@tangle-network/agent-runtime 0.340.0 → 0.342.1

package/dist/{prepare-FzJoS68l.js → prepare-C-cWCyt3.js}

@@ -1,5 +1,5 @@
-import { A as verifyWorkspaceSnapshotArtifacts, B as sha256Bytes$1, D as verifyBytes, E as readVerifiedArtifact, F as canonicalCandidateDocument, H as hasControlCharacter, I as deepFreezeCandidate, L as embeddedCandidateArtifact, N as canonicalCandidateBytes$1, O as verifyMaterializedProfileWorkspace, P as canonicalCandidateDigest$1, R as immutableCandidateValue, S as artifactCacheKey, T as readMaterializedWorkspaceFiles, X as errorMessage, b as isWellFormedUnicode, d as readCandidateGitHubResource, f as verifyCandidateCode, k as verifyMaterializedWorkspace, m as verifyTaskOutcomePatch, p as verifyTaskCheckout, v as persistCandidateOutputArtifact, y as assertExactObjectKeys, z as omitTopLevelDigest } from "./sandbox-profile-compat-DRr3JwDx.js";
-import { _ as parseAgentCandidateProfileActivation, c as buildLaunch, f as exactProfileExecutorFiles, h as modelRoutes, l as candidateEntrypointReceipt, m as materializeAgentCandidateProfilePlan, n as PI_CANDIDATE_SESSION_DIR_ENV, r as absoluteExecutionCwd, s as assertCandidateProfileExecutionSupport, t as PI_CANDIDATE_AGENT_DIR_ENV, u as candidateProfileAgentPaths, x as requirePublicCandidateConfigValue } from "./profile-DToH0XEs.js";
+import { A as verifyMaterializedProfileWorkspace, B as sha256Bytes$1, D as readMaterializedWorkspaceFiles, F as canonicalCandidateDocument, H as hasControlCharacter, I as deepFreezeCandidate, L as embeddedCandidateArtifact, M as verifyWorkspaceSnapshotArtifacts, N as canonicalCandidateBytes$1, O as readVerifiedArtifact, P as canonicalCandidateDigest$1, R as immutableCandidateValue, S as isWellFormedUnicode, X as errorMessage, b as persistCandidateOutputArtifact, d as readCandidateGitHubResource, f as verifyCandidateCode, j as verifyMaterializedWorkspace, k as verifyBytes, m as verifyTaskOutcomePatch, p as verifyTaskCheckout, w as artifactCacheKey, x as assertExactObjectKeys, z as omitTopLevelDigest } from "./sandbox-profile-compat-FN2kab2-.js";
+import { _ as parseAgentCandidateProfileActivation, c as buildLaunch, f as exactProfileExecutorFiles, h as modelRoutes, l as candidateEntrypointReceipt, m as materializeAgentCandidateProfilePlan, n as PI_CANDIDATE_SESSION_DIR_ENV, r as absoluteExecutionCwd, s as assertCandidateProfileExecutionSupport, t as PI_CANDIDATE_AGENT_DIR_ENV, u as candidateProfileAgentPaths, x as requirePublicCandidateConfigValue } from "./profile-CbMw5hAn.js";
 import { i as redactProtectedValue, n as createProtectedRecordRedactor, r as redactProtectedReason, t as assertNoProtectedBytes } from "./protected-redaction-DFCeo4vg.js";
 import { agentCandidateArtifactRefSchema, agentCandidateBenchmarkResultEvidenceSchema, agentCandidateBenchmarkSuiteSchema, agentCandidateBenchmarkTaskSchema, agentCandidateBundleSchema, agentCandidateContainerSchema, agentCandidateExecutionLimitsSchema, agentCandidateExecutionPlanEvidenceSchema, agentCandidateExecutionPlanMaterialSchema, agentCandidateMaterializationReceiptSchema, agentCandidateModelAccessNetworkSchema, agentCandidateModelSettlementEvidenceSchema, agentCandidateProfilePlanEvidenceSchema, agentCandidateResolvedModelSchema, agentCandidateRunCellSchema, agentCandidateRunReceiptSchema, agentCandidateTaskOutcomeEvidenceSchema, agentCandidateTaskOutcomeSpecSchema, agentCandidateTerminationSchema, agentCandidateWorkspaceManifestMaterialSchema, agentCandidateWorkspaceSnapshotEvidenceSchema, sha256DigestSchema } from "@tangle-network/agent-interface";
 import { REDACTION_VERSION, isLlmSpan } from "@tangle-network/agent-eval";
@@ -2334,89 +2334,6 @@ function retryLineageDigest(prepared, resultTimeoutMs) {
 	});
 }
 //#endregion
-//#region src/candidate-execution/executor-capture.ts
-const sealedFinalCaptureBrand = Symbol("sealedAgentCandidateExecutorFinalCapture");
-/** Validate and detach the only candidate-authored fields accepted from execution. */
-function sealAgentCandidateProtectedRunCapture(value) {
-	const capture = requireRecord(value, "candidate execution capture");
-	assertExactObjectKeys(capture, ["executionId", "termination"], "candidate execution capture");
-	if (typeof capture.executionId !== "string" || capture.executionId.length === 0) throw new Error("candidate execution capture has an invalid executionId");
-	return Object.freeze({
-		executionId: capture.executionId,
-		termination: Object.freeze(agentCandidateTerminationSchema.parse(capture.termination))
-	});
-}
-/** Validate, detach, and freeze evaluator-owned evidence captured after process death. */
-function sealAgentCandidateExecutorFinalCapture(value, expectedOutcome) {
-	const capture = requireRecord(value, "candidate final capture");
-	assertExactObjectKeys(capture, [], "candidate final capture", [
-		"taskOutcome",
-		"memoryAfter",
-		"evidence"
-	]);
-	const taskOutcome = capture.taskOutcome ? sealTaskOutcomeCapture(capture.taskOutcome, expectedOutcome) : void 0;
-	const memoryAfter = capture.memoryAfter ? sealMemoryCapture(capture.memoryAfter) : void 0;
-	if (capture.evidence !== void 0 && !(capture.evidence instanceof Uint8Array)) throw new Error("candidate executor evidence must be a byte array");
-	const evidence = capture.evidence ? Uint8Array.from(capture.evidence) : void 0;
-	return Object.freeze({
-		...taskOutcome ? { taskOutcome } : {},
-		...memoryAfter ? { memoryAfter: Object.freeze(memoryAfter) } : {},
-		...evidence ? { evidence } : {},
-		[sealedFinalCaptureBrand]: true
-	});
-}
-/** Prove exact process death before any final evidence capture. */
-function sealAgentCandidateExecutorStopAcknowledgement(value) {
-	const capture = requireRecord(value, "candidate stop acknowledgement");
-	assertExactObjectKeys(capture, ["stopped"], "candidate stop acknowledgement");
-	if (capture.stopped !== true) throw new Error("candidate stop acknowledgement does not prove process death");
-}
-function sealMemoryCapture(value) {
-	const capture = requireRecord(value, "candidate memory capture");
-	assertExactObjectKeys(capture, ["afterState", "archive"], "candidate memory capture");
-	if (!(capture.archive instanceof Uint8Array)) throw new Error("candidate memory capture archive must be a byte array");
-	return Object.freeze({
-		afterState: Object.freeze(agentCandidateWorkspaceManifestMaterialSchema.parse(capture.afterState)),
-		archive: Uint8Array.from(capture.archive)
-	});
-}
-function sealTaskOutcomeCapture(value, expected) {
-	const capture = requireRecord(value, "candidate task capture");
-	if (capture.kind === "output") {
-		assertExactObjectKeys(capture, ["kind", "bytes"], "candidate task output capture");
-		if (expected.kind !== "output") throw new Error("candidate task output capture does not match the signed outcome kind");
-		if (!(capture.bytes instanceof Uint8Array)) throw new Error("candidate task output capture must contain a byte array");
-		if (capture.bytes.byteLength > expected.maxBytes) throw new Error(`candidate task output exceeds the frozen ${expected.maxBytes}-byte maximum`);
-		return Object.freeze({
-			kind: "output",
-			bytes: Uint8Array.from(capture.bytes)
-		});
-	}
-	assertExactObjectKeys(capture, [
-		"kind",
-		"resultTree",
-		"afterState",
-		"archive",
-		"gitDiff"
-	], "candidate task capture");
-	if (capture.kind !== "workspace") throw new Error("candidate task capture has an invalid outcome kind");
-	if (expected.kind !== "workspace") throw new Error("candidate workspace capture does not match the signed outcome kind");
-	if (typeof capture.resultTree !== "string" || !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(capture.resultTree)) throw new Error("candidate task capture resultTree is not a Git object id");
-	if (!(capture.archive instanceof Uint8Array) || !(capture.gitDiff instanceof Uint8Array)) throw new Error("candidate task capture archive and gitDiff must be byte arrays");
-	const afterState = agentCandidateWorkspaceManifestMaterialSchema.parse(capture.afterState);
-	return Object.freeze({
-		kind: "workspace",
-		resultTree: capture.resultTree,
-		afterState: Object.freeze(afterState),
-		archive: Uint8Array.from(capture.archive),
-		gitDiff: Uint8Array.from(capture.gitDiff)
-	});
-}
-function requireRecord(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-//#endregion
 //#region src/candidate-execution/finalize.ts
 /** Builds a candidate run receipt exclusively from protected trace and memory evidence. */
 async function finalizeAgentCandidateRun(state, capture, traceStore, traceIdentity, settlement, evidence, protectedValues, writeRedactionReport, signal) {
@@ -3117,230 +3034,187 @@ async function persistFailureEvidence(state, reason, failureClass, termination,
 	});
 }
 //#endregion
-//#region src/candidate-execution/protected-trace-store.ts
-/** Keep the identity key in evaluator-owned closures and expose only the redacting store to code. */
-function createProtectedAgentCandidateTraceAccess(inner, protectedValues) {
-	const redactor = createProtectedRecordRedactor(protectedValues);
-	const pendingWrites = /* @__PURE__ */ new Set();
-	let acceptsWrites = true;
-	const write = (operation) => {
-		if (!acceptsWrites) return Promise.reject(/* @__PURE__ */ new Error("candidate trace writes are closed"));
-		let started;
-		try {
-			started = operation();
-		} catch (error) {
-			return Promise.reject(error);
-		}
-		let tracked;
-		tracked = started.finally(() => pendingWrites.delete(tracked));
-		pendingWrites.add(tracked);
-		return tracked;
-	};
-	const store = Object.freeze({
-		appendRun: (run) => write(() => inner.appendRun(redactor.record(run))),
-		updateRun: (runId, patch) => write(() => inner.updateRun(redactor.identifier(runId), redactor.record(patch))),
-		appendSpan: (span) => write(async () => {
-			if (span.kind === "llm") throw new Error("candidate executors cannot author protected model spans");
-			await inner.appendSpan(redactor.record(span));
-		}),
-		updateSpan: (spanId, patch) => write(async () => {
-			if (patch.kind === "llm") throw new Error("candidate executors cannot author protected model spans");
-			await inner.updateSpan(redactor.identifier(spanId), redactor.record(patch));
-		}),
-		appendEvent: (event) => write(() => inner.appendEvent(redactor.record(event))),
-		appendArtifact: (artifact) => write(() => inner.appendArtifact(redactor.record(artifact))),
-		appendBudgetEntry: (entry) => write(() => inner.appendBudgetEntry(redactor.record(entry))),
-		getRun: async (runId) => inner.getRun(redactor.identifier(runId)),
-		listRuns: async (filter) => inner.listRuns(filter ? redactor.query(filter) : void 0),
-		spans: async (filter) => inner.spans(filter ? redactor.query(filter) : void 0),
-		events: async (filter) => inner.events(filter ? redactor.query(filter) : void 0),
-		budget: async (runId) => inner.budget(redactor.identifier(runId)),
-		artifacts: async (runId) => inner.artifacts(redactor.identifier(runId))
-	});
-	return Object.freeze({
-		store,
-		closeWrites: async () => {
-			acceptsWrites = false;
-			await Promise.all([...pendingWrites]);
-		},
-		identity: (trace) => redactor.traceIdentity(trace),
-		report: () => redactor.report()
-	});
+//#region src/candidate-execution/execute-cleanup.ts
+/**
+* Failure and cleanup paths of an execution: closing isolated memory, settling the model grant,
+* recording a failed attempt's terminal result, and reporting why a run failed.
