCounted(otelSpan({
+				traceId,
+				spanId: rootSpanId,
+				name: root.name,
+				startMs,
+				endMs: Date.now(),
+				attributes: root.attributes,
+				status: result.outcome.status === "errored" ? STATUS_ERROR : STATUS_OK
+			}));
+			if (ownsExporter) {
+				await exporter.shutdown();
+				const stats = exporter.stats();
+				written = stats.written;
+				dropped = stats.dropped;
+			}
+			return {
+				traceId,
+				execRunId: null,
+				spansWritten: written,
+				spansDropped: dropped
+			};
+		}
+	};
+}
+function otelSpan(input) {
+	const attributes = {};
+	for (const [key, value] of Object.entries(input.attributes)) if (typeof value === "number" || typeof value === "boolean") attributes[key] = value;
+	else if (typeof value === "string") attributes[key] = value.slice(0, MAX_ATTRIBUTE_CHARS);
+	return {
+		traceId: input.traceId,
+		spanId: input.spanId,
+		...input.parentSpanId ? { parentSpanId: input.parentSpanId } : {},
+		name: input.name,
+		kind: 1,
+		startTimeUnixNano: (BigInt(Math.floor(input.startMs)) * 1000000n).toString(),
+		endTimeUnixNano: (BigInt(Math.floor(Math.max(input.startMs, input.endMs))) * 1000000n).toString(),
+		attributes: toOtelAttributes(attributes),
+		status: { code: input.status }
+	};
+}
+//#endregion
+//#region src/improvement/search-method.ts
+/** Build Runtime's native search for `improve(profile, { method })`. */
+function searchMethod(options) {
+	if (!options || typeof options !== "object") throw new ConfigError("searchMethod(): options are required");
+	const { proposer } = options;
+	if (!proposer || typeof proposer.kind !== "string" || typeof proposer.propose !== "function") throw new ConfigError("searchMethod(): proposer must be a SurfaceProposer");
+	const count = (name, value, fallback, min) => {
+		const resolved = value ?? fallback;
+		if (!Number.isSafeInteger(resolved) || resolved < min) throw new ConfigError(`searchMethod(): ${name} must be an integer of at least ${min}`);
+		return resolved;
+	};
+	const dollars = (name, value) => {
+		if (value === void 0) return null;
+		if (!Number.isFinite(value) || value < 0) throw new ConfigError(`searchMethod(): ${name} must be a finite non-negative number`);
+		return value;
+	};
+	if (options.deadline !== void 0 && !Number.isFinite(Date.parse(options.deadline))) throw new ConfigError("searchMethod(): deadline must be an ISO time");
+	const name = options.name ?? "search";
+	if (!name.trim() || name.trim() !== name) throw new ConfigError("searchMethod(): name must be a trimmed non-empty string");
+	assertSearchLanes(options.lanes, "searchMethod()");
+	return Object.freeze({
+		kind: "search",
+		name,
+		policy: options.policy ?? aide(),
+		allocation: options.allocation ?? asha(),
+		proposer,
+		maxExpansions: count("maxExpansions", options.maxExpansions, NaN, 0),
+		childrenPerProposal: count("childrenPerProposal", options.childrenPerProposal, 1, 1),
+		lanes: Object.freeze([...options.lanes]),
+		claimReserveUsd: dollars("claimReserveUsd", options.claimReserveUsd),
+		deadline: options.deadline === void 0 ? null : new Date(options.deadline).toISOString(),
+		maxAttempts: count("maxAttempts", options.maxAttempts, 3, 1)
+	});
+}
+function isImproveSearchMethod(value) {
+	return typeof value === "object" && value !== null && value.kind === "search";
+}
+const SEARCH_METHOD_SOURCE = {
+	uri: "npm:@tangle-network/agent-runtime#searchMethod",
+	revision: canonicalCandidateDigest$1({
+		name: "agent-runtime.search-method.2026-09",
+		node: "an exact AgentProfile materialized from the baseline and one surface, content-addressed by canonicalAgentProfileDigest; a surface that does not materialize is a node addressed by its surface and refused",
+		edge: "the Interface diffs from the parent profile to the child, stored when they reproduce the child digest",
+		admission: "a candidate is refused when it does not materialize, declares training on a test task, fails the caller validator, carries a credential or private value, or no lane can run its profile",
