@tangle-network/agent-runtime 0.339.0 → 0.342.0

package/dist/{runtime-B2fjL9Oi.js → runtime-eghmj6W4.js}

@@ -1,20 +1,20 @@
 import { o as writeAtomicDurableFile } from "./durable-file-gNI9ILAn.js";
-import { Di as contentAddress, Ei as detachedSnapshot, L as rollingDispatch, M as settledToIteration, Qn as verdictFromJudgeScore, Qt as createWorktreeCliExecutor, Ti as detachedFrozen, Wi as createSandboxTurnEventCollector, Xn as gateOnDeliverable, Yn as CheckUnavailableError, Zn as mapExecutorResult, _t as runAgentRounds, jt as routerBrain, k as coordinationProfileToolPrefix, li as executableAgentProfileSnapshot, lt as insideCursorNamespace, n as createSupervisor, ot as InMemoryResultBlobStore, p as isTraceAnalysisStore, pt as createExecutor, qi as notifySandboxEventObserver, st as InMemorySpawnJournal, u as withDriverExecutor, ui as executableAgentSpecSnapshot, ut as createExecutorRegistry, vt as assertBoxlessPromptOptions, wt as defaultSelectWinner, xt as createSandboxLineage, yr as runAbortable, yt as readPromptOptions } from "./supervisor-DHrUJhEZ.js";
+import { $t as createWorktreeCliExecutor, Hi as notifySandboxEventObserver, L as rollingDispatch, M as settledToIteration, Mt as routerBrain, Qn as verdictFromJudgeScore, Si as contentAddress, St as createSandboxLineage, Tt as defaultSelectWinner, Xn as gateOnDeliverable, Yn as CheckUnavailableError, Zn as mapExecutorResult, _r as runAbortable, ai as executableAgentSpecSnapshot, bi as detachedFrozen, bt as readPromptOptions, ct as InMemorySpawnJournal, dt as createExecutorRegistry, ii as executableAgentProfileSnapshot, k as coordinationProfileToolPrefix, mt as createExecutor, n as createSupervisor, p as isTraceAnalysisStore, st as InMemoryResultBlobStore, u as withDriverExecutor, ut as insideCursorNamespace, vt as runAgentRounds, xi as detachedSnapshot, yt as assertBoxlessPromptOptions, zi as createSandboxTurnEventCollector } from "./supervisor-DUWcecAd.js";
 import { i as ConfigError, m as ValidationError, n as AnalystError, s as PlannerError } from "./errors-DodWX-cb.js";
-import { D as runAgentic, E as refine, M as renderReport, N as profileChatClient, O as sample, j as observe, k as ObservationError, v as loadAuthoredStrategy, x as strategyAuthorContract, y as requestStrategySource } from "./structural-rollout-DpLCXzaL.js";
-import { $ as hasCompleteCacheBreakdown, F as canonicalCandidateDigest$1, G as addSpend, J as cloneSpend, M as markPutStreamVerified, Q as fnv1a32Hex, V as sha256Bytes$1, Z as errorMessage, ct as stringifySafe, et as isAbortError, it as randomSuffix, nt as mapWithConcurrency, pt as zeroSpend, q as chargedTokens, st as sleep, tt as isAsyncIterable, w as captureMaterializedWorkspace, wt as armDeadlineTimer, x as WorkspaceScanLimitError, z as immutableCandidateValue } from "./sandbox-profile-compat-BzVBFqrz.js";
+import { D as runAgentic, E as refine, M as renderReport, N as profileChatClient, O as sample, j as observe, k as ObservationError, v as loadAuthoredStrategy, x as strategyAuthorContract, y as requestStrategySource } from "./structural-rollout-BD9IN7K_.js";
+import { $ as isAbortError, B as sha256Bytes$1, C as WorkspaceScanLimitError, Ct as armDeadlineTimer, E as captureMaterializedWorkspace, K as chargedTokens, P as canonicalCandidateDigest$1, Q as hasCompleteCacheBreakdown, R as immutableCandidateValue, W as addSpend, X as errorMessage, Z as fnv1a32Hex, et as isAsyncIterable, ft as zeroSpend, h as markPutStreamVerified, ot as sleep, q as cloneSpend, rt as randomSuffix, st as stringifySafe, tt as mapWithConcurrency } from "./sandbox-profile-compat-FN2kab2-.js";
 import { c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, p as canonicalObservedModelParts, t as assertExecutableAgentProfile, v as harnessRunsAgent } from "./model-policy-CyCUwHed.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-tXpAarhW.js";
 import { a as readCommittedJsonLines, i as readCommittedJsonFile, n as isNoEntError, o as upsertCommittedJsonLine, s as withJsonlFileLock, t as appendCommittedJsonLine } from "./jsonl-file-C9Kde_0Z.js";
-import { g as foldCoordinationRecords, p as createInMemoryRunContext } from "./driver-control-acknowledgers-C53ggdJ6.js";
-import { I as runBrainLoop, t as supervise } from "./supervise-qAwXmPtD.js";
-import { a as reconcileInterruptedSearchCalls, c as searchExecutor, r as dedicatedLane, x as runtimeShipDecision } from "./search-executor-zMumiak_.js";
+import { g as foldCoordinationRecords, p as createInMemoryRunContext } from "./coordination-manager-B5JsolDR.js";
+import { _ as runBrainLoop, t as supervise } from "./supervise-DmOi7gll.js";
+import { a as reconcileInterruptedSearchCalls, c as searchExecutor, r as dedicatedLane, x as runtimeShipDecision } from "./search-executor-rbjdZ3OD.js";
 import "./run-cancellation-C9oL62sW.js";
 import { a as graphRunsFor, d as recordGraphRun, i as graphRegistry, l as lookupGraph, p as taskShapeDigest, r as graphFromStored, t as digestOfGraph } from "./graph-registry-BnO64cn8.js";
 import { i as redactProtectedValue, r as redactProtectedReason } from "./protected-redaction-DFCeo4vg.js";
-import "./provision-supervisor-CJ6Zz6dz.js";
-import "./delegate-CCWE_AkU.js";
-import "./graph-CI9JXKqO.js";
+import "./provision-supervisor-DL6gEMQp.js";
+import "./delegate-Rl-5paLJ.js";
+import "./graph-Ce-59ZXn.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, sha256Bytes, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { CODING_HARNESSES, DEFAULT_TRACE_ANALYST_KINDS, InMemoryTraceStore, OUTPUT_VALUE, benjaminiHochberg, buildTrajectory, computeFindingId as computeFindingId$1, confidenceInterval, createTraceAnalyst, expandProfileAxes, makeFinding as makeFinding$1, pairedBootstrap, paretoFrontier, wilcoxonSignedRank, wilson } from "@tangle-network/agent-eval";
 import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
@@ -2808,27 +2808,24 @@ function gitSha() {
 function normalizeScore(s) {
 	return typeof s === "number" ? { composite: s } : s;
 }
-/**
-* Assemble a declarative spec (`cases` + `prompt` + `score`) into a runnable
-* harness×model leaderboard — `run()` executes the matrix, `toBenchmarkAdapter()`
-* exposes the same domain as a structural `BenchmarkAdapter`.
-*/
-function defineLeaderboard(spec) {
-	const caseId = (c) => {
-		const id = spec.caseId ? spec.caseId(c) : c.id;
-		if (typeof id !== "string" || id.length === 0) throw new Error(`defineLeaderboard(${spec.name}): every case needs a stable string id — give cases an \`id\` property or supply spec.caseId`);
-		return id;
-	};
-	const selectCases = (ids) => {
-		if (!ids) return spec.cases;
-		const byId = new Map(spec.cases.map((c) => [caseId(c), c]));
-		return ids.map((id) => {
-			const c = byId.get(id);
-			if (c === void 0) throw new Error(`defineLeaderboard(${spec.name}): unknown case "${id}" (have: ${[...byId.keys()].join(", ")})`);
-			return c;
-		});
-	};
-	const scoreJudge = {
+/** The stable string id of a case. */
+function leaderboardCaseId(spec, c) {
+	const id = spec.caseId ? spec.caseId(c) : c.id;
+	if (typeof id !== "string" || id.length === 0) throw new Error(`defineLeaderboard(${spec.name}): every case needs a stable string id — give cases an \`id\` property or supply spec.caseId`);
+	return id;
+}
+/** The cases named by `ids`, in that order; every case when `ids` is omitted. */
+function selectLeaderboardCases(spec, ids) {
+	if (!ids) return spec.cases;
+	const byId = new Map(spec.cases.map((c) => [leaderboardCaseId(spec, c), c]));
+	return ids.map((id) => {
+		const c = byId.get(id);
+		if (c === void 0) throw new Error(`defineLeaderboard(${spec.name}): unknown case "${id}" (have: ${[...byId.keys()].join(", ")})`);
+		return c;
+	});
+}
+function leaderboardScoreJudge(spec) {
+	return {
 		name: `${spec.name}-score`,
 		dimensions: [{
 			key: "composite",
@@ -2846,20 +2843,174 @@ function defineLeaderboard(spec) {
 			};
 		}
 	};
+}
+/** The standard flags plus every `spec.flags` entry, read from argv. */
+function parseLeaderboardArgs(spec, argv) {
+	const args = {};
+	for (const name of [
+		"backend",
+		"harnesses",
+		"models",
+		"cases",
+		"shots",
+		"reps",
+		"model-snapshot",
+		"run-dir",
+		"export-dir"
+	]) args[name] = argOf(argv, name);
+	for (const [name, flag] of Object.entries(spec.flags ?? {})) args[name] = argOf(argv, name) ?? flag.default;
+	return args;
+}
+/** The harness×model axes and the executable profiles they expand to. */
+function resolveLeaderboardProfiles(spec, args, snapshot) {
+	const harnesses = splitList(args.harnesses) ?? spec.axis?.harnesses ?? CODING_HARNESSES;
+	const rawModels = splitList(args.models) ?? spec.axis?.models ?? (spec.baseProfile?.model?.default !== void 0 ? [spec.baseProfile.model.default] : void 0);
+	if (!rawModels || rawModels.length === 0) throw new Error(`defineLeaderboard(${spec.name}): no models — pass --models, set spec.axis.models, or give spec.baseProfile a model.default`);
+	const models = rawModels.map((m) => withSnapshot(m, snapshot));
+	const profiles = expandProfileAxes({
+		base: spec.baseProfile,
+		harnesses,
+		models
+	});
+	for (const profile of profiles) assertExecutableAgentProfile(profile, `defineLeaderboard(${spec.name})`);
+	return {
+		harnesses,
+		models,
+		profiles
+	};
+}
+/** The sandbox client for the named backend: defaults plus spec overrides (spec wins).
+*  Factories are lazy so an unused backend never resolves credentials. */
+function resolveLeaderboardClient(spec, backendName) {
+	const backends = {
+		sandbox: () => {
+			throw new Error(`defineLeaderboard(${spec.name}): the 'sandbox' backend needs your product's real Sandbox client — supply spec.backends.sandbox (e.g. () => new Sandbox({ apiKey, baseUrl }))`);
+		},
+		"cli-bridge": () => {
+			const bearer = process.env.BRIDGE_BEARER ?? process.env.CLI_BRIDGE_BEARER;
+			if (!bearer) throw new Error(`defineLeaderboard(${spec.name}): backend 'cli-bridge' needs BRIDGE_BEARER or CLI_BRIDGE_BEARER set`);
+			return resolveSandboxClient({
+				backend: "bridge",
+				bridge: {
+					url: process.env.CLI_BRIDGE_URL,
+					bearer,
+					timeoutMs: 9e5
+				}
+			});
+		},
+		...spec.backends
+	};
+	const makeClient = backends[backendName];
+	if (!makeClient) throw new Error(`defineLeaderboard(${spec.name}): unknown backend "${backendName}" (have: ${Object.keys(backends).join(", ")})`);
+	return makeClient();
+}
+/**
+* The default dispatch wraps loopDispatch per cell (closures only — no
+* per-cell resource cost) so the loop's finished iterations can be joined
+* with the campaign ctx: onCellEvents gets EVERY shot's outcome (a thrown
+* shot never reaches parse, so parse-time tapping would hide it), and a
+* the cost receipt records the spec-resolved served model.
