ren worker folder adding orig, mv new one into root

2026-09-25 10:34:29 -04:00
parent 10f0668e32
commit 5b010039d7
1308 changed files with 44597 additions and 1511 deletions
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile
@@ -32,7 +32,7 @@ RUN set -eux; \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -162,6 +162,10 @@ RUN git init && \
 RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn mongod claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.avds-cleaner
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.avds-cleaner
@@ -86,6 +86,10 @@ RUN git init && \
 RUN pip install --no-cache-dir -r requirements.txt \
    || echo "WARNING: dependency install failed (non-fatal) — source + toolchain still present" >&2

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.avspeech
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.avspeech
@@ -84,6 +84,10 @@ RUN git init && \

 # No dependency manifest — scripts run against the base interpreter.

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.browser-extensions
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.browser-extensions
@@ -17,7 +17,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -97,6 +97,10 @@ RUN git init && \
 # Install JS deps via npm (no yarn.lock committed).
 RUN cd chrome/recorder && npm install --no-audit --no-fund

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node npm claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.elasticmq-container
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.elasticmq-container
@@ -84,6 +84,10 @@ RUN git init && \

 # No dependency manifest — scripts run against the base interpreter.

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.gcp-application
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.gcp-application
@@ -17,7 +17,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -97,6 +97,10 @@ RUN git init && \
 # Install JS deps via npm (no yarn.lock committed).
 RUN npm install --no-audit --no-fund

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node npm claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.gcp-cloud-infrastructure
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.gcp-cloud-infrastructure
@@ -84,6 +84,10 @@ RUN git init && \

 # No dependency manifest — scripts run against the base interpreter.

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.gcp-infrastructure
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.gcp-infrastructure
@@ -21,7 +21,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -112,6 +112,10 @@ RUN git init && \
 # Fetch the pinned providers (no backend init — nothing remote to reach).
 RUN terraform init -backend=false -input=false

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in terraform claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.lambda-cloudwatch-logs-to-loggly
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.lambda-cloudwatch-logs-to-loggly
@@ -20,7 +20,7 @@ RUN printf 'deb http://archive.debian.org/debian bullseye main\ndeb http://archi
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -101,6 +101,10 @@ RUN git init && \
 RUN npm install --no-audit --no-fund \
    || echo "WARNING: dependency install failed (non-fatal) — source + toolchain still present" >&2

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node npm claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.lambda-datadog-forwarder
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.lambda-datadog-forwarder
@@ -85,6 +85,10 @@ RUN git init && \
 # Install this package (setup.py/pyproject) and its deps.
 RUN pip install --no-cache-dir .

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.lambda-potion-engagement
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.lambda-potion-engagement
@@ -20,7 +20,7 @@ RUN printf 'deb http://archive.debian.org/debian bullseye main\ndeb http://archi
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -101,6 +101,10 @@ RUN git init && \
 RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.lambda-potion-schedular
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.lambda-potion-schedular
@@ -20,7 +20,7 @@ RUN printf 'deb http://archive.debian.org/debian bullseye main\ndeb http://archi
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -101,6 +101,10 @@ RUN git init && \
 RUN npm install --no-audit --no-fund \
    || echo "WARNING: dependency install failed (non-fatal) — source + toolchain still present" >&2

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node npm claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.lambda-potion-transcription-scheduler
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.lambda-potion-transcription-scheduler
@@ -20,7 +20,7 @@ RUN printf 'deb http://archive.debian.org/debian bullseye main\ndeb http://archi
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -101,6 +101,10 @@ RUN git init && \
 RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.lambda-text-to-speech
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.lambda-text-to-speech
@@ -17,7 +17,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -98,6 +98,10 @@ RUN git init && \
 RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.lambda-video-processing
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.lambda-video-processing
@@ -17,7 +17,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -99,6 +99,10 @@ RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000 \
    || echo "WARNING: dependency install failed (non-fatal) — source + toolchain still present" >&2

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.microservice-dynamic-screen-recording
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.microservice-dynamic-screen-recording
@@ -19,7 +19,7 @@ ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -100,6 +100,10 @@ RUN git init && \
 RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.microservice-potion-voice
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.microservice-potion-voice
@@ -20,7 +20,7 @@ RUN printf 'deb http://archive.debian.org/debian bullseye main\ndeb http://archi
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -101,6 +101,10 @@ RUN git init && \
 RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.modnet-with-training
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.modnet-with-training
@@ -84,6 +84,10 @@ RUN git init && \