+		cell: "a one-cell runCampaign of the materialized profile in a directory addressed by its digest, on a lane that accepts the profile; a cached cell is read back, not run again; a finished attempt is recorded by run id before it settles and adopted after a restart",
+		lanes: "a hard lane refuses a paid call that declares no priced maximum or would take the cell past its cellUsd; an environment fault settles errored and retryable; a subscription seat reports no tokens and charges no dollars",
+		proposer: "a SurfaceProposer reads the parents, the train view and the train summary; paid calls it makes are its operation accounting",
+		ship: "the claim shipped, re-derives from the ledger, cost accounting is complete, and the shipped finalist test lower bound exceeds minimumLift"
+	})
+};
+async function runSearchImprovement(profile, opts) {
+	const { method, claim: inputClaim, agent, trainScenarios, selectionScenarios, testScenarios, judges: _judges, surface: _surface, executionRef: _executionRef, validateCandidate: _validateCandidate, findings: _findings, skills: _skills, profileComponents: _profileComponents, minimumLift: _minimumLift, subject: _subject, costCeiling, costLedger: inputCostLedger, seed = 42, signal, workerSlots, budgetPool, trace, ...campaignOptions } = opts;
+	if (!isImproveSearchMethod(method)) throw new ConfigError("improve(): a search needs method: searchMethod(...)");
+	const claim = defineEvaluationClaim(inputClaim);
+	if (claim.minimumEffect === void 0) throw new ConfigError("improve(): a search claim needs minimumEffect for its power check");
+	for (const [name, split] of [
+		["trainScenarios", trainScenarios],
+		["selectionScenarios", selectionScenarios],
+		["testScenarios", testScenarios]
+	]) if (!Array.isArray(split) || split.length === 0) throw new ConfigError(`improve(): a search needs at least one of ${name}`);
+	const { allocation, policy, lanes } = method;
+	const reps = allocation.reps;
+	const concurrency = lanes.reduce((total, lane) => total + lane.capacity, 0);
+	const prepared = prepareProfileImprovement(profile, {
+		...opts,
+		seed,
+		reps,
+		optimizationRunOptions: {
+			reps,
+			maxConcurrency: concurrency
+		}
+	});
+	const { evaluationRef } = prepared.identity;
+	const storage = campaignOptions.storage ?? fsCampaignStorage();
+	const runDir = resolveRunDir(campaignOptions.runDir, campaignOptions.repo);
+	const searchId = `improve-${canonicalCandidateDigest$1({
+		evaluationRef,
+		process: SEARCH_METHOD_SOURCE,
+		method: searchMethodDescriptor(method)
+	}).slice(7, 31)}`;
+	const searchDir = `${runDir}/search/${searchId}`;
+	const costLedger = inputCostLedger ?? createRunCostLedger({
+		storage,
+		runDir: searchDir,
+		costCeilingUsd: costCeiling
+	});
+	const unitOf = (scenario) => summarizeEvaluationUnits(claim, [scenario]).units[0].id;
+	const tasks = (scenarios) => scenarios.map((scenario) => ({
+		taskId: scenario.id,
+		unitId: unitOf(scenario),
+		source: {
+			uri: `scenario://${scenario.id}`,
+			revision: canonicalCandidateDigest$1(scenario)
+		}
+	}));
+	const splits = {
+		train: tasks(trainScenarios),
+		selection: tasks(selectionScenarios),
+		test: tasks(testScenarios)
+	};
+	const developmentUnits = new Set([...splits.train, ...splits.selection].map((task) => task.unitId));
+	const execution = {
+		model: prepared.searchIdentity.model,
+		agent: prepared.searchIdentity.agent,
+		benchmark: {
+			uri: "agent-runtime:improve-splits",
+			revision: canonicalCandidateDigest$1({
+				development: prepared.identity.developmentSplitDigest,
+				test: prepared.identity.finalTestSplitDigest
+			})
+		}
+	};
+	const reservedClaimUsd = Math.max(method.claimReserveUsd ?? 0, searchClaimReserveUsd({
+		testTasks: splits.test.length,
+		reps,
+		cellUsd: Math.max(...lanes.map((lane) => lane.cellUsd))
+	}));
+	const recorder = await SearchRecorder.open({
+		ledger: storage.kind === "filesystem" ? openSearchLedger({
+			path: `${searchDir}/ledger.jsonl`,
+			searchId
+		}) : openSearchLedger({
