carthagent 0.0.0-stage → 1.0.7

package/docs/budgets.md

@@ -0,0 +1,72 @@
+# Session delivery budgets
+
+The delivery extension supports opt-in execution limits on Windows, macOS,
+Linux and WSL. These are agent orchestration controls, not a security sandbox
+or a dollar/token billing cap.
+
+Normal `ctg` launches accept `--max-tools`, `--max-seconds`, and `--max-repairs`
+for both TUI and headless mode. For example:
+
+```text
+node bin/ctg.mjs -p --max-tools 100 --max-seconds 900 --max-repairs 2 "Implement the requested change"
+```
+
+Invalid or missing values, and budget options combined with `--no-delivery`,
+fail before launching the engine. Use `/delivery-budget-status` to inspect
+usage, remaining allowance (null means unlimited), and stop reason without
+spending a tool call. The command displays a JSON status message.
+
+Alternatively launch the bundled engine directly with the extension and flags
+(from the repository root; works in PowerShell and POSIX shells):
+
+```text
+node vendor/agent/cli.js -e extensions/delivery.ts --delivery-max-tools 100 --delivery-max-seconds 900 --delivery-max-repairs 2
+```
+
+Each flag accepts an integer from 0 to 1000000. Zero disables that dimension;
+all default to zero. The existing maximum of two automatic repair nudges per
+user input still applies. The new repair limit additionally caps nudges over
+the entire budget, including across user follow-ups.
+
+- Tool calls count at admission, including status calls and subsequently blocked
+  calls. Exactly N calls may be admitted; the next attempt stops the agent.
+- Seconds measure wall time from budget creation, including idle time and time
+  while the process is closed. An active turn has a timer that requests abort
+  even if no tools are invoked. An idle expired session stops on its next run.
+- Repair rounds count automatic delivery follow-ups, not arbitrary model turns.
+- Limits and counters are stored as session entries independently of plans.
+  Replanning, input, compaction and same-session tree navigation do not reset
+  them. Restoration reads all session entries, not only the selected branch.
+  Existing saved limits remain authoritative until reset.
+
+When exhausted, the extension blocks tools, requests engine abort, suppresses
+repair follow-ups, and emits a `delivery-budget-stop` JSON message containing
+its reason, counters, requirements and last recorded evidence. That evidence
+is a snapshot, **not a fresh verification**. The delivery report is not falsely
+marked verified or overwritten; unfinished work remains unfinished.
+
+To authorize more work, explicitly run `/delivery-budget-reset` while the agent
+is idle. In headless mode a command-only invocation on a previously failed
+session may still exit 1 because the engine prints its last assistant error;
+the command's persisted reset is applied. Our offline subprocess regression
+checks the saved reset and subsequent tool execution rather than treating that
+exit code as proof that reset failed. It creates a fresh budget using the current launch flags. This is a
+user command, not a model tool. A genuinely new session also starts a new budget.
+Separate processes/sessions do not share a workspace-wide quota, and deliberate
+session-file edits or extension removal can bypass the limits.
+
+Cancellation is cooperative: engine/provider/tools must honor abort signals.
+Detached subprocesses, uninterruptible synchronous code, and requests already
+billed by a provider cannot be undone. Time limits are not hard OS process
+termination deadlines. No paid-provider cancellation guarantee is implied.
+
+The bundled engine's headless print-mode finalizer also destroys its captured
+Undici dispatcher, but only if that dispatcher is still the process-global
+dispatcher. This releases sockets left open by aborted provider requests without
+destroying a dispatcher that another runtime installed later. After refreshing the
+vendored engine, run `node tools/patch-print-shutdown.mjs`; the patcher fails
+closed if the expected print-mode anchors have changed.
+
+Native Windows/macOS/Linux CI runs the regression suite on Node 22 and 24;
+WSL is validated separately locally. This does not establish every terminal,
+OS version, browser or processor architecture as tested.

package/docs/compaction.md

@@ -0,0 +1,34 @@
+# Bounded context compaction
+
+Both vendored engine compaction paths use `vendor/agent/bounded-summary.mjs`.
+After refreshing the engine bundle, run `node tools/patch-compaction.mjs`. The
+patcher validates its anchors and fails rather than guessing at changed code.
+
+Compaction starts at the earlier of 70% of the context window or the configured
+reserve boundary. Context estimates take the maximum of usage-based tokens and
+serialized UTF-8 bytes divided by four, including when cache usage is available.
+This is conservative for the managed gateway, whose current catalog advertises
+its serialized byte cap divided by four as the usable context window.
+
+Summary requests use half the catalog-derived byte cap (or half an explicit
+`maxRequestBytes`, if stricter), measured against their serialized context.
+The remaining space allows for transport encoding, provider fields, and output.
+This is a conservative bound, not an exact tokenizer or wire-payload measurement.
+Provider size rejections halve the budget and retry with smaller fragments.
+
+Oversized history is split at Unicode-safe boundaries. Every fragment includes
+instructions to preserve constraints, paths, unresolved failures, and next steps.
+Ordered fragment summaries are recursively combined into one checkpoint. No raw
+history is silently truncated. Prior summaries and custom instructions are part
+of the input being reduced. Each subrequest has a distinct session/operation seed;
+all returned usage is accumulated. Output is capped at 4096 tokens per request.
+
+Aborts, non-size failures, empty/tool-call/truncated responses, non-converging
+reduction, and the 128-request/eight-level limits fail compaction rather than
+persisting an incomplete checkpoint. The UI labels this as a failure, not success.
+There is no guarantee of lossless semantic compression: summaries remain model
+generated. Tests use deterministic transports and cover bytes, chunk coverage,
+adaptive rejection recovery, cancellation, failure states, and UI notices.
+
+Restart CTG after updating to load the new engine and UI. Existing session logs
+and working files are not rewritten by this update.