+*/
+async function failBeforeActivation(run, error, reason) {
+	const { prepared, state } = run;
+	beginPreparedCandidateSettlement(prepared);
+	const cleanupDeadlineAtMs = candidateCleanupDeadline(run.cleanupTimeoutMs);
+	const [memoryClose, settled] = await Promise.all([closeMemoryAccess(state, reason, cleanupDeadlineAtMs), settleModelGrant(state, reason, cleanupDeadlineAtMs)]);
+	const cleanupProven = memoryClose.closed && settled.settlement !== void 0;
+	consumePreparedCandidateExecution(prepared, cleanupProven ? "failed" : "cleanup-failed");
+	return failedAgentCandidateRun(state, redactProtectedReason(joinErrors(error, memoryClose.error, settled.error, !cleanupProven ? /* @__PURE__ */ new Error("prepared access cleanup remains incomplete and may be retried by disposal") : void 0), []), void 0, settled.settlement?.usage ?? null);
 }
-//#endregion
-//#region src/candidate-execution/execute.ts
-/** Executes and finalizes one durably claimed candidate without exposing an unproven result. */
-async function executePreparedAgentCandidate(prepared, options) {
-	const initialState = assertPreparedCandidateIntegrity(prepared);
-	const cleanupTimeoutMs = candidateCleanupTimeout(options.cleanupTimeoutMs ?? initialState.cleanupTimeoutMs);
-	if (cleanupTimeoutMs > initialState.cleanupTimeoutMs) throw new Error("execution cleanup timeout exceeds the frozen preparation bound");
-	const resultTimeoutMs = candidateResultTimeout(options.resultTimeoutMs ?? initialState.resultTimeoutMs, initialState.resultTimeoutMs);
-	if (resultTimeoutMs > initialState.resultTimeoutMs) throw new Error("execution result timeout exceeds the frozen preparation bound");
-	let state;
-	try {
-		state = beginPreparedCandidateClaim(prepared);
-	} catch (error) {
-		return failedAgentCandidateRun(initialState, errorMessage(error));
-	}
-	try {
-		await assertPreparedCandidateWorkspaces(state);
-	} catch (error) {
-		return await failBeforeActivation(prepared, state, error, "failed", cleanupTimeoutMs);
-	}
-	let preparationEvidence;
-	try {
-		const [executionPlan, materializationReceipt] = await Promise.all([persistCandidateOutputArtifact(options.outputArtifacts, {
-			executionId: state.executionId,
-			purpose: "execution-plan",
-			bytes: state.executionPlan.bytes
-		}), persistCandidateOutputArtifact(options.outputArtifacts, {
-			executionId: state.executionId,
-			purpose: "materialization-receipt",
-			bytes: state.materializationReceipt.bytes
-		})]);
-		preparationEvidence = Object.freeze({
-			executionPlan,
-			materializationReceipt
-		});
-	} catch (error) {
-		return await failBeforeActivation(prepared, state, error, "failed", cleanupTimeoutMs);
-	}
-	let acquired;
-	try {
-		acquired = await options.claimStore.tryClaim(candidateExecutionClaim(prepared, preparationEvidence));
-	} catch (error) {
-		return await failBeforeActivation(prepared, state, error, "failed", cleanupTimeoutMs);
+/** Fail a claimed attempt before the candidate may run: clean up, then record the failure. */
+async function failClaimedExecution(run, lease, error, failureClass, access = {}) {
+	const { prepared, state, claimStore, outputArtifacts } = run;
+	beginPreparedCandidateSettlement(prepared);
+	const cleanupDeadlineAtMs = candidateCleanupDeadline(run.cleanupTimeoutMs);
+	const [memoryClose, settled] = await Promise.all([closeMemoryAccess(state, "failed", cleanupDeadlineAtMs), settleModelGrant(state, "failed", cleanupDeadlineAtMs)]);
+	const protectedValues = protectedEnvironmentValues(access.activation, access.memoryActivation);
+	const safeReason = redactProtectedReason(joinErrors(error, memoryClose.error, settled.error), protectedValues);
+	let finishFailed = false;
+	let persistenceFailure;
+	if (settled.settlement && memoryClose.closed) try {
+		const modelSettlement = await withinCandidateCleanupDeadline(() => persistCandidateModelSettlement(state, settled.settlement, outputArtifacts), lease.expiresAtMs, "candidate pre-run model-settlement persistence");
+		const failureEvidence = await withinCandidateCleanupDeadline(() => persistFailureEvidence(state, safeReason, failureClass, void 0, outputArtifacts), lease.expiresAtMs, "candidate pre-run failure-evidence persistence");
+		finishFailed = !await finishClaim(claimStore, lease, {
+			status: "failed",
+			failureClass,
+			usage: settled.settlement.usage,
+			modelSettlement: modelSettlement.artifact,
+			failureEvidence
+		}, lease.expiresAtMs);
+	} catch (persistenceError) {
+		finishFailed = true;
+		persistenceFailure = persistenceError;
 	}
-	if (!acquired.acquired) return await failBeforeActivation(prepared, state, /* @__PURE__ */ new Error(acquired.reason === "retry-not-eligible" ? `candidate execution retry is not eligible: ${acquired.detail}` : "candidate execution attempt is already claimed"), "replayed", cleanupTimeoutMs);
-	markPreparedCandidateClaimed(prepared);
-	const postRunWindowMs = candidatePostRunWindowMs(cleanupTimeoutMs, resultTimeoutMs);
-	const deadlineAtMs = acquired.claim.leaseExpiresAtMs - candidatePostRunWindowMs(state.cleanupTimeoutMs, state.resultTimeoutMs);
-	const requiredLeaseExpiry = deadlineAtMs + postRunWindowMs;
-	if (Date.now() >= deadlineAtMs || deadlineAtMs > state.reservationExpiresAtMs || requiredLeaseExpiry > acquired.lease.expiresAtMs) return await failClaimedExecution(prepared, state, acquired.lease, options.claimStore, options.outputArtifacts, /* @__PURE__ */ new Error("candidate claim no longer covers its full execution and cleanup window"), "failed", cleanupTimeoutMs, "pre-model-infrastructure");
-	let activation;
+	consumePreparedCandidateExecution(prepared, "failed");
+	return failedAgentCandidateRun(state, redactProtectedReason(joinErrors(safeReason, persistenceFailure, memoryClose.error, settled.error, !memoryClose.closed || !settled.settlement ? /* @__PURE__ */ new Error("candidate claim remains recoverable until protected cleanup is proven") : void 0, finishFailed ? /* @__PURE__ */ new Error("candidate execution terminal record could not be persisted") : void 0), protectedValues), void 0, settled.settlement?.usage ?? null);
+}
+async function closeMemoryAccess(state, reason, cleanupDeadlineAtMs) {
+	if (state.memory.mode === "disabled") return { closed: true };
 	try {
-		const activated = await withinCandidateCleanupDeadline(() => state.ports.models.activateGrant({
-			executionId: state.executionId,
-			preparationId: state.preparationId,
-			grantDigest: state.modelReservation.digest,
-			resolved: state.resolvedModel,
-			deadlineAtMs
-		}), Math.min(deadlineAtMs, candidateCleanupDeadline(cleanupTimeoutMs)), "protected model activation");
-		activation = Object.freeze({ env: Object.freeze({ ...activated.env }) });
-	} catch (error) {
-		return await failClaimedExecution(prepared, state, acquired.lease, options.claimStore, options.outputArtifacts, new Error("protected model activation failed", { cause: error }), "failed", cleanupTimeoutMs, "pre-model-infrastructure");
-	}
-	let memoryActivation;
-	if (state.memory.mode === "isolated") try {
 		const reservation = state.memoryReservation;
 		if (!reservation) throw new Error("isolated memory reservation is missing");
-		const activated = await withinCandidateCleanupDeadline(() => state.ports.memory.activate({
+		const closed = await withinCandidateCleanupDeadline(() => state.ports.memory.close({
 			executionId: state.executionId,
 			preparationId: reservation.preparationId,
 			accessDigest: reservation.accessDigest,
 			effectiveNamespace: reservation.effectiveNamespace,
-			deadlineAtMs
-		}), Math.min(deadlineAtMs, candidateCleanupDeadline(cleanupTimeoutMs)), "isolated memory activation");
-		memoryActivation = Object.freeze({ env: Object.freeze({ ...activated.env }) });
+			reason
+		}), cleanupDeadlineAtMs, "isolated memory closure");
+		if (closed.closed !== true || Object.keys(closed).some((key) => key !== "closed")) throw new Error("isolated memory access did not acknowledge closure");
+		return { closed: true };
 	} catch (error) {
-		return await failClaimedExecution(prepared, state, acquired.lease, options.claimStore, options.outputArtifacts, new Error("isolated memory activation failed", { cause: error }), "failed", cleanupTimeoutMs, "pre-model-infrastructure", activation);
+		return {
+			closed: false,
+			error
+		};
 	}
-	let request;
+}
+async function settleModelGrant(state, reason, cleanupDeadlineAtMs) {
 	try {
-		request = beginPreparedCandidateRun(prepared, activation, memoryActivation).request;
+		return { settlement: sealAgentCandidateModelSettlement(await withinCandidateCleanupDeadline(() => state.ports.models.settleGrant({
+			executionId: state.executionId,
+			preparationId: state.preparationId,
+			grantDigest: state.modelReservation.digest,
+			resolved: state.resolvedModel,
+			reason
+		}), cleanupDeadlineAtMs, "protected model settlement"), {
+			preparationId: state.preparationId,
+			grantDigest: state.modelReservation.digest,
+			model: state.resolvedModel.model
+		}) };
 	} catch (error) {
-		return await failClaimedExecution(prepared, state, acquired.lease, options.claimStore, options.outputArtifacts, error, "failed", cleanupTimeoutMs, "pre-model-infrastructure", activation, memoryActivation);
+		return { error: new Error("protected model settlement failed", { cause: error }) };
 	}
+}
+async function finishClaim(store, lease, terminal, deadlineAtMs) {
 	try {
-		if ((await options.claimStore.markCandidateMayRun(acquired.lease)).phase !== "candidate-may-run") throw new Error("candidate claim did not persist the candidate-may-run phase");
-	} catch (error) {
-		return await failClaimedExecution(prepared, state, acquired.lease, options.claimStore, options.outputArtifacts, new Error("candidate execution phase persistence failed", { cause: error }), "failed", cleanupTimeoutMs, "pre-model-infrastructure", activation, memoryActivation);
+		const staged = await withinCandidateCleanupDeadline(() => store.stageTerminal(lease, terminal), deadlineAtMs ?? lease.expiresAtMs, "candidate terminal staging");
+		if (!staged.staged && !staged.exactReplay) return false;
+		const result = await withinCandidateCleanupDeadline(() => store.finish(lease, staged.terminal.terminalDigest), deadlineAtMs ?? lease.expiresAtMs, "candidate terminal publication");
+		return result.finished || result.exactReplay;
+	} catch {
+		return false;
 	}
-	if (Date.now() >= deadlineAtMs) return await failClaimedExecution(prepared, state, acquired.lease, options.claimStore, options.outputArtifacts, /* @__PURE__ */ new Error("candidate execution deadline elapsed while persisting its launch phase"), "failed", cleanupTimeoutMs, "unknown", activation, memoryActivation);
-	const protectedValues = protectedEnvironmentValues(activation, memoryActivation);
-	const protectedTrace = createProtectedAgentCandidateTraceAccess(options.traceStore, protectedValues);
-	const persistedTrace = protectedTrace.identity(state.trace);
-	const execution = await runAndStopExecutor(options.executor, request, state.benchmarkTask.outcome, protectedTrace.store, deadlineAtMs, cleanupTimeoutMs);
-	beginPreparedCandidateSettlement(prepared);
-	const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs);
-	const accessReason = execution.kind === "timeout" || execution.termination?.kind === "timeout" ? "timeout" : execution.kind === "capture" ? "completed" : "failed";
-	const traceClosure = withinCandidateCleanupDeadline(() => protectedTrace.closeWrites(), cleanupDeadlineAtMs, "candidate trace write closure").then(() => ({
-		closed: true,
-		error: void 0
-	}), (error) => ({
-		closed: false,
-		error
-	}));
-	const [traceClose, memoryClose, settlementResult] = await Promise.all([
-		traceClosure,
-		closeMemoryAccess(state, accessReason, cleanupDeadlineAtMs),
-		settleModelGrant(state, accessReason, cleanupDeadlineAtMs)
+}
+function protectedEnvironmentValues(activation, memoryActivation) {
+	return [...Object.values(activation?.env ?? {}), ...Object.values(memoryActivation?.env ?? {})];
+}
+function joinErrors(...errors) {
+	return errors.filter((error) => error !== void 0).map(errorMessage).join("; ");
+}
+//#endregion
+//#region src/candidate-execution/executor-capture.ts
+const sealedFinalCaptureBrand = Symbol("sealedAgentCandidateExecutorFinalCapture");
+/** Validate and detach the only candidate-authored fields accepted from execution. */
+function sealAgentCandidateProtectedRunCapture(value) {
+	const capture = requireRecord(value, "candidate execution capture");
+	assertExactObjectKeys(capture, ["executionId", "termination"], "candidate execution capture");
+	if (typeof capture.executionId !== "string" || capture.executionId.length === 0) throw new Error("candidate execution capture has an invalid executionId");
+	return Object.freeze({
+		executionId: capture.executionId,
+		termination: Object.freeze(agentCandidateTerminationSchema.parse(capture.termination))
+	});
+}
+/** Validate, detach, and freeze evaluator-owned evidence captured after process death. */
+function sealAgentCandidateExecutorFinalCapture(value, expectedOutcome) {
+	const capture = requireRecord(value, "candidate final capture");
+	assertExactObjectKeys(capture, [], "candidate final capture", [
+		"taskOutcome",
+		"memoryAfter",
+		"evidence"
 	]);
