diff --git a/.agents/skills/pr-agent-bench/SKILL.md b/.agents/skills/pr-agent-bench/SKILL.md
new file mode 100644
index 000000000..14f5c672e
--- /dev/null
+++ b/.agents/skills/pr-agent-bench/SKILL.md
@@ -0,0 +1,187 @@
+---
+name: pr-agent-bench
+description: >-
+  How to read and interpret an aws-blocks PR agent-bench run — what the bench report's columns,
+  colored balls (🟢 ⚪ 🟡 🔴), Judge dimensions (F/S/P/C/B), composite/Score, and stop_reason values
+  mean, plus a 60-second regression-triage runbook (top-line verdict → red cells → stop_reason triage
+  → failure class → trace). Use when reading or interpreting aws-blocks PR agent-bench results,
+  bench report columns/colors, deciding whether a PR regressed, or triaging a red/amber bench cell.
+---
+
+# Reading a PR agent-bench run
+
+## North star — the one question
+
+The bench exists to answer **one question per PR**: *did this change keep things steady-or-better, or
+did it regress?* Every column, color, and number below is in service of answering that in seconds. A
+healthy PR should be **dismissable in under 10 seconds** from the top-line alone; a genuine regression
+should hand you a **failure class and a trace path** without a second tool.
+
+> ⚠️ **Reading model vs. what's live today.** This runbook describes the *target* reading model the
+> bench is being built toward. A few mechanics in it — the per-cell **noise band** recolor, the single
+> **PR-verdict banner**, folded deep-dive, and per-red trace links — are **planned (v2), not yet on this
+> branch**. Where a mechanic isn't live yet, the runbook tells you how to derive the same judgment from
+> what the current (v1) report *does* show. See **[Implementation status](#implementation-status-as-of-pr-194)**
+> for the exact live-vs-planned split. Never assume a v2 signal is present just because it's described here.
+
+## Color semantics
+
+Each cell's color is keyed off that cell's **noise band** — its historical run-to-run variance — not a
+fixed number. The band is what makes a signal trustworthy at N=1.
+
+| Ball | Meaning | Action |
+|---|---|---|
+| 🟢 green | Improved **beyond** the cell's band | Glance only — good news, no action |
+| ⚪ gray | **Steady within band**, OR new / no baseline | Nothing to see — expected noise or a first observation |
+| 🟡 amber | Moved the **wrong way but within band** | **Watch, don't act** — one sample of normal variance |
+| 🔴 red | Composite Δ **≤ −5 AND** beyond band | **ACT** — a material, real regression |
+
+The whole point of the band is to stop 🟡 normal-variance swings from masquerading as 🔴 regressions,
+while still catching a small-but-real drop on an otherwise rock-steady cell.
+
+> **Today (v1)** the table does *not* yet use per-cell bands. It colors each metric by its delta vs the
+> baseline using **fixed thresholds**: 🟢 beyond +threshold, 🔴 beyond −threshold, 🟡 within ±threshold
+> (either direction = noise), ⚪ no baseline (tagged `(new)`), 🗑️ a cell that existed in the baseline but
+> is gone now. Thresholds: composite ±5, Score ±5, Judge ±0.3 (also per-dimension), Tests ±1 pass,
+> Cost ±max($0.02, 10% of baseline), Turns ±3. Consequence: a big drop on a naturally-swingy cell colors
+> 🔴 under v1 even when the band would call it amber (see the worked example).
+
+## PR verdict (top-line)
+
+The run rolls up to one of three verdicts:
+
+- **REGRESSED** — PR composite Δ is beyond the **−band**, OR **any** scenario is 🔴.
+- **IMPROVED** — PR composite Δ is beyond the **+band** AND there are **zero** 🔴.
+- **STEADY** — anything else (the common, healthy case).
+
+**STEADY or IMPROVED with 0 red → ship on bench grounds.** You're done in one glance.
+
+> **Today (v1)** there is no single banner word. Derive the verdict yourself from the preword bullets:
+> the *"Mean composite X/100 — 🟢/🟡/🔴 Δ vs `main`"* line (its ball uses a ±5 composite band) plus the
+> count of 🔴 / 🟡 cells in the table. The per-cell `verdict` tally in the preword
+> (`pass · partial · fail · harness_error`) is a *different* field — see [reference](#reference-what-the-current-v1-report-contains).
+
+## How to read a run in 60 seconds
+
+**Step 0 — Top-line only.** Read the verdict + composite Δ + counts of 🔴 / 🟡. If **STEADY / IMPROVED
+and 0 red → stop here and ship** (on bench grounds). Most PRs end at Step 0.
+
+**Step 1 — If red, read each red's structured line.** For every 🔴 cell, pull its one line: composite Δ,
+worst Judge dimension, `stop_reason`, and trace path. Do not open anything yet.
+
+**Step 2 — Triage `stop_reason` FIRST (before believing the score).** The score is only meaningful if the
+run actually finished.
+
+| stop_reason class | Values | Verdict |
+|---|---|---|
+| Infra / harness noise | `dead_server` (`dev_server_dead`), harness errors (`preflight_failed`, `oidc_failed`, `init_abort`, `cancelled`, `wall_clock_timeout`), `max_tokens`, `agent_timeout` | **NOT a PR signal → RE-RUN the cell.** A 0 here means the harness/agent died, not that the PR broke anything. |
+| Real completion | `end_turn` **with a dropped composite** | **Real agent-quality regression → dig** (go to Step 3). The agent finished and the result genuinely got worse. |
+
+**Step 3 — Worst dimension → failure class → where to look.** The Judge's lowest dimension points you
+straight at the code:
+
+| Dimension ↓ (letter) | Failure class | Where to look |
+|---|---|---|
+| **functional_completeness** (F) | Task not done | The **feature code the PR touched** |
+| **selector_contract** (S) | Selectors broke | **DOM / UI contract drift** (renamed ids, moved elements) |
+| **persistence** (P) | State didn't survive | **State / storage / auth round-trip** broken |
+| **code_quality** (C) | Quality regressed | The generated code got worse |
+| **blocks_fidelity** (B) | Stopped using the framework idiomatically | **KEY signal for framework PRs** — the change nudged the agent away from Blocks idioms |
+
+**Step 4 — Open the trace, confirm root cause, decide.** Open the cell's trace at its
+[stable artifact path](#finding-the-trace-and-per-cell-artifacts), confirm the root cause, then **fix vs
+revert**.
+
+**Step 5 — Amber is a watch-list, not a blocker.** 🟡 cells are non-blocking on their own. But if the
+**same cell** goes amber across **consecutive PRs**, that's a **slow regression** creeping in under the
+band — investigate it proactively.
+
+## Materiality rule
+
+**🔴 requires BOTH conditions: composite Δ ≤ −5 AND beyond the cell's noise band.**
+
+- The band kills **variance false-alarms** (a swingy cell dropping within its normal range is amber, not red).
+- The **−5 floor** is a materiality gate: it catches a real, small regression on an otherwise steady cell,
+  and refuses to raise the alarm for a sub-threshold wobble. −5 composite points is the minimum drop worth
+  a human's attention.
+
+## Worked example — run `29464250153` (a real messy run)
+
+This run shows why Step 2 (`stop_reason` first) and the noise band exist:
+
+- **`cognito` scored 0** — but via a **harness / `max_tokens` stop**, not a real failure. Per Step 2 this
+  is **infra → re-run**. A later re-run of that cell scored **92**. A reader who trusted the 0 without
+  triaging the stop reason would have chased a phantom regression.
+- **`auth-notes` posted a −78.8 composite delta** — alarming at first glance, and **v1's fixed ±5
+  threshold colors it 🔴**. But that cell's **historical band is 11.6–94.4**: its composite naturally
+  swings across nearly the whole range, so −78.8 lands **within band → 🟡 amber / watch, NOT a red
+  ship-blocker.** This is the exact case the band is designed to reclassify.
+
+Takeaway: **`stop_reason`-triage + the noise band together prevent phantom-regression chases.** Without
+them, this run reads as two regressions; with them, it reads as "one infra re-run, one watch-list amber."
+
+## Finding the trace and per-cell artifacts
+
+Each scenario cell writes three GitHub Actions artifacts, named `<kind>-<task>-<template>`:
+
+| Artifact | Contents |
+|---|---|
+| `bench-result-<task>-<template>` | `result.json` — the cell's scored result |
+| `bench-source-<task>-<template>` | the app the agent actually produced |
+| `bench-trace-<task>-<template>` | **`trace.json`** — the full agent trace (what you open in Step 4) |
+
+Aggregate results also land in S3 at `s3://<bucket>/bench/runs/<SHA>/results.json` (with a
+`bench/runs/latest-main.json` pointer to the most recent **main** run — the baseline).
+
+> **Caveat:** a **`wall_clock_timeout`** cell writes **no `trace.json`** (the step was killed
+> ungracefully). If there's no trace, the stop reason *is* your answer: infra → re-run.
+>
+> **Today (v1)** the report links **one run-level Artifacts page** (in the collapsed glossary); you find
+> the per-cell trace by opening that run's Artifacts and grabbing `bench-trace-<task>-<template>`.
+> **Per-red deep links straight to a cell's trace are planned (v2), not yet live.**
+
+## Implementation status (as of PR #194)
+
+**LIVE now on this branch (v1 — the slimmed single table):**
+
+- **One results table**, columns in order: **`Task | Template | Tests | Judge | Cost | Turns | Score | Stop reason`** (no Composite column in the table).
+- **Fixed-threshold** per-metric delta coloring (🟢 / 🔴 beyond ±threshold, 🟡 within, ⚪ `(new)` no baseline, 🗑️ removed) — **not** per-cell noise bands.
+- Cell format `<ball> <value> (<Δ>)`; Tests = `<ball> passed/denom (±n)`; Judge = `<ball> <overall> (<Δ>) · F9(+2) S8 P7(-1) C8 B9`; **Stop reason is the raw string with no ball.**
+- Headline is the **preword bullets**, not a one-word banner: *Mean composite X/100 — 🟢/🟡/🔴 Δ vs `main`*, a `pass · partial · fail · harness_error` verdict tally, totals, biggest gains/drops, config (+ an optional `BENCH_MIN_SCORE` gate line).
+- Deep-dive analysis (`## Executive summary`, `## 🔴 Failure root-cause`, `## ⚠️ Potential issues`, `## Per-cell analysis`) is appended **inline / always-present collapsed `<details>`** — the failure section renders inline only when failing cells carry analysis.
+- Trace access = **one run-level Artifacts link** in the glossary.
+
+**PLANNED (v2 — described in this runbook, NOT yet implemented):**
+
+- **Band-based recolor** — coloring keyed off each cell's historical-variance **noise band** instead of fixed thresholds.
+- **First-class PR-level composite headline + single PR-verdict banner** (`REGRESSED / IMPROVED / STEADY`).
+- **Folded `<details>` deep-dive** that expands **only on red**.
+- **Per-red trace-path links** straight from a red cell to its `trace.json`.
+
+Until v2 lands, apply the runbook by deriving these from the v1 signals as noted in each section above.
+
+## Reference — what the current (v1) report contains
+
+- **Judge:** 5 dimensions, each 0–10, averaged equally → overall Judge score. F=functional_completeness,
+  S=selector_contract, P=persistence, C=code_quality, B=blocks_fidelity.
+- **Composite (0–100):** `60·pass_rate + 4·judge·min(1, 4·pass_rate)` — 60% objective test pass-rate + 40%
+  Judge, with the Judge term ramped in only above a 25% pass-rate (too little objective evidence below that).
+- **Score:** composite ÷ builder $-cost (higher is better). Builder is Opus 4.8; pricing $5 in / $25 out per 1M tokens.
+- **`compositeBand`** (absolute: ≥80 🟢 / ≥50 🟡 / else 🔴) is used **only** in the per-cell analysis
+  `<details>` headers, **not** in the table's coloring.
+- **Per-cell `verdict` enum:** `pass` (rate ≥ 0.999) · `partial` (rate > 0) · `fail` (rate 0) ·
+  `harness_error` · `unknown` (no tests ran). This is the tally in the preword — distinct from the
+  planned PR-level REGRESSED/IMPROVED/STEADY verdict.
+- **`stop_reason` values seen in the column:** `end_turn`, `max_tokens`, `tool_use`, `stop_sequence`
+  (normal SDK finishes); `error` (invoke exhausted / max-tokens error); `wall_clock_timeout` (killed on
+  deadline); `cancelled`; `in_progress` (a checkpoint survivor).
+- **Cell classes (for the mean):** `scored` · `harness_error` (**excluded** from the mean) · `agent_fail`
+  (composite 0, **included**) · `dead_server` (composite 0, **included**). Analysis constants:
+  `REGRESSION_DELTA = -5`, `LOW_THRESHOLD = 50`.
+- **Baseline:** `bench/runs/latest-main.json` — the most recent **main** bench run, not the PR's merge base.
+
+## Acceptance — "eminently usable"
+
+- A **healthy PR is dismissable in < 10 seconds** from the top-line alone (verdict + composite Δ + 0 red).
+- A **red gives you the failure class + trace path without needing a second tool** — everything to start
+  the fix-vs-revert decision is on the cell's one structured line.
diff --git a/.changeset/bench-report-redesign.md b/.changeset/bench-report-redesign.md
new file mode 100644
index 000000000..e80ca72a8
--- /dev/null
+++ b/.changeset/bench-report-redesign.md
@@ -0,0 +1,55 @@
+---
+---
+
+feat(bench): redesign agent-bench PR-vs-`main` report + fix baseline selection
+
+Internal CI tooling — no published-package changes.
+
+- The report is now a SINGLE results table built from the run's cells
+  (`TASK · TEMPLATE · TESTS · JUDGE · COST · TURNS · SCORE · STOP REASON`),
+  preceded by a collapsible glossary + the headline (mean composite + delta) and
+  followed by a short executive summary (paragraph + bullets), a **Potential
+  issues** section, and a collapsed per-cell analysis. Replaces the old
+  two-table layout (a colors-only Overview + a numbers Detailed table) and drops
+  the standalone `Δ vs base` column. The table was later slimmed for readability:
+  the `TOKENS`, `LOC`, and `Files` columns were removed (those counts are still
+  persisted to the S3 baseline for offline analysis, just no longer rendered).
+- Each metric cell is a single inline line (`<color> <value> (<Δ vs main>)`): the
+  current value with its signed delta vs the `main` baseline, colored by the
+  significance + direction of the change via the per-metric `DELTA_THRESHOLDS`
+  (composite/score ±5, judge ±0.3, tests ±1, cost ±10%, turns ±3;
+  tests/judge/score higher-better, cost/turns lower-better; within band → 🟡,
+  beyond → 🟢/🔴). The JUDGE cell is compacted onto that one line — the overall
+  score plus a per-dimension shorthand (`F`/`S`/`P`/`C`/`B`), each with its own
+  signed delta. When the baseline has no value
+  for a field, the cell still shows the current value tagged `⚪ (new)` — decided
+  per field, so a partial baseline no longer forces the whole row to be treated
+  as new.
+- New **SCORE = composite ÷ cost** (composite points per dollar) priced from
+  builder tokens at Bedrock Opus 4.8 rates (`PRICING`/`cellCost`/`scorePerDollar`
+  in `scoring.mjs`).
+- Baseline-selection fix: a PR now always diffs against `latest-main.json` (the
+  current `main` tip), never the PR's stale recorded `base.sha`; a push to `main`
+  diffs against the preceding main commit (`github.event.before`) by exact sha.
+
+Bench integrity + failure-analysis honesty (harness self-scoring fixes):
+
+- The builder now persists a `trace.json` on EVERY exit path (success,
+  invoke-exhausted error, and the wall-clock / internal-deadline flush) and
+  captures `toolResult` blocks (tool outputs + errors) via a `MessageAddedEvent`
+  hook. Previously a non-returning `invoke()` (e.g. a `MaxTokensError`) left no
+  trace — an unanalyzable silent 0 — and traces held only `toolUse` blocks, so
+  tool error text was unrecoverable.
+- A `MaxTokensError` cell is now classified `agent_fail` with its own
+  `klass_reason='max_tokens'` (still composite 0, still INCLUDED) instead of
+  being mislabeled `agent_timeout`; only genuine wall-clock timeouts keep
+  `agent_timeout`.
+- The deep failure-analysis pass now short-circuits deterministically for
+  `harness_error` / no-trace / `failed_at==='2-agent'` cells (matching the cheap
+  analysis pass), so an ungrounded model can no longer confabulate a root
+  cause/owner; and seeded pessimistic build defaults from a SKIPPED build step
+  are reported as "not run / no build evidence" rather than an observed build
+  failure.
+- The builder arms a self-imposed internal deadline (~33.5 min, before GitHub's
+  35-min hard kill) that flushes a graceful partial envelope + trace, so a
+  budget-exhausted cell is no longer ungracefully killed leaving only a checkpoint.
diff --git a/.github/workflows/agent-bench.yml b/.github/workflows/agent-bench.yml
index 94e7eefc0..4b2ac3d9f 100644
--- a/.github/workflows/agent-bench.yml
+++ b/.github/workflows/agent-bench.yml
@@ -185,12 +185,16 @@ jobs:
         continue-on-error: true
         if: steps.init.outcome == 'success'
         timeout-minutes: 35
-        run: npx tsx scripts/agent-bench/steps/2-agent-run.ts
+        # `exec` so bash replaces itself with the node process — GitHub's SIGTERM/SIGINT on the
+        # timeout/cancel path then reaches our handler directly instead of a wrapper shell. The
+        # in-process internal deadline (BENCH_AGENT_DEADLINE_SEC, < 35min) is the real guarantee.
+        run: exec npx tsx scripts/agent-bench/steps/2-agent-run.ts
         env:
           TASK_PROMPT: ${{ github.workspace }}/tasks/${{ env.TASK }}/PROMPT.md
           OUTPUT: /tmp/builder-result.json
-          # Trace tree + run metrics, uploaded as bench-trace-*. Written only on normal completion
-          # (no mid-run trace accessor), so a wall-clock timeout emits no trace.
+          # Trace tree + run metrics, uploaded as bench-trace-*. TRACE is now written on EVERY exit
+          # path (success, invoke-exhausted error, wall-clock / internal-deadline flush) via a per-turn
+          # message accumulator; METRICS is written only on normal completion.
           TRACE: /tmp/trace.json
           METRICS: /tmp/metrics.json
 
@@ -256,12 +260,17 @@ jobs:
       - name: 4b. Analyze cell (best-effort)
         if: always()
         continue-on-error: true
-        timeout-minutes: 6
+        timeout-minutes: 20
         run: node scripts/agent-bench/steps/analyze-cell.mjs
         env:
           RESULT_PATH: /tmp/result.json
           TRACE: /tmp/trace.json
           METRICS: /tmp/metrics.json
+          # Deep-failure evidence, staged to stable /tmp paths by step "3. Build and test". Missing files
+          # degrade to null in analyze-cell.mjs (the deep pass simply has less to work with).
+          PW_RESULTS: /tmp/pw-results.json
+          DEV_LOG: /tmp/dev.log
+          BUILD_LOG: /tmp/build.log
           # BENCH_JUDGE_MODEL and AWS_REGION are inherited from the job-level env.
 
       - name: 5. Upload result
diff --git a/scripts/agent-bench/README.md b/scripts/agent-bench/README.md
index 6335ab397..817433714 100644
--- a/scripts/agent-bench/README.md
+++ b/scripts/agent-bench/README.md
@@ -137,14 +137,18 @@ and a broken (composite 0) cell scores 0 no matter how cheap it was. A cell with
 no recorded tokens renders `—` (never a fake `$0`). Flip the single
 `SCORE_PER_DOLLAR` constant in `lib/scoring.mjs` for cost-per-point instead.
 
-**Colors vs baseline (per metric).** In the report every metric cell is colored
-against the baseline value for that metric: 🟢 same-or-better · 🟡 worse but
-within the margin · 🔴 worse beyond it · 🆕 no baseline value (new cell) · `—`
-nothing to diff · 🗑️ cell gone since the baseline. The margin is a SINGLE tunable,
-`MARGIN_PCT` (5% relative) in `lib/overview.mjs`; for integer metrics (test
-counts, 0–10 judge dims) it is floored to 1, so a single-point nudge reads 🟡,
-never 🔴. Directions: tests ↑, judge ↑, score ↑ are better (higher = 🟢); cost ↓,
-tokens ↓ are better (lower = 🟢).
+**Colors vs baseline (per metric).** In the report every metric cell shows its
+current value on top and, underneath, the **signed delta vs the baseline value**
+for that metric, colored by the SIGNIFICANCE + DIRECTION of the change (not
+absolute quality): 🟢 meaningful improvement · 🟡 change within the noise band ·
+🔴 meaningful regression · ⚪ no baseline value for that field (a new cell, or a
+metric the baseline predates) — the current value is still shown, tagged `(new)`
+· `—` nothing to show this run · 🗑️ cell gone since the baseline. Directions:
+tests, judge, score are higher-better; cost, tokens are lower-better. The
+per-metric noise bands are a SINGLE tunable, `DELTA_THRESHOLDS` in
+`lib/overview.mjs`, consumed by `deltaColor`: composite/score ±5 points, judge
+±0.3, tests ±1 pass, cost ±10% (relative), tokens ±10% (in+out combined). A
+change within its band reads 🟡 (noise, since N=1); beyond it, 🟢/🔴 by direction.
 
 **Verdict tiers** are pure pass-rate — the judge plays no part, so an LLM
 failure can never flip a verdict:
@@ -209,19 +213,18 @@ data so identifiers stay collision-free across a spec's internal navigation.
 **Re-derivability.** Each `result.json` publishes `tests_passed`/`tests_total`,
 `test_rate`, the raw per-dimension judge scores (pre-cap `judge_dimensions_raw`
 and post-cap `judge_dimensions`), `judge_overall`, `composite`, `verdict`,
-`klass`, the builder `tokens_in`/`tokens_out`, and `stop_reason`. The **Detailed
-results** table renders every post-cap dimension inline (one colored
-`baseline -> pr` line per dimension in its Judge cell), and the cost + score are
-derived from the published tokens via `lib/scoring.mjs`. A reader can re-derive —
-or re-weight — every composite, cost and score from the published data without
-re-running anything.
+`klass`, the builder `tokens_in`/`tokens_out`, and `stop_reason`. The results
+table renders the overall judge score, tests, cost, tokens and score per cell,
+and the cost + score are derived from the published tokens via `lib/scoring.mjs`.
+A reader can re-derive — or re-weight — every composite, cost and score from the
+published data without re-running anything.
 
 **Gating.** Observational by default: with the repo/org variable
 `BENCH_MIN_SCORE` unset the summary only reports the mean composite. Set it to a
 number to gate — the summary job exits non-zero when the mean composite across
 scored cells falls below it; this is the **one** intentional exception to
 green-regardless (below). There is no baseline-*delta* gate — the PR-vs-baseline
-overview (below) is observational only.
+results table (below) is observational only.
 
 **Check status — green regardless.** A bench cell never turns the PR check red.
 Every fallible cell step (`npm ci`, OIDC, `1-init`, `2-agent`, `3-build-and-test`,
@@ -233,24 +236,27 @@ the run summary, not the check status, and the summary job is green too (unless
 `BENCH_MIN_SCORE` is set and trips). A new commit cancels the prior in-flight run
 via the workflow `concurrency` group.
 
-**The report — Overview + Detailed vs the `main` baseline.** Each run writes a
-compact **aggregate** (per cell: composite/verdict, test counts, per-dimension
+**The report — a single results table vs the `main` baseline.** Each run writes
+a compact **aggregate** (per cell: composite/verdict, test counts, per-dimension
 judge scores, builder tokens, cost, and score-per-$, plus the mean) to S3 at
 `bench/runs/<sha>/results.json`; a push-to-`main` run also updates the stable
 pointer `bench/runs/latest-main.json`. The summary job fetches a baseline and
-renders TWO tables from the SAME rows (`lib/overview.mjs`):
-
-- **Overview** — colors ONLY (🟢/🟡/🔴 per metric vs baseline), at-a-glance:
-  `TASK · TEMPLATE · TESTS · JUDGE · COST · TOKENS (in/out) · SCORE`.
-- **Detailed results** — the same rows widened WITH numbers (`baseline -> pr`),
-  including a multi-line per-dimension Judge cell and the cell's stop reason.
-
-A collapsible **Glossary** (scoring, colors, the ±5% margin) sits at the very
-top; a best-effort roll-up step (`analyze.mjs`) then appends an **Executive
-summary** (a short paragraph + bullets), a **Potential issues** section (fed by
-each cell's own analysis), and a collapsed **Per-cell analysis** (each cell also
-collapsed within it). The old `build` / `verdict` / `composite` columns and the
-raw per-dimension blurb are gone — folded into the two tables above.
+renders ONE results table (`renderDetailed` in `lib/overview.mjs`):
+`TASK · TEMPLATE · TESTS · JUDGE · COST · TURNS · SCORE · STOP REASON`.
+Each metric cell is a single inline line — `<color> <value> (<Δ vs main>)`: the
+current value with its signed delta vs the baseline (`⚪ (new)` when the baseline
+has no value for that field — the value is still shown), colored by `deltaColor`
+per the `DELTA_THRESHOLDS` bands. The JUDGE cell packs the overall score plus a
+per-dimension shorthand (`F`/`S`/`P`/`C`/`B` = functional / selectors /
+persistence / code / blocks) onto that one line. There is no separate colors-only
+Overview and no standalone `Δ vs base` column — the delta is baked into every cell.
+
+A collapsible **Glossary** (scoring, colors, the per-metric thresholds) sits at
+the very top; the deterministic **headline** (mean composite + delta) prints just
+above the table; a best-effort roll-up step (`analyze.mjs`) then appends an
+**Executive summary** (a short paragraph + bullets), a **Potential issues**
+section (fed by each cell's own analysis), and a collapsed **Per-cell analysis**
+(each cell also collapsed within it).
 
 **Baseline selection.** The baseline a **PR** diffs against is ALWAYS the most
 recent `main`-branch bench, `bench/runs/latest-main.json` — the current tip of
@@ -260,8 +266,9 @@ so an exact-base-sha lookup can silently diff against an outdated or never-bench
 commit; `latest-main.json`, refreshed on every push to `main`, can't. A **push to
 `main`** instead diffs against the immediately preceding main commit
 (`github.event.before`) by exact sha — the ONLY place a commit-keyed baseline is
-read — with `latest-main` as the fallback. With no baseline found the tables show
-absolute values (every metric 🆕) and a "no baseline" note (never an error).
+read — with `latest-main` as the fallback. With no baseline found the table shows
+current values only (every metric ⚪ `(new)`) and a "no baseline" note (never an
+error).
 Reading/writing the baseline uses the same OIDC role (`s3:GetObject` /
 `s3:PutObject` on `bench/*`); a missing grant just degrades to "no baseline".
 
@@ -279,12 +286,12 @@ Reading/writing the baseline uses the same OIDC role (`s3:GetObject` /
 | `steps/4-judge.ts` | Judge agent (Strands + Bedrock); one vended `bash` tool over a spec-blinded, disposable source-only copy; grades on the fixed shared rubric (`COMMON_DIMENSIONS`) and applies hard caps |
 | `steps/lib/run-shell.ts` | Shared shell infrastructure for the builder + judge: the `WorkspaceSandbox` (host-execution Sandbox rooted at a fixed dir) + a backgrounded-process-safe runner. The containment fix lives here once; imported by `2-agent-run.ts` and `4-judge.ts` |
 | `steps/lib/scoring.mjs` | **Single source of truth** for scoring: `classifyCell`, `testStats`/`testRate`, `verdict`/`verdictOf`, `composite`/`compositeBand`, `isScoredCell`, plus the cost/score model — `PRICING`/`BUILDER_PRICING`, `cellCost`, `scorePerDollar` (+ the `SCORE_PER_DOLLAR` knob). Imported by finalize, summary, and overview |
-| `steps/lib/overview.mjs` | Pure helpers for the two report tables: `buildAggregate` (schema-2 aggregate — per-cell composite/tests/judge-dims/tokens/cost/score/stop_reason + mean), `diffAgainstBaseline`, the color engine (`MARGIN_PCT`, `metricColor`), formatters, and `renderOverview` (colors) + `renderDetailed` (numbers). Imported by summary + analyze |
+| `steps/lib/overview.mjs` | Pure helpers for the report table: `buildAggregate` (schema-2 aggregate — per-cell composite/tests/judge-dims/tokens/cost/score/stop_reason + mean), `diffAgainstBaseline`, the color engine (`DELTA_THRESHOLDS`, `deltaColor`), formatters, and `renderDetailed` (the single results table: current value + colored signed delta per cell). Imported by summary + analyze |
 | `steps/lib/analysis.mjs` | Shared, mostly-pure helpers for the trace/metrics analysis feature: trace trimming, prompt builders, and `parseCellAnalysis` (splits the per-cell model output into an analysis string + a bounded potential-issues list). Imported by `analyze-cell.mjs` (per-cell) and `analyze.mjs` (roll-up) |
 | `steps/analyze-cell.mjs` | Step 4b: per-cell trace/metrics analysis via the judge model; writes a concise `analysis` string **and** an `analysis_issues[]` (potential issues) back into the cell's `result.json` |
 | `steps/analyze.mjs` | Summary-job roll-up: synthesizes the per-cell analyses into a short **Executive summary** (paragraph + bullets) via one best-effort Bedrock call, aggregates a **Potential issues** section, and renders a collapsed **Per-cell analysis** (each cell also collapsed) |
 | `steps/finalize-result.mjs` | Run with `if: always()`; stamps `status` + `failed_at` from per-step outcomes, then `klass`, `test_rate`, `verdict`, `composite` via `lib/scoring.mjs` |
-| `steps/summary.mjs` | Render the report to `$GITHUB_STEP_SUMMARY`: a collapsible **Glossary**, the colors-only **Overview** + numbers **Detailed results** tables (vs the `main` baseline), and a deterministic caveats block; reads one `result.json` per cell (N=1); writes the run's schema-2 aggregate (+ Athena NDJSON) for the S3 baseline; optional `BENCH_MIN_SCORE` gate |
+| `steps/summary.mjs` | Render the report to `$GITHUB_STEP_SUMMARY`: a collapsible **Glossary**, the headline (mean composite + delta), and the single **results table** — current value + colored signed delta per cell — vs the `main` baseline, plus a deterministic caveats block; reads one `result.json` per cell (N=1); writes the run's schema-2 aggregate (+ Athena NDJSON) for the S3 baseline; optional `BENCH_MIN_SCORE` gate |
 | `package.json` | Workspace metadata; `private: true` |
 
 Failure handling: every cell starts with `0-init-result.mjs` writing a
@@ -296,9 +303,9 @@ upload step also runs with `if: always()`, so the cell always shows up in the
 summary table — never silently missing.
 
 The report is written to the **GitHub Actions run summary**
-(`$GITHUB_STEP_SUMMARY`) and renders in the run UI — the Glossary, the Overview +
-Detailed tables, then the executive summary / potential issues / per-cell
-analysis. The bench posts **no PR comment** — the github-script commenting step in
+(`$GITHUB_STEP_SUMMARY`) and renders in the run UI — the Glossary, the headline,
+the single results table, then the executive summary / potential issues /
+per-cell analysis. The bench posts **no PR comment** — the github-script commenting step in
 `agent-bench.yml` is intentionally left in place but commented out, so it can be
 restored if commenting is ever wanted again. When the bench matrix produces no
 results, `summary.mjs` renders a benign "no results" note and still exits 0.
diff --git a/scripts/agent-bench/prompts.ts b/scripts/agent-bench/prompts.ts
index b57838cae..96f6087d4 100644
--- a/scripts/agent-bench/prompts.ts
+++ b/scripts/agent-bench/prompts.ts
@@ -27,7 +27,7 @@ Stay fair and deterministic. Tie every judgment to evidence in the source, not t
 
 APPLICABILITY — grade each dimension ONLY against what THIS task's prompt actually requires. Before scoring a dimension, decide whether the prompt puts it in play at all. A dimension that is genuinely not applicable to the task — e.g. \`persistence\` when nothing is required to survive a reload (no durable data), or \`selector_contract\` for a backend/API task with no DOM — must NOT be docked for the absence of something the task never asked for: treat an inapplicable dimension as satisfied (score it at the top of the scale) and state briefly in your explanation why it is N/A. This is NOT license to inflate: when a dimension DOES apply, hold the strict anchors above and dock for every real gap. Applicability decides only WHETHER a dimension is in play; the anchors decide the score once it is.
 
