@tangle-network/agent-runtime 0.281.1 → 0.282.2

package/dist/{runtime-B_yRPBjj.js → runtime-B3TTjtzE.js}

@@ -1,28 +1,30 @@
-import { $i as detachedSnapshot, $t as isTraceAnalysisStore, Ai as readCommittedJsonLines, Ca as stringifySafe, Et as rollingDispatch, Gn as probeSandboxCapabilities, Gt as encodeResultBlob, Ht as InMemorySpawnJournal, Ia as armDeadlineTimer, Jn as readPromptOptions, Kt as insideCursorNamespace, M as withDriverExecutor, Mt as createExecutorRegistry, O as verdictFromJudgeScore, Oa as zeroSpend, Pt as createWorktreeCliExecutor, Qi as detachedFrozen, Sa as sleep, Un as runAgentRounds, Ut as SpawnEventIndex, Vn as defaultSelectWinner, Vt as InMemoryResultBlobStore, W as settledToIteration, Wn as createSandboxLineage, Wt as assertContentAddress, Xi as executableAgentProfileSnapshot, Xn as runBrainLoop, Yn as routerBrain, Zi as executableAgentSpecSnapshot, Zn as canonicalObservedModelParts, _ as CheckUnavailableError, cr as createPushTraceSource, ga as cloneSpend, ha as chargedTokens, ji as writeAllBytes, jt as createExecutor, ki as prepareJsonlAppend, kr as contentAddress, ma as addSpend, qn as assertBoxlessPromptOptions, r as createSupervisor, ua as notifySandboxEventObserver, va as hasCompleteCacheBreakdown, xa as randomSuffix, ya as isAbortError } from "./supervisor-UXgaPisu.js";
-import { m as ValidationError, n as AnalystError, s as PlannerError } from "./errors-DodWX-cb.js";
-import { D as sample, E as runAgentic, I as strategyAuthorMethod, M as renderReport, N as profileChatClient, O as sampleThenRefine, T as refine, j as observe, k as ObservationError } from "./shared-box-CZFdugL1.js";
+import { $i as detachedSnapshot, $t as isTraceAnalysisStore, Ai as readCommittedJsonLines, Ca as stringifySafe, Et as rollingDispatch, Gn as probeSandboxCapabilities, Gt as encodeResultBlob, Ht as InMemorySpawnJournal, Ia as armDeadlineTimer, Jn as readPromptOptions, Kt as insideCursorNamespace, M as withDriverExecutor, Mt as createExecutorRegistry, O as verdictFromJudgeScore, Oa as zeroSpend, Pt as createWorktreeCliExecutor, Qi as detachedFrozen, Sa as sleep, Un as runAgentRounds, Ut as SpawnEventIndex, Vn as defaultSelectWinner, Vt as InMemoryResultBlobStore, W as settledToIteration, Wn as createSandboxLineage, Wt as assertContentAddress, Xi as executableAgentProfileSnapshot, Xn as runBrainLoop, Yn as routerBrain, Zi as executableAgentSpecSnapshot, Zn as canonicalObservedModelParts, _ as CheckUnavailableError, cr as createPushTraceSource, ga as cloneSpend, ha as chargedTokens, ji as writeAllBytes, jt as createExecutor, ki as prepareJsonlAppend, kr as contentAddress, ma as addSpend, qn as assertBoxlessPromptOptions, r as createSupervisor, ua as notifySandboxEventObserver, va as hasCompleteCacheBreakdown, xa as randomSuffix, ya as isAbortError } from "./supervisor-YAc4U8HQ.js";
+import { i as ConfigError, m as ValidationError, n as AnalystError, s as PlannerError } from "./errors-DodWX-cb.js";
+import { Q as sample, X as refine, Z as runAgentic, c as reconcileInterruptedSearchCalls, ct as strategyAuthorMethod, et as ObservationError, it as profileChatClient, nt as observe, o as dedicatedLane, r as runtimeShipDecision, rt as renderReport, u as searchExecutor } from "./search-method-q43Af9yu.js";
 import { c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, t as assertExecutableAgentProfile } from "./model-policy-BbSCSak0.js";
-import { C as canonicalCandidateDigest$1, D as immutableCandidateValue, k as sha256Bytes$1, m as captureMaterializedWorkspace } from "./workspace-archive-C9lgf77y.js";
+import { A as sha256Bytes$1, O as immutableCandidateValue, f as WorkspaceScanLimitError, h as captureMaterializedWorkspace, w as canonicalCandidateDigest$1 } from "./workspace-archive-MhowMCmp.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-tXpAarhW.js";
 import { i as redactProtectedValue, r as redactProtectedReason } from "./protected-redaction-DylCC_ot.js";
-import { S as foldCoordinationRecords, y as createInMemoryRunContext } from "./coordination-driver-B-HOpGN4.js";
-import { C as gateOnDeliverable, r as supervise, w as mapExecutorResult } from "./supervise-zt91I62x.js";
+import { S as foldCoordinationRecords, y as createInMemoryRunContext } from "./coordination-driver-BmkANXc5.js";
+import { C as gateOnDeliverable, r as supervise, w as mapExecutorResult } from "./supervise-DL_Hj1uk.js";
 import "./run-layout-vwd4SwX_.js";
-import "./provision-supervisor-CkN8RRjv.js";
-import "./delegate-C1eIBN70.js";
-import "./graph-KjJaTmbO.js";
+import "./provision-supervisor-BNUmrHwC.js";
+import "./delegate-BfHKdHzV.js";
+import "./graph-XmlRTlaI.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, sha256Bytes, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { CODING_HARNESSES, DEFAULT_TRACE_ANALYST_KINDS, InMemoryTraceStore, OUTPUT_VALUE, benjaminiHochberg, buildTrajectory, computeFindingId as computeFindingId$1, confidenceInterval, createTraceAnalyst, expandProfileAxes, makeFinding as makeFinding$1, pairedBootstrap, paretoFrontier, wilcoxonSignedRank, wilson } from "@tangle-network/agent-eval";
 import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
 import { createHash, randomUUID } from "node:crypto";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
-import { appendFileSync, chmodSync, constants, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { appendFileSync, chmodSync, constants, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readlinkSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { cp, mkdir, mkdtemp, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
+import { chmod, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { isDeepStrictEqual, promisify } from "node:util";
+import { redact } from "@tangle-network/agent-eval/traces";
 import { collectAgentResponseText } from "@tangle-network/sandbox";
-import { heldoutSignificance, runProfileMatrix } from "@tangle-network/agent-eval/campaign";
+import { SearchRecorder, asha, beam, createRunCostLedger, estimateNode, fsCampaignStorage, openSearchLedger, renderSearchSummary, runProfileMatrix, runSearch, searchClaimReserveUsd, searchModelIdentity, surfaceDiff } from "@tangle-network/agent-eval/campaign";
+import { defineEvaluationClaim, summarizeEvaluationUnits } from "@tangle-network/agent-eval/experiment";
 import { createInterface } from "node:readline";
 import { pathToFileURL } from "node:url";
 import { gzipSync } from "node:zlib";
@@ -59,7 +61,7 @@ function createTangleSandboxExactProcessProvider(client, options = {}) {
 					metadata,
 					idempotencyKey: requiredText(input.idempotencyKey, "exact-process idempotency key")
 				}, {
-					...input.provisionTimeoutMs === void 0 ? {} : { timeoutMs: positiveInteger(input.provisionTimeoutMs, "provision timeout") },
+					...input.provisionTimeoutMs === void 0 ? {} : { timeoutMs: positiveInteger$1(input.provisionTimeoutMs, "provision timeout") },
 					...input.signal === void 0 ? {} : { signal: input.signal }
 				});
 				try {
@@ -146,7 +148,7 @@ function sandboxAsExactProcessEnvironment(sandbox, provider) {
 	};
 }
 function sandboxProcessAsExactProcess(process) {
-	const pid = positiveInteger(process.pid, "Tangle Sandbox process pid");
+	const pid = positiveInteger$1(process.pid, "Tangle Sandbox process pid");
 	return {
 		pid,
 		async status() {
@@ -172,7 +174,7 @@ function sandboxProcessAsExactProcess(process) {
 	};
 }
 function exactProcessStatus(status, expectedPid) {
-	const pid = positiveInteger(status.pid, "Tangle Sandbox process pid");
+	const pid = positiveInteger$1(status.pid, "Tangle Sandbox process pid");
 	if (expectedPid !== void 0 && pid !== expectedPid) throw new Error("Tangle Sandbox process status changed process identity");
 	if (typeof status.running !== "boolean") throw new Error("Tangle Sandbox process status is missing running state");
 	if (!Number.isSafeInteger(status.exitCode)) throw new Error("Tangle Sandbox process status is missing an integer exit code");
@@ -272,8 +274,8 @@ function serializeEgressPolicy(policy) {
 }
 function sandboxResources(input) {
 	const cpuCores = positiveNumber(input.resources.cpu, "exact-process cpu");
-	const memoryMB = positiveInteger(input.resources.memoryMb, "exact-process memory");
-	const diskMb = positiveInteger(input.resources.diskMb, "exact-process disk");
+	const memoryMB = positiveInteger$1(input.resources.memoryMb, "exact-process memory");
+	const diskMb = positiveInteger$1(input.resources.diskMb, "exact-process disk");
 	if (diskMb % 1024 !== 0) throw new Error("Tangle Sandbox exact-process disk must be a whole GiB");
 	return {
 		cpuCores,
@@ -282,7 +284,7 @@ function sandboxResources(input) {
 	};
 }
 function sandboxLifetimeSeconds(maxLifetimeMs) {
-	const milliseconds = positiveInteger(maxLifetimeMs, "exact-process maximum lifetime");
+	const milliseconds = positiveInteger$1(maxLifetimeMs, "exact-process maximum lifetime");
 	if (milliseconds % 1e3 !== 0) throw new Error("Tangle Sandbox exact-process maximum lifetime must be a whole number of seconds");
 	return milliseconds / 1e3;
 }
@@ -372,7 +374,7 @@ function positiveNumber(value, label) {
 	if (!Number.isFinite(value) || value <= 0) throw new Error(`${label} must be positive`);
 	return value;
 }
-function positiveInteger(value, label) {
+function positiveInteger$1(value, label) {
 	if (!Number.isSafeInteger(value) || value < 1) throw new Error(`${label} must be a positive integer`);
 	return value;
 }
@@ -1804,7 +1806,8 @@ const contains = (parent, child) => {
 * Bubblewrap requires /usr/bin/bwrap and permission to create Linux namespaces.
 * Only trusted system toolchains, private proc/dev/tmp, and the writable copy are mounted.
 * The canonical input path remains the working directory; copy writes are discarded.
-* Limits bound command time and captured output, not copy size or memory consumption.
+* Time and output are bounded; input copy bytes and entries are bounded when requested.
+* The command's memory and generated files require a resource-limited placement.
 * Callers must keep the input and trusted toolchains stable while preparing the check.