-	if (!execution.processStopped || !traceClose.closed || !settlementResult.settlement || !memoryClose.closed) {
-		consumePreparedCandidateExecution(prepared, "failed");
-		return failedAgentCandidateRun(state, redactProtectedReason(joinErrors(execution.error, !execution.processStopped ? /* @__PURE__ */ new Error("candidate process termination is not proven") : void 0, traceClose.error, memoryClose.error, settlementResult.error ?? (!settlementResult.settlement ? /* @__PURE__ */ new Error("model settlement failed") : void 0), /* @__PURE__ */ new Error("candidate claim remains recoverable until protected cleanup is proven")), protectedValues), execution.termination, settlementResult.settlement?.usage ?? null);
-	}
-	let modelSettlement;
-	try {
-		modelSettlement = await withinCandidateCleanupDeadline(() => persistCandidateModelSettlement(state, settlementResult.settlement, options.outputArtifacts), candidateCleanupDeadline(cleanupTimeoutMs), "candidate model settlement persistence");
-	} catch (error) {
-		consumePreparedCandidateExecution(prepared, "failed");
-		return failedAgentCandidateRun(state, redactProtectedReason(joinErrors(error, /* @__PURE__ */ new Error("candidate claim remains recoverable until settlement evidence is durable")), protectedValues), execution.termination, settlementResult.settlement.usage);
-	}
-	let result;
-	const failureClass = execution.kind === "error" ? "execution" : "post-model-infrastructure";
-	if (execution.kind === "error") result = failedAgentCandidateRun(state, redactProtectedReason(errorMessage(execution.error), protectedValues), execution.termination, settlementResult.settlement.usage);
-	else if (!execution.finalCapture.taskOutcome) result = failedAgentCandidateRun(state, "candidate executor stopped without a captured task outcome", execution.termination, settlementResult.settlement.usage);
-	else {
-		const capture = execution.kind === "capture" ? execution.capture : {
-			executionId: state.executionId,
-			termination: execution.termination
-		};
-		try {
-			result = await withinCandidateResultDeadline(async (signal) => {
-				await appendAuthoritativeModelSettlementSpans(options.traceStore, persistedTrace.runId, settlementResult.settlement);
-				const { persistedCapture, taskOutcome } = await persistVerifiedAgentCandidateExecutorCapture(state, execution.finalCapture, options.outputArtifacts, protectedValues, signal);
-				const benchmarkResult = await persistCandidateBenchmarkResult(state, capture.termination, taskOutcome, options.grader, options.outputArtifacts, protectedValues, signal);
-				return await finalizeAgentCandidateRun(state, capture, options.traceStore, persistedTrace, settlementResult.settlement, {
-					finalCapture: execution.finalCapture,
-					persistedCapture,
-					modelSettlement,
-					taskOutcome,
-					benchmarkResult,
-					outputArtifacts: options.outputArtifacts
-				}, protectedValues, protectedTrace.report(), signal);
-			}, Math.min(Date.now() + resultTimeoutMs, acquired.lease.expiresAtMs - candidateTerminalWindowMs(cleanupTimeoutMs)), "candidate evidence finalization");
-		} catch (error) {
-			result = failedAgentCandidateRun(state, redactProtectedReason(errorMessage(error), protectedValues), execution.termination, settlementResult.settlement.usage);
-		}
-	}
-	let terminal;
-	try {
-		terminal = result.succeeded ? {
-			status: "succeeded",
-			usage: settlementResult.settlement.usage,
-			modelSettlement: result.artifacts.modelSettlement,
-			taskOutcome: result.artifacts.taskOutcome,
-			benchmarkResult: result.artifacts.benchmarkResult,
-			runReceipt: result.artifacts.runReceipt
-		} : {
-			status: "failed",
-			failureClass,
-			usage: settlementResult.settlement.usage,
-			modelSettlement: modelSettlement.artifact,
-			failureEvidence: await withinCandidateCleanupDeadline(() => persistFailureEvidence(state, result.reason, failureClass, execution.termination, options.outputArtifacts), acquired.lease.expiresAtMs, "candidate failure-evidence persistence")
-		};
-	} catch (error) {
-		consumePreparedCandidateExecution(prepared, "failed");
-		return failedAgentCandidateRun(state, redactProtectedReason(joinErrors(error, /* @__PURE__ */ new Error("candidate claim remains recoverable until terminal evidence is durable")), protectedValues), execution.termination, settlementResult.settlement.usage);
-	}
-	if (await finishClaim(options.claimStore, acquired.lease, terminal, acquired.lease.expiresAtMs)) {
-		consumePreparedCandidateExecution(prepared, result.succeeded ? "succeeded" : "failed");
-		return result;
+	const taskOutcome = capture.taskOutcome ? sealTaskOutcomeCapture(capture.taskOutcome, expectedOutcome) : void 0;
+	const memoryAfter = capture.memoryAfter ? sealMemoryCapture(capture.memoryAfter) : void 0;
+	if (capture.evidence !== void 0 && !(capture.evidence instanceof Uint8Array)) throw new Error("candidate executor evidence must be a byte array");
+	const evidence = capture.evidence ? Uint8Array.from(capture.evidence) : void 0;
+	return Object.freeze({
+		...taskOutcome ? { taskOutcome } : {},
+		...memoryAfter ? { memoryAfter: Object.freeze(memoryAfter) } : {},
+		...evidence ? { evidence } : {},
+		[sealedFinalCaptureBrand]: true
+	});
+}
+/** Prove exact process death before any final evidence capture. */
+function sealAgentCandidateExecutorStopAcknowledgement(value) {
+	const capture = requireRecord(value, "candidate stop acknowledgement");
+	assertExactObjectKeys(capture, ["stopped"], "candidate stop acknowledgement");
+	if (capture.stopped !== true) throw new Error("candidate stop acknowledgement does not prove process death");
+}
+function sealMemoryCapture(value) {
+	const capture = requireRecord(value, "candidate memory capture");
+	assertExactObjectKeys(capture, ["afterState", "archive"], "candidate memory capture");
+	if (!(capture.archive instanceof Uint8Array)) throw new Error("candidate memory capture archive must be a byte array");
+	return Object.freeze({
+		afterState: Object.freeze(agentCandidateWorkspaceManifestMaterialSchema.parse(capture.afterState)),
+		archive: Uint8Array.from(capture.archive)
+	});
+}
+function sealTaskOutcomeCapture(value, expected) {
+	const capture = requireRecord(value, "candidate task capture");
+	if (capture.kind === "output") {
+		assertExactObjectKeys(capture, ["kind", "bytes"], "candidate task output capture");
+		if (expected.kind !== "output") throw new Error("candidate task output capture does not match the signed outcome kind");
+		if (!(capture.bytes instanceof Uint8Array)) throw new Error("candidate task output capture must contain a byte array");
+		if (capture.bytes.byteLength > expected.maxBytes) throw new Error(`candidate task output exceeds the frozen ${expected.maxBytes}-byte maximum`);
+		return Object.freeze({
+			kind: "output",
+			bytes: Uint8Array.from(capture.bytes)
+		});
 	}
-	consumePreparedCandidateExecution(prepared, "failed");
-	return failedAgentCandidateRun(state, "candidate execution terminal record could not be persisted", execution.termination, settlementResult.settlement.usage);
+	assertExactObjectKeys(capture, [
+		"kind",
+		"resultTree",
+		"afterState",
+		"archive",
+		"gitDiff"
+	], "candidate task capture");
+	if (capture.kind !== "workspace") throw new Error("candidate task capture has an invalid outcome kind");
+	if (expected.kind !== "workspace") throw new Error("candidate workspace capture does not match the signed outcome kind");
+	if (typeof capture.resultTree !== "string" || !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(capture.resultTree)) throw new Error("candidate task capture resultTree is not a Git object id");
+	if (!(capture.archive instanceof Uint8Array) || !(capture.gitDiff instanceof Uint8Array)) throw new Error("candidate task capture archive and gitDiff must be byte arrays");
+	const afterState = agentCandidateWorkspaceManifestMaterialSchema.parse(capture.afterState);
+	return Object.freeze({
+		kind: "workspace",
+		resultTree: capture.resultTree,
+		afterState: Object.freeze(afterState),
+		archive: Uint8Array.from(capture.archive),
+		gitDiff: Uint8Array.from(capture.gitDiff)
+	});
 }
+function requireRecord(value, label) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
+	return value;
+}
+//#endregion
+//#region src/candidate-execution/execute-executor.ts
+/** Run the executor until it returns or the deadline passes, then stop and capture it. */
 async function runAndStopExecutor(executor, request, expectedOutcome, traceStore, deadlineAtMs, cleanupTimeoutMs) {
 	const timeoutMs = request.hardLimits.timeoutMs;
 	const timeoutError = new CandidateExecutionDeadlineError(timeoutMs);
@@ -3353,113 +3227,49 @@ async function runAndStopExecutor(executor, request, expectedOutcome, traceStore
 		},
 		processStopped: true
 	};
-	const controller = new AbortController();
-	let timer;
-	let timedOut = false;
-	let capture;
-	let executionError;
-	const executionPromise = Promise.resolve().then(() => executor.execute(request, {
-		traceStore,
-		signal: controller.signal,
-		deadlineAtMs
-	}));
-	executionPromise.catch(() => void 0);
-	const deadlinePromise = new Promise((_resolve, reject) => {
-		timer = setTimeout(() => {
-			timedOut = true;
-			controller.abort(timeoutError);
-			reject(timeoutError);
-		}, Math.max(0, deadlineAtMs - Date.now()));
-	});
-	deadlinePromise.catch(() => void 0);
-	try {
-		capture = sealAgentCandidateProtectedRunCapture(await Promise.race([executionPromise, deadlinePromise]));
-	} catch (error) {
-		executionError = error;
-	}
-	if (!timedOut && capture && capture.executionId !== request.executionId) {
-		executionError = /* @__PURE__ */ new Error("candidate execution capture id does not match the request");
-		capture = void 0;
-	} else if (!timedOut && capture && Date.now() >= deadlineAtMs) {
-		timedOut = true;
-		executionError = timeoutError;
-		capture = void 0;
-	} else if (!timedOut && capture?.termination.kind === "timeout") {
-		executionError = /* @__PURE__ */ new Error("candidate executor cannot declare the runtime-owned timeout");
-		capture = void 0;
-	}
-	if (!capture || timedOut) controller.abort(executionError);
-	const stopReason = timedOut ? "timeout" : capture ? "completed" : "failed";
+	const run = await executeUntilDeadline(executor, request, traceStore, deadlineAtMs, timeoutError);
+	rejectAmbiguousCapture(run, request, deadlineAtMs);
+	const { controller } = run;
+	if (!run.capture || run.timedOut) controller.abort(run.executionError);
+	const stopReason = run.timedOut ? "timeout" : run.capture ? "completed" : "failed";
 	const cleanupDeadlineAtMs = Date.now() + cleanupTimeoutMs;
-	try {
-		sealAgentCandidateExecutorStopAcknowledgement(await withinCandidateCleanupDeadline((cleanupSignal) => executor.stop({
-			executionId: request.executionId,
-			executionPlanDigest: request.executionPlan.value.digest
-		}, {
-			traceStore,
-			reason: stopReason,
-			signal: cleanupSignal,
-			deadlineAtMs: cleanupDeadlineAtMs
-		}), cleanupDeadlineAtMs, "candidate process termination"));
-	} catch (stopError) {
-		let disposalError;
-		try {
-			await disposeExecutor(executor, request, cleanupDeadlineAtMs);
-		} catch (error) {
-			disposalError = error;
-		}
-		if (timer) clearTimeout(timer);
-		controller.abort(stopError);
+	const timeoutTermination = () => run.timedOut ? { termination: {
+		kind: "timeout",
+		timeoutMs
+	} } : {};
+	const stop = await stopExecutor(executor, request, traceStore, stopReason, cleanupDeadlineAtMs);
+	if (!stop.stopped) {
+		const disposalError = await disposalFailure(executor, request, cleanupDeadlineAtMs);
+		if (run.timer) clearTimeout(run.timer);
+		controller.abort(stop.error);
 		return {
 			kind: "error",
-			error: new Error(joinErrors(executionError, stopError, disposalError)),
-			...timedOut ? { termination: {
-				kind: "timeout",
-				timeoutMs
-			} } : {},
+			error: new Error(joinErrors(run.executionError, stop.error, disposalError)),
+			...timeoutTermination(),
 			processStopped: false
 		};
 	}
-	let finalCapture;
-	let finalCaptureError;
-	try {
-		finalCapture = sealAgentCandidateExecutorFinalCapture(await withinCandidateCleanupDeadline((cleanupSignal) => executor.capture({
-			executionId: request.executionId,
-			executionPlanDigest: request.executionPlan.value.digest
-		}, {
-			traceStore,
-			signal: cleanupSignal
-		}), cleanupDeadlineAtMs, "candidate final evidence capture"), expectedOutcome);
-	} catch (captureError) {
-		finalCaptureError = captureError;
-	}
-	let disposalError;
-	try {
-		await disposeExecutor(executor, request, cleanupDeadlineAtMs);
-	} catch (disposeError) {
-		disposalError = disposeError;
-	}
-	if (finalCaptureError || disposalError || !finalCapture) {
-		if (timer) clearTimeout(timer);
-		controller.abort(finalCaptureError ?? disposalError);
+	const final = await captureFinalEvidence(executor, request, traceStore, expectedOutcome, cleanupDeadlineAtMs);
+	const disposalError = await disposalFailure(executor, request, cleanupDeadlineAtMs);
+	const { finalCapture } = final;
+	if (final.error || disposalError || !finalCapture) {
+		if (run.timer) clearTimeout(run.timer);
+		controller.abort(final.error ?? disposalError);
 		return {
 			kind: "error",
-			error: new Error(joinErrors(executionError, finalCaptureError, disposalError)),
-			...timedOut ? { termination: {