-You grade SOURCE you cannot run. Do NOT award full \`functional_completeness\` to a flow whose runtime success can't be proven from source alone — e.g. OIDC redirect/callback round-trips, async session establishment, delete / persist-then-reload cycles, or conditionally-rendered views. Treat such a flow as UNVERIFIED and hold the score back unless the source is unambiguously correct.`;
+You grade SOURCE you cannot run. Do NOT award full \`functional_completeness\` to a flow whose runtime success can't be proven from source alone — e.g. OIDC redirect/callback round-trips, async session establishment, delete / persist-then-reload cycles, or conditionally-rendered views. Treat such a flow as UNVERIFIED and hold the score back unless the source is unambiguously correct. If an auth UI plausibly fails to re-render after a state change, attribute it to the KNOWN @aws-blocks reactivity footgun (issue #185: \`setAuthState\` does not drive \`onAuthChange\` unless the app also calls \`broadcastAuthChange\`) rather than inventing a different cause.`;
 
 // The judge rubric is a fixed set of dimensions shared by every task (below).
 // All are 0-10 numbers averaged equally — no weights (they invite anchoring
@@ -51,7 +51,7 @@ const COMMON_RUBRIC_LINES: Record<(typeof COMMON_DIMENSIONS)[number], string> =
 	code_quality:
 		'No dead code, no @ts-ignore, no unused imports, no commented-out blocks. Cite the file. Applicability: always in play, but scale it to the code the task actually required — judge only the code that is there; do not manufacture issues in code the task never called for.',
 	blocks_fidelity:
-		"Applicability: in play whenever the task's core mechanism calls for an @aws-blocks Building Block; if the task genuinely needs no block, this dimension is N/A — treat it as satisfied and note why. When a block IS called for: does the app route its core behavior through a REAL @aws-blocks Building Block (see the <imports> grep + the source) rather than faking it with an in-memory Map/array, hardcoded data, an inline stub, or a bypassed/mocked block? Judge whether real blocks are genuinely used for the task's core mechanism — do NOT penalize the choice of one valid block/API over another equally-valid one, and do NOT require a specific method name. Cite an import (from <imports> or the source) plus a concrete method call as evidence. Score low/0 only if the core mechanism is faked, stubbed, or no relevant block is used at all.",
+		"Applicability: in play whenever the task's core mechanism calls for an @aws-blocks Building Block; if the task genuinely needs no block, this dimension is N/A — treat it as satisfied and note why. When a block IS called for: does the app route its core behavior through a REAL @aws-blocks Building Block (see the <imports> grep + the source) rather than faking it with an in-memory Map/array, hardcoded data, an inline stub, or a bypassed/mocked block? Judge whether real blocks are genuinely used for the task's core mechanism — do NOT penalize the choice of one valid block/API over another equally-valid one, and do NOT require a specific method name. Cite an import (from <imports> or the source) plus a concrete method call as evidence. Score low/0 only if the core mechanism is faked, stubbed, or no relevant block is used at all. The @aws-blocks auth Building Blocks expose REAL framework APIs — e.g. `setAuthState`/`getAuthState`/`onAuthChange`/`broadcastAuthChange` — as do the documented methods of the other blocks; treat all of these as GENUINE @aws-blocks APIs and never flag them as an invented or hallucinated API surface.",
 };
 
 // Compose the rubric from the fixed shared dimensions — every task is graded
diff --git a/scripts/agent-bench/steps/2-agent-run.ts b/scripts/agent-bench/steps/2-agent-run.ts
index 68782b0f0..13b793271 100644
--- a/scripts/agent-bench/steps/2-agent-run.ts
+++ b/scripts/agent-bench/steps/2-agent-run.ts
@@ -3,13 +3,14 @@
  *
  * Inputs (env): WORKSPACE (scaffolded bench-app), TASK_PROMPT (PROMPT.md path), OUTPUT (envelope
  * JSON path), BENCH_MODEL (default us.anthropic.claude-opus-4-8), TRACE/METRICS (optional output
- * paths; trace written only on normal completion, none on a wall-clock timeout).
+ * paths). TRACE is written on EVERY exit path — success, invoke-exhausted error, and the wall-clock /
+ * internal-deadline flush — via a per-turn message accumulator (METRICS is written only on success).
  *
  * Tools: the framework's vended `bash` + `fileEditor`, routed through a WorkspaceSandbox rooted at
  * WORKSPACE (containment enforced by the Sandbox); the bash timeout is floored to BASH_MIN_TIMEOUT_SEC.
  */
 import { readFileSync, writeFileSync } from 'node:fs';
-import { Agent, type AgentResult, BedrockModel, ModelStreamUpdateEvent } from '@strands-agents/sdk';
+import { Agent, type AgentResult, BedrockModel, MessageAddedEvent, ModelStreamUpdateEvent } from '@strands-agents/sdk';
 import { makeBash } from '@strands-agents/sdk/vended-tools/bash';
 import { fileEditor } from '@strands-agents/sdk/vended-tools/file-editor';
 import { builderSystem } from '../prompts.ts';
@@ -20,7 +21,8 @@ import {
 	nextBackoffMs,
 	sleep,
 } from './lib/bedrock-retry.ts';
-import { buildCheckpointEnvelope, writeEnvelopeAtomic } from './lib/partial-envelope.mjs';
+import { buildCheckpointEnvelope, buildTraceArtifact, writeEnvelopeAtomic } from './lib/partial-envelope.mjs';
+import { beginWorkspaceDiff, finishWorkspaceDiff } from './lib/workspace-diff.mjs';
 import {
 	BENCH_AGENT_USER,
 	WorkspaceSandbox,
@@ -45,6 +47,11 @@ const MAX_TURNS = 120;
 // Floor for the vended bash timeout (s): the tool defaults to 120s (kills npm install/build) and has
 // no timeout knob, so WorkspaceSandbox raises any provided timeout to at least this. 10 min is ample.
 const BASH_MIN_TIMEOUT_SEC = 600;
+// Self-imposed internal deadline (s): fire a GRACEFUL partial-envelope flush BEFORE GitHub Actions'
+// hard `timeout-minutes: 35` (=2100s) SIGKILLs the step. Without it a budget-exhausted cell that GH
+// kills ungracefully leaves only a checkpoint (→ misclassified harness_error, no trace); the timer
+// guarantees a graceful envelope + trace on our own terms. 2010s = 33.5min, comfortably under 35min.
+const AGENT_DEADLINE_SEC = Number(process.env.BENCH_AGENT_DEADLINE_SEC ?? '2010');
 
 const taskPrompt = readFileSync(TASK_PROMPT_PATH, 'utf-8');
 
@@ -76,7 +83,13 @@ process.stderr.write(
 // envelope from the signal handler. Counters at module scope so they survive invoke retries and the handler.
 let partialTokensIn = 0;
 let partialTokensOut = 0;
+let partialCacheRead = 0;
+let partialCacheWrite = 0;
 let partialCycles = 0;
+// Per-turn message accumulator (assistant toolUse AND user toolResult blocks), captured incrementally
+// via a MessageAddedEvent hook so a NON-returning invoke() (MaxTokensError, wall-clock / internal-
+// deadline kill) still leaves a trace on disk — AgentResult traces exist only once invoke() returns.
+const accumulatedMessages: unknown[] = [];
 
 // Fresh agent per invoke attempt (mirrors the judge): a mid-stream failure can leave a half-built
 // conversation, so each attempt gets a clean agent. The token hook is re-attached every build.
@@ -99,12 +112,27 @@ function makeBuilderAgent(): Agent {
 		if (inner.type === 'modelMetadataEvent' && inner.usage) {
 			partialTokensIn += inner.usage.inputTokens ?? 0;
 			partialTokensOut += inner.usage.outputTokens ?? 0;
+			// Cache-read/write tokens are DISPLAYED only (never fed into cost/SCORE); accumulated with
+			// the same per-cycle += as tokens_in/out so a mid-run kill still leaves the spend on disk.
+			partialCacheRead += inner.usage.cacheReadInputTokens ?? 0;
+			partialCacheWrite += inner.usage.cacheWriteInputTokens ?? 0;
 			partialCycles += 1;
 			// Checkpoint the moment usage advances, so an UNGRACEFUL kill (a pkill storm tearing down
 			// this harness before the SIGTERM flush) still leaves nonzero tokens + partial cycles on OUTPUT.
 			writeCheckpoint();
 		}
 	});
+	// Capture every message (user input, assistant toolUse, AND toolResult blocks) incrementally. The
+	// trace tree from AgentResult omits toolResult blocks and only exists once invoke() returns, so this
+	// hook is the ONLY way a timed-out / max-tokens cell (invoke never returns) preserves tool
+	// outputs + errors for the failure-analysis pass. Best-effort — never let it break the invoke loop.
+	agent.addHook(MessageAddedEvent, (event) => {
+		try {
+			accumulatedMessages.push(event.message.toJSON());
+		} catch {
+			// A malformed message must never abort the run; drop it and continue.
+		}
+	});
 	return agent;
 }
 
@@ -124,6 +152,8 @@ function writeCheckpoint(): void {
 				startedMs: started,
 				tokensIn: partialTokensIn,
 				tokensOut: partialTokensOut,
+				cacheRead: partialCacheRead,
+				cacheWrite: partialCacheWrite,
 				cycles: partialCycles,
 				isolationActive: ISOLATE,
 			}),
@@ -133,16 +163,42 @@ function writeCheckpoint(): void {
 	}
 }
 
-// Flush a best-effort partial envelope if the runner kills us: SIGTERM on the wall-clock timeout,
-// SIGINT on a cancellation. writeFileSync + exit run synchronously before the SIGKILL grace elapses.
+// Persist the trace artifact to TRACE on ANY exit path (success, invoke-exhausted error, wall-clock /
+// internal-deadline flush). Span traces exist only when invoke() RETURNED; the per-turn accumulated
+// messages (which carry the toolResult blocks) are always included, so an errored/timed-out cell is
+// still analyzable instead of becoming an unanalyzable silent 0. Best-effort — never throws.
+function writeTraceArtifact(result?: AgentResult): void {
+	if (!TRACE_PATH) return;
+	let spanTraces: unknown[] = [];
+	try {
+		spanTraces = result?.traces?.map((t) => t.toJSON()) ?? [];
+	} catch {
+		spanTraces = [];
+	}
+	try {
+		writeFileSync(TRACE_PATH, JSON.stringify(buildTraceArtifact(spanTraces, accumulatedMessages), null, 2));
+	} catch (err) {
+		process.stderr.write(`[bench] failed to write trace to ${TRACE_PATH}: ${describeError(err)}\n`);
+	}
+}
+
+// Flush a best-effort partial envelope when we must stop early: SIGTERM on GitHub's wall-clock
+// timeout, SIGINT on a cancellation, or our own 'internal-deadline' timer firing just before that
+// hard kill. writeFileSync + exit run synchronously before the SIGKILL grace elapses.
 function writePartialEnvelopeAndExit(signal: string): void {
 	if (finished) return;
 	finished = true;
 	// Label by signal so a cancellation isn't mislabeled a timeout. This GRACEFUL terminal stop_reason
-	// (and the absence of the checkpoint flag) is what keeps a genuine timeout as agent_fail (INCLUDED).
+	// (and the absence of the checkpoint flag) is what keeps a genuine timeout / budget exhaustion as
+	// agent_fail (INCLUDED). The internal deadline maps to a wall-clock timeout (the agent ran out of its
+	// time budget), just reached on our own terms with a trace flushed rather than a GH SIGKILL.
 	const isCancel = signal === 'SIGINT';
+	const isInternal = signal === 'internal-deadline';
 	const stopReason = isCancel ? 'cancelled' : 'wall_clock_timeout';
-	const cause = isCancel ? 'cancellation' : 'workflow wall-clock timeout';
+	const cause = isCancel ? 'cancellation' : isInternal ? 'internal deadline' : 'workflow wall-clock timeout';
+	const detail = isInternal
+		? `internal deadline (${AGENT_DEADLINE_SEC}s) reached after ${partialCycles} model call(s)`
+		: `killed by ${signal} (${cause}) after ${partialCycles} model call(s)`;
 	let wrote = false;
 	try {
 		writeFileSync(
@@ -153,11 +209,13 @@ function writePartialEnvelopeAndExit(signal: string): void {
 					duration_sec: Math.round((Date.now() - started) / 1000),
 					tokens_in: partialTokensIn,
 					tokens_out: partialTokensOut,
+					cache_read_tokens: partialCacheRead,
+					cache_write_tokens: partialCacheWrite,
 					stop_reason: stopReason,
 					cycle_count: partialCycles,
 					final_message: '',
 					partial: true,
-					builder_error: `killed by ${signal} (${cause}) after ${partialCycles} model call(s)`,
+					builder_error: detail,
 					isolation_active: ISOLATE,
 				},
 				null,
@@ -166,7 +224,7 @@ function writePartialEnvelopeAndExit(signal: string): void {
 		);
 		wrote = true;
 		process.stderr.write(
-			`[bench] ${signal}: wrote partial envelope tokens=${partialTokensIn}/${partialTokensOut} cycles=${partialCycles}\n`,
+			`[bench] ${signal}: wrote partial envelope (${stopReason}) tokens=${partialTokensIn}/${partialTokensOut} cycles=${partialCycles}\n`,
 		);
 	} catch (err) {
 		process.stderr.write(`[bench] failed to write partial envelope on ${signal}: ${describeError(err)}\n`);
@@ -175,20 +233,34 @@ function writePartialEnvelopeAndExit(signal: string): void {
 			`[bench] partial-spend tokens_in=${partialTokensIn} tokens_out=${partialTokensOut} cycles=${partialCycles}\n`,
 		);
 	}
-	// No trace on the timeout path: the Strands trace/metrics only exist once invoke() RETURNS and the
-	// SDK exposes no mid-run accessor, so a timed-out cell emits only this partial envelope.
-	// Exit 124 = clean timeout with the envelope flushed; 125 = the envelope write itself failed.
+	// Flush the trace too (the accumulated toolUse + toolResult messages) so a timed-out / deadline-hit
+	// cell stays analyzable — previously the timeout path emitted NO trace, an unanalyzable silent
+	// failure. Span traces are absent here (invoke never returned) but the per-turn messages are not.
+	// After the envelope so the envelope write is never delayed by it.
+	writeTraceArtifact();
+	// Exit 124 = clean early-stop with the envelope flushed; 125 = the envelope write itself failed.
 	process.exit(wrote ? 124 : 125);
 }
 process.on('SIGTERM', () => writePartialEnvelopeAndExit('SIGTERM'));
 process.on('SIGINT', () => writePartialEnvelopeAndExit('SIGINT'));
 
+// Arm the self-imposed internal deadline: if invoke() is still running at AGENT_DEADLINE_SEC we flush a
+// graceful partial envelope + trace ourselves, BEFORE GitHub's hard timeout SIGKILLs us ungracefully.
+// Cleared once the retry loop settles (both success and error paths) so it never fires post-finish.
+const deadlineTimer = setTimeout(() => writePartialEnvelopeAndExit('internal-deadline'), AGENT_DEADLINE_SEC * 1000);
+
 // Seed an initial checkpoint NOW — before the first model call — so `isolation_active` is on disk even
 // if the cell dies ungracefully before any model cycle (e.g. an OOM during agent/sandbox setup). Without
 // it such an early death would leave the step-0 baseline with no isolation flag, and scoring.mjs would
 // have to assume isolation was off. A later model cycle (or a terminal exit) overwrites this.
 writeCheckpoint();
 
+// Snapshot the scaffolded workspace NOW (before the agent touches it) so a post-run diff can report
+// LOC/files churn. Best-effort: null on any failure → the cell persists no loc/files (renders ⚪ "(new)").
+// Uses a throwaway external git dir, so it never disturbs the workspace/app or the agent's own git.
+const snapshot = beginWorkspaceDiff(WORKSPACE);
+process.stderr.write(`[bench] workspace churn snapshot: ${snapshot ? 'captured' : 'unavailable (loc/files → null)'}\n`);
+
 // Startup stagger: spread each wave's FIRST Bedrock call so N cells don't all hit invoke at once and
 // trip the account TPM ceiling (the burst that failed 6/10 cells in run 28967475174). Keyed to the
 // matrix job index for a deterministic fan-out, staggering by within-wave slot (index % waveSize) so
@@ -229,6 +301,9 @@ for (let attempt = 1; attempt <= INVOKE_MAX_ATTEMPTS; attempt++) {
 	}
 }
 
+// The retry loop has settled — cancel the internal deadline so it can't fire during teardown/exit.
+clearTimeout(deadlineTimer);
+
 if (!result) {
 	finished = true;
 	const desc = describeModelError(lastErr);
@@ -242,6 +317,8 @@ if (!result) {
 				duration_sec: Math.round((Date.now() - started) / 1000),
 				tokens_in: partialTokensIn,
 				tokens_out: partialTokensOut,
+				cache_read_tokens: partialCacheRead,
+				cache_write_tokens: partialCacheWrite,
 				stop_reason: 'error',
 				cycle_count: partialCycles,
 				final_message: '',
@@ -252,6 +329,9 @@ if (!result) {
 			2,
 		),
 	);
+	// Persist whatever trace we accumulated (toolUse + toolResult messages) so a non-retryable invoke
+	// failure (e.g. MaxTokensError) leaves an analyzable trace instead of an unanalyzable silent 0.
+	writeTraceArtifact();
 	process.exit(1);
 }
 finished = true;
@@ -266,6 +346,15 @@ const duration_sec = Math.round((Date.now() - started) / 1000);
 const winnerUsage = result.metrics?.accumulatedUsage;
 const tokensIn = Math.max(partialTokensIn, winnerUsage?.inputTokens ?? 0);
 const tokensOut = Math.max(partialTokensOut, winnerUsage?.outputTokens ?? 0);
+// Cache tokens follow the SAME max(hook, winner) rule as tokens_in/out. Displayed only — NOT part of
+// cost/SCORE (see scoring.mjs cellCost); a future net-of-cache cost model could subtract these.
+const cacheRead = Math.max(partialCacheRead, winnerUsage?.cacheReadInputTokens ?? 0);
+const cacheWrite = Math.max(partialCacheWrite, winnerUsage?.cacheWriteInputTokens ?? 0);
+
+// LOC/files churn from the pre-run scaffold snapshot (best-effort; null on any failure — see
+// workspace-diff.mjs). Computed only on the success path: a timed-out/errored cell left the workspace
+// mid-flight, so its diff would be misleading — those paths persist no loc/files (→ ⚪ "(new)").
+const churn = finishWorkspaceDiff(snapshot, WORKSPACE);
 
 writeFileSync(
 	OUTPUT,
@@ -275,8 +364,14 @@ writeFileSync(
 			duration_sec,
 			tokens_in: tokensIn,
 			tokens_out: tokensOut,
+			cache_read_tokens: cacheRead,
+			cache_write_tokens: cacheWrite,
 			stop_reason: result.stopReason,
 			cycle_count: result.metrics?.cycleCount ?? 0,
+			loc_created: churn.loc_created,
+			loc_edited: churn.loc_edited,
+			files_created: churn.files_created,
+			files_edited: churn.files_edited,
 			final_message: messageText(result.lastMessage),
 			isolation_active: ISOLATE,
 		},
@@ -290,13 +385,9 @@ process.stderr.write(
 
 // Persist the trace tree + run metrics as SEPARATE artifacts. NEVER serialize `result` directly:
 // AgentResult.toJSON() strips traces/metrics, so access the properties (traces need per-item toJSON()).
-if (TRACE_PATH) {
-	try {
-		writeFileSync(TRACE_PATH, JSON.stringify(result.traces?.map((t) => t.toJSON()) ?? [], null, 2));
-	} catch (err) {
-		process.stderr.write(`[bench] failed to write trace to ${TRACE_PATH}: ${describeError(err)}\n`);
-	}
-}
+// writeTraceArtifact folds the span traces together with the accumulated messages (toolResult blocks)
+// — the SAME artifact shape every exit path writes, so the analysis step reads one consistent structure.
+writeTraceArtifact(result);
 if (METRICS_PATH) {
 	try {
 		writeFileSync(METRICS_PATH, JSON.stringify(result.metrics ?? {}, null, 2));
diff --git a/scripts/agent-bench/steps/3-build-and-test.sh b/scripts/agent-bench/steps/3-build-and-test.sh
index 90f575a8f..e13960c1c 100755
--- a/scripts/agent-bench/steps/3-build-and-test.sh
+++ b/scripts/agent-bench/steps/3-build-and-test.sh
@@ -157,6 +157,9 @@ else
   # Banner never appeared / port never became ready within the window. Record the signal + a brief
   # diagnostic (pid liveness + log tail) onto result.json, then proceed with APP_BASE_URL empty.
   echo "::warning::dev server banner never appeared / port never became ready within ~60s"
+  # Distinct dead-server / backend-crash signal so downstream can tell this apart from an agent that
+  # built a genuinely broken app (mirrors how build_succeeded/dev_server_started are emitted above).
+  echo "dev_server_status=dead" >> "$GITHUB_OUTPUT"
   dev_pid=""; [ -f "${CELL_TMP}/dev.pid" ] && dev_pid="$(cat "${CELL_TMP}/dev.pid" 2>/dev/null || true)"
   if [ -z "${dev_pid:-}" ]; then dev_pid_status="no-pidfile"
   elif kill -0 "$dev_pid" 2>/dev/null; then dev_pid_status="alive (pid=${dev_pid}) but not serving"
@@ -175,11 +178,22 @@ else
     try { r = JSON.parse(fs.readFileSync(p, "utf-8")); } catch {}
     r.dev_log_tail = process.env.DEV_LOG_TAIL || "";
     r.dev_pid_status = process.env.DEV_PID_STATUS || "";
+    r.dev_server_status = "dead";
     fs.writeFileSync(p, JSON.stringify(r, null, 2));
   ' || echo "::warning::failed to record dev_log_tail on result.json"
 fi
 export APP_BASE_URL
 
+# Only run Playwright when the dev server actually came up. If APP_BASE_URL is empty the server is
+# dead / the backend crashed (see the dead-server branch above) — launching Playwright with an empty
+# BLOCKS_URL would surface as bogus "invalid URL" test failures, so skip Playwright entirely and let
+# the recorded dev_server_status=dead signal drive the score instead. That signal classifies the cell
+# as a real FAIL — verdict 'fail', composite 0, and INCLUDED in the mean (DEAD_SERVER_KLASS in
+# lib/scoring.mjs) — so a backend crash HURTS the score rather than hiding as an excluded 'unknown',
+# while the failure root-cause still attributes owner=framework. The pessimistic defaults (tests 0/0/0,
+# dev_server_started=false) carry the honest signal and control still falls through to the
+# stable-evidence copy below.
+if [ -n "$APP_BASE_URL" ]; then
 # Record whether Playwright installed; on failure tests can't run, so emit the signal and bail.
 # Both the package install AND the chromium download must succeed before the signal flips true.
 if ! npm install --no-save --silent "@playwright/test@${PW_VERSION}"; then
@@ -252,6 +266,25 @@ if [ -f "$PW_RESULTS_JSON" ]; then
 else
   echo "::warning::Playwright produced no ${PW_RESULTS_JSON} (probably never ran); defaults retained"
 fi
+else
+  echo "::warning::dev server never came up (dead-server/backend-crash) — skipped Playwright to avoid masking it as invalid-URL test failures; tests stay at pessimistic defaults"
+fi
+
+# Stage the deep-failure evidence to STABLE /tmp paths for the later "analyze cell" step. CELL_TMP is
+# keyed on this script's PID, so it's gone by the time analyze-cell.mjs runs — mirror how the
+# trace/metrics already land at /tmp. Best-effort: a missing source or copy failure must never break
+# the green-regardless exit (analyze-cell degrades to null when a file is absent). Clear any stale
+# copies from a PRIOR cell first (runner-agnostic) so a skipped / again-missing source can't leave the
+# previous cell's evidence in place for analyze-cell to misread.
+# /tmp is sticky (+t): a stale copy from a PRIOR cell may be benchagent-owned (the agent's isolated
+# phase wrote it), so a plain `rm` as the runner uid hits EPERM and — under `set -e` — would abort the
+# step BEFORE the green-regardless `exit 0` below, mis-recording a cell that actually built + passed.
+# Mirror the reap/fuser lines above: `sudo -n rm` clears benchagent-owned files, unprivileged `rm` is
+# the fallback, and the trailing `|| true` guarantees this cleanup never aborts the step.
+sudo -n rm -f /tmp/pw-results.json /tmp/dev.log /tmp/build.log 2>/dev/null || rm -f /tmp/pw-results.json /tmp/dev.log /tmp/build.log 2>/dev/null || true
+cp "$PW_RESULTS_JSON" /tmp/pw-results.json 2>/dev/null || true
+cp "${CELL_TMP}/dev.log" /tmp/dev.log 2>/dev/null || true
+cp "${CELL_TMP}/build.log" /tmp/build.log 2>/dev/null || true
 
 # Always exit 0: real failures are already captured as $GITHUB_OUTPUT signals for the judge, and a
 # non-zero exit would break green-regardless.
diff --git a/scripts/agent-bench/steps/4-judge.ts b/scripts/agent-bench/steps/4-judge.ts
index b04171a1c..371936c78 100644
--- a/scripts/agent-bench/steps/4-judge.ts
+++ b/scripts/agent-bench/steps/4-judge.ts
@@ -29,11 +29,13 @@ import { hardCapPlan } from './lib/scoring.mjs';
 
 // Physical spec-blinding: the judge grades a SOURCE-ONLY COPY (JUDGE_SRC) with these excluded, so the
 // objective test can't anchor the score — blinding by ABSENCE.
-//   - STAGE_EXCLUDE_DIRS: node_modules, .git, dist, the staged `bench-tests/` spec dir, and
-//     `.blocks-sandbox` (a build-time artifact). Also the grep exclude-dirs in collectBlocksImports.
+//   - STAGE_EXCLUDE_DIRS: node_modules, .git, dist, the staged `bench-tests/` spec dir,
+//     `.blocks-sandbox` (a build-time artifact), and `.bb-data` (the PGlite/BB mock datadir — runtime
+//     state, not source; copying it across the judge's UID boundary throws EACCES on internal files
+//     like pg_logical/replorigin_checkpoint). Also the grep exclude-dirs in collectBlocksImports.
 //   - EXCLUDED_FILE_RE: the objective *.spec.{js,ts,jsx,tsx,cjs,mjs} test CODE files — deliberately
 //     NOT framework *.spec.json manifests (e.g. blocks.spec.json), which are legit app source.
-const STAGE_EXCLUDE_DIRS = new Set(['node_modules', '.git', 'dist', 'bench-tests', '.blocks-sandbox']);
+const STAGE_EXCLUDE_DIRS = new Set(['node_modules', '.git', 'dist', 'bench-tests', '.blocks-sandbox', '.bb-data']);
 const EXCLUDED_FILE_RE = /\.spec\.[cm]?[jt]sx?$/;
 
 const WORKSPACE = required('WORKSPACE', '[judge]');
diff --git a/scripts/agent-bench/steps/analyze-cell.mjs b/scripts/agent-bench/steps/analyze-cell.mjs
index 3980939b8..4e72f5bf7 100644
--- a/scripts/agent-bench/steps/analyze-cell.mjs
+++ b/scripts/agent-bench/steps/analyze-cell.mjs
@@ -1,15 +1,42 @@
 // Per-cell analysis: runs INSIDE each matrix cell right after the judge, colocated with that cell's
 // fresh trace/metrics. Reads this cell's result.json + trace.json + metrics.json, asks the judge model
 // (Opus 4.8) for a concise analysis, and writes it back as `analysis` + `analysis_issues[]`
-// (analyze.mjs rolls these up later). Additive & isolated: wrapped so it can NEVER throw (always exits
-// 0), only ADDS those two fields, and falls back to a benign string on any error. Runs under bare
+// (analyze.mjs rolls these up later). For cells that actually FAILED (see isFailureCell) it then runs
+// a second, DEEPER pass that ingests the quoted failing-test output + dev/build log tails and writes a
+// structured `failure_analysis` root cause. Additive & isolated: wrapped so it can NEVER throw (always
+// exits 0), only ADDS those fields, and falls back to a benign string on any error. Runs under bare
 // `node`: Node built-ins + AWS CLI via lib/analysis.mjs, no SDK.
 import { readFileSync, writeFileSync } from 'node:fs';
-import { CELL_MAX_TOKENS, CELL_SYSTEM, DEFAULT_MODEL_ID, FALLBACK_ANALYSIS, bedrockConverse, buildCellUserText, parseCellAnalysis } from './lib/analysis.mjs';
+import {
+	CELL_MAX_TOKENS,
+	CELL_SYSTEM,
+	DEFAULT_MODEL_ID,
+	FALLBACK_ANALYSIS,
+	FAILURE_MAX_TOKENS,
+	FAILURE_SYSTEM,
+	bedrockConverse,
+	buildCellUserText,
+	buildEvidenceObserved,
+	buildFailureUserText,
+	deterministicCellAnalysis,
+	deterministicFailureAnalysis,
+	extractFailingTests,
+	isFailureCell,
+	parseCellAnalysis,
+	parseFailureAnalysis,
+	redactSecrets,
+	trimTrace,
+	truthy,
+} from './lib/analysis.mjs';
 
 const RESULT_PATH = process.env.RESULT_PATH ?? '/tmp/result.json';
 const TRACE_PATH = process.env.TRACE ?? '/tmp/trace.json';
 const METRICS_PATH = process.env.METRICS ?? '/tmp/metrics.json';
+// Deep-failure evidence, staged to STABLE paths by 3-build-and-test.sh (its own CELL_TMP uses $$ and is
+// gone by the time this step runs). Missing files degrade to null — the deep pass simply has less data.
+const PW_RESULTS_PATH = process.env.PW_RESULTS ?? '/tmp/pw-results.json';
+const DEV_LOG_PATH = process.env.DEV_LOG ?? '/tmp/dev.log';
+const BUILD_LOG_PATH = process.env.BUILD_LOG ?? '/tmp/build.log';
 const MODEL_ID = process.env.BENCH_JUDGE_MODEL ?? DEFAULT_MODEL_ID;
 const REGION = process.env.AWS_REGION ?? 'us-east-1';
 
@@ -21,22 +48,22 @@ function readJson(path) {
 	}
 }
 
-// Decide the per-cell analysis — never throws. Only calls Bedrock when there's data; a failure with
-// no trace gets a benign note and no model call.
+function readText(path) {
+	try {
+		return readFileSync(path, 'utf-8');
+	} catch {
+		return '';
+	}
+}
+
+// Decide the per-cell analysis — never throws. A harness_error, or ANY cell with no agent trace, gets a
+// deterministic note and NO model call (without a trace an ungrounded model would confabulate a root
+// cause/owner from stray metrics — see deterministicCellAnalysis); only a traced cell is sent to Bedrock.
 function analyze(result, trace, metrics) {
+	const deterministic = deterministicCellAnalysis(result, trace);
+	if (deterministic) return deterministic;
+
 	const klass = result?.klass ?? null;
-	if (klass === 'harness_error') {
-		return { analysis: 'Cell failed before producing a gradeable app (harness error) — no agent trace to analyze.', issues: [] };
-	}
-	if (!trace && !metrics) {
-		return {
-			analysis:
-				klass === 'agent_fail'
-					? 'Agent timed out / produced no app within budget — no trace was emitted, so there is nothing to analyze.'
-					: 'No trace/metrics artifact available for this cell — nothing to analyze.',
-			issues: [],
-		};
-	}
 
 	const userText = buildCellUserText({
 		task: result?.task,
@@ -61,6 +88,56 @@ function analyze(result, trace, metrics) {
 	return { analysis: parsed.analysis || FALLBACK_ANALYSIS, issues: parsed.issues };
 }
 