 *
 * A box check creates one fresh box with no owner secrets and blocked egress (or strict egress to
@@ -1817,7 +1820,7 @@ async function runIsolatedCheck(options) {
 	let result;
 	try {
 		if (process.platform !== "linux") throw new Error("Linux Bubblewrap namespaces are required");
-		const { timeoutMs, maxOutputBytes } = checkLimits(options);
+		const { timeoutMs, maxOutputBytes, maxInputBytes, maxInputEntries } = checkLimits(options);
 		if (options.signal?.aborted) return {
 			succeeded: false,
 			reason: "cancelled",
@@ -1840,11 +1843,7 @@ async function runIsolatedCheck(options) {
 		scratch = await mkdtemp(join(tmpdir(), "runtime-check-"));
 		if (contains(tree, scratch)) throw new Error("Temporary storage must be outside the input tree");
 		const copy = join(scratch, "tree");
-		await cp(tree, copy, {
-			recursive: true,
-			dereference: false,
-			verbatimSymlinks: true
-		});
+		await copyBoundedTree(tree, copy, maxInputBytes, maxInputEntries);
 		result = await execute([
 			"--unshare-all",
 			"--die-with-parent",
@@ -1884,7 +1883,7 @@ async function runIsolatedCheck(options) {
 	} catch (error) {
 		result = {
 			succeeded: false,
-			reason: "refused",
+			reason: error instanceof InputLimitError ? "input-limit" : "refused",
 			diagnostic: String(error)
 		};
 	}
@@ -1909,12 +1908,68 @@ async function runIsolatedCheck(options) {
 function checkLimits(options) {
 	const timeoutMs = options.timeoutMs ?? 3e4;
 	const maxOutputBytes = options.maxOutputBytes ?? 1048576;
-	if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647 || !Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 1) throw new Error("Invalid execution limits");
+	const maxInputBytes = options.maxInputBytes;
+	const maxInputEntries = options.maxInputEntries;
+	if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647 || !Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 1 || maxInputBytes !== void 0 && (!Number.isSafeInteger(maxInputBytes) || maxInputBytes < 1) || maxInputEntries !== void 0 && (!Number.isSafeInteger(maxInputEntries) || maxInputEntries < 1)) throw new Error("Invalid execution limits");
 	if (!options.command.length || !options.command[0]) throw new Error("A command is required");
 	return {
 		timeoutMs,
-		maxOutputBytes
+		maxOutputBytes,
+		maxInputBytes,
+		maxInputEntries
+	};
+}
+var InputLimitError = class extends Error {};
+/** Copy in bounded chunks, preserving symlink text without reading its target. */
+async function copyBoundedTree(source, destination, maxBytes, maxEntries) {
+	let bytes = 0;
+	let entries = 0;
+	const buffer = Buffer.allocUnsafe(1024 * 1024);
+	const visit = async (from, to, isRoot = false) => {
+		if (!isRoot && ++entries > (maxEntries ?? Number.MAX_SAFE_INTEGER)) throw new InputLimitError("Input tree exceeds maxInputEntries");
+		const info = await lstat(from);
+		if (info.isSymbolicLink()) await symlink(await readlink(from), to);
+		else if (info.isDirectory()) {
+			await mkdir(to, { mode: 448 });
+			for await (const entry of await opendir(from)) await visit(join(from, entry.name), join(to, entry.name));
+			await chmod(to, info.mode & 511);
+		} else if (info.isFile()) {
+			if (maxBytes !== void 0 && info.size > maxBytes - bytes) throw new InputLimitError("Input tree exceeds maxInputBytes");
+			const input = await open(from, constants.O_RDONLY | constants.O_NOFOLLOW);
+			try {
+				const output = await open(to, "wx", info.mode & 511);
+				try {
+					while (true) {
+						const { bytesRead } = await input.read(buffer, 0, maxBytes === void 0 ? buffer.length : Math.min(buffer.length, maxBytes - bytes + 1), null);
+						if (bytesRead === 0) break;
+						bytes += bytesRead;
+						if (maxBytes !== void 0 && bytes > maxBytes) throw new InputLimitError("Input tree exceeds maxInputBytes");
+						let written = 0;
+						while (written < bytesRead) {
+							const result = await output.write(buffer, written, bytesRead - written);
+							if (result.bytesWritten === 0) throw new Error("Input copy made no write progress");
+							written += result.bytesWritten;
+						}
+					}
+				} finally {
+					await output.close();
+				}
+				await chmod(to, info.mode & 511);
+			} finally {
+				await input.close();
+			}
+		} else throw new Error(`Input tree contains an unsupported entry: ${from}`);
+	};
+	await visit(source, destination, true);
+}
+async function checkInputEntries(root, maxEntries) {
+	let count = 0;
+	const visit = async (path, isRoot = false) => {
+		if (!isRoot && ++count > maxEntries) throw new InputLimitError("Input tree exceeds maxInputEntries");
+		if (!(await lstat(path)).isDirectory()) return;
+		for await (const entry of await opendir(path)) await visit(join(path, entry.name));
 	};
+	await visit(root, true);
 }
 async function protectedTree(options) {
 	const workspace = await realpath(options.workspaceRoot);
@@ -1940,15 +1995,22 @@ async function runInBox(options, placement) {
 	let evidence;
 	let result;
 	try {
-		const { timeoutMs, maxOutputBytes } = checkLimits(options);
+		const { timeoutMs, maxOutputBytes, maxInputBytes, maxInputEntries } = checkLimits(options);
 		if (options.signal?.aborted) return {
 			succeeded: false,
 			reason: "cancelled",
 			diagnostic: "Check cancelled"
 		};
 		const { tree } = await protectedTree(options);
-		const captured = await captureMaterializedWorkspace(tree);
+		if (maxInputEntries !== void 0) await checkInputEntries(tree, maxInputEntries);
+		const captured = await captureMaterializedWorkspace(tree, { limits: {
+			maxFiles: maxInputEntries ?? Number.MAX_SAFE_INTEGER,
+			maxFileBytes: maxInputBytes ?? Number.MAX_SAFE_INTEGER,
+			maxTotalFileBytes: maxInputBytes ?? Number.MAX_SAFE_INTEGER
+		} });
 		if (placement.builderAccounts.length === 0 || placement.builderAccounts.some((id) => !id)) throw new Error("builderAccounts must name the account of every key the judged run holds");
+		const memoryMB = placement.resources?.memoryMB;
+		if (memoryMB !== void 0 && (!Number.isSafeInteger(memoryMB) || memoryMB < 1 || placement.resources?.advisory === true || placement.resources?.advisoryFields?.includes("memoryMB"))) throw new Error("Check box requires an explicit finite resources.memoryMB limit");
 		const account = (await placement.client.getIdentity()).customerId;
 		if (!account) throw new Error("Sandbox returned no account for the check key");
 		if (placement.builderAccounts.includes(account)) throw new Error(`Check account ${account} is an account the judged run holds a key to, so the run can reach the check box`);
@@ -1965,6 +2027,8 @@ async function runInBox(options, placement) {
 		}, options.signal ? { signal: options.signal } : void 0);
 		const receipt = box.createReceipt();
 		if (receipt?.outcome !== "created" || receipt.ownerContext !== "isolated" || !Array.isArray(receipt.injectedSecrets) || receipt.injectedSecrets.length !== 0) throw new Error("Sandbox did not confirm a fresh box with no owner secrets");
+		const grantedMemoryMB = box.resources?.memoryMB;
+		if (memoryMB !== void 0 && (typeof grantedMemoryMB !== "number" || !Number.isSafeInteger(grantedMemoryMB) || grantedMemoryMB < 1 || grantedMemoryMB > memoryMB)) throw new Error("Sandbox did not confirm the requested finite memory cgroup limit");
 		const egress = (await box.egress.get()).policy;
 		const wanted = egressFor(placement);
 		if (egress.mode !== wanted.mode || wanted.mode === "strict" && (egress.includeImplicitDomains === true || [...egress.allowDomains ?? []].sort().join(",") !== [...wanted.allowDomains ?? []].sort().join(","))) throw new Error(`Check box egress is ${egress.mode} ${JSON.stringify(egress.allowDomains ?? [])}, not ${wanted.mode} ${JSON.stringify(wanted.allowDomains ?? [])}`);
@@ -1988,6 +2052,7 @@ async function runInBox(options, placement) {
 		evidence = {
 			sandboxId: box.id,
 			account,
+			...memoryMB === void 0 ? {} : { memoryMB: grantedMemoryMB },
 			input: captured.manifest,
 			inputDigest: canonicalCandidateDigest(captured.manifest)
 		};
@@ -1995,7 +2060,7 @@ async function runInBox(options, placement) {
 	} catch (error) {
 		result = {
 			succeeded: false,
-			reason: options.signal?.aborted ? "cancelled" : "refused",
+			reason: options.signal?.aborted ? "cancelled" : error instanceof InputLimitError || error instanceof WorkspaceScanLimitError ? "input-limit" : "refused",
 			diagnostic: String(error)
 		};
 	}
@@ -4894,188 +4959,6 @@ function requireSpend(rolled, id, root) {
 	return spend;
 }
 //#endregion
-//#region src/runtime/promotion-gate.ts
-/**
-* promotionGate — the statistical promotion decision over a holdout benchmark: does the
-* candidate strategy beat the incumbent on held-out tasks by a margin the task noise
-* cannot fake? The statistics come from `heldoutSignificance`, which chooses the
-* decision interval that matches the outcome shape, applies a minimum-evidence floor,
-* and requires the interval's lower bound to clear `deltaThreshold`. A raw h1>h0 point
-* comparison on m≈8 holdout tasks certifies false champions at near coin-flip rates.