-				kind: "timeout",
-				timeoutMs
-			} } : {},
+			error: new Error(joinErrors(run.executionError, final.error, disposalError)),
+			...timeoutTermination(),
 			processStopped: true
 		};
 	}
 	if (Date.now() >= deadlineAtMs) {
-		timedOut = true;
-		executionError = timeoutError;
-		capture = void 0;
+		run.timedOut = true;
+		run.executionError = timeoutError;
+		run.capture = void 0;
 		controller.abort(timeoutError);
 	}
-	if (timer) clearTimeout(timer);
-	if (timedOut) return {
+	if (run.timer) clearTimeout(run.timer);
+	if (run.timedOut) return {
 		kind: "timeout",
 		termination: {
 			kind: "timeout",
@@ -3468,144 +3278,603 @@ async function runAndStopExecutor(executor, request, expectedOutcome, traceStore
 		finalCapture,
 		processStopped: true
 	};
-	if (executionError || !capture) return {
+	if (run.executionError || !run.capture) return {
 		kind: "error",
-		error: executionError ?? /* @__PURE__ */ new Error("candidate executor returned no capture"),
+		error: run.executionError ?? /* @__PURE__ */ new Error("candidate executor returned no capture"),
 		finalCapture,
 		processStopped: true
 	};
 	return {
 		kind: "capture",
-		capture,
-		termination: capture.termination,
+		capture: run.capture,
+		termination: run.capture.termination,
 		finalCapture,
 		processStopped: true
 	};
 }
-async function disposeExecutor(executor, request, cleanupDeadlineAtMs) {
-	const dispose = executor.dispose;
-	if (!dispose) return;
-	const disposed = await withinCandidateCleanupDeadline((cleanupSignal) => dispose.call(executor, {
-		executionId: request.executionId,
-		executionPlanDigest: request.executionPlan.value.digest
-	}, { signal: cleanupSignal }), cleanupDeadlineAtMs, "candidate execution resource disposal");
-	if (disposed?.disposed !== true || Object.keys(disposed).some((key) => key !== "disposed")) throw new Error("candidate executor did not acknowledge resource disposal");
+async function executeUntilDeadline(executor, request, traceStore, deadlineAtMs, timeoutError) {
+	const run = {
+		controller: new AbortController(),
+		timeoutError,
+		timer: void 0,
+		timedOut: false,
+		capture: void 0,
+		executionError: void 0
+	};
+	const executionPromise = Promise.resolve().then(() => executor.execute(request, {
+		traceStore,
+		signal: run.controller.signal,
+		deadlineAtMs
+	}));
+	executionPromise.catch(() => void 0);
+	const deadlinePromise = new Promise((_resolve, reject) => {
+		run.timer = setTimeout(() => {
+			run.timedOut = true;
+			run.controller.abort(timeoutError);
+			reject(timeoutError);
+		}, Math.max(0, deadlineAtMs - Date.now()));
+	});
+	deadlinePromise.catch(() => void 0);
+	try {
+		run.capture = sealAgentCandidateProtectedRunCapture(await Promise.race([executionPromise, deadlinePromise]));
+	} catch (error) {
+		run.executionError = error;
+	}
+	return run;
+}
+/** Refuse a capture for another execution, one at the deadline, or one that claims the timeout. */
+function rejectAmbiguousCapture(run, request, deadlineAtMs) {
+	const { capture } = run;
+	if (!run.timedOut && capture && capture.executionId !== request.executionId) {
+		run.executionError = /* @__PURE__ */ new Error("candidate execution capture id does not match the request");
+		run.capture = void 0;
+	} else if (!run.timedOut && capture && Date.now() >= deadlineAtMs) {
+		run.timedOut = true;
+		run.executionError = run.timeoutError;
+		run.capture = void 0;
+	} else if (!run.timedOut && capture?.termination.kind === "timeout") {
+		run.executionError = /* @__PURE__ */ new Error("candidate executor cannot declare the runtime-owned timeout");
+		run.capture = void 0;
+	}
 }
-async function failBeforeActivation(prepared, state, error, reason, cleanupTimeoutMs) {
-	beginPreparedCandidateSettlement(prepared);
-	const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs);
-	const [memoryClose, settled] = await Promise.all([closeMemoryAccess(state, reason, cleanupDeadlineAtMs), settleModelGrant(state, reason, cleanupDeadlineAtMs)]);
-	const cleanupProven = memoryClose.closed && settled.settlement !== void 0;
-	consumePreparedCandidateExecution(prepared, cleanupProven ? "failed" : "cleanup-failed");
-	return failedAgentCandidateRun(state, redactProtectedReason(joinErrors(error, memoryClose.error, settled.error, !cleanupProven ? /* @__PURE__ */ new Error("prepared access cleanup remains incomplete and may be retried by disposal") : void 0), []), void 0, settled.settlement?.usage ?? null);
+async function stopExecutor(executor, request, traceStore, reason, cleanupDeadlineAtMs) {
+	try {
+		sealAgentCandidateExecutorStopAcknowledgement(await withinCandidateCleanupDeadline((cleanupSignal) => executor.stop(executionTarget(request), {
+			traceStore,
+			reason,
+			signal: cleanupSignal,
+			deadlineAtMs: cleanupDeadlineAtMs
+		}), cleanupDeadlineAtMs, "candidate process termination"));
+		return { stopped: true };
+	} catch (error) {
+		return {
+			stopped: false,
+			error
+		};
+	}
 }
-async function failClaimedExecution(prepared, state, lease, claimStore, outputArtifacts, error, reason, cleanupTimeoutMs, failureClass, activation, memoryActivation) {
-	beginPreparedCandidateSettlement(prepared);
-	const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs);
-	const [memoryClose, settled] = await Promise.all([closeMemoryAccess(state, reason, cleanupDeadlineAtMs), settleModelGrant(state, reason, cleanupDeadlineAtMs)]);
-	const protectedValues = protectedEnvironmentValues(activation, memoryActivation);
-	const safeReason = redactProtectedReason(joinErrors(error, memoryClose.error, settled.error), protectedValues);
-	let finishFailed = false;
-	let persistenceFailure;
-	if (settled.settlement && memoryClose.closed) try {
-		const modelSettlement = await withinCandidateCleanupDeadline(() => persistCandidateModelSettlement(state, settled.settlement, outputArtifacts), lease.expiresAtMs, "candidate pre-run model-settlement persistence");
-		const failureEvidence = await withinCandidateCleanupDeadline(() => persistFailureEvidence(state, safeReason, failureClass, void 0, outputArtifacts), lease.expiresAtMs, "candidate pre-run failure-evidence persistence");
-		finishFailed = !await finishClaim(claimStore, lease, {
+async function captureFinalEvidence(executor, request, traceStore, expectedOutcome, cleanupDeadlineAtMs) {
+	try {
+		return { finalCapture: sealAgentCandidateExecutorFinalCapture(await withinCandidateCleanupDeadline((cleanupSignal) => executor.capture(executionTarget(request), {
+			traceStore,
+			signal: cleanupSignal
+		}), cleanupDeadlineAtMs, "candidate final evidence capture"), expectedOutcome) };
+	} catch (error) {
+		return { error };
+	}
+}
+/** The error disposal threw, or undefined when the executor's resources were disposed. */
+async function disposalFailure(executor, request, cleanupDeadlineAtMs) {
+	try {
+		const dispose = executor.dispose;
+		if (!dispose) return void 0;
+		const disposed = await withinCandidateCleanupDeadline((cleanupSignal) => dispose.call(executor, executionTarget(request), { signal: cleanupSignal }), cleanupDeadlineAtMs, "candidate execution resource disposal");
+		if (disposed?.disposed !== true || Object.keys(disposed).some((key) => key !== "disposed")) throw new Error("candidate executor did not acknowledge resource disposal");
+		return;
+	} catch (error) {
+		return error;
+	}
+}
+const executionTarget = (request) => ({
+	executionId: request.executionId,
+	executionPlanDigest: request.executionPlan.value.digest
+});
+var CandidateExecutionDeadlineError = class extends Error {
+	constructor(timeoutMs) {
+		super(`candidate execution reached its frozen ${timeoutMs}ms deadline`);
+		this.name = "CandidateExecutionDeadlineError";
+	}
+};
+//#endregion
+//#region src/candidate-execution/protected-trace-store.ts
+/** Keep the identity key in evaluator-owned closures and expose only the redacting store to code. */
+function createProtectedAgentCandidateTraceAccess(inner, protectedValues) {
+	const redactor = createProtectedRecordRedactor(protectedValues);
+	const pendingWrites = /* @__PURE__ */ new Set();
+	let acceptsWrites = true;
+	const write = (operation) => {
+		if (!acceptsWrites) return Promise.reject(/* @__PURE__ */ new Error("candidate trace writes are closed"));
+		let started;
+		try {
+			started = operation();
+		} catch (error) {
+			return Promise.reject(error);
+		}
+		let tracked;
+		tracked = started.finally(() => pendingWrites.delete(tracked));
+		pendingWrites.add(tracked);
+		return tracked;
+	};
+	const store = Object.freeze({
+		appendRun: (run) => write(() => inner.appendRun(redactor.record(run))),
+		updateRun: (runId, patch) => write(() => inner.updateRun(redactor.identifier(runId), redactor.record(patch))),
+		appendSpan: (span) => write(async () => {
+			if (span.kind === "llm") throw new Error("candidate executors cannot author protected model spans");
+			await inner.appendSpan(redactor.record(span));
+		}),
+		updateSpan: (spanId, patch) => write(async () => {
+			if (patch.kind === "llm") throw new Error("candidate executors cannot author protected model spans");
+			await inner.updateSpan(redactor.identifier(spanId), redactor.record(patch));
+		}),
+		appendEvent: (event) => write(() => inner.appendEvent(redactor.record(event))),
+		appendArtifact: (artifact) => write(() => inner.appendArtifact(redactor.record(artifact))),
+		appendBudgetEntry: (entry) => write(() => inner.appendBudgetEntry(redactor.record(entry))),
+		getRun: async (runId) => inner.getRun(redactor.identifier(runId)),
+		listRuns: async (filter) => inner.listRuns(filter ? redactor.query(filter) : void 0),
+		spans: async (filter) => inner.spans(filter ? redactor.query(filter) : void 0),
+		events: async (filter) => inner.events(filter ? redactor.query(filter) : void 0),
+		budget: async (runId) => inner.budget(redactor.identifier(runId)),
+		artifacts: async (runId) => inner.artifacts(redactor.identifier(runId))
+	});
+	return Object.freeze({
+		store,
+		closeWrites: async () => {
+			acceptsWrites = false;
+			await Promise.all([...pendingWrites]);
+		},
+		identity: (trace) => redactor.traceIdentity(trace),
+		report: () => redactor.report()
+	});
+}
+//#endregion
+//#region src/candidate-execution/execute.ts
+/** Executes and finalizes one durably claimed candidate without exposing an unproven result. */
+async function executePreparedAgentCandidate(prepared, options) {
+	const initialState = assertPreparedCandidateIntegrity(prepared);
+	const cleanupTimeoutMs = candidateCleanupTimeout(options.cleanupTimeoutMs ?? initialState.cleanupTimeoutMs);
+	if (cleanupTimeoutMs > initialState.cleanupTimeoutMs) throw new Error("execution cleanup timeout exceeds the frozen preparation bound");
+	const resultTimeoutMs = candidateResultTimeout(options.resultTimeoutMs ?? initialState.resultTimeoutMs, initialState.resultTimeoutMs);
+	if (resultTimeoutMs > initialState.resultTimeoutMs) throw new Error("execution result timeout exceeds the frozen preparation bound");
+	let state;
+	try {
+		state = beginPreparedCandidateClaim(prepared);
+	} catch (error) {
+		return failedAgentCandidateRun(initialState, errorMessage(error));
+	}
+	const run = {
+		prepared,
+		state,
+		claimStore: options.claimStore,
+		outputArtifacts: options.outputArtifacts,
+		cleanupTimeoutMs,
+		resultTimeoutMs
+	};
+	const claimed = await claimExecution(run, options);
+	if (!claimed.ok) return claimed.result;
+	const launchable = await activateAccess(run, claimed.value);
+	if (!launchable.ok) return launchable.result;
+	const settled = await runAndSettle(run, options, claimed.value, launchable.value);
+	if (!settled.ok) return settled.result;
+	const { execution, settlement } = settled.value;
+	let modelSettlement;
+	try {
+		modelSettlement = await withinCandidateCleanupDeadline(() => persistCandidateModelSettlement(state, settlement, options.outputArtifacts), candidateCleanupDeadline(cleanupTimeoutMs), "candidate model settlement persistence");
+	} catch (error) {
+		consumePreparedCandidateExecution(prepared, "failed");
+		return failedAgentCandidateRun(state, redactProtectedReason(joinErrors(error, /* @__PURE__ */ new Error("candidate claim remains recoverable until settlement evidence is durable")), settled.value.protectedValues), execution.termination, settlement.usage);
+	}
+	const result = await finalizeEvidence(run, options, claimed.value, settled.value, modelSettlement);
+	return recordTerminal(run, claimed.value, settled.value, modelSettlement, result);
+}
+/** Stage and publish the attempt's terminal record, then consume the prepared execution. */
+async function recordTerminal(run, claimed, settled, modelSettlement, result) {
+	const { prepared, state } = run;
+	const { execution, settlement } = settled;
+	const { lease } = claimed.acquired;
+	const failureClass = execution.kind === "error" ? "execution" : "post-model-infrastructure";
+	let terminal;
+	try {
+		terminal = result.succeeded ? {
+			status: "succeeded",
+			usage: settlement.usage,
+			modelSettlement: result.artifacts.modelSettlement,
+			taskOutcome: result.artifacts.taskOutcome,
+			benchmarkResult: result.artifacts.benchmarkResult,
+			runReceipt: result.artifacts.runReceipt
+		} : {
 			status: "failed",
 			failureClass,
-			usage: settled.settlement.usage,
+			usage: settlement.usage,