package/docs/context-efficiency-plan.md

@@ -0,0 +1,24 @@
+# Context efficiency implementation plan
+
+Saved before implementation. Based on nine-cell v4 evidence: five harness cells exceeded the local input-byte envelope; one hit output length. Preserve all v1–v4 evidence. No paid benchmark rerun or production repository change is authorized by this implementation stage.
+
+## Boundaries and invariants
+
+1. `lib/delivery-context.mjs` pure projections own compact recovery/status/review receipts, byte accounting and conservative history selection. They cannot mutate lifecycle, acceptance, checks, evidence or approval. Exact active acceptance text, validator argv, outputs, progress and all unresolved blockers remain in recovery; size is measured, never silently trimmed to a hard cap.
+2. Extension owns archive persistence and event integration. Superseded successful **delivery-only, fully paired** tool turns can become archive receipts in outbound context; original session/report are untouched. Failed results, user messages, mixed coding batches, incomplete pairing, and recent delivery turns remain verbatim. Do not archive captures during pending design review. Receipts link to immutable content-addressed archives; archive failure retains original messages.
+3. Compact normal status and review responses stop serializing nested planning history/capture/revisions. Inspection must remain available in full; large inspection output must have a real complete artifact, not the current misleading generic truncation notice. Reading/semantic review remains model-authored. Any paging is explicit, with digest/source/capture identity retained; large captures are not considered read because a pointer exists.
+4. Compaction integration uses pi's documented lifecycle, not a second summarizer. Refresh active run before restoring a deterministic recovery record. No model summary can create approval, erase blockers or certify freshness. Do not silently enable paid compaction or override user settings. Add explicit pressure advice/telemetry and document conservative native compaction settings; automatic byte-triggered compaction remains gated on tested engine support.
+5. Metrics contain numeric category byte counts (system/schema/messages/reasoning/tool classes), no message bodies. Token estimates are labeled estimates, not tokenizer guarantees. A useful large-fixture test must show meaningful reduction while retaining exact obligations.
+
+## Challenges and validation before delivery
+
+- Restore after compaction, revision, source edits and branch switching: approval still locked when stale; exact validators/acceptance/outputs and failed evidence remain visible.
+- Old tool-call batches: never orphan IDs or merge tool results across user messages; preserve every failed result. Retained provider reasoning signatures untouched; archived whole turns remove their replay metadata together.
+- Full capture >48KB: parseable response, real retrievable archive, no mutation of capture, missing sections explicitly disclosed. Small-capture compatibility retained.
+- Archive corruption/symlinks/write failure fail conservatively; do not prune data without a verified archive. Session files and reports remain unchanged by projection.
+- Metric category totals, multibyte strings, no prompt/key leakage. Context pressure must not initiate paid retries/compaction unexpectedly.
+- Pure tests + real extension integration + repository quality; benchmark manifests and historic result documents remain preserved. No benchmark superiority claim from synthetic byte savings.
+
+## Subsequent repository benchmark design
+
+After implementation, design a preregistered suite, not tasks selected because baseline pi failed. Use realistic feature additions across pinned existing repositories: authorization/migrations, cross-layer optimistic updates, third-party API integration, background jobs and compatibility changes. Separate offline hermetic and authorized online documentation tracks. Specify pristine base SHAs, dependencies/services, network rules, protected tests, held-out probes, paired budgets, common compaction settings and >=3 repetitions. Include old/new harness ablation and Jev separately. Publish development pilots separately from untouched test tasks. Actual expensive runs require a separate frozen manifest and cost authorization.

package/docs/context-efficiency-review.md

@@ -0,0 +1,27 @@
+# Context-efficiency author review and validation
+
+This is an **author review**, not independent approval.
+
+## Challenged risks and dispositions
+
+1. **Summaries laundering authorization:** recovery is a read-only projection with explicit non-authority text; existing `planningStatus`/tool gate still fingerprints source and binds run/revision/digest. Extension regression changes source after approval and emits compaction notification: mutation remains blocked.
+2. **Losing exact requirements or negative evidence:** recovery retains acceptance/check argv/outputs, open blockers, validation and review findings, review limitations, failed check status and excerpt. Pure regression asserts exact equality and unchanged durable state across projection/revision. Original evidence/history remain in report/session. Extremely large status/finding responses still encounter the existing presentation limit; not represented as universally bounded lossless responses.
+3. **Provider-invalid orphan tool results or altered reasoning signatures:** only a complete contiguous assistant plus all its matching unique successful delivery-only results is replaceable. Never alter an assistant's reasoning field in place; preserve mixed code turns, failures and the newest eligible exchanges. No claim of compatibility with every provider cache/continuation API; live provider smoke remains needed for a new campaign.
+4. **Pointer pretending inspection occurred:** oversized captures include explicit full paged-read instruction and immutable identity, with full artifact on disk. A pointer is not a reading certificate. Existing review capture match/scenario requirements remain in effect; actual comprehension still unprovable. Trusted advisor receives full capture through tool details.
+5. **Archive corruption/write failure:** verify stored bytes on every archive substitution. Any storage failure conservatively retains original history. Tests cover corrupt artifact and symlinked root rejection. Atomic content-addressed create is not an OS sandbox or crash-proof disk guarantee.
+6. **Compaction resetting budgets or selecting another run:** compaction hook refreshes the same selected run only; it does not call session restore, reset timers or clear counters. Branch/session restore retains existing behavior. No automatic paid summarizer is introduced.
+7. **Telemetry leaking source:** only numerical sizes/categories/growth/time written. No prompt snippets or content hashes that imply semantic reading. Categories are coarse wire-JSON attribution; bytes/4 explicitly heuristic.
+8. **Overclaiming savings:** offline historical potential message savings 26–51% assume archive eligibility and simulated references. Not proof of better live completion, not actual serialized-provider request savings. Full design remains retrievable and exact obligations can still be large.
+9. **Benchmark integrity:** no historical candidate/evaluator/receipt edited. Adapter source change requires a new manifest/root; old freeze no longer validates this changed checkout and must not be overwritten.
+10. **Research claims:** repository API/README retrieved directly; identify unstable branches, licensing boundaries and unresolved Cal.com/Cal.diy identity. No claim that proposed tickets or containers are ready.
+
+## Results
+
+- `npm run quality`: lint, typecheck, build, **352/352 tests passed**; log `/tmp/context-quality-final.log`.
+- `node --test tools/benchmark/advisor.test.mjs tools/benchmark/runner.test.mjs`: **5/5 passed**, including actual installed pi offline discovery/guard and advisor integration; log `/tmp/context-installed-engine.log`.
+- `git diff --check`: clean.
+- No new paid model calls, no browser/Python suite run in this change, no independent review, no remote CI/PR/merge claimed.
+
+## Follow-ups, not implemented claims
+
+Byte-triggered automatic native-compaction scheduling; incremental section/patch design tools; pagination for every unusually large findings/status response; live context+compaction completion validation; new repository containers/reference patches/held-out evaluators; repeated online/offline paid comparisons. Native compaction is user-configured, with deterministic recovery already integrated.