 # No dependency manifest — scripts run against the base interpreter.

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-ai
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-ai
@@ -86,6 +86,10 @@ RUN git init && \
 RUN pip install --no-cache-dir -r requirements.txt \
    || echo "WARNING: dependency install failed (non-fatal) — source + toolchain still present" >&2

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-ai-cpu
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-ai-cpu
@@ -86,6 +86,10 @@ RUN git init && \
 RUN pip install --no-cache-dir -r requirements.txt \
    || echo "WARNING: dependency install failed (non-fatal) — source + toolchain still present" >&2

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-ai-gpu
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-ai-gpu
@@ -86,6 +86,10 @@ RUN git init && \
 RUN pip install --no-cache-dir -r requirements.txt \
    || echo "WARNING: dependency install failed (non-fatal) — source + toolchain still present" >&2

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-ai-pretrained-models-infra
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-ai-pretrained-models-infra
@@ -21,7 +21,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -112,6 +112,10 @@ RUN git init && \
 # Fetch the pinned providers (no backend init — nothing remote to reach).
 RUN terraform init -backend=false -input=false

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in terraform claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-analytics
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-analytics
@@ -17,7 +17,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -98,6 +98,10 @@ RUN git init && \
 RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-api
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-api
@@ -17,7 +17,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -98,6 +98,10 @@ RUN git init && \
 RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-app
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-app
@@ -32,7 +32,7 @@ RUN set -eux; \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -162,6 +162,10 @@ RUN git init && \
 RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn mongod claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-app-infra
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-app-infra
@@ -21,7 +21,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -112,6 +112,10 @@ RUN git init && \
 # Fetch the pinned providers (no backend init — nothing remote to reach).
 RUN terraform init -backend=false -input=false

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in terraform claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-bastion
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-bastion
@@ -21,7 +21,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -112,6 +112,10 @@ RUN git init && \
 # Fetch the pinned providers (no backend init — nothing remote to reach).
 RUN terraform init -backend=false -input=false

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in terraform claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-custom-domain-app
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-custom-domain-app
@@ -21,7 +21,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -161,6 +161,10 @@ RUN git init && \
 # Fetch the pinned providers (no backend init — nothing remote to reach).
 RUN terraform init -backend=false -input=false

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in terraform claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-devops
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-devops
@@ -84,6 +84,10 @@ RUN git init && \

 # No dependency manifest — scripts run against the base interpreter.

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-dynamic-screen-recording-lambda
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-dynamic-screen-recording-lambda
@@ -20,7 +20,7 @@ RUN printf 'deb http://archive.debian.org/debian bullseye main\ndeb http://archi
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -101,6 +101,10 @@ RUN git init && \
 RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-job-consumer
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-job-consumer
@@ -17,7 +17,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -98,6 +98,10 @@ RUN git init && \
 RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-job-producer
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-job-producer
@@ -17,7 +17,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -98,6 +98,10 @@ RUN git init && \
 RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-multi-dsr-watcher
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-multi-dsr-watcher
@@ -17,7 +17,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -98,6 +98,10 @@ RUN git init && \
 RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-qa
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-qa
@@ -17,7 +17,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -97,6 +97,10 @@ RUN git init && \
 # Install JS deps via npm (no yarn.lock committed).
 RUN npm install --no-audit --no-fund

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node npm claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-snapshot-testing
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-snapshot-testing
@@ -17,7 +17,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -97,6 +97,10 @@ RUN git init && \
 # Install JS deps via npm (no yarn.lock committed).
 RUN npm install --no-audit --no-fund

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node npm claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-stitch
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-stitch
@@ -86,6 +86,10 @@ RUN git init && \
 RUN pip install --no-cache-dir -r requirements.txt \
    || echo "WARNING: dependency install failed (non-fatal) — source + toolchain still present" >&2

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-tryon
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-tryon
@@ -86,6 +86,10 @@ RUN git init && \
 RUN pip install --no-cache-dir -r requirements.txt \
    || echo "WARNING: dependency install failed (non-fatal) — source + toolchain still present" >&2

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-video-background-change
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-video-background-change
@@ -84,6 +84,10 @@ RUN git init && \

 # No dependency manifest — scripts run against the base interpreter.

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-video-processing
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-video-processing
@@ -20,7 +20,7 @@ RUN printf 'deb http://archive.debian.org/debian bullseye main\ndeb http://archi
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -101,6 +101,10 @@ RUN git init && \
 RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-video-processing-devops
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-video-processing-devops
@@ -21,7 +21,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -112,6 +112,10 @@ RUN git init && \
 # Fetch the pinned providers (no backend init — nothing remote to reach).
 RUN terraform init -backend=false -input=false