-*/
-/** Statistical promotion decision over a holdout benchmark using the outcome-appropriate interval selected by `heldoutSignificance`. */
-function promotionGate(opts) {
-	const mode = opts.mode ?? "superiority";
-	if (opts.candidate === opts.incumbent) return {
-		promoted: false,
-		reason: "identical-champion",
-		mode,
-		n: 0,
-		lift: {
-			mean: 0,
-			median: 0,
-			low: 0,
-			high: 0
-		}
-	};
-	const before = [];
-	const after = [];
-	const incUsd = [];
-	const candUsd = [];
-	const incMs = [];
-	const candMs = [];
-	const cellIds = [];
-	/** Tasks where either arm's dollars were never measured — see the refusal below. */
-	const costUnknownTasks = [];
-	for (const row of opts.report.perTask) {
-		const inc = row.cells?.[opts.incumbent];
-		const cand = row.cells?.[opts.candidate];
-		if (!inc || !cand) continue;
-		before.push(inc.score);
-		after.push(cand.score);
-		incUsd.push(inc.usd);
-		candUsd.push(cand.usd);
-		if (inc.usdKnown === false || cand.usdKnown === false) costUnknownTasks.push(row.taskId);
-		incMs.push(inc.ms);
-		candMs.push(cand.ms);
-		cellIds.push(row.taskId);
-	}
-	if (before.length === 0) throw new Error(`promotionGate: no holdout task carried cells for both "${opts.incumbent}" and "${opts.candidate}" — the report must come from a run that included both strategies`);
-	const sig = heldoutSignificance({
-		before,
-		after,
-		cellIds
-	}, {
-		deltaThreshold: opts.deltaThreshold ?? 0,
-		minProductiveRuns: opts.minPairedTasks ?? 6,
-		statistic: opts.statistic ?? "mean",
-		...opts.seed !== void 0 ? { seed: opts.seed } : {},
-		...opts.resamples !== void 0 ? { resamples: opts.resamples } : {}
-	});
-	const lift = {
-		mean: sig.bootstrap.mean,
-		median: sig.bootstrap.median,
-		low: sig.decision.low,
-		high: sig.decision.high
-	};
-	const latSig = heldoutSignificance({
-		before: incMs,
-		after: candMs,
-		cellIds
-	}, {
-		deltaThreshold: 0,
-		minProductiveRuns: 1,
-		statistic: opts.statistic ?? "mean",
-		...opts.seed !== void 0 ? { seed: opts.seed } : {},
-		...opts.resamples !== void 0 ? { resamples: opts.resamples } : {}
-	});
-	const latency = {
-		mean: latSig.bootstrap.mean,
-		median: latSig.bootstrap.median,
-		low: latSig.decision.low,
-		high: latSig.decision.high
-	};
-	if (mode === "superiority") {
-		if (sig.fewRuns) return {
-			promoted: false,
-			reason: "few-tasks",
-			mode,
-			n: sig.n,
-			lift,
-			latency
-		};
-		return sig.significant ? {
-			promoted: true,
-			reason: "significant",
-			mode,
-			n: sig.n,
-			lift,
-			latency
-		} : {
-			promoted: false,
-			reason: "no-margin",
-			mode,
-			n: sig.n,
-			lift,
-			latency
-		};
-	}
-	const tolerance = opts.scoreTolerance ?? .05;
-	const scoreSig = heldoutSignificance({
-		before,
-		after,
-		cellIds
-	}, {
-		deltaThreshold: -tolerance,
-		minProductiveRuns: opts.minPairedTasks ?? 6,
-		statistic: opts.statistic ?? "mean",
-		...opts.seed !== void 0 ? { seed: opts.seed } : {},
-		...opts.resamples !== void 0 ? { resamples: opts.resamples } : {}
-	});
-	if (costUnknownTasks.length > 0) return {
-		promoted: false,
-		reason: "cost-unknown",
-		mode,
-		n: before.length,
-		lift,
-		costUnknownTasks: [...costUnknownTasks],
-		latency
-	};
-	const costSig = heldoutSignificance({
-		before: candUsd,
-		after: incUsd,
-		cellIds
-	}, {
-		deltaThreshold: 0,
-		minProductiveRuns: opts.minPairedTasks ?? 6,
-		statistic: opts.statistic ?? "mean",
-		...opts.seed !== void 0 ? { seed: opts.seed } : {},
-		...opts.resamples !== void 0 ? { resamples: opts.resamples } : {}
-	});
-	const costSavings = {
-		mean: costSig.bootstrap.mean,
-		median: costSig.bootstrap.median,
-		low: costSig.decision.low,
-		high: costSig.decision.high
-	};
-	if (scoreSig.fewRuns) return {
-		promoted: false,
-		reason: "few-tasks",
-		mode,
-		n: scoreSig.n,
-		lift,
-		costSavings,
-		latency
-	};
-	if (!scoreSig.significant) return {
-		promoted: false,
-		reason: "non-inferiority-unproven",
-		mode,
-		n: scoreSig.n,
-		lift,
-		costSavings,
-		latency
-	};
-	if (!costSig.significant) return {
-		promoted: false,
-		reason: "not-cheaper",
-		mode,
-		n: scoreSig.n,
-		lift,
-		costSavings,
-		latency
-	};
-	return {
-		promoted: true,
-		reason: "non-inferior-and-cheaper",
-		mode,
-		n: scoreSig.n,
-		lift,
-		costSavings,
-		latency
-	};
-}
-//#endregion
 //#region src/runtime/run-benchmark.ts
 /**
 * runBenchmark — the packaged optimization suite. Define a domain by implementing an
@@ -5105,6 +4988,8 @@ async function pool(items, limit, fn) {
 	await Promise.all(workers);
 	return out;
 }
+/** @internal Check each unique worker and analyst model once before any task runs, as
+*  `BenchmarkConfig.modelPreflight` describes. `runStrategyEvolution` checks the same way. */
 async function preflightModels(cfg) {
 	if (cfg.modelPreflight === false) return;
 	if (cfg.worker.complete && !cfg.modelPreflight) return;
@@ -5726,531 +5611,710 @@ const strategyAuthorSystemPrompt = "You are a senior researcher authoring optimi
 function assertStrategyContract(code) {
 	assertAuthoredCode(code, { allowedImports: ["@tangle-network/agent-runtime/kernel"] });
 }
-/** One authoring attempt: chat with the given model, extract the fenced module. Throws
-*  when the reply carries no code block. */
-async function requestAuthoredCode(opts, profile) {
-	const res = await profileChatClient({
-		profile,
-		executor: opts.executor,
-		context: "strategy author"
-	}).chat({ messages: [{
-		role: "user",
-		content: `${opts.contract ?? strategyAuthorContract}\n\nBASELINE RESULTS on the "${opts.environmentName}" environment (budget=${opts.budget}) — the per-task losses are your gradient:\n${opts.lossesJson}\n\nAuthor ONE new strategy that you expect to beat the baselines on THIS environment at the same budget.\n${strategyAuthorMethod}\n\nOutput only the module code block.`
-	}] }, { ...opts.signal ? { signal: opts.signal } : {} });
-	const match = res.content.match(/```(?:ts|typescript)?\s*\n([\s\S]*?)```/);
-	if (!match?.[1]) throw new Error(`authorStrategy: no code block in the author's reply: ${res.content.slice(0, 300)}`);
-	return match[1];
-}
-/** Author + load a strategy from losses. Throws when the author emits no loadable module;
-*  with `fallbackModel` set, the named fallback gets one attempt first. */
-async function authorStrategy(opts) {
-	let code;
+/** Ask the author for a strategy module. A failed call throws; a reply without a fenced
+*  module is `code: null`. With `fallbackProfile`, the fallback gets one attempt when the
+*  primary call fails or its reply carries no module. */
+async function requestStrategySource(opts) {
+	const turns = [];
+	const attempt = async (profile) => {
+		const res = await profileChatClient({
+			profile,
+			executor: opts.executor,
+			context: "strategy author"
+		}).chat({ messages: [{
+			role: "user",
+			content: `${opts.contract ?? strategyAuthorContract}\n\nBASELINE RESULTS on the "${opts.environmentName}" environment (budget=${opts.budget}) — the per-task losses are your gradient:\n${opts.lossesJson}\n\nAuthor ONE new strategy that you expect to beat the baselines on THIS environment at the same budget.\n${strategyAuthorMethod}\n\nOutput only the module code block.`
+		}] }, { ...opts.signal ? { signal: opts.signal } : {} });
+		turns.push({
+			content: res.content,
+			model: res.model,
+			inputTokens: res.usage.promptTokens,
+			outputTokens: res.usage.completionTokens,
+			tokensKnown: res.usage.captured !== false,
+			costUsd: res.costUsd
+		});
+		return res.content.match(/```(?:ts|typescript)?\s*\n([\s\S]*?)```/)?.[1] ?? null;
+	};
 	try {
-		code = await requestAuthoredCode(opts, opts.profile);
+		const code = await attempt(opts.profile);
+		if (code !== null || !opts.fallbackProfile) return {
+			code,
+			turns
+		};
 	} catch (primaryError) {
 		if (!opts.fallbackProfile) throw primaryError;
-		code = await requestAuthoredCode(opts, opts.fallbackProfile);
 	}
+	return {
+		code: await attempt(opts.fallbackProfile),
+		turns
+	};
+}
+/** Lint an authored module, write it under `outDir` at a name its content fixes, and import
+*  its default Strategy. The same source always loads from the same file. Throws when the
+*  module breaks the contract or exports no Strategy. */
+async function loadAuthoredStrategy(code, outDir) {
 	assertStrategyContract(code);
-	mkdirSync(opts.outDir, { recursive: true });
-	const file = join(opts.outDir, `authored-${Date.now()}.mts`);
-	writeFileSync(file, code);
-	const mod = await import(`file://${file}`);
+	const file = join(outDir, `strategy-${sha256Bytes$1(Buffer.from(code, "utf8")).slice(7)}.mts`);
+	if (!existsSync(file)) {
+		mkdirSync(outDir, { recursive: true });
+		const partial = `${file}.${process.pid}.tmp`;
+		writeFileSync(partial, code);
+		renameSync(partial, file);
+	}
+	const mod = await import(pathToFileURL(file).href);
 	if (!mod.default || typeof mod.default.driver !== "function" || !mod.default.name) throw new Error(`authorStrategy: ${file} does not export a default Strategy`);
 	return {
 		strategy: mod.default,
-		file,
+		file
+	};
+}
+/** Author + load a strategy from losses. Throws when the author emits no loadable module;
+*  with `fallbackProfile` set, the fallback gets one attempt first. */
+async function authorStrategy(opts) {
+	const { code, turns } = await requestStrategySource(opts);
+	if (code === null) throw new Error(`authorStrategy: no code block in the author's reply: ${(turns.at(-1)?.content ?? "").slice(0, 300)}`);
+	return {
+		...await loadAuthoredStrategy(code, opts.outDir),
 		code
 	};
 }
 //#endregion
 //#region src/runtime/strategy-evolution.ts
 /**
-* runStrategyEvolution — the multi-generation strategy search: per generation the system
-* authors a POPULATION of candidate strategies from the current tournament's losses,
-* plays them against the incumbent at equal budget, and advances a champion; one final
-* promotion decision runs on a NEVER-BEFORE-USED holdout slice through `promotionGate`.
+* runStrategyEvolution: strategy search on Eval's search kernel (`runSearch`).
 *
-* Measurement invariants (the reasons this design is shaped the way it is):
-*  - The author sees TRAIN losses only. The holdout slice is drawn fresh (disjoint task
-*    offsets) after all authoring is done — one promotion decision, one untouched slice,
-*    so adaptive reuse of evaluation data never enters the verdict.
-*  - Every tournament runs at the same per-strategy budget through the conserved pool;
-*    candidates cannot win by overspending.
-*  - Champion selection within the search is a SEARCH policy (configurable, default
-*    cost-aware: ties on score go to the cheapest strategy — a scalar hides a strategy
-*    that ties at half the cost). The promotion verdict never comes from search
-*    selection; it comes from the gate on the fresh slice.
-*  - Every authored artifact's description length (gzip bits) is recorded, so the
-*    artifact-complexity-vs-holdout-gap relation is analyzable from any run's report.