+*/
+function leaderboardDispatch(spec, sandboxClient, shots, promptOf) {
+	let shotNonce = 0;
+	const maximumCharge = spec.maximumCharge;
+	return (profile, scenario, dispatchCtx) => {
+		return loopDispatch({
+			sandboxClient,
+			maximumCharge: typeof maximumCharge === "function" ? (cellScenario, cellProfile) => maximumCharge(cellProfile, cellScenario) : maximumCharge,
+			resolveCostModel: (result, _cellScenario, cellProfile) => {
+				if (!spec.resolveModel) return cellProfile.model?.default;
+				const served = new Set(result.iterations.map((iteration) => spec.resolveModel?.(iteration.events)).filter((model) => model !== void 0));
+				if (served.size > 1) throw new Error(`defineLeaderboard(${spec.name}): one cell reported multiple served models: ${[...served].join(", ")}`);
+				return [...served][0] ?? cellProfile.model?.default;
+			},
+			toLoopOptions: (cellScenario, cellProfile) => {
+				return {
+					driver: naiveRetryDriver(shots),
+					agentRun: {
+						profile: cellProfile,
+						taskToPrompt: (s) => `${promptOf(s)}\n\n<!-- independent-attempt:${shotNonce++} -->`
+					},
+					output: { parse: (events) => spec.parseOutput ? spec.parseOutput(events, cellScenario.case) : collectAgentResponseText(events) ?? "" },
+					validator: { validate: async (output) => {
+						const s = normalizeScore(spec.score(output, cellScenario.case));
+						return {
+							valid: s.composite > 0,
+							score: s.composite
+						};
+					} },
+					task: cellScenario,
+					maxIterations: shots
+				};
+			},
+			toArtifact: (result) => {
+				for (const iter of result.iterations) spec.onCellEvents?.(iter.events, scenario.case, {
+					index: iter.index,
+					...iter.error ? { error: iter.error.message } : {},
+					...iter.verdict ? { verdict: { score: iter.verdict.score } } : {}
+				});
+				return result.winner?.output;
+			}
+		})(profile, scenario, dispatchCtx);
+	};
+}
+/** Hand the result to `spec.export`, or write the default JSON and markdown leaderboard. */
+async function exportLeaderboardResult(spec, result, ctx) {
+	if (spec.export) {
+		await spec.export(result, ctx);
+		return;
+	}
+	mkdirSync(ctx.exportDir, { recursive: true });
+	writeFileSync(join(ctx.runDir, "matrix-result.json"), `${JSON.stringify(result, null, 2)}\n`);
+	const table = renderLeaderboardMarkdown(leaderboard(result.records, {
+		title: spec.name,
+		meta: { backend: ctx.backend }
+	}));
+	writeFileSync(join(ctx.exportDir, "leaderboard.md"), table);
+	console.log(table);
+}
+/** The leaderboard's domain surface in the structural `BenchmarkAdapter` shape. */
+function leaderboardBenchmarkAdapter(spec) {
+	return {
+		name: spec.name,
+		async preflight() {
+			const seen = /* @__PURE__ */ new Set();
+			for (const c of spec.cases) {
+				const id = leaderboardCaseId(spec, c);
+				if (seen.has(id)) throw new Error(`defineLeaderboard(${spec.name}): duplicate case id "${id}"`);
+				seen.add(id);
+			}
+		},
+		async loadTasks(opts) {
+			const selected = selectLeaderboardCases(spec, opts?.ids);
+			const limited = opts?.limit !== void 0 ? selected.slice(0, opts.limit) : selected;
+			return Promise.all(limited.map(async (c) => ({
+				id: leaderboardCaseId(spec, c),
+				prompt: await spec.prompt(c),
+				metadata: { case: c }
+			})));
+		},
+		async judge(task, artifact) {
+			const [c] = selectLeaderboardCases(spec, [task.id]);
+			if (c === void 0) throw new Error(`defineLeaderboard(${spec.name}): no case "${task.id}"`);
+			const s = normalizeScore(spec.score(artifact, c));
+			return {
+				resolved: s.composite > 0,
+				score: s.composite,
+				detail: s.notes
+			};
+		},
+		async goldArtifact() {}
+	};
+}
+/**
+* Assemble a declarative spec (`cases` + `prompt` + `score`) into a runnable
+* harness×model leaderboard — `run()` executes the matrix, `toBenchmarkAdapter()`
+* exposes the same domain as a structural `BenchmarkAdapter`.
+*/
+function defineLeaderboard(spec) {
 	async function run(argv = process.argv.slice(2)) {
-		const args = {};
-		for (const name of [
-			"backend",
-			"harnesses",
-			"models",
-			"cases",
-			"shots",
-			"reps",
-			"model-snapshot",
-			"run-dir",
-			"export-dir"
-		]) args[name] = argOf(argv, name);
-		for (const [name, flag] of Object.entries(spec.flags ?? {})) args[name] = argOf(argv, name) ?? flag.default;
+		const args = parseLeaderboardArgs(spec, argv);
 		const backendName = args.backend ?? "sandbox";
 		const shots = Number(args.shots ?? spec.shots ?? 1);
 		const reps = Number(args.reps ?? spec.reps ?? 1);
@@ -2867,23 +3018,14 @@ function defineLeaderboard(spec) {
 		const runDir = args["run-dir"] ?? join(tmpdir(), `leaderboard-${spec.name}-${Date.now()}-${process.pid}`);
 		const exportDir = args["export-dir"] ?? join(runDir, "export");
 		mkdirSync(runDir, { recursive: true });
-		const cases = selectCases(splitList(args.cases));
+		const cases = selectLeaderboardCases(spec, splitList(args.cases));
 		if (cases.length === 0) throw new Error(`defineLeaderboard(${spec.name}): no cases to run`);
 		const scenarios = cases.map((c) => ({
-			id: caseId(c),
+			id: leaderboardCaseId(spec, c),
 			kind: spec.name,
 			case: c
 		}));
-		const harnesses = splitList(args.harnesses) ?? spec.axis?.harnesses ?? CODING_HARNESSES;
-		const rawModels = splitList(args.models) ?? spec.axis?.models ?? (spec.baseProfile?.model?.default !== void 0 ? [spec.baseProfile.model.default] : void 0);
-		if (!rawModels || rawModels.length === 0) throw new Error(`defineLeaderboard(${spec.name}): no models — pass --models, set spec.axis.models, or give spec.baseProfile a model.default`);
-		const models = rawModels.map((m) => withSnapshot(m, snapshot));
-		const profiles = expandProfileAxes({
-			base: spec.baseProfile,
-			harnesses,
-			models
-		});
-		for (const profile of profiles) assertExecutableAgentProfile(profile, `defineLeaderboard(${spec.name})`);
+		const { harnesses, models, profiles } = resolveLeaderboardProfiles(spec, args, snapshot);
 		const ctx = {
 			name: spec.name,
 			backend: backendName,
@@ -2896,27 +3038,7 @@ function defineLeaderboard(spec) {
 			shots,
 			reps
 		};
-		const backends = {
-			sandbox: () => {
-				throw new Error(`defineLeaderboard(${spec.name}): the 'sandbox' backend needs your product's real Sandbox client — supply spec.backends.sandbox (e.g. () => new Sandbox({ apiKey, baseUrl }))`);
-			},
-			"cli-bridge": () => {
-				const bearer = process.env.BRIDGE_BEARER ?? process.env.CLI_BRIDGE_BEARER;
-				if (!bearer) throw new Error(`defineLeaderboard(${spec.name}): backend 'cli-bridge' needs BRIDGE_BEARER or CLI_BRIDGE_BEARER set`);
-				return resolveSandboxClient({
-					backend: "bridge",
-					bridge: {
-						url: process.env.CLI_BRIDGE_URL,
-						bearer,
-						timeoutMs: 9e5
-					}
-				});
-			},
-			...spec.backends
-		};
-		const makeClient = backends[backendName];
-		if (!makeClient) throw new Error(`defineLeaderboard(${spec.name}): unknown backend "${backendName}" (have: ${Object.keys(backends).join(", ")})`);
-		const sandboxClient = makeClient();
+		const sandboxClient = resolveLeaderboardClient(spec, backendName);
 		const promptById = /* @__PURE__ */ new Map();
 		for (const s of scenarios) promptById.set(s.id, await spec.prompt(s.case));
 		const promptOf = (s) => {
@@ -2924,111 +3046,28 @@ function defineLeaderboard(spec) {
 			if (p === void 0) throw new Error(`defineLeaderboard(${spec.name}): no prompt for case "${s.id}"`);
 			return p;
 		};
-		let shotNonce = 0;
-		const maximumCharge = spec.maximumCharge;
-		const dispatch = spec.dispatch ?? ((profile, scenario, dispatchCtx) => {
-			return loopDispatch({
-				sandboxClient,
-				maximumCharge: typeof maximumCharge === "function" ? (cellScenario, cellProfile) => maximumCharge(cellProfile, cellScenario) : maximumCharge,
-				resolveCostModel: (result, _cellScenario, cellProfile) => {
-					if (!spec.resolveModel) return cellProfile.model?.default;
-					const served = new Set(result.iterations.map((iteration) => spec.resolveModel?.(iteration.events)).filter((model) => model !== void 0));
-					if (served.size > 1) throw new Error(`defineLeaderboard(${spec.name}): one cell reported multiple served models: ${[...served].join(", ")}`);
-					return [...served][0] ?? cellProfile.model?.default;
-				},
-				toLoopOptions: (cellScenario, cellProfile) => {
-					return {
-						driver: naiveRetryDriver(shots),
-						agentRun: {
-							profile: cellProfile,
-							taskToPrompt: (s) => `${promptOf(s)}\n\n<!-- independent-attempt:${shotNonce++} -->`
-						},
-						output: { parse: (events) => spec.parseOutput ? spec.parseOutput(events, cellScenario.case) : collectAgentResponseText(events) ?? "" },
-						validator: { validate: async (output) => {
-							const s = normalizeScore(spec.score(output, cellScenario.case));
-							return {
-								valid: s.composite > 0,
-								score: s.composite
-							};
-						} },
-						task: cellScenario,
-						maxIterations: shots
-					};
-				},
-				toArtifact: (result) => {
-					for (const iter of result.iterations) spec.onCellEvents?.(iter.events, scenario.case, {
-						index: iter.index,
-						...iter.error ? { error: iter.error.message } : {},
-						...iter.verdict ? { verdict: { score: iter.verdict.score } } : {}
-					});
-					return result.winner?.output;
-				}
-			})(profile, scenario, dispatchCtx);
-		});
+		const dispatch = spec.dispatch ?? leaderboardDispatch(spec, sandboxClient, shots, promptOf);
 		await spec.setup?.(ctx);
 		try {
 			const result = await runProfileMatrix({
 				profiles,
 				scenarios,
 				dispatch,
-				judges: spec.judges ?? [scoreJudge],
+				judges: spec.judges ?? [leaderboardScoreJudge(spec)],
 				runDir,
 				commitSha: gitSha(),
 				reps,
 				...spec.matrix
 			});
-			if (spec.export) await spec.export(result, ctx);
-			else {
-				mkdirSync(exportDir, { recursive: true });
-				writeFileSync(join(runDir, "matrix-result.json"), `${JSON.stringify(result, null, 2)}\n`);
-				const table = renderLeaderboardMarkdown(leaderboard(result.records, {
-					title: spec.name,
-					meta: { backend: backendName }
-				}));
-				writeFileSync(join(exportDir, "leaderboard.md"), table);
-				console.log(table);
-			}
+			await exportLeaderboardResult(spec, result, ctx);
 			return result;
 		} finally {
 			await spec.teardown?.(ctx);
 		}
 	}
-	function toBenchmarkAdapter() {
-		return {
-			name: spec.name,
-			async preflight() {
-				const seen = /* @__PURE__ */ new Set();
-				for (const c of spec.cases) {
-					const id = caseId(c);
-					if (seen.has(id)) throw new Error(`defineLeaderboard(${spec.name}): duplicate case id "${id}"`);
-					seen.add(id);
-				}
-			},
-			async loadTasks(opts) {
-				const selected = selectCases(opts?.ids);
-				const limited = opts?.limit !== void 0 ? selected.slice(0, opts.limit) : selected;
-				return Promise.all(limited.map(async (c) => ({
-					id: caseId(c),
-					prompt: await spec.prompt(c),
-					metadata: { case: c }
-				})));
-			},
-			async judge(task, artifact) {
-				const [c] = selectCases([task.id]);
-				if (c === void 0) throw new Error(`defineLeaderboard(${spec.name}): no case "${task.id}"`);
-				const s = normalizeScore(spec.score(artifact, c));
-				return {
-					resolved: s.composite > 0,
-					score: s.composite,
-					detail: s.notes
-				};
-			},
-			async goldArtifact() {}
-		};
-	}
 	return {
 		run,
-		toBenchmarkAdapter
+		toBenchmarkAdapter: () => leaderboardBenchmarkAdapter(spec)
 	};
 }
 //#endregion
@@ -4650,8 +4689,10 @@ function dispatch() {
 		run(worker, jobs.shift());
 	}
 }
+let syncs = 0;
 /** fsync an open file or directory on a sync thread; keep the handle open until this settles. */
 function syncHandle(handle) {
+	syncs += 1;
 	if (threadsUnavailable) return handle.sync();
 	return new Promise((resolve, reject) => {
 		jobs.push({
@@ -4671,21 +4712,42 @@ async function syncDirectory(directory) {
 	}
 }
 //#endregion
-//#region src/runtime/private-cas.ts
+//#region src/runtime/private-cas-objects.ts
+/**
+* The local object store of a private CAS: where an object lives, how it is written, read back
+* and verified, and how a locator is checked. An object's name is published only after its bytes
+* are synced, and that order is what makes a name trustworthy, except in an `ephemeral` store, which
+* syncs nothing and is never read after its process ends: see `createPrivateCasArtifactPort`.
+* Durable copies build on these.
+*/
 const DIGEST$1 = /^sha256:([0-9a-f]{64})$/u;
-const HEX = /^[0-9a-f]{64}$/u;
-const SHARD = /^[0-9a-f]{2}$/u;
-const SAFE_NAMESPACE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/u;
-const RECEIPT_SCHEMA = "agent-runtime.private-cas-durable-receipt.v1";
-const DURABLE_ATTEMPTS = 3;
-const DURABLE_STALL_MS = 12e4;
-const BUFFERED_BYTES_PER_MS = 256;
-const OFFLOAD_COPIES_AT_ONCE = 16;
-const LIST_SHARDS_AT_ONCE = 16;
+const isMissingPath = (error) => error?.code === "ENOENT";
+const casSha256 = (bytes) => `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+function privateCasRef(namespace, digest, byteLength) {
+	return {
+		locator: {
+			kind: "private-cas",
+			namespace,
+			digest
+		},
+		sha256: digest,
+		byteLength
+	};
+}
+function hexOf(digest) {
+	const match = DIGEST$1.exec(digest);
+	if (!match) throw new Error("private CAS digest must be sha256:<64 lowercase hex>");
+	return match[1];
+}
+function objectPath(layout, digest) {
+	const hex = hexOf(digest);
+	return join(layout.store, hex.slice(0, 2), hex);
+}
 async function realDirectory(path) {
 	const entry = await lstat(path);
 	if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error(`private CAS directory is not a real directory: ${path}`);
 }
+/** Require every component of `path` to be a real directory, creating them when `create`. */
 async function checkDirectories(path, create) {
 	const parts = resolve(path).split(sep);
 	let current = sep;
@@ -4700,16 +4762,13 @@ async function checkDirectories(path, create) {
 		await realDirectory(current);
 	}
 }
-const missing = (error) => error?.code === "ENOENT";
-const message = (error) => error instanceof Error ? error.message : String(error);
-const sha256 = (bytes) => `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
 /** Read one local object, or undefined when the host no longer holds it. */
 async function readLocal(path) {
 	let file;
 	try {
 		file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
 	} catch (error) {
-		if (missing(error)) return void 0;
+		if (isMissingPath(error)) return void 0;
 		throw error;
 	}
 	try {
@@ -4718,219 +4777,308 @@ async function readLocal(path) {
 		await file.close();
 	}
 }
-/**
-* Private content-addressed storage scoped to one recorded run identity.