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in terraform claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-voice
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-voice
@@ -20,7 +20,7 @@ RUN printf 'deb http://archive.debian.org/debian bullseye main\ndeb http://archi
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -100,6 +100,10 @@ RUN git init && \
 # Install JS deps via npm (no yarn.lock committed).
 RUN npm install --no-audit --no-fund

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node npm claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-voice-dataset
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-voice-dataset
@@ -85,6 +85,10 @@ RUN git init && \
 # Install Python deps from requirements.txt.
 RUN pip install --no-cache-dir -r requirements.txt

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-voice-utils
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-voice-utils
@@ -84,6 +84,10 @@ RUN git init && \

 # No dependency manifest — scripts run against the base interpreter.

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-watcher
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-watcher
@@ -17,7 +17,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -99,6 +99,10 @@ RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000 \
    || echo "WARNING: dependency install failed (non-fatal) — source + toolchain still present" >&2

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-web
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-web
@@ -17,7 +17,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -147,6 +147,10 @@ RUN git init && \
 RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-website
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-website
@@ -17,7 +17,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -146,6 +146,10 @@ RUN git init && \
 # Install JS deps via npm (no yarn.lock committed).
 RUN npm install --no-audit --no-fund

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node npm claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-website-recording-handler
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.potion-website-recording-handler
@@ -17,7 +17,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # a managed interpreter — no compile, no apt, works even on archived buster) and make it the
 # default `python3`. Without this the agent's file editor can't load and every trial dies at
 # agent setup (NonZeroAgentExitCodeError). Independent of the repo's own runtime.
-RUN curl -fsSL https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+RUN curl -fsSL https://astral.sh/uv/0.12.10/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
    && uv python install 3.10 \
    && ln -sf "$(uv python find 3.10)" /usr/local/bin/python3 \
    && python3 --version
@@ -98,6 +98,10 @@ RUN git init && \
 RUN yarn install --frozen-lockfile --network-timeout 600000 \
    || yarn install --network-timeout 600000

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in node yarn claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.sentence-split-service
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.sentence-split-service
@@ -85,6 +85,10 @@ RUN git init && \
 # Install Python deps from requirements.txt.
 RUN pip install --no-cache-dir -r requirements.txt

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.urlbox-experiments
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.urlbox-experiments
@@ -84,6 +84,10 @@ RUN git init && \

 # No dependency manifest — scripts run against the base interpreter.

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.video-synth-api
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.video-synth-api
@@ -84,6 +84,10 @@ RUN git init && \

 # No dependency manifest — scripts run against the base interpreter.

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.wav2lip-fa
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.wav2lip-fa
@@ -86,6 +86,10 @@ RUN git init && \
 RUN pip install --no-cache-dir -r requirements.txt \
    || echo "WARNING: dependency install failed (non-fatal) — source + toolchain still present" >&2

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/Dockerfile.yeahsure-tryon
+++ b/worker-toolkit-potion-polyglot/task-shared/Dockerfile.yeahsure-tryon
@@ -86,6 +86,10 @@ RUN git init && \
 RUN pip install --no-cache-dir -r requirements.txt \
    || echo "WARNING: dependency install failed (non-fatal) — source + toolchain still present" >&2

+# Fold the env-prep above into the baseline commit: tests/test.sh captures the agent's
+# work as the diff against it, so uncommitted setup edits ship as the agent's own.
+RUN git add -A && git commit --amend --no-edit --quiet
+
 # Fail loudly if any load-bearing tool is missing.
 RUN for t in python3 claude; do \
      command -v "$t" >/dev/null 2>&1 || { echo "FATAL: required tool '$t' missing from image" >&2; exit 1; }; \
--- a/worker-toolkit-potion-polyglot/task-shared/test-commands.toml
+++ b/worker-toolkit-potion-polyglot/task-shared/test-commands.toml
@@ -53,10 +53,10 @@ cmd = "DATABASE_URL=postgresql://postgres:secret_password@localhost:5432/r_test

 [[ZenBill-006.checks]]
 name = "jest"
-# The heaviest check we have (134 jsdom suites, ~3.8 GB however it is run) and the
-# one with the least margin at 4 GiB. --runInBand is deliberate: --maxWorkers is the
-# right lever elsewhere, but here it makes jest hang once the last suite passes.
-cmd = "TZ=UTC npx jest --runInBand"
+# Heaviest check we have (134 jsdom suites). The heap cap is load-bearing: Node is not
+# cgroup-aware, so uncapped V8 grows to 4.8 GB RSS and the kernel kills the run mid-suite.
+# --runInBand is deliberate too: --maxWorkers makes jest hang here once the last suite passes.
+cmd = "TZ=UTC NODE_OPTIONS=--max-old-space-size=1536 npx jest --runInBand"

