mostlyright-data 0.9.0__py3-none-any.whl

mostlyright/data_harness/acquisition/sandbox.py

@@ -0,0 +1,4888 @@
+"""Credential-free subprocess boundary for retrieval and untrusted parsing."""
+
+from __future__ import annotations
+
+import base64
+import contextlib
+import ipaddress
+import json
+import os
+import platform
+import resource
+import secrets
+import selectors
+import signal
+import socket
+import stat
+import subprocess
+import sys
+import threading
+import time
+import unicodedata
+from collections.abc import Iterator, Mapping
+from dataclasses import dataclass, replace
+from pathlib import Path
+from typing import Any, Protocol
+from urllib.parse import urlsplit
+
+from mostlyright.data_harness.acquisition.http import (
+    MAX_BYTE_RANGE_OFFSET,
+    MAX_RANGE_PLAN,
+    SIDECAR_MEDIA_TYPES,
+    SLICE_OBJECT_MEDIA_TYPES,
+    AcquisitionLimiter,
+    PeerAttempt,
+    PinnedHttpsRetriever,
+    ProbeTransport,
+    RetrievalHop,
+    RetrievalLimits,
+    StdlibPinnedTransport,
+    probe_transport_for,
+    require_range_plan_within_budget,
+)
+from mostlyright.data_harness.acquisition.parsing import (
+    ParsedTable,
+    ParseLimits,
+    parse_tabular_bytes,
+    prime_parquet_support,
+)
+from mostlyright.data_harness.acquisition.ranges import (
+    PlannedRange,
+    SidecarLimits,
+    check_grib_message,
+    check_grib_reference_time,
+    parse_index_sidecar,
+    plan_ranges,
+    require_reference_time_spelling,
+)
+from mostlyright.data_harness.acquisition.url_policy import (
+    AcquisitionSecurityError,
+    EgressPolicy,
+    SystemResolver,
+    validate_public_https_url,
+)
+from mostlyright.data_harness.canonical import canonical_sha256, sha256_bytes
+from mostlyright.data_harness.formats import (
+    PARSER_FORMATS_BY_OPERATION,
+    READER_CONTRACT_VERSION,
+    READER_WORKER_MEMORY_BYTES,
+)
+from mostlyright.data_harness.linux_process_boundary import (
+    _disable_process_dumpability,
+    _install_networkless_seccomp,
+)
+
+# The dependency edge this module owns: ``acquisition`` consumes ``readers``, never the
+# reverse. ``readers/`` is a leaf beneath this one, and anything both layers need is declared
+# in ``formats.py`` where neither has to import the other. A back-edge would close an import
+# cycle whose failure depends on which module a process imports first, so it would break the
+# Reader tests while the application, which imports the other way round, stayed green.
+from mostlyright.data_harness.readers.contracts import (
+    DECODE_FLAGS,
+    READER_ERROR_CODES,
+    ReaderPin,
+)
+from mostlyright.data_harness.readers.registry import TOOLBOX
+
+# V2 adds the exact fetched byte count to Reader retrieval responses. The response shape is strict,
+# so adding that measured fact is a protocol change rather than an optional field on V1.
+SANDBOX_PROTOCOL_VERSION = "harness-crawler-sandbox.v1"
+
+# Every operation this boundary admits, named once and read by both allowlists -- the
+# coordinator-side one in ``sandbox_policy_digest`` and the worker-side one in
+# ``_execute_worker_request``.  Two literal sets would be two places to remember: registered
+# on the coordinator side alone an operation computes a digest no worker will execute, and on
+# the worker side alone it executes under a digest no coordinator can bind.
+SANDBOX_OPERATIONS = frozenset(
+    {
+        "parse",
+        "probe",
+        "retrieve_and_parse",
+        "decode_and_parse",
+        "retrieve_decode_and_parse",
+        "fetch_ranges",
+        "survey_cycles",
+    }
+)
+
+# The operations that actually open a socket.  This set is the *single* source of socket
+# authority: ``_policy_document`` derives the attested ``network`` clause from it, and
+# ``_invoke`` derives from it whether an invocation may resolve approved endpoints at all.
+# Neither side is written by hand at a call site, because a hand-written flag beside a
+# derived clause is two independent literals and the failure mode is silent and severe: an
+# operation invoked with socket authority while the clause still named only
+# ``retrieve_and_parse`` would attest ``"os-denied"`` while holding a live TCP/443 rule.
+# The attestation would describe a posture the sandbox does not have, which is worse
+# than no attestation at all.  With one source, granting the rule and attesting it are one
+# edit, and an operation left out of this set fails closed -- no socket -- rather than open.
+NETWORK_PERFORMING_OPERATIONS = frozenset(
+    {"retrieve_and_parse", "retrieve_decode_and_parse", "fetch_ranges", "survey_cycles"}
+)
+
+# Every operation that executes a certified Reader must have the Reader worker's enforceable
+# memory boundary.  Keep this classification independent of socket authority: the composed
+# HTTPS operation both opens a socket and executes a Reader, while local decode only does the
+# latter.  Deriving the off-Linux refusal from this set prevents a newly composed Reader path
+# from accidentally bypassing the clean-room memory invariant.
+READER_PERFORMING_OPERATIONS = frozenset({"decode_and_parse", "retrieve_decode_and_parse"})
+# Every operation whose terminal response *is* the document a cadence probe observed.  A range
+# acquisition and a cycle survey are excluded on purpose: neither settles on one whole document,
+# and both already retain per-response status and validator evidence in ``fetched_members``.
+WHOLE_DOCUMENT_RETRIEVAL_OPERATIONS = frozenset({"retrieve_and_parse", "retrieve_decode_and_parse"})
+
+
+class ConfinedWorkerRefusal(AcquisitionSecurityError):
+    """One refusal raised inside the confinement, carrying which operation raised it.
+
+    Every worker refusal reaches a caller as ``SANDBOX_FAILURE``, because a confinement that
+    described itself in its own refusals would be describing the confinement.  That is right
+    for what a person is told and wrong for one caller: an empirical cadence observation may
+    only be recorded for a refusal that provably reached the source, and "reached the source"
+    is a question about *which operation* was running and *which code* it raised, neither of
+    which survives the collapse.
+
+    So both facts ride the refusal as structured values while ``code`` stays ``SANDBOX_FAILURE``
+    and ``detail`` stays exactly what it was.  Every existing catch site is unchanged: this is
+    an ``AcquisitionSecurityError`` with the same code and the same sentence.  ``worker_code``
+    is ``None`` when the worker's stderr yielded no code at all, which is the redacted case and
+    is evidence of nothing.
+    """
+
+    def __init__(
+        self,
+        code: str,
+        detail: str,
+        *,
+        worker_code: str | None,
+        operation: str,
+    ) -> None:
+        super().__init__(code, detail)
+        self.worker_code = worker_code
+        self.operation = operation
+
+
+@dataclass(frozen=True)
+class _WorkerRefusal:
+    """What the worker's stderr yielded: its typed code, and the sentence a person is told."""
+
+    code: str | None
+    message: str
+
+
+# The one line a pre-warmed child writes before it reads its request, and the only difference
+# between a warm child's stream and a cold child's. It is written after the child has finished
+# importing and before it has read a byte of stdin, so a coordinator that has read it knows the
+# expensive half of a cold start is already paid. Cold children never write it and the argv that
+# asks for it is the argv that produces it, so the two streams can never be confused.
+WORKER_READY_MARKER = b"mostlyright-sandbox-worker-ready\n"
+WORKER_ARGV = ("--worker",)
+WORKER_PREWARM_ARGV = ("--worker", "--prewarm")
+MAX_REQUEST_BYTES = 24 * 1024 * 1024
+MAX_RESPONSE_BYTES = 48 * 1024 * 1024
+MAX_WORKER_STDERR_BYTES = 64 * 1024
+# The worker imports PyArrow and may decode a 128 MiB admitted member. The 512 MiB process limit
+# includes interpreter and decoder overhead.
+MAX_WORKER_MEMORY_BYTES = READER_WORKER_MEMORY_BYTES
+MAX_WORKER_PIDS = 64
+# The hosted research-session service is deliberately one session per 4 GiB Cloud Run instance.
+# This is a separate boundary from the 512 MiB operator-delegated cgroup root above: the container
+# is the hard aggregate memory ceiling for the coordinator, parser child, and every descendant,
+# while an exec-inherited seccomp filter denies networking inside the parser tree. The exact value
+# is checked against the live controller before every spawn; a resource-class change therefore
+# refuses until Harness and Studio move together instead of quietly widening the Clean room.
+HOSTED_SESSION_CONTAINER_MEMORY_BYTES = 4 * 1024 * 1024 * 1024
+_HOSTED_SESSION_CGROUP_ROOT = Path("/sys/fs/cgroup")
+# The most idle children one coordinator may hold. Each one is a live process, a cgroup, and
+# three pipes against an RLIMIT_NOFILE the coordinator also has to live inside, so the pool is
+# bounded for the same reason every other budget in this module is: an unbounded one is a
+# resource-exhaustion lever pointed at the host that granted it.
+MAX_WARM_POOL_SIZE = 32
+# And a coordinator holding a bounded cgroup root may hold no warm children at all. Not because
+# of the descendant ceiling -- that would admit one -- but because of the stricter precondition
+# beside it: ``_require_bounded_cgroup_root`` refuses a root whose ``nr_descendants`` is anything
+# other than 1, meaning the operator-owned coordinator child and nothing else, and it is re-audited
+# before *every* Linux spawn rather than once at construction. An idle warm child holds a job leaf,
+# which makes that count 2, so a single warm child would turn every subsequent cold spawn -- every
+# retrieval, and every request whose confinement does not match the pool -- into a
+# ``SANDBOX_MEMORY_BOUNDARY`` refusal. A pool that breaks the path it is supposed to fall back to
+# is not a pool, so under that root the answer is zero and the coordinator keeps the behaviour it
+# has always had.
+#
+# Making Linux poolable means teaching that audit to distinguish a coordinator-owned warm leaf from
+# a leaf an attacker pre-created. That is a change to a reviewed property of the memory boundary,
+# which is the owner's decision and not a latency one, so it is surfaced here rather than taken.
+BOUNDED_CGROUP_WARM_POOL_SIZE = 0
+# The whole of one ``start_warm_pool`` call, not a budget per child. Serial per-child readiness
+# waits multiply, and a coordinator asking for a full pool against a broken interpreter should
+# find out in a minute rather than in the sixteen that thirty seconds times thirty-two would cost.
+WARM_POOL_FILL_TIMEOUT_SECONDS = 60.0
+_CGROUP_CLEANUP_TIMEOUT_SECONDS = 2.0
+# Exact environment handed to the worker process; nothing is inherited. The key set is
+# bound into the policy digest and is what the worker's reported keys are checked
+# against, so adding or removing a key changes that digest. Values are not digest-covered.
+_ALLOWED_ENVIRONMENT = {
+    # macOS Core Foundation text-encoding hint. It predates ADR 0021, which removed
+    # the Seatbelt profile that made reading it from the home directory a denial rather than a
+    # fallback, and it stays because this key set is bound into the policy digest: dropping it
+    # would rotate every operation's attestation to delete a string nothing reads back.
+    "__CF_USER_TEXT_ENCODING": "0x1F5:0x0:0x0",
+    "LANG": "C.UTF-8",
+    "LC_ALL": "C.UTF-8",
+    "PATH": os.defpath,
+    "PYTHONDONTWRITEBYTECODE": "1",
+    "PYTHONIOENCODING": "utf-8",
+    "PYTHONNOUSERSITE": "1",
+}
+_FORBIDDEN_EGRESS_HOSTS = frozenset(
+    {
+        "api.mostlyright.md",
+        "studio.mostlyright.md",
+        "metadata.google.internal",
+        "metadata.goog",
+        "localhost",
+    }
+)
+# The longest a single sidecar descriptor may be.  ``SidecarLimits.max_line_bytes`` bounds the
+# line a descriptor is read from, so a selector longer than a whole line could match nothing
+# and is refused before it is carried anywhere.
+MAX_SELECTOR_BYTES = 512
+# The most slice bytes one invocation may carry back. See ``_require_slice_bytes_within_budget``
+# for the base64 arithmetic that puts this comfortably inside ``MAX_RESPONSE_BYTES``.
+MAX_TOTAL_SLICE_BYTES = 24 * 1024 * 1024
+# The exact, closed shape of a range plan.  Both addresses are coordinator-supplied: the
+# worker never derives one from the other, because an address a worker constructs is an
+# address no coordinator resolved and pinned.
+_RANGE_PLAN_KEYS = frozenset(
+    {"sidecar_url", "object_url", "selectors", "max_ranges", "expected_reference_time"}
+)
+_FETCHED_SLICE_KEYS = frozenset(
+    {"index", "descriptor", "first_byte", "last_byte", "sha256", "content_base64"}
+)
+_FETCHED_MEMBER_KEYS = frozenset(
+    {
+        "role",
+        "sequence",
+        "url",
+        "resolution_digest",
+        "connected_peer",
+        "status",
+        "response_headers_digest",
+        "response_body_size_bytes",
+        "response_body_sha256",
+        "requested_range",
+        "observed_content_range",
+        "etag",
+        "last_modified",
+        "peer_attempts",
+    }
+)
+_PEER_ATTEMPT_KEYS = frozenset(
+    {"approved_ip", "outcome", "failure_code", "response_body_size_bytes"}
+)
+_PEER_ATTEMPT_OUTCOMES = frozenset({"transport_failure", "response", "response_failure"})
+_FETCHED_MEMBER_ROLES = frozenset(
+    {"cycle_probe", "sidecar_initial", "selected_slice", "sidecar_final"}
+)
+# The most candidate runs one availability survey may probe.  A survey costs one request per
+# candidate against a source that has done nothing wrong, so an unbounded candidate list is a
+# denial-of-service lever pointed at somebody else; 32 covers every cycle cadence this exists
+# for, including a full day of quarter-hourly runs.
+MAX_CYCLE_CANDIDATES = 32
+_CYCLE_SURVEY_KEYS = frozenset({"candidates"})
+_CYCLE_CANDIDATE_KEYS = frozenset({"label", "url"})
+_CYCLE_AVAILABILITY_KEYS = frozenset({"label", "present"})
+# The span a candidate is probed with, and the mapping from a typed refusal to absence, both
+# live in ``PinnedHttpsRetriever.probe_presence`` rather than here.  A survey asks whether a run
+# exists, so reading more than the one byte that settles the question would be an acquisition
+# nobody ordered, on an address no coordinator has locked yet -- and the boundary that owns the
+# request is the boundary that should own that bound.
+
+
+@dataclass(frozen=True)
+class CycleCandidate:
+    """One candidate run a coordinator asks the worker to look for.
+
+    The label, not the URL, is what a result is matched back to. The worker never parses
+    meaning out of an address -- which run this is, what hour it covers, whether it is newer
+    than the last one -- because a worker that read a cycle out of a URL would be choosing,
+    and choosing is the coordinator's half of look-then-lock.
+    """
+
+    label: str
+    url: str
+
+    def __post_init__(self) -> None:
+        _bounded_identifier(self.label)
+        _https_origin(_bounded_text(self.url, maximum=2_048), code="SANDBOX_CYCLE_SURVEY")
+
+
+@dataclass(frozen=True)
+class CycleAvailability:
+    """What the worker reports for one candidate: it is there, or it is not there yet."""
+
+    label: str
+    present: bool
+
+
+@dataclass(frozen=True)
+class FetchedSlice:
+    """One delivered message: which one it is, exactly which bytes, and its own digest.
+
+    The digest is per slice rather than per acquisition so a caller can bind an individual
+    message. A single digest over the concatenation would make one message's provenance
+    unstatable without restating the whole plan.
+
+    ``descriptor`` is the selector this slice answers, and it is carried because delivery
+    order is not selection order: ``plan_ranges`` emits in message-index order so the sealed
+    digest is a function of the recipe rather than of network timing. Without it a caller
+    holds N slices labelled only by a sidecar message number -- a number only the worker ever
+    saw the sidecar for -- and wiring "the first field I named" to the first slice silently
+    reads a different field. Matching is exact equality in ``plan_ranges``, so the descriptor
+    a slice reports is one of the selectors that were ordered, and the coordinator checks it
+    against its own order rather than taking the worker's word for the pairing.
+    """
+
+    index: int
+    descriptor: str
+    first_byte: int
+    last_byte: int
+    sha256: str
+    content: bytes
+
+
+@dataclass(frozen=True)
+class FetchedMember:
+    """One measured HTTP response, including redirects, in acquisition order."""
+
+    role: str
+    sequence: int
+    url: str
+    resolution_digest: str
+    connected_peer: str
+    status: int
+    response_headers_digest: str
+    response_body_size_bytes: int
+    response_body_sha256: str
+    requested_range: str | None
+    observed_content_range: str | None
+    etag: str | None
+    last_modified: str | None
+    peer_attempts: tuple[PeerAttempt, ...]
+
+    @property
+    def total_response_body_size_bytes(self) -> int:
+        """All response-body bytes consumed while obtaining this retained response."""
+
+        return sum(attempt.response_body_size_bytes for attempt in self.peer_attempts)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "role": self.role,
+            "sequence": self.sequence,
+            "url": self.url,
+            "resolution_digest": self.resolution_digest,
+            "connected_peer": self.connected_peer,
+            "status": self.status,
+            "response_headers_digest": self.response_headers_digest,
+            "response_body_size_bytes": self.response_body_size_bytes,
+            "response_body_sha256": self.response_body_sha256,
+            "requested_range": self.requested_range,
+            "observed_content_range": self.observed_content_range,
+            "etag": self.etag,
+            "last_modified": self.last_modified,
+            "peer_attempts": [attempt.to_dict() for attempt in self.peer_attempts],
+        }
+
+
+@dataclass(frozen=True)
+class SandboxResult:
+    request_id: str
+    operation: str
+    policy_digest: str
+    parsed: ParsedTable | None
+    content: bytes | None
+    media_type: str | None
+    final_url: str | None
+    transport_evidence_digest: str | None
+    visible_environment_keys: tuple[str, ...]
+    # The terminal response's status and hashed validators, sealed inside the Clean room by the
+    # operation that retrieved one whole document. ``None`` for every other operation, which is
+    # how "this probe observed no single response" stays distinguishable from "it observed one
+    # that stated no validator".
+    probe_transport: ProbeTransport | None = None
+    home_directory_readable: bool | None = None
+    network_probe_errors: tuple[tuple[str, int], ...] | None = None
+    external_network_policy_attestation: str | None = None
+    # The facts a Reader-decoded acquisition writes onto its receipt: which certified code ran,
+    # with which sealed settings, and what it reported about the decode and charged geometry.
+    # They cross the IPC boundary as data rather than being recomputed here, because the decode
+    # did not happen here. All five are ``None`` for an operation that decoded nothing, which
+    # is how "no Reader ran" stays distinguishable from "a Reader ran and declared nothing".
+    decode_family_id: str | None = None
+    decode_family_version: str | None = None
+    decode_options_digest: str | None = None
+    decode_flags: tuple[str, ...] | None = None
+    # Exact family-owned geometry charged against ``max_declared_cells``. This can exceed
+    # parsed rows times columns (for example, an XLSX header and declared used area).
+    decode_declared_cell_count: int | None = None
+    fetched_content_sha256: str | None = None
+    # Exact terminal source-body bytes decoded by ``retrieve_decode_and_parse``. It is paired with
+    # ``fetched_content_sha256`` and remains the per-member V3 content evidence; normalized output
+    # size remains ``len(content)`` and is not substituted for it.
+    fetched_content_size_bytes: int | None = None
+    # Exact sum of response-body bytes across the retained redirect hop evidence. The terminal
+    # body remains ``fetched_content_size_bytes`` because it is the object the Reader decoded;
+    # collection resource accounting uses this wider measured transport total.
+    fetched_total_response_body_size_bytes: int | None = None
+    # Exact peer-attempt count, including failed approved-IP fallbacks and redirects. Kept beside
+    # the byte count so a collection coordinator can spend one request budget across several
+    # confined invocations.
+    fetched_request_count: int | None = None
+    ranges: tuple[FetchedSlice, ...] | None = None
+    cycle_availability: tuple[CycleAvailability, ...] | None = None
+    sidecar_content_sha256: str | None = None
+    sidecar_size_bytes: int | None = None
+    full_object_size_bytes: int | None = None
+    fetched_members: tuple[FetchedMember, ...] | None = None
+
+
+class CrawlerSandbox:
+    """Trusted coordinator for one clean-environment sandbox process per request."""
+
+    def __init__(
+        self,
+        *,
+        staging_root: Path,
+        timeout_seconds: float = 45.0,
+        python_executable: str | None = None,
+        external_network_policy_attestation: str | None = None,
+        memory_cgroup_root_fd: int | None = None,
+        hosted_session_container_memory_bytes: int | None = None,
+    ) -> None:
+        if not staging_root.is_absolute() or staging_root.is_symlink() or not staging_root.is_dir():
+            raise AcquisitionSecurityError(
+                "SANDBOX_ROOT",
+                "sandbox staging root must be an existing absolute non-symlink directory",
+            )
+        if type(timeout_seconds) not in {int, float} or not 0 < timeout_seconds <= 300:
+            raise AcquisitionSecurityError(
+                "SANDBOX_TIMEOUT",
+                "sandbox timeout must be in (0, 300] seconds",
+            )
+        self._staging_root = staging_root
+        self._timeout_seconds = float(timeout_seconds)
+        self._python = python_executable or sys.executable
+        if external_network_policy_attestation is not None:
+            _require_digest(external_network_policy_attestation, "external network policy")
+        self._external_network_policy_attestation = external_network_policy_attestation
+        if memory_cgroup_root_fd is not None and hosted_session_container_memory_bytes is not None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_MEMORY_BOUNDARY",
+                "delegated and hosted-session memory boundaries are mutually exclusive",
+            )
+        if memory_cgroup_root_fd is not None:
+            _require_bounded_cgroup_root(memory_cgroup_root_fd)
+        if hosted_session_container_memory_bytes is not None:
+            try:
+                _disable_process_dumpability()
+            except OSError as error:
+                raise AcquisitionSecurityError(
+                    "SANDBOX_OS_BOUNDARY",
+                    "hosted-session coordinator process hardening is unavailable",
+                ) from error
+            _require_hosted_session_container_boundary(hosted_session_container_memory_bytes)
+        self._memory_cgroup_root_fd = memory_cgroup_root_fd
+        self._hosted_session_container_memory_bytes = hosted_session_container_memory_bytes
+        # Off unless a caller asks for it. Default behaviour is one fresh spawn per request,
+        # exactly as before; the pool is a lifecycle a long-lived session owner opts into and
+        # is responsible for closing.
+        self._warm_pool: _WarmSandboxPool | None = None
+
+    # ----------------------------------------------------------------------------------------
+    # Warm pool: an opt-in lifecycle for a coordinator that will serve many probes
+    # ----------------------------------------------------------------------------------------
+
+    def start_warm_pool(self, *, size: int) -> int:
+        """Pre-spawn up to ``size`` idle children for invocations that attest no network.
+
+        Returns the number now ready, which is the number to believe rather than the number
+        asked for: dead children are reaped rather than counted, and where the boundary admits
+        fewer than ``size`` the answer says so. Calling it again tops the pool back up, so a
+        session owner that has just spent a child can refill without tracking what it holds.
+
+        **A coordinator holding a bounded cgroup root gets zero, and must read the return value
+        to find that out.** That is the Linux boundary, and the reason is recorded beside
+        ``BOUNDED_CGROUP_WARM_POOL_SIZE``: the root audit re-run before every Linux spawn
+        refuses a root that contains anything but the coordinator's own child, so one idle warm
+        child would turn every cold spawn into a refusal. Zero rather than a typed refusal
+        because a caller should not have to branch on the platform to ask for a pool it may not
+        get; what it must do is believe the count.