-*
-* Bytes are written to the host first. With a durable store, every object is also copied off the
-* host as it is written, and `localBudgetBytes` bounds what the host keeps: an object's local copy
-* is deleted only after its durable receipt exists, and reads fall back to the durable store.
-*
-* An object's name is published only after its bytes are synced, and that order is what makes a
-* name trustworthy. A put whose digest already exists links nothing: it re-reads the existing
-* object and refuses on a mismatch, and no later put replaces that file. So a deferred-sync mode
-* that published names before one batch sync would, after a crash, leave a torn object under its
-* valid name, and every later put of that digest would fail. Any batching must keep the order:
-* write under temporary names, sync, publish the names, sync again (discovery-lab
-* runner/evidence-store.mjs commits receipts this way). On drew-gtr-pro's USB SMR disk on
-* 2026-10-21 these per-object fsyncs, 545 ms each on the 16 SYNC_THREADS, set a store's rate at
-* about 26 files/s.
-*/
-function createPrivateCasArtifactPort(root, namespace, options = {}) {
-	if (!isAbsolute(root)) throw new Error("private CAS root must be absolute");
-	if (!SAFE_NAMESPACE.test(namespace) || namespace === "." || namespace === "..") throw new Error("private CAS namespace must be one safe identifier");
-	const { durable, localBudgetBytes, durableStallMs = DURABLE_STALL_MS } = options;
-	if (!Number.isSafeInteger(durableStallMs) || durableStallMs <= 0) throw new Error("private CAS durableStallMs must be a positive integer");
-	if (localBudgetBytes !== void 0 && (durable === void 0 || !Number.isSafeInteger(localBudgetBytes) || localBudgetBytes < 0)) throw new Error("private CAS localBudgetBytes needs a durable store and a non-negative integer");
-	const store = join(resolve(root), "sha256");
-	const receipts = join(resolve(root), "durable", "sha256");
-	const hexOf = (digest) => {
-		const match = DIGEST$1.exec(digest);
-		if (!match) throw new Error("private CAS digest must be sha256:<64 lowercase hex>");
-		return match[1];
-	};
-	const destination = (digest) => {
-		const hex = hexOf(digest);
-		return join(store, hex.slice(0, 2), hex);
-	};
-	const hasReceipt = async (hex) => {
-		try {
-			return (await lstat(join(receipts, hex))).isFile();
-		} catch (error) {
-			if (missing(error)) return false;
-			throw error;
-		}
-	};
-	const writeReceipt = async (digest, byteLength) => {
-		await checkDirectories(receipts, true);
-		const hex = hexOf(digest);
-		const temporary = join(receipts, `.${hex}.${randomUUID()}.tmp`);
-		const file = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+async function* readObject(path, ref, signal) {
+	signal?.throwIfAborted();
+	const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+	try {
+		const stats = await file.stat();
+		if (!stats.isFile() || stats.size !== ref.byteLength) throw new Error("private CAS object failed digest or length verification");
+		yield* checkedChunks(file.createReadStream({
+			autoClose: false,
+			highWaterMark: 64 * 1024
+		}), ref, signal);
+	} finally {
+		await file.close();
+	}
+}
+async function* checkedChunks(chunks, ref, signal) {
+	const hash = createHash("sha256");
+	let byteLength = 0;
+	for await (const chunk of chunks) {
+		signal?.throwIfAborted();
+		if (!(chunk instanceof Uint8Array)) throw new Error("private CAS emitted a non-byte chunk");
+		byteLength += chunk.byteLength;
+		if (byteLength > ref.byteLength) throw new Error("private CAS object failed digest or length verification");
+		hash.update(chunk);
+		yield chunk;
+	}
+	signal?.throwIfAborted();
+	if (`sha256:${hash.digest("hex")}` !== ref.sha256 || byteLength !== ref.byteLength) throw new Error("private CAS object failed digest or length verification");
+}
+function verified(bytes, ref) {
+	if (casSha256(bytes) !== ref.sha256 || bytes.byteLength !== ref.byteLength) throw new Error("private CAS object failed digest or length verification");
+	return bytes;
+}
+function assertOwnLocator(layout, ref) {
+	if (ref.locator.kind !== "private-cas" || ref.locator.namespace !== layout.namespace || ref.locator.digest !== ref.sha256) throw new Error("private CAS locator does not match its digest and namespace");
+}
+/** Stream an object from the host, falling back to the durable store when the host lacks it. */
+async function* readPrivateCasStream(layout, ref, options = {}) {
+	const { signal } = options;
+	const { durable } = layout;
+	signal?.throwIfAborted();
+	assertOwnLocator(layout, ref);
+	const path = objectPath(layout, ref.sha256);
+	try {
+		await checkDirectories(join(layout.store, hexOf(ref.sha256).slice(0, 2)), false);
+		yield* readObject(path, ref, signal);
+		return;
+	} catch (error) {
+		if (!isMissingPath(error)) throw error;
+	}
+	if (!durable?.getStream) throw new Error(`private CAS object is not on this host; streaming durable reads are unavailable: ${ref.sha256}`);
+	const chunks = await durable.getStream({
+		namespace: layout.namespace,
+		digest: ref.sha256,
+		signal
+	});
+	if (!chunks) throw new Error(`private CAS object is neither on this host nor in ${durable.location}: ${ref.sha256}`);
+	yield* checkedChunks(chunks, ref, signal);
+}
+/** Read a whole object from the host, falling back to the durable store. */
+async function readPrivateCasRef(layout, ref) {
+	const { durable } = layout;
+	assertOwnLocator(layout, ref);
+	const path = objectPath(layout, ref.sha256);
+	const shard = join(layout.store, hexOf(ref.sha256).slice(0, 2));
+	let local;
+	try {
+		await checkDirectories(shard, false);
+		local = await readLocal(path);
+	} catch (error) {
+		if (!isMissingPath(error)) throw error;
+	}
+	if (local !== void 0) return verified(local, ref);
+	if (durable === void 0) throw new Error(`private CAS object is not on this host: ${ref.sha256}`);
+	const stored = await durable.get({
+		namespace: layout.namespace,
+		digest: ref.sha256
+	});
+	if (stored === void 0) throw new Error(`private CAS object is neither on this host nor in ${durable.location}: ${ref.sha256}`);
+	return verified(stored, ref);
+}
+/** The ref of an object this CAS holds with exactly this length, on the host or by receipt. */
+async function locatePrivateCasObject(layout, object, options = {}) {
+	options.signal?.throwIfAborted();
+	const digest = object.sha256;
+	const hex = hexOf(digest);
+	const ref = privateCasRef(layout.namespace, digest, object.byteLength);
+	try {
+		await checkDirectories(join(layout.store, hex.slice(0, 2)), false);
+		const local = await lstat(objectPath(layout, digest));
+		if (local.isFile()) return local.size === object.byteLength ? ref : void 0;
+	} catch (error) {
+		if (!isMissingPath(error)) throw error;
+	}
+	if (layout.durable === void 0) return void 0;
+	const receipt = await readLocal(join(layout.receipts, hex));
+	if (receipt === void 0) return void 0;
+	return JSON.parse(Buffer.from(receipt).toString("utf8")).byteLength === object.byteLength ? ref : void 0;
+}
+const CREATE_EXCLUSIVE = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW;
+/** Store a stream: stage it under a temporary name, verify the staged inode, then publish it. */
+async function putPrivateCasStream(layout, offload, input) {
+	const { signal } = input;
+	const { store, durable } = layout;
+	signal?.throwIfAborted();
+	await checkDirectories(store, true);
+	const temporary = join(store, `.${randomUUID()}.tmp`);
+	try {
+		const file = await open(temporary, CREATE_EXCLUSIVE, 384);
+		const hash = createHash("sha256");
+		let byteLength = 0;
 		try {
-			await file.writeFile(`${JSON.stringify({
-				schema: RECEIPT_SCHEMA,
-				location: durable.location,
-				namespace,
-				digest,
-				byteLength,
-				storedAt: (/* @__PURE__ */ new Date()).toISOString()
-			})}\n`);
-			await syncHandle(file);
+			for await (const chunk of input.chunks) {
+				signal?.throwIfAborted();
+				if (!(chunk instanceof Uint8Array)) throw new Error("private CAS received a non-byte chunk");
+				hash.update(chunk);
+				byteLength += chunk.byteLength;
+				if (!Number.isSafeInteger(byteLength)) throw new Error("private CAS object is too large");
+				await file.writeFile(chunk);
+			}
+			signal?.throwIfAborted();
+			if (!layout.ephemeral) await syncHandle(file);
 		} finally {
 			await file.close();
 		}
-		await rename(temporary, join(receipts, hex));
-		await syncDirectory(receipts);
-	};
-	const watchAttempt = (idleMs, signal) => {
-		const stall = new AbortController();
-		let timer;
-		const touch = () => {
-			clearTimeout(timer);
-			timer = setTimeout(() => stall.abort(/* @__PURE__ */ new Error(`durable copy moved no bytes for ${idleMs} ms`)), idleMs);
-		};
-		touch();
-		const attempt = signal === void 0 ? stall.signal : AbortSignal.any([signal, stall.signal]);
-		return {
-			signal: attempt,
-			touch,
-			run: (act) => runAbortable(act, attempt, "private CAS durable copy was cancelled"),
-			done: () => clearTimeout(timer)
-		};
-	};
-	const storeDurably = async (digest, bytes, signal) => {
-		let failure;
-		for (let attempt = 1; attempt <= DURABLE_ATTEMPTS; attempt++) {
-			signal?.throwIfAborted();
-			const watch = watchAttempt(durableStallMs + Math.ceil(bytes.byteLength / BUFFERED_BYTES_PER_MS), signal);
-			try {
-				await watch.run(() => durable.put({
-					namespace,
-					digest,
-					bytes,
-					signal: watch.signal
-				}));
-				await writeReceipt(digest, bytes.byteLength);
-				return;
-			} catch (error) {
-				failure = error;
-				if (signal?.aborted) throw error;
-				if (attempt < DURABLE_ATTEMPTS) await new Promise((settle) => setTimeout(settle, 1e3 * 4 ** (attempt - 1)));
-			} finally {
-				watch.done();
-			}
-		}
-		throw failure;
-	};
-	const localObjects = async () => {
-		let shards;
+		const sha = hash.digest("hex");
+		const digest = `sha256:${sha}`;
+		const ref = privateCasRef(layout.namespace, digest, byteLength);
+		for await (const _chunk of readObject(temporary, ref, signal));
+		const path = objectPath(layout, digest);
+		const directory = join(store, sha.slice(0, 2));
+		await checkDirectories(directory, true);
+		signal?.throwIfAborted();
+		let linked = true;
 		try {
-			shards = await readdir(store);
+			await link(temporary, path);
 		} catch (error) {
-			if (missing(error)) return [];
-			throw error;
+			if (error.code !== "EEXIST") throw error;
+			linked = false;
+			for await (const _chunk of readPrivateCasStream(layout, ref, { signal }));
+		}
+		if (!layout.ephemeral) await syncDirectory(directory);
+		if (durable !== void 0) await offload.settlePut({
+			sha,
+			byteLength,
+			linked
+		}, signal);
+		return ref;
+	} finally {
+		await unlink(temporary).catch((error) => {
+			if (error.code !== "ENOENT") throw error;
+		});
+	}
+}
+/** Store bytes already in memory; the durable copy then reuses those bytes. */
+async function putPrivateCasBuffered(layout, offload, object, signal) {
+	const { bytes, digest, sha } = object;
+	const path = objectPath(layout, digest);
+	const directory = join(layout.store, sha.slice(0, 2));
+	await checkDirectories(directory, true);
+	const temporary = join(directory, `.${sha}.${randomUUID()}.tmp`);
+	const file = await open(temporary, CREATE_EXCLUSIVE, 384);
+	try {
+		await file.writeFile(bytes);
+		if (!layout.ephemeral) await syncHandle(file);
+	} finally {
+		await file.close();
+	}
+	let linked = true;
+	try {
+		signal?.throwIfAborted();
+		try {
+			await link(temporary, path);
+		} catch (error) {
+			if (error.code !== "EEXIST") throw error;
+			linked = false;
 		}
-		return (await mapWithConcurrency(shards.filter((name) => SHARD.test(name)), LIST_SHARDS_AT_ONCE, async (shard) => {
-			const objects = [];
-			for (const hex of await readdir(join(store, shard))) {
-				if (!HEX.test(hex) || hex.slice(0, 2) !== shard) continue;
-				const path = join(store, shard, hex);
-				try {
-					const entry = await lstat(path);
-					if (entry.isFile()) objects.push({
-						hex,
-						path,
-						size: entry.size,
-						modifiedMs: entry.mtimeMs
-					});
-				} catch (error) {
-					if (!missing(error)) throw error;
-				}
-			}
-			return objects;
-		})).flat();
-	};
-	const streamDurably = async (digest, path, byteLength, signal) => {
-		const ref = {
-			locator: {
-				kind: "private-cas",
-				namespace,
-				digest
-			},
-			sha256: digest,
-			byteLength
-		};
-		let failure;
-		for (let attempt = 1; attempt <= DURABLE_ATTEMPTS; attempt++) {
-			signal?.throwIfAborted();
-			const watch = watchAttempt(durableStallMs, signal);
-			const chunks = readObject(path, ref, watch.signal);
-			const pulled = (async function* () {
-				for await (const chunk of chunks) {
-					watch.touch();
-					yield chunk;
-				}
-			})();
+		if (!layout.ephemeral) await syncDirectory(directory);
+	} finally {
+		await unlink(temporary).catch(() => void 0);
+	}
+	const ref = privateCasRef(layout.namespace, digest, bytes.byteLength);
+	await readPrivateCasRef(layout, ref);
+	if (layout.durable !== void 0) await offload.settlePut({
+		sha,
+		byteLength: bytes.byteLength,
+		linked,
+		bytes
+	}, signal);
+	return ref;
+}
+//#endregion
+//#region src/runtime/private-cas-offload.ts
+/**
+* Durable copies of a private CAS, and the offload passes that make them: one object at a time to
+* the off-host store, with a stall bound, retries, a receipt on the host once the store holds the
+* bytes, and one copy in flight per digest. A pass copies every local object without a receipt,
+* then deletes the oldest durable local copies above the host's budget.