package/docs/context-efficiency.md

@@ -0,0 +1,49 @@
+# Delivery context: compact projections, durable obligations
+
+## Implemented
+
+`lib/delivery-context.mjs` owns pure recovery/status/review projections, context byte metrics and conservative archival selection. `lib/context-archive.mjs` owns immutable content-addressed storage. The extension composes these without changing approval or verification policy.
+
+- `delivery_status` no longer echoes full `state.plan.design`, capture, planning history or revision snapshots. It returns exact active acceptance, checks (including argv), outputs, progress, current findings and compact evidence, plus report location and freshness/next-action fields.
+- Successful plan-review responses return counts instead of repeating every walkthrough/challenge. Findings, limitations, identity and provenance stay visible; full reviews remain in reports/session entries.
+- Large `delivery_design inspect` responses return a **complete capture archive path**, ID/digest/source identity and explicit instruction to read the entire artifact in pages. Small captures retain the previous shape. Full large capture remains in tool `details.deliveryCapture` for trusted advisor consumers; it is not automatically placed into model text.
+- After recorded approval, older successful **delivery-only** paired exchanges can become outbound archive references. Keep the two newest eligible exchanges. Failed tool results, reported blocking findings/failed checks, user messages, mixed/code tool turns, unmatched pairs and pending unapproved review contexts stay verbatim. Original session messages and full report history are not rewritten. Archive originals are verified before any replacement; failure retains messages.
+- Context rebuild injects a deterministic recovery record. It preserves exact acceptance, required check definitions, outputs, progress, all persistent open blockers and failed check status. It is explicitly **not authority**. Source freshness, approval and completion remain checked by existing policy immediately before execution/finish.
+- Native `session_compact` refreshes the same selected run without resetting timers, budget, repair counts or planning state. Branch/session restoration continues through the existing reconciliation logic. A generated summary cannot revive approval.
+- `before_provider_request` records numeric category bytes, growth, and labeled bytes/4 token estimate to `.harness/.../context-metrics.jsonl`. No message text is copied. Categories: system, schemas, planning calls, tool results, code calls, reasoning fields, remaining conversation, serialization envelope. Wire formats without messages are conservatively measured as envelope; this is not universal provider tokenizer accounting.
+- Above 240KB in the previously observed payload, inject a pressure warning to reserve room for verification/handoff. It does not silently trigger paid calls or change acceptance.
+
+## Compaction: explicit configuration, not a hidden new model call
+
+Native pi compaction remains controlled by the user's engine settings. **This change does not turn it on behind the user's back**, and does not add a second summarizing model. Future comparison runs must enable the same native policy in all arms and charge summarization tokens/time to each cell.
+
+For a 100k-token engine configuration, an initial development setting to validate is:
+
+```json
+{"compaction":{"enabled":true,"reserveTokens":40000,"keepRecentTokens":12000}}
+```
+
+That requests native compaction around 60k estimated tokens while keeping recent work. These are tuning starting points, **not** a guarantee against a 400KB byte ceiling: escaping, schemas, reasoning metadata and long Unicode/tool results can break bytes/token heuristics. Use the numeric metrics and a preflight that exercises real tool history and compaction before freezing a paid test. A byte-triggered automatic compaction scheduler and incremental plan-authoring APIs remain follow-up work; no implementation or success claim for them is made here.
+
+## Measured offline savings
+
+Applying eligible archive substitutions to the final saved v4 message histories (assuming approved state, with simulated compact archive references) reduced serialized **message-history** bytes by:
+
+| Task | Carthagent | Carthagent + Jev |
+|---|---:|---:|
+| Voxel | 26.4% | 27.6% |
+| Shop | 29.6% | 38.7% |
+| Ledger | 48.4% | 50.9% |
+
+Artifact `/home/baissi/benchmarks/context-efficiency/historical-projection.json`. This is an offline potential-savings measurement, not replayed paid runs, live provider tokens, improved correctness, or proof that the old runs would have finished. Post-revision pending review disables archival, so the final-history eligibility assumption can overestimate savings in an actual state. The smaller status/review responses are additional unquantified changes.
+
+## Limits and compatibility
+
+- Exact requirements/checks/blockers are not silently trimmed to a fixed recovery size. A huge contract can still be huge.
+- Archive files and reports may contain secrets already present in planning/tool data; no default redaction or zero retention. Archives use 0600 for new files. Same-user access and symlink races against a hostile host are outside the participating-tool boundary.
+- Archive pointer/read receipts never certify actual reading or semantic review. The model must explicitly retrieve large captures; all review and approval obligations remain unchanged.
+- The ordinary response truncation helper still applies to extremely large non-inspection responses; this change fixes large inspection retrieval specifically, not every possible result. Review/validation finding-list pagination is future work.
+- Benchmark advisor now accepts large captures from trusted tool details as well as small capture text. This invalidates historic source manifests for rerun; existing freezes/results remain unchanged evidence.
+- No code/test output or user messages are compressed by the deterministic archive selection. Native compaction handles general conversation growth, with the recovery record protecting harness obligations.
+
+Validation includes pure size/invariant tests, real extension gate/restore tests, large-capture retrieval, failure-preserving history projection, numeric telemetry redaction-by-design and repository quality. Native compaction's model-generated summary quality and a paid completion-rate improvement remain unmeasured.