+* Every node is a strategy: the caller's root, or a module an author model wrote from the
+* train results of the parent the policy chose. The default policy is `beam({ width: 2 })`
+* and the default allocator `asha()`, so a strategy is screened on a few selection tasks and
+* earns more tasks only by ranking well. Each cell is one `runAgentic` run of one strategy on
+* one task, scored by the environment's own check.
 *
-* Lineage fields (`parent`, `generation`) are recorded on every archive node so a
-* descendant-productivity parent-selection policy can be added without changing the
-* report schema; the v1 search authors from the latest tournament's losses.
+* Measurement follows the kernel's splits. The author reads train results only; the policy
+* and allocator rank on the private selection split; the claim runs the root and at most 3
+* finalists together on the sealed test split, once, with a power check and a Bonferroni
+* decision. The report is a projection of the ledger, and the ledger is the only checkpoint:
+* calling again with the same inputs continues an interrupted search and returns a finished
+* one without running anything.
 *
 * @experimental
 */
-/** Strategy means recomputed over the DISCRIMINATING tasks only — tasks where the field
-*  strategies did not all score identically. Zero-spread tasks (everyone 1.0, everyone
-*  0.0, everyone tied) carry no selection information; averaging over them dilutes real
-*  differences toward zero. Search-side denoising only — the gate never uses this. */
-function discriminatingMeans(report, fieldOrder) {
-	const rows = report.perTask.filter((r) => {
-		if (!r.cells) return false;
-		const scores = fieldOrder.map((n) => r.cells?.[n]?.score).filter((s) => s !== void 0);
-		if (scores.length < fieldOrder.length) return false;
-		return Math.max(...scores) - Math.min(...scores) > 0;
-	});
-	if (rows.length === 0) return null;
-	const out = {};
-	for (const name of fieldOrder) {
-		const cells = rows.map((r) => r.cells?.[name]).filter((c) => !!c);
-		out[name] = {
-			score: cells.reduce((s, c) => s + c.score, 0) / cells.length,
-			usd: cells.reduce((s, c) => s + c.usd, 0) / cells.length
-		};
-	}
-	return out;
-}
-/** The champion pick over a means table. 'score' takes the best mean score (ties →
-*  field order). 'costAware' treats scores within `epsilon` of the best as tied and
-*  takes the cheapest — the (score, $) Pareto rule collapsed to one pick. */
-function pickChampion(means, fieldOrder, policy, epsilon) {
-	const entries = fieldOrder.map((name) => ({
-		name,
-		summary: means[name]
-	})).filter((e) => !!e.summary);
-	if (entries.length === 0) throw new Error("pickChampion: the means table carries none of the field strategies");
-	const best = Math.max(...entries.map((e) => e.summary.score));
-	const pick = policy === "score" ? entries.find((e) => e.summary.score === best) : entries.filter((e) => e.summary.score >= best - epsilon).sort((a, b) => a.summary.usd - b.summary.usd || b.summary.score - a.summary.score)[0];
-	if (!pick) throw new Error("pickChampion: empty pick (unreachable)");
-	return {
-		name: pick.name,
-		score: pick.summary.score,
-		usd: pick.summary.usd
-	};
-}
-/** Search-side champion selection over a tournament report. */
-function selectChampion(report, fieldOrder, policy, epsilon) {
-	return pickChampion(report.perStrategy, fieldOrder, policy, epsilon);
-}
-const fieldSummary = (archive) => archive.map((n) => `- ${n.name} (${n.source}, gen ${n.generation}, last score ${(n.score * 100).toFixed(0)}%)`).join("\n");
-/** The author-visible losses: EVERY train task in compact form (score/resolved/
-*  progression per cell). A pretty-printed prefix slice would hide the tail tasks from
-*  the author and bias which failure modes it can target; the hard cap stays only as a
-*  guard against enormous fields. */
-const compactLosses = (report, detail) => {
-	const r2 = (x) => Math.round(x * 100) / 100;
-	const rows = report.perTask.map((row) => row.cells ? {
-		task: row.taskId,
-		...row.errors ? { errors: Object.fromEntries(Object.entries(row.errors).map(([n, msg]) => [n, msg.slice(0, 100)])) } : {},
-		cells: Object.fromEntries(Object.entries(row.cells).map(([name, c]) => [name, detail === "binary" ? {
-			resolved: c.resolved,
-			usd: Math.round(c.usd * 1e4) / 1e4
-		} : {
-			score: r2(c.score),
-			resolved: c.resolved,
-			usd: Math.round(c.usd * 1e4) / 1e4,
-			progression: (c.progression ?? []).map(r2)
-		}]))
-	} : {
-		task: row.taskId,
-		error: row.error?.slice(0, 80)
-	});
-	return JSON.stringify(rows).slice(0, 12e3);
+const STRATEGY_EVOLUTION_SOURCE = {
+	uri: "npm:@tangle-network/agent-runtime#runStrategyEvolution",
+	revision: canonicalCandidateDigest$1({
+		name: "agent-runtime.strategy-evolution.2026-09",
+		node: "the root strategy by name under the caller executionRef, or an authored module content-addressed by the sha256 of its source",
+		edge: "a text diff from the parent module source to the child; unknown from the root, which has no source here",
+		admission: "a module is refused when the reply carries none, it breaks the author contract, or it does not load a default Strategy",
+		cell: "one runAgentic run on one task, metered as one paid call on the search cost ledger through the Runtime search executor; an environment fault during it is errored and retried, a thrown strategy is failed at score 0, anything else passed at its harness-verified score",
+		proposer: "the author reads the strategy contract, the task tools, the train summary, the train results of every strategy and the parent source",
+		ship: "the claim shipped, re-derives from the ledger, cost accounting is complete, and the shipped finalist test lower bound exceeds 0"
+	})
 };
-/** Rename a strategy AND the deliverable's mode label its driver closes over — report
-*  keys and observability labels must never diverge for a renamed candidate. */
-function renameStrategy(orig, unique) {
-	if (orig.name === unique) return orig;
-	return {
-		name: unique,
-		driver: (s, t, o, b) => {
-			const agent = orig.driver(s, t, o, b);
-			return {
-				...agent,
-				name: unique,
-				act: async (task, scope) => {
-					const out = await agent.act(task, scope);
-					if (out.kind !== "done") return out;
-					const deliverable = {
-						...out.deliverable,
-						mode: unique
-					};
-					return {
-						...out,
-						deliverable
-					};
-				}
-			};
+const NO_MODULE = "the author reply carried no fenced ts module";
+/** Evolve a strategy on the search kernel and claim once on the sealed test split. */
+async function runStrategyEvolution(cfg) {
+	const root = cfg.root ?? refine;
+	const budget = positiveInteger("budget", cfg.budget ?? 3);
+	const concurrency = positiveInteger("concurrency", cfg.concurrency ?? 3);
+	const maxExpansions = nonNegativeInteger("maxExpansions", cfg.maxExpansions ?? 4);
+	const maxAttempts = positiveInteger("maxAttempts", cfg.maxAttempts ?? 3);
+	const seed = nonNegativeInteger("seed", cfg.seed ?? 42);
+	const cellUsd = dollars("cellUsd", cfg.cellUsd) ?? 0;
+	const maxUsd = dollars("maxUsd", cfg.maxUsd);
+	const policy = cfg.policy ?? beam({ width: 2 });
+	const allocation = cfg.allocation ?? asha();
+	if (cfg.deadline !== void 0 && !Number.isFinite(Date.parse(cfg.deadline))) throw new ConfigError("evolution: deadline must be an ISO time");
+	if (!/^sha256:[0-9a-f]{64}$/.test(cfg.executionRef)) throw new ConfigError("evolution: executionRef must be a lowercase sha256:<64 hex> digest");
+	if (!root.name.trim() || typeof root.driver !== "function") throw new ConfigError("evolution: root must be a named Strategy");
+	const claim = defineEvaluationClaim(cfg.claim);
+	if (claim.minimumEffect === void 0) throw new ConfigError("evolution: the claim needs minimumEffect for its power check");
+	const taskIds = /* @__PURE__ */ new Set();
+	const splitTasks = (label, tasks) => {
+		if (!Array.isArray(tasks) || tasks.length === 0) throw new ConfigError(`evolution: ${label} needs at least one task`);
+		for (const task of tasks) {
+			if (typeof task.id !== "string" || !task.id.trim() || taskIds.has(task.id)) throw new ConfigError(`evolution: task IDs must be non-empty and unique across splits`);
+			taskIds.add(task.id);
 		}
+		return immutableCandidateValue(tasks);
 	};
-}
-/** Multi-generation strategy search: author candidates from tournament losses, play them against the incumbent at equal budget, promote via `promotionGate` on an untouched holdout slice. */
-async function runStrategyEvolution(cfg) {
-	const budget = cfg.budget ?? 3;
-	const concurrency = cfg.concurrency ?? 3;
-	const generations = cfg.generations ?? 2;
-	const populationSize = cfg.populationSize ?? 2;
-	const baselines = cfg.baselines ?? [
-		sample,
-		refine,
-		sampleThenRefine
-	];
-	const policy = cfg.champion ?? "costAware";
-	const epsilon = cfg.championEpsilon ?? (cfg.objective === "cost" ? cfg.scoreTolerance ?? .05 : .01);
-	const byName = new Map(baselines.map((s) => [s.name, s]));
-	const codeByName = /* @__PURE__ */ new Map();
-	for (const [label, count] of Object.entries({
-		trainN: cfg.trainN,
-		holdoutN: cfg.holdoutN
-	})) if (!Number.isSafeInteger(count) || count < 1) throw new Error(`evolution: ${label} must be a positive integer`);
-	const holdoutOffset = cfg.holdoutOffset ?? 0;
-	if (!Number.isSafeInteger(holdoutOffset) || holdoutOffset < 0) throw new Error("evolution: holdoutOffset must be a non-negative integer");
-	if (baselines.length === 0 || byName.size !== baselines.length) throw new Error("evolution: baselines must have non-empty, unique names");
-	if (cfg.checkpoint && !/^sha256:[0-9a-f]{64}$/.test(cfg.checkpoint.executionRef)) throw new Error("evolution checkpoint: executionRef must be a lowercase sha256:<64 hex> digest");
-	const fingerprint = cfg.checkpoint ? canonicalCandidateDigest$1({
-		schemaVersion: 2,
-		executionRef: cfg.checkpoint?.executionRef ?? null,
-		environment: cfg.environment.name,
-		trainN: cfg.trainN,
-		holdoutN: cfg.holdoutN,
-		holdoutOffset,
-		budget,
-		concurrency,
-		generations,
-		populationSize,
-		baselines: baselines.map((baseline) => baseline.name),
-		objective: cfg.objective ?? "score",
-		scoreTolerance: cfg.scoreTolerance ?? .05,
-		champion: policy,
-		championEpsilon: epsilon,
-		minPairedTasks: cfg.minPairedTasks ?? null,
-		band: cfg.band ?? null,
-		lossesDetail: cfg.lossesDetail ?? "exact",
-		reproducerCheck: cfg.reproducerCheck ?? null,
-		modelPreflight: cfg.modelPreflight !== false,
-		modelPreflightTimeoutMs: cfg.modelPreflightTimeoutMs ?? null,
-		worker: {
+	const train = splitTasks("train", cfg.train);