+			path: `${searchDir}/ledger.jsonl`,
+			searchId,
+			store: storage
+		}),
+		storage
+	}, {
+		subject: prepared.searchIdentity.subject,
+		process: {
+			name: method.name,
+			executionRef: SEARCH_METHOD_SOURCE
+		},
+		artifactKind: "agent-profile",
+		objective: {
+			metric: "composite",
+			direction: "maximize",
+			judge: prepared.searchIdentity.judge,
+			claim
+		},
+		splits: {
+			...splits,
+			heldOutUnits: splits.test.every((task) => !developmentUnits.has(task.unitId))
+		},
+		policy: {
+			expansion: policy.name,
+			allocation: allocation.name,
+			seed
+		},
+		budget: {
+			maxUsd: costCeiling ?? null,
+			maxCells: null,
+			maxNodes: 1 + method.maxExpansions * method.childrenPerProposal,
+			deadline: method.deadline,
+			maxConcurrency: concurrency,
+			reservedClaimUsd: costCeiling === void 0 ? 0 : reservedClaimUsd
+		},
+		containment: null,
+		derivedFrom: null,
+		identity: execution
+	});
+	const nodeOf = (candidateSurface) => {
+		const surface = immutableCandidateValue(candidateSurface);
+		try {
+			return {
+				surface,
+				profile: prepared.materializeCandidate(surface),
+				refusal: null
+			};
+		} catch (error) {
+			return {
+				surface,
+				profile: null,
+				refusal: refusalText(error)
+			};
+		}
+	};
+	const profiles = /* @__PURE__ */ new Map();
+	const profiled = profileCodec(prepared);
+	const codec = {
+		node(recorder, node) {
+			const registered = profiled.node(recorder, node);
+			profiles.set(searchNodeId(searchId, registered.artifactDigest), node.profile);
+			return registered;
+		},
+		diff: profiled.diff,
+		load(recorder, node) {
+			const loaded = profiled.load(recorder, node);
+			profiles.set(node.nodeId, loaded.profile);
+			return loaded;
+		}
+	};
+	for (const node of (await recorder.state()).nodes()) codec.load(recorder, node);
+	await reconcileInterruptedSearchCalls(costLedger, searchId, lanes);
+	const laneRefusal = (nodeProfile) => {
+		const refusals = lanes.map((lane) => `${lane.name}: ${lane.refusal(nodeProfile)}`);
+		return lanes.some((lane) => lane.refusal(nodeProfile) === void 0) ? null : `no lane can run the profile (${refusals.join("; ")})`;
+	};
+	const root = nodeOf(prepared.baselineSurface);
+	if (root.profile) {
+		const refused = laneRefusal(root.profile);
+		if (refused) throw new ConfigError(`improve(): the baseline profile cannot run: ${refused}`);
+	}
+	const scenarios = [
+		...trainScenarios,
+		...selectionScenarios,
+		...testScenarios
+	];
+	const scenarioIds = /* @__PURE__ */ new Set();
+	for (const scenario of scenarios) {
+		if (scenarioIds.has(scenario.id)) throw new ConfigError(`improve(): scenario '${scenario.id}' appears in more than one split`);
+		scenarioIds.add(scenario.id);
+	}
+	const executor = searchExecutor({
+		lanes,
+		profileOf(nodeId) {
+			const known = profiles.get(nodeId);
+			if (known === void 0) throw new Error(`improve(): node ${nodeId} was placed unregistered`);
+			return known;
+		},
+		costLedger,
+		identity: execution,
+		storage,
+		dir: searchDir,
+		...workerSlots ? { workerSlots } : {},
+		...budgetPool ? { budgetPool } : {},
+		...trace ? { trace } : {},
+		async runAttempt({ work, lane, context, costLedger: cellLedger, span }) {
+			const nodeProfile = work.artifact.profile;
+			if (!nodeProfile) throw new Error(`improve(): refused node ${work.nodeId} was given a cell`);
+			const profileDigest = canonicalAgentProfileDigest(nodeProfile);
+			let fault;
+			const cell = (await runCampaign({
+				...campaignOptions,
+				...lane.kind === "subscription" && campaignOptions.expectUsage === void 0 ? { expectUsage: "off" } : {},
+				scenarios,
+				judges: prepared.judges,
+				seed,
+				reps,
+				storage,
+				runDir: `${searchDir}/nodes/${profileDigest.slice(7)}`,
+				dispatchRef: `improve:${evaluationRef}:${profileDigest}`,
+				async dispatch(scenario, ctx) {
+					try {
+						return await agent(nodeProfile, scenario, {
+							...ctx,
+							search: context
+						});
+					} catch (error) {