package/docs/deepseek-jev-benchmark-plan.md

@@ -0,0 +1,70 @@
+# Three-task DeepSeek / Jev benchmark — protocol v1
+
+Status: design challenged before benchmark implementation; candidates have not run.
+
+## Question and experimental arms
+
+Does Carthagent improve externally measured task delivery over plain pi, and does advisory Jev add value above the same harness? All arms use the same installed pi engine and pinned `deepseek/deepseek-v4.1-flash` via OpenRouter, high reasoning, identical task text, initial workspace, tool availability and resource ceilings. The harness arms explicitly load this repository's delivery extension/skill; the plain arm has no extensions, skills, context files or prompt templates. This controls engine version rather than conflating vendored-engine differences with harness value. Record exact engine and harness versions.
+
+A: plain pi. B: pi + Carthagent, no Jev. C: pi + Carthagent + Jev advisory feedback on the first successful design inspection per revision (at most 3 calls/run). No Jev router: it could choose a different generator and confound the ablation. Jev cannot approve or weaken deterministic gates. Probabilities >=0.5 flag review topics, not proven defects. Use OpenRouter `typesafe/jev-1.13` Decisions API, preserving returned snapshot/provider/cost.
+
+Initial exploratory matrix: **3 tasks × 3 arms × 1 independent run = 9 runs**. Balanced task-specific arm order; no selective retries or supervisor repairs. One replicate per cell is exploratory, not statistically conclusive. Infrastructure smoke tests are separate and are never counted as task successes. If infrastructure fails, preserve results and explicitly document any protocol revision before restarting any affected comparisons.
+
+## Tasks and external acceptance
+
+1. **Rust voxel sandbox (small Minecraft-like clone)**: actual Rust gameplay/voxel state and software-rendered first-person view, deterministic terrain, collision/gravity, block remove/place with bounded reach, save/reload and malformed-save rejection. Browser input/display may be a thin JS frontend to the Rust server. Test Rust compilation and headless scenarios, then real browser controls/rendering and screenshot. Not a Minecraft-complete game: no crafting, mobs, infinite streaming or multiplayer.
+2. **Sales website**: responsive local outdoor-products storefront, search/category/sort, stock-aware persistent cart, exact-cent totals, discount/shipping rules, validated checkout, idempotent order submission, persisted orders and stock, accessible status/error UI. Evaluate API contracts and real browser add/update/reload/checkout at desktop/mobile widths. No real payments/deployment.
+3. **Exact-money transfer ledger**: Node JSONL service/CLI, signed decimal parsing without float rounding, integer-cent balance invariants at large magnitudes, atomic insufficient-funds rejection, idempotent retries/conflict rejection, persistence/restart and malformed log handling. Evaluate ordinary, adversarial and deterministic seeded metamorphic cases. This targets defects that screenshots and agent-owned tests miss.
+
+Each task gets a frozen public prompt with observable interfaces and detailed requirements. External tests are written and hashed before candidates start; evaluator files are outside candidate workspaces and never sent to models. They are **withheld, not OS-isolated secrets**: same-host shell access is not a security sandbox. Do not claim blind testing if a trace shows evaluator access. Public API specifications are not hidden-test leakage. No candidate receives external scores or repairs during its initial run.
+
+Score separate behavioral categories; report missing/unbuildable/unlaunchable as failures, not missing rows. Collect agent-authored tests separately. Capture visual artifacts but do not pretend pixel existence proves playability or subjective design quality. Report browser/runtime infrastructure failures separately from candidate failures.
+
+## Budgets and measurement
+
+- Per candidate: 15 minutes wall time, 120 observed tool starts, at most 100 paid generation requests, 16,384 generated tokens per request, 100,000-token engine context setting and 402,000-byte serialized request cap (conservative <=412,000-token reservation envelope including protocol overhead; actual token count is recorded).
+- Provider proxy enforces max input/output prices of $0.30/$1.20 per million for DeepSeek, $0.15 generation-request reservation (covering <=412k input tokens and 16,384 output tokens at these rates) and **$3 maximum reserved spend per candidate**. Stop on unknown/invalid billing instead of interpreting missing cost as free; reconcile `usage.cost` when available. Jev max 3 requests, <=64KB request, $0.01 reservation each, included in candidate ceiling. Overall candidate ceiling $27; smoke/provisioning API calls separately capped at $0.10. No automatic escalation.
+- Track external score, completion/false-completion, all failures, wall time, requests/tool calls, input/output/cache/reasoning token usage, actual provider cost, Jev latency/probabilities and model snapshots. Local provisioning/build time is recorded separately. Missing cost is unknown, not zero.
+- One bounded infrastructure retry only for connection failure before generation, never candidate retries that erase failures. Sequential paid requests per candidate; overlapping tasks may be scheduled for practicality, with hardware contention disclosed.
+
+## SRP / DI design
+
+- Frozen protocol/task specs: own task meaning and scoring weights, no execution.
+- `gateway`: owns outbound model authentication, model allowlist, bounded requests and spend reservation, sanitized usage receipts. Inject fetch/key/clock; candidates receive a dummy local credential, never the real key. Never log authorization headers. Restrict listening to loopback.
+- `runner`: owns workspace/process lifecycle, resource deadline, JSON event logging, immutable invocation/results; no scoring or model-written repairs. Inject engine path, process environment and gateway address.
+- `advisor`: owns extracting an inspection result, typed Jev rubric and attaching advisory feedback to the corresponding generator tool result; no approval or execution permission. Exactly the same Carthagent policy in B/C.
+- `evaluators`: own independently specified functional oracles and browser checks, no candidate prompts or automatic repair. Real subprocess/HTTP/browser boundaries, not fake-only tests.
+- `report`: joins immutable receipts and scores; missing data stays missing; no synthetic statistical certainty.
+
+## Preimplementation challenges / scenario walkthroughs
+
+- Availability: OpenRouter's ordinary chat catalog lists DeepSeek and Jev Router, but Jev itself is a separate Decisions API. Verified primary Jev docs before choosing endpoint; never substitute router results for a Jev ablation.
+- Key confidentiality: parent reads only OpenRouter auth; child uses dummy proxy credential and a clean config/environment. Shell can still read host files absent OS isolation, so never represent this as protection against a malicious candidate. No real secrets in prompts, saved configs or request logs.
+- Fairness: same engine/tool set/settings and unmodified public task prompts. Harness guidance and Jev feedback are intentional treatment differences. Tool-budget overhead is part of harness cost; also report generation/request/time overhead so quality is not cherry-picked.
+- Failure: invalid model response, no billing, timeout, exhausted budget, compiler failure and no rendered UI stay visible. Missing Jev is an unavailable treatment, not a successful Jev run.
+- Oracle adequacy: test mutant behaviors (float money, duplicate application, ignored stock, no voxel change) to show evaluators detect meaningful failures before running candidates. Real browser checks complement API/headless checks.
+- Persistence: restart after state changes, then retry same operation; require exactly-once state. Malformed state must reject without overwriting valid state.
+- Visual scope: require a rendered scene plus controls/state transitions; do not award a playable-clone score to only a data structure or screenshot.
+- Environment: Rust is not installed on PATH; provision an isolated toolchain before candidates. Firefox exists but snap cannot use /tmp worktrees; use benchmark runtime under the home directory with an explicit writable profile root.
+- Provenance: generative/model-authored planning reviews are not independent; external tests are supervisor-authored with published limitations. Historical earlier trials remain untouched.
+
+Outcome: protocol ready for tooling/evaluator implementation. Freeze implementation hashes before any task candidate. Adjustments needed after infrastructure probes must be logged, not silently retrofitted to favor an arm.
+
+## Pre-candidate infrastructure findings and protocol v1.1
+
+- Rust 1.98.1/cargo 1.98.1 were already installed under `~/.cargo/bin`; only PATH composition was needed.
+- The first plain smoke preserved a genuine budget-stop: its $0.05 total could not reserve a second $0.05 generation request after the first bill. A separate harness smoke with $0.08 total completed tool use and `SMOKE_OK`. No task candidate ran during these corrections. Paid smoke actual costs: $0.0007059 + $0.0041763 + $0.000019278 (Jev) = $0.004901478, below the $0.10 ceiling.
+- Real Firefox initially exposed two supervisor fixture defects (missing HTML content type; missing WebDriver return). Both were repaired before candidate evaluation and original failing logs retained. Native click + screenshot now pass under home-directory profiles.
+- Jev live endpoint smoke returned valid typed answers and billing. Inspection of the real delivery tool showed an outer `{result,planningStatus}` wrapper; the benchmark adapter now reads `result`. A real loopback integration test reproduces this exact envelope, verifies once-per-revision feedback and proves the adapter leaves the original tool result unchanged. The initial synthetic smoke did not use the real wrapper; it established API connectivity, not end-to-end harness integration.
+- Initial 95KB generation body cap would unnecessarily truncate longer coding contexts. Before all candidates, increased to 402KB after serialization, with $0.15 reservation rather than $0.05. Reservation uses a deliberately conservative byte/token envelope, not a claim that bytes/4 is a guaranteed tokenizer bound. Provider billing remains the external source of truth; unexpected billing stops further requests, not a vendor-enforced account cap.
+- Gateway buffers bounded upstream SSE until billing arrives; all arms have the same buffering and 180-second per-request transport deadline. This delays visible token streaming, not the model's generation. There are no automatic gateway retries. No OS sandbox or absolute account-level spending guarantee is claimed.
+- Evaluator self-tests include a separately authored ledger reference process and float/idempotency mutant processes. Shop quote and voxel-state/change oracles have component-level mutant assertions, not complete reference applications; their full candidate HTTP/browser suites have not been validated against independently built passing apps. Report that limitation. Browser infrastructure uses actual Firefox and native input.
+- Scores are unweighted category pass counts with the complete assertions published afterward; categories are not equal complexity. Visual screenshots support inspection but there is no invented quantitative aesthetic score.
+
+## Verified primary references
+
+- https://openrouter.ai/api/v1/models (retrieved 2026-09-28): DeepSeek model ID and $0.30/M input, $1.20/M output, $0.006/M cache-read listing.
+- https://openrouter.ai/docs/guides/community/jev : Jev available with OpenRouter key, distinct Decisions/System One endpoints.
+- https://openrouter.ai/docs/guides/community/jev-tutorial : typed answers and `usage.cost`, pinned `typesafe/jev-1.13` resolving to dated snapshot.
+
+The full API catalog and primary documentation snapshots were retained under `/tmp/ctg-benchmark-discovery/`. Search snippets were discovery aids, not the basis for endpoint selection.