+// Deeper, structured root-cause pass — ONLY for failing cells. Reads the quoted failing tests + dev/
+// build log tails and asks the model for strict JSON. Returns a normalized object or null (no usable
+// diagnosis / model error / no evidence). Never throws — the caller also guards it.
+function analyzeFailure(result, trace) {
+	// Deterministic short-circuit — the same honesty guard analyze() applies. A harness_error, an agent
+	// step failure (failed_at 2-agent), or a cell with no trace gets a deterministic, honest answer and
+	// NO model call: an ungrounded model would confabulate a root cause/owner from stray metrics/logs
+	// (the fabricated "build FAILED / owner=agent" on a wall-clock-timeout cell). Only a genuinely
+	// gradeable failing cell that has a trace reaches the model below.
+	const guard = deterministicFailureAnalysis(result, trace);
+	if (guard) return guard.failure_analysis;
+
+	const failingTests = extractFailingTests(readJson(PW_RESULTS_PATH));
+	// Gate the build signal on whether build evidence was actually OBSERVED (step 3 ran); otherwise the
+	// seeded pessimistic defaults (build_succeeded=false) from 0-init-result.mjs would feed the model a
+	// false "build failed". Defense-in-depth: the guard above already excludes those cells from this path.
+	const buildObserved = buildEvidenceObserved(result);
+	const buildFailed = buildObserved && result?.build_succeeded != null && !truthy(result.build_succeeded);
+	// If there's genuinely nothing to look at (no failing tests, no logs), skip the model call.
+	// Scrub any credential material the dev/build logs may have echoed before it reaches the model.
+	const devLogTail = redactSecrets(readText(DEV_LOG_PATH));
+	const buildLogTail = buildFailed ? redactSecrets(readText(BUILD_LOG_PATH)) : '';
+	if (failingTests.totalFailing === 0 && !devLogTail && !buildLogTail) return null;
+
+	const userText = buildFailureUserText({
+		task: result?.task,
+		template: result?.template,
+		verdict: result?.verdict,
+		klass: result?.klass ?? null,
+		testsFailed: typeof result?.tests_failed === 'number' ? result.tests_failed : null,
+		testsTotal: typeof result?.tests_total === 'number' ? result.tests_total : null,
+		buildSucceeded: !buildObserved ? null : result?.build_succeeded == null ? null : truthy(result.build_succeeded),
+		devServerStarted: result?.dev_server_started == null ? null : truthy(result.dev_server_started),
+		judgeExplanation: result?.judge_explanation,
+		failingTests,
+		devLogTail,
+		buildLogTail,
+		traceTail: trace ? trimTrace(trace).tail : '',
+	});
+	const { text, error } = bedrockConverse({
+		system: FAILURE_SYSTEM,
+		userText,
+		modelId: MODEL_ID,
+		region: REGION,
+		maxTokens: FAILURE_MAX_TOKENS,
+	});
+	if (error) return null;
+	return parseFailureAnalysis(text);
+}
+
 function main() {
 	const result = readJson(RESULT_PATH);
 	if (!result || typeof result !== 'object') {
@@ -84,9 +161,26 @@ function main() {
 	// Add ONLY the analysis fields — never touch score/verdict/klass/etc.
 	result.analysis = analysis;
 	result.analysis_issues = issues;
+
+	// Deeper root-cause pass for failing cells only — passing/partial-clean cells stay on the cheap
+	// path above (no extra model call). Fully guarded: any error → no failure_analysis, cell unaffected.
+	if (isFailureCell(result)) {
+		try {
+			const fa = analyzeFailure(result, trace);
+			if (fa) {
+				result.failure_analysis = fa;
+				process.stderr.write(`[analyze-cell] deep failure analysis: category=${fa.category ?? '?'} owner=${fa.owner ?? '?'}\n`);
+			} else {
+				process.stderr.write('[analyze-cell] deep failure analysis produced no usable diagnosis (skipped/ignored)\n');
+			}
+		} catch (err) {
+			process.stderr.write(`[analyze-cell] deep failure analysis failed (ignored): ${err?.message ?? err}\n`);
+		}
+	}
+
 	try {
 		writeFileSync(RESULT_PATH, JSON.stringify(result, null, 2));
-		process.stderr.write(`[analyze-cell] wrote analysis (${analysis.length} chars, ${issues.length} issue(s)) to ${RESULT_PATH}\n`);
+		process.stderr.write(`[analyze-cell] wrote analysis (${analysis.length} chars, ${issues.length} issue(s)${result.failure_analysis ? ', +failure_analysis' : ''}) to ${RESULT_PATH}\n`);
 	} catch (err) {
 		process.stderr.write(`[analyze-cell] failed to write analysis to ${RESULT_PATH} (ignored): ${err?.message ?? err}\n`);
 	}
diff --git a/scripts/agent-bench/steps/analyze.mjs b/scripts/agent-bench/steps/analyze.mjs
index f04f1d8c4..a2c2e059e 100644
--- a/scripts/agent-bench/steps/analyze.mjs
+++ b/scripts/agent-bench/steps/analyze.mjs
@@ -83,20 +83,32 @@ function main() {
 			regressed: delta !== null && delta < REGRESSION_DELTA,
 			analysis: c.analysis || null,
 			issues: Array.isArray(c.analysis_issues) ? c.analysis_issues.filter((s) => typeof s === 'string' && s.trim()) : [],
+			failure_analysis: c.failure_analysis && typeof c.failure_analysis === 'object' ? c.failure_analysis : null,
 		};
 	});
 
 	// ── Executive summary: ONE best-effort Bedrock synthesis over the analyses ─
 	const execSummary = synthesize(aggregate, verdictCounts, rows);
 
+	// ── Failure root-cause: deterministic roll-up line + per-cell structured diagnosis ─
+	const failureRows = rows.filter((r) => r.failure_analysis);
+	const failureRollup = summarizeFailures(failureRows);
+
 	// ── Potential issues: deterministic flags + each cell's emitted issues ─────
 	const potential = collectPotentialIssues(rows);
 
-	// ── Render: Executive summary → Potential issues → collapsible per-cell ────
+	// ── Render: Executive summary → Failure root-cause → Potential issues → collapsible per-cell ────
 	const out = [];
 	out.push('## Executive summary', '');
+	if (failureRollup) out.push(failureRollup, '');
 	out.push(execSummary.text, '');
 
+	if (failureRows.length > 0) {
+		out.push('## 🔴 Failure root-cause', '');
+		out.push(`_Deep per-cell diagnosis of ${failureRows.length} failing cell(s) from quoted test/log evidence · model \`${MODEL_ID}\`._`, '');
+		for (const line of renderFailureAnalyses(failureRows)) out.push(line);
+	}
+
 	out.push('## ⚠️ Potential issues', '');
 	if (potential.length === 0) {
 		out.push('_None surfaced — no low or regressed cells, and no per-cell analysis flagged an issue._', '');
@@ -139,9 +151,71 @@ function main() {
 		executive_summary_error: execSummary.error ?? null,
 		potential_issues: potential,
 		cells: rows,
+		failure_analyses: failureRows.map((r) => ({ task: r.task, template: r.template, ...r.failure_analysis })),
 	});
 }
 
+// Badge per failure category (falls back to a generic marker for unknown categories).
+const FAILURE_CATEGORY_BADGE = {
+	build: '🏗️',
+	'dev-server': '🖥️',
+	'api-shape': '🔌',
+	auth: '🔑',
+	persistence: '💾',
+	timeout: '⏱️',
+	flake: '🎲',
+	'agent-logic': '🧠',
+};
+const MAX_EVIDENCE_CHARS = 500;
+
+function fdisp(v, fallback = '—') {
+	return typeof v === 'string' && v.trim() ? v.trim() : fallback;
+}
+
+// One deterministic sentence folding the structured failures by category + owner into the exec summary
+// (rendered even if the Bedrock roll-up call failed). Returns null when there are no structured failures.
+function summarizeFailures(failureRows) {
+	if (failureRows.length === 0) return null;
+	const byCat = new Map();
+	const byOwner = new Map();
+	for (const r of failureRows) {
+		const cat = fdisp(r.failure_analysis?.category, 'uncategorized');
+		const owner = fdisp(r.failure_analysis?.owner, 'unknown');
+		byCat.set(cat, (byCat.get(cat) ?? 0) + 1);
+		byOwner.set(owner, (byOwner.get(owner) ?? 0) + 1);
+	}
+	const catParts = [...byCat.entries()].sort((a, b) => b[1] - a[1]).map(([c, n]) => `${n} ${c}`);
+	const ownerParts = [...byOwner.entries()].sort((a, b) => b[1] - a[1]).map(([o, n]) => `${n} ${o}`);
+	const n = failureRows.length;
+	return `**${n} failing cell(s) diagnosed:** ${catParts.join(', ')} · owners: ${ownerParts.join(', ')}.`;
+}
+
+// Per-cell structured root-cause blocks. Each: category badge + owner header, root cause, quoted
+// evidence (as a blockquote, clipped), and likely fix. Defensive against missing fields.
+function renderFailureAnalyses(failureRows) {
+	const out = [];
+	for (const r of failureRows) {
+		const fa = r.failure_analysis ?? {};
+		const cat = fdisp(fa.category, 'uncategorized');
+		const badge = FAILURE_CATEGORY_BADGE[cat] ?? '🔴';
+		const owner = fdisp(fa.owner, 'unknown');
+		out.push(`### ${badge} \`${r.task}/${r.template}\` — ${cat} · owner: ${owner}`, '');
+		out.push(`- **Root cause:** ${fdisp(fa.root_cause)}`);
+		const evidence = fdisp(fa.evidence, '');
+		if (evidence) {
+			const clipped = (evidence.length > MAX_EVIDENCE_CHARS ? `${evidence.slice(0, MAX_EVIDENCE_CHARS)}…` : evidence)
+				.split('\n')
+				.map((l) => `  > ${l}`)
+				.join('\n');
+			out.push('- **Evidence:**');
+			out.push(clipped);
+		}
+		out.push(`- **Likely fix:** ${fdisp(fa.likely_fix)}`);
+		out.push('');
+	}
+	return out;
+}
+
 // Deterministic "Potential issues": harness/agent failures + low/regressed composites first, then
 // every per-cell issue, each attributed to its cell.
 function collectPotentialIssues(rows) {
diff --git a/scripts/agent-bench/steps/lib/analysis.mjs b/scripts/agent-bench/steps/lib/analysis.mjs
index 027404ab0..6ffc40904 100644
--- a/scripts/agent-bench/steps/lib/analysis.mjs
+++ b/scripts/agent-bench/steps/lib/analysis.mjs
@@ -8,6 +8,7 @@ import { spawnSync } from 'node:child_process';
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { AGENT_FAIL_AT, AGENT_MAX_TOKENS_REASON, HARNESS_FAIL_REASONS } from './scoring.mjs';
 
 // Judge model, reused for analysis (Opus 4.8 for both per-cell + synthesis). Same id as 4-judge.ts.
 export const DEFAULT_MODEL_ID = 'us.anthropic.claude-opus-4-8';
@@ -36,6 +37,111 @@ export const REGRESSION_DELTA = -5;
 // Benign fallback stored when the per-cell analysis can't be produced.
 export const FALLBACK_ANALYSIS = 'analysis unavailable';
 
+// Deterministic per-cell analysis for a cell with NO agent trace (the wall-clock-timeout / ungraceful-
+// teardown path emits none). Without a trace the model has nothing to ground "what the agent built /
+// where it struggled" on, so it would CONFABULATE a root cause/owner from stray metrics — record an
+// explicit "undetermined" note and skip the model call instead. Exported + pure so analyze-cell.mjs and
+// the unit test share one source.
+export const NO_TRACE_ANALYSIS =
+	'No agent trace was emitted (e.g. a wall-clock timeout or ungraceful teardown) — the failure root cause is undetermined; nothing to analyze.';
+
+/**
+ * Decide the deterministic (no Bedrock call) per-cell analysis when one applies, else null (→ ask the
+ * model). Fires for a harness_error cell (it failed before producing a gradeable app) and for ANY cell
+ * with no trace — an ungrounded model would confabulate an owner/category, so we record the
+ * {@link NO_TRACE_ANALYSIS} "undetermined" note instead. Pure.
+ * @param {{klass?: string|null}} result finalized cell result
+ * @param {unknown} trace parsed trace.json (any shape) or null
+ * @returns {{analysis: string, issues: string[]}|null} deterministic result, or null to call the model
+ */
+export function deterministicCellAnalysis(result, trace) {
+	const klass = result?.klass ?? null;
+	if (klass === 'harness_error') {
+		return { analysis: 'Cell failed before producing a gradeable app (harness error) — no agent trace to analyze.', issues: [] };
+	}
+	if (!trace) {
+		return { analysis: NO_TRACE_ANALYSIS, issues: [] };
+	}
+	return null;
+}
+
+/**
+ * Was the cell's build / dev-server signal actually OBSERVED, or is it a seeded pessimistic default?
+ * 0-init-result.mjs seeds build_succeeded=false / build_status='failed' / dev_server_started=false;
+ * when step 3 (build-and-test) is SKIPPED — because the agent step didn't succeed — those seeds are
+ * never overwritten, so they are DEFAULTS, not observations. Treat build evidence as observed only
+ * when the cell actually reached grading: not an agent_fail / harness_error, and not failed_at a
+ * pre-grade step. Mirrors the "build evidence absent" intent of scoring.mjs buildCapDecision. Pure.
+ * @param {{failed_at?: unknown, klass?: unknown}} result finalized cell result
+ * @returns {boolean}
+ */
+export function buildEvidenceObserved(result) {
+	const failedAt = result?.failed_at ?? null;
+	if (failedAt === AGENT_FAIL_AT) return false;
+	if (typeof failedAt === 'string' && Object.prototype.hasOwnProperty.call(HARNESS_FAIL_REASONS, failedAt)) {
+		return false;
+	}
+	const klass = result?.klass ?? null;
+	if (klass === 'agent_fail' || klass === 'harness_error') return false;
+	return true;
+}
+
+/**
+ * Deterministic short-circuit for the DEEP failure pass — the analog of {@link deterministicCellAnalysis}
+ * for analyzeFailure(). Without it an ungrounded model confabulates a root cause/owner (the kb-chat
+ * cell's fabricated category='build' / owner='agent' "build FAILED", contradicting its own
+ * wall_clock_timeout reason). Returns `{ failure_analysis: obj|null }` when a deterministic answer
+ * applies (caller returns it, skipping the model), or null to fall through to the model.
+ *   - harness_error     → { failure_analysis: null } (excluded cell — emit no root-cause block)
+ *   - failed_at 2-agent → honest agent-owned analysis (max_tokens vs generic budget); build/test never ran
+ *   - no trace          → undetermined; owner null
+ * Ordered harness_error → 2-agent → no-trace so the most specific honest answer wins. Pure.
+ * @param {{klass?: string|null, klass_reason?: string|null, failed_at?: unknown, tokens_in?: unknown, duration_sec?: unknown}} result
+ * @param {unknown} trace parsed trace.json (any shape) or null
+ * @returns {{failure_analysis: object|null}|null} deterministic result, or null to call the model
+ */
+export function deterministicFailureAnalysis(result, trace) {
+	const klass = result?.klass ?? null;
+	if (klass === 'harness_error') {
+		return { failure_analysis: null };
+	}
+	if ((result?.failed_at ?? null) === AGENT_FAIL_AT) {
+		const maxTokens = result?.klass_reason === AGENT_MAX_TOKENS_REASON;
+		const tokensIn = typeof result?.tokens_in === 'number' ? result.tokens_in : null;
+		const durationSec = typeof result?.duration_sec === 'number' ? result.duration_sec : null;
+		const evidenceBits = [
+			result?.klass_reason ? `reason=${result.klass_reason}` : null,
+			tokensIn != null ? `tokens_in=${tokensIn}` : null,
+			durationSec != null ? `duration=${durationSec}s` : null,
+		].filter(Boolean);
+		return {
+			failure_analysis: {
+				category: maxTokens ? null : 'timeout',
+				single_root_cause: true,
+				root_cause: maxTokens
+					? 'Agent exhausted the model token budget (MaxTokensError) before completing; build and test steps never ran.'
+					: 'Agent step did not finish within its budget; build and test steps never ran.',
+				evidence: evidenceBits.join(' '),
+				likely_fix: '',
+				owner: 'agent',
+			},
+		};
+	}
+	if (!trace) {
+		return {
+			failure_analysis: {
+				category: null,
+				single_root_cause: null,
+				root_cause: 'No agent trace was emitted (e.g. an ungraceful teardown); the failure root cause is undetermined.',
+				evidence: '',
+				likely_fix: '',
+				owner: null,
+			},
+		};
+	}
+	return null;
+}
+
 // App-level throttle/transient retry (initial + up to 4 backoffs) for the post-run ANALYSIS
 // model calls. TRANSIENT_RE is a deliberately BROAD text heuristic matched against stringified
 // error output (bare `timeout`, `500`, `503`, etc.) — it is NOT the same classifier as
@@ -245,6 +351,251 @@ export function buildRollupUserText(input) {
 	].join('\n');
 }
 
+// ---------------------------------------------------------------------------
+// DEEP FAILURE ANALYSIS — a second, richer pass that runs ONLY on failing cells
+// (see isFailureCell). Motivated by the shallow per-cell pass misdiagnosing an
+// auth-notes 0/11 as a "scoring/harness mismatch" because it never saw the
+// actual failing-test output. This pass ingests the quoted test failures + dev/
+// build logs and emits a STRUCTURED root cause. Best-effort: never gates a cell.
+// ---------------------------------------------------------------------------
+
+// Output budget for the deeper pass (a touch larger than CELL_MAX_TOKENS — it emits a small JSON object).
+export const FAILURE_MAX_TOKENS = 600;
+// Bound the failure evidence fed to the model so a log storm can't blow up the prompt.
+export const MAX_FAILING_TESTS = 8; // distinct error groups (after dedup)
+export const MAX_FAILURE_ERR_LEN = 300; // per grouped error line
+export const MAX_FAILURE_TITLES = 4; // example spec titles listed per error group
+export const MAX_FAILURE_TITLE_LEN = 120; // cap per spec title (mirrors the error-line cap so a pathological title can't bloat the prompt)
+export const MAX_LOG_TAIL_CHARS = 1500; // dev.log / build.log tail
+export const MAX_FAILURE_JUDGE_CHARS = 1500; // full-ish judge explanation (vs the 500 the cheap pass uses)
+
+// Closed vocabularies the model must pick from; parseFailureAnalysis coerces to these (unknowns → null).
+export const FAILURE_CATEGORIES = ['build', 'dev-server', 'api-shape', 'auth', 'persistence', 'timeout', 'flake', 'agent-logic'];
+export const FAILURE_OWNERS = ['agent', 'framework', 'harness'];
+
+// GITHUB_OUTPUT booleans arrive as the strings "true"/"false" (not real bools) when result.json is
+// assembled from step outputs; mirror scoring.mjs so string flags are interpreted correctly.
+// truthy('false') === false, so a genuine build/dev-server failure is still caught below.
+export function truthy(v) {
+	return v === true || v === 'true';
+}
+
+/**
+ * Should this cell get the deep failure pass? True for any cell that actually failed at some layer:
+ * a fail verdict, an agent_fail, any failed test, or a build / dev-server that never came up. A clean
+ * pass / partial with all-green tests is left on the cheap path (no extra model call).
+ * @param {unknown} result parsed result.json
+ * @returns {boolean}
+ */
+export function isFailureCell(result) {
+	if (!result || typeof result !== 'object') return false;
+	const r = /** @type {Record<string, unknown>} */ (result);
+	if (r.verdict === 'fail') return true;
+	if (r.klass === 'agent_fail') return true;
+	if (typeof r.tests_failed === 'number' && r.tests_failed > 0) return true;
+	if (r.dev_server_started != null && !truthy(r.dev_server_started)) return true;
+	if (r.build_succeeded != null && !truthy(r.build_succeeded)) return true;
+	return false;
+}
+
+/**
+ * Scrub AWS / GitHub credential material from free-form log text before it is placed into a model
+ * prompt. Defense-in-depth: dev/build log tails can accidentally echo exported env vars or printed
+ * tokens. Non-string input → ''. Pure, best-effort — pattern-based, not a completeness guarantee.
+ * @param {unknown} text
+ * @returns {string}
+ */
+export function redactSecrets(text) {
+	if (typeof text !== 'string') return '';
+	return text
+		.replace(/\b(AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN|GITHUB_TOKEN)\s*[:=]\s*\S+/gi, '$1=***REDACTED***')
+		.replace(/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, '***REDACTED-AWS-KEY-ID***')
+		.replace(/\bgh[oprsu]_[A-Za-z0-9]{20,}\b/g, '***REDACTED-GH-TOKEN***')
+		.replace(/\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, '***REDACTED-GH-TOKEN***');
+}
+
+// Strip ANSI color codes Playwright embeds in error messages (they wreck dedup + waste chars).
+function stripAnsi(s) {
+	// eslint-disable-next-line no-control-regex
+	return typeof s === 'string' ? s.replace(/\u001b\[[0-9;]*m/g, '') : '';
+}
+
+// Collapse an error message to a single trimmed line, capped — the dedup key.
+function normalizeError(msg) {
+	return oneLine(stripAnsi(msg)).slice(0, MAX_FAILURE_ERR_LEN);
+}
+
+/**
+ * Pure parser for the Playwright JSON reporter output. Walks the (recursively nested) suites, finds
+ * FAILING specs, lifts each one's first error message, and DEDUPES by identical normalized error so a
+ * single root cause hitting all N specs collapses to one group (e.g. auth-notes' 11 identical
+ * `getByTestId('auth-username')` failures → one group, count 11). Never throws.
+ * @param {unknown} pwResults parsed pw-results.json (any shape) or null
+ * @returns {{totalFailing: number, groups: Array<{error: string, count: number, titles: string[]}>}}
+ */
+export function extractFailingTests(pwResults) {
+	const empty = { totalFailing: 0, groups: [] };
+	if (!pwResults || typeof pwResults !== 'object') return empty;
+	/** @type {Array<{title: string, error: string}>} */
+	const failing = [];
+
+	const firstError = (spec) => {
+		for (const t of spec?.tests ?? []) {
+			for (const res of t?.results ?? []) {
+				const status = res?.status;
+				if (status && status !== 'passed' && status !== 'skipped') {
+					const msg = res?.error?.message ?? (Array.isArray(res?.errors) ? res.errors[0]?.message : '') ?? '';
+					if (msg) return normalizeError(msg);
+				}
+			}
+		}
+		return '';
+	};
+
+	const walk = (suite, prefix) => {
+		if (!suite || typeof suite !== 'object') return;
+		const title = suite.title ? `${prefix}${prefix ? ' › ' : ''}${suite.title}` : prefix;
+		for (const spec of suite.specs ?? []) {
+			// A spec is failing when ok===false OR any of its tests has a non-passed result.
+			const anyBad = spec?.ok === false || (spec?.tests ?? []).some((t) => (t?.results ?? []).some((r) => r?.status && r.status !== 'passed' && r.status !== 'skipped'));
+			if (anyBad) {
+				failing.push({ title: (oneLine(spec?.title) || '(untitled spec)').slice(0, MAX_FAILURE_TITLE_LEN), error: firstError(spec) || '(no error message captured)' });
+			}
+		}
+		for (const child of suite.suites ?? []) walk(child, title);
+	};
+
+	try {
+		for (const s of pwResults.suites ?? []) walk(s, '');
+	} catch {
+		return empty;
+	}
+
+	// Dedup by identical normalized error, preserving first-seen order.
+	/** @type {Map<string, {error: string, count: number, titles: string[]}>} */
+	const byError = new Map();
+	for (const f of failing) {
+		const g = byError.get(f.error);
+		if (g) {
+			g.count += 1;
+			if (g.titles.length < MAX_FAILURE_TITLES) g.titles.push(f.title);
+		} else {
+			byError.set(f.error, { error: f.error, count: 1, titles: [f.title] });
+		}
+	}
+	return { totalFailing: failing.length, groups: [...byError.values()].slice(0, MAX_FAILING_TESTS) };
+}
+
+// Deep-failure system prompt: force a single, evidence-grounded root cause as STRICT JSON.
+export const FAILURE_SYSTEM = `You are the failure triager for ONE benchmark cell where an AI coding agent built an app that then FAILED (tests failed, or the build / dev-server never came up). You are given the failing test names + their error messages, the dev-server log tail, the build log tail (if the build failed), the judge's notes on what was built, and the tool-call trace tail.
+
+Diagnose the SINGLE most likely root cause from the QUOTED evidence. Prefer one shared cause when many tests fail identically. Output ONLY a JSON object (no prose, no markdown fence) with EXACTLY these keys:
+{
+  "category": one of ["build","dev-server","api-shape","auth","persistence","timeout","flake","agent-logic"],
+  "single_root_cause": boolean (true if one cause explains all/most failures),
+  "root_cause": string (<=2 sentences; cite the decisive evidence),
+  "evidence": string (a quoted failing test name + its error line, or the decisive log line),
+  "likely_fix": string (<=1 sentence, concrete and actionable),
+  "owner": one of ["agent","framework","harness"] (who must fix it)
+}
+Base every field on the provided evidence — do not invent file names or errors you were not shown.`;
+
+/**
+ * Build the deep-failure prompt user text from a failing cell's data + logs. Pure.
+ * @param {{task?: string, template?: string, verdict?: string, klass?: string|null,
+ *   testsFailed?: number|null, testsTotal?: number|null, buildSucceeded?: boolean|null,
+ *   devServerStarted?: boolean|null, judgeExplanation?: string,
+ *   failingTests?: {totalFailing: number, groups: Array<{error: string, count: number, titles: string[]}>},
+ *   devLogTail?: string, buildLogTail?: string, traceTail?: string}} input
+ * @returns {string}
+ */
+export function buildFailureUserText(input) {
+	const ft = input.failingTests ?? { totalFailing: 0, groups: [] };
+	const testLines = ft.groups.length
+		? ft.groups.map((g) => {
+				const titles = g.titles.join(' | ');
+				return `- [${g.count}× ] ${titles}${g.count > g.titles.length ? ' (+more)' : ''}\n    ↳ ${g.error}`;
+			})
+		: ['(no failing-test detail captured)'];
+	const signals = [
+		input.verdict ? `verdict ${input.verdict}` : null,
+		input.klass ? `klass ${input.klass}` : null,
+		typeof input.testsFailed === 'number' ? `tests_failed ${input.testsFailed}${typeof input.testsTotal === 'number' ? `/${input.testsTotal}` : ''}` : null,
+		input.buildSucceeded === false ? 'build FAILED' : input.buildSucceeded === true ? 'build ok' : null,
+		input.devServerStarted === false ? 'dev-server DID NOT START' : input.devServerStarted === true ? 'dev-server ok' : null,
+	]
+		.filter(Boolean)
+		.join(', ');
+	const judge = oneLine(input.judgeExplanation).slice(0, MAX_FAILURE_JUDGE_CHARS);
+	const devTail = (input.devLogTail ?? '').slice(-MAX_LOG_TAIL_CHARS);
+	const buildTail = (input.buildLogTail ?? '').slice(-MAX_LOG_TAIL_CHARS);
+	return [
+		`Cell: ${input.task ?? '—'}/${input.template ?? '—'}`,
+		`Signals: ${signals || '(none)'}`,
+		`Failing tests (${ft.totalFailing} total, deduped by error):`,
+		...testLines,
+		'',
+		'Dev-server log tail:',
+		devTail || '(none)',
+		...(input.buildSucceeded === false ? ['', 'Build log tail:', buildTail || '(none)'] : []),
+		'',
+		judge ? `Judge notes (what was built): ${judge}` : 'Judge notes: (none)',
+		'',
+		'Trace tail:',
+		(input.traceTail ?? '').slice(-MAX_TAIL_CHARS) || '(no trace tail)',
+	].join('\n');
+}
+
+/**
+ * Tolerantly parse the deep-failure model output into a normalized object. Accepts a bare JSON object,
+ * a ```json fenced block, or JSON embedded in surrounding prose (first `{` … last `}`). Coerces
+ * category/owner to their closed vocabularies (unknown → null) and caps string lengths. Returns null
+ * on anything unusable. NEVER throws.
+ * @param {unknown} text raw model completion
+ * @returns {{category: string|null, single_root_cause: boolean|null, root_cause: string, evidence: string, likely_fix: string, owner: string|null}|null}
+ */
+export function parseFailureAnalysis(text) {
+	if (typeof text !== 'string' || !text.trim()) return null;
+	let raw = text.trim();
+	// Strip a ```json … ``` fence if present.
+	const fence = raw.match(/```(?:json)?\s*([\s\S]*?)```/i);
+	if (fence) raw = fence[1].trim();
+	let obj = null;
+	try {
+		obj = JSON.parse(raw);
+	} catch {
+		// Fall back to the first {...} span embedded in prose.
+		const start = raw.indexOf('{');
+		const end = raw.lastIndexOf('}');
+		if (start !== -1 && end > start) {
+			try {
+				obj = JSON.parse(raw.slice(start, end + 1));
+			} catch {
+				return null;
+			}
+		} else {
+			return null;
+		}
+	}
+	if (!obj || typeof obj !== 'object' || Array.isArray(obj)) return null;
+	const str = (v, cap) => (typeof v === 'string' ? oneLine(v).slice(0, cap) : '');
+	const category = FAILURE_CATEGORIES.includes(obj.category) ? obj.category : null;
+	const owner = FAILURE_OWNERS.includes(obj.owner) ? obj.owner : null;
+	const root_cause = str(obj.root_cause, 600);
+	const evidence = str(obj.evidence, 600);
+	const likely_fix = str(obj.likely_fix, 400);
+	// Require at least a category or a root_cause — otherwise the object carried nothing usable.
+	if (!category && !root_cause) return null;
+	return {
+		category,
+		single_root_cause: typeof obj.single_root_cause === 'boolean' ? obj.single_root_cause : null,
+		root_cause,
+		evidence,
+		likely_fix,
+		owner,
+	};
+}
+
 // Block synchronously between retries (bare-node, no async loop to yield to).
 function sleepSync(ms) {
 	try {
diff --git a/scripts/agent-bench/steps/lib/analysis.test.mjs b/scripts/agent-bench/steps/lib/analysis.test.mjs
index d8b45bdca..2bf743af5 100644
--- a/scripts/agent-bench/steps/lib/analysis.test.mjs
+++ b/scripts/agent-bench/steps/lib/analysis.test.mjs
@@ -7,16 +7,30 @@ import {
 	LOW_THRESHOLD,
 	MAX_CELL_ISSUES,
 	MAX_ERROR_LINES,
+	MAX_FAILING_TESTS,
+	MAX_FAILURE_ERR_LEN,
+	MAX_FAILURE_TITLES,
+	MAX_FAILURE_TITLE_LEN,
 	MAX_ISSUE_LEN,
 	MAX_TAIL_CHARS,
 	MAX_TOOL_NAMES,
+	NO_TRACE_ANALYSIS,
 	REGRESSION_DELTA,
 	buildCellUserText,
+	buildFailureUserText,
 	buildRollupUserText,
+	buildEvidenceObserved,
+	extractFailingTests,
+	isFailureCell,
+	deterministicCellAnalysis,
+	deterministicFailureAnalysis,
 	oneLine,
 	parseCellAnalysis,
+	parseFailureAnalysis,
+	redactSecrets,
 	summarizeMetrics,
 	trimTrace,
+	truthy,
 } from './analysis.mjs';
 