+
+        Warm is pre-spawned and pre-imported, never reused: each child serves exactly one
+        request and exits, and a request that finds no matching child spawns its own. The pool
+        is therefore a latency optimisation with no failure mode of its own -- an empty pool,
+        a pool of the wrong shape, and a pool that was never started all produce the identical
+        cold path.
+
+        Only the no-network confinement is pooled. A retrieving invocation's approved
+        endpoints are derived from the request being made, and those do not exist before the
+        request does; a child spawned earlier would either carry socket authority nobody
+        validated for the request that binds to it, or authority that differs from what that
+        request would have been given. Retrieval therefore spawns cold.
+        """
+
+        if type(size) is not int or not 0 <= size <= MAX_WARM_POOL_SIZE:
+            raise AcquisitionSecurityError(
+                "SANDBOX_WARM_POOL",
+                f"warm pool size must be an integer in [0, {MAX_WARM_POOL_SIZE}]",
+            )
+        if self._memory_cgroup_root_fd is not None:
+            size = min(size, BOUNDED_CGROUP_WARM_POOL_SIZE)
+        if size == 0:
+            self.close_warm_pool()
+            return 0
+        launch = self._worker_launch(prewarm=True)
+        if self._warm_pool is None:
+            self._warm_pool = _WarmSandboxPool(
+                timeout_seconds=self._timeout_seconds,
+                memory_cgroup_root_fd=self._memory_cgroup_root_fd,
+                hosted_session_container_memory_bytes=(self._hosted_session_container_memory_bytes),
+            )
+        return self._warm_pool.fill(launch, size=size)
+
+    def warm_pool_ready_count(self) -> int:
+        """How many pre-spawned children are idle and unbound right now."""
+
+        return 0 if self._warm_pool is None else self._warm_pool.ready_count()
+
+    def close_warm_pool(self) -> None:
+        """Kill and reap every idle child. Idempotent; safe to call without a pool."""
+
+        pool, self._warm_pool = self._warm_pool, None
+        if pool is not None:
+            pool.close()
+
+    @contextlib.contextmanager
+    def warm_pool(self, *, size: int) -> Iterator[CrawlerSandbox]:
+        """Own a warm pool for the duration of a block, closing it on the way out."""
+
+        # Inside the ``try``: ``fill`` keeps every child it has already started when a later one
+        # fails, so a partial fill that raises still has children to close.
+        try:
+            self.start_warm_pool(size=size)
+            yield self
+        finally:
+            self.close_warm_pool()
+
+    def parse(
+        self,
+        *,
+        request_id: str,
+        content: bytes,
+        data_format: str,
+        media_type: str,
+        filename: str,
+        limits: ParseLimits,
+    ) -> SandboxResult:
+        return self._invoke(
+            {
+                "schema_version": SANDBOX_PROTOCOL_VERSION,
+                "request_id": request_id,
+                "operation": "parse",
+                "content_base64": base64.b64encode(content).decode("ascii"),
+                "data_format": data_format,
+                "media_type": media_type,
+                "filename": filename,
+                "parse_limits": _parse_limits_dict(limits),
+                "url": None,
+                "allowed_hostnames": [],
+                "approved_endpoints": [],
+                "retrieval_limits": None,
+                "network_probe_targets": [],
+                "reader_pin": None,
+                "reader_budgets": None,
+                "range_plan": None,
+                "cycle_survey": None,
+            },
+            approved_endpoints=(),
+        )
+
+    def decode_and_parse(
+        self,
+        *,
+        request_id: str,
+        content: bytes,
+        reader_pin: Mapping[str, Any],
+        output_format: str,
+        limits: ParseLimits,
+        reader_budgets: Mapping[str, Any] | None = None,
+    ) -> SandboxResult:
+        """Decode untrusted bytes with the pinned Reader, inside the confinement.
+
+        A fourth operation rather than a widened ``parse``. ``parse`` returns a table and a
+        Reader must hand back **bytes**, because those bytes become the sealed snapshot.
+        Widening ``parse`` would silently grow what a ``parse``-attested worker may do, which
+        is a security regression disguised as a smaller diff; a separate operation carries its
+        own policy digest and leaves the other three unrotated.
+
+        ``output_format`` is the encoding the coordinator will accept back and is what the
+        operation's ``parser_formats`` clause is checked against, so a decode that would seal
+        an unattested encoding is refused before the family runs. ``reader_budgets`` may only
+        narrow the family's own defaults; it can never buy more room than the family allows.
+        """
+
+        return self._invoke(
+            {
+                "schema_version": SANDBOX_PROTOCOL_VERSION,
+                "request_id": request_id,
+                "operation": "decode_and_parse",
+                "content_base64": base64.b64encode(content).decode("ascii"),
+                "data_format": output_format,
+                # The media type and the filename of the parsed artifact are the Reader
+                # family's declarations, not the coordinator's choice, so they travel back on
+                # the response rather than out on the request.
+                "media_type": None,
+                "filename": None,
+                "parse_limits": _parse_limits_dict(limits),
+                "url": None,
+                "allowed_hostnames": [],
+                "approved_endpoints": [],
+                "retrieval_limits": None,
+                "network_probe_targets": [],
+                "reader_pin": dict(reader_pin),
+                "reader_budgets": None if reader_budgets is None else dict(reader_budgets),
+                "range_plan": None,
+                "cycle_survey": None,
+            },
+            approved_endpoints=(),
+        )
+
+    def retrieve_and_parse(
+        self,
+        *,
+        request_id: str,
+        url: str,
+        allowed_hostnames: tuple[str, ...],
+        data_format: str,
+        filename: str,
+        parse_limits: ParseLimits,
+        retrieval_limits: RetrievalLimits,
+    ) -> SandboxResult:
+        _validate_egress_hosts(allowed_hostnames)
+        if self._external_network_policy_attestation is None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_OS_BOUNDARY",
+                (
+                    "live retrieval requires an explicit externally enforced "
+                    "deny-default public-IP network policy attestation"
+                ),
+            )
+        approved_endpoints = _resolve_approved_endpoints(url, allowed_hostnames)
+        return self._invoke(
+            {
+                "schema_version": SANDBOX_PROTOCOL_VERSION,
+                "request_id": request_id,
+                "operation": "retrieve_and_parse",
+                "content_base64": None,
+                "data_format": data_format,
+                "media_type": None,
+                "filename": filename,
+                "parse_limits": _parse_limits_dict(parse_limits),
+                "url": url,
+                "allowed_hostnames": list(allowed_hostnames),
+                "approved_endpoints": [
+                    {
+                        "hostname": hostname,
+                        "port": port,
+                        "approved_ips": list(addresses),
+                    }
+                    for hostname, port, addresses in approved_endpoints
+                ],
+                "retrieval_limits": _retrieval_limits_dict(retrieval_limits),
+                "network_probe_targets": [],
+                "reader_pin": None,
+                "reader_budgets": None,
+                "range_plan": None,
+                "cycle_survey": None,
+            },
+            approved_endpoints=approved_endpoints,
+        )
+
+    def retrieve_decode_and_parse(
+        self,
+        *,
+        request_id: str,
+        url: str,
+        allowed_hostnames: tuple[str, ...],
+        reader_pin: Mapping[str, Any],
+        output_format: str,
+        parse_limits: ParseLimits,
+        retrieval_limits: RetrievalLimits,
+        reader_budgets: Mapping[str, Any] | None = None,
+    ) -> SandboxResult:
+        """Retrieve, decode, and parse one Reader-pinned public HTTPS source.
+
+        This is one operation because fetched container bytes must stay inside the clean room.
+        Returning them to the coordinator between network and decode operations would create an
+        unconfined materialization path and no single attestation would describe the composition.
+        """
+
+        _validate_egress_hosts(allowed_hostnames)
+        if self._external_network_policy_attestation is None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_OS_BOUNDARY",
+                (
+                    "live Reader retrieval requires an explicit externally enforced "
+                    "deny-default public-IP network policy attestation"
+                ),
+            )
+        approved_endpoints = _resolve_approved_endpoints(url, allowed_hostnames)
+        return self._invoke(
+            {
+                "schema_version": SANDBOX_PROTOCOL_VERSION,
+                "request_id": request_id,
+                "operation": "retrieve_decode_and_parse",
+                "content_base64": None,
+                "data_format": output_format,
+                "media_type": None,
+                "filename": None,
+                "parse_limits": _parse_limits_dict(parse_limits),
+                "url": url,
+                "allowed_hostnames": list(allowed_hostnames),
+                "approved_endpoints": [
+                    {
+                        "hostname": hostname,
+                        "port": port,
+                        "approved_ips": list(addresses),
+                    }
+                    for hostname, port, addresses in approved_endpoints
+                ],
+                "retrieval_limits": _retrieval_limits_dict(retrieval_limits),
+                "network_probe_targets": [],
+                "reader_pin": dict(reader_pin),
+                "reader_budgets": None if reader_budgets is None else dict(reader_budgets),
+                "range_plan": None,
+                "cycle_survey": None,
+            },
+            approved_endpoints=approved_endpoints,
+        )
+
+    def fetch_ranges(
+        self,
+        *,
+        request_id: str,
+        sidecar_url: str,
+        object_url: str,
+        selectors: tuple[str, ...],
+        allowed_hostnames: tuple[str, ...],
+        retrieval_limits: RetrievalLimits,
+        expected_reference_time: str | None = None,
+    ) -> SandboxResult:
+        """Fetch an index sidecar and every slice it names, in one clean-room invocation.
+
+        One invocation is not an optimisation. ``_resolve_approved_endpoints`` runs once per
+        invocation, so one invocation is the only way N ranges share one DNS epoch and one
+        retrieval budget; a second invocation would be a second chance to be rebound between
+        the sidecar that says where to look and the slice taken from there.
+
+        Both addresses are supplied here and travel together. The worker is never asked to
+        derive the sidecar's address from the object's, because an address a worker builds is
+        an address no coordinator resolved and pinned.
+
+        ``expected_reference_time`` is the model run this order is for, spelled
+        ``YYYY-MM-DDTHH:MM:SSZ``. Supplied, it binds every delivered message to that run in the
+        worker and again here -- the control the span check and the structural check cannot be,
+        because both are properties of a message alone and a re-issued run answers the ordered
+        span with a well-formed message of the same length. Omitted, the run binding is not in
+        force and the result says so rather than implying otherwise.
+        """
+
+        if expected_reference_time is not None:
+            expected_reference_time = require_reference_time_spelling(expected_reference_time)
+
+        _validate_egress_hosts(allowed_hostnames)
+        if self._external_network_policy_attestation is None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_OS_BOUNDARY",
+                (
+                    "slice fetching requires an explicit externally enforced "
+                    "deny-default public-IP network policy attestation"
+                ),
+            )
+        approved_endpoints = _resolve_approved_endpoints(sidecar_url, allowed_hostnames)
+        result = self._invoke(
+            {
+                "schema_version": SANDBOX_PROTOCOL_VERSION,
+                "request_id": request_id,
+                "operation": "fetch_ranges",
+                "content_base64": None,
+                "data_format": None,
+                "media_type": None,
+                "filename": None,
+                "parse_limits": None,
+                "url": None,
+                "allowed_hostnames": list(allowed_hostnames),
+                "approved_endpoints": [
+                    {
+                        "hostname": hostname,
+                        "port": port,
+                        "approved_ips": list(addresses),
+                    }
+                    for hostname, port, addresses in approved_endpoints
+                ],
+                "retrieval_limits": _retrieval_limits_dict(retrieval_limits),
+                "network_probe_targets": [],
+                "reader_pin": None,
+                "reader_budgets": None,
+                "range_plan": {
+                    "sidecar_url": sidecar_url,
+                    "object_url": object_url,
+                    "selectors": list(selectors),
+                    "max_ranges": retrieval_limits.max_ranges,
+                    "expected_reference_time": expected_reference_time,
+                },
+                "cycle_survey": None,
+            },
+            approved_endpoints=approved_endpoints,
+        )
+        # The response is evidence, not testimony -- the same posture the slices themselves are
+        # held to. The worker refuses a sidecar answered off the object's origin; the
+        # coordinator re-makes that check on the address the worker reports, so a response that
+        # named no delivered sidecar address at all, or named one somewhere else, is refused on
+        # this side too rather than being taken on the worker's word.
+        if result.final_url is None or _https_origin(
+            result.final_url, code="SANDBOX_SIDECAR_ORIGIN"
+        ) != _https_origin(object_url, code="SANDBOX_SIDECAR_ORIGIN"):
+            raise AcquisitionSecurityError(
+                "SANDBOX_SIDECAR_ORIGIN",
+                "the clean room's response does not bind the index sidecar to the object's origin",
+            )
+        return result
+
+    def survey_cycles(
+        self,
+        *,
+        request_id: str,
+        candidates: tuple[CycleCandidate, ...],
+        allowed_hostnames: tuple[str, ...],
+        retrieval_limits: RetrievalLimits,
+    ) -> SandboxResult:
+        """Report which of these candidate runs exist. Report only -- never choose one.
+
+        This is the *look* half of look-then-lock. The candidate list is supplied here, by the
+        side that already holds wall-clock authority and the watermark; the worker probes each
+        address and says present or absent, and the coordinator locks one and orders exactly
+        that. Discovery deliberately does not move into the worker: a candidate a worker
+        derived from its own clock at run time is a candidate no coordinator pinned, which is
+        the execution binding this boundary exists to preserve.
+
+        A candidate that is not published yet is reported absent and the invocation succeeds.
+        Every other failure -- a server error, a TLS failure, a peer outside the pin, a source
+        that ignored the range -- fails the whole invocation, because a broken source reported
+        as "nothing new yet" is a dataset that stops updating and never says so.
+        """
+
+        _validate_egress_hosts(allowed_hostnames)
+        if self._external_network_policy_attestation is None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_OS_BOUNDARY",
+                (
+                    "an availability survey requires an explicit externally enforced "
+                    "deny-default public-IP network policy attestation"
+                ),
+            )
+        # Before ``_resolve_approved_endpoints``, which performs real DNS. A candidate set that
+        # was never going to be admitted must cost no lookup, on this host or on the source's.
+        _require_surveyable_candidates(candidates, allowed_hostnames=allowed_hostnames)
+        approved_endpoints = _resolve_approved_endpoints(candidates[0].url, allowed_hostnames)
+        return self._invoke(
+            {
+                "schema_version": SANDBOX_PROTOCOL_VERSION,
+                "request_id": request_id,
+                "operation": "survey_cycles",
+                "content_base64": None,
+                "data_format": None,
+                "media_type": None,
+                "filename": None,
+                "parse_limits": None,
+                "url": None,
+                "allowed_hostnames": list(allowed_hostnames),
+                "approved_endpoints": [
+                    {
+                        "hostname": hostname,
+                        "port": port,
+                        "approved_ips": list(addresses),
+                    }
+                    for hostname, port, addresses in approved_endpoints
+                ],
+                "retrieval_limits": _retrieval_limits_dict(retrieval_limits),
+                "network_probe_targets": [],
+                "reader_pin": None,
+                "reader_budgets": None,
+                "range_plan": None,
+                "cycle_survey": {
+                    "candidates": [
+                        {"label": candidate.label, "url": candidate.url} for candidate in candidates
+                    ]
+                },
+            },
+            approved_endpoints=approved_endpoints,
+        )
+
+    def probe_isolation(
+        self,
+        *,
+        request_id: str,
+        loopback_probe_port: int = 9,
+    ) -> SandboxResult:
+        if type(loopback_probe_port) is not int or not 1 <= loopback_probe_port <= 65_535:
+            raise AcquisitionSecurityError(
+                "SANDBOX_PROBE",
+                "loopback probe port must be a valid integer",
+            )
+        return self._invoke(
+            {
+                "schema_version": SANDBOX_PROTOCOL_VERSION,
+                "request_id": request_id,
+                "operation": "probe",
+                "content_base64": None,
+                "data_format": None,
+                "media_type": None,
+                "filename": None,
+                "parse_limits": None,
+                "url": None,
+                "allowed_hostnames": [],
+                "approved_endpoints": [],
+                "retrieval_limits": None,
+                "network_probe_targets": [
+                    {"label": "loopback", "ip": "127.0.0.1", "port": loopback_probe_port},
+                    {"label": "private", "ip": "10.0.0.1", "port": 443},
+                    {"label": "metadata", "ip": "169.254.169.254", "port": 80},
+                ],
+                "reader_pin": None,
+                "reader_budgets": None,
+                "range_plan": None,
+                "cycle_survey": None,
+            },
+            approved_endpoints=(),
+        )
+
+    def _worker_launch(self, *, prewarm: bool) -> _WorkerLaunch:
+        """Build the exact confinement one child is started in.
+
+        One builder for both paths. A warm child and the cold child it stands in for are
+        started from the same specification produced by the same code, so "is a warm child
+        indistinguishable from a fresh spawn" is answered by construction rather than by two
+        launch sites that have to be kept in agreement.
+        """
+
+        command = [
+            self._python,
+            "-I",
+            "-m",
+            "mostlyright.data_harness.acquisition.sandbox",
+            "--worker",
+        ]
+        # One rule, no platform arm. Before ADR 0021 there were two boundaries here: an
+        # external deny-default one that every host had to attest, and macOS Seatbelt, which
+        # this process composed for itself and which therefore excused a darwin host from the
+        # attestation for non-networking operations. ADR 0021 deletes the Seatbelt backend --
+        # "The Linux cgroups-v2 sandbox remains and becomes the only boundary implementation,
+        # protecting our workers. The Seatbelt backend and every user-machine enforcement path
+        # leave the product surface." What is left is the rule that always applied to every
+        # other host: no attested boundary, no clean room. A host that cannot present one fails
+        # closed rather than running unconfined, which is the same answer this code has always
+        # given on Windows.
+        if (
+            self._external_network_policy_attestation is None
+            and self._hosted_session_container_memory_bytes is None
+        ):
+            raise AcquisitionSecurityError(
+                "SANDBOX_OS_BOUNDARY",
+                (
+                    "crawler execution requires an explicit externally enforced "
+                    "deny-default network policy attestation"
+                ),
+            )
+        return _WorkerLaunch(
+            command=tuple(command),
+            cwd=self._staging_root,
+            env=tuple(sorted(_ALLOWED_ENVIRONMENT.items())),
+            prewarm=prewarm,
+        )
+
+    def _invoke(
+        self,
+        request: dict[str, Any],
+        *,
+        approved_endpoints: tuple[tuple[str, int, tuple[str, ...]], ...],
+    ) -> SandboxResult:
+        # Socket authority is derived from the operation being invoked, never handed in
+        # beside it. A ``network_allowed`` argument written at each call site was a second
+        # literal that could disagree with the ``network`` clause this same operation
+        # attests, and the disagreement was invisible: the profile would carry a live
+        # TCP/443 rule while the digest-bound document said ``"os-denied"``. Reading the
+        # authority out of ``request["operation"]`` makes the grant and the attestation the
+        # same decision, taken once, from one set.
+        operation = request["operation"]
+        if operation not in SANDBOX_OPERATIONS:
+            raise AcquisitionSecurityError(
+                "SANDBOX_OPERATION",
+                "sandbox operation is not allowlisted",
+            )
+        network_allowed = operation in NETWORK_PERFORMING_OPERATIONS
+        if self._hosted_session_container_memory_bytes is not None and operation != "parse":
+            raise AcquisitionSecurityError(
+                "SANDBOX_OS_BOUNDARY",
+                "hosted-session container confinement admits only no-network parsing",
+            )
+        # Was darwin-only, and is now every host that is not Linux. The refusal never really
+        # was about macOS: it was about there being no cgroup to bound a Reader's memory with,
+        # which is true of every host without cgroups v2. Seatbelt used to make macOS the one
+        # non-Linux host that got this far with a boundary of its own; with it gone (ADR 0021
+        # ADR 0021) there is no reason to keep naming one platform. The typed code is unchanged,
+        # because ``SANDBOX_MEMORY_BOUNDARY`` is what callers and receipts already read.
+        if operation in READER_PERFORMING_OPERATIONS and sys.platform != "linux":
+            raise AcquisitionSecurityError(
+                "SANDBOX_MEMORY_BOUNDARY",
+                "Clean room Reader execution has no enforceable memory boundary off Linux",
+            )
+        if approved_endpoints and not network_allowed:
+            # Endpoints for an operation that attests no network is a caller confusion, not
+            # something to quietly discard: the request it built is not the request its
+            # policy document describes.
+            raise AcquisitionSecurityError(
+                "SANDBOX_OPERATION",
+                "an operation that attests no network was given approved endpoints",
+            )
+        request = {
+            **request,
+            "external_network_policy_attestation": (self._external_network_policy_attestation),
+        }
+        request_bytes = _ipc_json_bytes(request)
+        if len(request_bytes) > MAX_REQUEST_BYTES:
+            raise AcquisitionSecurityError(
+                "SANDBOX_IPC_LIMIT",
+                "sandbox request exceeds the IPC byte budget",
+            )
+        if (
+            sys.platform == "linux"
+            and self._memory_cgroup_root_fd is None
+            and self._hosted_session_container_memory_bytes is None
+        ):
+            raise AcquisitionSecurityError(
+                "SANDBOX_MEMORY_BOUNDARY",
+                "Linux Clean room execution requires a trusted bounded cgroup root",
+            )
+        launch = self._worker_launch(prewarm=False)
+        # A warm child is only ever taken for a confinement identical to the one this
+        # invocation would have spawned for itself, and only when no socket is in play. Taking
+        # it removes it from the pool: a child is handed out once, serves this one request,
+        # and exits.
+        prepared: _PreparedWorker | None = None
+        if self._warm_pool is not None and not network_allowed:
+            prepared = self._warm_pool.take(launch)
+        if prepared is None:
+            # No warm child for this confinement: the untouched cold path, spawn and all.
+            stdout, stderr, returncode = _run_worker_command(
+                launch.argv(),
+                cwd=launch.cwd,
+                env=dict(launch.env),
+                request_bytes=request_bytes,
+                timeout_seconds=self._timeout_seconds,
+                memory_cgroup_root_fd=self._memory_cgroup_root_fd,
+                hosted_session_container_memory_bytes=(self._hosted_session_container_memory_bytes),
+            )
+        else:
+            stdout, stderr, returncode = _complete_worker(
+                prepared,
+                request_bytes=request_bytes,
+                timeout_seconds=self._timeout_seconds,
+                terminate_process_group=(self._hosted_session_container_memory_bytes is not None),
+            )
+        if returncode != 0:
+            refusal = _bounded_worker_error(stderr, returncode=returncode)
+            raise ConfinedWorkerRefusal(
+                "SANDBOX_FAILURE",
+                f"sandbox failed closed: {refusal.message}",
+                worker_code=refusal.code,
+                operation=operation,
+            )
+        response = _strict_json_object(stdout, "sandbox.response")
+        survey = request["cycle_survey"]
+        range_plan = request["range_plan"]
+        return _parse_response(
+            response,
+            expected_request_id=request["request_id"],
+            # The operation this invocation ordered. The policy attestation below is only an
+            # attestation if the operation it is derived from is the coordinator's, not the
+            # responder's.
+            expected_operation=request["operation"],
+            expected_external_network_policy_attestation=(
+                self._external_network_policy_attestation
+            ),
+            # The labels this invocation ordered, in the order it ordered them. A survey result
+            # is matched back to a run by label, so the coordinator checks the answer set
+            # against its own question rather than trusting the response to have kept both.
+            expected_cycle_labels=(
+                None
+                if survey is None
+                else tuple(candidate["label"] for candidate in survey["candidates"])
+            ),
+            # The descriptors this invocation ordered. One selector is one message, so the set
+            # is known from the request alone: a short answer is a partial acquisition rather
+            # than a smaller success, and a slice that answers a descriptor nobody named is
+            # refused rather than carried back under a label the coordinator never asked for.
+            expected_selectors=(None if range_plan is None else tuple(range_plan["selectors"])),
+            # The model run this invocation ordered, when it ordered one. Read from the
+            # coordinator's own request rather than from the response, for the same reason the
+            # count above is: a binding a response supplies for itself binds nothing.