package/docs/deepseek-jev-benchmark-repair-plan.md

@@ -0,0 +1,20 @@
+# Benchmark readiness repair (v3)
+
+User requested all fixes needed to make the tests runnable. Preserve v1/v2 and their reports. Do not change candidate code or interpret transport failures as model failures.
+
+## Design before implementation
+
+1. Transport adapter owns HTTPS/process I/O only: use a fresh system-curl process (system OpenSSL, HTTP/1.1, no shared TLS session/pool) per upstream request, with normal certificate/hostname validation. No `-k`, relaxed ciphers, credential argv, redirects, implicit curl config, or automatic POST retry. Fixed gateway endpoints remain authoritative. Bound body, deadline and subprocess lifetime. Return a fetch-compatible buffered response; gateway owns envelope and billing. TLS root cause remains unproven; this is a separately tested avoidance path.
+2. Shared runtime adapter owns explicit sanitized environment, copied offline fd/rg binaries, process cleanup and engine paths. Verify actual pi read/ls/find/grep in an empty isolated config, not merely `--version`. Same tool/guard setup for every arm; planning gates unchanged.
+3. Durable campaign accounting owns exclusive locking, atomic snapshots, reservation before process/request dispatch and conservative crash recovery (holds remain). Seed previous candidate spending plus unresolved holds and smoke spending. No automatic retries, reset, or account-level cap claim.
+4. Freeze owns source/engine/tool hashes and readiness receipts. Runner verifies actual hashes before any candidate, rejects existing directories, classifies terminal assistant errors separately from exit status, records tool attempts/admitted calls and structured infrastructure failures. Pre-execution extension blocks beyond 120 attempts; observed `tool_execution_start` may include blocked calls and is not execution proof.
+5. Evaluation keeps original contracts, sanitizes child environments, bounds process groups and browser waits, uses fresh output directories. Browser waits honor the public 2s UI update allowance rather than fixed subsecond assumptions; reference fixtures and mutants exercise the real HTTP/browser paths. Old evaluator hashes/results remain historical; v3 changes require a new freeze.
+
+## Challenges / tests
+
+- Malformed HTTP/SSE, wrong model, split Unicode, stalled/chunked/oversized response, TLS self-signed rejection, trusted local TLS, redirects, abort, missing curl, secret-in-argv/log and concurrent body-read races.
+- Unknown billing is not replay-safe: retain reservation and stop campaign rather than retry a paid POST. Reconciled invalid response can stop without labeling its cost unknown.
+- Concurrent processes cannot both spend the same campaign balance; crash leaves a hold. Existing state cannot be silently reset. Freeze modification blocks before paid calls.
+- Installed pi scripted local provider completes discovery, sees missing tools as failure, reaches real plan validation/inspection and Jev hook, respects preapproval mutation lock and preventive tool budget. Exit 0 + terminal error must fail readiness.
+- Reference shop real API/native Firefox controls must pass, deliberate pricing/idempotency mutants must fail. Voxel previous candidate is a retained regression fixture only, not an independent reference; evaluator logic invariants/mutants complement it. Do not fix candidates to satisfy evaluators.
+- No paid candidate matrix until offline readiness and bounded TLS/live connectivity checks pass. Live readiness expenses share the remaining original smoke allowance. A finite soak is evidence, not proof TLS can never fail.

package/docs/deepseek-jev-benchmark-restart.md

@@ -0,0 +1,9 @@
+# Uniform infrastructure restart (v2)
+
+Original frozen tasks and evaluators: original-freeze.json, commit 7087423. No task/evaluator changes between attempts. All v1 runs are retained at ../deepseek-jev-v1, including the partial plain voxel candidate and eight zero-tool failures. The initial gateway hid the root cause behind its sanitized generic failure. Separate tiny diagnostic requests succeeded afterward; no candidate repair or external scores were returned to a generator.
+
+Restart announced to user before beginning. Changes are runner root v2, candidate ceiling $2.84 (was $3), extra sanitized error class/code/stage receipts, and stop-the-matrix on the first gateway stopped condition instead of spending startup requests on the remaining arms. Full matrix order is unchanged. The first v2 run is launched individually for early diagnosis; subsequent runs only proceed if infrastructure remains healthy. No copying v1 candidate files into v2.
+
+Worst-case accounting for v1: known actual $0.048990234 plus 9 unresolved $0.15 reservations = $1.398990234. Nine v2 ceilings of $2.84 = $25.56. Combined $26.958990234 <= original $27 candidate ceiling. Tiny diagnostic calls are separate smoke expense, within the original $0.10 allowance. Reservations are conservative local limits, not an OpenRouter account-level cap.
+
+This is a transparent all-arm infrastructure restart, not another statistically independent replicate or a discarded bad model result. Retain both attempts and report v1 failures. No further automatic restarts authorized by this protocol.