 # confidence: validated
 [zeta-platform]
@@ -82,11 +82,15 @@ setup = "until pg_isready -h localhost -p 5432 -U postgres >/dev/null 2>&1; do s

 [[human-essentials.checks]]
 name = "rspec"
-cmd = "RAILS_ENV=test PG_HOST=localhost PG_USERNAME=postgres bundle exec rspec --exclude-pattern 'spec/system/**/*'"
+cmd = "RAILS_ENV=test PG_HOST=localhost PG_USERNAME=postgres bundle exec rspec --exclude-pattern 'spec/system/**/*,spec/requests/partners/family_requests_requests_spec.rb'"

 # confidence: validated
 [endsideout]
 notes = "Rails 8.1 / Ruby 4.0.0, Minitest + SQLite (no DB service — file-backed)"
+# A response that bumps the gemset leaves the lockfile needing an install, which errored the
+# whole check and cost one run a -0.05 the agent had not earned. bundle check keeps this a
+# no-op when the lockfile is untouched.
+setup = "bundle check >/dev/null 2>&1 || BUNDLE_FROZEN=false bundle install --jobs 4 --retry 3"

 [[endsideout.checks]]
 name = "minitest"
@@ -107,10 +111,12 @@ setup = "until pg_isready -h localhost -p 5432 -U postgres >/dev/null 2>&1; do s

 [[stocks-in-the-future.checks]]
 name = "minitest"
-cmd = "bin/rails test"
+# Serial is load-bearing, not a speed choice: parallel workers each restart the global
+# FactoryBot sequence(:level), which collides with the hardcoded levels below.
+cmd = "PARALLEL_WORKERS=1 bin/rails test"
 baseline_known_failures = [
  "Admin::TeachersControllerTest#test_new_shows_classrooms_when_available (test/controllers/admin/teachers_controller_test.rb:143) — pre-existing, time-dependent failure: test hardcodes Year '2025 - 2026' but Admin::TeachersController#new scopes classrooms to the current school year by today's date, so the expected classroom isn't shown. Latent app-side time-bomb, not an env defect; documented in overview.md.",
-  "ClassroomsControllerTest — any test in this class can fail or error with ActiveRecord::RecordInvalid 'Validation failed: Level has already been taken'. Pre-existing app-side flake that surfaces ONLY under parallel workers: a FactoryBot global sequence(:level) collides with a hardcoded create(:grade, level: 7). Which method it lands on varies with the run seed and worker interleaving (test_create observed 2026-07-14, test_update observed 2026-09-01), so match on the class + message, not the method name. Passes serially (PARALLEL_WORKERS=1). Not an env defect.",
+  "Any test that errors with ActiveRecord::RecordInvalid 'Validation failed: Level has already been taken'. Pre-existing app-side flake, not an env defect: the global FactoryBot sequence(:level) (test/factories/grades.rb:5, consumed by every classroom via test/factories/classrooms.rb) collides with hardcoded levels 5/6/7/9/10 at classrooms_controller_test.rb:30,96, admin/classrooms_controller_test.rb:27,28,51, models/grade_test.rb:62,70 and system/user_manages_classrooms_test.rb:11,32. With workers pinned to 1 there is one seed-dependent window per run instead of one per worker, so it is rare but not impossible. Match on the message, not on a class or method name.",
 ]

 # confidence: validated
@@ -141,11 +147,20 @@ baseline_known_failures = [
 # confidence: validated
 [flaredown]
 notes = "Rails 7.1 API (Ruby 3.2.3), Mongoid 8.1 on MongoDB 7.0 + Postgres + Redis + Sidekiq. The app lives in backend/ (not the repo root), so the check cd's into it. The harbor Dockerfile's start-services.sh starts all three datastores, creates flaredown_development/flaredown_test, and loads the Postgres schema for both envs; backend/.env is materialized from env-example with PG host rewritten to localhost. Mongoid creates collections lazily (no schema to load). Browser/acceptance specs are excluded — Ember `ember test` needs a browser on PATH (phantomjs up to pin 5f859e8d, headless Chrome via CHROME_BIN from b0605ff3, which the Explore image now provides though the verifier image does not) and is bad grader signal anyway; the rspec verifier touches neither the client nor a running server. [Runtime-validated 2026-08-04 in the harbor image built from Dockerfile.flaredown @ pin b0605ff3]: 315 examples, 0 failures (~7s, 96.08% coverage) — clean, so no baseline is declared. Unchanged from the earlier validation at pin 5f859e8d (2026-07-20, same 315/0/96%); the only backend change across that pin advance is backend/lib/tasks/app.rake."
-setup = "until pg_isready -h localhost -p 5432 -U postgres >/dev/null 2>&1; do sleep 0.5; done; cd backend && RAILS_ENV=test bundle exec rails db:schema:load"
+# start-services.sh creates flaredown_test after its own pg_isready wait, so the verifier can
+# win the race and find no database; db:schema:load cannot create one, db:test:prepare can.
+setup = "until pg_isready -h localhost -p 5432 -U postgres >/dev/null 2>&1; do sleep 0.5; done; cd backend && RAILS_ENV=test bundle exec rails db:test:prepare"