+	const selection = splitTasks("selection", cfg.selection);
+	const test = splitTasks("test", cfg.test);
+	const taskById = new Map([
+		...train,
+		...selection,
+		...test
+	].map((task) => [task.id, task]));
+	const searchTasks = (tasks) => tasks.map((task) => ({
+		taskId: task.id,
+		unitId: summarizeEvaluationUnits(claim, [task]).units[0].id,
+		source: {
+			uri: `task://${task.id}`,
+			revision: canonicalCandidateDigest$1(task)
+		}
+	}));
+	const splits = {
+		train: searchTasks(train),
+		selection: searchTasks(selection),
+		test: searchTasks(test)
+	};
+	const developmentUnits = new Set([...splits.train, ...splits.selection].map((task) => task.unitId));
+	const workerProfile = cfg.worker.workerProfile;
+	const analystProfile = cfg.worker.analystProfile ?? workerProfile;
+	const workerModel = concreteModelId(workerProfile.model?.default);
+	if (!workerModel) throw new ConfigError("evolution: worker AgentProfile.model.default must name an exact model");
+	const authorModel = concreteModelId(cfg.author.profile.model?.default);
+	if (!authorModel) throw new ConfigError("evolution: author AgentProfile.model.default must name an exact model");
+	const workerSource = {
+		uri: "npm:@tangle-network/agent-runtime#runAgentic",
+		revision: canonicalCandidateDigest$1({
+			worker: canonicalAgentProfileDigest(workerProfile),
+			analyst: canonicalAgentProfileDigest(analystProfile),
 			routerBaseUrl: cfg.worker.routerBaseUrl,
-			profile: cfg.worker.workerProfile,
-			analystProfile: cfg.worker.analystProfile ?? cfg.worker.workerProfile,
 			corpusTags: cfg.worker.corpusTags ?? [],
-			corpusReadback: cfg.worker.corpusReadback ?? null
+			corpusReadback: cfg.worker.corpusReadback ?? null,
+			budget
+		})
+	};
+	const authorSource = {
+		uri: `agent-profile:${cfg.author.profile.name}`,
+		revision: canonicalCandidateDigest$1({
+			profile: canonicalAgentProfileDigest(cfg.author.profile),
+			fallback: cfg.author.fallbackProfile ? canonicalAgentProfileDigest(cfg.author.fallbackProfile) : null,
+			backend: cfg.author.executor.backend,
+			contract: strategyAuthorContract
+		})
+	};
+	const environmentSource = {
+		uri: `environment:${cfg.environment.name}`,
+		revision: cfg.executionRef
+	};
+	const execution = {
+		model: searchModelIdentity(workerModel, workerProfile.model?.provider ?? "unknown"),
+		agent: workerSource,
+		benchmark: environmentSource
+	};
+	const searchId = `evolution-${canonicalCandidateDigest$1({
+		process: STRATEGY_EVOLUTION_SOURCE,
+		executionRef: cfg.executionRef,
+		root: root.name,
+		worker: workerSource,
+		author: authorSource,
+		claim,
+		splits,
+		policy: policy.name,
+		allocation: allocation.name,
+		reps: allocation.reps,
+		maxExpansions,
+		concurrency,
+		maxUsd,
+		cellUsd,
+		deadline: cfg.deadline ?? null,
+		maxAttempts,
+		seed
+	}).slice(7, 31)}`;
+	const searchDir = `${cfg.outDir}/${searchId}`;
+	const modulesDir = `${searchDir}/strategies`;
+	const ledgerPath = `${searchDir}/ledger.jsonl`;
+	mkdirSync(searchDir, { recursive: true });
+	const recorder = await SearchRecorder.open({ ledger: openSearchLedger({
+		path: ledgerPath,
+		searchId
+	}) }, {
+		subject: `strategy/${cfg.environment.name}`,
+		process: {
+			name: "strategy-evolution",
+			executionRef: STRATEGY_EVOLUTION_SOURCE
 		},
-		author: {
-			profile: cfg.author.profile,
-			fallbackProfile: cfg.author.fallbackProfile ?? null,
-			executorBackend: cfg.author.executor.backend
+		artifactKind: "code",
+		objective: {
+			metric: "score",
+			direction: "maximize",
+			judge: environmentSource,
+			claim
 		},
-		authorContract: strategyAuthorContract
-	}) : void 0;
-	let ckpt;
-	if (cfg.checkpoint?.resume && existsSync(cfg.checkpoint.path)) {
-		const raw = JSON.parse(readFileSync(cfg.checkpoint.path, "utf8"));
-		if (raw.fingerprint !== fingerprint) throw new Error(`evolution resume: checkpoint design mismatch at ${cfg.checkpoint.path}; use a new checkpoint or restore the original execution dependencies`);
-		ckpt = raw;
-	}
-	const train = checkedTaskSlice(await cfg.tasks(0, cfg.trainN), cfg.trainN, "train", !!cfg.checkpoint);
-	const trainDigest = cfg.checkpoint ? canonicalCandidateDigest$1(train) : void 0;
-	if (ckpt && ckpt.trainDigest !== trainDigest) throw new Error("evolution resume: train task payloads changed");
-	let holdoutPoolDigest;
-	const save = (state) => {
-		if (cfg.checkpoint) writeFileSync(cfg.checkpoint.path, JSON.stringify({
-			...state,
-			fingerprint,
-			trainDigest,
-			holdoutPoolDigest
-		}, null, 1));
-	};
-	let modelsPreflighted = false;
-	const bench = async (phase, tasks, strategies) => {
-		await cfg.onPhase?.(phase);
-		const report = await runBenchmark({
-			environment: cfg.environment,
-			tasks,
-			worker: cfg.worker,
-			strategies,
-			budget,
-			concurrency,
-			modelPreflight: modelsPreflighted ? false : cfg.modelPreflight,
-			modelPreflightTimeoutMs: cfg.modelPreflightTimeoutMs,
-			...cfg.onTask ? { onTask: (row, done, total) => cfg.onTask?.(phase, row, done, total) } : {},
-			...cfg.hooks ? { hooks: cfg.hooks } : {}
-		});
-		modelsPreflighted = true;
-		return report;
+		splits: {
+			...splits,
+			heldOutUnits: splits.test.every((task) => !developmentUnits.has(task.unitId))
+		},
+		policy: {
+			expansion: policy.name,
+			allocation: allocation.name,
+			seed
+		},
+		budget: {
+			maxUsd,
+			maxCells: null,
+			maxNodes: 1 + maxExpansions,
+			deadline: cfg.deadline === void 0 ? null : new Date(cfg.deadline).toISOString(),
+			maxConcurrency: concurrency,
+			reservedClaimUsd: maxUsd === null ? 0 : searchClaimReserveUsd({
+				testTasks: splits.test.length,
+				reps: allocation.reps,
+				cellUsd
+			})
+		},
+		containment: null,
+		derivedFrom: null,
+		identity: execution
+	});
+	if (!(await recorder.state()).closed) await preflightModels({
+		worker: cfg.worker,
+		modelPreflight: cfg.modelPreflight,
+		modelPreflightTimeoutMs: cfg.modelPreflightTimeoutMs
+	});
+	const rootNode = {
+		kind: "root",
+		name: root.name
 	};
-	const probeTask = train[0];
-	if (!probeTask) throw new Error("runStrategyEvolution: empty train slice");
-	const probe = await cfg.environment.open(probeTask);
-	let toolCatalog;
-	try {
-		toolCatalog = (await cfg.environment.tools(probeTask, probe)).map((t) => `- ${t.function.name}${t.function.description ? ` — ${t.function.description.slice(0, 120)}` : ""}`).join("\n");
-	} finally {
-		await cfg.environment.close(probe);
-	}
-	const gen0 = ckpt?.gen0 ?? await bench("gen0", train, baselines);
-	const archive = ckpt?.archive ? [...ckpt.archive] : baselines.map((s) => ({
-		name: s.name,
-		source: "baseline",
-		generation: 0,
-		score: gen0.perStrategy[s.name]?.score ?? 0,
-		usd: gen0.perStrategy[s.name]?.usd ?? 0
-	}));
-	const gen0Champion = ckpt?.gen0Champion ?? selectChampion(gen0, baselines.map((s) => s.name), policy, epsilon);
-	const generationRows = ckpt?.generations ? [...ckpt.generations] : [];
-	const trajectory = ckpt?.trajectory ? [...ckpt.trajectory] : [{
-		generation: 0,
-		champion: gen0Champion.name,
-		score: gen0Champion.score,
-		usd: gen0Champion.usd
-	}];
-	for (const row of generationRows) for (const c of row.candidates) {
-		if (c.error) continue;
-		if (!c.file || !c.sourceSha256) throw new Error(`evolution resume: missing source identity for '${c.name}'`);
-		const bytes = readFileSync(c.file);
-		if (sha256Bytes$1(bytes) !== c.sourceSha256) throw new Error(`evolution resume: authored source changed for '${c.name}' (${c.file})`);
-		const sourceUrl = pathToFileURL(c.file);
-		sourceUrl.searchParams.set("sha256", c.sourceSha256);
-		const mod = await import(sourceUrl.href);
-		if (!mod.default || typeof mod.default.driver !== "function") throw new Error(`evolution resume: ${c.file} no longer exports a Strategy — cannot restore "${c.name}"`);
-		byName.set(c.name, renameStrategy(mod.default, c.name));
-		codeByName.set(c.name, bytes.toString("utf8"));
-	}
-	let authoredOk = generationRows.reduce((n, row) => n + row.candidates.filter((c) => !c.error).length, 0);
-	const lastRow = generationRows[generationRows.length - 1];
-	let incumbent = lastRow ? lastRow.champion : gen0Champion;
-	let latestReport = lastRow ? lastRow.report : gen0;
-	if (!ckpt) save({
-		gen0,
-		gen0Champion,
-		generations: generationRows,
-		archive,
-		trajectory
+	const codec = {
+		node(rec, node) {
+			const artifact = rec.blob("strategy", { ...node });
+			return {
+				artifactDigest: node.kind === "root" ? canonicalCandidateDigest$1({
+					kind: "root",
+					name: node.name
+				}) : sha256Bytes$1(Buffer.from(node.code, "utf8")),
+				artifact,
+				surfaces: [{
+					surfaceId: "strategy",
+					kind: "code",
+					artifact
+				}]
+			};
+		},
+		diff(rec, parent, child) {
+			if (parent.kind === "root" || child.kind === "root") return { unknown: "the root is a caller-supplied strategy with no source here" };
+			return surfaceDiff(rec, parent.code, child.code);
+		},
+		load(rec, node) {
+			const stored = rec.readBlob(node.artifact);
+			if (stored.kind === "root") {
+				if (stored.name !== root.name) throw new Error(`evolution: node ${node.nodeId} is root '${stored.name}', not '${root.name}'`);
+				return rootNode;
+			}
+			if (stored.kind === "authored" && typeof stored.code === "string") return stored;
+			throw new Error(`evolution: node ${node.nodeId} holds no strategy`);
+		}
+	};
+	const loaded = /* @__PURE__ */ new Map();
+	const strategyOf = (node) => {
+		if (node.kind === "root") return Promise.resolve(root);
+		let strategy = loaded.get(node.code);
+		if (!strategy) {
+			strategy = loadAuthoredStrategy(node.code, modulesDir).then((module) => module.strategy);
+			loaded.set(node.code, strategy);
+		}
+		return strategy;
+	};
+	const storage = fsCampaignStorage();
+	const costLedger = createRunCostLedger({
+		storage,
+		runDir: searchDir
 	});
-	for (let g = generationRows.length + 1; g <= generations; g += 1) {
-		const lossesJson = compactLosses(latestReport, cfg.lossesDetail ?? "exact");
-		const candidates = [];
-		const newStrategies = [];
-		for (let i = 0; i < populationSize; i += 1) {
-			const contract = `${strategyAuthorContract}${cfg.objective === "cost" ? `\n\nYOUR OBJECTIVE: match or exceed the incumbent's SCORE while spending LESS (the losses include usd per task). Promotion requires proven score non-inferiority PLUS significant cost savings — a strategy that ties the score at half the cost WINS; a cheaper strategy that loses score by more than ${((cfg.scoreTolerance ?? .05) * 100).toFixed(0)}pp LOSES.` : ""}\n\nEXAMPLE TOOLS FROM ONE TASK (tool sets VARY per task on this domain — a strategy MUST select tool names from await listTools(handle) at runtime; hardcoding these example names will zero your score on most tasks):\n${toolCatalog}\n\nSTRATEGIES ALREADY IN THE TOURNAMENT (author something MEANINGFULLY different — a new composition, not a rename):\n${fieldSummary(archive)}\n\nYou are authoring candidate ${i + 1} of ${populationSize} this generation; explore a distinct region of the strategy space from your siblings.`;