+*/
+const HEX = /^[0-9a-f]{64}$/u;
+const SHARD = /^[0-9a-f]{2}$/u;
+const OFFLOAD_COPIES_AT_ONCE = 16;
+const LIST_SHARDS_AT_ONCE = 16;
+async function receiptCount(layout) {
+	try {
+		return (await readdir(layout.receipts)).filter((name) => HEX.test(name)).length;
+	} catch (error) {
+		if (!isMissingPath(error)) throw error;
+		return 0;
+	}
+}
+async function listLocalObjects(layout) {
+	let shards;
+	try {
+		shards = await readdir(layout.store);
+	} catch (error) {
+		if (isMissingPath(error)) return [];
+		throw error;
+	}
+	return (await mapWithConcurrency(shards.filter((name) => SHARD.test(name)), LIST_SHARDS_AT_ONCE, async (shard) => {
+		const objects = [];
+		for (const hex of await readdir(join(layout.store, shard))) {
+			if (!HEX.test(hex) || hex.slice(0, 2) !== shard) continue;
+			const path = join(layout.store, shard, hex);
 			try {
-				await watch.run(() => durable.putStream({
-					namespace,
-					digest,
-					byteLength,
-					chunks: pulled,
-					signal: watch.signal
-				}));
-				await writeReceipt(digest, byteLength);
-				return;
+				const entry = await lstat(path);
+				if (entry.isFile()) objects.push({
+					hex,
+					path,
+					size: entry.size,
+					modifiedMs: entry.mtimeMs
+				});
 			} catch (error) {
-				failure = error;
-				if (signal?.aborted) throw error;
-				if (attempt < DURABLE_ATTEMPTS) await new Promise((settle) => setTimeout(settle, 1e3 * 4 ** (attempt - 1)));
-			} finally {
-				watch.done();
-				await chunks.return(void 0);
+				if (!isMissingPath(error)) throw error;
 			}
 		}
-		throw failure;
-	};
-	let lastPass;
-	const localIndex = /* @__PURE__ */ new Map();
-	const undurable = /* @__PURE__ */ new Set();
-	const settlePut = async (sha, byteLength, linked, upload, signal) => {
-		if (upload !== void 0 && !await hasReceipt(sha)) await copyOnce(sha, upload, signal).catch(() => void 0);
-		const durableNow = await hasReceipt(sha);
-		if (linked) localIndex.set(sha, byteLength);
-		if (durableNow) undurable.delete(sha);
-		else undurable.add(sha);
+		return objects;
+	})).flat();
+}
+/**
+* The state offload passes share, with the passes that read and write it.
+*
+* A pass after the first reads only the objects this process wrote without a receipt: a full
+* pass lists every object of the store and reads its receipt, and on canary
+* test-acceptance-canary-20261019q two of them per capture (the Lab offloads before and after)
+* took 60.1-63.2 s on each native copy, on a store whose puts had already uploaded their own
+* objects. The first pass of every process is full, so objects an earlier process left on disk
+* without a receipt are always found.
+*/
+var PrivateCasOffload = class {
+	layout;
+	lastPass;
+	localIndex = /* @__PURE__ */ new Map();
+	undurable = /* @__PURE__ */ new Set();
+	copier;
+	passes = Promise.resolve();
+	waiting;
+	constructor(layout) {
+		this.layout = layout;
+		this.copier = createDurableCopier(layout);
+	}
+	/** Make a just-written object durable, then run a pass unless the last one proves it needs none. */
+	async settlePut(put, signal) {
+		const { sha, byteLength, linked } = put;
+		const { layout } = this;
+		if (!await hasReceipt(layout, sha)) await this.copier.copyOnce(sha, put.bytes === void 0 ? {
+			path: join(layout.store, sha.slice(0, 2), sha),
+			byteLength
+		} : { bytes: put.bytes }, signal).catch(() => void 0);
+		const durableNow = await hasReceipt(layout, sha);
+		if (linked) this.localIndex.set(sha, byteLength);
+		if (durableNow) this.undurable.delete(sha);
+		else this.undurable.add(sha);
 		const added = linked ? byteLength : 0;
-		const known = lastPass;
-		if (durableNow && known !== void 0 && known.pending === 0 && (localBudgetBytes === void 0 || known.localBytes + added <= localBudgetBytes)) {
+		const known = this.lastPass;
+		if (durableNow && known !== void 0 && known.pending === 0 && (layout.localBudgetBytes === void 0 || known.localBytes + added <= layout.localBudgetBytes)) {
 			known.localBytes += added;
 			return;
 		}
-		await offload(signal);
-	};
-	const uploading = /* @__PURE__ */ new Map();
-	const waitFor = (copy, signal) => {
-		const settled = copy.catch(() => void 0);
-		return signal === void 0 ? settled : runAbortable(() => settled, signal, "private CAS wait for a copy in flight was cancelled");
-	};
-	const copyOnce = async (sha, copy, signal) => {
-		for (let inflight = uploading.get(sha); inflight !== void 0; inflight = uploading.get(sha)) {
-			await waitFor(inflight, signal);
-			if (await hasReceipt(sha)) return false;
-		}
-		const current = copy();
-		uploading.set(sha, current);
-		try {
-			await current;
-			return true;
-		} finally {
-			if (uploading.get(sha) === current) uploading.delete(sha);
+		await this.offload(signal);
+	}
+	offload(signal) {
+		let pass = this.waiting;
+		if (pass === void 0) {
+			pass = this.passes.then(() => {
+				this.waiting = void 0;
+				return this.sweep();
+			});
+			this.waiting = pass;
+			this.passes = pass.catch(() => void 0);
 		}
-	};
-	const undurableObjects = async () => {
+		const shared = pass;
+		return signal === void 0 ? shared : runAbortable(() => shared, signal, "private CAS offload wait was cancelled");
+	}
+	indexedBytes() {
+		let total = 0;
+		for (const size of this.localIndex.values()) total += size;
+		return total;
+	}
+	async undurableObjects() {
 		const objects = [];
-		for (const hex of [...undurable]) {
-			const path = join(store, hex.slice(0, 2), hex);
+		for (const hex of [...this.undurable]) {
+			const path = join(this.layout.store, hex.slice(0, 2), hex);
 			try {
 				const entry = await lstat(path);
 				if (entry.isFile()) objects.push({
@@ -4940,30 +5088,92 @@ function createPrivateCasArtifactPort(root, namespace, options = {}) {
 					modifiedMs: entry.mtimeMs
 				});
 			} catch (error) {
-				if (!missing(error)) throw error;
-				undurable.delete(hex);
+				if (!isMissingPath(error)) throw error;
+				this.undurable.delete(hex);
 			}
 		}
 		return objects;
-	};
-	const receiptCount = async () => {
-		try {
-			return (await readdir(receipts)).filter((name) => HEX.test(name)).length;
-		} catch (error) {
-			if (!missing(error)) throw error;
-			return 0;
+	}
+	async sweep() {
+		const { durable, localBudgetBytes } = this.layout;
+		const full = this.lastPass === void 0 || durable === void 0 || localBudgetBytes !== void 0 && this.indexedBytes() > localBudgetBytes;
+		const objects = full ? await listLocalObjects(this.layout) : await this.undurableObjects();
+		const outcomes = await this.copyObjects(objects);
+		const pending = [];
+		let uploaded = 0;
+		const durableHex = /* @__PURE__ */ new Set();
+		for (const outcome of outcomes) if (outcome.durable) {
+			durableHex.add(outcome.hex);
+			if (outcome.copied) uploaded++;
+		} else if (outcome.error !== void 0) pending.push({
+			digest: `sha256:${outcome.hex}`,
+			error: outcome.error
+		});
+		for (const outcome of outcomes) if (outcome.durable) this.undurable.delete(outcome.hex);
+		else if (durable !== void 0) this.undurable.add(outcome.hex);
+		if (!full) {
+			const localBytes = this.indexedBytes();
+			this.lastPass = {
+				localBytes,
+				pending: pending.length
+			};
+			return {
+				durable: await receiptCount(this.layout),
+				uploaded,
+				pending,
+				evicted: 0,
+				localObjects: this.localIndex.size,
+				localBytes
+			};
 		}
-	};
-	const sweep = async (signal) => {
-		let indexedBytes = 0;
-		for (const size of localIndex.values()) indexedBytes += size;
-		const full = lastPass === void 0 || durable === void 0 || localBudgetBytes !== void 0 && indexedBytes > localBudgetBytes;
-		const objects = full ? await localObjects() : await undurableObjects();
+		this.localIndex.clear();
+		for (const object of objects) this.localIndex.set(object.hex, object.size);
+		const total = objects.reduce((sum, object) => sum + object.size, 0);
+		const { evicted, localBytes } = await this.evictOldest(objects, durableHex, total);
+		this.lastPass = {
+			localBytes,
+			pending: pending.length
+		};
+		return {
+			durable: await receiptCount(this.layout),
+			uploaded,
+			pending,
+			evicted,
+			localObjects: objects.length - evicted,
+			localBytes
+		};
+	}
+	async evictOldest(objects, durableHex, totalBytes) {
+		const { localBudgetBytes } = this.layout;
+		let localBytes = totalBytes;
+		let evicted = 0;
+		if (localBudgetBytes === void 0) return {
+			evicted,
+			localBytes
+		};
+		for (const object of [...objects].sort((a, b) => a.modifiedMs - b.modifiedMs)) {
+			if (localBytes <= localBudgetBytes) break;
+			if (!durableHex.has(object.hex) || !await hasReceipt(this.layout, object.hex)) continue;
+			try {
+				await unlink(object.path);
+			} catch (error) {
+				if (!isMissingPath(error)) throw error;
+			}
+			localBytes -= object.size;
+			this.localIndex.delete(object.hex);
+			evicted++;
+		}
+		return {
+			evicted,
+			localBytes
+		};
+	}
+	async copyObjects(objects) {
+		const { durable } = this.layout;
 		let refusal;
-		const outcomes = await mapWithConcurrency(objects, durable === void 0 || durable.putStream && durable.getStream ? OFFLOAD_COPIES_AT_ONCE : 1, async ({ hex, path, size }) => {
-			const inflight = uploading.get(hex);
-			if (inflight !== void 0) await waitFor(inflight, signal);
-			if (await hasReceipt(hex)) return {
+		return mapWithConcurrency(objects, durable === void 0 || durable.putStream && durable.getStream ? OFFLOAD_COPIES_AT_ONCE : 1, async ({ hex, path, size }) => {
+			await this.copier.waitForCopy(hex);
+			if (await hasReceipt(this.layout, hex)) return {
 				hex,
 				durable: true,
 				copied: false
@@ -4982,14 +5192,17 @@ function createPrivateCasArtifactPort(root, namespace, options = {}) {
 				if (durable.putStream && durable.getStream) return {
 					hex,
 					durable: true,
-					copied: await copyOnce(hex, () => streamDurably(digest, path, size, signal), signal)
+					copied: await this.copier.copyOnce(hex, {
+						path,
+						byteLength: size
+					})
 				};
 				const bytes = await readLocal(path);
 				if (bytes === void 0) return {
 					hex,
 					durable: false
 				};
-				if (sha256(bytes) !== digest) return {
+				if (casSha256(bytes) !== digest) return {
 					hex,
 					durable: false,
 					error: "local object failed digest verification; it stays on the host"
@@ -4997,199 +5210,206 @@ function createPrivateCasArtifactPort(root, namespace, options = {}) {
 				return {
 					hex,
 					durable: true,
-					copied: await copyOnce(hex, () => storeDurably(digest, bytes, signal), signal)
+					copied: await this.copier.copyOnce(hex, { bytes })
 				};
 			} catch (error) {
-				if (signal?.aborted) throw error;
-				refusal ??= message(error);
+				refusal ??= errorMessage(error);
 				return {
 					hex,
 					durable: false,
-					error: message(error)
+					error: errorMessage(error)
 				};
 			}
 		});
-		const pending = [];
-		let uploaded = 0;
-		const durableHex = /* @__PURE__ */ new Set();
-		for (const outcome of outcomes) if (outcome.durable) {
-			durableHex.add(outcome.hex);
-			if (outcome.copied) uploaded++;
-		} else if (outcome.error !== void 0) pending.push({
-			digest: `sha256:${outcome.hex}`,
-			error: outcome.error
-		});
-		for (const outcome of outcomes) if (outcome.durable) undurable.delete(outcome.hex);
-		else if (durable !== void 0) undurable.add(outcome.hex);
-		if (!full) {
-			let localBytes = 0;
-			for (const size of localIndex.values()) localBytes += size;
-			lastPass = {
-				localBytes,
-				pending: pending.length
-			};
-			return {
-				durable: await receiptCount(),
-				uploaded,
-				pending,
-				evicted: 0,
-				localObjects: localIndex.size,
-				localBytes
-			};
-		}
-		localIndex.clear();
-		for (const object of objects) localIndex.set(object.hex, object.size);
-		let localBytes = objects.reduce((total, object) => total + object.size, 0);
-		let evicted = 0;
-		if (localBudgetBytes !== void 0) for (const object of [...objects].sort((a, b) => a.modifiedMs - b.modifiedMs)) {
-			if (localBytes <= localBudgetBytes) break;
-			if (!durableHex.has(object.hex) || !await hasReceipt(object.hex)) continue;
-			try {
-				await unlink(object.path);
-			} catch (error) {
-				if (!missing(error)) throw error;
-			}
-			localBytes -= object.size;
-			localIndex.delete(object.hex);
-			evicted++;
-		}
-		lastPass = {
-			localBytes,
-			pending: pending.length
-		};
-		return {
-			durable: await receiptCount(),
-			uploaded,
-			pending,
-			evicted,
-			localObjects: objects.length - evicted,
-			localBytes
-		};
-	};
-	let passes = Promise.resolve();
-	let waiting;
-	const offload = (signal) => {
-		let pass = waiting;
-		if (pass === void 0) {
-			pass = passes.then(() => {
-				waiting = void 0;
-				return sweep();
-			});
-			waiting = pass;
-			passes = pass.catch(() => void 0);
-		}
-		const shared = pass;
-		return signal === void 0 ? shared : runAbortable(() => shared, signal, "private CAS offload wait was cancelled");
-	};
-	const verified = (bytes, ref) => {
-		if (sha256(bytes) !== ref.sha256 || bytes.byteLength !== ref.byteLength) throw new Error("private CAS object failed digest or length verification");
-		return bytes;
+	}
+};
+const RECEIPT_SCHEMA = "agent-runtime.private-cas-durable-receipt.v1";
+const DURABLE_ATTEMPTS = 3;
+const BUFFERED_BYTES_PER_MS = 256;
+async function hasReceipt(layout, hex) {
+	try {
+		return (await lstat(join(layout.receipts, hex))).isFile();
+	} catch (error) {
+		if (isMissingPath(error)) return false;
+		throw error;
+	}
+}
+async function writeReceipt(layout, digest, byteLength) {
+	const { receipts } = layout;
+	await checkDirectories(receipts, true);
+	const hex = hexOf(digest);
+	const temporary = join(receipts, `.${hex}.${randomUUID()}.tmp`);
+	const file = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+	try {
+		await file.writeFile(`${JSON.stringify({
+			schema: RECEIPT_SCHEMA,
+			location: layout.durable.location,
+			namespace: layout.namespace,
+			digest,
+			byteLength,
+			storedAt: (/* @__PURE__ */ new Date()).toISOString()
+		})}\n`);
+		if (!layout.ephemeral) await syncHandle(file);
+	} finally {
+		await file.close();
+	}
+	await rename(temporary, join(receipts, hex));
+	if (!layout.ephemeral) await syncDirectory(receipts);
+}
+function watchAttempt(idleMs, signal) {
+	const stall = new AbortController();
+	let timer;
+	const touch = () => {
+		clearTimeout(timer);