 			modelSettlement: modelSettlement.artifact,
-			failureEvidence
-		}, lease.expiresAtMs);
-	} catch (persistenceError) {
-		finishFailed = true;
-		persistenceFailure = persistenceError;
+			failureEvidence: await withinCandidateCleanupDeadline(() => persistFailureEvidence(state, result.reason, failureClass, execution.termination, run.outputArtifacts), lease.expiresAtMs, "candidate failure-evidence persistence")
+		};
+	} catch (error) {
+		consumePreparedCandidateExecution(prepared, "failed");
+		return failedAgentCandidateRun(state, redactProtectedReason(joinErrors(error, /* @__PURE__ */ new Error("candidate claim remains recoverable until terminal evidence is durable")), settled.protectedValues), execution.termination, settlement.usage);
+	}
+	if (await finishClaim(run.claimStore, lease, terminal, lease.expiresAtMs)) {
+		consumePreparedCandidateExecution(prepared, result.succeeded ? "succeeded" : "failed");
+		return result;
 	}
 	consumePreparedCandidateExecution(prepared, "failed");
-	return failedAgentCandidateRun(state, redactProtectedReason(joinErrors(safeReason, persistenceFailure, memoryClose.error, settled.error, !memoryClose.closed || !settled.settlement ? /* @__PURE__ */ new Error("candidate claim remains recoverable until protected cleanup is proven") : void 0, finishFailed ? /* @__PURE__ */ new Error("candidate execution terminal record could not be persisted") : void 0), protectedValues), void 0, settled.settlement?.usage ?? null);
+	return failedAgentCandidateRun(state, "candidate execution terminal record could not be persisted", execution.termination, settlement.usage);
 }
-async function closeMemoryAccess(state, reason, cleanupDeadlineAtMs) {
-	if (state.memory.mode === "disabled") return { closed: true };
+/** Persist the plan and receipt, claim the attempt, and check the claim covers the run. */
+async function claimExecution(run, options) {
+	const { prepared, state, cleanupTimeoutMs, resultTimeoutMs } = run;
 	try {
-		const reservation = state.memoryReservation;
-		if (!reservation) throw new Error("isolated memory reservation is missing");
-		const closed = await withinCandidateCleanupDeadline(() => state.ports.memory.close({
+		await assertPreparedCandidateWorkspaces(state);
+	} catch (error) {
+		return {
+			ok: false,
+			result: await failBeforeActivation(run, error, "failed")
+		};
+	}
+	let preparationEvidence;
+	try {
+		const [executionPlan, materializationReceipt] = await Promise.all([persistCandidateOutputArtifact(options.outputArtifacts, {
 			executionId: state.executionId,
-			preparationId: reservation.preparationId,
-			accessDigest: reservation.accessDigest,
-			effectiveNamespace: reservation.effectiveNamespace,
-			reason
-		}), cleanupDeadlineAtMs, "isolated memory closure");
-		if (closed.closed !== true || Object.keys(closed).some((key) => key !== "closed")) throw new Error("isolated memory access did not acknowledge closure");
-		return { closed: true };
+			purpose: "execution-plan",
+			bytes: state.executionPlan.bytes
+		}), persistCandidateOutputArtifact(options.outputArtifacts, {
+			executionId: state.executionId,
+			purpose: "materialization-receipt",
+			bytes: state.materializationReceipt.bytes
+		})]);
+		preparationEvidence = Object.freeze({
+			executionPlan,
+			materializationReceipt
+		});
 	} catch (error) {
 		return {
-			closed: false,
-			error
+			ok: false,
+			result: await failBeforeActivation(run, error, "failed")
+		};
+	}
+	let acquired;
+	try {
+		acquired = await options.claimStore.tryClaim(candidateExecutionClaim(prepared, preparationEvidence));
+	} catch (error) {
+		return {
+			ok: false,
+			result: await failBeforeActivation(run, error, "failed")
 		};
 	}
+	if (!acquired.acquired) return {
+		ok: false,
+		result: await failBeforeActivation(run, /* @__PURE__ */ new Error(acquired.reason === "retry-not-eligible" ? `candidate execution retry is not eligible: ${acquired.detail}` : "candidate execution attempt is already claimed"), "replayed")
+	};
+	markPreparedCandidateClaimed(prepared);
+	const postRunWindowMs = candidatePostRunWindowMs(cleanupTimeoutMs, resultTimeoutMs);
+	const deadlineAtMs = acquired.claim.leaseExpiresAtMs - candidatePostRunWindowMs(state.cleanupTimeoutMs, state.resultTimeoutMs);
+	const requiredLeaseExpiry = deadlineAtMs + postRunWindowMs;
+	if (Date.now() >= deadlineAtMs || deadlineAtMs > state.reservationExpiresAtMs || requiredLeaseExpiry > acquired.lease.expiresAtMs) return {
+		ok: false,
+		result: await failClaimedExecution(run, acquired.lease, /* @__PURE__ */ new Error("candidate claim no longer covers its full execution and cleanup window"), "pre-model-infrastructure")
+	};
+	return {
+		ok: true,
+		value: {
+			acquired,
+			deadlineAtMs
+		}
+	};
 }
-async function settleModelGrant(state, reason, cleanupDeadlineAtMs) {
+/** Activate model and memory access, build the executor request, and persist that it may run. */
+async function activateAccess(run, claimed) {
+	const { prepared, state, cleanupTimeoutMs } = run;
+	const { acquired, deadlineAtMs } = claimed;
+	const fail = async (error, failureClass, access) => ({
+		ok: false,
+		result: await failClaimedExecution(run, acquired.lease, error, failureClass, access)
+	});
+	let activation;
 	try {
-		return { settlement: sealAgentCandidateModelSettlement(await withinCandidateCleanupDeadline(() => state.ports.models.settleGrant({
+		const activated = await withinCandidateCleanupDeadline(() => state.ports.models.activateGrant({
 			executionId: state.executionId,
 			preparationId: state.preparationId,
 			grantDigest: state.modelReservation.digest,
 			resolved: state.resolvedModel,
-			reason
-		}), cleanupDeadlineAtMs, "protected model settlement"), {
-			preparationId: state.preparationId,
-			grantDigest: state.modelReservation.digest,
-			model: state.resolvedModel.model
-		}) };
+			deadlineAtMs
+		}), Math.min(deadlineAtMs, candidateCleanupDeadline(cleanupTimeoutMs)), "protected model activation");
+		activation = Object.freeze({ env: Object.freeze({ ...activated.env }) });
 	} catch (error) {
-		return { error: new Error("protected model settlement failed", { cause: error }) };
+		return fail(new Error("protected model activation failed", { cause: error }), "pre-model-infrastructure");
+	}
+	let memoryActivation;
+	if (state.memory.mode === "isolated") try {
+		const reservation = state.memoryReservation;
+		if (!reservation) throw new Error("isolated memory reservation is missing");
+		const activated = await withinCandidateCleanupDeadline(() => state.ports.memory.activate({
+			executionId: state.executionId,
+			preparationId: reservation.preparationId,
+			accessDigest: reservation.accessDigest,
+			effectiveNamespace: reservation.effectiveNamespace,
+			deadlineAtMs
+		}), Math.min(deadlineAtMs, candidateCleanupDeadline(cleanupTimeoutMs)), "isolated memory activation");
+		memoryActivation = Object.freeze({ env: Object.freeze({ ...activated.env }) });
+	} catch (error) {
+		return fail(new Error("isolated memory activation failed", { cause: error }), "pre-model-infrastructure", { activation });
+	}
+	const access = {
+		activation,
+		memoryActivation
+	};
+	let request;
+	try {
+		request = beginPreparedCandidateRun(prepared, activation, memoryActivation).request;
+	} catch (error) {
+		return fail(error, "pre-model-infrastructure", access);
+	}
+	try {
+		if ((await run.claimStore.markCandidateMayRun(acquired.lease)).phase !== "candidate-may-run") throw new Error("candidate claim did not persist the candidate-may-run phase");
+	} catch (error) {
+		return fail(new Error("candidate execution phase persistence failed", { cause: error }), "pre-model-infrastructure", access);
+	}
+	if (Date.now() >= deadlineAtMs) return fail(/* @__PURE__ */ new Error("candidate execution deadline elapsed while persisting its launch phase"), "unknown", access);
+	return {
+		ok: true,
+		value: {
+			...access,
+			request
+		}
+	};
+}
+/** Run the executor, prove its process stopped, and close and settle the protected access. */
+async function runAndSettle(run, options, claimed, launchable) {
+	const { prepared, state, cleanupTimeoutMs } = run;
+	const protectedValues = protectedEnvironmentValues(launchable.activation, launchable.memoryActivation);
+	const protectedTrace = createProtectedAgentCandidateTraceAccess(options.traceStore, protectedValues);
+	const persistedTrace = protectedTrace.identity(state.trace);
+	const execution = await runAndStopExecutor(options.executor, launchable.request, state.benchmarkTask.outcome, protectedTrace.store, claimed.deadlineAtMs, cleanupTimeoutMs);
+	beginPreparedCandidateSettlement(prepared);
+	const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs);
+	const accessReason = execution.kind === "timeout" || execution.termination?.kind === "timeout" ? "timeout" : execution.kind === "capture" ? "completed" : "failed";
+	const traceClosure = withinCandidateCleanupDeadline(() => protectedTrace.closeWrites(), cleanupDeadlineAtMs, "candidate trace write closure").then(() => ({
+		closed: true,
+		error: void 0
+	}), (error) => ({
+		closed: false,
+		error
+	}));
+	const [traceClose, memoryClose, settlementResult] = await Promise.all([
+		traceClosure,
+		closeMemoryAccess(state, accessReason, cleanupDeadlineAtMs),
+		settleModelGrant(state, accessReason, cleanupDeadlineAtMs)
+	]);
+	if (!execution.processStopped || !traceClose.closed || !settlementResult.settlement || !memoryClose.closed) {
+		consumePreparedCandidateExecution(prepared, "failed");
+		return {
+			ok: false,
+			result: failedAgentCandidateRun(state, redactProtectedReason(joinErrors(execution.error, !execution.processStopped ? /* @__PURE__ */ new Error("candidate process termination is not proven") : void 0, traceClose.error, memoryClose.error, settlementResult.error ?? (!settlementResult.settlement ? /* @__PURE__ */ new Error("model settlement failed") : void 0), /* @__PURE__ */ new Error("candidate claim remains recoverable until protected cleanup is proven")), protectedValues), execution.termination, settlementResult.settlement?.usage ?? null)
+		};
 	}
+	return {
+		ok: true,
+		value: {
+			execution,
+			settlement: settlementResult.settlement,
+			protectedValues,
+			persistedTrace,
+			protectedTrace
+		}
+	};
 }
-async function finishClaim(store, lease, terminal, deadlineAtMs) {
+/** Verify and grade the captured evidence into the run's result; a failure is a failed run. */
+async function finalizeEvidence(run, options, claimed, settled, modelSettlement) {
+	const { state, cleanupTimeoutMs, resultTimeoutMs } = run;
+	const { execution, settlement, protectedValues, persistedTrace, protectedTrace } = settled;
+	if (execution.kind === "error") return failedAgentCandidateRun(state, redactProtectedReason(errorMessage(execution.error), protectedValues), execution.termination, settlement.usage);
+	if (!execution.finalCapture.taskOutcome) return failedAgentCandidateRun(state, "candidate executor stopped without a captured task outcome", execution.termination, settlement.usage);
+	const capture = execution.kind === "capture" ? execution.capture : {
+		executionId: state.executionId,
+		termination: execution.termination
+	};
 	try {
-		const staged = await withinCandidateCleanupDeadline(() => store.stageTerminal(lease, terminal), deadlineAtMs ?? lease.expiresAtMs, "candidate terminal staging");
-		if (!staged.staged && !staged.exactReplay) return false;
-		const result = await withinCandidateCleanupDeadline(() => store.finish(lease, staged.terminal.terminalDigest), deadlineAtMs ?? lease.expiresAtMs, "candidate terminal publication");
-		return result.finished || result.exactReplay;
-	} catch {
-		return false;
+		return await withinCandidateResultDeadline(async (signal) => {
+			await appendAuthoritativeModelSettlementSpans(options.traceStore, persistedTrace.runId, settlement);
+			const { persistedCapture, taskOutcome } = await persistVerifiedAgentCandidateExecutorCapture(state, execution.finalCapture, options.outputArtifacts, protectedValues, signal);
+			const benchmarkResult = await persistCandidateBenchmarkResult(state, capture.termination, taskOutcome, options.grader, options.outputArtifacts, protectedValues, signal);
+			return await finalizeAgentCandidateRun(state, capture, options.traceStore, persistedTrace, settlement, {
+				finalCapture: execution.finalCapture,
+				persistedCapture,
+				modelSettlement,
+				taskOutcome,
+				benchmarkResult,
+				outputArtifacts: options.outputArtifacts
+			}, protectedValues, protectedTrace.report(), signal);
+		}, Math.min(Date.now() + resultTimeoutMs, claimed.acquired.lease.expiresAtMs - candidateTerminalWindowMs(cleanupTimeoutMs)), "candidate evidence finalization");
+	} catch (error) {
+		return failedAgentCandidateRun(state, redactProtectedReason(errorMessage(error), protectedValues), execution.termination, settlement.usage);
 	}
 }
-function protectedEnvironmentValues(activation, memoryActivation) {
-	return [...Object.values(activation?.env ?? {}), ...Object.values(memoryActivation?.env ?? {})];
+//#endregion
+//#region src/candidate-execution/prepare-plan.ts
+/**
+* The evaluator-owned documents of a preparation: the launch environment, the execution plan,
+* the materialization receipt, and the trace bindings that tie a run back to them.