 describe('constants', () => {
@@ -216,3 +230,362 @@ describe('buildRollupUserText(input)', () => {
 		assert.match(text, /\(none\)/);
 	});
 });
+
+describe('isFailureCell(result)', () => {
+	it('triggers on a fail verdict', () => {
+		assert.equal(isFailureCell({ verdict: 'fail' }), true);
+	});
+	it('triggers on an agent_fail klass', () => {
+		assert.equal(isFailureCell({ verdict: 'partial', klass: 'agent_fail' }), true);
+	});
+	it('triggers on any failed test', () => {
+		assert.equal(isFailureCell({ verdict: 'partial', tests_failed: 1 }), true);
+	});
+	it('triggers when the dev-server did not start', () => {
+		assert.equal(isFailureCell({ verdict: 'pass', dev_server_started: false }), true);
+	});
+	it('triggers when the build failed', () => {
+		assert.equal(isFailureCell({ verdict: 'pass', build_succeeded: false }), true);
+	});
+	it('triggers on STRING "false" flags (GITHUB_OUTPUT bools arrive as strings)', () => {
+		assert.equal(isFailureCell({ verdict: 'pass', dev_server_started: 'false' }), true);
+		assert.equal(isFailureCell({ verdict: 'pass', build_succeeded: 'false' }), true);
+	});
+	it('does NOT trigger on STRING "true" flags', () => {
+		assert.equal(isFailureCell({ verdict: 'pass', klass: null, tests_failed: 0, dev_server_started: 'true', build_succeeded: 'true' }), false);
+	});
+	it('does NOT trigger on a clean pass', () => {
+		assert.equal(isFailureCell({ verdict: 'pass', klass: null, tests_failed: 0, dev_server_started: true, build_succeeded: true }), false);
+	});
+	it('does NOT trigger on a partial with all-green tests', () => {
+		assert.equal(isFailureCell({ verdict: 'partial', tests_failed: 0, dev_server_started: true, build_succeeded: true }), false);
+	});
+	it('is null-safe', () => {
+		assert.equal(isFailureCell(null), false);
+		assert.equal(isFailureCell(undefined), false);
+		assert.equal(isFailureCell('nope'), false);
+		assert.equal(isFailureCell(42), false);
+	});
+});
+
+describe('truthy(v)', () => {
+	it('is true only for boolean true or the string "true"', () => {
+		assert.equal(truthy(true), true);
+		assert.equal(truthy('true'), true);
+	});
+	it('is false for false, "false", and every other value', () => {
+		assert.equal(truthy(false), false);
+		assert.equal(truthy('false'), false);
+		assert.equal(truthy(undefined), false);
+		assert.equal(truthy(null), false);
+		assert.equal(truthy(0), false);
+		assert.equal(truthy(1), false);
+		assert.equal(truthy('TRUE'), false);
+	});
+});
+
+describe('redactSecrets(text)', () => {
+	it('scrubs KEY=value credential pairs, keeping the key name', () => {
+		const t = [
+			'AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE',
+			'AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+			'AWS_SESSION_TOKEN=FwoGZXIvYXdzEabcDEF1234567890',
+			'GITHUB_TOKEN=ghp_0123456789abcdefABCDEF0123456789',
+		].join('\n');
+		const out = redactSecrets(t);
+		assert.match(out, /AWS_ACCESS_KEY_ID=\*\*\*REDACTED\*\*\*/);
+		assert.match(out, /AWS_SECRET_ACCESS_KEY=\*\*\*REDACTED\*\*\*/);
+		assert.match(out, /AWS_SESSION_TOKEN=\*\*\*REDACTED\*\*\*/);
+		assert.match(out, /GITHUB_TOKEN=\*\*\*REDACTED\*\*\*/);
+		assert.doesNotMatch(out, /AKIAIOSFODNN7EXAMPLE/);
+		assert.doesNotMatch(out, /wJalrXUtnFEMI/);
+		assert.doesNotMatch(out, /ghp_0123456789/);
+	});
+	it('scrubs a bare AWS access-key id', () => {
+		const out = redactSecrets('token is AKIAIOSFODNN7EXAMPLE here');
+		assert.match(out, /\*\*\*REDACTED-AWS-KEY-ID\*\*\*/);
+		assert.doesNotMatch(out, /AKIAIOSFODNN7EXAMPLE/);
+	});
+	it('scrubs a bare GitHub token', () => {
+		const out = redactSecrets('using ghp_0123456789abcdefABCDEF0123456789 now');
+		assert.match(out, /\*\*\*REDACTED-GH-TOKEN\*\*\*/);
+		assert.doesNotMatch(out, /ghp_0123456789/);
+	});
+	it('leaves ordinary text untouched', () => {
+		const clean = 'build failed: cannot find module ./foo at line 42';
+		assert.equal(redactSecrets(clean), clean);
+	});
+	it('is non-string-safe (returns empty string)', () => {
+		assert.equal(redactSecrets(null), '');
+		assert.equal(redactSecrets(undefined), '');
+		assert.equal(redactSecrets(42), '');
+	});
+});
+
+describe('extractFailingTests(pwResults)', () => {
+	// Build a Playwright JSON report with `n` specs that all fail with the SAME error, plus optional extras.
+	function pwReport(specs) {
+		return { suites: [{ title: 'auth', specs }] };
+	}
+	function failSpec(title, message) {
+		return { title, ok: false, tests: [{ results: [{ status: 'unexpected', error: { message } }] }] };
+	}
+	function passSpec(title) {
+		return { title, ok: true, tests: [{ results: [{ status: 'passed' }] }] };
+	}
+
+	it('dedupes N identical errors into ONE group with the right count', () => {
+		const specs = [];
+		for (let i = 0; i < 11; i++) specs.push(failSpec(`shows username ${i}`, "getByTestId('auth-username') not visible"));
+		const out = extractFailingTests(pwReport(specs));
+		assert.equal(out.totalFailing, 11);
+		assert.equal(out.groups.length, 1);
+		assert.equal(out.groups[0].count, 11);
+		assert.match(out.groups[0].error, /auth-username/);
+		// only a bounded number of example titles are retained
+		assert.ok(out.groups[0].titles.length <= MAX_FAILURE_TITLES);
+	});
+
+	it('separates distinct errors and caps distinct groups', () => {
+		const specs = [];
+		for (let i = 0; i < MAX_FAILING_TESTS + 5; i++) specs.push(failSpec(`spec ${i}`, `distinct error number ${i}`));
+		const out = extractFailingTests(pwReport(specs));
+		assert.equal(out.totalFailing, MAX_FAILING_TESTS + 5);
+		assert.equal(out.groups.length, MAX_FAILING_TESTS); // capped
+	});
+
+	it('ignores passed and skipped specs', () => {
+		const specs = [passSpec('ok one'), failSpec('bad one', 'boom'), { title: 'skipped one', ok: true, tests: [{ results: [{ status: 'skipped' }] }] }];
+		const out = extractFailingTests(pwReport(specs));
+		assert.equal(out.totalFailing, 1);
+		assert.equal(out.groups[0].titles[0], 'bad one');
+	});
+
+	it('caps each error line length', () => {
+		const long = 'x'.repeat(MAX_FAILURE_ERR_LEN + 200);
+		const out = extractFailingTests(pwReport([failSpec('long err', long)]));
+		assert.ok(out.groups[0].error.length <= MAX_FAILURE_ERR_LEN);
+	});
+
+	it('caps each spec title length', () => {
+		const longTitle = 't'.repeat(MAX_FAILURE_TITLE_LEN + 180);
+		const out = extractFailingTests(pwReport([failSpec(longTitle, 'boom')]));
+		assert.ok(out.groups[0].titles[0].length <= MAX_FAILURE_TITLE_LEN);
+	});
+
+	it('walks nested suites', () => {
+		const nested = { suites: [{ title: 'outer', suites: [{ title: 'inner', specs: [failSpec('deep fail', 'nested boom')] }] }] };
+		const out = extractFailingTests(nested);
+		assert.equal(out.totalFailing, 1);
+		assert.match(out.groups[0].error, /nested boom/);
+	});
+
+	it('is null/shape-safe', () => {
+		assert.deepEqual(extractFailingTests(null), { totalFailing: 0, groups: [] });
+		assert.deepEqual(extractFailingTests(undefined), { totalFailing: 0, groups: [] });
+		assert.deepEqual(extractFailingTests('nope'), { totalFailing: 0, groups: [] });
+		assert.deepEqual(extractFailingTests({}), { totalFailing: 0, groups: [] });
+		assert.deepEqual(extractFailingTests({ suites: 'bad' }), { totalFailing: 0, groups: [] });
+	});
+});
+
+describe('buildFailureUserText(input)', () => {
+	it('includes signals, deduped failing tests, and log tails', () => {
+		const text = buildFailureUserText({
+			task: 'auth-notes',
+			template: 'demo',
+			verdict: 'fail',
+			klass: null,
+			testsFailed: 11,
+			testsTotal: 11,
+			buildSucceeded: true,
+			devServerStarted: true,
+			judgeExplanation: 'App built but never rendered the sign-in form.',
+			failingTests: { totalFailing: 11, groups: [{ error: "getByTestId('auth-username') not visible", count: 11, titles: ['a', 'b'] }] },
+			devLogTail: 'listening on 3000\nhydrating…',
+			buildLogTail: '',
+			traceTail: '{"tool":"str_replace"}',
+		});
+		assert.match(text, /Cell: auth-notes\/demo/);
+		assert.match(text, /verdict fail/);
+		assert.match(text, /tests_failed 11\/11/);
+		assert.match(text, /\[11× \]/);
+		assert.match(text, /auth-username/);
+		assert.match(text, /Dev-server log tail:/);
+		assert.match(text, /Judge notes \(what was built\): App built/);
+	});
+
+	it('includes the build log tail ONLY when the build failed', () => {
+		const withBuild = buildFailureUserText({ task: 't', template: 'x', buildSucceeded: false, buildLogTail: 'tsc error TS2304', failingTests: { totalFailing: 0, groups: [] } });
+		assert.match(withBuild, /Build log tail:/);
+		assert.match(withBuild, /tsc error TS2304/);
+		const noBuild = buildFailureUserText({ task: 't', template: 'x', buildSucceeded: true, buildLogTail: 'should not appear', failingTests: { totalFailing: 0, groups: [] } });
+		assert.doesNotMatch(noBuild, /Build log tail:/);
+		assert.doesNotMatch(noBuild, /should not appear/);
+	});
+
+	it('caps the log tails and judge explanation', () => {
+		const big = 'y'.repeat(5000);
+		const text = buildFailureUserText({ task: 't', template: 'x', buildSucceeded: false, judgeExplanation: big, devLogTail: big, buildLogTail: big, failingTests: { totalFailing: 0, groups: [] } });
+		// Prompt must stay bounded — nowhere near the 5000-char raw inputs ×3.
+		assert.ok(text.length < 6000, `expected bounded prompt, got ${text.length}`);
+	});
+
+	it('degrades gracefully with no failing-test detail', () => {
+		const text = buildFailureUserText({ task: 't', template: 'x' });
+		assert.match(text, /\(no failing-test detail captured\)/);
+		assert.match(text, /Signals: \(none\)/);
+	});
+});
+
+describe('parseFailureAnalysis(text)', () => {
+	const valid = JSON.stringify({
+		category: 'agent-logic',
+		single_root_cause: true,
+		root_cause: 'No initial render; UI only paints on onAuthChange which never fires synchronously.',
+		evidence: "getByTestId('auth-username') not visible (×11)",
+		likely_fix: 'Call renderSignedOut() at module scope on load.',
+		owner: 'agent',
+	});
+
+	it('parses a bare JSON object', () => {
+		const out = parseFailureAnalysis(valid);
+		assert.equal(out.category, 'agent-logic');
+		assert.equal(out.owner, 'agent');
+		assert.equal(out.single_root_cause, true);
+		assert.match(out.root_cause, /No initial render/);
+		assert.match(out.evidence, /auth-username/);
+		assert.match(out.likely_fix, /renderSignedOut/);
+	});
+
+	it('parses JSON wrapped in prose', () => {
+		const out = parseFailureAnalysis(`Here is my diagnosis:\n${valid}\nHope that helps.`);
+		assert.equal(out.category, 'agent-logic');
+		assert.equal(out.owner, 'agent');
+	});
+
+	it('parses a ```json fenced block', () => {
+		const out = parseFailureAnalysis('```json\n' + valid + '\n```');
+		assert.equal(out.category, 'agent-logic');
+	});
+
+	it('coerces unknown category/owner to null', () => {
+		const out = parseFailureAnalysis(JSON.stringify({ category: 'quantum', owner: 'aliens', root_cause: 'x' }));
+		assert.equal(out.category, null);
+		assert.equal(out.owner, null);
+		assert.equal(out.root_cause, 'x');
+	});
+
+	it('returns null on malformed JSON', () => {
+		assert.equal(parseFailureAnalysis('{not valid json at all'), null);
+		assert.equal(parseFailureAnalysis('just some prose, no braces'), null);
+	});
+
+	it('returns null when the object carries nothing usable', () => {
+		assert.equal(parseFailureAnalysis(JSON.stringify({ single_root_cause: true })), null);
+		assert.equal(parseFailureAnalysis(JSON.stringify({ category: 'nonsense' })), null);
+	});
+
+	it('is null-safe and never throws on junk input', () => {
+		assert.equal(parseFailureAnalysis(null), null);
+		assert.equal(parseFailureAnalysis(undefined), null);
+		assert.equal(parseFailureAnalysis(''), null);
+		assert.equal(parseFailureAnalysis('   '), null);
+		assert.equal(parseFailureAnalysis(42), null);
+		assert.equal(parseFailureAnalysis(JSON.stringify(['array', 'not', 'object'])), null);
+	});
+});
+
+describe('deterministicCellAnalysis(result, trace)', () => {
+	it('suppresses the model call for a harness_error cell (no gradeable app was produced)', () => {
+		const out = deterministicCellAnalysis({ klass: 'harness_error' }, null);
+		assert.ok(out, 'a harness_error cell must be deterministic (no model call)');
+		assert.match(out.analysis, /harness error/i);
+		assert.deepEqual(out.issues, []);
+	});
+
+	it('suppresses the model for ANY klass with no trace — records "undetermined", never a confabulated owner', () => {
+		// The wall-clock-timeout / teardown path emits no trace; an ungrounded model would guess a root
+		// cause/owner. Every non-harness klass must fall back to the deterministic undetermined note.
+		for (const klass of ['agent_fail', 'scored', null, undefined]) {
+			const out = deterministicCellAnalysis({ klass }, null);
+			assert.ok(out, `klass=${klass} with no trace must be deterministic`);
+			assert.equal(out.analysis, NO_TRACE_ANALYSIS);
+			assert.match(out.analysis, /undetermined/i);
+			assert.deepEqual(out.issues, []);
+		}
+	});
+
+	it('returns null (→ ask the model) only when a trace is present', () => {
+		assert.equal(deterministicCellAnalysis({ klass: 'scored' }, [{ name: 'bash' }]), null);
+		assert.equal(deterministicCellAnalysis({ klass: 'agent_fail' }, { spans: [] }), null);
+	});
+});
+
+describe('deterministicFailureAnalysis(result, trace) — the honesty guard for the DEEP failure pass (fix #5)', () => {
+	// The bug (kb-chat-agent): analyzeFailure() ran the model on a harness wall-clock-timeout cell that
+	// had a stray dev-log tail, and the ungrounded model FABRICATED category='build'/owner='agent'
+	// "build FAILED" — contradicting the deterministic klass_reason. This guard mirrors
+	// deterministicCellAnalysis: skip the model for harness_error / no-trace / failed_at 2-agent and emit
+	// an honest, deterministic answer instead.
+	it('harness_error → { failure_analysis: null } (an excluded cell emits no root-cause block)', () => {
+		assert.deepEqual(deterministicFailureAnalysis({ klass: 'harness_error' }, null), { failure_analysis: null });
+		// even with a non-empty trace present, a harness_error still emits nothing (it is excluded)
+		assert.deepEqual(deterministicFailureAnalysis({ klass: 'harness_error' }, { some: 'trace' }), {
+			failure_analysis: null,
+		});
+	});
+
+	it("failed_at 2-agent (generic timeout) → honest agent-owned 'timeout', NEVER a fabricated build failure", () => {
+		const { failure_analysis: fa } = deterministicFailureAnalysis(
+			{ failed_at: '2-agent', klass: 'agent_fail', klass_reason: 'agent_timeout', tokens_in: 500_000, duration_sec: 2010 },
+			null,
+		);
+		assert.equal(fa.owner, 'agent'); // owned by the agent under test, not fabricated onto the framework
+		assert.equal(fa.category, 'timeout'); // NOT 'build'
+		assert.notEqual(fa.category, 'build');
+		assert.match(fa.root_cause, /never ran/); // build/test never ran — honest, matches the classification
+		assert.match(fa.evidence, /tokens_in=500000/);
+		assert.equal(fa.single_root_cause, true);
+	});
+
+	it("failed_at 2-agent with klass_reason 'max_tokens' → category null + a token-budget root cause", () => {
+		const { failure_analysis: fa } = deterministicFailureAnalysis(
+			{ failed_at: '2-agent', klass: 'agent_fail', klass_reason: 'max_tokens', tokens_in: 1_082_766, duration_sec: 203 },
+			null,
+		);
+		assert.equal(fa.owner, 'agent');
+		assert.equal(fa.category, null); // max-tokens is not a 'timeout' category
+		assert.match(fa.root_cause, /token budget|MaxTokensError/i);
+		assert.match(fa.evidence, /reason=max_tokens/);
+	});
+
+	it('no trace (non-harness, non-2agent) → undetermined root cause, owner null (no confabulation)', () => {
+		const { failure_analysis: fa } = deterministicFailureAnalysis({ klass: 'scored', failed_at: '4-judge' }, null);
+		assert.equal(fa.owner, null);
+		assert.equal(fa.category, null);
+		assert.match(fa.root_cause, /undetermined/);
+	});
+
+	it('a scored cell WITH a trace → returns null (defer to the model — the guard does not fire)', () => {
+		assert.equal(deterministicFailureAnalysis({ klass: 'scored', failed_at: '4-judge' }, { some: 'trace' }), null);
+	});
+});
+
+describe('buildEvidenceObserved(result) — seeded pessimistic build defaults are NOT observations (fix #5)', () => {
+	// 0-init-result.mjs seeds build_succeeded=false / build_status='failed' / dev_server_started=false.
+	// When step 3 (build-and-test) is SKIPPED because the agent step didn't succeed, those seeds are
+	// never overwritten — so they are DEFAULTS, not observed failures, and must not be reported as a real
+	// "build FAILED / owner=agent".
+	it('false when the cell never reached grading (agent_fail / harness_error / a pre-grade failed_at)', () => {
+		assert.equal(buildEvidenceObserved({ failed_at: '2-agent' }), false);
+		assert.equal(buildEvidenceObserved({ klass: 'agent_fail' }), false);
+		assert.equal(buildEvidenceObserved({ klass: 'harness_error' }), false);
+		assert.equal(buildEvidenceObserved({ failed_at: '1-init' }), false); // a pre-grade harness step
+	});
+
+	it('true only when the cell actually reached grading (build evidence is real)', () => {
+		assert.equal(buildEvidenceObserved({ klass: 'scored', failed_at: '4-judge' }), true);
+		assert.equal(buildEvidenceObserved({ klass: 'scored' }), true);
+	});
+});
diff --git a/scripts/agent-bench/steps/lib/overview.mjs b/scripts/agent-bench/steps/lib/overview.mjs
index 09ad79a35..5f5e8f921 100644
--- a/scripts/agent-bench/steps/lib/overview.mjs
+++ b/scripts/agent-bench/steps/lib/overview.mjs
@@ -1,8 +1,9 @@
-// PR-vs-baseline overview + detailed-results helpers, kept as PURE functions (no fs/env/process) so
-// the diff math + coloring are unit-testable under `node --test`. summary.mjs does the I/O and calls
-// these to render two tables from the same rows: renderOverview (colors only) and renderDetailed
-// (colors + numbers). Baseline = commit-keyed aggregate (bench/runs/latest-main.json); no baseline →
-// absolute numbers, all 🆕. Composite/cost/score all come from lib/scoring.mjs.
+// PR-vs-baseline results helpers, kept as PURE functions (no fs/env/process) so the diff math +
+// coloring are unit-testable under `node --test`. summary.mjs does the I/O and calls these to render
+// ONE results table: renderDetailed. Each metric cell shows the CURRENT value plus a color for the
+// SIGNIFICANCE + DIRECTION of its change vs the baseline, with the signed delta shown inline.
+// Baseline = most recent main bench (bench/runs/latest-main.json); a missing baseline VALUE for a
+// field renders ⚪ + the current value + "(new)". Composite/cost/score all come from lib/scoring.mjs.
 import {
 	SCORE_PER_DOLLAR,
 	cellCost,
@@ -13,6 +14,7 @@ import {
 	testStats,
 	verdictOf,
 } from './scoring.mjs';
+import { COMMON_DIMENSIONS } from './scoring.mjs';
 
 // Stable cross-run identity for a cell (task + template, since a task may run on multiple templates).
 export const cellKey = (c) => `${c?.task ?? ''}/${c?.template ?? ''}`;
@@ -24,49 +26,46 @@ const numOrNull = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : null
 export const GREEN = '🟢';
 export const YELLOW = '🟡';
 export const RED = '🔴';
-export const NEW = '🆕';
+export const WHITE = '⚪'; // no baseline value for this field/cell — current value still shown, tagged "(new)"
 export const GONE = '🗑️';
 export const NONE = '—';
 
-// The single tunable separating 🟡 (worse within noise) from 🔴 (worse beyond): a 5% relative margin.
-export const MARGIN_PCT = 0.05;
-
-// Default boundary policy: worse-but-within-margin renders 🟡. Set true to treat within-margin as 🟢.
-export const MARGIN_IS_GREEN = false;
-
 // SCORE is higher-better iff scoring.mjs computes composite-per-$ (default); imported so one knob drives both.
 export const SCORE_HIGHER_BETTER = SCORE_PER_DOLLAR;
+const SCORE_DIR = SCORE_HIGHER_BETTER ? 'up' : 'down';
 
-/**
- * Absolute tolerance around a baseline below which a WORSE move stays 🟡. MARGIN_PCT of |baseline|;
- * floored to 1 for integer metrics so a ±1 nudge on a small integer reads as within-margin.
- * @param {number} baseline
- * @param {boolean} integer
- * @returns {number}
- */
-export function marginAbs(baseline, integer) {
-	const raw = Math.abs(baseline) * MARGIN_PCT;
-	return integer ? Math.max(1, Math.round(raw)) : raw;
-}
+// Per-metric significance thresholds for the delta coloring — the ONE place they live. A change within
+// ±threshold reads as 🟡 (noise, since N=1); beyond it, 🟢 (improved) / 🔴 (regressed) by direction.
+// Absolute units unless the key ends in `Pct` (then it's a fraction of |baseline|).
+export const DELTA_THRESHOLDS = {
+	composite: 5, // composite points — also the headline mean-delta band (deltaBall)
+	score: 5, // composite-per-$ points
+	judge: 0.3, // judge score (0-10) — applied per-dimension too
+	tests: 1, // test pass count (a ±1 nudge is noise)
+	costPct: 0.1, // cost: ±10% of the baseline cost
+	turns: 3, // cycle_count (lower-better): ±3 turns is within run-to-run noise at N=1
+	costAbs: 0.02, // absolute $ floor for the cost band — a near-zero baseline mustn't make pct·|bv|≈0 over-color
+};
 
 /**
- * Color one metric vs its baseline. Returns 🟢/🟡/🔴, or `null` when either side is missing.
- * `direction` 'up' = higher-better (tests/judge/score), 'down' = lower-better (cost/tokens). Equal = 🟢.
- * A worse move within {@link marginAbs} is 🟡 (or 🟢 when MARGIN_IS_GREEN); beyond it, 🔴.
+ * Color a metric by the SIGNIFICANCE + DIRECTION of its delta vs baseline (NOT absolute quality).
+ * `direction` 'up' = higher-is-better (tests/judge/score), 'down' = lower-is-better (cost/tokens).
+ * A change beyond `threshold` in the improving direction → 🟢; beyond it in the worsening direction →
+ * 🔴; within ±threshold (either way) → 🟡. Missing either side → ⚪.
  * @param {number|null|undefined} baseline
  * @param {number|null|undefined} pr
- * @param {{direction?: 'up'|'down', integer?: boolean}} [opts]
- * @returns {'🟢'|'🟡'|'🔴'|null}
+ * @param {number} threshold absolute tolerance in the metric's own units
+ * @param {'up'|'down'} direction
+ * @returns {'🟢'|'🟡'|'🔴'|'⚪'}
  */
-export function metricColor(baseline, pr, opts = {}) {
-	const direction = opts.direction ?? 'up';
-	const integer = opts.integer ?? false;
-	if (baseline === null || baseline === undefined || Number.isNaN(baseline)) return null;
-	if (pr === null || pr === undefined || Number.isNaN(pr)) return null;
-	const better = direction === 'up' ? pr >= baseline : pr <= baseline;
-	if (better) return GREEN;
-	const worseBy = direction === 'up' ? baseline - pr : pr - baseline; // > 0
-	return worseBy <= marginAbs(baseline, integer) ? (MARGIN_IS_GREEN ? GREEN : YELLOW) : RED;
+export function deltaColor(baseline, pr, threshold, direction = 'up') {
+	if (baseline === null || baseline === undefined || Number.isNaN(baseline)) return WHITE;
+	if (pr === null || pr === undefined || Number.isNaN(pr)) return WHITE;
+	const raw = pr - baseline; // signed change in the metric's units
+	const improvement = direction === 'up' ? raw : -raw; // > 0 means "better"
+	if (improvement > threshold) return GREEN;
+	if (improvement < -threshold) return RED;
+	return YELLOW;
 }
 
 // ── Cell scoring (shared with the mean/headline) ─────────────────────────────
@@ -96,8 +95,8 @@ export function meanComposite(cells) {
 /**
  * Build the compact schema-2 aggregate persisted to S3 as the commit-keyed baseline: per-cell
  * composite/verdict/klass, test counts, judge overall + per-dimension, tokens, $ cost, score-per-$,
- * plus mean + provenance. Artifact-unreadable cells dropped. Schema-1 baselines still diff (missing
- * fields render 🆕/— until a main bench records schema-2).
+ * plus mean + provenance. Artifact-unreadable cells dropped. An older baseline that lacks some
+ * per-metric fields still diffs per-field: fields it carries color, fields it lacks render ⚪ "(new)".
  * @param {object[]} cells finalized result.json cells for this run
  * @param {{sha?: string, base_sha?: string, pr_number?: string, event?: string, generated_at?: string}} [meta]
  * @returns {object}
@@ -132,6 +131,16 @@ export function buildAggregate(cells, meta = {}) {
 						c.judge_dimensions && typeof c.judge_dimensions === 'object' ? c.judge_dimensions : null,
 					tokens_in: numOrNull(c.tokens_in),
 					tokens_out: numOrNull(c.tokens_out),
+					// Newer per-cell signals persisted into the baseline: cycle_count feeds the Turns column;
+					// the token/cache/LOC/file counts are retained for historical baselines and offline
+					// analysis (the results table no longer renders them, but dropping them loses the series).
+					cycle_count: numOrNull(c.cycle_count),
+					cache_read_tokens: numOrNull(c.cache_read_tokens),
+					cache_write_tokens: numOrNull(c.cache_write_tokens),
+					loc_created: numOrNull(c.loc_created),
+					loc_edited: numOrNull(c.loc_edited),
+					files_created: numOrNull(c.files_created),
+					files_edited: numOrNull(c.files_edited),
 					cost,
 					score: scorePerDollar(comp, cost),
 					stop_reason: typeof c.stop_reason === 'string' && c.stop_reason ? c.stop_reason : null,
@@ -142,58 +151,47 @@ export function buildAggregate(cells, meta = {}) {
 }
 
 /**
- * Status ball for a COMPOSITE delta, reusing the report's 🟢/🟡/🔴 convention. ±5 near-equal band
- * (wide: N=1, so a small delta is as likely variance as signal): improved beyond it 🟢, regressed
- * beyond it 🔴, within it (flat / noise) 🟡. `''` for a missing/NaN delta.
+ * Status ball for a COMPOSITE delta (headline mean-delta), over the ±{@link DELTA_THRESHOLDS}.composite
+ * band: improved beyond it 🟢, regressed beyond it 🔴, within it (flat / noise) 🟡. `''` for a
+ * missing/NaN delta.
  * @param {number|null} delta
  * @returns {'🟢'|'🟡'|'🔴'|''}
  */
 export function deltaBall(delta) {
 	if (delta === null || delta === undefined || Number.isNaN(delta)) return '';
-	if (delta > 5) return GREEN;
-	if (delta < -5) return RED;
+	if (delta > DELTA_THRESHOLDS.composite) return GREEN;
+	if (delta < -DELTA_THRESHOLDS.composite) return RED;
 	return YELLOW;
 }
 
-// The metric fields the tables read, defaulted to null so a schema-1/partial baseline degrades to 🆕/—.
+// The per-cell metric fields the table reads, defaulted to null so any field an older baseline lacks
+// degrades to ⚪ "(new)" for THAT metric only (never forcing the whole row).
 function cellMetrics(c) {
 	return {
 		composite: numOrNull(c?.composite),
 		tests_passed: numOrNull(c?.tests_passed),
 		tests_denom: numOrNull(c?.tests_denom),
 		judge_score: numOrNull(c?.judge_score),
+		// Per-dimension judge scores (capped), rendered as the JUDGE cell's per-dim shorthand. Baselines
+		// that carry them color per-dim; older ones lacking them fall back to the overall judge score.
 		judge_dimensions: c?.judge_dimensions && typeof c.judge_dimensions === 'object' ? c.judge_dimensions : null,
-		tokens_in: numOrNull(c?.tokens_in),
-		tokens_out: numOrNull(c?.tokens_out),
+		cycle_count: numOrNull(c?.cycle_count),
 		cost: numOrNull(c?.cost),
 		score: numOrNull(c?.score),
 		stop_reason: typeof c?.stop_reason === 'string' && c.stop_reason ? c.stop_reason : null,
 	};
 }
 
-/**
- * True iff the baseline is schema 2+, i.e. carries the per-metric set the tables diff (test counts,
- * per-dimension judge, tokens, cost, score). A schema-1 baseline is treated as "no per-metric
- * baseline" — every column (Judge included) renders 🆕 — so coloring stays consistent; the composite
- * mean/delta still uses `composite` (present in schema 1) for the headline + analysis roll-up.
- * @param {object|null|undefined} baseline
- * @returns {boolean}
- */
-export function baselineHasMetrics(baseline) {
-	return !!baseline && (numOrNull(baseline.schema) ?? 0) >= 2;
-}
-
 /**
  * Diff the current run's aggregate against a baseline (or `null`). Cells matched by {@link cellKey}.
- * Each row carries the COMPOSITE delta plus `pr`/`base` metric objects the tables color. `base` is
- * populated only for a schema-2 baseline ({@link baselineHasMetrics}); against schema-1 every metric
- * renders 🆕. A baseline-only cell surfaces as a `removed` row.
+ * Each row carries the COMPOSITE delta plus `pr`/`base` metric objects the table colors. `base` is
+ * populated for ANY matched baseline cell (per-field: fields it lacks simply read null → ⚪ "(new)").
+ * A baseline-only cell surfaces as a `removed` row.
  * @param {object} current aggregate from {@link buildAggregate} for this run
  * @param {object|null} baseline aggregate fetched for the base commit, or null
- * @returns {{rows: object[], meanCurrent: number|null, meanBaseline: number|null, meanDelta: number|null, hasBaseline: boolean, perMetricBaseline: boolean}}
+ * @returns {{rows: object[], meanCurrent: number|null, meanBaseline: number|null, meanDelta: number|null, hasBaseline: boolean}}
  */
 export function diffAgainstBaseline(current, baseline) {
-	const perMetricBaseline = baselineHasMetrics(baseline);
 	const baseCells = new Map((baseline?.cells ?? []).map((c) => [cellKey(c), c]));
 	const curKeys = new Set((current?.cells ?? []).map((c) => cellKey(c)));
 	const rows = (current?.cells ?? []).map((c) => {
@@ -212,8 +210,8 @@ export function diffAgainstBaseline(current, baseline) {
 			hasBaselineCell: !!base,
 			removed: false,
 			pr: cellMetrics(c),
-			// Per-metric diff only against a schema-2 baseline; schema-1 → every column 🆕.
-			base: base && perMetricBaseline ? cellMetrics(base) : null,
+			// Per-field diff against whatever the baseline cell carries (missing fields → ⚪ "(new)").
+			base: base ? cellMetrics(base) : null,
 		};
 	});
 	// Baseline-only cells (removed/renamed) get their OWN row so a dropped cell stays visible.
@@ -229,182 +227,275 @@ export function diffAgainstBaseline(current, baseline) {
 			hasBaselineCell: true,
 			removed: true,
 			pr: null,
-			base: perMetricBaseline ? cellMetrics(base) : null,
+			base: cellMetrics(base),
 		});
 	}
 	rows.sort((a, b) => a.key.localeCompare(b.key));
 	const meanCurrent = numOrNull(current?.mean_composite);
 	const meanBaseline = baseline ? numOrNull(baseline.mean_composite) : null;
 	const meanDelta = meanCurrent !== null && meanBaseline !== null ? round1(meanCurrent - meanBaseline) : null;
-	return { rows, meanCurrent, meanBaseline, meanDelta, hasBaseline: !!baseline, perMetricBaseline };
+	return { rows, meanCurrent, meanBaseline, meanDelta, hasBaseline: !!baseline };
 }
 
 // ── Formatters ───────────────────────────────────────────────────────────────
 /** Compact token count: 3456 → "3.5K", 3000 → "3K", 800 → "800", null → "—". */
 export function humanTokens(n) {
 	if (n === null || n === undefined || Number.isNaN(n)) return NONE;
+	if (!Number.isFinite(n)) return NONE;
 	if (n < 1000) return String(Math.round(n));
-	return `${+(n / 1000).toFixed(1)}K`;
+	if (n < 1_000_000) return `${+(n / 1000).toFixed(1)}K`;
+	return `${+(n / 1_000_000).toFixed(1)}M`;
 }
 
 /** USD, trailing zeros trimmed: 3.5 → "$3.5", 2 → "$2", 1.05 → "$1.05", null → "—". */
 export function fmtCost(c) {
 	if (c === null || c === undefined || Number.isNaN(c)) return NONE;
+	if (!Number.isFinite(c)) return NONE;
 	return `$${+c.toFixed(2)}`;
 }
 
 /** Score-per-$ to 1 decimal: 66.7 → "66.7", null → "—". */
 export function fmtScore(s) {
 	if (s === null || s === undefined || Number.isNaN(s)) return NONE;
+	if (!Number.isFinite(s)) return NONE;
 	return String(+s.toFixed(1));
 }
 
-// Metric spec shared by both renderers so a metric is colored/directed identically in both tables.
-const SCORE_DIR = SCORE_HIGHER_BETTER ? 'up' : 'down';
+/** Judge score 0-10: integer as-is, else 1 decimal. 8 → "8", 7.5 → "7.5". */
+export function fmtJudge(j) {
+	if (j === null || j === undefined || Number.isNaN(j)) return NONE;
+	return Number.isInteger(j) ? String(j) : String(+j.toFixed(1));
+}
+
+// Signed-delta formatters for the delta suffix of each cell (no arrows — sign only).
+const signOf = (n) => (n > 0 ? '+' : n < 0 ? '-' : '');
+const signedInt = (d) => `${d > 0 ? '+' : ''}${Math.round(d)}`;
+const signed1 = (d) => {
+	const v = Math.round(d * 10) / 10;
+	return `${v > 0 ? '+' : ''}${v}`;
+};
+const signedCost = (d) => `${signOf(d)}${fmtCost(Math.abs(d))}`;
+const wholeNum = (v) => String(Math.round(v));
 
-// Glyph for the colors-only Overview: metric color, else 🆕 (scored now, no baseline) / — (nothing to diff).
-function overviewGlyph(baseVal, prVal, opts) {
-	if (prVal === null || prVal === undefined) return NONE;
-	const col = metricColor(baseVal, prVal, opts);
-	if (col) return col;
-	return baseVal === null || baseVal === undefined ? NEW : NONE;
+// ── Metric cells ──────────────────────────────────────────────────────────────
+// Scalar cells are ONE inline line: `<ball> <value> (<Δ>)`. The JUDGE cell is also one line — the overall
+// score followed by ` · ` and a per-dimension shorthand. The current value is ALWAYS shown; a metric the
+// baseline lacks reads `⚪ … (new)`; no current value at all → NONE.
+
+// Single-letter shorthand for the per-dimension judge scores, packed onto ONE line after the overall
+// judge score (e.g. `🟢 8 (+1) · F9(+2) S8 P7(-1) C8 B9`). Keeps the Judge column compact for a GFM
+// job-summary table where per-cell <details> collapse is unavailable.
+const DIM_SHORT = {
+	functional_completeness: 'F',
+	selector_contract: 'S',
+	persistence: 'P',
+	code_quality: 'C',
+	blocks_fidelity: 'B',
+};
+
+// One INLINE scalar cell: `<ball> <value> (<Δ>)`; `⚪ <value> (new)` with no baseline; NONE with no
+// current value. `threshold` may be a number or fn(baseline); `dir` sets the improving direction.
+function scalarCell(base, pr, { threshold, dir, fmtVal, fmtDelta }) {
+	const pv = numOrNull(pr);
+	if (pv === null) return NONE;
+	const value = fmtVal(pv);
+	const bv = numOrNull(base);
+	if (bv === null) return `${WHITE} ${value} (new)`;
+	const t = typeof threshold === 'function' ? threshold(bv) : threshold;
+	return `${deltaColor(bv, pv, t, dir)} ${value} (${fmtDelta(pv - bv)})`;
 }
 