+						if (isSearchEnvironmentFault(error)) fault = error;
+						throw error;
+					}
+				},
+				cellFilter: ({ scenario, rep }) => scenario.id === work.taskId && rep === work.rep,
+				resumable: true,
+				maxConcurrency: 1,
+				costLedger: cellLedger,
+				costPhase: `search.${work.stage}`,
+				buildTraceWriter: () => ({
+					span,
+					flush: async () => {}
+				}),
+				signal: work.signal
+			})).cells[0];
+			if (!cell) throw new Error(`improve(): cell ${work.cellId} produced no campaign cell`);
+			return faultResult(campaignCellSearchResult(cell, {
+				execution,
+				lane: lane.name
+			}), cell.errorStage === "dispatch" ? fault : void 0);
+		}
+	});
+	const { proposer } = method;
+	const proposerSource = {
+		uri: `proposer:${proposer.kind}`,
+		revision: canonicalCandidateDigest$1({
+			kind: proposer.kind,
+			propose: Function.prototype.toString.call(proposer.propose),
+			decide: proposer.decide ? Function.prototype.toString.call(proposer.decide) : null
+		})
+	};
+	const proposalPhase = "search.proposal";
+	const port = {
+		name: proposer.kind,
+		kind: "optimizer",
+		source: proposerSource,
+		execution: {
+			kind: "deterministic",
+			source: proposerSource
+		},
+		childrenPerProposal: method.childrenPerProposal,
+		async propose(request) {
+			const tags = searchCallTags(searchId, { operation: request.operationId });
+			const state = await recorder.state();
+			const parents = request.parents.map(({ nodeId, artifact }) => ({
+				nodeId,
+				artifact: artifact.surface
+			}));
+			const context = Object.freeze({
+				currentSurface: parents[0]?.artifact ?? prepared.baselineSurface,
+				operator: request.operator,
+				parents,
+				train: searchProposerView(state),
+				summary: renderSearchSummary(state, { split: "train" }),
+				history: [],
+				findings: prepared.findings,
+				populationSize: method.childrenPerProposal,
+				generation: request.expansion,
+				signal: request.signal,
+				costLedger: taggedLedger(costLedger, tags),
+				costPhase: proposalPhase
+			});
+			const decision = proposer.decide?.({ history: [] });
+			const proposed = decision?.stop ? [] : await proposer.propose(context);
+			if (!Array.isArray(proposed)) throw new ConfigError("improve(): the search proposer must return an array");
+			const fresh = costLedger.list({
+				phase: proposalPhase,
+				tags
+			});
+			return {
+				children: proposed.slice(0, method.childrenPerProposal).map((child) => isProposedCandidate(child) ? {
+					artifact: nodeOf(child.surface),
+					label: child.label,
+					rationale: child.rationale,
+					...child.attribution ? { attribution: child.attribution } : {}
+				} : {
+					artifact: nodeOf(child),
+					label: "",
+					rationale: ""
+				}),
+				...decision?.stop ? { stop: decision.reason ?? "the proposer decided to stop" } : {},
+				accounting: searchReceiptAccounting(fresh),
+				execution: searchProposalExecution(fresh, prepared.searchIdentity.model.provider, proposerSource)
+			};
+		}
+	};
+	const admit = (node) => {
+		if (node.refusal !== null || node.profile === null) return node.refusal;
+		try {
+			prepared.admitCandidate(node.profile, node.surface);
+		} catch (error) {
+			return refusalText(error);
+		}
+		const paths = privateValuePaths([node.surface]);
+		if (paths.length > 0) return `the surface carries a credential or private value at ${paths.slice(0, 8).join(", ")}`;
+		return laneRefusal(node.profile);
+	};
+	const startedAt = Date.now();
+	const result = await runSearch({
+		recorder,
+		root,
+		codec,
+		policy,
+		allocation,
+		proposer: port,
+		executor,
+		admit,
+		maxExpansions: method.maxExpansions,
+		maxAttempts: method.maxAttempts,
+		...signal ? { signal } : {}
+	});
+	const { state } = result;
+	const claimResult = result.claim;
+	if (!claimResult || !result.claimVerification) throw new Error(`improve(): search ${searchId} closed without a claim`);
+	const kept = codec.load(recorder, state.node(result.leader));
+	if (!kept.profile) throw new Error(`improve(): search ${searchId} kept a refused node`);