-			try {
-				const authored = await authorStrategy({
+	const lanes = [dedicatedLane({
+		name: "in-process",
+		capacity: concurrency,
+		cellUsd
+	})];
+	await reconcileInterruptedSearchCalls(costLedger, searchId, lanes);
+	const executor = searchExecutor({
+		lanes,
+		profileOf: () => workerProfile,
+		costLedger,
+		identity: execution,
+		storage,
+		dir: searchDir,
+		...cfg.workerSlots ? { workerSlots: cfg.workerSlots } : {},
+		async runAttempt({ work, lane, costLedger: cellLedger }) {
+			if (work.artifact.kind === "authored" && work.artifact.refusal !== null) throw new Error(`evolution: refused node ${work.nodeId} was given a cell`);
+			const strategy = await strategyOf(work.artifact);
+			const task = taskById.get(work.taskId);
+			if (!task) throw new Error(`evolution: cell ${work.cellId} names unknown task ${work.taskId}`);
+			const faults = [];
+			const environment = faultRecording(cfg.environment, faults);
+			const paid = await cellLedger.runPaidCall({
+				channel: "agent",
+				phase: `search.${work.stage}`,
+				actor: `strategy:${strategy.name}`,
+				model: workerModel,
+				signal: work.signal,
+				execute: () => runAgentic({
+					...cfg.worker,
+					surface: environment,
+					task,
+					strategy,
+					budget,
+					...cfg.hooks ? { hooks: cfg.hooks } : {}
+				}),
+				receipt: (run) => ({
+					model: workerModel,
+					inputTokens: run.tokens.input,
+					outputTokens: run.tokens.output,
+					...run.usdKnown ? { actualCostUsd: run.usd } : { costUnknown: true },
+					...run.tokensKnown ? {} : { usageUnknown: true }
+				}),
+				receiptFromError: () => ({
+					model: workerModel,
+					inputTokens: 0,
+					outputTokens: 0,
+					costUnknown: true,
+					usageUnknown: true
+				})
+			});
+			const settled = {
+				identity: execution,
+				placement: {
+					lane: lane.name,
+					boxId: null
+				},
+				accounting: unknownAccounting("replaced by the attempt receipts"),
+				...paid.succeeded ? { wallMs: paid.value.ms } : {}
+			};
+			if (faults.length > 0) return {
+				...settled,
+				...environmentFault(faults)
+			};
+			if (!paid.succeeded) return {
+				...settled,
+				outcome: {
+					status: "failed",
+					score: 0,
+					metrics: {},
+					failure: {
+						code: "strategy-threw",
+						message: shareText(paid.error)
+					}
+				}
+			};
+			const run = paid.value;
+			return {
+				...settled,
+				outcome: {
+					status: "passed",
+					score: run.score,
+					metrics: {
+						resolved: run.resolved ? 1 : 0,
+						shots: run.shots
+					}
+				}
+			};
+		}
+	});
+	let toolCatalog;
+	const catalog = () => {
+		toolCatalog ??= listToolCatalog(cfg.environment, train[0]);
+		return toolCatalog;
+	};
+	const authorProvider = cfg.author.profile.model?.provider ?? "unknown";
+	const result = await runSearch({
+		recorder,
+		root: rootNode,
+		codec,
+		policy,
+		allocation,
+		proposer: {
+			name: "strategy-author",
+			kind: "frontier-author",
+			source: authorSource,
+			execution: {
+				kind: "model",
+				model: searchModelIdentity(authorModel, authorProvider),
+				source: authorSource
+			},
+			childrenPerProposal: 1,
+			async propose(request) {
+				const state = await recorder.state();
+				const names = strategyNames(state, recorder, codec);
+				const losses = JSON.stringify(strategyTournament(state, "train", names).rows.map((row) => ({
+					task: row.taskId,
+					...row.rep > 0 ? { rep: row.rep } : {},
+					cells: row.cells
+				}))).slice(0, 12e3);
+				const summary = renderSearchSummary(state, { split: "train" });
+				const parent = request.parents[0];
+				const parentName = names.get(parent.nodeId) ?? parent.nodeId;
+				const tried = [...names.values()].join(", ");
+				const parentSource = parent.artifact.kind === "authored" ? `\n\nPARENT STRATEGY "${parentName}" (improve on it):\n${parent.artifact.code}` : `\n\nPARENT STRATEGY "${parentName}" is the built-in baseline; improve on it.`;
+				const contract = `${strategyAuthorContract}\n\nEXAMPLE TOOLS FROM ONE TASK (tool sets VARY per task on this domain — a strategy MUST select tool names from await listTools(handle) at runtime; hardcoding these example names will zero your score on most tasks):\n${await catalog()}\n\nTHE SEARCH SO FAR (train split):\n${summary}\n\nSTRATEGIES ALREADY TRIED (author something MEANINGFULLY different — a new composition, not a rename): ${tried}${parentSource}`;
+				const source = await requestStrategySource({
 					profile: cfg.author.profile,
 					executor: cfg.author.executor,
 					...cfg.author.fallbackProfile ? { fallbackProfile: cfg.author.fallbackProfile } : {},
 					contract,
 					environmentName: cfg.environment.name,
-					lossesJson,
+					lossesJson: losses,
 					budget,
-					outDir: cfg.outDir
-				});
-				const unique = byName.has(authored.strategy.name) ? `${authored.strategy.name}-g${g}c${i + 1}` : authored.strategy.name;
-				const strategy = renameStrategy(authored.strategy, unique);
-				byName.set(unique, strategy);
-				codeByName.set(unique, authored.code);
-				newStrategies.push(strategy);
-				archive.push({
-					name: unique,
-					source: "authored",
-					generation: g,
-					parent: incumbent.name,
-					gzipBits: gzipSync(Buffer.from(authored.code)).length * 8,
-					file: authored.file,
-					score: 0,
-					usd: 0
+					outDir: modulesDir,
+					signal: request.signal
 				});
-				candidates.push({
-					name: unique,
-					file: authored.file,
-					sourceSha256: sha256Bytes$1(Buffer.from(authored.code)),
-					gzipBits: gzipSync(Buffer.from(authored.code)).length * 8,
-					codeChars: authored.code.length
-				});
-				authoredOk += 1;
-			} catch (e) {
-				candidates.push({
-					name: `(author-failed g${g}c${i + 1})`,
-					error: e instanceof Error ? e.message.slice(0, 300) : String(e)
-				});
-			}
-		}
-		const incumbentStrategy = byName.get(incumbent.name);
-		if (!incumbentStrategy) throw new Error(`evolution: incumbent "${incumbent.name}" missing from the field`);
-		const field = [incumbentStrategy, ...newStrategies];
-		const report = await bench(`gen${g}`, train, field);
-		for (const node of archive) {
-			const cell = report.perStrategy[node.name];
-			if (cell) {
-				node.score = cell.score;
-				node.usd = cell.usd;
+				let child = {
+					kind: "authored",
+					name: null,
+					code: "",
+					refusal: NO_MODULE
+				};
+				if (source.code !== null) try {
+					const { strategy } = await loadAuthoredStrategy(source.code, modulesDir);
+					child = {
+						kind: "authored",
+						name: strategy.name,
+						code: source.code,
+						refusal: null
+					};
+				} catch (error) {
+					child = {
+						kind: "authored",
+						name: null,
+						code: source.code,
+						refusal: shareText(error)
+					};
+				}
+				const answered = source.turns.at(-1);
+				return {
+					children: [{
+						artifact: child,
+						label: child.name ?? "refused module",
+						rationale: `authored from the train results of ${parentName} and ${names.size - 1} other strategies`
+					}],
+					accounting: authorAccounting(source.turns),
+					...answered ? { execution: {
+						kind: "model",
+						model: searchModelIdentity(answered.model, authorProvider),
+						source: authorSource
+					} } : {}
+				};
 			}
+		},
+		executor,
+		admit: (node) => node.kind === "authored" ? node.refusal : null,
+		maxExpansions,
+		maxAttempts,
+		...cfg.signal ? { signal: cfg.signal } : {}
+	});
+	if (!result.claim || !result.claimVerification) throw new Error(`evolution: search ${searchId} closed without a claim`);
+	const { state } = result;
+	const names = strategyNames(state, recorder, codec);
+	const rootId = state.rootNodeId;
+	const strategies = state.nodes().map((node) => {
+		const artifact = codec.load(recorder, node);
+		const authored = artifact.kind === "authored" ? artifact : null;
+		return {
+			name: names.get(node.nodeId),
+			nodeId: node.nodeId,
+			parent: node.primaryParentId === null ? null : names.get(node.primaryParentId),
+			source: artifact.kind,
+			status: node.status,
+			code: authored?.code ?? null,
+			gzipBits: authored ? gzipSync(Buffer.from(authored.code)).length * 8 : null,
+			refusal: authored?.refusal ?? null,
+			selection: node.nodeId === rootId ? null : estimateNode(state, node.nodeId, {
+				against: rootId,
+				split: "selection"
+			})
+		};
+	});
+	const claimResult = result.claim;
+	const shipped = claimResult.finalists.find((finalist) => finalist.nodeId === claimResult.selected && finalist.test !== null);
+	const { spend } = state.audit;
+	const { decision, reason } = runtimeShipDecision({
+		claim: claimResult,
+		verified: result.claimVerification.status === "verified",
+		accountingComplete: spend.unknownCostCells === 0 && spend.unknownCostOperations === 0,
+		lowerBound: shipped?.test?.interval[0] ?? null,
+		minimumLift: 0
+	});
+	return {
+		searchId,
+		ledger: ledgerPath,
+		closeReason: result.reason,
+		strategies,
+		selected: strategies.find((strategy) => strategy.nodeId === result.leader),
+		claim: claimResult,
+		claimVerification: result.claimVerification,
+		decision,
+		reason,
+		tournament: {
+			train: strategyTournament(state, "train", names),
+			selection: strategyTournament(state, "selection", names),
+			test: strategyTournament(state, "test", names)
+		},
+		spend: {
+			knownUsd: spend.knownUsd,
+			floorUsd: spend.floorUsd,
+			unknownCostCells: spend.unknownCostCells,
+			unknownCostOperations: spend.unknownCostOperations
 		}
-		const fieldNames = field.map((s) => s.name);
-		const champion = pickChampion(cfg.band ? discriminatingMeans(report, fieldNames) ?? report.perStrategy : report.perStrategy, fieldNames, policy, epsilon);
-		generationRows.push({
-			generation: g,
-			candidates,
-			report,
-			champion
-		});
-		trajectory.push({
-			generation: g,
-			champion: champion.name,
-			score: champion.score,
-			usd: champion.usd
-		});
-		incumbent = champion;
-		latestReport = report;
-		save({
-			gen0,
-			gen0Champion,
-			generations: generationRows,
-			archive,
-			trajectory
-		});
+	};
+}
+/**
+* The tournament on one split, projected from the ledger: each settled cell's final attempt,
+* by task and repeat, keyed by strategy name. `names` maps node ids to report names.