-// "baseline -> pr" for the Detailed table, colored. `fmtVal` formats each side.
-function detailPair(baseVal, prVal, fmtVal, opts) {
-	if (prVal === null || prVal === undefined) return NONE;
-	const col = metricColor(baseVal, prVal, opts);
-	if (col === null) return `${NEW} ${fmtVal(prVal)}`; // scored now, no baseline
-	return `${col} ${fmtVal(baseVal)} -> ${fmtVal(prVal)}`;
+// TESTS: "passed/denom", colored by the pass COUNT (higher better, ±1 noise). denom 0 → NONE.
+function testsCell(base, pr) {
+	const pp = numOrNull(pr?.tests_passed);
+	const pd = numOrNull(pr?.tests_denom);
+	if (pp === null || pd === null || pd === 0) return NONE;
+	const value = `${pp}/${pd}`;
+	const bp = numOrNull(base?.tests_passed);
+	if (bp === null) return `${WHITE} ${value} (new)`;
+	return `${deltaColor(bp, pp, DELTA_THRESHOLDS.tests, 'up')} ${value} (${signedInt(pp - bp)})`;
 }
 
-// Union of judge-dimension keys across baseline + pr (pr first), stable order for the multi-line cell.
-function dimKeys(baseDims, prDims) {
-	const keys = [];
-	for (const k of Object.keys(prDims ?? {})) if (!keys.includes(k)) keys.push(k);
-	for (const k of Object.keys(baseDims ?? {})) if (!keys.includes(k)) keys.push(k);
-	return keys;
+// JUDGE: ONE compact line — the overall judge score `<ball> <score> (<Δ>)` then ` · ` and a
+// single-letter-per-dimension shorthand (F/S/P/C/B) from the CAPPED judge_dimensions, each with its
+// signed per-dim delta when the baseline carries that dimension (e.g. `🟢 8 (+1) · F9(+2) S8 P7(-1) C8 B9`).
+// A dimension the run lacks reads `<Letter>—`. Falls back to the overall score alone with no per-dimension
+// breakdown, or to the shorthand alone when the overall score is missing. Overall judge mean also
+// appears in the preword.
+function judgeCell(base, pr) {
+	const overall = scalarCell(base?.judge_score, pr?.judge_score, {
+		threshold: DELTA_THRESHOLDS.judge,
+		dir: 'up',
+		fmtVal: fmtJudge,
+		fmtDelta: signed1,
+	});
+	const pd = pr?.judge_dimensions;
+	if (!pd || typeof pd !== 'object') return overall;
+	const bd = base?.judge_dimensions && typeof base.judge_dimensions === 'object' ? base.judge_dimensions : null;
+	const shorthand = COMMON_DIMENSIONS.map((dim) => {
+		const letter = DIM_SHORT[dim] ?? dim;
+		const pv = numOrNull(pd[dim]);
+		if (pv === null) return `${letter}${NONE}`;
+		const bv = bd ? numOrNull(bd[dim]) : null;
+		return bv === null ? `${letter}${fmtJudge(pv)}` : `${letter}${fmtJudge(pv)}(${signed1(pv - bv)})`;
+	}).join(' ');
+	if (overall === NONE) return shorthand;
+	return `${overall} · ${shorthand}`;
 }
 
-// Multi-line judge cell for the Detailed table: one "<color> <dim> base -> pr" line per dim, <br>-joined.
-function judgeDetailCell(base, pr) {
-	const baseDims = base?.judge_dimensions ?? null;
-	const prDims = pr?.judge_dimensions ?? null;
-	const keys = dimKeys(baseDims, prDims);
-	if (keys.length === 0) return NONE;
-	const lines = keys.map((k) => {
-		const bv = baseDims ? numOrNull(baseDims[k]) : null;
-		const pv = prDims ? numOrNull(prDims[k]) : null;
-		if (pv === null) return `${NONE} ${k} ${bv ?? NONE} -> ${NONE}`;
-		const col = metricColor(bv, pv, { direction: 'up', integer: true });
-		if (col === null) return `${NEW} ${k} ${pv}`;
-		return `${col} ${k} ${bv} -> ${pv}`;
+// COST: $ builder spend (lower better, ±10% of baseline noise).
+function costCell(base, pr) {
+	return scalarCell(base?.cost, pr?.cost, {
+		threshold: (bv) => Math.max(DELTA_THRESHOLDS.costAbs, DELTA_THRESHOLDS.costPct * Math.abs(bv)),
+		dir: 'down',
+		fmtVal: fmtCost,
+		fmtDelta: signedCost,
 	});
-	return lines.join('<br>');
 }
 
-// Per-row base→PR COMPOSITE delta as a status ball: 🟢/🟡/🔴 over the same ±5-point band as the
-// headline; 🆕 for a scored cell with no baseline counterpart; — for an unscored/undiffable cell.
-function overviewDeltaGlyph(r) {
-	if (r.delta !== null && r.delta !== undefined) return deltaBall(r.delta);
-	return r.current !== null && r.current !== undefined ? NEW : NONE;
+// TURNS: agent cycle_count (lower better, ±3 noise).
+function turnsCell(base, pr) {
+	return scalarCell(base?.cycle_count, pr?.cycle_count, {
+		threshold: DELTA_THRESHOLDS.turns,
+		dir: 'down',
+		fmtVal: wholeNum,
+		fmtDelta: signedInt,
+	});
 }
 
-// Detailed variant: the ball plus the signed numeric delta (e.g. "🟢 +12.4"); 🆕 / — like above.
-function detailDeltaCell(r) {
-	if (r.delta !== null && r.delta !== undefined) {
-		return `${deltaBall(r.delta)} ${r.delta > 0 ? '+' : ''}${r.delta.toFixed(1)}`;
-	}
-	return r.current !== null && r.current !== undefined ? NEW : NONE;
+// SCORE: composite-per-$ (direction from SCORE_HIGHER_BETTER, ±5 noise).
+function scoreCell(base, pr) {
+	return scalarCell(base?.score, pr?.score, {
+		threshold: DELTA_THRESHOLDS.score,
+		dir: SCORE_DIR,
+		fmtVal: fmtScore,
+		fmtDelta: signed1,
+	});
 }
 
-// ── Render: Overview (colors only) ───────────────────────────────────────────
+// The metric columns after Task|Template, in render order. Kept as one list so the header, the
+// separator, the per-row cells, and the removed-row padding can't drift out of sync.
+const METRIC_COLUMNS = ['Tests', 'Judge', 'Cost', 'Turns', 'Score', 'Stop reason'];
+
+// ── Render: single results table ──────────────────────────────────────────────
 /**
- * Colors-only overview: TASK | TEMPLATE | TESTS | JUDGE | COST | TOKENS (in/out) | SCORE | Δ VS BASE,
- * one glyph per metric vs baseline (🆕 new, — nothing to diff). The trailing Δ vs base column is the
- * cell's COMPOSITE change vs the same cell on the baseline as a {@link deltaBall}. See
- * {@link renderDetailed} for numbers.
+ * The one results table: TASK | TEMPLATE | TESTS | JUDGE | COST | TURNS | SCORE | STOP REASON. Scalar
+ * cells (tests/cost/turns/score) are inline `<ball> <value> (<Δ>)`; JUDGE is one line — the overall
+ * score plus a per-dimension shorthand (F/S/P/C/B). ⚪ "(new)" where the baseline lacks a metric. Every
+ * row emits ALL columns.
  * @param {ReturnType<typeof diffAgainstBaseline>} diff
  * @param {{heading?: string, note?: string}} [opts]
  * @returns {string[]}
  */
-export function renderOverview(diff, opts = {}) {
-	const lines = [opts.heading ?? '## Overview', ''];
+export function renderDetailed(diff, opts = {}) {
+	const lines = [];
+	if (opts.heading) lines.push(opts.heading, '');
 	if (opts.note) lines.push(opts.note, '');
 	lines.push(
-		'| Task | Template | Tests | Judge | Cost | Tokens (in/out) | Score | Δ vs base |',
-		'|------|----------|:-----:|:-----:|:----:|:---------------:|:-----:|:---------:|',
+		`| Task | Template | ${METRIC_COLUMNS.join(' | ')} |`,
+		`|${Array(2 + METRIC_COLUMNS.length).fill('---').join('|')}|`,
 	);
+	const cell = (v) => (typeof v === 'string' && v.trim() ? v : NONE);
 	for (const r of diff.rows) {
 		if (r.removed) {
-			lines.push(`| ${r.task ?? NONE} | ${r.template ?? NONE} | ${GONE} | ${GONE} | ${GONE} | ${GONE} | ${GONE} | ${GONE} |`);
+			const was =
+				r.base && r.base.tests_passed != null && r.base.tests_denom != null
+					? ` (was ${r.base.tests_passed}/${r.base.tests_denom})`
+					: '';
+			// Tests column carries the 🗑️ marker; the remaining metric columns pad with NONE so the
+			// removed row keeps the full column count.
+			const pad = Array(METRIC_COLUMNS.length - 1).fill(NONE).join(' | ');
+			lines.push(`| ${r.task ?? NONE} | ${r.template ?? NONE} | ${GONE} removed${was} | ${pad} |`);
 			continue;
 		}
 		const b = r.base;
 		const p = r.pr ?? {};
-		const tests = overviewGlyph(b?.tests_passed, p.tests_passed, { direction: 'up', integer: true });
-		const judge = overviewGlyph(b?.judge_score, p.judge_score, { direction: 'up' });
-		const cost = overviewGlyph(b?.cost, p.cost, { direction: 'down' });
-		const tin = overviewGlyph(b?.tokens_in, p.tokens_in, { direction: 'down' });
-		const tout = overviewGlyph(b?.tokens_out, p.tokens_out, { direction: 'down' });
-		const score = overviewGlyph(b?.score, p.score, { direction: SCORE_DIR });
-		const vsBase = overviewDeltaGlyph(r);
-		lines.push(
-			`| ${r.task ?? NONE} | ${r.template ?? NONE} | ${tests} | ${judge} | ${cost} | ${tin}/${tout} | ${score} | ${vsBase} |`,
-		);
+		// Coerce any empty metric cell to NONE so a crashed/null-metric cell can never drop a column and
+		// misalign the row (the all-columns invariant, guarded in the tests).
+		const cells = [
+			testsCell(b, p),
+			judgeCell(b, p),
+			costCell(b, p),
+			turnsCell(b, p),
+			scoreCell(b, p),
+			p.stop_reason || NONE,
+		].map(cell);
+		lines.push(`| ${r.task ?? NONE} | ${r.template ?? NONE} | ${cells.join(' | ')} |`);
 	}
 	lines.push('');
 	return lines;
 }
 
-// ── Render: Detailed results (numbers) ───────────────────────────────────────
+// ── Preword: aggregated run summary (bullets above the table) ───────────────────
 /**
- * The Overview rows widened WITH numbers: TESTS (🟡 10/14 -> 9/14) | JUDGE (one colored dim per line)
- * | COST | TOKENS (in/out) | SCORE (base -> pr) | Δ VS BASE (ball + signed composite delta) | STOP
- * REASON. Colors/directions match the Overview.
+ * Bulleted headline summary rendered ABOVE the table: mean composite + Δ vs main (with the judge mean),
+ * the verdict tally, run totals (cost / tokens / turns), the biggest composite movers vs the baseline,
+ * and the run config. Pure — derives everything from the diff + aggregate + a small opts bag.
  * @param {ReturnType<typeof diffAgainstBaseline>} diff
- * @param {{heading?: string, note?: string}} [opts]
- * @returns {string[]}
+ * @param {ReturnType<typeof buildAggregate>} aggregate
+ * @param {{builderModel?: string, judgeModel?: string, baselineSha?: string}} [opts]
+ * @returns {string[]} markdown bullet lines (each prefixed with "- ")
  */
-export function renderDetailed(diff, opts = {}) {
-	const lines = [opts.heading ?? '## Detailed results', ''];
-	if (opts.note) lines.push(opts.note, '');
-	lines.push(
-		'| Task | Template | Tests | Judge | Cost | Tokens | Score | Δ vs base | Stop reason |',
-		'|------|----------|-------|-------|------|--------|-------|-----------|-------------|',
+export function renderPreword(diff, aggregate, opts = {}) {
+	const cells = aggregate?.cells ?? [];
+	const bullets = [];
+
+	// Mean composite + Δ vs main, with the overall judge mean folded in.
+	const mean = numOrNull(aggregate?.mean_composite);
+	const meanStr = mean === null ? NONE : mean.toFixed(1);
+	const deltaStr =
+		diff?.hasBaseline && diff.meanDelta !== null
+			? ` — ${deltaBall(diff.meanDelta)} ${diff.meanDelta > 0 ? '+' : ''}${diff.meanDelta.toFixed(1)} vs \`main\``
+			: ' — no `main` baseline yet';
+	const judged = cells.filter((c) => c.klass !== 'harness_error' && numOrNull(c.judge_score) !== null);
+	const judgeMean = judged.length ? judged.reduce((a, c) => a + c.judge_score, 0) / judged.length : null;
+	const judgeStr = judgeMean !== null ? ` · judge mean ${judgeMean.toFixed(2)}/10` : '';
+	bullets.push(
+		`**Mean composite ${meanStr}/100** across ${aggregate?.scored_cells ?? 0} scored cell(s)${deltaStr}${judgeStr}.`,
 	);
-	for (const r of diff.rows) {
-		if (r.removed) {
-			const was = r.base && r.base.tests_passed !== null ? ` (was ${r.base.tests_passed}/${r.base.tests_denom})` : '';
-			lines.push(`| ${r.task ?? NONE} | ${r.template ?? NONE} | ${GONE} removed${was} | ${NONE} | ${NONE} | ${NONE} | ${NONE} | ${GONE} | ${NONE} |`);
-			continue;
-		}
-		const b = r.base;
-		const p = r.pr ?? {};
-		// TESTS is "passed/denom" colored by the passed COUNT, built explicitly rather than via detailPair.
-		const fmtTests = (m) => `${m.tests_passed ?? NONE}/${m.tests_denom ?? NONE}`;
-		let testsCell;
-		if (p.tests_passed === null || p.tests_passed === undefined || p.tests_denom === 0) {
-			testsCell = NONE;
-		} else if (!b || b.tests_passed === null) {
-			testsCell = `${NEW} ${fmtTests(p)}`;
-		} else {
-			const col = metricColor(b.tests_passed, p.tests_passed, { direction: 'up', integer: true });
-			testsCell = `${col} ${fmtTests(b)} -> ${fmtTests(p)}`;
+
+	// Verdict tally (harness_error read off klass; the rest off the stored verdict).
+	const v = { pass: 0, partial: 0, fail: 0, harness_error: 0, unknown: 0 };
+	for (const c of cells) {
+		const verd = c.klass === 'harness_error' ? 'harness_error' : (c.verdict ?? 'unknown');
+		v[verd in v ? verd : 'unknown'] += 1;
+	}
+	bullets.push(
+		`**Verdicts:** ${v.pass} pass · ${v.partial} partial · ${v.fail} fail · ${v.harness_error} harness_error${v.unknown ? ` · ${v.unknown} unknown` : ''}.`,
+	);
+
+	// Run totals.
+	const anyOf = (k) => cells.some((c) => numOrNull(c[k]) !== null);
+	const sumOf = (k) => cells.reduce((a, c) => a + (numOrNull(c[k]) ?? 0), 0);
+	const totalsParts = [
+		`cost ${anyOf('cost') ? fmtCost(sumOf('cost')) : NONE}`,
+		`tokens ${
+			anyOf('tokens_in') || anyOf('tokens_out')
+				? `${humanTokens(sumOf('tokens_in'))} in / ${humanTokens(sumOf('tokens_out'))} out`
+				: NONE
+		}`,
+	];
+	if (anyOf('cycle_count')) totalsParts.push(`${Math.round(sumOf('cycle_count'))} turns`);
+	bullets.push(`**Totals:** ${totalsParts.join(' · ')}.`);
+
+	// Biggest composite movers vs the baseline (only when a baseline exists AND there are deltas).
+	if (diff?.hasBaseline) {
+		const moved = diff.rows.filter((r) => !r.removed && numOrNull(r.delta) !== null && r.delta !== 0);
+		if (moved.length > 0) {
+			const fmtMove = (r) => `\`${r.task}/${r.template}\` (${r.delta > 0 ? '+' : ''}${r.delta})`;
+			const gains = moved.filter((r) => r.delta > 0).sort((a, b) => b.delta - a.delta).slice(0, 3);
+			const drops = moved.filter((r) => r.delta < 0).sort((a, b) => a.delta - b.delta).slice(0, 3);
+			bullets.push(`**Biggest gains:** ${gains.length ? gains.map(fmtMove).join(', ') : 'none'}.`);
+			bullets.push(`**Biggest drops:** ${drops.length ? drops.map(fmtMove).join(', ') : 'none'}.`);
 		}
-		const judge = judgeDetailCell(b, p);
-		const cost = detailPair(b?.cost ?? null, p.cost, fmtCost, { direction: 'down' });
-		const tinCell = detailPair(b?.tokens_in ?? null, p.tokens_in, humanTokens, { direction: 'down' });
-		const toutCell = detailPair(b?.tokens_out ?? null, p.tokens_out, humanTokens, { direction: 'down' });
-		const tokens =
-			p.tokens_in === null && p.tokens_out === null ? NONE : `in ${tinCell}<br>out ${toutCell}`;
-		const score = detailPair(b?.score ?? null, p.score, fmtScore, { direction: SCORE_DIR });
-		const vsBase = detailDeltaCell(r);
-		const stop = p.stop_reason || NONE;
-		lines.push(
-			`| ${r.task ?? NONE} | ${r.template ?? NONE} | ${testsCell} | ${judge} | ${cost} | ${tokens} | ${score} | ${vsBase} | ${stop} |`,
-		);
 	}
-	lines.push('');
-	return lines;
+
+	// Run config.
+	const cfgParts = [];
+	if (opts.builderModel) cfgParts.push(`builder \`${opts.builderModel}\``);
+	if (opts.judgeModel) cfgParts.push(`judge \`${opts.judgeModel}\``);
+	if (opts.baselineSha) cfgParts.push(`baseline \`${String(opts.baselineSha).slice(0, 7)}\``);
+	if (cfgParts.length) bullets.push(`**Config:** ${cfgParts.join(' · ')}.`);
+
+	return bullets.map((b) => `- ${b}`);
 }
diff --git a/scripts/agent-bench/steps/lib/overview.test.mjs b/scripts/agent-bench/steps/lib/overview.test.mjs
index 53bd206ad..5ae388ee9 100644
--- a/scripts/agent-bench/steps/lib/overview.test.mjs
+++ b/scripts/agent-bench/steps/lib/overview.test.mjs
@@ -1,24 +1,23 @@
-// Unit tests for the PR-vs-baseline report helpers (overview.mjs): the diff math, margin/color engine,
-// formatters, and the two render modes (Overview = colors, Detailed = numbers). Run under bare `node --test`.
+// Unit tests for the PR-vs-baseline report helpers (overview.mjs): the diff math, the delta color
+// engine, formatters, and the single results table (renderDetailed) + preword. Run under bare `node --test`.
 
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
 import {
-	MARGIN_PCT,
-	baselineHasMetrics,
+	DELTA_THRESHOLDS,
 	buildAggregate,
 	cellComposite,
 	cellKey,
 	deltaBall,
+	deltaColor,
 	diffAgainstBaseline,
 	fmtCost,
+	fmtJudge,
 	fmtScore,
 	humanTokens,
-	marginAbs,
 	meanComposite,
-	metricColor,
 	renderDetailed,
-	renderOverview,
+	renderPreword,
 } from './overview.mjs';
 
 const DIMS = { functional_completeness: 8, selector_contract: 8, persistence: 8, code_quality: 8, blocks_fidelity: 8 };
@@ -29,6 +28,9 @@ const PARTIAL = { task: 'file-gallery', template: 'bare', tests_passed: 3, tests
 const AGENT_FAIL = { task: 'sql-kb', template: 'nextjs', klass: 'agent_fail', tests_passed: 0, tests_failed: 0 }; // comp 0 · no tokens → cost/score null
 const HARNESS = { task: 'oidc-dsql', template: 'react', klass: 'harness_error' }; // excluded → null
 const UNKNOWN = { task: 'email-digest', template: 'demo', tests_passed: 0, tests_failed: 0 }; // gradeable, no tests → null
+// A dead/crashed dev-server (empty APP_BASE_URL): dev_server_status='dead' → klass dead_server. A REAL
+// fail — composite 0, INCLUDED in the mean (contrast UNKNOWN, gradeable-but-no-tests → excluded).
+const DEAD = { task: 'sql-notes', template: 'nextjs', klass: 'dead_server', dev_server_status: 'dead', tests_passed: 0, tests_failed: 0 }; // comp 0 · INCLUDED
 
 describe('cellComposite(r)', () => {
 	it('returns the shared composite for a scored cell', () => {
@@ -40,6 +42,9 @@ describe('cellComposite(r)', () => {
 		assert.equal(cellComposite(HARNESS), null);
 		assert.equal(cellComposite(UNKNOWN), null);
 	});
+	it('a dead_server (crashed dev-server) is scored 0 and INCLUDED — NOT null/excluded like unknown', () => {
+		assert.equal(cellComposite(DEAD), 0);
+	});
 });
 
 describe('meanComposite(cells)', () => {
@@ -47,50 +52,57 @@ describe('meanComposite(cells)', () => {
 		assert.equal(meanComposite([PASS, PARTIAL, AGENT_FAIL, HARNESS, UNKNOWN]), 52.3); // (92+65+0)/3
 		assert.equal(meanComposite([PASS, PARTIAL]), 78.5);
 	});
+	it('a dead_server counts toward the mean as composite 0 (the crash HURTS the score, not excluded)', () => {
+		assert.equal(meanComposite([PASS, PARTIAL, DEAD]), 52.3); // (92+65+0)/3 — DEAD INCLUDED as 0
+		// Contrast: swapping DEAD for an UNKNOWN (gradeable, no dev_server_status) EXCLUDES it → 78.5.
+		assert.equal(meanComposite([PASS, PARTIAL, UNKNOWN]), 78.5);
+	});
 	it('is null when no cell was scored', () => {
 		assert.equal(meanComposite([HARNESS, UNKNOWN]), null);
 		assert.equal(meanComposite([]), null);
 	});
 });
 
-describe('marginAbs(baseline, integer) — one tunable, MARGIN_PCT', () => {
-	it('MARGIN_PCT is the documented 5%', () => {
-		assert.equal(MARGIN_PCT, 0.05);
-	});
-	it('integer metrics floor the margin to 1 (a ±1 nudge is always within-margin)', () => {
-		assert.equal(marginAbs(8, true), 1); // round(0.4)=0 → floored to 1
-		assert.equal(marginAbs(11, true), 1); // round(0.55)=1
-		assert.equal(marginAbs(40, true), 2); // round(2.0)=2
-		assert.equal(marginAbs(0, true), 1);
-	});
-	it('continuous metrics use exact 5% of |baseline| (no floor)', () => {
-		assert.equal(marginAbs(100, false), 5);
-		assert.equal(marginAbs(2, false), 0.1);
-		assert.equal(marginAbs(0, false), 0);
+describe('DELTA_THRESHOLDS — the one place the bands live', () => {
+	it('holds the documented per-metric thresholds', () => {
+		assert.equal(DELTA_THRESHOLDS.composite, 5);
+		assert.equal(DELTA_THRESHOLDS.score, 5);
+		assert.equal(DELTA_THRESHOLDS.judge, 0.3);
+		assert.equal(DELTA_THRESHOLDS.tests, 1);
+		assert.equal(DELTA_THRESHOLDS.costPct, 0.1);
+		assert.equal(DELTA_THRESHOLDS.turns, 3);
+		assert.equal(DELTA_THRESHOLDS.costAbs, 0.02);
+	});
+	it('LOC, Files & token thresholds are GONE with their removed columns', () => {
+		assert.equal('loc' in DELTA_THRESHOLDS, false);
+		assert.equal('files' in DELTA_THRESHOLDS, false);
+		assert.equal('tokensPct' in DELTA_THRESHOLDS, false);
+		assert.equal('tokensAbs' in DELTA_THRESHOLDS, false);
+		assert.equal('cacheReadPct' in DELTA_THRESHOLDS, false);
+		assert.equal('cacheWritePct' in DELTA_THRESHOLDS, false);
 	});
 });
 
-describe('metricColor(baseline, pr, {direction, integer})', () => {
-	it('equal or better is 🟢 (both directions)', () => {
-		assert.equal(metricColor(8, 8, { direction: 'up' }), '🟢');
-		assert.equal(metricColor(8, 9, { direction: 'up' }), '🟢');
-		assert.equal(metricColor(2, 2, { direction: 'down' }), '🟢');
-		assert.equal(metricColor(2, 1, { direction: 'down' }), '🟢');
-	});
-	it('worse within the (integer) margin is 🟡, beyond is 🔴 — matches the judge-dim example', () => {
-		assert.equal(metricColor(8, 7, { direction: 'up', integer: true }), '🟡'); // 8→7 within 1
-		assert.equal(metricColor(9, 5, { direction: 'up', integer: true }), '🔴'); // 9→5 beyond 1
-		assert.equal(metricColor(11, 10, { direction: 'up', integer: true }), '🟡'); // 11→10
-		assert.equal(metricColor(11, 9, { direction: 'up', integer: true }), '🔴'); // 11→9
-	});
-	it('worse within/beyond the (continuous) margin for a lower-is-better metric (cost/tokens)', () => {
-		assert.equal(metricColor(100, 103, { direction: 'down' }), '🟡'); // +3 within 5
-		assert.equal(metricColor(100, 110, { direction: 'down' }), '🔴'); // +10 beyond 5
-	});
-	it('null when either side is missing (caller renders 🆕 / —)', () => {
-		assert.equal(metricColor(null, 5, { direction: 'up' }), null);
-		assert.equal(metricColor(5, null, { direction: 'up' }), null);
-		assert.equal(metricColor(undefined, undefined), null);
+describe('deltaColor(baseline, pr, threshold, direction) — significance + direction of the change', () => {
+	it('higher-is-better: 🟢 beyond threshold up, 🔴 beyond threshold down, 🟡 within (either way)', () => {
+		assert.equal(deltaColor(5, 11, 5, 'up'), '🟢'); // +6 beyond +5 → improved
+		assert.equal(deltaColor(11, 5, 5, 'up'), '🔴'); // -6 beyond -5 → regressed
+		assert.equal(deltaColor(10, 13, 5, 'up'), '🟡'); // +3 within → noise
+		assert.equal(deltaColor(10, 10, 5, 'up'), '🟡'); // flat → noise
+	});
+	it('lower-is-better (cost/tokens): a DROP is 🟢, a RISE is 🔴', () => {
+		assert.equal(deltaColor(100, 80, 5, 'down'), '🟢'); // -20 → improved (cheaper)
+		assert.equal(deltaColor(100, 120, 5, 'down'), '🔴'); // +20 → regressed (pricier)
+		assert.equal(deltaColor(100, 103, 5, 'down'), '🟡'); // +3 within → noise
+	});
+	it('the threshold boundary is inclusive-of-noise (exactly ±threshold is 🟡, not 🟢/🔴)', () => {
+		assert.equal(deltaColor(0, 5, 5, 'up'), '🟡'); // exactly +threshold
+		assert.equal(deltaColor(0, -5, 5, 'up'), '🟡'); // exactly -threshold
+	});
+	it('⚪ when either side is missing (no baseline value for the field)', () => {
+		assert.equal(deltaColor(null, 5, 5, 'up'), '⚪');
+		assert.equal(deltaColor(5, null, 5, 'up'), '⚪');
+		assert.equal(deltaColor(undefined, undefined, 5, 'up'), '⚪');
 	});
 });
 
@@ -99,6 +111,8 @@ describe('formatters', () => {
 		assert.equal(humanTokens(3456), '3.5K');
 		assert.equal(humanTokens(3000), '3K');
 		assert.equal(humanTokens(800), '800');
+		assert.equal(humanTokens(2396400), '2.4M');
+		assert.equal(humanTokens(13835800), '13.8M');
 		assert.equal(humanTokens(null), '—');
 	});
 	it('fmtCost trims trailing zeros', () => {
@@ -112,6 +126,18 @@ describe('formatters', () => {
 		assert.equal(fmtScore(108.3), '108.3');
 		assert.equal(fmtScore(null), '—');
 	});
+	it('fmtJudge: integer as-is, else 1 decimal', () => {
+		assert.equal(fmtJudge(8), '8');
+		assert.equal(fmtJudge(7.5), '7.5');
+		assert.equal(fmtJudge(null), '—');
+	});
+	it('non-finite numbers render as the em-dash (never Infinity / NaN leaking into the table)', () => {
+		assert.equal(humanTokens(Infinity), '—');
+		assert.equal(humanTokens(-Infinity), '—');
+		assert.equal(humanTokens(NaN), '—');
+		assert.equal(fmtCost(Infinity), '—');
+		assert.equal(fmtScore(Infinity), '—');
+	});
 });
 
 describe('buildAggregate(cells, meta) — schema 2', () => {
@@ -144,18 +170,45 @@ describe('buildAggregate(cells, meta) — schema 2', () => {
 		assert.equal(p.stop_reason, 'end_turn');
 		assert.deepEqual(p.judge_dimensions, DIMS);
 	});
+	it('persists the newer per-cell signals (cycle_count, cache, loc, files) for future baselines', () => {
+		const full = buildAggregate([{ ...PASS, cycle_count: 22, cache_read_tokens: 150000, cache_write_tokens: 12000, loc_created: 300, loc_edited: 40, files_created: 8, files_edited: 3 }], {});
+		const c = full.cells[0];
+		assert.equal(c.cycle_count, 22);
+		assert.equal(c.cache_read_tokens, 150000);
+		assert.equal(c.cache_write_tokens, 12000);
+		assert.equal(c.loc_created, 300);
+		assert.equal(c.loc_edited, 40);
+		assert.equal(c.files_created, 8);
+		assert.equal(c.files_edited, 3);
+	});
+	it('newer signals are null when the cell lacks them (older artifacts)', () => {
+		const c = byKey['auth-notes/demo'];
+		assert.equal(c.cycle_count, null);
+		assert.equal(c.cache_read_tokens, null);
+		assert.equal(c.loc_created, null);
+		assert.equal(c.files_created, null);
+	});
 	it('a cell with no tokens has cost + score null (never a fake $0)', () => {
 		assert.equal(byKey['sql-kb/nextjs'].composite, 0);
 		assert.equal(byKey['sql-kb/nextjs'].cost, null);
 		assert.equal(byKey['sql-kb/nextjs'].score, null);
 	});
+	it('a dead_server cell is INCLUDED: verdict fail, composite 0, counted in scored_cells', () => {
+		const deadAgg = buildAggregate([PASS, DEAD], { sha: 'dead01' });
+		assert.equal(deadAgg.scored_cells, 2); // PASS + DEAD both counted
+		assert.equal(deadAgg.mean_composite, 46); // (92 + 0)/2 — DEAD drags the mean down
+		const d = deadAgg.cells.find((c) => c.task === 'sql-notes');
+		assert.equal(d.klass, 'dead_server');
+		assert.equal(d.verdict, 'fail'); // NOT 'unknown'
+		assert.equal(d.composite, 0);
+	});
 	it('cells are sorted by task/template', () => {
 		const keys = agg.cells.map(cellKey);
 		assert.deepEqual(keys, [...keys].sort((a, b) => a.localeCompare(b)));
 	});
 });
 
-describe('deltaBall(delta)', () => {
+describe('deltaBall(delta) — headline composite mean-delta', () => {
 	it('🟢 / 🔴 beyond ±5, 🟡 within (inclusive), empty for null', () => {
 		assert.equal(deltaBall(5.2), '🟢');
 		assert.equal(deltaBall(-6.4), '🔴');
@@ -165,13 +218,17 @@ describe('deltaBall(delta)', () => {
 	});
 });
 