+	const candidate = Object.freeze({
+		surface: prepared.surface,
+		value: kept.surface,
+		profile: kept.profile
+	});
+	const cost = copyImproveCost(costLedger.summary());
+	const shipped = claimResult.finalists.find((finalist) => finalist.nodeId === claimResult.selected && finalist.test !== null);
+	const { decision, reason } = runtimeShipDecision({
+		claim: claimResult,
+		verified: result.claimVerification.status === "verified",
+		accountingComplete: cost.accountingComplete,
+		lowerBound: shipped?.test?.interval[0] ?? null,
+		minimumLift: prepared.minimumLift
+	});
+	return {
+		mode: "search",
+		method: method.name,
+		candidate,
+		decision,
+		reason,
+		claim: claimResult,
+		claimVerification: result.claimVerification,
+		...shipped?.test ? {
+			lift: shipped.test.delta,
+			liftInterval: {
+				low: shipped.test.interval[0],
+				high: shipped.test.interval[1]
+			}
+		} : {},
+		searchHistory: recorder.receipt({
+			producerId: method.name,
+			runId: searchId
+		}),
+		cost,
+		durationMs: Date.now() - startedAt,
+		lineage: Object.freeze({
+			invocationId: prepared.invocationId,
+			runId: searchId,
+			developmentSplitDigest: prepared.identity.developmentSplitDigest,
+			finalTestSplitDigest: prepared.identity.finalTestSplitDigest,
+			scenarioPartitions: prepared.identity.scenarioPartitions,
+			executionRef: prepared.executionRef,
+			baselineProfileDigest: prepared.baselineProfileDigest
+		}),
+		async dispose() {}
+	};
+}
+/** Runtime's ship rule over the kernel's statistical claim (design §6.5 step 5), shared by
+* `searchMethod` and `runStrategyEvolution`. */
+function runtimeShipDecision(input) {
+	const { claim } = input;
+	if (claim.decision !== "ship") return {
+		decision: "hold",
+		reason: claim.reason
+	};
+	if (!input.verified) return {
+		decision: "hold",
+		reason: "the claim shipped, but it does not re-derive from the ledger under this rule revision"
+	};
+	if (!input.accountingComplete) return {
+		decision: "hold",
+		reason: "the claim shipped, but the search cost accounting is incomplete"
+	};
+	if (input.lowerBound === null || !(input.lowerBound > input.minimumLift)) return {
+		decision: "hold",
+		reason: `the claim shipped, but its test lower bound ${input.lowerBound} does not exceed minimumLift ${input.minimumLift}`
+	};
+	return {
+		decision: "ship",
+		reason: claim.reason
+	};
+}
+/** Profiles as search artifacts: nodes by profile digest, edges by profile diffs. */
+function profileCodec(prepared) {
+	const surfaceId = prepared.surface;
+	return {
+		node(recorder, node) {
+			if (node.profile) {
+				const artifact = recorder.blob("agent-profile", {
+					kind: "agent-profile",
+					profile: node.profile
+				});
+				return {
+					artifactDigest: canonicalAgentProfileDigest(node.profile),
+					artifact,
+					surfaces: [{
+						surfaceId,
+						kind: "agent-profile",
+						artifact
+					}]
+				};
+			}
+			const artifact = recorder.blob("surface", {
+				kind: "unmaterialized-surface",
+				surface: node.surface,
+				refusal: node.refusal
+			});
+			return {
+				artifactDigest: canonicalCandidateDigest$1({
+					kind: "unmaterialized-surface",
+					surface: node.surface
+				}),
+				artifact,
+				surfaces: [{
+					surfaceId,
+					kind: "agent-profile",
+					artifact
+				}]
+			};
+		},
+		diff(recorder, parent, child) {
+			if (!parent.profile || !child.profile) return { unknown: "a surface that does not materialize has no profile to diff" };
+			const diffs = diffAgentProfiles(parent.profile, child.profile);
+			const to = canonicalAgentProfileDigest(child.profile);
+			if (canonicalAgentProfileDigest(diffs.reduce(applyAgentProfileDiff, parent.profile)) !== to) return { unknown: "the Interface profile diffs do not reproduce the child profile" };
+			return recorder.blob("diff", {
+				kind: "agent-profile-diff",
+				from: canonicalAgentProfileDigest(parent.profile),
+				to,
+				diffs
+			});
+		},
+		load(recorder, node) {
+			const stored = recorder.readBlob(node.artifact);