+*/
+function strategyTournament(state, split, names) {
+	const rows = /* @__PURE__ */ new Map();
+	const perStrategy = {};
+	for (const nodeId of state.nodeIds()) {
+		const name = names.get(nodeId);
+		if (name === void 0) throw new Error(`strategyTournament: node ${nodeId} has no name`);
+		perStrategy[name] = {
+			cells: 0,
+			scored: 0,
+			score: null,
+			usd: 0,
+			usdKnown: true
+		};
 	}
-	if (authoredOk === 0) throw new Error("runStrategyEvolution: every author attempt failed across all generations — no search happened; see the candidates[].error entries");
-	const poolN = cfg.band?.holdoutPoolN ?? cfg.holdoutN;
-	const pool = checkedTaskSlice(await cfg.tasks(cfg.trainN + holdoutOffset, poolN), poolN, "holdout", !!cfg.checkpoint);
-	const trainIds = new Set(train.map((task) => task.id));
-	if (pool.some((task) => trainIds.has(task.id))) throw new Error("evolution: train and holdout task IDs must be disjoint");
-	holdoutPoolDigest = cfg.checkpoint ? canonicalCandidateDigest$1(pool) : void 0;
-	if (ckpt?.holdout && ckpt.holdoutPoolDigest !== holdoutPoolDigest) throw new Error("evolution resume: holdout task payloads changed");
-	let holdoutTasks = [];
-	let bandInfo;
-	if (ckpt?.holdout && ckpt.verdict) {
-		bandInfo = ckpt.band;
-		if (cfg.reproducerCheck && codeByName.has(incumbent.name)) {
-			const gateIds = new Set(ckpt.holdout.perTask.map((r) => r.taskId));
-			holdoutTasks = pool.filter((t) => gateIds.has(t.id));
+	const sums = /* @__PURE__ */ new Map();
+	const cells = state.cells().filter((cell) => cell.split === split && cell.outcome !== null).sort((left, right) => compare(left.taskId, right.taskId) || left.rep - right.rep);
+	for (const cell of cells) {
+		const name = names.get(cell.nodeId);
+		const key = `${cell.taskId}\u0000${cell.rep}`;
+		let row = rows.get(key);
+		if (!row) {
+			row = {
+				taskId: cell.taskId,
+				unitId: cell.unitId,
+				rep: cell.rep,
+				cells: {}
+			};
+			rows.set(key, row);
 		}
-	} else if (cfg.band) {
-		const maxRef = cfg.band.maxRefScore ?? .99;
-		const reference = baselines[0];
-		if (!reference) throw new Error("evolution band: baselines[0] required as the screening reference");
-		const refScores = (await bench("band-screen", pool, [reference])).perTask.filter((r) => r.cells?.[reference.name]).map((r) => ({
-			taskId: r.taskId,
-			score: r.cells?.[reference.name]?.score ?? 0
-		}));
-		const inBandIds = new Set(refScores.filter((r) => r.score <= maxRef).map((r) => r.taskId));
-		const kept = pool.filter((t) => inBandIds.has(t.id));
-		if (kept.length < cfg.holdoutN) throw new Error(`evolution band: only ${kept.length}/${cfg.holdoutN} holdout tasks have headroom (pool ${cfg.band.holdoutPoolN}, reference "${reference.name}" ≤ ${maxRef}) — widen holdoutPoolN or raise maxRefScore`);
-		holdoutTasks = kept.slice(0, cfg.holdoutN);
-		bandInfo = {
-			screened: refScores.length,
-			inBand: kept.length,
-			refScores
+		const outcome = cell.outcome;
+		row.cells[name] = {
+			score: cell.score,
+			outcome,
+			usd: cell.spentUsd,
+			usdKnown: cell.costKnown
 		};
-	} else holdoutTasks = pool;
-	let holdout;
-	let verdict;
-	if (ckpt?.holdout && ckpt.verdict) {
-		holdout = ckpt.holdout;
-		verdict = ckpt.verdict;
-	} else {
-		const finalists = [.../* @__PURE__ */ new Set([gen0Champion.name, incumbent.name])].map((n) => byName.get(n)).filter((s) => !!s);
-		holdout = await bench("holdout", holdoutTasks, finalists);
-		verdict = promotionGate({
-			report: holdout,
-			incumbent: gen0Champion.name,
-			candidate: incumbent.name,
-			...cfg.objective === "cost" ? {
-				mode: "non-inferiority",
-				...cfg.scoreTolerance !== void 0 ? { scoreTolerance: cfg.scoreTolerance } : {}
-			} : {},
-			...cfg.minPairedTasks !== void 0 ? { minPairedTasks: cfg.minPairedTasks } : {}
-		});
-		save({
-			gen0,
-			gen0Champion,
-			generations: generationRows,
-			archive,
-			trajectory,
-			holdout,
-			verdict,
-			...bandInfo ? { band: bandInfo } : {}
-		});
+		const summary = perStrategy[name];
+		summary.cells += 1;
+		summary.usd += cell.spentUsd;
+		summary.usdKnown &&= cell.costKnown;
+		if (cell.score !== null) {
+			summary.scored += 1;
+			sums.set(name, (sums.get(name) ?? 0) + cell.score);
+		}
+	}
+	for (const [name, summary] of Object.entries(perStrategy)) summary.score = summary.scored === 0 ? null : sums.get(name) / summary.scored;
+	return {
+		split,
+		rows: [...rows.values()],
+		perStrategy
+	};
+}
+/** Report names: each node's strategy name, suffixed `~<ordinal>` when an earlier node has it. */
+function strategyNames(state, recorder, codec) {
+	const names = /* @__PURE__ */ new Map();
+	const taken = /* @__PURE__ */ new Set();
+	for (const node of state.nodes()) {
+		const base = codec.load(recorder, node).name ?? "refused-module";
+		const name = taken.has(base) ? `${base}~${node.ordinal}` : base;
+		taken.add(name);
+		names.set(node.nodeId, name);
 	}
-	let reproduction;
-	const championCode = codeByName.get(incumbent.name);
-	if (cfg.reproducerCheck && championCode) {
-		const words = cfg.reproducerCheck.summaryMaxWords ?? 64;
-		const tolerance = cfg.reproducerCheck.tolerance ?? .05;
-		const championHoldoutScore = holdout.perStrategy[incumbent.name]?.score ?? 0;
+	return names;
+}
+/** The environment as one attempt sees it, recording each throw from `open`, `tools`,
+* `score` or `close`: those are the environment's faults. A `call` that throws is a tool
+* error the agent's loop handles. */
+function faultRecording(environment, faults) {
+	const recorded = (name, method) => async (...args) => {
 		try {
-			const summary = (await profileChatClient({
-				profile: {
-					...cfg.author.profile,
-					prompt: {
-						...cfg.author.profile.prompt,
-						systemPrompt: `Summarize the optimization strategy implemented by this code in at most ${words} words. Describe the COMPOSITION (shots, critique, artifact handling, restarts, stopping) — not the code. Output only the summary.`
-					}
-				},
-				executor: cfg.author.executor,
-				context: "strategy reproducer summary"
-			}).chat({ messages: [{
-				role: "user",
-				content: championCode
-			}] })).content.trim();
-			const reproduced = await authorStrategy({
-				profile: cfg.author.profile,
-				executor: cfg.author.executor,
-				...cfg.author.fallbackProfile ? { fallbackProfile: cfg.author.fallbackProfile } : {},
-				contract: `${strategyAuthorContract}\n\nIMPLEMENT EXACTLY THIS STRATEGY (a colleague's description — do not invent a different approach):\n${summary}`,
-				environmentName: cfg.environment.name,
-				lossesJson: "[]",
-				budget,
-				outDir: cfg.outDir
-			});
-			const reproStrategy = {
-				name: `${incumbent.name}-reproduced`,
-				driver: reproduced.strategy.driver
-			};
-			const reproducedHoldoutScore = (await bench("reproduce", holdoutTasks, [reproStrategy])).perStrategy[reproStrategy.name]?.score ?? 0;
-			reproduction = {
-				summary,
-				reproducedName: reproStrategy.name,
-				file: reproduced.file,
-				championHoldoutScore,
-				reproducedHoldoutScore,
-				gap: championHoldoutScore - reproducedHoldoutScore,
-				reproducible: reproducedHoldoutScore >= championHoldoutScore - tolerance
-			};
-		} catch (e) {
-			reproduction = {
-				summary: "",
-				reproducedName: "",
-				championHoldoutScore,
-				reproducedHoldoutScore: 0,
-				gap: championHoldoutScore,
-				reproducible: false,
-				error: e instanceof Error ? e.message.slice(0, 300) : String(e)
-			};
+			return await method(...args);
+		} catch (error) {
+			faults.push(`${name}: ${shareText(error)}`);
+			throw error;
 		}
-	}
+	};
 	return {
-		gen0,
-		gen0Champion,
-		generations: generationRows,
-		archive,
-		finalChampion: incumbent,
-		holdout,
-		verdict,
-		...bandInfo ? { band: bandInfo } : {},
-		...reproduction ? { reproduction } : {},
-		trajectory
-	};
-}
-function checkedTaskSlice(tasks, count, label, snapshot) {
-	if (!Number.isSafeInteger(count) || count < 1 || tasks.length !== count) throw new Error(`evolution: ${label} must supply exactly ${count} tasks; received ${tasks.length}`);
-	const ids = /* @__PURE__ */ new Set();
-	for (const task of tasks) {
-		if (typeof task.id !== "string" || !task.id.trim() || ids.has(task.id)) throw new Error(`evolution: ${label} task IDs must be non-empty and unique`);
-		ids.add(task.id);
+		name: environment.name,
+		open: recorded("open", (task) => environment.open(task)),
+		tools: recorded("tools", (task, handle) => environment.tools(task, handle)),
+		call: (handle, name, args) => environment.call(handle, name, args),