package/docs/deepseek-jev-benchmark-results.md

@@ -0,0 +1,77 @@
+# DeepSeek / Carthagent / Jev benchmark: interrupted, not a comparison
+
+## Status
+
+The exploratory matrix is **incomplete**. No conclusion about Carthagent or Jev effectiveness is supported. Candidate generation is stopped; no further automatic restarts or paid requests are scheduled.
+
+Generator: `deepseek/deepseek-v4.1-flash`, high reasoning, installed pi 0.85.1, Node 26.7.0. Treatment arms add this repository's delivery extension/skill; Jev treatment adds a benchmark-only OpenRouter Decisions adapter using `typesafe/jev-1.13`, never a generator router. Completed v2 generation receipts report provider Together. One replicate per task/arm was intended.
+
+Public contracts/evaluators were committed and hashed before candidates at `7087423`; the restart amendment is committed at `dfc5292`. See [protocol](deepseek-jev-benchmark-plan.md) and [restart amendment](deepseek-jev-benchmark-restart.md).
+
+## Attempts retained
+
+### Original v1 matrix
+
+Artifacts: `/home/baissi/benchmarks/deepseek-jev-v1`.
+
+Plain voxel made eight observed tool starts, wrote a partial candidate, then hit an unresolved gateway transport/billing failure after 89.181 seconds. Each of the other eight cells failed on its first request with zero tools. The original gateway obscured the exception type, so the root cause for v1 is **unknown**, not retroactively proven to be the TLS error seen later. No v1 candidate was repaired or selectively resumed.
+
+The original runner did not stop the matrix on shared infrastructure failures, so it unnecessarily attempted all eight later cells. Its process exit status was zero even though the model's terminal message was an error. Raw `result.json` records are preserved, not rewritten to hide that classification defect.
+
+### Uniform v2 restart
+
+Artifacts: `/home/baissi/benchmarks/deepseek-jev-v2`.
+
+Announced before execution, with the same tasks and evaluator hashes, fresh empty candidate workspaces, no source copied from v1, reduced $2.84/cell ceiling, sanitized transport diagnostics, and matrix stop after the first unreconciled failure. This is an infrastructure restart, not a second successful replicate or a substitute for reporting v1.
+
+| Task / arm | Outcome | Time | Tool starts | Known billed generation cost | External evaluation |
+|---|---|---:|---:|---:|---|
+| Voxel / plain pi | Terminal model `stop`; candidate completed | 129.204 s | 32 | $0.067758660 | 8/8 frozen categories passed |
+| Voxel / Carthagent | Terminal model error; interrupted during planning | 86.358 s | 24 | $0.058291788 + unresolved reservation | Not scored as an implementation failure |
+| Voxel / Carthagent + Jev | Not run | — | — | — | — |
+| Shop / all three arms | Not run | — | — | — | — |
+| Ledger / all three arms | Not run | — | — | — | — |
+
+The second v2 cell recorded `TypeError`, cause code **`ERR_SSL_SSL/TLS_ALERT_BAD_RECORD_MAC`**, 73 ms after request start. No upstream response identity/billing was available for that request. The matrix stopped immediately. This establishes a transport-layer failure in that attempt, not whether Node, the TLS stack, the network, or the upstream caused it. A separate small request succeeding does not demonstrate the long-running path is repaired.
+
+## Completed voxel evidence
+
+Frozen categories passed: release compilation; deterministic seeded state; movement/gravity/jump/solid-state checks; reachable removal/placement and material selection; unreachable-sky and unknown-action nonmutation; save/reload plus corrupt-load atomicity; changing Rust PPM frames; actual Firefox keyboard input affecting Rust state.
+
+Candidate-owned tests were run separately afterward: **17 unit tests and 9 HTTP integration tests passed** (`evaluation/candidate-tests.log`). This is not additional independent correctness evidence of the same strength as a withheld evaluator.
+
+Artifacts under `voxel-plain/evaluation/`: `result.json`, `build.log`, `server.log`, `frame.ppm`, `game.png`, Firefox profile/logs, `candidate-tests.log`. The screenshot was captured successfully; the supervising model could not view the image attachment, so **no visual-quality judgment is claimed**. The candidate is a software-rendered voxel slice, not Minecraft feature parity.
+
+The completed candidate reported all required features, but 8/8 category checks are not exhaustive proof of every acceptance condition. For example, the evaluator's world checks do not prove collision safety at every pose, its PPM check is not a full visual-quality metric, and it does not exhaustively mutate every out-of-bounds save field. Do not equate category pass count with full contract correctness or rank this candidate against absent competitors.
+
+## Planning observations, not treatment-effect estimates
+
+The interrupted Carthagent candidate encountered implementation locks, a malformed design value, an invalid artifact-root proposal, and premature inspection before passing validation; it revised its plan. These recorded errors and recovery attempts are retained. No approved implementation was completed before transport failure.
+
+Two advertised discovery tools failed because `fd` and the pi-managed `rg` were unavailable in the isolated configuration and offline mode prevented downloading them. This is a benchmark bootstrap defect with potentially unequal impact: plain pi can use shell alternatives, whereas Carthagent's preapproval gate restricts arbitrary shell. It must be repaired/tested before any future fair comparison, not presented as evidence that the planning approach is worse.
+
+The candidate also read harness source beyond the explicitly linked documentation while diagnosing its schema. This was not OS-isolated. No claim of enforced evaluator/credential inaccessibility is made.
+
+Jev returned valid typed probabilities in a separate live endpoint smoke. A local integration test used the actual `{result,planningStatus}` inspection envelope and checked once-per-revision, non-authoritative feedback. **No candidate received Jev feedback in either attempted matrix.** Thus there is no empirical Jev quality/latency/net-value comparison here.
+
+## Billing
+
+Known candidate bills across both attempts: **$0.175040682**. Ten unresolved $0.15 reservations total **$1.50**. These are conservative held amounts, not confirmed charges and not zero-cost assumptions. Known bills plus retained holds: **$1.675040682**; provider-side reconciliation is still needed for unknown requests.
+
+Smoke/diagnostic known costs: $0.000705900 + $0.004176300 + $0.000019278 + $0.000017220 + $0.000016380 = **$0.004935078**, below the separate $0.10 allowance. One tiny diagnostic used a direct max-32-token request rather than the gateway; its returned billing is preserved at `v1/diagnostic-response.txt`. No real key was included in receipt logs.
+
+V2 token usage totals (sum of request usage, includes repeated context/cache): plain voxel 1,649,799 prompt / 35,859 completion; interrupted harness voxel 747,309 prompt / 26,107 completion. These are not unique task tokens. Provider costs, not nominal catalog multiplication, are reported.
+
+## Preflight and remaining limitations
+
+- Seven focused benchmark tests passed: gateway bounds/billing, actual advisor envelope, ledger reference and float/idempotency mutants, shop/voxel component oracle checks, real Firefox native click/screenshot. Original failing browser fixture logs are retained.
+- `npm run quality` passed: lint, typecheck, build, **348 repository tests**. Focused benchmark tests run separately. No benchmark GitHub CI/independent review/PR merge is claimed.
+- Shop and voxel did not have full independently authored passing reference applications before freeze. Only the completed plain voxel candidate has exercised the full voxel HTTP/browser evaluator. Shop scoring remains unvalidated end-to-end.
+- The runner records exit status but lacks terminal-model-error classification; analysis above reads actual assistant terminal events. Its tool cap is reactive at start 121, not a preventive stop at 120. The matrix freeze guard only checks file presence; hashes were checked separately for v2 tasks/evaluators. Aggregate budgets are documented per-attempt arithmetic, not centrally enforced across arbitrary extra invocations.
+- Candidate server/test evaluation inherits the supervisor process environment rather than the runner's sanitized environment. No credential isolation guarantee should be inferred from the candidate-generation gateway arrangement. Same-user shell access is outside these controls in all cases.
+- The gateway buffers bounded SSE and uses a 180-second request deadline, altering visible streaming equally in all arms. Model identifier is pinned outbound and returned identities logged; this is not a reproducible immutable provider-weight snapshot.
+- One replicate and an infrastructure restart cannot establish statistical superiority. Incomplete cells remain missing, not zeros or successes.
+
+## Before another matrix
+
+Investigate the reproducible long-running TLS path using bounded non-candidate traffic; verify clean offline discovery-tool availability; add terminal model status, central attempt accounting, actual freeze verification, and preventive tool-budget checks. Re-freeze a clearly versioned protocol, preserve both existing attempts, and obtain agreement before another full restart. No further candidate run is scheduled by this report.