+*/
+/** The public environment: the candidate's own, the profile's, and the evaluator's path bindings. */
+function launchEnvironment(candidate, profile, knowledgePaths) {
+	const { execution } = candidate.bundle;
+	const { agentPaths } = profile;
+	return mergePublicEnvironment(execution.env ?? {}, profile.application.env, agentPaths ? {
+		[PI_CANDIDATE_AGENT_DIR_ENV]: {
+			kind: "public",
+			value: agentPaths.agentDir
+		},
+		[PI_CANDIDATE_SESSION_DIR_ENV]: {
+			kind: "public",
+			value: agentPaths.sessionDir
+		}
+	} : {}, execution.instructionDelivery.kind === "utf8-file" ? { [execution.instructionDelivery.env]: {
+		kind: "public",
+		value: execution.instructionDelivery.path
+	} } : {}, knowledgePaths ? {
+		[CANDIDATE_KNOWLEDGE_ROOT_ENV]: {
+			kind: "public",
+			value: knowledgePaths.root
+		},
+		...knowledgePaths.retrievalConfig ? { [CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV]: {
+			kind: "public",
+			value: knowledgePaths.retrievalConfig
+		} } : {}
+	} : {});
 }
-function joinErrors(...errors) {
-	return errors.filter((error) => error !== void 0).map(errorMessage).join("; ");
+/** The plan material for one execution: workspaces, profile, model access, launch and memory. */
+function executionPlanMaterial(input) {
+	const { candidate, task } = input;
+	const { bundle } = candidate;
+	return {
+		kind: "agent-candidate-execution-plan-material",
+		runCell: task.runCell,
+		executionId: task.executionId,
+		workspaces: {
+			taskRoot: task.executionRoots.taskRoot,
+			...task.executionRoots.candidateRoot ? { candidateRoot: task.executionRoots.candidateRoot } : {}
+		},
+		codeKind: bundle.code.kind,
+		...bundle.execution.workspace ? { candidateWorkspace: bundle.execution.workspace } : {},
+		profile: input.profile.application.application,
+		harness: bundle.execution.harness,
+		harnessVersion: bundle.execution.harnessVersion,
+		instructionDelivery: bundle.execution.instructionDelivery,
+		limits: task.task.limits,
+		container: input.container,
+		model: {
+			policy: "single",
+			resolved: input.resolvedModel,
+			access: {
+				kind: "evaluator-mediated",
+				grantDigest: input.modelReservation.digest,
+				network: input.modelReservation.network
+			},
+			routes: modelRoutes(bundle.profile, task.task.model.requested)
+		},
+		launch: {
+			executable: input.launch.executable,
+			args: input.launch.args,
+			env: input.publicEnv,
+			cwd: bundle.execution.cwd
+		},
+		...bundle.knowledge ? { knowledgeManifestDigest: bundle.knowledge.snapshot.digest } : {},
+		memory: input.memory,
+		network: { mode: "disabled" }
+	};
 }
-var CandidateExecutionDeadlineError = class extends Error {
-	constructor(timeoutMs) {
-		super(`candidate execution reached its frozen ${timeoutMs}ms deadline`);
-		this.name = "CandidateExecutionDeadlineError";
+/** Check and canonically serialize the plan material into the plan's evidence. */
+function sealExecutionPlan(material) {
+	agentCandidateExecutionPlanMaterialSchema.parse(material);
+	const bytes = canonicalCandidateBytes$1(material);
+	const digest = canonicalCandidateDigest$1(material);
+	if (sha256Bytes$1(bytes) !== digest) throw new Error("execution plan canonical serializers disagree");
+	return {
+		evidence: agentCandidateExecutionPlanEvidenceSchema.parse({
+			kind: "agent-candidate-execution-plan",
+			digest,
+			material,
+			artifact: embeddedCandidateArtifact(bytes)
+		}),
+		bytes
+	};
+}
+/** The receipt that binds the bundle, the benchmark task, and the sealed plan together. */
+function sealMaterializationReceipt(input) {
+	const { candidate, task } = input;
+	const { bundle } = candidate;
+	const benchmarkTask = task.task;
+	const entrypoint = candidateEntrypointReceipt(candidate);
+	const materializationReceipt = canonicalCandidateDocument({
+		kind: "agent-candidate-materialization",
+		digestAlgorithm: "rfc8785-sha256",
+		bundleDigest: bundle.digest,
+		benchmark: {
+			suite: {
+				digest: task.benchmarkSuite.digest,
+				material: embeddedCandidateArtifact(canonicalCandidateBytes$1(omitTopLevelDigest(task.benchmarkSuite)))
+			},
+			task: {
+				digest: benchmarkTask.digest,
+				material: embeddedCandidateArtifact(canonicalCandidateBytes$1(omitTopLevelDigest(benchmarkTask)))
+			}
+		},
+		profileActivation: input.profile.application.profileActivation,
+		executionPlan: input.executionPlan,
+		...bundle.execution.workspace ? { candidateWorkspace: bundle.execution.workspace } : {},
+		codeKind: bundle.code.kind,
+		...candidate.materializedTree ? { materializedTree: candidate.materializedTree } : {},
+		harness: bundle.execution.harness,
+		harnessVersion: bundle.execution.harnessVersion,
+		container: input.container,
+		resolvedModel: input.resolvedModel,
+		...bundle.knowledge ? { knowledgeManifestDigest: bundle.knowledge.snapshot.digest } : {},
+		...entrypoint ? { entrypoint } : {}
+	});
+	agentCandidateMaterializationReceiptSchema.parse(materializationReceipt.value);
+	return materializationReceipt;
+}
+/** The run id, tags and environment that tie a trace to this execution's sealed documents. */
+function candidateTraceBindings(input) {
+	const { task, bundleDigest, executionPlanDigest, materializationReceiptDigest } = input;
+	const runId = `${task.executionId}:attempt-${input.attemptNumber}:${canonicalCandidateDigest$1({ preparationId: input.preparationId }).slice(7, 23)}`;
+	const tags = {
+		[CANDIDATE_TRACE_TAGS.executionId]: task.executionId,
+		[CANDIDATE_TRACE_TAGS.bundleDigest]: bundleDigest,
+		[CANDIDATE_TRACE_TAGS.executionPlanDigest]: executionPlanDigest,
+		[CANDIDATE_TRACE_TAGS.materializationReceiptDigest]: materializationReceiptDigest
+	};
+	const env = {
+		[CANDIDATE_TRACE_ENV.executionId]: task.executionId,
+		[CANDIDATE_TRACE_ENV.bundleDigest]: bundleDigest,
+		[CANDIDATE_TRACE_ENV.executionPlanDigest]: executionPlanDigest,
+		[CANDIDATE_TRACE_ENV.materializationReceiptDigest]: materializationReceiptDigest,
+		[CANDIDATE_TRACE_ENV.traceRunId]: runId
+	};
+	assertEnvironmentDisjoint(input.publicEnv, env);
+	return {
+		runId,
+		tags,
+		env
+	};
+}
+function unwrapPublicEnvironment(values) {
+	return Object.fromEntries(Object.entries(values).map(([name, value]) => [name, requirePublicCandidateConfigValue(value, `env.${name}`)]));
+}
+function mergePublicEnvironment(...records) {
+	const output = {};
+	for (const record of records) for (const [name, value] of Object.entries(record)) {
+		const previous = output[name];
+		const publicValue = requirePublicCandidateConfigValue(value, `env.${name}`);
+		if (previous && requirePublicCandidateConfigValue(previous, `env.${name}`) !== publicValue) throw new Error(`candidate and profile environment disagree on ${name}`);
+		output[name] = value;
 	}
-};
+	return output;
+}
+function assertEnvironmentDisjoint(publicEnv, traceEnv) {
+	const seen = new Set(Object.keys(publicEnv));
+	for (const name of Object.keys(traceEnv)) {
+		if (seen.has(name)) throw new Error(`evaluator environment binding collides with ${name}`);
+		seen.add(name);
+	}
+}
 //#endregion
-//#region src/candidate-execution/prepare.ts
-const MIN_RESERVATION_TTL_MS = 15 * 6e4;
-const PREPARED_HOLD_MARGIN_MS = 5 * 6e4;
-/** Materializes a verified candidate into one immutable evaluator-owned execution plan. */
-async function prepareAgentCandidateExecution(candidate, task, ports, options = {}) {
-	const cleanupTimeoutMs = candidateCleanupTimeout(options.cleanupTimeoutMs);
-	assertSameVerificationPorts(getVerifiedCandidateState(candidate).ports, ports);
-	const bundle = candidate.bundle;
-	if (task.runCell.bundleDigest !== bundle.digest) throw new Error("candidate experiment cell does not bind the verified bundle");
+//#region src/candidate-execution/prepare-workspaces.ts
+/**
+* The three host staging roots of a preparation: the task workspace, the candidate workspace,
+* and the profile workspace, each materialized and verified against its signed material.
+*/
+async function materializeTaskWorkspace(task, ports) {
 	const benchmarkTask = task.task;
-	const attempt = {
-		number: task.runCell.attempt,
-		maxAttempts: benchmarkTask.attempt.maxAttempts,
-		retryPolicy: benchmarkTask.attempt.retryPolicy
-	};
-	assertTaskInput(task, bundle.execution.instructionDelivery);
-	const resultTimeoutMs = candidateResultTimeout(options.resultTimeoutMs, benchmarkTask.limits.timeoutMs);
-	const reservationWindowMs = candidateExecutionOwnerWindowMs(benchmarkTask.limits.timeoutMs, cleanupTimeoutMs, resultTimeoutMs) + PREPARED_HOLD_MARGIN_MS;
-	if (reservationWindowMs > 2147483647) throw new Error("candidate reservation window exceeds the supported timer range");
-	assertDisjointHostStagingRoots(task);
-	const instructionBytes = Buffer.from(benchmarkTask.instruction, "utf8");
 	const taskArtifacts = await verifyWorkspaceSnapshotArtifacts(benchmarkTask.workspace, ports.artifacts);
 	await ports.workspaces.materialize({
 		role: "task",
@@ -3615,23 +3884,31 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
 	});
 	await verifyMaterializedWorkspace(task.stagingRoots.taskRoot, benchmarkTask.workspace.material, { ignoredProtectedRootEntries: [".git", ".sidecar"] });
 	if (benchmarkTask.repository) await verifyTaskCheckout(task.stagingRoots.taskRoot, benchmarkTask.repository);
-	const taskExecutorFiles = await readMaterializedWorkspaceFiles(task.stagingRoots.taskRoot, benchmarkTask.workspace.material, { ignoredProtectedRootEntries: [".git", ".sidecar"] });
-	let candidateArchive;
-	let candidateExecutorFiles;
-	if (bundle.execution.workspace) {
-		if (!task.stagingRoots.candidateRoot || !task.executionRoots.candidateRoot) throw new Error("active candidate execution requires host and container candidate roots");
-		candidateArchive = await verifiedArtifactBytes(candidate, bundle.execution.workspace.archive);
-		await ports.workspaces.materialize({
-			role: "candidate",
-			snapshot: bundle.execution.workspace,
-			archive: candidateArchive,
-			destination: task.stagingRoots.candidateRoot
-		});
-		await verifyMaterializedWorkspace(task.stagingRoots.candidateRoot, bundle.execution.workspace.material);
-		candidateExecutorFiles = await readMaterializedWorkspaceFiles(task.stagingRoots.candidateRoot, bundle.execution.workspace.material);
-	} else if (task.stagingRoots.candidateRoot || task.executionRoots.candidateRoot) throw new Error("disabled code cannot receive a candidate workspace root");
+	return readMaterializedWorkspaceFiles(task.stagingRoots.taskRoot, benchmarkTask.workspace.material, { ignoredProtectedRootEntries: [".git", ".sidecar"] });
+}
+/** The candidate's own workspace files, or undefined when its code is disabled. */
+async function materializeCandidateWorkspace(candidate, task, ports) {
+	const workspace = candidate.bundle.execution.workspace;
+	if (!workspace) {
+		if (task.stagingRoots.candidateRoot || task.executionRoots.candidateRoot) throw new Error("disabled code cannot receive a candidate workspace root");
+		return;
+	}
+	if (!task.stagingRoots.candidateRoot || !task.executionRoots.candidateRoot) throw new Error("active candidate execution requires host and container candidate roots");
+	const archive = await verifiedArtifactBytes(candidate, workspace.archive);
+	await ports.workspaces.materialize({
+		role: "candidate",
+		snapshot: workspace,
+		archive,
+		destination: task.stagingRoots.candidateRoot
+	});
+	await verifyMaterializedWorkspace(task.stagingRoots.candidateRoot, workspace.material);
+	return readMaterializedWorkspaceFiles(task.stagingRoots.candidateRoot, workspace.material);
+}
+/** Materialize the profile into its empty staging root and check the plan's exact bytes. */
+async function stageCandidateProfile(candidate, task, ports) {
+	const { bundle } = candidate;
 	await assertEmptyDirectory(task.stagingRoots.profileRoot);
-	const profileWorkspacePlan = materializeAgentCandidateProfilePlan({
+	const workspacePlan = materializeAgentCandidateProfilePlan({
 		profile: bundle.profile,
 		harness: bundle.execution.harness,
 		launch: bundle.execution.launch,
@@ -3642,22 +3919,46 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
 		},
 		resolvedResources: verifiedResourceTextByDigest(candidate)
 	});
-	const profileAgentPaths = candidateProfileAgentPaths(profileWorkspacePlan, task.executionRoots.profileRoot);