+            expected_reference_time=(
+                None if range_plan is None else range_plan["expected_reference_time"]
+            ),
+        )
+
+
+def sandbox_policy_digest(operation: str) -> str:
+    """Return the exact policy digest the coordinator must bind into its context."""
+
+    # The coordinator and worker read the same operation allowlist.
+    if operation not in SANDBOX_OPERATIONS:
+        raise AcquisitionSecurityError(
+            "SANDBOX_OPERATION",
+            "sandbox operation is not allowlisted",
+        )
+    return _policy_digest(operation)
+
+
+def worker_main(*, prewarm: bool = False) -> int:
+    """Read one bounded request from stdin and emit one canonical response.
+
+    One request, one response, one exit -- and ``prewarm`` does not change that. It only moves
+    two things earlier: the deferred parser imports, and a marker line saying they are done.
+    Both happen before stdin is read, so a pre-warmed child announces readiness while it still
+    holds nothing a caller supplied, and then behaves exactly as a cold child does.
+
+    Two handlers, and the second one is the point.  The typed handler carries the refusal's
+    own code out to the coordinator, which is how an operator is told what to fix.  The broad
+    handler underneath it exists because this worker runs on bytes a stranger supplied: a
+    decoder that reports its own failures with an exception type nobody mapped would otherwise
+    unwind out of the process, and the operator would be told only that the sandbox failed
+    closed, with no code and a Python traceback on the stream the coordinator reads.  Both
+    outcomes halt the run -- neither handler can make a failed job look like a finished one --
+    but only one of them says what happened.
+
+    The broad handler reports the exception's type and nothing else.  An unmapped failure has
+    no vetted message, and the text of an arbitrary exception may carry a path from inside the
+    confinement; the type name is enough to route a bug report and carries nothing a caller
+    supplied.  A failure arriving here is a defect in this codebase rather than a refusal a
+    recipe can repair, and the code says so.
+    """
+
+    if prewarm:
+        # Before the request, never after it: the point of priming is that the import cost is
+        # paid by an idle child rather than by a bound one. A failure here is a startup
+        # failure and is reported on the same channel every other worker refusal uses.
+        try:
+            prime_parquet_support()
+        except Exception as exc:
+            return _worker_error(
+                "SANDBOX_UNEXPECTED",
+                f"pre-warm raised {type(exc).__name__}, which no refusal maps",
+            )
+        sys.stdout.buffer.write(WORKER_READY_MARKER)
+        sys.stdout.buffer.flush()
+    raw = sys.stdin.buffer.read(MAX_REQUEST_BYTES + 1)
+    if len(raw) > MAX_REQUEST_BYTES:
+        return _worker_error("SANDBOX_IPC_LIMIT", "request exceeds the IPC byte budget")
+    try:
+        request = _strict_json_object(raw, "sandbox.request")
+        response = _execute_worker_request(request)
+        encoded = _ipc_json_bytes(response)
+        if len(encoded) > MAX_RESPONSE_BYTES:
+            raise AcquisitionSecurityError(
+                "SANDBOX_IPC_LIMIT",
+                "response exceeds the IPC byte budget",
+            )
+    except (AcquisitionSecurityError, ValueError, TypeError) as exc:
+        code = getattr(exc, "code", "SANDBOX_REQUEST")
+        return _worker_error(code, str(exc))
+    except Exception as exc:
+        return _worker_error(
+            "SANDBOX_UNEXPECTED",
+            f"the worker raised {type(exc).__name__}, which no refusal maps",
+        )
+    sys.stdout.buffer.write(encoded)
+    sys.stdout.buffer.flush()
+    return 0
+
+
+def _execute_worker_request(request: dict[str, Any]) -> dict[str, Any]:
+    expected = {
+        "schema_version",
+        "request_id",
+        "operation",
+        "content_base64",
+        "data_format",
+        "media_type",
+        "filename",
+        "parse_limits",
+        "url",
+        "allowed_hostnames",
+        "approved_endpoints",
+        "retrieval_limits",
+        "network_probe_targets",
+        # Reader authority. Every operation other than the decode sends both null and refuses
+        # them non-null, exactly as ``parse`` already refuses ``url``. This literal is not
+        # part of the policy document, so adding to it rotates no digest.
+        "reader_pin",
+        "reader_budgets",
+        "range_plan",
+        "cycle_survey",
+        "external_network_policy_attestation",
+    }
+    if set(request) != expected:
+        raise AcquisitionSecurityError(
+            "SANDBOX_FIELDS",
+            "sandbox request contains missing or extra fields",
+        )
+    if request["schema_version"] != SANDBOX_PROTOCOL_VERSION:
+        raise AcquisitionSecurityError("SANDBOX_VERSION", "sandbox protocol version is invalid")
+    request_id = _bounded_identifier(request["request_id"])
+    operation = request["operation"]
+    if operation not in SANDBOX_OPERATIONS:
+        raise AcquisitionSecurityError("SANDBOX_OPERATION", "sandbox operation is not allowlisted")
+    policy_digest = _policy_digest(operation)
+    external_network_policy_attestation = _optional_digest(
+        request["external_network_policy_attestation"]
+    )
+    visible_keys = tuple(sorted(os.environ))
+    base: dict[str, Any] = {
+        "schema_version": SANDBOX_PROTOCOL_VERSION,
+        "request_id": request_id,
+        "operation": operation,
+        "policy_digest": policy_digest,
+        "visible_environment_keys": list(visible_keys),
+        "parsed": None,
+        "content_base64": None,
+        "media_type": None,
+        "final_url": None,
+        "transport_evidence_digest": None,
+        "probe_transport": None,
+        "home_directory_readable": None,
+        "network_probe_errors": None,
+        "decode_family_id": None,
+        "decode_family_version": None,
+        "decode_options_digest": None,
+        "decode_flags": None,
+        "decode_declared_cell_count": None,
+        "fetched_content_sha256": None,
+        "fetched_content_size_bytes": None,
+        "fetched_total_response_body_size_bytes": None,
+        "fetched_request_count": None,
+        "ranges": None,
+        "cycle_availability": None,
+        "sidecar_content_sha256": None,
+        "sidecar_size_bytes": None,
+        "full_object_size_bytes": None,
+        "fetched_members": None,
+        "external_network_policy_attestation": external_network_policy_attestation,
+    }
+    if operation == "probe":
+        _require_null_request_fields(request)
+        probe_targets = _parse_network_probe_targets(request)
+        base["home_directory_readable"] = _home_directory_readable()
+        base["network_probe_errors"] = [
+            {"label": label, "errno": error}
+            for label, error in _probe_network_denials(probe_targets)
+        ]
+        return base
+
+    if operation == "fetch_ranges":
+        _require_no_reader_authority(request)
+        return _execute_range_plan(request, base)
+
+    if operation == "survey_cycles":
+        _require_no_reader_authority(request)
+        return _execute_cycle_survey(request, base)
+
+    if request["range_plan"] is not None or request["cycle_survey"] is not None:
+        raise AcquisitionSecurityError(
+            "SANDBOX_FIELDS",
+            "a parsing request must not carry a range plan or a candidate survey",
+        )
+    limits = _parse_parse_limits(request["parse_limits"])
+    data_format = _bounded_text(request["data_format"], maximum=16)
+    # The ``parser_formats`` clause of this operation's policy document is enforced here,
+    # before any bytes reach a parser.  Without this check the clause would be attested and
+    # digest-bound but never honoured: ``parse_tabular_bytes`` admits from the global format
+    # tables and never sees ``operation``, so a worker bound to a csv-only attestation would
+    # still decode parquet.  An operation absent from the registry declares no parser formats
+    # at all and therefore may parse nothing -- ``probe`` returns above and never reaches here.
+    #
+    # It runs before the filename is read rather than after, which is a move earlier and never
+    # later: no bytes reach a parser that would not have reached one before, and the decode
+    # operation declares no filename of its own because the Reader family declares it.
+    admitted_formats = PARSER_FORMATS_BY_OPERATION.get(operation)
+    if admitted_formats is None or data_format not in admitted_formats:
+        raise AcquisitionSecurityError(
+            "SANDBOX_FORMAT",
+            "sandbox operation is not attested to parse this data format",
+        )
+    if operation == "decode_and_parse":
+        return _decode_in_worker(request, base, output_format=data_format, limits=limits)
+    if operation == "retrieve_decode_and_parse":
+        return _retrieve_decode_in_worker(request, base, output_format=data_format, limits=limits)
+
+    _require_no_reader_authority(request)
+    filename = _bounded_text(request["filename"], maximum=255)
+    if operation == "parse":
+        if request["url"] is not None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_FIELDS",
+                "parse request contains retrieval-only fields",
+            )
+        if (
+            request["allowed_hostnames"] != []
+            or request["approved_endpoints"] != []
+            or request["retrieval_limits"] is not None
+            or request["network_probe_targets"] != []
+        ):
+            raise AcquisitionSecurityError(
+                "SANDBOX_FIELDS",
+                "parse request contains retrieval-only authority",
+            )
+        media_type = _bounded_text(request["media_type"], maximum=255)
+        content = _request_content(request)
+        parsed = parse_tabular_bytes(
+            content,
+            data_format=data_format,
+            media_type=media_type,
+            filename=filename,
+            limits=limits,
+        )
+        base["parsed"] = _parsed_dict(parsed)
+        return base
+
+    if request["content_base64"] is not None or request["media_type"] is not None:
+        raise AcquisitionSecurityError(
+            "SANDBOX_FIELDS",
+            "retrieve request cannot supply source bytes or choose response media type",
+        )
+    url = _bounded_text(request["url"], maximum=2_048)
+    allowed_hostnames = _string_tuple(
+        request["allowed_hostnames"],
+        maximum_items=32,
+        item_maximum=253,
+    )
+    _validate_egress_hosts(allowed_hostnames)
+    if request["network_probe_targets"] != []:
+        raise AcquisitionSecurityError(
+            "SANDBOX_FIELDS",
+            "retrieve request cannot carry network probes",
+        )
+    approved_resolver = _parse_approved_endpoints(
+        request["approved_endpoints"],
+        allowed_hostnames=allowed_hostnames,
+    )
+    retrieval_limits = _parse_retrieval_limits(request["retrieval_limits"])
+    retriever = PinnedHttpsRetriever(
+        resolver=approved_resolver,
+        egress_policy=EgressPolicy(allowed_hostnames=allowed_hostnames),
+        transport=StdlibPinnedTransport(),
+        limits=retrieval_limits,
+    )
+    retrieved = retriever.retrieve(url)
+    parsed = parse_tabular_bytes(
+        retrieved.content,
+        data_format=data_format,
+        media_type=retrieved.media_type,
+        filename=filename,
+        limits=limits,
+    )
+    base.update(
+        {
+            "parsed": _parsed_dict(parsed),
+            "content_base64": base64.b64encode(retrieved.content).decode("ascii"),
+            "media_type": retrieved.media_type,
+            "final_url": retrieved.final_url,
+            "transport_evidence_digest": retrieved.transport_evidence_digest,
+            "probe_transport": probe_transport_for(retrieved).to_dict(),
+        }
+    )
+    return base
+
+
+def _request_content(request: dict[str, Any]) -> bytes:
+    """Decode the request's carried bytes, refusing anything but canonical base64."""
+
+    try:
+        return base64.b64decode(
+            _bounded_text(request["content_base64"], maximum=MAX_REQUEST_BYTES),
+            validate=True,
+        )
+    except (ValueError, TypeError):
+        raise AcquisitionSecurityError(
+            "SANDBOX_BASE64",
+            "sandbox content is not canonical base64",
+        ) from None
+
+
+def _require_no_reader_authority(request: dict[str, Any]) -> None:
+    """Refuse Reader authority on an operation that is not the decode.
+
+    The mirror of the retrieval-only refusals: an operation that may not run a Reader must
+    refuse the fields that would name one, rather than ignoring them.  An ignored pin is a
+    decoder a caller believes it selected.
+    """
+
+    if request["reader_pin"] is not None or request["reader_budgets"] is not None:
+        raise AcquisitionSecurityError(
+            "SANDBOX_FIELDS",
+            "only the decode operation may carry Reader authority",
+        )
+
+
+def _decode_in_worker(
+    request: dict[str, Any],
+    base: dict[str, Any],
+    *,
+    output_format: str,
+    limits: ParseLimits,
+) -> dict[str, Any]:
+    """Run one pinned Reader on untrusted bytes and parse what it produced.
+
+    Two rules live here as comments rather than in a document, because they are the security
+    argument for admitting a decoder at all and not implementation detail.
+
+    * **The Reader never constructs a ``ParsedTable``.**  It returns bytes, and the one
+      allowlisted parser produces the table and its ``schema_digest`` from those bytes.  A
+      Reader therefore cannot attest a schema it did not derive.
+    * **The normalized bytes are parsed inside this same confined process.**  Untrusted bytes
+      never cross to the coordinator undecoded; what crosses is the Reader's own canonical
+      output and a table derived from it here, under the policy this operation is bound to.
+    """
+
+    if (
+        request["url"] is not None
+        or request["allowed_hostnames"] != []
+        or request["approved_endpoints"] != []
+        or request["retrieval_limits"] is not None
+        or request["network_probe_targets"] != []
+    ):
+        raise AcquisitionSecurityError(
+            "SANDBOX_FIELDS",
+            "decode request contains retrieval-only authority",
+        )
+    if request["media_type"] is not None or request["filename"] is not None:
+        raise AcquisitionSecurityError(
+            "SANDBOX_FIELDS",
+            "decode request cannot choose the media type or filename the Reader declares",
+        )
+    content = _request_content(request)
+    return _decode_content_in_worker(
+        request,
+        base,
+        output_format=output_format,
+        limits=limits,
+        content=content,
+    )
+
+
+def _retrieve_decode_in_worker(
+    request: dict[str, Any],
+    base: dict[str, Any],
+    *,
+    output_format: str,
+    limits: ParseLimits,
+) -> dict[str, Any]:
+    """Fetch Reader input and normalize it without exporting container bytes."""
+
+    if request["content_base64"] is not None or request["media_type"] is not None:
+        raise AcquisitionSecurityError(
+            "SANDBOX_FIELDS",
+            "Reader retrieval cannot supply source bytes or choose a response media type",
+        )
+    if request["filename"] is not None or request["network_probe_targets"] != []:
+        raise AcquisitionSecurityError(
+            "SANDBOX_FIELDS",
+            "Reader retrieval cannot choose a filename or carry network probes",
+        )
+    url = _bounded_text(request["url"], maximum=2_048)
+    allowed_hostnames = _string_tuple(
+        request["allowed_hostnames"], maximum_items=32, item_maximum=253
+    )
+    _validate_egress_hosts(allowed_hostnames)
+    approved_resolver = _parse_approved_endpoints(
+        request["approved_endpoints"], allowed_hostnames=allowed_hostnames
+    )
+    retrieval_limits = _parse_retrieval_limits(request["retrieval_limits"])
+    retrieved = PinnedHttpsRetriever(
+        resolver=approved_resolver,
+        egress_policy=EgressPolicy(allowed_hostnames=allowed_hostnames),
+        transport=StdlibPinnedTransport(),
+        limits=retrieval_limits,
+    ).retrieve(url)
+    base.update(
+        {
+            "final_url": retrieved.final_url,
+            "transport_evidence_digest": retrieved.transport_evidence_digest,
+            "probe_transport": probe_transport_for(retrieved).to_dict(),
+            "fetched_content_sha256": retrieved.content_sha256,
+            "fetched_content_size_bytes": len(retrieved.content),
+            "fetched_total_response_body_size_bytes": (retrieved.total_response_body_size_bytes),
+            # One redirect hop can contain several approved-IP transport attempts.  The
+            # retriever charges each of those attempts against ``max_requests``, so collection
+            # evidence must count the same measured events rather than merely the number of
+            # response hops.
+            "fetched_request_count": sum(len(hop.peer_attempts) for hop in retrieved.hops),
+        }
+    )
+    return _decode_content_in_worker(
+        request,
+        base,
+        output_format=output_format,
+        limits=limits,
+        content=retrieved.content,
+    )
+
+
+def _decode_content_in_worker(
+    request: dict[str, Any],
+    base: dict[str, Any],
+    *,
+    output_format: str,
+    limits: ParseLimits,
+    content: bytes,
+) -> dict[str, Any]:
+    """Run the exact pinned Reader and parse its normalized bytes."""
+
+    pin = _reader_pin_from_request(request["reader_pin"])
+    caps = request["reader_budgets"]
+    if caps is not None and not isinstance(caps, dict):
+        raise AcquisitionSecurityError("SANDBOX_FIELDS", "decode request budgets are invalid")
+
+    # Resolution is against the closed Toolbox on an exact coordinate, with no fallback and
+    # no discovery path, and it happens here inside the confinement.  An unattested decoder
+    # cannot run even if a request naming one reached the worker.
+    family = TOOLBOX.resolve(pin.family_id, pin.family_version)
+    # Admission before decode: the family's declared output encoding is checked against the
+    # encoding this operation is attested to parse, so a family that would seal an unattested
+    # encoding is refused before it sees a byte.
+    if family.output_format != output_format:
+        raise AcquisitionSecurityError(
+            "SANDBOX_FORMAT",
+            "the pinned Reader family does not emit the format this request is attested to seal",
+        )
+    budgets = family.default_budgets.narrowed_by(caps)
+    if len(content) > budgets.max_input_bytes:
+        raise AcquisitionSecurityError(
+            "SANDBOX_IPC_LIMIT",
+            "decode input exceeds the Reader input byte budget",
+        )
+    result = family.decode(content, pin, budgets)
+    result.validate_for(family.output_format, budgets)
+    parsed = parse_tabular_bytes(
+        result.content,
+        data_format=result.data_format,
+        media_type=result.media_type,
+        filename=result.filename,
+        limits=limits,
+    )
+    base.update(
+        {
+            "parsed": _parsed_dict(parsed),
+            "content_base64": base64.b64encode(result.content).decode("ascii"),
+            "media_type": result.media_type,
+            "decode_family_id": family.family_id,
+            "decode_family_version": family.family_version,
+            "decode_options_digest": pin.options_digest,
+            # Already sorted and de-duplicated by ``ReaderResult``; carried as data because
+            # the coordinator cannot recompute a fact about a decode it did not run.
+            "decode_flags": list(result.flags),
+            "decode_declared_cell_count": result.declared_cell_count,
+        }
+    )
+    return base
+
+
+def _reader_pin_from_request(value: Any) -> ReaderPin:
+    """Admit the request's Reader pin as the contract's own three-key object."""
+
+    if not isinstance(value, dict) or set(value) != {
+        "family_id",
+        "family_version",
+        "decode_options",
+    }:
+        raise AcquisitionSecurityError(
+            "SANDBOX_FIELDS",
+            "decode request must carry exactly a three-key Reader pin",
+        )
+    return ReaderPin(value["family_id"], value["family_version"], value["decode_options"])
+
+
+def _execute_range_plan(request: dict[str, Any], base: dict[str, Any]) -> dict[str, Any]:
+    """Validate a slice-fetch request's authority and its plan, then run it.
+
+    Ordered so that every refusal that can be made from the request alone is made before any
+    address is looked at: parsing inputs first, then probe authority, then egress, then the
+    pinned endpoint set, then the retrieval budget, and only then the plan those bounds apply
+    to. A plan checked against a budget that had not been validated would be checked against
+    nothing.
+    """
+
+    for key in ("content_base64", "data_format", "media_type", "filename", "parse_limits", "url"):
+        if request[key] is not None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_FIELDS",
+                "a slice fetch carries no parsing inputs and no single-object URL",
+            )
+    if request["network_probe_targets"] != [] or request["cycle_survey"] is not None:
+        raise AcquisitionSecurityError(
+            "SANDBOX_FIELDS",
+            "a slice fetch cannot carry network probes or a candidate survey",
+        )
+    allowed_hostnames = _string_tuple(
+        request["allowed_hostnames"],
+        maximum_items=32,
+        item_maximum=253,
+    )
+    _validate_egress_hosts(allowed_hostnames)
+    approved_resolver = _parse_approved_endpoints(
+        request["approved_endpoints"],
+        allowed_hostnames=allowed_hostnames,
+    )
+    retrieval_limits = _parse_retrieval_limits(request["retrieval_limits"])
+    plan = _parse_range_plan(request["range_plan"], budget_ceiling=retrieval_limits.max_ranges)
+
+    # One resolver, one transport and one limiter for the whole plan. The resolver is the
+    # coordinator's single DNS epoch, already pinned to exact public addresses; reusing it is
+    # what stops a rebind between the sidecar that says where to look and the slice taken
+    # from there. The limiter is shared for the other half of the same property: N sequential
+    # fetches against one source must be polite as one acquisition rather than as N bursts.
+    #
+    # Two retrievers rather than one, differing only in their media allowlist, because a
+    # sidecar and a slice are different responses and each call should admit only the one it
+    # ordered. Both narrow within whatever the coordinator already allowed and neither can
+    # widen it.
+    egress_policy = EgressPolicy(allowed_hostnames=allowed_hostnames)
+    transport = StdlibPinnedTransport()
+    limiter = AcquisitionLimiter(
+        max_concurrency=retrieval_limits.max_concurrency,
+        min_interval_seconds=retrieval_limits.min_interval_seconds,
+    )
+
+    def retriever(media_types: tuple[str, ...]) -> PinnedHttpsRetriever:
+        return PinnedHttpsRetriever(
+            resolver=approved_resolver,
+            egress_policy=egress_policy,
+            transport=transport,
+            limits=_narrowed_to_media_types(retrieval_limits, media_types),
+            limiter=limiter,
+        )
+
+    # Construct both narrowed retrievers before any request. A coordinator allowlist that
+    # admits neither half is therefore still a request-free refusal even though the retained
+    # presence probe itself admits any media type.
+    sidecar_retriever = retriever(SIDECAR_MEDIA_TYPES)
+    slice_retriever = retriever(SLICE_OBJECT_MEDIA_TYPES)
+    member_documents: list[dict[str, Any]] = []
+
+    def retain_members(role: str, hops: tuple[RetrievalHop, ...]) -> None:
+        for hop in hops:
+            member_documents.append(
+                {
+                    "role": role,
+                    "sequence": len(member_documents),
+                    **hop.to_dict(),
+                }
+            )
+
+    sidecar = sidecar_retriever.retrieve(plan.sidecar_url)
+    retain_members("sidecar_initial", sidecar.hops)
+    # ``_parse_range_plan`` bound the sidecar and the object to one origin, but it bound the
+    # address that was *ordered*. An unranged retrieval follows redirects, so without this the
+    # ordered host can hand the sidecar fetch to any other allowlisted host, and that host then
+    # chooses which bytes of the first host's object are delivered: it renames the offsets of a
+    # message the operator did not order to the descriptor the operator did order, and every
+    # control downstream still passes -- exactly 206, a matching ``Content-Range``, three
+    # lengths in agreement, and a structurally valid GRIB message, just the wrong field. The
+    # ranged fetches are already closed to this by ``REDIRECT_ON_RANGE``; this is the same
+    # property for the half of the order that says where to look. Compared against the object's
+    # origin rather than the ordered sidecar's, because those two are equal by the check above
+    # and the object is the thing whose bytes the index is allowed to speak for.
+    if _https_origin(sidecar.final_url, code="SANDBOX_SIDECAR_ORIGIN") != _https_origin(
+        plan.object_url, code="SANDBOX_SIDECAR_ORIGIN"
+    ):
+        raise AcquisitionSecurityError(
+            "SANDBOX_SIDECAR_ORIGIN",
+            "the index sidecar was answered by an origin other than the object's",
+        )
+    # The address that actually answered, so the receipt can state it rather than restating the
+    # address that was ordered. The hop list is digested, not carried, so this is the only field
+    # in which a redirect that was allowed is legible after the fact.