+		timer = setTimeout(() => stall.abort(/* @__PURE__ */ new Error(`durable copy moved no bytes for ${idleMs} ms`)), idleMs);
+	};
+	touch();
+	const attempt = signal === void 0 ? stall.signal : AbortSignal.any([signal, stall.signal]);
+	return {
+		signal: attempt,
+		touch,
+		run: (act) => runAbortable(act, attempt, "private CAS durable copy was cancelled"),
+		done: () => clearTimeout(timer)
 	};
-	async function* readStream(ref, options = {}) {
-		const { signal } = options;
+}
+async function retryCopy(signal, attemptCopy) {
+	let failure;
+	for (let attempt = 1; attempt <= DURABLE_ATTEMPTS; attempt++) {
 		signal?.throwIfAborted();
-		if (ref.locator.kind !== "private-cas" || ref.locator.namespace !== namespace || ref.locator.digest !== ref.sha256) throw new Error("private CAS locator does not match its digest and namespace");
-		const path = destination(ref.sha256);
 		try {
-			await checkDirectories(join(store, hexOf(ref.sha256).slice(0, 2)), false);
-			yield* readObject(path, ref, signal);
+			await attemptCopy();
 			return;
 		} catch (error) {
-			if (!missing(error)) throw error;
+			failure = error;
+			if (signal?.aborted) throw error;
+			if (attempt < DURABLE_ATTEMPTS) await new Promise((settle) => setTimeout(settle, 1e3 * 4 ** (attempt - 1)));
 		}
-		if (!durable?.getStream) throw new Error(`private CAS object is not on this host; streaming durable reads are unavailable: ${ref.sha256}`);
-		const chunks = await durable.getStream({
-			namespace,
-			digest: ref.sha256,
-			signal
-		});
-		if (!chunks) throw new Error(`private CAS object is neither on this host nor in ${durable.location}: ${ref.sha256}`);
-		yield* checkedChunks(chunks, ref, signal);
 	}
-	async function* readObject(path, ref, signal) {
-		signal?.throwIfAborted();
-		const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+	throw failure;
+}
+function storeDurably(layout, digest, bytes, signal) {
+	return retryCopy(signal, async () => {
+		const watch = watchAttempt(layout.durableStallMs + Math.ceil(bytes.byteLength / BUFFERED_BYTES_PER_MS), signal);
 		try {
-			const stats = await file.stat();
-			if (!stats.isFile() || stats.size !== ref.byteLength) throw new Error("private CAS object failed digest or length verification");
-			yield* checkedChunks(file.createReadStream({
-				autoClose: false,
-				highWaterMark: 64 * 1024
-			}), ref, signal);
+			await watch.run(() => layout.durable.put({
+				namespace: layout.namespace,
+				digest,
+				bytes,
+				signal: watch.signal
+			}));
+			await writeReceipt(layout, digest, bytes.byteLength);
 		} finally {
-			await file.close();
+			watch.done();
 		}
-	}
-	async function* checkedChunks(chunks, ref, signal) {
-		const hash = createHash("sha256");
-		let byteLength = 0;
-		for await (const chunk of chunks) {
-			signal?.throwIfAborted();
-			if (!(chunk instanceof Uint8Array)) throw new Error("private CAS emitted a non-byte chunk");
-			byteLength += chunk.byteLength;
-			if (byteLength > ref.byteLength) throw new Error("private CAS object failed digest or length verification");
-			hash.update(chunk);
-			yield chunk;
-		}
-		signal?.throwIfAborted();
-		if (`sha256:${hash.digest("hex")}` !== ref.sha256 || byteLength !== ref.byteLength) throw new Error("private CAS object failed digest or length verification");
-	}
-	async function putStream(input) {
-		const { signal } = input;
-		signal?.throwIfAborted();
-		await checkDirectories(store, true);
-		const temporary = join(store, `.${randomUUID()}.tmp`);
+	});
+}
+function streamDurably(layout, digest, path, byteLength, signal) {
+	const ref = privateCasRef(layout.namespace, digest, byteLength);
+	return retryCopy(signal, async () => {
+		const watch = watchAttempt(layout.durableStallMs, signal);
+		const chunks = readObject(path, ref, watch.signal);
+		const pulled = (async function* () {
+			for await (const chunk of chunks) {
+				watch.touch();
+				yield chunk;
+			}
+		})();
 		try {
-			const file = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
-			const hash = createHash("sha256");
-			let byteLength = 0;
-			try {
-				for await (const chunk of input.chunks) {
-					signal?.throwIfAborted();
-					if (!(chunk instanceof Uint8Array)) throw new Error("private CAS received a non-byte chunk");
-					hash.update(chunk);
-					byteLength += chunk.byteLength;
-					if (!Number.isSafeInteger(byteLength)) throw new Error("private CAS object is too large");
-					await file.writeFile(chunk);
-				}
-				signal?.throwIfAborted();
-				await syncHandle(file);
-			} finally {
-				await file.close();
+			await watch.run(() => layout.durable.putStream({
+				namespace: layout.namespace,
+				digest,
+				byteLength,
+				chunks: pulled,
+				signal: watch.signal
+			}));
+			await writeReceipt(layout, digest, byteLength);
+		} finally {
+			watch.done();
+			await chunks.return(void 0);
+		}
+	});
+}
+/**
+* The one copy of each digest to the durable store in flight, from a put or a pass. A put or pass
+* that finds its digest in flight waits for that copy, then reads the receipt. Copying it again
+* doubles the upload and, for a buffered store, the archive in memory. Reporting it pending
+* failed captures: a capture refuses on any pending object, so two captures sharing one store
+* refused each other (discovery-lab provider-retention, agent-runtime 0.325.6, 2026-10-18).
+* A copy never waits for a pass, so a pass may wait for a copy.
+*/
+function createDurableCopier(layout) {
+	const uploading = /* @__PURE__ */ new Map();
+	const waitFor = (copy, signal) => {
+		const settled = copy.catch(() => void 0);
+		return signal === void 0 ? settled : runAbortable(() => settled, signal, "private CAS wait for a copy in flight was cancelled");
+	};
+	return {
+		async waitForCopy(hex, signal) {
+			const inflight = uploading.get(hex);
+			if (inflight !== void 0) await waitFor(inflight, signal);
+		},
+		async copyOnce(hex, source, signal) {
+			for (let inflight = uploading.get(hex); inflight !== void 0; inflight = uploading.get(hex)) {
+				await waitFor(inflight, signal);
+				if (await hasReceipt(layout, hex)) return false;
 			}
-			const sha = hash.digest("hex");
-			const digest = `sha256:${sha}`;
-			const ref = {
-				locator: {
-					kind: "private-cas",
-					namespace,
-					digest
-				},
-				sha256: digest,
-				byteLength
-			};
-			for await (const _chunk of readObject(temporary, ref, signal));
-			const path = destination(digest);
-			const directory = join(store, sha.slice(0, 2));
-			await checkDirectories(directory, true);
-			signal?.throwIfAborted();
-			let linked = true;
+			const digest = `sha256:${hex}`;
+			const current = "bytes" in source ? storeDurably(layout, digest, source.bytes, signal) : streamDurably(layout, digest, source.path, source.byteLength, signal);
+			uploading.set(hex, current);
 			try {
-				await link(temporary, path);
-			} catch (error) {
-				if (error.code !== "EEXIST") throw error;
-				linked = false;
-				for await (const _chunk of readStream(ref, { signal }));
+				await current;
+				return true;
+			} finally {
+				if (uploading.get(hex) === current) uploading.delete(hex);
 			}
-			await syncDirectory(directory);
-			if (durable !== void 0) await settlePut(sha, byteLength, linked, () => streamDurably(digest, path, byteLength, signal), signal);
-			return ref;
-		} finally {
-			await unlink(temporary).catch((error) => {
-				if (error.code !== "ENOENT") throw error;
-			});
 		}
-	}
+	};
+}
+//#endregion
+//#region src/runtime/private-cas.ts
+const SAFE_NAMESPACE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/u;
+const DURABLE_STALL_MS = 12e4;
+/**
+* Private content-addressed storage scoped to one recorded run identity.
+*
+* Bytes are written to the host first. With a durable store, every object is also copied off the
+* host as it is written, and `localBudgetBytes` bounds what the host keeps: an object's local copy
+* is deleted only after its durable receipt exists, and reads fall back to the durable store.
+*
+* An object's name is published only after its bytes are synced, and that order is what makes a
+* name trustworthy. A put whose digest already exists links nothing: it re-reads the existing
+* object and refuses on a mismatch, and no later put replaces that file. So a deferred-sync mode
+* that published names before one batch sync would, after a crash, leave a torn object under its
+* valid name, and every later put of that digest would fail. Any batching must keep the order:
+* write under temporary names, sync, publish the names, sync again (discovery-lab
+* runner/evidence-store.mjs commits receipts this way). On drew-gtr-pro's USB SMR disk on
+* 2026-10-21 these per-object fsyncs, 545 ms each on the 16 SYNC_THREADS, set a store's rate at
+* about 26 files/s.
+*
+* The one exception is an `ephemeral` store, which syncs nothing: its root is discarded with its
+* process, so no name in it is ever read after a crash, and nothing durable may be derived from it
+* but by a caller that copies and syncs what it keeps.
+*/
+function createPrivateCasArtifactPort(root, namespace, options = {}) {
+	if (!isAbsolute(root)) throw new Error("private CAS root must be absolute");
+	if (!SAFE_NAMESPACE.test(namespace) || namespace === "." || namespace === "..") throw new Error("private CAS namespace must be one safe identifier");
+	const { durable, localBudgetBytes, durableStallMs = DURABLE_STALL_MS, ephemeral = false } = options;
+	if (!Number.isSafeInteger(durableStallMs) || durableStallMs <= 0) throw new Error("private CAS durableStallMs must be a positive integer");
+	if (typeof ephemeral !== "boolean") throw new Error("private CAS ephemeral must be a boolean");
+	if (ephemeral && durable === void 0) throw new Error("private CAS ephemeral needs a durable store");
+	if (localBudgetBytes !== void 0 && (durable === void 0 || !Number.isSafeInteger(localBudgetBytes) || localBudgetBytes < 0)) throw new Error("private CAS localBudgetBytes needs a durable store and a non-negative integer");
+	const layout = {
+		namespace,
+		store: join(resolve(root), "sha256"),
+		receipts: join(resolve(root), "durable", "sha256"),
+		durable,
+		localBudgetBytes,
+		durableStallMs,
+		ephemeral
+	};
+	const offload = new PrivateCasOffload(layout);
+	const readStream = (ref, options) => readPrivateCasStream(layout, ref, options);
+	const putStream = (input) => putPrivateCasStream(layout, offload, input);
 	const port = {
 		...durable === void 0 || durable.putStream && durable.getStream ? {
 			putStream,
@@ -5197,97 +5417,17 @@ function createPrivateCasArtifactPort(root, namespace, options = {}) {
 		} : {},
 		async put({ bytes, signal }) {
 			signal?.throwIfAborted();
-			const digest = sha256(bytes);
-			return putBuffered(bytes, digest, hexOf(digest), signal);
-		},
-		async read(ref) {
-			return readRef(ref);
-		},
-		async locate(object, options = {}) {
-			options.signal?.throwIfAborted();
-			const digest = object.sha256;
-			const hex = hexOf(digest);
-			const ref = {
-				locator: {
-					kind: "private-cas",
-					namespace,
-					digest
-				},
-				sha256: digest,
-				byteLength: object.byteLength
-			};
-			try {
-				await checkDirectories(join(store, hex.slice(0, 2)), false);
-				const local = await lstat(destination(digest));
-				if (local.isFile()) return local.size === object.byteLength ? ref : void 0;
-			} catch (error) {
-				if (!missing(error)) throw error;
-			}
-			if (durable === void 0) return void 0;
-			const receipt = await readLocal(join(receipts, hex));
-			if (receipt === void 0) return void 0;
-			return JSON.parse(Buffer.from(receipt).toString("utf8")).byteLength === object.byteLength ? ref : void 0;
+			const digest = casSha256(bytes);
+			return putPrivateCasBuffered(layout, offload, {
+				bytes,
+				digest,
+				sha: hexOf(digest)
+			}, signal);
 		},
-		offload
+		read: (ref) => readPrivateCasRef(layout, ref),
+		locate: (object, options) => locatePrivateCasObject(layout, object, options),
+		offload: (signal) => offload.offload(signal)
 	};
-	async function putBuffered(bytes, digest, sha, signal) {
-		const path = destination(digest);
-		const directory = join(store, sha.slice(0, 2));
-		await checkDirectories(directory, true);
-		const temporary = join(directory, `.${sha}.${randomUUID()}.tmp`);
-		const file = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
-		try {
-			await file.writeFile(bytes);
-			await syncHandle(file);
-		} finally {
-			await file.close();
-		}
-		let linked = true;
-		try {
-			signal?.throwIfAborted();
-			try {
-				await link(temporary, path);
-			} catch (error) {
-				if (error.code !== "EEXIST") throw error;
-				linked = false;
-			}
-			await syncDirectory(directory);
-		} finally {
-			await unlink(temporary).catch(() => void 0);
-		}
-		const ref = {
-			locator: {
-				kind: "private-cas",
-				namespace,
-				digest
-			},
-			sha256: digest,
-			byteLength: bytes.byteLength
-		};
-		await readRef(ref);
-		if (durable !== void 0) await settlePut(sha, bytes.byteLength, linked, () => storeDurably(digest, bytes, signal), signal);
-		return ref;
-	}
-	async function readRef(ref) {
-		if (ref.locator.kind !== "private-cas" || ref.locator.namespace !== namespace || ref.locator.digest !== ref.sha256) throw new Error("private CAS locator does not match its digest and namespace");
-		const path = destination(ref.sha256);
-		const shard = join(store, hexOf(ref.sha256).slice(0, 2));
-		let local;
-		try {
-			await checkDirectories(shard, false);
-			local = await readLocal(path);
-		} catch (error) {
-			if (!missing(error)) throw error;
-		}
-		if (local !== void 0) return verified(local, ref);
-		if (durable === void 0) throw new Error(`private CAS object is not on this host: ${ref.sha256}`);
-		const stored = await durable.get({
-			namespace,
-			digest: ref.sha256
-		});
-		if (stored === void 0) throw new Error(`private CAS object is neither on this host nor in ${durable.location}: ${ref.sha256}`);
-		return verified(stored, ref);
-	}
 	if (durable === void 0) markPutStreamVerified(putStream, readStream);
 	return port;
 }
@@ -6040,30 +6180,169 @@ function hashText(value) {
 	return (hash >>> 0).toString(16).padStart(8, "0");
 }
 //#endregion
-//#region src/runtime/strategy-evolution.ts
+//#region src/runtime/strategy-evolution-cells.ts
 /**
-* runStrategyEvolution: strategy search on Eval's search kernel (`runSearch`).