+			if (stored.kind === "agent-profile") {
+				const parsed = agentProfileSchema.safeParse(stored.profile);
+				if (!parsed.success) throw new Error(`improve(): node ${node.nodeId} holds an invalid AgentProfile`);
+				const loaded = immutableCandidateValue(parsed.data);
+				return {
+					surface: prepared.surfaceOf(loaded),
+					profile: loaded,
+					refusal: null
+				};
+			}
+			if (stored.kind === "unmaterialized-surface" && stored.surface !== void 0) return {
+				surface: stored.surface,
+				profile: null,
+				refusal: stored.refusal ?? null
+			};
+			throw new Error(`improve(): node ${node.nodeId} holds no profile search artifact`);
+		}
+	};
+}
+/** Everything that decides which search a call continues. */
+function searchMethodDescriptor(method) {
+	return {
+		name: method.name,
+		policy: method.policy.name,
+		allocation: method.allocation.name,
+		reps: method.allocation.reps,
+		proposer: method.proposer.kind,
+		maxExpansions: method.maxExpansions,
+		childrenPerProposal: method.childrenPerProposal,
+		lanes: method.lanes.map(({ name, kind, capacity, costCap, cellUsd }) => ({
+			name,
+			kind,
+			capacity,
+			costCap,
+			cellUsd
+		})),
+		claimReserveUsd: method.claimReserveUsd,
+		deadline: method.deadline,
+		maxAttempts: method.maxAttempts
+	};
+}
+/**
+* An environment fault the agent raised settles retryable. The campaign reports every error as
+* final because it applies its own retry policy; here the kernel owns retries.
+*/
+function faultResult(result, fault) {
+	if (fault === void 0 || result.outcome.status !== "errored") return result;
+	return {
+		...result,
+		outcome: {
+			...result.outcome,
+			error: {
+				code: "environment-fault",
+				message: refusalText(fault),
+				retryable: true
+			}
+		}
+	};
+}
+/** A refusal as the ledger stores it: redacted with the share profile. */
+function refusalText(error) {
+	return redact(error instanceof Error ? error.message : String(error), { profile: "share" }).value;
+}
+//#endregion
+export { sampleThenRefine as $, parseRolloutPolicy as A, officialChecksFromMeta as B, privateValuePaths as C, ROLLOUT_POLICY_EXTENSION as D, isCodeSurface as E, composeCheckSources as F, visibleCheckScore as G, sandboxCheckRunner as H, defaultExtractCandidate as I, defineStrategy as J, adaptiveRefine as K, defaultStructuralRolloutPolicy as L, structuralRolloutPolicyFromProfile as M, canDisplace as N, applyRolloutPolicyToProfile as O, compareCheckOutcomes as P, sample as Q, filterAuthoredAsserts as R, parseExecutionRef as S, assertCandidateSurfaceKind as T, selectBestIndex as U, resolveEntrySymbol as V, structuralRollout as W, refine as X, depthStrategy as Y, runAgentic as Z, sharedBoxRefusal as _, startOrResumeRuntimeSession as _t, SearchEnvironmentFault as a, profileOptimizerModelCall as at, assertCandidateValidator as b, reconcileInterruptedSearchCalls as c, strategyAuthorMethod as ct, sharedBoxLane as d, createIterableBackend as dt, ObservationError as et, subscriptionLane as f, createSandboxPromptBackend as ft, sharedBoxPlacement as g, nowIso as gt, ROUTER_CLIENT_HEADER as h, newRuntimeSession as ht, searchMethod as i, profileChatClient as it, serializeRolloutPolicy as j, normalizeRolloutPolicy as k, routerLane as l, collectAgentTurn as lt, DEFAULT_SHARED_BOX_WORKERS as m, InMemoryRuntimeSessionStore as mt, runSearchImprovement as n, observe as nt, dedicatedLane as o, copyImproveCost as ot, DEFAULT_SHARED_BOX_RESOURCES as p, normalizeBackendStreamEvent as pt, breadthStrategy as q, runtimeShipDecision as r, renderReport as rt, isSearchEnvironmentFault as s, optimizerMethod as st, isImproveSearchMethod as t, defaultAnalystInstruction as tt, searchExecutor as u, streamAgentTurn as ut, sharedWorkerClientName as v, touchSession as vt, validateProfileCandidate as w, assertProfileTrainingIsHeldOut as x, prepareProfileImprovement as y, modelAuthoredChecks as z };
 
-//# sourceMappingURL=shared-box-CZFdugL1.js.map
+//# sourceMappingURL=search-method-CbUyhdz5.js.map