+    base["final_url"] = sidecar.final_url
+    # The sidecar is untrusted input from here on. Its numbers may become a ``ByteRange`` and
+    # nothing else: never an address, never an allocation size, never a length trusted without
+    # the bytes that arrive being measured against it.
+    messages = parse_index_sidecar(sidecar.content, limits=SidecarLimits())
+    planned = plan_ranges(messages, selectors=plan.selectors, max_ranges=plan.max_ranges)
+    _require_slice_bytes_within_budget(planned, limits=retrieval_limits)
+
+    # The selected cycle is probed again inside the acquisition's DNS epoch. Unlike
+    # ``survey_cycles`` this is retained evidence: the object has already been chosen, so the
+    # exact one-byte response and every redirect body belong in the receipt and efficiency
+    # numerator rather than being accepted as a caller-supplied count.
+    probe_retriever = PinnedHttpsRetriever(
+        resolver=approved_resolver,
+        egress_policy=egress_policy,
+        transport=transport,
+        limits=retrieval_limits,
+        limiter=limiter,
+    )
+    probe = probe_retriever.retrieve_presence_evidence(plan.object_url)
+    retain_members("cycle_probe", probe.hops)
+
+    hops = [*sidecar.hops, *probe.hops]
+    slices: list[dict[str, Any]] = []
+    complete_sizes: set[int] = set()
+    for entry in planned:
+        # ``retrieve`` runs the delivery check: exactly 206, a ``Content-Range`` equal to the
+        # span that was ordered, three lengths in agreement. That proves the span. It cannot
+        # prove the framing, so the structural check below runs before this slice is kept, and
+        # neither proves which run the bytes came from, so the run binding below runs too when
+        # the order named a run. Any of the three refusing fails the whole invocation. A
+        # partial slice set is not a smaller success; it is an acquisition that did not happen.
+        parcel = slice_retriever.retrieve(plan.object_url, byte_range=entry.byte_range)
+        hops.extend(parcel.hops)
+        retain_members("selected_slice", parcel.hops)
+        check_grib_message(parcel.content)
+        # The run binding, when the order named a run. Ordered after the structural check
+        # because that check is what makes the section offsets below meaningful at all.
+        if plan.expected_reference_time is not None:
+            check_grib_reference_time(parcel.content, expected=plan.expected_reference_time)
+        if parcel.complete_size_bytes is None:
+            raise AcquisitionSecurityError(
+                "CONTENT_RANGE",
+                "a slice response must name the complete object size",
+            )
+        complete_sizes.add(parcel.complete_size_bytes)
+        slices.append(
+            {
+                "index": entry.index,
+                # The selector this span was planned for. The plan is emitted in message-index
+                # order, so without it the response says which message it delivered and never
+                # which of the ordered descriptors that message answers.
+                "descriptor": entry.descriptor,
+                "first_byte": entry.byte_range.first_byte,
+                "last_byte": entry.byte_range.last_byte,
+                "sha256": parcel.content_sha256,
+                "content_base64": base64.b64encode(parcel.content).decode("ascii"),
+            }
+        )
+    # Re-read the complete sidecar only after every selected member has arrived. The source
+    # revision is admitted only when the terminal bytes are identical to the bytes that chose
+    # the ranges; an update during the acquisition is a refusal, never a mixed revision.
+    terminal_sidecar = sidecar_retriever.retrieve(plan.sidecar_url)
+    retain_members("sidecar_final", terminal_sidecar.hops)
+    hops.extend(terminal_sidecar.hops)
+    if (
+        terminal_sidecar.content_sha256 != sidecar.content_sha256
+        or terminal_sidecar.content != sidecar.content
+        or terminal_sidecar.final_url != sidecar.final_url
+    ):
+        raise AcquisitionSecurityError(
+            "SANDBOX_SOURCE_REVISION",
+            "the index sidecar changed while selected messages were being fetched",
+        )
+    base["final_url"] = terminal_sidecar.final_url
+    base["ranges"] = slices
+    if probe.complete_size_bytes is None:
+        raise AcquisitionSecurityError(
+            "CONTENT_RANGE",
+            "the retained cycle probe must name the complete object size",
+        )
+    complete_sizes.add(probe.complete_size_bytes)
+    if len(complete_sizes) != 1:
+        raise AcquisitionSecurityError(
+            "CONTENT_RANGE",
+            "all slice responses must name one complete object size",
+        )
+    base["sidecar_content_sha256"] = sidecar.content_sha256
+    base["sidecar_size_bytes"] = len(sidecar.content)
+    base["full_object_size_bytes"] = complete_sizes.pop()
+    base["fetched_members"] = member_documents
+    # One acquisition, one transport evidence digest: the sidecar hop followed by every range
+    # hop in fetch order, flattened, digested exactly as a single retrieval's hop list is.
+    base["transport_evidence_digest"] = canonical_sha256([hop.to_dict() for hop in hops])
+    return base
+
+
+def _execute_cycle_survey(request: dict[str, Any], base: dict[str, Any]) -> dict[str, Any]:
+    """Probe each coordinator-supplied candidate once and report presence, in their order.
+
+    Ordered exactly as ``_execute_range_plan`` is: every refusal that can be made from the
+    request alone is made before any address is looked at, so a candidate set that was never
+    going to be admitted costs no request against a source that has done nothing wrong.
+    """
+
+    for key in ("content_base64", "data_format", "media_type", "filename", "parse_limits", "url"):
+        if request[key] is not None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_FIELDS",
+                "an availability survey carries no parsing inputs and no single-object URL",
+            )
+    if request["network_probe_targets"] != [] or request["range_plan"] is not None:
+        raise AcquisitionSecurityError(
+            "SANDBOX_FIELDS",
+            "an availability survey cannot carry network probes or a range plan",
+        )
+    allowed_hostnames = _string_tuple(
+        request["allowed_hostnames"],
+        maximum_items=32,
+        item_maximum=253,
+    )
+    _validate_egress_hosts(allowed_hostnames)
+    approved_resolver = _parse_approved_endpoints(
+        request["approved_endpoints"],
+        allowed_hostnames=allowed_hostnames,
+    )
+    retrieval_limits = _parse_retrieval_limits(request["retrieval_limits"])
+    candidates = _parse_cycle_survey(
+        request["cycle_survey"],
+        allowed_hostnames=allowed_hostnames,
+    )
+
+    # One retriever for the candidate set, so one resolver, one transport and one limiter cover
+    # it: the survey is polite to a source as one look rather than as N bursts, and every probe
+    # is answered inside the single DNS epoch the coordinator pinned.
+    #
+    # Every probe goes through ``probe_presence``, which admits any media type. The survey does
+    # not know what a candidate is -- a cycle-addressed CSV run and a GRIB object are both
+    # legitimate candidates, and the GRIB case answers ``application/octet-stream``, which the
+    # default acquisition allowlist deliberately excludes. Judging presence by content type
+    # would report a healthy published run as a hard failure on every poll. The coordinator's
+    # ``retrieval_limits`` still govern this call in every other respect -- budgets, timeouts,
+    # redirects, response ceiling and rate limit -- and its media allowlist governs every call
+    # that actually acquires bytes.
+    retriever = PinnedHttpsRetriever(
+        resolver=approved_resolver,
+        egress_policy=EgressPolicy(allowed_hostnames=allowed_hostnames),
+        transport=StdlibPinnedTransport(),
+        limits=retrieval_limits,
+    )
+    availability: list[dict[str, Any]] = []
+    for candidate in candidates:
+        # Presence and nothing else. No bytes, no digest, no status code: the survey answers one
+        # question, and an address the coordinator has not locked yet is not an acquisition.
+        # Absence is decided inside ``probe_presence`` from the typed ``HTTP_NOT_FOUND`` code
+        # and never from message text; every other refusal propagates and fails the invocation.
+        present = retriever.probe_presence(candidate.url)
+        availability.append({"label": candidate.label, "present": present})
+    base["cycle_availability"] = availability
+    # No transport digest is emitted because not-found responses carry no hop list. A partial
+    # digest would omit the absent candidates being reported.
+    return base
+
+
+def _parse_cycle_survey(
+    value: Any,
+    *,
+    allowed_hostnames: tuple[str, ...],
+) -> tuple[CycleCandidate, ...]:
+    """Parse the closed candidate list, or refuse it.
+
+    No refusal here quotes an address or a label. The refusal crosses the sandbox boundary and
+    both are text that came from outside this process.
+    """
+
+    if not isinstance(value, dict) or set(value) != _CYCLE_SURVEY_KEYS:
+        raise AcquisitionSecurityError(
+            "SANDBOX_CYCLE_SURVEY",
+            "an availability survey must be the exact closed object of one field",
+        )
+    candidates = value["candidates"]
+    if not isinstance(candidates, list) or not 1 <= len(candidates) <= MAX_CYCLE_CANDIDATES:
+        raise AcquisitionSecurityError(
+            "SANDBOX_CYCLE_SURVEY",
+            f"a survey must name between one and {MAX_CYCLE_CANDIDATES} candidates",
+        )
+    parsed: list[CycleCandidate] = []
+    labels: set[str] = set()
+    for item in candidates:
+        if not isinstance(item, dict) or set(item) != _CYCLE_CANDIDATE_KEYS:
+            raise AcquisitionSecurityError(
+                "SANDBOX_CYCLE_SURVEY",
+                "a survey candidate is exactly a label and an address",
+            )
+        candidate = CycleCandidate(label=item["label"], url=item["url"])
+        # Unique, because the label is the only key a coordinator matches a result back to.
+        # Two candidates sharing one label make an answer set that cannot be read.
+        if candidate.label in labels:
+            raise AcquisitionSecurityError(
+                "SANDBOX_CYCLE_SURVEY",
+                "survey candidate labels must be unique within one request",
+            )
+        labels.add(candidate.label)
+        # Checked here as well as by the egress policy at fetch time, so a candidate outside
+        # the coordinator's allowlist costs no request at all -- including no request for the
+        # legitimate candidates that would otherwise have been probed before reaching it.
+        hostname = urlsplit(candidate.url).hostname
+        if hostname is None or hostname.lower() not in allowed_hostnames:
+            raise AcquisitionSecurityError(
+                "SANDBOX_EGRESS",
+                "a survey candidate names a host outside the egress allowlist",
+            )
+        parsed.append(candidate)
+    return tuple(parsed)
+
+
+def _require_surveyable_candidates(
+    candidates: tuple[CycleCandidate, ...],
+    *,
+    allowed_hostnames: tuple[str, ...],
+) -> None:
+    """Refuse a candidate set on the trusted side, before a single name is resolved."""
+
+    if not isinstance(candidates, tuple) or not 1 <= len(candidates) <= MAX_CYCLE_CANDIDATES:
+        raise AcquisitionSecurityError(
+            "SANDBOX_CYCLE_SURVEY",
+            f"a survey must name between one and {MAX_CYCLE_CANDIDATES} candidates",
+        )
+    labels = [candidate.label for candidate in candidates]
+    if len(set(labels)) != len(labels):
+        raise AcquisitionSecurityError(
+            "SANDBOX_CYCLE_SURVEY",
+            "survey candidate labels must be unique within one request",
+        )
+    for candidate in candidates:
+        if not isinstance(candidate, CycleCandidate):
+            raise AcquisitionSecurityError(
+                "SANDBOX_CYCLE_SURVEY",
+                "a survey candidate must be a validated candidate value",
+            )
+        hostname = urlsplit(candidate.url).hostname
+        if hostname is None or hostname.lower() not in allowed_hostnames:
+            raise AcquisitionSecurityError(
+                "SANDBOX_EGRESS",
+                "a survey candidate names a host outside the egress allowlist",
+            )
+
+
+def _narrowed_to_media_types(
+    limits: RetrievalLimits,
+    media_types: tuple[str, ...],
+) -> RetrievalLimits:
+    """Narrow a retrieval's media allowlist to one call's half of it, never widening it."""
+
+    admitted = tuple(
+        media_type for media_type in media_types if media_type in limits.allowed_media_types
+    )
+    if not admitted:
+        raise AcquisitionSecurityError(
+            "SANDBOX_LIMITS",
+            "the retrieval's media allowlist admits nothing this fetch would accept",
+        )
+    return replace(limits, allowed_media_types=admitted)
+
+
+def _require_slice_bytes_within_budget(
+    planned: tuple[PlannedRange, ...],
+    *,
+    limits: RetrievalLimits,
+) -> None:
+    """Refuse a plan whose slices would not fit, before a single byte of them is fetched.
+
+    Two ceilings, because they bound different things. One slice may not exceed the response
+    limit the retrieval already enforces per fetch -- checked here as well so an over-large
+    span is refused before the request rather than after the bytes arrive.
+
+    The total is bounded by the IPC response cap it has to survive. Base64 expands by four
+    thirds, so ``MAX_TOTAL_SLICE_BYTES`` of slices becomes 32 MiB of response text against a
+    48 MiB cap, leaving 16 MiB for a response whose other fields do not reach a kilobyte. The
+    arithmetic is stated rather than left for a reader to rediscover, and the plan is refused
+    rather than truncated: a shortened slice set is a different acquisition, silently.
+    """
+
+    total = 0
+    for entry in planned:
+        length = entry.byte_range.length
+        if length > limits.max_response_bytes:
+            raise AcquisitionSecurityError(
+                "SANDBOX_SLICE_BUDGET",
+                "a planned slice is larger than the retrieval's own response limit",
+            )
+        total += length
+    if total > MAX_TOTAL_SLICE_BYTES:
+        raise AcquisitionSecurityError(
+            "SANDBOX_SLICE_BUDGET",
+            f"the planned slices total more than the {MAX_TOTAL_SLICE_BYTES} byte ceiling",
+        )
+
+
+@dataclass(frozen=True)
+class _RangePlan:
+    """A coordinator's order: which object, which sidecar describes it, and what to take."""
+
+    sidecar_url: str
+    object_url: str
+    selectors: tuple[str, ...]
+    max_ranges: int
+    # The model run this order is for, or ``None`` when the order names none. When it is set,
+    # every delivered message must say in its own Section 1 that it came from that run; when it
+    # is ``None`` the run binding is simply not in force, which is a smaller claim, not a
+    # silent one -- ``mr-data acquire-slices`` prints which of the two it ran under.
+    expected_reference_time: str | None
+
+
+def _parse_range_plan(value: Any, *, budget_ceiling: int) -> _RangePlan:
+    """Parse the closed range-plan object, or refuse it.
+
+    No refusal here quotes an address or a selector. The refusal crosses the sandbox boundary
+    and both are text that came from outside this process.
+    """
+
+    if not isinstance(value, dict) or set(value) != _RANGE_PLAN_KEYS:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RANGE_PLAN",
+            "a range plan must be the exact closed object of five fields",
+        )
+    sidecar_url = _bounded_text(value["sidecar_url"], maximum=2_048)
+    object_url = _bounded_text(value["object_url"], maximum=2_048)
+    # Checked, never derived. Appending ``.idx`` to the object's address here would make the
+    # sidecar an address this worker invented rather than one the coordinator resolved and
+    # pinned, and the whole value of the pin is that every address fetched came from outside.
+    if _https_origin(sidecar_url) != _https_origin(object_url):
+        raise AcquisitionSecurityError(
+            "SANDBOX_RANGE_PLAN",
+            "a range plan's sidecar and object must share one https origin",
+        )
+    selectors = _string_tuple(
+        value["selectors"],
+        maximum_items=MAX_RANGE_PLAN,
+        item_maximum=MAX_SELECTOR_BYTES,
+    )
+    if not selectors:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RANGE_PLAN",
+            "a range plan must order at least one message",
+        )
+    max_ranges = value["max_ranges"]
+    # Bounded by the retrieval's own budget rather than only by the transport ceiling: a plan
+    # that could name its own larger budget would make the limits it travels beside advisory.
+    if type(max_ranges) is not int or not 1 <= max_ranges <= budget_ceiling:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RANGE_PLAN",
+            "a range plan's budget must lie within the retrieval's own range budget",
+        )
+    # How many slices are ordered is known from the request alone, so the budget is applied
+    # here rather than after the sidecar fetch. ``plan_ranges`` applies the same bound again
+    # to the plan it builds; this one exists so an over-long order costs no request at all.
+    require_range_plan_within_budget(len(selectors), max_ranges=max_ranges)
+    # Parsed here rather than trusted as it arrives, and parsed by the same function the
+    # coordinator used to build it, so the two sides of the boundary cannot come to hold two
+    # spellings of one run.
+    expected_reference_time = value["expected_reference_time"]
+    if expected_reference_time is not None:
+        expected_reference_time = require_reference_time_spelling(expected_reference_time)
+    return _RangePlan(
+        sidecar_url=sidecar_url,
+        object_url=object_url,
+        selectors=selectors,
+        max_ranges=max_ranges,
+        expected_reference_time=expected_reference_time,
+    )
+
+
+def _https_origin(url: str, *, code: str = "SANDBOX_RANGE_PLAN") -> tuple[str, str]:
+    """Return an address's origin, refusing anything that is not an absolute https URL.
+
+    The refusal code is the caller's, because the two callers refuse different things and a
+    survey that reported a malformed candidate as a range-plan failure would send a reader to
+    the wrong half of the boundary.
+    """
+
+    split = urlsplit(url)
+    if split.scheme != "https" or not split.netloc:
+        raise AcquisitionSecurityError(
+            code,
+            "a clean-room address must be an absolute https URL",
+        )
+    return split.scheme, split.netloc.lower()
+
+
+def _parse_response(
+    response: dict[str, Any],
+    *,
+    expected_request_id: str,
+    expected_operation: str,
+    expected_external_network_policy_attestation: str | None,
+    expected_cycle_labels: tuple[str, ...] | None = None,
+    expected_selectors: tuple[str, ...] | None = None,
+    expected_reference_time: str | None = None,
+) -> SandboxResult:
+    expected = {
+        "schema_version",
+        "request_id",
+        "operation",
+        "policy_digest",
+        "visible_environment_keys",
+        "parsed",
+        "content_base64",
+        "media_type",
+        "final_url",
+        "transport_evidence_digest",
+        "probe_transport",
+        "home_directory_readable",
+        "network_probe_errors",
+        "decode_family_id",
+        "decode_family_version",
+        "decode_options_digest",
+        "decode_flags",
+        "decode_declared_cell_count",
+        "fetched_content_sha256",
+        "fetched_content_size_bytes",
+        "fetched_total_response_body_size_bytes",
+        "fetched_request_count",
+        "ranges",
+        "cycle_availability",
+        "sidecar_content_sha256",
+        "sidecar_size_bytes",
+        "full_object_size_bytes",
+        "fetched_members",
+        "external_network_policy_attestation",
+    }
+    if set(response) != expected or response["schema_version"] != SANDBOX_PROTOCOL_VERSION:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE",
+            "sandbox response shape or version is invalid",
+        )
+    request_id = _bounded_identifier(response["request_id"])
+    if request_id != expected_request_id:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE_BINDING",
+            "sandbox response does not bind the exact request",
+        )
+    operation = _bounded_text(response["operation"], maximum=32)
+    # The operation is bound to the one that was ordered, exactly as ``request_id`` is above.
+    # Without this the response names its own operation and ``_policy_digest`` below then
+    # validates it against itself: a clean room invoked for ``fetch_ranges`` -- which resolves
+    # endpoints, opens the attested network clause and requires the external
+    # network attestation -- could answer with ``parse``'s digest, and the sealed evidence
+    # would record a stricter policy than the one that actually ran.  A self-declared
+    # attestation is not an attestation.
+    if operation != expected_operation:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE_BINDING",
+            "the clean room's response does not bind the operation that was requested",
+        )
+    expected_policy = _policy_digest(operation)
+    if response["policy_digest"] != expected_policy:
+        raise AcquisitionSecurityError(
+            "SANDBOX_POLICY_BINDING",
+            "sandbox response policy attestation is invalid",
+        )
+    external_network_policy_attestation = _optional_digest(
+        response["external_network_policy_attestation"]
+    )
+    if external_network_policy_attestation != expected_external_network_policy_attestation:
+        raise AcquisitionSecurityError(
+            "SANDBOX_POLICY_BINDING",
+            "sandbox response does not bind the external network policy attestation",
+        )
+    visible = _string_tuple(
+        response["visible_environment_keys"],
+        maximum_items=32,
+        item_maximum=128,
+    )
+    if set(visible) - set(_ALLOWED_ENVIRONMENT):
+        raise AcquisitionSecurityError(
+            "SANDBOX_ENVIRONMENT",
+            "sandbox inherited non-allowlisted environment keys",
+        )
+    home_directory_readable = response["home_directory_readable"]
+    if home_directory_readable is not None and type(home_directory_readable) is not bool:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE",
+            "sandbox home-directory probe is invalid",
+        )
+    # The home-directory answer is still reported, and is still bound into the response the
+    # policy digest covers, but nothing enforces it here any more. It was enforced on darwin
+    # alone, because the Seatbelt profile ADR 0021 deleted was the thing that made the
+    # home directory unreadable; on every other host the boundary that owns the filesystem is
+    # the external container the attestation names, and this process is in no position to
+    # second-guess it. Keeping the field is what lets a container's own conformance check read
+    # it.
+    network_probe_errors = _parse_network_probe_response(
+        response["network_probe_errors"],
+        required=operation == "probe",
+    )
+    ranges = _parse_fetched_slices(
+        response["ranges"],
+        required=operation == "fetch_ranges",
+        expected_selectors=expected_selectors,
+        expected_reference_time=expected_reference_time,
+    )
+    cycle_availability = _parse_cycle_availability(
+        response["cycle_availability"],
+        required=operation == "survey_cycles",
+        expected_labels=expected_cycle_labels,
+    )
+    fetched_members = _parse_fetched_members(
+        response["fetched_members"],
+        required=operation == "fetch_ranges",
+    )
+    sidecar_content_sha256 = _optional_digest(response["sidecar_content_sha256"])
+    sidecar_size_bytes = response["sidecar_size_bytes"]
+    full_object_size_bytes = response["full_object_size_bytes"]
+    if operation == "fetch_ranges":
+        if sidecar_content_sha256 is None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE", "range response omits sidecar identity"
+            )
+        for name, value in (
+            ("sidecar_size_bytes", sidecar_size_bytes),
+            ("full_object_size_bytes", full_object_size_bytes),
+        ):
+            if type(value) is not int or not 1 <= value <= MAX_BYTE_RANGE_OFFSET + 1:
+                raise AcquisitionSecurityError(
+                    "SANDBOX_RESPONSE", f"range response {name} is invalid"
+                )
+    elif (
+        sidecar_content_sha256 is not None
+        or sidecar_size_bytes is not None
+        or full_object_size_bytes is not None
+    ):
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE", "non-range response carries range identity"
+        )
+    transport_evidence_digest = _optional_digest(response["transport_evidence_digest"])
+    probe_transport = _parse_probe_transport(
+        response["probe_transport"],
+        required=operation in WHOLE_DOCUMENT_RETRIEVAL_OPERATIONS,
+    )
+    if operation == "fetch_ranges":
+        assert fetched_members is not None
+        expected_transport_digest = canonical_sha256(
+            [
+                {
+                    key: value
+                    for key, value in member.to_dict().items()
+                    if key not in {"role", "sequence"}
+                }
+                for member in fetched_members
+            ]
+        )
+        if transport_evidence_digest != expected_transport_digest:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "range response transport digest does not bind every measured response",
+            )
+    parsed_value = response["parsed"]
+    parsed = _parsed_from_dict(parsed_value) if parsed_value is not None else None
+    content_value = response["content_base64"]
+    content: bytes | None
+    if content_value is None:
+        content = None
+    else:
+        try:
+            content = base64.b64decode(
+                _bounded_text(content_value, maximum=MAX_RESPONSE_BYTES),
+                validate=True,
+            )
+        except (ValueError, TypeError):
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "sandbox response content is not canonical base64",
+            ) from None
+    decode_facts = _parse_decode_facts(response, operation=operation)
+    if decode_facts is not None:
+        # The returned table must describe the returned bytes. The worker parses what it
+        # decoded, so this can only fail for a worker that did something else -- which is
+        # exactly the case a boundary check exists for.