+		score: recorded("score", (task, handle) => environment.score(task, handle)),
+		close: recorded("close", (handle) => environment.close(handle))
+	};
+}
+function environmentFault(faults) {
+	return { outcome: {
+		status: "errored",
+		metrics: {},
+		error: {
+			code: "environment-fault",
+			message: faults[0],
+			retryable: true
+		}
+	} };
+}
+function authorAccounting(turns) {
+	let usd = 0;
+	let costKnown = true;
+	for (const turn of turns) if (turn.costUsd === null) costKnown = false;
+	else usd += turn.costUsd;
+	return {
+		tokens: turns.every((turn) => turn.tokensKnown) ? {
+			status: "known",
+			inputTokens: turns.reduce((sum, turn) => sum + turn.inputTokens, 0),
+			outputTokens: turns.reduce((sum, turn) => sum + turn.outputTokens, 0),
+			cachedTokens: 0
+		} : {
+			status: "unknown",
+			reason: "an authoring call reported no token usage"
+		},
+		cost: costKnown ? {
+			status: "known",
+			usd,
+			source: usd === 0 ? "free" : "provider"
+		} : {
+			status: "unknown",
+			knownLowerBoundUsd: usd,
+			reason: "an authoring call reported no billed cost"
+		}
+	};
+}
+function unknownAccounting(reason) {
+	return {
+		tokens: {
+			status: "unknown",
+			reason
+		},
+		cost: {
+			status: "unknown",
+			knownLowerBoundUsd: 0,
+			reason
+		}
+	};
+}
+/** One probe round-trip lists the domain's tools so the author can focus shots, names and
+* descriptions only, never the implementations. */
+async function listToolCatalog(environment, task) {
+	const handle = await environment.open(task);
+	try {
+		return (await environment.tools(task, handle)).map((tool) => `- ${tool.function.name}${tool.function.description ? ` — ${tool.function.description.slice(0, 120)}` : ""}`).join("\n");
+	} finally {
+		await environment.close(handle);
 	}
-	return snapshot ? immutableCandidateValue(tasks) : tasks;
+}
+/** Free text as the ledger stores it: redacted with the share profile and bounded. */
+function shareText(error) {
+	return redact(error instanceof Error ? error.message : String(error), { profile: "share" }).value.slice(0, 300);
+}
+function compare(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+function positiveInteger(name, value) {
+	if (!Number.isSafeInteger(value) || value < 1) throw new ConfigError(`evolution: ${name} must be a positive integer`);
+	return value;
+}
+function nonNegativeInteger(name, value) {
+	if (!Number.isSafeInteger(value) || value < 0) throw new ConfigError(`evolution: ${name} must be a non-negative integer`);
+	return value;
+}
+function dollars(name, value) {
+	if (value === void 0) return null;
+	if (!Number.isFinite(value) || value < 0) throw new ConfigError(`evolution: ${name} must be a finite non-negative number`);
+	return value;
 }
 //#endregion
 //#region src/runtime/supervise/chat-transport-executor.ts
@@ -8241,6 +8305,6 @@ function tail(s) {
 	return s.slice(-400);
 }
 //#endregion
-export { registerShape as $, sanitizeMcpToolSchema as $t, unsafeInProcessRunner as A, declaredCheckJudge as At, strategyAuthorContract as B, renderLeaderboardMarkdown as Bt, withUntrackedArtifacts as C, loopCampaignDispatch as Ct, patchDelivered as D, checkProgramDigest as Dt, createSqlRunContext as E, assertDeclaredCheck as Et, pickChampion as F, sentinelCompletion as Ft, runBenchmark as G, SqlRunOwnershipError as Gt, SandboxRunAbortError as H, renderPairwiseMarkdown as Ht, runStrategyEvolution as I, stopSentinel as It, trajectoryReport as J, SqlSpawnJournal as Jt, promotionGate as K, openSqlRunStore as Kt, selectChampion as L, leaderboard as Lt, chatWorkerSeam as M, runIsolatedCheck as Mt, createChatSessionStore as N, completionAuthorizes as Nt, runCoderChecks as O, declaredCheckDeliverable as Ot, discriminatingMeans as P, deterministicCompletion as Pt, createShapeRegistry as Q, createMcpEnvironment as Qt, assertStrategyContract as R, pairwiseSignificance as Rt, copyUntrackedIntoClone as S, inlineSandboxClient as St, createFencedSqlRunContext as T, superviseDispatch as Tt, openSandboxRun as U, auditIntent as Ut, strategyAuthorSystemPrompt as V, renderLeaderboardSvg as Vt, printBenchmarkReport as W, defaultAuditorInstruction as Wt, runPersonified as X, connectStdioMcp as Xt, definePersona as Y, McpSpawnFault as Yt, builtinShapes as Z, materializeLocalMcp as Zt, NOTE_MAX_CHARS as _, HarvestError as _t, localShell as a, createTangleSandboxExactProcessProvider as an, loopUntil as at, composeWorkerEvidence as b, resolveSandboxClient as bt, createVerifierEnvironment as c, selectValidWinner as ct, harvestSurfaceDiffs as d, assertTraceDerivedFindings as dt, envKeyProvider as en, FileCorpus as et, analystsFromRegistry as f, buildSteerContext as ft, EVIDENCE_MAX_CHARS as g, inProcessSandboxClient as gt, worktreeFanout as h, observationFromRegistry as ht, jjWorkspace as i, secretEnvOfMcpServer as in, flatWidenGate as it, chatTransportExecutor as j, readDeclaredCheck as jt, codeModeSupervisorTools as k, declaredCheckDigest as kt, boxSurfaceReader as l, verify as lt, superviseSurface as m, registryScopeAnalyst as mt, makeFinding$1 as n, resolveMcpServerLaunch as nn, renderCorpusToInstructions as nt, runInWorkspace as o, panel as ot, failuresAnalyst as p, createScopeAnalyst as pt, equalKOnCost as q, SqlResultBlobStore as qt, gitWorkspace as r, resolveSecretEnv as rn, fanout as rt, createWaterfallCollector as s, pipeline as st, computeFindingId$1 as t, mcpSecretEnvMetadataKey as tn, InMemoryCorpus as tt, fsSurfaceReader as u, widen as ut, VERIFY_TAIL_CHARS as v, harvestCorpus as vt, analyzeTrace as w, loopDispatch as wt, settledWorkerOut as x, localSandboxClient as xt, closingWorkerNote as y, defineLeaderboard as yt, authorStrategy as z, renderLeaderboardHtml as zt };
+export { renderCorpusToInstructions as $, resolveMcpServerLaunch as $t, unsafeInProcessRunner as A, completionAuthorizes as At, SandboxRunAbortError as B, auditIntent as Bt, withUntrackedArtifacts as C, assertDeclaredCheck as Ct, patchDelivered as D, declaredCheckJudge as Dt, createSqlRunContext as E, declaredCheckDigest as Et, strategyTournament as F, pairwiseSignificance as Ft, trajectoryReport as G, SqlSpawnJournal as Gt, printBenchmarkReport as H, SqlRunOwnershipError as Ht, assertStrategyContract as I, renderLeaderboardHtml as It, builtinShapes as J, materializeLocalMcp as Jt, definePersona as K, McpSpawnFault as Kt, authorStrategy as L, renderLeaderboardMarkdown as Lt, chatWorkerSeam as M, sentinelCompletion as Mt, createChatSessionStore as N, stopSentinel as Nt, runCoderChecks as O, readDeclaredCheck as Ot, runStrategyEvolution as P, leaderboard as Pt, InMemoryCorpus as Q, mcpSecretEnvMetadataKey as Qt, strategyAuthorContract as R, renderLeaderboardSvg as Rt, copyUntrackedIntoClone as S, superviseDispatch as St, createFencedSqlRunContext as T, declaredCheckDeliverable as Tt, runBenchmark as U, openSqlRunStore as Ut, openSandboxRun as V, defaultAuditorInstruction as Vt, equalKOnCost as W, SqlResultBlobStore as Wt, registerShape as X, sanitizeMcpToolSchema as Xt, createShapeRegistry as Y, createMcpEnvironment as Yt, FileCorpus as Z, envKeyProvider as Zt, NOTE_MAX_CHARS as _, resolveSandboxClient as _t, localShell as a, selectValidWinner as at, composeWorkerEvidence as b, loopCampaignDispatch as bt, createVerifierEnvironment as c, assertTraceDerivedFindings as ct, harvestSurfaceDiffs as d, registryScopeAnalyst as dt, resolveSecretEnv as en, fanout as et, analystsFromRegistry as f, observationFromRegistry as ft, EVIDENCE_MAX_CHARS as g, defineLeaderboard as gt, worktreeFanout as h, harvestCorpus as ht, jjWorkspace as i, pipeline as it, chatTransportExecutor as j, deterministicCompletion as jt, codeModeSupervisorTools as k, runIsolatedCheck as kt, boxSurfaceReader as l, buildSteerContext as lt, superviseSurface as m, HarvestError as mt, makeFinding$1 as n, createTangleSandboxExactProcessProvider as nn, loopUntil as nt, runInWorkspace as o, verify as ot, failuresAnalyst as p, inProcessSandboxClient as pt, runPersonified as q, connectStdioMcp as qt, gitWorkspace as r, panel as rt, createWaterfallCollector as s, widen as st, computeFindingId$1 as t, secretEnvOfMcpServer as tn, flatWidenGate as tt, fsSurfaceReader as u, createScopeAnalyst as ut, VERIFY_TAIL_CHARS as v, localSandboxClient as vt, analyzeTrace as w, checkProgramDigest as wt, settledWorkerOut as x, loopDispatch as xt, closingWorkerNote as y, inlineSandboxClient as yt, strategyAuthorSystemPrompt as z, renderPairwiseMarkdown as zt };
 
-//# sourceMappingURL=runtime-B_yRPBjj.js.map
+//# sourceMappingURL=runtime-B3TTjtzE.js.map