-*
-* Every node is a strategy: the caller's root, or a module an author model wrote from the
-* train results of the parent the policy chose. The default policy is `beam({ width: 2 })`
-* and the default allocator `asha()`, so a strategy is screened on a few selection tasks and
-* earns more tasks only by ranking well. Each cell is one `runAgentic` run of one strategy on
-* one task, scored by the environment's own check.
-*
-* Measurement follows the kernel's splits. The author reads train results only; the policy
-* and allocator rank on the private selection split; the claim runs the root and at most 3
-* finalists together on the sealed test split, once, with a power check and a Bonferroni
-* decision. The report is a projection of the ledger, and the ledger is the only checkpoint:
-* calling again with the same inputs continues an interrupted search and returns a finished
-* one without running anything.
-*
-* @experimental
+* Cells run in this process on one dedicated lane of Runtime's search executor, which
+* records each finished attempt under its run id (a restarted search adopts it instead of
+* running it again), meters it through the search's cost ledger, and traces it.
 */
-const STRATEGY_EVOLUTION_SOURCE = {
-	uri: "npm:@tangle-network/agent-runtime#runStrategyEvolution",
-	revision: canonicalCandidateDigest$1({
-		name: "agent-runtime.strategy-evolution.2026-09",
-		node: "the root strategy by name under the caller executionRef, or an authored module content-addressed by the sha256 of its source",
+async function openStrategyCellExecutor(cfg, plan, strategyOf) {
+	const storage = fsCampaignStorage();
+	const costLedger = createRunCostLedger({
+		storage,
+		runDir: plan.searchDir
+	});
+	const lanes = [dedicatedLane({
+		name: "in-process",
+		capacity: plan.concurrency,
+		cellUsd: plan.cellUsd
+	})];
+	await reconcileInterruptedSearchCalls(costLedger, plan.searchId, lanes);
+	return searchExecutor({
+		lanes,
+		profileOf: () => cfg.worker.workerProfile,
+		costLedger,
+		identity: plan.execution,
+		storage,
+		dir: plan.searchDir,
+		...cfg.workerSlots ? { workerSlots: cfg.workerSlots } : {},
+		runAttempt: ({ work, lane, costLedger: cellLedger }) => runStrategyCell(cfg, plan, {
+			work,
+			lane,
+			costLedger: cellLedger
+		}, strategyOf)
+	});
+}
+async function runStrategyCell(cfg, plan, attempt, strategyOf) {
+	const { work, lane, costLedger: cellLedger } = attempt;
+	const { workerModel } = plan;
+	if (work.artifact.kind === "authored" && work.artifact.refusal !== null) throw new Error(`evolution: refused node ${work.nodeId} was given a cell`);
+	const strategy = await strategyOf(work.artifact);
+	const task = plan.taskById.get(work.taskId);
+	if (!task) throw new Error(`evolution: cell ${work.cellId} names unknown task ${work.taskId}`);
+	const faults = [];
+	const environment = faultRecording(cfg.environment, faults);
+	const paid = await cellLedger.runPaidCall({
+		channel: "agent",
+		phase: `search.${work.stage}`,
+		actor: `strategy:${strategy.name}`,
+		model: workerModel,
+		signal: work.signal,
+		execute: () => runAgentic({
+			...cfg.worker,
+			surface: environment,
+			task,
+			strategy,
+			budget: plan.budget,
+			...cfg.hooks ? { hooks: cfg.hooks } : {}
+		}),
+		receipt: (run) => ({
+			model: workerModel,
+			inputTokens: run.tokens.input,
+			outputTokens: run.tokens.output,
+			...run.usdKnown ? { actualCostUsd: run.usd } : { costUnknown: true },
+			...run.tokensKnown ? {} : { usageUnknown: true }
+		}),
+		receiptFromError: () => ({
+			model: workerModel,
+			inputTokens: 0,
+			outputTokens: 0,
+			costUnknown: true,
+			usageUnknown: true
+		})
+	});
+	const settled = {
+		identity: plan.execution,
+		placement: {
+			lane: lane.name,
+			boxId: null
+		},
+		accounting: unknownAccounting("replaced by the attempt receipts"),
+		...paid.succeeded ? { wallMs: paid.value.ms } : {}
+	};
+	if (faults.length > 0) return {
+		...settled,
+		...environmentFault(faults)
+	};
+	if (!paid.succeeded) return {
+		...settled,
+		outcome: {
+			status: "failed",
+			score: 0,
+			metrics: {},
+			failure: {
+				code: "strategy-threw",
+				message: shareText(paid.error)
+			}
+		}
+	};
+	const run = paid.value;
+	return {
+		...settled,
+		outcome: {
+			status: "passed",
+			score: run.score,
+			metrics: {
+				resolved: run.resolved ? 1 : 0,
+				shots: run.shots
+			}
+		}
+	};
+}
+/** The environment as one attempt sees it, recording each throw from `open`, `tools`,
+* `score` or `close`: those are the environment's faults. A `call` that throws is a tool
+* error the agent's loop handles. */
+function faultRecording(environment, faults) {
+	const recorded = (name, method) => async (...args) => {
+		try {
+			return await method(...args);
+		} catch (error) {
+			faults.push(`${name}: ${shareText(error)}`);
+			throw error;
+		}
+	};
+	return {
+		name: environment.name,
+		open: recorded("open", (task) => environment.open(task)),
+		tools: recorded("tools", (task, handle) => environment.tools(task, handle)),
+		call: (handle, name, args) => environment.call(handle, name, args),
+		score: recorded("score", (task, handle) => environment.score(task, handle)),
+		close: recorded("close", (handle) => environment.close(handle))
+	};
+}
+function environmentFault(faults) {
+	return { outcome: {
+		status: "errored",
+		metrics: {},
+		error: {
+			code: "environment-fault",
+			message: faults[0],
+			retryable: true
+		}
+	} };
+}
+function unknownAccounting(reason) {
+	return {
+		tokens: {
+			status: "unknown",
+			reason
+		},
+		cost: {
+			status: "unknown",
+			knownLowerBoundUsd: 0,
+			reason
+		}
+	};
+}
+/** Free text as the ledger stores it: redacted with the share profile and bounded. */
+function shareText(error) {
+	return redact(error instanceof Error ? error.message : String(error), { profile: "share" }).value.slice(0, 300);
+}
+const STRATEGY_EVOLUTION_SOURCE = {
+	uri: "npm:@tangle-network/agent-runtime#runStrategyEvolution",
+	revision: canonicalCandidateDigest$1({
+		name: "agent-runtime.strategy-evolution.2026-09",
+		node: "the root strategy by name under the caller executionRef, or an authored module content-addressed by the sha256 of its source",
 		edge: "a text diff from the parent module source to the child; unknown from the root, which has no source here",
 		admission: "a module is refused when the reply carries none, it breaks the author contract, or it does not load a default Strategy",
 		cell: "one runAgentic run on one task, metered as one paid call on the search cost ledger through the Runtime search executor; an environment fault during it is errored and retried, a thrown strategy is failed at score 0, anything else passed at its harness-verified score",
@@ -6071,9 +6350,8 @@ const STRATEGY_EVOLUTION_SOURCE = {
 		ship: "the claim shipped, re-derives from the ledger, cost accounting is complete, and the shipped finalist test lower bound exceeds 0"
 	})
 };
-const NO_MODULE = "the author reply carried no fenced ts module";
-/** Evolve a strategy on the search kernel and claim once on the sealed test split. */
-async function runStrategyEvolution(cfg) {
+/** Check every option and derive the search's identity; throws `ConfigError` on a bad one. */
+function planStrategyEvolution(cfg) {
 	const root = cfg.root ?? refine;
 	const budget = positiveInteger("budget", cfg.budget ?? 3);
 	const concurrency = positiveInteger("concurrency", cfg.concurrency ?? 3);
@@ -6090,36 +6368,14 @@ async function runStrategyEvolution(cfg) {
 	const claim = defineEvaluationClaim(cfg.claim);
 	if (claim.minimumEffect === void 0) throw new ConfigError("evolution: the claim needs minimumEffect for its power check");
 	const taskIds = /* @__PURE__ */ new Set();
-	const splitTasks = (label, tasks) => {
-		if (!Array.isArray(tasks) || tasks.length === 0) throw new ConfigError(`evolution: ${label} needs at least one task`);
-		for (const task of tasks) {
-			if (typeof task.id !== "string" || !task.id.trim() || taskIds.has(task.id)) throw new ConfigError(`evolution: task IDs must be non-empty and unique across splits`);
-			taskIds.add(task.id);
-		}
-		return immutableCandidateValue(tasks);
-	};
-	const train = splitTasks("train", cfg.train);
-	const selection = splitTasks("selection", cfg.selection);
-	const test = splitTasks("test", cfg.test);
-	const taskById = new Map([
-		...train,
-		...selection,
-		...test
-	].map((task) => [task.id, task]));
-	const searchTasks = (tasks) => tasks.map((task) => ({
-		taskId: task.id,
-		unitId: summarizeEvaluationUnits(claim, [task]).units[0].id,
-		source: {
-			uri: `task://${task.id}`,
-			revision: canonicalCandidateDigest$1(task)
-		}
-	}));
+	const train = splitTasks(taskIds, "train", cfg.train);
+	const selection = splitTasks(taskIds, "selection", cfg.selection);
+	const test = splitTasks(taskIds, "test", cfg.test);
 	const splits = {
-		train: searchTasks(train),
-		selection: searchTasks(selection),
-		test: searchTasks(test)
+		train: searchTasks(claim, train),
+		selection: searchTasks(claim, selection),
+		test: searchTasks(claim, test)
 	};
-	const developmentUnits = new Set([...splits.train, ...splits.selection].map((task) => task.unitId));
 	const workerProfile = cfg.worker.workerProfile;
 	const analystProfile = cfg.worker.analystProfile ?? workerProfile;
 	const workerModel = concreteModelId(workerProfile.model?.default);
@@ -6150,11 +6406,6 @@ async function runStrategyEvolution(cfg) {
 		uri: `environment:${cfg.environment.name}`,
 		revision: cfg.executionRef
 	};
-	const execution = {
-		model: searchModelIdentity(workerModel, workerProfile.model?.provider ?? "unknown"),
-		agent: workerSource,
-		benchmark: environmentSource
-	};
 	const searchId = `evolution-${canonicalCandidateDigest$1({
 		process: STRATEGY_EVOLUTION_SOURCE,
 		executionRef: cfg.executionRef,
@@ -6175,12 +6426,135 @@ async function runStrategyEvolution(cfg) {
 		seed
 	}).slice(7, 31)}`;
 	const searchDir = `${cfg.outDir}/${searchId}`;
-	const modulesDir = `${searchDir}/strategies`;
-	const ledgerPath = `${searchDir}/ledger.jsonl`;
-	mkdirSync(searchDir, { recursive: true });
-	const recorder = await SearchRecorder.open({ ledger: openSearchLedger({
-		path: ledgerPath,
-		searchId
+	return {
+		root,
+		budget,
+		concurrency,
+		maxExpansions,
+		maxAttempts,
+		seed,
+		cellUsd,
+		maxUsd,
+		policy,
+		allocation,
+		claim,
+		train,
+		taskById: new Map([
+			...train,
+			...selection,
+			...test
+		].map((task) => [task.id, task])),
+		splits,
+		developmentUnits: new Set([...splits.train, ...splits.selection].map((task) => task.unitId)),
+		workerModel,
+		authorModel,
+		authorSource,
+		environmentSource,
+		execution: {
+			model: searchModelIdentity(workerModel, workerProfile.model?.provider ?? "unknown"),
+			agent: workerSource,
+			benchmark: environmentSource
+		},
+		searchId,
+		searchDir,
+		modulesDir: `${searchDir}/strategies`,
+		ledgerPath: `${searchDir}/ledger.jsonl`
+	};
+}
+function splitTasks(taskIds, label, tasks) {
+	if (!Array.isArray(tasks) || tasks.length === 0) throw new ConfigError(`evolution: ${label} needs at least one task`);
+	for (const task of tasks) {
+		if (typeof task.id !== "string" || !task.id.trim() || taskIds.has(task.id)) throw new ConfigError(`evolution: task IDs must be non-empty and unique across splits`);
+		taskIds.add(task.id);
+	}
+	return immutableCandidateValue(tasks);
+}
+function searchTasks(claim, tasks) {
+	return tasks.map((task) => ({
+		taskId: task.id,
+		unitId: summarizeEvaluationUnits(claim, [task]).units[0].id,
+		source: {
+			uri: `task://${task.id}`,
+			revision: canonicalCandidateDigest$1(task)
+		}
+	}));
+}
+function positiveInteger(name, value) {
+	if (!Number.isSafeInteger(value) || value < 1) throw new ConfigError(`evolution: ${name} must be a positive integer`);
+	return value;
+}
+function nonNegativeInteger(name, value) {
+	if (!Number.isSafeInteger(value) || value < 0) throw new ConfigError(`evolution: ${name} must be a non-negative integer`);
+	return value;
+}
+function dollars(name, value) {
+	if (value === void 0) return null;
+	if (!Number.isFinite(value) || value < 0) throw new ConfigError(`evolution: ${name} must be a finite non-negative number`);
+	return value;
+}
+//#endregion
+//#region src/runtime/strategy-evolution.ts
+/**
+* runStrategyEvolution: strategy search on Eval's search kernel (`runSearch`).