package/docs/deepseek-jev-benchmark-running.md

@@ -0,0 +1,60 @@
+# Running the repaired benchmark (v3)
+
+This supersedes the **operating instructions**, not the historical results, in the v1/v2 protocol/reports. Repair design: [repair plan](deepseek-jev-benchmark-repair-plan.md). Previous attempts remain unchanged. No candidate implementation was repaired.
+
+## Transport fix and evidence
+
+The paid gateway now uses **one fresh system curl/OpenSSL process per request**, HTTP/1.1, rather than Node 26's pooled fetch/TLS transport. Normal certificate and hostname verification remain enabled. There is no insecure flag, TLS downgrade, automatic retry, redirect following, curlrc loading, or credential in argv. Request headers/body enter through an anonymous stdin pipe; output and time are bounded. This bypasses the previously failing path; it does **not** establish the root cause of `BAD_RECORD_MAC` or guarantee future network availability.
+
+Real local TLS tests reject an untrusted self-signed certificate and accept the explicitly trusted fixture; exercise 25 fresh connections, Unicode/chunking, redirects, lost POST responses, oversized responses, timeouts, cancellation, and missing curl. Unknown POST billing stops the campaign rather than silently replaying requests.
+
+Live repair evidence: **24 sequential DeepSeek requests**, including two 60KB inputs, **one Jev request**, then the installed pi engine completing all four discovery tools and `SMOKE_OK`. All passed with known billing and zero outstanding holds. New repair smoke spend: **$0.005075892**. Historical + repair smoke: **$0.010010970**, under the original $0.10 allowance. Raw receipts: `/home/baissi/benchmarks/deepseek-jev-v3/live-preflight/` and `smoke-plain/`.
+
+## Other fixes
+
+- Copy verified `fd`/`rg` into each isolated pi config before launch. Scripted loopback-provider tests drive the actual installed pi engine's read/ls/find/grep in **all arms**, with no downloads. The Carthagent preapproval mutation gate and actual validate/inspect→advisor path are also exercised. Fixture planning does not certify semantic plan quality.
+- Identical budget-only extension in all arms blocks tool attempt 121 **before its body executes**. JSON `tool_execution_start` still counts attempts (including blocked calls), not actual execution. Record admitted/blocked counts separately; Carthagent may separately reject admitted calls.
+- Removed the ineffective `toolExecution: sequential` setting: this installed CLI has no such setting. All arms retain its same default (parallel sibling tools with sequential preflight). The original sequential-execution claim was incorrect. Carthagent still serializes its own state operations.
+- Terminal assistant `error`/`aborted`/missing/incomplete is separate from process exit. Smoke passes only on terminal completion plus `SMOKE_OK`. Matrix stops on transport/model/launch infrastructure errors instead of cascading through later cells.
+- Gateway serializes before reading request bodies, preserves split UTF-8, validates returned model and SSE completion, and reconciles known bills before rejecting malformed semantic responses.
+- Persistent campaign accounting reserves **before** dispatch, locks concurrent updates, fsyncs atomic state, and retains holds after crashes/ambiguous failures. Existing state cannot be reset by rerunning setup. A stale lock requires human inspection, not automatic deletion.
+- Every candidate launch verifies actual frozen source, engine, discovery binary and readiness hashes. Newly added files in frozen directories invalidate the manifest. Run/evaluation directories are exclusively created; no overwrite or selective resume.
+- Evaluator subprocesses have explicit sanitized environments, bounded process groups, bounded browser/HTTP waits and cleanup. Shop browser checks use native clicks, honor the 2-second UI update allowance and confirm inventory changes rather than guessing success from English confirmation words. Full shop HTTP/browser evaluation passes a supervisor-only reference fixture and catches pricing/idempotency mutants. Ledger has separate reference/mutants. Voxel regression runs on a **copy** of the retained candidate, not an independent reference app.
+- Candidate-owned tests are collected separately; missing cells remain `not-run`, infrastructure-interrupted cells are not scored as product failures.
+
+## Budget / paths
+
+- Fresh candidate output: `/home/baissi/benchmarks/deepseek-jev-v3`.
+- Shared durable budget: `/home/baissi/benchmarks/deepseek-jev-campaign.json`.
+- Candidate account starts conservatively charged **$1.675040682**, covering prior actual bills plus all unresolved holds. Those historical holds remain unknown charges, not confirmed spending.
+- New ceiling: **$2.80/cell**, 9 cells, with the same 900 seconds, 120 admitted tool attempts, 100 paid requests including <=3 Jev calls, 16,384 generation output tokens/request. $1.675040682 + 9×$2.80 = **$26.875040682**, below original $27 candidate ceiling. Shared ledger is an additional check, not a vendor-enforced account cap.
+- No automatic paid POST retry, candidate rerun, or supervisor candidate repair. Interrupted historical matrices are still reported.
+
+## Reproduction
+
+Run from `/tmp/ctg-tested-planning` (branch `bench/deepseek-jev-three-tasks`). Node >=22.19 with TypeScript stripping support as used by this installed environment, local curl/OpenSSL, Rust, Firefox/geckodriver, and the pinned installed pi engine are required.
+
+```sh
+# Offline tests, including real local TLS / installed pi / Firefox:
+node --test tools/benchmark/*.test.mjs tools/benchmark/selftest.mjs
+npm run quality
+
+# Live checks are explicit paid opt-in and refuse existing attempt directories:
+# Already completed here. Do NOT rerun or delete old directories to make it run.
+# node tools/benchmark/preflight-live.mjs --paid
+
+# Generate source-bound readiness and freeze (new output path; refuses existing freeze):
+node tools/benchmark/preflight.mjs /home/baissi/benchmarks/deepseek-jev-v3/preflight --freeze
+
+# Paid task matrix, only after passing freeze verification:
+node tools/benchmark/runner.mjs matrix
+
+# External evaluator + separate candidate-owned tests; refuses overwrite:
+node tools/benchmark/evaluate.mjs matrix
+```
+
+`matrix` does not resume. If interrupted, retain everything and inspect the failing cell/campaign receipts before proposing a new protocol. To inspect accounting without exposing the API key, read only `deepseek-jev-campaign.json`; the supervisor reads the key from existing pi auth, and children receive dummy gateway credentials.
+
+## Limits retained
+
+This is not an OS sandbox: same-user host access and trusted extension/state replacement remain outside enforcement. Sanitized environment is not filesystem credential isolation. Evaluators remain finite checks; no exhaustive correctness, calibrated aesthetic score, immutable provider weight snapshot, or independent-review claim. Freeze includes installed engine dist files but not every transitive dependency. Finite readiness tests cannot guarantee a future provider/network response. Passing readiness is not benchmark superiority; the full v3 task matrix has not run as part of these repairs.