+        if parsed is None or content is None or parsed.input_sha256 != sha256_bytes(content):
+            raise AcquisitionSecurityError(
+                "SANDBOX_DECODE_BINDING",
+                "decode response table does not describe the bytes the decode returned",
+            )
+    family_id, family_version, options_digest, flags, declared_cell_count = decode_facts or (
+        None,
+        None,
+        None,
+        None,
+        None,
+    )
+    fetched_content_sha256 = _optional_digest(response["fetched_content_sha256"])
+    fetched_content_size_bytes = response["fetched_content_size_bytes"]
+    fetched_total_response_body_size_bytes = response["fetched_total_response_body_size_bytes"]
+    fetched_request_count = response["fetched_request_count"]
+    if operation == "retrieve_decode_and_parse":
+        if fetched_content_sha256 is None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE", "Reader retrieval response omits fetched content identity"
+            )
+        if (
+            type(fetched_content_size_bytes) is not int
+            or not 1 <= fetched_content_size_bytes <= 1 << 34
+        ):
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE", "Reader retrieval response omits fetched content size"
+            )
+        if (
+            type(fetched_total_response_body_size_bytes) is not int
+            or not fetched_content_size_bytes <= fetched_total_response_body_size_bytes <= 1 << 34
+        ):
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "Reader retrieval response omits cumulative response-body size",
+            )
+        if type(fetched_request_count) is not int or not 1 <= fetched_request_count <= 256:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE", "Reader retrieval response omits fetched request count"
+            )
+    elif (
+        fetched_content_sha256 is not None
+        or fetched_content_size_bytes is not None
+        or fetched_total_response_body_size_bytes is not None
+        or fetched_request_count is not None
+    ):
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE",
+            "a non-Reader-retrieval response carries fetched content identity",
+        )
+    return SandboxResult(
+        request_id=request_id,
+        operation=operation,
+        policy_digest=expected_policy,
+        parsed=parsed,
+        content=content,
+        media_type=_optional_text(response["media_type"], 255),
+        final_url=_optional_text(response["final_url"], 2_048),
+        transport_evidence_digest=transport_evidence_digest,
+        visible_environment_keys=visible,
+        probe_transport=probe_transport,
+        home_directory_readable=home_directory_readable,
+        network_probe_errors=network_probe_errors,
+        external_network_policy_attestation=external_network_policy_attestation,
+        decode_family_id=family_id,
+        decode_family_version=family_version,
+        decode_options_digest=options_digest,
+        decode_flags=flags,
+        decode_declared_cell_count=declared_cell_count,
+        fetched_content_sha256=fetched_content_sha256,
+        fetched_content_size_bytes=fetched_content_size_bytes,
+        fetched_total_response_body_size_bytes=fetched_total_response_body_size_bytes,
+        fetched_request_count=fetched_request_count,
+        ranges=ranges,
+        cycle_availability=cycle_availability,
+        sidecar_content_sha256=sidecar_content_sha256,
+        sidecar_size_bytes=sidecar_size_bytes,
+        full_object_size_bytes=full_object_size_bytes,
+        fetched_members=fetched_members,
+    )
+
+
+def _parse_decode_facts(
+    response: dict[str, Any],
+    *,
+    operation: str,
+) -> tuple[str, str, str, tuple[str, ...], int] | None:
+    """Admit the five decode facts, or refuse a response that carries them out of place.
+
+    The flags are checked against the closed ``DECODE_FLAGS`` vocabulary here, at the
+    boundary, rather than trusted onward.  A family that could name its own flag could write
+    an unreviewed field into a receipt, so the vocabulary is enforced where the untrusted
+    process's answer arrives and not only where it was produced.
+    """
+
+    stated = (
+        response["decode_family_id"],
+        response["decode_family_version"],
+        response["decode_options_digest"],
+        response["decode_flags"],
+        response["decode_declared_cell_count"],
+    )
+    if operation not in READER_PERFORMING_OPERATIONS:
+        if any(item is not None for item in stated):
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "a response for an operation that decodes nothing carries decode facts",
+            )
+        return None
+    if any(item is None for item in stated):
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE",
+            "decode response does not carry the decode facts the receipt needs",
+        )
+    family_id = _bounded_text(stated[0], maximum=128)
+    family_version = _bounded_text(stated[1], maximum=32)
+    options_digest = _digest(stated[2])
+    flags = _string_tuple(stated[3], maximum_items=32, item_maximum=64)
+    unknown = sorted(flag for flag in flags if flag not in DECODE_FLAGS)
+    if unknown:
+        raise AcquisitionSecurityError(
+            "SANDBOX_DECODE_FLAGS",
+            f"decode response names no such decode flag: {', '.join(unknown)}",
+        )
+    if tuple(sorted(flags)) != flags:
+        raise AcquisitionSecurityError(
+            "SANDBOX_DECODE_FLAGS",
+            "decode flags must arrive sorted, as the Reader contract produces them",
+        )
+    declared_cell_count = stated[4]
+    if type(declared_cell_count) is not int or not 0 <= declared_cell_count <= (1 << 63) - 1:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE",
+            "decode response declared-cell count is invalid",
+        )
+    return family_id, family_version, options_digest, flags, declared_cell_count
+
+
+def _parse_cycle_availability(
+    value: Any,
+    *,
+    required: bool,
+    expected_labels: tuple[str, ...] | None,
+) -> tuple[CycleAvailability, ...] | None:
+    """Check a survey's answers against the exact question the coordinator asked, or refuse.
+
+    Compare labels positionally so availability cannot be attached to a different run.
+    """
+
+    if not required:
+        if value is not None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "non-survey response contains availability evidence",
+            )
+        return None
+    if expected_labels is None:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE",
+            "a survey response can only be read against the labels that were ordered",
+        )
+    if not isinstance(value, list) or len(value) != len(expected_labels):
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE",
+            "survey response does not answer the exact candidate set that was ordered",
+        )
+    results: list[CycleAvailability] = []
+    for item, label in zip(value, expected_labels, strict=True):
+        if not isinstance(item, dict) or set(item) != _CYCLE_AVAILABILITY_KEYS:
+            raise AcquisitionSecurityError("SANDBOX_RESPONSE", "survey result shape is invalid")
+        if item["label"] != label:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "survey results are not the candidates that were ordered, in that order",
+            )
+        present = item["present"]
+        if type(present) is not bool:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "survey presence must be exactly true or false",
+            )
+        results.append(CycleAvailability(label=label, present=present))
+    return tuple(results)
+
+
+_PROBE_TRANSPORT_KEYS = frozenset({"http_status_code", "etag_digest", "last_modified_digest"})
+
+
+def _parse_probe_transport(value: Any, *, required: bool) -> ProbeTransport | None:
+    """Re-admit the terminal-response facts a whole-document retrieval sealed.
+
+    The worker computed both validator digests inside the confinement, so the coordinator never
+    sees a publisher's header text and cannot be handed one here: a value that is not a bare
+    lowercase SHA-256 is refused rather than carried.  An operation that settled on no single
+    response must report none, because a status attached to the wrong exchange would be recorded
+    as an observation of the source.
+    """
+
+    if not required:
+        if value is not None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "an operation that retrieves no whole document carries probe transport evidence",
+            )
+        return None
+    if not isinstance(value, dict) or set(value) != _PROBE_TRANSPORT_KEYS:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE",
+            "whole-document retrieval response omits its exact probe transport evidence",
+        )
+    try:
+        transport = ProbeTransport(
+            http_status_code=value["http_status_code"],
+            etag_digest=_optional_digest(value["etag_digest"]),
+            last_modified_digest=_optional_digest(value["last_modified_digest"]),
+        )
+    except AcquisitionSecurityError as error:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE",
+            "probe transport evidence is not the exact sealed shape",
+        ) from error
+    # A retrieval that returned a document returned it with a successful status; the retriever
+    # refuses every other class before a byte is admitted.  Pinning the range here rather than
+    # trusting the worker keeps a response that states 404 beside acquired bytes from becoming
+    # an observation whose status contradicts its own content.  The hosted Courier pins the
+    # same range on its own acquired path.
+    if not 200 <= transport.http_status_code <= 299:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE",
+            "a whole-document retrieval reported a response it could not have admitted",
+        )
+    return transport
+
+
+def _parse_fetched_members(value: Any, *, required: bool) -> tuple[FetchedMember, ...] | None:
+    """Admit the exact ordered HTTP responses retained by a range acquisition."""
+
+    if not required:
+        if value is not None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "non-range response contains fetched-member evidence",
+            )
+        return None
+    if not isinstance(value, list) or not 4 <= len(value) <= 256:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE",
+            "range response must retain a bounded complete fetched-member list",
+        )
+    members: list[FetchedMember] = []
+    roles: list[str] = []
+    for sequence, item in enumerate(value):
+        if not isinstance(item, dict) or set(item) != _FETCHED_MEMBER_KEYS:
+            raise AcquisitionSecurityError("SANDBOX_RESPONSE", "fetched-member shape is invalid")
+        if item["sequence"] != sequence:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE", "fetched members are not in exact response order"
+            )
+        role = item["role"]
+        if role not in _FETCHED_MEMBER_ROLES:
+            raise AcquisitionSecurityError("SANDBOX_RESPONSE", "fetched-member role is invalid")
+        status = item["status"]
+        body_size = item["response_body_size_bytes"]
+        if type(status) is not int or not 100 <= status <= 599:
+            raise AcquisitionSecurityError("SANDBOX_RESPONSE", "fetched-member status is invalid")
+        if type(body_size) is not int or not 0 <= body_size <= MAX_RESPONSE_BYTES:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE", "fetched-member body size is invalid"
+            )
+        member = FetchedMember(
+            role=role,
+            sequence=sequence,
+            url=_bounded_text(item["url"], maximum=2_048),
+            resolution_digest=_digest(item["resolution_digest"]),
+            connected_peer=_bounded_text(item["connected_peer"], maximum=64),
+            status=status,
+            response_headers_digest=_digest(item["response_headers_digest"]),
+            response_body_size_bytes=body_size,
+            response_body_sha256=_digest(item["response_body_sha256"]),
+            requested_range=_optional_text(item["requested_range"], 128),
+            observed_content_range=_optional_text(item["observed_content_range"], 128),
+            etag=_optional_text(item["etag"], 1_024),
+            last_modified=_optional_text(item["last_modified"], 1_024),
+            peer_attempts=_parse_peer_attempts(item["peer_attempts"]),
+        )
+        if member.peer_attempts[-1].response_body_size_bytes != body_size:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "terminal peer-attempt bytes differ from the retained response body",
+            )
+        members.append(member)
+        roles.append(role)
+    # Redirects may repeat a role; the four acquisition stages remain ordered and complete.
+    collapsed = tuple(
+        role for index, role in enumerate(roles) if index == 0 or role != roles[index - 1]
+    )
+    if collapsed != ("sidecar_initial", "cycle_probe", "selected_slice", "sidecar_final"):
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE",
+            "fetched members do not contain the complete ordered range acquisition",
+        )
+    return tuple(members)
+
+
+def _parse_peer_attempts(value: Any) -> tuple[PeerAttempt, ...]:
+    """Re-admit the closed, ordered peer evidence carried by one retrieval hop."""
+
+    if not isinstance(value, list) or not 1 <= len(value) <= 32:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE",
+            "fetched-member peer attempts must be a non-empty bounded list",
+        )
+    attempts: list[PeerAttempt] = []
+    saw_response = False
+    for index, item in enumerate(value):
+        if not isinstance(item, dict) or set(item) != _PEER_ATTEMPT_KEYS:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE", "fetched-member peer-attempt shape is invalid"
+            )
+        approved_ip = _bounded_text(item["approved_ip"], maximum=64)
+        try:
+            address = ipaddress.ip_address(approved_ip)
+        except ValueError as error:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE", "fetched-member peer-attempt address is invalid"
+            ) from error
+        if str(address) != approved_ip or not address.is_global:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE", "fetched-member peer-attempt address is not canonical public IP"
+            )
+        outcome = item["outcome"]
+        failure_code = item["failure_code"]
+        response_body_size_bytes = item["response_body_size_bytes"]
+        if (
+            type(response_body_size_bytes) is not int
+            or not 0 <= response_body_size_bytes <= (1 << 34) + 1
+        ):
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "fetched-member peer-attempt byte evidence is invalid",
+            )
+        if outcome not in _PEER_ATTEMPT_OUTCOMES:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE", "fetched-member peer-attempt outcome is invalid"
+            )
+        if outcome in {"transport_failure", "response_failure"}:
+            failure_code = _bounded_text(failure_code, maximum=128)
+            if saw_response:
+                raise AcquisitionSecurityError(
+                    "SANDBOX_RESPONSE", "peer attempts continue after a successful response"
+                )
+            if outcome == "response_failure" and index != len(value) - 1:
+                raise AcquisitionSecurityError(
+                    "SANDBOX_RESPONSE", "a response failure must terminate peer attempts"
+                )
+        elif failure_code is not None or index != len(value) - 1:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE", "successful peer attempt must terminate the attempt list"
+            )
+        else:
+            saw_response = True
+        attempts.append(
+            PeerAttempt(
+                approved_ip=approved_ip,
+                outcome=outcome,
+                failure_code=failure_code,
+                response_body_size_bytes=response_body_size_bytes,
+            )
+        )
+    if not saw_response:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE", "successful fetched member has no successful peer attempt"
+        )
+    return tuple(attempts)
+
+
+def _parse_fetched_slices(
+    value: Any,
+    *,
+    required: bool,
+    expected_selectors: tuple[str, ...] | None = None,
+    expected_reference_time: str | None = None,
+) -> tuple[FetchedSlice, ...] | None:
+    """Re-check every delivered slice on the trusted side of the boundary, or refuse it.
+
+    The worker already proved each slice's span and structure. This is not that check again:
+    it is the coordinator refusing to build a result out of anything the response says that
+    the response's own bytes do not support. Each slice's digest is recomputed, each span is
+    compared against the bytes that claim it, the sequence must ascend, and every slice must
+    still be a well-formed message -- so the ordering and structural properties this operation
+    promises are facts the coordinator verified rather than ones the worker asserted.
+
+    ``expected_selectors`` is the exact set of descriptors the invocation ordered, which the
+    coordinator knows from its own request. One selector yields exactly one slice, so the
+    response must answer every selector exactly once: a response carrying fewer is a partial
+    acquisition, one carrying more is a set nobody ordered, and one answering the same
+    descriptor twice is not the order that was placed. This is the count check it replaces
+    and more -- the count was the weakest fact the coordinator held, and holding the answer
+    to the question instead makes each delivered slice say which descriptor it answers.
+    ``plan_ranges`` matches by exact equality, so a descriptor that is not one of these is a
+    descriptor no selector named. The exact spans still cannot be checked here -- they come
+    from the sidecar, which only the worker fetched -- and neither can the descriptor-to-span
+    mapping, which is the sidecar's and is the documented known gap.
+
+    ``expected_reference_time`` is the model run the invocation ordered, when it ordered one.
+    It is re-checked here for the same reason the structural check is: the worker is the process
+    that handled the untrusted bytes, so a run binding that only ever ran there is a binding the
+    coordinator is taking on trust. When the order named no run, no run binding is claimed.
+    """
+
+    if not required:
+        if value is not None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "non-slice response contains slice evidence",
+            )
+        return None
+    if expected_selectors is None:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE",
+            "a slice response can only be read against the plan that was ordered",
+        )
+    if not isinstance(value, list) or not 1 <= len(value) <= MAX_RANGE_PLAN:
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE",
+            "slice response is not a bounded non-empty list",
+        )
+    if len(value) != len(expected_selectors):
+        raise AcquisitionSecurityError(
+            "SANDBOX_RESPONSE",
+            "slice response does not answer the exact plan that was ordered",
+        )
+    unanswered = list(expected_selectors)
+    slices: list[FetchedSlice] = []
+    for item in value:
+        if not isinstance(item, dict) or set(item) != _FETCHED_SLICE_KEYS:
+            raise AcquisitionSecurityError("SANDBOX_RESPONSE", "slice shape is invalid")
+        index = item["index"]
+        first_byte = item["first_byte"]
+        last_byte = item["last_byte"]
+        if type(index) is not int or index < 1:
+            raise AcquisitionSecurityError("SANDBOX_RESPONSE", "slice index is invalid")
+        descriptor = _bounded_text(item["descriptor"], maximum=MAX_SELECTOR_BYTES)
+        if descriptor not in unanswered:
+            # Either a descriptor no selector named, or one named once and answered twice.
+            # Neither is the order that was placed, and both would put a slice on the receipt
+            # under a label the coordinator never asked for.
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "a delivered slice does not answer an unanswered selector that was ordered",
+            )
+        unanswered.remove(descriptor)
+        if (
+            type(first_byte) is not int
+            or type(last_byte) is not int
+            or not 0 <= first_byte <= last_byte
+        ):
+            raise AcquisitionSecurityError("SANDBOX_RESPONSE", "slice span is invalid")
+        digest = _digest(item["sha256"])
+        try:
+            content = base64.b64decode(
+                _bounded_text(item["content_base64"], maximum=MAX_RESPONSE_BYTES),
+                validate=True,
+            )
+        except (ValueError, TypeError):
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "slice content is not canonical base64",
+            ) from None
+        if len(content) != last_byte - first_byte + 1:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "slice bytes do not fill the span they name",
+            )
+        if sha256_bytes(content) != digest:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "slice digest does not match its own bytes",
+            )
+        # The structural check again, on this side of the boundary. The worker runs it before
+        # it keeps a slice, but the worker is the process that handled the untrusted bytes; a
+        # check that only ever ran there is a check the coordinator is taking on trust. It is
+        # pure, it is cheap, and re-running it is the difference between "the worker says these
+        # are messages" and "these are messages".
+        try:
+            check_grib_message(content)
+        except AcquisitionSecurityError as exc:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                f"slice bytes are not a well-formed message ({exc.code})",
+            ) from None
+        if expected_reference_time is not None:
+            try:
+                check_grib_reference_time(content, expected=expected_reference_time)
+            except AcquisitionSecurityError as exc:
+                raise AcquisitionSecurityError(
+                    "SANDBOX_RESPONSE",
+                    f"slice bytes are not from the model run that was ordered ({exc.code})",
+                ) from None
+        if slices and index <= slices[-1].index:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "slices are not emitted in ascending message-index order",
+            )
+        slices.append(
+            FetchedSlice(
+                index=index,
+                descriptor=descriptor,
+                first_byte=first_byte,
+                last_byte=last_byte,
+                sha256=digest,
+                content=content,
+            )
+        )
+    return tuple(slices)
+
+
+def _parsed_dict(parsed: ParsedTable) -> dict[str, Any]:
+    return {
+        "data_format": parsed.data_format,
+        "input_sha256": parsed.input_sha256,
+        "columns": list(parsed.columns),
+        "rows": [list(row) for row in parsed.rows],
+        "schema_digest": parsed.schema_digest,
+    }
+
+
+def _parsed_from_dict(value: Any) -> ParsedTable:
+    if not isinstance(value, dict) or set(value) != {
+        "data_format",
+        "input_sha256",
+        "columns",
+        "rows",
+        "schema_digest",
+    }:
+        raise AcquisitionSecurityError("SANDBOX_RESPONSE", "parsed response shape is invalid")
+    columns = _string_tuple(value["columns"], maximum_items=10_000, item_maximum=256)
+    if not isinstance(value["rows"], list) or len(value["rows"]) > 10_000_000:
+        raise AcquisitionSecurityError("SANDBOX_RESPONSE", "parsed response rows are invalid")
+    rows: list[tuple[Any, ...]] = []
+    for row in value["rows"]:
+        if not isinstance(row, list):
+            raise AcquisitionSecurityError("SANDBOX_RESPONSE", "parsed row is not an array")
+        rows.append(tuple(row))
+    return ParsedTable(
+        data_format=_bounded_text(value["data_format"], maximum=16),
+        input_sha256=_digest(value["input_sha256"]),
+        columns=columns,
+        rows=tuple(rows),
+        schema_digest=_digest(value["schema_digest"]),
+    )
+
+
+def _strict_json_object(raw: bytes, path: str) -> dict[str, Any]:
+    try:
+        value = json.loads(raw, object_pairs_hook=_unique_object, parse_constant=_reject_constant)
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        raise AcquisitionSecurityError("SANDBOX_JSON", f"{path} is not strict JSON") from None
+    if not isinstance(value, dict):
+        raise AcquisitionSecurityError("SANDBOX_JSON", f"{path} must be an object")
+    return value
+
+
+def _unique_object(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+    result: dict[str, Any] = {}
+    for key, value in pairs:
+        if key in result:
+            raise AcquisitionSecurityError("SANDBOX_JSON", "JSON keys must be unique")
+        result[key] = value
+    return result
+
+
+def _reject_constant(value: str) -> Any:
+    raise AcquisitionSecurityError("SANDBOX_JSON", f"non-finite number {value!r} is forbidden")
+
+
+def _parse_limits_dict(limits: ParseLimits) -> dict[str, int]:
+    return {
+        "max_input_bytes": limits.max_input_bytes,
+        "max_uncompressed_bytes": limits.max_uncompressed_bytes,
+        "max_expansion_ratio": limits.max_expansion_ratio,
+        "max_rows": limits.max_rows,
+        "max_columns": limits.max_columns,
+        "max_field_bytes": limits.max_field_bytes,
+        "max_json_depth": limits.max_json_depth,
+        "max_total_cells": limits.max_total_cells,
+    }
+
+
+def _parse_parse_limits(value: Any) -> ParseLimits:
+    if not isinstance(value, dict) or set(value) != set(_parse_limits_dict(ParseLimits())):
+        raise AcquisitionSecurityError("SANDBOX_LIMITS", "parse limits shape is invalid")
+    return ParseLimits(**value)
+
+
+def _retrieval_limits_dict(limits: RetrievalLimits) -> dict[str, Any]:
+    return {
+        "max_response_bytes": limits.max_response_bytes,
+        "max_aggregate_response_bytes": limits.max_aggregate_response_bytes,
+        "max_redirects": limits.max_redirects,
+        "max_requests": limits.max_requests,
+        # Carried across the boundary like every other bound. Left out, a coordinator that
+        # narrowed the range budget would have the worker silently rebuild the default, and
+        # the plan's own budget would be checked against a ceiling nobody chose.
+        "max_ranges": limits.max_ranges,
+        "connect_timeout_seconds": limits.connect_timeout_seconds,
+        "read_timeout_seconds": limits.read_timeout_seconds,
+        "total_timeout_seconds": limits.total_timeout_seconds,
+        "max_concurrency": limits.max_concurrency,
+        "min_interval_seconds": limits.min_interval_seconds,
+        "allowed_media_types": list(limits.allowed_media_types),
+        "user_agent": limits.user_agent,
+    }
+
+
+def _parse_retrieval_limits(value: Any) -> RetrievalLimits:
+    if not isinstance(value, dict) or set(value) != set(_retrieval_limits_dict(RetrievalLimits())):
+        raise AcquisitionSecurityError("SANDBOX_LIMITS", "retrieval limits shape is invalid")
+    copied = dict(value)
+    copied["allowed_media_types"] = _string_tuple(
+        copied["allowed_media_types"],
+        maximum_items=16,
+        item_maximum=255,
+    )
+    return RetrievalLimits(**copied)
+
+
+@dataclass(frozen=True)
+class _ApprovedEndpointResolver:
+    endpoints: dict[tuple[str, int], tuple[str, ...]]