+function round1Delta(a, b) {
+	return Math.round((a - b) * 10) / 10;
+}
+
 describe('diffAgainstBaseline(current, baseline)', () => {
 	const current = buildAggregate([PASS, PARTIAL, { task: 'brand-new', template: 'demo', tests_passed: 2, tests_failed: 0, judge_score: 10, tokens_in: 50000, tokens_out: 5000 }], {});
 	const baseline = {
 		schema: 2,
 		mean_composite: 70,
 		cells: [
-			{ task: 'auth-notes', template: 'demo', composite: 80, judge_score: 7, tests_passed: 4, tests_denom: 4, judge_dimensions: { functional_completeness: 9, selector_contract: 8, persistence: 8, code_quality: 7, blocks_fidelity: 8 }, cost: 2.0, score: 40, tokens_in: 190000, tokens_out: 28000 },
+			{ task: 'auth-notes', template: 'demo', composite: 80, judge_score: 7, tests_passed: 4, tests_denom: 4, cost: 2.0, score: 40, tokens_in: 190000, tokens_out: 28000 },
 			{ task: 'file-gallery', template: 'bare', composite: 70, tests_passed: 3, tests_denom: 4, cost: 0.6, score: 116.7, tokens_in: 100000, tokens_out: 20000 },
 			{ task: 'removed', template: 'x', composite: 50, tests_passed: 5, tests_denom: 5 },
 		],
@@ -184,13 +241,12 @@ describe('diffAgainstBaseline(current, baseline)', () => {
 		assert.equal(byKey['file-gallery/bare'].delta, -5); // 65 - 70
 		assert.equal(diff.meanDelta, round1Delta(diff.meanCurrent, 70));
 	});
-	it('attaches pr + base metric objects for the tables', () => {
+	it('attaches pr + base metric objects for the table', () => {
 		const r = byKey['auth-notes/demo'];
 		assert.equal(r.pr.cost, 1.75);
 		assert.equal(r.base.cost, 2.0);
 		assert.equal(r.pr.tests_passed, 4);
 		assert.equal(r.base.judge_score, 7);
-		assert.deepEqual(r.base.judge_dimensions.functional_completeness, 9);
 	});
 	it('a new cell has base=null; a removed cell surfaces with pr=null', () => {
 		assert.equal(byKey['brand-new/demo'].base, null);
@@ -205,70 +261,139 @@ describe('diffAgainstBaseline(current, baseline)', () => {
 		assert.equal(noBase.hasBaseline, false);
 		assert.equal(noBase.rows.every((r) => r.base === null), true);
 	});
+	it('attaches base PER-FIELD: an older baseline missing some fields still attaches (fields read null)', () => {
+		const partialBase = {
+			mean_composite: 80,
+			cells: [{ task: 'auth-notes', template: 'demo', composite: 80, judge_score: 7, test_rate: 1 }], // no tests_passed/cost/tokens/score
+		};
+		const r = diffAgainstBaseline(buildAggregate([PASS], {}), partialBase).rows.find((x) => x.key === 'auth-notes/demo');
+		assert.notEqual(r.base, null); // base IS attached (no whole-row gate)
+		assert.equal(r.base.judge_score, 7); // a field it HAS
+		assert.equal(r.base.cost, null); // a field it LACKS → null (renders ⚪ "(new)")
+		assert.equal(r.base.tests_passed, null);
+		assert.equal(r.delta, 12); // composite still comparable (92 - 80)
+	});
 });
 
-function round1Delta(a, b) {
-	return Math.round((a - b) * 10) / 10;
-}
+// A full-feature cell exercising every RENDERED column (tests, per-dim judge, cost, turns, score) plus
+// the token/cache/LOC/file counts buildAggregate still persists (no longer shown as their own columns).
+const FULL = {
+	task: 'auth-notes',
+	template: 'demo',
+	tests_passed: 4,
+	tests_failed: 0,
+	judge_score: 8,
+	judge_dimensions: { functional_completeness: 9, selector_contract: 8, persistence: 7, code_quality: 8, blocks_fidelity: 8 },
+	tokens_in: 200000,
+	tokens_out: 30000,
+	cache_read_tokens: 150000,
+	cache_write_tokens: 12000,
+	cycle_count: 22,
+	loc_created: 300,
+	loc_edited: 40,
+	files_created: 8,
+	files_edited: 3,
+	stop_reason: 'end_turn',
+}; // comp 92 · cost 1.75 · score 52.6
 
-describe('renderOverview(diff) — colors only', () => {
-	const current = buildAggregate([PASS], {});
-	const baseline = {
-		schema: 2,
-		mean_composite: 92,
-		cells: [{ task: 'auth-notes', template: 'demo', composite: 92, judge_score: 8, tests_passed: 4, tests_denom: 4, cost: 2.0, score: 46, tokens_in: 190000, tokens_out: 28000 }],
-	};
-	const md = renderOverview(diffAgainstBaseline(current, baseline), { heading: '## Overview' }).join('\n');
+// A baseline that carries ALL of FULL's metrics, so each column has a real delta to color.
+const BASE_FULL = {
+	schema: 2,
+	mean_composite: 90,
+	cells: [
+		{
+			task: 'auth-notes',
+			template: 'demo',
+			composite: 90,
+			judge_score: 7,
+			judge_dimensions: { functional_completeness: 7, selector_contract: 8, persistence: 9, code_quality: 8, blocks_fidelity: 8 },
+			tests_passed: 4,
+			tests_denom: 4,
+			cost: 2.0,
+			score: 40,
+			tokens_in: 190000,
+			tokens_out: 28000,
+			cache_read_tokens: 100000,
+			cache_write_tokens: 10000,
+			cycle_count: 18,
+			loc_created: 250,
+			loc_edited: 30,
+			files_created: 6,
+			files_edited: 2,
+		},
+	],
+};
 
-	it('has the colors-only column header incl. the Δ vs base column and no baseline->pr numbers', () => {
-		assert.match(md, /\| Task \| Template \| Tests \| Judge \| Cost \| Tokens \(in\/out\) \| Score \| Δ vs base \|/);
-		assert.doesNotMatch(md, /->/); // Overview is glyphs only
-	});
-	it('colors each metric vs baseline + a per-row composite Δ ball', () => {
-		// tests 4/4 vs 4/4 → 🟢 ; judge 8 vs 8 → 🟢 ; cost $1.75 vs $2.0 (lower) → 🟢 ;
-		// tokens_in 200k vs 190k (higher=worse, beyond 5%) → 🔴 ; score 52.6 vs 46 (higher) → 🟢 ;
-		// composite 92 vs 92 → Δ 0 → 🟡 (flat, within the ±5-point band)
-		const row = md.split('\n').find((l) => l.includes('auth-notes'));
-		assert.match(row, /\| auth-notes \| demo \| 🟢 \| 🟢 \| 🟢 \| 🔴\/🔴 \| 🟢 \| 🟡 \|/);
-	});
-	it('no-baseline mode flags every metric AND the Δ column 🆕', () => {
-		const noBase = renderOverview(diffAgainstBaseline(current, null), {}).join('\n');
-		const row = noBase.split('\n').find((l) => l.includes('auth-notes'));
-		assert.match(row, /\| auth-notes \| demo \| 🆕 \| 🆕 \| 🆕 \| 🆕\/🆕 \| 🆕 \| 🆕 \|/);
+describe('renderDetailed(diff) — the expanded single results table', () => {
+	const rowFor = (diff) => renderDetailed(diff, {}).join('\n').split('\n').find((l) => l.includes('auth-notes'));
+
+	it('has the 8-column header — Tests|Judge|Cost|Turns|Score|Stop reason', () => {
+		const md = renderDetailed(diffAgainstBaseline(buildAggregate([FULL], {}), BASE_FULL), {}).join('\n');
+		assert.match(md, /\| Task \| Template \| Tests \| Judge \| Cost \| Turns \| Score \| Stop reason \|/);
+		assert.doesNotMatch(md, /Δ vs base/);
+		assert.doesNotMatch(md, /->/); // no arrows anywhere
+		assert.doesNotMatch(md, /Tokens|LOC|Files/); // removed columns gone from the header
 	});
-});
 
-describe('renderDetailed(diff) — numbers', () => {
-	const current = buildAggregate([PASS], {});
-	const baseline = {
-		schema: 2,
-		mean_composite: 92,
-		cells: [{ task: 'auth-notes', template: 'demo', composite: 92, judge_score: 8, tests_passed: 4, tests_denom: 4, judge_dimensions: { functional_completeness: 9, selector_contract: 8, persistence: 8, code_quality: 7, blocks_fidelity: 8 }, cost: 2.0, score: 46, tokens_in: 190000, tokens_out: 28000 }],
-	};
-	const md = renderDetailed(diffAgainstBaseline(current, baseline), {}).join('\n');
-	const row = md.split('\n').find((l) => l.includes('auth-notes'));
+	it('scalar cells are INLINE `<ball> <value> (<Δ>)` (tests/cost/turns/score)', () => {
+		const row = rowFor(diffAgainstBaseline(buildAggregate([FULL], {}), BASE_FULL));
+		assert.match(row, /🟡 4\/4 \(0\)/); // tests 4→4, ±1 → 🟡
+		assert.match(row, /🟢 \$1\.75 \(-\$0\.25\)/); // cost $2→$1.75 (−12.5% beyond ±10%) → 🟢
+		assert.match(row, /🔴 22 \(\+4\)/); // turns 18→22 (+4 beyond ±3, lower-better) → 🔴
+		assert.match(row, /🟢 52\.6 \(\+12\.6\)/); // score 40→52.6 (+12.6 beyond ±5) → 🟢
+		assert.match(row, /\| end_turn \|$/); // stop reason retained, last column
+	});
 
-	it('has the detailed column header incl. Δ vs base and Stop reason', () => {
-		assert.match(md, /\| Task \| Template \| Tests \| Judge \| Cost \| Tokens \| Score \| Δ vs base \| Stop reason \|/);
-	});
-	it('renders tests as colored baseline->pr counts', () => {
-		assert.match(row, /🟢 4\/4 -> 4\/4/);
-	});
-	it('renders the judge cell multi-line per dimension with color + baseline->pr', () => {
-		// functional_completeness 9→8 (down 1, within margin 1) → 🟡 ; code_quality 7→8 (better) → 🟢
-		assert.match(row, /🟡 functional_completeness 9 -> 8/);
-		assert.match(row, /🟢 code_quality 7 -> 8/);
-		assert.match(row, /<br>/); // dimensions on separate lines
-	});
-	it('renders cost, tokens (in/out), score, Δ vs base, and stop reason with numbers', () => {
-		assert.match(row, /🟢 \$2 -> \$1\.75/); // cost lower = better
-		assert.match(row, /in 🔴 190K -> 200K<br>out 🔴 28K -> 30K/);
-		assert.match(row, /🟢 46 -> 52\.6/); // score higher = better
-		assert.match(row, /🟡 0\.0 \| end_turn \|/); // composite 92 vs 92 → Δ 0 → 🟡 flat, ball + signed number
-		assert.match(row, /\| end_turn \|/);
-	});
-	it('a removed cell shows a 🗑️ marker', () => {
-		const withRemoved = diffAgainstBaseline(current, {
+	it('JUDGE is ONE line: overall score + per-dimension shorthand (F/S/P/C/B) with per-dim deltas', () => {
+		const row = rowFor(diffAgainstBaseline(buildAggregate([FULL], {}), BASE_FULL));
+		const judge = row.split('|').slice(1, -1).map((c) => c.trim())[3];
+		assert.match(judge, /^🟢 8 \(\+1\)/); // overall 7→8 beyond ±0.3 → 🟢, leads the cell
+		assert.match(judge, /· F9\(\+2\)/); // functional 7→9 → +2
+		assert.match(judge, /S8\(0\)/); // selector flat
+		assert.match(judge, /P7\(-2\)/); // persistence 9→7 → -2
+		assert.match(judge, /C8\(0\) B8\(0\)/);
+		assert.equal(judge.split('<br>').length, 1); // single line — no <br> stacking
+	});
+
+	it('no cell uses <br> stacking any more (every column is a single inline value)', () => {
+		const md = renderDetailed(diffAgainstBaseline(buildAggregate([FULL], {}), BASE_FULL), {}).join('\n');
+		assert.doesNotMatch(md, /<br>/); // Tokens/LOC/Files stacking and multi-line judge are gone
+	});
+
+	it('no baseline at all → ⚪ + the CURRENT value + (new) for every metric (value never hidden)', () => {
+		const row = rowFor(diffAgainstBaseline(buildAggregate([FULL], {}), null));
+		assert.match(row, /⚪ 4\/4 \(new\)/); // tests
+		assert.match(row, /⚪ 8 \(new\) · F9 S8 P7 C8 B8/); // judge: overall + per-dim shorthand, no deltas
+		assert.match(row, /⚪ \$1\.75 \(new\)/); // cost
+		assert.match(row, /⚪ 22 \(new\)/); // turns
+		assert.match(row, /⚪ 52\.6 \(new\)/); // score
+	});
+
+	it('a run that predates turns: the Turns cell reads — while tests/judge/cost/score still color', () => {
+		// PASS has tokens_in/out + judge_dimensions but NO cycle_count (turns).
+		const row = rowFor(diffAgainstBaseline(buildAggregate([PASS], {}), BASE_FULL));
+		assert.match(row, /🟢 \$1\.75/); // cost present → colored
+		const inner = row.split('|').slice(1, -1).map((c) => c.trim());
+		assert.equal(inner.length, 8);
+		assert.equal(inner[5], '—'); // Turns column (index: Task,Template,Tests,Judge,Cost,Turns) absent this run
+	});
+
+	it('EVERY row emits exactly 8 columns — even a crashed cell with null everything', () => {
+		const CRASH = { task: 'crash', template: 'nextjs', klass: 'agent_fail', tests_passed: 0, tests_failed: 0 };
+		const cmd = renderDetailed(diffAgainstBaseline(buildAggregate([FULL, CRASH], {}), null), {}).join('\n');
+		const dataRows = cmd.split('\n').filter((l) => l.startsWith('| ') && !l.startsWith('| Task') && !l.startsWith('|--') && !l.startsWith('|---'));
+		assert.equal(dataRows.length, 2);
+		for (const line of dataRows) {
+			const inner = line.split('|').slice(1, -1);
+			assert.equal(inner.length, 8, `row must have 8 columns, got ${inner.length}: ${line}`);
+			assert.ok(inner.every((c) => c.trim().length > 0), `no column may be empty: ${line}`);
+		}
+		const crashRow = dataRows.find((l) => l.includes('| crash |'));
+		assert.match(crashRow, /\| crash \| nextjs \| — \| — \| — \| — \| — \| — \|/); // 6 placeholder metric cols
+	});
+
+	it('a removed cell shows a 🗑️ marker with the last-known test count, still 8 columns', () => {
+		const withRemoved = diffAgainstBaseline(buildAggregate([FULL], {}), {
 			schema: 2,
 			mean_composite: 80,
 			cells: [
@@ -277,90 +402,85 @@ describe('renderDetailed(diff) — numbers', () => {
 			],
 		});
 		const dmd = renderDetailed(withRemoved, {}).join('\n');
-		assert.match(dmd, /\| gone \| demo \| 🗑️ removed \(was 2\/5\)/);
+		const goneRow = dmd.split('\n').find((l) => l.includes('| gone |'));
+		assert.match(goneRow, /\| gone \| demo \| 🗑️ removed \(was 2\/5\)/);
+		assert.equal(goneRow.split('|').slice(1, -1).length, 8);
 	});
-});
-
-describe('Δ vs base column — per-row composite delta ball', () => {
-	const mk = (task, tp, tf, judge) => ({ task, template: 'demo', tests_passed: tp, tests_failed: tf, judge_score: judge, tokens_in: 100000, tokens_out: 10000, stop_reason: 'end_turn' });
-	// composites: imp 4/4·8 → 92 ; reg 1/4·3 → 27 ; flat 4/4·8 → 92 ; fresh 4/4·8 → 92 (no baseline cell)
-	const current = buildAggregate([mk('imp', 4, 0, 8), mk('reg', 1, 3, 3), mk('flat', 4, 0, 8), mk('fresh', 4, 0, 8)], {});
-	const baseline = {
-		schema: 2,
-		mean_composite: 80,
-		cells: [
-			{ task: 'imp', template: 'demo', composite: 60 }, // 92 - 60 = +32 → 🟢 improved
-			{ task: 'reg', template: 'demo', composite: 90 }, // 27 - 90 = -63 → 🔴 regressed
-			{ task: 'flat', template: 'demo', composite: 90 }, // 92 - 90 = +2 → 🟡 flat (within ±5)
-			// 'fresh' has no baseline cell → 🆕
-		],
-	};
-	const ov = renderOverview(diffAgainstBaseline(current, baseline), {}).join('\n');
-	const de = renderDetailed(diffAgainstBaseline(current, baseline), {}).join('\n');
-	const cellOf = (md, task) => md.split('\n').find((l) => l.includes(`| ${task} |`));
 
-	it('Overview shows 🟢 improved / 🔴 regressed / 🟡 flat / 🆕 no-base as the trailing column', () => {
-		assert.match(cellOf(ov, 'imp'), /🟢 \|$/);
-		assert.match(cellOf(ov, 'reg'), /🔴 \|$/);
-		assert.match(cellOf(ov, 'flat'), /🟡 \|$/);
-		assert.match(cellOf(ov, 'fresh'), /🆕 \|$/);
-	});
-	it('Detailed shows the ball + signed delta (🆕 for a no-base cell)', () => {
-		assert.match(cellOf(de, 'imp'), /🟢 \+32\.0 \| end_turn \|/);
-		assert.match(cellOf(de, 'reg'), /🔴 -63\.0 \| end_turn \|/);
-		assert.match(cellOf(de, 'flat'), /🟡 \+2\.0 \| end_turn \|/);
-		assert.match(cellOf(de, 'fresh'), /🆕 \| end_turn \|/);
+	it('judge renders ALL common dimensions on ONE line (missing ones as <Letter>—) so the shorthand stays stable', () => {
+		const partialDims = { ...FULL, judge_dimensions: { functional_completeness: 9, selector_contract: 8, code_quality: 7 } };
+		const row = rowFor(diffAgainstBaseline(buildAggregate([partialDims], {}), null));
+		const judge = row.split('|').slice(1, -1).map((c) => c.trim())[3];
+		assert.equal(judge.split('<br>').length, 1); // single line, never <br>-stacked
+		assert.match(judge, /⚪ 8 \(new\) · F9 S8 P— C7 B—/); // present dims show scores; missing dims show <Letter>—
 	});
-});
 
-describe('baselineHasMetrics(baseline) — the per-metric gate', () => {
-	it('true only for a schema-2+ baseline (carries the per-metric set)', () => {
-		assert.equal(baselineHasMetrics({ schema: 2, cells: [] }), true);
-		assert.equal(baselineHasMetrics({ schema: 3, cells: [] }), true);
-	});
-	it('false for schema-1, a missing schema, or null (NOT per-metric comparable)', () => {
-		assert.equal(baselineHasMetrics({ schema: 1, cells: [] }), false);
-		assert.equal(baselineHasMetrics({ cells: [] }), false);
-		assert.equal(baselineHasMetrics(null), false);
-		assert.equal(baselineHasMetrics(undefined), false);
+	it('a removed cell whose baseline lacks a test denom omits the "(was …)" suffix (never prints /null)', () => {
+		const withRemoved = diffAgainstBaseline(buildAggregate([FULL], {}), {
+			schema: 2,
+			mean_composite: 80,
+			cells: [
+				{ task: 'auth-notes', template: 'demo', composite: 92, tests_passed: 4, tests_denom: 4 },
+				{ task: 'gone', template: 'demo', composite: 40, tests_passed: 2, tests_denom: null },
+			],
+		});
+		const goneRow = renderDetailed(withRemoved, {}).join('\n').split('\n').find((l) => l.includes('| gone |'));
+		assert.match(goneRow, /🗑️ removed/);
+		assert.doesNotMatch(goneRow, /\(was/);
+		assert.doesNotMatch(goneRow, /null/);
 	});
 });
 
-// REGRESSION GUARD for the "Judge colored while everything else is 🆕" bug: a schema-1 baseline lacked
-// the per-metric fields, so coloring lit up Judge alone. The fix gates all per-metric coloring on
-// baseline completeness → schema-1 renders every column 🆕 while the composite mean/delta stays comparable.
-describe('schema-1 baseline → every column (Judge included) is 🆕', () => {
-	// Exactly what the OLD buildAggregate wrote: composite/judge_score/test_rate only.
-	const SCHEMA1 = {
-		schema: 1,
-		mean_composite: 80,
-		cells: [{ task: 'auth-notes', template: 'demo', composite: 80, verdict: 'pass', klass: null, judge_score: 7, test_rate: 1 }],
-	};
-	const diff = diffAgainstBaseline(buildAggregate([PASS], {}), SCHEMA1);
+describe('renderPreword(diff, aggregate, opts) — bulleted run summary', () => {
+	const current = buildAggregate([FULL, PARTIAL, AGENT_FAIL, HARNESS], { sha: 'deadbeef' });
+	const diff = diffAgainstBaseline(current, BASE_FULL);
+	const bullets = renderPreword(diff, current, { builderModel: 'claude-opus-4-8', judgeModel: 'claude-opus-4-8', baselineSha: '6853382abc' });
+	const md = bullets.join('\n');
 
-	it('is recognized as a baseline, but NOT a per-metric one', () => {
-		assert.equal(diff.hasBaseline, true); // a baseline WAS found in S3…
-		assert.equal(diff.perMetricBaseline, false); // …but it can't diff per-metric
-		assert.equal(diff.rows.every((r) => r.base === null), true); // so no base metrics
-	});
-	it('keeps the composite mean/delta comparable (the headline still works)', () => {
-		assert.equal(diff.rows.find((r) => r.key === 'auth-notes/demo').delta, 12); // 92 - 80
-		assert.equal(diff.meanDelta, round1Delta(diff.meanCurrent, 80));
-	});
-	it('Overview: per-METRIC columns render 🆕 (the bug) — but the composite Δ still colors', () => {
-		const row = renderOverview(diff, {}).find((l) => l.includes('auth-notes'));
-		// metric columns 🆕 (schema-1 has no per-metric baseline), Δ vs base 🟢 (composite 92 vs 80 → +12)
-		assert.match(row, /\| auth-notes \| demo \| 🆕 \| 🆕 \| 🆕 \| 🆕\/🆕 \| 🆕 \| 🟢 \|/);
-		// The composite Δ is the ONLY colored cell — composite persists in schema 1, so its delta is comparable.
-		const metricsOnly = row.replace(/ 🟢 \|$/, ' |');
-		assert.doesNotMatch(metricsOnly, /🟢|🟡|🔴/); // no PER-METRIC cell colors against a schema-1 baseline
-	});
-	it('Detailed: per-metric columns are 🆕 + numbers — only the composite Δ colors', () => {
-		const row = renderDetailed(diff, {}).find((l) => l.includes('auth-notes'));
-		assert.match(row, /🟢 \+12\.0/); // composite 92 vs 80 → Δ +12 → 🟢 (comparable even for schema-1)
-		const metricsOnly = row.replace(/🟢 \+12\.0 \|/, '|');
-		assert.doesNotMatch(metricsOnly, /🟢|🟡|🔴/); // no PER-METRIC cell colors against a schema-1 baseline
-		assert.doesNotMatch(row, /->/); // 🆕 cells show the pr value only, no baseline->pr
-		assert.match(row, /🆕 functional_completeness 8/); // judge dims are 🆕, not colored
+	it('every line is a markdown bullet', () => {
+		assert.ok(bullets.length > 0);
+		assert.ok(bullets.every((b) => b.startsWith('- ')));
+	});
+	it('leads with mean composite + Δ vs main + judge mean', () => {
+		assert.match(md, /Mean composite [\d.]+\/100/);
+		assert.match(md, /vs `main`/);
+		assert.match(md, /judge mean [\d.]+\/10/);
+	});
+	it('tallies verdicts (pass/partial/fail/harness_error)', () => {
+		assert.match(md, /\*\*Verdicts:\*\* \d+ pass · \d+ partial · \d+ fail · \d+ harness_error/);
+	});
+	it('reports totals (cost, tokens in/out, turns)', () => {
+		assert.match(md, /\*\*Totals:\*\*/);
+		assert.match(md, /tokens .*in .*out/);
+		assert.match(md, /turns/);
+	});
+	it('lists biggest gains / drops by composite Δ when a baseline exists', () => {
+		assert.match(md, /\*\*Biggest gains:\*\*/);
+		assert.match(md, /\*\*Biggest drops:\*\*/);
+	});
+	it('carries the run config (builder + judge model, baseline sha)', () => {
+		assert.match(md, /\*\*Config:\*\*/);
+		assert.match(md, /builder `claude-opus-4-8`/);
+		assert.match(md, /judge `claude-opus-4-8`/);
+		assert.match(md, /baseline `6853382`/); // truncated to 7 chars
+	});
+	it('with no baseline: no gains/drops bullets, says "no `main` baseline yet"', () => {
+		const noBase = renderPreword(diffAgainstBaseline(current, null), current, {});
+		const nmd = noBase.join('\n');
+		assert.match(nmd, /no `main` baseline yet/);
+		assert.doesNotMatch(nmd, /Biggest gains/);
+	});
+	it('an all-failed run (no token data) shows "tokens —" in totals, not "0 in / 0 out"', () => {
+		const failedOnly = buildAggregate([AGENT_FAIL, HARNESS], { sha: 'deadfeed' });
+		const fmd = renderPreword(diffAgainstBaseline(failedOnly, null), failedOnly, {}).join('\n');
+		assert.match(fmd, /tokens —/);
+		assert.doesNotMatch(fmd, /0 in \/ 0 out/);
+	});
+	it('a dead_server cell is tallied under `fail` and counted among the scored cells', () => {
+		const withDead = buildAggregate([FULL, DEAD], { sha: 'deadd00d' });
+		const dmd = renderPreword(diffAgainstBaseline(withDead, null), withDead, {}).join('\n');
+		// FULL passes, DEAD (crashed dev-server) fails → tallied under fail, both counted as scored.
+		assert.match(dmd, /\*\*Verdicts:\*\* 1 pass · 0 partial · 1 fail · 0 harness_error/);
+		assert.match(dmd, /across 2 scored cell\(s\)/);
 	});
 });
diff --git a/scripts/agent-bench/steps/lib/partial-envelope.mjs b/scripts/agent-bench/steps/lib/partial-envelope.mjs
index e1a4d4ecf..fb0807f8e 100644
--- a/scripts/agent-bench/steps/lib/partial-envelope.mjs
+++ b/scripts/agent-bench/steps/lib/partial-envelope.mjs
@@ -12,8 +12,8 @@ import { CHECKPOINT_STOP_REASON } from './scoring.mjs';
  * envelopes so finalize-result folds it identically, but with the non-terminal
  * {@link CHECKPOINT_STOP_REASON} + `checkpoint:true` so a surviving checkpoint classifies as
  * harness_error (excluded) while still carrying tokens for the cost signal.
- * @param {{model: string, startedMs: number, tokensIn: number, tokensOut: number, cycles: number, isolationActive?: boolean, now?: number}} state
- * @returns {{model: string, duration_sec: number, tokens_in: number, tokens_out: number, stop_reason: string, cycle_count: number, final_message: string, partial: true, checkpoint: true, isolation_active: boolean}}
+ * @param {{model: string, startedMs: number, tokensIn: number, tokensOut: number, cacheRead?: number, cacheWrite?: number, cycles: number, isolationActive?: boolean, now?: number}} state
+ * @returns {{model: string, duration_sec: number, tokens_in: number, tokens_out: number, cache_read_tokens: number, cache_write_tokens: number, stop_reason: string, cycle_count: number, final_message: string, partial: true, checkpoint: true, isolation_active: boolean}}
  */
 export function buildCheckpointEnvelope(state) {
 	const now = typeof state.now === 'number' ? state.now : Date.now();
@@ -22,6 +22,10 @@ export function buildCheckpointEnvelope(state) {
 		duration_sec: Math.round((now - state.startedMs) / 1000),
 		tokens_in: state.tokensIn,
 		tokens_out: state.tokensOut,
+		// Cache tokens are DISPLAYED only (never in cost/SCORE); carried on the checkpoint so an
+		// ungraceful teardown still preserves them alongside tokens_in/out.
+		cache_read_tokens: state.cacheRead ?? 0,
+		cache_write_tokens: state.cacheWrite ?? 0,
 		stop_reason: CHECKPOINT_STOP_REASON,
 		cycle_count: state.cycles,
 		final_message: '',
@@ -47,3 +51,21 @@ export function writeEnvelopeAtomic(path, envelope) {
 	writeFileSync(tmp, JSON.stringify(envelope, null, 2));
 	renameSync(tmp, path);
 }
+
+/**
+ * Assemble the trace artifact written to TRACE. Combines the SDK span traces (present ONLY when
+ * invoke() returned) with the per-turn accumulated messages — captured incrementally via a
+ * MessageAddedEvent hook in 2-agent-run.ts. Those messages carry the `toolResult` blocks that
+ * AgentResult.toJSON() strips AND survive a NON-returning invoke() (MaxTokensError, wall-clock /
+ * internal-deadline kill), so the artifact is analyzable on EVERY exit path, not just success.
+ * Pure + defensive (coerces non-arrays to []) so the caller can write a trace unconditionally.
+ * @param {unknown} spanTraces result.traces mapped through toJSON() (or [] when invoke never returned)
+ * @param {unknown} messages the accumulated event.message.toJSON() objects
+ * @returns {{traces: unknown[], messages: unknown[]}}
+ */
+export function buildTraceArtifact(spanTraces, messages) {
+	return {
+		traces: Array.isArray(spanTraces) ? spanTraces : [],
+		messages: Array.isArray(messages) ? messages : [],
+	};
+}
diff --git a/scripts/agent-bench/steps/lib/partial-envelope.test.mjs b/scripts/agent-bench/steps/lib/partial-envelope.test.mjs
index a3d45466c..acdb046e1 100644
--- a/scripts/agent-bench/steps/lib/partial-envelope.test.mjs
+++ b/scripts/agent-bench/steps/lib/partial-envelope.test.mjs
@@ -8,7 +8,7 @@ import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { describe, it } from 'node:test';
-import { buildCheckpointEnvelope, writeEnvelopeAtomic } from './partial-envelope.mjs';
+import { buildCheckpointEnvelope, buildTraceArtifact, writeEnvelopeAtomic } from './partial-envelope.mjs';
 import { CHECKPOINT_STOP_REASON, cellCost, classifyCell, isScoredCell } from './scoring.mjs';
 
 describe('buildCheckpointEnvelope(state) — the non-terminal running checkpoint', () => {
@@ -95,3 +95,30 @@ describe('writeEnvelopeAtomic(path, envelope) — survives an abrupt kill, then
 		}
 	});
 });
+
+describe('buildTraceArtifact(spanTraces, messages) — a trace on EVERY exit path (fixes #1/#2)', () => {
+	// The bug: trace.json was written ONLY when invoke() RETURNED, so a non-returning invoke (a
+	// MaxTokensError or a wall-clock/internal-deadline kill) left the cell with NO trace → an
+	// unanalyzable silent 0. The per-turn MessageAddedEvent accumulator captures messages incrementally,
+	// so even with zero span traces the tool-result-bearing messages are preserved on disk.
+	it('preserves accumulated messages even when span traces are absent (the error / non-return path)', () => {
+		const messages = [
+			{ role: 'assistant', content: [{ toolUse: { toolUseId: 't1', name: 'bash', input: {} } }] },
+			{ role: 'user', content: [{ toolResult: { toolUseId: 't1', status: 'error', content: [{ text: 'boom' }] } }] },
+		];
+		const artifact = buildTraceArtifact(undefined, messages);
+		assert.deepEqual(artifact.traces, []); // invoke never returned ⇒ no span traces …
+		assert.deepEqual(artifact.messages, messages); // … but the toolResult-bearing messages survive
+	});
+
+	it('passes both span traces and messages through on the success path', () => {
+		const spanTraces = [{ name: 'invoke', children: [] }];
+		const messages = [{ role: 'assistant', content: [{ text: 'done' }] }];
+		assert.deepEqual(buildTraceArtifact(spanTraces, messages), { traces: spanTraces, messages });
+	});
+
+	it('is defensive: non-array inputs collapse to empty arrays (never throws, always serializable)', () => {
+		assert.deepEqual(buildTraceArtifact(null, null), { traces: [], messages: [] });
+		assert.deepEqual(buildTraceArtifact(undefined, undefined), { traces: [], messages: [] });
+	});
+});
diff --git a/scripts/agent-bench/steps/lib/scoring.mjs b/scripts/agent-bench/steps/lib/scoring.mjs
index 47299d760..02cc4ad60 100644
--- a/scripts/agent-bench/steps/lib/scoring.mjs
+++ b/scripts/agent-bench/steps/lib/scoring.mjs
@@ -27,9 +27,41 @@ export const HARNESS_FAIL_REASONS = {
 export const AGENT_FAIL_AT = '2-agent';
 export const AGENT_FAIL_REASON = 'agent_timeout';
 
-// An ungraceful 2-agent death that tore down the harness itself (isUngracefulStepTwoDeath) is infra,
-// not a gradeable failure → reclassified harness_error, EXCLUDED under this (distinct) reason.
-export const AGENT_HARNESS_TEARDOWN_REASON = 'agent_harness_teardown';
+// A MaxTokensError (a single model response hit the per-call OUTPUT-token cap) is NOT a wall-clock
+// timeout: the agent exhausted its token budget on its own merits, so it stays agent_fail (composite
+// 0, INCLUDED in the mean) but under its own reason so it isn't mislabeled 'agent_timeout'.
+export const AGENT_MAX_TOKENS_REASON = 'max_tokens';
+
+// A checkpoint-survived ungraceful 2-agent death UNDER ACTIVE ISOLATION cannot be an agent pkill-storm
+// (cross-uid EPERM stops the agent from signalling the harness) — it is an infra WALL-CLOCK TIMEOUT
+// that killed the process group before a terminal stop_reason could flush. Reclassified harness_error
+// and EXCLUDED under this (distinct) timeout reason. (The old `agent_harness_teardown` label wrongly
+// implied an agent-inflicted teardown, which active isolation makes impossible.)
+export const AGENT_HARNESS_TIMEOUT_REASON = 'wall_clock_timeout';
+
+// A dev-server that never came up (empty APP_BASE_URL) or crashed AFTER the agent's build: step 3
+// detects this, SKIPS Playwright (no bogus invalid-URL failures) and stamps dev_server_status='dead'
+// on result.json. The built app failing to RUN is a GENUINE product failure, so it's scored exactly
+// like agent_fail — verdict 'fail', composite 0, INCLUDED in the mean — so a backend crash can't hide
+// as an excluded 'unknown'. A DISTINCT klass (not agent_fail) so the failure root-cause can still
+// attribute owner=framework (e.g. the PGlite backend crash) rather than blaming the agent. This is
+// NOT harness_error: the harness did its job; it was the produced app that did not run.
+export const DEAD_SERVER_STATUS = 'dead';
+export const DEAD_SERVER_KLASS = 'dead_server';
+export const DEAD_SERVER_REASON = 'dev_server_dead';
+
+/**
+ * The klasses that are GENUINE failures counted in the mean as composite 0 (verdict 'fail', included
+ * by isScoredCell) — as opposed to `harness_error` (excluded) or `scored` (graded on its tests).
+ * `agent_fail` = the agent produced no app within budget; `dead_server` = it produced an app whose
+ * dev-server never served / crashed. Both are real product failures, so both count. Single-sourced
+ * here so verdictOf, isScoredCell and summary.mjs share ONE definition of "a counted failure".
+ * @param {string|null|undefined} klass
+ * @returns {boolean}
+ */
+export function isCountedFailKlass(klass) {
+	return klass === 'agent_fail' || klass === DEAD_SERVER_KLASS;
+}
 