+*
+* Every node is a strategy: the caller's root, or a module an author model wrote from the
+* train results of the parent the policy chose. The default policy is `beam({ width: 2 })`
+* and the default allocator `asha()`, so a strategy is screened on a few selection tasks and
+* earns more tasks only by ranking well. Each cell is one `runAgentic` run of one strategy on
+* one task, scored by the environment's own check.
+*
+* Measurement follows the kernel's splits. The author reads train results only; the policy
+* and allocator rank on the private selection split; the claim runs the root and at most 3
+* finalists together on the sealed test split, once, with a power check and a Bonferroni
+* decision. The report is a projection of the ledger, and the ledger is the only checkpoint:
+* calling again with the same inputs continues an interrupted search and returns a finished
+* one without running anything.
+*
+* @experimental
+*/
+const NO_MODULE = "the author reply carried no fenced ts module";
+/** Evolve a strategy on the search kernel and claim once on the sealed test split. */
+async function runStrategyEvolution(cfg) {
+	const plan = planStrategyEvolution(cfg);
+	mkdirSync(plan.searchDir, { recursive: true });
+	const recorder = await openEvolutionRecorder(cfg, plan);
+	if (!(await recorder.state()).closed) await preflightModels({
+		worker: cfg.worker,
+		modelPreflight: cfg.modelPreflight,
+		modelPreflightTimeoutMs: cfg.modelPreflightTimeoutMs
+	});
+	const rootNode = {
+		kind: "root",
+		name: plan.root.name
+	};
+	const codec = strategyNodeCodec(plan.root);
+	const executor = await openStrategyCellExecutor(cfg, plan, strategyLoader(plan.root, plan.modulesDir));
+	const proposer = strategyAuthorProposer(cfg, plan, recorder, codec);
+	const result = await runSearch({
+		recorder,
+		root: rootNode,
+		codec,
+		policy: plan.policy,
+		allocation: plan.allocation,
+		proposer,
+		executor,
+		admit: (node) => node.kind === "authored" ? node.refusal : null,
+		maxExpansions: plan.maxExpansions,
+		maxAttempts: plan.maxAttempts,
+		...cfg.signal ? { signal: cfg.signal } : {}
+	});
+	if (!result.claim || !result.claimVerification) throw new Error(`evolution: search ${plan.searchId} closed without a claim`);
+	return evolutionReport(plan, recorder, codec, {
+		...result,
+		claim: result.claim,
+		claimVerification: result.claimVerification
+	});
+}
+function openEvolutionRecorder(cfg, plan) {
+	const { splits, policy, allocation, maxUsd } = plan;
+	return SearchRecorder.open({ ledger: openSearchLedger({
+		path: plan.ledgerPath,
+		searchId: plan.searchId
 	}) }, {
 		subject: `strategy/${cfg.environment.name}`,
 		process: {
@@ -6191,269 +6565,124 @@ async function runStrategyEvolution(cfg) {
 		objective: {
 			metric: "score",
 			direction: "maximize",
-			judge: environmentSource,
-			claim
+			judge: plan.environmentSource,
+			claim: plan.claim
 		},
 		splits: {
 			...splits,
-			heldOutUnits: splits.test.every((task) => !developmentUnits.has(task.unitId))
+			heldOutUnits: splits.test.every((task) => !plan.developmentUnits.has(task.unitId))
 		},
 		policy: {
 			expansion: policy.name,
 			allocation: allocation.name,
-			seed
+			seed: plan.seed
 		},
 		budget: {
 			maxUsd,
 			maxCells: null,
-			maxNodes: 1 + maxExpansions,
+			maxNodes: 1 + plan.maxExpansions,
 			deadline: cfg.deadline === void 0 ? null : new Date(cfg.deadline).toISOString(),
-			maxConcurrency: concurrency,
+			maxConcurrency: plan.concurrency,
 			reservedClaimUsd: maxUsd === null ? 0 : searchClaimReserveUsd({
 				testTasks: splits.test.length,
 				reps: allocation.reps,
-				cellUsd
+				cellUsd: plan.cellUsd
 			})
 		},
 		containment: null,
 		derivedFrom: null,
-		identity: execution
+		identity: plan.execution
 	});
-	if (!(await recorder.state()).closed) await preflightModels({
-		worker: cfg.worker,
-		modelPreflight: cfg.modelPreflight,
-		modelPreflightTimeoutMs: cfg.modelPreflightTimeoutMs
-	});
-	const rootNode = {
-		kind: "root",
-		name: root.name
+}
+/** The author model as the search's proposer: it reads the train results and writes a module. */
+function strategyAuthorProposer(cfg, plan, recorder, codec) {
+	const { authorSource } = plan;
+	let toolCatalog;
+	const catalog = () => {
+		toolCatalog ??= listToolCatalog(cfg.environment, plan.train[0]);
+		return toolCatalog;
 	};
-	const codec = {
-		node(rec, node) {
-			const artifact = rec.blob("strategy", { ...node });
-			return {
-				artifactDigest: node.kind === "root" ? canonicalCandidateDigest$1({
-					kind: "root",
-					name: node.name
-				}) : sha256Bytes$1(Buffer.from(node.code, "utf8")),
-				artifact,
-				surfaces: [{
-					surfaceId: "strategy",
-					kind: "code",
-					artifact
-				}]
-			};
-		},
-		diff(rec, parent, child) {
-			if (parent.kind === "root" || child.kind === "root") return { unknown: "the root is a caller-supplied strategy with no source here" };
-			return surfaceDiff(rec, parent.code, child.code);
+	const authorProvider = cfg.author.profile.model?.provider ?? "unknown";
+	return {
+		name: "strategy-author",
+		kind: "frontier-author",
+		source: authorSource,
+		execution: {
+			kind: "model",
+			model: searchModelIdentity(plan.authorModel, authorProvider),
+			source: authorSource
 		},
-		load(rec, node) {
-			const stored = rec.readBlob(node.artifact);
-			if (stored.kind === "root") {
-				if (stored.name !== root.name) throw new Error(`evolution: node ${node.nodeId} is root '${stored.name}', not '${root.name}'`);
-				return rootNode;
-			}
-			if (stored.kind === "authored" && typeof stored.code === "string") return stored;
-			throw new Error(`evolution: node ${node.nodeId} holds no strategy`);
-		}
-	};
-	const loaded = /* @__PURE__ */ new Map();
-	const strategyOf = (node) => {
-		if (node.kind === "root") return Promise.resolve(root);
-		let strategy = loaded.get(node.code);
-		if (!strategy) {
-			strategy = loadAuthoredStrategy(node.code, modulesDir).then((module) => module.strategy);
-			loaded.set(node.code, strategy);
-		}
-		return strategy;
-	};
-	const storage = fsCampaignStorage();
-	const costLedger = createRunCostLedger({
-		storage,
-		runDir: searchDir
-	});
-	const lanes = [dedicatedLane({
-		name: "in-process",
-		capacity: concurrency,
-		cellUsd
-	})];
-	await reconcileInterruptedSearchCalls(costLedger, searchId, lanes);
-	const executor = searchExecutor({
-		lanes,
-		profileOf: () => workerProfile,
-		costLedger,
-		identity: execution,
-		storage,
-		dir: searchDir,
-		...cfg.workerSlots ? { workerSlots: cfg.workerSlots } : {},
-		async runAttempt({ work, lane, costLedger: cellLedger }) {
-			if (work.artifact.kind === "authored" && work.artifact.refusal !== null) throw new Error(`evolution: refused node ${work.nodeId} was given a cell`);
-			const strategy = await strategyOf(work.artifact);
-			const task = taskById.get(work.taskId);
-			if (!task) throw new Error(`evolution: cell ${work.cellId} names unknown task ${work.taskId}`);
-			const faults = [];
-			const environment = faultRecording(cfg.environment, faults);
-			const paid = await cellLedger.runPaidCall({
-				channel: "agent",
-				phase: `search.${work.stage}`,
-				actor: `strategy:${strategy.name}`,
-				model: workerModel,
-				signal: work.signal,
-				execute: () => runAgentic({
-					...cfg.worker,
-					surface: environment,
-					task,
-					strategy,
-					budget,
-					...cfg.hooks ? { hooks: cfg.hooks } : {}
-				}),
-				receipt: (run) => ({
-					model: workerModel,
-					inputTokens: run.tokens.input,
-					outputTokens: run.tokens.output,
-					...run.usdKnown ? { actualCostUsd: run.usd } : { costUnknown: true },
-					...run.tokensKnown ? {} : { usageUnknown: true }
-				}),
-				receiptFromError: () => ({
-					model: workerModel,
-					inputTokens: 0,
-					outputTokens: 0,
-					costUnknown: true,
-					usageUnknown: true
-				})
+		childrenPerProposal: 1,
+		async propose(request) {
+			const state = await recorder.state();
+			const names = strategyNames(state, recorder, codec);
+			const losses = JSON.stringify(strategyTournament(state, "train", names).rows.map((row) => ({
+				task: row.taskId,
+				...row.rep > 0 ? { rep: row.rep } : {},
+				cells: row.cells
+			}))).slice(0, 12e3);
+			const summary = renderSearchSummary(state, { split: "train" });
+			const parent = request.parents[0];
+			const parentName = names.get(parent.nodeId) ?? parent.nodeId;
+			const tried = [...names.values()].join(", ");
+			const parentSource = parent.artifact.kind === "authored" ? `\n\nPARENT STRATEGY "${parentName}" (improve on it):\n${parent.artifact.code}` : `\n\nPARENT STRATEGY "${parentName}" is the built-in baseline; improve on it.`;
+			const contract = `${strategyAuthorContract}\n\nEXAMPLE TOOLS FROM ONE TASK (tool sets VARY per task on this domain — a strategy MUST select tool names from await listTools(handle) at runtime; hardcoding these example names will zero your score on most tasks):\n${await catalog()}\n\nTHE SEARCH SO FAR (train split):\n${summary}\n\nSTRATEGIES ALREADY TRIED (author something MEANINGFULLY different — a new composition, not a rename): ${tried}${parentSource}`;
+			const source = await requestStrategySource({
+				profile: cfg.author.profile,
+				executor: cfg.author.executor,
+				...cfg.author.fallbackProfile ? { fallbackProfile: cfg.author.fallbackProfile } : {},
+				contract,
+				environmentName: cfg.environment.name,
+				lossesJson: losses,
+				budget: plan.budget,
+				outDir: plan.modulesDir,
+				signal: request.signal
 			});
-			const settled = {
-				identity: execution,
-				placement: {
-					lane: lane.name,
-					boxId: null
-				},
-				accounting: unknownAccounting("replaced by the attempt receipts"),
-				...paid.succeeded ? { wallMs: paid.value.ms } : {}
-			};
-			if (faults.length > 0) return {
-				...settled,
-				...environmentFault(faults)
-			};
-			if (!paid.succeeded) return {
-				...settled,
-				outcome: {
-					status: "failed",
-					score: 0,
-					metrics: {},
-					failure: {
-						code: "strategy-threw",
-						message: shareText(paid.error)
-					}
-				}
-			};
-			const run = paid.value;
+			const child = await authoredNode(source.code, plan.modulesDir);
+			const answered = source.turns.at(-1);
 			return {
-				...settled,
-				outcome: {
-					status: "passed",
-					score: run.score,
-					metrics: {
-						resolved: run.resolved ? 1 : 0,
-						shots: run.shots
-					}
-				}
+				children: [{
+					artifact: child,
+					label: child.name ?? "refused module",
+					rationale: `authored from the train results of ${parentName} and ${names.size - 1} other strategies`
+				}],
+				accounting: authorAccounting(source.turns),
+				...answered ? { execution: {
+					kind: "model",
+					model: searchModelIdentity(answered.model, authorProvider),
+					source: authorSource
+				} } : {}
 			};
 		}
-	});
-	let toolCatalog;
-	const catalog = () => {
-		toolCatalog ??= listToolCatalog(cfg.environment, train[0]);
-		return toolCatalog;
 	};
-	const authorProvider = cfg.author.profile.model?.provider ?? "unknown";
-	const result = await runSearch({
-		recorder,
-		root: rootNode,
-		codec,
-		policy,
-		allocation,
-		proposer: {
-			name: "strategy-author",
-			kind: "frontier-author",
-			source: authorSource,
-			execution: {
-				kind: "model",
-				model: searchModelIdentity(authorModel, authorProvider),
-				source: authorSource
-			},
-			childrenPerProposal: 1,
-			async propose(request) {
-				const state = await recorder.state();
-				const names = strategyNames(state, recorder, codec);
-				const losses = JSON.stringify(strategyTournament(state, "train", names).rows.map((row) => ({
-					task: row.taskId,
-					...row.rep > 0 ? { rep: row.rep } : {},
-					cells: row.cells
-				}))).slice(0, 12e3);
-				const summary = renderSearchSummary(state, { split: "train" });
-				const parent = request.parents[0];
-				const parentName = names.get(parent.nodeId) ?? parent.nodeId;
-				const tried = [...names.values()].join(", ");