 [[flaredown.checks]]
 name = "rspec"
-cmd = "cd backend && RAILS_ENV=test bundle exec rspec --exclude-pattern 'spec/system/**/*'"
+# Two pre-existing flakes are skipped rather than declared, so a red is always the response's:
+#   spec/models/food_spec.rb — same_food_1/same_food_2 are both "TestFood #{FFaker::Lorem.word}",
+#     so a stopword draw gives identical tsvectors and Food.fts has no tiebreaker (4 of 47 runs).
+#   spec/services/collection_retriever_spec.rb — object_ids.sample(5) x5 over 20 ids can draw
+#     uniform counts while the assertion is a strict min < max.
+# Cost, measured at pin b0605ff3: 9 sound examples of 315, and CollectionRetriever (behind
+# api/v1/tags#index and api/v1/foods#index) loses its only spec coverage.
+cmd = "cd backend && RAILS_ENV=test bundle exec rspec --exclude-pattern 'spec/system/**/*,spec/models/food_spec.rb,spec/services/collection_retriever_spec.rb'"

 # confidence: none
 [alongwithyou]
--- a/worker-toolkit-potion-polyglot/task-shared/test.sh
+++ b/worker-toolkit-potion-polyglot/task-shared/test.sh
@@ -54,7 +54,7 @@ RENDER_GRADE="$TESTS_DIR/render-grade-consolidated.py"
 # Grader model + number of samples (graded GRADER_SAMPLES times and averaged to
 # reduce noise). Override with GRADER_MODEL=... / GRADER_SAMPLES=...
 GRADER_MODEL="${GRADER_MODEL:-claude-fable-5-1}"
-GRADER_SAMPLES="${GRADER_SAMPLES:-3}"
+GRADER_SAMPLES="${GRADER_SAMPLES:-1}"

 # The grader model's Claude Code floor. A task image installs Claude Code when it is first built
 # and Docker reuses that layer on every rebuild, so an image can carry a CLI the API refuses for
@@ -332,6 +332,23 @@ if [ -f "$TESTS_DIR/test-commands.sh" ] && [ "$AGENT_CHANGED" = 1 ]; then
            echo "signal setup ok" >&2
        else
            echo "signal setup FAILED (rc=${rc}, non-fatal) — see /logs/verifier/signals/_setup.log" >&2
+            # Surface it where the grader reads. Guidance routinely says "if the codegen
+            # step failed, treat the downstream failures as environmental" — a judgement
+            # the grader could not make, because this outcome reached only stderr.
+            {
+                echo "===== SETUP STEP FAILED ====="
+                echo "command: \`$1\`"
+                echo "exit: ${rc} (non-fatal; the checks below still ran)"
+                echo "This is a build/codegen step, not a scored check. Failures in the checks"
+                echo "below that follow from it are not the response's doing — but say which,"
+                echo "and do not discount a failure this cannot explain."
+                echo "full output file (readable with your tools): /logs/verifier/signals/_setup.log"
+                echo '```'
+                tail -c 4000 /logs/verifier/signals/_setup.log 2>/dev/null
+                echo '```'
+                echo "===== END SETUP STEP ====="
+                echo
+            } >> "$_SIG"
        fi
    }
    # shellcheck source=/dev/null
@@ -646,7 +663,7 @@ echo "Launching Claude Code grader (requested model: $GRADER_MODEL, samples: $GR
 # the canonical grade.md etc. are copied from the sample closest to the mean. A
 # sample with no valid reward in [0,1] is skipped; need min(2, GRADER_SAMPLES) valid.
 GRADER_MODEL="${GRADER_MODEL:-claude-fable-5-1}"
-GRADER_SAMPLES="${GRADER_SAMPLES:-3}"
+GRADER_SAMPLES="${GRADER_SAMPLES:-1}"
 mkdir -p /tmp/outputs /logs/verifier
 [ -e /tmp/files ] || ln -sfn /workspace /tmp/files