-	const profileAgentStagingRoot = profileWorkspacePlan.files.some((file) => file.root === "agent") ? await mkdtemp(join(tmpdir(), "tangle-candidate-profile-agent-")) : void 0;
-	let profileApplication;
+	const agentPaths = candidateProfileAgentPaths(workspacePlan, task.executionRoots.profileRoot);
+	const agentStagingRoot = workspacePlan.files.some((file) => file.root === "agent") ? await mkdtemp(join(tmpdir(), "tangle-candidate-profile-agent-")) : void 0;
+	let application;
 	try {
-		profileApplication = applyAgentCandidateWorkspacePlan(profileWorkspacePlan, task.stagingRoots.profileRoot, bundle.execution.cwd.workspace, profileAgentStagingRoot ? { agentDir: profileAgentStagingRoot } : void 0);
-		await verifyMaterializedProfileWorkspace(task.stagingRoots.profileRoot, profileApplication.profileActivation.profilePlan.material);
-		if (profileAgentStagingRoot) await verifyMaterializedProfileWorkspace(profileAgentStagingRoot, profileApplication.profileActivation.profilePlan.material, "agent");
+		application = applyAgentCandidateWorkspacePlan(workspacePlan, task.stagingRoots.profileRoot, bundle.execution.cwd.workspace, agentStagingRoot ? { agentDir: agentStagingRoot } : void 0);
+		await verifyMaterializedProfileWorkspace(task.stagingRoots.profileRoot, application.profileActivation.profilePlan.material);
+		if (agentStagingRoot) await verifyMaterializedProfileWorkspace(agentStagingRoot, application.profileActivation.profilePlan.material, "agent");
 	} finally {
-		if (profileAgentStagingRoot) await rm(profileAgentStagingRoot, {
+		if (agentStagingRoot) await rm(agentStagingRoot, {
 			recursive: true,
 			force: true
 		});
 	}
-	const profilePlanBytes = await readVerifiedArtifact(profileApplication.profileActivation.profilePlan.artifact, ports.artifacts);
-	if (!Buffer.from(profilePlanBytes).equals(Buffer.from(canonicalCandidateBytes$1(profileApplication.profileActivation.profilePlan.material)))) throw new Error("profile materializer did not capture exact canonical plan bytes");
-	const profileActivation = profileApplication.profileActivation;
+	const planBytes = await readVerifiedArtifact(application.profileActivation.profilePlan.artifact, ports.artifacts);
+	if (!Buffer.from(planBytes).equals(Buffer.from(canonicalCandidateBytes$1(application.profileActivation.profilePlan.material)))) throw new Error("profile materializer did not capture exact canonical plan bytes");
+	return {
+		workspacePlan,
+		agentPaths,
+		application,
+		planBytes
+	};
+}
+async function assertEmptyDirectory(path) {
+	const stats = await lstat(path);
+	if (!stats.isDirectory() || stats.isSymbolicLink()) throw new Error("profile staging root must be a real directory");
+	if ((await readdir(path)).length !== 0) throw new Error("profile staging root must be empty before materialization");
+}
+//#endregion
+//#region src/candidate-execution/prepare.ts
+const MIN_RESERVATION_TTL_MS = 15 * 6e4;
+const PREPARED_HOLD_MARGIN_MS = 5 * 6e4;
+/** Materializes a verified candidate into one immutable evaluator-owned execution plan. */
+async function prepareAgentCandidateExecution(candidate, task, ports, options = {}) {
+	const { cleanupTimeoutMs, resultTimeoutMs, reservationWindowMs } = checkPreparation(candidate, task, ports, options);
+	const bundle = candidate.bundle;
+	const benchmarkTask = task.task;
+	const instructionBytes = Buffer.from(benchmarkTask.instruction, "utf8");
+	const taskExecutorFiles = await materializeTaskWorkspace(task, ports);
+	const candidateExecutorFiles = await materializeCandidateWorkspace(candidate, task, ports);
+	const profile = await stageCandidateProfile(candidate, task, ports);
 	const container = await resolveContainer(candidate, task, ports);
 	const resolvedModel = await resolveModel(candidate, task, ports);
 	const preparationId = `candidate-preparation.${randomBytes(32).toString("base64url")}`;
@@ -3666,7 +3967,7 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
 		executionId: task.executionId,
 		preparationId,
 		expiresAtMs: reservationExpiresAtMs,
-		attempt,
+		attempt: attemptOf(task),
 		bundleDigest: bundle.digest,
 		resolved: resolvedModel,
 		limits: modelLimits(benchmarkTask.limits)
@@ -3675,221 +3976,160 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
 	try {
 		validateProtectedModelReservation(modelReservation, benchmarkTask.limits, preparationId, reservationExpiresAtMs);
 		preparedMemory = await prepareMemory(candidate, task, ports, preparationId, reservationExpiresAtMs, cleanupTimeoutMs);
-		const memory = preparedMemory.value;
-		const knowledge = await prepareAgentCandidateKnowledge(candidate, ports, task.runCell.arm);
-		const knowledgePaths = knowledge ? candidateKnowledgeExecutionPaths(task.executionRoots.taskRoot, knowledge.retrievalConfig !== void 0) : void 0;
-		const baseLaunch = buildLaunch(candidate, task, profileApplication.flags);
-		const publicEnv = mergePublicEnvironment(bundle.execution.env ?? {}, profileApplication.env, profileAgentPaths ? {
-			[PI_CANDIDATE_AGENT_DIR_ENV]: {
-				kind: "public",
-				value: profileAgentPaths.agentDir
-			},
-			[PI_CANDIDATE_SESSION_DIR_ENV]: {
-				kind: "public",
-				value: profileAgentPaths.sessionDir
-			}
-		} : {}, bundle.execution.instructionDelivery.kind === "utf8-file" ? { [bundle.execution.instructionDelivery.env]: {
-			kind: "public",
-			value: bundle.execution.instructionDelivery.path
-		} } : {}, knowledgePaths ? {
-			[CANDIDATE_KNOWLEDGE_ROOT_ENV]: {
-				kind: "public",
-				value: knowledgePaths.root
-			},
-			...knowledgePaths.retrievalConfig ? { [CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV]: {
-				kind: "public",
-				value: knowledgePaths.retrievalConfig
-			} } : {}
-		} : {});
-		const routes = modelRoutes(bundle.profile, benchmarkTask.model.requested);
-		const executionMaterial = {
-			kind: "agent-candidate-execution-plan-material",
-			runCell: task.runCell,
-			executionId: task.executionId,
-			workspaces: {
-				taskRoot: task.executionRoots.taskRoot,
-				...task.executionRoots.candidateRoot ? { candidateRoot: task.executionRoots.candidateRoot } : {}
-			},
-			codeKind: bundle.code.kind,
-			...bundle.execution.workspace ? { candidateWorkspace: bundle.execution.workspace } : {},
-			profile: profileApplication.application,
-			harness: bundle.execution.harness,
-			harnessVersion: bundle.execution.harnessVersion,
-			instructionDelivery: bundle.execution.instructionDelivery,
-			limits: benchmarkTask.limits,
-			container,
-			model: {
-				policy: "single",
-				resolved: resolvedModel,
-				access: {
-					kind: "evaluator-mediated",
-					grantDigest: modelReservation.digest,
-					network: modelReservation.network
-				},
-				routes
-			},
-			launch: {
-				executable: baseLaunch.executable,
-				args: baseLaunch.args,
-				env: publicEnv,
-				cwd: bundle.execution.cwd
-			},
-			...bundle.knowledge ? { knowledgeManifestDigest: bundle.knowledge.snapshot.digest } : {},
-			memory,
-			network: { mode: "disabled" }
-		};
-		agentCandidateExecutionPlanMaterialSchema.parse(executionMaterial);
-		const executionBytes = canonicalCandidateBytes$1(executionMaterial);
-		const executionDigest = canonicalCandidateDigest$1(executionMaterial);
-		if (sha256Bytes$1(executionBytes) !== executionDigest) throw new Error("execution plan canonical serializers disagree");
-		const executionPlan = agentCandidateExecutionPlanEvidenceSchema.parse({
-			kind: "agent-candidate-execution-plan",
-			digest: executionDigest,
-			material: executionMaterial,
-			artifact: embeddedCandidateArtifact(executionBytes)
-		});
-		const entrypoint = candidateEntrypointReceipt(candidate);
-		const materializationReceipt = canonicalCandidateDocument({
-			kind: "agent-candidate-materialization",
-			digestAlgorithm: "rfc8785-sha256",
-			bundleDigest: bundle.digest,
-			benchmark: {
-				suite: {
-					digest: task.benchmarkSuite.digest,
-					material: embeddedCandidateArtifact(canonicalCandidateBytes$1(omitTopLevelDigest(task.benchmarkSuite)))
-				},
-				task: {
-					digest: benchmarkTask.digest,
-					material: embeddedCandidateArtifact(canonicalCandidateBytes$1(omitTopLevelDigest(benchmarkTask)))
-				}
-			},
-			profileActivation,
-			executionPlan,
-			...bundle.execution.workspace ? { candidateWorkspace: bundle.execution.workspace } : {},
-			codeKind: bundle.code.kind,
-			...candidate.materializedTree ? { materializedTree: candidate.materializedTree } : {},
-			harness: bundle.execution.harness,
-			harnessVersion: bundle.execution.harnessVersion,
+		return await assemblePrepared({
+			candidate,
+			task,
+			ports,
+			cleanupTimeoutMs,
+			resultTimeoutMs,
+			taskExecutorFiles,
+			candidateExecutorFiles,
+			profile,
 			container,
 			resolvedModel,
-			...bundle.knowledge ? { knowledgeManifestDigest: bundle.knowledge.snapshot.digest } : {},
-			...entrypoint ? { entrypoint } : {}
+			preparationId,
+			reservationExpiresAtMs,
+			modelReservation,
+			preparedMemory,
+			instructionBytes
 		});
-		agentCandidateMaterializationReceiptSchema.parse(materializationReceipt.value);
-		const traceRunId = `${task.executionId}:attempt-${attempt.number}:${canonicalCandidateDigest$1({ preparationId }).slice(7, 23)}`;
-		const traceTags = {
-			[CANDIDATE_TRACE_TAGS.executionId]: task.executionId,
-			[CANDIDATE_TRACE_TAGS.bundleDigest]: bundle.digest,
-			[CANDIDATE_TRACE_TAGS.executionPlanDigest]: executionPlan.digest,
-			[CANDIDATE_TRACE_TAGS.materializationReceiptDigest]: materializationReceipt.digest
-		};
-		const traceEnv = {
-			[CANDIDATE_TRACE_ENV.executionId]: task.executionId,
-			[CANDIDATE_TRACE_ENV.bundleDigest]: bundle.digest,
-			[CANDIDATE_TRACE_ENV.executionPlanDigest]: executionPlan.digest,
-			[CANDIDATE_TRACE_ENV.materializationReceiptDigest]: materializationReceipt.digest,
-			[CANDIDATE_TRACE_ENV.traceRunId]: traceRunId
-		};
-		assertEnvironmentDisjoint(publicEnv, traceEnv);
-		return createPreparedCandidateExecution({
+	} catch (error) {
+		await cleanupFailedPreparation({
+			task,
 			ports,
-			bundle,
-			benchmarkSuite: task.benchmarkSuite,
-			benchmarkTask,
-			executionId: task.executionId,
-			roots: {
-				execution: { ...task.executionRoots },
-				staging: { ...task.stagingRoots }
-			},
-			profilePlan: {
-				value: profileApplication.profileActivation.profilePlan,
-				bytes: profilePlanBytes,
-				written: [...profileApplication.application.mountPaths]
-			},
-			profileActivation,
-			executionPlan: {
-				value: executionPlan,
-				bytes: executionBytes
-			},
-			materializationReceipt,
-			launch: {
-				executable: baseLaunch.executable,
-				args: baseLaunch.args.map((value, index) => requirePublicCandidateConfigValue(value, `launch.args[${index}]`)),
-				env: unwrapPublicEnvironment(publicEnv),
-				flags: profileApplication.flags.map((value, index) => requirePublicCandidateConfigValue(value, `profile.flags[${index}]`)),
-				cwd: absoluteExecutionCwd(bundle.execution.cwd, task.executionRoots)
-			},
-			instruction: {
-				bytes: Uint8Array.from(instructionBytes),
-				delivery: bundle.execution.instructionDelivery
-			},
-			resolvedModel,
 			preparationId,
-			reservationExpiresAtMs,
 			cleanupTimeoutMs,
-			resultTimeoutMs,
-			modelReservation: {
-				preparationId: modelReservation.preparationId,
-				digest: modelReservation.digest,
-				expiresAtMs: modelReservation.expiresAtMs,
-				enforcedLimits: modelReservation.enforcedLimits,
-				network: modelReservation.network
-			},
-			executorInputs: {
-				taskFiles: taskExecutorFiles,
-				...candidateExecutorFiles ? { candidateFiles: candidateExecutorFiles } : {},
-				profileFiles: exactProfileExecutorFiles(profileWorkspacePlan.files, profileApplication.profileActivation.profilePlan.material.files)
-			},
-			...preparedMemory.accessDigest && preparedMemory.value.mode === "isolated" ? { memoryReservation: {
-				preparationId,
+			modelGrantDigest: modelReservation.digest,
+			resolvedModel,
+			...preparedMemory?.value.mode === "isolated" ? { memory: {
 				accessDigest: preparedMemory.accessDigest,
-				expiresAtMs: reservationExpiresAtMs,
 				effectiveNamespace: preparedMemory.value.effectiveNamespace
-			} } : {},
-			...knowledge ? { knowledge } : {},
-			trace: {
-				runId: traceRunId,
-				tags: traceTags,
-				env: traceEnv
-			},
-			memory
-		});
-	} catch (error) {
-		const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs);
-		const cleanup = [];
-		if (preparedMemory?.value.mode === "isolated") {