-				const parentSource = parent.artifact.kind === "authored" ? `\n\nPARENT STRATEGY "${parentName}" (improve on it):\n${parent.artifact.code}` : `\n\nPARENT STRATEGY "${parentName}" is the built-in baseline; improve on it.`;
-				const contract = `${strategyAuthorContract}\n\nEXAMPLE TOOLS FROM ONE TASK (tool sets VARY per task on this domain — a strategy MUST select tool names from await listTools(handle) at runtime; hardcoding these example names will zero your score on most tasks):\n${await catalog()}\n\nTHE SEARCH SO FAR (train split):\n${summary}\n\nSTRATEGIES ALREADY TRIED (author something MEANINGFULLY different — a new composition, not a rename): ${tried}${parentSource}`;
-				const source = await requestStrategySource({
-					profile: cfg.author.profile,
-					executor: cfg.author.executor,
-					...cfg.author.fallbackProfile ? { fallbackProfile: cfg.author.fallbackProfile } : {},
-					contract,
-					environmentName: cfg.environment.name,
-					lossesJson: losses,
-					budget,
-					outDir: modulesDir,
-					signal: request.signal
-				});
-				let child = {
-					kind: "authored",
-					name: null,
-					code: "",
-					refusal: NO_MODULE
-				};
-				if (source.code !== null) try {
-					const { strategy } = await loadAuthoredStrategy(source.code, modulesDir);
-					child = {
-						kind: "authored",
-						name: strategy.name,
-						code: source.code,
-						refusal: null
-					};
-				} catch (error) {
-					child = {
-						kind: "authored",
-						name: null,
-						code: source.code,
-						refusal: shareText(error)
-					};
-				}
-				const answered = source.turns.at(-1);
-				return {
-					children: [{
-						artifact: child,
-						label: child.name ?? "refused module",
-						rationale: `authored from the train results of ${parentName} and ${names.size - 1} other strategies`
-					}],
-					accounting: authorAccounting(source.turns),
-					...answered ? { execution: {
-						kind: "model",
-						model: searchModelIdentity(answered.model, authorProvider),
-						source: authorSource
-					} } : {}
-				};
-			}
-		},
-		executor,
-		admit: (node) => node.kind === "authored" ? node.refusal : null,
-		maxExpansions,
-		maxAttempts,
-		...cfg.signal ? { signal: cfg.signal } : {}
-	});
-	if (!result.claim || !result.claimVerification) throw new Error(`evolution: search ${searchId} closed without a claim`);
+}
+/** The node an author reply makes: admitted when the module loads, else carrying the refusal. */
+async function authoredNode(code, modulesDir) {
+	if (code === null) return {
+		kind: "authored",
+		name: null,
+		code: "",
+		refusal: NO_MODULE
+	};
+	try {
+		const { strategy } = await loadAuthoredStrategy(code, modulesDir);
+		return {
+			kind: "authored",
+			name: strategy.name,
+			code,
+			refusal: null
+		};
+	} catch (error) {
+		return {
+			kind: "authored",
+			name: null,
+			code,
+			refusal: shareText(error)
+		};
+	}
+}
+/** The report: a projection of the ledger the finished search leaves. */
+function evolutionReport(plan, recorder, codec, result) {
 	const { state } = result;
 	const names = strategyNames(state, recorder, codec);
 	const rootId = state.rootNodeId;
@@ -6487,8 +6716,8 @@ async function runStrategyEvolution(cfg) {
 		minimumLift: 0
 	});
 	return {
-		searchId,
-		ledger: ledgerPath,
+		searchId: plan.searchId,
+		ledger: plan.ledgerPath,
 		closeReason: result.reason,
 		strategies,
 		selected: strategies.find((strategy) => strategy.nodeId === result.leader),
@@ -6565,50 +6794,6 @@ function strategyTournament(state, split, names) {
 		perStrategy
 	};
 }
-/** Report names: each node's strategy name, suffixed `~<ordinal>` when an earlier node has it. */
-function strategyNames(state, recorder, codec) {
-	const names = /* @__PURE__ */ new Map();
-	const taken = /* @__PURE__ */ new Set();
-	for (const node of state.nodes()) {
-		const base = codec.load(recorder, node).name ?? "refused-module";
-		const name = taken.has(base) ? `${base}~${node.ordinal}` : base;
-		taken.add(name);
-		names.set(node.nodeId, name);
-	}
-	return names;
-}
-/** The environment as one attempt sees it, recording each throw from `open`, `tools`,
-* `score` or `close`: those are the environment's faults. A `call` that throws is a tool
-* error the agent's loop handles. */
-function faultRecording(environment, faults) {
-	const recorded = (name, method) => async (...args) => {
-		try {
-			return await method(...args);
-		} catch (error) {
-			faults.push(`${name}: ${shareText(error)}`);
-			throw error;
-		}
-	};
-	return {
-		name: environment.name,
-		open: recorded("open", (task) => environment.open(task)),
-		tools: recorded("tools", (task, handle) => environment.tools(task, handle)),
-		call: (handle, name, args) => environment.call(handle, name, args),
-		score: recorded("score", (task, handle) => environment.score(task, handle)),
-		close: recorded("close", (handle) => environment.close(handle))
-	};
-}
-function environmentFault(faults) {
-	return { outcome: {
-		status: "errored",
-		metrics: {},
-		error: {
-			code: "environment-fault",
-			message: faults[0],
-			retryable: true
-		}
-	} };
-}
 function authorAccounting(turns) {
 	let usd = 0;
 	let costKnown = true;
@@ -6635,19 +6820,6 @@ function authorAccounting(turns) {
 		}
 	};
 }
-function unknownAccounting(reason) {
-	return {
-		tokens: {
-			status: "unknown",
-			reason
-		},
-		cost: {
-			status: "unknown",
-			knownLowerBoundUsd: 0,
-			reason
-		}
-	};
-}
 /** One probe round-trip lists the domain's tools so the author can focus shots, names and
 * descriptions only, never the implementations. */
 async function listToolCatalog(environment, task) {
@@ -6658,25 +6830,70 @@ async function listToolCatalog(environment, task) {
 		await environment.close(handle);
 	}
 }
-/** Free text as the ledger stores it: redacted with the share profile and bounded. */
-function shareText(error) {
-	return redact(error instanceof Error ? error.message : String(error), { profile: "share" }).value.slice(0, 300);
-}
 function compare(left, right) {
 	return left < right ? -1 : left > right ? 1 : 0;
 }
-function positiveInteger(name, value) {
-	if (!Number.isSafeInteger(value) || value < 1) throw new ConfigError(`evolution: ${name} must be a positive integer`);
-	return value;
+/** How the ledger stores a node's artifact and reads it back. */
+function strategyNodeCodec(root) {
+	const rootNode = {
+		kind: "root",
+		name: root.name
+	};
+	return {
+		node(rec, node) {
+			const artifact = rec.blob("strategy", { ...node });
+			return {
+				artifactDigest: node.kind === "root" ? canonicalCandidateDigest$1({
+					kind: "root",
+					name: node.name
+				}) : sha256Bytes$1(Buffer.from(node.code, "utf8")),
+				artifact,
+				surfaces: [{
+					surfaceId: "strategy",
+					kind: "code",
+					artifact
+				}]
+			};
+		},
+		diff(rec, parent, child) {
+			if (parent.kind === "root" || child.kind === "root") return { unknown: "the root is a caller-supplied strategy with no source here" };
+			return surfaceDiff(rec, parent.code, child.code);
+		},
+		load(rec, node) {
+			const stored = rec.readBlob(node.artifact);
+			if (stored.kind === "root") {
+				if (stored.name !== root.name) throw new Error(`evolution: node ${node.nodeId} is root '${stored.name}', not '${root.name}'`);
+				return rootNode;
+			}
+			if (stored.kind === "authored" && typeof stored.code === "string") return stored;
+			throw new Error(`evolution: node ${node.nodeId} holds no strategy`);
+		}
+	};
 }
-function nonNegativeInteger(name, value) {
-	if (!Number.isSafeInteger(value) || value < 0) throw new ConfigError(`evolution: ${name} must be a non-negative integer`);
-	return value;
+/** Resolve a node to its runnable strategy; an authored module loads once per source. */
+function strategyLoader(root, modulesDir) {
+	const loaded = /* @__PURE__ */ new Map();
+	return (node) => {
+		if (node.kind === "root") return Promise.resolve(root);
+		let strategy = loaded.get(node.code);
+		if (!strategy) {
+			strategy = loadAuthoredStrategy(node.code, modulesDir).then((module) => module.strategy);
+			loaded.set(node.code, strategy);
+		}
+		return strategy;
+	};
 }
-function dollars(name, value) {
-	if (value === void 0) return null;
-	if (!Number.isFinite(value) || value < 0) throw new ConfigError(`evolution: ${name} must be a finite non-negative number`);
-	return value;
+/** Report names: each node's strategy name, suffixed `~<ordinal>` when an earlier node has it. */
+function strategyNames(state, recorder, codec) {
+	const names = /* @__PURE__ */ new Map();
+	const taken = /* @__PURE__ */ new Set();
+	for (const node of state.nodes()) {
+		const base = codec.load(recorder, node).name ?? "refused-module";
+		const name = taken.has(base) ? `${base}~${node.ordinal}` : base;
+		taken.add(name);
+		names.set(node.nodeId, name);
+	}
+	return names;
 }
 //#endregion
 //#region src/runtime/supervise/chat-transport-executor.ts
@@ -7445,7 +7662,7 @@ function compileSearchSpec(raw, inputs) {
 		})
 	});
 	const continuation = {
-		deadline: inputs.deadline,
+		...inputs.deadline === void 0 ? {} : { deadline: inputs.deadline },
 		maxBarren: spec.stop.maxBarren,
 		profile: inputs.continuation.profile,
 		failures: spec.evaluate.feedback,
@@ -8980,4 +9197,4 @@ function tail(s) {
 //#endregion
 export { runPersonified as $, openSqlRunStore as $t, searchSpecDigest as A, secretEnvOfMcpServer as At, chatWorkerSeam as B, readDeclaredCheck as Bt, withUntrackedArtifacts as C, materializeLocalMcp as Ct, assertSearchSpec as D, mcpSecretEnvMetadataKey as Dt, SEARCH_SPEC_CORRELATION_KEY as E, envKeyProvider as Et, profileRegistry as F, assertDeclaredCheck as Ft, openSandboxRun as G, stopSentinel as Gt, runStrategyEvolution as H, completionAuthorizes as Ht, profileRunsForName as I, checkProgramDigest as It, runBenchmark as J, renderLeaderboardHtml as Jt, createS3PrivateCasStore as K, leaderboard as Kt, recordProfileRun as L, declaredCheckDeliverable as Lt, bestProfileFor as M, loopCampaignDispatch as Mt, loadProfile as N, loopDispatch as Nt, compileSearchSpec as O, resolveMcpServerLaunch as Ot, pickBestProfile as P, superviseDispatch as Pt, definePersona as Q, SqlRunOwnershipError as Qt, graphDesignerExtraTools as R, declaredCheckDigest as Rt, copyUntrackedIntoClone as S, connectStdioMcp as St, createFencedSqlRunContext as T, sanitizeMcpToolSchema as Tt, strategyTournament as U, deterministicCompletion as Ut, createChatSessionStore as V, runIsolatedCheck as Vt, SandboxRunAbortError as W, sentinelCompletion as Wt, equalKOnCost as X, renderLeaderboardSvg as Xt, createPrivateCasArtifactPort as Y, renderLeaderboardMarkdown as Yt, trajectoryReport as Z, renderPairwiseMarkdown as Zt, NOTE_MAX_CHARS as _, HarvestError as _t, localShell as a, loopUntil as at, composeWorkerEvidence as b, resolveSandboxClient as bt, createVerifierEnvironment as c, selectValidWinner as ct, harvestSurfaceDiffs as d, assertTraceDerivedFindings as dt, FileCorpus as et, analystsFromRegistry as f, buildSteerContext as ft, EVIDENCE_MAX_CHARS as g, inProcessSandboxClient as gt, runCoderChecks as h, observationFromRegistry as ht, jjWorkspace as i, flatWidenGate as it, connectRemoteSupervisor as j, inlineSandboxClient as jt, searchPresets as k, resolveSecretEnv as kt, boxSurfaceReader as l, verify as lt, worktreeFanout as m, registryScopeAnalyst as mt, makeFinding$1 as n, renderCorpusToInstructions as nt, runInWorkspace as o, panel as ot, failuresAnalyst as p, createScopeAnalyst as pt, printBenchmarkReport as q, pairwiseSignificance as qt, gitWorkspace as r, fanout as rt, createWaterfallCollector as s, pipeline as st, computeFindingId$1 as t, InMemoryCorpus as tt, fsSurfaceReader as u, widen as ut, VERIFY_TAIL_CHARS as v, harvestCorpus as vt, analyzeTrace as w, createMcpEnvironment as wt, settledWorkerOut as x, McpSpawnFault as xt, closingWorkerNote as y, defineLeaderboard as yt, chatTransportExecutor as z, declaredCheckJudge as zt };
 
-//# sourceMappingURL=runtime-B2fjL9Oi.js.map
+//# sourceMappingURL=runtime-eghmj6W4.js.map