+
+    def resolve(self, hostname: str, port: int) -> tuple[str, ...]:
+        try:
+            return self.endpoints[(hostname, port)]
+        except KeyError as exc:
+            raise AcquisitionSecurityError(
+                "SANDBOX_EGRESS",
+                "worker attempted an endpoint outside the coordinator DNS pin",
+            ) from exc
+
+
+def _resolve_approved_endpoints(
+    url: str,
+    allowed_hostnames: tuple[str, ...],
+) -> tuple[tuple[str, int, tuple[str, ...]], ...]:
+    resolver = SystemResolver()
+    policy = EgressPolicy(allowed_hostnames=allowed_hostnames)
+    initial = validate_public_https_url(url, resolver=resolver, egress_policy=policy)
+    resolved: dict[str, tuple[str, ...]] = {initial.hostname: initial.approved_ips}
+    for hostname in allowed_hostnames:
+        if hostname not in resolved:
+            target = validate_public_https_url(
+                _https_root_url(hostname),
+                resolver=resolver,
+                egress_policy=policy,
+            )
+            resolved[hostname] = target.approved_ips
+    return tuple((hostname, 443, resolved[hostname]) for hostname in sorted(resolved))
+
+
+def _parse_approved_endpoints(
+    value: Any,
+    *,
+    allowed_hostnames: tuple[str, ...],
+) -> _ApprovedEndpointResolver:
+    if not isinstance(value, list) or len(value) != len(allowed_hostnames):
+        raise AcquisitionSecurityError(
+            "SANDBOX_EGRESS",
+            "approved endpoint set does not cover the exact hostname allowlist",
+        )
+    endpoints: dict[tuple[str, int], tuple[str, ...]] = {}
+    for item in value:
+        if not isinstance(item, dict) or set(item) != {
+            "hostname",
+            "port",
+            "approved_ips",
+        }:
+            raise AcquisitionSecurityError(
+                "SANDBOX_EGRESS",
+                "approved endpoint shape is invalid",
+            )
+        hostname = _bounded_text(item["hostname"], maximum=253)
+        port = item["port"]
+        if hostname not in allowed_hostnames or type(port) is not int or port != 443:
+            raise AcquisitionSecurityError(
+                "SANDBOX_EGRESS",
+                "approved endpoint is outside the hostname/port authority",
+            )
+        addresses = _string_tuple(
+            item["approved_ips"],
+            maximum_items=32,
+            item_maximum=64,
+        )
+        if not addresses:
+            raise AcquisitionSecurityError("SANDBOX_EGRESS", "approved IP set is empty")
+        normalized: list[str] = []
+        for raw in addresses:
+            try:
+                address = ipaddress.ip_address(raw)
+            except ValueError:
+                raise AcquisitionSecurityError(
+                    "SANDBOX_EGRESS",
+                    "approved endpoint contains a non-IP address",
+                ) from None
+            if not address.is_global:
+                raise AcquisitionSecurityError(
+                    "SANDBOX_EGRESS",
+                    "approved endpoint contains a non-public address",
+                )
+            normalized.append(address.compressed)
+        key = (hostname, port)
+        if key in endpoints or tuple(sorted(normalized)) != addresses:
+            raise AcquisitionSecurityError(
+                "SANDBOX_EGRESS",
+                "approved endpoint set is duplicate or non-canonical",
+            )
+        endpoints[key] = addresses
+    if {hostname for hostname, _port in endpoints} != set(allowed_hostnames):
+        raise AcquisitionSecurityError(
+            "SANDBOX_EGRESS",
+            "approved endpoint set differs from the hostname allowlist",
+        )
+    return _ApprovedEndpointResolver(endpoints)
+
+
+def _https_root_url(hostname: str) -> str:
+    try:
+        address = ipaddress.ip_address(hostname)
+    except ValueError:
+        address = None
+    host = f"[{hostname}]" if isinstance(address, ipaddress.IPv6Address) else hostname
+    return f"https://{host}/"
+
+
+def _parse_network_probe_targets(
+    request: dict[str, Any],
+) -> tuple[tuple[str, str, int], ...]:
+    value = request["network_probe_targets"]
+    if not isinstance(value, list) or len(value) != 3:
+        raise AcquisitionSecurityError(
+            "SANDBOX_PROBE",
+            "probe must contain the exact three network-denial targets",
+        )
+    parsed: dict[str, tuple[str, int]] = {}
+    for item in value:
+        if not isinstance(item, dict) or set(item) != {"label", "ip", "port"}:
+            raise AcquisitionSecurityError("SANDBOX_PROBE", "network probe shape is invalid")
+        label = _bounded_text(item["label"], maximum=16)
+        ip = _bounded_text(item["ip"], maximum=64)
+        port = item["port"]
+        if type(port) is not int or not 1 <= port <= 65_535 or label in parsed:
+            raise AcquisitionSecurityError("SANDBOX_PROBE", "network probe target is invalid")
+        parsed[label] = (ip, port)
+    if set(parsed) != {"loopback", "private", "metadata"}:
+        raise AcquisitionSecurityError(
+            "SANDBOX_PROBE",
+            "network probe labels are invalid",
+        )
+    if (
+        parsed["loopback"][0] != "127.0.0.1"
+        or parsed["private"] != ("10.0.0.1", 443)
+        or parsed["metadata"] != ("169.254.169.254", 80)
+    ):
+        raise AcquisitionSecurityError(
+            "SANDBOX_PROBE",
+            "network probe destinations are invalid",
+        )
+    return tuple((label, *parsed[label]) for label in ("loopback", "private", "metadata"))
+
+
+def _probe_network_denials(
+    targets: tuple[tuple[str, str, int], ...],
+) -> tuple[tuple[str, int], ...]:
+    results: list[tuple[str, int]] = []
+    for label, ip, port in targets:
+        family = socket.AF_INET6 if ":" in ip else socket.AF_INET
+        probe = socket.socket(family, socket.SOCK_STREAM)
+        try:
+            probe.settimeout(0.25)
+            error = probe.connect_ex((ip, port))
+        except OSError as exc:
+            error = exc.errno or 1
+        finally:
+            probe.close()
+        results.append((label, error))
+    return tuple(results)
+
+
+def _parse_network_probe_response(
+    value: Any,
+    *,
+    required: bool,
+) -> tuple[tuple[str, int], ...] | None:
+    if not required:
+        if value is not None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_RESPONSE",
+                "non-probe response contains network probe evidence",
+            )
+        return None
+    if not isinstance(value, list) or len(value) != 3:
+        raise AcquisitionSecurityError(
+            "SANDBOX_OS_BOUNDARY",
+            "sandbox did not return complete network-denial evidence",
+        )
+    result: list[tuple[str, int]] = []
+    for item in value:
+        if not isinstance(item, dict) or set(item) != {"label", "errno"}:
+            raise AcquisitionSecurityError(
+                "SANDBOX_OS_BOUNDARY",
+                "sandbox network-denial evidence is invalid",
+            )
+        label = item["label"]
+        error = item["errno"]
+        if label not in {"loopback", "private", "metadata"} or type(error) is not int or error <= 0:
+            raise AcquisitionSecurityError(
+                "SANDBOX_OS_BOUNDARY",
+                "sandbox completed a forbidden direct socket attempt",
+            )
+        result.append((label, error))
+    if {label for label, _error in result} != {"loopback", "private", "metadata"}:
+        raise AcquisitionSecurityError(
+            "SANDBOX_OS_BOUNDARY",
+            "sandbox network-denial evidence is incomplete",
+        )
+    return tuple(result)
+
+
+def _require_null_request_fields(request: dict[str, Any]) -> None:
+    for key in (
+        "content_base64",
+        "data_format",
+        "media_type",
+        "filename",
+        "parse_limits",
+        "url",
+        "approved_endpoints",
+        "retrieval_limits",
+        "reader_pin",
+        "reader_budgets",
+        "range_plan",
+        "cycle_survey",
+    ):
+        expected = [] if key == "approved_endpoints" else None
+        if request[key] != expected:
+            raise AcquisitionSecurityError(
+                "SANDBOX_FIELDS",
+                "probe request must not carry acquisition inputs",
+            )
+    if request["allowed_hostnames"] != []:
+        raise AcquisitionSecurityError(
+            "SANDBOX_FIELDS",
+            "probe request must not carry egress authority",
+        )
+
+
+def _validate_egress_hosts(hostnames: tuple[str, ...]) -> None:
+    if not hostnames or len(hostnames) > 32 or len(set(hostnames)) != len(hostnames):
+        raise AcquisitionSecurityError(
+            "SANDBOX_EGRESS",
+            "sandbox egress hostnames must be non-empty, unique, and bounded",
+        )
+    for hostname in hostnames:
+        normalized = hostname.rstrip(".").lower()
+        if (
+            normalized != hostname
+            or normalized in _FORBIDDEN_EGRESS_HOSTS
+            or normalized.endswith(".internal")
+        ):
+            raise AcquisitionSecurityError(
+                "SANDBOX_EGRESS",
+                "sandbox egress includes a forbidden production or metadata host",
+            )
+
+
+def _policy_document(operation: str) -> dict[str, Any]:
+    """Build the exact policy mapping whose digest binds a worker to its sandbox policy.
+
+    Split out from ``_policy_digest`` so a test can assert the document's shape directly --
+    in particular that a non-parsing operation carries no ``parser_formats`` key -- rather
+    than inferring shape from an opaque digest.
+    """
+
+    policy: dict[str, Any] = {
+        "schema_version": SANDBOX_PROTOCOL_VERSION,
+        "operation": operation,
+        "environment_keys": sorted(_ALLOWED_ENVIRONMENT),
+        "ambient_credentials": False,
+        "ambient_proxy": False,
+        "studio_clients": False,
+        # One value since ADR 0021. The other arm named the Seatbelt profile, which no
+        # longer exists; this is the clause every non-darwin host already attested, so no
+        # digest a Linux worker ever produced moves.
+        "filesystem": "external-container-boundary-required",
+        # Driven by the named set rather than by a comparison against one operation name, so
+        # an operation cannot be given live socket authority in ``_invoke`` while its own
+        # attestation keeps claiming the network is denied to it.
+        # The word "seatbelt" in this constant outlived the Seatbelt backend on purpose. This
+        # string is not a description that can be freshened -- it is digest input, and every
+        # sealed attestation, golden, and coordinator pin in the repository and in already
+        # released evidence binds the digest it produces. Renaming it would rotate four
+        # operation digests to improve a label. It reads today as the historical name of the
+        # approved-public-IP-plus-TCP/443 posture, which is still exactly the posture.
+        "network": (
+            "external-deny-default-approved-public-ip-plus-seatbelt-tcp-443"
+            if operation in NETWORK_PERFORMING_OPERATIONS
+            else "os-denied"
+        ),
+    }
+    # Scoped per operation, following the pattern ``filesystem`` and ``network`` already use
+    # above. An operation absent from the registry gets no key at all rather than an empty
+    # list: absent parsing support produces no key. ``canonical_sha256`` sorts keys, so insertion
+    # conditionally cannot perturb the digest by ordering.
+    parser_formats = PARSER_FORMATS_BY_OPERATION.get(operation)
+    if parser_formats is not None:
+        policy["parser_formats"] = list(parser_formats)
+    # The Reader contract label, present only on the operation that may run a Reader, in the
+    # same conditional register the two clauses above use.
+    #
+    # It is the contract label and deliberately not the list of admitted families. Embedding
+    # the family ids would make every family registration rotate this digest and require a
+    # coordinator-configuration change -- for no security gain, because the family that ran is
+    # already bound per source by three independent checks: the pin inside ``request.digest``,
+    # the adapter-side cross-check in ``sources/_adapter_steps.py``, and
+    # ``recipe._validate_reader_pin_binding``. What the label actually versions is the shape
+    # of that authority, which is the thing an attestation should be bound to.
+    if operation in READER_PERFORMING_OPERATIONS:
+        policy["reader_contract"] = READER_CONTRACT_VERSION
+    return policy
+
+
+def _policy_digest(operation: str) -> str:
+    return canonical_sha256(_policy_document(operation))
+
+
+def _home_directory_readable() -> bool:
+    try:
+        next(Path.home().iterdir(), None)
+    except OSError:
+        return False
+    return True
+
+
+class _WorkerProcess(Protocol):
+    """The small process surface needed by the bounded IPC pump."""
+
+    pid: int
+    stdin_fd: int
+    stdout_fd: int
+    stderr_fd: int
+
+    def close_stdin(self) -> None: ...
+
+    def close_output(self, descriptor: int) -> None: ...
+
+    def wait(self, timeout: float) -> int: ...
+
+    def kill_group(self) -> None: ...
+
+
+class _PopenWorker:
+    def __init__(self, process: subprocess.Popen[bytes]) -> None:
+        if process.stdin is None or process.stdout is None or process.stderr is None:
+            raise RuntimeError("Clean room process pipes were not created")
+        self._process = process
+        self.pid = process.pid
+        self.stdin_fd = process.stdin.fileno()
+        self.stdout_fd = process.stdout.fileno()
+        self.stderr_fd = process.stderr.fileno()
+
+    def close_stdin(self) -> None:
+        if self._process.stdin is not None and not self._process.stdin.closed:
+            self._process.stdin.close()
+
+    def wait(self, timeout: float) -> int:
+        return self._process.wait(timeout=max(timeout, 0.0))
+
+    def close_output(self, descriptor: int) -> None:
+        for stream in (self._process.stdout, self._process.stderr):
+            if stream is not None and not stream.closed and stream.fileno() == descriptor:
+                stream.close()
+
+    def kill_group(self) -> None:
+        try:
+            os.killpg(self.pid, signal.SIGKILL)
+        except ProcessLookupError:
+            pass
+
+
+class _ForkedWorker:
+    def __init__(
+        self,
+        *,
+        pid: int,
+        stdin_fd: int,
+        stdout_fd: int,
+        stderr_fd: int,
+    ) -> None:
+        self.pid = pid
+        self.stdin_fd = stdin_fd
+        self.stdout_fd = stdout_fd
+        self.stderr_fd = stderr_fd
+        self._returncode: int | None = None
+
+    def close_stdin(self) -> None:
+        if self.stdin_fd >= 0:
+            try:
+                os.close(self.stdin_fd)
+            except OSError:
+                pass
+            self.stdin_fd = -1
+
+    def wait(self, timeout: float) -> int:
+        if self._returncode is not None:
+            return self._returncode
+        deadline = time.monotonic() + max(timeout, 0.0)
+        while True:
+            pid, status = os.waitpid(self.pid, os.WNOHANG)
+            if pid == self.pid:
+                self._returncode = os.waitstatus_to_exitcode(status)
+                return self._returncode
+            if time.monotonic() >= deadline:
+                raise subprocess.TimeoutExpired(("sandbox-worker",), timeout)
+            time.sleep(0.005)
+
+    def close_output(self, descriptor: int) -> None:
+        if descriptor == self.stdout_fd:
+            self.stdout_fd = -1
+        elif descriptor == self.stderr_fd:
+            self.stderr_fd = -1
+        else:
+            return
+        try:
+            os.close(descriptor)
+        except OSError:
+            pass
+
+    def kill_group(self) -> None:
+        try:
+            os.killpg(self.pid, signal.SIGKILL)
+        except ProcessLookupError:
+            pass
+
+
+def _start_popen_worker(
+    command: list[str],
+    *,
+    cwd: Path,
+    env: dict[str, str],
+) -> _WorkerProcess:
+    """Start a session-isolated worker for platforms without the Linux barrier."""
+
+    nproc_limit = _nproc_limit()
+
+    def apply_limits() -> None:
+        _apply_resource_limits(nproc_limit)
+
+    return _PopenWorker(
+        subprocess.Popen(
+            command,
+            cwd=cwd,
+            env=env,
+            stdin=subprocess.PIPE,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            start_new_session=True,
+            preexec_fn=apply_limits,
+        )
+    )
+
+
+def _stop_worker(process: _WorkerProcess) -> None:
+    failure: BaseException | None = None
+
+    def attempt(operation: Any) -> None:
+        nonlocal failure
+        try:
+            operation()
+        except BaseException as error:
+            if failure is None:
+                failure = error
+
+    stdout_fd = process.stdout_fd
+    stderr_fd = process.stderr_fd
+    attempt(process.kill_group)
+    attempt(process.close_stdin)
+    try:
+        process.wait(1.0)
+    except subprocess.TimeoutExpired:
+        # A timeout is only a failed first reap attempt. Preserve failures from the second
+        # kill/reap, but do not report this timeout when the retry succeeds.
+        attempt(process.kill_group)
+        attempt(lambda: process.wait(1.0))
+    except BaseException as error:
+        if failure is None:
+            failure = error
+    attempt(process.close_stdin)
+    attempt(lambda: process.close_output(stdout_fd))
+    attempt(lambda: process.close_output(stderr_fd))
+    if failure is not None:
+        raise failure
+
+
+def _reap_owned_process_group_children(process_group: int, deadline: float) -> None:
+    """Reap adopted hosted descendants without touching another warm worker's group."""
+
+    while True:
+        try:
+            pid, _status = os.waitpid(-process_group, os.WNOHANG)
+        except ChildProcessError:
+            return
+        if pid > 0:
+            continue
+        if time.monotonic() >= deadline:
+            raise OSError("hosted-session process-group descendants did not become reapable")
+        time.sleep(0.005)
+
+
+def _drain_worker_ipc(
+    process: _WorkerProcess,
+    *,
+    request_bytes: bytes,
+    timeout_seconds: float,
+    terminate_process_group: bool = False,
+) -> tuple[bytes, bytes, int]:
+    """Pump all three pipes concurrently and enforce byte caps during streaming."""
+
+    selector: selectors.BaseSelector | None = None
+    stdout = bytearray()
+    stderr = bytearray()
+    request_offset = 0
+    streams = {
+        process.stdout_fd: (stdout, MAX_RESPONSE_BYTES, "stdout"),
+        process.stderr_fd: (stderr, MAX_WORKER_STDERR_BYTES, "stderr"),
+    }
+    result: tuple[bytes, bytes, int] | None = None
+    failure: BaseException | None = None
+
+    def remember(error: BaseException) -> None:
+        nonlocal failure
+        if failure is None:
+            failure = error
+
+    try:
+        selector = selectors.DefaultSelector()
+        deadline = time.monotonic() + timeout_seconds
+        for descriptor in (process.stdin_fd, process.stdout_fd, process.stderr_fd):
+            os.set_blocking(descriptor, False)
+        if request_bytes:
+            selector.register(process.stdin_fd, selectors.EVENT_WRITE, "stdin")
+        else:
+            process.close_stdin()
+        selector.register(process.stdout_fd, selectors.EVENT_READ, "stdout")
+        selector.register(process.stderr_fd, selectors.EVENT_READ, "stderr")
+
+        while streams:
+            remaining = deadline - time.monotonic()
+            if remaining <= 0:
+                raise AcquisitionSecurityError(
+                    "SANDBOX_TIMEOUT",
+                    "The Clean room process did not finish in time",
+                )
+            events = selector.select(remaining)
+            if not events:
+                continue
+            for key, mask in events:
+                descriptor = key.fd
+                if key.data == "stdin" and mask & selectors.EVENT_WRITE:
+                    try:
+                        written = os.write(descriptor, request_bytes[request_offset:])
+                    except BrokenPipeError:
+                        written = 0
+                    request_offset += written
+                    if written == 0 or request_offset == len(request_bytes):
+                        selector.unregister(descriptor)
+                        process.close_stdin()
+                    continue
+                if not mask & selectors.EVENT_READ:
+                    continue
+                buffer, cap, _label = streams[descriptor]
+                try:
+                    chunk = os.read(descriptor, min(65_536, cap - len(buffer) + 1))
+                except BlockingIOError:
+                    continue
+                if not chunk:
+                    selector.unregister(descriptor)
+                    process.close_output(descriptor)
+                    del streams[descriptor]
+                    continue
+                buffer.extend(chunk)
+                if len(buffer) > cap:
+                    raise AcquisitionSecurityError(
+                        "SANDBOX_IPC_LIMIT",
+                        "The Clean room process returned more data than this job allows",
+                    )
+
+        # Hosted-session children may fork bounded parser helpers, but no helper may outlive the
+        # one request. Signal the still-owned process group before reaping its leader: this covers
+        # the success path, catches descendants that deliberately closed all inherited pipes, and
+        # avoids signalling a numeric group id after the leader pid could have been reused.
+        if terminate_process_group:
+            process.kill_group()
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            raise AcquisitionSecurityError(
+                "SANDBOX_TIMEOUT",
+                "The Clean room process did not finish in time",
+            )
+        try:
+            returncode = process.wait(remaining)
+        except subprocess.TimeoutExpired as error:
+            raise AcquisitionSecurityError(
+                "SANDBOX_TIMEOUT",
+                "The Clean room process did not finish in time",
+            ) from error
+        if terminate_process_group:
+            _reap_owned_process_group_children(process.pid, deadline)
+        result = bytes(stdout), bytes(stderr), returncode
+    except BaseException as error:
+        remember(error)
+        try:
+            _stop_worker(process)
+        except BaseException as cleanup_error:
+            # Cleanup is subordinate to the exception that initiated it.
+            remember(cleanup_error)
+    finally:
+        cleanup_steps = [process.close_stdin]
+        if selector is not None:
+            cleanup_steps.insert(0, selector.close)
+        for descriptor in tuple(streams):
+            cleanup_steps.append(lambda descriptor=descriptor: process.close_output(descriptor))
+        for cleanup_step in cleanup_steps:
+            try:
+                cleanup_step()
+            except BaseException as cleanup_error:
+                remember(cleanup_error)
+    if failure is not None:
+        raise failure
+    assert result is not None
+    return result
+
+
+def _read_control(directory_fd: int, name: str) -> str:
+    descriptor = os.open(name, os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW, dir_fd=directory_fd)
+    try:
+        chunks: list[bytes] = []
+        while True:
+            chunk = os.read(descriptor, 4096)
+            if not chunk:
+                return b"".join(chunks).decode("ascii", "strict")
+            chunks.append(chunk)
+    finally:
+        os.close(descriptor)
+
+
+def _write_control(directory_fd: int, name: str, value: str) -> None:
+    descriptor = os.open(name, os.O_WRONLY | os.O_CLOEXEC | os.O_NOFOLLOW, dir_fd=directory_fd)
+    try:
+        payload = value.encode("ascii", "strict")
+        if os.write(descriptor, payload) != len(payload):
+            raise OSError("short write to cgroup control")
+    finally:
+        os.close(descriptor)
+
+
+def _control_can_be_opened_for_write(directory_fd: int, name: str) -> bool:
+    try:
+        descriptor = os.open(
+            name,
+            os.O_WRONLY | os.O_CLOEXEC | os.O_NOFOLLOW,
+            dir_fd=directory_fd,
+        )
+    except OSError:
+        return False
+    os.close(descriptor)
+    return True
+
+
+def _require_hosted_session_container_boundary(expected_memory_bytes: int) -> None:
+    """Validate the immutable whole-container boundary used only by research sessions.
+
+    Cloud Run does not delegate a writable cgroup subtree to the service. Instead, one session is
+    the sole tenant of one instance and the platform's cgroup is the hard aggregate ceiling for
+    the coordinator, parser, and every descendant. The same credentials that reach the parser
+    must be unable to change that ceiling, create a child cgroup, or migrate a process elsewhere.
+    A networkless seccomp filter is installed separately before the parser is released to exec.