 // The NON-terminal stop_reason 2-agent-run.ts stamps on its running checkpoint (lib/partial-envelope.mjs).
 // A checkpoint surviving to finalize means no terminal exit path overwrote it (the process died
@@ -70,14 +102,30 @@ export function isUngracefulStepTwoDeath(result) {
 	return !reachedGracefulExit(result);
 }
 
+/**
+ * Detect a MaxTokensError 2-agent failure from the folded envelope: the model hit its per-call
+ * OUTPUT-token cap (a graceful `error` stop_reason carrying a MaxTokensError builder_error), which is
+ * the agent exhausting its own token budget — NOT a wall-clock timeout. Reads stop_reason +
+ * builder_error (finalize-result folds both onto the result before classifyCell runs).
+ * @param {{stop_reason?: unknown, builder_error?: unknown}} result
+ * @returns {boolean}
+ */
+export function isMaxTokensFailure(result) {
+	const sr = typeof result?.stop_reason === 'string' ? result.stop_reason : '';
+	const be = typeof result?.builder_error === 'string' ? result.builder_error : '';
+	return /max[_\s]?tokens/i.test(sr) || /maxtokenserror|max[_\s]?tokens/i.test(be);
+}
+
 /**
  * Classify a finalized cell:
  *   - `harness_error` — a pre-grade step failed or the run was CANCELLED (EXCLUDED from the mean).
  *   - `agent_fail` — the agent step failed on its own merits AND exited gracefully (verdict 'fail',
  *     composite 0, INCLUDED). An ungraceful 2-agent teardown is reclassified `harness_error`.
+ *   - `dead_server` — the agent finished but the built app's dev-server never served / crashed
+ *     (dev_server_status='dead'): a genuine product failure (verdict 'fail', composite 0, INCLUDED).
  *   - `scored` — reached build/test/judge; its outcome is a real signal.
- * @param {{failed_at?: string|null, status?: string, stop_reason?: unknown, checkpoint?: unknown}} result
- * @returns {{klass: 'scored'|'harness_error'|'agent_fail', reason: string|null}}
+ * @param {{failed_at?: string|null, status?: string, dev_server_status?: string, stop_reason?: unknown, checkpoint?: unknown}} result
+ * @returns {{klass: 'scored'|'harness_error'|'agent_fail'|'dead_server', reason: string|null}}
  */
 export function classifyCell(result) {
 	const failedAt = result?.failed_at ?? null;
@@ -98,10 +146,25 @@ export function classifyCell(result) {
 	// quietly excluded and inflating the headline mean.
 	if (failedAt === AGENT_FAIL_AT) {
 		if (isUngracefulStepTwoDeath(result) && result?.isolation_active === true) {
-			return { klass: 'harness_error', reason: AGENT_HARNESS_TEARDOWN_REASON };
+			return { klass: 'harness_error', reason: AGENT_HARNESS_TIMEOUT_REASON };
+		}
+		// A MaxTokensError (the model hit its per-call output cap) is the agent exhausting its own budget,
+		// not a wall-clock timeout — keep it agent_fail (composite 0, INCLUDED) but label it distinctly so
+		// the summary/analysis don't misreport it as 'agent_timeout'.
+		if (isMaxTokensFailure(result)) {
+			return { klass: 'agent_fail', reason: AGENT_MAX_TOKENS_REASON };
 		}
 		return { klass: 'agent_fail', reason: AGENT_FAIL_REASON };
 	}
+	// The agent finished and any build succeeded, but the dev-server never served / crashed (step 3
+	// detected it, skipped Playwright, and stamped dev_server_status='dead'). The produced app failing
+	// to RUN is a genuine product failure → dead_server (verdict 'fail', composite 0, INCLUDED), NOT a
+	// 'scored' cell with no tests (which would read 'unknown' and be EXCLUDED, masking the crash).
+	// Ordered AFTER the harness_error / agent_fail returns so a cancellation or a pre-grade failure —
+	// which never produced a runnable app to begin with — still wins and stays excluded.
+	if (result?.dev_server_status === DEAD_SERVER_STATUS) {
+		return { klass: DEAD_SERVER_KLASS, reason: DEAD_SERVER_REASON };
+	}
 	return { klass: 'scored', reason: null };
 }
 
@@ -154,8 +217,9 @@ export function verdict(tr, harnessHint) {
 export function verdictOf(result) {
 	const klass = result?.klass ?? classifyCell(result).klass;
 	if (klass === 'harness_error') return verdict(0, 'harness_error');
-	// An agent failure is a real 'fail' even with no tests — must not read as 'unknown' (excluded).
-	if (klass === 'agent_fail') return 'fail';
+	// A counted failure (agent_fail / dead_server) is a real 'fail' even with no tests — it must not
+	// read as 'unknown', which would exclude it from the mean and hide the failure.
+	if (isCountedFailKlass(klass)) return 'fail';
 	const stats = testStats(result);
 	if (stats.denom === 0) return verdict(0, 'unknown');
 	return verdict(testRate(stats), null);
@@ -189,15 +253,16 @@ export function compositeBand(c) {
 }
 
 /**
- * The single inclusion rule for the headline mean. A cell counts iff it is an `agent_fail` (a genuine
- * failure counted as composite 0), OR it is gradeable (not harness_error) and produced tests (denom>0).
+ * The single inclusion rule for the headline mean. A cell counts iff it is a COUNTED failure
+ * (`agent_fail` or `dead_server` — a genuine failure scored as composite 0), OR it is gradeable
+ * (not harness_error) and produced tests (denom>0).
  * @param {object} result
  * @returns {boolean}
  */
 export function isScoredCell(result) {
 	const klass = result?.klass ?? classifyCell(result).klass;
 	if (klass === 'harness_error') return false;
-	if (klass === 'agent_fail') return true;
+	if (isCountedFailKlass(klass)) return true;
 	return testStats(result).denom > 0;
 }
 
diff --git a/scripts/agent-bench/steps/lib/scoring.test.mjs b/scripts/agent-bench/steps/lib/scoring.test.mjs
index 5d610a6e0..a42aa9379 100644
--- a/scripts/agent-bench/steps/lib/scoring.test.mjs
+++ b/scripts/agent-bench/steps/lib/scoring.test.mjs
@@ -6,9 +6,13 @@ import { describe, it } from 'node:test';
 import {
 	AGENT_FAIL_AT,
 	AGENT_FAIL_REASON,
-	AGENT_HARNESS_TEARDOWN_REASON,
+	AGENT_HARNESS_TIMEOUT_REASON,
+	AGENT_MAX_TOKENS_REASON,
 	BUILDER_PRICING,
 	CHECKPOINT_STOP_REASON,
+	DEAD_SERVER_KLASS,
+	DEAD_SERVER_REASON,
+	DEAD_SERVER_STATUS,
 	PRICING,
 	buildCapDecision,
 	cellCost,
@@ -18,6 +22,8 @@ import {
 	compositeBand,
 	HARNESS_FAIL_REASONS,
 	hardCapPlan,
+	isCountedFailKlass,
+	isMaxTokensFailure,
 	isScoredCell,
 	isUngracefulStepTwoDeath,
 	scorePerDollar,
@@ -181,11 +187,23 @@ describe('harness-integrity: ungraceful 2-agent teardown is reclassified harness
 			isolation_active: true,
 		};
 		assert.equal(isUngracefulStepTwoDeath(cell), true);
-		assert.deepEqual(classifyCell(cell), { klass: 'harness_error', reason: AGENT_HARNESS_TEARDOWN_REASON });
+		assert.deepEqual(classifyCell(cell), { klass: 'harness_error', reason: AGENT_HARNESS_TIMEOUT_REASON });
 		assert.equal(isScoredCell(cell), false); // EXCLUDED — a flaky teardown can't move the score
 		assert.equal(verdictOf(cell), 'harness_error');
 	});
 
+	it('the isolation-active teardown reason is the concrete WALL-CLOCK-TIMEOUT label, not the old agent-teardown one', () => {
+		// Under active isolation the death is an infra wall-clock timeout, NOT an agent pkill-storm, so the
+		// reason must read as a timeout. Still harness_error, still EXCLUDED — only the label changed.
+		const cell = { failed_at: AGENT_FAIL_AT, status: 'error', stop_reason: '', isolation_active: true };
+		const { klass, reason } = classifyCell(cell);
+		assert.equal(klass, 'harness_error');
+		assert.equal(reason, 'wall_clock_timeout');
+		assert.equal(reason, AGENT_HARNESS_TIMEOUT_REASON);
+		assert.notEqual(reason, 'agent_harness_teardown'); // the old, misleading label is gone
+		assert.equal(isScoredCell(cell), false); // still EXCLUDED from the headline mean
+	});
+
 	it('the SAME ungraceful death with isolation OFF → agent_fail, INCLUDED (the #184 pkill-storm is the agent)', () => {
 		const cell = { failed_at: AGENT_FAIL_AT, status: 'error', stop_reason: '', isolation_active: false };
 		assert.equal(isUngracefulStepTwoDeath(cell), true); // same signature…
@@ -383,6 +401,74 @@ describe('agent_fail end-to-end invariant: verdict fail, composite 0, INCLUDED',
 	});
 });
 
+describe('dead_server: a crashed/never-served dev-server is a REAL fail (composite 0, INCLUDED — issue #188)', () => {
+	// The over-correction being reversed: an empty APP_BASE_URL / crashed backend makes step 3 skip
+	// Playwright, leaving tests 0/0/0. As a plain 'scored' cell that read verdict 'unknown' and was
+	// EXCLUDED, masking the PGlite backend crash from the mean. dev_server_status='dead' now classifies
+	// it as dead_server — verdict 'fail', composite 0, INCLUDED — so the crash HURTS the score, while a
+	// DISTINCT klass keeps the failure root-cause free to attribute owner=framework (not the agent).
+	const deadCell = { task: 'sql-notes', template: 'nextjs', dev_server_status: 'dead', tests_passed: 0, tests_failed: 0 };
+
+	it("classifyCell → { klass: 'dead_server', reason: 'dev_server_dead' }", () => {
+		assert.deepEqual(classifyCell(deadCell), { klass: DEAD_SERVER_KLASS, reason: DEAD_SERVER_REASON });
+		assert.equal(DEAD_SERVER_STATUS, 'dead');
+		assert.equal(DEAD_SERVER_KLASS, 'dead_server');
+		assert.equal(DEAD_SERVER_REASON, 'dev_server_dead');
+	});
+
+	it("verdicts 'fail' (NOT 'unknown'), is INCLUDED in the mean, and scores composite 0", () => {
+		assert.equal(verdictOf(deadCell), 'fail');
+		assert.equal(isScoredCell(deadCell), true); // INCLUDED — the crash must move the mean
+		assert.equal(composite(testRate(testStats(deadCell)), 10), 0); // even a generous judge can't lift it off 0
+	});
+
+	it('a stamped klass:dead_server is honoured (no tests) — fail + INCLUDED', () => {
+		assert.equal(verdictOf({ klass: DEAD_SERVER_KLASS }), 'fail');
+		assert.equal(isScoredCell({ klass: DEAD_SERVER_KLASS }), true);
+	});
+
+	// PRECEDENCE — a genuine harness_error still WINS over the dead-server signal and stays EXCLUDED.
+	// A cancellation / pre-grade failure / ungraceful agent teardown never produced a runnable app, so a
+	// stray dev_server_status='dead' on such a cell must NOT flip it into the scored set.
+	it('a CANCELLATION with dev_server_status=dead is still harness_error, EXCLUDED (cancel wins)', () => {
+		const cell = { ...deadCell, status: 'cancelled', failed_at: AGENT_FAIL_AT };
+		assert.equal(classifyCell(cell).klass, 'harness_error');
+		assert.equal(isScoredCell(cell), false);
+		assert.equal(verdictOf(cell), 'harness_error');
+	});
+
+	it('a pre-grade (pre-oidc) failure with dev_server_status=dead is still harness_error, EXCLUDED', () => {
+		const cell = { ...deadCell, failed_at: 'pre-oidc' };
+		assert.equal(classifyCell(cell).klass, 'harness_error');
+		assert.equal(isScoredCell(cell), false);
+	});
+
+	it('an ungraceful 2-agent teardown (isolation on) with dev_server_status=dead stays harness_error, EXCLUDED', () => {
+		// The agent step already died as an infra teardown (issue #183) before any dev server existed —
+		// that reclassification must still win over a stray dead signal.
+		const cell = { ...deadCell, failed_at: AGENT_FAIL_AT, status: 'error', stop_reason: '', isolation_active: true };
+		assert.equal(classifyCell(cell).klass, 'harness_error');
+		assert.equal(isScoredCell(cell), false);
+	});
+});
+
+describe('isCountedFailKlass(klass) — the shared "counted failure" set (agent_fail + dead_server)', () => {
+	it('agent_fail and dead_server are counted failures (verdict fail, composite 0, INCLUDED)', () => {
+		assert.equal(isCountedFailKlass('agent_fail'), true);
+		assert.equal(isCountedFailKlass(DEAD_SERVER_KLASS), true);
+	});
+
+	it('scored and harness_error are NOT counted failures', () => {
+		assert.equal(isCountedFailKlass('scored'), false);
+		assert.equal(isCountedFailKlass('harness_error'), false);
+	});
+
+	it('a missing / undefined / null klass is not a counted failure', () => {
+		assert.equal(isCountedFailKlass(undefined), false);
+		assert.equal(isCountedFailKlass(null), false);
+	});
+});
+
 describe('buildCapDecision(ev) — the build-cap is for REAL build failures only', () => {
 	it("build_status='na' (no `build` script in the template) does NOT cap, and notes it", () => {
 		// The observability-api/backend case: a template with no `build` script
@@ -586,3 +672,44 @@ describe('scorePerDollar(composite, cost) — the headline SCORE (points per $)'
 		assert.equal(scorePerDollar(92, 0), null);
 	});
 });
+
+describe('classifyCell — MaxTokensError is agent_fail with its OWN reason, not a wall-clock timeout (fix #3)', () => {
+	// A MaxTokensError means a single model response hit the per-call OUTPUT-token cap: the agent spent
+	// its budget on its own merits. That is a GENUINE agent failure (composite 0, INCLUDED) — but it is
+	// NOT a wall-clock timeout, so it must carry the distinct 'max_tokens' reason, never 'agent_timeout'.
+	// Mirrors the cognito-profile cell (composite 0, tokens_in 1,082,766, duration 203s — NOT a timeout).
+	it("a MaxTokensError builder_error → agent_fail, reason 'max_tokens' (INCLUDED, not excluded)", () => {
+		const cell = {
+			failed_at: AGENT_FAIL_AT,
+			status: 'error',
+			stop_reason: 'error',
+			builder_error: 'MaxTokensError: output exceeded the maximum allowed tokens',
+			tokens_in: 1_082_766,
+			tokens_out: 64_000,
+		};
+		assert.deepEqual(classifyCell(cell), { klass: 'agent_fail', reason: AGENT_MAX_TOKENS_REASON });
+		assert.equal(AGENT_MAX_TOKENS_REASON, 'max_tokens');
+		assert.notEqual(classifyCell(cell).reason, AGENT_FAIL_REASON); // NOT mislabeled 'agent_timeout'
+		assert.equal(isScoredCell({ ...cell, klass: 'agent_fail' }), true); // INCLUDED (composite 0)
+	});
+
+	it("a 'maxTokens' stop_reason (the SDK StopReason string) is also detected", () => {
+		const cell = { failed_at: AGENT_FAIL_AT, status: 'error', stop_reason: 'maxTokens' };
+		assert.deepEqual(classifyCell(cell), { klass: 'agent_fail', reason: AGENT_MAX_TOKENS_REASON });
+	});
+
+	it("a genuine wall-clock timeout keeps reason 'agent_timeout' (only real max-tokens is relabeled)", () => {
+		const cell = { failed_at: AGENT_FAIL_AT, status: 'error', stop_reason: 'wall_clock_timeout' };
+		assert.deepEqual(classifyCell(cell), { klass: 'agent_fail', reason: AGENT_FAIL_REASON });
+	});
+
+	it('isMaxTokensFailure detects the signature in stop_reason OR builder_error, and nowhere else', () => {
+		assert.equal(isMaxTokensFailure({ builder_error: 'MaxTokensError: ...' }), true);
+		assert.equal(isMaxTokensFailure({ stop_reason: 'maxTokens' }), true);
+		assert.equal(isMaxTokensFailure({ stop_reason: 'max_tokens' }), true);
+		assert.equal(isMaxTokensFailure({ stop_reason: 'wall_clock_timeout' }), false);
+		assert.equal(isMaxTokensFailure({ builder_error: 'ThrottlingException: rate exceeded' }), false);
+		assert.equal(isMaxTokensFailure({}), false);
+		assert.equal(isMaxTokensFailure(null), false);
+	});
+});
diff --git a/scripts/agent-bench/steps/lib/workspace-diff.mjs b/scripts/agent-bench/steps/lib/workspace-diff.mjs
new file mode 100644
index 000000000..a29d909df
--- /dev/null
+++ b/scripts/agent-bench/steps/lib/workspace-diff.mjs
@@ -0,0 +1,146 @@
+// Best-effort LOC/files churn for a bench cell, measured by snapshotting the scaffolded workspace
+// BEFORE the agent runs and diffing it AFTER. Kept OFF the agent's own git: every git op here targets
+// a THROWAWAY external GIT_DIR (in the OS temp dir) with the workspace as its work-tree, so it only
+// READS workspace files and writes to its own scratch repo — the workspace's own `.git` (if any) and
+// the app are never touched. Safe under agent-shell UID isolation because prepareWorkspaceIsolation
+// grants the harness user a DEFAULT ACL on the workspace, so files the benchagent UID creates stay
+// readable by this (harness-UID) process. ANY failure degrades to null churn (never throws into the
+// hot path) so the report renders ⚪ "(new)"/— rather than corrupting the run.
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+const GIT_TIMEOUT_MS = 120_000;
+const GIT_MAX_BUFFER = 64 * 1024 * 1024;
+
+// Heavy/irrelevant trees excluded even when the scaffold ships no .gitignore for them — written to the
+// scratch repo's info/exclude (git reads it automatically). node_modules alone would make `git add -A`
+// pathologically slow and swamp the churn counts. Git also honors the work-tree's own .gitignore files.
+const SCRATCH_EXCLUDES = ['.git/', 'node_modules/', 'dist/', 'build/', '.next/', 'out/', 'coverage/', '.turbo/', '.cache/'];
+
+/**
+ * Run a git command against the scratch GIT_DIR + workspace work-tree. `-c safe.directory=*` disables
+ * the dubious-ownership guard (agent-created files may be benchagent-owned); we pass an explicit
+ * --git-dir so git never does repo discovery on the (possibly foreign-owned) work-tree.
+ * @param {string} gitDir scratch repo dir (owned by this process)
+ * @param {string} workTree the workspace
+ * @param {string[]} args git args
+ * @returns {string} stdout
+ */
+function git(gitDir, workTree, args) {
+	const r = spawnSync(
+		'git',
+		['-c', 'safe.directory=*', '-c', 'core.autocrlf=false', `--git-dir=${gitDir}`, `--work-tree=${workTree}`, ...args],
+		{ encoding: 'utf8', timeout: GIT_TIMEOUT_MS, maxBuffer: GIT_MAX_BUFFER },
+	);
+	if (r.error) throw r.error;
+	if (typeof r.status === 'number' && r.status !== 0) {
+		throw new Error(`git ${args[0]} exited ${r.status}: ${(r.stderr || '').trim().slice(0, 300)}`);
+	}
+	return r.stdout ?? '';
+}
+
+/**
+ * Snapshot the workspace into a fresh scratch repo and return a handle for {@link finishWorkspaceDiff}.
+ * Returns `null` on ANY failure (git missing, permission, etc.) so the caller silently degrades to null
+ * churn. The returned `gitDir` lives in the OS temp dir (NOT inside the workspace, so `git add -A`
+ * never ingests it) and is removed by finishWorkspaceDiff.
+ * @param {string} workspace absolute path to the scaffolded bench app
+ * @returns {{gitDir: string, baseTree: string}|null}
+ */
+export function beginWorkspaceDiff(workspace) {
+	let gitDir;
+	try {
+		gitDir = mkdtempSync(join(tmpdir(), 'bench-wsdiff-'));
+		git(gitDir, workspace, ['init', '-q']);
+		writeFileSync(join(gitDir, 'info', 'exclude'), `${SCRATCH_EXCLUDES.join('\n')}\n`);
+		git(gitDir, workspace, ['add', '-A']);
+		const baseTree = git(gitDir, workspace, ['write-tree']).trim();
+		if (!baseTree) throw new Error('empty base tree');
+		return { gitDir, baseTree };
+	} catch {
+		if (gitDir) rmSync(gitDir, { recursive: true, force: true });
+		return null;
+	}
+}
+
+const NULL_CHURN = { loc_created: null, loc_edited: null, files_created: null, files_edited: null };
+
+/**
+ * Diff the workspace against the snapshot: added lines in ADDED files (loc_created), added+deleted in
+ * MODIFIED files (loc_edited), and the counts of added / modified files. Renames count as edits.
+ * Deleted files are ignored (they contribute no created/edited lines). Always returns the 4-key object;
+ * all-null on a missing snapshot or ANY error. Cleans up the scratch repo.
+ * @param {{gitDir: string, baseTree: string}|null} snapshot from {@link beginWorkspaceDiff}
+ * @param {string} workspace absolute path to the (now agent-modified) bench app
+ * @returns {{loc_created: number|null, loc_edited: number|null, files_created: number|null, files_edited: number|null}}
+ */
+export function finishWorkspaceDiff(snapshot, workspace) {
+	if (!snapshot) return { ...NULL_CHURN };
+	const { gitDir, baseTree } = snapshot;
+	try {
+		git(gitDir, workspace, ['add', '-A']);
+		// -M so a rename reads as a modify (churn) rather than a delete+add. --cached diffs the freshly
+		// staged tree against the pre-run baseTree.
+		const numstat = git(gitDir, workspace, ['diff-index', '-M', '--cached', '--numstat', baseTree]);
+		const namestat = git(gitDir, workspace, ['diff-index', '-M', '--cached', '--name-status', baseTree]);
+		return parseChurn(numstat, namestat);
+	} catch {
+		return { ...NULL_CHURN };
+	} finally {
+		rmSync(gitDir, { recursive: true, force: true });
+	}
+}
+
+/**
+ * Pure parser for `git diff-index --numstat` + `--name-status` output (tab-separated). Exported for
+ * unit testing without spawning git.
+ *   numstat line:      `<added>\t<deleted>\t<path>`  (added/deleted are `-` for binary files)
+ *   name-status line:  `<status>\t<path>` or `R<score>\t<old>\t<new>` (rename)
+ * A→loc_created (added lines) + files_created; M/R→loc_edited (added+deleted) + files_edited; D ignored.
+ * @param {string} numstat
+ * @param {string} namestat
+ * @returns {{loc_created: number, loc_edited: number, files_created: number, files_edited: number}}
+ */
+export function parseChurn(numstat, namestat) {
+	// path → 'A' | 'M' | 'D' (renames map to their NEW path as 'M').
+	const status = new Map();
+	for (const line of namestat.split('\n')) {
+		if (!line.trim()) continue;
+		const parts = line.split('\t');
+		const code = parts[0]?.[0] ?? '';
+		if (code === 'R' || code === 'C') {
+			// `R<score>\told\tnew` — the new path is what numstat also keys on; treat as a modify.
+			const newPath = parts[2] ?? parts[1];
+			if (newPath) status.set(newPath, 'M');
+		} else if (code === 'A' || code === 'M' || code === 'D') {
+			const p = parts[1];
+			if (p) status.set(p, code);
+		}
+	}
+	let loc_created = 0;
+	let loc_edited = 0;
+	let files_created = 0;
+	let files_edited = 0;
+	for (const line of numstat.split('\n')) {
+		if (!line.trim()) continue;
+		const [addRaw, delRaw, ...pathParts] = line.split('\t');
+		// A rename numstat row is `<add>\t<del>\told => new` OR `<add>\t<del>\told\tnew` (with -M and
+		// path rewriting); the last field is the new path, which is how `status` is keyed.
+		const path = pathParts[pathParts.length - 1];
+		if (!path) continue;
+		const added = addRaw === '-' ? 0 : Number.parseInt(addRaw, 10) || 0; // '-' = binary → 0 lines
+		const deleted = delRaw === '-' ? 0 : Number.parseInt(delRaw, 10) || 0;
+		const code = status.get(path);
+		if (code === 'A') {
+			loc_created += added;
+			files_created += 1;
+		} else if (code === 'M') {
+			loc_edited += added + deleted;
+			files_edited += 1;
+		}
+		// 'D' (deletions) contribute no created/edited lines and are not counted as files_edited.
+	}
+	return { loc_created, loc_edited, files_created, files_edited };
+}
diff --git a/scripts/agent-bench/steps/lib/workspace-diff.test.mjs b/scripts/agent-bench/steps/lib/workspace-diff.test.mjs
new file mode 100644
index 000000000..d0cfe49f6
--- /dev/null
+++ b/scripts/agent-bench/steps/lib/workspace-diff.test.mjs
@@ -0,0 +1,104 @@
+// Integration + unit tests for the LOC/files workspace-diff helper (workspace-diff.mjs). The
+// begin/finish tests exercise REAL git against a REAL temp workspace (no mocks): scaffold → snapshot →
+// mutate → diff. parseChurn is tested purely on captured git output.
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { after, before, describe, it } from 'node:test';
+import { beginWorkspaceDiff, finishWorkspaceDiff, parseChurn } from './workspace-diff.mjs';
+
+const hasGit = spawnSync('git', ['--version'], { encoding: 'utf8' }).status === 0;
+
+describe('parseChurn(numstat, namestat) — pure parser', () => {
+	it('added files → loc_created + files_created; modified → loc_edited + files_edited', () => {
+		const numstat = ['10\t0\tsrc/new.ts', '3\t2\tsrc/existing.ts'].join('\n');
+		const namestat = ['A\tsrc/new.ts', 'M\tsrc/existing.ts'].join('\n');
+		assert.deepEqual(parseChurn(numstat, namestat), {
+			loc_created: 10,
+			loc_edited: 5, // 3 added + 2 deleted on the modified file
+			files_created: 1,
+			files_edited: 1,
+		});
+	});
+	it('deletions contribute nothing (not created, not edited)', () => {
+		assert.deepEqual(parseChurn('0\t8\tsrc/gone.ts', 'D\tsrc/gone.ts'), {
+			loc_created: 0,
+			loc_edited: 0,
+			files_created: 0,
+			files_edited: 0,
+		});
+	});
+	it('a rename (R) counts as an edit on the new path', () => {
+		// -M rewrites the numstat path to the new name; name-status carries `R<score>\told\tnew`.
+		const numstat = '2\t1\tsrc/renamed.ts';
+		const namestat = 'R096\tsrc/old.ts\tsrc/renamed.ts';
+		assert.deepEqual(parseChurn(numstat, namestat), {
+			loc_created: 0,
+			loc_edited: 3,
+			files_created: 0,
+			files_edited: 1,
+		});
+	});
+	it('binary files (— added/deleted) count as a file but 0 lines', () => {
+		assert.deepEqual(parseChurn('-\t-\tlogo.png', 'A\tlogo.png'), {
+			loc_created: 0,
+			loc_edited: 0,
+			files_created: 1,
+			files_edited: 0,
+		});
+	});
+	it('empty output → all zeros', () => {
+		assert.deepEqual(parseChurn('', ''), { loc_created: 0, loc_edited: 0, files_created: 0, files_edited: 0 });
+	});
+});
+
+describe('begin/finishWorkspaceDiff — REAL git against a REAL workspace', { skip: !hasGit }, () => {
+	let ws;
+	before(() => {
+		ws = mkdtempSync(join(tmpdir(), 'bench-ws-test-'));
+		mkdirSync(join(ws, 'src'), { recursive: true });
+		writeFileSync(join(ws, 'src', 'keep.ts'), 'line1\nline2\nline3\n');
+		writeFileSync(join(ws, '.gitignore'), 'node_modules/\n');
+		mkdirSync(join(ws, 'node_modules', 'dep'), { recursive: true });
+		writeFileSync(join(ws, 'node_modules', 'dep', 'index.js'), 'module.exports = {};\n');
+	});
+	after(() => rmSync(ws, { recursive: true, force: true }));
+
+	it('captures a snapshot then reports created + edited churn, ignoring node_modules', () => {
+		const snap = beginWorkspaceDiff(ws);
+		assert.ok(snap && snap.baseTree, 'snapshot must succeed with a base tree');
+
+		// Agent mutations: add a new 2-line file, append a line to keep.ts, drop a node_modules file.
+		writeFileSync(join(ws, 'src', 'added.ts'), 'a\nb\n');
+		writeFileSync(join(ws, 'src', 'keep.ts'), 'line1\nline2\nline3\nline4\n'); // +1 line
+		writeFileSync(join(ws, 'node_modules', 'dep', 'extra.js'), 'noise\n'); // must be ignored
+
+		const churn = finishWorkspaceDiff(snap, ws);
+		assert.equal(churn.files_created, 1, 'one new tracked file (added.ts)');
+		assert.equal(churn.loc_created, 2, 'added.ts has 2 lines');
+		assert.equal(churn.files_edited, 1, 'keep.ts modified');
+		assert.equal(churn.loc_edited, 1, 'keep.ts +1 line, -0');
+	});
+
+	it('a null snapshot yields all-null churn (graceful degradation)', () => {
+		assert.deepEqual(finishWorkspaceDiff(null, ws), {
+			loc_created: null,
+			loc_edited: null,
+			files_created: null,
+			files_edited: null,
+		});
+	});
+
+	it('no changes since the snapshot → all zeros', () => {
+		const snap = beginWorkspaceDiff(ws);
+		assert.ok(snap);
+		assert.deepEqual(finishWorkspaceDiff(snap, ws), {
+			loc_created: 0,
+			loc_edited: 0,
+			files_created: 0,
+			files_edited: 0,
+		});
+	});
+});
diff --git a/scripts/agent-bench/steps/summary.mjs b/scripts/agent-bench/steps/summary.mjs
index 6d5a63bcc..54d81e0d2 100644
--- a/scripts/agent-bench/steps/summary.mjs
+++ b/scripts/agent-bench/steps/summary.mjs
@@ -1,12 +1,12 @@
 // "Render summary": read every bench-result-*/result.json artifact and render a markdown report to
-// $GITHUB_STEP_SUMMARY (Overview colors + Detailed numbers, glossary on top; exec summary/analysis
-// appended later by analyze.mjs). N=1 per cell. Formulas live in ./lib/scoring.mjs. Baseline = most
-// recent main bench (bench/runs/latest-main.json). Headline = mean composite over scored cells;
-// observational unless BENCH_MIN_SCORE gates.
+// $GITHUB_STEP_SUMMARY (ONE results table with a value + colored delta per metric, glossary on top;
+// exec summary/analysis appended later by analyze.mjs). N=1 per cell. Formulas live in ./lib/scoring.mjs.
+// Baseline = most recent main bench (bench/runs/latest-main.json). Headline = mean composite over
+// scored cells; observational unless BENCH_MIN_SCORE gates.
 import { appendFileSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { cellCost, compositeBand, isScoredCell, scorePerDollar, testRate, testStats, verdictOf } from './lib/scoring.mjs';
-import { buildAggregate, cellComposite, deltaBall, diffAgainstBaseline, renderDetailed, renderOverview } from './lib/overview.mjs';
+import { cellCost, isCountedFailKlass, isScoredCell, scorePerDollar, testRate, testStats, verdictOf } from './lib/scoring.mjs';
+import { buildAggregate, cellComposite, diffAgainstBaseline, renderDetailed, renderPreword } from './lib/overview.mjs';
 
 const RESULTS_DIR = process.env.RESULTS_DIR ?? 'results';
 
@@ -34,15 +34,14 @@ const dataCells = cells.filter((c) => !c.error);
 const errorCells = cells.filter((c) => c.error);
 // A cell enters the composite mean iff gradeable AND it produced test results (via isScoredCell).
 const compositeCells = dataCells.filter((c) => isScoredCell(c));
-const judgeScoredCells = dataCells.filter((c) => c.klass !== 'harness_error' && typeof c.judge_score === 'number');
 const harnessErrors = dataCells.filter((c) => c.klass === 'harness_error');
 