package/docs/deepseek-jev-benchmark-v3-results.md

@@ -0,0 +1,41 @@
+# V3 matrix execution: stopped on upstream HTTP 400
+
+The user authorized execution after the readiness repairs. The v3 matrix was launched with the frozen implementation at commit `90b25c9`; the actual 954-file freeze was verified before launch and after the stop. No source/evaluator changes or candidate repairs were made during the attempt.
+
+## Outcome
+
+- First cell: voxel / plain pi + `deepseek/deepseek-v4.1-flash`.
+- Runtime: **115.105 seconds**; **11 observed tool starts**.
+- Ten generation requests returned valid model identity/billing. Request eleven returned **upstream HTTP 400** after 145 ms.
+- Status: `infrastructure-error`; assistant terminal status `error`, despite pi process exit code 0.
+- Known generation charges: **$0.0143985192**. Unresolved reservation: **$0.15** (not a confirmed charge).
+- The other **eight cells were not run**. Matrix process stopped automatically, with no retry/resume or further paid diagnostic request.
+
+This was **not a recorded TLS error**. curl completed the HTTPS transaction and received HTTP 400 from the upstream endpoint. The gateway's non-2xx receipt contains only the HTTP status, not the error response body. Therefore the specific rejection reason is **unknown**; do not assert a provider outage, invalid message history, context limit, or TLS cause without further evidence.
+
+The candidate wrote Rust source, a browser frontend, and HTTP tests and invoked build/tests before the interruption. Its last action was a source edit. It did not deliver a final response. These partial artifacts are retained but are **not scored as a completed candidate or as a product-quality failure**. No current correctness claim is made from its earlier build/test tool output.
+
+## Evaluation and accounting
+
+Executed the frozen evaluation orchestrator. It correctly classified the interrupted cell as `not-scored-infrastructure`, and all eight absent cells as `not-run`. No external task score or comparative result is available.
+
+New v3 candidate expenditure: $0.0143985192 known plus $0.15 held. Shared campaign state now records $1.6894392012 conservatively accounted candidate spending (includes historical unresolved reservations seeded during repair), plus the new $0.15 outstanding hold. Smoke total remains $0.010010970; no extra paid diagnostics were performed for this failure.
+
+## Artifacts
+
+Root: `/home/baissi/benchmarks/deepseek-jev-v3`.
+
+- `matrix.log`
+- `voxel-plain/{invocation.json,events.jsonl,gateway.jsonl,result.json,guard.jsonl}`
+- `voxel-plain/workspace/` and session logs
+- `evaluation-status.jsonl`
+- `freeze.json`, `preflight/`, `live-preflight/`, `smoke-plain/`
+- Shared accounting: `/home/baissi/benchmarks/deepseek-jev-campaign.json`
+
+Previous v1/v2 runs and failures remain untouched. The finite live readiness soak passed but did not predict this subsequent HTTP-level rejection; readiness is not a guarantee of future provider acceptance.
+
+## Next repair boundary
+
+Before another paid attempt, add a bounded, sanitized upstream error receipt (status, safe error code/message, request identity where supplied) with credential-reflection tests. Determine whether the rejection is provider-side or generated-request compatibility using preserved evidence wherever possible. Any paid replay may be billed and must be separately reserved; there is no automatic retry or another full restart scheduled by this report.
+
+No conclusion about plain pi versus Carthagent versus Carthagent+Jev is supported by this interrupted attempt.

package/docs/deepseek-jev-benchmark-v4-protocol.md

@@ -0,0 +1,15 @@
+# V4 authorized execution
+
+User authorized live validation and running the matrix after the exact HTTP-body fix. Preserve v1–v3 and their interrupted candidates; no copying candidate source into new cells.
+
+- Root: `/home/baissi/benchmarks/deepseek-jev-v4`.
+- Same task texts, evaluator assertions, balanced order, model and reasoning configuration as repaired v3. No provider pinning or selective candidate retry.
+- Corrected large-body transport and sanitized upstream errors described in `deepseek-jev-http400-diagnosis.md`.
+- Per-candidate cap **$2.79**. Historical conservative candidate debit $1.6894392012 plus outstanding $0.15 plus nine times $2.79 = **$26.9494392012**, within the original $27. Shared durable account remains authoritative. No historical holds are released without billing evidence.
+- New live gate: exact reconstructed historical 97,377-byte request, only max_tokens changed to 32, using fixed transport: **HTTP 200**, same requested/returned model, provider AtlasCloud, known bill **$0.0004261776**, no tool execution. Original failing HTTP replay's $0.04 smoke hold remains retained.
+- Known smoke spend now $0.0104371476 plus unresolved $0.04 = $0.0504371476 conservatively accounted, under original $0.10.
+- Re-run complete offline readiness/repository quality and create new source-bound freeze before candidates. Freeze schema remains version 3; attempt identifier/root is v4. V3 freeze and receipts are not overwritten.
+- Matrix stops on recorded transport/model/launch infrastructure errors. Resource-bound task outcomes remain outcomes. No autonomous retries, source repair, or existing-directory overwrite.
+- External evaluation occurs only after candidate termination; no evaluation feedback is returned to generators. Candidate-owned checks and infrastructure failures remain separate from external product scores.
+
+This finite live acceptance proves the historical request can pass with the fixed transport, not universal provider availability, semantic correctness, or comparative benefit. Readiness/transport fixes do not alter advisory authority or planning gates.