+    """
+
+    if (
+        type(expected_memory_bytes) is not int
+        or expected_memory_bytes != HOSTED_SESSION_CONTAINER_MEMORY_BYTES
+    ):
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_BOUNDARY",
+            "hosted-session memory authority must name the exact 4 GiB service ceiling",
+        )
+    if sys.platform != "linux" or platform.machine().lower() not in {"x86_64", "amd64"}:
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_BOUNDARY",
+            "hosted-session container confinement requires Linux/amd64",
+        )
+    selected: (
+        tuple[
+            int,
+            os.stat_result,
+            str,
+            str,
+            tuple[str, ...],
+            tuple[str, ...],
+        ]
+        | None
+    ) = None
+    last_error: BaseException | None = None
+    layouts = (
+        (_HOSTED_SESSION_CGROUP_ROOT, "memory.max", ("cgroup.procs",), ("cgroup.subtree_control",)),
+        (
+            _HOSTED_SESSION_CGROUP_ROOT / "memory",
+            "memory.limit_in_bytes",
+            ("cgroup.procs", "tasks"),
+            (),
+        ),
+    )
+    for root, limit_name, member_names, extra_immutable in layouts:
+        root_fd = -1
+        try:
+            root_fd = os.open(
+                root,
+                os.O_RDONLY | os.O_DIRECTORY | os.O_CLOEXEC | os.O_NOFOLLOW,
+            )
+            metadata = os.fstat(root_fd)
+            raw_limit = _read_control(root_fd, limit_name).strip()
+        except (OSError, UnicodeError) as error:
+            last_error = error
+            if root_fd >= 0:
+                os.close(root_fd)
+            continue
+        selected = (
+            root_fd,
+            metadata,
+            raw_limit,
+            limit_name,
+            member_names,
+            extra_immutable,
+        )
+        break
+    if selected is None:
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_BOUNDARY",
+            "hosted-session container cgroup is unavailable or unreadable",
+        ) from last_error
+    root_fd, metadata, raw_limit, limit_name, member_names, extra_immutable = selected
+    try:
+        member_name: str | None = None
+        members: set[int] | None = None
+        for candidate in member_names:
+            try:
+                raw_members = _read_control(root_fd, candidate)
+            except (OSError, UnicodeError):
+                continue
+            try:
+                members = {int(value) for value in raw_members.split()}
+            except ValueError as error:
+                raise AcquisitionSecurityError(
+                    "SANDBOX_MEMORY_BOUNDARY",
+                    "hosted-session container process membership is malformed",
+                ) from error
+            member_name = candidate
+            break
+        if member_name is None or members is None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_MEMORY_BOUNDARY",
+                "hosted-session container process membership is unavailable",
+            )
+        if not stat.S_ISDIR(metadata.st_mode):
+            raise AcquisitionSecurityError(
+                "SANDBOX_MEMORY_BOUNDARY",
+                "hosted-session memory authority is not a cgroup directory",
+            )
+        if raw_limit == "max":
+            raise AcquisitionSecurityError(
+                "SANDBOX_MEMORY_BOUNDARY",
+                "hosted-session container cgroup has no finite memory ceiling",
+            )
+        if not raw_limit.isascii() or not raw_limit.isdecimal():
+            raise AcquisitionSecurityError(
+                "SANDBOX_MEMORY_BOUNDARY",
+                "hosted-session container memory ceiling is not an unsigned byte count",
+            )
+        if int(raw_limit) != expected_memory_bytes:
+            raise AcquisitionSecurityError(
+                "SANDBOX_MEMORY_BOUNDARY",
+                "hosted-session container memory ceiling does not match the exact service class",
+            )
+        if os.getpid() not in members:
+            raise AcquisitionSecurityError(
+                "SANDBOX_MEMORY_BOUNDARY",
+                "hosted-session coordinator is not in the bounded container cgroup",
+            )
+        descriptor_path = f"/proc/self/fd/{root_fd}"
+        if os.access(descriptor_path, os.W_OK, effective_ids=True) or any(
+            _control_can_be_opened_for_write(root_fd, control)
+            for control in (
+                limit_name,
+                *member_names,
+                *extra_immutable,
+            )
+        ):
+            raise AcquisitionSecurityError(
+                "SANDBOX_MEMORY_BOUNDARY",
+                "hosted-session container cgroup must be immutable to worker credentials",
+            )
+    finally:
+        os.close(root_fd)
+
+
+def _require_bounded_cgroup_root(root_fd: int) -> None:
+    """Validate one empty, operation-scoped, hierarchically bounded cgroup-v2 root.
+
+    The coordinator and worker share Unix credentials, so the worker can exercise the root's
+    process-migration and child-creation delegation too. Containment therefore lives on the root
+    itself: immutable memory/pid ceilings apply to every descendant, depth and descendant counts
+    admit one protected coordinator plus exactly one job child, the no-internal-process rule keeps
+    the worker out of the root, and the non-writable parent prevents escape above it.
+    """
+
+    if type(root_fd) is not int or root_fd < 0:
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_BOUNDARY",
+            "Linux memory authority must be an open bounded cgroup root descriptor",
+        )
+    try:
+        metadata = os.fstat(root_fd)
+        controllers = set(_read_control(root_fd, "cgroup.controllers").split())
+        enabled = set(_read_control(root_fd, "cgroup.subtree_control").split())
+        limits = {
+            "memory.max": _read_control(root_fd, "memory.max").strip(),
+            "memory.swap.max": _read_control(root_fd, "memory.swap.max").strip(),
+            "pids.max": _read_control(root_fd, "pids.max").strip(),
+            "cgroup.max.depth": _read_control(root_fd, "cgroup.max.depth").strip(),
+            "cgroup.max.descendants": _read_control(root_fd, "cgroup.max.descendants").strip(),
+        }
+        cgroup_stat = dict(
+            line.split() for line in _read_control(root_fd, "cgroup.stat").splitlines()
+        )
+    except (OSError, UnicodeError) as error:
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_BOUNDARY",
+            "Linux memory authority is not a readable bounded cgroup-v2 root",
+        ) from error
+    expected = {
+        "memory.max": str(MAX_WORKER_MEMORY_BYTES),
+        "memory.swap.max": "0",
+        "pids.max": str(MAX_WORKER_PIDS),
+        "cgroup.max.depth": "1",
+        "cgroup.max.descendants": "2",
+    }
+    if not stat.S_ISDIR(metadata.st_mode) or not {"memory", "pids"} <= controllers | enabled:
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_BOUNDARY",
+            "bounded cgroup root must expose the memory and pids controllers",
+        )
+    if limits != expected or not {"memory", "pids"} <= enabled:
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_BOUNDARY",
+            "bounded cgroup root must carry immutable hierarchy, memory, swap, and process limits",
+        )
+    descriptor_path = f"/proc/self/fd/{root_fd}"
+    if not os.access(descriptor_path, os.W_OK, effective_ids=True):
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_BOUNDARY",
+            "bounded cgroup root must grant child-creation authority",
+        )
+    immutable_controls = (*expected, "cgroup.subtree_control")
+    if any(_control_can_be_opened_for_write(root_fd, name) for name in immutable_controls):
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_BOUNDARY",
+            "bounded cgroup root limits must not be writable by worker credentials",
+        )
+    if not _control_can_be_opened_for_write(root_fd, "cgroup.procs"):
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_BOUNDARY",
+            "bounded cgroup root must grant process-migration authority",
+        )
+    if _control_can_be_opened_for_write(root_fd, "../cgroup.procs"):
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_BOUNDARY",
+            "worker credentials must not be able to leave the bounded cgroup root",
+        )
+    if _read_control(root_fd, "cgroup.procs").split() or cgroup_stat.get("nr_descendants") != "1":
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_BOUNDARY",
+            "bounded cgroup root must contain only its operator-owned coordinator child",
+        )
+    coordinator_fd = -1
+    try:
+        coordinator_fd = os.open(
+            "coordinator",
+            os.O_RDONLY | os.O_DIRECTORY | os.O_CLOEXEC | os.O_NOFOLLOW,
+            dir_fd=root_fd,
+        )
+        coordinator_members = {
+            int(value) for value in _read_control(coordinator_fd, "cgroup.procs").split()
+        }
+        if os.getpid() not in coordinator_members or _control_can_be_opened_for_write(
+            coordinator_fd, "cgroup.procs"
+        ):
+            raise AcquisitionSecurityError(
+                "SANDBOX_MEMORY_BOUNDARY",
+                "the trusted coordinator must run in a non-writable sibling cgroup",
+            )
+    except OSError as error:
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_BOUNDARY",
+            "bounded cgroup root has no protected coordinator child",
+        ) from error
+    finally:
+        if coordinator_fd >= 0:
+            os.close(coordinator_fd)
+
+
+class _CgroupJob:
+    def __init__(self, *, root_fd: int, name: str, job_fd: int) -> None:
+        self.root_fd = root_fd
+        self.name = name
+        self.job_fd = job_fd
+        self._root_oom_before = self._oom_events(root_fd)
+
+    @classmethod
+    def create(cls, root_fd: int, pid: int) -> _CgroupJob:
+        name = f"mostlyright-sandbox-{pid}-{secrets.token_hex(8)}"
+        duplicated_root = os.dup(root_fd)
+        job_fd = -1
+        leaf_created = False
+        job: _CgroupJob | None = None
+        try:
+            os.mkdir(name, mode=0o700, dir_fd=duplicated_root)
+            leaf_created = True
+            job_fd = os.open(
+                name,
+                os.O_RDONLY | os.O_DIRECTORY | os.O_CLOEXEC | os.O_NOFOLLOW,
+                dir_fd=duplicated_root,
+            )
+            # Construction reads root telemetry. It belongs inside the ownership scope too: an
+            # OSError -- or a process-level BaseException -- after the leaf and its descriptor
+            # exist must not strand either merely because no `_CgroupJob` was returned to the
+            # caller yet.
+            job = cls(root_fd=duplicated_root, name=name, job_fd=job_fd)
+            job._configure(pid)
+        except BaseException:
+            if job is not None:
+                job._best_effort_remove()
+            else:
+                # These are independent owned resources. A failing close or removal must not
+                # prevent the later cleanup attempts, and none may replace the construction
+                # failure being re-raised below.
+                if job_fd >= 0:
+                    try:
+                        os.close(job_fd)
+                    except BaseException:
+                        pass
+                if leaf_created:
+                    try:
+                        os.rmdir(name, dir_fd=duplicated_root)
+                    except BaseException:
+                        pass
+                try:
+                    os.close(duplicated_root)
+                except BaseException:
+                    pass
+            raise
+        assert job is not None
+        return job
+
+    def _configure(self, pid: int) -> None:
+        expected = {
+            "memory.max": str(MAX_WORKER_MEMORY_BYTES),
+            "memory.swap.max": "0",
+            "pids.max": str(MAX_WORKER_PIDS),
+        }
+        for control, value in expected.items():
+            _write_control(self.job_fd, control, value)
+            if _read_control(self.job_fd, control).strip() != value:
+                raise OSError(f"cgroup refused {control}")
+        _write_control(self.job_fd, "cgroup.procs", str(pid))
+        members = {int(value) for value in _read_control(self.job_fd, "cgroup.procs").split()}
+        if pid not in members:
+            raise OSError("worker was not attached to its cgroup before release")
+
+    @staticmethod
+    def _oom_events(directory_fd: int) -> int:
+        events = {
+            key: int(value)
+            for key, value in (
+                line.split() for line in _read_control(directory_fd, "memory.events").splitlines()
+            )
+        }
+        return max(events.get("oom", 0), events.get("oom_kill", 0))
+
+    def memory_limit_hit(self) -> bool:
+        return (
+            self._oom_events(self.job_fd) > 0
+            or self._oom_events(self.root_fd) > self._root_oom_before
+        )
+
+    def cleanup(self) -> None:
+        failure: BaseException | None = None
+
+        def remember(error: BaseException) -> None:
+            nonlocal failure
+            if failure is None:
+                failure = error
+
+        def kill_members() -> None:
+            try:
+                members = _read_control(self.job_fd, "cgroup.procs").split()
+            except BaseException as error:
+                remember(error)
+                return
+            for pid_text in members:
+                try:
+                    os.kill(int(pid_text), signal.SIGKILL)
+                except ProcessLookupError:
+                    pass
+                except BaseException as error:
+                    remember(error)
+
+        populated: bool | None = None
+        try:
+            populated = bool(
+                "populated 0" not in _read_control(self.job_fd, "cgroup.events").splitlines()
+            )
+        except BaseException as error:
+            remember(error)
+
+        # Unknown telemetry is not evidence that the leaf is empty. Both kill mechanisms are
+        # attempted independently: cgroup.kill may be absent on an older kernel, while reading
+        # cgroup.procs or killing one member may itself be the operation that was interrupted.
+        if populated is not False:
+            deadline: float | None = None
+            try:
+                deadline = time.monotonic() + _CGROUP_CLEANUP_TIMEOUT_SECONDS
+            except BaseException as error:
+                remember(error)
+            # The attempt cap is an independent bound when clock access itself is interrupted.
+            # When the clock works, the earlier of the wall-clock deadline and this cap wins.
+            attempts_left = max(1, int(_CGROUP_CLEANUP_TIMEOUT_SECONDS / 0.01) + 1)
+            while attempts_left > 0:
+                attempts_left -= 1
+                # Repeat both kill mechanisms: a descendant can appear after one procs
+                # snapshot, and cgroup.kill is optional on older cgroup-v2 kernels.
+                try:
+                    _write_control(self.job_fd, "cgroup.kill", "1")
+                except OSError:
+                    pass
+                except BaseException as error:
+                    remember(error)
+                kill_members()
+                try:
+                    populated = (
+                        "populated 0"
+                        not in _read_control(self.job_fd, "cgroup.events").splitlines()
+                    )
+                except BaseException as error:
+                    remember(error)
+                    populated = None
+                if populated is False:
+                    break
+                timed_out = attempts_left == 0
+                if deadline is not None:
+                    try:
+                        timed_out = timed_out or time.monotonic() >= deadline
+                    except BaseException as error:
+                        remember(error)
+                if timed_out:
+                    remember(OSError("cgroup descendants survived cleanup"))
+                    break
+                try:
+                    time.sleep(0.01)
+                except BaseException as error:
+                    remember(error)
+                    continue
+        try:
+            os.close(self.job_fd)
+        except BaseException as error:
+            remember(error)
+        try:
+            os.rmdir(self.name, dir_fd=self.root_fd)
+        except BaseException as error:
+            remember(error)
+        try:
+            os.close(self.root_fd)
+        except BaseException as error:
+            remember(error)
+        if failure is not None:
+            raise failure
+
+    def _best_effort_remove(self) -> None:
+        try:
+            self.cleanup()
+        except BaseException:
+            pass
+
+
+def _close_child_descriptors_except(keep: set[int]) -> None:
+    try:
+        descriptors = [int(name) for name in os.listdir("/proc/self/fd") if name.isdigit()]
+    except OSError:
+        soft_limit, _hard_limit = resource.getrlimit(resource.RLIMIT_NOFILE)
+        descriptors = list(range(3, min(int(soft_limit), 65_536)))
+    for descriptor in descriptors:
+        if descriptor not in keep:
+            try:
+                os.close(descriptor)
+            except OSError:
+                pass
+
+
+def _start_linux_barrier_worker(
+    command: list[str],
+    *,
+    cwd: Path,
+    env: dict[str, str],
+    hosted_session_networkless: bool = False,
+) -> tuple[_ForkedWorker, int, int]:
+    """Fork a stopped-before-exec child; return it plus ready/release pipe ends."""
+
+    stdin_read, stdin_write = os.pipe2(os.O_CLOEXEC)
+    stdout_read, stdout_write = os.pipe2(os.O_CLOEXEC)
+    stderr_read, stderr_write = os.pipe2(os.O_CLOEXEC)
+    ready_read, ready_write = os.pipe2(os.O_CLOEXEC)
+    release_read, release_write = os.pipe2(os.O_CLOEXEC)
+    nproc_limit = _nproc_limit()
+    try:
+        pid = os.fork()
+    except BaseException:
+        for descriptor in (
+            stdin_read,
+            stdin_write,
+            stdout_read,
+            stdout_write,
+            stderr_read,
+            stderr_write,
+            ready_read,
+            ready_write,
+            release_read,
+            release_write,
+        ):
+            os.close(descriptor)
+        raise
+    if pid == 0:
+        try:
+            os.close(stdin_write)
+            os.close(stdout_read)
+            os.close(stderr_read)
+            os.close(ready_read)
+            os.close(release_write)
+            os.setsid()
+            os.dup2(stdin_read, 0)
+            os.dup2(stdout_write, 1)
+            os.dup2(stderr_write, 2)
+            _close_child_descriptors_except({0, 1, 2, ready_write, release_read})
+            _apply_resource_limits(nproc_limit)
+            if hosted_session_networkless:
+                _install_networkless_seccomp(allow_descendants=True)
+            os.write(ready_write, b"R")
+            if os.read(release_read, 1) != b"G":
+                os._exit(126)
+            os.close(ready_write)
+            os.close(release_read)
+            os.chdir(cwd)
+            os.execve(command[0], command, env)
+        except BaseException:
+            try:
+                os.write(2, b"sandbox worker failed before exec\n")
+            except OSError:
+                pass
+            os._exit(127)
+    os.close(stdin_read)
+    os.close(stdout_write)
+    os.close(stderr_write)
+    os.close(ready_write)
+    os.close(release_read)
+    return (
+        _ForkedWorker(
+            pid=pid,
+            stdin_fd=stdin_write,
+            stdout_fd=stdout_read,
+            stderr_fd=stderr_read,
+        ),
+        ready_read,
+        release_write,
+    )
+
+
+def _wait_for_barrier(descriptor: int, timeout_seconds: float) -> None:
+    selector = selectors.DefaultSelector()
+    try:
+        selector.register(descriptor, selectors.EVENT_READ)
+        if not selector.select(timeout_seconds) or os.read(descriptor, 1) != b"R":
+            raise OSError("The Clean room process did not stop before starting its job")
+    finally:
+        selector.close()
+        os.close(descriptor)
+
+
+@dataclass
+class _PreparedWorker:
+    """One started, resource-limited child that has not been given a request yet.
+
+    The split between preparing a child and completing a request against it is what makes a
+    warm pool expressible without a second launch path. Both paths build the identical
+    ``_PreparedWorker``; the only difference is when it is built. A cold invocation builds one
+    and binds it in the same call, a warm one built it earlier and idle. Because there is one
+    constructor, a warm child cannot drift away from a cold child's environment, descriptors,
+    session, or resource limits -- there is no second place for it to drift in.
+
+    ``deadline`` is the wall-clock budget a cold invocation already started spending on the
+    barrier handshake, carried forward so the split does not silently widen the timeout. A
+    warm child carries ``None``: its request budget starts when the request binds, not when
+    the child was spawned, because the seconds it spent idle are not seconds the request had.
+    """
+
+    process: _WorkerProcess
+    job: _CgroupJob | None
+    deadline: float | None
+    launch: _WorkerLaunch
+
+
+@dataclass(frozen=True)
+class _WorkerLaunch:
+    """The exact launch specification a child was started from.
+
+    A warm child may only be bound to a request whose launch specification is byte-identical
+    to the one the child was started from. The boundary is the container and the cgroup, which
+    are the same for every child of one coordinator, so the specification is what is left to
+    compare. Comparing the whole of it rather than an operation name keeps the argument
+    mechanical: nothing about a pooled child's confinement can differ from the confinement the
+    binding request would have been given had it spawned its own. (Until ADR 0021 there
+    was a second reason -- on darwin the Seatbelt profile was an argv element, so equal commands
+    were equal kernel authority. That backend is gone; the comparison it motivated is not, because
+    it is what makes a warm child indistinguishable from a fresh spawn.)
+    """
+
+    command: tuple[str, ...]
+    cwd: Path
+    env: tuple[tuple[str, str], ...]
+    prewarm: bool
+
+    @property
+    def confinement(self) -> tuple[tuple[str, ...], Path, tuple[tuple[str, str], ...]]:
+        """Everything about a child that a request may rely on: argv, directory, environment."""
+
+        return (self.command, self.cwd, self.env)
+
+    def argv(self) -> list[str]:
+        """The exact argv this child is exec'd with.
+
+        ``--prewarm`` is appended rather than folded into ``command`` so the confinement a
+        warm child was given and the confinement a binding request asks for stay comparable.
+        It is the one enumerated difference between a warm child and a cold one, it is
+        readable in ``ps``, and it grants nothing: the flag chooses when the parser imports
+        happen and whether a readiness line is written, and the child's authority is decided
+        entirely by the container boundary, the cgroup, the closed environment, and the request.
+        """
+
+        return [*self.command, "--prewarm"] if self.prewarm else list(self.command)
+
+
+def _prepare_worker(
+    launch: _WorkerLaunch,
+    *,
+    timeout_seconds: float,
+    memory_cgroup_root_fd: int | None,
+    hosted_session_container_memory_bytes: int | None = None,
+    track_deadline: bool,
+    ready_timeout_seconds: float | None = None,
+) -> _PreparedWorker:
+    """Start one confined child and bring it to the point of reading its request.
+
+    ``ready_timeout_seconds`` bounds only the pre-warm readiness wait, and a filler passes what
+    is left of one budget for the whole fill rather than a fresh budget per child.
+    """
+
+    command = launch.argv()
+    cwd = launch.cwd
+    env = dict(launch.env)
+    deadline = time.monotonic() + timeout_seconds
+    if ready_timeout_seconds is None:
+        ready_timeout_seconds = min(timeout_seconds, 30.0)
+    if sys.platform != "linux":
+        # No deadline is carried here, and that is the pre-existing behaviour rather than an
+        # oversight: this platform has no barrier handshake, so nothing was spent before the
+        # request, and the drain gets the whole timeout exactly as it did before the split.
+        return _become_ready_if_asked(
+            _PreparedWorker(
+                process=_start_popen_worker(command, cwd=cwd, env=env),
+                job=None,
+                deadline=None,
+                launch=launch,
+            ),
+            timeout_seconds=ready_timeout_seconds,
+        )
+    if memory_cgroup_root_fd is not None and hosted_session_container_memory_bytes is not None:
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_BOUNDARY",
+            "delegated and hosted-session memory boundaries are mutually exclusive",
+        )
+    if memory_cgroup_root_fd is None and hosted_session_container_memory_bytes is None:
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_BOUNDARY",
+            "Linux Clean room execution requires a trusted bounded cgroup root",
+        )
+    if memory_cgroup_root_fd is not None:
+        _require_bounded_cgroup_root(memory_cgroup_root_fd)
+    else:
+        assert hosted_session_container_memory_bytes is not None
+        _require_hosted_session_container_boundary(hosted_session_container_memory_bytes)
+    process, ready_fd, release_fd = _start_linux_barrier_worker(
+        command,
+        cwd=cwd,
+        env=env,
+        hosted_session_networkless=hosted_session_container_memory_bytes is not None,
+    )
+    job: _CgroupJob | None = None
+    try:
+        _wait_for_barrier(ready_fd, min(max(deadline - time.monotonic(), 0.0), 5.0))
+        if memory_cgroup_root_fd is not None:
+            job = _CgroupJob.create(memory_cgroup_root_fd, process.pid)
+        if os.write(release_fd, b"G") != 1:
+            raise OSError("The Clean room process could not be released to start its job")
+        os.close(release_fd)
+        release_fd = -1
+    except BaseException as error:
+        if release_fd >= 0:
+            try:
+                os.close(release_fd)
+            except BaseException:
+                pass
+        try:
+            _stop_worker(process)
+        except BaseException:
+            pass
+        if job is not None:
+            job._best_effort_remove()
+        if not isinstance(error, Exception):
+            raise error
+        if isinstance(error, AcquisitionSecurityError):
+            raise
+        if hosted_session_container_memory_bytes is not None:
+            raise AcquisitionSecurityError(
+                "SANDBOX_OS_BOUNDARY",
+                "hosted-session networkless process boundary could not be established before exec",
+            ) from error
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_BOUNDARY",
+            "Linux cgroup memory boundary could not be established before exec",
+        ) from error
+
+    return _become_ready_if_asked(
+        _PreparedWorker(
+            process=process,
+            job=job,
+            deadline=deadline if track_deadline else None,
+            launch=launch,
+        ),
+        timeout_seconds=ready_timeout_seconds,
+    )
+
+
+def _become_ready_if_asked(
+    prepared: _PreparedWorker,
+    *,
+    timeout_seconds: float,
+) -> _PreparedWorker:
+    """Wait for a pre-warm child's readiness line, discarding it whole if it never comes.