 // Judge/test harness errors tracked SEPARATELY so they can't flip a verdict or zero a test_rate.
-// An agent_fail ran neither, so it's excluded from both.
-const testErr = (r) => r.klass !== 'harness_error' && r.klass !== 'agent_fail' && testStats(r).denom === 0;
+// A counted failure (agent_fail / dead_server) ran neither, so it's excluded from both.
+const testErr = (r) => r.klass !== 'harness_error' && !isCountedFailKlass(r.klass) && testStats(r).denom === 0;
 const judgeErr = (r) =>
 	r.klass !== 'harness_error' &&
-	r.klass !== 'agent_fail' &&
+	!isCountedFailKlass(r.klass) &&
 	!testErr(r) &&
 	r.failed_at !== '3-build-test' &&
 	typeof r.judge_score !== 'number';
@@ -88,31 +87,27 @@ const min = Number(minScoreRaw);
 const gateEnabled = minScoreRaw !== '' && Number.isFinite(min);
 let gateFailed = false;
 
-const judgeMean = judgeScoredCells.length
-	? judgeScoredCells.reduce((acc, r) => acc + r.judge_score, 0) / judgeScoredCells.length
-	: null;
+// Builder + judge model ids for the preword's config line (same env the run steps read).
+const builderModel = (process.env.BENCH_MODEL ?? '').trim() || null;
+const judgeModel = (process.env.BENCH_JUDGE_MODEL ?? '').trim() || null;
 
-// Deterministic headline under the Overview heading (the LLM exec summary is separate, from analyze.mjs).
-function headlineLine() {
-	if (compositeCells.length === 0) {
-		if (cells.length > 0 && harnessErrors.length === cells.length) {
-			return `⚠️ All ${cells.length} cell(s) were harness_error — nothing was scored, no composite headline.`;
-		}
-		const g = gateEnabled ? ` (\`BENCH_MIN_SCORE=${min}\` set, but with no scored cells the gate is skipped — conservative.)` : '';
-		return `_No cells produced test results — no composite headline to report._${g}`;
+// Message shown in place of the preword when NO cell produced test results (nothing to average).
+function noScoreMessage() {
+	if (cells.length > 0 && harnessErrors.length === cells.length) {
+		return `- ⚠️ All ${cells.length} cell(s) were harness_error — nothing was scored, no composite headline.`;
 	}
+	const g = gateEnabled ? ` (\`BENCH_MIN_SCORE=${min}\` set, but with no scored cells the gate is skipped — conservative.)` : '';
+	return `- _No cells produced test results — no composite headline to report._${g}`;
+}
+
+// The merge gate over the composite mean (scored cells only). Sets gateFailed; returns a bullet when
+// BENCH_MIN_SCORE is set, else an observational note. Called only when there ARE scored cells.
+function gateLine() {
 	const mean = aggregate.mean_composite;
-	const judgeNote = judgeMean !== null ? ` · judge mean **${judgeMean.toFixed(2)}**/10` : '';
-	// Composite mean delta vs the baseline (🟢/🔴/🟡 over the ±5 band), when present.
-	const deltaNote =
-		diff.hasBaseline && diff.meanDelta !== null
-			? ` · ${deltaBall(diff.meanDelta)} ${diff.meanDelta > 0 ? '+' : ''}${diff.meanDelta.toFixed(1)} vs \`main\``
-			: '';
-	const head = `Mean composite **${mean.toFixed(1)}**/100 ${compositeBand(mean)} across ${compositeCells.length} scored cell(s)${judgeNote}${deltaNote}.`;
-	if (!gateEnabled) return `${head} _Observational — \`BENCH_MIN_SCORE\` unset, so it does not gate the merge._`;
+	if (!gateEnabled) return `_Observational — \`BENCH_MIN_SCORE\` unset, so the mean does not gate the merge._`;
 	const pass = mean >= min;
 	gateFailed = !pass;
-	return `${pass ? '✅' : '❌'} ${head} Threshold **${min}** — ${pass ? 'pass' : 'FAIL'}.`;
+	return `${pass ? '✅' : '❌'} **Gate:** mean composite **${mean.toFixed(1)}** vs threshold **${min}** — ${pass ? 'pass' : 'FAIL'}.`;
 }
 
 // ── Assemble the report ───────────────────────────────────────────────────────
@@ -121,19 +116,21 @@ const md = [];
 // 1) Glossary & notes — collapsed, at the very top.
 const lastRun = (process.env.GITHUB_RUN_STARTED_AT || new Date().toISOString()).replace(/\.\d{3}Z$/, 'Z');
 md.push('<details>');
-md.push('<summary>📖 Glossary &amp; notes — scoring, colors, the ±5% margin (click to expand)</summary>');
+md.push('<summary>📖 Glossary &amp; notes — scoring, colors, per-metric thresholds (click to expand)</summary>');
 md.push('');
 md.push('- **N = 1** — one rep per cell, so a small delta may be model variance, not a real change; re-run for certainty.');
 md.push(
-	'- **Colors (vs baseline, per metric):** 🟢 same-or-better · 🟡 worse but within the margin · 🔴 worse beyond it · 🆕 no comparable baseline value (a new cell, or a baseline that predates this metric) · — nothing to diff this run · 🗑️ cell gone since the baseline.',
+	'- **Colors (change vs baseline, per metric):** 🟢 meaningful improvement · 🟡 change within the noise band · 🔴 meaningful regression · ⚪ no baseline value yet (a new cell, or a metric the baseline predates) — the current value is still shown, tagged `(new)` · — nothing to show this run · 🗑️ cell gone since the baseline. Each cell shows `<color> <value> (<Δ vs main>)` inline.',
+);
+md.push(
+	'- **Columns:** Tests (pass/denom) · Judge (overall score + per-dimension shorthand `F`/`S`/`P`/`C`/`B` = functional / selectors / persistence / code / blocks) · Cost · Turns (agent cycles) · Score · Stop reason. Turns is new — it reads ⚪ `(new)` until a `main` bench records a baseline for it.',
 );
 md.push(
-	'- **Δ vs base (per row):** the cell\'s COMPOSITE change vs the same cell on the baseline — 🟢 improved · 🟡 flat · 🔴 regressed, over the same ±5-point band as the headline delta (wider than the per-metric ±5% margin — it\'s absolute composite points, since N=1 makes a small swing likely noise). 🆕 no baseline cell to diff. The Detailed table also shows the signed number.',
+	'- **Thresholds (per metric, `DELTA_THRESHOLDS` in `overview.mjs`):** composite/score ±5 points · judge (& each dimension) ±0.3 · tests ±1 pass · cost ±10% · turns ±3. A change within the threshold is 🟡 (noise, since N=1); beyond it, 🟢/🔴 by direction. Edit that one map to tune them.',
 );
 md.push(
-	'- **Margin = ±5%** (`MARGIN_PCT` in `overview.mjs`) — relative to the baseline value; for integer metrics (test counts, 0-10 judge dims) it is floored to 1, so a single-point nudge is 🟡, never 🔴. Edit that one constant to widen/narrow it.',
+	'- **Directions:** higher is better for tests, judge (+ dimensions), and score; lower is better for cost and turns.',
 );
-md.push('- **Directions:** tests ↑, judge ↑, score ↑ are better (higher = 🟢); cost ↓, tokens ↓ are better (lower = 🟢).');
 md.push(
 	'- **Composite (0-100)** = `round(60·test_rate + 4·judge·min(1, 4·test_rate), 1)` — 60% objective pass-rate + 40% judge, the judge term gated below a 25% pass-rate.',
 );
@@ -145,45 +142,42 @@ md.push(
 	'- **Baseline** = the most recent `main`-branch bench (`bench/runs/latest-main.json`), NOT the PR base commit — the PR always diffs against the current state of `main`.',
 );
 md.push(
-	'- **Excluded from the mean:** `harness_error` cells (infra failures) and gradeable cells that ran no tests. `agent_fail` (agent produced no app in budget) IS included, as composite 0.',
+	'- **Excluded from the mean:** `harness_error` cells (infra failures) and gradeable cells that ran no tests. `agent_fail` (agent produced no app in budget) and `dead_server` (built app never served / crashed) are BOTH included, as composite 0.',
 );
 if (logsUrl) md.push(`- [Run artifacts — per-cell source + full agent traces](${logsUrl}) · 🕒 Last run: ${lastRun} · run #${runId}`);
 md.push('');
 md.push('</details>');
 md.push('');
 
-// 2) Overview — colors only.
+// 2) Results — one table: current value + colored delta per metric, headline underneath the heading.
 if (cells.length > 0) {
-	let heading = '## Overview — PR vs `main` baseline';
+	let heading = '## Results — PR vs `main` baseline';
 	let note;
-	const legend = '🟢 better/equal · 🟡 worse within ±5% · 🔴 worse beyond · 🆕 new/uncomparable.';
-	const perMetric = diff.perMetricBaseline;
+	const legend = '🟢 improved · 🟡 within noise · 🔴 regressed · ⚪ no baseline yet (value shown, tagged `(new)`).';
 	const baseLabel = baseline?.sha ? `\`${String(baseline.sha).slice(0, 7)}\`` : 'the recorded baseline';
-	// A baseline predating the per-metric (schema-2) aggregate can compare only the composite mean;
-	// per-metric cells show 🆕 until the next main bench records the new schema.
-	const staleNote = `A \`main\` baseline exists (${baseLabel}) but predates the per-metric schema, so per-metric cells show 🆕 — only the composite mean (in the headline) is comparable. Full per-metric coloring returns once a \`main\` bench records the new schema.`;
 	if (benchEvent === 'push') {
 		// A push-to-main run IS the new baseline; diffs against the previous main bench, else absolute.
-		heading = '## Overview — baseline run';
+		heading = '## Results — baseline run';
 		const rec = `Baseline run (push to \`main\`): recorded as the new \`main\` baseline for \`${benchSha.slice(0, 7) || '(unknown)'}\`.`;
-		if (!baseline) note = `${rec} No earlier baseline to diff — absolute values (all 🆕).`;
-		else if (perMetric) note = `${rec} Colored vs the PREVIOUS \`main\` baseline ${baseLabel}. ${legend}`;
-		else note = `${rec} ${staleNote}`;
-	} else if (perMetric) {
-		note = `Each metric colored vs the latest \`main\` baseline ${baseLabel}. ${legend}`;
+		note = baseline
+			? `${rec} Each metric colored vs the PREVIOUS \`main\` baseline ${baseLabel}. ${legend}`
+			: `${rec} No earlier baseline to diff — current values only (every metric ⚪).`;
 	} else if (baseline) {
-		note = staleNote;
+		note = `Each metric shows its current value colored by the change vs the latest \`main\` baseline ${baseLabel}. ${legend}`;
 	} else {
-		note = 'No `main` baseline recorded yet — showing absolute values (every metric 🆕). PR-vs-`main` deltas appear once a `main` bench has stored one.';
+		note = 'No `main` baseline recorded yet — showing current values only (every metric ⚪). Colored deltas vs `main` appear once a `main` bench has stored one.';
 	}
-	md.push(...renderOverview(diff, { heading, note }));
-	// Deterministic headline directly under the Overview.
-	md.push(headlineLine(), '');
-}
-
-// 3) Detailed results — numbers.
-if (cells.length > 0) {
-	md.push(...renderDetailed(diff, { heading: '## Detailed results', note: 'Same rows, colored `baseline -> pr`.' }));
+	md.push(heading, '');
+	md.push(note, '');
+	// Bulleted aggregated summary (preword) directly under the heading, above the table.
+	if (compositeCells.length === 0) {
+		md.push(noScoreMessage(), '');
+	} else {
+		md.push(...renderPreword(diff, aggregate, { builderModel, judgeModel, baselineSha: baseline?.sha }));
+		md.push(`- ${gateLine()}`);
+		md.push('');
+	}
+	md.push(...renderDetailed(diff, {}));
 }
 
 // 4) Compact caveats (deterministic) — excluded / harness / judge-error cells.
diff --git a/tasks/async-word-counter/PROMPT.md b/tasks/async-word-counter/PROMPT.md
index 4b0a5d3dc..7775afef0 100644
--- a/tasks/async-word-counter/PROMPT.md
+++ b/tasks/async-word-counter/PROMPT.md
@@ -11,7 +11,7 @@ The workspace has already been scaffolded. Begin by reading README.md, then do a
 1. A user types text into an input and clicks submit.
 2. Submitting enqueues a background job (do the counting in the job — not inline in the request handler) and immediately adds a row for it whose `data-status` is `"processing"`.
 3. The background job counts the words and stores the result in a key/value block keyed by the job id. **Count by whitespace runs only:** trim the text, then split on any run of whitespace (spaces, tabs) — so `one two three four five` is 5, and `"   a   b  "` (leading/trailing + double spaces) is 2. A naive `split(' ')` that counts empty gaps is wrong.
-   - **Punctuation is part of a word, not a separator:** only whitespace separates words, so `hello,world foo.bar-baz!` is **3** words, not 5.
+   - **Punctuation is part of a word, not a separator:** only whitespace separates words, so `hello,world foo.bar baz` is **3** words, not 5.
    - **Unicode and emoji tokens each count as one word:** `café 日本語 🙂 naïve` is **4** words. Count each maximal run of non-whitespace as one word — do **not** use `\w+` / `\W+`, which miscount punctuation and non-ASCII/emoji characters.
 4. **Polling:** the frontend polls for the result; when it's ready the row's `data-status` becomes `"done"` and the row shows the word count.
 5. **Persistence (including in-flight jobs):** persist each submission to the key/value block **when you enqueue it** (status `"processing"`, keyed by job id) — not only when it finishes. On load, **restore the whole list from the store** (every job, including still-`processing` ones) and resume polling — not just the most recent submission. A row reloaded **while still processing** must reappear and still resolve to `"done"` with its count. (An app that tracks the job list only in client memory loses an in-flight row on reload — that fails.)
diff --git a/tasks/async-word-counter/test.spec.ts b/tasks/async-word-counter/test.spec.ts
index ff72ec551..def374278 100644
--- a/tasks/async-word-counter/test.spec.ts
+++ b/tasks/async-word-counter/test.spec.ts
@@ -8,9 +8,18 @@ const RUN = process.env.RUN_ID || String(Date.now());
 let seq = 0;
 const uniq = (base: string) => `${base}-${RUN}-${++seq}-${Date.now()}`;
 
-// Per-test no-error gate: ONLY uncaught page errors.
+// Per-test no-error gate: uncaught page errors and genuine console errors.
 function watchErrors(page: Page, sink: string[] = []): string[] {
 	page.on('pageerror', (err) => sink.push(String(err)));
+	page.on('console', (msg) => {
+		if (msg.type() !== 'error') return;
+		const text = msg.text();
+		// Exclude benign browser-generated noise (not an app JS fault): failed resource loads / HTTP
+		// status errors (favicon, pre-auth 4xx, JSON-RPC-over-HTTP), WebSocket lifecycle, and dev-mode
+		// "Warning:" logs. A genuine console error still fails the gate, asserted empty end-of-test.
+		if (/Failed to load resource|net::ERR|favicon|WebSocket|^\s*Warning:/i.test(text)) return;
+		sink.push(`console.error: ${text}`);
+	});
 	return sink;
 }
 
@@ -37,8 +46,11 @@ test.describe('async-word-counter', () => {
 		await expect(page.getByTestId('wc-input')).toBeVisible();
 		await expect(page.getByTestId('wc-submit')).toBeVisible();
 		// Enforce the wc-list container contract (in the PROMPT selector table)
-		// so an impl can't omit the list wrapper and still pass.
-		await expect(page.getByTestId('wc-list')).toBeVisible();
+		// so an impl can't omit the list wrapper and still pass. Use toBeAttached
+		// (not toBeVisible): an empty list container legitimately has zero layout
+		// height, so toBeVisible() would fail a correct app, while toBeAttached
+		// still enforces that the wrapper exists.
+		await expect(page.getByTestId('wc-list')).toBeAttached();
 
 		expect(errors, `page errors: ${errors.join(' | ')}`).toEqual([]);
 	});
diff --git a/tasks/auth-notes/test.spec.ts b/tasks/auth-notes/test.spec.ts
index 4b8dd66d1..b0e9e470e 100644
--- a/tasks/auth-notes/test.spec.ts
+++ b/tasks/auth-notes/test.spec.ts
@@ -11,11 +11,20 @@ const RUN = process.env.RUN_ID || String(Date.now());
 let seq = 0;
 const uniq = (base: string) => `${base}-${RUN}-${++seq}-${Date.now()}`;
 
-// Per-test no-error gate: collect ONLY uncaught page errors. Console warnings
+// Per-test no-error gate: collect uncaught page errors and genuine console errors. Console warnings
 // and 4xx/5xx responses are intentionally NOT failures — the local dev server
 // returns HTTP 200 for JSON-RPC errors and 4xx pre-auth, which are expected.
 function watchErrors(page: Page, sink: string[] = []): string[] {
 	page.on('pageerror', (err) => sink.push(String(err)));
+	page.on('console', (msg) => {
+		if (msg.type() !== 'error') return;
+		const text = msg.text();
+		// Exclude benign browser-generated noise (not an app JS fault): failed resource loads / HTTP
+		// status errors (favicon, pre-auth 4xx, JSON-RPC-over-HTTP), WebSocket lifecycle, and dev-mode
+		// "Warning:" logs. A genuine console error still fails the gate, asserted empty end-of-test.
+		if (/Failed to load resource|net::ERR|favicon|WebSocket|^\s*Warning:/i.test(text)) return;
+		sink.push(`console.error: ${text}`);
+	});
 	return sink;
 }
 
diff --git a/tasks/cognito-profile/test.spec.ts b/tasks/cognito-profile/test.spec.ts
index b8b896844..53d3a31df 100644
--- a/tasks/cognito-profile/test.spec.ts
+++ b/tasks/cognito-profile/test.spec.ts
@@ -7,11 +7,20 @@ const RUN = process.env.RUN_ID || String(Date.now());
 let seq = 0;
 const uniq = (base: string) => `${base}-${RUN}-${++seq}-${Date.now()}`;
 
-// Per-test no-error gate: ONLY uncaught page errors. The local dev server
+// Per-test no-error gate: uncaught page errors and genuine console errors. The local dev server
 // returns HTTP 200 for JSON-RPC errors, so legitimate pre-auth errors never
 // trip the gate.
 function watchErrors(page: Page, sink: string[] = []): string[] {
 	page.on('pageerror', (err) => sink.push(String(err)));
+	page.on('console', (msg) => {
+		if (msg.type() !== 'error') return;
+		const text = msg.text();
+		// Exclude benign browser-generated noise (not an app JS fault): failed resource loads / HTTP
+		// status errors (favicon, pre-auth 4xx, JSON-RPC-over-HTTP), WebSocket lifecycle, and dev-mode
+		// "Warning:" logs. A genuine console error still fails the gate, asserted empty end-of-test.
+		if (/Failed to load resource|net::ERR|favicon|WebSocket|^\s*Warning:/i.test(text)) return;
+		sink.push(`console.error: ${text}`);
+	});
 	return sink;
 }
 
diff --git a/tasks/collab-presence-board/test.spec.ts b/tasks/collab-presence-board/test.spec.ts
index d2e349abe..2cedf8811 100644
--- a/tasks/collab-presence-board/test.spec.ts
+++ b/tasks/collab-presence-board/test.spec.ts
@@ -7,9 +7,18 @@ const RUN = process.env.RUN_ID || String(Date.now());
 let seq = 0;
 const uniq = (base: string) => `${base}-${RUN}-${++seq}-${Date.now()}`;
 
-// Per-test no-error gate: ONLY uncaught page errors.
+// Per-test no-error gate: uncaught page errors and genuine console errors.
 function watchErrors(page: Page, sink: string[] = []): string[] {
 	page.on('pageerror', (err) => sink.push(String(err)));
+	page.on('console', (msg) => {
+		if (msg.type() !== 'error') return;
+		const text = msg.text();
+		// Exclude benign browser-generated noise (not an app JS fault): failed resource loads / HTTP
+		// status errors (favicon, pre-auth 4xx, JSON-RPC-over-HTTP), WebSocket lifecycle, and dev-mode
+		// "Warning:" logs. A genuine console error still fails the gate, asserted empty end-of-test.
+		if (/Failed to load resource|net::ERR|favicon|WebSocket|^\s*Warning:/i.test(text)) return;
+		sink.push(`console.error: ${text}`);
+	});
 	return sink;
 }
 
diff --git a/tasks/email-digest/PROMPT.md b/tasks/email-digest/PROMPT.md
index e89818fbf..983c9bc62 100644
--- a/tasks/email-digest/PROMPT.md
+++ b/tasks/email-digest/PROMPT.md
@@ -4,7 +4,7 @@ Build a scheduled email-digest feature in this AWS Blocks app. A recurring job i
 
 ## Setup (do this first)
 
-The workspace has already been scaffolded. Begin by reading README.md, then do all your edits in this workspace.
+The workspace has already been scaffolded. Begin by reading README.md, then do all your edits in this workspace. Remove any starter/scaffold demo code and UI you don't need for this task, so the workspace stays scoped to the digest feature.
 
 ## Requirements
 
diff --git a/tasks/email-digest/test.spec.ts b/tasks/email-digest/test.spec.ts
index 1d102481e..096a91601 100644
--- a/tasks/email-digest/test.spec.ts
+++ b/tasks/email-digest/test.spec.ts
@@ -7,9 +7,18 @@ const RUN = process.env.RUN_ID || String(Date.now());
 let seq = 0;
 const uniq = (base: string) => `${base}-${RUN}-${++seq}-${Date.now()}`;
 
-// Per-test no-error gate: ONLY uncaught page errors.
+// Per-test no-error gate: uncaught page errors and genuine console errors.
 function watchErrors(page: Page, sink: string[] = []): string[] {
 	page.on('pageerror', (err) => sink.push(String(err)));
+	page.on('console', (msg) => {
+		if (msg.type() !== 'error') return;
+		const text = msg.text();
+		// Exclude benign browser-generated noise (not an app JS fault): failed resource loads / HTTP
+		// status errors (favicon, pre-auth 4xx, JSON-RPC-over-HTTP), WebSocket lifecycle, and dev-mode
+		// "Warning:" logs. A genuine console error still fails the gate, asserted empty end-of-test.
+		if (/Failed to load resource|net::ERR|favicon|WebSocket|^\s*Warning:/i.test(text)) return;
+		sink.push(`console.error: ${text}`);
+	});
 	return sink;
 }
 
diff --git a/tasks/file-gallery/test.spec.ts b/tasks/file-gallery/test.spec.ts
index aea9dd2bf..b18389da1 100644
--- a/tasks/file-gallery/test.spec.ts
+++ b/tasks/file-gallery/test.spec.ts
@@ -7,10 +7,19 @@ const RUN = process.env.RUN_ID || String(Date.now());
 let seq = 0;
 const uniq = (base: string) => `${base}-${RUN}-${++seq}-${Date.now()}`;
 
-// Per-test no-error gate: ONLY uncaught page errors (not console warnings, not
+// Per-test no-error gate: uncaught page errors and genuine console errors (not console warnings, not
 // 4xx/5xx responses).
 function watchErrors(page: Page, sink: string[] = []): string[] {
 	page.on('pageerror', (err) => sink.push(String(err)));
+	page.on('console', (msg) => {
+		if (msg.type() !== 'error') return;
+		const text = msg.text();
+		// Exclude benign browser-generated noise (not an app JS fault): failed resource loads / HTTP
+		// status errors (favicon, pre-auth 4xx, JSON-RPC-over-HTTP), WebSocket lifecycle, and dev-mode
+		// "Warning:" logs. A genuine console error still fails the gate, asserted empty end-of-test.
+		if (/Failed to load resource|net::ERR|favicon|WebSocket|^\s*Warning:/i.test(text)) return;
+		sink.push(`console.error: ${text}`);
+	});
 	return sink;
 }
 
diff --git a/tasks/kb-chat-agent/test.spec.ts b/tasks/kb-chat-agent/test.spec.ts
index c614a44ea..0bb3efdbb 100644
--- a/tasks/kb-chat-agent/test.spec.ts
+++ b/tasks/kb-chat-agent/test.spec.ts
@@ -14,10 +14,19 @@ const RUN = process.env.RUN_ID || String(Date.now());
 let seq = 0;
 const uniq = (base: string) => `${base}-${RUN}-${++seq}-${Date.now()}`;
 
-// Per-test no-error gate: ONLY uncaught page errors. JSON-RPC error envelopes
+// Per-test no-error gate: uncaught page errors and genuine console errors. JSON-RPC error envelopes
 // come back as HTTP 200, so they are intentionally not treated as failures.
 function watchErrors(page: Page, sink: string[] = []): string[] {
 	page.on('pageerror', (err) => sink.push(String(err)));
+	page.on('console', (msg) => {
+		if (msg.type() !== 'error') return;
+		const text = msg.text();
+		// Exclude benign browser-generated noise (not an app JS fault): failed resource loads / HTTP
+		// status errors (favicon, pre-auth 4xx, JSON-RPC-over-HTTP), WebSocket lifecycle, and dev-mode
+		// "Warning:" logs. A genuine console error still fails the gate, asserted empty end-of-test.
+		if (/Failed to load resource|net::ERR|favicon|WebSocket|^\s*Warning:/i.test(text)) return;
+		sink.push(`console.error: ${text}`);
+	});
 	return sink;
 }
 
diff --git a/tasks/observability-api/test.spec.ts b/tasks/observability-api/test.spec.ts
index c07990beb..6345bf950 100644
--- a/tasks/observability-api/test.spec.ts
+++ b/tasks/observability-api/test.spec.ts
@@ -11,9 +11,18 @@ const RUN = process.env.RUN_ID || String(Date.now());
 let seq = 0;
 const uniq = (base: string) => `${base}-${RUN}-${++seq}-${Date.now()}`;
 
-// Per-test no-error gate: ONLY uncaught page errors.
+// Per-test no-error gate: uncaught page errors and genuine console errors.
 function watchErrors(page: Page, sink: string[] = []): string[] {
 	page.on('pageerror', (err) => sink.push(String(err)));
+	page.on('console', (msg) => {
+		if (msg.type() !== 'error') return;
+		const text = msg.text();
+		// Exclude benign browser-generated noise (not an app JS fault): failed resource loads / HTTP
+		// status errors (favicon, pre-auth 4xx, JSON-RPC-over-HTTP), WebSocket lifecycle, and dev-mode
+		// "Warning:" logs. A genuine console error still fails the gate, asserted empty end-of-test.
+		if (/Failed to load resource|net::ERR|favicon|WebSocket|^\s*Warning:/i.test(text)) return;
+		sink.push(`console.error: ${text}`);
+	});
 	return sink;
 }
 
@@ -243,6 +252,24 @@ test.describe('observability-api', () => {
 		expect(b2.result ?? null).toBeNull();
 	});
 
+	test('api.echo round-trips falsy-but-present arguments (0, false, null, "") — no truthiness footgun', async ({ request }) => {
+		// A supplied argument that is FALSY is still present: only an absent/empty params list is
+		// "missing" (covered above). An impl that detects "missing" via truthiness (`if (!arg)`)
+		// wrongly rejects these — echo must key off arity (params.length), not the value's truthiness.
+		const falsy: Array<number | boolean | null | string> = [0, false, null, ''];
+		let id = 530;
+		for (const v of falsy) {
+			const res = await request.post(`${BASE}/aws-blocks/api`, {
+				headers: { 'Content-Type': 'application/json' },
+				data: { jsonrpc: '2.0', method: 'api.echo', params: [v], id: id++ },
+			});
+			expect(res.ok(), `HTTP ${res.status()} from api.echo(${JSON.stringify(v)})`).toBe(true);
+			const body = await res.json();
+			expect(body.error, `echo(${JSON.stringify(v)}) must not error: ${JSON.stringify(body.error)}`).toBeFalsy();
+			expect(body.result, `echo(${JSON.stringify(v)}) result`).toEqual({ echo: v });
+		}
+	});
+
 	test('a malformed (array/batch) request returns an InvalidRequest error envelope, not a 5xx', async ({ request }) => {
 		// The framework does not support batch; an array body is an Invalid
 		// Request. The contract is a clean JSON-RPC error envelope, never a crash.
diff --git a/tasks/oidc-dsql-notes/test.spec.ts b/tasks/oidc-dsql-notes/test.spec.ts
index 287eb0730..a65efbd06 100644
--- a/tasks/oidc-dsql-notes/test.spec.ts
+++ b/tasks/oidc-dsql-notes/test.spec.ts
@@ -8,10 +8,19 @@ const RUN = process.env.RUN_ID || String(Date.now());
 let seq = 0;
 const uniq = (base: string) => `${base}-${RUN}-${++seq}-${Date.now()}`;
 
-// Per-test no-error gate: ONLY uncaught page errors (persists across the
+// Per-test no-error gate: uncaught page errors and genuine console errors (persists across the
 // sign-in redirect navigations).
 function watchErrors(page: Page, sink: string[] = []): string[] {
 	page.on('pageerror', (err) => sink.push(String(err)));
+	page.on('console', (msg) => {
+		if (msg.type() !== 'error') return;
+		const text = msg.text();
+		// Exclude benign browser-generated noise (not an app JS fault): failed resource loads / HTTP
+		// status errors (favicon, pre-auth 4xx, JSON-RPC-over-HTTP), WebSocket lifecycle, and dev-mode
+		// "Warning:" logs. A genuine console error still fails the gate, asserted empty end-of-test.
+		if (/Failed to load resource|net::ERR|favicon|WebSocket|^\s*Warning:/i.test(text)) return;
+		sink.push(`console.error: ${text}`);
+	});
 	return sink;
 }
 
@@ -271,4 +280,25 @@ test.describe('oidc-dsql-notes', () => {
 
 		expect(errors, `page errors: ${errors.join(' | ')}`).toEqual([]);
 	});
+
+	test('unauthenticated JSON-RPC note access is refused (no session → no note data)', async ({ request }) => {
+		// No session cookie. Notes are OIDC-gated and per-user, so an unauthenticated list/add must
+		// NOT return note data. Method names aren't fixed by the contract (they're the agent's choice),
+		// so an unknown method also yields a JSON-RPC error envelope — this probe never spuriously
+		// fails; it only fails an impl that actually serves or mutates notes with no session.
+		for (const method of ['api.listNotes', 'api.addNote']) {
+			const res = await request.post(`${BASE}/aws-blocks/api`, {
+				headers: { 'Content-Type': 'application/json' },
+				data: { jsonrpc: '2.0', method, params: method === 'api.addNote' ? [`unauth-probe-${RUN}`] : [], id: 41 },
+			});
+			expect(res.status(), `unexpected HTTP ${res.status()} from ${method}`).toBeLessThan(500);
+			const body = await res.json().catch(() => null);
+			// A non-JSON response (e.g. an auth redirect to the sign-in page) is itself a refusal: it
+			// carried no note data. Only a JSON body is held to the error-envelope contract.
+			if (body && typeof body === 'object') {
+				expect(body.error, `${method} with no session must yield a JSON-RPC error envelope`).toBeTruthy();
+				expect(body.result ?? null, `${method} must not return note data unauthenticated`).toBeNull();
+			}
+		}
+	});
 });
diff --git a/tasks/sql-kb-catalog/test.spec.ts b/tasks/sql-kb-catalog/test.spec.ts
index 1ae8d283d..a3be20ae4 100644
--- a/tasks/sql-kb-catalog/test.spec.ts
+++ b/tasks/sql-kb-catalog/test.spec.ts
@@ -7,9 +7,18 @@ const RUN = process.env.RUN_ID || String(Date.now());
 let seq = 0;
 const uniq = (base: string) => `${base}-${RUN}-${++seq}-${Date.now()}`;
 
-// Per-test no-error gate: ONLY uncaught page errors.
+// Per-test no-error gate: uncaught page errors and genuine console errors.
 function watchErrors(page: Page, sink: string[] = []): string[] {
 	page.on('pageerror', (err) => sink.push(String(err)));
+	page.on('console', (msg) => {
+		if (msg.type() !== 'error') return;
+		const text = msg.text();
+		// Exclude benign browser-generated noise (not an app JS fault): failed resource loads / HTTP
+		// status errors (favicon, pre-auth 4xx, JSON-RPC-over-HTTP), WebSocket lifecycle, and dev-mode
+		// "Warning:" logs. A genuine console error still fails the gate, asserted empty end-of-test.
+		if (/Failed to load resource|net::ERR|favicon|WebSocket|^\s*Warning:/i.test(text)) return;
+		sink.push(`console.error: ${text}`);
+	});
 	return sink;
 }
 
@@ -88,6 +97,7 @@ test.describe('sql-kb-catalog', () => {
 		await expect(page.getByTestId('kb-result')).toHaveCount(0);
 		await searchFaq(page, 'return refund policy');
 		await expect(page.getByTestId('kb-result').first()).toBeVisible({ timeout: T });
+		await expect(page.getByTestId('kb-result').first()).toContainText(/refund/i, { timeout: T });
 
 		expect(errors, `page errors: ${errors.join(' | ')}`).toEqual([]);
 	});
@@ -99,6 +109,7 @@ test.describe('sql-kb-catalog', () => {
 		await expect(page.getByTestId('kb-result')).toHaveCount(0);
 		await searchFaq(page, 'refund');
 		await expect(page.getByTestId('kb-result').first()).toBeVisible({ timeout: T });
+		await expect(page.getByTestId('kb-result').first()).toContainText(/refund/i, { timeout: T });
 
 		expect(errors, `page errors: ${errors.join(' | ')}`).toEqual([]);
 	});