-			const accessDigest = preparedMemory.accessDigest;
-			const effectiveNamespace = preparedMemory.value.effectiveNamespace;
-			if (!accessDigest) throw new Error("isolated memory preparation is missing access identity");
-			cleanup.push(withinCandidateCleanupDeadline(async () => {
-				const closed = await ports.memory.close({
-					executionId: task.executionId,
-					preparationId,
-					accessDigest,
-					effectiveNamespace,
-					reason: "preparation-failed"
-				});
-				if (closed.closed !== true || Object.keys(closed).some((key) => key !== "closed")) throw new Error("failed preparation did not close isolated memory access");
-			}, cleanupDeadlineAtMs, "failed preparation memory cleanup"));
-		}
-		cleanup.push(withinCandidateCleanupDeadline(async () => {
-			if (sealAgentCandidateModelSettlement(await ports.models.settleGrant({
-				executionId: task.executionId,
-				preparationId,
-				grantDigest: modelReservation.digest,
-				resolved: resolvedModel,
-				reason: "preparation-failed"
-			}), {
-				preparationId,
-				grantDigest: modelReservation.digest,
-				model: resolvedModel.model
-			}).usage.modelCalls !== 0) throw new Error("failed preparation unexpectedly contains model calls");
-		}, cleanupDeadlineAtMs, "failed preparation model cleanup"));
-		const cleanupErrors = (await Promise.allSettled(cleanup)).filter((result) => result.status === "rejected").map((result) => result.reason);
-		if (cleanupErrors.length > 0) throw new Error(`candidate preparation failed and protected access cleanup failed: ${cleanupErrors.map(errorMessage).join("; ")}`, { cause: error });
+			} } : {}
+		}, error);
 		throw error;
 	}
 }
+const attemptOf = (task) => ({
+	number: task.runCell.attempt,
+	maxAttempts: task.task.attempt.maxAttempts,
+	retryPolicy: task.task.attempt.retryPolicy
+});
+/** Check the call before any compute, and size its timeouts and reservation window. */
+function checkPreparation(candidate, task, ports, options) {
+	const cleanupTimeoutMs = candidateCleanupTimeout(options.cleanupTimeoutMs);
+	assertSameVerificationPorts(getVerifiedCandidateState(candidate).ports, ports);
+	const bundle = candidate.bundle;
+	if (task.runCell.bundleDigest !== bundle.digest) throw new Error("candidate experiment cell does not bind the verified bundle");
+	const benchmarkTask = task.task;
+	assertTaskInput(task, bundle.execution.instructionDelivery);
+	const resultTimeoutMs = candidateResultTimeout(options.resultTimeoutMs, benchmarkTask.limits.timeoutMs);
+	const reservationWindowMs = candidateExecutionOwnerWindowMs(benchmarkTask.limits.timeoutMs, cleanupTimeoutMs, resultTimeoutMs) + PREPARED_HOLD_MARGIN_MS;
+	if (reservationWindowMs > 2147483647) throw new Error("candidate reservation window exceeds the supported timer range");
+	assertDisjointHostStagingRoots(task);
+	return {
+		cleanupTimeoutMs,
+		resultTimeoutMs,
+		reservationWindowMs
+	};
+}
+/** Seal the plan and receipt over what the preparation staged and reserved, and freeze it. */
+async function assemblePrepared(hold) {
+	const { candidate, task, ports, profile, container, resolvedModel, preparedMemory } = hold;
+	const { bundle } = candidate;
+	const memory = preparedMemory.value;
+	const knowledge = await prepareAgentCandidateKnowledge(candidate, ports, task.runCell.arm);
+	const knowledgePaths = knowledge ? candidateKnowledgeExecutionPaths(task.executionRoots.taskRoot, knowledge.retrievalConfig !== void 0) : void 0;
+	const baseLaunch = buildLaunch(candidate, task, profile.application.flags);
+	const publicEnv = launchEnvironment(candidate, profile, knowledgePaths);
+	const executionPlan = sealExecutionPlan(executionPlanMaterial({
+		candidate,
+		task,
+		profile,
+		container,
+		resolvedModel,
+		modelReservation: hold.modelReservation,
+		launch: baseLaunch,
+		publicEnv,
+		memory
+	}));
+	const materializationReceipt = sealMaterializationReceipt({
+		candidate,
+		task,
+		profile,
+		executionPlan: executionPlan.evidence,
+		container,
+		resolvedModel
+	});
+	const trace = candidateTraceBindings({
+		task,
+		bundleDigest: bundle.digest,
+		attemptNumber: task.runCell.attempt,
+		preparationId: hold.preparationId,
+		executionPlanDigest: executionPlan.evidence.digest,
+		materializationReceiptDigest: materializationReceipt.digest,
+		publicEnv
+	});
+	const { modelReservation } = hold;
+	return createPreparedCandidateExecution({
+		ports,
+		bundle,
+		benchmarkSuite: task.benchmarkSuite,
+		benchmarkTask: task.task,
+		executionId: task.executionId,
+		roots: {
+			execution: { ...task.executionRoots },
+			staging: { ...task.stagingRoots }
+		},
+		profilePlan: {
+			value: profile.application.profileActivation.profilePlan,
+			bytes: profile.planBytes,
+			written: [...profile.application.application.mountPaths]
+		},
+		profileActivation: profile.application.profileActivation,
+		executionPlan: {
+			value: executionPlan.evidence,
+			bytes: executionPlan.bytes
+		},
+		materializationReceipt,
+		launch: {
+			executable: baseLaunch.executable,
+			args: baseLaunch.args.map((value, index) => requirePublicCandidateConfigValue(value, `launch.args[${index}]`)),
+			env: unwrapPublicEnvironment(publicEnv),
+			flags: profile.application.flags.map((value, index) => requirePublicCandidateConfigValue(value, `profile.flags[${index}]`)),
+			cwd: absoluteExecutionCwd(bundle.execution.cwd, task.executionRoots)
+		},
+		instruction: {
+			bytes: Uint8Array.from(hold.instructionBytes),
+			delivery: bundle.execution.instructionDelivery
+		},
+		resolvedModel,
+		preparationId: hold.preparationId,
+		reservationExpiresAtMs: hold.reservationExpiresAtMs,
+		cleanupTimeoutMs: hold.cleanupTimeoutMs,
+		resultTimeoutMs: hold.resultTimeoutMs,
+		modelReservation: {
+			preparationId: modelReservation.preparationId,
+			digest: modelReservation.digest,
+			expiresAtMs: modelReservation.expiresAtMs,
+			enforcedLimits: modelReservation.enforcedLimits,
+			network: modelReservation.network
+		},
+		executorInputs: {
+			taskFiles: hold.taskExecutorFiles,
+			...hold.candidateExecutorFiles ? { candidateFiles: hold.candidateExecutorFiles } : {},
+			profileFiles: exactProfileExecutorFiles(profile.workspacePlan.files, profile.application.profileActivation.profilePlan.material.files)
+		},
+		...preparedMemory.accessDigest && memory.mode === "isolated" ? { memoryReservation: {
+			preparationId: hold.preparationId,
+			accessDigest: preparedMemory.accessDigest,
+			expiresAtMs: hold.reservationExpiresAtMs,
+			effectiveNamespace: memory.effectiveNamespace
+		} } : {},
+		...knowledge ? { knowledge } : {},
+		trace,
+		memory
+	});
+}
 function assertSameVerificationPorts(verified, execution) {
 	if (verified.artifacts !== execution.artifacts || verified.repositories !== execution.repositories) throw new Error("prepare must use the same artifact and repository ports that verified the bundle");
 }
@@ -3970,11 +4210,6 @@ function isContainedPath(parent, child) {
 	const path = relative(parent, child);
 	return path !== "" && !path.startsWith("..") && !isAbsolute(path);
 }
-async function assertEmptyDirectory(path) {
-	const stats = await lstat(path);
-	if (!stats.isDirectory() || stats.isSymbolicLink()) throw new Error("profile staging root must be a real directory");
-	if ((await readdir(path)).length !== 0) throw new Error("profile staging root must be empty before materialization");
-}
 async function resolveContainer(candidate, task, ports) {
 	const environment = candidate.bundle.execution.environment;
 	const evaluatorTaskContainer = task.task.evaluatorTaskContainer;
@@ -4054,19 +4289,6 @@ async function prepareMemory(candidate, task, ports, preparationId, expiresAtMs,
 		throw error;
 	}
 }
-function mergePublicEnvironment(...records) {
-	const output = {};
-	for (const record of records) for (const [name, value] of Object.entries(record)) {
-		const previous = output[name];
-		const publicValue = requirePublicCandidateConfigValue(value, `env.${name}`);
-		if (previous && requirePublicCandidateConfigValue(previous, `env.${name}`) !== publicValue) throw new Error(`candidate and profile environment disagree on ${name}`);
-		output[name] = value;
-	}
-	return output;
-}
-function unwrapPublicEnvironment(values) {
-	return Object.fromEntries(Object.entries(values).map(([name, value]) => [name, requirePublicCandidateConfigValue(value, `env.${name}`)]));
-}
 function validateProtectedModelReservation(reservation, expectedLimits, preparationId, expiresAtMs) {
 	if (!/^sha256:[a-f0-9]{64}$/.test(reservation.digest)) throw new Error("protected model reservation has an invalid identity digest");
 	if (reservation.preparationId !== preparationId || reservation.expiresAtMs !== expiresAtMs) throw new Error("protected model reservation is not scoped to this preparation");
@@ -4075,14 +4297,45 @@ function validateProtectedModelReservation(reservation, expectedLimits, preparat
 	const expectedNetworkMode = limits.maxModelCalls === 0 ? "disabled" : "gateway-only";
 	if (agentCandidateModelAccessNetworkSchema.parse(reservation.network).mode !== expectedNetworkMode) throw new Error("protected model reservation has the wrong network policy for its call limit");
 }
-function assertEnvironmentDisjoint(publicEnv, traceEnv) {
-	const seen = new Set(Object.keys(publicEnv));
-	for (const name of Object.keys(traceEnv)) {
-		if (seen.has(name)) throw new Error(`evaluator environment binding collides with ${name}`);
-		seen.add(name);
+/**
+* Close the isolated memory and settle the model grant of a preparation that failed. Throws a
+* combined error, with `cause` set to the preparation's own, when a cleanup fails too.
+*/
+async function cleanupFailedPreparation(held, error) {
+	const { task, ports, preparationId, resolvedModel } = held;
+	const cleanupDeadlineAtMs = candidateCleanupDeadline(held.cleanupTimeoutMs);
+	const cleanup = [];
+	if (held.memory !== void 0) {
+		const { accessDigest, effectiveNamespace } = held.memory;
+		if (!accessDigest) throw new Error("isolated memory preparation is missing access identity");
+		cleanup.push(withinCandidateCleanupDeadline(async () => {
+			const closed = await ports.memory.close({
+				executionId: task.executionId,
+				preparationId,
+				accessDigest,
+				effectiveNamespace,
+				reason: "preparation-failed"
+			});
+			if (closed.closed !== true || Object.keys(closed).some((key) => key !== "closed")) throw new Error("failed preparation did not close isolated memory access");
+		}, cleanupDeadlineAtMs, "failed preparation memory cleanup"));
 	}
+	cleanup.push(withinCandidateCleanupDeadline(async () => {
+		if (sealAgentCandidateModelSettlement(await ports.models.settleGrant({
+			executionId: task.executionId,
+			preparationId,
+			grantDigest: held.modelGrantDigest,
+			resolved: resolvedModel,
+			reason: "preparation-failed"
+		}), {
+			preparationId,
+			grantDigest: held.modelGrantDigest,
+			model: resolvedModel.model
+		}).usage.modelCalls !== 0) throw new Error("failed preparation unexpectedly contains model calls");
+	}, cleanupDeadlineAtMs, "failed preparation model cleanup"));
+	const cleanupErrors = (await Promise.allSettled(cleanup)).filter((result) => result.status === "rejected").map((result) => result.reason);
+	if (cleanupErrors.length > 0) throw new Error(`candidate preparation failed and protected access cleanup failed: ${cleanupErrors.map(errorMessage).join("; ")}`, { cause: error });
 }
 //#endregion
 export { verifiedResourceTextByDigest as C, AGENT_CANDIDATE_EXECUTION_SUPPORT as S, sealTerminalDigest as _, consumePreparedCandidateExecution as a, sealAgentCandidateModelSettlement as b, withinCandidateCleanupDeadline as c, assertTerminalMatchesClaim as d, assertTerminalMatchesStaged as f, requireStagedTerminal as g, rejectedStage as h, beginPreparedCandidateDisposal as i, assertRecoveryMatchesStaged as l, rejectedFinish as m, executePreparedAgentCandidate as n, candidateClaimFileInternals as o, recoveredTerminalRecord as p, assertPreparedCandidateIntegrity as r, candidateCleanupDeadline as s, prepareAgentCandidateExecution as t, assertTerminalAllowedInPhase as u, terminalRecord as v, verifyAgentCandidateBundle as w, exactProcessProviderAsCandidateExecutor as x, createProtectedAgentCandidateModelPort as y };
 
-//# sourceMappingURL=prepare-FzJoS68l.js.map
+//# sourceMappingURL=prepare-C-cWCyt3.js.map