+
+    After exec and inside whatever boundary this platform establishes, so the child that
+    announces readiness is the confined child and not something on its way to becoming one. A
+    child that fails here is torn down completely -- process group and cgroup both -- because
+    it was never handed out and nothing is waiting on its response.
+    """
+
+    if not prepared.launch.prewarm:
+        return prepared
+    try:
+        _await_worker_ready(prepared.process, timeout_seconds=timeout_seconds)
+    except BaseException:
+        _discard_prepared_worker(prepared)
+        raise
+    return prepared
+
+
+def _worker_is_running(process: _WorkerProcess) -> bool:
+    """Whether a child is still alive, reaping it if it is not.
+
+    ``wait`` with a zero budget is the one liveness question both worker shapes already answer:
+    a returncode means it exited and has now been reaped, and a timeout means it is running.
+
+    Anything else answers neither, and the two possible guesses are not symmetric. Guessing
+    "exited" sends the child down the teardown that does not signal it, which would leak a live
+    process holding a cgroup. Guessing "running" sends it down the teardown that kills and
+    reaps, which is correct for a live child and harmless for a dead one. So an unrecognised
+    failure reports running. Interruptions are not answers at all and are re-raised.
+    """
+
+    try:
+        process.wait(0.0)
+    except subprocess.TimeoutExpired:
+        return True
+    except (KeyboardInterrupt, SystemExit):
+        raise
+    except BaseException:
+        return True
+    return False
+
+
+def _discard_prepared_worker(
+    prepared: _PreparedWorker,
+    *,
+    already_exited: bool = False,
+) -> None:
+    """Tear down a prepared child that will never be given a request.
+
+    ``already_exited`` changes the teardown rather than shortening it. A reaped child's pid is
+    free for the kernel to hand to somebody else, so signalling its process group could reach
+    whatever now holds that number; a child known to have exited therefore gets its
+    descriptors closed and its cgroup removed, and nothing is signalled. Cgroup teardown is
+    unaffected either way: it only ever reaches members of the leaf it owns.
+    """
+
+    process = prepared.process
+    stdout_fd = process.stdout_fd
+    stderr_fd = process.stderr_fd
+    steps: tuple[Any, ...] = (
+        (
+            process.close_stdin,
+            lambda: process.close_output(stdout_fd),
+            lambda: process.close_output(stderr_fd),
+        )
+        if already_exited
+        else (lambda: _stop_worker(process),)
+    )
+    for step in steps:
+        try:
+            step()
+        except BaseException:
+            pass
+    if prepared.job is not None:
+        try:
+            prepared.job.cleanup()
+        except BaseException:
+            prepared.job._best_effort_remove()
+
+
+def _await_worker_ready(process: _WorkerProcess, *, timeout_seconds: float) -> None:
+    """Read exactly the readiness marker a pre-warmed child writes before its response.
+
+    Never more than the marker: the read length is capped at the bytes still outstanding, so
+    this cannot consume a byte of the response the request will later produce, and the pump
+    that drains that response sees the same stream it would have seen from a cold child.
+    """
+
+    selector = selectors.DefaultSelector()
+    seen = bytearray()
+    try:
+        os.set_blocking(process.stdout_fd, False)
+        selector.register(process.stdout_fd, selectors.EVENT_READ)
+        deadline = time.monotonic() + timeout_seconds
+        while len(seen) < len(WORKER_READY_MARKER):
+            remaining = deadline - time.monotonic()
+            if remaining <= 0 or not selector.select(remaining):
+                raise AcquisitionSecurityError(
+                    "SANDBOX_WARM_POOL",
+                    "a warm Clean room process did not become ready in time",
+                )
+            try:
+                chunk = os.read(process.stdout_fd, len(WORKER_READY_MARKER) - len(seen))
+            except BlockingIOError:
+                continue
+            if not chunk:
+                raise AcquisitionSecurityError(
+                    "SANDBOX_WARM_POOL",
+                    "a warm Clean room process ended before it became ready",
+                )
+            seen.extend(chunk)
+        if bytes(seen) != WORKER_READY_MARKER:
+            raise AcquisitionSecurityError(
+                "SANDBOX_WARM_POOL",
+                "a warm Clean room process did not announce readiness",
+            )
+    finally:
+        selector.close()
+        # Left exactly as a cold child's descriptor is found. The pump sets all three
+        # non-blocking itself, so this changes no behaviour -- but "a warm child is
+        # indistinguishable from a fresh spawn" should not rest on the next reader repeating
+        # the state this one happened to leave behind.
+        try:
+            os.set_blocking(process.stdout_fd, True)
+        except OSError:
+            pass
+
+
+def _complete_worker(
+    prepared: _PreparedWorker,
+    *,
+    request_bytes: bytes,
+    timeout_seconds: float,
+    terminate_process_group: bool = False,
+) -> tuple[bytes, bytes, int]:
+    """Give one prepared child its one request and collect its one response."""
+
+    process = prepared.process
+    job = prepared.job
+    deadline = prepared.deadline
+    if deadline is None:
+        deadline = time.monotonic() + timeout_seconds
+    if job is None:
+        return _drain_worker_ipc(
+            process,
+            request_bytes=request_bytes,
+            timeout_seconds=max(deadline - time.monotonic(), 0.0),
+            terminate_process_group=terminate_process_group,
+        )
+    result: tuple[bytes, bytes, int] | None = None
+    primary_error: BaseException | None = None
+    primary_stage: str | None = None
+    memory_limit_hit = False
+    try:
+        try:
+            result = _drain_worker_ipc(
+                process,
+                request_bytes=request_bytes,
+                timeout_seconds=max(deadline - time.monotonic(), 0.0),
+                terminate_process_group=terminate_process_group,
+            )
+        except BaseException as error:
+            primary_error = error
+            primary_stage = "drain"
+        try:
+            memory_limit_hit = job.memory_limit_hit()
+        except BaseException as error:
+            if primary_error is None:
+                primary_error = error
+                primary_stage = "telemetry"
+    finally:
+        try:
+            job.cleanup()
+        except BaseException as error:
+            if primary_error is None:
+                primary_error = error
+                primary_stage = "cleanup"
+
+    if primary_error is not None:
+        # Interruptions are control flow, not worker failures. Teardown above still owns every
+        # cgroup resource, but the exact process-level exception must reach the caller unchanged.
+        if not isinstance(primary_error, Exception):
+            raise primary_error
+        if primary_stage == "drain" and isinstance(primary_error, AcquisitionSecurityError):
+            raise primary_error
+        if primary_stage == "telemetry":
+            raise AcquisitionSecurityError(
+                "SANDBOX_MEMORY_BOUNDARY",
+                "Linux cgroup memory telemetry could not be corroborated",
+            ) from primary_error
+        if primary_stage == "cleanup":
+            raise AcquisitionSecurityError(
+                "SANDBOX_MEMORY_BOUNDARY",
+                "Linux cgroup descendants could not be killed and removed",
+            ) from primary_error
+        raise AcquisitionSecurityError(
+            "SANDBOX_FAILURE",
+            "The Clean room process could not be watched safely",
+        ) from primary_error
+    if memory_limit_hit:
+        raise AcquisitionSecurityError(
+            "SANDBOX_MEMORY_LIMIT",
+            "The Clean room process used more memory than this job allows",
+        )
+    if result is None:
+        raise AcquisitionSecurityError(
+            "SANDBOX_FAILURE", "The Clean room process returned no result"
+        )
+    return result
+
+
+def _run_worker_command(
+    command: list[str],
+    *,
+    cwd: Path,
+    env: dict[str, str],
+    request_bytes: bytes,
+    timeout_seconds: float,
+    memory_cgroup_root_fd: int | None,
+    hosted_session_container_memory_bytes: int | None = None,
+) -> tuple[bytes, bytes, int]:
+    """Spawn one child and run one request against it: the cold path, start to finish."""
+
+    launch = _WorkerLaunch(
+        command=tuple(command),
+        cwd=cwd,
+        env=tuple(sorted(env.items())),
+        prewarm=False,
+    )
+    prepared = _prepare_worker(
+        launch,
+        timeout_seconds=timeout_seconds,
+        memory_cgroup_root_fd=memory_cgroup_root_fd,
+        hosted_session_container_memory_bytes=hosted_session_container_memory_bytes,
+        track_deadline=True,
+    )
+    return _complete_worker(
+        prepared,
+        request_bytes=request_bytes,
+        timeout_seconds=timeout_seconds,
+        terminate_process_group=hosted_session_container_memory_bytes is not None,
+    )
+
+
+class _WarmSandboxPool:
+    """Pre-spawned, pre-imported children that have not been bound to a request.
+
+    Warm means spawned early and finished importing -- it never means reused. Every child
+    here is handed out at most once, serves exactly the one request it is handed, and exits;
+    :func:`worker_main` reads stdin once and returns, so there is no code path by which a
+    second request could reach a child that has already served one. What pooling removes is
+    the interpreter start and the module imports, which are the same work for every child and
+    depend on nothing a request supplies.
+
+    A child sitting here holds no request, no credential, and no coordinator state: it was
+    exec'd with the same closed environment and closed descriptor set as a cold child and is
+    blocked reading an empty stdin. The one thing a warm child has that a cold child does not
+    is time already spent, and time is not authority.
+
+    Every method that reads or writes ``_ready`` holds ``_lock``. Handing one child to two
+    callers is the one way this class could break the invariant it exists to keep, and it is
+    reachable without it: the liveness check releases the GIL, so two threads could select the
+    same child between the scan and the reassignment. No caller is threaded today. The lock is
+    here because the invariant is stated unconditionally, and an invariant that depends on the
+    caller staying single-threaded is a comment rather than a guarantee.
+    """
+
+    def __init__(
+        self,
+        *,
+        timeout_seconds: float,
+        memory_cgroup_root_fd: int | None,
+        hosted_session_container_memory_bytes: int | None = None,
+    ) -> None:
+        self._timeout_seconds = timeout_seconds
+        self._memory_cgroup_root_fd = memory_cgroup_root_fd
+        self._hosted_session_container_memory_bytes = hosted_session_container_memory_bytes
+        self._ready: list[_PreparedWorker] = []
+        self._lock = threading.Lock()
+
+    def fill(self, launch: _WorkerLaunch, *, size: int) -> int:
+        """Bring the pool up to ``size`` live children ready for exactly ``launch``.
+
+        One readiness budget covers the whole call. A child that fails to start leaves the
+        ones already started in the pool rather than unwinding them, so a caller that wraps
+        this in a lifecycle still has something to close.
+        """
+
+        with self._lock:
+            self._prune(launch)
+            deadline = time.monotonic() + WARM_POOL_FILL_TIMEOUT_SECONDS
+            while len(self._ready) < size:
+                self._ready.append(
+                    _prepare_worker(
+                        launch,
+                        timeout_seconds=self._timeout_seconds,
+                        memory_cgroup_root_fd=self._memory_cgroup_root_fd,
+                        hosted_session_container_memory_bytes=(
+                            self._hosted_session_container_memory_bytes
+                        ),
+                        track_deadline=False,
+                        ready_timeout_seconds=max(deadline - time.monotonic(), 0.0),
+                    )
+                )
+            return len(self._ready)
+
+    def take(self, launch: _WorkerLaunch) -> _PreparedWorker | None:
+        """Hand out one live child started from exactly ``launch``, or nothing.
+
+        Nothing is a complete answer: the caller spawns its own child, which is what it would
+        have done anyway. A near-match is never a match, because the launch specification is
+        the whole of a child's confinement.
+
+        A child that died while it was idle -- an operator kill, a host-level OOM -- is reaped
+        here and skipped rather than handed out, so the pool cannot turn a dead process into a
+        failed probe. That is the property the pool is meant to have: every way it can be
+        unhelpful degrades to the cold path, and none of them degrade to an error.
+        """
+
+        with self._lock:
+            remaining: list[_PreparedWorker] = []
+            taken: _PreparedWorker | None = None
+            for prepared in self._ready:
+                if taken is not None or prepared.launch.confinement != launch.confinement:
+                    remaining.append(prepared)
+                    continue
+                if _worker_is_running(prepared.process):
+                    taken = prepared
+                    continue
+                _discard_prepared_worker(prepared, already_exited=True)
+            self._ready = remaining
+            return taken
+
+    def _prune(self, launch: _WorkerLaunch | None) -> None:
+        """Drop every child that is not live, or not launched from exactly ``launch``.
+
+        A refill has to count live children rather than remembered ones. Without this the
+        pool would report a child an operator killed hours ago as ready, and topping up to
+        ``size`` would keep the corpse and add nothing. ``launch`` of ``None`` prunes on
+        liveness alone, which is what a caller asking only for a count wants.
+
+        Callers hold ``_lock``.
+        """
+
+        keep: list[_PreparedWorker] = []
+        for prepared in self._ready:
+            if launch is not None and prepared.launch.confinement != launch.confinement:
+                _discard_prepared_worker(prepared)
+            elif _worker_is_running(prepared.process):
+                keep.append(prepared)
+            else:
+                _discard_prepared_worker(prepared, already_exited=True)
+        self._ready = keep
+
+    def ready_count(self) -> int:
+        """How many children are idle *and* still alive.
+
+        The liveness scan is the whole point: a count that includes children the host killed
+        while they were idle is the misreport this method exists to avoid, and a caller sizing
+        a refill from it would under-provision by exactly the number of corpses.
+        """
+
+        with self._lock:
+            self._prune(None)
+            return len(self._ready)
+
+    def close(self) -> None:
+        with self._lock:
+            ready, self._ready = self._ready, []
+        for prepared in ready:
+            _discard_prepared_worker(prepared)
+
+
+def _apply_resource_limits(nproc_limit: int) -> None:
+    resource.setrlimit(resource.RLIMIT_CPU, (30, 30))
+    resource.setrlimit(resource.RLIMIT_NOFILE, (64, 64))
+    resource.setrlimit(resource.RLIMIT_FSIZE, (64 * 1024 * 1024, 64 * 1024 * 1024))
+    if hasattr(resource, "RLIMIT_NPROC"):
+        resource.setrlimit(resource.RLIMIT_NPROC, (nproc_limit, nproc_limit))
+
+
+def _nproc_limit() -> int:
+    """Pick the RLIMIT_NPROC cap in the coordinator before forking the worker.
+
+    macOS charges RLIMIT_NPROC only on fork, so an absolute cap of 32 blocks the
+    worker from spawning processes without limiting its threads. Linux charges
+    every task (process or thread) of the real UID system-wide against the cap,
+    so the same absolute 32 makes the worker's first pthread_create fail on any
+    host whose UID already runs that many tasks (CI runners do) and its BLAS
+    runtime aborts. Linux therefore gets the UID's current tasks plus bounded
+    headroom for the worker and its BLAS/Arrow thread pools: runaway task
+    creation still fails closed, at the same order of magnitude as before.
+    """
+
+    if sys.platform != "linux":
+        return 32
+    limit = _linux_uid_task_count() + 32 + 4 * (os.cpu_count() or 1)
+    _soft, hard = resource.getrlimit(resource.RLIMIT_NPROC)
+    if hard != resource.RLIM_INFINITY:
+        limit = min(limit, hard)
+    return limit
+
+
+def _linux_uid_task_count() -> int:
+    """Count the real UID's current tasks via /proc.
+
+    Entries hidden by hidepid, owned by another UID, or gone mid-scan are
+    skipped; undercounting only lowers the limit, which fails closed.
+    """
+
+    uid = os.getuid()
+    tasks = 0
+    try:
+        with os.scandir("/proc") as entries:
+            for entry in entries:
+                if not entry.name.isdigit():
+                    continue
+                try:
+                    if entry.stat(follow_symlinks=False).st_uid != uid:
+                        continue
+                    tasks += len(os.listdir(os.path.join(entry.path, "task")))
+                except OSError:
+                    continue
+    except OSError:
+        return 0
+    return tasks
+
+
+def _worker_error(code: str, detail: str) -> int:
+    value = {"status": "error", "code": code, "detail": detail[:MAX_CARRIED_DETAIL]}
+    sys.stderr.buffer.write(_ipc_json_bytes(value))
+    sys.stderr.buffer.flush()
+    return 1
+
+
+def _bounded_worker_error(raw: bytes, *, returncode: int) -> _WorkerRefusal:
+    """Recover the worker's refusal from a stderr stream it does not own alone.
+
+    The worker writes exactly one single-line JSON object, but the interpreter may have
+    written to the same stream first: running ``-m`` on a module the package's ``__init__``
+    has already imported emits a runpy ``RuntimeWarning``, and that one line was enough to
+    make every fail-closed refusal arrive at the coordinator as "redacted", losing the code a
+    person needs.  The whole buffer is tried first and the last non-empty line second; a
+    stream that yields neither is still redacted rather than guessed at.
+
+    **The sentence crosses too, and only for a Reader refusal.**  A code alone was not enough:
+    the weather family composes the pair of templates it refused, the constant to edit and the
+    three-step fix entirely inside ``ReaderError.detail``, and none of those facts is
+    recoverable from a static code-to-fix map, because the code is only ``READER_GRID_UNKNOWN``.
+    Two documents promised the operator that sentence, so it is carried -- under the narrowest
+    rule that delivers it:
+
+    * only when the code is in ``READER_ERROR_CODES``, the closed table a Reader may raise from.
+      Every other code -- ``SANDBOX_*`` and anything a caller invented -- carries nothing, so
+      no failure inside the confinement can describe the confinement;
+    * only after ``_readable_detail`` accepts it, which bounds the length and admits printable
+      single-line text and nothing else.
+
+    A Reader is handed bytes and never a path -- the container module asserts structurally that
+    no filesystem-taking name appears in it -- so a Reader refusal has no staging path, no
+    temporary directory and no environment to name.  That is why this is the code set where
+    carrying the sentence is safe, and it is asserted rather than assumed in
+    ``tests/h3/test_sandbox.py``.
+
+    When no candidate yields a code at all the refusal is still redacted, but it carries the
+    fixed-shape ``_worker_exit_diagnostic``: trusted kernel exit status plus a one-way digest
+    of the first stderr line.  A worker killed by a signal, or one whose stderr never became
+    JSON, is then distinguishable in logs without anything the worker wrote reaching a person
+    verbatim.
+    """
+
+    lines = [line for line in raw.splitlines() if line.strip()]
+    for candidate in (raw, lines[-1] if lines else b""):
+        try:
+            value = _strict_json_object(candidate, "sandbox.error")
+            code = _bounded_text(value.get("code"), maximum=128)
+        except AcquisitionSecurityError:
+            continue
+        detail = _readable_detail(value.get("detail")) if code in READER_ERROR_CODES else None
+        return _WorkerRefusal(code, code if detail is None else f"{code}: {detail}")
+    return _WorkerRefusal(
+        None,
+        f"worker returned a redacted failure ({_worker_exit_diagnostic(raw, returncode)})",
+    )
+
+
+def _worker_exit_diagnostic(raw: bytes, returncode: int) -> str:
+    """Fixed-shape diagnostic from the kernel exit status and a stderr digest.
+
+    Only trusted kernel metadata and a one-way SHA-256 prefix of the first
+    stderr line appear; nothing the untrusted worker wrote reaches the error
+    verbatim, so signal kills and known failure signatures are distinguishable
+    in logs without weakening redaction.
+    """
+
+    if returncode < 0:
+        try:
+            status = f"signal={signal.Signals(-returncode).name}"
+        except ValueError:
+            status = f"signal={-returncode}"
+    else:
+        status = f"exit={returncode}"
+    if not raw:
+        return f"{status}, stderr=empty"
+    first_line = raw.split(b"\n", 1)[0].rstrip(b"\r")
+    return f"{status}, stderr={len(raw)}B, first-line-sha256={sha256_bytes(first_line)[:16]}"
+
+
+# How much of a Reader's own sentence crosses the boundary.  The worker truncates at the same
+# number when it writes one, so the two are the same bound stated once on each side rather than
+# two bounds that can drift.  The longest refusal any shipped family composes -- the weather
+# family's grid-template halt, which carries the pair, the constant and the three-step edit --
+# is comfortably inside it.
+MAX_CARRIED_DETAIL = 1_000
+
+
+def _readable_detail(value: Any) -> str | None:
+    """The worker's sentence if it is plain readable text, and ``None`` otherwise.
+
+    Deliberately strict and deliberately silent: a detail this refuses is dropped rather than
+    escalated, because the code has already been recovered and losing the sentence is strictly
+    better than failing the refusal itself.  Printable single-line text only -- no control
+    characters, so nothing can rewrite a terminal or forge a second log line, and no surrogate,
+    so the string survives every encoder it will pass through on the way to a person.
+    """
+
+    if not isinstance(value, str) or not value.strip() or len(value) > MAX_CARRIED_DETAIL:
+        return None
+    if any(unicodedata.category(char) in {"Cc", "Cf", "Cs", "Co", "Cn"} for char in value):
+        return None
+    return value.strip()
+
+
+def _ipc_json_bytes(value: Any) -> bytes:
+    try:
+        return json.dumps(
+            value,
+            ensure_ascii=False,
+            allow_nan=False,
+            sort_keys=True,
+            separators=(",", ":"),
+        ).encode("utf-8", errors="strict")
+    except (TypeError, ValueError, UnicodeEncodeError):
+        raise AcquisitionSecurityError(
+            "SANDBOX_JSON",
+            "sandbox message is not strict JSON",
+        ) from None
+
+
+def _bounded_identifier(value: Any) -> str:
+    text = _bounded_text(value, maximum=128)
+    if not text[0].islower() or not all(
+        char.islower() or char.isdigit() or char in "._-" for char in text
+    ):
+        raise AcquisitionSecurityError(
+            "SANDBOX_IDENTIFIER",
+            "request ID must be a lowercase bounded identifier",
+        )
+    return text
+
+
+def _bounded_text(value: Any, *, maximum: int) -> str:
+    if not isinstance(value, str) or not value or len(value) > maximum:
+        raise AcquisitionSecurityError("SANDBOX_TEXT", "sandbox text field is invalid")
+    if any(0xD800 <= ord(char) <= 0xDFFF for char in value):
+        raise AcquisitionSecurityError("SANDBOX_TEXT", "sandbox text contains invalid Unicode")
+    return value
+
+
+def _optional_text(value: Any, maximum: int) -> str | None:
+    return None if value is None else _bounded_text(value, maximum=maximum)
+
+
+def _string_tuple(value: Any, *, maximum_items: int, item_maximum: int) -> tuple[str, ...]:
+    if not isinstance(value, list) or len(value) > maximum_items:
+        raise AcquisitionSecurityError("SANDBOX_ARRAY", "sandbox string array is invalid")
+    result = tuple(_bounded_text(item, maximum=item_maximum) for item in value)
+    if len(set(result)) != len(result):
+        raise AcquisitionSecurityError("SANDBOX_ARRAY", "sandbox string array has duplicates")
+    return result
+
+
+def _digest(value: Any) -> str:
+    text = _bounded_text(value, maximum=64)
+    if len(text) != 64 or any(char not in "0123456789abcdef" for char in text):
+        raise AcquisitionSecurityError("SANDBOX_DIGEST", "sandbox digest is invalid")
+    return text
+
+
+def _require_digest(value: Any, label: str) -> str:
+    try:
+        return _digest(value)
+    except AcquisitionSecurityError as exc:
+        raise AcquisitionSecurityError(
+            "SANDBOX_OS_BOUNDARY",
+            f"{label} attestation must be a lowercase SHA-256 digest",
+        ) from exc
+
+
+def _optional_digest(value: Any) -> str | None:
+    return None if value is None else _digest(value)
+
+
+if __name__ == "__main__":
+    # Two argv shapes and no parser: the set is closed, and anything outside it exits before a
+    # byte of stdin is read. ``--prewarm`` selects when the imports happen, never what the
+    # child is allowed to do.
+    if tuple(sys.argv[1:]) == WORKER_ARGV:
+        raise SystemExit(worker_main())
+    if tuple(sys.argv[1:]) == WORKER_PREWARM_ARGV:
+        raise SystemExit(worker_main(prewarm=True))
+    raise SystemExit(2)